opensource/RuoYi-Vue-Plus
2
0
Fork 1
mirror of https://gitee.com/dromara/RuoYi-Vue-Plus.git synced 2026-09-16 16:54:41 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix 修复 防止tenantId出现sql注入问题

Browse Source
This commit is contained in:
疯狂的狮子Li 2026-08-17 18:04:58 +08:00
parent c3a83c11d5
commit 0498ba2e41
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
ruoyi-common/ruoyi-common-tenant/src/main/java/org/dromara/common/tenant/handle/PlusTenantLineHandler.java
View File

@ -8,6 +8,7 @@ import net.sf.jsqlparser.expression.Expression;
import net.sf.jsqlparser.expression.NullValue; import net.sf.jsqlparser.expression.NullValue;
import net.sf.jsqlparser.expression.StringValue; import net.sf.jsqlparser.expression.StringValue;
import org.dromara.common.core.utils.StringUtils; import org.dromara.common.core.utils.StringUtils;
import org.dromara.common.core.utils.sql.SqlUtil;
import org.dromara.common.tenant.helper.TenantHelper; import org.dromara.common.tenant.helper.TenantHelper;
import org.dromara.common.tenant.properties.TenantProperties; import org.dromara.common.tenant.properties.TenantProperties;
@ -32,7 +33,7 @@ public class PlusTenantLineHandler implements TenantLineHandler {
return new NullValue(); return new NullValue();
} }
// 返回固定租户 // 返回固定租户
return new StringValue(tenantId); return new StringValue(SqlUtil.escapeOrderBySql(tenantId));
} }
@Override @Override