From 8c489cac12d311039a45a15a8f17caf9fae6dbff Mon Sep 17 00:00:00 2001 From: zer0Black Date: Thu, 18 Mar 2021 14:45:48 +0800 Subject: [PATCH] =?UTF-8?q?=E3=80=90=E6=B7=BB=E5=8A=A0=E3=80=91=E5=AD=97?= =?UTF-8?q?=E5=85=B8=E6=95=B0=E6=8D=AE=E6=B7=BB=E5=8A=A0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../system/controller/SysDictController.java | 39 ++++++++++----- .../modules/system/mapper/SysDictMapper.java | 24 ++++++++- .../system/mapper/xml/SysDictMapper.xml | 25 ++++++++-- .../modules/system/model/TreeSelectModel.java | 5 +- .../system/service/ISysDictService.java | 14 +++++- .../service/impl/SysDictServiceImpl.java | 49 ++++++++++++++++++- 6 files changed, 134 insertions(+), 22 deletions(-) diff --git a/jero-boot/jero-boot-module-system/src/main/java/com/jero/modules/system/controller/SysDictController.java b/jero-boot/jero-boot-module-system/src/main/java/com/jero/modules/system/controller/SysDictController.java index 4f9ad41d..9dc317b0 100644 --- a/jero-boot/jero-boot-module-system/src/main/java/com/jero/modules/system/controller/SysDictController.java +++ b/jero-boot/jero-boot-module-system/src/main/java/com/jero/modules/system/controller/SysDictController.java @@ -279,25 +279,42 @@ public class SysDictController { /** * 根据表名——显示字段-存储字段 pid 加载树形数据 */ - @SuppressWarnings("unchecked") - @ApiOperation(value = "字典控制器-根据表名——显示字段-存储字段 pid 加载树形数据", notes = "字典控制器-根据表名——显示字段-存储字段 pid 加载树形数据") + @ApiOperation(value = "字典控制器-根据表名—显示字段-存储字段 pid 加载树形数据", notes = "字典控制器-根据表名—显示字段-存储字段 pid 加载树形数据") @RequestMapping(value = "/loadTreeData", method = RequestMethod.GET) public Result> loadTreeData(@RequestParam(name="pid") String pid, @RequestParam(name="pidField") String pidField, @RequestParam(name="tableName") String tbname, @RequestParam(name="text") String text, @RequestParam(name="code") String code, - @RequestParam(name="hasChildField") String hasChildField, - @RequestParam(name="condition") String condition, - @RequestParam(value = "sign",required = false) String sign, HttpServletRequest request) { + @RequestParam(name="hasChildField", required = false) String hasChildField, + @RequestParam(value = "sign", required = false) String sign, HttpServletRequest request) { Result> result = new Result>(); - Map query = null; - if(oConvertUtils.isNotEmpty(condition)) { - query = JSON.parseObject(condition, Map.class); - } + // SQL注入漏洞 sign签名校验(表名,label字段,val字段,条件) - String dictCode = tbname+","+text+","+code+","+condition; + String dictCode = tbname +","+ text +","+ code; SqlInjectionUtil.filterContent(dictCode); - List ls = sysDictService.queryTreeList(query,tbname, text, code, pidField, pid,hasChildField); + List ls = sysDictService.queryTreeList(null, tbname, text, code, pidField, pid, hasChildField); + result.setSuccess(true); + result.setResult(ls); + return result; + } + + /** + * 查询后返回树型数据 + */ + @ApiOperation(value = "字典控制器-根据表名—显示字段-存储字段 查询数据 加载树形数据", notes = "字典控制器-根据表名—显示字段-存储字段 pid 加载树形数据") + @RequestMapping(value = "/queryTreeDataByKeyword", method = RequestMethod.GET) + public Result> queryTreeDataByKeyword(@RequestParam(name="pidField") String pidField, + @RequestParam(name="tableName") String tbname, + @RequestParam(name="text") String text, + @RequestParam(name="code") String code, + @RequestParam(name="keyword") String keyword, + HttpServletRequest request) { + Result> result = new Result>(); + + // SQL注入漏洞 sign签名校验(表名,label字段,val字段,条件) + String dictCode = tbname +","+ text +","+ code + "," + keyword; + SqlInjectionUtil.filterContent(dictCode); + List ls = sysDictService.queryTreeDataByKeyword(keyword, tbname, text, code, pidField); result.setSuccess(true); result.setResult(ls); return result; diff --git a/jero-boot/jero-boot-module-system/src/main/java/com/jero/modules/system/mapper/SysDictMapper.java b/jero-boot/jero-boot-module-system/src/main/java/com/jero/modules/system/mapper/SysDictMapper.java index 79b9ed68..558bff5b 100644 --- a/jero-boot/jero-boot-module-system/src/main/java/com/jero/modules/system/mapper/SysDictMapper.java +++ b/jero-boot/jero-boot-module-system/src/main/java/com/jero/modules/system/mapper/SysDictMapper.java @@ -32,6 +32,7 @@ public interface SysDictMapper extends BaseMapper { * @return */ public Long duplicateCheckCountSql(DuplicateCheckVo duplicateCheckVo); + public Long duplicateCheckCountSqlNoDataId(DuplicateCheckVo duplicateCheckVo); public List queryDictItemsByCode(@Param("code") String code); @@ -98,8 +99,27 @@ public interface SysDictMapper extends BaseMapper { * @param hasChildField * @return */ - @Deprecated - List queryTreeList(@Param("query") Map query,@Param("table") String table,@Param("text") String text,@Param("code") String code,@Param("pidField") String pidField,@Param("pid") String pid,@Param("hasChildField") String hasChildField); + List queryTreeList(@Param("query") String query,@Param("table") String table,@Param("text") String text,@Param("code") String code,@Param("pidField") String pidField,@Param("pid") String pid,@Param("hasChildField") String hasChildField); + + /** + * 根据表名、显示字段名、存储字段名 和查询条件拼接树结构 + * @param query + * @param table + * @param text + * @param code + * @return + */ + List queryTreeDataByKeyword(@Param("query") String query,@Param("table") String table,@Param("text") String text,@Param("code") String code,@Param("pidField") String pidField); + + /** + * 根据表名、显示字段名、存储字段名、自身ID查询 + * @param id + * @param table + * @param text + * @param code + * @return + */ + TreeSelectModel queryTreeDataItemById(@Param("id") String id,@Param("table") String table,@Param("text") String text,@Param("code") String code,@Param("pidField") String pidField); /** * 删除 diff --git a/jero-boot/jero-boot-module-system/src/main/java/com/jero/modules/system/mapper/xml/SysDictMapper.xml b/jero-boot/jero-boot-module-system/src/main/java/com/jero/modules/system/mapper/xml/SysDictMapper.xml index 1cdb7ebd..068ffc88 100644 --- a/jero-boot/jero-boot-module-system/src/main/java/com/jero/modules/system/mapper/xml/SysDictMapper.xml +++ b/jero-boot/jero-boot-module-system/src/main/java/com/jero/modules/system/mapper/xml/SysDictMapper.xml @@ -87,12 +87,31 @@ - - and ${key} = #{value} - + and ${text} like concat(concat('%',#{query}),'%') + + + + +