fix: close platform admin final audit findings

This commit is contained in:
2026-07-27 12:02:08 +08:00
parent 0ba4136e1a
commit 34e8b092b3
70 changed files with 1873 additions and 348 deletions

View File

@@ -3,6 +3,8 @@ package platform
import (
"errors"
"reflect"
"strings"
"git.apinb.com/bsm-sdk/core/errcode"
"git.apinb.com/bsm-sdk/core/infra"
@@ -38,7 +40,8 @@ func listPage[T any](ctx *gin.Context) {
page, size := pageSize(ctx)
var list []T
var total int64
databaseQuery := impl.DBService.Model(new(T))
model := new(T)
databaseQuery := applyKeywordFilter(ctx, impl.DBService.Model(model), model)
if err := databaseQuery.Count(&total).Error; err != nil {
infra.Response.Error(ctx, err)
return
@@ -55,6 +58,58 @@ func listPage[T any](ctx *gin.Context) {
infra.Response.Success(ctx, gin.H{"total": total, "list": response})
}
var keywordExcludedColumns = map[string]bool{
"identity": true, "status": true, "password_hash": true,
"longitude": true, "latitude": true, "payload": true,
"before_data": true, "after_data": true,
}
func applyKeywordFilter(ctx *gin.Context, query *gorm.DB, model any) *gorm.DB {
keyword := strings.ToLower(strings.TrimSpace(ctx.Query("keyword")))
if keyword == "" {
return query
}
columns := keywordColumns(model)
if len(columns) == 0 {
return query
}
conditions := make([]string, 0, len(columns))
arguments := make([]any, 0, len(columns))
for _, column := range columns {
conditions = append(conditions, `LOWER("`+column+`") LIKE ?`)
arguments = append(arguments, "%"+keyword+"%")
}
return query.Where("("+strings.Join(conditions, " OR ")+")", arguments...)
}
func keywordColumns(model any) []string {
modelType := reflect.TypeOf(model)
for modelType.Kind() == reflect.Pointer {
modelType = modelType.Elem()
}
columns := make([]string, 0)
for index := 0; index < modelType.NumField(); index++ {
field := modelType.Field(index)
if field.Anonymous || field.Type.Kind() != reflect.String {
continue
}
column := gormColumn(field.Tag.Get("gorm"))
if column != "" && !keywordExcludedColumns[column] {
columns = append(columns, column)
}
}
return columns
}
func gormColumn(tag string) string {
for _, part := range strings.Split(tag, ";") {
if strings.HasPrefix(part, "column:") {
return strings.TrimPrefix(part, "column:")
}
}
return ""
}
func getByIdentity[T any](ctx *gin.Context) {
var data T
if err := impl.DBService.Where("identity = ?", ctx.Param("identity")).First(&data).Error; err != nil {