webapi 测试sql注入

Learun.Framework.Ultimate V7/Learun.Application.Web/Views/Home/AdminDefault.cshtml

@@ -16,7 +16,7 @@
         <img style="height: 40px;" width="95%" src="~/LR_SystemModule/LogoImg/GetImg?code=headbg" alt="经典风格">
     </div>
     <div>
-        <iframe style="position: absolute; top: 18px; right: 150px; height: 25px;" id="fancybox-frame" name="fancybox-frame1591155087436" frameborder="0" scrolling="no" hspace="0" src="http://i.tianqi.com/index.php?c=code&a=getcode&id=34&h=25&w=280"></iframe>
+        <iframe style="position: absolute; top: 18px; right: 150px; height: 25px;" id="fancybox-frame" name="fancybox-frame1591155087436" frameborder="0" scrolling="no" hspace="0" src="http://i.tianqi.com/index.php?c=code&py=dachang&a=getcode&id=34&h=25&w=280"></iframe>
     </div>
 </div>
 <div class="lr-lg-setting" id="lr_lg_setting">
@@ -28,10 +28,14 @@
 @*<div class="lr-lzc-user"><a class="lr-lzca-user" href="javascript:void(0);" class="dropdown-toggle" data-toggle="dropdown">在线人数 @ViewBag.OnlineUserNum 人</a>
     <ul class="dropdown-menu pull-right lr-lzca-user-ul">
     </ul></div>*@
-<div class="lr-im-bell2" title="消息中心2">
-    <a href="javascript:void(0);" class="dropdown-toggle" data-toggle="dropdown">
+<div class="lr-im-bell2" title="消息中心">
+    <a href="javascript:void(0);" class="dropdown-toggle" data-toggle="dropdown" style="position: relative;">
         <span class="point" style="display:none;"></span>
         <i style="font-size: 20px" class="fa fa-bell"></i>
+        @if (ViewBag.UnreadNum > 0)
+        {
+            <span style="font-size: 12px; position: absolute; background: #E54424; color: #fff; line-height: 16px; border-radius: 8px; padding: 0 6px; height: 16px; top: -12px; left: 8px;">@ViewBag.UnreadNum</span>
+        }
     </a>
     <ul class="dropdown-menu pull-right">
         <li><a href="javascript:void(0);" id="btn_daiban"><i class="fa fa-comment"></i>待办事项 @ViewBag.UnreadTask 条</a></li>

Learun.Framework.Ultimate V7/Learun.Application.Web/Views/Home/AdminDefaultForDC.cshtml

@@ -1,6 +1,6 @@
 @{
     ViewBag.Title = "经典版风格";
-    Layout = "~/Views/Shared/_Admin.cshtml";
+    Layout = "~/Views/Shared/_AdminForDC.cshtml.cshtml";
 }
 @Html.AppendCssFile("/Views/Home/AdminDefault/index.css")
 <script>

Learun.Framework.Ultimate V7/Learun.Application.Web/Views/LR_Content/script/lr-admin.js

@@ -66,7 +66,7 @@ var loaddfimg;
         userInit: function () {
             var loginInfo = learun.clientdata.get(['userinfo']);
             var _html = '<div class="lr-frame-personCenter"><a href="javascript:void(0);" class="dropdown-toggle" data-toggle="dropdown">';
-            _html += '<img id="userhead"src="' + top.$.rootUrl + '/LR_OrganizationModule/User/GetImg?userId=' + loginInfo.userId + '" >';
+            _html += '<img id="userhead"src="' + top.$.rootUrl + '/LR_OrganizationModule/User/GetImgForDC?userId=' + loginInfo.userId + '" >';
             _html += '<span>' + loginInfo.realName + '</span>';
             _html += '</a>';
             _html += '<ul class="dropdown-menu pull-right">';
@@ -203,8 +203,6 @@ var loaddfimg;
             //_html += '<div><label><input type="radio" name="ui_theme" value="3" ' + (uitheme == '3' ? 'checked' : '') + '>炫动版</label></div>';
             _html += '<div><label><input type="radio" name="ui_theme" value="4" ' + (uitheme == '4' ? 'checked' : '') + '>飞扬版</label></div>';
             _html += '<div><label><input type="radio" name="ui_theme" value="5" ' + (uitheme == '5' ? 'checked' : '') + '>导航版</label></div>';
-            _html += '<div><label><input type="radio" name="ui_theme" value="6" ' + (uitheme == '6' ? 'checked' : '') + '>主题5</label></div>';
-
             _html += '</div>';
             $setting.append($btn);
             $setting.append(_html);

Learun.Framework.Ultimate V7/Learun.Application.Web/Views/Shared/_Admin.cshtml

@@ -45,10 +45,10 @@
         </div>
     </div>
     <div class="lr-frame-main" id="lr_frame_main">
-    <img src="~/Content/images/iframebg.png"/>
+        <img src="~/Content/images/iframebg.png" />
     </div>
 
-   
+
     <script src="~/Content/bootstrap/bootstrap.min.js"></script>
     <script src="~/Content/jquery/plugin/layer/layer.js"></script>
     <script src="~/Content/jquery/plugin/jquery.cookie.min.js"></script>
@@ -75,12 +75,12 @@
 
     "/Views/LR_Content/plugin/tree/lr-tree.js",
     "/Views/LR_Content/plugin/select/lr-select.js",
-    
+
 
     "/Views/LR_Content/plugin/workflow/lr-workflow-api.js",
     "/Views/LR_Content/plugin/contextmenu/lr-contextmenu.js",
     "/Views/LR_Content/script/lr-im.js",
-            
+
     "/Views/LR_Content/script/lr-admin.js"
     )
 </body>

Learun.Framework.Ultimate V7/Learun.Application.Web/Views/UserCenter/Index.cshtml

@@ -17,7 +17,7 @@
                 <ul class="lr-left-list" id="lr_left_list">
                     <li data-value="1">基本信息</li>
                     @*<li data-value="2">联系方式</li>*@
-                    <li data-value="3">我的头像</li>
+                    @*<li data-value="3">我的头像</li>*@
                     <li data-value="4">修改密码</li>
                     <li data-value="5">我的日志</li>
                     @if (ViewBag.UserType == "学生")
@@ -382,8 +382,7 @@
                                             <li>出生日期 : {{teacherInfo.Birthday | date}}</li>
                                             <li>联系电话 : {{teacherInfo.mobile}}</li>
                                             <li>校 &nbsp; &nbsp; &nbsp; 区 : {{baseInfo.companyId | company}}</li>
-                                            <li>教职工类别 : {{teacherInfo.EmpSortNo | empSortNo}}</li>
-                                            <li>聘任职称1 : {{teacherInfo.TitleOfTechPostNo | titleOfTechPostNo}}</li>
+                                            <li>部门 : {{teacherInfo.F_DepartmentId | department}}</li>
                                         </ul>
                                     </div>
                                 </div>
@@ -396,41 +395,39 @@
                                             <li>民  族 : {{teacherInfo.NationalityNo | nationalityNo}}</li>
                                             <li>政治面貌 : {{teacherInfo.PartyFaceNo | partyFaceNo}}</li>
                                             <li>身份证号 : {{teacherInfo.IdentityCardNo}}  </li>
-                                            <li>E-mail : {{teacherInfo.EMail}}</li>
+                                            <li>健康状况 : {{teacherInfo.HealthStatusNo | healthStatusNo}}</li>
                                             <li>档案所在地 : {{teacherInfo.LocusOfArchives}} </li>
                                             <li>户口所在地 : {{teacherInfo.LocusOfResidence}} </li>
                                         </ul>
                                     </div>
 
                                     <div class="userSec2Box">
-                                        <div class="userSec2T">家庭情况  <i class="fa fa-angle-right"></i></div>
+                                        <div class="userSec2T">学历学位信息  <i class="fa fa-angle-right"></i></div>
                                         <ul class="userSec2List">
-                                            <li>港澳台侨 : {{teacherInfo.OverseasChineseNo | overseasChineseNo}}  </li>
-                                            <li>健康状况 : {{teacherInfo.HealthStatusNo | healthStatusNo}}</li>
-                                            <li>家庭出身 : {{teacherInfo.FamilyOriginNo | familyOriginNo}}  </li>
-                                            <li>外语语种 : {{teacherInfo.ForeignLanguageNo | foreignLanguageNo}}  </li>
-                                            <li>户籍省份 : {{teacherInfo.ProvinceNo | provinceNo}}  </li>
-                                            <li>户籍地市 : {{teacherInfo.CityNo | cityNo}}  </li>
-                                            <li>户籍县区 : {{teacherInfo.RegionNo | regionNo}}  </li>
+                                            <li>最高学历 : {{teacherInfo.HighestRecord | HighestRecordNo}}  </li>
+                                            <li>获取方式 : {{teacherInfo.ObtainWayOfHighestRecord | ObtainWayNo}}  </li>
+                                            <li>取得时间 : {{teacherInfo.HighestRecordGetTime}}  </li>
+                                            <li>最高学位 : {{teacherInfo.DegreeNo | degreeNo}}</li>
+                                            <li>获取方式 : {{teacherInfo.ObtainWayOfHighestDegree | ObtainWayOfHighestDegreeNo}}  </li>
+                                            <li>取得时间 : {{teacherInfo.HighestDegreeGetTime}}  </li>
                                         </ul>
                                     </div>
 
                                     <div class="userSec2Box">
-                                        <div class="userSec2T">其他  <i class="fa fa-angle-right"></i></div>
+                                        <div class="userSec2T">其他信息  <i class="fa fa-angle-right"></i></div>
                                         <ul class="userSec2List">
-                                            <li>学科门 : {{teacherInfo.SubjectSpeciesNo | subjectSpeciesNo}}</li>
-                                            <li>现任职务: {{teacherInfo.Title}}</li>
-                                            <li>所在系部 : {{teacherInfo.DeptNo | deptNo}}  </li>
-                                            <li>文化程度 : {{teacherInfo.CultureDegreeNo | cultureDegreeNo}}   </li>
                                             <li>毕业学校 : {{teacherInfo.GraduateSchoolName}} </li>
-                                            <li>最高学位 : {{teacherInfo.DegreeNo | degreeNo}}</li>
-                                            <li>来校年月 : {{teacherInfo.InSchoolDate | date}}</li>
+                                            <li>毕业时间 : {{teacherInfo.GraduateDate1}} </li>
+                                            <li>是否代课 : {{teacherInfo.IsHasLesson | IsHasLessonNo}}</li>
+                                            <li>文化程度 : {{teacherInfo.CultureDegreeNo | cultureDegreeNo}} </li>
+                                            <li>现任职务: {{teacherInfo.Title}}</li>
                                         </ul>
                                     </div>
 
                                     <div class="userSec2Box">
                                         <div class="userSec2T">联系方式  <i class="fa fa-angle-right"></i></div>
                                         <ul class="userSec2List">
+                                            <li>手机号码 : {{teacherInfo.mobile}}</li>
                                             <li>紧急联系人 : {{teacherInfo.Linkman}}</li>
                                             <li>紧急联系人电话 : {{teacherInfo.PhoneOfLinkman}}</li>
                                         </ul>
@@ -452,8 +449,6 @@
                                         $.get('/UserCenter/GetTeacherInfo', function (ref) {
                                             this.teacherInfo = ref.data.userInfo;
                                             this.baseInfo = ref.data.basecInfo;
-                                            console.log(ref);
-
                                         }.bind(this), "json");
                                     },
                                     getUrl: function () {
@@ -485,6 +480,19 @@
                                         });
                                         return result;
                                     },
+                                    department: function (value) {
+                                        var result;
+                                        top.learun.clientdata.getAsync('custmerData', {
+                                            sync: true,
+                                            url: '/LR_SystemModule/DataSource/GetDataTable?code=' + 'classdata',
+                                            key: value,
+                                            keyId: 'f_departmentid',
+                                            callback: function (_data) {
+                                                result = _data.f_fullname;
+                                            }
+                                        });
+                                        return result;
+                                    },
                                     nationalityNo: function (value) {
                                         var result;
                                         top.learun.clientdata.getAsync('custmerData', {
@@ -511,15 +519,15 @@
                                         });
                                         return result;
                                     },
-                                    overseasChineseNo: function (value) {
+                                    HighestRecordNo: function (value) {
                                         var result;
                                         top.learun.clientdata.getAsync('custmerData', {
                                             sync: true,
-                                            url: '/LR_SystemModule/DataSource/GetDataTable?code=' + 'BCdOverseasChinese',
+                                            url: '/LR_SystemModule/DataSource/GetDataTable?code=' + 'BCdCultureDegree',
                                             key: value,
-                                            keyId: 'overseaschineseno',
+                                            keyId: 'culturedegreeno',
                                             callback: function (_data) {
-                                                result = _data.overseaschinesename;
+                                                result = _data.culturedegree;
                                             }
                                         });
 
@@ -575,15 +583,14 @@
                                         });
                                         return result;
                                     },
-                                    foreignLanguageNo: function (value) {
+                                    ObtainWayNo: function (value) {
                                         var result;
-                                        top.learun.clientdata.getAsync('custmerData', {
-                                            url: '/LR_SystemModule/DataSource/GetDataTable?code=' + 'BCdForeignLanguage',
+                                        top.learun.clientdata.getAsync('dataItem', {
                                             key: value,
-                                            keyId: 'foreignlanguageno',
+                                            code: 'ObtainWay',
                                             callback: function (_data) {
-                                                result = _data.foreignlanguagename;
-                                            }.bind(this)
+                                                result = _data.text;
+                                            }
                                         });
                                         return result;
                                     },
@@ -652,6 +659,17 @@
                                         });
                                         return result;
                                     },
+                                    ObtainWayOfHighestDegreeNo: function (value) {
+                                        var result;
+                                        top.learun.clientdata.getAsync('dataItem', {
+                                            key: value,
+                                            code: 'ObtainWayOfDegree',
+                                            callback: function (_data) {
+                                                result = _data.text;
+                                            }
+                                        });
+                                        return result;
+                                    },
                                     empSortNo: function (value) {
                                         var result;
                                         top.learun.clientdata.getAsync('dataItem', {
@@ -675,6 +693,17 @@
                                             }
                                         });
                                         return result;
+                                    },
+                                    IsHasLessonNo: function (value) {
+                                        var result;
+                                        top.learun.clientdata.getAsync('dataItem', {
+                                            key: value,
+                                            code: 'YesOrNoBit',
+                                            callback: function (_data) {
+                                                result = _data.text;
+                                            }
+                                        });
+                                        return result;
                                     }
                                 }
 
@@ -765,7 +794,7 @@
 
     $(function () {
         var loginInfo = top.learun.clientdata.get(['userinfo']);
-        $("#headUrl").attr("src", "/LR_OrganizationModule/User/GetImg?userId=" + loginInfo.userId);
+        $("#headUrl").attr("src", "/LR_OrganizationModule/User/GetImgForDC?userId=" + loginInfo.userId);
 
         if ('@ViewBag.UserType' == '学生') {
             $("#lr_left_list").children('li').eq(4).addClass("active");
@@ -805,4 +834,4 @@
                 }
             });
 </script>
-@Html.AppendJsFile("/Views/UserCenter/Index.js")
+@Html.AppendJsFile("/Views/UserCenter/IndexForDC.js")

Learun.Framework.Ultimate V7/Learun.Application.Web/Views/UserCenter/Index.js

@@ -69,6 +69,8 @@ var bootstrap = function ($, learun) {
                     learun.alert.error('数据加载失败');
                 }
             }.bind(this));
+
+            //console.log("成功");
         }
     };
     refreshGirdData = function () {

Learun.Framework.Ultimate V7/Learun.Application.WebApi/Modules/BaseApi.cs

@@ -175,6 +175,17 @@ namespace Learun.Application.WebApi
         /// <returns></returns>
         private Response BeforeRequest(NancyContext ctx)
         {
+            ctx.Request.Url.Query = Learun.Util.WebHelper.Formatstr(ctx.Request.Url.Query);
+            foreach (var p in ctx.Parameters)
+            {
+                if (p.ParameterType == typeof(string))
+                {
+                    if (ctx.Parameters[p.ParameterName] != null)
+                    {
+                        ctx.Parameters[p.ParameterName] = Learun.Util.WebHelper.Formatstr(ctx.Parameters[p.ParameterName].ToString());
+                    }
+                }
+            }
             string path = ctx.ResolvedRoute.Description.Path;
             //验证登录状态
             ReqParameter req = this.Bind<ReqParameter>();

Learun.Framework.Ultimate V7/Learun.Application.WebApi/Properties/PublishProfiles/FolderProfile1.pubxml

@@ -13,6 +13,6 @@
     <LaunchSiteAfterPublish>True</LaunchSiteAfterPublish>
     <ExcludeApp_Data>False</ExcludeApp_Data>
     <publishUrl>bin\Release\Publish</publishUrl>
-    <DeleteExistingFiles>False</DeleteExistingFiles>
+    <DeleteExistingFiles>True</DeleteExistingFiles>
   </PropertyGroup>
 </Project>

Learun.Framework.Ultimate V7/Learun.Framework.Module/Learun.Util/Learun.Util/Web/WebHelper.cs

@@ -345,6 +345,7 @@ namespace Learun.Util
             System.Text.RegularExpressions.Regex regex10 = new System.Text.RegularExpressions.Regex(@"select", System.Text.RegularExpressions.RegexOptions.IgnoreCase);
             System.Text.RegularExpressions.Regex regex11 = new System.Text.RegularExpressions.Regex(@"update", System.Text.RegularExpressions.RegexOptions.IgnoreCase);
             System.Text.RegularExpressions.Regex regex12 = new System.Text.RegularExpressions.Regex(@"delete", System.Text.RegularExpressions.RegexOptions.IgnoreCase);
+            System.Text.RegularExpressions.Regex regex13 = new System.Text.RegularExpressions.Regex(@"exec", System.Text.RegularExpressions.RegexOptions.IgnoreCase);
             html = regex1.Replace(html, ""); //过滤<script></script>标记
             html = regex2.Replace(html, ""); //过滤href=javascript: (<A>) 属性
             html = regex3.Replace(html, " _disibledevent="); //过滤其它控件的on...事件
@@ -352,6 +353,7 @@ namespace Learun.Util
             html = regex10.Replace(html, "s_elect");
             html = regex11.Replace(html, "u_pudate");
             html = regex12.Replace(html, "d_elete");
+            html = regex13.Replace(html, "e_xec");
             html = html.Replace("'", "’");
             html = html.Replace("&nbsp;", " ");
             return html;