LK/income_payments_management
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix bug 41705,41704 资料网元项目水平越权

Browse Source
This commit is contained in:
lijiarao
2021-10-29 14:46:06 +08:00
parent e3ac24b7d0
commit 33f65f4162
8 changed files with 100 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
jero-boot-incoming-payment/src/main/java/com/jero/member/controller/PayMemberProjectController.java
+7
View File
@@ -209,6 +209,7 @@ public class PayMemberProjectController extends JeroController<PayMemberProject,
@ApiOperation(value = "会员项目表-编辑", notes = "会员项目表-编辑")
@PostMapping(value = "/edit")
public Result<?> edit(@Validated @RequestBody PayMemberProject payMemberProject) {
memberProjectService.check(payMemberProject.getId(),"memberProject:edit");
memberProjectService.editById(payMemberProject);
return Result.OK("编辑成功!");
}
@@ -221,6 +222,7 @@ public class PayMemberProjectController extends JeroController<PayMemberProject,
@ApiOperation(value = "会员项目表-通过id删除", notes = "会员项目表-通过id删除")
@GetMapping(value = "/delete")
public Result<?> delete(@RequestParam(name = "id") String id) {
memberProjectService.check(id,"memberProject:delete");
memberProjectService.deleteById(id);
return Result.OK("删除成功!");
}
@@ -233,6 +235,10 @@ public class PayMemberProjectController extends JeroController<PayMemberProject,
@ApiOperation(value = "会员项目表-批量删除", notes = "会员项目表-批量删除")
@GetMapping(value = "/deleteBatch")
public Result<?> deleteBatch(@RequestParam(name = "ids") String ids) {
List<String> idList = Arrays.asList(ids.split(","));
for (String id : idList) {
memberProjectService.check(id,"memberProject:batchDel");
}
this.memberProjectService.deleteByIds(Arrays.asList(ids.split(",")));
return Result.OK("批量删除成功!");
}
@@ -244,6 +250,7 @@ public class PayMemberProjectController extends JeroController<PayMemberProject,
@ApiOperation(value = "会员项目表-通过id查询", notes = "会员项目表-通过id查询")
@GetMapping(value = "/queryById")
public Result<?> queryById(@RequestParam(name = "id") String id) {
memberProjectService.check(id,"memberProject:search");
PayMemberProject payMemberProject = memberProjectService.queryById(id);
if (payMemberProject == null) {
return Result.error("未找到对应数据");
jero-boot-incoming-payment/src/main/java/com/jero/member/controller/PayMemberProjectSubitemController.java
+40 -3
View File
@@ -10,6 +10,7 @@ import javax.servlet.http.HttpServletResponse;
import cn.hutool.core.util.NumberUtil;
import com.jero.common.api.vo.Result;
import com.jero.common.exception.JeroBootException;
import com.jero.common.service.RolePermissionService;
import com.jero.common.system.api.ISysBaseAPI;
import com.jero.common.system.query.QueryGenerator;
import com.jero.common.system.vo.DictModel;
@@ -19,7 +20,9 @@ import com.jero.common.util.oConvertUtils;
import com.jero.company.entity.PayCompanyManagement;
import com.jero.company.entity.PayContactsManagement;
import com.jero.company.service.IPayContactsManagementService;
import com.jero.member.entity.PayMemberProject;
import com.jero.member.entity.PayMemberProjectSubitem;
import com.jero.member.service.IPayMemberProjectService;
import com.jero.member.service.IPayMemberProjectSubitemService;
import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
import com.baomidou.mybatisplus.core.metadata.IPage;
@@ -52,9 +55,13 @@ public class PayMemberProjectSubitemController extends JeroController<PayMemberP
@Resource
private IPayMemberProjectSubitemService memberProjectSubitemService;
@Resource
private IPayMemberProjectService memberProjectService;
@Resource
private IPayContactsManagementService contactsManagementService;
@Resource
private ISysBaseAPI sysBaseAPI;
@Resource
private RolePermissionService rolePermissionService;
/**
* 分页列表查询
@@ -67,8 +74,12 @@ public class PayMemberProjectSubitemController extends JeroController<PayMemberP
@RequestParam(name = "pageSize", defaultValue = "10") Integer pageSize,
HttpServletRequest req) {
QueryWrapper<PayMemberProjectSubitem> queryWrapper = QueryGenerator.initQueryWrapper(payMemberProjectSubitem, req.getParameterMap());
LoginUser sysUser = (LoginUser) SecurityUtils.getSubject().getPrincipal();
if (!rolePermissionService.getRolePermission("safeguardMember:search")) {
queryWrapper.eq("pmp.director_id",sysUser.getId());
}
Page<PayMemberProjectSubitem> page = new Page<>(pageNo, pageSize);
IPage<PayMemberProjectSubitem> pageList = memberProjectSubitemService.page(page, queryWrapper);
IPage<PayMemberProjectSubitem> pageList = memberProjectSubitemService.getPage(page, queryWrapper);
return Result.OK(pageList);
}
@@ -123,6 +134,7 @@ public class PayMemberProjectSubitemController extends JeroController<PayMemberP
@ApiOperation(value = "会员项目成员表-添加", notes = "会员项目成员表-添加")
@PostMapping(value = "/add")
public Result<?> add(@RequestBody PayMemberProjectSubitem payMemberProjectSubitem) {
memberProjectService.check(payMemberProjectSubitem.getProjectId(),"safeguardMember:add");
ValidUtil.validate(payMemberProjectSubitem);
memberProjectSubitemService.add(payMemberProjectSubitem);
return Result.OK("添加成功！");
@@ -136,6 +148,7 @@ public class PayMemberProjectSubitemController extends JeroController<PayMemberP
@ApiOperation(value = "会员项目成员表-编辑", notes = "会员项目成员表-编辑")
@PostMapping(value = "/edit")
public Result<?> edit(@RequestBody PayMemberProjectSubitem payMemberProjectSubitem) {
memberProjectSubitemService.check(payMemberProjectSubitem.getId(),"safeguardMember:edit");
ValidUtil.validate(payMemberProjectSubitem);
memberProjectSubitemService.editById(payMemberProjectSubitem);
return Result.OK("编辑成功!");
@@ -149,6 +162,7 @@ public class PayMemberProjectSubitemController extends JeroController<PayMemberP
@ApiOperation(value = "会员项目成员表-通过id删除", notes = "会员项目成员表-通过id删除")
@GetMapping(value = "/delete")
public Result<?> delete(@RequestParam(name = "id") String id) {
memberProjectSubitemService.check(id,"safeguardMember:delete");
memberProjectSubitemService.deleteById(id);
return Result.OK("删除成功!");
}
@@ -161,7 +175,11 @@ public class PayMemberProjectSubitemController extends JeroController<PayMemberP
@ApiOperation(value = "会员项目成员表-批量删除", notes = "会员项目成员表-批量删除")
@GetMapping(value = "/deleteBatch")
public Result<?> deleteBatch(@RequestParam(name = "ids") String ids) {
this.memberProjectSubitemService.deleteByIds(Arrays.asList(ids.split(",")));
List<String> idList = Arrays.asList(ids.split(","));
for (String id : idList) {
memberProjectSubitemService.check(id,"safeguardMember:batchDel");
}
this.memberProjectSubitemService.deleteByIds(idList);
return Result.OK("批量删除成功!");
}
@@ -172,6 +190,7 @@ public class PayMemberProjectSubitemController extends JeroController<PayMemberP
@ApiOperation(value = "会员项目成员表-通过id查询", notes = "会员项目成员表-通过id查询")
@GetMapping(value = "/queryById")
public Result<?> queryById(@RequestParam(name = "id") String id) {
memberProjectSubitemService.check(id,"safeguardMember:search");
PayMemberProjectSubitem payMemberProjectSubitem = memberProjectSubitemService.queryById(id);
if (payMemberProjectSubitem == null) {
return Result.error("未找到对应数据");
@@ -186,7 +205,24 @@ public class PayMemberProjectSubitemController extends JeroController<PayMemberP
@AutoLog(value = "会员项目成员表-导出数据")
@RequestMapping(value = "/exportXls")
public ModelAndView exportXls(HttpServletRequest request, PayMemberProjectSubitem payMemberProjectSubitem) {
return super.exportXls(request, payMemberProjectSubitem, PayMemberProjectSubitem.class, "会员项目成员表");
QueryWrapper<PayMemberProjectSubitem> queryWrapper = QueryGenerator.initQueryWrapper(payMemberProjectSubitem, request.getParameterMap());
LoginUser sysUser = (LoginUser) SecurityUtils.getSubject().getPrincipal();
if (!rolePermissionService.getRolePermission("safeguardMember:export")) {
queryWrapper.eq("pmp.director_id",sysUser.getId());
}
Page<PayMemberProjectSubitem> page = new Page<>(-1, -1);
IPage<PayMemberProjectSubitem> getPage = memberProjectSubitemService.getPage(page, queryWrapper);
List<PayMemberProjectSubitem> pageList = getPage.getRecords();
// 过滤选中数据
String selections = request.getParameter("selections");
if (oConvertUtils.isNotEmpty(selections)) {
List<String> selectionList = Arrays.asList(selections.split(","));
pageList = pageList.stream().filter(item -> selectionList.contains(item.getId())).collect(Collectors.toList());
}
if (pageList.isEmpty()) {
throw new JeroBootException("没有数据");
}
return super.exportListXls(pageList, PayMemberProjectSubitem.class, "会员项目成员表");
}
/**
@@ -211,6 +247,7 @@ public class PayMemberProjectSubitemController extends JeroController<PayMemberP
if (StringUtils.isBlank(projectId)) {
throw new JeroBootException("项目id为空");
}
memberProjectService.check(projectId,"safeguardMember:import");
List<Object> excelData = super.getExcelData(request, PayMemberProjectSubitemExcel.class);
if (excelData.isEmpty()) {
throw new JeroBootException("导入数据为空，请填写数据之后重新导入！");
jero-boot-incoming-payment/src/main/java/com/jero/member/mapper/PayMemberProjectSubitemMapper.java
+2
View File
@@ -17,4 +17,6 @@ import org.apache.ibatis.annotations.Param;
public interface PayMemberProjectSubitemMapper extends BaseMapper<PayMemberProjectSubitem> {
IPage<PayMemberProjectSubitem> queryPageListCompany(Page<PayMemberProjectSubitem> page, @Param(Constants.WRAPPER) QueryWrapper<PayMemberProjectSubitem> queryWrapper);
IPage<PayMemberProjectSubitem> getPage(Page<PayMemberProjectSubitem> page, @Param(Constants.WRAPPER) QueryWrapper<PayMemberProjectSubitem> queryWrapper);
}
jero-boot-incoming-payment/src/main/java/com/jero/member/mapper/xml/PayMemberProjectSubitemMapper.xml
+5
View File
@@ -39,4 +39,9 @@
left join pay_member_project pmp on pmps.project_id = pmp.id
${ew.customSqlSegment}
</select>
<select id="getPage" resultMap="MemberProjectSubitemResultMap">
select pmps.* from pay_member_project_subitem pmps left join pay_member_project pmp on pmps.project_id = pmp.id
${ew.customSqlSegment}
</select>
</mapper>
jero-boot-incoming-payment/src/main/java/com/jero/member/service/IPayMemberProjectService.java
+2
View File
@@ -83,4 +83,6 @@ public interface IPayMemberProjectService extends IService<PayMemberProject> {
* @Exception
*/
IPage<PayMemberProject> queryListByCompany(Page<PayMemberProject> page, String companyId, String projectName, String projectType, Integer pack, String packYear);
void check(String projectId, String permission);
}
jero-boot-incoming-payment/src/main/java/com/jero/member/service/IPayMemberProjectSubitemService.java
+4
View File
@@ -69,4 +69,8 @@ public interface IPayMemberProjectSubitemService extends IService<PayMemberProje
List<PayMemberProjectSubitem> queryList();
IPage<PayMemberProjectSubitem> queryPageListCompany(Page<PayMemberProjectSubitem> page, QueryWrapper<PayMemberProjectSubitem> queryWrapper);
IPage<PayMemberProjectSubitem> getPage(Page<PayMemberProjectSubitem> page, QueryWrapper<PayMemberProjectSubitem> queryWrapper);
void check(String subitemId, String permission);
}
jero-boot-incoming-payment/src/main/java/com/jero/member/service/impl/PayPayMemberProjectServiceImpl.java
+16
View File
@@ -5,6 +5,8 @@ import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
import com.baomidou.mybatisplus.core.metadata.IPage;
import com.baomidou.mybatisplus.extension.plugins.pagination.Page;
import com.jero.common.exception.JeroBootException;
import com.jero.common.service.RolePermissionService;
import com.jero.common.system.vo.LoginUser;
import com.jero.contract.service.IPayIncomeContractAssociatedService;
import com.jero.contract.service.IPayIncomeContractService;
import com.jero.member.entity.PayMemberProject;
@@ -15,9 +17,11 @@ import com.jero.member.service.IPayMemberProjectSubitemService;
import com.jero.modules.system.entity.SysUser;
import com.jero.modules.system.mapper.SysUserMapper;
import org.apache.commons.collections.CollectionUtils;
import org.apache.shiro.SecurityUtils;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Service;
import java.util.List;
import java.util.Objects;
import com.baomidou.mybatisplus.extension.service.impl.ServiceImpl;
import org.springframework.transaction.annotation.Transactional;
@@ -43,6 +47,8 @@ public class PayPayMemberProjectServiceImpl extends ServiceImpl<PayMemberProject
private IPayMemberProjectSubitemService memberProjectSubitemService;
@Autowired
private IPayIncomeContractService payIncomeContractService;
@Resource
private RolePermissionService rolePermissionService;
/**
* 保存
*
@@ -153,4 +159,14 @@ public class PayPayMemberProjectServiceImpl extends ServiceImpl<PayMemberProject
public IPage<PayMemberProject> queryListByCompany(Page<PayMemberProject> page, String companyId, String projectName, String projectType, Integer pack, String packYear) {
return payMemberProjectMapper.queryListByCompany(page,companyId, projectName,projectType, pack, packYear);
}
@Override
public void check(String projectId,String permission){
LoginUser sysUser = (LoginUser) SecurityUtils.getSubject().getPrincipal();
if (!rolePermissionService.getRolePermission(permission)) {
PayMemberProject payMemberProject = payMemberProjectMapper.selectById(projectId);
if (!Objects.equals(payMemberProject.getDirectorId(),sysUser.getId())){
throw new JeroBootException("权限不足");
}
}
}
}
jero-boot-incoming-payment/src/main/java/com/jero/member/service/impl/PayPayMemberProjectSubitemServiceImpl.java
+24
View File
@@ -9,12 +9,15 @@ import com.jero.common.common.ProjectCommon;
import com.jero.common.exception.JeroBootException;
import com.jero.common.service.ContractCreateProjectSendMessageService;
import com.jero.common.service.ProjectDetailService;
import com.jero.common.service.RolePermissionService;
import com.jero.common.system.vo.LoginUser;
import com.jero.common.util.ValidUtil;
import com.jero.common.vo.ProjectStatusVO;
import com.jero.company.entity.PayContactsManagement;
import com.jero.company.service.IPayContactsManagementService;
import com.jero.contract.entity.PayIncomeContract;
import com.jero.contract.service.IPayIncomeContractService;
import com.jero.member.mapper.PayMemberProjectMapper;
import com.jero.pack.entity.PayPackCompanyProject;
import com.jero.pack.service.IPayPackCompanyProjectService;
import com.jero.project.common.PayProjectCommon;
@@ -30,6 +33,7 @@ import com.jero.member.service.IPayMemberProjectSubitemService;
import com.jero.valid.group.ChargeNotice;
import com.jero.valid.group.Contract;
import org.apache.commons.lang3.StringUtils;
import org.apache.shiro.SecurityUtils;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Service;
@@ -69,6 +73,10 @@ public class PayPayMemberProjectSubitemServiceImpl extends ServiceImpl<PayMember
private ContractCreateProjectSendMessageService contractCreateProjectSendMessageService;
@Resource
private IPayMemberProjectSubitemService memberProjectSubitemService;
@Resource
private RolePermissionService rolePermissionService;
@Resource
private PayMemberProjectMapper payMemberProjectMapper;
/**
* 保存
*/
@@ -446,4 +454,20 @@ public class PayPayMemberProjectSubitemServiceImpl extends ServiceImpl<PayMember
public IPage<PayMemberProjectSubitem> queryPageListCompany(Page<PayMemberProjectSubitem> page, QueryWrapper<PayMemberProjectSubitem> queryWrapper) {
return baseMapper.queryPageListCompany(page,queryWrapper);
}
@Override
public IPage<PayMemberProjectSubitem> getPage(Page<PayMemberProjectSubitem> page, QueryWrapper<PayMemberProjectSubitem> queryWrapper) {
return baseMapper.getPage(page, queryWrapper);
}
@Override
public void check(String subitemId,String permission){
LoginUser sysUser = (LoginUser) SecurityUtils.getSubject().getPrincipal();
if (!rolePermissionService.getRolePermission(permission)) {
PayMemberProjectSubitem payMemberProjectSubitem = baseMapper.selectById(subitemId);
PayMemberProject payMemberProject = payMemberProjectMapper.selectById(payMemberProjectSubitem.getProjectId());
if (!Objects.equals(payMemberProject.getDirectorId(),sysUser.getId())){
throw new JeroBootException("权限不足");
}
}
}
}