用户接口不返回敏感数据 sidx参数限定范围检验

app/service/user/userSvc.go

@@ -194,7 +194,10 @@ func Page(form *base.BaseForm) ([]user.Entity, error) {
 		glog.Error("page list error", err)
 		return []user.Entity{}, err
 	}
-
+	for i := range resData {
+		resData[i].Password = ""
+		resData[i].Salt = ""
+	}
 	return resData, nil
 }
 

library/base/baseForm.go

@@ -1,6 +1,11 @@
 package base
 
-import "github.com/gogf/gf/util/gconv"
+import (
+	"github.com/gogf/gf/util/gconv"
+	"gmanager/app/model/user"
+	"reflect"
+	"strings"
+)
 
 type BaseForm struct {
 	Page      int    `form:"page",json:"page"`           // 当前页码
@@ -31,6 +36,19 @@ func NewForm(params map[string]interface{}) BaseForm {
 	if value, ok := params["orderBy"]; ok && value != "" {
 		form.OrderBy = gconv.String(value)
 	} else if value2, ok := params["sidx"]; ok && value2 != "" {
+		t := reflect.TypeOf(user.Entity{})
+		checkPassed := false
+		value2 := gconv.String(value2)
+		for i := 0; i < t.NumField(); i++ {
+			field := t.Field(i)
+			if strings.EqualFold(field.Name, value2) {
+				checkPassed = true
+				break
+			}
+		}
+		if !checkPassed {
+			return form
+		}
 		form.OrderBy = gconv.String(value2)
 		if value3, ok := params["sord"]; ok && value3 != "" {
 			form.OrderBy += " " + gconv.String(value3)