SQL注入新增接口错误修改

ibps-provider-root/modules/provider-business/src/main/java/com/lc/ibps/components/sqlzdy/Service/SwdlServiceImpl.java

@@ -77,8 +77,12 @@ public class SwdlServiceImpl extends GenericProvider implements SwdlService {
             if(BeanUtils.isEmpty(map.get("locationId"))){
                 map.put("locationId",getDiDian());
             }
-            map.put("shiFouQiYong","%"+map.get("shiFouQiYong")+"%");
-            map.put("daiLiRenXingM","%"+map.get("daiLiRenXingM")+"%");
+            if(BeanUtils.isNotEmpty(map.get("shiFouQiYong"))){
+                map.put("shiFouQiYong","%"+map.get("shiFouQiYong")+"%");
+            }
+            if(BeanUtils.isNotEmpty(map.get("daiLiRenXingM"))){
+                map.put("daiLiRenXingM","%"+map.get("daiLiRenXingM")+"%");
+            }
             List<Map<String,Object>> list = updateDataTableDao.selectByLocation(map);
             int totalCount = updateDataTableDao.selectByLocationCount(map);
             APIPageList<Map<String,Object>> pageList = getAPIPageList(list);
@@ -206,21 +210,26 @@ public class SwdlServiceImpl extends GenericProvider implements SwdlService {
             stringObjectHashMap.put("limit", map.get("limit"));
             stringObjectHashMap.put("startPage", map.get("startPage"));
             stringObjectHashMap.put("locationId", getDiDian());
-            ArrayList arrayList = (ArrayList) map.get("param");
-            Map map2 = (Map) arrayList.get(0);
-            ArrayList orderList = (ArrayList) map.get("order");
-            Map mapOrder = (Map) arrayList.get(0);
-            String kaoShiMingChen = (String) map2.get("kaoShiMingChen");
-            ArrayList kaoShiLeiXingList = (ArrayList) map2.get("kaoShiLeiXing");
+            Map param = (Map) map.get("param");
+            Map mapOrder = (Map)map.get("order");
+            String kaoShiMingChen = (String) param.get("kaoShiMingChen");
+       /*     ArrayList kaoShiLeiXingList = (ArrayList) param.get("kaoShiLeiXing");
             String sKaoShiLeiXing = String.join(",", kaoShiLeiXingList);
-            stringObjectHashMap.put("kaoShiLeiXing",sKaoShiLeiXing);
-            stringObjectHashMap.put("zhuangTai", String.join(",", (ArrayList)map2.get("zhuangTai")));
-            stringObjectHashMap.put("tiKuId", String.join(",", (ArrayList)map2.get("tiKuId")));
+            stringObjectHashMap.put("kaoShiLeiXing",sKaoShiLeiXing);*/
+            if(BeanUtils.isNotEmpty(param.get("kaoShiLeiXing"))){
+                stringObjectHashMap.put("kaoShiLeiXing", String.join(",", (ArrayList)param.get("kaoShiLeiXing")));
+            }
+            if(BeanUtils.isNotEmpty(param.get("zhuangTai"))){
+                stringObjectHashMap.put("zhuangTai", String.join(",", (ArrayList)param.get("zhuangTai")));
+            }
+            if(BeanUtils.isNotEmpty(param.get("tiKuId"))){
+                stringObjectHashMap.put("tiKuId", String.join(",", (ArrayList)param.get("tiKuId")));
+            }
             stringObjectHashMap.put("kaoShiMingChen",kaoShiMingChen);
-            stringObjectHashMap.put("chuangJianShiJUp",map2.get("chuangJianShiJ_Up"));
-            stringObjectHashMap.put("chuangJianShiJLower",map2.get("chuangJianShiJ_Lower"));
-            stringObjectHashMap.put("faBuShiJianUp",map2.get("faBuShiJian_Up"));
-            stringObjectHashMap.put("faBuShiJianLower",map2.get("faBuShiJian_Lower"));
+            stringObjectHashMap.put("chuangJianShiJUp",param.get("chuangJianShiJ_Up"));
+            stringObjectHashMap.put("chuangJianShiJLower",param.get("chuangJianShiJ_Lower"));
+            stringObjectHashMap.put("faBuShiJianUp",param.get("faBuShiJian_Up"));
+            stringObjectHashMap.put("faBuShiJianLower",param.get("faBuShiJian_Lower"));
             if(BeanUtils.isNotEmpty(mapOrder.get("chuangJianShiJ"))){
                 stringObjectHashMap.put("cjsj",(String) mapOrder.get("chuangJianShiJ"));
             }else{

ibps-provider-root/modules/provider-business/src/main/resources/com/lc/ibps/klimsibps/mapping/UpdateDataTableMapper.xml

@@ -269,7 +269,18 @@
         limit ${map.startPage},${map.limit}
     </select>
     <select id="selectByLocationCount" resultType="java.lang.Integer" parameterType="java.util.Map">
-        select count(a.id_) as count from t_swdl a where a.di_dian_ = #{map.locationId} and a.shi_fou_qi_yong_ like '%enabled%'
+        select
+          count(*)
+        from t_swdl a left join ibps_party_employee b on a.create_by_ = b.ID_
+        <where>
+            a.di_dian_ = #{map.locationId}
+            <if test="@o.Ognl@isNotEmpty(map.shiFouQiYong)">
+                and a.shi_fou_qi_yong_ like #{map.shiFouQiYong}
+            </if>
+            <if test="@o.Ognl@isNotEmpty(map.daiLiRenXingM)">
+                and a.dai_li_ren_xing_m like #{map.daiLiRenXingM}
+            </if>
+        </where>
     </select>
     <select id="selectExInfoByLocation" resultType="java.util.Map" parameterType="java.util.Map">
         select