KH/kh-device-admin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix 68490 【垂直越权】系统管理-菜单管理 接口未处理越权

Browse Source
This commit is contained in:
liao
2023-05-06 10:42:58 +08:00
parent 75b8f4a40c
commit 81060cc84f
1 changed files with 21 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
jero-boot/jero-boot-module-system/src/main/java/com/jero/modules/system/controller/SysPermissionController.java
+21
View File
@@ -24,6 +24,7 @@ import lombok.extern.slf4j.Slf4j;
import org.apache.commons.lang.StringUtils;
import org.apache.poi.ss.formula.functions.T;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authz.annotation.RequiresPermissions;
import org.jetbrains.annotations.NotNull;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.web.bind.annotation.*;
@@ -68,6 +69,7 @@ public class SysPermissionController {
* @return
*/
@GetMapping("/page")
@RequiresPermissions("PermissionList:list")
public Results<List<SysPermissionTree>> list() {
long start = System.currentTimeMillis();
Results<List<SysPermissionTree>> result = new Results<>();
@@ -94,6 +96,7 @@ public class SysPermissionController {
* @return
*/
@GetMapping("/getSystemMenuList")
@RequiresPermissions("PermissionList:list")
public Results<List<SysPermissionTree>> getSystemMenuList() {
long start = System.currentTimeMillis();
Results<List<SysPermissionTree>> result = new Results<>();
@@ -123,6 +126,7 @@ public class SysPermissionController {
* @return
*/
@GetMapping("/getSystemSubmenu")
@RequiresPermissions("PermissionList:list")
public Results<List<SysPermissionTree>> getSystemSubmenu(@RequestParam("parentId") String parentId){
Results<List<SysPermissionTree>> result = new Results<>();
try{
@@ -153,6 +157,7 @@ public class SysPermissionController {
* @return 返回 key-value 的 Map
*/
@GetMapping("/getSystemSubmenuBatch")
@RequiresPermissions("PermissionList:list")
public Results<Map<String, List<SysPermissionTree>>> getSystemSubmenuBatch(@RequestParam("parentIds") String parentIds) {
try {
LambdaQueryWrapper<SysPermission> query = new LambdaQueryWrapper<>();
@@ -186,6 +191,7 @@ public class SysPermissionController {
* @return
*/
@GetMapping("/getUserPermissionByToken")
@RequiresPermissions("PermissionList:list")
public Results<JSONObject> getUserPermissionByToken() {
Results<JSONObject> result = new Results<>();
try {
@@ -230,6 +236,7 @@ public class SysPermissionController {
*/
//@RequiresRoles({ "admin" })
@PostMapping("/add")
@RequiresPermissions("PermissionList:add")
public Results<Object> add(@RequestBody SysPermission permission) {
try {
permission = PermissionDataUtil.intelligentProcessData(permission);
@@ -248,6 +255,7 @@ public class SysPermissionController {
*/
//@RequiresRoles({ "admin" })
@PostMapping("/edit")
@RequiresPermissions("PermissionList:edit")
public Results<Object> edit(@RequestBody SysPermission permission) {
try {
permission = PermissionDataUtil.intelligentProcessData(permission);
@@ -266,6 +274,7 @@ public class SysPermissionController {
*/
//@RequiresRoles({ "admin" })
@PostMapping("/delete")
@RequiresPermissions("PermissionList:delete")
public Results<T> delete(@RequestBody Map<String, String> map) {
String id = map.get("id");
if(StringUtils.isBlank(id)){
@@ -287,6 +296,7 @@ public class SysPermissionController {
*/
//@RequiresRoles({ "admin" })
@PostMapping("/deleteBatch")
@RequiresPermissions("PermissionList:delete")
public Results<T> deleteBatch(@RequestBody Map<String, String> map) {
String ids = map.get("ids");
if(StringUtils.isBlank(ids)){
@@ -312,6 +322,7 @@ public class SysPermissionController {
* @return
*/
@GetMapping("/queryTreeList")
@RequiresPermissions("PermissionList:list")
public Results<Map<String, Object>> queryTreeList() {
Results<Map<String, Object>> result = new Results<>();
// 全部权限ids
@@ -344,6 +355,7 @@ public class SysPermissionController {
* @return
*/
@GetMapping("/queryListAsync")
@RequiresPermissions("PermissionList:list")
public Results<List<TreeModel>> queryAsync(@RequestParam(name = "pid", required = false) String parentId) {
Results<List<TreeModel>> result = new Results<>();
try {
@@ -367,6 +379,7 @@ public class SysPermissionController {
* @return
*/
@GetMapping("/queryRolePermission")
@RequiresPermissions("PermissionList:list")
public Results<List<String>> queryRolePermission(@RequestParam(name = "roleId", required = true) String roleId) {
Results<List<String>> result = new Results<>();
try {
@@ -385,6 +398,7 @@ public class SysPermissionController {
* @return
*/
@PostMapping("/saveRolePermission")
@RequiresPermissions("PermissionList:add")
//@RequiresRoles({ "admin" })
public Results<String> saveRolePermission(@RequestBody JSONObject json) {
long start = System.currentTimeMillis();
@@ -655,6 +669,7 @@ public class SysPermissionController {
* @return
*/
@GetMapping("/getPermRuleListByPermId")
@RequiresPermissions("PermissionList:list")
public Results<List<SysPermissionDataRule>> getPermRuleListByPermId(SysPermissionDataRule sysPermissionDataRule) {
List<SysPermissionDataRule> permRuleList = sysPermissionDataRuleService.getPermRuleListByPermId(sysPermissionDataRule.getPermissionId());
Results<List<SysPermissionDataRule>> result = new Results<>();
@@ -671,6 +686,7 @@ public class SysPermissionController {
*/
//@RequiresRoles({ "admin" })
@PostMapping("/addPermissionRule")
@RequiresPermissions("PermissionList:add")
public Results<Object> addPermissionRule(@RequestBody SysPermissionDataRule sysPermissionDataRule) {
try {
sysPermissionDataRule.setCreateTime(new Date());
@@ -684,6 +700,7 @@ public class SysPermissionController {
//@RequiresRoles({ "admin" })
@PostMapping("/editPermissionRule")
@RequiresPermissions("PermissionList:edit")
public Results<Object> editPermissionRule(@RequestBody SysPermissionDataRule sysPermissionDataRule) {
try {
sysPermissionDataRuleService.saveOrUpdate(sysPermissionDataRule);
@@ -702,6 +719,7 @@ public class SysPermissionController {
*/
//@RequiresRoles({ "admin" })
@PostMapping("/deletePermissionRule")
@RequiresPermissions("PermissionList:delete")
public Results<Object> deletePermissionRule(@RequestBody Map<String,String> map) {
try {
String id = map.get("id");
@@ -723,6 +741,7 @@ public class SysPermissionController {
* @return
*/
@GetMapping("/queryPermissionRule")
@RequiresPermissions("PermissionList:list")
public Results<List<SysPermissionDataRule>> queryPermissionRule(SysPermissionDataRule sysPermissionDataRule) {
try {
List<SysPermissionDataRule> permRuleList = sysPermissionDataRuleService.queryPermissionRule(sysPermissionDataRule);
@@ -739,6 +758,7 @@ public class SysPermissionController {
* @return
*/
@GetMapping("/queryDepartPermission")
@RequiresPermissions("PermissionList:list")
public Results<List<String>> queryDepartPermission(@RequestParam(name = "departId", required = true) String departId) {
Results<List<String>> result = new Results<>();
try {
@@ -757,6 +777,7 @@ public class SysPermissionController {
* @return
*/
@PostMapping("/saveDepartPermission")
@RequiresPermissions("PermissionList:add")
//@RequiresRoles({ "admin" })
public Results<String> saveDepartPermission(@RequestBody JSONObject json) {
long start = System.currentTimeMillis();