#weaver-njpmsreport-2# 修复漏洞

devlop
shilei 10 months ago
parent 1bb01f6085
commit 5706027a6b

@ -701,21 +701,21 @@ public class ProjectColumnsController {
*
* @return
*/
@GetMapping("/queryTableData")
@WeaPermission(publicPermission = true)
public WeaResult<Object> queryTableData(HttpServletRequest request){
int pageNo = CommonUtils.getIntValue(request.getParameter("pageNo"),1);
int pageSize = CommonUtils.getIntValue(request.getParameter("pageSize"),20);
String tablename = CommonUtils.null2String(request.getParameter("tablename"));
String sourceType = CommonUtils.null2String(request.getParameter("sourceType"));
String groupId = CommonUtils.null2String(request.getParameter("groupId"));
String datakey = CommonUtils.null2String(request.getParameter("datakey"));
String datavalue = CommonUtils.null2String(request.getParameter("datavalue"));
List<Map<String, Object>> recordList = columnsUtils.queryTableData(sourceType,groupId,tablename,pageNo,pageSize,datakey,datavalue);
return WeaResult.success(recordList);
}
// @GetMapping("/queryTableData")
// @WeaPermission(publicPermission = true)
// public WeaResult<Object> queryTableData(HttpServletRequest request){
//
// int pageNo = CommonUtils.getIntValue(request.getParameter("pageNo"),1);
// int pageSize = CommonUtils.getIntValue(request.getParameter("pageSize"),20);
// String tablename = CommonUtils.null2String(request.getParameter("tablename"));
// String sourceType = CommonUtils.null2String(request.getParameter("sourceType"));
// String groupId = CommonUtils.null2String(request.getParameter("groupId"));
// String datakey = CommonUtils.null2String(request.getParameter("datakey"));
// String datavalue = CommonUtils.null2String(request.getParameter("datavalue"));
//
// List<Map<String, Object>> recordList = columnsUtils.queryTableData(sourceType,groupId,tablename,pageNo,pageSize,datakey,datavalue);
// return WeaResult.success(recordList);
// }
// @GetMapping("/getprojectcount")

@ -271,7 +271,14 @@ public class ProjectDownloadController {
String otherid = CommonUtils.null2String(request.getParameter("otherid")).trim();
if(StringUtils.isBlank(otherid)){
String pkey = "pms.knowledgeshare.others" ;
String userids = columnsUtils.getUfPropData(pkey,tenant_key);
log.error("userids:"+userids);
if(StringUtils.isNotBlank(userids)){
permissionEmployee = userids ;
}
otherid = permissionEmployee;
log.error("otherid:"+otherid);
}
String xm_id = CommonUtils.null2String(request.getParameter("xmid")).trim();
String xm_mc = CommonUtils.null2String(request.getParameter("xmmc")).trim();

@ -1,199 +0,0 @@
package com.weaver.seconddev.njprojectreport.controller;
import com.alibaba.fastjson.JSON;
import com.alibaba.fastjson.JSONArray;
import com.alibaba.fastjson.JSONObject;
import com.weaver.common.authority.annotation.WeaPermission;
import com.weaver.common.cache.tablecache.impl.ComInfoCache;
import com.weaver.project.service.RemoteMainlineService;
import com.weaver.teams.security.context.UserContext;
import com.weaver.workflow.common.util.OrgUtil;
import com.weaver.workflow.core.entity.publicApi.RequestPAResultMessageEntity;
import com.weaver.workflow.common.entity.org.WeaUser;
import com.weaver.workflow.common.framework.util.ServiceUtil;
import com.weaver.workflow.core.entity.publicApi.RequestPAResultEntity;
import com.weaver.workflow.core.services.RequestPAService;
import com.weaver.workflow.core.services.impl.RequestPAServiceImpl;
import org.apache.commons.lang3.StringUtils;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.web.bind.annotation.*;
import com.weaver.seconddev.njprojectreport.util.RequestUtil;
import javax.servlet.http.HttpServletRequest;
import java.util.HashMap;
import java.util.Map;
@RestController
@RequestMapping("/api/secondev/njpmsrequest")
public class ProjectRequestController {
//日志
private final Logger log = LoggerFactory.getLogger(ProjectRequestController.class);
public String tenant_key = "t7akvdnf84" ;
/**
*
* @param request
* @return
*/
@RequestMapping({"/doCreateRequest"})
@WeaPermission(publicPermission = true)
public RequestPAResultEntity doCreateRequest(HttpServletRequest request) {
log.info("doCreateRequest");
RequestPAResultEntity paResult = new RequestPAResultEntity();
Long employeeId = UserContext.getCurrentEmployeeId();
String requestname = "验收项目知识分享流程超时未提交提醒" ;
String remark = "请尽快提交" ;
String userId = request.getParameter("userId");
String workflowId = request.getParameter("workflowId");
String isnextflow = request.getParameter("isnextflow");
String requestLevel= request.getParameter("requestLevel");
String managerid = request.getParameter("managerid");
String mainlineid = request.getParameter("mainlineid");
if(StringUtils.isBlank(requestLevel)){
requestLevel = "0";
}
if(StringUtils.isBlank(isnextflow)){
isnextflow = "0";
}
log.info("doCreateRequest-userId:"+userId);
log.info("doCreateRequest-workflowId:"+workflowId);
log.info("doCreateRequest-isnextflow:"+isnextflow);
log.info("doCreateRequest-requestLevel:"+requestLevel);
log.info("doCreateRequest-managerid:"+managerid);
log.info("doCreateRequest-mainlineid:"+mainlineid);
if(StringUtils.isBlank(workflowId)){
RequestPAResultMessageEntity resultMessage = new RequestPAResultMessageEntity();
resultMessage.setErrcode("300");
resultMessage.setErrmsg("获取创建的流程为空,无法提交");
paResult.setMessage(resultMessage);
return paResult;
}
if(StringUtils.isBlank(userId)){
RequestPAResultMessageEntity resultMessage = new RequestPAResultMessageEntity();
resultMessage.setErrcode("300");
resultMessage.setErrmsg("获取创建人为空,无法提交");
paResult.setMessage(resultMessage);
return paResult;
}
// if(StringUtils.isBlank(managerid)){
// RequestPAResultMessageEntity resultMessage = new RequestPAResultMessageEntity();
// resultMessage.setErrcode("300");
// resultMessage.setErrmsg("项目的项目经理为空,无法提交");
// paResult.setMessage(resultMessage);
// return paResult;
// }
//
// if(StringUtils.isBlank(mainlineid)){
// RequestPAResultMessageEntity resultMessage = new RequestPAResultMessageEntity();
// resultMessage.setErrcode("300");
// resultMessage.setErrmsg("项目编码空,无法提交");
// paResult.setMessage(resultMessage);
// return paResult;
// }
String managerSubcompanyId = "" ;
String mainlinename = "" ;
String username = "";
// if(StringUtils.isNotEmpty(userId)){
// HrmEmployeeComInfo hrmEmployeeComInfo = comInfoCache.getCacheById(HrmEmployeeComInfo.class,userId) ;
// username = CommonUtils.null2String(hrmEmployeeComInfo.getUsername()+"") ;
// }
//
// if(StringUtils.isNotEmpty(managerid)){
// HrmEmployeeComInfo hrmEmployeeComInfo = comInfoCache.getCacheById(HrmEmployeeComInfo.class,managerid) ;
// managerSubcompanyId = CommonUtils.null2String(hrmEmployeeComInfo.getSubcompanyId()+"") ;
// }
// if(StringUtils.isNotEmpty(mainlineid)){
// SimpleMainline simpleMainline = remoteMainlineService.get(Long.parseLong(mainlineid),tenant_key);
// log.info("simpleMainline:"+simpleMainline.toString());
// Map<String, Object> recordMap = RequestUtil.getmainlinename(mainlineid,tenant_key);
// if(recordMap !=null && recordMap.size()>0){
// mainlinename = CommonUtils.null2String(recordMap.get("name"));
// }
// }
Map<String, Object> requestMap = new HashMap<String, Object>();
requestMap.put("userId",userId);
requestMap.put("workflowId",workflowId);
requestMap.put("requestname",requestname);
requestMap.put("remark",remark);
requestMap.put("isnextflow",isnextflow);
requestMap.put("requestLevel",requestLevel);
JSONObject formData = new JSONObject();
JSONArray dataDetails = new JSONArray();
JSONObject dataDetail = new JSONObject();
dataDetail.put("dataKey","resource_n");
dataDetail.put("content",employeeId);
dataDetails.add(dataDetail);
// dataDetail = new JSONObject();
// dataDetail.put("dataKey","mutiresource");
// dataDetail.put("content",managerid);
// dataDetails.add(dataDetail);
dataDetail = new JSONObject();
dataDetail.put("dataKey","fenbu");
dataDetail.put("content",managerSubcompanyId);
dataDetails.add(dataDetail);
// dataDetail = new JSONObject();
// dataDetail.put("dataKey","Project");
// dataDetail.put("content",mainlineid);
// dataDetails.add(dataDetail);
dataDetail = new JSONObject();
dataDetail.put("dataKey","description");
dataDetail.put("content","1111");
dataDetails.add(dataDetail);
dataDetail = new JSONObject();
dataDetail.put("dataKey","duohangwenbenhtml");
dataDetail.put("content","<p>项目:"+mainlinename+" 未提交<第三集团军知识分享提交流程>,请务必尽快提交,如有疑问,请联系:"+username+"</p>");
dataDetails.add(dataDetail);
formData.put("dataDetails",dataDetails);
requestMap.put("formData",formData);
log.info("doCreateRequest-create:params:{}", JSON.toJSONString(requestMap));
WeaUser user = getUser(Long.parseLong(userId));
RequestPAService paService = (RequestPAService) ServiceUtil.getService(RequestPAServiceImpl.class, user);
return paService.create(requestMap);
}
/***
*
* @param userId
* @return
*/
private WeaUser getUser(long userId) {
if (userId > 0L) {
WeaUser user = OrgUtil.getUser(userId);
if (user != null && user.getUserId() != null && user.getUserId() > 0L) {
return user;
}
}
return null;
}
}

@ -330,9 +330,7 @@ public class ColumnsUtils {
}else{
zt = "5";
}
log.info("zt:"+zt);
}else{
log.info("actual_val_date:"+actual_val_date);
int yqys = 0;
dataSql = " select p.requestname,l.requestid,ifnull(yqys,0) as yqys\n" +
@ -391,9 +389,22 @@ public class ColumnsUtils {
requestid = CommonUtils.null2String(recordList.get(0).get("requestid"));
}
dataSql = " select timestampdiff(month,date_add('"+actual_val_date+"', interval (2+"+yqys+") month),now()) as sjc " ;
yqys = yqys + 2;
dataSql = " select timestampdiff(month,date_add(?, interval(?) month),now()) as sjc " ;
log.error("dataSql:"+dataSql);
result = databaseUtils.execute(sourceType, groupId, dataSql);
List<SqlParamEntity> sqlparam5 = new ArrayList<SqlParamEntity>();
SqlParamEntity sqlParamEntity5 = new SqlParamEntity();
sqlParamEntity5.setParamType(SqlParamType.VARCHAR);
sqlParamEntity5.setValue(actual_val_date);
sqlparam5.add(sqlParamEntity5);
sqlParamEntity5 = new SqlParamEntity();
sqlParamEntity5.setParamType(SqlParamType.INTEGER);
sqlParamEntity5.setValue(yqys+"");
sqlparam5.add(sqlParamEntity5);
result = databaseUtils.executeForQuery(sourceType, groupId, dataSql,sqlparam5);
recordList = databaseUtils.getDataSourceList(result);
if(CollectionUtils.isNotEmpty(recordList)){
String sjc = String.valueOf(recordList.get(0).get("sjc"));
@ -875,7 +886,13 @@ public class ColumnsUtils {
String sqlwhere = "" ;
log.error("subcompanyids:"+subcompanyids);
if(StringUtils.isNotBlank(subcompanyids)){
sqlwhere = " and d.subcompanyid in("+subcompanyids+")";
sqlwhere = " and d.subcompanyid in(?)";
sqlParamEntity = new SqlParamEntity();
sqlParamEntity.setParamType(SqlParamType.VARCHAR);
sqlParamEntity.setValue(subcompanyids);
sqlparam.add(sqlParamEntity);
}
if(StringUtils.isBlank(xm_ysrq_start)){
@ -908,23 +925,49 @@ public class ColumnsUtils {
}
if(StringUtils.isNotBlank(xm_mc)){
sqlwhere += " and m.name like '%"+xm_mc+"%'" ;
sqlwhere += " and m.name like '%?%'" ;
sqlParamEntity = new SqlParamEntity();
sqlParamEntity.setParamType(SqlParamType.VARCHAR);
sqlParamEntity.setValue(xm_mc);
sqlparam.add(sqlParamEntity);
}
if(StringUtils.isNotBlank(xm_xmjl)){
sqlwhere += " and m.manager in("+xm_xmjl+")" ;
sqlwhere += " and m.manager in(?)" ;
sqlParamEntity = new SqlParamEntity();
sqlParamEntity.setParamType(SqlParamType.VARCHAR);
sqlParamEntity.setValue(xm_xmjl);
sqlparam.add(sqlParamEntity);
}
if(StringUtils.isNotBlank(xm_bm)){
sqlwhere += " and d.id in ("+xm_bm+")" ;
sqlwhere += " and d.id in (?)" ;
sqlParamEntity = new SqlParamEntity();
sqlParamEntity.setParamType(SqlParamType.VARCHAR);
sqlParamEntity.setValue(xm_bm);
sqlparam.add(sqlParamEntity);
}
if(StringUtils.isNotBlank(xm_jg)){
sqlwhere += " and d.subcompanyid in ("+xm_jg+")" ;
sqlwhere += " and d.subcompanyid in (?)" ;
sqlParamEntity = new SqlParamEntity();
sqlParamEntity.setParamType(SqlParamType.VARCHAR);
sqlParamEntity.setValue(xm_jg);
sqlparam.add(sqlParamEntity);
}
if(StringUtils.isNotBlank(xm_id)){
sqlwhere += " and m.id in ("+xm_id+")" ;
sqlwhere += " and m.id in (?)" ;
sqlParamEntity = new SqlParamEntity();
sqlParamEntity.setParamType(SqlParamType.VARCHAR);
sqlParamEntity.setValue(xm_id);
sqlparam.add(sqlParamEntity);
}
sqlwhere += " order by actual_val_date desc " ;
@ -1761,7 +1804,12 @@ public class ColumnsUtils {
String sqlwhere = "" ;
log.error("subcompanyids:"+subcompanyids);
if(StringUtils.isNotBlank(subcompanyids)){
sqlwhere = " and d.subcompanyid in("+subcompanyids+")";
sqlwhere += " and d.subcompanyid in(?)";
sqlParamEntity = new SqlParamEntity();
sqlParamEntity.setParamType(SqlParamType.VARCHAR);
sqlParamEntity.setValue(subcompanyids);
sqlparam.add(sqlParamEntity);
}
if(StringUtils.isBlank(xm_ysrq_start)){
@ -1798,27 +1846,53 @@ public class ColumnsUtils {
log.error("xm_mc:"+xm_mc);
if(StringUtils.isNotBlank(xm_mc)){
sqlwhere += " and m.name like '%"+xm_mc+"%'" ;
sqlwhere += " and m.name like '%?%'" ;
sqlParamEntity = new SqlParamEntity();
sqlParamEntity.setParamType(SqlParamType.VARCHAR);
sqlParamEntity.setValue(xm_mc);
sqlparam.add(sqlParamEntity);
}
log.error("xm_xmjl:"+xm_xmjl);
if(StringUtils.isNotBlank(xm_xmjl)){
sqlwhere += " and m.manager in("+xm_xmjl+")" ;
sqlwhere += " and m.manager in(?)" ;
sqlParamEntity = new SqlParamEntity();
sqlParamEntity.setParamType(SqlParamType.VARCHAR);
sqlParamEntity.setValue(xm_xmjl);
sqlparam.add(sqlParamEntity);
}
log.error("xm_bm:"+xm_bm);
if(StringUtils.isNotBlank(xm_bm)){
sqlwhere += " and d.id in ("+xm_bm+")" ;
sqlwhere += " and d.id in (?)" ;
sqlParamEntity = new SqlParamEntity();
sqlParamEntity.setParamType(SqlParamType.VARCHAR);
sqlParamEntity.setValue(xm_bm);
sqlparam.add(sqlParamEntity);
}
log.error("xm_jg:"+xm_jg);
if(StringUtils.isNotBlank(xm_jg)){
sqlwhere += " and d.subcompanyid in ("+xm_jg+")" ;
sqlwhere += " and d.subcompanyid in (?)" ;
sqlParamEntity = new SqlParamEntity();
sqlParamEntity.setParamType(SqlParamType.VARCHAR);
sqlParamEntity.setValue(xm_jg);
sqlparam.add(sqlParamEntity);
}
log.error("xm_id:"+xm_id);
if(StringUtils.isNotBlank(xm_id)){
sqlwhere += " and m.id in ("+xm_id+")" ;
sqlwhere += " and m.id in (?)" ;
sqlParamEntity = new SqlParamEntity();
sqlParamEntity.setParamType(SqlParamType.VARCHAR);
sqlParamEntity.setValue(xm_id);
sqlparam.add(sqlParamEntity);
}
sqlwhere += " order by actual_val_date desc " ;
log.error("sqlwhere:"+sqlwhere);
@ -1944,24 +2018,24 @@ public class ColumnsUtils {
}
public List<Map<String, Object>> queryTableData(String sourceType,String groupId,String tablename,int pageNo,int pageSize,String datakey,String datavalue){
String where = "" ;
if(StringUtils.isNotBlank(datakey) && StringUtils.isNotBlank(datavalue)){
if("null".equals(datavalue)){
where += " and "+datakey+" is null" ;
}else if("notnull".equals(datavalue)){
where += " and "+datakey+" is not null" ;
}else{
where += " and "+datakey+" ='"+datavalue+"' " ;
}
}
String sql = " select * from "+tablename+" where 1=1 " + where;
sql = databaseUtils.getMysqlPagedSql(sql, pageNo, pageSize);
Map<String, Object> result = databaseUtils.execute(sourceType, groupId, sql);
List<Map<String, Object>> recordList = databaseUtils.getDataSourceList(result);
return recordList;
}
// public List<Map<String, Object>> queryTableData(String sourceType,String groupId,String tablename,int pageNo,int pageSize,String datakey,String datavalue){
//
// String where = "" ;
// if(StringUtils.isNotBlank(datakey) && StringUtils.isNotBlank(datavalue)){
// if("null".equals(datavalue)){
// where += " and "+datakey+" is null" ;
// }else if("notnull".equals(datavalue)){
// where += " and "+datakey+" is not null" ;
// }else{
// where += " and "+datakey+" ='"+datavalue+"' " ;
// }
// }
// String sql = " select * from "+tablename+" where 1=1 " + where;
// sql = databaseUtils.getMysqlPagedSql(sql, pageNo, pageSize);
// Map<String, Object> result = databaseUtils.execute(sourceType, groupId, sql);
// List<Map<String, Object>> recordList = databaseUtils.getDataSourceList(result);
// return recordList;
// }
/**

Loading…
Cancel
Save