From d4d6cc23a1eb95c0b40753baea954271fa42256f Mon Sep 17 00:00:00 2001
From: fit2cloud-chenyw <yawen.chen@fit2cloud.com>
Date: Mon, 11 Sep 2023 09:18:39 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20=E7=94=A8=E6=88=B7=E5=88=97=E8=A1=A8?=
 =?UTF-8?q?=E6=8E=A5=E5=8F=A3sql-inject?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../main/java/io/dataease/ext/ExtSysUserMapper.xml   | 12 ++++++++++++
 core/frontend/src/views/system/user/index.vue        |  5 +----
 2 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/core/backend/src/main/java/io/dataease/ext/ExtSysUserMapper.xml b/core/backend/src/main/java/io/dataease/ext/ExtSysUserMapper.xml
index 7f873a23c6..85318db4f7 100644
--- a/core/backend/src/main/java/io/dataease/ext/ExtSysUserMapper.xml
+++ b/core/backend/src/main/java/io/dataease/ext/ExtSysUserMapper.xml
@@ -73,6 +73,18 @@
             </foreach>
         </if>
 
+        <choose>
+            <when test="orders!=null and orders.size > 0">
+                order by
+                <foreach collection="orders" item="item" open='' separator=',' close=''>
+                    ${item}
+                </foreach>
+            </when>
+            <otherwise>
+                order by u.update_time desc
+            </otherwise>
+        </choose>
+
 
     </select>
 
diff --git a/core/frontend/src/views/system/user/index.vue b/core/frontend/src/views/system/user/index.vue
index 7f146a1d68..8f50b25257 100644
--- a/core/frontend/src/views/system/user/index.vue
+++ b/core/frontend/src/views/system/user/index.vue
@@ -572,11 +572,8 @@ export default {
       })
     },
     search() {
-      /* const param = {
-        orders: formatOrders(this.orderConditions),
-        conditions: [...this.cacheCondition]
-      } */
       const param = buildParam(this.cacheCondition, this.nickName)
+      param.orders = formatOrders(this.orderConditions)
 
       const { currentPage, pageSize } = this.paginationConfig
       userLists(currentPage, pageSize, param).then((response) => {