fix 68476 【垂直越权】系统管理-人员管理接口未处理越权

jero-boot/jero-boot-module-system/src/main/java/com/jero/modules/system/controller/SysUserController.java

@@ -254,6 +254,7 @@ public class SysUserController {
     }
 
     @PostMapping("/delete")
+    @RequiresPermissions("sys:user:sel")
     public Results<T> delete(@RequestBody Map<String,String> map) {
         String id = map.get("id");
         if(StringUtils.isBlank(id)){
@@ -265,6 +266,7 @@ public class SysUserController {
 	}
 
     @PostMapping("/deleteBatch")
+    @RequiresPermissions("sys:user:sel")
     public Results<T> deleteBatch(@RequestBody Map<String, String> map) {
         String ids = map.get("ids");
         if(StringUtils.isBlank(ids)){
@@ -276,7 +278,7 @@ public class SysUserController {
 	}
 
 
-    //@RequiresPermissions("sys:user:list")
+    @RequiresPermissions("user:edit")
     @PostMapping("/frozenBatch")
 	public Results<Object> frozenBatch(@RequestBody JSONObject jsonObject) {
 		try {
@@ -296,7 +298,7 @@ public class SysUserController {
         return Results.OK(OPTION_SUCCESS);
 
     }
-    //@RequiresPermissions("sys:user:list")
+    @RequiresPermissions("sys:user:list")
 //    @RequestMapping(value = "/queryById", method = RequestMethod.GET)
     @GetMapping("/queryById")
     public Results<SysUser> queryById(@RequestParam(name = "id", required = true) String id) {
@@ -308,7 +310,7 @@ public class SysUserController {
         }
     }
 
-    //@RequiresPermissions("sys:user:list")
+    @RequiresPermissions("sys:user:list")
 //    @RequestMapping(value = "/queryUserRole", method = RequestMethod.GET)
     @GetMapping("/queryUserRole")
     public Results<List<String>> queryUserRole(@RequestParam(name = "userid", required = true) String userid) {
@@ -332,7 +334,7 @@ public class SysUserController {
      * @param sysUser
      * @return
      */
-    //@RequiresPermissions("sys:user:list")
+    @RequiresPermissions("sys:user:list")
 //    @RequestMapping(value = "/checkOnlyUser", method = RequestMethod.GET)
     @GetMapping("/checkOnlyUser")
     public Results<Boolean> checkOnlyUser(SysUser sysUser) {
@@ -363,6 +365,7 @@ public class SysUserController {
      */
 //    @RequestMapping(value = "/changePassword", method = RequestMethod.PUT)
     @PostMapping("/changePassword")
+    @RequiresPermissions("user:edit")
     public Results<T> changePassword(@RequestBody SysUser sysUser) {
         SysUser u = this.sysUserService.getOne(new LambdaQueryWrapper<SysUser>().eq(SysUser::getUsername, sysUser.getUsername()));
         if (u == null) {
@@ -378,7 +381,7 @@ public class SysUserController {
      * @param userId
      * @return
      */
-    //@RequiresPermissions("sys:user:list")
+    @RequiresPermissions("sys:user:list")
 //    @RequestMapping(value = "/userDepartList", method = RequestMethod.GET)
     @GetMapping("/userDepartList")
     public Results<List<DepartIdModel>> getUserDepartsList(@RequestParam(name = "userId", required = true) String userId) {
@@ -408,7 +411,7 @@ public class SysUserController {
      *
      * @return
      */
-    //@RequiresPermissions("sys:user:list")
+    @RequiresPermissions("sys:user:list")
 //    @RequestMapping(value = "/generateUserId", method = RequestMethod.GET)
     @GetMapping("/generateUserId")
     public Results<String> generateUserId() {
@@ -426,7 +429,7 @@ public class SysUserController {
      * @param id
      * @return
      */
-    //@RequiresPermissions("sys:user:list")
+    @RequiresPermissions("sys:user:list")
 //    @RequestMapping(value = "/queryUserByDepId", method = RequestMethod.GET)
     @GetMapping("/queryUserByDepId")
     public Results<List<SysUser>> queryUserByDepId(@RequestParam(name = "id", required = true) String id, @RequestParam(name="realname",required=false) String realname , @RequestParam(name="username",required=false) String username) {
@@ -475,6 +478,7 @@ public class SysUserController {
      */
 //    @RequestMapping(value = "/queryUserComponentData", method = RequestMethod.GET)
     @GetMapping("/queryUserComponentData")
+    @RequiresPermissions("sys:user:list")
     public Results<IPage<SysUser>> queryUserComponentData(
             @RequestParam(name="pageNo", defaultValue="1") Integer pageNo,
             @RequestParam(name="pageSize", defaultValue="10") Integer pageSize,
@@ -638,6 +642,7 @@ public class SysUserController {
 	 */
     //@RequiresPermissions("sys:user:list")
     @GetMapping("/queryByIds")
+    @RequiresPermissions("sys:user:list")
 	public Results<Collection<SysUser>> queryByIds(@RequestParam String userIds) {
 		Results<Collection<SysUser>> result = new Results<>();
 		String[] userId = userIds.split(",");
@@ -655,6 +660,7 @@ public class SysUserController {
 	 * 首页用户重置密码
 	 */
     @PostMapping("/updatePassword")
+    @RequiresPermissions("user:edit")
 	public Results<T> updatePassword(@RequestBody JSONObject json) {
 		String username = json.getString(USER_NAME);
 		String oldpassword = json.getString("oldpassword");
@@ -683,7 +689,7 @@ public class SysUserController {
 		}
 		return sysUserService.resetPassword(username,oldpassword,password,confirmpassword);
 	}
-    //@RequiresPermissions("sys:user:list")
+    @RequiresPermissions("sys:user:list")
 //    @RequestMapping(value = "/userRoleList", method = RequestMethod.GET)
     @GetMapping("/userRoleList")
     public Results<IPage<SysUser>> userRoleList(@RequestParam(name="pageNo", defaultValue="1") Integer pageNo,
@@ -741,6 +747,7 @@ public class SysUserController {
      */
 //    @RequestMapping(value = "/deleteUserRole", method = RequestMethod.DELETE)
     @PostMapping("/deleteUserRole")
+    @RequiresPermissions("sys:user:sel")
     public Results<Object> deleteUserRole(@RequestParam(name="roleId") String roleId,
                                           @RequestParam(name="userId",required=true) String userId) {
           try {
@@ -762,6 +769,7 @@ public class SysUserController {
      */
 //    @RequestMapping(value = "/deleteUserRoleBatch", method = RequestMethod.DELETE)
     @PostMapping("/deleteUserRoleBatch")
+    @RequiresPermissions("sys:user:sel")
     public Results<SysUserRole> deleteUserRoleBatch(
             @RequestParam(name="roleId") String roleId,
             @RequestParam(name="userIds",required=true) String userIds) {
@@ -781,7 +789,7 @@ public class SysUserController {
      */
 //    @RequestMapping(value = "/departUserList", method = RequestMethod.GET)
     @GetMapping("/departUserList")
-    //@RequiresPermissions("sys:user:list")
+    @RequiresPermissions("sys:user:list")
     public Results<IPage<SysUser>> departUserList(@RequestParam(name="pageNo", defaultValue="1") Integer pageNo,
                                                   @RequestParam(name="pageSize", defaultValue="10") Integer pageSize, HttpServletRequest req) {
         Results<IPage<SysUser>> result = new Results<>();
@@ -831,7 +839,7 @@ public class SysUserController {
      * 若某个用户包含多个部门，则会显示多条记录，可自行处理成单条记录
      */
     @GetMapping("/queryByOrgCode")
-    //@RequiresPermissions("sys:user:list")
+    @RequiresPermissions("sys:user:list")
     public Results<IPage<SysUserSysDepartModel>> queryByDepartId(
             @RequestParam(name = "pageNo", defaultValue = "1") Integer pageNo,
             @RequestParam(name = "pageSize", defaultValue = "10") Integer pageSize,
@@ -877,6 +885,7 @@ public class SysUserController {
      */
 //    @RequestMapping(value = "/deleteUserInDepart", method = RequestMethod.DELETE)
     @PostMapping("/deleteUserInDepart")
+    @RequiresPermissions("sys:user:sel")
     public Results<Object> deleteUserInDepart(@RequestParam(name="depId") String depId,
                                               @RequestParam(name="userId",required=true) String userId) {
         try {
@@ -897,6 +906,7 @@ public class SysUserController {
 //    @RequestMapping(value = "/deleteUserInDepartBatch", method = RequestMethod.DELETE)
     @PostMapping("/deleteUserInDepartBatch")
     @Transactional
+    @RequiresPermissions("sys:user:sel")
     public Results<Object> deleteUserInDepartBatch(
             @RequestParam(name="depId") String depId,
             @RequestParam(name="userIds",required=true) String userIds) {
@@ -920,7 +930,7 @@ public class SysUserController {
          *  查询当前用户的所有部门/当前部门编码
      * @return
      */
-    //@RequiresPermissions("sys:user:list")
+    @RequiresPermissions("sys:user:list")
 //    @RequestMapping(value = "/getCurrentUserDeparts", method = RequestMethod.GET)
     @GetMapping("/getCurrentUserDeparts")
     public Results<Map<String,Object>> getCurrentUserDeparts() {
@@ -1133,7 +1143,7 @@ public class SysUserController {
 	 * @param pageSize
 	 * @return
 	 */
-    //@RequiresPermissions("sys:user:list")
+    @RequiresPermissions("sys:user:list")
 	@GetMapping("/appUserList")
 	public Results<IPage<SysUser>> appUserList(@RequestParam(name = "keyword", required = false) String keyword,
                                                @RequestParam(name = USER_NAME, required = false) String username,
@@ -1170,7 +1180,7 @@ public class SysUserController {
      *
      * @return logicDeletedUserList
      */
-    //@RequiresPermissions("sys:user:list")
+    @RequiresPermissions("sys:user:list")
     @GetMapping("/recycleBin")
     public Results<List<SysUser>> getRecycleBin() {
         List<SysUser> logicDeletedUserList = sysUserService.queryLogicDeleted();
@@ -1194,6 +1204,7 @@ public class SysUserController {
     //@RequiresPermissions("sys:user:list")
 //    @RequestMapping(value = "/putRecycleBin", method = RequestMethod.PUT)
     @PostMapping("/putRecycleBin")
+    @RequiresPermissions("user:edit")
     public Results<T> putRecycleBin(@RequestBody JSONObject jsonObject, HttpServletRequest request) {
         String userIds = jsonObject.getString("userIds");
         if (StringUtils.isNotBlank(userIds)) {
@@ -1213,6 +1224,7 @@ public class SysUserController {
      */
 //    @RequestMapping(value = "/deleteRecycleBin", method = RequestMethod.DELETE)
     @PostMapping("/deleteRecycleBin")
+    @RequiresPermissions("sys:user:sel")
     public Results<T> deleteRecycleBin(@RequestParam("userIds") String userIds) {
         if (StringUtils.isNotBlank(userIds)) {
             sysUserService.removeLogicDeleted(Arrays.asList(userIds.split(",")));