tj

igirl-channel-web/app/base/controller/impl/trademark/tmqueryCtl.js

@@ -42,6 +42,13 @@ class tmqueryCtl extends CtlBase {
       if (!pobj.actionBody) {
       if (!pobj.actionBody) {
         return system.getResult(null, "actionBody不能为空");
         return system.getResult(null, "actionBody不能为空");
       }
       }
+      if (pobj.requrl && pobj.requrl.indexOf('|') >= 0) {
+        return system.getResult(null, "非法请求！");
+      }
+      var tmpReqUrl = pobj.requrl.replace('|', '').replace(' ', '');
+      if (tmpReqUrl.length != pobj.requrl.length) {
+        return system.getResult(null, "非法请求！！");
+      }
       var reqobj = {
       var reqobj = {
         "actionProcess": pobj.actionProcess || "",
         "actionProcess": pobj.actionProcess || "",
         "actionType": pobj.actionType || "",
         "actionType": pobj.actionType || "",
@@ -61,6 +68,7 @@ class tmqueryCtl extends CtlBase {
       var oldActionType = reqobj.actionType;
       var oldActionType = reqobj.actionType;
       var oldActionBody = reqobj.actionBody;
       var oldActionBody = reqobj.actionBody;
       var oldIsUser = reqobj.isUser;
       var oldIsUser = reqobj.isUser;
+
       if (reqobj.isDecryptUser == "yes") {
       if (reqobj.isDecryptUser == "yes") {
         reqobj.actionType = "decryptStr";
         reqobj.actionType = "decryptStr";
         reqobj.isUser = "no";
         reqobj.isUser = "no";
@@ -571,7 +579,7 @@ class tmqueryCtl extends CtlBase {
       if (["FW_GOODS-582206-1", "FW_GOODS-582208-1", "FW_GOODS-582207-1"].indexOf(pushData.skuId) >= 0) {
       if (["FW_GOODS-582206-1", "FW_GOODS-582208-1", "FW_GOODS-582207-1"].indexOf(pushData.skuId) >= 0) {
         param.actionType = pushData.skuId == "FW_GOODS-582206-1" ? "updateOrderPayStatus" : "addOrderAndDelivery";
         param.actionType = pushData.skuId == "FW_GOODS-582206-1" ? "updateOrderPayStatus" : "addOrderAndDelivery";
       }//商标的产品订单
       }//商标的产品订单
-      else {        
+      else {
         param.actionBody.channelItemCode = pushData.serviceCode;
         param.actionBody.channelItemCode = pushData.serviceCode;
         param.actionType = "jdAddQifuOrder";
         param.actionType = "jdAddQifuOrder";
       }//工商产品订单
       }//工商产品订单