QR/laws_chery_serve
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(88718): 【水平越权】资料中心目录新增同级接口未处理水平越权

Browse Source
This commit is contained in:
yjz
2024-08-17 00:35:07 +08:00
parent d0b58d86b2
commit 7013703225
1 changed files with 29 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
laws-modules/src/main/java/com/jero/modules/laws/dataCenter/service/impl/LawsDataCenterFolderServiceImpl.java
+29
View File
@@ -204,6 +204,35 @@ public class LawsDataCenterFolderServiceImpl extends ServiceImpl<LawsDataCenterF
*/ */
@Override @Override
public void add(LawsDataCenterFolder lawsDataCenterFolder) { public void add(LawsDataCenterFolder lawsDataCenterFolder) {
// 水平越权
LoginUser loginUser = (LoginUser) SecurityUtils.getSubject().getPrincipal();
String roleIds = loginUser.getRoleIds();
List<String> adminRoleCodeList = Arrays.asList(adminRoleCode.split(","));
Collection<String> intersection = CollectionUtils.intersection(Arrays.asList(roleIds.split(",")), adminRoleCodeList);
if (!roleIds.contains("admin") && CollectionUtils.isEmpty(intersection)){
LambdaQueryWrapper<LawsDataCenterFolderSublist> queryWrapper = new LambdaQueryWrapper<>();
if ("0".equals(lawsDataCenterFolder.getParentId())) {
List<LawsDataCenterFolder> firstList = list(
new LambdaQueryWrapper<LawsDataCenterFolder>()
.eq(LawsDataCenterFolder::getParentId, "0"));
if (CollectionUtils.isNotEmpty(firstList)){
queryWrapper.in(LawsDataCenterFolderSublist::getDataCenterFolderId,
firstList.stream().map(LawsDataCenterFolder::getId).collect(Collectors.toList()));
}
}else {
queryWrapper.eq(LawsDataCenterFolderSublist::getDataCenterFolderId, lawsDataCenterFolder.getParentId());
}
queryWrapper.eq(LawsDataCenterFolderSublist::getType, DataCenterCommon.AUTH_MANAGE);
queryWrapper.like(LawsDataCenterFolderSublist::getUserId, loginUser.getId());
int count = lawsDataCenterFolderSublistService.count(queryWrapper);
if (count == 0){
if(LanguageEnum.CN.equals(MessageUtils.getLanguage())) {
throw new JeroBootException("无权限!");
}else{
throw new JeroBootException("No access!");
}
}
}
lawsDataCenterFolder.setOwnerId(CurrentUserUtil.getId()); lawsDataCenterFolder.setOwnerId(CurrentUserUtil.getId());
lawsDataCenterFolder.setOrgCode(CurrentUserUtil.getOrgCode()); lawsDataCenterFolder.setOrgCode(CurrentUserUtil.getOrgCode());
if (StringUtils.isBlank(lawsDataCenterFolder.getParentId())) { if (StringUtils.isBlank(lawsDataCenterFolder.getParentId())) {