fix: 88681 【水平越权】法规符合性评估库部分接口没有处理水平越权

laws-modules/src/main/java/com/jero/modules/assessmentLibrary/service/impl/LawsEvaluationNotMetLibraryServiceImpl.java

@@ -6,6 +6,7 @@ import com.baomidou.mybatisplus.core.conditions.update.LambdaUpdateWrapper;
 import com.baomidou.mybatisplus.core.metadata.IPage;
 import com.baomidou.mybatisplus.extension.plugins.pagination.Page;
 import com.baomidou.mybatisplus.extension.service.impl.ServiceImpl;
+import com.jero.common.api.vo.ResultCommon;
 import com.jero.common.exception.JeroBootException;
 import com.jero.common.util.FileUtils;
 import com.jero.common.util.ZipUtil;
@@ -88,6 +89,8 @@ public class LawsEvaluationNotMetLibraryServiceImpl extends ServiceImpl<LawsEval
         if (ids == null || ids.isEmpty()) {
             return;
         }
+        horizontalCheck(String.join(",", ids));
+
         LambdaUpdateWrapper<LawsEvaluationNotMetLibrary> wrapper = new LambdaUpdateWrapper<>();
         wrapper.set(LawsEvaluationNotMetLibrary::getRectifyStatus, AssessCommon.CLOSED);
         wrapper.set(StrUtil.isNotBlank(lawsEvaluationNotMet.getPcrNo()),
@@ -105,6 +108,8 @@ public class LawsEvaluationNotMetLibraryServiceImpl extends ServiceImpl<LawsEval
     @Override
     public void export(HttpServletResponse response, LawsEvaluationNotMetLibrary lawsEvaluationNotMet, String fileName,
                        String sheetName, HttpServletRequest req) {
+        horizontalCheck(lawsEvaluationNotMet.getSelections());
+
         String url = exportExcelTempPath.replace(EXPORT_EXCEL_TEMP, fileName);
         File file = new File(url);
         if (!file.exists()) {
@@ -150,6 +155,24 @@ public class LawsEvaluationNotMetLibraryServiceImpl extends ServiceImpl<LawsEval
         }
 
     }
+
+    private void horizontalCheck(String selections) {
+        if (calService.noAdminAuth()) {
+            if (StringUtils.isNotBlank(selections)) {
+                String userId = UserUtils.getUserId();
+                String[] split = selections.split(",");
+                for (String splitStr : split) {
+                    LawsEvaluationNotMetLibrary data = this.getById(splitStr);
+                    if (data == null) {
+                        throw new JeroBootException(ResultCommon.DATA_DOES_NOT_EXIST);
+                    }
+                    if (!data.getAllApprovalUser().contains(userId)) {
+                        throw new JeroBootException(ResultCommon.HORIZONTAL_TRANSGRESSION);
+                    }
+                }
+            }
+        }
+    }
 }