doomiwork 4.1.6 → 4.1.8

package/core/controller.js

@@ -182,7 +182,7 @@ class controller {
     */
     async getListData(req, dataKey, configFile = 0) {
         if (this.logger) this.logger.trace("准备获取dataconfig文件中对应的 %s list数据",dataKey)
-        const listinfo = getListInfo(req, dataKey, configFile, this._daoModel, ignorefilter==1);
+        const listinfo = getListInfo(req, dataKey, configFile, this._daoModel);  //, ignorefilter==1
         if (!listinfo) return { successed: false, errcode: -10, errmsg:`缺失${dataKey}对应的查询语句`};
 
         ////直接操作数据库之前，可由子类再次Handler

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "doomiwork",
-  "version": "4.1.6",
+  "version": "4.1.8",
   "description": "doomisoft nodejs web framework",
   "main": "index.js",
   "scripts": {

package/utilities/requestparser.js

@@ -19,12 +19,17 @@ function checkSqlInjection(sql) {
     if (FORBID_SQL_KEYWORD.test(sql)) return '';
     return sql;
 }
+
+function isEmptyValue(value){
+    if (value === undefined || value === null || value === '') return true;
+    return false;
+}
 /*
 * 根据对应列表的配置(dataConfig.list.search),从请求上下文中获取用户进行搜索的参数信息
 */
 module.exports.getSearchCondition = (option) => {
     let paraCopy = option || {};
-    if (!paraCopy.request || !paraCopy.refer) return '';
+    if (!paraCopy.request || !paraCopy.refer) return { filter:'', params:[] };
     if (!paraCopy.valueFrom) paraCopy.valueFrom = "all";
     const request = paraCopy.request;
     let retSearch = [],params = [];
@@ -88,6 +93,7 @@ module.exports.parseTagInSql = (req, sql, allowNull = true) => {
     return sql;
 }
 
+
 /**
  * 为列表查询定义参数化查询
  * @param {*} req 
@@ -100,7 +106,7 @@ module.exports.parseTagForParameterize = (req, filterSetting={}) => {
     ///type=parameter表示参数化方式查询
     ///type=joint 表示拼接sql语句查询
     ///scope=[] 表示需要解析的字段必须在此列表内容中
-    let {pattern:sql,type='parameter',inscope=[]} = filterSetting;
+    let {pattern:sql,type='parameter',inscope=[],allowEmpty=false} = filterSetting;
     if (!sql) return {sql:''};
     ///定义正则准备查找sql中的特定关键字
     const matched = sql.match(/@.*?@/g);
@@ -116,23 +122,24 @@ module.exports.parseTagForParameterize = (req, filterSetting={}) => {
         ///是否有格式要求
         let validformat = matchValue.split('|');
         matchValue = validformat[0];
+        
         let keyValue = parseKeyValue(req, matchValue)||''; //utility.ifNull(keyParse.parseKeyValue(req, matchValue), '')+'';
         if (keyValue && validformat.length > 1) keyValue = validatorParamsType(keyValue, validformat[1], validformat[2], inscope)
         ///如果解析不出这个KeyValue ,则认为当前这条SQL过滤无效
-        if (!keyValue) return {sql:'',params:[]};
-        if (keyValue) {
-            if(type.toLowerCase() === 'parameter'){
-                sql = sql.replace(ele, '?');    ///变成参数化查询
-                if (Array.isArray(keyValue))
-                    params.push(keyValue)
-                else
-                    params.push(matchContent[0].replace(matchContent[1], keyValue));// '%' + keyValue + '%')
-            } else if (type.toLowerCase() === 'joint'){ ///拼接sql语句查询
-                ///拼接的SQL语句，keyvalue必须在scope列表中，否则不予拼接
-                const result = inscope.some(item => item.toLowerCase() === matchValue.toLowerCase());
-                if (result)sql = sql.replace(ele, keyValue); 
-            }
+        if (isEmptyValue(keyValue) && !allowEmpty) return {sql:'',params:[]};
+        // if (keyValue) {
+        if(type.toLowerCase() === 'parameter'){
+            sql = sql.replace(ele, '?');    ///变成参数化查询
+            if (Array.isArray(keyValue))
+                params.push(keyValue)
+            else
+                params.push(matchContent[0].replace(matchContent[1], keyValue));// '%' + keyValue + '%')
+        } else if (type.toLowerCase() === 'joint'){ ///拼接sql语句查询
+            ///拼接的SQL语句，keyvalue必须在scope列表中，否则不予拼接
+            const result = inscope.some(item => item.toLowerCase() === matchValue.toLowerCase());
+            if (result)sql = sql.replace(ele, keyValue||''); 
         }
+        // }
     }
     return {sql,params};
 }
@@ -198,15 +205,15 @@ module.exports.getListInfo = (req, dataKey, cfgType = 0, dao) => {
 
         /**根据过滤条件、排序条件、分页获取的方式，和原始sql拼接成最终获取数据的sql */
         if (sqltype==='sql'){
-            const mainParameterlizedSql = this.parseTagForParameterize(req, {pattern:sql});
+            const mainParameterlizedSql = this.parseTagForParameterize(req, { pattern: sql, allowEmpty:true });
             if (!mainParameterlizedSql.sql) return null;
-            sql = `${mainParameterlizedSql.sql} ${searchCondition.filter} ${sort ? (' order by ' + sort) : ''} ${export2Excel ? '' : ' limit ' + Number(pageSize) + ' OFFSET ' + (Math.max(Number(page), 1) - 1) * Number(pageSize)};SELECT FOUND_ROWS() AS total`;
+            sql = `${mainParameterlizedSql.sql} ${searchCondition.filter ||''} ${sort ? (' order by ' + sort) : ''} ${export2Excel ? '' : ' limit ' + Number(pageSize) + ' OFFSET ' + (Math.max(Number(page), 1) - 1) * Number(pageSize)};SELECT FOUND_ROWS() AS total`;
             SqlParameters = SqlParameters.concat(mainParameterlizedSql.params || [], searchCondition.params);
             /*** 如果存在汇总列的sql，则把SQL放置在最末尾 */
             if (countsql) {
-                const countParameterlizedSql = this.parseTagForParameterize(req, { pattern: countsql });
+                const countParameterlizedSql = this.parseTagForParameterize(req, { pattern: countsql, allowEmpty: true });
                 if (!countParameterlizedSql.sql) return null;
-                sql += appendSearchCondition2Count(countParameterlizedSql.sql, searchCondition.filter)
+                sql += appendSearchCondition2Count(countParameterlizedSql.sql, searchCondition.filter||'')
                 SqlParameters = SqlParameters.concat(countParameterlizedSql.params || [], searchCondition.params);
             }
         }