周伟鹏 / cnlive_shenhe · Commits

Commit 880669c11c833ab10e13da301a11802722e75746

Authored by 李虎
1 parent 3f105f6e

审核云越权漏洞

Inline Side-by-side
Showing 3 changed files with 61 additions and 46 deletions
src/main/java/com/cnlive/shenhe/mapper/ShyAudioMapper.java
  View file @880669c
... ... @@ -15,4 +15,6 @@ public interface ShyAudioMapper extends Mapper<ShyAudio> {
15 15 */
16 16 ShyAudio getAudioMsg(@Param(value = "audioId") String audioId);
17 17  
  18 + ShyAudio getAudioBySpId(@Param(value = "id") Integer id,
  19 + @Param(value = "spId") Integer spId);
18 20 }
19 21 \ No newline at end of file
... ...
src/main/java/com/cnlive/shenhe/service/serviceImpl/AudioServiceImpl.java
  View file @880669c
... ... @@ -323,13 +323,14 @@ public class AudioServiceImpl implements AudioService {
323 323  
324 324 @Override
325 325 public ShyAudio getDetailsAudio(Integer id, Integer spid) {
326   - ShyAudio audio = new ShyAudio();
327   - audio.setId(id);
328   - if (spid != 0) {
329   - audio.setSpId(spid);
330   - }
331 326 //ShyAudio shyAudio = shyAudioMapper.selectByPrimaryKey(id);
332   - ShyAudio shyAudio = shyAudioMapper.selectByPrimaryKey(audio);
  327 + /*Example example = new Example(ShyAudio.class);
  328 + example.createCriteria().andEqualTo("id", id)
  329 + .andEqualTo("spId", spid);
  330 +
  331 + List<ShyAudio> shyAudios = shyAudioMapper.selectByExample(example);*/
  332 + //ShyAudio shyAudio = shyAudioMapper.selectOne(audio);
  333 + ShyAudio shyAudio = shyAudioMapper.getAudioBySpId(id, spid);
333 334 logger.info("查询音频实体参数:{}", JSON.toJSON(shyAudio));
334 335 if (CommonUtils.isNotNull(shyAudio)) {
335 336 if (!shyAudio.getState().equals(CommonConst.AUDIT_INTT)) {
... ...
src/main/resources/mapper/ShyAudioMapper.xml
  View file @880669c
1 1 <?xml version="1.0" encoding="UTF-8"?>
2 2 <!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd">
3 3 <mapper namespace="com.cnlive.shenhe.mapper.ShyAudioMapper">
4   - <resultMap id="BaseResultMap" type="com.cnlive.shenhe.entity.ShyAudio">
5   - <!--
6   - WARNING - @mbg.generated
7   - -->
8   - <id column="id" jdbcType="INTEGER" property="id" />
9   - <result column="multiplecategory" jdbcType="VARCHAR" property="multiplecategory" />
10   - <result column="audioClipsName" jdbcType="VARCHAR" property="audioClipsName" />
11   - <result column="soure" jdbcType="INTEGER" property="soure" />
12   - <result column="audioId" jdbcType="VARCHAR" property="audioId" />
13   - <result column="audioTitle" jdbcType="VARCHAR" property="audioTitle" />
14   - <result column="audioUrl" jdbcType="VARCHAR" property="audioUrl" />
15   - <result column="audioCoverUrl" jdbcType="VARCHAR" property="audioCoverUrl" />
16   - <result column="audioIntro" jdbcType="VARCHAR" property="audioIntro" />
17   - <result column="audioTag" jdbcType="VARCHAR" property="audioTag" />
18   - <result column="audioKeyword" jdbcType="VARCHAR" property="audioKeyword" />
19   - <result column="uploadTime" jdbcType="TIMESTAMP" property="uploadTime" />
20   - <result column="priority" jdbcType="INTEGER" property="priority" />
21   - <result column="callback" jdbcType="VARCHAR" property="callback" />
22   - <result column="spId" jdbcType="INTEGER" property="spId" />
23   - <result column="bucketName" jdbcType="VARCHAR" property="bucketName" />
24   - <result column="bucketType" jdbcType="INTEGER" property="bucketType" />
25   - <result column="duration" jdbcType="INTEGER" property="duration" />
26   - <result column="uploader" jdbcType="VARCHAR" property="uploader" />
27   - <result column="contactInfo" jdbcType="VARCHAR" property="contactInfo" />
28   - <result column="extendField" jdbcType="VARCHAR" property="extendField" />
29   - <result column="auditor_id" jdbcType="VARCHAR" property="auditor_id" />
30   - <result column="attr_tags" jdbcType="VARCHAR" property="attr_tags" />
31   - <result column="msg" jdbcType="VARCHAR" property="msg" />
32   - <result column="shenhe_type" jdbcType="INTEGER" property="shenhe_type" />
33   - <result column="state" jdbcType="INTEGER" property="state" />
34   - <result column="createTime" jdbcType="TIMESTAMP" property="createTime" />
35   - <result column="updateTime" jdbcType="TIMESTAMP" property="updateTime" />
36   - <result column="receive" jdbcType="INTEGER" property="receive" />
37   - <result column="receive_user_id" jdbcType="VARCHAR" property="receive_user_id" />
38   - </resultMap>
  4 + <resultMap id="BaseResultMap" type="com.cnlive.shenhe.entity.ShyAudio">
  5 + <!--
  6 + WARNING - @mbg.generated
  7 + -->
  8 + <id column="id" jdbcType="INTEGER" property="id"/>
  9 + <result column="multiplecategory" jdbcType="VARCHAR" property="multiplecategory"/>
  10 + <result column="audioClipsName" jdbcType="VARCHAR" property="audioClipsName"/>
  11 + <result column="soure" jdbcType="INTEGER" property="soure"/>
  12 + <result column="audioId" jdbcType="VARCHAR" property="audioId"/>
  13 + <result column="audioTitle" jdbcType="VARCHAR" property="audioTitle"/>
  14 + <result column="audioUrl" jdbcType="VARCHAR" property="audioUrl"/>
  15 + <result column="audioCoverUrl" jdbcType="VARCHAR" property="audioCoverUrl"/>
  16 + <result column="audioIntro" jdbcType="VARCHAR" property="audioIntro"/>
  17 + <result column="audioTag" jdbcType="VARCHAR" property="audioTag"/>
  18 + <result column="audioKeyword" jdbcType="VARCHAR" property="audioKeyword"/>
  19 + <result column="uploadTime" jdbcType="TIMESTAMP" property="uploadTime"/>
  20 + <result column="priority" jdbcType="INTEGER" property="priority"/>
  21 + <result column="callback" jdbcType="VARCHAR" property="callback"/>
  22 + <result column="spId" jdbcType="INTEGER" property="spId"/>
  23 + <result column="bucketName" jdbcType="VARCHAR" property="bucketName"/>
  24 + <result column="bucketType" jdbcType="INTEGER" property="bucketType"/>
  25 + <result column="duration" jdbcType="INTEGER" property="duration"/>
  26 + <result column="uploader" jdbcType="VARCHAR" property="uploader"/>
  27 + <result column="contactInfo" jdbcType="VARCHAR" property="contactInfo"/>
  28 + <result column="extendField" jdbcType="VARCHAR" property="extendField"/>
  29 + <result column="auditor_id" jdbcType="VARCHAR" property="auditor_id"/>
  30 + <result column="attr_tags" jdbcType="VARCHAR" property="attr_tags"/>
  31 + <result column="msg" jdbcType="VARCHAR" property="msg"/>
  32 + <result column="shenhe_type" jdbcType="INTEGER" property="shenhe_type"/>
  33 + <result column="state" jdbcType="INTEGER" property="state"/>
  34 + <result column="createTime" jdbcType="TIMESTAMP" property="createTime"/>
  35 + <result column="updateTime" jdbcType="TIMESTAMP" property="updateTime"/>
  36 + <result column="receive" jdbcType="INTEGER" property="receive"/>
  37 + <result column="receive_user_id" jdbcType="VARCHAR" property="receive_user_id"/>
  38 + </resultMap>
39 39  
40   - <select id="getAudioMsg" resultType="com.cnlive.shenhe.entity.ShyAudio">
41   - SELECT *
42   - FROM shy_audio
43   - where audioId = #{audioId,jdbcType=VARCHAR};
44   - </select>
  40 + <select id="getAudioMsg" resultType="com.cnlive.shenhe.entity.ShyAudio">
  41 + SELECT *
  42 + FROM shy_audio
  43 + where audioId = #{audioId,jdbcType=VARCHAR};
  44 + </select>
45 45  
  46 + <select id="getAudioBySpId" resultType="com.cnlive.shenhe.entity.ShyAudio">
  47 + select *
  48 + from shy_audio
  49 + <where>
  50 + <if test="id != null">
  51 + and id = #{id}
  52 + </if>
  53 + <if test="spId != null and spId != 0">
  54 + and spId = #{spId}
  55 + </if>
  56 + </where>
  57 + </select>
46 58 </mapper>
47 59 \ No newline at end of file
... ...