修复SQL注入

controllers/data_manage/correlation/correlation_chart_info.go

@@ -516,7 +516,9 @@ func (this *CorrelationChartInfoController) List() {
 		condition += " AND chart_classify_id IN(" + chartClassifyId + ") "
 	}
 	if keyword != "" {
-		condition += ` AND  ( chart_name LIKE '%` + keyword + `%' )`
+		likeKey := `%` + keyword + `%`
+		condition += ` AND  ( chart_name LIKE ? )`
+		pars = append(pars, likeKey)
 	}
 
 	//只看我的

controllers/data_manage/cross_variety/chart_info.go

@@ -91,7 +91,10 @@ func (c *ChartInfoController) List() {
 		condition += " AND chart_classify_id IN(" + chartClassifyId + ") "
 	}
 	if keyword != "" {
-		condition += ` AND  ( chart_name LIKE '%` + keyword + `%' )`
+		likeKey := `%` + keyword + `%`
+		//condition += ` AND  ( chart_name LIKE '%` + keyword + `%' )`
+		condition += ` AND  ( chart_name LIKE ? )`
+		pars = append(pars, likeKey)
 	}
 
 	//只看我的

controllers/data_manage/edb_info.go

@@ -2100,9 +2100,11 @@ func (this *EdbInfoController) EdbInfoList() {
 	}
 
 	if keyWord != "" {
-		condition += ` AND  ( edb_code LIKE '%` + keyWord + `%'  OR  edb_name LIKE '%` + keyWord + `%' )`
-		//pars = append(pars, keyWord)
-		//pars = append(pars, keyWord)
+		likeKey := `%` + keyWord + `%`
+		//condition += ` AND  ( edb_code LIKE '%` + keyWord + `%'  OR  edb_name LIKE '%` + keyWord + `%' )`
+		condition += ` AND  ( edb_code LIKE ?  OR  edb_name LIKE ? )`
+		pars = append(pars, likeKey)
+		pars = append(pars, likeKey)
 	}
 
 	resp := new(data_manage.EdbInfoListResp)
@@ -3233,7 +3235,11 @@ func (this *EdbInfoController) EdbInfoFilter() {
 		if filterSource == 4 {
 			condition += ` AND edb_type = 1 `
 		}
-		conditionWhere := `AND  ( edb_code LIKE '%` + v + `%'  OR  edb_name LIKE '%` + v + `%' )`
+		//conditionWhere := `AND  ( edb_code LIKE '%` + v + `%'  OR  edb_name LIKE '%` + v + `%' )`
+		likeKey := `%` + v + `%`
+		conditionWhere := `AND  ( edb_code LIKE ?  OR  edb_name LIKE ? )`
+		pars = append(pars, likeKey)
+		pars = append(pars, likeKey)
 
 		condition += conditionWhere + baseCondition
 		newEdbInfoList, err := data_manage.GetEdbInfoFilter(condition, pars)

controllers/data_manage/future_good/future_good_chart_info.go

@@ -89,7 +89,10 @@ func (this *FutureGoodChartInfoController) ChartList() {
 		//pars = append(pars, chartClassifyId)
 	}
 	if keyword != "" {
-		condition += ` AND  ( chart_name LIKE '%` + keyword + `%' )`
+		likeKey := `%` + keyword + `%`
+		//condition += ` AND  ( chart_name LIKE '%` + keyword + `%' )`
+		condition += ` AND  ( chart_name LIKE ? )`
+		pars = append(pars, likeKey)
 	}
 
 	//只看我的

controllers/data_manage/line_equation/line_chart_info.go

@@ -595,7 +595,10 @@ func (this *LineEquationChartInfoController) List() {
 		condition += " AND chart_classify_id IN(" + chartClassifyId + ") "
 	}
 	if keyword != "" {
-		condition += ` AND  ( chart_name LIKE '%` + keyword + `%' )`
+		//condition += ` AND  ( chart_name LIKE '%` + keyword + `%' )`
+		likeKey := `%` + keyword + `%`
+		condition += ` AND  ( chart_name LIKE ? )`
+		pars = append(pars, likeKey)
 	}
 
 	//只看我的

controllers/data_manage/line_feature/chart_info.go

@@ -1639,7 +1639,10 @@ func (this *LineFeaturesChartInfoController) List() {
 		condition += " AND chart_classify_id IN(" + chartClassifyId + ") "
 	}
 	if keyword != "" {
-		condition += ` AND  ( chart_name LIKE '%` + keyword + `%' )`
+		likeKey := `%` + keyword + `%`
+		//condition += ` AND  ( chart_name LIKE '%` + keyword + `%' )`
+		condition += ` AND  ( chart_name LIKE ? )`
+		pars = append(pars, likeKey)
 	}
 
 	//只看我的

controllers/data_manage/my_chart.go

@@ -51,7 +51,7 @@ func (this *MyChartController) ChartList() {
 	pageSize, _ := this.GetInt("PageSize")
 	currentIndex, _ := this.GetInt("CurrentIndex")
 	keyWord := this.GetString("KeyWord")
-	
+
 	var total int
 	page := paging.GetPaging(currentIndex, pageSize, total)
 
@@ -74,14 +74,14 @@ func (this *MyChartController) ChartList() {
 	chartClassifyIds := make([]int, 0)
 	var classifyList []*data_manage.ChartClassifyItems
 	var err error
-	
+
 	classifyList, err = data_manage.GetChartClassifyAllBySourceIsSelected(utils.CHART_SOURCE_DEFAULT, isSelected)
 	if err != nil {
 		br.Msg = "获取失败"
 		br.ErrMsg = fmt.Sprintf("获取图表分类失败, Err: %v", err)
 		return
 	}
-	
+
 	if chartClassifyId > 0 {
 		parents := data.GetChartClassifyChildrenRecursive(classifyList, chartClassifyId)
 		sort.Slice(parents, func(i, j int) bool {
@@ -100,7 +100,11 @@ func (this *MyChartController) ChartList() {
 		pars = append(pars, chartClassifyIds)
 	}
 	if keyWord != "" {
-		condition += ` AND  ( chart_name LIKE '%` + keyWord + `%' OR chart_name_en LIKE '%` + keyWord + `%' )`
+		likeKey := `%` + keyWord + `%`
+		//condition += ` AND  ( chart_name LIKE '%` + keyWord + `%' OR chart_name_en LIKE '%` + keyWord + `%' )`
+		condition += ` AND  ( chart_name LIKE ? OR chart_name_en LIKE ? )`
+		pars = append(pars, likeKey)
+		pars = append(pars, likeKey)
 	}
 
 	//只看我的
@@ -1679,7 +1683,10 @@ func (this *MyChartController) MyChartSearch() {
 
 	keyWord := this.GetString("KeyWord")
 	if keyWord != "" {
-		condition += ` AND chart_name LIKE '%` + keyWord + `%' `
+		//condition += ` AND chart_name LIKE '%` + keyWord + `%' `
+		condition += ` AND chart_name LIKE ? `
+		likeKey := `%` + keyWord + `%`
+		pars = append(pars, likeKey)
 	}
 
 	//获取图表信息

controllers/data_manage/predict_edb_info.go

@@ -226,9 +226,12 @@ func (this *PredictEdbInfoController) List() {
 	}
 
 	if keyWord != "" {
-		condition += ` AND  ( edb_code LIKE '%` + keyWord + `%'  OR  edb_name LIKE '%` + keyWord + `%' )`
-		//pars = append(pars, keyWord)
-		//pars = append(pars, keyWord)
+
+		likeKey := `%` + keyWord + `%`
+
+		condition += ` AND  ( edb_code LIKE ?  OR  edb_name LIKE ? )`
+		pars = append(pars, likeKey)
+		pars = append(pars, likeKey)
 	}
 
 	resp := data_manage.EdbInfoListResp{}

controllers/data_manage/range_analysis/chart_info.go

@@ -762,12 +762,18 @@ func (this *RangeChartChartInfoController) List() {
 	if keyword != "" {
 		//将关键词按照空格分割
 		keywords := strings.Split(keyword, " ")
-		condition += ` AND  ( chart_name LIKE '%` + keywords[0] + `%' `
+		//condition += ` AND  ( chart_name LIKE '%` + keywords[0] + `%' `
+		likeKey := `%` + keywords[0] + `%`
+		condition += ` AND  ( chart_name LIKE ? `
+		pars = append(pars, likeKey)
 		for k, key := range keywords {
 			if k == 0 {
 				continue
 			}
-			condition += ` OR chart_name LIKE '%` + key + `%' `
+			//condition += ` OR chart_name LIKE '%` + key + `%' `
+			likeKey := `%` + key + `%`
+			condition += ` OR chart_name LIKE ? `
+			pars = append(pars, likeKey)
 		}
 		condition += ` )`
 	}

controllers/material/material.go

@@ -753,9 +753,13 @@ func (this *MaterialController) List() {
 	if keyword != "" {
 		switch this.Lang {
 		case utils.LANG_EN:
-			condition += ` AND  ( material_name_en LIKE '%` + keyword + `%' )`
+			likeKey := `%` + keyword + `%`
+			condition += ` AND  ( material_name_en LIKE ? )`
+			pars = append(pars, likeKey)
 		default:
-			condition += ` AND  ( material_name LIKE '%` + keyword + `%' )`
+			likeKey := `%` + keyword + `%`
+			condition += ` AND  ( material_name LIKE ? )`
+			pars = append(pars, likeKey)
 		}
 	}
 

controllers/ppt.go

@@ -53,7 +53,11 @@ func (this *PptController) ListPpt() {
 	var pars []interface{}
 
 	if keyWord != "" {
-		condition += ` AND (title LIKE '%` + keyWord + `%' OR admin_real_name LIKE '%` + keyWord + `%' ) `
+		//condition += ` AND (title LIKE '%` + keyWord + `%' OR admin_real_name LIKE '%` + keyWord + `%' ) `
+		likeKey := `%` + keyWord + `%`
+		condition += ` AND (title LIKE ? OR admin_real_name LIKE ? ) `
+		pars = append(pars, likeKey)
+		pars = append(pars, likeKey)
 	}
 	total, err := models.GetPptListCount(condition, pars)
 	if err != nil {

controllers/sandbox/sandbox.go

@@ -54,7 +54,11 @@ func (this *SandboxController) ListByQuote() {
 	}
 
 	if keyword != "" {
-		condition += ` AND  ( a.name LIKE '%` + keyword + `%' OR  a.chart_permission_name LIKE '%` + keyword + `%' )`
+		//condition += ` AND  ( a.name LIKE '%` + keyword + `%' OR  a.chart_permission_name LIKE '%` + keyword + `%' )`
+		likeKey := `%` + keyword + `%`
+		condition += ` AND  ( a.name LIKE ? OR  a.chart_permission_name LIKE ? )`
+		pars = append(pars, likeKey)
+		pars = append(pars, likeKey)
 	}
 
 	//获取指标信息

services/material/material.go

@@ -559,9 +559,13 @@ func GetBatchSelectedMaterialList(classifyId int, keyword string, isShowMe bool,
 	if keyword != "" {
 		switch lang {
 		case utils.LANG_EN:
-			condition += ` AND  ( material_name_en LIKE '%` + keyword + `%' )`
+			likeKey := `%` + keyword + `%`
+			condition += ` AND  ( material_name_en LIKE ? )`
+			pars = append(pars, likeKey)
 		default:
-			condition += ` AND  ( material_name LIKE '%` + keyword + `%' )`
+			likeKey := `%` + keyword + `%`
+			condition += ` AND  ( material_name LIKE ? )`
+			pars = append(pars, likeKey)
 		}
 	}