diff --git a/jeecg-boot-base-core/src/main/java/org/jeecg/common/exception/JeecgBootExceptionHandler.java b/jeecg-boot-base-core/src/main/java/org/jeecg/common/exception/JeecgBootExceptionHandler.java index 6d5d8ef7..82e19cf9 100644 --- a/jeecg-boot-base-core/src/main/java/org/jeecg/common/exception/JeecgBootExceptionHandler.java +++ b/jeecg-boot-base-core/src/main/java/org/jeecg/common/exception/JeecgBootExceptionHandler.java @@ -1,6 +1,7 @@ package org.jeecg.common.exception; import cn.hutool.core.util.ObjectUtil; +import lombok.extern.slf4j.Slf4j; import org.apache.shiro.authz.AuthorizationException; import org.apache.shiro.authz.UnauthorizedException; import org.jeecg.common.api.vo.Result; @@ -16,8 +17,6 @@ import org.springframework.web.bind.annotation.RestControllerAdvice; import org.springframework.web.multipart.MaxUploadSizeExceededException; import org.springframework.web.servlet.NoHandlerFoundException; -import lombok.extern.slf4j.Slf4j; - /** * 异常处理器 * @@ -133,4 +132,24 @@ public class JeecgBootExceptionHandler { return Result.error("Redis 连接异常!"); } + + /** + * SQL注入风险，全局异常处理 + * + * @param exception + * @return + */ + @ExceptionHandler(JeecgSqlInjectionException.class) + public Result handleSQLException(Exception exception) { + String msg = exception.getMessage().toLowerCase(); + final String extractvalue = "extractvalue"; + final String updatexml = "updatexml"; + boolean hasSensitiveInformation = msg.indexOf(extractvalue) >= 0 || msg.indexOf(updatexml) >= 0; + if (msg != null && hasSensitiveInformation) { + log.error("校验失败，存在SQL注入风险！{}", msg); + return Result.error("校验失败，存在SQL注入风险！"); + } + return Result.error("校验失败，存在SQL注入风险！" + msg); + } + } diff --git a/jeecg-boot-base-core/src/main/java/org/jeecg/common/exception/JeecgSqlInjectionException.java b/jeecg-boot-base-core/src/main/java/org/jeecg/common/exception/JeecgSqlInjectionException.java new file mode 100644 index 00000000..db9a2875 --- /dev/null +++ b/jeecg-boot-base-core/src/main/java/org/jeecg/common/exception/JeecgSqlInjectionException.java @@ -0,0 +1,23 @@ +package org.jeecg.common.exception; + +/** + * @Description: jeecg-boot自定义SQL注入异常 + * @author: jeecg-boot + */ +public class JeecgSqlInjectionException extends RuntimeException { + private static final long serialVersionUID = 1L; + + public JeecgSqlInjectionException(String message){ + super(message); + } + + public JeecgSqlInjectionException(Throwable cause) + { + super(cause); + } + + public JeecgSqlInjectionException(String message, Throwable cause) + { + super(message,cause); + } +} diff --git a/jeecg-boot-base-core/src/main/java/org/jeecg/common/util/SqlInjectionUtil.java b/jeecg-boot-base-core/src/main/java/org/jeecg/common/util/SqlInjectionUtil.java index 9d84762b..7525e820 100644 --- a/jeecg-boot-base-core/src/main/java/org/jeecg/common/util/SqlInjectionUtil.java +++ b/jeecg-boot-base-core/src/main/java/org/jeecg/common/util/SqlInjectionUtil.java @@ -2,7 +2,10 @@ package org.jeecg.common.util; import cn.hutool.crypto.SecureUtil; import lombok.extern.slf4j.Slf4j; +import org.jeecg.common.constant.SymbolConstant; import org.jeecg.common.exception.JeecgBootException; +import org.jeecg.common.exception.JeecgSqlInjectionException; + import javax.servlet.http.HttpServletRequest; import java.lang.reflect.Field; import java.util.Set; @@ -47,7 +50,7 @@ public class SqlInjectionUtil { * @param request: * @Return: void */ - public static void checkDictTableSign(String dictCode, String sign, HttpServletRequest request) { + private static void checkDictTableSign(String dictCode, String sign, HttpServletRequest request) { //表字典SQL注入漏洞,签名校验 String accessToken = request.getHeader("X-Access-Token"); String signStr = dictCode + SqlInjectionUtil.TABLE_DICT_SIGN_SALT + accessToken; @@ -60,11 +63,72 @@ public class SqlInjectionUtil { } /** + * 返回查询表名 + *

* sql注入过滤处理，遇到注入关键字抛异常 - * @param value + * + * @param table */ - public static void filterContent(String value) { - filterContent(value, null); + private static Pattern tableNamePattern = Pattern.compile("^[a-zA-Z][a-zA-Z0-9_]{0,63}$"); + public static String getSqlInjectTableName(String table) { + table = table.trim(); + /** + * 检验表名是否合法 + * + * 表名只能由字母、数字和下划线组成。 + * 表名必须以字母开头。 + * 表名长度通常有限制，例如最多为 64 个字符。 + */ + boolean isValidTableName = tableNamePattern.matcher(table).matches(); + if (!isValidTableName) { + String errorMsg = "表名不合法，存在SQL注入风险!--->" + table; + log.error(errorMsg); + throw new JeecgSqlInjectionException(errorMsg); + } + + //进一步验证是否存在SQL注入风险 + filterContent(table); + return table; + } + + + /** + * 返回查询字段 + *

+ * sql注入过滤处理，遇到注入关键字抛异常 + * + * @param field + */ + static final Pattern fieldPattern = Pattern.compile("^[a-zA-Z0-9_]+$"); + public static String getSqlInjectField(String field) { + field = field.trim(); + + if (field.contains(SymbolConstant.COMMA)) { + return getSqlInjectField(field.split(SymbolConstant.COMMA)); + } + + /** + * 校验表字段是否有效 + * + * 字段定义只能是是字母 数字 下划线的组合（不允许有空格、转义字符串等） + */ + boolean isValidField = fieldPattern.matcher(field).matches(); + if (!isValidField) { + String errorMsg = "字段不合法，存在SQL注入风险!--->" + field; + log.error(errorMsg); + throw new JeecgSqlInjectionException(errorMsg); + } + + //进一步验证是否存在SQL注入风险 + filterContent(field); + return field; + } + + public static String getSqlInjectField(String... fields) { + for (String s : fields) { + getSqlInjectField(s); + } + return String.join(SymbolConstant.COMMA, fields); } /** @@ -89,7 +153,7 @@ public class SqlInjectionUtil { if (value.indexOf(xssArr[i]) > -1) { log.error("请注意，存在SQL注入关键词---> {}", xssArr[i]); log.error("请注意，值可能存在SQL注入风险!---> {}", value); - throw new RuntimeException("请注意，值可能存在SQL注入风险!--->" + value); + throw new JeecgSqlInjectionException("请注意，值可能存在SQL注入风险!--->" + value); } } //update-begin-author:taoyan date:2022-7-13 for: 除了XSS_STR这些提前设置好的，还需要额外的校验比如 单引号 @@ -99,13 +163,13 @@ public class SqlInjectionUtil { if (value.indexOf(xssArr2[i]) > -1) { log.error("请注意，存在SQL注入关键词---> {}", xssArr2[i]); log.error("请注意，值可能存在SQL注入风险!---> {}", value); - throw new RuntimeException("请注意，值可能存在SQL注入风险!--->" + value); + throw new JeecgSqlInjectionException("请注意，值可能存在SQL注入风险!--->" + value); } } } //update-end-author:taoyan date:2022-7-13 for: 除了XSS_STR这些提前设置好的，还需要额外的校验比如 单引号 if(Pattern.matches(SHOW_TABLES, value) || Pattern.matches(REGULAR_EXPRE_USER, value)){ - throw new RuntimeException("请注意，值可能存在SQL注入风险!--->" + value); + throw new JeecgSqlInjectionException("请注意，值可能存在SQL注入风险!--->" + value); } return; } @@ -114,7 +178,7 @@ public class SqlInjectionUtil { * sql注入过滤处理，遇到注入关键字抛异常 * @param values */ - public static void filterContent(String[] values) { + public static void filterContent(String... values) { filterContent(values, null); } @@ -141,7 +205,7 @@ public class SqlInjectionUtil { if (value.indexOf(xssArr[i]) > -1) { log.error("请注意，存在SQL注入关键词---> {}", xssArr[i]); log.error("请注意，值可能存在SQL注入风险!---> {}", value); - throw new RuntimeException("请注意，值可能存在SQL注入风险!--->" + value); + throw new JeecgSqlInjectionException("请注意，值可能存在SQL注入风险!--->" + value); } } //update-begin-author:taoyan date:2022-7-13 for: 除了XSS_STR这些提前设置好的，还需要额外的校验比如 单引号 @@ -151,13 +215,13 @@ public class SqlInjectionUtil { if (value.indexOf(xssArr2[i]) > -1) { log.error("请注意，存在SQL注入关键词---> {}", xssArr2[i]); log.error("请注意，值可能存在SQL注入风险!---> {}", value); - throw new RuntimeException("请注意，值可能存在SQL注入风险!--->" + value); + throw new JeecgSqlInjectionException("请注意，值可能存在SQL注入风险!--->" + value); } } } //update-end-author:taoyan date:2022-7-13 for: 除了XSS_STR这些提前设置好的，还需要额外的校验比如 单引号 if(Pattern.matches(SHOW_TABLES, value) || Pattern.matches(REGULAR_EXPRE_USER, value)){ - throw new RuntimeException("请注意，值可能存在SQL注入风险!--->" + value); + throw new JeecgSqlInjectionException("请注意，值可能存在SQL注入风险!--->" + value); } } return; @@ -188,11 +252,11 @@ public class SqlInjectionUtil { if (value.indexOf(xssArr[i]) > -1 || value.startsWith(xssArr[i].trim())) { log.error("请注意，存在SQL注入关键词---> {}", xssArr[i]); log.error("请注意，值可能存在SQL注入风险!---> {}", value); - throw new RuntimeException("请注意，值可能存在SQL注入风险!--->" + value); + throw new JeecgSqlInjectionException("请注意，值可能存在SQL注入风险!--->" + value); } } if(Pattern.matches(SHOW_TABLES, value) || Pattern.matches(REGULAR_EXPRE_USER, value)){ - throw new RuntimeException("请注意，值可能存在SQL注入风险!--->" + value); + throw new JeecgSqlInjectionException("请注意，值可能存在SQL注入风险!--->" + value); } return; } @@ -222,12 +286,12 @@ public class SqlInjectionUtil { if (value.indexOf(xssArr[i]) > -1 || value.startsWith(xssArr[i].trim())) { log.error("请注意，存在SQL注入关键词---> {}", xssArr[i]); log.error("请注意，值可能存在SQL注入风险!---> {}", value); - throw new RuntimeException("请注意，值可能存在SQL注入风险!--->" + value); + throw new JeecgSqlInjectionException("请注意，值可能存在SQL注入风险!--->" + value); } } if(Pattern.matches(SHOW_TABLES, value) || Pattern.matches(REGULAR_EXPRE_USER, value)){ - throw new RuntimeException("请注意，值可能存在SQL注入风险!--->" + value); + throw new JeecgSqlInjectionException("请注意，值可能存在SQL注入风险!--->" + value); } return; } @@ -285,7 +349,7 @@ public class SqlInjectionUtil { if(matcher.find()){ String error = "请注意，值可能存在SQL注入风险---> \\*.*\\"; log.error(error); - throw new RuntimeException(error); + throw new JeecgSqlInjectionException(error); } // issues/4737 sys/duplicate/check SQL注入 #4737 @@ -293,7 +357,7 @@ public class SqlInjectionUtil { if(sleepMatcher.find()){ String error = "请注意，值可能存在SQL注入风险---> sleep"; log.error(error); - throw new RuntimeException(error); + throw new JeecgSqlInjectionException(error); } } } diff --git a/jeecg-boot-base-core/src/main/java/org/jeecg/common/util/security/AbstractQueryBlackListHandler.java b/jeecg-boot-base-core/src/main/java/org/jeecg/common/util/security/AbstractQueryBlackListHandler.java index dd0141c0..8b7e5e26 100644 --- a/jeecg-boot-base-core/src/main/java/org/jeecg/common/util/security/AbstractQueryBlackListHandler.java +++ b/jeecg-boot-base-core/src/main/java/org/jeecg/common/util/security/AbstractQueryBlackListHandler.java @@ -2,6 +2,7 @@ package org.jeecg.common.util.security; import lombok.extern.slf4j.Slf4j; import org.apache.commons.lang.StringUtils; +import org.jeecg.common.exception.JeecgSqlInjectionException; import java.util.*; import java.util.regex.Matcher; @@ -81,6 +82,12 @@ public abstract class AbstractQueryBlackListHandler { } } + + // 返回黑名单校验结果（不合法直接抛出异常） + if(!flag){ + log.error(this.getError()); + throw new JeecgSqlInjectionException(this.getError()); + } return flag; } diff --git a/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/DuplicateCheckController.java b/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/DuplicateCheckController.java index c6dc9a37..7eb44d92 100644 --- a/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/DuplicateCheckController.java +++ b/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/DuplicateCheckController.java @@ -1,24 +1,18 @@ package org.jeecg.modules.system.controller; -import javax.servlet.http.HttpServletRequest; - -import org.apache.commons.lang.StringUtils; -import org.jeecg.common.api.vo.Result; -import org.jeecg.common.constant.SymbolConstant; -import org.jeecg.common.util.SqlInjectionUtil; -import org.jeecg.modules.system.mapper.SysDictMapper; -import org.jeecg.modules.system.model.DuplicateCheckVo; -import org.jeecg.modules.system.security.DictQueryBlackListHandler; -import org.mybatis.spring.MyBatisSystemException; -import org.springframework.beans.factory.annotation.Autowired; -import org.springframework.web.bind.annotation.ExceptionHandler; -import org.springframework.web.bind.annotation.RequestMapping; -import org.springframework.web.bind.annotation.RequestMethod; -import org.springframework.web.bind.annotation.RestController; - import io.swagger.annotations.Api; import io.swagger.annotations.ApiOperation; import lombok.extern.slf4j.Slf4j; +import org.apache.commons.lang.StringUtils; +import org.jeecg.common.api.vo.Result; +import org.jeecg.modules.system.model.DuplicateCheckVo; +import org.jeecg.modules.system.service.ISysDictService; +import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.web.bind.annotation.RequestMapping; +import org.springframework.web.bind.annotation.RequestMethod; +import org.springframework.web.bind.annotation.RestController; + +import javax.servlet.http.HttpServletRequest; /** * @Title: DuplicateCheckAction @@ -34,10 +28,7 @@ import lombok.extern.slf4j.Slf4j; public class DuplicateCheckController { @Autowired - SysDictMapper sysDictMapper; - - @Autowired - DictQueryBlackListHandler dictQueryBlackListHandler; + ISysDictService sysDictService; /** * 校验数据是否在系统中是否存在 @@ -47,14 +38,9 @@ public class DuplicateCheckController { @RequestMapping(value = "/check", method = RequestMethod.GET) @ApiOperation("重复校验接口") public Result doDuplicateCheck(DuplicateCheckVo duplicateCheckVo, HttpServletRequest request) { - Long num = null; - log.debug("----duplicate check------："+ duplicateCheckVo.toString()); - //关联表字典（举例：sys_user,realname,id） - //SQL注入校验（只限制非法串改数据库） - final String[] sqlInjCheck = {duplicateCheckVo.getTableName(),duplicateCheckVo.getFieldName()}; - SqlInjectionUtil.filterContent(sqlInjCheck); - // update-begin-author:taoyan date:20211227 for: JTC-25 【online报表】oracle 操作问题 录入弹框啥都不填直接保存 ①编码不是应该提示必填么？②报错也应该是具体文字提示，不是后台错误日志 + + // 1.填值为空，直接返回 if(StringUtils.isEmpty(duplicateCheckVo.getFieldVal())){ Result rs = new Result(); rs.setCode(500); @@ -62,31 +48,9 @@ public class DuplicateCheckController { rs.setMessage("数据为空,不作处理！"); return rs; } - //update-begin-author:taoyan date:20220329 for: VUEN-223【安全漏洞】当前被攻击的接口 - String checkSql = duplicateCheckVo.getTableName() + SymbolConstant.COMMA + duplicateCheckVo.getFieldName() + SymbolConstant.COMMA; - if(!dictQueryBlackListHandler.isPass(checkSql)){ - return Result.error(dictQueryBlackListHandler.getError()); - } - //update-end-author:taoyan date:20220329 for: VUEN-223【安全漏洞】当前被攻击的接口 - // update-end-author:taoyan date:20211227 for: JTC-25 【online报表】oracle 操作问题 录入弹框啥都不填直接保存 ①编码不是应该提示必填么？②报错也应该是具体文字提示，不是后台错误日志 - - // update-begin-author:liusq date:20230721 for: [issues/5134] duplicate/check Sql泄露问题 - try{ - if (StringUtils.isNotBlank(duplicateCheckVo.getDataId())) { - // [2].编辑页面校验 - num = sysDictMapper.duplicateCheckCountSql(duplicateCheckVo); - } else { - // [1].添加页面校验 - num = sysDictMapper.duplicateCheckCountSqlNoDataId(duplicateCheckVo); - } - }catch(MyBatisSystemException e){ - log.error(e.getMessage(), e); - String errorCause = "查询异常,请检查唯一校验的配置！"; - return Result.error(errorCause); - } - // update-end-author:liusq date:20230721 for: [issues/5134] duplicate/check Sql泄露问题 - - if (num == null || num == 0) { + + // 2.返回结果 + if (sysDictService.duplicateCheckData(duplicateCheckVo)) { // 该值可用 return Result.ok("该值可用！"); } else { @@ -95,21 +59,5 @@ public class DuplicateCheckController { return Result.error("该值不可用，系统中已存在！"); } } - - /** - * VUEN-2584【issue】平台sql注入漏洞几个问题 - * 部分特殊函数 可以将查询结果混夹在错误信息中，导致数据库的信息暴露 - * @param e - * @return - */ - @ExceptionHandler(java.sql.SQLException.class) - public Result handleSQLException(Exception e){ - String msg = e.getMessage(); - String extractvalue = "extractvalue"; - String updatexml = "updatexml"; - if(msg!=null && (msg.toLowerCase().indexOf(extractvalue)>=0 || msg.toLowerCase().indexOf(updatexml)>=0)){ - return Result.error("校验失败，sql解析异常！"); - } - return Result.error("校验失败，sql解析异常！" + msg); - } + } diff --git a/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/mapper/SysDictMapper.java b/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/mapper/SysDictMapper.java index 49e51282..247b7c82 100644 --- a/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/mapper/SysDictMapper.java +++ b/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/mapper/SysDictMapper.java @@ -66,27 +66,6 @@ public interface SysDictMapper extends BaseMapper { */ public List queryDictItemsByCodeList(@Param("dictCodeList") List dictCodeList); - /** - * 通过查询指定table的 text code 获取字典 - * @param table - * @param text - * @param code - * @return List - */ - @Deprecated - public List queryTableDictItemsByCode(@Param("table") String table,@Param("text") String text,@Param("code") String code); - - /** - * 通过查询指定table的 text code 获取字典（指定查询条件） - * @param table - * @param text - * @param code - * @param filterSql - * @return List - */ - @Deprecated - public List queryTableDictItemsByCodeAndFilter(@Param("table") String table,@Param("text") String text,@Param("code") String code,@Param("filterSql") String filterSql); - /** * 通过查询指定table的 text code 获取字典 * @param table @@ -114,40 +93,6 @@ public interface SysDictMapper extends BaseMapper { */ List queryManyDictByKeys(@Param("dictCodeList") List dictCodeList, @Param("keys") List keys); - /** - * 通过查询指定table的 text code key 获取字典值 - * @param table - * @param text - * @param code - * @param key - * @return String - */ - @Deprecated - public String queryTableDictTextByKey(@Param("table") String table,@Param("text") String text,@Param("code") String code,@Param("key") String key); - -// /** -// * 通过查询指定table的 text code key 获取字典值，可批量查询 -// * -// * @param table -// * @param text -// * @param code -// * @param keys -// * @return -// */ -// @Deprecated -// List queryTableDictTextByKeys(@Param("table") String table, @Param("text") String text, @Param("code") String code, @Param("keys") List keys); - -// D /** -//// * 通过查询指定table的 text code key 获取字典值，包含value -//// * @param table -//// * @param text -//// * @param code -//// * @param keyArray -//// * @return List -//// */ -//// @Deprecated -//// public List queryTableictByKeys(@Param("table") String table, @Param("text") String text, @Param("code") String code, @Param("keyArray") String[] keyArray); - /** * 查询所有部门 作为字典信息 id -->value,departName -->text * @return @@ -160,29 +105,6 @@ public interface SysDictMapper extends BaseMapper { */ public List queryAllUserBackDictModel(); -// /** -// * 通过关键字查询出字典表 -// * @param table -// * @param text -// * @param code -// * @param keyword -// * @return -// */ -// @Deprecated -// public List queryTableDictItems(@Param("table") String table,@Param("text") String text,@Param("code") String code,@Param("keyword") String keyword); - - -// /** -// * 通过关键字查询出字典表 -// * @param page -// * @param table -// * @param text -// * @param code -// * @param keyword -// * @return -// */ -// //IPage queryTableDictItems(Page page, @Param("table") String table, @Param("text") String text, @Param("code") String code, @Param("keyword") String keyword); - /** * 根据表名、显示字段名、存储字段名 查询树 * @param table @@ -195,7 +117,7 @@ public interface SysDictMapper extends BaseMapper { * @return */ @Deprecated - List queryTreeList(@Param("query") Map query,@Param("table") String table,@Param("text") String text,@Param("code") String code,@Param("pidField") String pidField,@Param("pid") String pid,@Param("hasChildField") String hasChildField,@Param("converIsLeafVal") int converIsLeafVal); + List queryTreeList(@Param("query") Map query, @Param("table") String table, @Param("text") String text, @Param("code") String code, @Param("pidField") String pidField, @Param("pid") String pid, @Param("hasChildField") String hasChildField, @Param("converIsLeafVal") int converIsLeafVal); /** * 删除 @@ -240,7 +162,7 @@ public interface SysDictMapper extends BaseMapper { * @return */ @Deprecated - IPage queryTableDictWithFilter(Page page, @Param("table") String table, @Param("text") String text, @Param("code") String code, @Param("filterSql") String filterSql); + IPage queryPageTableDictWithFilter(Page page, @Param("table") String table, @Param("text") String text, @Param("code") String code, @Param("filterSql") String filterSql); /** * 查询 字典表数据 支持查询条件 查询所有 @@ -251,7 +173,7 @@ public interface SysDictMapper extends BaseMapper { * @return */ @Deprecated - List queryAllTableDictItems(@Param("table") String table, @Param("text") String text, @Param("code") String code, @Param("filterSql") String filterSql); + List queryTableDictWithFilter(@Param("table") String table, @Param("text") String text, @Param("code") String code, @Param("filterSql") String filterSql); /** * 查询字典表的数据 @@ -262,7 +184,9 @@ public interface SysDictMapper extends BaseMapper { * @param codeValues 存储字段值 作为查询条件in * @return */ - List queryTableDictByKeysAndFilterSql(@Param("table") String table, @Param("text") String text, @Param("code") String code, @Param("filterSql") String filterSql, @Param("codeValues") List codeValues); + @Deprecated + List queryTableDictByKeysAndFilterSql(@Param("table") String table, @Param("text") String text, @Param("code") String code, @Param("filterSql") String filterSql, + @Param("codeValues") List codeValues); /** * 根据应用id获取字典列表和详情 diff --git a/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/mapper/xml/SysDictMapper.xml b/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/mapper/xml/SysDictMapper.xml index d87729d2..41282070 100644 --- a/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/mapper/xml/SysDictMapper.xml +++ b/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/mapper/xml/SysDictMapper.xml @@ -62,71 +62,35 @@ ) - - - - - - - - - - - - - - - - - - - - - + + - - + + + + + SELECT COUNT(1) FROM ${tableName} WHERE ${fieldName} = #{fieldVal} + + + + + - - + - - + + + + select ${text} as "text", ${code} as "value" from ${table} + + where ${filterSql} + + + + + - - - - - + + +