参数赋值，漏洞修复

futian.liu

2023-11-28 c29479a57db73c4dd379788d1b819e716ff7e1c1

 consum-base/src/main/java/com/consum/base/controller/LWhFormScrappedController.java

@@ -1,22 +1,39 @@
package com.consum.base.controller;

import cn.afterturn.easypoi.excel.ExcelExportUtil;
import cn.afterturn.easypoi.excel.entity.ExportParams;
import com.consum.base.BaseController;
import com.consum.base.pojo.*;
import com.consum.base.service.LWhFormScrappedGoodsService;
import com.consum.base.core.utils.CommonUtil;
import com.consum.base.core.utils.MapUtils;
import com.consum.base.core.utils.MapperUtil;
import com.consum.base.core.utils.PageUtil;
import com.consum.base.pojo.LWhFormScrappedParam;
import com.consum.base.pojo.excel.ScrappedInfoExport;
import com.consum.base.pojo.query.LWhFormScrappedQry;
import com.consum.base.pojo.response.FromTransferTemplateInfoVO;
import com.consum.base.pojo.response.LWhFormScrappedExtendVO;
import com.consum.base.pojo.response.LWhFormScrappedVO;
import com.consum.base.service.LWhFormScrappedServiceImpl;
import com.consum.model.po.*;
import com.consum.model.vo.LWhFormOutputVo;
import com.consum.model.vo.LWhFormTransferVo;
import com.iplatform.model.po.S_user_core;
import com.walker.db.page.GenericPager;
import com.consum.model.po.FinSysTenantUser;
import com.consum.model.po.LWhFormScrapped;
import com.walker.infrastructure.utils.CollectionUtils;
import com.walker.web.ResponseValue;
import io.swagger.annotations.Api;
import io.swagger.annotations.ApiImplicitParam;
import io.swagger.annotations.ApiImplicitParams;
import io.swagger.annotations.ApiOperation;
import org.apache.commons.compress.utils.Lists;
import org.apache.poi.ss.usermodel.Workbook;
import org.springframework.beans.BeanUtils;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.web.bind.annotation.*;

import java.lang.reflect.Field;
import java.util.ArrayList;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.io.OutputStream;
import java.net.URLEncoder;
import java.util.HashMap;
import java.util.List;
import java.util.Map;

@@ -25,109 +42,171 @@
 * @Author 卢庆阳
 * @Date 2023/11/1
 */
@Api(value = "报废单", tags = "报废单")
@RestController
@RequestMapping("/pc/l/wh/form/scrapped")
public class LWhFormScrappedController extends BaseController {

    @Autowired
    private LWhFormScrappedServiceImpl lWhFormScrappedService;
    @Autowired
    private LWhFormScrappedGoodsService scrappedGoodsService;


    /**
     * @Description  新增报废单
     * @Description 新增报废单
     * @Author 卢庆阳
     * @Date 2023/11/1
     */
    @ApiOperation(value = "新增报废单", notes = "新增报废单")
    @ApiImplicitParams({
            @ApiImplicitParam(name = "param")
    })
    @PostMapping("/add")
    public ResponseValue add(@RequestBody LWhFormScrappedParam param) {
    public ResponseValue add() {
        LWhFormScrappedParam param = CommonUtil.getObjFromReqBody(LWhFormScrappedParam.class);
        LWhFormScrappedParam query = new LWhFormScrappedParam();
        CommonUtil.copyProperties(param, query);
        param = query;
        FinSysTenantUser sysInfo = this.getSysInfo();
        int result = this.lWhFormScrappedService.add(param, this.getCurrentUser(),sysInfo);
        if (result > 0) return ResponseValue.success(1);
        int result = this.lWhFormScrappedService.add(param,0, this.getCurrentUser(), sysInfo);
        if (result > 0) {
            return ResponseValue.success(1);
        }
        return ResponseValue.error("新增失败！");
    }

    @ApiOperation(value = "新增报废单", notes = "新增报废单")
    @ApiImplicitParams({
            @ApiImplicitParam(name = "param")
    })
    @PostMapping("/deprAdd")
    public ResponseValue deprAdd() {
        LWhFormScrappedParam param = CommonUtil.getObjFromReqBody(LWhFormScrappedParam.class);
        LWhFormScrappedParam query = new LWhFormScrappedParam();
        CommonUtil.copyProperties(param, query);
        param = query;

        FinSysTenantUser sysInfo = this.getSysInfo();
        int result = this.lWhFormScrappedService.add(param,1, this.getCurrentUser(), sysInfo);
        if (result > 0) {
            return ResponseValue.success(1);
        }
        return ResponseValue.error("新增失败！");
    }

    /**
     * @Description  列表查询
     * @Description 列表查询
     * @Author 卢庆阳
     * @Date 2023/11/02
     * @Date 2023/11/02 1.查询报废单 2.查询报废单物品
     */
    //1.查询报废单
    //2.查询报废单物品
    @ApiOperation(value = "列表查询", notes = "列表查询")
    @ApiImplicitParams({
            @ApiImplicitParam(name = "param", value = "查询条件", dataType = "LWhFormScrappedQry", paramType = "query")
    })
    @GetMapping("/list")
    public ResponseValue queryList(LWhFormScrappedParam param) {
    public ResponseValue queryList() {
        LWhFormScrappedQry param = CommonUtil.getObjFromReq(LWhFormScrappedQry.class);
        LWhFormScrappedQry query = new LWhFormScrappedQry();
        CommonUtil.copyProperties(param, query);
        param = query;

        FinSysTenantUser sysInfo = getSysInfo();
        if (sysInfo == null) {
            return ResponseValue.error("登录用户信息不存在");
        }

        GenericPager genericPager = lWhFormScrappedService.queryList(param,sysInfo);
        List<LWhFormScrapped> datas = genericPager.getDatas();
        ArrayList<LWhFormScrappedExtend> newDatas = new ArrayList<>();
        if (!CollectionUtils.isEmpty(datas)) {
            datas.forEach(item -> {
                // 查询报废单物品
                LWhFormScrappedGoods scrappedGoods = new LWhFormScrappedGoods();
                scrappedGoods.setFormScrappedId(item.getId());
                List<LWhFormScrappedGoods> scrappedGoodsList = scrappedGoodsService.select(scrappedGoods);
                LWhFormScrappedExtend formScrappedExtend = new LWhFormScrappedExtend();
                BeanUtils.copyProperties(item, formScrappedExtend);
                formScrappedExtend.setScrappedGoodsList(scrappedGoodsList);
                newDatas.add(formScrappedExtend);
        PageUtil genericPager = lWhFormScrappedService.queryList(param, sysInfo);
        List<LWhFormScrapped> data = genericPager.getDatas();
        List<LWhFormScrappedVO> result = Lists.newArrayList();
        if (!CollectionUtils.isEmpty(data)) {
            data.forEach(item -> {
                LWhFormScrappedVO lWhFormScrappedVO = new LWhFormScrappedVO();
                BeanUtils.copyProperties(item, lWhFormScrappedVO);
                List<FromTransferTemplateInfoVO> list = Lists.newArrayList();
                // 查询型号数量
                String sql =
                        "SELECT fsg.id,fsg.BASE_GOODS_TEMPLATE_ID goodsTemplatesId,fsg.GOODS_TEMPLATE_NAME goodsName,sum(counts) count FROM l_wh_form_scrapped fs left join l_wh_form_scrapped_goods fsg on fs.id = fsg.FORM_SCRAPPED_ID "
                                + "where fsg.FORM_SCRAPPED_ID =:id group by fsg.BASE_GOODS_TEMPLATE_ID";
                Map<String, Object> paramMap = new HashMap<>();
                paramMap.put("id", item.getId());
                List<Map<String, Object>> procureModelList = lWhFormScrappedService.select(sql, paramMap, new MapperUtil());
                for (Map<String, Object> map : procureModelList) {
                    FromTransferTemplateInfoVO fromTransferTemplateInfoVO = MapUtils.convertMapToObj(map, FromTransferTemplateInfoVO.class);
                    list.add(fromTransferTemplateInfoVO);
                }
                lWhFormScrappedVO.setGoodTemplateInfo(list);
                result.add(lWhFormScrappedVO);
            });
        }
        try {
            Field fieldDatas = GenericPager.class.getDeclaredField("datas");
            fieldDatas.setAccessible(true);
            fieldDatas.set(genericPager, newDatas);
        } catch (Exception e) {
            e.printStackTrace();
        }
//        genericPager.setDatas(newDatas);
        genericPager.setDatas(result);
        return ResponseValue.success(genericPager);
    }

    /**
     * @Description  根据id查询详情
     * @Description 根据id查询详情
     * @Author 卢庆阳
     * @Date 2023/11/2
     */
    @ApiOperation(value = "根据id查询详情", notes = "根据id查询详情")
    @ApiImplicitParams({
            @ApiImplicitParam(name = "id", value = "报废单id", dataType = "Long", paramType = "query")
    })
    @GetMapping("/detail")
    public ResponseValue getById(Long id) {
        if (id == null) {
            return ResponseValue.error("报废单id为空");
        }
        LWhFormScrappedExtend scrappedExtend = this.lWhFormScrappedService.getById(id);
        LWhFormScrappedExtendVO scrappedExtend = this.lWhFormScrappedService.getById(id);
        return ResponseValue.success(scrappedExtend);
    }

    /**
     * 报废明细
     * @param param
     *
     * @param
     * @return
     */
    @ApiOperation(value = "报废明细", notes = "报废明细")
    @ApiImplicitParams({
            @ApiImplicitParam(name = "param", value = "查询条件", dataType = "LWhFormScrappedQry", paramType = "query")
    })
    @GetMapping("/list/detailList")
    public ResponseValue queryDetailList(LWhFormScrappedParam param) {
    public ResponseValue queryDetailList( ) {
        LWhFormScrappedQry param = CommonUtil.getObjFromReq(LWhFormScrappedQry.class);
        LWhFormScrappedQry query = new LWhFormScrappedQry();
        CommonUtil.copyProperties(param, query);
        param = query;

        FinSysTenantUser sysInfo = this.getSysInfo();
        if (sysInfo == null) {
            return ResponseValue.error("登录用户信息不存在");
        }
        GenericPager<Map<String, Object>> genericPager = lWhFormScrappedService.queryDetailList(param,sysInfo);
        return ResponseValue.success(genericPager);
        PageUtil pageUtil = lWhFormScrappedService.queryDetailList(param, sysInfo);
        return ResponseValue.success(pageUtil);
    }

    /**
     * @Description  导出报废登记单
     * @Description 导出报废登记单
     * @Author 卢庆阳
     * @Date 2023/11/2
     */
    @GetMapping("/export")
    public ResponseValue export(Long id) {
    public ResponseValue export(Long id, HttpServletRequest request, HttpServletResponse response) {
        if (id == null) {
            return ResponseValue.error("报废单id为空");
        }
        LWhFormScrappedExtend scrappedExtend = this.lWhFormScrappedService.export(id,this.getSysInfo());
        return ResponseValue.success(scrappedExtend);
        try {
            OutputStream outputStream = response.getOutputStream();
            List<Map<String, Object>> export = lWhFormScrappedService.export(id);
            ExportParams exportParams = new ExportParams("报废单登记", "报废单登记");
            Workbook sheets = ExcelExportUtil.exportExcel(exportParams, ScrappedInfoExport.class, export);
            // 设置响应头
            response.setContentType("application/vnd.openxmlformats-officedocument.spreadsheetml.sheet;charset=utf-8");
            response.setHeader("Content-disposition", "attachment;filename=" + URLEncoder.encode("报废单登记.xlsx", "utf-8"));
            sheets.write(outputStream);
            sheets.close();
        } catch (IOException e) {
            throw new RuntimeException(e);
        }
        return ResponseValue.success();
    }