fix: 修复order by和limit、page的sql注入风险
This commit is contained in:
parent
b6bb886e2b
commit
fa6333910b
@ -2,10 +2,10 @@ package lxDb
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"git.listensoft.net/tool/lxutils/lxUtil"
|
||||
"gorm.io/gorm"
|
||||
"regexp"
|
||||
"strings"
|
||||
|
||||
"git.listensoft.net/
|
||||
)
|
||||
|
||||
// 带事务的, 和不带事务的 说明:
|
||||
@ -337,7 +337,6 @@ func SqlQueryNew(tx *gorm.DB, sql string, list interface{}, q *PaginationQuery,
|
||||
// 条件字段
|
||||
if q != nil {
|
||||
where, args := q.BuildRawWhere()
|
||||
|
||||
|
||||
if hasWhere(sql) { // 原SQL已有WHERE子句
|
||||
// 确保 where 子句以 AND 或 OR 开头,然后安全添加
|
||||
|
||||
Loading…
Reference in New Issue
Block a user