fix 68490 【垂直越权】系统管理-菜单管理 接口未处理越权

jero-boot/jero-boot-module-system/src/main/java/com/jero/modules/system/controller/SysPermissionController.java

@@ -24,6 +24,7 @@ import lombok.extern.slf4j.Slf4j;
 import org.apache.commons.lang.StringUtils;
 import org.apache.poi.ss.formula.functions.T;
 import org.apache.shiro.SecurityUtils;
+import org.apache.shiro.authz.annotation.RequiresPermissions;
 import org.jetbrains.annotations.NotNull;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.web.bind.annotation.*;
@@ -68,6 +69,7 @@ public class SysPermissionController {
 	 * @return
 	 */
 	@GetMapping("/page")
+	@RequiresPermissions("PermissionList:list")
 	public Results<List<SysPermissionTree>> list() {
         long start = System.currentTimeMillis();
 		Results<List<SysPermissionTree>> result = new Results<>();
@@ -94,6 +96,7 @@ public class SysPermissionController {
 	 * @return
 	 */
 	@GetMapping("/getSystemMenuList")
+	@RequiresPermissions("PermissionList:list")
 	public Results<List<SysPermissionTree>> getSystemMenuList() {
         long start = System.currentTimeMillis();
 		Results<List<SysPermissionTree>> result = new Results<>();
@@ -123,6 +126,7 @@ public class SysPermissionController {
 	 * @return
 	 */
 	@GetMapping("/getSystemSubmenu")
+	@RequiresPermissions("PermissionList:list")
 	public Results<List<SysPermissionTree>> getSystemSubmenu(@RequestParam("parentId") String parentId){
 		Results<List<SysPermissionTree>> result = new Results<>();
 		try{
@@ -153,6 +157,7 @@ public class SysPermissionController {
 	 * @return 返回 key-value 的 Map
 	 */
 	@GetMapping("/getSystemSubmenuBatch")
+	@RequiresPermissions("PermissionList:list")
 	public Results<Map<String, List<SysPermissionTree>>> getSystemSubmenuBatch(@RequestParam("parentIds") String parentIds) {
 		try {
 			LambdaQueryWrapper<SysPermission> query = new LambdaQueryWrapper<>();
@@ -186,6 +191,7 @@ public class SysPermissionController {
 	 * @return
 	 */
 	@GetMapping("/getUserPermissionByToken")
+	@RequiresPermissions("PermissionList:list")
 	public Results<JSONObject> getUserPermissionByToken() {
 		Results<JSONObject> result = new Results<>();
 		try {
@@ -230,6 +236,7 @@ public class SysPermissionController {
 	 */
 	//@RequiresRoles({ "admin" })
 	@PostMapping("/add")
+	@RequiresPermissions("PermissionList:add")
 	public Results<Object> add(@RequestBody SysPermission permission) {
 		try {
 			permission = PermissionDataUtil.intelligentProcessData(permission);
@@ -248,6 +255,7 @@ public class SysPermissionController {
 	 */
 	//@RequiresRoles({ "admin" })
 	@PostMapping("/edit")
+	@RequiresPermissions("PermissionList:edit")
 	public Results<Object> edit(@RequestBody SysPermission permission) {
 		try {
 			permission = PermissionDataUtil.intelligentProcessData(permission);
@@ -266,6 +274,7 @@ public class SysPermissionController {
 	 */
 	//@RequiresRoles({ "admin" })
 	@PostMapping("/delete")
+	@RequiresPermissions("PermissionList:delete")
 	public Results<T> delete(@RequestBody Map<String, String> map) {
 		String id = map.get("id");
 		if(StringUtils.isBlank(id)){
@@ -287,6 +296,7 @@ public class SysPermissionController {
 	 */
 	//@RequiresRoles({ "admin" })
 	@PostMapping("/deleteBatch")
+	@RequiresPermissions("PermissionList:delete")
 	public Results<T> deleteBatch(@RequestBody Map<String, String> map) {
 		String ids = map.get("ids");
 		if(StringUtils.isBlank(ids)){
@@ -312,6 +322,7 @@ public class SysPermissionController {
 	 * @return
 	 */
 	@GetMapping("/queryTreeList")
+	@RequiresPermissions("PermissionList:list")
 	public Results<Map<String, Object>> queryTreeList() {
 		Results<Map<String, Object>> result = new Results<>();
 		// 全部权限ids
@@ -344,6 +355,7 @@ public class SysPermissionController {
 	 * @return
 	 */
 	@GetMapping("/queryListAsync")
+	@RequiresPermissions("PermissionList:list")
 	public Results<List<TreeModel>> queryAsync(@RequestParam(name = "pid", required = false) String parentId) {
 		Results<List<TreeModel>> result = new Results<>();
 		try {
@@ -367,6 +379,7 @@ public class SysPermissionController {
 	 * @return
 	 */
 	@GetMapping("/queryRolePermission")
+	@RequiresPermissions("PermissionList:list")
 	public Results<List<String>> queryRolePermission(@RequestParam(name = "roleId", required = true) String roleId) {
 		Results<List<String>> result = new Results<>();
 		try {
@@ -385,6 +398,7 @@ public class SysPermissionController {
 	 * @return
 	 */
 	@PostMapping("/saveRolePermission")
+	@RequiresPermissions("PermissionList:add")
 	//@RequiresRoles({ "admin" })
 	public Results<String> saveRolePermission(@RequestBody JSONObject json) {
 		long start = System.currentTimeMillis();
@@ -655,6 +669,7 @@ public class SysPermissionController {
 	 * @return
 	 */
 	@GetMapping("/getPermRuleListByPermId")
+	@RequiresPermissions("PermissionList:list")
 	public Results<List<SysPermissionDataRule>> getPermRuleListByPermId(SysPermissionDataRule sysPermissionDataRule) {
 		List<SysPermissionDataRule> permRuleList = sysPermissionDataRuleService.getPermRuleListByPermId(sysPermissionDataRule.getPermissionId());
 		Results<List<SysPermissionDataRule>> result = new Results<>();
@@ -671,6 +686,7 @@ public class SysPermissionController {
 	 */
 	//@RequiresRoles({ "admin" })
 	@PostMapping("/addPermissionRule")
+	@RequiresPermissions("PermissionList:add")
 	public Results<Object> addPermissionRule(@RequestBody SysPermissionDataRule sysPermissionDataRule) {
 		try {
 			sysPermissionDataRule.setCreateTime(new Date());
@@ -684,6 +700,7 @@ public class SysPermissionController {
 
 	//@RequiresRoles({ "admin" })
 	@PostMapping("/editPermissionRule")
+	@RequiresPermissions("PermissionList:edit")
 	public Results<Object> editPermissionRule(@RequestBody SysPermissionDataRule sysPermissionDataRule) {
 		try {
 			sysPermissionDataRuleService.saveOrUpdate(sysPermissionDataRule);
@@ -702,6 +719,7 @@ public class SysPermissionController {
 	 */
 	//@RequiresRoles({ "admin" })
 	@PostMapping("/deletePermissionRule")
+	@RequiresPermissions("PermissionList:delete")
 	public Results<Object> deletePermissionRule(@RequestBody Map<String,String> map) {
 		try {
 			String id = map.get("id");
@@ -723,6 +741,7 @@ public class SysPermissionController {
 	 * @return
 	 */
 	@GetMapping("/queryPermissionRule")
+	@RequiresPermissions("PermissionList:list")
 	public Results<List<SysPermissionDataRule>> queryPermissionRule(SysPermissionDataRule sysPermissionDataRule) {
 		try {
 			List<SysPermissionDataRule> permRuleList = sysPermissionDataRuleService.queryPermissionRule(sysPermissionDataRule);
@@ -739,6 +758,7 @@ public class SysPermissionController {
 	 * @return
 	 */
 	@GetMapping("/queryDepartPermission")
+	@RequiresPermissions("PermissionList:list")
 	public Results<List<String>> queryDepartPermission(@RequestParam(name = "departId", required = true) String departId) {
 		Results<List<String>> result = new Results<>();
 		try {
@@ -757,6 +777,7 @@ public class SysPermissionController {
 	 * @return
 	 */
 	@PostMapping("/saveDepartPermission")
+	@RequiresPermissions("PermissionList:add")
 	//@RequiresRoles({ "admin" })
 	public Results<String> saveDepartPermission(@RequestBody JSONObject json) {
 		long start = System.currentTimeMillis();