fix: 88681 【水平越权】法规符合性评估库部分接口没有处理水平越权

laws-modules/src/main/java/com/jero/modules/assessmentLibrary/service/impl/LawsConformityAssessmentLibraryServiceImpl.java

@@ -6,6 +6,7 @@ import com.baomidou.mybatisplus.core.metadata.IPage;
 import com.baomidou.mybatisplus.core.toolkit.CollectionUtils;
 import com.baomidou.mybatisplus.extension.plugins.pagination.Page;
 import com.baomidou.mybatisplus.extension.service.impl.ServiceImpl;
+import com.jero.common.api.vo.ResultCommon;
 import com.jero.common.exception.JeroBootException;
 import com.jero.common.system.vo.LoginUser;
 import com.jero.common.util.FileUtils;
@@ -106,6 +107,10 @@ public class LawsConformityAssessmentLibraryServiceImpl extends ServiceImpl<Laws
 
     @Override
     public IPage<LawsConformityAssessmentLibraryDetail> detail(LawsConformityAssessmentLibraryDetail lawsConformityAssessmentLibraryDetail, Integer pageNo, Integer pageSize) {
+        String bindId = lawsConformityAssessmentLibraryDetail.getBindId();
+        // 水平越权校验
+        horizontalCheck(bindId);
+
         QueryWrapper<LawsConformityAssessmentLibraryDetail> queryWrapper = new QueryWrapper<>();
         Page<LawsConformityAssessmentLibraryDetail> page = new Page<>(pageNo, pageSize);
         queryWrapper.eq(StringUtils.isNotBlank(lawsConformityAssessmentLibraryDetail.getBindId()),
@@ -123,7 +128,6 @@ public class LawsConformityAssessmentLibraryServiceImpl extends ServiceImpl<Laws
                 "CONCAT(u.realname, '(', u.username, ')')", lawsConformityAssessmentLibraryDetail.getAssessor());
         if (noAdminAuth()) {
             String userId = UserUtils.getUserId();
-            String bindId = lawsConformityAssessmentLibraryDetail.getBindId();
             LawsConformityAssessmentLibrary cal = this.getById(bindId);
             String allApprovalUser = "";
             allApprovalUser = cal.getAllApprovalUser();
@@ -142,6 +146,9 @@ public class LawsConformityAssessmentLibraryServiceImpl extends ServiceImpl<Laws
             boolean mkdirs = file.mkdirs();
             log.info("创建临时目录：{}", mkdirs);
         }
+        // 水平越权校验
+        horizontalCheck(lawsConformityAssessmentLibrary.getSelections());
+
         try (FileOutputStream fos = new FileOutputStream(url + File.separator + fileName + ".xls")){
             // 获取数据
             IPage<LawsConformityAssessmentLibrary> data = this.queryPage(lawsConformityAssessmentLibrary, 1, Integer.MAX_VALUE);
@@ -206,6 +213,24 @@ public class LawsConformityAssessmentLibraryServiceImpl extends ServiceImpl<Laws
         }
     }
 
+    private void horizontalCheck(String selections) {
+        if (noAdminAuth()) {
+            if (StringUtils.isNotBlank(selections)) {
+                String userId = UserUtils.getUserId();
+                String[] split = selections.split(",");
+                for (String splitStr : split) {
+                    LawsConformityAssessmentLibrary data = this.getById(splitStr);
+                    if (data == null) {
+                        throw new JeroBootException(ResultCommon.DATA_DOES_NOT_EXIST);
+                    }
+                    if (!data.getAllApprovalUser().contains(userId)) {
+                        throw new JeroBootException(ResultCommon.HORIZONTAL_TRANSGRESSION);
+                    }
+                }
+            }
+        }
+    }
+
     @Override
     public LawsConformityAssessmentLibrary queryOne(LawsConformityAssessmentLibrary lawsConformityAssessmentLibrary) {
         QueryWrapper<LawsConformityAssessmentLibrary> queryWrapper = new QueryWrapper<>();