update 优化 工作流管理页接口增加权限标识符 避免越权

ruoyi-modules/ruoyi-workflow/src/main/java/org/dromara/workflow/controller/FlwTaskController.java

@@ -1,5 +1,6 @@
 package org.dromara.workflow.controller;
 
+import cn.dev33.satoken.annotation.SaCheckPermission;
 import lombok.RequiredArgsConstructor;
 import org.dromara.common.core.domain.PageResult;
 import org.dromara.common.core.domain.R;
@@ -96,6 +97,7 @@ public class FlwTaskController extends BaseController {
      * @param pageQuery  分页
      * @return 待办任务分页数据
      */
+    @SaCheckPermission("workflow:task:list")
     @GetMapping("/pageByAllTaskWait")
     public R<PageResult<FlowTaskVo>> pageByAllTaskWait(FlowTaskBo flowTaskBo, PageQuery pageQuery) {
         return R.ok(flwTaskService.pageByAllTaskWait(flowTaskBo, pageQuery));
@@ -108,6 +110,7 @@ public class FlwTaskController extends BaseController {
      * @param pageQuery  分页
      * @return 已办任务分页数据
      */
+    @SaCheckPermission("workflow:task:list")
     @GetMapping("/pageByAllTaskFinish")
     public R<PageResult<FlowHisTaskVo>> pageByAllTaskFinish(FlowTaskBo flowTaskBo, PageQuery pageQuery) {
         return R.ok(flwTaskService.pageByAllTaskFinish(flowTaskBo, pageQuery));
@@ -186,6 +189,7 @@ public class FlwTaskController extends BaseController {
      */
     @Log(title = "任务管理", businessType = BusinessType.UPDATE)
     @RepeatSubmit()
+    @SaCheckPermission("workflow:task:edit")
     @PutMapping("/updateAssignee/{userId}")
     public R<Void> updateAssignee(@RequestBody List<Long> taskIdList, @PathVariable String userId) {
         return toAjax(flwTaskService.updateAssignee(taskIdList, userId));
@@ -235,6 +239,7 @@ public class FlwTaskController extends BaseController {
      */
     @PostMapping("/urgeTask")
     @Log(title = "任务管理", businessType = BusinessType.INSERT)
+    @SaCheckPermission("workflow:task:edit")
     public R<Void> urgeTask(@RequestBody FlowUrgeTaskBo bo) {
         return toAjax(flwTaskService.urgeTask(bo));
     }