JeroBoot/base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix 68486 【垂直越权】系统管理-数据字典 接口未处理越权

Browse Source
This commit is contained in:
liao
2023-05-06 15:22:24 +08:00
parent ce487b42b7
commit 91a5d4ae48
3 changed files with 647 additions and 595 deletions
Download Patch File Download Diff File Expand all files Collapse all files
jero-boot/jero-boot-module-system/src/main/java/com/jero/modules/system/controller/SysDictController.java
+596 -575
View File
File diff suppressed because it is too large Load Diff
jero-boot/jero-boot-module-system/src/main/java/com/jero/modules/system/controller/SysPermissionController.java
+20 -20
View File
@@ -69,7 +69,7 @@ public class SysPermissionController {
* @return
*/
@GetMapping("/page")
@RequiresPermissions("PermissionList:list")
@RequiresPermissions("permission:list")
public Results<List<SysPermissionTree>> list() {
long start = System.currentTimeMillis();
Results<List<SysPermissionTree>> result = new Results<>();
@@ -96,7 +96,7 @@ public class SysPermissionController {
* @return
*/
@GetMapping("/getSystemMenuList")
@RequiresPermissions("PermissionList:list")
@RequiresPermissions("permission:list")
public Results<List<SysPermissionTree>> getSystemMenuList() {
long start = System.currentTimeMillis();
Results<List<SysPermissionTree>> result = new Results<>();
@@ -126,7 +126,7 @@ public class SysPermissionController {
* @return
*/
@GetMapping("/getSystemSubmenu")
@RequiresPermissions("PermissionList:list")
@RequiresPermissions("permission:list")
public Results<List<SysPermissionTree>> getSystemSubmenu(@RequestParam("parentId") String parentId){
Results<List<SysPermissionTree>> result = new Results<>();
try{
@@ -157,7 +157,7 @@ public class SysPermissionController {
* @return 返回 key-value 的 Map
*/
@GetMapping("/getSystemSubmenuBatch")
@RequiresPermissions("PermissionList:list")
@RequiresPermissions("permission:list")
public Results<Map<String, List<SysPermissionTree>>> getSystemSubmenuBatch(@RequestParam("parentIds") String parentIds) {
try {
LambdaQueryWrapper<SysPermission> query = new LambdaQueryWrapper<>();
@@ -191,7 +191,7 @@ public class SysPermissionController {
* @return
*/
@GetMapping("/getUserPermissionByToken")
@RequiresPermissions("PermissionList:list")
@RequiresPermissions("permission:list")
public Results<JSONObject> getUserPermissionByToken() {
Results<JSONObject> result = new Results<>();
try {
@@ -236,7 +236,7 @@ public class SysPermissionController {
*/
//@RequiresRoles({ "admin" })
@PostMapping("/add")
@RequiresPermissions("PermissionList:add")
@RequiresPermissions("permission:add")
public Results<Object> add(@RequestBody SysPermission permission) {
try {
permission = PermissionDataUtil.intelligentProcessData(permission);
@@ -255,7 +255,7 @@ public class SysPermissionController {
*/
//@RequiresRoles({ "admin" })
@PostMapping("/edit")
@RequiresPermissions("PermissionList:edit")
@RequiresPermissions("permission:edit")
public Results<Object> edit(@RequestBody SysPermission permission) {
try {
permission = PermissionDataUtil.intelligentProcessData(permission);
@@ -274,7 +274,7 @@ public class SysPermissionController {
*/
//@RequiresRoles({ "admin" })
@PostMapping("/delete")
@RequiresPermissions("PermissionList:delete")
@RequiresPermissions("permission:delete")
public Results<T> delete(@RequestBody Map<String, String> map) {
String id = map.get("id");
if(StringUtils.isBlank(id)){
@@ -296,7 +296,7 @@ public class SysPermissionController {
*/
//@RequiresRoles({ "admin" })
@PostMapping("/deleteBatch")
@RequiresPermissions("PermissionList:delete")
@RequiresPermissions("permission:delete")
public Results<T> deleteBatch(@RequestBody Map<String, String> map) {
String ids = map.get("ids");
if(StringUtils.isBlank(ids)){
@@ -322,7 +322,7 @@ public class SysPermissionController {
* @return
*/
@GetMapping("/queryTreeList")
@RequiresPermissions("PermissionList:list")
@RequiresPermissions("permission:list")
public Results<Map<String, Object>> queryTreeList() {
Results<Map<String, Object>> result = new Results<>();
// 全部权限ids
@@ -355,7 +355,7 @@ public class SysPermissionController {
* @return
*/
@GetMapping("/queryListAsync")
@RequiresPermissions("PermissionList:list")
@RequiresPermissions("permission:list")
public Results<List<TreeModel>> queryAsync(@RequestParam(name = "pid", required = false) String parentId) {
Results<List<TreeModel>> result = new Results<>();
try {
@@ -379,7 +379,7 @@ public class SysPermissionController {
* @return
*/
@GetMapping("/queryRolePermission")
@RequiresPermissions("PermissionList:list")
@RequiresPermissions("permission:list")
public Results<List<String>> queryRolePermission(@RequestParam(name = "roleId", required = true) String roleId) {
Results<List<String>> result = new Results<>();
try {
@@ -398,7 +398,7 @@ public class SysPermissionController {
* @return
*/
@PostMapping("/saveRolePermission")
@RequiresPermissions("PermissionList:add")
@RequiresPermissions("permission:add")
//@RequiresRoles({ "admin" })
public Results<String> saveRolePermission(@RequestBody JSONObject json) {
long start = System.currentTimeMillis();
@@ -669,7 +669,7 @@ public class SysPermissionController {
* @return
*/
@GetMapping("/getPermRuleListByPermId")
@RequiresPermissions("PermissionList:list")
@RequiresPermissions("permission:list")
public Results<List<SysPermissionDataRule>> getPermRuleListByPermId(SysPermissionDataRule sysPermissionDataRule) {
List<SysPermissionDataRule> permRuleList = sysPermissionDataRuleService.getPermRuleListByPermId(sysPermissionDataRule.getPermissionId());
Results<List<SysPermissionDataRule>> result = new Results<>();
@@ -686,7 +686,7 @@ public class SysPermissionController {
*/
//@RequiresRoles({ "admin" })
@PostMapping("/addPermissionRule")
@RequiresPermissions("PermissionList:add")
@RequiresPermissions("permission:add")
public Results<Object> addPermissionRule(@RequestBody SysPermissionDataRule sysPermissionDataRule) {
try {
sysPermissionDataRule.setCreateTime(new Date());
@@ -700,7 +700,7 @@ public class SysPermissionController {
//@RequiresRoles({ "admin" })
@PostMapping("/editPermissionRule")
@RequiresPermissions("PermissionList:edit")
@RequiresPermissions("permission:edit")
public Results<Object> editPermissionRule(@RequestBody SysPermissionDataRule sysPermissionDataRule) {
try {
sysPermissionDataRuleService.saveOrUpdate(sysPermissionDataRule);
@@ -719,7 +719,7 @@ public class SysPermissionController {
*/
//@RequiresRoles({ "admin" })
@PostMapping("/deletePermissionRule")
@RequiresPermissions("PermissionList:delete")
@RequiresPermissions("permission:delete")
public Results<Object> deletePermissionRule(@RequestBody Map<String,String> map) {
try {
String id = map.get("id");
@@ -741,7 +741,7 @@ public class SysPermissionController {
* @return
*/
@GetMapping("/queryPermissionRule")
@RequiresPermissions("PermissionList:list")
@RequiresPermissions("permission:list")
public Results<List<SysPermissionDataRule>> queryPermissionRule(SysPermissionDataRule sysPermissionDataRule) {
try {
List<SysPermissionDataRule> permRuleList = sysPermissionDataRuleService.queryPermissionRule(sysPermissionDataRule);
@@ -758,7 +758,7 @@ public class SysPermissionController {
* @return
*/
@GetMapping("/queryDepartPermission")
@RequiresPermissions("PermissionList:list")
@RequiresPermissions("permission:list")
public Results<List<String>> queryDepartPermission(@RequestParam(name = "departId", required = true) String departId) {
Results<List<String>> result = new Results<>();
try {
@@ -777,7 +777,7 @@ public class SysPermissionController {
* @return
*/
@PostMapping("/saveDepartPermission")
@RequiresPermissions("PermissionList:add")
@RequiresPermissions("permission:add")
//@RequiresRoles({ "admin" })
public Results<String> saveDepartPermission(@RequestBody JSONObject json) {
long start = System.currentTimeMillis();