潘钊 / bsth_control · Commits

Commit e808a67d47202c44301f8d09f863f5a9a1c09096

Authored by yiming
1 parent 0dcb03d2
build: skipped

SQL注入漏洞修复

Inline Side-by-side
Showing 8 changed files with 88 additions and 28 deletions
src/main/java/com/bsth/repository/calc/CalcIntervalRepository.java
  View file @e808a67
1 1 package com.bsth.repository.calc;
2 2  
3 3 import java.util.List;
  4 +import java.util.Map;
4 5  
5 6 import org.springframework.data.jpa.repository.Query;
6 7 import org.springframework.data.repository.query.Param;
... ... @@ -54,4 +55,12 @@ public interface CalcIntervalRepository extends BaseRepository<CalcInterval, Int
54 55 // 按日期查询
55 56 @Query(value="select c from CalcInterval c where c.date in (:dates)")
56 57 List<CalcInterval> selectByDates(@Param("dates")List<String> dates);
  58 +
  59 + @Query(value = "select gsbm,fgsbm,xl_bm as xlBm,xl_name as xlName,level,djg_all as djgAll,bcs,sfyy as sfyyB from bsth_c_calc_interval where date >= ?1 and date <= ?2 and level is not null and level <> '' " +
  60 + "and if ( ?3 > 0 and ?4 > 0 , gsbm = ?5 and fgsbm = ?6 , 1=1 ) " +
  61 + "and if ( ?3 > 0 and ?4 = 0 , gsbm = ?5, 1=1) " +
  62 + "and if ( ?7 > 0 and ?9 = '1' , date not in ( ?8 ) , 1=1) " +
  63 + "and if ( ?7 > 0 and ?9 = '2' , date in ( ?8 ) , 1=1) " +
  64 + "order by gsbm,fgsbm,level", nativeQuery = true)
  65 + List<Map<String, Object>> sumInterval(String sDate,String eDate,int gsl,int fgsl,String gs,String fgs,int weekendl,List<String> weekend,String week);
57 66 }
... ...
src/main/java/com/bsth/repository/oil/DlbRepository.java
  View file @e808a67
... ... @@ -116,5 +116,8 @@ public interface DlbRepository extends BaseRepository&lt;Dlb, Integer&gt;{
116 116  
117 117 @Query(value="SELECT * FROM bsth_c_dlb where rq=?1 and xlbm=?2",nativeQuery=true)
118 118 List<Dlb> queryDlbByRqXlbm(String rq, String xlbm);
  119 +
  120 + @Query(value="select * from bsth_c_dlb where rq BETWEEN ?1 and ?2 and if( ?3 is not null , xlbm = ?3 , fgsdm = ?4 and xlbm =?5)",nativeQuery=true)
  121 + List<Dlb> dlbList(String date ,String date2 ,String line ,String gsdm ,String fgsdm);
119 122  
120 123 }
... ...
src/main/java/com/bsth/repository/oil/YlbRepository.java
  View file @e808a67
... ... @@ -189,6 +189,9 @@ public interface YlbRepository extends BaseRepository&lt;Ylb, Integer&gt;{
189 189 " yhlx = ?9"+
190 190 " WHERE id = ?1", nativeQuery=true)
191 191 public void ylbUpdate(Integer id,double czyl,double jzyl,double yh, double sh,String shyy,double ns,String rylx,int yhlx);
  192 +
  193 + @Query(value="select * from bsth_c_ylb where rq BETWEEN ?1 and ?2 and if( ?3 is not null , xlbm = ?3 , fgsdm = ?4 and xlbm =?5)",nativeQuery=true)
  194 + List<Ylb> ylbList(String date ,String date2 ,String line ,String gsdm ,String fgsdm);
192 195  
193 196  
194 197 }
... ...
src/main/java/com/bsth/repository/realcontrol/ScheduleRealInfoRepository.java
  View file @e808a67
... ... @@ -244,4 +244,12 @@ public interface ScheduleRealInfoRepository extends BaseRepository&lt;ScheduleRealI
244 244 "and adjust_exps = ?3 " +
245 245 "group by schedule_date_str, xl_bm, j_gh, s_gh ", nativeQuery = true)
246 246 List<Object[]> findCancelSchedule(String date1, String date2, String lbType);
  247 +
  248 + @Query(value = "select r.xl_bm as line,r.cl_zbh as nbbm from bsth_c_s_sp_info_real r where r.schedule_date_str BETWEEN ?1 and ?2 " +
  249 + "and if( ?3 is not null , r.xl_bm = ?3 , r.gs_bm = ?4 and r.fgs_bm =?5) group by r.xl_bm,r.cl_zbh", nativeQuery = true)
  250 + List<Map<String, Object>> querySchedule(String date1, String date2,String line ,String gsdm ,String fgsdm);
  251 +
  252 + @Query(value = "select r.xl_bm as line,r.cl_zbh as nbbm,r.j_gh as jGh,r.s_gh as sGh from bsth_c_s_sp_info_real r where r.schedule_date_str BETWEEN ?1 and ?2 " +
  253 + "and if( ?3 is not null , r.xl_bm = ?3 , r.gs_bm = ?4 and r.fgs_bm =?5) group by r.xl_bm,r.cl_zbh,r.j_gh,r.s_gh", nativeQuery = true)
  254 + List<Map<String, Object>> querySchedule2(String date1, String date2,String line ,String gsdm ,String fgsdm);
247 255 }
... ...
src/main/java/com/bsth/repository/sys/IntervalRepository.java
  View file @e808a67
1 1 package com.bsth.repository.sys;
2 2  
3 3  
  4 +import org.springframework.data.jpa.repository.Query;
4 5 import org.springframework.stereotype.Repository;
5 6 import com.bsth.entity.sys.Interval;
6 7 import com.bsth.repository.BaseRepository;
7 8  
  9 +import java.util.List;
  10 +
8 11 @Repository
9 12 public interface IntervalRepository extends BaseRepository<Interval, Integer> {
10 13  
  14 + @Query(value = "select i from Interval i")
  15 + List<Interval> intervalAll();
  16 +
11 17 }
... ...
src/main/java/com/bsth/service/calc/impl/CalcIntervalServiceImpl.java
  View file @e808a67
... ... @@ -6,18 +6,7 @@ import java.sql.SQLException;
6 6 import java.text.DecimalFormat;
7 7 import java.text.ParseException;
8 8 import java.text.SimpleDateFormat;
9   -import java.util.ArrayList;
10   -import java.util.Calendar;
11   -import java.util.Collections;
12   -import java.util.Comparator;
13   -import java.util.Date;
14   -import java.util.GregorianCalendar;
15   -import java.util.HashMap;
16   -import java.util.HashSet;
17   -import java.util.Iterator;
18   -import java.util.List;
19   -import java.util.Map;
20   -import java.util.Set;
  9 +import java.util.*;
21 10  
22 11 import org.apache.commons.lang3.StringUtils;
23 12 import org.springframework.beans.factory.annotation.Autowired;
... ... @@ -944,7 +933,7 @@ public class CalcIntervalServiceImpl extends BaseServiceImpl&lt;CalcInterval,Intege
944 933  
945 934 List<Map<String, Object>> listAll=new ArrayList<Map<String, Object>>();
946 935  
947   - String sql="select gsbm,fgsbm,xl_bm,xl_name,level,djg_all,bcs,sfyy"
  936 + /*String sql="select gsbm,fgsbm,xl_bm,xl_name,level,djg_all,bcs,sfyy"
948 937 + " from bsth_c_calc_interval where date>= '"+sDate+"' and date<='"+eDate+"'"
949 938 + " and level is not null and level <> '' ";
950 939 if(gs.length() > 0){
... ... @@ -962,7 +951,7 @@ public class CalcIntervalServiceImpl extends BaseServiceImpl&lt;CalcInterval,Intege
962 951 sql += " order by gsbm,fgsbm,level";
963 952  
964 953 List<Map<String, Object>> countList = new ArrayList<Map<String, Object>>();
965   - List<Map<String, Object>> list=jdbcTemplate.query(sql,
  954 + List<Map<String, Object>> list=jdbcTemplate.query(sql,
966 955 new RowMapper<Map<String,Object>>(){
967 956 @Override
968 957 public Map<String, Object> mapRow(ResultSet rs, int rowNum) throws SQLException {
... ... @@ -977,8 +966,18 @@ public class CalcIntervalServiceImpl extends BaseServiceImpl&lt;CalcInterval,Intege
977 966 m.put("sfyy", rs.getInt("sfyy"));
978 967 return m;
979 968 }
980   - });
981   -
  969 + });*/
  970 + List<Map<String, Object>> countList = new ArrayList<Map<String, Object>>();
  971 + List<String> weekendL=Arrays.asList(weekend.replace("'","").split(","));
  972 + List<Map<String, Object>> list2=calcIntervalRepository.sumInterval(sDate,eDate,gs.length(),fgs.length(),gs,fgs,weekendL.size(),weekendL,week);
  973 + List<Map<String, Object>> list=new ArrayList<>();
  974 + for (Map<String, Object> m : list2) {
  975 + Map<String, Object> m2=new HashMap<>(m);
  976 + m2.put("gs", BasicData.businessCodeNameMap.get(m2.get("gsbm")));
  977 + m2.put("fgs", BasicData.businessFgsCodeNameMap.get(m2.get("fgsbm")+"_"+m.get("gsbm")));
  978 + m2.put("sfyy",!(boolean)m2.get("sfyyB")?0:1);
  979 + list.add(m2);
  980 + }
982 981 //根据线路类型确定是否营运
983 982 for (int i = 0; i < list.size(); i++) {
984 983 Map<String, Object> m=list.get(i);
... ...
src/main/java/com/bsth/service/report/impl/CulateMileageServiceImpl.java
  View file @e808a67
1 1 package com.bsth.service.report.impl;
2 2  
  3 +import com.bsth.entity.Line;
3 4 import com.bsth.entity.realcontrol.ChildTaskPlan;
4 5 import com.bsth.entity.realcontrol.ScheduleRealInfo;
5 6 import com.bsth.entity.sys.Interval;
  7 +import com.bsth.repository.LineRepository;
  8 +import com.bsth.repository.sys.IntervalRepository;
6 9 import com.bsth.service.report.CulateMileageService;
7 10 import com.bsth.util.Arith;
8 11 import com.bsth.util.ComparableChild;
... ... @@ -24,6 +27,13 @@ import java.util.*;
24 27 public class CulateMileageServiceImpl implements CulateMileageService{
25 28 @Autowired
26 29 JdbcTemplate jdbcTemplate;
  30 +
  31 + @Autowired
  32 + LineRepository lineRepository;
  33 +
  34 + @Autowired
  35 + IntervalRepository intervalRepository;
  36 +
27 37 private static long zgf1 = 6 * 60 + 31,
28 38 zgf2 = 8 * 60 + 30,
29 39 wgf1 = 16 * 60 + 1,
... ... @@ -1360,7 +1370,7 @@ public class CulateMileageServiceImpl implements CulateMileageService{
1360 1370 SimpleDateFormat sdf=new SimpleDateFormat("yyyy-MM-dd HH:mm");
1361 1371 // Collections.sort(listInfo,new ComparableAcuals());
1362 1372 //查询所有线路
1363   - String xlSql="select line_code,spac_grade from bsth_c_line"
  1373 +/* String xlSql="select line_code,spac_grade from bsth_c_line"
1364 1374 + " where line_code ='"+line+"'";
1365 1375  
1366 1376 List<Map<String, Object>> xlList=jdbcTemplate.query(xlSql, new RowMapper<Map<String, Object>>() {
... ... @@ -1371,9 +1381,17 @@ public class CulateMileageServiceImpl implements CulateMileageService{
1371 1381 map.put("grade", arg0.getString("spac_grade"));
1372 1382 return map;
1373 1383 }
1374   - });
  1384 + });*/
  1385 + List<Line> lines=lineRepository.findLineByCode(line);
  1386 + List<Map<String, Object>> xlList = new ArrayList<>();
  1387 + for (Line l : lines) {
  1388 + Map<String, Object> map=new HashMap<String,Object>();
  1389 + map.put("line",l.getLineCode());
  1390 + map.put("grade",l.getSpacGrade());
  1391 + xlList.add(map);
  1392 + }
1375 1393 //查询大间隔时间
1376   - String djgSql="select * from bsth_c_interval";
  1394 +/* String djgSql="select * from bsth_c_interval";
1377 1395 List<Interval> djgList=jdbcTemplate.query(djgSql, new RowMapper<Interval>() {
1378 1396 @Override
1379 1397 public Interval mapRow(ResultSet arg0, int arg1) throws SQLException {
... ... @@ -1383,7 +1401,8 @@ public class CulateMileageServiceImpl implements CulateMileageService{
1383 1401 m.setTrough(arg0.getInt("trough"));
1384 1402 return m;
1385 1403 }
1386   - });
  1404 + });*/
  1405 + List<Interval> djgList=intervalRepository.intervalAll();
1387 1406  
1388 1407 for (int i = 0; i < xlList.size(); i++) {
1389 1408 String lineCode=xlList.get(i).get("line").toString();
... ...
src/main/java/com/bsth/service/report/impl/ReportServiceImpl.java
  View file @e808a67
... ... @@ -15,6 +15,8 @@ import com.bsth.entity.sys.Interval;
15 15 import com.bsth.repository.LineRepository;
16 16 import com.bsth.repository.LsStationRouteRepository;
17 17 import com.bsth.repository.StationRouteRepository;
  18 +import com.bsth.repository.oil.DlbRepository;
  19 +import com.bsth.repository.oil.YlbRepository;
18 20 import com.bsth.repository.realcontrol.ScheduleRealInfoRepository;
19 21 import com.bsth.service.LineService;
20 22 import com.bsth.service.calc.CalcWaybillService;
... ... @@ -82,6 +84,12 @@ public class ReportServiceImpl implements ReportService{
82 84 @Autowired
83 85 CalcWaybillService calcWaybillService;
84 86  
  87 + @Autowired
  88 + YlbRepository ylbRepository;
  89 +
  90 + @Autowired
  91 + DlbRepository dlbRepository;
  92 +
85 93 @Override
86 94 public List<ScheduleRealInfo> queryListBczx(String line, String date,String clzbh) {
87 95 // TODO Auto-generated method stub
... ... @@ -3098,26 +3106,29 @@ public class ReportServiceImpl implements ReportService{
3098 3106 //查询单条线路
3099 3107 list = scheduleRealInfoRepository.scheduleByDateAndLineTj2(line, date,date2);
3100 3108 }
3101   - String ylbSql=" select * from bsth_c_ylb where rq BETWEEN '"+date+"' and '"+date2+"'";
  3109 +/* String ylbSql=" select * from bsth_c_ylb where rq BETWEEN '"+date+"' and '"+date2+"'";
3102 3110 if(line.equals("")){
3103 3111 ylbSql +="and ssgsdm='"+gsdm+"' "
3104 3112 + " and fgsdm='"+fgsdm+"'";
3105 3113 }else{
3106 3114 ylbSql += " and xlbm = '"+line+"'";
3107 3115 }
3108   - List<Ylb> ylbList=ylbList(ylbSql);
3109   - String dlbSql=" select * from bsth_c_dlb where rq BETWEEN '"+date+"' and '"+date2+"'";
  3116 + List<Ylb> ylbList=ylbList(ylbSql);*/
  3117 + List<Ylb> ylbList=ylbRepository.ylbList(date,date2,line,gsdm,fgsdm);
  3118 + /*String dlbSql=" select * from bsth_c_dlb where rq BETWEEN '"+date+"' and '"+date2+"'";
3110 3119 if(line.equals("")){
3111 3120 dlbSql +="and ssgsdm='"+gsdm+"' "
3112 3121 + " and fgsdm='"+fgsdm+"'";
3113 3122 }else{
3114 3123 dlbSql += " and xlbm = '"+line+"'";
3115 3124 }
3116   - List<Dlb> dlbList=dlbList(dlbSql);
  3125 + List<Dlb> dlbList=dlbList(dlbSql);*/
  3126 + List<Dlb> dlbList=dlbRepository.dlbList(date,date2,line,gsdm,fgsdm);
  3127 +
3117 3128 List<Map<String, Object>> listGroupBy =null;
3118 3129 String sql="";
3119 3130 if(zt.equals("zbh")){
3120   - sql+="select r.xl_bm,r.cl_zbh"
  3131 + /*sql+="select r.xl_bm,r.cl_zbh"
3121 3132 + " from bsth_c_s_sp_info_real r where"
3122 3133 + " r.schedule_date_str BETWEEN '"+date+"' and '"+date2+"'";
3123 3134 if(line.equals("")){
... ... @@ -3135,9 +3146,10 @@ public class ReportServiceImpl implements ReportService{
3135 3146 map.put("nbbm", arg0.getString("cl_zbh"));
3136 3147 return map;
3137 3148 }
3138   - });
  3149 + });*/
  3150 + listGroupBy =scheduleRealInfoRepository.querySchedule(date,date2,line,gsdm,fgsdm);
3139 3151 }else{
3140   - sql+="select r.xl_bm,r.cl_zbh,r.j_gh,r.s_gh"
  3152 + /*sql+="select r.xl_bm,r.cl_zbh,r.j_gh,r.s_gh"
3141 3153 + " from bsth_c_s_sp_info_real r where"
3142 3154 + " r.schedule_date_str BETWEEN '"+date+"' and '"+date2+"'";
3143 3155 if(line.equals("")){
... ... @@ -3159,7 +3171,8 @@ public class ReportServiceImpl implements ReportService{
3159 3171 // map.put("sName", arg0.getString("s_name"));
3160 3172 return map;
3161 3173 }
3162   - });
  3174 + });*/
  3175 + listGroupBy =scheduleRealInfoRepository.querySchedule2(date,date2,line,gsdm,fgsdm);
3163 3176 }
3164 3177  
3165 3178  
... ...