code

service/report.class.php

@@ -84,9 +84,21 @@ class report {
             }
 
             if(!empty($_POST['party_id'])){
-                if($_POST['party_id'] != 'ALL'){
-                    $sqlWhere .= " and '".common::check_input($_POST['party_id'])."' = any(party_ids)";
+                $unique_arr = $_POST['party_id'];
+                //构建安全的数组字面量用于 PostgreSQL 的 && 交集判断
+                // 转义每个 ID 防注入
+                $escaped_ids = array();
+                foreach($unique_arr as $id){
+                    $id = trim($id);
+                    if (empty($id))
+                        continue;
+                    $escaped_ids[] =  "'" .common::check_input($id) . "'";
                 }
+                if(!empty($escaped_ids)){
+                    $partyIdsStr = 'ARRAY[' . implode(',', $escaped_ids) . ']';
+                    $sqlWhere .= " and party_ids && $partyIdsStr ";
+                }
+                //$sqlWhere .= " and '".common::check_input($_POST['party_id'])."' = any(party_ids)";
             }
             //这里不需要控制,能进来这个页面的帐号，都可以配置任何权限的模板的
             // if(strtolower(_getLoginName()) == "chud" ||strtolower(_getLoginName()) == "it.andywu" ){