fix(88718): 【水平越权】资料中心目录新增同级接口未处理水平越权

2024-08-17 00:35:07 +08:00
parent d0b58d86b2
commit 7013703225
1 changed files with 29 additions and 0 deletions
@@ -204,6 +204,35 @@ public class LawsDataCenterFolderServiceImpl extends ServiceImpl<LawsDataCenterF
 	 */
 	@Override
    public void add(LawsDataCenterFolder lawsDataCenterFolder) {
+		// 水平越权
+		LoginUser loginUser = (LoginUser) SecurityUtils.getSubject().getPrincipal();
+		String roleIds = loginUser.getRoleIds();
+		List<String> adminRoleCodeList = Arrays.asList(adminRoleCode.split(","));
+		Collection<String> intersection = CollectionUtils.intersection(Arrays.asList(roleIds.split(",")), adminRoleCodeList);
+		if (!roleIds.contains("admin") && CollectionUtils.isEmpty(intersection)){
+			LambdaQueryWrapper<LawsDataCenterFolderSublist> queryWrapper = new LambdaQueryWrapper<>();
+			if ("0".equals(lawsDataCenterFolder.getParentId())) {
+				List<LawsDataCenterFolder> firstList = list(
+						new LambdaQueryWrapper<LawsDataCenterFolder>()
+								.eq(LawsDataCenterFolder::getParentId, "0"));
+				if (CollectionUtils.isNotEmpty(firstList)){
+					queryWrapper.in(LawsDataCenterFolderSublist::getDataCenterFolderId,
+							firstList.stream().map(LawsDataCenterFolder::getId).collect(Collectors.toList()));
+				}
+			}else {
+				queryWrapper.eq(LawsDataCenterFolderSublist::getDataCenterFolderId, lawsDataCenterFolder.getParentId());
+			}
+			queryWrapper.eq(LawsDataCenterFolderSublist::getType, DataCenterCommon.AUTH_MANAGE);
+			queryWrapper.like(LawsDataCenterFolderSublist::getUserId, loginUser.getId());
+			int count = lawsDataCenterFolderSublistService.count(queryWrapper);
+			if (count == 0){
+				if(LanguageEnum.CN.equals(MessageUtils.getLanguage())) {
+					throw new JeroBootException("无权限!");
+				}else{
+					throw new JeroBootException("No access!");
+				}
+			}
+		}
 		lawsDataCenterFolder.setOwnerId(CurrentUserUtil.getId());
 		lawsDataCenterFolder.setOrgCode(CurrentUserUtil.getOrgCode());
 		if (StringUtils.isBlank(lawsDataCenterFolder.getParentId())) {