部分代码审计

yudao-module-system/yudao-module-system-biz/src/main/java/cn/iocoder/yudao/module/system/dal/mysql/user/AdminUserMapper.java

@@ -93,41 +93,55 @@ public interface AdminUserMapper extends BaseMapperX<AdminUserDO> {
         return selectPage(reqVO,queryWrapperX);
     }
 
+    List<AdminUserDO> selectPage1(
+            @Param("reqVO") UserPageReqVO reqVO,
+            @Param("deptIds") Collection<Long> deptIds,
+            @Param("roleIds") Set<Long> roleIds,
+            @Param("loginId") Long loginId,
+            @Param("offset") Integer offset
+    );
+    Long  selectPage1Count(
+            @Param("reqVO") UserPageReqVO reqVO,
+            @Param("deptIds") Collection<Long> deptIds,
+            @Param("roleIds") Set<Long> roleIds,
+            @Param("loginId") Long loginId,
+            @Param("offset") Integer offset
+    );
     // 会根据登录 查在校学生
-    default PageResult<AdminUserDO> selectPage1(UserPageReqVO reqVO, Collection<Long> deptIds,Set<Long>roleIds,Long loginId) {
-
-        MPJLambdaWrapper<AdminUserDO> queryWrapperX =new MPJLambdaWrapper<AdminUserDO>();
-        queryWrapperX
-//                .between(reqVO.getCreateTime() != null,AdminUserDO::getCreateTime, reqVO.getCreateTime())
-                .leftJoin(UserAchievementDO.class,UserAchievementDO::getUserId,AdminUserDO::getId)
-                .likeIfExists(AdminUserDO::getUsername, reqVO.getUsername())
-                .likeIfExists(AdminUserDO::getEmail,reqVO.getEmail())
-                .likeIfExists(AdminUserDO::getMobile, reqVO.getMobile())
-                .likeIfExists(AdminUserDO::getUserNumber,reqVO.getUserNumber())//学号查询
-                .likeIfExists(AdminUserDO::getNickname, reqVO.getNickname())//昵称查询
-                .eqIfExists(AdminUserDO::getUserType,reqVO.getUserType())//类型查询
-                .likeIfExists(AdminUserDO::getGrade, reqVO.getGrade())//班级查询
-                .eqIfExists(AdminUserDO::getSupervisorId,reqVO.getSupervisorId())//导师查询
-                .eqIfExists(AdminUserDO::getStatus, reqVO.getStatus())
-                .eqIfExists(UserAchievementDO::getIsGraduate, reqVO.getIsGraduate())
-                .in(deptIds!=null && !deptIds.isEmpty(),AdminUserDO::getDeptId, deptIds)
-
-                .orderByDesc(AdminUserDO::getId);
-
-//        if ()
-
-        if (roleIds.contains(113L)){//如果是教师,只找导师是登录的
-            queryWrapperX.eqIfExists(AdminUserDO::getSupervisorId,loginId)
-                          .eqIfExists(AdminUserDO::getUserType,1);
-        } else if (roleIds.contains(114L)) {//学院
-            queryWrapperX.eqIfExists(AdminUserDO::getUserType,1);
-        }else if (roleIds.contains(1L)){//管理员
-            queryWrapperX.in(AdminUserDO::getDeptId, 1,2);
-        }
-        PageResult<AdminUserDO> result = selectPage(reqVO,queryWrapperX);
-
-        return result;
-    }
+//    default PageResult<AdminUserDO> selectPage1(UserPageReqVO reqVO, Collection<Long> deptIds,Set<Long>roleIds,Long loginId) {
+//
+//        MPJLambdaWrapper<AdminUserDO> queryWrapperX =new MPJLambdaWrapper<AdminUserDO>();
+//        queryWrapperX
+////                .between(reqVO.getCreateTime() != null,AdminUserDO::getCreateTime, reqVO.getCreateTime())
+//                .leftJoin(UserAchievementDO.class,UserAchievementDO::getUserId,AdminUserDO::getId)
+//                .likeIfExists(AdminUserDO::getUsername, reqVO.getUsername())
+//                .likeIfExists(AdminUserDO::getEmail,reqVO.getEmail())
+//                .likeIfExists(AdminUserDO::getMobile, reqVO.getMobile())
+//                .likeIfExists(AdminUserDO::getUserNumber,reqVO.getUserNumber())//学号查询
+//                .likeIfExists(AdminUserDO::getNickname, reqVO.getNickname())//昵称查询
+//                .eqIfExists(AdminUserDO::getUserType,reqVO.getUserType())//类型查询
+//                .likeIfExists(AdminUserDO::getGrade, reqVO.getGrade())//班级查询
+//                .eqIfExists(AdminUserDO::getSupervisorId,reqVO.getSupervisorId())//导师查询
+//                .eqIfExists(AdminUserDO::getStatus, reqVO.getStatus())
+//                .eqIfExists(UserAchievementDO::getIsGraduate, reqVO.getIsGraduate())
+//                .in(deptIds!=null && !deptIds.isEmpty(),AdminUserDO::getDeptId, deptIds)
+//
+//                .orderByDesc(AdminUserDO::getId);
+//
+////        if ()
+//
+//        if (roleIds.contains(113L)){//如果是教师,只找导师是登录的
+//            queryWrapperX.eqIfExists(AdminUserDO::getSupervisorId,loginId)
+//                          .eqIfExists(AdminUserDO::getUserType,1);
+//        } else if (roleIds.contains(114L)) {//学院
+//            queryWrapperX.eqIfExists(AdminUserDO::getUserType,1);
+//        }else if (roleIds.contains(1L)){//管理员
+//            queryWrapperX.in(AdminUserDO::getDeptId, 1,2);
+//        }
+//        PageResult<AdminUserDO> result = selectPage(reqVO,queryWrapperX);
+//
+//        return result;
+//    }
     default List<AdminUserDO> selectList1(UserPageReqVO reqVO, Collection<Long> deptIds,Set<Long>roleIds,Long loginId) {
 
         LambdaQueryWrapperX<AdminUserDO> queryWrapperX =new LambdaQueryWrapperX<AdminUserDO>();

yudao-module-system/yudao-module-system-biz/src/main/java/cn/iocoder/yudao/module/system/service/user/AdminUserServiceImpl.java

@@ -361,37 +361,35 @@ public class AdminUserServiceImpl implements AdminUserService {
     public PageResult<AdminUserDO> getUserPage1(UserPageReqVO reqVO) {//(学院)
         Long loginId = SecurityFrameworkUtils.getLoginUserId();
         Set<Long> roleIds = permissionService.getUserRoleIdListByUserId(loginId);
-        PageResult<AdminUserDO> result =userMapper.selectPage1(reqVO, getDeptCondition(reqVO.getDeptId()),roleIds,loginId);
+        int offset = (reqVO.getPageNo() - 1) * reqVO.getPageSize();
+        List<AdminUserDO> result =userMapper.selectPage1(reqVO, getDeptCondition(reqVO.getDeptId()),roleIds,loginId,offset);
+        Long size = userMapper.selectPage1Count(reqVO, getDeptCondition(reqVO.getDeptId()),roleIds,loginId,offset);
+
         // 遍历结果集，设置 photoIsExist
-        result.getList().stream().forEach(user -> {
-            user.setPhotoIsExist(Long.valueOf(user.getPhotoUrl() != null && !user.getPhotoUrl().isEmpty() ? 1 : 0));
-//            user.setIsGraduate(vilidateIsGraduate(user));
-            if (user.getDeptId()==null||user.getDeptId()==0L){
-                user.setDeptName("测绘学院");
-            }
-            if ("1".equals(user.getUserType()) ||"2".equals(user.getUserType())) {
-                if (user.getSupervisorId() != null) {
-                    AdminUserDO supervisorUser = getUser(user.getSupervisorId());
-                    String supervisor = supervisorUser.getNickname();
-                    String mobile = supervisorUser.getMobile();
-                    // 赋值给 对应 字段
-                    user.setSupervisor(supervisor);
-                    user.setSupervisorMobile(mobile);
-                }
-            }
-        });
-//        if (reqVO.getIsGraduate() != null) {//搜索毕业状态
-//            result.setList(result.getList().stream()
-//                    .filter(user -> reqVO.getIsGraduate().equals(user.getIsGraduate()))
-//                    .collect(Collectors.toList()));
-//            // 重新计算分页信息
-//        }
+//        resultPage.getList().stream().forEach(user -> {
+//            user.setPhotoIsExist(Long.valueOf(user.getPhotoUrl() != null && !user.getPhotoUrl().isEmpty() ? 1 : 0));
+////            user.setIsGraduate(vilidateIsGraduate(user));
+//            if (user.getDeptId()==null||user.getDeptId()==0L){
+//                user.setDeptName("测绘学院");
+//            }
+//            if ("1".equals(user.getUserType()) ||"2".equals(user.getUserType())) {
+//                if (user.getSupervisorId() != null) {
+//                    AdminUserDO supervisorUser = getUser(user.getSupervisorId());
+//                    String supervisor = supervisorUser.getNickname();
+//                    String mobile = supervisorUser.getMobile();
+//                    // 赋值给 对应 字段
+//                    user.setSupervisor(supervisor);
+//                    user.setSupervisorMobile(mobile);
+//                }
+//            }
+//        });
+
 //        if (reqVO.getPhotoIsExist() != null) {//搜索人脸导入
 //            result.setList(result.getList().stream()
 //                    .filter(user -> reqVO.getPhotoIsExist().equals(user.getPhotoIsExist()))
 //                    .collect(Collectors.toList()));
 //        }
-        return result;
+        return new PageResult<>(result, size);
     }
 
     @Override

yudao-module-system/yudao-module-system-biz/src/main/resources/Mapper/AdminUserMapper/AdminUserMapper.xml

@@ -2,6 +2,162 @@
 <!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd">
 <mapper namespace="cn.iocoder.yudao.module.system.dal.mysql.user.AdminUserMapper">
     <select id="selectPage1" resultType="cn.iocoder.yudao.module.system.dal.dataobject.user.AdminUserDO">
+        SELECT
+        a.*,
+        COALESCE(ua.is_graduate, 1) AS is_graduate,
+        CASE
+            WHEN a.photo_url IS NOT NULL THEN 1
+        ELSE 0
+            END AS photoIsExist,
 
+        COALESCE(system_dept.name, "测绘学院") AS deptName,
+        supervisor_user.nickname as supervisor,
+        supervisor_user.mobile as supervisorMobile
+        FROM
+        system_users a
+        LEFT JOIN
+        system_user_achievement ua ON ua.user_id = a.id
+        LEFT JOIN
+        system_users supervisor_user ON supervisor_user.id = a.supervisor_id  -- 自连接获取 supervisor 的信息
+        LEFT JOIN
+        system_dept system_dept ON system_dept.id = a.dept_id
+        WHERE
+        1=1
+        <if test="reqVO.username != null and reqVO.username != ''">
+            AND a.username LIKE CONCAT('%', #{reqVO.username}, '%')
+        </if>
+        <if test="reqVO.email != null and reqVO.email != ''">
+            AND a.email LIKE CONCAT('%', #{reqVO.email}, '%')
+        </if>
+        <if test="reqVO.mobile != null and reqVO.mobile != ''">
+            AND a.mobile LIKE CONCAT('%', #{reqVO.mobile}, '%')
+        </if>
+        <if test="reqVO.userNumber != null and reqVO.userNumber != ''">
+            AND a.user_number LIKE CONCAT('%', #{reqVO.userNumber}, '%')
+        </if>
+        <if test="reqVO.nickname != null and reqVO.nickname != ''">
+            AND a.nickname LIKE CONCAT('%', #{reqVO.nickname}, '%')
+        </if>
+        <if test="reqVO.userType != null">
+            AND a.user_type = #{reqVO.userType}
+        </if>
+        <if test="reqVO.grade != null and reqVO.grade != ''">
+            AND a.grade LIKE CONCAT('%', #{reqVO.grade}, '%')
+        </if>
+        <if test="reqVO.supervisorId != null">
+            AND a.supervisor_id = #{reqVO.supervisorId}
+        </if>
+        <if test="reqVO.status != null">
+            AND a.status = #{reqVO.status}
+        </if>
+        <if test="deptIds != null and !deptIds.isEmpty()">
+            AND a.dept_id IN
+            <foreach collection="deptIds" item="deptId" open="(" separator="," close=")">
+                #{deptId}
+            </foreach>
+        </if>
+        <if test="roleIds != null and roleIds.contains(113L)">
+            AND a.supervisor_id = #{loginId}
+            AND a.user_type = 1
+        </if>
+        <if test="roleIds != null and roleIds.contains(114L)">
+            AND a.user_type = 1
+        </if>
+        <if test="roleIds != null and roleIds.contains(1L)">
+            AND a.dept_id IN (1, 2)
+        </if>
+        <if test="reqVO.isGraduate != null">
+            <if test="reqVO.isGraduate == 1">
+                AND a.id NOT IN (SELECT user_id FROM system_user_achievement WHERE user_id = a.id AND is_graduate = 0)
+            </if>
+            <if test="reqVO.isGraduate == 0">
+                AND a.id IN (SELECT user_id FROM system_user_achievement WHERE user_id = a.id AND is_graduate = #{reqVO.isGraduate})
+                AND ua.is_graduate = 0
+            </if>
+        </if>
+        <if test="reqVO.photoIsExist != null">
+            <if test="reqVO.photoIsExist == 0">
+                AND a.photo_url IS NULL
+            </if>
+            <if test="reqVO.photoIsExist == 1">
+                AND a.photo_url IS NOT NULL AND a.photo_url != ''
+            </if>
+        </if>
+        GROUP BY
+        a.id
+        ORDER BY
+        a.id DESC
+        LIMIT #{offset}, #{reqVO.pageSize}
+    </select>
+
+    <select id="selectPage1Count" resultType="Long">
+        SELECT COUNT(*) AS total_count
+        FROM (
+        SELECT a.id
+        FROM system_users a
+        LEFT JOIN system_user_achievement ua ON ua.user_id = a.id
+        WHERE 1=1
+        <if test="reqVO.username != null and reqVO.username != ''">
+            AND a.username LIKE CONCAT('%', #{reqVO.username}, '%')
+        </if>
+        <if test="reqVO.email != null and reqVO.email != ''">
+            AND a.email LIKE CONCAT('%', #{reqVO.email}, '%')
+        </if>
+        <if test="reqVO.mobile != null and reqVO.mobile != ''">
+            AND a.mobile LIKE CONCAT('%', #{reqVO.mobile}, '%')
+        </if>
+        <if test="reqVO.userNumber != null and reqVO.userNumber != ''">
+            AND a.user_number LIKE CONCAT('%', #{reqVO.userNumber}, '%')
+        </if>
+        <if test="reqVO.nickname != null and reqVO.nickname != ''">
+            AND a.nickname LIKE CONCAT('%', #{reqVO.nickname}, '%')
+        </if>
+        <if test="reqVO.userType != null">
+            AND a.user_type = #{reqVO.userType}
+        </if>
+        <if test="reqVO.grade != null and reqVO.grade != ''">
+            AND a.grade LIKE CONCAT('%', #{reqVO.grade}, '%')
+        </if>
+        <if test="reqVO.supervisorId != null">
+            AND a.supervisor_id = #{reqVO.supervisorId}
+        </if>
+        <if test="reqVO.status != null">
+            AND a.status = #{reqVO.status}
+        </if>
+        <if test="deptIds != null and !deptIds.isEmpty()">
+            AND a.dept_id IN
+            <foreach collection="deptIds" item="deptId" open="(" separator="," close=")">
+                #{deptId}
+            </foreach>
+        </if>
+        <if test="roleIds != null and roleIds.contains(113L)">
+            AND a.supervisor_id = #{loginId}
+            AND a.user_type = 1
+        </if>
+        <if test="roleIds != null and roleIds.contains(114L)">
+            AND a.user_type = 1
+        </if>
+        <if test="roleIds != null and roleIds.contains(1L)">
+            AND a.dept_id IN (1, 2)
+        </if>
+        <if test="reqVO.isGraduate != null">
+            <if test="reqVO.isGraduate == 1">
+                AND a.id NOT IN (SELECT user_id FROM system_user_achievement WHERE user_id = a.id AND is_graduate = 0)
+            </if>
+            <if test="reqVO.isGraduate == 0">
+                AND a.id IN (SELECT user_id FROM system_user_achievement WHERE user_id = a.id AND is_graduate = #{reqVO.isGraduate})
+                AND ua.is_graduate = 0
+            </if>
+        </if>
+        <if test="reqVO.photoIsExist != null">
+            <if test="reqVO.photoIsExist == 0">
+                AND a.photo_url IS NULL
+            </if>
+            <if test="reqVO.photoIsExist == 1">
+                AND a.photo_url IS NOT NULL AND a.photo_url != ''
+            </if>
+        </if>
+        GROUP BY a.id
+        ) AS subquery;
     </select>
 </mapper>