From a62dbfe74cc5d825d4f46ad5a3160aff1dcff7b9 Mon Sep 17 00:00:00 2001 From: Odboy Date: Tue, 1 Sep 2026 21:17:57 +0800 Subject: [PATCH] =?UTF-8?q?fix(sql):=20=E4=BF=AE=E5=A4=8DSQL=E6=B3=A8?= =?UTF-8?q?=E5=85=A5=E6=BC=8F=E6=B4=9E=E6=94=B9=E7=94=A8=E5=8F=82=E6=95=B0?= =?UTF-8?q?=E5=8C=96=E6=9F=A5=E8=AF=A2?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - app.go 将查询条件从字符串拼接改为占位符参数绑定 - config.go 将查询条件从字符串拼接改为占位符参数绑定 - user.go 将查询条件从字符串拼接改为占位符参数绑定 - 移除 app.go 中重复的条件构建逻辑 - 对 group_id、enabled 等参数增加类型校验与错误处理 --- server/internal/handler/app.go | 65 ++++++++++++++++--------------- server/internal/handler/config.go | 52 ++++++++++++------------- server/internal/handler/user.go | 38 +++++++++++++----- 3 files changed, 87 insertions(+), 68 deletions(-) diff --git a/server/internal/handler/app.go b/server/internal/handler/app.go index 9850172..77a5cd5 100644 --- a/server/internal/handler/app.go +++ b/server/internal/handler/app.go @@ -37,7 +37,9 @@ func (h *AppHandler) List(c *gin.Context) { } userInfo := middleware.GetUserInfo(c) - query := dao.Engine.Where("enabled = 1") + + conditions := []string{"enabled = 1"} + args := make([]interface{}, 0, 6) if !userInfo.IsSuperAdmin() { userId, _ := strconv.Atoi(userInfo.Id) @@ -45,42 +47,41 @@ func (h *AppHandler) List(c *gin.Context) { if userInfo.IsGroupAdmin() && userInfo.GroupId != nil { // 组管理员：本组应用 + 自己是负责人的应用 - query = query.And("(group_id = ? OR FIND_IN_SET('" + userIdStr + "', owner_ids) > 0)", *userInfo.GroupId) + conditions = append(conditions, "(group_id = ? OR FIND_IN_SET(?, owner_ids) > 0)") + args = append(args, *userInfo.GroupId, userIdStr) } else { // 普通用户：自己是负责人的应用 - query = query.And("FIND_IN_SET('" + userIdStr + "', owner_ids) > 0") - } - } - - var apps []model.Application - whereClause := "enabled = 1" - if !userInfo.IsSuperAdmin() { - userId, _ := strconv.Atoi(userInfo.Id) - userIdStr := strconv.Itoa(userId) - - if userInfo.IsGroupAdmin() && userInfo.GroupId != nil { - // 组管理员：本组应用 + 自己是负责人的应用 - whereClause += " AND (group_id = " + strconv.Itoa(*userInfo.GroupId) + " OR FIND_IN_SET('" + userIdStr + "', owner_ids) > 0)" - } else { - // 普通用户：自己是负责人的应用 - whereClause += " AND (FIND_IN_SET('" + userIdStr + "', owner_ids) > 0)" + conditions = append(conditions, "FIND_IN_SET(?, owner_ids) > 0") + args = append(args, userIdStr) } } if req.AppType != "" { - whereClause += " AND service_id = '" + req.AppType + "'" + conditions = append(conditions, "service_id = ?") + args = append(args, req.AppType) } if req.Name != "" { - whereClause += " AND name LIKE '%" + req.Name + "%'" + conditions = append(conditions, "name LIKE ?") + args = append(args, "%"+req.Name+"%") } if req.Code != "" { - whereClause += " AND code LIKE '%" + req.Code + "%'" + conditions = append(conditions, "code LIKE ?") + args = append(args, "%"+req.Code+"%") } if req.GroupId != "" { - whereClause += " AND group_id = " + req.GroupId + groupId, err := strconv.Atoi(req.GroupId) + if err != nil { + c.JSON(http.StatusBadRequest, model.WrapperResponse{Code: 400, Msg: "参数错误"}) + return + } + conditions = append(conditions, "group_id = ?") + args = append(args, groupId) } - - total, _ := dao.Engine.Where(whereClause).Count(&model.Application{}) - dao.Engine.Where(whereClause).Limit(req.PageSize, (req.PageNo-1)*req.PageSize).Find(&apps) + + whereClause := strings.Join(conditions, " AND ") + + var apps []model.Application + total, _ := dao.Engine.Where(whereClause, args...).Count(&model.Application{}) + dao.Engine.Where(whereClause, args...).Limit(req.PageSize, (req.PageNo-1)*req.PageSize).Find(&apps) // load group names - batch query to avoid N+1 groupIds := make(map[int]bool) @@ -122,13 +123,13 @@ func (h *AppHandler) GetById(c *gin.Context) { } type AddAppRequest struct { - Id int `json:"id"` - GroupId *int `json:"groupId"` - Name string `json:"name" binding:"required"` - Code string `json:"code" binding:"required"` - ServiceId string `json:"serviceId"` - OwnerIds []int `json:"ownerIds"` - Remarks string `json:"remarks"` + Id int `json:"id"` + GroupId *int `json:"groupId"` + Name string `json:"name" binding:"required"` + Code string `json:"code" binding:"required"` + ServiceId string `json:"serviceId"` + OwnerIds []int `json:"ownerIds"` + Remarks string `json:"remarks"` } func (h *AppHandler) Add(c *gin.Context) { diff --git a/server/internal/handler/config.go b/server/internal/handler/config.go index cbcabcc..8445c28 100644 --- a/server/internal/handler/config.go +++ b/server/internal/handler/config.go @@ -14,8 +14,8 @@ import ( ) type ConfigHandler struct { - parseService *service.ConfigParseService - permService *service.PermissionService + parseService *service.ConfigParseService + permService *service.PermissionService } func NewConfigHandler(parse *service.ConfigParseService, perm *service.PermissionService) *ConfigHandler { @@ -47,38 +47,38 @@ func (h *ConfigHandler) List(c *gin.Context) { } // 构建查询条件 - buildConditions := func() []string { - conditions := []string{"enabled = 1"} - if req.Env != "" { - conditions = append(conditions, "env = '"+req.Env+"'") + conditions := []string{"enabled = 1"} + args := make([]interface{}, 0, 4) + if req.Env != "" { + conditions = append(conditions, "env = ?") + args = append(args, req.Env) + } + if req.AppId != nil { + if *req.AppId <= 0 { + conditions = append(conditions, "(app_id is null OR app_id = 0)") + } else { + conditions = append(conditions, "app_id = ?") + args = append(args, *req.AppId) } - if req.AppId != nil { - if *req.AppId <= 0 { - conditions = append(conditions, "(app_id is null OR app_id = 0)") - } else { - conditions = append(conditions, "app_id = "+strconv.Itoa(*req.AppId)) + } + if !userInfo.IsSuperAdmin() { + if userInfo.IsGroupAdmin() && userInfo.GroupId != nil { + conditions = append(conditions, "group_id = ?") + args = append(args, *userInfo.GroupId) + } else if len(userInfo.GrantAppIds) > 0 { + ids := make([]string, len(userInfo.GrantAppIds)) + for i, id := range userInfo.GrantAppIds { + ids[i] = strconv.Itoa(id) } + conditions = append(conditions, "app_id in ("+strings.Join(ids, ",")+")") } - if !userInfo.IsSuperAdmin() { - if userInfo.IsGroupAdmin() && userInfo.GroupId != nil { - conditions = append(conditions, "group_id = "+strconv.Itoa(*userInfo.GroupId)) - } else if len(userInfo.GrantAppIds) > 0 { - ids := make([]string, len(userInfo.GrantAppIds)) - for i, id := range userInfo.GrantAppIds { - ids[i] = strconv.Itoa(id) - } - conditions = append(conditions, "app_id in ("+strings.Join(ids, ",")+")") - } - } - return conditions } - conditions := buildConditions() whereClause := strings.Join(conditions, " AND ") var configs []model.AppConfig - total, _ := dao.Engine.Where(whereClause).Count(&model.AppConfig{}) - dao.Engine.Where(whereClause).Limit(req.PageSize, (req.PageNo-1)*req.PageSize).Find(&configs) + total, _ := dao.Engine.Where(whereClause, args...).Count(&model.AppConfig{}) + dao.Engine.Where(whereClause, args...).Limit(req.PageSize, (req.PageNo-1)*req.PageSize).Find(&configs) // build app names (batch query) and collect configIds for client counts configIds := make([]int, 0, len(configs)) diff --git a/server/internal/handler/user.go b/server/internal/handler/user.go index efa3f3c..17cd4aa 100644 --- a/server/internal/handler/user.go +++ b/server/internal/handler/user.go @@ -1,12 +1,12 @@ package handler import ( + "crypto/rand" "kenaito-conf/server/internal/dao" "kenaito-conf/server/internal/middleware" "kenaito-conf/server/internal/model" "kenaito-conf/server/internal/service" "kenaito-conf/server/internal/util" - "crypto/rand" "net/http" "strconv" "strings" @@ -30,30 +30,48 @@ func (h *UserHandler) List(c *gin.Context) { enabledStr := c.Query("enabled") userInfo := middleware.GetUserInfo(c) - buildConditions := func() []string { + buildConditions := func() (string, []interface{}) { conditions := []string{"1=1"} + args := make([]interface{}, 0, 4) if !userInfo.IsSuperAdmin() && userInfo.GroupId != nil { - conditions = append(conditions, "group_id = "+strconv.Itoa(*userInfo.GroupId)) + conditions = append(conditions, "group_id = ?") + args = append(args, *userInfo.GroupId) } if groupIdStr != "" { - conditions = append(conditions, "group_id = "+groupIdStr) + groupId, err := strconv.Atoi(groupIdStr) + if err != nil { + return "", nil + } + conditions = append(conditions, "group_id = ?") + args = append(args, groupId) } if name != "" { - conditions = append(conditions, "name like '%"+name+"%'") + conditions = append(conditions, "name LIKE ?") + args = append(args, "%"+name+"%") } if userType != "" { - conditions = append(conditions, "type = '"+userType+"'") + conditions = append(conditions, "type = ?") + args = append(args, userType) } if enabledStr != "" { - conditions = append(conditions, "enabled = "+enabledStr) + enabled, err := strconv.Atoi(enabledStr) + if err != nil { + return "", nil + } + conditions = append(conditions, "enabled = ?") + args = append(args, enabled) } - return conditions + return strings.Join(conditions, " AND "), args } - whereClause := strings.Join(buildConditions(), " AND ") + whereClause, args := buildConditions() + if whereClause == "" { + c.JSON(http.StatusBadRequest, model.WrapperResponse{Code: 400, Msg: "参数错误"}) + return + } var users []model.User - dao.Engine.Where(whereClause).Find(&users) + dao.Engine.Where(whereClause, args...).Find(&users) // load group names var groups []model.BusinessGroup