issues/4983 SQL Injection in 3.5.1 #4983

README-EN.md

@@ -205,15 +205,15 @@ Technical Architecture:
 
 #### backend
 
-- Basic framework: Spring Boot 2.6.6
+- Basic framework: Spring Boot 2.6.14
 
 - Microservice framework: Spring Cloud Alibaba 2021.0.1.0
 
 - Persistence layer framework: MybatisPlus 3.5.1
 
-- Report tool: JimuReport 1.5.2
+- Report tool: JimuReport 1.5.8
 
-- Security framework: Apache Shiro 1.8.0, Jwt 3.11.0
+- Security framework: Apache Shiro 1.10.0, Jwt 3.11.0
 
 - Microservice technology stack: Spring Cloud Alibaba, Nacos, Gateway, Sentinel, Skywalking
 

README.md

@@ -238,15 +238,15 @@ VUE2版本专题介绍
 
 #### 后端
 
-- 基础框架：Spring Boot 2.6.6
+- 基础框架：Spring Boot 2.6.14
 
 - 微服务框架： Spring Cloud Alibaba 2021.0.1.0
 
 - 持久层框架：MybatisPlus 3.5.1
 
-- 报表工具： JimuReport 1.5.2
+- 报表工具： JimuReport 1.5.8
 
-- 安全框架：Apache Shiro 1.8.0，Jwt 3.11.0
+- 安全框架：Apache Shiro 1.10.0，Jwt 3.11.0
 
 - 微服务技术栈：Spring Cloud Alibaba、Nacos、Gateway、Sentinel、Skywalking
 
@@ -441,7 +441,7 @@ VUE2版本专题介绍
 │  ├─数据报表设计
 │  ├─图形报表设计（支持echart）
 │  ├─大屏设计器(未开源)
-│─流程模块功能 (未开源)
+│─更多商业功能 (未开源)
 │  ├─流程设计器
 │  ├─表单设计器
    ├─大屏设计器

jeecg-boot-base-core/src/main/java/org/jeecg/common/es/JeecgElasticsearchTemplate.java

@@ -7,6 +7,7 @@ import org.apache.commons.lang3.StringUtils;
 import org.jeecg.common.util.RestUtil;
 import org.jeecg.common.util.oConvertUtils;
 import org.springframework.beans.factory.annotation.Value;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
 import org.springframework.http.HttpHeaders;
 import org.springframework.http.HttpMethod;
 import org.springframework.http.HttpStatus;
@@ -22,6 +23,7 @@ import java.util.*;
  */
 @Slf4j
 @Component
+@ConditionalOnProperty(prefix = "jeecg.elasticsearch", name = "cluster-nodes")
 public class JeecgElasticsearchTemplate {
     /** es服务地址 */
     private String baseUrl;

jeecg-boot-base-core/src/main/java/org/jeecg/common/system/base/controller/JeecgController.java

@@ -11,6 +11,7 @@ import org.jeecg.common.api.vo.Result;
 import org.jeecg.common.system.query.QueryGenerator;
 import org.jeecg.common.system.vo.LoginUser;
 import org.jeecg.common.util.oConvertUtils;
+import org.jeecg.config.JeecgBaseConfig;
 import org.jeecgframework.poi.excel.ExcelImportUtil;
 import org.jeecgframework.poi.excel.def.NormalExcelConstants;
 import org.jeecgframework.poi.excel.entity.ExportParams;
@@ -23,6 +24,7 @@ import org.springframework.web.multipart.MultipartFile;
 import org.springframework.web.multipart.MultipartHttpServletRequest;
 import org.springframework.web.servlet.ModelAndView;
 
+import javax.annotation.Resource;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import java.io.IOException;
@@ -40,9 +42,9 @@ public class JeecgController<T, S extends IService<T>> {
     /**issues/2933 JeecgController注入service时改用protected修饰，能避免重复引用service*/
     @Autowired
     protected S service;
+    @Resource
+    private JeecgBaseConfig jeecgBaseConfig;
     
-    @Value("${jeecg.path.upload}")
-    private String upLoadPath;
     /**
      * 导出excel
      *
@@ -69,7 +71,7 @@ public class JeecgController<T, S extends IService<T>> {
         mv.addObject(NormalExcelConstants.CLASS, clazz);
         //update-begin--Author:liusq  Date:20210126 for：图片导出报错，ImageBasePath未设置--------------------
         ExportParams  exportParams=new ExportParams(title + "报表", "导出人:" + sysUser.getRealname(), title);
-        exportParams.setImageBasePath(upLoadPath);
+        exportParams.setImageBasePath(jeecgBaseConfig.getPath().getUpload());
         //update-end--Author:liusq  Date:20210126 for：图片导出报错，ImageBasePath未设置----------------------
         mv.addObject(NormalExcelConstants.PARAMS,exportParams);
         mv.addObject(NormalExcelConstants.DATA_LIST, exportList);
@@ -108,7 +110,7 @@ public class JeecgController<T, S extends IService<T>> {
             IPage<T> pageList = service.page(page, queryWrapper);
             List<T> exportList = pageList.getRecords();
             Map<String, Object> map = new HashMap<>(5);
-            ExportParams  exportParams=new ExportParams(title + "报表", "导出人:" + sysUser.getRealname(), title+i,upLoadPath);
+            ExportParams  exportParams=new ExportParams(title + "报表", "导出人:" + sysUser.getRealname(), title+i,jeecgBaseConfig.getPath().getUpload());
             exportParams.setType(ExcelType.XSSF);
             //map.put("title",exportParams);
             //表格Title

jeecg-boot-base-core/src/main/java/org/jeecg/common/util/DySmsHelper.java

@@ -62,6 +62,8 @@ public class DySmsHelper {
 
         //update-begin-author：taoyan date:20200811 for:配置类数据获取
         StaticConfig staticConfig = SpringContextUtils.getBean(StaticConfig.class);
+        logger.info("阿里大鱼短信秘钥 accessKeyId：" + staticConfig.getAccessKeyId());
+        logger.info("阿里大鱼短信秘钥 accessKeySecret："+ staticConfig.getAccessKeySecret());
         setAccessKeyId(staticConfig.getAccessKeyId());
         setAccessKeySecret(staticConfig.getAccessKeySecret());
         //update-end-author：taoyan date:20200811 for:配置类数据获取

jeecg-boot-base-core/src/main/java/org/jeecg/common/util/PmsUtil.java

@@ -21,7 +21,7 @@ public class PmsUtil {
 
     private static String uploadPath;
 
-    @Value("${jeecg.path.upload}")
+    @Value("${jeecg.path.upload:}")
     public void setUploadPath(String uploadPath) {
         PmsUtil.uploadPath = uploadPath;
     }

jeecg-boot-base-core/src/main/java/org/jeecg/common/util/security/AbstractQueryBlackListHandler.java

@@ -3,6 +3,8 @@ package org.jeecg.common.util.security;
 import lombok.extern.slf4j.Slf4j;
 
 import java.util.*;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
 
 /**
  * 查询表/字段 黑名单处理
@@ -21,6 +23,11 @@ public abstract class AbstractQueryBlackListHandler {
      */
     public static Map<String, String> ruleMap = new HashMap<>();
 
+    /**
+     * 以下字符不能出现在表名中或是字段名中
+     */
+    public static final Pattern ILLEGAL_NAME_REG = Pattern.compile("[-]{2,}");
+
     static {
         ruleMap.put("sys_user", "password,salt");
     }
@@ -53,7 +60,10 @@ public abstract class AbstractQueryBlackListHandler {
             return true;
         }
         log.info("--获取sql信息--", list.toString());
-        boolean flag = true;
+        boolean flag = checkTableAndFieldsName(list);
+        if(flag == false){
+            return false;
+        }
         for (QueryTable table : list) {
             String name = table.getName();
             String fieldString = ruleMap.get(name);
@@ -73,6 +83,46 @@ public abstract class AbstractQueryBlackListHandler {
         return flag;
     }
 
+    /**
+     * 校验表名和字段名是否有效，或是是否会带些特殊的字符串进行sql注入
+     * issues/4983 SQL Injection in 3.5.1 #4983
+     * @return
+     */
+    private boolean checkTableAndFieldsName(List<QueryTable> list){
+        boolean flag = true;
+        for(QueryTable queryTable: list){
+            String tableName = queryTable.getName();
+            if(hasSpecialString(tableName)){
+                flag = false;
+                log.warn("sql黑名单校验，表名【"+tableName+"】包含特殊字符");
+                break;
+            }
+            Set<String> fields = queryTable.getFields();
+            for(String name: fields){
+                if(hasSpecialString(name)){
+                    flag = false;
+                    log.warn("sql黑名单校验，字段名【"+name+"】包含特殊字符");
+                    break;
+                } 
+            }
+        }
+        return flag;
+    }
+
+    /**
+     * 是否包含特殊的字符串
+     * @param name
+     * @return
+     */
+    private boolean hasSpecialString(String name){
+        Matcher m = ILLEGAL_NAME_REG.matcher(name);
+        if (m.find()) {
+            return true;
+        }
+        return false;
+    }
+    
+
     /**
      * 查询的表的信息
      */

jeecg-boot-base-core/src/main/java/org/jeecg/config/JeecgBaseConfig.java

@@ -1,6 +1,7 @@
 package org.jeecg.config;
 
 import org.jeecg.config.vo.DomainUrl;
+import org.jeecg.config.vo.Elasticsearch;
 import org.jeecg.config.vo.Path;
 import org.jeecg.config.vo.Shiro;
 import org.springframework.boot.context.properties.ConfigurationProperties;
@@ -52,6 +53,18 @@ public class JeecgBaseConfig {
      * 文件预览
      */
     private String fileViewDomain;
+     /**
+     * ES配置
+     */
+    private Elasticsearch elasticsearch;
+
+    public Elasticsearch getElasticsearch() {
+        return elasticsearch;
+    }
+
+    public void setElasticsearch(Elasticsearch elasticsearch) {
+        this.elasticsearch = elasticsearch;
+    }
 
     public Boolean getSafeMode() {
         return safeMode;

jeecg-boot-base-core/src/main/java/org/jeecg/config/StaticConfig.java

@@ -12,13 +12,13 @@ import org.springframework.stereotype.Component;
 @Data
 public class StaticConfig {
 
-    @Value("${jeecg.oss.accessKey}")
+    @Value("${jeecg.oss.accessKey:}")
     private String accessKeyId;
 
-    @Value("${jeecg.oss.secretKey}")
+    @Value("${jeecg.oss.secretKey:}")
     private String accessKeySecret;
 
-    @Value(value = "${spring.mail.username}")
+    @Value(value = "${spring.mail.username:}")
     private String emailFrom;
 
 //    /**

jeecg-boot-base-core/src/main/java/org/jeecg/config/WebMvcConfiguration.java

@@ -25,6 +25,7 @@ import org.springframework.http.converter.json.MappingJackson2HttpMessageConvert
 import org.springframework.web.cors.CorsConfiguration;
 import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
 import org.springframework.web.filter.CorsFilter;
+import org.springframework.web.servlet.config.annotation.ResourceHandlerRegistration;
 import org.springframework.web.servlet.config.annotation.ResourceHandlerRegistry;
 import org.springframework.web.servlet.config.annotation.ViewControllerRegistry;
 import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
@@ -59,12 +60,13 @@ public class WebMvcConfiguration implements WebMvcConfigurer {
      */
     @Override
     public void addResourceHandlers(ResourceHandlerRegistry registry) {
-        registry.addResourceHandler("/**")
+        ResourceHandlerRegistration resourceHandlerRegistration = registry.addResourceHandler("/**");
-                //update-begin-author:taoyan date:20211116 for: jeecg.path.webapp配置无效 #3126
+        if (jeecgBaseConfig.getPath() != null && jeecgBaseConfig.getPath().getUpload() != null) {
+            resourceHandlerRegistration
                     .addResourceLocations("file:" + jeecgBaseConfig.getPath().getUpload() + "//")
-                .addResourceLocations("file:" + jeecgBaseConfig.getPath().getWebapp() + "//")
+                    .addResourceLocations("file:" + jeecgBaseConfig.getPath().getWebapp() + "//");
-                //update-end-author:taoyan date:20211116 for: jeecg.path.webapp配置无效 #3126
+        }
-                .addResourceLocations(staticLocations.split(","));
+        resourceHandlerRegistration.addResourceLocations(staticLocations.split(","));
     }
 
     /**

jeecg-boot-base-core/src/main/java/org/jeecg/config/oss/MinioConfig.java

@@ -5,6 +5,7 @@ import org.jeecg.common.constant.CommonConstant;
 import org.jeecg.common.constant.SymbolConstant;
 import org.jeecg.common.util.MinioUtil;
 import org.springframework.beans.factory.annotation.Value;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 
@@ -14,6 +15,7 @@ import org.springframework.context.annotation.Configuration;
  */
 @Slf4j
 @Configuration
+@ConditionalOnProperty(prefix = "jeecg.minio", name = "minio_url")
 public class MinioConfig {
     @Value(value = "${jeecg.minio.minio_url}")
     private String minioUrl;

jeecg-boot-base-core/src/main/java/org/jeecg/config/oss/OssConfiguration.java

@@ -2,6 +2,7 @@ package org.jeecg.config.oss;
 
 import org.jeecg.common.util.oss.OssBootUtil;
 import org.springframework.beans.factory.annotation.Value;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 
@@ -10,6 +11,7 @@ import org.springframework.context.annotation.Configuration;
  * @author: jeecg-boot
  */
 @Configuration
+@ConditionalOnProperty(prefix = "jeecg.oss", name = "endpoint")
 public class OssConfiguration {
 
     @Value("${jeecg.oss.endpoint}")

jeecg-boot-base-core/src/main/java/org/jeecg/config/shiro/ShiroConfig.java

@@ -20,7 +20,6 @@ import org.jeecg.config.shiro.filters.CustomShiroFilterFactoryBean;
 import org.jeecg.config.shiro.filters.JwtFilter;
 import org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator;
 import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.beans.factory.annotation.Value;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.context.annotation.DependsOn;
@@ -146,6 +145,11 @@ public class ShiroConfig {
         //测试模块排除
         filterChainDefinitionMap.put("/test/seata/**", "anon");
 
+        // update-begin--author:liusq Date:20230522 for：[issues/4829]访问不存在的url时会提示Token失效，请重新登录呢
+        //错误路径排除
+        filterChainDefinitionMap.put("/error", "anon");
+        // update-end--author:liusq Date:20230522 for：[issues/4829]访问不存在的url时会提示Token失效，请重新登录呢
+
         // 添加自己的过滤器并且取名为jwt
         Map<String, Filter> filterMap = new HashMap<String, Filter>(1);
         //如果cloudServer为空 则说明是单体 需要加载跨域配置【微服务跨域切换】

jeecg-boot-base-core/src/main/java/org/jeecg/config/vo/Elasticsearch.java

@@ -0,0 +1,26 @@
+package org.jeecg.config.vo;
+
+/**
+ * @author: scott
+ * @date: 2023年05月10日 16:06
+ */
+public class Elasticsearch {
+    private String clusterNodes;
+    private boolean checkEnabled;
+
+    public String getClusterNodes() {
+        return clusterNodes;
+    }
+
+    public void setClusterNodes(String clusterNodes) {
+        this.clusterNodes = clusterNodes;
+    }
+
+    public boolean isCheckEnabled() {
+        return checkEnabled;
+    }
+
+    public void setCheckEnabled(boolean checkEnabled) {
+        this.checkEnabled = checkEnabled;
+    }
+}

jeecg-module-demo/src/main/java/org/jeecg/modules/demo/cloud/controller/JcloudDemoFeignController.java

@@ -44,7 +44,7 @@
 ////    /**
 ////     * 测试调用 erp 微服务接口
 ////     * 【如何测试：通过archetype生成微服务模块，快速集成测试】
-////     *  http://doc.jeecg.com/2194069
+////     *  https://help.jeecg.com/java/springcloud/archetype.html
 ////     * @return
 ////     */
 ////    @GetMapping("/callErp")

jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/config/init/CodeTemplateInitListener.java

@@ -17,7 +17,6 @@ import java.nio.charset.StandardCharsets;
  * 自动初始化代码生成器模板
  * <p>
  * 解决JAR发布需要手工配置代码生成器模板问题
- * http://doc.jeecg.com/2043922
  * @author zhang
  */
 @Slf4j

jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/message/handle/impl/EmailSendMsgHandle.java

@@ -58,6 +58,7 @@ public class EmailSendMsgHandle implements ISendMsgHandle {
         //update-begin-author：taoyan date:20200811 for:配置类数据获取
         if(oConvertUtils.isEmpty(emailFrom)){
             StaticConfig staticConfig = SpringContextUtils.getBean(StaticConfig.class);
+            log.info("邮件配置 emailFrom：" + emailFrom);
             setEmailFrom(staticConfig.getEmailFrom());
         }
         //update-end-author：taoyan date:20200811 for:配置类数据获取

jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysDictController.java

@@ -46,6 +46,8 @@ import org.springframework.web.servlet.ModelAndView;
 
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
+import java.io.UnsupportedEncodingException;
+import java.net.URLDecoder;
 import java.util.*;
 
 /**
@@ -203,6 +205,17 @@ public class SysDictController {
 											@RequestParam(name="keyword",required = false) String keyword,
 											@RequestParam(value = "sign",required = false) String sign,
 											@RequestParam(value = "pageSize", required = false) Integer pageSize) {
+		
+		//update-begin-author:taoyan date:2023-5-22 for: /issues/4905 因为中括号(%5)的问题导致的 表单生成器字段配置时，选择关联字段，在进行高级配置时，无法加载数据库列表，提示 Sgin签名校验错误！ #4905 RouteToRequestUrlFilter
+		if(keyword!=null && keyword.indexOf("%5")>=0){
+			try {
+				keyword = URLDecoder.decode(keyword, "UTF-8");
+			} catch (UnsupportedEncodingException e) {
+				log.error("下拉搜索关键字解码失败", e);
+			}
+		}
+		//update-end-author:taoyan date:2023-5-22 for: /issues/4905 因为中括号(%5)的问题导致的  表单生成器字段配置时，选择关联字段，在进行高级配置时，无法加载数据库列表，提示 Sgin签名校验错误！ #4905
+		
 		log.info(" 加载字典表数据,加载关键字: "+ keyword);
 		Result<List<DictModel>> result = new Result<List<DictModel>>();
 		//update-begin-author:taoyan date:20220317 for: VUEN-222【安全机制】字典接口、online报表、online图表等接口，加一些安全机制

jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/mapper/SysCategoryMapper.java

@@ -1,14 +1,15 @@
 package org.jeecg.modules.system.mapper;
 
-import java.util.List;
+import com.baomidou.mybatisplus.annotation.InterceptorIgnore;
-import java.util.Map;
+import com.baomidou.mybatisplus.core.mapper.BaseMapper;
-
+import com.baomidou.mybatisplus.extension.plugins.pagination.Page;
 import org.apache.ibatis.annotations.Param;
 import org.apache.ibatis.annotations.Select;
 import org.jeecg.modules.system.entity.SysCategory;
 import org.jeecg.modules.system.model.TreeSelectModel;
 
-import com.baomidou.mybatisplus.core.mapper.BaseMapper;
+import java.util.List;
+import java.util.Map;
 
 /**
  * @Description: 分类字典
@@ -34,5 +35,16 @@ public interface SysCategoryMapper extends BaseMapper<SysCategory> {
 	@Select("SELECT ID FROM sys_category WHERE CODE = #{code,jdbcType=VARCHAR}")
 	public String queryIdByCode(@Param("code")  String code);
 	
+	/**
+	 * 获取分类字典最大的code
+	 * @param page
+	 * @return
+	 */
+	@InterceptorIgnore(tenantLine = "true")
+	@Select("SELECT code FROM sys_category WHERE code IS NOT NULL AND pid=#{categoryPid} ORDER BY code DESC")
+	List<SysCategory> getMaxCategoryCodeByPage(@Param("page") Page<SysCategory> page, @Param("categoryPid") String categoryPid);
 
+	@InterceptorIgnore(tenantLine = "true")
+	@Select("SELECT code FROM sys_category WHERE ID = #{id}")
+    SysCategory selectSysCategoryById(@Param("id") String id);
 }

jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/model/SysPermissionTree.java

@@ -1,10 +1,11 @@
 package org.jeecg.modules.system.model;
 
+import org.jeecg.modules.system.entity.SysPermission;
+
 import java.io.Serializable;
 import java.util.ArrayList;
 import java.util.Date;
 import java.util.List;
-import org.jeecg.modules.system.entity.SysPermission;
 
 /**
  * @Description: 菜单树，封装树结构
@@ -129,13 +130,19 @@ public class SysPermissionTree implements Serializable {
     private boolean hidden;
     
     /**按钮权限状态(0无效1有效)*/
-	private java.lang.String status;
+	private String status;
 
 	/*update_begin author:wuxianquan date:20190908 for:model增加字段 */
 	/** 外链菜单打开方式 0/内部打开 1/外部打开 */
 	private boolean internalOrExternal;
 	/*update_end author:wuxianquan date:20190908 for:model增加字段 */
 
+	/*update_begin author:liusq date:20230601 for:【issues/4986】model增加hideTab字段 */
+	/**
+	 * 是否隐藏Tab: 0否,1是（默认值0）
+	 */
+	private boolean hideTab;
+	/*update_end author:liusq date:20230601 for:【issues/4986】model增加hideTab字段 */
 
 	public SysPermissionTree() {
 	}
@@ -169,6 +176,9 @@ public class SysPermissionTree implements Serializable {
 		this.internalOrExternal = permission.isInternalOrExternal();
 		/*update_end author:wuxianquan date:20190908 for:赋值 */
 		this.title=permission.getName();
+		/*update_end author:liusq date:20230601 for:【issues/4986】model增加hideTab字段 */
+		this.hideTab = permission.isHideTab();
+		/*update_end author:liusq date:20230601 for:【issues/4986】model增加hideTab字段 */
 		if (!permission.isLeaf()) {
 			this.children = new ArrayList<SysPermissionTree>();
 		}
@@ -392,11 +402,11 @@ public class SysPermissionTree implements Serializable {
 		this.permsType = permsType;
 	}
 
-	public java.lang.String getStatus() {
+	public String getStatus() {
 		return status;
 	}
 
-	public void setStatus(java.lang.String status) {
+	public void setStatus(String status) {
 		this.status = status;
 	}
 
@@ -409,4 +419,12 @@ public class SysPermissionTree implements Serializable {
 		this.internalOrExternal = internalOrExternal;
 	}
 	/*update_end author:wuxianquan date:20190908 for:get set 方法 */
+
+	public boolean isHideTab() {
+		return hideTab;
+	}
+
+	public void setHideTab(boolean hideTab) {
+		this.hideTab = hideTab;
+	}
 }

jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/rule/CategoryCodeRule.java

@@ -1,7 +1,7 @@
 package org.jeecg.modules.system.rule;
 
 import com.alibaba.fastjson.JSONObject;
-import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
+import com.baomidou.mybatisplus.extension.plugins.pagination.Page;
 import lombok.extern.slf4j.Slf4j;
 import org.jeecg.common.handler.IFillRuleHandler;
 import org.jeecg.common.util.SpringContextUtils;
@@ -50,16 +50,20 @@ public class CategoryCodeRule implements IFillRuleHandler {
          * 3.添加子节点有兄弟元素 YouBianCodeUtil.getNextYouBianCode(lastCode);
          * */
         //找同类 确定上一个最大的code值
-        LambdaQueryWrapper<SysCategory> query = new LambdaQueryWrapper<SysCategory>().eq(SysCategory::getPid, categoryPid).isNotNull(SysCategory::getCode).orderByDesc(SysCategory::getCode);
         SysCategoryMapper baseMapper = (SysCategoryMapper) SpringContextUtils.getBean("sysCategoryMapper");
-        List<SysCategory> list = baseMapper.selectList(query);
+        //update-begin---author:wangshuai ---date:20230424  for：【issues/4846】开启saas多租户功能后，租户管理员在添加分类字典时，报错------------
+        Page<SysCategory> page = new Page<>(1,1);
+        List<SysCategory> list = baseMapper.getMaxCategoryCodeByPage(page,categoryPid);
+        //update-end---author:wangshuai ---date:20230424  for：【issues/4846】开启saas多租户功能后，租户管理员在添加分类字典时，报错------------
         if (list == null || list.size() == 0) {
             if (ROOT_PID_VALUE.equals(categoryPid)) {
                 //情况1
                 categoryCode = YouBianCodeUtil.getNextYouBianCode(null);
             } else {
                 //情况2
-                SysCategory parent = (SysCategory) baseMapper.selectById(categoryPid);
+                //update-begin---author:wangshuai ---date:20230424  for：【issues/4846】开启saas多租户功能后，租户管理员在添加分类字典时，报错------------
+                SysCategory parent = (SysCategory) baseMapper.selectSysCategoryById(categoryPid);
+                //update-end---author:wangshuai ---date:20230424  for：【issues/4846】开启saas多租户功能后，租户管理员在添加分类字典时，报错------------
                 categoryCode = YouBianCodeUtil.getSubYouBianCode(parent.getCode(), null);
             }
         } else {

jeecg-module-system/jeecg-system-start/src/main/java/org/jeecg/codegenerate/JeecgOneGUI.java

@@ -10,7 +10,7 @@ import org.jeecgframework.codegenerate.window.CodeWindow;
  */
 public class JeecgOneGUI {
 
-	/** 使用手册： http://doc.jeecg.com/2684691 */
+	/** 使用手册： https://help.jeecg.com/vue3/codegen/gui.html */
     public static void main(String[] args) {
     	new CodeWindow().pack();
 	}

jeecg-server-cloud/jeecg-visual/jeecg-cloud-test/jeecg-cloud-test-seata/jeecg-cloud-test-seata-account/src/main/resources/application.yml

@@ -3,17 +3,20 @@ server:
 spring:
   application:
     name: seata-account
+  main:
+    allow-bean-definition-overriding: true
+  autoconfigure:
+    exclude: com.alibaba.druid.spring.boot.autoconfigure.DruidDataSourceAutoConfigure
   datasource:
     dynamic:
       seata: true    # 开启对 seata的支持
-      seata-mode: AT #支持XA及AT模式,默认AT
+      primary: account
       datasource:
-        # 设置 账号数据源配置
         account:
-          driver-class-name: com.mysql.cj.jdbc.Driver
+          url: jdbc:mysql://127.0.0.1:3306/jeecg_account?characterEncoding=UTF-8&useUnicode=true&useSSL=false&tinyInt1isBit=false&allowPublicKeyRetrieval=true&rewriteBatchedStatements=true
-          url: jdbc:mysql://127.0.0.1:3306/jeecg_account?serverTimezone=GMT%2B8&useUnicode=true&characterEncoding=utf8&rewriteBatchedStatements=true&useSSL=false
           username: root
           password: root
+          driver-class-name: com.mysql.cj.jdbc.Driver
           schema: classpath:sql/schema-account.sql
 seata:
   enable-auto-data-source-proxy: false

jeecg-server-cloud/jeecg-visual/jeecg-cloud-test/jeecg-cloud-test-seata/jeecg-cloud-test-seata-order/src/main/resources/application.yml

@@ -3,15 +3,19 @@ server:
 spring:
   application:
     name: seata-order
+  main:
+    allow-bean-definition-overriding: true
+  autoconfigure:
+    exclude: com.alibaba.druid.spring.boot.autoconfigure.DruidDataSourceAutoConfigure
   datasource:
     dynamic:
+      primary: order
       seata: true    # 开启对 seata的支持
-      seata-mode: AT #支持XA及AT模式,默认AT
       datasource:
         # 设置 账号数据源配置
         order:
           driver-class-name: com.mysql.cj.jdbc.Driver
-          url: jdbc:mysql://127.0.0.1:3306/jeecg_order?serverTimezone=GMT%2B8&useUnicode=true&characterEncoding=utf8&rewriteBatchedStatements=true&useSSL=false
+          url: jdbc:mysql://127.0.0.1:3306/jeecg_order?useUnicode=true&characterEncoding=utf8&rewriteBatchedStatements=true&useSSL=false
           username: root
           password: root
           schema: classpath:sql/schema-order.sql

jeecg-server-cloud/jeecg-visual/jeecg-cloud-test/jeecg-cloud-test-seata/jeecg-cloud-test-seata-product/src/main/resources/application.yml

@@ -3,15 +3,18 @@ server:
 spring:
   application:
     name: seata-product
+  main:
+    allow-bean-definition-overriding: true
   datasource:
     dynamic:
+      primary: product
       seata: true    # 开启对 seata的支持
       seata-mode: AT #支持XA及AT模式,默认AT
       datasource:
         # 设置 账号数据源配置
         product:
           driver-class-name: com.mysql.cj.jdbc.Driver
-          url: jdbc:mysql://127.0.0.1:3306/jeecg_product?serverTimezone=GMT%2B8&useUnicode=true&characterEncoding=utf8&rewriteBatchedStatements=true&useSSL=false
+          url: jdbc:mysql://127.0.0.1:3306/jeecg_product?useUnicode=true&characterEncoding=utf8&rewriteBatchedStatements=true&useSSL=false
           username: root
           password: root
           schema: classpath:sql/schema-product.sql

pom.xml

@@ -55,7 +55,7 @@
 		<minidao.version>1.9.0</minidao.version>
 
 		<!-- 积木报表-->
-		<jimureport-spring-boot-starter.version>1.5.6</jimureport-spring-boot-starter.version>
+		<jimureport-spring-boot-starter.version>1.5.8</jimureport-spring-boot-starter.version>
 		<commons.version>2.6</commons.version>
 		<aliyun-java-sdk-dysmsapi.version>2.1.0</aliyun-java-sdk-dysmsapi.version>
 		<aliyun.oss.version>3.11.2</aliyun.oss.version>
@@ -344,7 +344,7 @@
 			<dependency>
 				<groupId>org.jeecgframework.jimureport</groupId>
 				<artifactId>jimureport-nosql-starter</artifactId>
-				<version>${jimureport-spring-boot-starter.version}</version>
+				<version>1.5.6</version>
 			</dependency>
 		</dependencies>
 	</dependencyManagement>