doomiwork 2.9.2 → 2.9.5

package/core/database/daoBase.js

@@ -4,7 +4,7 @@
  * Author : Stephen.Shen
  */
 
-var dao = require('./mysqlbase');
+const dao = require('./mysqlbase');
 
 class mysqlDao extends dao{
     /**

package/core/database/mysqlbase.js

@@ -2,10 +2,10 @@
 * MySql 封装 （简单，应该尚未完善）
 */
 //var mysql = require('mysql');
-var apiResult = require('../actionresult');
+const apiResult = require('../actionresult');
 const logHelper = require('doomi-helper').logHelper;
-//const appsetting = require('../../configuration/appsetting').getCurrentApp();
 const PoolManager = require('./poolmanager')
+const mysql = require('mysql');
 class Database {
     /**
      * 
@@ -17,6 +17,13 @@ class Database {
         //mysql.createPool(appsetting.getConnection(connectionstring || 'dev'));
         this.logger = logHelper.getInstance().getLogger("framework");
     }
+    /**
+     * 防Sql注入进行编码
+     * @param {*} value 
+     */
+    escape(value){
+        return mysql.escape(value);
+    }
     /**
      * 不事务执行SQL命令
      * @param {*} sqlCommand 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "doomiwork",
-  "version": "2.9.2",
+  "version": "2.9.5",
   "description": "doomisoft nodejs web framework",
   "main": "index.js",
   "scripts": {

package/utilities/requestparser.js

@@ -30,10 +30,13 @@ class RequestParser {
             let matchValue = ele.substring(1,ele.length-1);
             if (matchValue.indexOf(' ')>=0 || matchValue.indexOf(':')>=0 || matchValue.indexOf('=')>=0) return;
             let keyValue =utility.ifNull(keyParse.parseKeyValue(req,ele.substring(1,ele.length-1)),'');
-            if(keyValue=='') parseKeyWordIsNull = true;
-            keyValue = mysql.escape(keyValue)
-            //keyValue = keyValue.replace(/'/g, "''")
-            keyValue = keyValue.substr(1, a.length - 2)
+            if(keyValue=='') {
+                parseKeyWordIsNull = true;
+            }else if (typeof(keyValue)==='string'){
+                keyValue = mysql.escape(keyValue)
+                keyValue = keyValue.substr(1, keyValue.length - 2)
+            }
+                
             sql=sql.replace(ele,keyValue);
         });
         if (!allowNull && parseKeyWordIsNull) return '';
@@ -105,28 +108,6 @@ class RequestParser {
                         this.parseAndReplaceSql(req,countsql),
                         req.searchCondition)+';'
                 }                                
-                // switch (req.sqltype) {
-                //     case 'sql':
-                //         ///客户端调用时是否传递一些 特殊的过滤方式
-                //         req.listSql =this.parseAndReplaceSql(req,req.dataConfig.list.sql) + 
-                //                      ' ' + req.searchCondition + clientFilter +
-                //                     (utility.isNullOrEmpty(req.sort) ? '' : (' order by ' + (req.sort+' '+req.order))) +
-                //                     (export2Excel?'':' limit ' + req.pageSize + ' OFFSET ' + (req.page - 1) * req.pageSize) +
-                //                      /////在Sql中再放入获取总记录数的语句
-                //                     ';SELECT FOUND_ROWS() AS total;';
-                //         if (req.dataConfig.list.countsql){
-                //             req.countSql = this.appendSearchCondition2Count(
-                //                 this.parseAndReplaceSql(req,req.dataConfig.list.countsql),
-                //                 req.searchCondition
-                //             )
-                //             req.listSql+=req.countSql +';';
-                //         }
-                //         break;
-                //     ////来自DAO对象的属性
-                //     ////一般较复杂的SQL写在DAO对象的constantSql属性中
-                //     case 'property':
-                //         break;
-                // }
             }
         }
     }