doomiwork 3.6.2 → 3.7.1

package/core/controller.js

@@ -335,7 +335,7 @@ class controller {
         /////处理SQL中的一些定义符
         let parseSql = rcp.parseAndReplaceSql(req,beforeData.sql);
         ////操作数据库
-        let result = await this._daoModel.delete(parseSql, beforeData.sqlParams)
+        let result = await this._daoModel.delete(parseSql, beforeData.sqlParams,req.user?.id)
         if(!result.successed) {
             this.logUserAction(req,this._daoModel.getBusiness(),2,-1);
             return result;

package/core/database/daoBase.js

@@ -1,11 +1,10 @@
-// @ts-check
-/**
+/**
  * 封装了数据访问层的基础访问
  * Author : Stephen.Shen
  */
 
 const dao = require('./mysqlbase');
-
+const Moment = require('moment')
 class mysqlDao extends dao{
     /**
      * 构造函数，确定使用的数据库链接
@@ -104,7 +103,13 @@ class mysqlDao extends dao{
      */
     deleteSql() { 
         ////如果是逻辑删除，则只将记录的删除状态设置为1
-        if(this.tableoption.logicDelete)  return `update ${this.tableoption.tableName} set ${this.tableoption.logicDeleteField || 'rec_isdeleted'} =1 where ${this.tableoption.primaryKey}=? ${this.tableoption.forcefilter}`; 
+        if(this.tableoption.logicDelete)  {
+
+            return `update ${this.tableoption.tableName} set ${this.tableoption.logicDeleteField || 'rec_isdeleted'} =1 where ${this.tableoption.primaryKey}=? ${this.tableoption.forcefilter}`; 
+            //sqlDelete = sqlDelete.replace('#DELETEBY#', this.tableoption.logDeleteBy?`${this.tableoption.logDeleteBy}=?,`:'')
+            //sqlDelete = sqlDelete.replace('#DELETEDATE#', this.tableoption.logDeleteDate ? `${this.tableoption.logDeleteDate}=now(),` : '');
+            //return sqlDelete;
+        }
         return `delete from ${this.tableoption.tableName} where ${this.tableoption.primaryKey}=? ${this.tableoption.forcefilter}`; 
     }
 
@@ -122,7 +127,22 @@ class mysqlDao extends dao{
     ///更新记录
     async update(Sql, model, id) {return this.executeSql(Sql, [model, id]);}
     ///删除记录
-    async delete(Sql, id) {return this.executeSql(Sql, id);}
+    async delete(Sql, id,userid) { 
+        return this.executeSql(Sql, id); 
+        /*if (result.successed && this.tableoption.logicDelete && userid && (this.tableoption.logDeleteBy || this.tableoption.logDeleteDate)){
+            let sqlLog = `update ${this.tableoption.tableName} set ? where ${this.tableoption.primaryKey}=? ${this.tableoption.forcefilter}`; 
+            let model = {};
+            if (this.tableoption.logDeleteBy){
+                model[this.tableoption.logDeleteBy] = userid;
+            }
+            if (this.tableoption.logDeleteDate){
+                model[this.tableoption.logDeleteDate] = Moment().format('YYYY-MM-DD HH:mm:ss');
+            }
+            if (Object.keys(model).length>0) this.executeSql(sqlLog, [model, id]);
+        }
+        return result;
+        */
+    }
     /**
      * 获取对应数据的权限设置
      * @param {*} id 

package/core/database/mysqlbase.js

@@ -117,7 +117,7 @@ class Database {
                 if (err) {
                     this.logger.error("Database Query Error :" + err, sqlCommand);
                     this.logError(null, '数据库操作错误:' + err + sqlCommand)
-                    return success(Object.assign(apiResult.DB_EXECUTE_FAILED, { errmessage: err.message }));
+                    return success(Object.assign(apiResult.DB_EXECUTE_FAILED, { errmessage:'数据库操作错误'}));// err.message }));
                 }
                 return success({ successed: true, rows: rows });//,fields:fields});
             });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "doomiwork",
-  "version": "3.6.2",
+  "version": "3.7.1",
   "description": "doomisoft nodejs web framework",
   "main": "index.js",
   "scripts": {

package/utilities/requestparser.js

@@ -64,6 +64,9 @@ class RequestParser {
                 if (!keyValue && noQuoteProtect) {
                     keyValue = '1=0'
                 }
+            }else{  ////数组形式的参数，目前框架不支持，统一认为为sql注入攻击,全部忽略
+                parseKeyWordIsNull = true;
+                keyValue = ''
             }
             sql=sql.replace(ele,keyValue);
         });