【fix bug】67865

jero-boot/jero-boot-module-system/src/main/java/com/jero/modules/system/service/impl/LoginServiceImpl.java

@@ -16,12 +16,14 @@ import com.jero.common.util.*;
 import com.jero.common.util.encryption.EncryptedString;
 import com.jero.modules.base.service.BaseCommonService;
 import com.jero.modules.system.entity.SysDepart;
+import com.jero.modules.system.entity.SysPermission;
 import com.jero.modules.system.entity.SysTenant;
 import com.jero.modules.system.entity.SysUser;
 import com.jero.modules.system.model.SysLoginModel;
 import com.jero.modules.system.service.*;
 import com.jero.modules.system.util.RandImageUtil;
 import lombok.extern.slf4j.Slf4j;
+import org.apache.commons.collections4.CollectionUtils;
 import org.apache.poi.ss.formula.functions.T;
 import org.apache.shiro.SecurityUtils;
 import org.springframework.beans.BeanUtils;
@@ -56,6 +58,8 @@ public class LoginServiceImpl implements ILoginService {
     private ISysDictService sysDictService;
     @Resource
     private BaseCommonService baseCommonService;
+    @Resource
+    private ISysPermissionService sysPermissionService;
 
     private static final String BASE_CHECK_CODES = "qwertyuiplkjhgfdsazxcvbnmQWERTYUPLKJHGFDSAZXCVBNM1234567890";
     //密码登录错误的次数前缀
@@ -137,6 +141,15 @@ public class LoginServiceImpl implements ILoginService {
         }
         //登录成功，清除错误登录次数
         redisUtil.del(RETRY_LOGIN_PREFIX + username);
+        // 登录成功之后验证是否有权限
+        List<SysPermission> metaList = sysPermissionService.queryByUser(username);
+        if(CollectionUtils.isEmpty(metaList)){
+            return Results.error("该用户无权限，请联系管理员！");
+        }
+        long l = metaList.stream().filter(o->Objects.equals(o.getMenuType(),0)).count();
+        if(l <= 0){
+            return Results.error("该用户无权限，请联系管理员！");
+        }
 
         //用户登录信息
         userInfo(sysUser, result);