修改权限通用查询过滤sql注入问题，导致动态页面无法保存，追加jsonArray判断

src/main/java/leaf/service/http/AbstractFacadeServlet.java

@@ -12,6 +12,7 @@ import leaf.events.E_ServiceFinish;
 import leaf.service.*;
 import leaf.transaction.ITransactionService;
 import leaf.transaction.UserTransactionImpl;
+import org.json.JSONArray;
 import org.json.JSONObject;
 import org.springframework.security.web.csrf.CsrfToken;
 import org.springframework.security.web.csrf.HttpSessionCsrfTokenRepository;
@@ -116,21 +117,24 @@ public abstract class AbstractFacadeServlet extends HttpServlet {
             if(it.getKey().equals("_request_data")&&!it.getValue()[0].isEmpty()){
                 JSONObject requestData = new JSONObject(it.getValue()[0]);
                 if(requestData.has("parameter")){
-                    JSONObject paraOject=requestData.getJSONObject("parameter");
-                    if (paraOject.has("trx_id")){
-                        String trx_id=paraOject.get("trx_id").toString().toLowerCase();
-                        if(trx_id.indexOf("and") != -1||
-                                trx_id.indexOf("or") != -1||
-                                trx_id.indexOf("=") != -1||
-                                trx_id.indexOf("select") != -1||
-                                trx_id.indexOf("union") != -1||
-                                trx_id.indexOf("<") != -1||
-                                trx_id.indexOf(">") != -1||
-                                trx_id.indexOf("+") != -1||
-                                trx_id.indexOf("-") != -1){
-                            throw new RuntimeException("parameter contain illegal value:" + trx_id);
+                    if(!(requestData.get("parameter") instanceof JSONArray)){
+                        JSONObject paraOject=requestData.getJSONObject("parameter");
+                        if (paraOject.has("trx_id")){
+                            String trx_id=paraOject.get("trx_id").toString().toLowerCase();
+                            if(trx_id.indexOf("and") != -1||
+                                    trx_id.indexOf("or") != -1||
+                                    trx_id.indexOf("=") != -1||
+                                    trx_id.indexOf("select") != -1||
+                                    trx_id.indexOf("union") != -1||
+                                    trx_id.indexOf("<") != -1||
+                                    trx_id.indexOf(">") != -1||
+                                    trx_id.indexOf("+") != -1||
+                                    trx_id.indexOf("-") != -1){
+                                throw new RuntimeException("parameter contain illegal value:" + trx_id);
+                            }
                         }
                     }
+
                 }