数据安全检测

 

--------------of_buildselectexpression-------------------------------

string  ls_value = '', ls_expression, ls_tmp, ls_column, ls_coltype
long ll_row, ll_rowcount

ll_rowcount = ids_cond.rowcount()
 
ls_column = adwc.describe(as_col + '.dbname')
if ls_column = '!' or ls_column = '?' or ls_column = '' then return '!'

ls_coltype = adwc.describe(as_col + '.coltype')
If ls_coltype='!' or ls_coltype='?' Then Return '!'
ls_coltype = Lower ( Left (ls_coltype, 5 ) )

ls_expression = ls_column + ' ' + as_opr + ' '

choose case as_opr
 case '= any'
  ls_expression = ''
 case 'is null', 'is not null'
  //do nothing
 case 'in', 'not in'
  if ll_rowcount < 2 then return '!'
  ls_value = "("
  for ll_row = 1 to ll_rowcount
   ls_tmp = ids_cond.getitemstring(ll_row, 'value')
   if len(trim(ls_tmp)) = 0 or isnull(ls_tmp) then return '!'
    Choose Case ls_coltype
     Case "char(", "char", "date", "datet", "time", "times"
      ls_value += "'" + ls_tmp + "', "
     Case  Else
      ls_value += ls_tmp + ", "
    end choose     
  next
  ls_value = left(ls_value, len(ls_value) - 2) + ')'
  ls_expression += ls_value
 case 'like', 'not like'
  if ll_rowcount <> 1 then return '!'
   ls_tmp = ids_cond.getitemstring(1, 'value')
   if len(trim(ls_tmp)) = 0 or isnull(ls_tmp) then return '!' 
    Choose Case ls_coltype
     Case "char(", "char"   
      ls_expression += "'%" + ls_tmp + "%'"
     case else
      ls_expression = '!'
    end choose    
 case else
  if ll_rowcount <> 1 then return '!'
   ls_tmp = ids_cond.getitemstring(1, 'value')
   if len(trim(ls_tmp)) = 0 or isnull(ls_tmp) then return '!' 
    Choose Case ls_coltype
     Case "char(", "char", "date", "datet", "time", "times"   
      ls_expression += "'" + ls_tmp + "'"
     case else
      ls_expression += ls_tmp
    end choose           
end choose

return ls_expression

------------------------of_buildselectexpression------------------------------

 

string  ls_value = '', ls_expression, ls_tmp, ls_column, ls_coltype
long ll_row, ll_rowcount

ll_rowcount = ids_cond.rowcount()
 
ls_column = adw.describe(as_col + '.dbname')
if ls_column = '!' or ls_column = '?' or ls_column = '' then return '!'

ls_coltype = adw.describe(as_col + '.coltype')
If ls_coltype='!' or ls_coltype='?' Then Return '!'
ls_coltype = Lower ( Left (ls_coltype, 5 ) )

ls_expression = ls_column + ' ' + as_opr + ' '

choose case as_opr
 case '= any'
  ls_expression = ''
 case 'is null', 'is not null'
  ls_expression += ls_column + ' ' + as_opr
 case 'in', 'not in'
  if ll_rowcount < 2 then return '!'
  ls_value = "("
  for ll_row = 1 to ll_rowcount
   ls_tmp = ids_cond.getitemstring(ll_row, 'value')
   if len(trim(ls_tmp)) = 0 or isnull(ls_tmp) then return '!'
    Choose Case ls_coltype
     Case "char(", "char", "date", "datet", "time", "times"
      ls_value += "'" + ls_tmp + "', "
               Case  Else
//weng
//old     ls_value += "'" + ls_tmp + ", "
          ls_value += ls_tmp + ", "
//weng      
     end choose     
     next
  ls_value = left(ls_value, len(ls_value) - 2) + ')'
  ls_expression += ls_value
 case 'like', 'not like'
  if ll_rowcount <> 1 then return '!'
   ls_tmp = ids_cond.getitemstring(1, 'value')
   if len(trim(ls_tmp)) = 0 or isnull(ls_tmp) then return '!' 
    Choose Case ls_coltype
     Case "char(", "char"   
      ls_expression += "'%" + ls_tmp + "%'"
     case else
      ls_expression = '!'
    end choose    
 case else
  if ll_rowcount <> 1 then return '!'
   ls_tmp = ids_cond.getitemstring(1, 'value')
   if len(trim(ls_tmp)) = 0 or isnull(ls_tmp) then return '!' 
    Choose Case ls_coltype
     Case "char(", "char", "date", "datet", "time", "times"   
      ls_expression += "'" + ls_tmp + "'"
     case else
      ls_expression += ls_tmp
    end choose           
end choose

return ls_expression

--------------------of_buildselectimpossible---------------------------------------

string ls_column

If Len(Trim(as_col))=0 or IsNull(as_col) Then Return '!'
ls_column = adw.describe(ls_column + '.dbname')
if ls_column = '!' or ls_column = '?' or ls_column = '' then return '!'

return ls_column + ' is null and ' + ls_column + ' is not null '

 

-----------------------------of_buildselectimpossible--------------------------------------

string ls_column

If Len(Trim(as_col))=0 or IsNull(as_col) Then Return '!'
ls_column = adwc.describe(as_col + '.dbname')
if ls_column = '!' or ls_column = '?' or ls_column = '' then return '!'

return ls_column + ' is null and ' + ls_column + ' is not null '

---------------------------of_findcontrolcolumn-----------------------------------------

string ls_r
long ll_row

if isnull(as_dw) or len(trim(as_dw)) = 0 then return '!'
if not isvalid(ids_template) then return '!'

if ids_template.rowcount() < 1 then return '!'

ll_row = ids_template.find('datawindow = "' + as_dw + '"', 1, ids_template.rowcount())

if ll_row <= 0 then return '!'

ls_r = ids_template.getitemstring(ll_row, 'columnname')

if isnull(ls_r) or trim(ls_r) = '' then return '!'

return ls_r
-----------------------------of_finddw----------------------------------------------------

long ll_row

if isnull(as_dw) or len(trim(as_dw)) = 0 then return false

if not isvalid(ids_template) then return false

if ids_template.rowcount() < 1 then return false

ll_row = ids_template.find('datawindow = "' + as_dw + '"', 1, ids_template.rowcount())

if ll_row <= 0 then return false

return true

--------------------------------of_protect-------------------------------

string ls_cols[], ls_modify, ls_tmp
long ll_column, ll_tmp

of_getobjects(ls_cols, 'column', '*', false)
ll_column = upperbound(ls_cols)

for ll_tmp = 1 to ll_column
 ls_modify = ls_cols[ll_tmp] + ".Protect=1"
 ls_tmp = idw_requestor.describe(ls_cols[ll_tmp] + ".band")
 if ls_tmp <> '?' then
  ls_modify = idw_requestor.modify(ls_modify)
  if ls_modify <> '' then return FAILURE
 end if
next

return SUCCESS

-----------------------------------of_register-----------------------------

string ls_dw, ls_col, ls_opr, ls_user
integer li_rc
application app

app = GetApplication()
is_app = app.appname
is_user = as_user
ls_dw = idw_requestor.dataobject

idw_requestor.settransobject(atr)
itr = atr

if isnull(atr) or not isvalid(atr) then return FAILURE
if isnull(is_app) or isnull(as_user) or isnull(ls_dw) or trim(is_user) = '' then return FAILURE

//初始化数据窗口
ids_info = create n_ds
ids_info.dataobject = 'd_datasecurity_info'
ids_info.settransobject(atr)

ids_cond = create n_ds
ids_cond.dataobject = 'd_datasecurity_condition'
ids_cond.settransobject(atr)

ids_template = create n_ds
ids_template.dataobject = 'd_datasecurity_template'
ids_template.settransobject(atr)

//取出模板
if ids_template.retrieve(is_app) < 0 then return FAILURE

//如果在安全模板中就处理，否则就处理CHILDDATAWINDOW，然后返回，对本窗口不作任何控制
if not of_finddw(ls_dw) then
 is_act = ''
 return of_securechild()
end if

//取出控制列
ls_col= of_findcontrolcolumn(ls_dw)

//取控制列出错
if ls_col= '!' then
 return FAILURE
end if

//模板中有，信息中没有，认为不可见，则只需将is_act置为'不可见'，DATAWINDOW也不可见
if ids_info.retrieve(is_app, ls_dw, is_user) < 0 then return FAILURE

if ids_info.rowcount() = 0 then
 is_act = '不可见'
else //取出用户信息
 is_act = trim(ids_info.getitemstring(1, 'allowedaction'))
 ls_opr = trim(ids_info.getitemstring(1, 'operator'))
 ls_user = trim(ids_info.getitemstring(1, 'username'))
 if isnull(ls_user) or len(trim(ls_user) ) = 0 then return FAILURE
 if isnull(ls_col) or isnull(is_act) or trim(ls_opr) = '' or trim(is_act) = '' then return FAILURE
end if

//明确不可见
if is_act = '不可见' then
 if of_setinvisible(idw_requestor, ls_col) = FAILURE then return FAILURE
 if of_protect() = FAILURE then return FAILURE
 return SUCCESS
end if

//如果是可见先保护再说
if is_act = '可见' then
 if of_protect() = FAILURE then return FAILURE
end if

//再往下就只有'可见'和'可改'了, 不论'可见'或'可改', 均应先改sql
//先把条件取出来
if ids_cond.retrieve(is_app, ls_dw, ls_user, ls_col) < 0 then return FAILURE

//在本函数中处理中DATAWINDOW，如果成功则继续处理CHILDDATAWINDOW
li_rc = of_beforeretrieve(idw_requestor, ls_col, ls_opr)
if li_rc = FAILURE then return FAILURE

li_rc = of_securechild()
return li_rc

--------------------------------------------of_securechild--------------------------------

//以下处理CHILDDATAWINDOW
string ls_cols[], ls_dddw, ls_act, ls_opr, ls_col, ls_user
long ll_column, ll_tmp
integer li_rc
datawindowchild ldwc

of_getobjects(ls_cols, 'column', '*', false)
ll_column = upperbound(ls_cols)

for ll_tmp = 1 to ll_column
 //先判断是否DDDW
 ls_dddw = idw_requestor.describe(ls_cols[ll_tmp] + ".dddw.name")
 if ls_dddw = '!' or ls_dddw = '?' or ls_dddw = '' then continue
 //是否在模板中
 if not of_finddw(ls_dddw) then continue 
 //取出列名信息
 ls_col = of_findcontrolcolumn(ls_dddw)
 if ls_col = '!' then return FAILURE
 //如果在模板中，应该能取出来
 if idw_requestor.getchild(ls_cols[ll_tmp], ldwc) = -1 then return FAILURE
 //SETTRANSOBJECT
 if ldwc.settransobject(itr) = -1 then return FAILURE
 //取出用户信息
 if ids_info.retrieve(is_app, ls_dddw, is_user) < 0 then return FAILURE

 if ids_info.rowcount() = 0 then
  ls_act = '不可见'
 else //取出用户信息
  ls_act = trim(ids_info.getitemstring(1, 'allowedaction'))
  ls_opr = trim(ids_info.getitemstring(1, 'operator'))
  ls_user = trim(ids_info.getitemstring(1, 'username'))
  if isnull(ls_col) or isnull(ls_act) or trim(ls_opr) = '' or trim(ls_act) = '' then return FAILURE
 end if

 //明确不可见
 if ls_act = '不可见' then
  if of_setinvisible(ldwc, ls_col) = FAILURE then return FAILURE
  continue
 end if
 if ids_cond.retrieve(is_app, ls_dddw, ls_user, ls_col) < 0 then return FAILURE
 if of_securechild(ldwc, ls_col, ls_opr) = FAILURE then return FAILURE
next

return SUCCESS
//结束

 

 

-----------------------------------------------of_securechild----------------------------------

string ls_select, ls_expression, ls_colexp, ls_oldfilter
long ll_row

//先构造过滤用的EXPRESSION
ls_expression = of_builddwexpression(adwc, as_col, as_opr)

if ls_expression = '!' then
 return FAILURE
else
 ls_oldfilter = adwc.describe('datawindow.table.filter') 
 if not (isnull(ls_oldfilter) or ls_oldfilter = '' or ls_oldfilter = '?' or ls_oldfilter = '!') then
  ls_expression = '(' + ls_oldfilter + ') and (' + ls_expression + ')'
 end if 
 if adwc.setfilter(ls_expression) <> 1 then 
  return FAILURE
 else
  adwc.filter()
  is_filter = ls_expression
 end if
end if

//对于可取到SQL并且非数据窗口计算字段的，还要修改SQL，修改成功当然好，不成功也没有关系因为FILTER成功了
ls_select = adwc.describe('datawindow.table.select')
ls_colexp = adwc.describe(as_col + '.expression')
if ls_select <> '!' and ls_select <> '?' and ls_select <> '' and ls_colexp = '!' then //可以修改select
 ls_expression = of_buildselectexpression(adwc, as_col, as_opr)
 if ls_expression <> '!' and ls_expression <> '' then
  ls_select = lower(ls_select)
  if pos(ls_select, 'where') > 0 then
   ls_select = ls_select + ' and ' + ls_expression
  else
   ls_select = ls_select + ' where ' + ls_expression
  end if
 end if
// if of_testsqlselect() then
  if adwc.modify('datawindow.table.select="' + ls_select + '"') <> '' then return FAILURE
// end if
 
end if

return SUCCESS
----------------------------------------of_setinvisible-----------------------------------------------------

string ls_expression, ls_select, ls_colexp

if isnull(as_col) or trim(as_col) = '' then return FAILURE
if not isvalid(adw) then return FAILURE

ls_expression = 'isnull(' + as_col + ') and not isnull(' +as_col + ')'

if adw.setfilter(ls_expression) <> 1 then
 return FAILURE
else
 adw.filter()
end if

//处理SQL，对于可取到SQL并且非数据窗口计算字段的，还要修改SQL，修改成功当然好，不成功也没有关系因为FILTER成功了
ls_select = adw.describe('datawindow.table.select')
ls_colexp = adw.describe(as_col + '.expression')
if ls_select <> '!' and ls_select <> '?' and ls_select <> '' and ls_colexp = '!' then //可以修改select
 ls_expression = of_buildselectimpossible(adw, as_col)

 ls_select = lower(ls_select)
 if pos(ls_select, 'where') > 0 then
  ls_expression = ls_select + ' and ' + ls_expression
 else
  ls_expression = ls_select + ' where ' + ls_expression
 end if
 
 adw.modify('datawindow.table.select="' + ls_expression + '"')
end if

return SUCCESS

-------------------------------------of_setinvisible-----------------------------------

string ls_expression, ls_select, ls_colexp

if isnull(as_col) or trim(as_col) = '' then return FAILURE
if not isvalid(adwc) then return FAILURE

ls_expression = 'isnull(' + as_col + ') and not isnull(' +as_col + ')'

if adwc.setfilter(ls_expression) <> 1 then
 return FAILURE
else
 adwc.filter()
end if

//处理SQL，对于可取到SQL并且非数据窗口计算字段的，还要修改SQL，修改成功当然好，不成功也没有关系因为FILTER成功了
ls_select = adwc.describe('datawindow.table.select')
ls_colexp = adwc.describe(as_col + '.expression')
if ls_select <> '!' and ls_select <> '?' and ls_select <> '' and (ls_colexp = '!' or ls_colexp = '?') then //可以修改select
 ls_expression = of_buildselectimpossible(adwc, as_col)

 ls_select = lower(ls_select)
 if pos(ls_select, 'where') > 0 then
  ls_expression = ls_select + ' and ' + ls_expression
 else
  ls_expression = ls_select + ' where ' + ls_expression
 end if 
 adwc.modify('datawindow.table.select="' + ls_expression + '"')
end if

return SUCCESS