cyf/lserp_cs_6.0
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

SVN r1189

Browse Source 
SVN-Revision: r1189
This commit is contained in:
cyf
2026-06-01 01:42:40 +00:00
parent 29490ec187
commit 6245aa0768
6 changed files with 50 additions and 65 deletions
Download Patch File Download Diff File Expand all files Collapse all files
插件库/Lskj.Business/Impl/AttachImpl.cs
+28 -4
View File
@@ -353,12 +353,36 @@ namespace Lskj.Business.Impl
DataTable dt = SqlHelper.ExecuteDataTable(sqlValue, new SqlParameter[] { new SqlParameter("@sName", sName) });
if (dt.Rows.Count > 1)
{
string webpath11 = Lskj.Web.Core.Util.FileUtil.UrlEncode(HttpUtility.UrlDecode(webpath), false);
//if (!webpath.StartsWith("%")) webpath = "%" + webpath;
sqlValue = string.Format("select * from P_fm_FileTab where sName='{0}' and (webpath like '%{1}' )", sName, webpath11);
//string webpath11 = Lskj.Web.Core.Util.FileUtil.UrlEncode(HttpUtility.UrlDecode(webpath), false);
////if (!webpath.StartsWith("%")) webpath = "%" + webpath;
//sqlValue = string.Format("select * from P_fm_FileTab where sName='{0}' and (webpath like '%{1}' )", sName, webpath11);
//sqlValue = string.Format("select * from P_fm_FileTab where sName='{0}' and (webpath like '%{1}' or webpath like '%{2}' or webpath like '%{3}')", sName, webpath, HttpUtility.UrlDecode(webpath).Replace("#", "%23").Replace("%2f", "/").Replace("（", "%ef%bc%88").Replace("）", "%ef%bc%89"), HttpUtility.UrlDecode(webpath));
dt = SqlHelper.ExecuteDataTable(sqlValue);
//dt = SqlHelper.ExecuteDataTable(sqlValue);
// 解码一次，统一处理路径
string decodePath = HttpUtility.UrlDecode(webpath);
// 统一构造三种匹配格式（原始、解码、格式化编码）
string formatPath = decodePath
.Replace("#", "%23")
.Replace("%2f", "/")
.Replace("（", "%ef%bc%88")
.Replace("）", "%ef%bc%89");
// 完全参数化 SQL，彻底杜绝 SQL 注入！
sqlValue = @"SELECT * FROM P_fm_FileTab
WHERE sName = @sName
AND (webpath LIKE @path1
OR webpath LIKE @path2
OR webpath LIKE @path3)";
dt = SqlHelper.ExecuteDataTable(sqlValue,
new SqlParameter("@sName", sName),
new SqlParameter("@path1", "%" + webpath),
new SqlParameter("@path2", "%" + formatPath),
new SqlParameter("@path3", "%" + decodePath)
);
}
return dt.Rows.Count > 0 ? dt.Rows[0] : null;
插件库/Lskj.Business/Impl/BaseModuleImpl.cs
+5 -1
View File
@@ -660,7 +660,7 @@ namespace Lskj.Business.Impl
string.IsNullOrWhiteSpace(fieldName) ||
string.IsNullOrWhiteSpace(condKey))
return 0;
string sqlValue = string.Format("update {0} set {1}='{2}' where {3}='{4}'", tableName, fieldName, fieldValue, condKey, condValue); ;
string sqlValue = string.Format("update {0} set {1}='{2}' where {3}='{4}'", tableName, fieldName, fieldValue, condKey, condValue);
return SqlHelper.ExecuteNonQuery(sqlValue);
}
@@ -988,6 +988,10 @@ namespace Lskj.Business.Impl
{
field += ",UnionValue";
}
if (dataTable.Columns.Contains("RememberValue"))
{
field += ",RememberValue";
}
string sqlValue = string.Format(@"select id,controlLeft,controlTop,controlWidth,controlHeight,controlType as fieldTypeId,controlName as fieldName,controlLabel as userName,'' DataFormat,
defaultValue,sourceSql as lookupSql,keyField as lookupKeyField,resultField as lookupResult,edited,checkCond,InputHintText{0}
插件库/Lskj.Business/Impl/BaseSpecImpl.cs
+2 -29
View File
@@ -72,7 +72,7 @@ namespace Lskj.Business.Impl
maxNum += "9";
}
string sqlValue = string.Format("select max(cast(SpeciesNo as bigint))+1 from {0} where {1} like '{2}{3}'", tableName, parentKey, parentValue, maxdivision);
string sqlValue = string.Format("select max(cast({1} as bigint))+1 from {0} where {1} like '{2}{3}'", tableName, parentKey, parentValue, maxdivision);
string maxNo = GetResult(sqlValue) + "";
if (string.IsNullOrWhiteSpace(maxNo))
@@ -87,31 +87,4 @@ namespace Lskj.Business.Impl
return maxNum;
// 取未使用的编号
sqlValue = string.Format("select cast({1} as bigint) as SpeciesNo from {0} where {1} like '{2}{3}' order by {1}", tableName, parentKey, parentValue,maxdivision);
DataTable table = GetDataTableResult(sqlValue);
Int64 speciesNo = table.Rows.Count > 0 ? Convert.ToInt64(table.Rows[0]["SpeciesNo"] + "") : 0;
if (speciesNo != Int64.Parse(parentValue + PrefixNum+"1"))
return parentValue +PrefixNum+"1";;
foreach (DataRow item in table.Rows)
{
Int64 rowSpeciesNo = Convert.ToInt64(item["SpeciesNo"] + "");
if (speciesNo == rowSpeciesNo) continue;
if (rowSpeciesNo != speciesNo + 1)
{
maxNo = (speciesNo + 1).ToString();
maxNo = maxNo.PadLeft(parentValue.Length + firstNode.Length, '0');
break;
}
speciesNo = rowSpeciesNo;
}
}
return maxNo;
}
}
}
sqlValue = string.Format("select cast({1} as bigint) as SpeciesNo from {0} where {1} like '{2}{
插件库/Lskj.Business/Impl/BillImpl.cs
+3 -3
View File
@@ -84,9 +84,6 @@ namespace Lskj.Business.Impl
DataSet dataSet = SqlHelper.ExecuteDataSet(CommandType.StoredProcedure, newVer == 0 ? "P_BillSavePr_3" : "P_BillSavePr70", "billSave", param);
tipMsg = pMsg.Value.ToString();
if (newVer == 1 && billWay == 1) billNo = tipMsg;
if (Convert.ToInt32(returnValue.Value + "") == -1&& SqlHelper.ConnectionType == ConnectionType.SqlServer)
{
SqlStoredProcedurepPrompt.GenerateBillSaveScript( masterSql, detailSql, detailTable, billNo, detailGuid, billSeq, billWay, comfirm,auditFlag ,newVer);
@@ -96,6 +93,9 @@ namespace Lskj.Business.Impl
SqlStoredProcedurepPrompt.GenerateBillSaveScript_DM(detailSql, SqlHelper.LastFailureSql, detailTable, detailGuid);
}
tipMsg = pMsg.Value.ToString();
if (newVer == 1 && billWay == 1) billNo = tipMsg;
return Convert.ToInt32(returnValue.Value + "");
}
}
插件库/Lskj.Business/Impl/MainImpl.cs
+7 -27
View File
@@ -200,9 +200,13 @@ namespace Lskj.Business.Impl
public static int UpdatePassword(string userId, string beforePass, string afterPass)
{
// 检查用户是否存在
//string sqlValue = string.Format("select password from P_EmployeeTab WHERE sign=0 and UseFlag=1 and EmployeeId='{0}' order by loginaccount", userId);
//string password = SqlHelper.ExecuteString("password", sqlValue);
//if (string.IsNullOrWhiteSpace(password)) return 0;
DataTable dtTable = GetEmployeeList(userId);
if (dtTable.Rows.Count == 0) return 0;
string sqlValue = string.Format("select password from P_EmployeeTab WHERE sign=0 and UseFlag=1 and EmployeeId='{0}' order by loginaccount", userId);
string password = SqlHelper.ExecuteString("password", sqlValue);
if (string.IsNullOrWhiteSpace(password)) return 0;
//md5加密密码
string mdpassword = SHAHelper.GetMd5Hash(afterPass);
@@ -212,7 +216,7 @@ namespace Lskj.Business.Impl
// 检查旧密码是否一致
if (!password.Equals(beforePass)) return 2;
if (!password.Equals(beforePass)&&!string.IsNullOrWhiteSpace(password)) return 2;
sqlValue = string.Format("update P_EmployeeTab set password='{0}' where EmployeeId='{1}' select @@ROWCOUNT", afterPass, userId);
@@ -1301,28 +1305,4 @@ namespace Lskj.Business.Impl
string sqlvalue = $@"SELECT COLUMN_NAME FROM INFORMATION_SCHEMA.columns
WHERE TABLE_NAME = '{tableName}' AND COLUMNPROPERTY(OBJECT_ID('{tableName}'),COLUMN_NAME,'IsIdentity')= 1;";
if (SqlHelper.ConnectionType == ConnectionType.DmServer)
{
sqlvalue = $@"select a.NAME from SYS.SYSCOLUMNS a,sysobjects b
where b.id = a.id and b.name = '{tableName}' and a.info2 = 1;";
}
return BaseImpl.GetResult(sqlvalue) + "";
}
/// <summary>
/// 获取表格属性
/// </summary>
/// <returns></returns>
public static DataTable GetDatabaseProperty(string tableName)
{
string sqlvalue = $@"select COLUMN_NAME,DATA_TYPE,CHARACTER_MAXIMUM_LENGTH from information_schema.columns
where table_name = '{tableName}';";
if (SqlHelper.ConnectionType == ConnectionType.DmServer)
{
sqlvalue = $@"SELECT COLUMN_NAME, DATA_TYPE, DATA_LENGTH AS CHARACTER_MAXIMUM_LENGTH
FROM ALL_TAB_COLUMNS WHERE TABLE_NAME = '{tableName}';";
}
return BaseImpl.GetDataTableResult(sqlvalue);
}
}
}
插件库/Lskj.Business/Impl/SystemInfo.cs
+5 -1
View File
@@ -320,6 +320,7 @@ namespace Lskj.Business
Instance.isBlankCellColor = item.Table.Columns.Contains("isBlankCellColor") && !string.IsNullOrEmpty(item["isBlankCellColor"] + "") ? "1".Equals(item["isBlankCellColor"] + "") : false;
Instance.ModuleSpecialDrag = item.Table.Columns.Contains("ModuleSpecialDrag") && !string.IsNullOrEmpty(item["ModuleSpecialDrag"] + "") ? "1".Equals(item["ModuleSpecialDrag"] + "") : false;
Instance.ViewPwd = item.Table.Columns.Contains("ViewPwd") && !string.IsNullOrEmpty(item["ViewPwd"] + "") ? "1".Equals(item["ViewPwd"] + "") : false;
Instance.LoginAnnouncement = item.Table.Columns.Contains("LoginAnnouncement") && !string.IsNullOrEmpty(item["LoginAnnouncement"] + "") ? "1".Equals(item["LoginAnnouncement"] + "") : false;
}
/// <summary>
@@ -1086,4 +1087,7 @@ namespace Lskj.Business
public int SubscriptRefreshTime;
/// <summary>
/// 盛邦的Lims加密Key
/// <
/// </summary>
public string CDSBLimsPrivateKey;
/// <summary>
/// 流转记录sql不拼�