From 701370322525d0eda0ee868bfb8cce34ca353665 Mon Sep 17 00:00:00 2001
From: yjz <3131811435@qq.com>
Date: Sat, 17 Aug 2024 00:35:07 +0800
Subject: [PATCH] =?UTF-8?q?fix(88718):=20=E3=80=90=E6=B0=B4=E5=B9=B3?=
 =?UTF-8?q?=E8=B6=8A=E6=9D=83=E3=80=91=E8=B5=84=E6=96=99=E4=B8=AD=E5=BF=83?=
 =?UTF-8?q?=E7=9B=AE=E5=BD=95=E6=96=B0=E5=A2=9E=E5=90=8C=E7=BA=A7=E6=8E=A5?=
 =?UTF-8?q?=E5=8F=A3=E6=9C=AA=E5=A4=84=E7=90=86=E6=B0=B4=E5=B9=B3=E8=B6=8A?=
 =?UTF-8?q?=E6=9D=83?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../impl/LawsDataCenterFolderServiceImpl.java | 29 +++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/laws-modules/src/main/java/com/jero/modules/laws/dataCenter/service/impl/LawsDataCenterFolderServiceImpl.java b/laws-modules/src/main/java/com/jero/modules/laws/dataCenter/service/impl/LawsDataCenterFolderServiceImpl.java
index 40ea5f8d..7faaa74d 100644
--- a/laws-modules/src/main/java/com/jero/modules/laws/dataCenter/service/impl/LawsDataCenterFolderServiceImpl.java
+++ b/laws-modules/src/main/java/com/jero/modules/laws/dataCenter/service/impl/LawsDataCenterFolderServiceImpl.java
@@ -204,6 +204,35 @@ public class LawsDataCenterFolderServiceImpl extends ServiceImpl<LawsDataCenterF
 	 */
 	@Override
     public void add(LawsDataCenterFolder lawsDataCenterFolder) {
+		// 水平越权
+		LoginUser loginUser = (LoginUser) SecurityUtils.getSubject().getPrincipal();
+		String roleIds = loginUser.getRoleIds();
+		List<String> adminRoleCodeList = Arrays.asList(adminRoleCode.split(","));
+		Collection<String> intersection = CollectionUtils.intersection(Arrays.asList(roleIds.split(",")), adminRoleCodeList);
+		if (!roleIds.contains("admin") && CollectionUtils.isEmpty(intersection)){
+			LambdaQueryWrapper<LawsDataCenterFolderSublist> queryWrapper = new LambdaQueryWrapper<>();
+			if ("0".equals(lawsDataCenterFolder.getParentId())) {
+				List<LawsDataCenterFolder> firstList = list(
+						new LambdaQueryWrapper<LawsDataCenterFolder>()
+								.eq(LawsDataCenterFolder::getParentId, "0"));
+				if (CollectionUtils.isNotEmpty(firstList)){
+					queryWrapper.in(LawsDataCenterFolderSublist::getDataCenterFolderId,
+							firstList.stream().map(LawsDataCenterFolder::getId).collect(Collectors.toList()));
+				}
+			}else {
+				queryWrapper.eq(LawsDataCenterFolderSublist::getDataCenterFolderId, lawsDataCenterFolder.getParentId());
+			}
+			queryWrapper.eq(LawsDataCenterFolderSublist::getType, DataCenterCommon.AUTH_MANAGE);
+			queryWrapper.like(LawsDataCenterFolderSublist::getUserId, loginUser.getId());
+			int count = lawsDataCenterFolderSublistService.count(queryWrapper);
+			if (count == 0){
+				if(LanguageEnum.CN.equals(MessageUtils.getLanguage())) {
+					throw new JeroBootException("无权限!");
+				}else{
+					throw new JeroBootException("No access!");
+				}
+			}
+		}
 		lawsDataCenterFolder.setOwnerId(CurrentUserUtil.getId());
 		lawsDataCenterFolder.setOrgCode(CurrentUserUtil.getOrgCode());
 		if (StringUtils.isBlank(lawsDataCenterFolder.getParentId())) {