数据安全检测
--------------of_buildselectexpression-------------------------------
string ls_value = '', ls_expression, ls_tmp, ls_column, ls_coltype
long ll_row, ll_rowcount
ll_rowcount = ids_cond.rowcount()
ls_column = adwc.describe(as_col + '.dbname')
if ls_column = '!' or ls_column = '?' or ls_column = '' then return '!'
ls_coltype = adwc.describe(as_col + '.coltype')
If ls_coltype='!' or ls_coltype='?' Then Return '!'
ls_coltype = Lower ( Left (ls_coltype, 5 ) )
ls_expression = ls_column + ' ' + as_opr + ' '
choose case as_opr
case '= any'
ls_expression = ''
case 'is null', 'is not null'
//do nothing
case 'in', 'not in'
if ll_rowcount < 2 then return '!'
ls_value = "("
for ll_row = 1 to ll_rowcount
ls_tmp = ids_cond.getitemstring(ll_row, 'value')
if len(trim(ls_tmp)) = 0 or isnull(ls_tmp) then return '!'
Choose Case ls_coltype
Case "char(", "char", "date", "datet", "time", "times"
ls_value += "'" + ls_tmp + "', "
Case Else
ls_value += ls_tmp + ", "
end choose
next
ls_value = left(ls_value, len(ls_value) - 2) + ')'
ls_expression += ls_value
case 'like', 'not like'
if ll_rowcount <> 1 then return '!'
ls_tmp = ids_cond.getitemstring(1, 'value')
if len(trim(ls_tmp)) = 0 or isnull(ls_tmp) then return '!'
Choose Case ls_coltype
Case "char(", "char"
ls_expression += "'%" + ls_tmp + "%'"
case else
ls_expression = '!'
end choose
case else
if ll_rowcount <> 1 then return '!'
ls_tmp = ids_cond.getitemstring(1, 'value')
if len(trim(ls_tmp)) = 0 or isnull(ls_tmp) then return '!'
Choose Case ls_coltype
Case "char(", "char", "date", "datet", "time", "times"
ls_expression += "'" + ls_tmp + "'"
case else
ls_expression += ls_tmp
end choose
end choose
return ls_expression
------------------------of_buildselectexpression------------------------------
string ls_value = '', ls_expression, ls_tmp, ls_column, ls_coltype
long ll_row, ll_rowcount
ll_rowcount = ids_cond.rowcount()
ls_column = adw.describe(as_col + '.dbname')
if ls_column = '!' or ls_column = '?' or ls_column = '' then return '!'
ls_coltype = adw.describe(as_col + '.coltype')
If ls_coltype='!' or ls_coltype='?' Then Return '!'
ls_coltype = Lower ( Left (ls_coltype, 5 ) )
ls_expression = ls_column + ' ' + as_opr + ' '
choose case as_opr
case '= any'
ls_expression = ''
case 'is null', 'is not null'
ls_expression += ls_column + ' ' + as_opr
case 'in', 'not in'
if ll_rowcount < 2 then return '!'
ls_value = "("
for ll_row = 1 to ll_rowcount
ls_tmp = ids_cond.getitemstring(ll_row, 'value')
if len(trim(ls_tmp)) = 0 or isnull(ls_tmp) then return '!'
Choose Case ls_coltype
Case "char(", "char", "date", "datet", "time", "times"
ls_value += "'" + ls_tmp + "', "
Case Else
//weng
//old ls_value += "'" + ls_tmp + ", "
ls_value += ls_tmp + ", "
//weng
end choose
next
ls_value = left(ls_value, len(ls_value) - 2) + ')'
ls_expression += ls_value
case 'like', 'not like'
if ll_rowcount <> 1 then return '!'
ls_tmp = ids_cond.getitemstring(1, 'value')
if len(trim(ls_tmp)) = 0 or isnull(ls_tmp) then return '!'
Choose Case ls_coltype
Case "char(", "char"
ls_expression += "'%" + ls_tmp + "%'"
case else
ls_expression = '!'
end choose
case else
if ll_rowcount <> 1 then return '!'
ls_tmp = ids_cond.getitemstring(1, 'value')
if len(trim(ls_tmp)) = 0 or isnull(ls_tmp) then return '!'
Choose Case ls_coltype
Case "char(", "char", "date", "datet", "time", "times"
ls_expression += "'" + ls_tmp + "'"
case else
ls_expression += ls_tmp
end choose
end choose
return ls_expression
--------------------of_buildselectimpossible---------------------------------------
string ls_column
If Len(Trim(as_col))=0 or IsNull(as_col) Then Return '!'
ls_column = adw.describe(ls_column + '.dbname')
if ls_column = '!' or ls_column = '?' or ls_column = '' then return '!'
return ls_column + ' is null and ' + ls_column + ' is not null '
-----------------------------of_buildselectimpossible--------------------------------------
string ls_column
If Len(Trim(as_col))=0 or IsNull(as_col) Then Return '!'
ls_column = adwc.describe(as_col + '.dbname')
if ls_column = '!' or ls_column = '?' or ls_column = '' then return '!'
return ls_column + ' is null and ' + ls_column + ' is not null '
---------------------------of_findcontrolcolumn-----------------------------------------
string ls_r
long ll_row
if isnull(as_dw) or len(trim(as_dw)) = 0 then return '!'
if not isvalid(ids_template) then return '!'
if ids_template.rowcount() < 1 then return '!'
ll_row = ids_template.find('datawindow = "' + as_dw + '"', 1, ids_template.rowcount())
if ll_row <= 0 then return '!'
ls_r = ids_template.getitemstring(ll_row, 'columnname')
if isnull(ls_r) or trim(ls_r) = '' then return '!'
return ls_r
-----------------------------of_finddw----------------------------------------------------
long ll_row
if isnull(as_dw) or len(trim(as_dw)) = 0 then return false
if not isvalid(ids_template) then return false
if ids_template.rowcount() < 1 then return false
ll_row = ids_template.find('datawindow = "' + as_dw + '"', 1, ids_template.rowcount())
if ll_row <= 0 then return false
return true
--------------------------------of_protect-------------------------------
string ls_cols[], ls_modify, ls_tmp
long ll_column, ll_tmp
of_getobjects(ls_cols, 'column', '*', false)
ll_column = upperbound(ls_cols)
for ll_tmp = 1 to ll_column
ls_modify = ls_cols[ll_tmp] + ".Protect=1"
ls_tmp = idw_requestor.describe(ls_cols[ll_tmp] + ".band")
if ls_tmp <> '?' then
ls_modify = idw_requestor.modify(ls_modify)
if ls_modify <> '' then return FAILURE
end if
next
return SUCCESS
-----------------------------------of_register-----------------------------
string ls_dw, ls_col, ls_opr, ls_user
integer li_rc
application app
app = GetApplication()
is_app = app.appname
is_user = as_user
ls_dw = idw_requestor.dataobject
idw_requestor.settransobject(atr)
itr = atr
if isnull(atr) or not isvalid(atr) then return FAILURE
if isnull(is_app) or isnull(as_user) or isnull(ls_dw) or trim(is_user) = '' then return FAILURE
//初始化数据窗口
ids_info = create n_ds
ids_info.dataobject = 'd_datasecurity_info'
ids_info.settransobject(atr)
ids_cond = create n_ds
ids_cond.dataobject = 'd_datasecurity_condition'
ids_cond.settransobject(atr)
ids_template = create n_ds
ids_template.dataobject = 'd_datasecurity_template'
ids_template.settransobject(atr)
//取出模板
if ids_template.retrieve(is_app) < 0 then return FAILURE
//如果在安全模板中就处理，否则就处理CHILDDATAWINDOW，然后返回，对本窗口不作任何控制
if not of_finddw(ls_dw) then
is_act = ''
return of_securechild()
end if
//取出控制列
ls_col= of_findcontrolcolumn(ls_dw)
//取控制列出错
if ls_col= '!' then
return FAILURE
end if
//模板中有，信息中没有，认为不可见，则只需将is_act置为'不可见'，DATAWINDOW也不可见
if ids_info.retrieve(is_app, ls_dw, is_user) < 0 then return FAILURE
if ids_info.rowcount() = 0 then
is_act = '不可见'
else //取出用户信息
is_act = trim(ids_info.getitemstring(1, 'allowedaction'))
ls_opr = trim(ids_info.getitemstring(1, 'operator'))
ls_user = trim(ids_info.getitemstring(1, 'username'))
if isnull(ls_user) or len(trim(ls_user) ) = 0 then return FAILURE
if isnull(ls_col) or isnull(is_act) or trim(ls_opr) = '' or trim(is_act) = '' then return FAILURE
end if
//明确不可见
if is_act = '不可见' then
if of_setinvisible(idw_requestor, ls_col) = FAILURE then return FAILURE
if of_protect() = FAILURE then return FAILURE
return SUCCESS
end if
//如果是可见先保护再说
if is_act = '可见' then
if of_protect() = FAILURE then return FAILURE
end if
//再往下就只有'可见'和'可改'了, 不论'可见'或'可改', 均应先改sql
//先把条件取出来
if ids_cond.retrieve(is_app, ls_dw, ls_user, ls_col) < 0 then return FAILURE
//在本函数中处理中DATAWINDOW，如果成功则继续处理CHILDDATAWINDOW
li_rc = of_beforeretrieve(idw_requestor, ls_col, ls_opr)
if li_rc = FAILURE then return FAILURE
li_rc = of_securechild()
return li_rc
--------------------------------------------of_securechild--------------------------------
//以下处理CHILDDATAWINDOW
string ls_cols[], ls_dddw, ls_act, ls_opr, ls_col, ls_user
long ll_column, ll_tmp
integer li_rc
datawindowchild ldwc
of_getobjects(ls_cols, 'column', '*', false)
ll_column = upperbound(ls_cols)
for ll_tmp = 1 to ll_column
//先判断是否DDDW
ls_dddw = idw_requestor.describe(ls_cols[ll_tmp] + ".dddw.name")
if ls_dddw = '!' or ls_dddw = '?' or ls_dddw = '' then continue
//是否在模板中
if not of_finddw(ls_dddw) then continue
//取出列名信息
ls_col = of_findcontrolcolumn(ls_dddw)
if ls_col = '!' then return FAILURE
//如果在模板中，应该能取出来
if idw_requestor.getchild(ls_cols[ll_tmp], ldwc) = -1 then return FAILURE
//SETTRANSOBJECT
if ldwc.settransobject(itr) = -1 then return FAILURE
//取出用户信息
if ids_info.retrieve(is_app, ls_dddw, is_user) < 0 then return FAILURE
if ids_info.rowcount() = 0 then
ls_act = '不可见'
else //取出用户信息
ls_act = trim(ids_info.getitemstring(1, 'allowedaction'))
ls_opr = trim(ids_info.getitemstring(1, 'operator'))
ls_user = trim(ids_info.getitemstring(1, 'username'))
if isnull(ls_col) or isnull(ls_act) or trim(ls_opr) = '' or trim(ls_act) = '' then return FAILURE
end if
//明确不可见
if ls_act = '不可见' then
if of_setinvisible(ldwc, ls_col) = FAILURE then return FAILURE
continue
end if
if ids_cond.retrieve(is_app, ls_dddw, ls_user, ls_col) < 0 then return FAILURE
if of_securechild(ldwc, ls_col, ls_opr) = FAILURE then return FAILURE
next
return SUCCESS
//结束
-----------------------------------------------of_securechild----------------------------------
string ls_select, ls_expression, ls_colexp, ls_oldfilter
long ll_row
//先构造过滤用的EXPRESSION
ls_expression = of_builddwexpression(adwc, as_col, as_opr)
if ls_expression = '!' then
return FAILURE
else
ls_oldfilter = adwc.describe('datawindow.table.filter')
if not (isnull(ls_oldfilter) or ls_oldfilter = '' or ls_oldfilter = '?' or ls_oldfilter = '!') then
ls_expression = '(' + ls_oldfilter + ') and (' + ls_expression + ')'
end if
if adwc.setfilter(ls_expression) <> 1 then
return FAILURE
else
adwc.filter()
is_filter = ls_expression
end if
end if
//对于可取到SQL并且非数据窗口计算字段的，还要修改SQL，修改成功当然好，不成功也没有关系因为FILTER成功了
ls_select = adwc.describe('datawindow.table.select')
ls_colexp = adwc.describe(as_col + '.expression')
if ls_select <> '!' and ls_select <> '?' and ls_select <> '' and ls_colexp = '!' then //可以修改select
ls_expression = of_buildselectexpression(adwc, as_col, as_opr)
if ls_expression <> '!' and ls_expression <> '' then
ls_select = lower(ls_select)
if pos(ls_select, 'where') > 0 then
ls_select = ls_select + ' and ' + ls_expression
else
ls_select = ls_select + ' where ' + ls_expression
end if
end if
// if of_testsqlselect() then
if adwc.modify('datawindow.table.select="' + ls_select + '"') <> '' then return FAILURE
// end if
end if
return SUCCESS
----------------------------------------of_setinvisible-----------------------------------------------------
string ls_expression, ls_select, ls_colexp
if isnull(as_col) or trim(as_col) = '' then return FAILURE
if not isvalid(adw) then return FAILURE
ls_expression = 'isnull(' + as_col + ') and not isnull(' +as_col + ')'
if adw.setfilter(ls_expression) <> 1 then
return FAILURE
else
adw.filter()
end if
//处理SQL，对于可取到SQL并且非数据窗口计算字段的，还要修改SQL，修改成功当然好，不成功也没有关系因为FILTER成功了
ls_select = adw.describe('datawindow.table.select')
ls_colexp = adw.describe(as_col + '.expression')
if ls_select <> '!' and ls_select <> '?' and ls_select <> '' and ls_colexp = '!' then //可以修改select
ls_expression = of_buildselectimpossible(adw, as_col)
ls_select = lower(ls_select)
if pos(ls_select, 'where') > 0 then
ls_expression = ls_select + ' and ' + ls_expression
else
ls_expression = ls_select + ' where ' + ls_expression
end if
adw.modify('datawindow.table.select="' + ls_expression + '"')
end if
return SUCCESS
-------------------------------------of_setinvisible-----------------------------------
string ls_expression, ls_select, ls_colexp
if isnull(as_col) or trim(as_col) = '' then return FAILURE
if not isvalid(adwc) then return FAILURE
ls_expression = 'isnull(' + as_col + ') and not isnull(' +as_col + ')'
if adwc.setfilter(ls_expression) <> 1 then
return FAILURE
else
adwc.filter()
end if
//处理SQL，对于可取到SQL并且非数据窗口计算字段的，还要修改SQL，修改成功当然好，不成功也没有关系因为FILTER成功了
ls_select = adwc.describe('datawindow.table.select')
ls_colexp = adwc.describe(as_col + '.expression')
if ls_select <> '!' and ls_select <> '?' and ls_select <> '' and (ls_colexp = '!' or ls_colexp = '?') then //可以修改select
ls_expression = of_buildselectimpossible(adwc, as_col)
ls_select = lower(ls_select)
if pos(ls_select, 'where') > 0 then
ls_expression = ls_select + ' and ' + ls_expression
else
ls_expression = ls_select + ' where ' + ls_expression
end if
adwc.modify('datawindow.table.select="' + ls_expression + '"')
end if
return SUCCESS