xiaozhi/xiaozhi-server
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

update 优化 重构系统业务数据权限 避免可能存在的越权风险

Browse Source
This commit is contained in:
疯狂的狮子Li
2023-03-11 01:32:38 +08:00
parent 69edf436da
commit f0a9768d8e
13 changed files with 151 additions and 119 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/controller/system/SysRoleController.java
+4 -6
View File
@@ -22,7 +22,6 @@ import com.ruoyi.system.domain.vo.DeptTreeSelectVo;
import com.ruoyi.system.domain.vo.SysRoleVo;
import com.ruoyi.system.domain.vo.SysUserVo;
import com.ruoyi.system.service.ISysDeptService;
import com.ruoyi.system.service.ISysPermissionService;
import com.ruoyi.system.service.ISysRoleService;
import com.ruoyi.system.service.ISysUserService;
import jakarta.servlet.http.HttpServletResponse;
@@ -46,7 +45,6 @@ public class SysRoleController extends BaseController {
private final ISysRoleService roleService;
private final ISysUserService userService;
private final ISysDeptService deptService;
private final ISysPermissionService permissionService;
/**
* 获取角色信息列表
@@ -103,7 +101,7 @@ public class SysRoleController extends BaseController {
@Log(title = "角色管理", businessType = BusinessType.UPDATE)
@PutMapping
public R<Void> edit(@Validated @RequestBody SysRoleBo role) {
roleService.checkRoleAllowed(role);
roleService.checkRoleAllowed(role.getRoleId());
roleService.checkRoleDataScope(role.getRoleId());
if (!roleService.checkRoleNameUnique(role)) {
return R.fail("修改角色'" + role.getRoleName() + "'失败，角色名称已存在");
@@ -143,7 +141,7 @@ public class SysRoleController extends BaseController {
@Log(title = "角色管理", businessType = BusinessType.UPDATE)
@PutMapping("/dataScope")
public R<Void> dataScope(@RequestBody SysRoleBo role) {
roleService.checkRoleAllowed(role);
roleService.checkRoleAllowed(role.getRoleId());
roleService.checkRoleDataScope(role.getRoleId());
return toAjax(roleService.authDataScope(role));
}
@@ -155,9 +153,9 @@ public class SysRoleController extends BaseController {
@Log(title = "角色管理", businessType = BusinessType.UPDATE)
@PutMapping("/changeStatus")
public R<Void> changeStatus(@RequestBody SysRoleBo role) {
roleService.checkRoleAllowed(role);
roleService.checkRoleAllowed(role.getRoleId());
roleService.checkRoleDataScope(role.getRoleId());
return toAjax(roleService.updateRoleStatus(role));
return toAjax(roleService.updateRoleStatus(role.getRoleId(), role.getStatus()));
}
/**
ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/controller/system/SysUserController.java
+5 -5
View File
@@ -145,7 +145,7 @@ public class SysUserController extends BaseController {
@Log(title = "用户管理", businessType = BusinessType.UPDATE)
@PutMapping
public R<Void> edit(@Validated @RequestBody SysUserBo user) {
userService.checkUserAllowed(user);
userService.checkUserAllowed(user.getUserId());
userService.checkUserDataScope(user.getUserId());
if (!userService.checkUserNameUnique(user)) {
return R.fail("修改用户'" + user.getUserName() + "'失败，登录账号已存在");
@@ -179,10 +179,10 @@ public class SysUserController extends BaseController {
@Log(title = "用户管理", businessType = BusinessType.UPDATE)
@PutMapping("/resetPwd")
public R<Void> resetPwd(@RequestBody SysUserBo user) {
userService.checkUserAllowed(user);
userService.checkUserAllowed(user.getUserId());
userService.checkUserDataScope(user.getUserId());
user.setPassword(BCrypt.hashpw(user.getPassword()));
return toAjax(userService.resetUserPwd(user.getUserId(),user.getPassword()));
return toAjax(userService.resetUserPwd(user.getUserId(), user.getPassword()));
}
/**
@@ -192,9 +192,9 @@ public class SysUserController extends BaseController {
@Log(title = "用户管理", businessType = BusinessType.UPDATE)
@PutMapping("/changeStatus")
public R<Void> changeStatus(@RequestBody SysUserBo user) {
userService.checkUserAllowed(user);
userService.checkUserAllowed(user.getUserId());
userService.checkUserDataScope(user.getUserId());
return toAjax(userService.updateUserStatus(user));
return toAjax(userService.updateUserStatus(user.getUserId(), user.getStatus()));
}
/**