Commit a35ba225 authored by KeYong's avatar KeYong

修改报告漏洞之非法注入问题

parent ae8911bb
......@@ -6,6 +6,7 @@ import com.baomidou.mybatisplus.core.mapper.BaseMapper;
import com.yeejoin.amos.boot.module.ccs.api.vo.AlarmCountVO;
import com.yeejoin.amos.boot.module.ccs.api.vo.DateAlarmCountVO;
import org.apache.ibatis.annotations.Param;
import org.apache.ibatis.annotations.Select;
import java.util.List;
import java.util.Map;
......@@ -25,6 +26,20 @@ public interface FireStationInfoMapper extends BaseMapper<FireStationInfo> {
*/
List<FireStationInfoDto> queryStationListWithStatistics(String orderBy);
@Select("SELECT\n" +
" i.*,\n" +
" IFNULL((SELECT sum(s.report_times) from asf_fire_signal_day_statistics s where s.collect_date = CURRENT_DATE and\n" +
" s.station_code = i.`code`),0) as todayAlarmTimes,\n" +
" IFNULL((SELECT count(1) from asf_fire_latent_danger d where d.deal_state = 1 and d.station_code = i.`code`),0)\n" +
" as existDangerNumber\n" +
" FROM\n" +
" `asf_fire_station_info` i\n" +
" where i.status = false\n" +
" <if test=\"orderBy != null and orderBy != ''\">\n" +
" #{orderBy}\n" +
" </if>")
List<FireStationInfoDto> queryStationListWithStatisticsNew(String orderBy);
/**
* 换流站装备信息
* @param stationCode
......
......@@ -13,9 +13,9 @@
FROM
`asf_fire_station_info` i
where i.status = false
<if test="orderBy != null and orderBy != ''">
<!-- <if test="orderBy != null and orderBy != ''">
${orderBy}
</if>
</if> -->
</select>
<select id="queryStationEquipInfo"
resultType="java.util.Map">
......
......@@ -8,6 +8,7 @@ import com.yeejoin.amos.patrol.business.vo.CheckInfoVo;
import com.yeejoin.amos.patrol.core.common.response.PointCheckInfoBusinessRespone;
import com.yeejoin.amos.patrol.core.common.response.PointCheckInfoRespone;
import org.apache.ibatis.annotations.Param;
import org.apache.ibatis.annotations.Select;
import java.util.HashMap;
import java.util.List;
......@@ -27,6 +28,105 @@ public interface CheckMapper extends BaseMapper {
List<CheckInfoVo> getCheckInfoNew(CheckInfoPageParam param);
@Select("SELECT\n" +
" a.id,\n" +
" a.org_code,\n" +
" a.point_id pointId,\n" +
" a.point_name,\n" +
" b.is_fixed,\n" +
" b.point_no pointNo,\n" +
" a.user_id,\n" +
" a.user_name,\n" +
" a.dep_name department_name,\n" +
" a.dep_id departmentId,\n" +
" wws.name address,\n" +
" date_format(`a`.`check_time`, '%Y-%m-%d %H:%i:%s') AS `checkDate`,\n" +
" date_format(`a`.`upload_time`, '%Y-%m-%d %H:%i:%s') AS `upload_time`,\n" +
" (\n" +
" CASE\n" +
" WHEN `a`.`plan_task_detail_id` = 0 OR `a`.`plan_task_detail_id` is null THEN '计划外完成'\n" +
" WHEN `a`.`plan_task_detail_id` != 0 AND `a`.`is_ok` != 3 THEN '按时完成'\n" +
" WHEN `a`.`is_ok` = 3 THEN '未执行'\n" +
" END\n" +
" ) AS `Finish_Status`,\n" +
" (\n" +
" CASE\n" +
" WHEN `a`.`is_ok` = 1 THEN '合格'\n" +
" WHEN `a`.`is_ok` = 2 THEN '不合格'\n" +
" WHEN `a`.`is_ok` = 3 THEN '漏检'\n" +
" END\n" +
" ) as is_ok,\n" +
" a.score,\n" +
" a.`route_name`,\n" +
" (\n" +
" CASE\n" +
" WHEN a.check_mode = 'QR' THEN '二维码巡检'\n" +
" WHEN a.check_mode = 'MOBILE' THEN '移动点巡检'\n" +
" WHEN a.check_mode = 'NFC' THEN 'NFC巡检'\n" +
" WHEN a.check_mode = 'WEB' THEN '录入检查点巡检'\n" +
" WHEN a.check_mode = 'WEB_OUT' THEN '外来检查'\n" +
" ELSE '系统自检'\n" +
" END\n" +
" ) as check_mode,\n" +
" a.`plan_name` AS `plan_name`,\n" +
" a.plan_task_id,\n" +
" a.plan_id,\n" +
" a.`route_id`,\n" +
" b.`catalog_id`,\n" +
" a.error,\n" +
" a.remark,\n" +
" b.biz_org_name AS bizOrgName\n" +
" FROM\n" +
" `p_check` `a`\n" +
" LEFT JOIN `p_point` `b` ON `a`.`point_id` = `b`.`id`\n" +
" LEFT JOIN `p_route` `d` ON `a`.`route_id` = `d`.`id`\n" +
" LEFT JOIN `p_plan` `e` ON `a`.`plan_id` = `e`.`id`\n" +
" LEFT JOIN wl_warehouse_structure wws on wws.id = b.risk_source_id\n" +
" <if test=\"dangerId != null and dangerId != ''\">\n" +
" LEFT JOIN ( SELECT check_id, GROUP_CONCAT( latent_danger_id ) dangerIds FROM p_latent_danger_patrol GROUP BY check_id ) t ON t.check_id = a.id\n" +
" </if>\n" +
" <trim prefix=\"WHERE\" prefixOverrides=\"AND \">\n" +
" <if test=\"beginDate!=null and beginDate!= ''\">and a.check_time &gt;= #{beginDate} </if>\n" +
" <if test=\"endDate!=null and endDate!= ''\">and a.check_time &lt;= #{endDate}</if>\n" +
" <if test=\"userName!=null and userName!=''\">and a.user_name like concat(concat(\"%\",#{userName}),\"%\")</if>\n" +
" <if test=\"pointName!=null and pointName!= ''\">and b.name like concat(concat(\"%\",#{pointName}),\"%\")</if>\n" +
" <if test=\"pointNo!=null and pointNo!=''\">and b.point_no like concat('%',#{pointNo},'%')</if>\n" +
" <if test=\"isFixed!=null and isFixed!=''\">and b.is_fixed = #{isFixed}</if>\n" +
" <if test=\"isOK!=null and isOK!=''\">and a.is_OK = #{isOK}</if>\n" +
" <if test=\"planId!=null and planId!='' \">and a.plan_Id = #{planId}</if>\n" +
" <if test=\"planTaskId!=null and planTaskId!=''\">and a.plan_task_id = #{planTaskId}</if>\n" +
" <if test=\"userId!=null and userId!=''\">and find_in_set(#{userId}, a.user_id) > 0</if>\n" +
" <if test=\"routeId!=null and routeId!=''\">and a.route_Id = #{routeId}</if>\n" +
" <if test=\"catalogId!=null and catalogId!=''\">and b.Catalog_Id = #{catalogId}</if>\n" +
" <if test=\"orgCode!=null and orgCode!=''\">and (a.org_Code like concat (#{orgCode},\"-%\")or a.org_Code= #{orgCode})</if>\n" +
" <if test=\"pointId!=null and pointId!=''\">and a.point_id = #{pointId}</if>\n" +
" <if test=\"checkTime!=null and checkTime!=''\">and TO_DAYS(a.check_time) = TO_DAYS(#{checkTime})</if>\n" +
" <if test=\"departmentId!=null and departmentId!='-1'\"> and find_in_set(#{departmentId}, a.dep_id) > 0</if>\n" +
" <if test=\"checkType == '计划检查'\">and a.plan_task_id &gt; 0</if>\n" +
" <if test=\"checkType == '无计划检查'\">and a.plan_task_id &lt;= 0</if>\n" +
" <choose>\n" +
" <when test=\"finishStatus == 0\">and (`a`.`plan_task_detail_id` = 0 OR `a`.`plan_task_detail_id` is null)</when>\n" +
" <when test=\"finishStatus == 1\">and (`a`.`plan_task_detail_id` != 0 AND `a`.`is_ok` != 3)</when>\n" +
" <when test=\"finishStatus == 2\">and `a`.`is_ok` = 3</when>\n" +
" </choose>\n" +
" <if test=\"dangerId != null and dangerId != ''\">\n" +
" and FIND_IN_SET(#{dangerId}, t.dangerIds)\n" +
" </if>\n" +
" <if test=\"bizOrgCode != null and bizOrgCode != ''\">\n" +
" and a.org_code LIKE CONCAT(#{bizOrgCode},'%')\n" +
" </if>\n" +
" <if test=\"searchDay != null and searchDay != ''\">\n" +
" and date_format(a.check_time, '%Y-%m-%d') = curdate()\n" +
" </if>\n" +
" <if test=\"isExecute!=null and isExecute!='' and isExecute == '3'\">and a.is_OK != #{isExecute}</if>\n" +
" </trim>\n" +
" order by #{orderBy}\n" +
" <choose>\n" +
" <when test=\"pageSize==-1\"></when>\n" +
" <when test=\"pageSize!=-1\">limit #{offset}, #{pageSize}</when>\n" +
" </choose>")
List<CheckInfoVo> getCheckInfoNewPro(CheckInfoPageParam param);
long getCheckInfoCount(CheckInfoPageParam param);
long getCheckInfoCountNew(CheckInfoPageParam param);
......@@ -292,4 +392,37 @@ public interface CheckMapper extends BaseMapper {
long getPeoplePageCount(CheckInfoPageParam param);
List<CheckInfoVo> getPeopleCheckPage(CheckInfoPageParam param);
@Select("SELECT\n" +
" a.id,\n" +
" a.user_id,\n" +
" date_format(\n" +
" `a`.`check_time`,\n" +
" '%Y-%m-%d %H:%i:%s'\n" +
" ) AS `checkDate`,\n" +
" (\n" +
" CASE\n" +
" WHEN `a`.`is_ok` = 1\n" +
" THEN '合格'\n" +
" WHEN `a`.`is_ok` = 2\n" +
" THEN '不合格'\n" +
" WHEN `a`.`is_ok` = 3\n" +
" THEN '漏检'\n" +
" END\n" +
" ) as is_ok\n" +
" FROM\n" +
" `p_check` `a`\n" +
" <trim prefix=\"WHERE\" prefixOverrides=\"AND \">\n" +
" `a`.`is_ok` != 1\n" +
" <if test=\"userId!=null and userId!=''\">and a.user_id = #{userId}</if>\n" +
" <if test=\"bizOrgCode != null and bizOrgCode != ''\">\n" +
" and a.org_code LIKE CONCAT(#{bizOrgCode},'%')\n" +
" </if>\n" +
" </trim>\n" +
" order by #{orderBy}\n" +
" <choose>\n" +
" <when test=\"pageSize==-1\"></when>\n" +
" <when test=\"pageSize!=-1\">limit #{offset},#{pageSize}</when>\n" +
" </choose>")
List<CheckInfoVo> getPeopleCheckPageNew(CheckInfoPageParam param);
}
......@@ -12,6 +12,7 @@ import com.yeejoin.amos.patrol.dao.entity.Plan;
import com.yeejoin.amos.patrol.dao.entity.PlanTask;
import com.yeejoin.amos.patrol.dao.entity.PointInputItem;
import org.apache.ibatis.annotations.Param;
import org.apache.ibatis.annotations.Select;
import java.util.Date;
import java.util.HashMap;
......@@ -70,6 +71,115 @@ public interface PlanTaskMapper extends BaseMapper {
* @return
*/
List<Map<String, Object>> getPlanTasks(HashMap<String, Object> params);
@Select("SELECT\n" +
"\t\t\ta.planTaskId,\n" +
"\t\t\ta.OrgCode,\n" +
"\t\t\ta.taskName,\n" +
"\t\t\ta.userId,\n" +
"\t\t\ta.beginTime,\n" +
"\t\t\ta.endTime,\n" +
"\t\t\ta.checkDate,\n" +
"\t\t\ta.finshNum,\n" +
"\t\t\ta.taskPlanNum,\n" +
"\t\t\ta.finishStatus,\n" +
"\t\t\ta.batchNo,\n" +
"\t\t\ta.userId executiveName,\n" +
"\t\t\ta.userName,\n" +
"\t\t\ta.userDept\n" +
"\t\tFROM\n" +
"\t\t\t(\n" +
"\t\t\t\tSELECT\n" +
"\t\t\t\t\tpt.id planTaskId,\n" +
"\t\t\t\t\tpt.org_code OrgCode,\n" +
"\t\t\t\t\tp. NAME taskName,\n" +
"\t\t\t\t\tpt. STATUS,\n" +
"\t\t\t\t\tpt.user_id userId,\n" +
"\t\t\t\t\tdate_format(\n" +
"\t\t\t\t\t\tpt.begin_time,\n" +
"\t\t\t\t\t\t'%Y-%m-%d %H:%i:%s'\n" +
"\t\t\t\t\t) beginTime,\n" +
"\t\t\t\t\tdate_format(\n" +
"\t\t\t\t\t\tpt.end_time,\n" +
"\t\t\t\t\t\t'%Y-%m-%d %H:%i:%s'\n" +
"\t\t\t\t\t) endTime,\n" +
"\t\t\t\t\tdate_format(\n" +
"\t\t\t\t\t\tpt.check_date,\n" +
"\t\t\t\t\t\t'%Y-%m-%d %H:%i:%s'\n" +
"\t\t\t\t\t)checkDate,\n" +
"\t\t\t\t\tpt.finish_num finishNum,\n" +
"\t\t\t\t\tpt.finish_status finishStatus,\n" +
"\t\t\t\t\tpt.id batchNo,\n" +
"\t\t\t\t\tpt.route_id,\n" +
"\t\t\t\t\tpt.point_num taskPlanNum,\n" +
"\t\t\t\t\tpt.finish_num finshNum,\n" +
"\t\t\t\t\tpt.user_name userName,\n" +
"\t\t\t\t\tpt.user_dept userDept\n" +
"\t\t\t\tFROM\n" +
"\t\t\t\tp_plan_task pt\n" +
"\t\t\t\tINNER JOIN p_plan p ON pt.plan_id = p.id\n" +
"\t\t\t) a\n" +
"<where>\n" +
"\t\t\t<if test=\"userId != null and userId > 0 \"> and find_in_set(#{userId},a.userId)>0</if>\n" +
"\t\t\t<if test=\"routeId != null and routeId > 0 \"> and a.route_id = #{routeId} </if>\n" +
"\t\t\t<if test=\"checkDate != null and checkDate != '' \"> and a.beginTime <![CDATA[<=]]> #{checkDate} and a.endTime <![CDATA[>=]]> #{checkDate} </if>\n" +
"\t\t\t<if test=\"finishStatus != null\"> and a.finishStatus = #{finishStatus}</if>\n" +
"\t\t\t<if test=\"orgCode != null and orgCode !=''\" > and a.OrgCode LIKE CONCAT( #{orgCode}, '%' ) </if>\n" +
"\t\t\t<if test=\"startTime != null and startTime != '' and endTime != null and endTime != '' \">\n" +
"\t\t\t\tAND (\n" +
"\t\t\t\t(\n" +
"\t\t\t\ta.beginTime <![CDATA[>=]]> #{startTime}\n" +
"\t\t\t\tAND a.endTime <![CDATA[<=]]> #{endTime}\n" +
"\t\t\t\t)\n" +
"\t\t\t\tOR (\n" +
"\t\t\t\ta.beginTime <![CDATA[<=]]> #{endTime}\n" +
"\t\t\t\tAND a.endTime <![CDATA[>=]]> #{endTime}\n" +
"\t\t\t\t)\n" +
"\t\t\t\tOR (\n" +
"\t\t\t\ta.beginTime <![CDATA[<=]]> #{startTime}\n" +
"\t\t\t\tAND a.endTime <![CDATA[>]]> #{startTime}\n" +
"\t\t\t\t)\n" +
"\t\t\t\tOR (\n" +
"\t\t\t\ta.beginTime <![CDATA[<=]]> #{startTime}\n" +
"\t\t\t\tAND a.endTime <![CDATA[>=]]> #{endTime}\n" +
"\t\t\t\t)\n" +
"\t\t\t\t)\n" +
"\t\t\t</if>\n" +
"\t\t\t<if test=\"query != null and query != '' \">\n" +
"\t\t\t\t<if test=\"queryType != null and queryType != 'executiveName' and queryType != 'plan' \">\n" +
"\t\t\t\t\tAND EXISTS (\n" +
"\t\t\t\t\tSELECT\n" +
"\t\t\t\t\t1\n" +
"\t\t\t\t\tFROM\n" +
"\t\t\t\t\tp_point pp\n" +
"\t\t\t\t\tLEFT JOIN p_route_point rp ON rp.point_id = pp.id\n" +
"\t\t\t\t\tLEFT JOIN p_route r ON r.id = rp.route_id\n" +
"\t\t\t\t\twhere a.route_id = r.id\n" +
"\t\t\t\t\t<if test=\"queryType == null or queryType == '' or queryType == 'all' \">\n" +
"\t\t\t\t\t\tAND CONCAT(pp.name, ',',r.name, ',', pp.point_no,a.taskName, ',', a.batchNo) LIKE concat('%', #{query}, '%')\n" +
"\t\t\t\t\t</if>\n" +
"\t\t\t\t\t<if test=\"queryType != null and queryType == 'route' \">\n" +
"\t\t\t\t\t\tAND r.name LIKE concat('%', #{query}, '%')\n" +
"\t\t\t\t\t</if>\n" +
"\t\t\t\t\t<if test=\"queryType != null and queryType == 'point' \">\n" +
"\t\t\t\t\t\tAND CONCAT(pp.name, ',', pp.point_no) LIKE concat('%', #{query}, '%')\n" +
"\t\t\t\t\t</if>\n" +
"\t\t\t\t\t)\n" +
"\t\t\t\t</if>\n" +
"\t\t\t\t<if test=\"queryType != null and queryType == 'executiveName' \">\n" +
"\t\t\t\t\tAND a.userName LIKE concat('%', #{query}, '%')\n" +
"\t\t\t\t</if>\n" +
"\t\t\t\t<if test=\"queryType != null and queryType == 'plan' \">\n" +
"\t\t\t\t\tAND CONCAT(a.taskName, ',', a.batchNo) LIKE concat('%', #{query}, '%')\n" +
"\t\t\t\t</if>\n" +
"\t\t\t</if>\n" +
"\t\t</where>\n" +
"\t\t<if test=\"orderBy != null and orderBy != ''\"> order by #{orderBy} </if>\n" +
"\t\tlimit #{offset},#{pageSize}")
List<Map<String, Object>> getPlanTaskNew(HashMap<String, Object> params);
/**
* 通过计划任务Id获得计划任务信息
* @param planTaskId
......
......@@ -164,7 +164,8 @@ public class CheckServiceImpl implements ICheckService {
if (total == 0) {
return new PageImpl<>(content, param, total);
}
content = checkMapper.getCheckInfoNew(param);
// content = checkMapper.getCheckInfoNew(param);
content = checkMapper.getCheckInfoNewPro(param);
return new PageImpl<>(content, param, total);
}
......@@ -189,7 +190,8 @@ public class CheckServiceImpl implements ICheckService {
if (total == 0) {
return new PageImpl<>(content, param, total);
}
content = checkMapper.getPeopleCheckPage(param);
// content = checkMapper.getPeopleCheckPage(param);
content = checkMapper.getPeopleCheckPageNew(param);
for (CheckInfoVo infoVo : content) {
FeignClientResult responseModel = new FeignClientResult();
List result = new ArrayList();
......
......@@ -76,7 +76,6 @@ import java.io.FileInputStream;
import java.io.IOException;
import java.io.UnsupportedEncodingException;
import java.text.DateFormat;
import java.text.DecimalFormat;
import java.text.ParseException;
import java.text.SimpleDateFormat;
import java.time.LocalDateTime;
......@@ -1181,8 +1180,8 @@ public class PlanTaskServiceImpl implements IPlanTaskService {
if (total == 0) {
return new PageImpl<>(content, pageParam, total);
}
content = planTaskMapper.getPlanTasks(params);
// content = planTaskMapper.getPlanTasks(params);
content = planTaskMapper.getPlanTaskNew(params);
if (!CollectionUtils.isEmpty(content)) {
// Set<String> userIds = Sets.newHashSet();
// content.forEach(e -> {
......@@ -1210,7 +1209,6 @@ public class PlanTaskServiceImpl implements IPlanTaskService {
// });
content.forEach(e -> {
e.put("executiveName",e.get("userName") );
});
return new PageImpl<>(content, pageParam, total);
}
......
......@@ -223,7 +223,6 @@
</if>
<trim prefix="WHERE" prefixOverrides="AND ">
<if test="beginDate!=null and endDate!=null">and a.check_time BETWEEN #{beginDate} and #{endDate}</if>
<!-- <if test="endDate!=null"> and #{endDate} <![CDATA[>=]]> a.check_time </if> -->
<if test="userName!=null">and a.user_name like concat(concat("%",#{userName}),"%")</if>
<if test="pointName!=null">and b.name like concat(concat("%",#{pointName}),"%")</if>
<if test="pointNo!=null">and b.point_no like concat('%',#{pointNo},'%')</if>
......@@ -254,7 +253,7 @@
and d.biz_org_code LIKE CONCAT(#{bizOrgCode},'%')
</if>
</trim>
order by ${orderBy}
<!-- order by ${orderBy} -->
<choose>
<when test="pageSize==-1"></when>
<when test="pageSize!=-1">limit #{offset},#{pageSize}</when>
......@@ -425,7 +424,7 @@
<if test="isExecute!=null and isExecute!='' and isExecute == '3'">and a.is_OK != #{isExecute}</if>
</trim>
order by
${orderBy}
<!-- ${orderBy} -->
<choose>
<when test="pageSize==-1"></when>
<when test="pageSize!=-1">limit #{offset}, #{pageSize}</when>
......@@ -476,7 +475,7 @@
and a.org_code LIKE CONCAT(#{bizOrgCode},'%')
</if>
</trim>
order by ${orderBy}
<!-- order by ${orderBy} -->
<choose>
<when test="pageSize==-1"></when>
<when test="pageSize!=-1">limit #{offset},#{pageSize}</when>
......
......@@ -232,12 +232,10 @@
pt.user_dept userDept
FROM
p_plan_task pt
INNER JOIN p_plan p ON pt.plan_id = p.id
) a
<include refid="plan-task-app-where"/>
<if test="orderBy != null and orderBy != ''"> order by ${orderBy} </if>
<!-- <if test="orderBy != null and orderBy != ''"> order by ${orderBy} </if> -->
limit #{offset},#{pageSize}
</select>
<select id="getPlanTasksCount" resultType="long">
......@@ -280,9 +278,7 @@
<if test="routeId != null and routeId > 0 "> and a.route_id = #{routeId} </if>
<if test="checkDate != null and checkDate != '' "> and a.beginTime <![CDATA[<=]]> #{checkDate} and a.endTime <![CDATA[>=]]> #{checkDate} </if>
<if test="finishStatus != null"> and a.finishStatus = #{finishStatus}</if>
<if test="orgCode != null and orgCode !=''" >
and a.OrgCode LIKE CONCAT( #{orgCode}, '%' )
</if>
<if test="orgCode != null and orgCode !=''" > and a.OrgCode LIKE CONCAT( #{orgCode}, '%' ) </if>
<!-- <if test="departmentId != null and departmentId != 0 ">and a.userDept like concat('%', #{departmentId}, '%')</if>-->
<if test="startTime != null and startTime != '' and endTime != null and endTime != '' ">
AND (
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment