3535import java .util .Locale ;
3636import java .util .Map ;
3737import java .util .Set ;
38+ import java .util .stream .Stream ;
3839import javax .persistence .PersistenceException ;
40+ import lombok .RequiredArgsConstructor ;
3941import org .apache .commons .lang3 .BooleanUtils ;
4042import org .apache .commons .lang3 .ObjectUtils ;
4143import org .apache .commons .lang3 .StringUtils ;
7274import org .apache .fineract .useradministration .domain .AppUser ;
7375import org .slf4j .Logger ;
7476import org .slf4j .LoggerFactory ;
75- import org .springframework .beans .factory .annotation .Autowired ;
7677import org .springframework .dao .DataAccessException ;
7778import org .springframework .dao .DataIntegrityViolationException ;
7879import org .springframework .dao .EmptyResultDataAccessException ;
8687import org .springframework .transaction .annotation .Transactional ;
8788
8889@ Service
90+ @ RequiredArgsConstructor
8991public class ReadWriteNonCoreDataServiceImpl implements ReadWriteNonCoreDataService {
9092
9193 private static final String DATATABLE_NAME_REGEX_PATTERN = "^[a-zA-Z][a-zA-Z0-9\\ -_\\ s]{0,48}[a-zA-Z0-9]$" ;
@@ -110,7 +112,7 @@ public class ReadWriteNonCoreDataServiceImpl implements ReadWriteNonCoreDataServ
110112 private final DatabaseSpecificSQLGenerator sqlGenerator ;
111113 private final PlatformSecurityContext context ;
112114 private final FromJsonHelper fromJsonHelper ;
113- private final JsonParserHelper helper ;
115+ private final JsonParserHelper helper = new JsonParserHelper () ;
114116 private final GenericDataService genericDataService ;
115117 private final DatatableCommandFromApiJsonDeserializer fromApiJsonDeserializer ;
116118 private final ConfigurationDomainService configurationDomainService ;
@@ -120,29 +122,6 @@ public class ReadWriteNonCoreDataServiceImpl implements ReadWriteNonCoreDataServ
120122 private final NamedParameterJdbcTemplate namedParameterJdbcTemplate ;
121123 private final SqlInjectionPreventerService preventSqlInjectionService ;
122124
123- @ Autowired (required = true )
124- public ReadWriteNonCoreDataServiceImpl (final JdbcTemplate jdbcTemplate , final NamedParameterJdbcTemplate namedParameterJdbcTemplate ,
125- final PlatformSecurityContext context , final FromJsonHelper fromJsonHelper , final GenericDataService genericDataService ,
126- final DatatableCommandFromApiJsonDeserializer fromApiJsonDeserializer , final CodeReadPlatformService codeReadPlatformService ,
127- final ConfigurationDomainService configurationDomainService , final DataTableValidator dataTableValidator ,
128- final ColumnValidator columnValidator , DatabaseTypeResolver databaseTypeResolver , DatabaseSpecificSQLGenerator sqlGenerator ,
129- SqlInjectionPreventerService sqlInjectionPreventerService ) {
130- this .databaseTypeResolver = databaseTypeResolver ;
131- this .sqlGenerator = sqlGenerator ;
132- this .jdbcTemplate = jdbcTemplate ;
133- this .context = context ;
134- this .fromJsonHelper = fromJsonHelper ;
135- this .helper = new JsonParserHelper ();
136- this .genericDataService = genericDataService ;
137- this .fromApiJsonDeserializer = fromApiJsonDeserializer ;
138- this .codeReadPlatformService = codeReadPlatformService ;
139- this .configurationDomainService = configurationDomainService ;
140- this .dataTableValidator = dataTableValidator ;
141- this .columnValidator = columnValidator ;
142- this .namedParameterJdbcTemplate = namedParameterJdbcTemplate ;
143- this .preventSqlInjectionService = sqlInjectionPreventerService ;
144- }
145-
146125 @ Override
147126 public List <DatatableData > retrieveDatatableNames (final String appTable ) {
148127 Object [] params = new Object [] { this .context .authenticatedUser ().getId () };
@@ -306,14 +285,16 @@ private String getPermissionSql(final String dataTableName) {
306285 final String updatePermissionChecker = "'UPDATE_" + dataTableName + "_CHECKER'" ;
307286 final String deletePermission = "'DELETE_" + dataTableName + "'" ;
308287 final String deletePermissionChecker = "'DELETE_" + dataTableName + "_CHECKER'" ;
288+ final List <String > escapedColumns = Stream .of ("grouping" , "code" , "action_name" , "entity_name" , "can_maker_checker" )
289+ .map (sqlGenerator ::escape ).toList ();
290+ final String columns = String .join (", " , escapedColumns );
309291
310- return "insert into m_permission (grouping, code, action_name, entity_name, can_maker_checker) values " + "('datatable', "
311- + createPermission + ", 'CREATE', '" + dataTableName + "', true)," + "('datatable', " + createPermissionChecker
312- + ", 'CREATE', '" + dataTableName + "', false)," + "('datatable', " + readPermission + ", 'READ', '" + dataTableName
313- + "', false)," + "('datatable', " + updatePermission + ", 'UPDATE', '" + dataTableName + "', true)," + "('datatable', "
314- + updatePermissionChecker + ", 'UPDATE', '" + dataTableName + "', false)," + "('datatable', " + deletePermission
315- + ", 'DELETE', '" + dataTableName + "', true)," + "('datatable', " + deletePermissionChecker + ", 'DELETE', '"
316- + dataTableName + "', false)" ;
292+ return "insert into m_permission (" + columns + ") values " + "('datatable', " + createPermission + ", 'CREATE', '" + dataTableName
293+ + "', true)," + "('datatable', " + createPermissionChecker + ", 'CREATE', '" + dataTableName + "', false),"
294+ + "('datatable', " + readPermission + ", 'READ', '" + dataTableName + "', false)," + "('datatable', " + updatePermission
295+ + ", 'UPDATE', '" + dataTableName + "', true)," + "('datatable', " + updatePermissionChecker + ", 'UPDATE', '"
296+ + dataTableName + "', false)," + "('datatable', " + deletePermission + ", 'DELETE', '" + dataTableName + "', true),"
297+ + "('datatable', " + deletePermissionChecker + ", 'DELETE', '" + dataTableName + "', false)" ;
317298
318299 }
319300
@@ -918,7 +899,7 @@ private void deleteColumnCodeMapping(final List<String> columnNames) {
918899 * Name of data table
919900 * @param column
920901 * JSON encoded array of column properties
921- * @see https://mifosforge.jira.com/browse/MIFOSX-1145
902+ * @see <a href=" https://mifosforge.jira.com/browse/MIFOSX-1145">MIFOSX-1145</a>
922903 **/
923904 private void removeNullValuesFromStringColumn (final String datatableName , final JsonObject column ,
924905 final Map <String , ResultsetColumnHeaderData > mapColumnNameDefinition ) {
0 commit comments