KH/kh-device-admin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix 68486 【垂直越权】系统管理-数据字典 接口未处理越权

Browse Source
This commit is contained in:
liao
2023-05-06 15:22:24 +08:00
parent ce487b42b7
commit 91a5d4ae48
3 changed files with 647 additions and 595 deletions
Download Patch File Download Diff File Expand all files Collapse all files
jero-boot/db/20230506处理垂直越权.sql
+31
View File
@@ -0,0 +1,31 @@
-- ----------------------------
-- 系统管理-菜单管理（增删查改权限）
-- ----------------------------
-- 权限数据 --
INSERT INTO `sys_permission` VALUES ('1654673897041223683', '54dd5457a3190740005c1bfec55b1c34', '查询', NULL, NULL, NULL, NULL, 2, 'permission:list', '1', NULL, 0, NULL, 1, 1, 0, 0, NULL, 'admin', '2023-05-06 10:26:14', NULL, NULL, 0, 0, '1', 0);
INSERT INTO `sys_permission` VALUES ('1654675497143033857', '54dd5457a3190740005c1bfec55b1c34', '添加', NULL, NULL, NULL, NULL, 2, 'permission:add', '1', NULL, 0, NULL, 1, 1, 0, 0, NULL, 'admin', '2023-05-06 10:32:36', NULL, NULL, 0, 0, '1', 0);
INSERT INTO `sys_permission` VALUES ('1654675694854135809', '54dd5457a3190740005c1bfec55b1c34', '删除', NULL, NULL, NULL, NULL, 2, 'permission:delete', '1', NULL, 0, NULL, 1, 1, 0, 0, NULL, 'admin', '2023-05-06 10:33:23', NULL, NULL, 0, 0, '1', 0);
INSERT INTO `sys_permission` VALUES ('1654675850508951554', '54dd5457a3190740005c1bfec55b1c34', '编辑', NULL, NULL, NULL, NULL, 2, 'permission:edit', '1', NULL, 0, NULL, 1, 1, 0, 0, NULL, 'admin', '2023-05-06 10:34:00', NULL, NULL, 0, 0, '1', 0);
-- 权限与admin角色关联数据 --
INSERT INTO `sys_role_permission` VALUES ('1654675964954730498', 'f6817f48af4fb3af11b9e8bf182f618b', '1654673897041223683', NULL, '2023-05-06 10:34:27', '127.0.0.1');
INSERT INTO `sys_role_permission` VALUES ('1654675964984090626', 'f6817f48af4fb3af11b9e8bf182f618b', '1654675497143033857', NULL, '2023-05-06 10:34:27', '127.0.0.1');
INSERT INTO `sys_role_permission` VALUES ('1654675964988284929', 'f6817f48af4fb3af11b9e8bf182f618b', '1654675694854135809', NULL, '2023-05-06 10:34:27', '127.0.0.1');
INSERT INTO `sys_role_permission` VALUES ('1654675964992479233', 'f6817f48af4fb3af11b9e8bf182f618b', '1654675850508951554', NULL, '2023-05-06 10:34:27', '127.0.0.1');
-- ----------------------------
-- 系统管理-数据字典（增删查改、导出导入权限）
-- ----------------------------
-- 权限数据 --
INSERT INTO `sys_permission` VALUES ('1654744031105675265', 'f1cb187abf927c88b89470d08615f5ac', '查询', NULL, NULL, NULL, NULL, 2, 'dict:list', '1', NULL, 0, NULL, 1, 1, 0, 0, NULL, 'admin', '2023-05-06 15:04:55', NULL, NULL, 0, 0, '1', 0);
INSERT INTO `sys_permission` VALUES ('1654744160357347330', 'f1cb187abf927c88b89470d08615f5ac', '添加', NULL, NULL, NULL, NULL, 2, 'dict:add', '1', NULL, 0, NULL, 1, 1, 0, 0, NULL, 'admin', '2023-05-06 15:05:26', NULL, NULL, 0, 0, '1', 0);
INSERT INTO `sys_permission` VALUES ('1654744259787517954', 'f1cb187abf927c88b89470d08615f5ac', '删除', NULL, NULL, NULL, NULL, 2, 'dict:delete', '1', NULL, 0, NULL, 1, 1, 0, 0, NULL, 'admin', '2023-05-06 15:05:50', NULL, NULL, 0, 0, '1', 0);
INSERT INTO `sys_permission` VALUES ('1654744350615171074', 'f1cb187abf927c88b89470d08615f5ac', '编辑', NULL, NULL, NULL, NULL, 2, 'dict:edit', '1', NULL, 0, NULL, 1, 1, 0, 0, NULL, 'admin', '2023-05-06 15:06:12', NULL, NULL, 0, 0, '1', 0);
INSERT INTO `sys_permission` VALUES ('1654746352959123457', 'f1cb187abf927c88b89470d08615f5ac', '导出', NULL, NULL, NULL, NULL, 2, 'dict:export', '1', NULL, 0, NULL, 1, 1, 0, 0, NULL, 'admin', '2023-05-06 15:14:09', NULL, NULL, 0, 0, '1', 0);
INSERT INTO `sys_permission` VALUES ('1654746470756151297', 'f1cb187abf927c88b89470d08615f5ac', '导入', NULL, NULL, NULL, NULL, 2, 'dict:import', '1', NULL, 0, NULL, 1, 1, 0, 0, NULL, 'admin', '2023-05-06 15:14:37', NULL, NULL, 0, 0, '1', 0);
-- 权限与admin角色关联数据 --
INSERT INTO `sys_role_permission` VALUES ('1654747707610263553', 'f6817f48af4fb3af11b9e8bf182f618b', '1654744031105675265', NULL, '2023-05-06 15:19:32', '127.0.0.1');
INSERT INTO `sys_role_permission` VALUES ('1654747707627040770', 'f6817f48af4fb3af11b9e8bf182f618b', '1654744160357347330', NULL, '2023-05-06 15:19:32', '127.0.0.1');
INSERT INTO `sys_role_permission` VALUES ('1654747707627040771', 'f6817f48af4fb3af11b9e8bf182f618b', '1654744259787517954', NULL, '2023-05-06 15:19:32', '127.0.0.1');
INSERT INTO `sys_role_permission` VALUES ('1654747707631235073', 'f6817f48af4fb3af11b9e8bf182f618b', '1654744350615171074', NULL, '2023-05-06 15:19:32', '127.0.0.1');
INSERT INTO `sys_role_permission` VALUES ('1654747707631235074', 'f6817f48af4fb3af11b9e8bf182f618b', '1654746352959123457', NULL, '2023-05-06 15:19:32', '127.0.0.1');
INSERT INTO `sys_role_permission` VALUES ('1654747707635429378', 'f6817f48af4fb3af11b9e8bf182f618b', '1654746470756151297', NULL, '2023-05-06 15:19:32', '127.0.0.1');
jero-boot/jero-boot-module-system/src/main/java/com/jero/modules/system/controller/SysDictController.java
+596 -575
View File
File diff suppressed because it is too large Load Diff
jero-boot/jero-boot-module-system/src/main/java/com/jero/modules/system/controller/SysPermissionController.java
+20 -20
View File
@@ -69,7 +69,7 @@ public class SysPermissionController {
* @return
*/
@GetMapping("/page")
@RequiresPermissions("PermissionList:list")
@RequiresPermissions("permission:list")
public Results<List<SysPermissionTree>> list() {
long start = System.currentTimeMillis();
Results<List<SysPermissionTree>> result = new Results<>();
@@ -96,7 +96,7 @@ public class SysPermissionController {
* @return
*/
@GetMapping("/getSystemMenuList")
@RequiresPermissions("PermissionList:list")
@RequiresPermissions("permission:list")
public Results<List<SysPermissionTree>> getSystemMenuList() {
long start = System.currentTimeMillis();
Results<List<SysPermissionTree>> result = new Results<>();
@@ -126,7 +126,7 @@ public class SysPermissionController {
* @return
*/
@GetMapping("/getSystemSubmenu")
@RequiresPermissions("PermissionList:list")
@RequiresPermissions("permission:list")
public Results<List<SysPermissionTree>> getSystemSubmenu(@RequestParam("parentId") String parentId){
Results<List<SysPermissionTree>> result = new Results<>();
try{
@@ -157,7 +157,7 @@ public class SysPermissionController {
* @return 返回 key-value 的 Map
*/
@GetMapping("/getSystemSubmenuBatch")
@RequiresPermissions("PermissionList:list")
@RequiresPermissions("permission:list")
public Results<Map<String, List<SysPermissionTree>>> getSystemSubmenuBatch(@RequestParam("parentIds") String parentIds) {
try {
LambdaQueryWrapper<SysPermission> query = new LambdaQueryWrapper<>();
@@ -191,7 +191,7 @@ public class SysPermissionController {
* @return
*/
@GetMapping("/getUserPermissionByToken")
@RequiresPermissions("PermissionList:list")
@RequiresPermissions("permission:list")
public Results<JSONObject> getUserPermissionByToken() {
Results<JSONObject> result = new Results<>();
try {
@@ -236,7 +236,7 @@ public class SysPermissionController {
*/
//@RequiresRoles({ "admin" })
@PostMapping("/add")
@RequiresPermissions("PermissionList:add")
@RequiresPermissions("permission:add")
public Results<Object> add(@RequestBody SysPermission permission) {
try {
permission = PermissionDataUtil.intelligentProcessData(permission);
@@ -255,7 +255,7 @@ public class SysPermissionController {
*/
//@RequiresRoles({ "admin" })
@PostMapping("/edit")
@RequiresPermissions("PermissionList:edit")
@RequiresPermissions("permission:edit")
public Results<Object> edit(@RequestBody SysPermission permission) {
try {
permission = PermissionDataUtil.intelligentProcessData(permission);
@@ -274,7 +274,7 @@ public class SysPermissionController {
*/
//@RequiresRoles({ "admin" })
@PostMapping("/delete")
@RequiresPermissions("PermissionList:delete")
@RequiresPermissions("permission:delete")
public Results<T> delete(@RequestBody Map<String, String> map) {
String id = map.get("id");
if(StringUtils.isBlank(id)){
@@ -296,7 +296,7 @@ public class SysPermissionController {
*/
//@RequiresRoles({ "admin" })
@PostMapping("/deleteBatch")
@RequiresPermissions("PermissionList:delete")
@RequiresPermissions("permission:delete")
public Results<T> deleteBatch(@RequestBody Map<String, String> map) {
String ids = map.get("ids");
if(StringUtils.isBlank(ids)){
@@ -322,7 +322,7 @@ public class SysPermissionController {
* @return
*/
@GetMapping("/queryTreeList")
@RequiresPermissions("PermissionList:list")
@RequiresPermissions("permission:list")
public Results<Map<String, Object>> queryTreeList() {
Results<Map<String, Object>> result = new Results<>();
// 全部权限ids
@@ -355,7 +355,7 @@ public class SysPermissionController {
* @return
*/
@GetMapping("/queryListAsync")
@RequiresPermissions("PermissionList:list")
@RequiresPermissions("permission:list")
public Results<List<TreeModel>> queryAsync(@RequestParam(name = "pid", required = false) String parentId) {
Results<List<TreeModel>> result = new Results<>();
try {
@@ -379,7 +379,7 @@ public class SysPermissionController {
* @return
*/
@GetMapping("/queryRolePermission")
@RequiresPermissions("PermissionList:list")
@RequiresPermissions("permission:list")
public Results<List<String>> queryRolePermission(@RequestParam(name = "roleId", required = true) String roleId) {
Results<List<String>> result = new Results<>();
try {
@@ -398,7 +398,7 @@ public class SysPermissionController {
* @return
*/
@PostMapping("/saveRolePermission")
@RequiresPermissions("PermissionList:add")
@RequiresPermissions("permission:add")
//@RequiresRoles({ "admin" })
public Results<String> saveRolePermission(@RequestBody JSONObject json) {
long start = System.currentTimeMillis();
@@ -669,7 +669,7 @@ public class SysPermissionController {
* @return
*/
@GetMapping("/getPermRuleListByPermId")
@RequiresPermissions("PermissionList:list")
@RequiresPermissions("permission:list")
public Results<List<SysPermissionDataRule>> getPermRuleListByPermId(SysPermissionDataRule sysPermissionDataRule) {
List<SysPermissionDataRule> permRuleList = sysPermissionDataRuleService.getPermRuleListByPermId(sysPermissionDataRule.getPermissionId());
Results<List<SysPermissionDataRule>> result = new Results<>();
@@ -686,7 +686,7 @@ public class SysPermissionController {
*/
//@RequiresRoles({ "admin" })
@PostMapping("/addPermissionRule")
@RequiresPermissions("PermissionList:add")
@RequiresPermissions("permission:add")
public Results<Object> addPermissionRule(@RequestBody SysPermissionDataRule sysPermissionDataRule) {
try {
sysPermissionDataRule.setCreateTime(new Date());
@@ -700,7 +700,7 @@ public class SysPermissionController {
//@RequiresRoles({ "admin" })
@PostMapping("/editPermissionRule")
@RequiresPermissions("PermissionList:edit")
@RequiresPermissions("permission:edit")
public Results<Object> editPermissionRule(@RequestBody SysPermissionDataRule sysPermissionDataRule) {
try {
sysPermissionDataRuleService.saveOrUpdate(sysPermissionDataRule);
@@ -719,7 +719,7 @@ public class SysPermissionController {
*/
//@RequiresRoles({ "admin" })
@PostMapping("/deletePermissionRule")
@RequiresPermissions("PermissionList:delete")
@RequiresPermissions("permission:delete")
public Results<Object> deletePermissionRule(@RequestBody Map<String,String> map) {
try {
String id = map.get("id");
@@ -741,7 +741,7 @@ public class SysPermissionController {
* @return
*/
@GetMapping("/queryPermissionRule")
@RequiresPermissions("PermissionList:list")
@RequiresPermissions("permission:list")
public Results<List<SysPermissionDataRule>> queryPermissionRule(SysPermissionDataRule sysPermissionDataRule) {
try {
List<SysPermissionDataRule> permRuleList = sysPermissionDataRuleService.queryPermissionRule(sysPermissionDataRule);
@@ -758,7 +758,7 @@ public class SysPermissionController {
* @return
*/
@GetMapping("/queryDepartPermission")
@RequiresPermissions("PermissionList:list")
@RequiresPermissions("permission:list")
public Results<List<String>> queryDepartPermission(@RequestParam(name = "departId", required = true) String departId) {
Results<List<String>> result = new Results<>();
try {
@@ -777,7 +777,7 @@ public class SysPermissionController {
* @return
*/
@PostMapping("/saveDepartPermission")
@RequiresPermissions("PermissionList:add")
@RequiresPermissions("permission:add")
//@RequiresRoles({ "admin" })
public Results<String> saveDepartPermission(@RequestBody JSONObject json) {
long start = System.currentTimeMillis();