From 31cefe480080928357112823c2325be7a48c8d0e Mon Sep 17 00:00:00 2001 From: chengqian Date: Thu, 28 May 2026 15:43:05 +0800 Subject: [PATCH] =?UTF-8?q?fix:=E4=BF=AE=E5=A4=8Dai=E8=AF=86=E5=88=AB?= =?UTF-8?q?=E7=9A=84bug?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../tenant_v1_tenant_notification_delete.go | 8 +++----- internal/logic/admin/audit.go | 15 ++++++++++++++- internal/logic/admin/cron_job.go | 2 +- internal/middleware/maintenance.go | 6 +++--- relay/taskchannel/volcengine/adaptor.go | 4 ++-- 5 files changed, 23 insertions(+), 12 deletions(-) diff --git a/internal/controller/tenant/tenant_v1_tenant_notification_delete.go b/internal/controller/tenant/tenant_v1_tenant_notification_delete.go index d658558..bc48050 100644 --- a/internal/controller/tenant/tenant_v1_tenant_notification_delete.go +++ b/internal/controller/tenant/tenant_v1_tenant_notification_delete.go @@ -3,12 +3,10 @@ package tenant import ( "context" - "github.com/gogf/gf/v2/errors/gcode" - "github.com/gogf/gf/v2/errors/gerror" - - "github.com/qianfree/team-api/api/tenant/v1" + v1 "github.com/qianfree/team-api/api/tenant/v1" + "github.com/qianfree/team-api/internal/service" ) func (c *ControllerV1) TenantNotificationDelete(ctx context.Context, req *v1.TenantNotificationDeleteReq) (res *v1.TenantNotificationDeleteRes, err error) { - return nil, gerror.NewCode(gcode.CodeNotImplemented) + return service.Tenant().DeleteNotification(ctx, req) } diff --git a/internal/logic/admin/audit.go b/internal/logic/admin/audit.go index 4096af8..724db53 100644 --- a/internal/logic/admin/audit.go +++ b/internal/logic/admin/audit.go @@ -87,8 +87,21 @@ func (s *sAdmin) UpdateAuditConfig(ctx context.Context, req *v1.AuditConfigUpdat return nil, nil } -// queryPage 使用原生 SQL 分页查询，绕过 GoFrame ScanAndCount 对 map[string]any 的 bug +// allowedQueryTables 白名单：仅允许 queryPage 查询这些表 +var allowedQueryTables = map[string]bool{ + "aud_operation_logs": true, + "aud_sensitive_access_logs": true, + "aud_request_logs": true, + "aud_content_filter_logs": true, +} + +// queryPage 使用原生 SQL 分页查询，绕过 GoFrame ScanAndCount 对 map[string]any 的 bug。 +// table 和 fields 仅接受白名单中的表名和预定义字段，防止 SQL 注入。 func queryPage(ctx context.Context, table, fields, where, orderBy string, page, pageSize int, args ...any) ([]map[string]any, int, error) { + if !allowedQueryTables[table] { + return nil, 0, fmt.Errorf("不允许查询的表: %s", table) + } + countSQL := fmt.Sprintf("SELECT COUNT(*) AS total FROM %s", table) if where != "" { countSQL += " WHERE " + where diff --git a/internal/logic/admin/cron_job.go b/internal/logic/admin/cron_job.go index cd55c63..1f45486 100644 --- a/internal/logic/admin/cron_job.go +++ b/internal/logic/admin/cron_job.go @@ -121,7 +121,7 @@ func (s *sAdmin) CronJobExecutions(ctx context.Context, req *v1.CronJobExecution func (s *sAdmin) CronJobTrigger(ctx context.Context, req *v1.CronJobTriggerReq) (*v1.CronJobTriggerRes, error) { err := common.GetCronScheduler().TriggerJob(ctx, req.Name) if err != nil { - return nil, fmt.Errorf("触发任务失败: %v", err) + return nil, fmt.Errorf("触发任务失败: %w", err) } return &v1.CronJobTriggerRes{Message: "任务已触发"}, nil } diff --git a/internal/middleware/maintenance.go b/internal/middleware/maintenance.go index b6c134f..e5222bc 100644 --- a/internal/middleware/maintenance.go +++ b/internal/middleware/maintenance.go @@ -36,7 +36,7 @@ func ApiMaintenance(r *ghttp.Request) { } durationStr := common.Config().GetString(ctx, "maintenance_duration") - retryAfter := parseMaintenanceDuration(durationStr) + retryAfter := parseMaintenanceDuration(ctx, durationStr) message := common.Config().GetString(ctx, "maintenance_message") if message == "" { @@ -70,14 +70,14 @@ func ApiMaintenance(r *ghttp.Request) { // parseMaintenanceDuration parses a duration string like "2h", "30m", "1h30m" // and returns the total number of seconds. Returns 300 (5 minutes) as default // if parsing fails or the string is empty. -func parseMaintenanceDuration(s string) int { +func parseMaintenanceDuration(ctx context.Context, s string) int { if s == "" { return 300 } d, err := time.ParseDuration(s) if err != nil { - g.Log().Warningf(context.TODO(), "failed to parse maintenance duration %q: %v, using default 300s", s, err) + g.Log().Warningf(ctx, "failed to parse maintenance duration %q: %v, using default 300s", s, err) return 300 } diff --git a/relay/taskchannel/volcengine/adaptor.go b/relay/taskchannel/volcengine/adaptor.go index 994f836..937bc93 100644 --- a/relay/taskchannel/volcengine/adaptor.go +++ b/relay/taskchannel/volcengine/adaptor.go @@ -101,8 +101,8 @@ func (a *VolcengineVideoAdaptor) ValidateRequest(_ context.Context, _ *common.Re func (a *VolcengineVideoAdaptor) EstimateBilling(_ context.Context, info *common.RelayInfo, body []byte) map[string]float64 { var req map[string]any - if json.Unmarshal(body, &req) != nil { - return nil + if err := json.Unmarshal(body, &req); err != nil { + return map[string]float64{} } ratios := make(map[string]float64)