fix：二级等保【高危】接口权限越权

elevator-admin/src/main/java/com/inspur/idm/media/controller/ElevatorInfoController.java

@@ -18,6 +18,7 @@ import com.inspur.idm.platform.aop.ControllerLog;
 import com.inspur.idm.platform.comm.BaseObj;
 import com.inspur.idm.platform.comm.BasePageListObj;
 import com.inspur.idm.platform.comm.CodeException;
+import com.inspur.idm.platform.utils.UserUtils;
 import com.inspur.idm.platform.validator.GroupAdd;
 import com.inspur.idm.platform.validator.GroupUpdate;
 import com.inspur.idm.sys.service.PubConfigService;
@@ -118,7 +119,14 @@ public class ElevatorInfoController {
     @GetMapping("ElevatorDashboard/{elevatorId}")
     @PreAuthorize("hasPermission('ElevatorInfo','detail')")
     public ElevatorDashboardVO getElevatorDashboardById(@PathVariable String elevatorId) {
-        ElevatorInfoVO vo = ElevatorInfoService.getElevatorInfoById(elevatorId);
+        String limitUser = null;
+        final String currentUserId = UserUtils.getCurrentUserId();
+        if (MyUserUtil.isSuperAdmin(currentUserId)) {
+            //超级管理员 拥有所有数据权限
+        }else{
+            limitUser = currentUserId;
+        }
+        ElevatorInfoVO vo = ElevatorInfoService.getElevatorInfoByIdAndLimitUser(elevatorId,limitUser);
         if (vo == null) {
             throw new CodeException(NOT_EXISTS_ERROR);
         }

elevator-admin/src/main/java/com/inspur/idm/media/dao/EleBuildingEquipmentDao.java

@@ -5,6 +5,7 @@ import com.inspur.idm.media.po.estate.EleBuildingEquipment;
 import com.inspur.idm.media.po.estate.EleEstate;
 import com.inspur.idm.media.vo.estate.EleBuildingEquipmentQuery;
 import com.inspur.idm.media.vo.estate.EleBuildingEquipmentVO;
+import org.apache.ibatis.annotations.Param;
 
 import java.util.List;
 
@@ -15,7 +16,7 @@ public interface EleBuildingEquipmentDao {
 
     int insertSelective(EleBuildingEquipment record);
 
-    EleBuildingEquipment selectByPrimaryKey(String equipmentId);
+    EleBuildingEquipment selectByPrimaryKey(@Param("equipmentId") String equipmentId, @Param("limitCompany") String limitCompany);
 
     int updateByPrimaryKeySelective(EleBuildingEquipment record);
 
@@ -26,4 +27,4 @@ public interface EleBuildingEquipmentDao {
     void updateBuildingName(EleBuilding po);
 
     void updateEstateName(EleEstate po);
-}
+}

elevator-admin/src/main/java/com/inspur/idm/media/dao/EleFittingsPriceDao.java

@@ -3,6 +3,7 @@ package com.inspur.idm.media.dao;
 import com.inspur.idm.media.po.fittings.EleFittingsPrice;
 import com.inspur.idm.media.vo.fittings.EleFittingsPriceQuery;
 import com.inspur.idm.media.vo.fittings.EleFittingsPriceVO;
+import org.apache.ibatis.annotations.Param;
 
 import java.util.List;
 
@@ -20,4 +21,6 @@ public interface EleFittingsPriceDao {
     int updateByPrimaryKey(EleFittingsPrice record);
 
     List<EleFittingsPriceVO> selectByQuery(EleFittingsPriceQuery query);
-}
+
+    EleFittingsPrice selectByPrimaryKeyV2(@Param("fittingsPriceId") String fittingsPriceId, @Param("limitCompany") String limitCompany);
+}

elevator-admin/src/main/java/com/inspur/idm/media/dao/EleInfoBasicDao.java

@@ -27,4 +27,6 @@ public interface EleInfoBasicDao {
     Long selectMaxIdByCityId(String cityId);
 
     List<String> getEleIdsByCC(@Param("limitUser") String limitUser);
-}
+
+    List<String> selectUserElevatorIds(@Param("limitUser") String limitUser);
+}

elevator-admin/src/main/java/com/inspur/idm/media/dao/fault/FaultInsureDao.java

@@ -4,6 +4,7 @@ import com.inspur.idm.media.vo.fault.FaultInsureTypeVO;
 import com.inspur.idm.media.po.fault.FaultInsure;
 import com.inspur.idm.media.vo.fault.FaultInsureQuery;
 import org.apache.ibatis.annotations.Param;
+import org.springframework.security.core.parameters.P;
 
 import java.util.List;
 
@@ -14,7 +15,7 @@ public interface FaultInsureDao {
 
     int insertSelective(FaultInsure record);
 
-    FaultInsure selectByPrimaryKey(String insureId);
+    FaultInsure selectByPrimaryKey(@Param("insureId") String insureId, @Param("query") FaultInsureQuery query);
 
     int updateByPrimaryKeySelective(FaultInsure record);
 
@@ -27,4 +28,4 @@ public interface FaultInsureDao {
     Integer getTimeOutEleCount(@Param("elevatorId") String elevatorId,@Param("limitUser") String limitUser);
 
     int getWillExpireInAWeek();
-}
+}

elevator-admin/src/main/java/com/inspur/idm/media/service/EleBuildingEquipmentServiceImpl.java

@@ -7,9 +7,11 @@ import com.inspur.idm.media.dao.EleEstateDao;
 import com.inspur.idm.media.po.estate.EleBuilding;
 import com.inspur.idm.media.po.estate.EleBuildingEquipment;
 import com.inspur.idm.media.po.estate.EleEstate;
+import com.inspur.idm.media.util.MyUserUtil;
 import com.inspur.idm.media.vo.estate.EleBuildingEquipmentDTO;
 import com.inspur.idm.media.vo.estate.EleBuildingEquipmentQuery;
 import com.inspur.idm.media.vo.estate.EleBuildingEquipmentVO;
+import com.inspur.idm.media.vo.estate.EleEstateQuery;
 import com.inspur.idm.platform.utils.UUIDUtil;
 import org.apache.commons.lang3.StringUtils;
 import org.springframework.beans.BeanUtils;
@@ -41,7 +43,9 @@ public class EleBuildingEquipmentServiceImpl implements EleBuildingEquipmentServ
 
     @Override
     public EleBuildingEquipmentVO getEleBuildingEquipmentById(String equipmentId) {
-        EleBuildingEquipment po = EleBuildingEquipmentDao.selectByPrimaryKey(equipmentId);
+        EleBuildingEquipmentQuery query = new EleBuildingEquipmentQuery();
+        MyUserUtil.addDataAuth(query);
+        EleBuildingEquipment po = EleBuildingEquipmentDao.selectByPrimaryKey(equipmentId,query.getLimitCompany());
         if (po == null) {
             return null;
         }

elevator-admin/src/main/java/com/inspur/idm/media/service/EleFittingsPriceServiceImpl.java

@@ -12,6 +12,7 @@ import com.inspur.idm.media.po.fault.FaultRepairInfo;
 import com.inspur.idm.media.po.fittings.EleFittingsPrice;
 import com.inspur.idm.media.po.part.ElePartType;
 import com.inspur.idm.media.util.MyUserUtil;
+import com.inspur.idm.media.vo.estate.EleBuildingEquipmentQuery;
 import com.inspur.idm.media.vo.fittings.EleFittingsPriceDTO;
 import com.inspur.idm.media.vo.fittings.EleFittingsPriceQuery;
 import com.inspur.idm.media.vo.fittings.EleFittingsPriceVO;
@@ -63,7 +64,10 @@ public class EleFittingsPriceServiceImpl implements EleFittingsPriceService {
 
     @Override
     public EleFittingsPriceVO getEleFittingsPriceById(String fittingsPriceId) {
-        EleFittingsPrice po = eleFittingsPriceDao.selectByPrimaryKey(fittingsPriceId);
+        // EleFittingsPrice po = eleFittingsPriceDao.selectByPrimaryKey(fittingsPriceId);
+        EleFittingsPriceQuery query = new EleFittingsPriceQuery();
+        MyUserUtil.addDataAuth(query);
+        EleFittingsPrice po = eleFittingsPriceDao.selectByPrimaryKeyV2(fittingsPriceId,query.getLimitCompany());
         if(po == null){
             return null;
         }

elevator-admin/src/main/java/com/inspur/idm/media/service/ElevatorInfoService.java

@@ -70,4 +70,6 @@ public interface ElevatorInfoService {
      * @return
      */
     boolean inElevatorScope(String position, String elevatorId);
+
+    ElevatorInfoVO getElevatorInfoByIdAndLimitUser(String elevatorId, String limitUser);
 }

elevator-admin/src/main/java/com/inspur/idm/media/service/ElevatorInfoServiceImpl.java

@@ -135,6 +135,28 @@ public class ElevatorInfoServiceImpl implements ElevatorInfoService {
         return getElevatorInfoById(elevatorId, true);
     }
 
+    @Override
+    public ElevatorInfoVO getElevatorInfoByIdAndLimitUser(String elevatorId, String limitUser) {
+        if (StringUtils.isBlank(limitUser)) {
+            return getElevatorInfoById(elevatorId, true);
+        }
+        // 验证当前用户是否有电梯权限
+        if (!isElevatorUser(limitUser, elevatorId)) {
+            return null;
+        }else {
+            return getElevatorInfoById(elevatorId, true);
+        }
+    }
+
+    private boolean isElevatorUser(String limitUser, String elevatorId) {
+        List<String> userElevatorIds = eleInfoBasicDao.selectUserElevatorIds(limitUser);
+        if (CollectionUtils.isEmpty(userElevatorIds)) {
+            return false;
+        }else {
+            return userElevatorIds.contains(elevatorId);
+        }
+    }
+
     public ElevatorInfoVO getElevatorInfoById(String elevatorId, boolean formatName) {
         ElevatorInfo po = ElevatorInfoDao.selectByPrimaryKey(elevatorId);
         if(po == null){

elevator-admin/src/main/java/com/inspur/idm/media/service/fault/FaultInsureServiceImpl.java

@@ -2,10 +2,12 @@ package com.inspur.idm.media.service.fault;
 
 import com.github.pagehelper.Page;
 import com.github.pagehelper.PageHelper;
+import com.inspur.idm.media.comm.CommConstant;
 import com.inspur.idm.media.dao.EleCompanyDao;
 import com.inspur.idm.media.dao.fault.FaultInsureDao;
 import com.inspur.idm.media.po.fault.FaultInsure;
 import com.inspur.idm.media.service.FormatNameService;
+import com.inspur.idm.media.util.MyUserUtil;
 import com.inspur.idm.media.vo.fault.FaultInsureDTO;
 import com.inspur.idm.media.dao.fault.FaultInsureElevatorDao;
 import com.inspur.idm.media.dao.fault.FaultInsureTypeDao;
@@ -13,6 +15,7 @@ import com.inspur.idm.media.po.company.EleCompany;
 import com.inspur.idm.media.po.fault.FaultInsureType;
 import com.inspur.idm.media.vo.fault.FaultInsureQuery;
 import com.inspur.idm.media.vo.fault.FaultInsureVO;
+import com.inspur.idm.media.vo.fittings.EleFittingsPriceQuery;
 import com.inspur.idm.platform.utils.UUIDUtil;
 import com.inspur.idm.sys.dao.NewAuthUserDao;
 import com.inspur.idm.sys.po.AuthUser;
@@ -57,7 +60,24 @@ public class FaultInsureServiceImpl implements FaultInsureService {
 
     @Override
     public FaultInsureVO getFaultInsureById(String insureId) {
-        FaultInsure po = faultInsureDao.selectByPrimaryKey(insureId);
+
+        FaultInsureQuery query = new FaultInsureQuery();
+        if (!MyUserUtil.isSuperAdmin()) {
+            String companyType = MyUserUtil.getCompanyType();
+            String companyId = MyUserUtil.getCompanyId();
+            if (StringUtils.equals(companyType, CommConstant.COMPANY_TYPE_ESTATE)) {
+                query.setEstateCompanyId(companyId);
+            } else if (StringUtils.equals(companyType, CommConstant.COMPANY_TYPE_INSURE)) {
+                query.setInsureCompanyId(companyId);
+            } else if (StringUtils.equals(companyType, CommConstant.COMPANY_TYPE_MAINTEN)) {
+                query.setMaintenCompanyId(companyId);
+            } else {
+                // 非以上三种单位的，是否直接查不到数据得确认下
+                query.setEstateCompanyId("none");
+            }
+        }
+
+        FaultInsure po = faultInsureDao.selectByPrimaryKey(insureId,query);
         if(po == null){
             return null;
         }

elevator-admin/src/main/resources/mapper/media/EleBuildingEquipmentDao.xml

@@ -16,27 +16,30 @@
     <result column="create_company" jdbcType="VARCHAR" property="createCompany" />
   </resultMap>
   <sql id="Base_Column_List">
-    equipment_id, building_id, building_name, create_time, data_status, equipment_ip, 
+    equipment_id, building_id, building_name, create_time, data_status, equipment_ip,
     equipment_no, estate_id, estate_name, manufacturer, software_version, create_company
   </sql>
   <select id="selectByPrimaryKey" parameterType="java.lang.String" resultMap="BaseResultMap">
-    select 
+    select
     <include refid="Base_Column_List" />
     from `ele_building_equipment`
     where equipment_id = #{equipmentId,jdbcType=VARCHAR}
+    <if test="limitCompany!= null">
+      and create_company = #{limitCompany}
+    </if>
   </select>
   <delete id="deleteByPrimaryKey" parameterType="java.lang.String">
     delete from `ele_building_equipment`
     where equipment_id = #{equipmentId,jdbcType=VARCHAR}
   </delete>
   <insert id="insert" parameterType="com.inspur.idm.media.po.estate.EleBuildingEquipment">
-    insert into `ele_building_equipment` (equipment_id, building_id, building_name, 
-      create_time, data_status, equipment_ip, 
-      equipment_no, estate_id, estate_name, 
+    insert into `ele_building_equipment` (equipment_id, building_id, building_name,
+      create_time, data_status, equipment_ip,
+      equipment_no, estate_id, estate_name,
       manufacturer, software_version)
-    values (#{equipmentId,jdbcType=VARCHAR}, #{buildingId,jdbcType=VARCHAR}, #{buildingName,jdbcType=VARCHAR}, 
-      #{createTime,jdbcType=TIMESTAMP}, #{dataStatus,jdbcType=INTEGER}, #{equipmentIp,jdbcType=VARCHAR}, 
-      #{equipmentNo,jdbcType=VARCHAR}, #{estateId,jdbcType=VARCHAR}, #{estateName,jdbcType=VARCHAR}, 
+    values (#{equipmentId,jdbcType=VARCHAR}, #{buildingId,jdbcType=VARCHAR}, #{buildingName,jdbcType=VARCHAR},
+      #{createTime,jdbcType=TIMESTAMP}, #{dataStatus,jdbcType=INTEGER}, #{equipmentIp,jdbcType=VARCHAR},
+      #{equipmentNo,jdbcType=VARCHAR}, #{estateId,jdbcType=VARCHAR}, #{estateName,jdbcType=VARCHAR},
       #{manufacturer,jdbcType=VARCHAR}, #{softwareVersion,jdbcType=VARCHAR})
   </insert>
   <insert id="insertSelective" parameterType="com.inspur.idm.media.po.estate.EleBuildingEquipment">
@@ -229,4 +232,4 @@
     where building_id = #{buildingId,jdbcType=VARCHAR}
   </update>
 
-</mapper>
+</mapper>

elevator-admin/src/main/resources/mapper/media/EleFittingsPriceDao.xml

@@ -20,10 +20,19 @@
     fittings_name, manufact_company_id, own_company_id, fittings_price, remark
   </sql>
   <select id="selectByPrimaryKey" parameterType="java.lang.String" resultMap="BaseResultMap">
-    select 
+    select
+    <include refid="Base_Column_List" />
+    from `ele_fittings_price`
+    where fittings_price_id = #{fittingsPriceId,jdbcType=VARCHAR}
+  </select>
+  <select id="selectByPrimaryKeyV2" parameterType="java.lang.String" resultMap="BaseResultMap">
+    select
     <include refid="Base_Column_List" />
     from `ele_fittings_price`
     where fittings_price_id = #{fittingsPriceId,jdbcType=VARCHAR}
+    <if test="limitCompany != null">
+      AND own_company_id = #{limitCompany,jdbcType=VARCHAR}
+    </if>
   </select>
   <delete id="deleteByPrimaryKey" parameterType="java.lang.String">
     delete from `ele_fittings_price`
@@ -36,7 +45,7 @@
                                       fittings_price, remark)
     values (#{fittingsPriceId,jdbcType=VARCHAR}, #{partId,jdbcType=VARCHAR}, #{auditDesc,jdbcType=VARCHAR}, #{auditStatus,jdbcType=VARCHAR},
       #{cityId,jdbcType=VARCHAR}, #{estateId,jdbcType=VARCHAR}, #{fittingsModel,jdbcType=VARCHAR},
-      #{fittingsName,jdbcType=VARCHAR}, #{manufactCompanyId,jdbcType=VARCHAR}, #{ownCompanyId,jdbcType=VARCHAR}, 
+      #{fittingsName,jdbcType=VARCHAR}, #{manufactCompanyId,jdbcType=VARCHAR}, #{ownCompanyId,jdbcType=VARCHAR},
       #{fittingsPrice,jdbcType=DECIMAL}, #{remark,jdbcType=VARCHAR})
   </insert>
   <insert id="insertSelective" parameterType="com.inspur.idm.media.po.fittings.EleFittingsPrice">
@@ -215,4 +224,4 @@
       </otherwise>
     </choose>
   </select>
-</mapper>
+</mapper>

elevator-admin/src/main/resources/mapper/media/EleInfoBasicDao.xml

@@ -20,11 +20,11 @@
   </resultMap>
   <sql id="Base_Column_List">
     elevator_id, `96333_code`, data_status, elevator_name, elevator_type, emergency_call,
-    estate_equip_code, inspect_company_id, inspector, quality_company_id, registered_office, 
+    estate_equip_code, inspect_company_id, inspector, quality_company_id, registered_office,
     registered_person, registration_code, risk_rating_current, risk_rating_initial
   </sql>
   <select id="selectByPrimaryKey" parameterType="java.lang.String" resultMap="BaseResultMap">
-    select 
+    select
     <include refid="Base_Column_List" />
     from `ele_info_basic`
     where elevator_id = #{elevatorId,jdbcType=VARCHAR}
@@ -46,15 +46,15 @@
 
   <insert id="insert" parameterType="com.inspur.idm.media.po.elevator.EleInfoBasic">
     insert into `ele_info_basic` (elevator_id, `96333_code`, data_status,
-      elevator_name, elevator_type, emergency_call, 
-      estate_equip_code, inspect_company_id, inspector, 
-      quality_company_id, registered_office, registered_person, 
+      elevator_name, elevator_type, emergency_call,
+      estate_equip_code, inspect_company_id, inspector,
+      quality_company_id, registered_office, registered_person,
       registration_code, risk_rating_current, risk_rating_initial
       )
     values (#{elevatorId,jdbcType=VARCHAR}, #{nine6333Code,jdbcType=VARCHAR}, #{dataStatus,jdbcType=INTEGER},
-      #{elevatorName,jdbcType=VARCHAR}, #{elevatorType,jdbcType=INTEGER}, #{emergencyCall,jdbcType=VARCHAR}, 
-      #{estateEquipCode,jdbcType=VARCHAR}, #{inspectCompanyId,jdbcType=VARCHAR}, #{inspector,jdbcType=VARCHAR}, 
-      #{qualityCompanyId,jdbcType=VARCHAR}, #{registeredOffice,jdbcType=VARCHAR}, #{registeredPerson,jdbcType=VARCHAR}, 
+      #{elevatorName,jdbcType=VARCHAR}, #{elevatorType,jdbcType=INTEGER}, #{emergencyCall,jdbcType=VARCHAR},
+      #{estateEquipCode,jdbcType=VARCHAR}, #{inspectCompanyId,jdbcType=VARCHAR}, #{inspector,jdbcType=VARCHAR},
+      #{qualityCompanyId,jdbcType=VARCHAR}, #{registeredOffice,jdbcType=VARCHAR}, #{registeredPerson,jdbcType=VARCHAR},
       #{registrationCode,jdbcType=VARCHAR}, #{riskRatingCurrent,jdbcType=VARCHAR}, #{riskRatingInitial,jdbcType=VARCHAR}
       )
   </insert>
@@ -259,4 +259,7 @@
       </if>
     </where>
   </select>
-</mapper>
+  <select id="selectUserElevatorIds" resultType="String" parameterType="String">
+    select elevator_id from pf_user_elevator where user_id = #{limitUser}
+  </select>
+</mapper>

elevator-admin/src/main/resources/mapper/media/FaultInsureDao.xml

@@ -18,30 +18,39 @@
     <result column="start_time" jdbcType="TIMESTAMP" property="startTime" />
   </resultMap>
   <sql id="Base_Column_List">
-    insure_id, additional_insure, data_status, end_time, estate_company_id, estate_staff_id, 
-    insure_company_id, insure_no, insure_staff_id, insure_type_id, mainten_company_id, 
+    insure_id, additional_insure, data_status, end_time, estate_company_id, estate_staff_id,
+    insure_company_id, insure_no, insure_staff_id, insure_type_id, mainten_company_id,
     mainten_staff_id, policy_file_url, start_time
   </sql>
-  <select id="selectByPrimaryKey" parameterType="java.lang.String" resultMap="BaseResultMap">
-    select 
+  <select id="selectByPrimaryKey" resultMap="BaseResultMap">
+    select
     <include refid="Base_Column_List" />
     from `fault_insure`
     where insure_id = #{insureId,jdbcType=VARCHAR}
+    <if test="query.estateCompanyId != null">
+      AND estate_company_id = #{query.estateCompanyId,jdbcType=VARCHAR}
+    </if>
+    <if test="query.insureCompanyId != null">
+      AND insure_company_id = #{query.insureCompanyId,jdbcType=VARCHAR}
+    </if>
+    <if test="query.maintenCompanyId != null">
+      AND mainten_company_id = #{query.maintenCompanyId,jdbcType=VARCHAR},
+    </if>
   </select>
   <delete id="deleteByPrimaryKey" parameterType="java.lang.String">
     delete from `fault_insure`
     where insure_id = #{insureId,jdbcType=VARCHAR}
   </delete>
   <insert id="insert" parameterType="com.inspur.idm.media.po.fault.FaultInsure">
-    insert into `fault_insure` (insure_id, additional_insure, data_status, 
-      end_time, estate_company_id, estate_staff_id, 
-      insure_company_id, insure_no, insure_staff_id, 
-      insure_type_id, mainten_company_id, mainten_staff_id, 
+    insert into `fault_insure` (insure_id, additional_insure, data_status,
+      end_time, estate_company_id, estate_staff_id,
+      insure_company_id, insure_no, insure_staff_id,
+      insure_type_id, mainten_company_id, mainten_staff_id,
       policy_file_url, start_time)
-    values (#{insureId,jdbcType=VARCHAR}, #{additionalInsure,jdbcType=INTEGER}, #{dataStatus,jdbcType=INTEGER}, 
-      #{endTime,jdbcType=TIMESTAMP}, #{estateCompanyId,jdbcType=VARCHAR}, #{estateStaffId,jdbcType=VARCHAR}, 
-      #{insureCompanyId,jdbcType=VARCHAR}, #{insureNo,jdbcType=VARCHAR}, #{insureStaffId,jdbcType=VARCHAR}, 
-      #{insureTypeId,jdbcType=VARCHAR}, #{maintenCompanyId,jdbcType=VARCHAR}, #{maintenStaffId,jdbcType=VARCHAR}, 
+    values (#{insureId,jdbcType=VARCHAR}, #{additionalInsure,jdbcType=INTEGER}, #{dataStatus,jdbcType=INTEGER},
+      #{endTime,jdbcType=TIMESTAMP}, #{estateCompanyId,jdbcType=VARCHAR}, #{estateStaffId,jdbcType=VARCHAR},
+      #{insureCompanyId,jdbcType=VARCHAR}, #{insureNo,jdbcType=VARCHAR}, #{insureStaffId,jdbcType=VARCHAR},
+      #{insureTypeId,jdbcType=VARCHAR}, #{maintenCompanyId,jdbcType=VARCHAR}, #{maintenStaffId,jdbcType=VARCHAR},
       #{policyFileUrl,jdbcType=VARCHAR}, #{startTime,jdbcType=TIMESTAMP})
   </insert>
   <insert id="insertSelective" parameterType="com.inspur.idm.media.po.fault.FaultInsure">
@@ -268,4 +277,4 @@
     select count(0) from `fault_insure`
     where DATEDIFF(end_time, now())  &lt;= 7 and DATEDIFF(end_time, now()) &gt;= 0
   </select>
-</mapper>
+</mapper>