mirror of
https://github.com/dromara/RuoYi-Vue-Plus.git
synced 2026-08-18 17:21:06 +00:00
fix 修复 防止tenantId出现sql注入问题
This commit is contained in:
+2
-1
@@ -8,6 +8,7 @@ import net.sf.jsqlparser.expression.Expression;
|
||||
import net.sf.jsqlparser.expression.NullValue;
|
||||
import net.sf.jsqlparser.expression.StringValue;
|
||||
import org.dromara.common.core.utils.StringUtils;
|
||||
import org.dromara.common.core.utils.sql.SqlUtil;
|
||||
import org.dromara.common.tenant.helper.TenantHelper;
|
||||
import org.dromara.common.tenant.properties.TenantProperties;
|
||||
|
||||
@@ -32,7 +33,7 @@ public class PlusTenantLineHandler implements TenantLineHandler {
|
||||
return new NullValue();
|
||||
}
|
||||
// 返回固定租户
|
||||
return new StringValue(tenantId);
|
||||
return new StringValue(SqlUtil.escapeOrderBySql(tenantId));
|
||||
}
|
||||
|
||||
@Override
|
||||
|
||||
Reference in New Issue
Block a user