From b0c599e513b09315092c902f88ce66a3e1eac7cc Mon Sep 17 00:00:00 2001 From: liuwenxin <1009266660@qq.com> Date: Fri, 30 Oct 2026 09:57:30 +0800 Subject: [PATCH] =?UTF-8?q?fix(=E8=84=9A=E6=9C=AC):=20=E6=94=B6=E7=B4=A7?= =?UTF-8?q?=20T+=20=E8=BF=90=E7=BB=B4=E8=84=9A=E6=9C=AC=E6=A0=A1=E9=AA=8C?= =?UTF-8?q?=E4=B8=8E=E6=81=A2=E5=A4=8D=E8=A1=8C=E4=B8=BA?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit login 脚本原先在结尾无条件 SET READ_ONLY：库名误指向其他 可写库时会把它锁成只读。改为开头校验库存在（不存在即中止） 并记录初始 Updateability，结尾仅当初始为 READ_ONLY 时恢复。 inventory 脚本的库名校验统一为 restore 脚本的字符白名单。 Co-Authored-By: Claude Code --- scripts/tplus/create_tplus_readonly_login.ps1 | 14 +++++++++++--- scripts/tplus/inventory_tplus_database.ps1 | 4 ++++ 2 files changed, 15 insertions(+), 3 deletions(-) diff --git a/scripts/tplus/create_tplus_readonly_login.ps1 b/scripts/tplus/create_tplus_readonly_login.ps1 index 2562fc9..521f64c 100644 --- a/scripts/tplus/create_tplus_readonly_login.ps1 +++ b/scripts/tplus/create_tplus_readonly_login.ps1 @@ -30,7 +30,14 @@ $safeDatabaseLiteral = $DatabaseName.Replace("'", "''") $safeLoginIdentifier = $LoginName.Replace("]", "]]" ) $safeReaderPassword = $readerPasswordText.Replace("'", "''") $sql = @" -IF DATABASEPROPERTYEX(N'$safeDatabaseLiteral', 'Updateability') = N'READ_ONLY' +IF DB_ID(N'$safeDatabaseLiteral') IS NULL +BEGIN + ;THROW 51000, N'目标数据库不存在，已停止配置，未修改任何库。', 1; +END; +DECLARE @initialReadonly bit = + CASE WHEN CAST(DATABASEPROPERTYEX(N'$safeDatabaseLiteral', 'Updateability') AS nvarchar(30)) = N'READ_ONLY' + THEN 1 ELSE 0 END; +IF @initialReadonly = 1 ALTER DATABASE [$safeDatabaseIdentifier] SET READ_WRITE; IF NOT EXISTS (SELECT 1 FROM sys.server_principals WHERE name = N'$safeLoginIdentifier') BEGIN @@ -49,8 +56,9 @@ IF NOT EXISTS ( ) EXEC sp_addrolemember N'db_datareader', N'$safeLoginIdentifier'; DENY INSERT, UPDATE, DELETE TO [$safeLoginIdentifier]; -ALTER DATABASE [$safeDatabaseIdentifier] SET READ_ONLY; +IF @initialReadonly = 1 + ALTER DATABASE [$safeDatabaseIdentifier] SET READ_ONLY; "@ Invoke-TPlusContainerSql -ContainerName $ContainerName -Sql $sql -SaPassword $SaPassword -Write-Host "只读账号已配置：$LoginName（未输出密码）" +Write-Host "只读账号已配置：$LoginName（未输出密码）。仅当目标库初始为 READ_ONLY 时才恢复只读；初始为可写的库保持可写。" diff --git a/scripts/tplus/inventory_tplus_database.ps1 b/scripts/tplus/inventory_tplus_database.ps1 index 1931ef0..f1d5e74 100644 --- a/scripts/tplus/inventory_tplus_database.ps1 +++ b/scripts/tplus/inventory_tplus_database.ps1 @@ -13,6 +13,10 @@ $ErrorActionPreference = "Stop" . (Join-Path $PSScriptRoot "container_sql.ps1") +if ($DatabaseName -notmatch '^[A-Za-z_][A-Za-z0-9_]{0,127}$') { + throw "核验数据库名只能使用字母、数字和下划线。" +} + New-Item -ItemType Directory -Path $ReportRoot -Force | Out-Null $reportPath = Join-Path $ReportRoot ("Tplus-核验-{0:yyyyMMdd-HHmmss}.md" -f (Get-Date)) $safeDatabaseIdentifier = $DatabaseName.Replace("]", "]]" )