From 93ee021b6e8a9e6b3bca12c2f35f6e3c68baef5a Mon Sep 17 00:00:00 2001
From: RuoYi <yzz_ivy@163.com>
Date: Sat, 31 Jul 2021 12:18:24 +0800
Subject: [PATCH] XSS过滤排除非json类型
---
ruoyi-modules/ruoyi-system/src/main/resources/mapper/system/SysDeptMapper.xml | 25 ++++++++++++-------------
1 files changed, 12 insertions(+), 13 deletions(-)
diff --git a/ruoyi-modules/ruoyi-system/src/main/resources/mapper/system/SysDeptMapper.xml b/ruoyi-modules/ruoyi-system/src/main/resources/mapper/system/SysDeptMapper.xml
index cda58d7..e3930a9 100644
--- a/ruoyi-modules/ruoyi-system/src/main/resources/mapper/system/SysDeptMapper.xml
+++ b/ruoyi-modules/ruoyi-system/src/main/resources/mapper/system/SysDeptMapper.xml
@@ -40,16 +40,18 @@
AND status = #{status}
</if>
<!-- 数据范围过滤 -->
- ${dataScope}
+ ${params.dataScope}
order by d.parent_id, d.order_num
</select>
- <select id="selectDeptListByRoleId" parameterType="Long" resultType="Integer">
- select d.dept_id, d.parent_id
+ <select id="selectDeptListByRoleId" resultType="Integer">
+ select d.dept_id
from sys_dept d
left join sys_role_dept rd on d.dept_id = rd.dept_id
where rd.role_id = #{roleId}
- and d.dept_id not in (select d.parent_id from sys_dept d inner join sys_role_dept rd on d.dept_id = rd.dept_id and rd.role_id = #{roleId})
+ <if test="deptCheckStrictly">
+ and d.dept_id not in (select d.parent_id from sys_dept d inner join sys_role_dept rd on d.dept_id = rd.dept_id and rd.role_id = #{roleId})
+ </if>
order by d.parent_id, d.order_num
</select>
@@ -77,7 +79,7 @@
<select id="checkDeptNameUnique" resultMap="SysDeptResult">
<include refid="selectDeptVo"/>
- where dept_name=#{deptName} and parent_id = #{parentId}
+ where dept_name=#{deptName} and parent_id = #{parentId} limit 1
</select>
<insert id="insertDept" parameterType="SysDept">
@@ -138,14 +140,11 @@
</foreach>
</update>
- <update id="updateDeptStatus" parameterType="SysDept">
- update sys_dept
- <set>
- <if test="status != null and status != ''">status = #{status},</if>
- <if test="updateBy != null and updateBy != ''">update_by = #{updateBy},</if>
- update_time = sysdate()
- </set>
- where dept_id in (${ancestors})
+ <update id="updateDeptStatusNormal" parameterType="Long">
+ update sys_dept set status = '0' where dept_id in
+ <foreach collection="array" item="deptId" open="(" separator="," close=")">
+ #{deptId}
+ </foreach>
</update>
<delete id="deleteDeptById" parameterType="Long">
--
Gitblit v1.9.3