diff --git a/插件库/Lskj.Business/Impl/AttachImpl.cs b/插件库/Lskj.Business/Impl/AttachImpl.cs
index f00680c..272fd2e 100644
--- a/插件库/Lskj.Business/Impl/AttachImpl.cs
+++ b/插件库/Lskj.Business/Impl/AttachImpl.cs
@@ -353,12 +353,36 @@ namespace Lskj.Business.Impl
DataTable dt = SqlHelper.ExecuteDataTable(sqlValue, new SqlParameter[] { new SqlParameter("@sName", sName) });
if (dt.Rows.Count > 1)
{
- string webpath11 = Lskj.Web.Core.Util.FileUtil.UrlEncode(HttpUtility.UrlDecode(webpath), false);
- //if (!webpath.StartsWith("%")) webpath = "%" + webpath;
- sqlValue = string.Format("select * from P_fm_FileTab where sName='{0}' and (webpath like '%{1}' )", sName, webpath11);
+ //string webpath11 = Lskj.Web.Core.Util.FileUtil.UrlEncode(HttpUtility.UrlDecode(webpath), false);
+ ////if (!webpath.StartsWith("%")) webpath = "%" + webpath;
+ //sqlValue = string.Format("select * from P_fm_FileTab where sName='{0}' and (webpath like '%{1}' )", sName, webpath11);
//sqlValue = string.Format("select * from P_fm_FileTab where sName='{0}' and (webpath like '%{1}' or webpath like '%{2}' or webpath like '%{3}')", sName, webpath, HttpUtility.UrlDecode(webpath).Replace("#", "%23").Replace("%2f", "/").Replace("（", "%ef%bc%88").Replace("）", "%ef%bc%89"), HttpUtility.UrlDecode(webpath));
- dt = SqlHelper.ExecuteDataTable(sqlValue);
+ //dt = SqlHelper.ExecuteDataTable(sqlValue);
+
+ // 解码一次，统一处理路径
+ string decodePath = HttpUtility.UrlDecode(webpath);
+
+ // 统一构造三种匹配格式（原始、解码、格式化编码）
+ string formatPath = decodePath
+ .Replace("#", "%23")
+ .Replace("%2f", "/")
+ .Replace("（", "%ef%bc%88")
+ .Replace("）", "%ef%bc%89");
+
+ // 完全参数化 SQL，彻底杜绝 SQL 注入！
+ sqlValue = @"SELECT * FROM P_fm_FileTab
+ WHERE sName = @sName
+ AND (webpath LIKE @path1
+ OR webpath LIKE @path2
+ OR webpath LIKE @path3)";
+
+ dt = SqlHelper.ExecuteDataTable(sqlValue,
+ new SqlParameter("@sName", sName),
+ new SqlParameter("@path1", "%" + webpath),
+ new SqlParameter("@path2", "%" + formatPath),
+ new SqlParameter("@path3", "%" + decodePath)
+ );
}
return dt.Rows.Count > 0 ? dt.Rows[0] : null;
diff --git a/插件库/Lskj.Business/Impl/BaseModuleImpl.cs b/插件库/Lskj.Business/Impl/BaseModuleImpl.cs
index 9930305..fab0da3 100644
--- a/插件库/Lskj.Business/Impl/BaseModuleImpl.cs
+++ b/插件库/Lskj.Business/Impl/BaseModuleImpl.cs
@@ -660,7 +660,7 @@ namespace Lskj.Business.Impl
string.IsNullOrWhiteSpace(fieldName) ||
string.IsNullOrWhiteSpace(condKey))
return 0;
- string sqlValue = string.Format("update {0} set {1}='{2}' where {3}='{4}'", tableName, fieldName, fieldValue, condKey, condValue); ;
+ string sqlValue = string.Format("update {0} set {1}='{2}' where {3}='{4}'", tableName, fieldName, fieldValue, condKey, condValue);
return SqlHelper.ExecuteNonQuery(sqlValue);
}
@@ -988,6 +988,10 @@ namespace Lskj.Business.Impl
{
field += ",UnionValue";
}
+ if (dataTable.Columns.Contains("RememberValue"))
+ {
+ field += ",RememberValue";
+ }
string sqlValue = string.Format(@"select id,controlLeft,controlTop,controlWidth,controlHeight,controlType as fieldTypeId,controlName as fieldName,controlLabel as userName,'' DataFormat,
defaultValue,sourceSql as lookupSql,keyField as lookupKeyField,resultField as lookupResult,edited,checkCond,InputHintText{0}
diff --git a/插件库/Lskj.Business/Impl/BaseSpecImpl.cs b/插件库/Lskj.Business/Impl/BaseSpecImpl.cs
index 4cd0613..443efdf 100644
--- a/插件库/Lskj.Business/Impl/BaseSpecImpl.cs
+++ b/插件库/Lskj.Business/Impl/BaseSpecImpl.cs
@@ -72,7 +72,7 @@ namespace Lskj.Business.Impl
maxNum += "9";
}
- string sqlValue = string.Format("select max(cast(SpeciesNo as bigint))+1 from {0} where {1} like '{2}{3}'", tableName, parentKey, parentValue, maxdivision);
+ string sqlValue = string.Format("select max(cast({1} as bigint))+1 from {0} where {1} like '{2}{3}'", tableName, parentKey, parentValue, maxdivision);
string maxNo = GetResult(sqlValue) + "";
if (string.IsNullOrWhiteSpace(maxNo))
@@ -87,31 +87,4 @@ namespace Lskj.Business.Impl
return maxNum;
// 取未使用的编号
- sqlValue = string.Format("select cast({1} as bigint) as SpeciesNo from {0} where {1} like '{2}{3}' order by {1}", tableName, parentKey, parentValue,maxdivision);
- DataTable table = GetDataTableResult(sqlValue);
-
- Int64 speciesNo = table.Rows.Count > 0 ? Convert.ToInt64(table.Rows[0]["SpeciesNo"] + "") : 0;
- if (speciesNo != Int64.Parse(parentValue + PrefixNum+"1"))
- return parentValue +PrefixNum+"1";;
-
- foreach (DataRow item in table.Rows)
- {
- Int64 rowSpeciesNo = Convert.ToInt64(item["SpeciesNo"] + "");
- if (speciesNo == rowSpeciesNo) continue;
-
- if (rowSpeciesNo != speciesNo + 1)
- {
- maxNo = (speciesNo + 1).ToString();
- maxNo = maxNo.PadLeft(parentValue.Length + firstNode.Length, '0');
-
- break;
- }
-
- speciesNo = rowSpeciesNo;
- }
- }
-
- return maxNo;
- }
- }
-}
+ sqlValue = string.Format("select cast({1} as bigint) as SpeciesNo from {0} where {1} like '{2}{
\ No newline at end of file
diff --git a/插件库/Lskj.Business/Impl/BillImpl.cs b/插件库/Lskj.Business/Impl/BillImpl.cs
index 76588aa..f19e9c3 100644
--- a/插件库/Lskj.Business/Impl/BillImpl.cs
+++ b/插件库/Lskj.Business/Impl/BillImpl.cs
@@ -84,9 +84,6 @@ namespace Lskj.Business.Impl
DataSet dataSet = SqlHelper.ExecuteDataSet(CommandType.StoredProcedure, newVer == 0 ? "P_BillSavePr_3" : "P_BillSavePr70", "billSave", param);
- tipMsg = pMsg.Value.ToString();
- if (newVer == 1 && billWay == 1) billNo = tipMsg;
-
if (Convert.ToInt32(returnValue.Value + "") == -1&& SqlHelper.ConnectionType == ConnectionType.SqlServer)
{
SqlStoredProcedurepPrompt.GenerateBillSaveScript( masterSql, detailSql, detailTable, billNo, detailGuid, billSeq, billWay, comfirm,auditFlag ,newVer);
@@ -96,6 +93,9 @@ namespace Lskj.Business.Impl
SqlStoredProcedurepPrompt.GenerateBillSaveScript_DM(detailSql, SqlHelper.LastFailureSql, detailTable, detailGuid);
}
+ tipMsg = pMsg.Value.ToString();
+ if (newVer == 1 && billWay == 1) billNo = tipMsg;
+
return Convert.ToInt32(returnValue.Value + "");
}
}
diff --git a/插件库/Lskj.Business/Impl/MainImpl.cs b/插件库/Lskj.Business/Impl/MainImpl.cs
index d80f65e..76edfdc 100644
--- a/插件库/Lskj.Business/Impl/MainImpl.cs
+++ b/插件库/Lskj.Business/Impl/MainImpl.cs
@@ -200,9 +200,13 @@ namespace Lskj.Business.Impl
public static int UpdatePassword(string userId, string beforePass, string afterPass)
{
// 检查用户是否存在
+ //string sqlValue = string.Format("select password from P_EmployeeTab WHERE sign=0 and UseFlag=1 and EmployeeId='{0}' order by loginaccount", userId);
+ //string password = SqlHelper.ExecuteString("password", sqlValue);
+ //if (string.IsNullOrWhiteSpace(password)) return 0;
+ DataTable dtTable = GetEmployeeList(userId);
+ if (dtTable.Rows.Count == 0) return 0;
string sqlValue = string.Format("select password from P_EmployeeTab WHERE sign=0 and UseFlag=1 and EmployeeId='{0}' order by loginaccount", userId);
string password = SqlHelper.ExecuteString("password", sqlValue);
- if (string.IsNullOrWhiteSpace(password)) return 0;
//md5加密密码
string mdpassword = SHAHelper.GetMd5Hash(afterPass);
@@ -212,7 +216,7 @@ namespace Lskj.Business.Impl
// 检查旧密码是否一致
- if (!password.Equals(beforePass)) return 2;
+ if (!password.Equals(beforePass)&&!string.IsNullOrWhiteSpace(password)) return 2;
sqlValue = string.Format("update P_EmployeeTab set password='{0}' where EmployeeId='{1}' select @@ROWCOUNT", afterPass, userId);
@@ -1301,28 +1305,4 @@ namespace Lskj.Business.Impl
string sqlvalue = $@"SELECT COLUMN_NAME FROM INFORMATION_SCHEMA.columns
WHERE TABLE_NAME = '{tableName}' AND COLUMNPROPERTY(OBJECT_ID('{tableName}'),COLUMN_NAME,'IsIdentity')= 1;";
if (SqlHelper.ConnectionType == ConnectionType.DmServer)
- {
- sqlvalue = $@"select a.NAME from SYS.SYSCOLUMNS a,sysobjects b
- where b.id = a.id and b.name = '{tableName}' and a.info2 = 1;";
- }
- return BaseImpl.GetResult(sqlvalue) + "";
- }
-
- ///
- /// 获取表格属性
- ///
- ///
- public static DataTable GetDatabaseProperty(string tableName)
- {
- string sqlvalue = $@"select COLUMN_NAME,DATA_TYPE,CHARACTER_MAXIMUM_LENGTH from information_schema.columns
- where table_name = '{tableName}';";
- if (SqlHelper.ConnectionType == ConnectionType.DmServer)
- {
- sqlvalue = $@"SELECT COLUMN_NAME, DATA_TYPE, DATA_LENGTH AS CHARACTER_MAXIMUM_LENGTH
- FROM ALL_TAB_COLUMNS WHERE TABLE_NAME = '{tableName}';";
- }
- return BaseImpl.GetDataTableResult(sqlvalue);
- }
-
- }
-}
\ No newline at end of file
+
\ No newline at end of file
diff --git a/插件库/Lskj.Business/Impl/SystemInfo.cs b/插件库/Lskj.Business/Impl/SystemInfo.cs
index 13458cf..805456f 100644
--- a/插件库/Lskj.Business/Impl/SystemInfo.cs
+++ b/插件库/Lskj.Business/Impl/SystemInfo.cs
@@ -320,6 +320,7 @@ namespace Lskj.Business
Instance.isBlankCellColor = item.Table.Columns.Contains("isBlankCellColor") && !string.IsNullOrEmpty(item["isBlankCellColor"] + "") ? "1".Equals(item["isBlankCellColor"] + "") : false;
Instance.ModuleSpecialDrag = item.Table.Columns.Contains("ModuleSpecialDrag") && !string.IsNullOrEmpty(item["ModuleSpecialDrag"] + "") ? "1".Equals(item["ModuleSpecialDrag"] + "") : false;
Instance.ViewPwd = item.Table.Columns.Contains("ViewPwd") && !string.IsNullOrEmpty(item["ViewPwd"] + "") ? "1".Equals(item["ViewPwd"] + "") : false;
+ Instance.LoginAnnouncement = item.Table.Columns.Contains("LoginAnnouncement") && !string.IsNullOrEmpty(item["LoginAnnouncement"] + "") ? "1".Equals(item["LoginAnnouncement"] + "") : false;
}
///
@@ -1086,4 +1087,7 @@ namespace Lskj.Business
public int SubscriptRefreshTime;
///
/// 盛邦的Lims加密Key
- /// <
\ No newline at end of file
+ ///
+ public string CDSBLimsPrivateKey;
+ ///
+ /// 流转记录sql不拼
\ No newline at end of file