c-zhangr1/zhgh_zjipc
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

1

Browse Source
This commit is contained in:
c-zhangr1
2026-06-16 11:29:49 +08:00
parent 42e72aad99
commit ae027378f7
7 changed files with 86 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/main/java/com/budwk/app/zhgh/staffbenefit/difficulthelp/controller/DifficultHelpMineController.java
+5 -2
View File
@@ -99,10 +99,13 @@ public class DifficultHelpMineController {
""");
Cnd cnd = Cnd.NEW();
pageParam.buildSearch(cnd, "info.");
if (StrUtil.isAllBlank(pageParam.getPageOrderName(), pageParam.getPageOrderBy())) {
// 排序字段必须经过 service 白名单校验，避免前端 pageOrderName 直接进入 ORDER BY。
String orderColumn = difficultHelpCommonService.getSafeMineOrderColumn(pageParam.getPageOrderName());
String orderBy = PageUtil.getOrder(pageParam.getPageOrderBy());
if (StrUtil.isBlank(orderColumn) || StrUtil.isBlank(orderBy)) {
cnd.desc("info.applyTime");
} else {
cnd.orderBy("info." + pageParam.getPageOrderName(), PageUtil.getOrder(pageParam.getPageOrderBy()));
cnd.orderBy(orderColumn, orderBy);
}
cnd.groupBy("info.id");
sql.setCondition(cnd);
src/main/java/com/budwk/app/zhgh/staffbenefit/difficulthelp/service/DifficultHelpCommonService.java
+8
View File
@@ -11,4 +11,12 @@ import com.budwk.app.zhgh.staffbenefit.difficulthelp.models.DifficultHelpInfo;
* @注释
*/
public interface DifficultHelpCommonService extends BaseService<DifficultHelpInfo> {
/**
* 校验困难帮扶“我的申请”列表排序字段，并返回可用于 SQL 排序的安全字段名。
*
* @param pageOrderName 前端传入的排序字段
* @return 白名单内的 SQL 排序字段；不在白名单时返回空字符串
*/
String getSafeMineOrderColumn(String pageOrderName);
}
src/main/java/com/budwk/app/zhgh/staffbenefit/difficulthelp/service/impl/DifficultHelpCommonServiceImpl.java
+25
View File
@@ -1,5 +1,6 @@
package com.budwk.app.zhgh.staffbenefit.difficulthelp.service.impl;
import cn.hutool.core.util.StrUtil;
import com.budwk.app.base.service.impl.BaseServiceImpl;
import com.budwk.app.zhgh.staffbenefit.difficulthelp.models.DifficultHelpInfo;
import com.budwk.app.zhgh.staffbenefit.difficulthelp.service.DifficultHelpCommonService;
@@ -19,4 +20,28 @@ public class DifficultHelpCommonServiceImpl extends BaseServiceImpl<DifficultHel
public DifficultHelpCommonServiceImpl(Dao dao) {
super(dao);
}
/**
* 校验困难帮扶“我的申请”列表排序字段，避免前端参数直接拼接到 ORDER BY。
*
* @param pageOrderName 前端传入的排序字段
* @return 白名单内的 SQL 排序字段；不在白名单时返回空字符串
*/
@Override
public String getSafeMineOrderColumn(String pageOrderName) {
if (StrUtil.isBlank(pageOrderName)) {
return "";
}
// 仅允许页面表格中存在的可排序字段参与 ORDER BY，未知字段交由 controller 回退默认排序。
return switch (pageOrderName) {
case "loginName" -> "info.loginName";
case "userName" -> "info.userName";
case "unionName" -> "info.unionName";
case "unitName" -> "info.unitName";
case "subsidyStandards" -> "info.subsidyStandards";
case "applyTime" -> "info.applyTime";
default -> "";
};
}
}
src/main/java/com/budwk/app/zhgh/staffmanage/member/controller/apply/MemberApplyMineController.java
+5 -2
View File
@@ -108,10 +108,13 @@ public class MemberApplyMineController {
cnd.and("info.userId", "=", SecurityUtil.getUserId());
}
}
if (StrUtil.isAllBlank(pageForm.getPageOrderName(), pageForm.getPageOrderBy())) {
// 排序字段必须经过 service 白名单校验，避免前端 pageOrderName 直接进入 ORDER BY。
String orderColumn = memberCommonService.getSafeMineOrderColumn(pageForm.getPageOrderName());
String orderBy = PageUtil.getOrder(pageForm.getPageOrderBy());
if (StrUtil.isBlank(orderColumn) || StrUtil.isBlank(orderBy)) {
cnd.desc("info.applyDateTime");
} else {
cnd.orderBy("info." + pageForm.getPageOrderName(), PageUtil.getOrder(pageForm.getPageOrderBy()));
cnd.orderBy(orderColumn, orderBy);
}
cnd.groupBy("t.id");
sql.setCondition(cnd);
src/main/java/com/budwk/app/zhgh/staffmanage/member/controller/change/MemberChangeMineController.java
+5 -2
View File
@@ -111,10 +111,13 @@ public class MemberChangeMineController {
cnd.and("info.userId", "=", SecurityUtil.getUserId());
}
}
if (StrUtil.isAllBlank(pageForm.getPageOrderName(), pageForm.getPageOrderBy())) {
// 排序字段必须经过 service 白名单校验，避免前端 pageOrderName 直接进入 ORDER BY。
String orderColumn = memberCommonService.getSafeMineOrderColumn(pageForm.getPageOrderName());
String orderBy = PageUtil.getOrder(pageForm.getPageOrderBy());
if (StrUtil.isBlank(orderColumn) || StrUtil.isBlank(orderBy)) {
cnd.desc("info.applyDateTime");
} else {
cnd.orderBy("info." + pageForm.getPageOrderName(), PageUtil.getOrder(pageForm.getPageOrderBy()));
cnd.orderBy(orderColumn, orderBy);
}
cnd.groupBy("t.id");
sql.setCondition(cnd);
src/main/java/com/budwk/app/zhgh/staffmanage/member/service/MemberCommonService.java
+8
View File
@@ -115,4 +115,12 @@ public interface MemberCommonService extends BaseService<Sys_user> {
* @param type 类型： apply or change
*/
void validateApplyOrChangeIsDoing(String userId, String type);
/**
* 校验会员申请、会员变更“我的申请”列表排序字段，并返回可用于 SQL 排序的安全字段名。
*
* @param pageOrderName 前端传入的排序字段
* @return 白名单内的 SQL 排序字段；不在白名单时返回空字符串
*/
String getSafeMineOrderColumn(String pageOrderName);
}
src/main/java/com/budwk/app/zhgh/staffmanage/member/service/impl/MemberManageServiceImpl.java
+30
View File
@@ -546,6 +546,36 @@ public class MemberManageServiceImpl extends BaseServiceImpl<Sys_user> implement
}
/**
* 校验会员申请、会员变更“我的申请”列表排序字段，避免前端参数直接拼接到 ORDER BY。
*
* @param pageOrderName 前端传入的排序字段
* @return 白名单内的 SQL 排序字段；不在白名单时返回空字符串
*/
@Override
public String getSafeMineOrderColumn(String pageOrderName) {
if (StrUtil.isBlank(pageOrderName)) {
return "";
}
// 仅允许页面表格中存在的可排序字段参与 ORDER BY，未知字段交由 controller 回退默认排序。
return switch (pageOrderName) {
case "loginName" -> "info.loginName";
case "userName" -> "info.userName";
case "loginname" -> "info.loginname";
case "username" -> "info.username";
case "sex" -> "info.sex";
case "userState" -> "info.userState";
case "personType" -> "info.personType";
case "preparedBy" -> "info.preparedBy";
case "unionName" -> "info.unionName";
case "unitName" -> "info.unitName";
case "changeTypes" -> "info.changeTypes";
case "applyDateTime" -> "info.applyDateTime";
default -> "";
};
}
private String booleanVerification(Object value) {
// 检查是否为null或空字符串