KH/kh-device-admin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix 68477 【垂直越权】系统管理-角色管理 接口未处理越权

Browse Source
This commit is contained in:
liao
2023-05-06 15:40:22 +08:00
parent 91a5d4ae48
commit e7f79873d4
1 changed files with 8 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
jero-boot/jero-boot-module-system/src/main/java/com/jero/modules/system/controller/SysRoleController.java
+8 -8
View File
@@ -81,7 +81,7 @@ public class SysRoleController {
* @param req
* @return
*/
//@RequiresPermissions("sys:role:list")
@RequiresPermissions("sys:role:list")
@GetMapping("/page")
public Results<IPage<SysRole>> queryPageList(SysRole role,
@RequestParam(name="pageNo", defaultValue="1") Integer pageNo,
@@ -181,7 +181,7 @@ public class SysRoleController {
* @param id
* @return
*/
//@RequiresPermissions("sys:role:list")
@RequiresPermissions("sys:role:list")
@GetMapping("/queryById")
public Results<SysRole> queryById(@RequestParam(name="id",required=true) String id) {
SysRole sysRole = sysRoleService.getById(id);
@@ -191,7 +191,7 @@ public class SysRoleController {
return Results.OK(sysRole);
}
}
//@RequiresPermissions("sys:role:list")
@RequiresPermissions("sys:role:list")
@GetMapping("/queryall")
public Results<List<SysRole>> queryall() {
List<SysRole> list = sysRoleService.list();
@@ -205,7 +205,7 @@ public class SysRoleController {
/**
* 校验角色编码唯一
*/
//@RequiresPermissions("sys:role:list")
@RequiresPermissions("sys:role:list")
@GetMapping("/checkRoleCode")
public Results<Boolean> checkUsername(String id, String roleCode) {
Results<Boolean> result = new Results<>();
@@ -292,7 +292,7 @@ public class SysRoleController {
/**
* 查询数据规则数据
*/
//@RequiresPermissions("sys:role:list")
@RequiresPermissions("sys:role:list")
@GetMapping(value = "/datarule/{permissionId}/{roleId}")
public Results<Map<String, Object>> loadDatarule(@PathVariable("permissionId") String permissionId, @PathVariable("roleId") String roleId) {
List<SysPermissionDataRule> list = sysPermissionDataRuleService.getPermRuleListByPermId(permissionId);
@@ -320,7 +320,7 @@ public class SysRoleController {
/**
* 保存数据规则至角色菜单关联表
*/
//@RequiresPermissions("sys:role:list")
@RequiresPermissions("sys:role:list")
@PostMapping(value = "/datarule")
public Results<T> saveDatarule(@RequestBody JSONObject jsonObject) {
try {
@@ -351,7 +351,7 @@ public class SysRoleController {
* @param request
* @return
*/
//@RequiresPermissions("sys:role:list")
@RequiresPermissions("sys:role:list")
@GetMapping("/queryTreeList")
public Results<Map<String,Object>> queryTreeList(HttpServletRequest request) {
Results<Map<String,Object>> result = new Results<>();
@@ -377,7 +377,7 @@ public class SysRoleController {
}
return result;
}
//@RequiresPermissions("sys:role:list")
@RequiresPermissions("sys:role:list")
private void getTreeModelList(List<TreeModel> treeList,List<SysPermission> metaList,TreeModel temp) {
for (SysPermission permission : metaList) {
String tempPid = permission.getParentId();