From 8b1f480044111dc53551f9238e208f76bfb72d0e Mon Sep 17 00:00:00 2001 From: "zangch@mesnac.com" Date: Fri, 26 Dec 2025 10:26:23 +0800 Subject: [PATCH] =?UTF-8?q?refactor(mapper):=20=E4=BC=98=E5=8C=96=E6=95=B0?= =?UTF-8?q?=E6=8D=AE=E6=9D=83=E9=99=90=E5=92=8CSQL=E6=9F=A5=E8=AF=A2?= =?UTF-8?q?=E7=BB=93=E6=9E=84?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - 为 CrmMailingApplyMapper 添加数据权限注解 - 为 CrmQuoteInfoMapper 和 CrmQuoteMaterialMapper 添加数据权限控制 - 为 ErpProject 相关的 Mapper 添加数据权限注解 - 将所有动态SQL片段从 ${ew.getCustomSqlSegment} 重构为 标签 - 修复潜在的SQL注入风险并增强查询安全性 - 为 WmsShippingBillMapper 和 WmsShippingDetailsMapper 添加数据权限支持 --- .../oa/crm/mapper/CrmMailingApplyMapper.java | 12 ++++++++ .../oa/erp/mapper/ErpProjectChangeMapper.java | 23 ++++++++++---- .../mapper/oa/crm/CrmMailingApplyMapper.xml | 30 +++++++++++++++---- .../mapper/oa/crm/CrmQuoteInfoMapper.xml | 30 +++++++++++++++---- .../mapper/oa/crm/CrmQuoteMaterialMapper.xml | 30 +++++++++++++++---- .../oa/erp/ErpProjectAcceptanceMapper.xml | 30 +++++++++++++++---- .../oa/erp/ErpProjectChangeBudgetMapper.xml | 30 +++++++++++++++---- .../mapper/oa/erp/ErpProjectChangeMapper.xml | 30 +++++++++++++++---- .../oa/erp/ErpProjectChangeProgressMapper.xml | 30 +++++++++++++++---- .../mapper/oa/erp/ErpProjectPlanMapper.xml | 30 +++++++++++++++---- .../oa/erp/ErpProjectPlanStageMapper.xml | 30 +++++++++++++++---- .../oa/erp/ErpProjectReceivingMapper.xml | 30 +++++++++++++++---- .../mapper/wms/WmsShippingBillMapper.xml | 30 +++++++++++++++---- .../mapper/wms/WmsShippingDetailsMapper.xml | 30 +++++++++++++++---- 14 files changed, 330 insertions(+), 65 deletions(-) diff --git a/ruoyi-modules/ruoyi-oa/src/main/java/org/dromara/oa/crm/mapper/CrmMailingApplyMapper.java b/ruoyi-modules/ruoyi-oa/src/main/java/org/dromara/oa/crm/mapper/CrmMailingApplyMapper.java index a7d4b8fe..694af54a 100644 --- a/ruoyi-modules/ruoyi-oa/src/main/java/org/dromara/oa/crm/mapper/CrmMailingApplyMapper.java +++ b/ruoyi-modules/ruoyi-oa/src/main/java/org/dromara/oa/crm/mapper/CrmMailingApplyMapper.java @@ -69,6 +69,10 @@ public interface CrmMailingApplyMapper extends BaseMapperPlus queryWrapper); /** @@ -78,6 +82,10 @@ public interface CrmMailingApplyMapper extends BaseMapperPlus selectCustomCrmMailingApplyVoPage(@Param("page") Page page, @Param(Constants.WRAPPER) Wrapper queryWrapper); /** @@ -118,6 +126,10 @@ public interface CrmMailingApplyMapper extends BaseMapperPlus queryWrapper); diff --git a/ruoyi-modules/ruoyi-oa/src/main/java/org/dromara/oa/erp/mapper/ErpProjectChangeMapper.java b/ruoyi-modules/ruoyi-oa/src/main/java/org/dromara/oa/erp/mapper/ErpProjectChangeMapper.java index 099c5de0..398380a2 100644 --- a/ruoyi-modules/ruoyi-oa/src/main/java/org/dromara/oa/erp/mapper/ErpProjectChangeMapper.java +++ b/ruoyi-modules/ruoyi-oa/src/main/java/org/dromara/oa/erp/mapper/ErpProjectChangeMapper.java @@ -1,17 +1,18 @@ package org.dromara.oa.erp.mapper; -import java.util.List; -import java.util.Collection; -import com.github.yulichang.wrapper.MPJLambdaWrapper; import com.baomidou.mybatisplus.core.conditions.Wrapper; import com.baomidou.mybatisplus.core.toolkit.Constants; import com.baomidou.mybatisplus.extension.plugins.pagination.Page; +import com.github.yulichang.wrapper.MPJLambdaWrapper; import org.apache.ibatis.annotations.Param; -import org.dromara.oa.erp.domain.ErpProjectChange; -import org.dromara.oa.erp.domain.vo.ErpProjectChangeVo; import org.dromara.common.mybatis.annotation.DataColumn; import org.dromara.common.mybatis.annotation.DataPermission; import org.dromara.common.mybatis.core.mapper.BaseMapperPlus; +import org.dromara.oa.erp.domain.ErpProjectChange; +import org.dromara.oa.erp.domain.vo.ErpProjectChangeVo; + +import java.util.Collection; +import java.util.List; /** * 项目变更申请Mapper接口 @@ -68,6 +69,10 @@ public interface ErpProjectChangeMapper extends BaseMapperPlus queryWrapper); /** @@ -77,6 +82,10 @@ public interface ErpProjectChangeMapper extends BaseMapperPlus selectCustomErpProjectChangeVoPage(@Param("page") Page page, @Param(Constants.WRAPPER) Wrapper queryWrapper); /** @@ -117,6 +126,10 @@ public interface ErpProjectChangeMapper extends BaseMapperPlus queryWrapper); /** diff --git a/ruoyi-modules/ruoyi-oa/src/main/resources/mapper/oa/crm/CrmMailingApplyMapper.xml b/ruoyi-modules/ruoyi-oa/src/main/resources/mapper/oa/crm/CrmMailingApplyMapper.xml index c450afc4..258e4084 100644 --- a/ruoyi-modules/ruoyi-oa/src/main/resources/mapper/oa/crm/CrmMailingApplyMapper.xml +++ b/ruoyi-modules/ruoyi-oa/src/main/resources/mapper/oa/crm/CrmMailingApplyMapper.xml @@ -14,7 +14,11 @@ t.create_time, t.update_by, t.update_time from crm_mailing_apply t left join sys_dept d on t.dept_id = d.dept_id - ${ew.getCustomSqlSegment} + + + AND ${ew.sqlSegment} + + @@ -42,14 +46,22 @@ @@ -272,7 +284,11 @@ delete from crm_mailing_apply t - ${ew.getCustomSqlSegment} + + + AND ${ew.sqlSegment} + + @@ -287,7 +303,11 @@ diff --git a/ruoyi-modules/ruoyi-oa/src/main/resources/mapper/oa/crm/CrmQuoteInfoMapper.xml b/ruoyi-modules/ruoyi-oa/src/main/resources/mapper/oa/crm/CrmQuoteInfoMapper.xml index 43ca51cc..3bae71be 100644 --- a/ruoyi-modules/ruoyi-oa/src/main/resources/mapper/oa/crm/CrmQuoteInfoMapper.xml +++ b/ruoyi-modules/ruoyi-oa/src/main/resources/mapper/oa/crm/CrmQuoteInfoMapper.xml @@ -24,7 +24,11 @@ left join crm_customer_contact cc on t.customer_contact_id = cc.contact_id left join crm_customer_info ci on ci.customer_id = cc.customer_id left join crm_supplier_info s on s.supplier_id = t.supplier_contact_id - ${ew.getCustomSqlSegment} + + + AND ${ew.sqlSegment} + + @@ -50,14 +54,22 @@ @@ -378,7 +390,11 @@ delete from crm_quote_info - ${ew.getCustomSqlSegment} + + + AND ${ew.sqlSegment} + + @@ -393,7 +409,11 @@ diff --git a/ruoyi-modules/ruoyi-oa/src/main/resources/mapper/oa/crm/CrmQuoteMaterialMapper.xml b/ruoyi-modules/ruoyi-oa/src/main/resources/mapper/oa/crm/CrmQuoteMaterialMapper.xml index 56d203f7..09ffb06f 100644 --- a/ruoyi-modules/ruoyi-oa/src/main/resources/mapper/oa/crm/CrmQuoteMaterialMapper.xml +++ b/ruoyi-modules/ruoyi-oa/src/main/resources/mapper/oa/crm/CrmQuoteMaterialMapper.xml @@ -12,7 +12,11 @@ t.including_price, t.subtotal, t.remark, t.active_flag, t.del_flag, t.create_dept, t.create_by, t.create_time, t.update_by, t.update_time from crm_quote_material t - ${ew.getCustomSqlSegment} + + + AND ${ew.sqlSegment} + + @@ -41,7 +45,11 @@ @@ -51,7 +59,11 @@ t.including_price, t.subtotal, t.remark, t.active_flag, t.del_flag, t.create_dept, t.create_by, t.create_time, t.update_by, t.update_time from crm_quote_material t - ${ew.getCustomSqlSegment} + + + AND ${ew.sqlSegment} + + @@ -239,7 +251,11 @@ delete from crm_quote_material - ${ew.getCustomSqlSegment} + + + AND ${ew.sqlSegment} + + @@ -254,7 +270,11 @@ diff --git a/ruoyi-modules/ruoyi-oa/src/main/resources/mapper/oa/erp/ErpProjectAcceptanceMapper.xml b/ruoyi-modules/ruoyi-oa/src/main/resources/mapper/oa/erp/ErpProjectAcceptanceMapper.xml index e9d96236..944ccac6 100644 --- a/ruoyi-modules/ruoyi-oa/src/main/resources/mapper/oa/erp/ErpProjectAcceptanceMapper.xml +++ b/ruoyi-modules/ruoyi-oa/src/main/resources/mapper/oa/erp/ErpProjectAcceptanceMapper.xml @@ -30,7 +30,11 @@ left join sys_user u1 on t.manager_id = u1.user_id left join sys_user u3 on t.charge_id = u3.user_id left join sys_user u4 on t.deputy_id = u4.user_id - ${ew.getCustomSqlSegment} + + + AND ${ew.sqlSegment} + + @@ -63,7 +67,11 @@ @@ -75,7 +83,11 @@ left join sys_user u1 on t.manager_id = u1.user_id left join sys_user u3 on t.charge_id = u3.user_id left join sys_user u4 on t.deputy_id = u4.user_id - ${ew.getCustomSqlSegment} + + + AND ${ew.sqlSegment} + + @@ -221,7 +233,11 @@ delete from erp_project_acceptance - ${ew.getCustomSqlSegment} + + + AND ${ew.sqlSegment} + + @@ -236,7 +252,11 @@ diff --git a/ruoyi-modules/ruoyi-oa/src/main/resources/mapper/oa/erp/ErpProjectChangeBudgetMapper.xml b/ruoyi-modules/ruoyi-oa/src/main/resources/mapper/oa/erp/ErpProjectChangeBudgetMapper.xml index 3ab6fbb0..a3933c10 100644 --- a/ruoyi-modules/ruoyi-oa/src/main/resources/mapper/oa/erp/ErpProjectChangeBudgetMapper.xml +++ b/ruoyi-modules/ruoyi-oa/src/main/resources/mapper/oa/erp/ErpProjectChangeBudgetMapper.xml @@ -8,7 +8,11 @@ @@ -31,14 +35,22 @@ @@ -170,7 +182,11 @@ delete from erp_project_change_budget - ${ew.getCustomSqlSegment} + + + AND ${ew.sqlSegment} + + @@ -185,7 +201,11 @@ diff --git a/ruoyi-modules/ruoyi-oa/src/main/resources/mapper/oa/erp/ErpProjectChangeMapper.xml b/ruoyi-modules/ruoyi-oa/src/main/resources/mapper/oa/erp/ErpProjectChangeMapper.xml index 1a7d3f96..f5cde547 100644 --- a/ruoyi-modules/ruoyi-oa/src/main/resources/mapper/oa/erp/ErpProjectChangeMapper.xml +++ b/ruoyi-modules/ruoyi-oa/src/main/resources/mapper/oa/erp/ErpProjectChangeMapper.xml @@ -21,7 +21,11 @@ left join sys_user u2 on t.dept_head_id = u2.user_id left join sys_user u3 on t.responsible_vp_id = u3.user_id left join sys_user u4 on t.create_by = u4.user_id - ${ew.getCustomSqlSegment} + + + AND ${ew.sqlSegment} + + @@ -56,14 +60,22 @@ @@ -300,7 +312,11 @@ delete from erp_project_change - ${ew.getCustomSqlSegment} + + + AND ${ew.sqlSegment} + + @@ -315,7 +331,11 @@ diff --git a/ruoyi-modules/ruoyi-oa/src/main/resources/mapper/oa/erp/ErpProjectChangeProgressMapper.xml b/ruoyi-modules/ruoyi-oa/src/main/resources/mapper/oa/erp/ErpProjectChangeProgressMapper.xml index 3c308a16..05ea7cb2 100644 --- a/ruoyi-modules/ruoyi-oa/src/main/resources/mapper/oa/erp/ErpProjectChangeProgressMapper.xml +++ b/ruoyi-modules/ruoyi-oa/src/main/resources/mapper/oa/erp/ErpProjectChangeProgressMapper.xml @@ -8,7 +8,11 @@ @@ -31,14 +35,22 @@ @@ -177,7 +189,11 @@ delete from erp_project_change_progress - ${ew.getCustomSqlSegment} + + + AND ${ew.sqlSegment} + + @@ -192,7 +208,11 @@ diff --git a/ruoyi-modules/ruoyi-oa/src/main/resources/mapper/oa/erp/ErpProjectPlanMapper.xml b/ruoyi-modules/ruoyi-oa/src/main/resources/mapper/oa/erp/ErpProjectPlanMapper.xml index 8305a5a4..c4a1aeeb 100644 --- a/ruoyi-modules/ruoyi-oa/src/main/resources/mapper/oa/erp/ErpProjectPlanMapper.xml +++ b/ruoyi-modules/ruoyi-oa/src/main/resources/mapper/oa/erp/ErpProjectPlanMapper.xml @@ -41,7 +41,11 @@ left join sys_user u2 on t.charge_id = u2.user_id left join sys_user u3 on t.create_by = u3.user_id left join erp_contract_info c on t.contract_id = c.contract_id - ${ew.getCustomSqlSegment} + + + AND ${ew.sqlSegment} + + @@ -124,7 +128,11 @@ @@ -161,7 +169,11 @@ left join sys_dept d1 on u1.dept_id = d1.dept_id left join sys_user u2 on t.charge_id = u2.user_id left join erp_contract_info c on t.contract_id = c.contract_id - ${ew.getCustomSqlSegment} + + + AND ${ew.sqlSegment} + + @@ -321,7 +333,11 @@ delete from erp_project_plan - ${ew.getCustomSqlSegment} + + + AND ${ew.sqlSegment} + + @@ -336,7 +352,11 @@ diff --git a/ruoyi-modules/ruoyi-oa/src/main/resources/mapper/oa/erp/ErpProjectPlanStageMapper.xml b/ruoyi-modules/ruoyi-oa/src/main/resources/mapper/oa/erp/ErpProjectPlanStageMapper.xml index da485b3e..b2884714 100644 --- a/ruoyi-modules/ruoyi-oa/src/main/resources/mapper/oa/erp/ErpProjectPlanStageMapper.xml +++ b/ruoyi-modules/ruoyi-oa/src/main/resources/mapper/oa/erp/ErpProjectPlanStageMapper.xml @@ -8,7 +8,11 @@ @@ -31,14 +35,22 @@ @@ -240,7 +252,11 @@ delete from erp_project_plan_stage - ${ew.getCustomSqlSegment} + + + AND ${ew.sqlSegment} + + @@ -255,7 +271,11 @@ diff --git a/ruoyi-modules/ruoyi-oa/src/main/resources/mapper/oa/erp/ErpProjectReceivingMapper.xml b/ruoyi-modules/ruoyi-oa/src/main/resources/mapper/oa/erp/ErpProjectReceivingMapper.xml index 6a975351..c38974c7 100644 --- a/ruoyi-modules/ruoyi-oa/src/main/resources/mapper/oa/erp/ErpProjectReceivingMapper.xml +++ b/ruoyi-modules/ruoyi-oa/src/main/resources/mapper/oa/erp/ErpProjectReceivingMapper.xml @@ -31,7 +31,11 @@ left join sys_user u1 on t.manager_id = u1.user_id left join sys_user u3 on t.charge_id = u3.user_id left join sys_user u4 on t.deputy_id = u4.user_id - ${ew.getCustomSqlSegment} + + + AND ${ew.sqlSegment} + + @@ -64,7 +68,11 @@ @@ -76,7 +84,11 @@ left join sys_user u1 on t.manager_id = u1.user_id left join sys_user u3 on t.charge_id = u3.user_id left join sys_user u4 on t.deputy_id = u4.user_id - ${ew.getCustomSqlSegment} + + + AND ${ew.sqlSegment} + + @@ -229,7 +241,11 @@ delete from erp_project_receiving - ${ew.getCustomSqlSegment} + + + AND ${ew.sqlSegment} + + @@ -244,7 +260,11 @@ diff --git a/ruoyi-modules/ruoyi-wms/src/main/resources/mapper/wms/WmsShippingBillMapper.xml b/ruoyi-modules/ruoyi-wms/src/main/resources/mapper/wms/WmsShippingBillMapper.xml index 64058355..896673a3 100644 --- a/ruoyi-modules/ruoyi-wms/src/main/resources/mapper/wms/WmsShippingBillMapper.xml +++ b/ruoyi-modules/ruoyi-wms/src/main/resources/mapper/wms/WmsShippingBillMapper.xml @@ -16,7 +16,11 @@ t.supplier, t.supplier_id, t.contact_user, t.contact_number, t.receiver_name, t.receiver_phone, t.logistics_company, t.tracking_no, t.logistics_phone, t.directions, t.plan_arrival_time, t.shipping_time, t.received_time, t.completed_time, t.out_stock_bill_status, t.flow_status, t.shipping_status, t.warehouse_id, t.warehouse_name, t.remark, t.del_flag, t.create_dept, t.create_by, t.create_time, t.update_by, t.update_time from wms_shipping_bill t left join erp_contract_info c on t.contract_id = c.contract_id - ${ew.getCustomSqlSegment} + + + AND ${ew.sqlSegment} + + @@ -57,7 +61,11 @@ @@ -65,7 +73,11 @@ select t.shipping_bill_id, t.tenant_id, t.shipping_code, t.shipping_type, t.shipping_mode, t.bind_type, t.project_id, t.project_code, t.project_name, t.customer_id, t.customer_contact_id, t.customer_name, t.shipping_address, t.inventory_amount, t.source_bill_type, t.source_bill_id, t.source_bill_code, t.contract_id, t.contract_code, t.contract_name, c.order_contract_code as orderContractCode, t.supplier, t.supplier_id, t.contact_user, t.contact_number, t.receiver_name, t.receiver_phone, t.logistics_company, t.tracking_no, t.logistics_phone, t.directions, t.plan_arrival_time, t.shipping_time, t.received_time, t.completed_time, t.out_stock_bill_status, t.flow_status, t.shipping_status, t.warehouse_id, t.warehouse_name, t.remark, t.del_flag, t.create_dept, t.create_by, t.create_time, t.update_by, t.update_time from wms_shipping_bill t left join erp_contract_info c on t.contract_id = c.contract_id - ${ew.getCustomSqlSegment} + + + AND ${ew.sqlSegment} + + @@ -407,7 +419,11 @@ delete from wms_shipping_bill t - ${ew.getCustomSqlSegment} + + + AND ${ew.sqlSegment} + + @@ -422,7 +438,11 @@ diff --git a/ruoyi-modules/ruoyi-wms/src/main/resources/mapper/wms/WmsShippingDetailsMapper.xml b/ruoyi-modules/ruoyi-wms/src/main/resources/mapper/wms/WmsShippingDetailsMapper.xml index f766a73d..78a48d0b 100644 --- a/ruoyi-modules/ruoyi-wms/src/main/resources/mapper/wms/WmsShippingDetailsMapper.xml +++ b/ruoyi-modules/ruoyi-wms/src/main/resources/mapper/wms/WmsShippingDetailsMapper.xml @@ -8,7 +8,11 @@ @@ -31,14 +35,22 @@ @@ -240,7 +252,11 @@ delete from wms_shipping_details t - ${ew.getCustomSqlSegment} + + + AND ${ew.sqlSegment} + + @@ -255,7 +271,11 @@