doomiwork 2.9.3 → 3.0.0

package/core/database/daoBase.js

@@ -4,7 +4,7 @@
  * Author : Stephen.Shen
  */
 
-var dao = require('./mysqlbase');
+const dao = require('./mysqlbase');
 
 class mysqlDao extends dao{
     /**

package/core/database/mysqlbase.js

@@ -2,10 +2,10 @@
 * MySql 封装 （简单，应该尚未完善）
 */
 //var mysql = require('mysql');
-var apiResult = require('../actionresult');
+const apiResult = require('../actionresult');
 const logHelper = require('doomi-helper').logHelper;
-//const appsetting = require('../../configuration/appsetting').getCurrentApp();
 const PoolManager = require('./poolmanager')
+const mysql = require('mysql');
 class Database {
     /**
      * 
@@ -17,6 +17,13 @@ class Database {
         //mysql.createPool(appsetting.getConnection(connectionstring || 'dev'));
         this.logger = logHelper.getInstance().getLogger("framework");
     }
+    /**
+     * 防Sql注入进行编码
+     * @param {*} value 
+     */
+    escape(value){
+        return mysql.escape(value);
+    }
     /**
      * 不事务执行SQL命令
      * @param {*} sqlCommand 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "doomiwork",
-  "version": "2.9.3",
+  "version": "3.0.0",
   "description": "doomisoft nodejs web framework",
   "main": "index.js",
   "scripts": {

package/utilities/requestparser.js

@@ -32,10 +32,11 @@ class RequestParser {
             let keyValue =utility.ifNull(keyParse.parseKeyValue(req,ele.substring(1,ele.length-1)),'');
             if(keyValue=='') {
                 parseKeyWordIsNull = true;
-            }else{
+            }else if (typeof(keyValue)==='string'){
                 keyValue = mysql.escape(keyValue)
                 keyValue = keyValue.substr(1, keyValue.length - 2)
             }
+                
             sql=sql.replace(ele,keyValue);
         });
         if (!allowNull && parseKeyWordIsNull) return '';
@@ -58,9 +59,18 @@ class RequestParser {
         ///确认是否是需要导出Excel
         const export2Excel =(req.query.exportexcel+"").toLowerCase()==="true";
         req.page = req.query.page || req.body.page|| 1;
-        req.pageSize = req.query.rows || req.body.rows || 2000;
+        req.pageSize = req.query.rows || req.body.rows || 100;
         req.sort = req.query.sort || req.body.sort;
-
+        //防止注入式Sql
+        if (isNaN(req.pageSize)){
+            req.pageSize = 30;
+        }
+        //防止注入式Sql
+        if (isNaN(req.page)) {
+            req.page = 1;
+        }
+        ///最大允许获取100条数据
+        req.pageSize = Math.min(req.pageSize,100);
         req.order =req.sort? utility.ifNull((req.body.order == null ? req.query.order : req.body.order), ""):'';
         if (dataKey) {
             req.dataConfig = dataconfig.getConfig(dataKey,cfgType);
@@ -107,28 +117,6 @@ class RequestParser {
                         this.parseAndReplaceSql(req,countsql),
                         req.searchCondition)+';'
                 }                                
-                // switch (req.sqltype) {
-                //     case 'sql':
-                //         ///客户端调用时是否传递一些 特殊的过滤方式
-                //         req.listSql =this.parseAndReplaceSql(req,req.dataConfig.list.sql) + 
-                //                      ' ' + req.searchCondition + clientFilter +
-                //                     (utility.isNullOrEmpty(req.sort) ? '' : (' order by ' + (req.sort+' '+req.order))) +
-                //                     (export2Excel?'':' limit ' + req.pageSize + ' OFFSET ' + (req.page - 1) * req.pageSize) +
-                //                      /////在Sql中再放入获取总记录数的语句
-                //                     ';SELECT FOUND_ROWS() AS total;';
-                //         if (req.dataConfig.list.countsql){
-                //             req.countSql = this.appendSearchCondition2Count(
-                //                 this.parseAndReplaceSql(req,req.dataConfig.list.countsql),
-                //                 req.searchCondition
-                //             )
-                //             req.listSql+=req.countSql +';';
-                //         }
-                //         break;
-                //     ////来自DAO对象的属性
-                //     ////一般较复杂的SQL写在DAO对象的constantSql属性中
-                //     case 'property':
-                //         break;
-                // }
             }
         }
     }