cyf/lserp_cs_6.0
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

SVN r1189

Browse Source 
SVN-Revision: r1189
This commit is contained in:
cyf
2026-06-01 01:42:40 +00:00
parent 29490ec187
commit 6245aa0768
6 changed files with 50 additions and 65 deletions
Download Patch File Download Diff File Expand all files Collapse all files
插件库/Lskj.Business/Impl/AttachImpl.cs
+28 -4
View File
@@ -353,12 +353,36 @@ namespace Lskj.Business.Impl
DataTable dt = SqlHelper.ExecuteDataTable(sqlValue, new SqlParameter[] { new SqlParameter("@sName", sName) });
if (dt.Rows.Count > 1)
{
string webpath11 = Lskj.Web.Core.Util.FileUtil.UrlEncode(HttpUtility.UrlDecode(webpath), false);
//if (!webpath.StartsWith("%")) webpath = "%" + webpath;
sqlValue = string.Format("select * from P_fm_FileTab where sName='{0}' and (webpath like '%{1}' )", sName, webpath11);
//string webpath11 = Lskj.Web.Core.Util.FileUtil.UrlEncode(HttpUtility.UrlDecode(webpath), false);
////if (!webpath.StartsWith("%")) webpath = "%" + webpath;
//sqlValue = string.Format("select * from P_fm_FileTab where sName='{0}' and (webpath like '%{1}' )", sName, webpath11);
//sqlValue = string.Format("select * from P_fm_FileTab where sName='{0}' and (webpath like '%{1}' or webpath like '%{2}' or webpath like '%{3}')", sName, webpath, HttpUtility.UrlDecode(webpath).Replace("#", "%23").Replace("%2f", "/").Replace("（", "%ef%bc%88").Replace("）", "%ef%bc%89"), HttpUtility.UrlDecode(webpath));
dt = SqlHelper.ExecuteDataTable(sqlValue);
//dt = SqlHelper.ExecuteDataTable(sqlValue);
// 解码一次，统一处理路径
string decodePath = HttpUtility.UrlDecode(webpath);
// 统一构造三种匹配格式（原始、解码、格式化编码）
string formatPath = decodePath
.Replace("#", "%23")
.Replace("%2f", "/")
.Replace("（", "%ef%bc%88")
.Replace("）", "%ef%bc%89");
// 完全参数化 SQL，彻底杜绝 SQL 注入！
sqlValue = @"SELECT * FROM P_fm_FileTab
WHERE sName = @sName
AND (webpath LIKE @path1
OR webpath LIKE @path2
OR webpath LIKE @path3)";
dt = SqlHelper.ExecuteDataTable(sqlValue,
new SqlParameter("@sName", sName),
new SqlParameter("@path1", "%" + webpath),
new SqlParameter("@path2", "%" + formatPath),
new SqlParameter("@path3", "%" + decodePath)
);
}
return dt.Rows.Count > 0 ? dt.Rows[0] : null;