表格组件查询按钮及扩展单选组件优化

io.sc.platform.core.frontend/src/platform/components/grid/ts/function/RequestApi.ts

@@ -216,12 +216,17 @@ export class RequestApi extends Base {
       reqParams.pageable = this.props.tree || this.props.localMode ? false : this.props.pageable;
     }
     if (ops.pagination.sortBy && ops.pagination.sortBy !== '') {
+      const column = this.table.columns.find((item) => item.name === ops.pagination.sortBy);
+      let columnName = ops.pagination.sortBy;
+      if (column && column.sortByName && typeof column.sortByName === 'string') {
+        columnName = column.sortByName;
+      }
       // 处理表格点击列头进行的排序
       if (ops.pagination.descending) {
-        reqParams.sortBy = '-' + ops.pagination.sortBy;
+        reqParams.sortBy = '-' + columnName;
         reqParams.descending = ops.pagination.descending;
       } else {
-        reqParams.sortBy = ops.pagination.sortBy;
+        reqParams.sortBy = columnName;
       }
     } else if (this.props.sortBy && this.props.sortBy.length > 0) {
       // 处理表格配置的默认排序

io.sc.platform.lcdp/src/main/java/io/sc/platform/lcdp/form/service/impl/JdbcTemplateServiceImpl.java

@@ -4,6 +4,7 @@ import com.fasterxml.jackson.databind.ObjectMapper;
 import io.sc.platform.jdbc.DatabaseType;
 import io.sc.platform.jdbc.sql.builder.SqlBuilder;
 import io.sc.platform.jdbc.sql.condition.Condition;
+import io.sc.platform.jdbc.util.SqlInjectionPreventer;
 import io.sc.platform.lcdp.form.entity.GridFieldEntity;
 import io.sc.platform.lcdp.form.entity.GridPageEntity;
 import io.sc.platform.lcdp.form.enums.AddValueType;
@@ -633,6 +634,7 @@ public class JdbcTemplateServiceImpl implements JdbcTemplateService {
         if (null != parameter.getSortBy() && parameter.getSortBy().size() > 0) {
             sql = " ORDER BY ";
             for (String sort: parameter.getSortBy()) {
+                SqlInjectionPreventer.checkSqlInjection(sort);
                 if (sort.startsWith("-")) {
                     sql += sort.substring(1) + " DESC,";
                 } else if (sort.startsWith("+")) {