fix(industry): 审计修复 — 4 CRITICAL + 5 HIGH 全部解决
Some checks failed
CI / Lint & TypeCheck (push) Has been cancelled
CI / Unit Tests (push) Has been cancelled
CI / Build Frontend (push) Has been cancelled
CI / Rust Check (push) Has been cancelled
CI / Security Scan (push) Has been cancelled
CI / E2E Tests (push) Has been cancelled
Some checks failed
CI / Lint & TypeCheck (push) Has been cancelled
CI / Unit Tests (push) Has been cancelled
CI / Build Frontend (push) Has been cancelled
CI / Rust Check (push) Has been cancelled
CI / Security Scan (push) Has been cancelled
CI / E2E Tests (push) Has been cancelled
C1: SaaS industry/service.rs SQL 注入风险 → 参数化查询 ($N 绑定) C2: INDUSTRY_CONFIGS 死链 → Kernel 共享 Arc 接通 ButlerRouter C3: IndustryListItem 缺 keywords_count → SQL 查询 + 类型补全 C4: set_account_industries 非事务性 → batch 验证 + 事务 DELETE+INSERT H8: Accounts.tsx mutate 竞态 → mutateAsync 顺序等待 H9: XML 注入未转义 → xml_escape() 辅助函数 H10: update_industry 覆盖 source → 保留原始值 H11: 面包屑缺少 /industries → 添加行业配置映射
This commit is contained in:
@@ -221,6 +221,7 @@ const breadcrumbMap: Record<string, string> = {
|
||||
'/knowledge': '知识库',
|
||||
'/billing': '计费管理',
|
||||
'/config': '系统配置',
|
||||
'/industries': '行业配置',
|
||||
'/prompts': '提示词管理',
|
||||
'/logs': '操作日志',
|
||||
'/config-sync': '同步日志',
|
||||
|
||||
@@ -188,7 +188,7 @@ export default function Accounts() {
|
||||
if (editingId) {
|
||||
// 更新基础信息
|
||||
const { industry_ids, ...accountData } = values
|
||||
updateMutation.mutate({ id: editingId, data: accountData })
|
||||
await updateMutation.mutateAsync({ id: editingId, data: accountData })
|
||||
|
||||
// 更新行业授权(如果变更了)
|
||||
const newIndustryIds: string[] = industry_ids || []
|
||||
@@ -254,7 +254,7 @@ export default function Accounts() {
|
||||
open={modalOpen}
|
||||
onOk={handleSave}
|
||||
onCancel={handleClose}
|
||||
confirmLoading={updateMutation.isPending}
|
||||
confirmLoading={updateMutation.isPending || setIndustriesMutation.isPending}
|
||||
width={560}
|
||||
>
|
||||
<Form form={form} layout="vertical" className="mt-4">
|
||||
|
||||
Reference in New Issue
Block a user