Index: ssts-tousse/src/main/java/com/forgon/disinfectsystem/tousse/imagefilemanager/service/ImageFileManagerImpl.java =================================================================== diff -u -r40302 -r40811 --- ssts-tousse/src/main/java/com/forgon/disinfectsystem/tousse/imagefilemanager/service/ImageFileManagerImpl.java (.../ImageFileManagerImpl.java) (revision 40302) +++ ssts-tousse/src/main/java/com/forgon/disinfectsystem/tousse/imagefilemanager/service/ImageFileManagerImpl.java (.../ImageFileManagerImpl.java) (revision 40811) @@ -22,6 +22,7 @@ import java.util.ArrayList; import java.util.Arrays; import java.util.Base64; +import java.util.Collection; import java.util.Comparator; import java.util.Date; import java.util.HashMap; @@ -87,6 +88,7 @@ import com.forgon.tools.db.InitDbConnection; import com.forgon.tools.hibernate.ObjectDao; import com.forgon.tools.json.JSONUtil; +import com.forgon.tools.string.StringTools; import com.forgon.tools.util.ConfigUtils; import com.forgon.tools.util.FileUtils; import com.forgon.tools.util.SqlUtils; @@ -1197,14 +1199,16 @@ } else { // 没有关联对象的图片视频,根据id查找 if (StringUtils.isNotBlank(imageIds)) { + Collection imageIdList = StringTools.parseToLongs(imageIds, ","); imageHql = String.format(" from %s po where %s %s order by po.serialNum", ImageFile.class.getSimpleName(), - SqlUtils.getNonStringFieldInLargeCollectionsPredicate("po.id", Arrays.asList(imageIds.split(","))), barcodeSql); + SqlUtils.getNonStringFieldInLargeCollectionsPredicate("po.id", imageIdList), barcodeSql); } if (StringUtils.isNotBlank(videoIds)) { + Collection videoIdList = StringTools.parseToLongs(videoIds, ","); videoHql = String.format(" from %s po where %s %s order by po.serialNum", VideoFile.class.getSimpleName(), - SqlUtils.getNonStringFieldInLargeCollectionsPredicate("po.id", Arrays.asList(videoIds.split(","))), barcodeSql); + SqlUtils.getNonStringFieldInLargeCollectionsPredicate("po.id", videoIdList), barcodeSql); } } List imageList = null; Index: ssts-web/src/main/java/com/forgon/disinfectsystem/message/dwr/table/SystemMessageTableManager.java =================================================================== diff -u -r36192 -r40811 --- ssts-web/src/main/java/com/forgon/disinfectsystem/message/dwr/table/SystemMessageTableManager.java (.../SystemMessageTableManager.java) (revision 36192) +++ ssts-web/src/main/java/com/forgon/disinfectsystem/message/dwr/table/SystemMessageTableManager.java (.../SystemMessageTableManager.java) (revision 40811) @@ -15,6 +15,7 @@ import net.sf.json.util.CycleDetectionStrategy; import org.apache.commons.collections4.CollectionUtils; +import org.apache.commons.lang.StringEscapeUtils; import org.apache.commons.lang.StringUtils; import org.hibernate.Query; @@ -75,6 +76,7 @@ if(StringUtils.isBlank(departCode)){ departCode = AcegiHelper.getCurrentOrgUnitCode(); } + departCode = StringEscapeUtils.escapeSql(departCode); //该科室不是一级供应室 if(!StringUtils.equals(firstRoomCode, departCode)){ sql += " and (po.departCodes like '" + departCode + "'" Index: ssts-web/src/main/webapp/logonForExpensiveGoods.jsp =================================================================== diff -u -r31663 -r40811 --- ssts-web/src/main/webapp/logonForExpensiveGoods.jsp (.../logonForExpensiveGoods.jsp) (revision 31663) +++ ssts-web/src/main/webapp/logonForExpensiveGoods.jsp (.../logonForExpensiveGoods.jsp) (revision 40811) @@ -82,7 +82,7 @@