jeecgboot / jeecgboot/JeecgBoot
部门管理下,新增岗位,职务级别查询下拉框问题
- Dominant language
- Java
- Stars
- 47.8k
- Forks
- 16.2k
- PR merge metrics
- No merged PRs in 30d
Description
##### 版本号:3.9.5
##### 分支:main
##### 问题描述:
部门管理下,新增岗位,职务级别查询下拉框报错,查到DictSqlConditionCheckUtil中addConditionField方法跟前端代码里1=1存在冲突,直接过滤sql注入了。
##### 错误截图:
#### 友情提示:
- 未按格式要求发帖、描述过于简单的,会被直接删掉;
- 描述问题请图文并茂,方便我们理解并快速定位问题;
- 如果使用的不是master,请说明你使用的分支;
Contributor guide
No contributing guide indexed for this repository
Research direction
Reproduce the issue in Department Management by adding a position and opening the job-level query dropdown. Start with DictSqlConditionCheckUtil.addConditionField and inspect how the frontend's `1=1` condition is handled. Done means the dropdown query no longer fails because of this conflict and the reported scenario can be verified successfully.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- backend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 62/100