修复两处存在SQL注入漏洞问题

2021-05-27 17:38:27 +08:00
parent 5e64a93d11
commit 6fa3bfe051
2 changed files with 15 additions and 1 deletions
--- a/ruoyi-system/src/main/resources/mapper/system/SysDeptMapper.xml
+++ b/ruoyi-system/src/main/resources/mapper/system/SysDeptMapper.xml
@ -147,7 +147,7 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
 	        <if test="updateBy != null and updateBy != ''">update_by = #{updateBy},</if>
 	        update_time = sysdate()
        </set>
- 	    where dept_id in (${ancestors})
+ 	    where find_in_set(#{deptId}, ancestors)
 	</update>
 	
 	<delete id="deleteDeptById" parameterType="Long">