tj

igirl-channel-web/app/base/controller/impl/trademark/tmqueryCtl.js

@@ -42,6 +42,13 @@ class tmqueryCtl extends CtlBase {
       if (!pobj.actionBody) {
         return system.getResult(null, "actionBody不能为空");
       }
+      if (pobj.requrl && pobj.requrl.indexOf('|') >= 0) {
+        return system.getResult(null, "非法请求！");
+      }
+      var tmpReqUrl = pobj.requrl.replace('|', '').replace(' ', '');
+      if (tmpReqUrl.length != pobj.requrl.length) {
+        return system.getResult(null, "非法请求！！");
+      }
       var reqobj = {
         "actionProcess": pobj.actionProcess || "",
         "actionType": pobj.actionType || "",
@@ -61,6 +68,7 @@ class tmqueryCtl extends CtlBase {
       var oldActionType = reqobj.actionType;
       var oldActionBody = reqobj.actionBody;
       var oldIsUser = reqobj.isUser;
+
       if (reqobj.isDecryptUser == "yes") {
         reqobj.actionType = "decryptStr";
         reqobj.isUser = "no";