doomiwork 3.7.0 → 3.7.1

package/core/database/daoBase.js

@@ -128,8 +128,8 @@ class mysqlDao extends dao{
     async update(Sql, model, id) {return this.executeSql(Sql, [model, id]);}
     ///删除记录
     async delete(Sql, id,userid) { 
-        let result = await this.executeSql(Sql, id); 
-        if (result.successed && this.tableoption.logicDelete && userid && (this.tableoption.logDeleteBy || this.tableoption.logDeleteDate)){
+        return this.executeSql(Sql, id); 
+        /*if (result.successed && this.tableoption.logicDelete && userid && (this.tableoption.logDeleteBy || this.tableoption.logDeleteDate)){
             let sqlLog = `update ${this.tableoption.tableName} set ? where ${this.tableoption.primaryKey}=? ${this.tableoption.forcefilter}`; 
             let model = {};
             if (this.tableoption.logDeleteBy){
@@ -141,6 +141,7 @@ class mysqlDao extends dao{
             if (Object.keys(model).length>0) this.executeSql(sqlLog, [model, id]);
         }
         return result;
+        */
     }
     /**
      * 获取对应数据的权限设置

package/core/database/mysqlbase.js

@@ -117,7 +117,7 @@ class Database {
                 if (err) {
                     this.logger.error("Database Query Error :" + err, sqlCommand);
                     this.logError(null, '数据库操作错误:' + err + sqlCommand)
-                    return success(Object.assign(apiResult.DB_EXECUTE_FAILED, { errmessage: err.message }));
+                    return success(Object.assign(apiResult.DB_EXECUTE_FAILED, { errmessage:'数据库操作错误'}));// err.message }));
                 }
                 return success({ successed: true, rows: rows });//,fields:fields});
             });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "doomiwork",
-  "version": "3.7.0",
+  "version": "3.7.1",
   "description": "doomisoft nodejs web framework",
   "main": "index.js",
   "scripts": {

package/utilities/requestparser.js

@@ -64,6 +64,9 @@ class RequestParser {
                 if (!keyValue && noQuoteProtect) {
                     keyValue = '1=0'
                 }
+            }else{  ////数组形式的参数，目前框架不支持，统一认为为sql注入攻击,全部忽略
+                parseKeyWordIsNull = true;
+                keyValue = ''
             }
             sql=sql.replace(ele,keyValue);
         });