Browse Source

调整sql,防止sql注入

yucheng 3 years ago
parent
commit
5290440a4a

+ 5 - 0
dc-business/dc-dictionary-manage/src/main/java/com/persagy/dc/dictionary/service/impl/ObjectTypeHistoryServiceImpl.java

@@ -29,6 +29,11 @@ public class ObjectTypeHistoryServiceImpl implements IObjectTypeHistoryService {
 
 
     @Override
     @Override
     public void copyByVersion(String srcVersion, String version) {
     public void copyByVersion(String srcVersion, String version) {
+        /**
+         * TODO 目前是以编辑工具中数据为主体操作。应调整为从数据字典中读取当前数据
+         * 这样可以避免非编辑工具触发的数据字典编辑场景,产生的数据不一致
+         * 同时也可以通过调整数据字典服务源来支持为其他数据字典服务提供编辑服务
+         **/
         dao.copyByVersion(srcVersion, version);
         dao.copyByVersion(srcVersion, version);
     }
     }
 
 

+ 2 - 2
dc-business/dc-dictionary-manage/src/main/resources/mapper/ObjectInfoHistoryMapper.xml

@@ -8,8 +8,8 @@
             is_multiple,is_region,formatter,data_source,note,sub_flag,weak_point,is_used,version,operator,operator_level)
             is_multiple,is_region,formatter,data_source,note,sub_flag,weak_point,is_used,version,operator,operator_level)
         select id,group_code,project_id,code,orig_code,name,alias_code,alias_name,
         select id,group_code,project_id,code,orig_code,name,alias_code,alias_name,
             class_code,category,type,first_tag,second_tag,priority,input_mode,unit,data_type,orig_data_type,
             class_code,category,type,first_tag,second_tag,priority,input_mode,unit,data_type,orig_data_type,
-            is_multiple,is_region,formatter,data_source,note,sub_flag,weak_point,is_used,${version},null,null
+            is_multiple,is_region,formatter,data_source,note,sub_flag,weak_point,is_used,#{version},null,null
         from rwd_object_info_his
         from rwd_object_info_his
-        where version = ${srcVersion}
+        where version = #{srcVersion}
     </insert>
     </insert>
 </mapper>
 </mapper>

+ 2 - 2
dc-business/dc-dictionary-manage/src/main/resources/mapper/ObjectTypeHistoryMapper.xml

@@ -6,8 +6,8 @@
         insert into rwd_object_type_his(id,group_code,obj_type,name,alias_code,alias_name,
         insert into rwd_object_type_his(id,group_code,obj_type,name,alias_code,alias_name,
             type,project_id,major_code,system_code,equipment_code,parent_code,is_used,version,operator,operator_level)
             type,project_id,major_code,system_code,equipment_code,parent_code,is_used,version,operator,operator_level)
         select id,group_code,obj_type,name,alias_code,alias_name,type,project_id,major_code,system_code,
         select id,group_code,obj_type,name,alias_code,alias_name,type,project_id,major_code,system_code,
-            equipment_code,parent_code,is_used,${version},null,null
+            equipment_code,parent_code,is_used,#{version},null,null
         from rwd_object_type_his
         from rwd_object_type_his
-        where version = ${srcVersion}
+        where version = #{srcVersion}
     </insert>
     </insert>
 </mapper>
 </mapper>