KH/kh-device-admin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix 68477 【垂直越权】系统管理-角色管理 接口未处理越权

Browse Source
This commit is contained in:
liao
2023-05-06 15:40:22 +08:00
parent 91a5d4ae48
commit e7f79873d4
1 changed files with 8 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
jero-boot/jero-boot-module-system/src/main/java/com/jero/modules/system/controller/SysRoleController.java
+8 -8
View File
@@ -81,7 +81,7 @@ public class SysRoleController {
* @param req * @param req
* @return * @return
*/ */
//@RequiresPermissions("sys:role:list") @RequiresPermissions("sys:role:list")
@GetMapping("/page") @GetMapping("/page")
public Results<IPage<SysRole>> queryPageList(SysRole role, public Results<IPage<SysRole>> queryPageList(SysRole role,
@RequestParam(name="pageNo", defaultValue="1") Integer pageNo, @RequestParam(name="pageNo", defaultValue="1") Integer pageNo,
@@ -181,7 +181,7 @@ public class SysRoleController {
* @param id * @param id
* @return * @return
*/ */
//@RequiresPermissions("sys:role:list") @RequiresPermissions("sys:role:list")
@GetMapping("/queryById") @GetMapping("/queryById")
public Results<SysRole> queryById(@RequestParam(name="id",required=true) String id) { public Results<SysRole> queryById(@RequestParam(name="id",required=true) String id) {
SysRole sysRole = sysRoleService.getById(id); SysRole sysRole = sysRoleService.getById(id);
@@ -191,7 +191,7 @@ public class SysRoleController {
return Results.OK(sysRole); return Results.OK(sysRole);
} }
} }
//@RequiresPermissions("sys:role:list") @RequiresPermissions("sys:role:list")
@GetMapping("/queryall") @GetMapping("/queryall")
public Results<List<SysRole>> queryall() { public Results<List<SysRole>> queryall() {
List<SysRole> list = sysRoleService.list(); List<SysRole> list = sysRoleService.list();
@@ -205,7 +205,7 @@ public class SysRoleController {
/** /**
* 校验角色编码唯一 * 校验角色编码唯一
*/ */
//@RequiresPermissions("sys:role:list") @RequiresPermissions("sys:role:list")
@GetMapping("/checkRoleCode") @GetMapping("/checkRoleCode")
public Results<Boolean> checkUsername(String id, String roleCode) { public Results<Boolean> checkUsername(String id, String roleCode) {
Results<Boolean> result = new Results<>(); Results<Boolean> result = new Results<>();
@@ -292,7 +292,7 @@ public class SysRoleController {
/** /**
* 查询数据规则数据 * 查询数据规则数据
*/ */
//@RequiresPermissions("sys:role:list") @RequiresPermissions("sys:role:list")
@GetMapping(value = "/datarule/{permissionId}/{roleId}") @GetMapping(value = "/datarule/{permissionId}/{roleId}")
public Results<Map<String, Object>> loadDatarule(@PathVariable("permissionId") String permissionId, @PathVariable("roleId") String roleId) { public Results<Map<String, Object>> loadDatarule(@PathVariable("permissionId") String permissionId, @PathVariable("roleId") String roleId) {
List<SysPermissionDataRule> list = sysPermissionDataRuleService.getPermRuleListByPermId(permissionId); List<SysPermissionDataRule> list = sysPermissionDataRuleService.getPermRuleListByPermId(permissionId);
@@ -320,7 +320,7 @@ public class SysRoleController {
/** /**
* 保存数据规则至角色菜单关联表 * 保存数据规则至角色菜单关联表
*/ */
//@RequiresPermissions("sys:role:list") @RequiresPermissions("sys:role:list")
@PostMapping(value = "/datarule") @PostMapping(value = "/datarule")
public Results<T> saveDatarule(@RequestBody JSONObject jsonObject) { public Results<T> saveDatarule(@RequestBody JSONObject jsonObject) {
try { try {
@@ -351,7 +351,7 @@ public class SysRoleController {
* @param request * @param request
* @return * @return
*/ */
//@RequiresPermissions("sys:role:list") @RequiresPermissions("sys:role:list")
@GetMapping("/queryTreeList") @GetMapping("/queryTreeList")
public Results<Map<String,Object>> queryTreeList(HttpServletRequest request) { public Results<Map<String,Object>> queryTreeList(HttpServletRequest request) {
Results<Map<String,Object>> result = new Results<>(); Results<Map<String,Object>> result = new Results<>();
@@ -377,7 +377,7 @@ public class SysRoleController {
} }
return result; return result;
} }
//@RequiresPermissions("sys:role:list") @RequiresPermissions("sys:role:list")
private void getTreeModelList(List<TreeModel> treeList,List<SysPermission> metaList,TreeModel temp) { private void getTreeModelList(List<TreeModel> treeList,List<SysPermission> metaList,TreeModel temp) {
for (SysPermission permission : metaList) { for (SysPermission permission : metaList) {
String tempPid = permission.getParentId(); String tempPid = permission.getParentId();