fix 68486 【垂直越权】系统管理-数据字典 接口未处理越权

jero-boot/db/20230506处理垂直越权.sql

@@ -0,0 +1,31 @@
+-- ----------------------------
+-- 系统管理-菜单管理（增删查改权限）
+-- ----------------------------
+-- 权限数据 --
+INSERT INTO `sys_permission` VALUES ('1654673897041223683', '54dd5457a3190740005c1bfec55b1c34', '查询', NULL, NULL, NULL, NULL, 2, 'permission:list', '1', NULL, 0, NULL, 1, 1, 0, 0, NULL, 'admin', '2023-05-06 10:26:14', NULL, NULL, 0, 0, '1', 0);
+INSERT INTO `sys_permission` VALUES ('1654675497143033857', '54dd5457a3190740005c1bfec55b1c34', '添加', NULL, NULL, NULL, NULL, 2, 'permission:add', '1', NULL, 0, NULL, 1, 1, 0, 0, NULL, 'admin', '2023-05-06 10:32:36', NULL, NULL, 0, 0, '1', 0);
+INSERT INTO `sys_permission` VALUES ('1654675694854135809', '54dd5457a3190740005c1bfec55b1c34', '删除', NULL, NULL, NULL, NULL, 2, 'permission:delete', '1', NULL, 0, NULL, 1, 1, 0, 0, NULL, 'admin', '2023-05-06 10:33:23', NULL, NULL, 0, 0, '1', 0);
+INSERT INTO `sys_permission` VALUES ('1654675850508951554', '54dd5457a3190740005c1bfec55b1c34', '编辑', NULL, NULL, NULL, NULL, 2, 'permission:edit', '1', NULL, 0, NULL, 1, 1, 0, 0, NULL, 'admin', '2023-05-06 10:34:00', NULL, NULL, 0, 0, '1', 0);
+-- 权限与admin角色关联数据 --
+INSERT INTO `sys_role_permission` VALUES ('1654675964954730498', 'f6817f48af4fb3af11b9e8bf182f618b', '1654673897041223683', NULL, '2023-05-06 10:34:27', '127.0.0.1');
+INSERT INTO `sys_role_permission` VALUES ('1654675964984090626', 'f6817f48af4fb3af11b9e8bf182f618b', '1654675497143033857', NULL, '2023-05-06 10:34:27', '127.0.0.1');
+INSERT INTO `sys_role_permission` VALUES ('1654675964988284929', 'f6817f48af4fb3af11b9e8bf182f618b', '1654675694854135809', NULL, '2023-05-06 10:34:27', '127.0.0.1');
+INSERT INTO `sys_role_permission` VALUES ('1654675964992479233', 'f6817f48af4fb3af11b9e8bf182f618b', '1654675850508951554', NULL, '2023-05-06 10:34:27', '127.0.0.1');
+
+-- ----------------------------
+-- 系统管理-数据字典（增删查改、导出导入权限）
+-- ----------------------------
+-- 权限数据 --
+INSERT INTO `sys_permission` VALUES ('1654744031105675265', 'f1cb187abf927c88b89470d08615f5ac', '查询', NULL, NULL, NULL, NULL, 2, 'dict:list', '1', NULL, 0, NULL, 1, 1, 0, 0, NULL, 'admin', '2023-05-06 15:04:55', NULL, NULL, 0, 0, '1', 0);
+INSERT INTO `sys_permission` VALUES ('1654744160357347330', 'f1cb187abf927c88b89470d08615f5ac', '添加', NULL, NULL, NULL, NULL, 2, 'dict:add', '1', NULL, 0, NULL, 1, 1, 0, 0, NULL, 'admin', '2023-05-06 15:05:26', NULL, NULL, 0, 0, '1', 0);
+INSERT INTO `sys_permission` VALUES ('1654744259787517954', 'f1cb187abf927c88b89470d08615f5ac', '删除', NULL, NULL, NULL, NULL, 2, 'dict:delete', '1', NULL, 0, NULL, 1, 1, 0, 0, NULL, 'admin', '2023-05-06 15:05:50', NULL, NULL, 0, 0, '1', 0);
+INSERT INTO `sys_permission` VALUES ('1654744350615171074', 'f1cb187abf927c88b89470d08615f5ac', '编辑', NULL, NULL, NULL, NULL, 2, 'dict:edit', '1', NULL, 0, NULL, 1, 1, 0, 0, NULL, 'admin', '2023-05-06 15:06:12', NULL, NULL, 0, 0, '1', 0);
+INSERT INTO `sys_permission` VALUES ('1654746352959123457', 'f1cb187abf927c88b89470d08615f5ac', '导出', NULL, NULL, NULL, NULL, 2, 'dict:export', '1', NULL, 0, NULL, 1, 1, 0, 0, NULL, 'admin', '2023-05-06 15:14:09', NULL, NULL, 0, 0, '1', 0);
+INSERT INTO `sys_permission` VALUES ('1654746470756151297', 'f1cb187abf927c88b89470d08615f5ac', '导入', NULL, NULL, NULL, NULL, 2, 'dict:import', '1', NULL, 0, NULL, 1, 1, 0, 0, NULL, 'admin', '2023-05-06 15:14:37', NULL, NULL, 0, 0, '1', 0);
+-- 权限与admin角色关联数据 --
+INSERT INTO `sys_role_permission` VALUES ('1654747707610263553', 'f6817f48af4fb3af11b9e8bf182f618b', '1654744031105675265', NULL, '2023-05-06 15:19:32', '127.0.0.1');
+INSERT INTO `sys_role_permission` VALUES ('1654747707627040770', 'f6817f48af4fb3af11b9e8bf182f618b', '1654744160357347330', NULL, '2023-05-06 15:19:32', '127.0.0.1');
+INSERT INTO `sys_role_permission` VALUES ('1654747707627040771', 'f6817f48af4fb3af11b9e8bf182f618b', '1654744259787517954', NULL, '2023-05-06 15:19:32', '127.0.0.1');
+INSERT INTO `sys_role_permission` VALUES ('1654747707631235073', 'f6817f48af4fb3af11b9e8bf182f618b', '1654744350615171074', NULL, '2023-05-06 15:19:32', '127.0.0.1');
+INSERT INTO `sys_role_permission` VALUES ('1654747707631235074', 'f6817f48af4fb3af11b9e8bf182f618b', '1654746352959123457', NULL, '2023-05-06 15:19:32', '127.0.0.1');
+INSERT INTO `sys_role_permission` VALUES ('1654747707635429378', 'f6817f48af4fb3af11b9e8bf182f618b', '1654746470756151297', NULL, '2023-05-06 15:19:32', '127.0.0.1');

jero-boot/jero-boot-module-system/src/main/java/com/jero/modules/system/controller/SysDictController.java

@@ -31,6 +31,7 @@ import lombok.extern.slf4j.Slf4j;
 import org.apache.commons.lang.StringUtils;
 import org.apache.poi.ss.formula.functions.T;
 import org.apache.shiro.SecurityUtils;
+import org.apache.shiro.authz.annotation.RequiresPermissions;
 import org.jeecgframework.poi.excel.ExcelImportCheckUtil;
 import org.jeecgframework.poi.excel.ExcelImportUtil;
 import org.jeecgframework.poi.excel.def.NormalExcelConstants;
@@ -76,6 +77,7 @@ public class SysDictController {
 	private static final String DEL_SUCCESS = "删除成功!";
 
 	@GetMapping("/page")
+	@RequiresPermissions("dict:list")
 	@ApiOperation(value = "字典控制器-分页列表查询", notes = "字典控制器-分页列表查询")
 	public Results<IPage<SysDict>> queryPageList(SysDict sysDict, @RequestParam(name="pageNo", defaultValue="1") Integer pageNo,
 												 @RequestParam(name="pageSize", defaultValue="10") Integer pageSize, HttpServletRequest req) {
@@ -102,6 +104,7 @@ public class SysDictController {
 	 */
 	@ApiOperation(value = "字典控制器-树形字典数据", notes = "字典控制器-树形字典数据")
 	@GetMapping("/treeList")
+	@RequiresPermissions("dict:list")
 	public Results<List<SysDictTree>> treeList(SysDict sysDict, @RequestParam(name="pageNo", defaultValue="1") Integer pageNo,
 											   @RequestParam(name="pageSize", defaultValue="10") Integer pageSize, HttpServletRequest req) {
 		Results<List<SysDictTree>> result = new Results<>();
@@ -129,6 +132,7 @@ public class SysDictController {
 	 */
 	@ApiOperation(value = "字典控制器-获取全部字典数据", notes = "字典控制器-获取全部字典数据")
 	@GetMapping("/queryAllDictItems")
+	@RequiresPermissions("dict:list")
 	public Results<Map<String, List<DictModel>>> queryAllDictItems(HttpServletRequest request) {
 		Map<String, List<DictModel>> res ;
 		res = sysDictService.queryAllDictItems();
@@ -142,6 +146,7 @@ public class SysDictController {
 	 */
 	@ApiOperation(value = "字典控制器-通过字典code和字典值key获取字典数据", notes = "字典控制器-通过字典code和字典值key获取字典数据")
 	@GetMapping("/getDictText/{dictCode}/{key}")
+	@RequiresPermissions("dict:list")
 	public Results<String> getDictText(@PathVariable("dictCode") String dictCode, @PathVariable("key") String key) {
 		log.info(" dictCode : "+ dictCode);
 		Results<String> result = new Results<>();
@@ -164,6 +169,7 @@ public class SysDictController {
 	 * @return
 	 */
 	@GetMapping("/getDictItems/{dictCode}")
+	@RequiresPermissions("dict:list")
 	public Results<List<DictModel>> getDictItems(@PathVariable String dictCode, @RequestParam(value = "sign",required = false) String sign, HttpServletRequest request) {
 		log.info(" dictCode : "+ dictCode);
 		Results<List<DictModel>> result = new Results<>();
@@ -190,6 +196,7 @@ public class SysDictController {
 	 * @return
 	 */
 	@GetMapping("/loadDict/{dictCode}")
+	@RequiresPermissions("dict:list")
 	public Results<List<DictModel>> loadDict(@PathVariable String dictCode,
 											 @RequestParam(name="keyword") String keyword,
 											 @RequestParam(value = "sign",required = false) String sign,
@@ -220,6 +227,7 @@ public class SysDictController {
 	 * @return
 	 */
 	@GetMapping("/loadDictOrderByValue/{dictCode}")
+	@RequiresPermissions("dict:list")
 	public Results<List<DictModel>> loadDictOrderByValue(
 			@PathVariable String dictCode,
 			@RequestParam(name = "keyword") String keyword,
@@ -262,6 +270,7 @@ public class SysDictController {
 	 * @return
 	 */
 	@GetMapping("/loadDictItem/{dictCode}")
+	@RequiresPermissions("dict:list")
 	public Results<List<String>> loadDictItem(@PathVariable String dictCode, @RequestParam(name="key") String keys, @RequestParam(value = "sign",required = false) String sign, @RequestParam(value = "delNotExist",required = false,defaultValue = "true") boolean delNotExist, HttpServletRequest request) {
 		Results<List<String>> result = new Results<>();
 		try {
@@ -292,6 +301,7 @@ public class SysDictController {
 	 */
 	@ApiOperation(value = "字典控制器-根据表名—显示字段-存储字段 pid 加载树形数据", notes = "字典控制器-根据表名—显示字段-存储字段 pid 加载树形数据")
 	@GetMapping("/loadTreeData")
+	@RequiresPermissions("dict:list")
 	public Results<List<TreeSelectModel>> loadTreeData(@RequestParam(name="pid") String pid, @RequestParam(name="pidField") String pidField,
 													   @RequestParam(name="tableName") String tbname,
 													   @RequestParam(name="text") String text,
@@ -314,6 +324,7 @@ public class SysDictController {
 	 */
 	@ApiOperation(value = "字典控制器-根据表名—显示字段-存储字段 加载树形数据", notes = "字典控制器-根据表名—显示字段-存储字段 加载树形数据")
 	@GetMapping("/queryAllTreeData")
+	@RequiresPermissions("dict:list")
 	public Results<List<TreeSelectModel>> queryAllTreeData(@RequestParam(name="pidField") String pidField,
 														   @RequestParam(name="tableName") String tbname,
 														   @RequestParam(name="text") String text,
@@ -337,6 +348,7 @@ public class SysDictController {
 	 */
 	@ApiOperation(value = "字典控制器-新增字典", notes = "字典控制器-新增字典")
 	@PostMapping("/add")
+	@RequiresPermissions("dict:add")
 	public Results<Object> add(@RequestBody SysDict sysDict) {
 		try {
 			sysDict.setCreateTime(new Date());
@@ -358,6 +370,7 @@ public class SysDictController {
 	 */
 	@ApiOperation(value = "字典控制器-编辑字典", notes = "字典控制器-编辑字典")
 	@PostMapping("/edit")
+	@RequiresPermissions("dict:edit")
 	public Results<Object> edit(@RequestBody SysDict sysDict) {
 		SysDict sysdict = sysDictService.getById(sysDict.getId());
 		if(sysdict==null) {
@@ -381,6 +394,7 @@ public class SysDictController {
 	 */
 	@ApiOperation(value = "字典控制器-删除字典", notes = "字典控制器-删除字典")
 	@PostMapping(value = "/delete")
+	@RequiresPermissions("dict:delete")
 	@CacheEvict(value={CacheConstant.SYS_DICT_CACHE, CacheConstant.SYS_ENABLE_DICT_CACHE}, allEntries=true)
 	public Results<Object> delete(@RequestBody Map<String,String> map) {
 		String id = map.get("id");
@@ -402,6 +416,7 @@ public class SysDictController {
 	 */
 	@ApiOperation(value = "字典控制器-批量字典", notes = "字典控制器-批量字典")
 	@PostMapping(value = "/deleteBatch")
+	@RequiresPermissions("dict:delete")
 	@CacheEvict(value= {CacheConstant.SYS_DICT_CACHE, CacheConstant.SYS_ENABLE_DICT_CACHE}, allEntries=true)
 	public Results<Object> deleteBatch(@RequestParam(name="ids",required=true) String ids) {
 		if(oConvertUtils.isEmpty(ids)) {
@@ -418,6 +433,7 @@ public class SysDictController {
 	 * @return
 	 */
 	@RequestMapping(value = "/refleshCache")
+	@RequiresPermissions("dict:list")
 	public Results<SysDict> refleshCache() {
 		Results<SysDict> result = new Results<>();
 		sysDictService.refreshCache();
@@ -430,6 +446,7 @@ public class SysDictController {
 	 * @param request
 	 */
 	@RequestMapping(value = "/exportXls")
+	@RequiresPermissions("dict:export")
 	public ModelAndView exportXls(SysDict sysDict, HttpServletRequest request) {
 		// Step.1 组装查询条件
 		QueryWrapper<SysDict> queryWrapper = QueryGenerator.initQueryWrapper(sysDict, request.getParameterMap());
@@ -461,6 +478,7 @@ public class SysDictController {
 
 
 	@PostMapping(value = "/importExcel")
+	@RequiresPermissions("dict:import")
 	public Results<JSONObject> importExcel(HttpServletRequest request, HttpServletResponse response) {
  		MultipartHttpServletRequest multipartRequest = (MultipartHttpServletRequest) request;
 		Map<String, MultipartFile> fileMap = multipartRequest.getFileMap();
@@ -535,6 +553,7 @@ public class SysDictController {
 	 * @return
 	 */
 	@GetMapping(value = "/deleteList")
+	@RequiresPermissions("dict:list")
 	public Results<List<SysDict>> deleteList() {
 		List<SysDict> list = this.sysDictService.queryDeleteList();
 		return Results.OK(list);
@@ -546,6 +565,7 @@ public class SysDictController {
 	 * @return
 	 */
 	@PostMapping(value = "/deletePhysic/{id}")
+	@RequiresPermissions("dict:delete")
 	public Results<T> deletePhysic(@PathVariable String id) {
 		try {
 			sysDictService.deleteOneDictPhysically(id);
@@ -562,6 +582,7 @@ public class SysDictController {
 	 * @return
 	 */
 	@PostMapping(value = "/back/{id}")
+	@RequiresPermissions("dict:edit")
 	public Results<T> back(@PathVariable String id) {
 		try {
 			sysDictService.updateDictDelFlag(0,id);

jero-boot/jero-boot-module-system/src/main/java/com/jero/modules/system/controller/SysPermissionController.java

@@ -69,7 +69,7 @@ public class SysPermissionController {
 	 * @return
 	 */
 	@GetMapping("/page")
-	@RequiresPermissions("PermissionList:list")
+	@RequiresPermissions("permission:list")
 	public Results<List<SysPermissionTree>> list() {
         long start = System.currentTimeMillis();
 		Results<List<SysPermissionTree>> result = new Results<>();
@@ -96,7 +96,7 @@ public class SysPermissionController {
 	 * @return
 	 */
 	@GetMapping("/getSystemMenuList")
-	@RequiresPermissions("PermissionList:list")
+	@RequiresPermissions("permission:list")
 	public Results<List<SysPermissionTree>> getSystemMenuList() {
         long start = System.currentTimeMillis();
 		Results<List<SysPermissionTree>> result = new Results<>();
@@ -126,7 +126,7 @@ public class SysPermissionController {
 	 * @return
 	 */
 	@GetMapping("/getSystemSubmenu")
-	@RequiresPermissions("PermissionList:list")
+	@RequiresPermissions("permission:list")
 	public Results<List<SysPermissionTree>> getSystemSubmenu(@RequestParam("parentId") String parentId){
 		Results<List<SysPermissionTree>> result = new Results<>();
 		try{
@@ -157,7 +157,7 @@ public class SysPermissionController {
 	 * @return 返回 key-value 的 Map
 	 */
 	@GetMapping("/getSystemSubmenuBatch")
-	@RequiresPermissions("PermissionList:list")
+	@RequiresPermissions("permission:list")
 	public Results<Map<String, List<SysPermissionTree>>> getSystemSubmenuBatch(@RequestParam("parentIds") String parentIds) {
 		try {
 			LambdaQueryWrapper<SysPermission> query = new LambdaQueryWrapper<>();
@@ -191,7 +191,7 @@ public class SysPermissionController {
 	 * @return
 	 */
 	@GetMapping("/getUserPermissionByToken")
-	@RequiresPermissions("PermissionList:list")
+	@RequiresPermissions("permission:list")
 	public Results<JSONObject> getUserPermissionByToken() {
 		Results<JSONObject> result = new Results<>();
 		try {
@@ -236,7 +236,7 @@ public class SysPermissionController {
 	 */
 	//@RequiresRoles({ "admin" })
 	@PostMapping("/add")
-	@RequiresPermissions("PermissionList:add")
+	@RequiresPermissions("permission:add")
 	public Results<Object> add(@RequestBody SysPermission permission) {
 		try {
 			permission = PermissionDataUtil.intelligentProcessData(permission);
@@ -255,7 +255,7 @@ public class SysPermissionController {
 	 */
 	//@RequiresRoles({ "admin" })
 	@PostMapping("/edit")
-	@RequiresPermissions("PermissionList:edit")
+	@RequiresPermissions("permission:edit")
 	public Results<Object> edit(@RequestBody SysPermission permission) {
 		try {
 			permission = PermissionDataUtil.intelligentProcessData(permission);
@@ -274,7 +274,7 @@ public class SysPermissionController {
 	 */
 	//@RequiresRoles({ "admin" })
 	@PostMapping("/delete")
-	@RequiresPermissions("PermissionList:delete")
+	@RequiresPermissions("permission:delete")
 	public Results<T> delete(@RequestBody Map<String, String> map) {
 		String id = map.get("id");
 		if(StringUtils.isBlank(id)){
@@ -296,7 +296,7 @@ public class SysPermissionController {
 	 */
 	//@RequiresRoles({ "admin" })
 	@PostMapping("/deleteBatch")
-	@RequiresPermissions("PermissionList:delete")
+	@RequiresPermissions("permission:delete")
 	public Results<T> deleteBatch(@RequestBody Map<String, String> map) {
 		String ids = map.get("ids");
 		if(StringUtils.isBlank(ids)){
@@ -322,7 +322,7 @@ public class SysPermissionController {
 	 * @return
 	 */
 	@GetMapping("/queryTreeList")
-	@RequiresPermissions("PermissionList:list")
+	@RequiresPermissions("permission:list")
 	public Results<Map<String, Object>> queryTreeList() {
 		Results<Map<String, Object>> result = new Results<>();
 		// 全部权限ids
@@ -355,7 +355,7 @@ public class SysPermissionController {
 	 * @return
 	 */
 	@GetMapping("/queryListAsync")
-	@RequiresPermissions("PermissionList:list")
+	@RequiresPermissions("permission:list")
 	public Results<List<TreeModel>> queryAsync(@RequestParam(name = "pid", required = false) String parentId) {
 		Results<List<TreeModel>> result = new Results<>();
 		try {
@@ -379,7 +379,7 @@ public class SysPermissionController {
 	 * @return
 	 */
 	@GetMapping("/queryRolePermission")
-	@RequiresPermissions("PermissionList:list")
+	@RequiresPermissions("permission:list")
 	public Results<List<String>> queryRolePermission(@RequestParam(name = "roleId", required = true) String roleId) {
 		Results<List<String>> result = new Results<>();
 		try {
@@ -398,7 +398,7 @@ public class SysPermissionController {
 	 * @return
 	 */
 	@PostMapping("/saveRolePermission")
-	@RequiresPermissions("PermissionList:add")
+	@RequiresPermissions("permission:add")
 	//@RequiresRoles({ "admin" })
 	public Results<String> saveRolePermission(@RequestBody JSONObject json) {
 		long start = System.currentTimeMillis();
@@ -669,7 +669,7 @@ public class SysPermissionController {
 	 * @return
 	 */
 	@GetMapping("/getPermRuleListByPermId")
-	@RequiresPermissions("PermissionList:list")
+	@RequiresPermissions("permission:list")
 	public Results<List<SysPermissionDataRule>> getPermRuleListByPermId(SysPermissionDataRule sysPermissionDataRule) {
 		List<SysPermissionDataRule> permRuleList = sysPermissionDataRuleService.getPermRuleListByPermId(sysPermissionDataRule.getPermissionId());
 		Results<List<SysPermissionDataRule>> result = new Results<>();
@@ -686,7 +686,7 @@ public class SysPermissionController {
 	 */
 	//@RequiresRoles({ "admin" })
 	@PostMapping("/addPermissionRule")
-	@RequiresPermissions("PermissionList:add")
+	@RequiresPermissions("permission:add")
 	public Results<Object> addPermissionRule(@RequestBody SysPermissionDataRule sysPermissionDataRule) {
 		try {
 			sysPermissionDataRule.setCreateTime(new Date());
@@ -700,7 +700,7 @@ public class SysPermissionController {
 
 	//@RequiresRoles({ "admin" })
 	@PostMapping("/editPermissionRule")
-	@RequiresPermissions("PermissionList:edit")
+	@RequiresPermissions("permission:edit")
 	public Results<Object> editPermissionRule(@RequestBody SysPermissionDataRule sysPermissionDataRule) {
 		try {
 			sysPermissionDataRuleService.saveOrUpdate(sysPermissionDataRule);
@@ -719,7 +719,7 @@ public class SysPermissionController {
 	 */
 	//@RequiresRoles({ "admin" })
 	@PostMapping("/deletePermissionRule")
-	@RequiresPermissions("PermissionList:delete")
+	@RequiresPermissions("permission:delete")
 	public Results<Object> deletePermissionRule(@RequestBody Map<String,String> map) {
 		try {
 			String id = map.get("id");
@@ -741,7 +741,7 @@ public class SysPermissionController {
 	 * @return
 	 */
 	@GetMapping("/queryPermissionRule")
-	@RequiresPermissions("PermissionList:list")
+	@RequiresPermissions("permission:list")
 	public Results<List<SysPermissionDataRule>> queryPermissionRule(SysPermissionDataRule sysPermissionDataRule) {
 		try {
 			List<SysPermissionDataRule> permRuleList = sysPermissionDataRuleService.queryPermissionRule(sysPermissionDataRule);
@@ -758,7 +758,7 @@ public class SysPermissionController {
 	 * @return
 	 */
 	@GetMapping("/queryDepartPermission")
-	@RequiresPermissions("PermissionList:list")
+	@RequiresPermissions("permission:list")
 	public Results<List<String>> queryDepartPermission(@RequestParam(name = "departId", required = true) String departId) {
 		Results<List<String>> result = new Results<>();
 		try {
@@ -777,7 +777,7 @@ public class SysPermissionController {
 	 * @return
 	 */
 	@PostMapping("/saveDepartPermission")
-	@RequiresPermissions("PermissionList:add")
+	@RequiresPermissions("permission:add")
 	//@RequiresRoles({ "admin" })
 	public Results<String> saveDepartPermission(@RequestBody JSONObject json) {
 		long start = System.currentTimeMillis();