flipped-aurora/gin-vue-admin · error

order by %s is not in the fields

Error message

order by %s is not in the fields

What it means

ExportExcel validates that the requested sort field belongs to the template's field list before applying an ORDER BY, preventing SQL injection via unvalidated column names. If the first token of the 'order' parameter is not a known field key, it returns this error.

Source

Thrown at server/service/system/sys_export_template.go:300

		for _, column := range orderColumns {
			fields[column.Name()] = true
		}

		// 通过参数传入order
		order := paramsValues.Get("order")

		if order == "" && template.Order != "" {
			// 如果没有order入参，这里会使用模板的默认排序
			order = template.Order
		}

		if order != "" {
			checkOrderArr := strings.Split(order, " ")
			orderStr := ""
			// 检查请求的排序字段是否在字段列表中
			if _, ok := fields[checkOrderArr[0]]; !ok {
				return nil, "", fmt.Errorf("order by %s is not in the fields", order)
			}
			orderStr = checkOrderArr[0]
			if len(checkOrderArr) > 1 {
				if checkOrderArr[1] != "asc" && checkOrderArr[1] != "desc" {
					return nil, "", fmt.Errorf("order by %s is not secure", order)
				}
				orderStr = orderStr + " " + checkOrderArr[1]
			}
			db = db.Order(orderStr)
		}

		err = db.Find(&tableMap).Error
		if err != nil {
			return nil, "", err
		}
	}

	var rows [][]string

View on GitHub (pinned to 3136500ef3)

Solutions

1. Use a field name present in the export template's conditions/fields list
2. Sync the frontend sort options with the template's configured fields
3. Check template config in sys_export_template and add the field if it should be sortable

Example fix

// before
params: 'order=create_time desc' // create_time not in fields
// after
params: 'order=CreatedAt desc' // matches a configured field key

if (!template.fields.some(f => f.key === orderCol)) {
  orderCol = template.fields[0].key
}

try {
  await exportExcel(templateId, params)
} catch (e) {
  if (e.message.includes('not in the fields')) {
    ElMessage.error('排序字段不在模板字段列表中')
  }
}

When it happens

Trigger: Export request with an order parameter whose column name (text before the first space) does not match any key in the template's fields map, e.g. order=password or order=nonexistent_col asc.

Common situations: Client sending DB column names instead of the template's exposed field names; renamed fields in the template while frontend caches old names; crafted injection attempts caught by this check.

Related errors

• order by %s is not secure
• 参数错误：executionPlan 必须提供
• packageName 不能为空
• packageType 必须是 'package' 或 'plugin'
• packageType 和 packageInfo.template 必须保持一致

AI-assisted analysis of flipped-aurora/gin-vue-admin@3136500ef3 (2026-08-31). Data as JSON: /api/errors/f0b0cb02b2937333. Report an issue: GitHub.