From 6245aa0768453ceaa09cdad4c778313cb1bfcd5c Mon Sep 17 00:00:00 2001 From: cyf Date: Mon, 1 Jun 2026 01:42:40 +0000 Subject: [PATCH] SVN r1189 SVN-Revision: r1189 --- 插件库/Lskj.Business/Impl/AttachImpl.cs | 32 ++++++++++++++++--- 插件库/Lskj.Business/Impl/BaseModuleImpl.cs | 6 +++- 插件库/Lskj.Business/Impl/BaseSpecImpl.cs | 31 ++----------------- 插件库/Lskj.Business/Impl/BillImpl.cs | 6 ++-- 插件库/Lskj.Business/Impl/MainImpl.cs | 34 +++++---------------- 插件库/Lskj.Business/Impl/SystemInfo.cs | 6 +++- 6 files changed, 50 insertions(+), 65 deletions(-) diff --git a/插件库/Lskj.Business/Impl/AttachImpl.cs b/插件库/Lskj.Business/Impl/AttachImpl.cs index f00680c..272fd2e 100644 --- a/插件库/Lskj.Business/Impl/AttachImpl.cs +++ b/插件库/Lskj.Business/Impl/AttachImpl.cs @@ -353,12 +353,36 @@ namespace Lskj.Business.Impl DataTable dt = SqlHelper.ExecuteDataTable(sqlValue, new SqlParameter[] { new SqlParameter("@sName", sName) }); if (dt.Rows.Count > 1) { - string webpath11 = Lskj.Web.Core.Util.FileUtil.UrlEncode(HttpUtility.UrlDecode(webpath), false); - //if (!webpath.StartsWith("%")) webpath = "%" + webpath; - sqlValue = string.Format("select * from P_fm_FileTab where sName='{0}' and (webpath like '%{1}' )", sName, webpath11); + //string webpath11 = Lskj.Web.Core.Util.FileUtil.UrlEncode(HttpUtility.UrlDecode(webpath), false); + ////if (!webpath.StartsWith("%")) webpath = "%" + webpath; + //sqlValue = string.Format("select * from P_fm_FileTab where sName='{0}' and (webpath like '%{1}' )", sName, webpath11); //sqlValue = string.Format("select * from P_fm_FileTab where sName='{0}' and (webpath like '%{1}' or webpath like '%{2}' or webpath like '%{3}')", sName, webpath, HttpUtility.UrlDecode(webpath).Replace("#", "%23").Replace("%2f", "/").Replace("（", "%ef%bc%88").Replace("）", "%ef%bc%89"), HttpUtility.UrlDecode(webpath)); - dt = SqlHelper.ExecuteDataTable(sqlValue); + //dt = SqlHelper.ExecuteDataTable(sqlValue); + + // 解码一次，统一处理路径 + string decodePath = HttpUtility.UrlDecode(webpath); + + // 统一构造三种匹配格式（原始、解码、格式化编码） + string formatPath = decodePath + .Replace("#", "%23") + .Replace("%2f", "/") + .Replace("（", "%ef%bc%88") + .Replace("）", "%ef%bc%89"); + + // 完全参数化 SQL，彻底杜绝 SQL 注入！ + sqlValue = @"SELECT * FROM P_fm_FileTab + WHERE sName = @sName + AND (webpath LIKE @path1 + OR webpath LIKE @path2 + OR webpath LIKE @path3)"; + + dt = SqlHelper.ExecuteDataTable(sqlValue, + new SqlParameter("@sName", sName), + new SqlParameter("@path1", "%" + webpath), + new SqlParameter("@path2", "%" + formatPath), + new SqlParameter("@path3", "%" + decodePath) + ); } return dt.Rows.Count > 0 ? dt.Rows[0] : null; diff --git a/插件库/Lskj.Business/Impl/BaseModuleImpl.cs b/插件库/Lskj.Business/Impl/BaseModuleImpl.cs index 9930305..fab0da3 100644 --- a/插件库/Lskj.Business/Impl/BaseModuleImpl.cs +++ b/插件库/Lskj.Business/Impl/BaseModuleImpl.cs @@ -660,7 +660,7 @@ namespace Lskj.Business.Impl string.IsNullOrWhiteSpace(fieldName) || string.IsNullOrWhiteSpace(condKey)) return 0; - string sqlValue = string.Format("update {0} set {1}='{2}' where {3}='{4}'", tableName, fieldName, fieldValue, condKey, condValue); ; + string sqlValue = string.Format("update {0} set {1}='{2}' where {3}='{4}'", tableName, fieldName, fieldValue, condKey, condValue); return SqlHelper.ExecuteNonQuery(sqlValue); } @@ -988,6 +988,10 @@ namespace Lskj.Business.Impl { field += ",UnionValue"; } + if (dataTable.Columns.Contains("RememberValue")) + { + field += ",RememberValue"; + } string sqlValue = string.Format(@"select id,controlLeft,controlTop,controlWidth,controlHeight,controlType as fieldTypeId,controlName as fieldName,controlLabel as userName,'' DataFormat, defaultValue,sourceSql as lookupSql,keyField as lookupKeyField,resultField as lookupResult,edited,checkCond,InputHintText{0} diff --git a/插件库/Lskj.Business/Impl/BaseSpecImpl.cs b/插件库/Lskj.Business/Impl/BaseSpecImpl.cs index 4cd0613..443efdf 100644 --- a/插件库/Lskj.Business/Impl/BaseSpecImpl.cs +++ b/插件库/Lskj.Business/Impl/BaseSpecImpl.cs @@ -72,7 +72,7 @@ namespace Lskj.Business.Impl maxNum += "9"; } - string sqlValue = string.Format("select max(cast(SpeciesNo as bigint))+1 from {0} where {1} like '{2}{3}'", tableName, parentKey, parentValue, maxdivision); + string sqlValue = string.Format("select max(cast({1} as bigint))+1 from {0} where {1} like '{2}{3}'", tableName, parentKey, parentValue, maxdivision); string maxNo = GetResult(sqlValue) + ""; if (string.IsNullOrWhiteSpace(maxNo)) @@ -87,31 +87,4 @@ namespace Lskj.Business.Impl return maxNum; // 取未使用的编号 - sqlValue = string.Format("select cast({1} as bigint) as SpeciesNo from {0} where {1} like '{2}{3}' order by {1}", tableName, parentKey, parentValue,maxdivision); - DataTable table = GetDataTableResult(sqlValue); - - Int64 speciesNo = table.Rows.Count > 0 ? Convert.ToInt64(table.Rows[0]["SpeciesNo"] + "") : 0; - if (speciesNo != Int64.Parse(parentValue + PrefixNum+"1")) - return parentValue +PrefixNum+"1";; - - foreach (DataRow item in table.Rows) - { - Int64 rowSpeciesNo = Convert.ToInt64(item["SpeciesNo"] + ""); - if (speciesNo == rowSpeciesNo) continue; - - if (rowSpeciesNo != speciesNo + 1) - { - maxNo = (speciesNo + 1).ToString(); - maxNo = maxNo.PadLeft(parentValue.Length + firstNode.Length, '0'); - - break; - } - - speciesNo = rowSpeciesNo; - } - } - - return maxNo; - } - } -} + sqlValue = string.Format("select cast({1} as bigint) as SpeciesNo from {0} where {1} like '{2}{ \ No newline at end of file diff --git a/插件库/Lskj.Business/Impl/BillImpl.cs b/插件库/Lskj.Business/Impl/BillImpl.cs index 76588aa..f19e9c3 100644 --- a/插件库/Lskj.Business/Impl/BillImpl.cs +++ b/插件库/Lskj.Business/Impl/BillImpl.cs @@ -84,9 +84,6 @@ namespace Lskj.Business.Impl DataSet dataSet = SqlHelper.ExecuteDataSet(CommandType.StoredProcedure, newVer == 0 ? "P_BillSavePr_3" : "P_BillSavePr70", "billSave", param); - tipMsg = pMsg.Value.ToString(); - if (newVer == 1 && billWay == 1) billNo = tipMsg; - if (Convert.ToInt32(returnValue.Value + "") == -1&& SqlHelper.ConnectionType == ConnectionType.SqlServer) { SqlStoredProcedurepPrompt.GenerateBillSaveScript( masterSql, detailSql, detailTable, billNo, detailGuid, billSeq, billWay, comfirm,auditFlag ,newVer); @@ -96,6 +93,9 @@ namespace Lskj.Business.Impl SqlStoredProcedurepPrompt.GenerateBillSaveScript_DM(detailSql, SqlHelper.LastFailureSql, detailTable, detailGuid); } + tipMsg = pMsg.Value.ToString(); + if (newVer == 1 && billWay == 1) billNo = tipMsg; + return Convert.ToInt32(returnValue.Value + ""); } } diff --git a/插件库/Lskj.Business/Impl/MainImpl.cs b/插件库/Lskj.Business/Impl/MainImpl.cs index d80f65e..76edfdc 100644 --- a/插件库/Lskj.Business/Impl/MainImpl.cs +++ b/插件库/Lskj.Business/Impl/MainImpl.cs @@ -200,9 +200,13 @@ namespace Lskj.Business.Impl public static int UpdatePassword(string userId, string beforePass, string afterPass) { // 检查用户是否存在 + //string sqlValue = string.Format("select password from P_EmployeeTab WHERE sign=0 and UseFlag=1 and EmployeeId='{0}' order by loginaccount", userId); + //string password = SqlHelper.ExecuteString("password", sqlValue); + //if (string.IsNullOrWhiteSpace(password)) return 0; + DataTable dtTable = GetEmployeeList(userId); + if (dtTable.Rows.Count == 0) return 0; string sqlValue = string.Format("select password from P_EmployeeTab WHERE sign=0 and UseFlag=1 and EmployeeId='{0}' order by loginaccount", userId); string password = SqlHelper.ExecuteString("password", sqlValue); - if (string.IsNullOrWhiteSpace(password)) return 0; //md5加密密码 string mdpassword = SHAHelper.GetMd5Hash(afterPass); @@ -212,7 +216,7 @@ namespace Lskj.Business.Impl // 检查旧密码是否一致 - if (!password.Equals(beforePass)) return 2; + if (!password.Equals(beforePass)&&!string.IsNullOrWhiteSpace(password)) return 2; sqlValue = string.Format("update P_EmployeeTab set password='{0}' where EmployeeId='{1}' select @@ROWCOUNT", afterPass, userId); @@ -1301,28 +1305,4 @@ namespace Lskj.Business.Impl string sqlvalue = $@"SELECT COLUMN_NAME FROM INFORMATION_SCHEMA.columns WHERE TABLE_NAME = '{tableName}' AND COLUMNPROPERTY(OBJECT_ID('{tableName}'),COLUMN_NAME,'IsIdentity')= 1;"; if (SqlHelper.ConnectionType == ConnectionType.DmServer) - { - sqlvalue = $@"select a.NAME from SYS.SYSCOLUMNS a,sysobjects b - where b.id = a.id and b.name = '{tableName}' and a.info2 = 1;"; - } - return BaseImpl.GetResult(sqlvalue) + ""; - } - - /// - /// 获取表格属性 - /// - /// - public static DataTable GetDatabaseProperty(string tableName) - { - string sqlvalue = $@"select COLUMN_NAME,DATA_TYPE,CHARACTER_MAXIMUM_LENGTH from information_schema.columns - where table_name = '{tableName}';"; - if (SqlHelper.ConnectionType == ConnectionType.DmServer) - { - sqlvalue = $@"SELECT COLUMN_NAME, DATA_TYPE, DATA_LENGTH AS CHARACTER_MAXIMUM_LENGTH - FROM ALL_TAB_COLUMNS WHERE TABLE_NAME = '{tableName}';"; - } - return BaseImpl.GetDataTableResult(sqlvalue); - } - - } -} \ No newline at end of file + \ No newline at end of file diff --git a/插件库/Lskj.Business/Impl/SystemInfo.cs b/插件库/Lskj.Business/Impl/SystemInfo.cs index 13458cf..805456f 100644 --- a/插件库/Lskj.Business/Impl/SystemInfo.cs +++ b/插件库/Lskj.Business/Impl/SystemInfo.cs @@ -320,6 +320,7 @@ namespace Lskj.Business Instance.isBlankCellColor = item.Table.Columns.Contains("isBlankCellColor") && !string.IsNullOrEmpty(item["isBlankCellColor"] + "") ? "1".Equals(item["isBlankCellColor"] + "") : false; Instance.ModuleSpecialDrag = item.Table.Columns.Contains("ModuleSpecialDrag") && !string.IsNullOrEmpty(item["ModuleSpecialDrag"] + "") ? "1".Equals(item["ModuleSpecialDrag"] + "") : false; Instance.ViewPwd = item.Table.Columns.Contains("ViewPwd") && !string.IsNullOrEmpty(item["ViewPwd"] + "") ? "1".Equals(item["ViewPwd"] + "") : false; + Instance.LoginAnnouncement = item.Table.Columns.Contains("LoginAnnouncement") && !string.IsNullOrEmpty(item["LoginAnnouncement"] + "") ? "1".Equals(item["LoginAnnouncement"] + "") : false; } /// @@ -1086,4 +1087,7 @@ namespace Lskj.Business public int SubscriptRefreshTime; /// /// 盛邦的Lims加密Key - /// < \ No newline at end of file + /// + public string CDSBLimsPrivateKey; + /// + /// 流转记录sql不拼 \ No newline at end of file