From 3a4314a9d8fcd78b73e7629677497f2552d5a9e4 Mon Sep 17 00:00:00 2001
From: lijiarao <lijiarao@syxysoft.com>
Date: Wed, 3 Nov 2021 18:18:05 +0800
Subject: [PATCH] =?UTF-8?q?fix=20bug=2040273=20=E7=AE=A1=E7=90=86=E5=91=98?=
 =?UTF-8?q?=E8=B4=A6=E5=8F=B7--admin=E8=B4=A6=E5=8F=B7=E5=8F=AF=E5=88=9B?=
 =?UTF-8?q?=E5=BB=BA=E5=B9=B6=E7=99=BB=E5=BD=95=E6=88=90=E5=8A=9F?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../system/controller/SysUserController.java  | 23 +++++++++++++++++--
 1 file changed, 21 insertions(+), 2 deletions(-)

diff --git a/jero-boot-module-system/src/main/java/com/jero/modules/system/controller/SysUserController.java b/jero-boot-module-system/src/main/java/com/jero/modules/system/controller/SysUserController.java
index 1f483c3d..63335b40 100644
--- a/jero-boot-module-system/src/main/java/com/jero/modules/system/controller/SysUserController.java
+++ b/jero-boot-module-system/src/main/java/com/jero/modules/system/controller/SysUserController.java
@@ -106,7 +106,10 @@ public class SysUserController {
 
     @Resource
     private BaseCommonService baseCommonService;
-
+    private final static List<String> INTERNAL_USER =
+            Arrays.asList("LKGLZ", "BXGLZ");
+    private final static List<String> ADMIN_USER =
+            Arrays.asList("admin", "root","test","administrator","supervisor");
     /**
      * 根据角色id和部门id获取用户列表数据
      */
@@ -319,6 +322,9 @@ public class SysUserController {
         } catch (Exception e) {
             throw new JeroBootException("解密失败！", e);
         }
+        if (ADMIN_USER.contains(StringUtils.lowerCase(user.getUsername().trim()))) {
+            throw new JeroBootException("不可添加用户名为admin，root，test，administrator，supervisor的用户");
+        }
         LambdaQueryWrapper<SysUser> wrapper = new LambdaQueryWrapper<>();
         wrapper.eq(SysUser::getUsername,user.getUsername());
         wrapper.eq(SysUser::getDelFlag,0);
@@ -391,7 +397,9 @@ public class SysUserController {
             user.setEmail(email);
             user.setEmailPassword(emailPassword);
             user.setPhone(phone);
-
+            if (ADMIN_USER.contains(StringUtils.lowerCase(user.getUsername().trim()))) {
+                throw new JeroBootException("不可添加用户名为admin，root，test，administrator，supervisor的用户");
+            }
             LambdaQueryWrapper<SysUser> wrapper = new LambdaQueryWrapper<>();
             wrapper.eq(SysUser::getUsername,user.getUsername());
             wrapper.eq(SysUser::getDelFlag,0);
@@ -433,6 +441,9 @@ public class SysUserController {
 	@RequestMapping(value = "/delete", method = RequestMethod.GET)
 	public Result<?> delete(@RequestParam(name="id",required=true) String id) {
         SysUser sysUser = sysUserService.getById(id);
+        if (INTERNAL_USER.contains(sysUser.getUsername())) {
+            throw new JeroBootException("内置用户不可删除");
+        }
         baseCommonService.addLog("删除用户： " +sysUser.getUsername() ,CommonConstant.LOG_TYPE_2, 4);
 		this.sysUserService.deleteUser(id);
 		return Result.OK("删除用户成功");
@@ -448,6 +459,11 @@ public class SysUserController {
         List<SysUser> sysUsers = sysUserService.listByIds(Arrays.asList(ids.split(",")));
         List<String> userNames = new ArrayList<>();
         sysUsers.forEach(i -> userNames.add(i.getUsername()));
+        for (String userName : userNames) {
+            if (INTERNAL_USER.contains(userName)) {
+                throw new JeroBootException("内置用户不可删除");
+            }
+        }
         baseCommonService.addLog("批量删除用户： " +userNames ,CommonConstant.LOG_TYPE_2, 4);
 		this.sysUserService.deleteBatchUsers(ids);
 		return Result.OK("批量删除用户成功");
@@ -795,6 +811,9 @@ public class SysUserController {
                         }
                         //处理邮箱和手机号的加密
                         UserUtil.encryptUser(sysUser);
+                        if (ADMIN_USER.contains(StringUtils.lowerCase(sysUser.getUsername().trim()))) {
+                            errorMessage.add("第 " + lineNumber + " 行：不可添加用户名为admin，root，test，administrator，supervisor的用户");
+                        }
                         LambdaQueryWrapper<SysUser> wrapper = new LambdaQueryWrapper<>();
                         wrapper.eq(SysUser::getUsername,sysUser.getUsername());
                         wrapper.eq(SysUser::getDelFlag,0);