fix: 用户列表接口sql-inject

core/backend/src/main/java/io/dataease/ext/ExtSysUserMapper.xml

@@ -73,6 +73,18 @@
             </foreach>
         </if>
 
+        <choose>
+            <when test="orders!=null and orders.size > 0">
+                order by
+                <foreach collection="orders" item="item" open='' separator=',' close=''>
+                    ${item}
+                </foreach>
+            </when>
+            <otherwise>
+                order by u.update_time desc
+            </otherwise>
+        </choose>
+
 
     </select>
 

core/frontend/src/views/system/user/index.vue

@@ -572,11 +572,8 @@ export default {
       })
     },
     search() {
-      /* const param = {
-        orders: formatOrders(this.orderConditions),
-        conditions: [...this.cacheCondition]
-      } */
       const param = buildParam(this.cacheCondition, this.nickName)
+      param.orders = formatOrders(this.orderConditions)
 
       const { currentPage, pageSize } = this.paginationConfig
       userLists(currentPage, pageSize, param).then((response) => {