修复两处存在SQL注入漏洞问题

2021-05-27 14:17:34 +08:00
parent dfe7c1a4a3
commit e1cab589f2
2 changed files with 15 additions and 1 deletions
--- a/ruoyi-system/src/main/resources/mapper/system/SysDeptMapper.xml
+++ b/ruoyi-system/src/main/resources/mapper/system/SysDeptMapper.xml
@ -152,7 +152,7 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
 	        <if test="updateBy != null and updateBy != ''">update_by = #{updateBy},</if>
 	        update_time = sysdate()
        </set>
- 	    where dept_id in (${ancestors})
+ 	    where find_in_set(#{deptId}, ancestors)
 	</update>

 </mapper>