4040import apijson .orm .exception .CommonException ;
4141
4242import static apijson .JSONObject .KEY_EXPLAIN ;
43+ import static apijson .RequestMethod .CRUD ;
4344import static apijson .RequestMethod .GET ;
4445
4546/**parser for parsing request to JSONObject
@@ -2096,44 +2097,36 @@ private JSONObject batchVerify(RequestMethod method, String tag, int version, St
20962097 try {
20972098 if (key .startsWith ("@" )) {
20982099 try {
2099- // 如果不匹配,不处理即可
2100+ // 如果不匹配,异常不处理即可
21002101 RequestMethod l_method = RequestMethod .valueOf (key .substring (1 ).toUpperCase ());
2101- if (l_method != null ) {
2102- if (request .get (key ) instanceof JSONArray ) {
2103- for (Object objKey : request .getJSONArray (key )) {
2104- key_method_Map .put (objKey , l_method );
2105- }
2106- continue ;
2107- } else {
2108- throw new IllegalArgumentException ("参数 " + key + " 必须是数组格式 ! ,例如: [\" Moment\" , \" Comment[]\" ]" );
2109- }
2102+ for (String objKey : StringUtil .split (request .getString (key ))) {
2103+ key_method_Map .put (objKey , l_method );
21102104 }
21112105 } catch (Exception e ) {
21122106 }
21132107 }
21142108
2115- // 如果对象设置了@method, 优先使用 对象内部的@method
2116- // 对于没有显式声明操作方法的,直接用 URL(/get, /post 等) 对应的默认操作方法
2109+ //
2110+ // 1、非crud,对于没有显式声明操作方法的,直接用 URL(/get, /post 等) 对应的默认操作方法
2111+ // 2、crud, 没有声明就用 GET
2112+ // 3、兼容 sql@ JSONObject,设置 GET方法
21172113 // 将method 设置到每个object, op执行会解析
21182114 if (request .get (key ) instanceof JSONObject ) {
2119- if (request .getJSONObject (key ).getString (apijson .JSONObject .KEY_METHOD ) == null ) {
2120- if (key_method_Map .get (key ) == null ) {
2121- // 数组会解析为对象进行校验,做一下兼容
2122- if (key_method_Map .get (key + apijson .JSONObject .KEY_ARRAY ) == null ) {
2115+ if (key_method_Map .get (key ) == null ) {
2116+ // 数组会解析为对象进行校验,做一下兼容
2117+ if (key_method_Map .get (key + apijson .JSONObject .KEY_ARRAY ) == null ) {
2118+ if (method == RequestMethod .CRUD || (key .endsWith ("@" ) && request .get (key ) instanceof JSONObject )) {
2119+ request .getJSONObject (key ).put (apijson .JSONObject .KEY_METHOD , GET );
2120+ key_method_Map .put (key , GET );
2121+ } else {
21232122 request .getJSONObject (key ).put (apijson .JSONObject .KEY_METHOD , method );
2124- }else {
2125- request .getJSONObject (key ).put (apijson .JSONObject .KEY_METHOD , key_method_Map .get (key + apijson .JSONObject .KEY_ARRAY ));
2123+ key_method_Map .put (key , method );
21262124 }
21272125 } else {
2128- request .getJSONObject (key ).put (apijson .JSONObject .KEY_METHOD , key_method_Map .get (key ));
2126+ request .getJSONObject (key ).put (apijson .JSONObject .KEY_METHOD , key_method_Map .get (key + apijson . JSONObject . KEY_ARRAY ));
21292127 }
2130- }
2131-
2132- // get请求不校验
2133- RequestMethod _method = RequestMethod .valueOf (request .getJSONObject (key ).getString (apijson .JSONObject .KEY_METHOD ).toUpperCase ());
2134- if (RequestMethod .isPublicMethod (_method )) {
2135- jsonObject .put (key , request .getJSONObject (key ));
2136- continue ;
2128+ } else {
2129+ request .getJSONObject (key ).put (apijson .JSONObject .KEY_METHOD , key_method_Map .get (key ));
21372130 }
21382131 }
21392132
@@ -2149,12 +2142,29 @@ private JSONObject batchVerify(RequestMethod method, String tag, int version, St
21492142 _method = RequestMethod .valueOf (request .getJSONObject (key ).getString (apijson .JSONObject .KEY_METHOD ).toUpperCase ());
21502143 } else {
21512144 if (key_method_Map .get (key ) == null ) {
2152- _method = method ;
2145+ if (method == RequestMethod .CRUD ) {
2146+ _method = GET ;
2147+ key_method_Map .put (key , GET );
2148+ } else {
2149+ _method = method ;
2150+ key_method_Map .put (key , method );
2151+ }
21532152 } else {
21542153 _method = key_method_Map .get (key );
21552154 }
21562155 }
21572156
2157+ // 非 CRUD 方法,都只能和 URL method 完全一致,避免意料之外的安全风险。
2158+ if (method != RequestMethod .CRUD && _method != method ) {
2159+ throw new IllegalArgumentException ("不支持在 " + method + " 中 " + _method + " !" );
2160+ }
2161+
2162+ // get请求不校验
2163+ if (RequestMethod .isPublicMethod (_method )) {
2164+ jsonObject .put (key , request .get (key ));
2165+ continue ;
2166+ }
2167+
21582168 String _tag = buildTag (request , key );
21592169 JSONObject requestItem = new JSONObject ();
21602170 requestItem .put (_tag , request .get (key ));
@@ -2213,4 +2223,17 @@ protected JSONObject objectVerify(RequestMethod method, String tag, int version,
22132223 // JSONObject clone 浅拷贝没用,Structure.parse 会导致 structure 里面被清空,第二次从缓存里取到的就是 {}
22142224 return getVerifier ().verifyRequest (method , name , target , request , maxUpdateCount , getGlobalDatabase (), getGlobalSchema (), creator );
22152225 }
2226+
2227+ /***
2228+ * 兼容url crud, 获取真实method
2229+ * @param method = crud
2230+ * @param key
2231+ * @return
2232+ */
2233+ public RequestMethod getRealMethod (RequestMethod method , String key , Object value ) {
2234+ if (method == CRUD && (value instanceof JSONObject || value instanceof JSONArray )) {
2235+ return this .key_method_Map .get (key );
2236+ }
2237+ return method ;
2238+ }
22162239}
0 commit comments