fix(88734): 【水平越权】文档拆分发布接口未做水平越权

2024-08-19 18:44:18 +08:00
parent afa0e1e3c4
commit 9e2b4d1dd0
1 changed files with 13 additions and 0 deletions
@@ -1205,6 +1205,19 @@ public class DocumentSplitServiceImpl implements IDocumentSplitService {
        if (b){
            // 水平越权
            isHorizontalOverstep(id);
+            LoginUser loginUser = (LoginUser) SecurityUtils.getSubject().getPrincipal();
+            int count = sarFileSplitInfoService.count(
+                    new LambdaQueryWrapper<SarFileSplitInfoEO>()
+                            .eq(SarFileSplitInfoEO::getId, id)
+                            .eq(SarFileSplitInfoEO::getAuthor, loginUser.getId()));
+            if (count <= 0){
+                if(LanguageEnum.CN.equals(MessageUtils.getLanguage())) {
+                    throw new JeroBootException("无权限!");
+                }else{
+                    throw new JeroBootException("No access!");
+                }
+            }
+
        }
        // 文档拆分信息(旧)
        DocumentSplitInfo oldInfo = documentSplitMapper.queryDocumentSplitInfoById(id);