QR/laws_chery_serve
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: scc流程提交审批增加水平越权校验

Browse Source
This commit is contained in:
mzaxd
2024-07-25 11:30:09 +08:00
parent 9a0a3c0d70
commit b961564c10
3 changed files with 48 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
laws-modules/src/main/java/com/jero/modules/activiti/process/fb/service/IProcessHandleService.java
+7
View File
@@ -41,6 +41,13 @@ public interface IProcessHandleService {
**/
void isMyTask(String taskId);
/**
* @Author: liao
* @Date: 2023/11/6 11:59
* @Description: 判断Task
**/
void validTask(String taskId);
/**
* @Author: liao
* @Date: 2023/11/6 14:22
laws-modules/src/main/java/com/jero/modules/activiti/process/fb/service/impl/ProcessHandleServiceImpl.java
+37 -3
View File
@@ -257,9 +257,43 @@ public class ProcessHandleServiceImpl implements IProcessHandleService {
if (Objects.isNull(task)) {
throw new JeroBootException(ResultCommon.TASK_NOT_EXISTS);
}
//if (!CurrentUserUtil.getId().equals(task.getAssignee())) {
// throw new JeroBootException(ResultCommon.NO_PERMISSION);
//}
LambdaQueryWrapper<ProcessApprovalRecord> lambdaQueryWrapper = new LambdaQueryWrapper<>();
lambdaQueryWrapper.eq(ProcessApprovalRecord::getTaskId, taskId);
ProcessApprovalRecord processApprovalRecord = processApprovalRecordService.getOne(lambdaQueryWrapper, false);
if (!CurrentUserUtil.getId().equals(processApprovalRecord.getUserId())) {
throw new JeroBootException(ResultCommon.TASK_NOT_EXISTS);
}
String curUserId = CurrentUserUtil.getId();
if (!curUserId.equals(processApprovalRecord.getUserId())) {
throw new JeroBootException(ResultCommon.NO_PERMISSION);
}
}
/**
* @Author: liao
* @Date: 2023/11/6 12:00
* @Description: 判断是否是自己的任务
**/
@Override
public void validTask(String taskId) {
if (StringUtils.isBlank(taskId)) {
throw new JeroBootException(ResultCommon.EMPTY_COMMON, "taskId");
}
Task task = taskService.createTaskQuery().taskId(taskId).singleResult();
if (Objects.isNull(task)) {
throw new JeroBootException(ResultCommon.TASK_NOT_EXISTS);
}
LambdaQueryWrapper<ProcessApprovalRecord> lambdaQueryWrapper = new LambdaQueryWrapper<>();
lambdaQueryWrapper.eq(ProcessApprovalRecord::getTaskId, taskId);
ProcessApprovalRecord processApprovalRecord = processApprovalRecordService.getOne(lambdaQueryWrapper, false);
if (!CurrentUserUtil.getId().equals(processApprovalRecord.getUserId())) {
throw new JeroBootException(ResultCommon.TASK_NOT_EXISTS);
}
String curUserId = CurrentUserUtil.getId();
if (!curUserId.equals(processApprovalRecord.getUserId())) {
throw new JeroBootException(ResultCommon.NO_PERMISSION);
}
}
laws-modules/src/main/java/com/jero/modules/activiti/process/standardComplianceCheck/service/impl/ProcessStandardComplianceCheckServiceImpl.java
+4 -7
View File
@@ -217,9 +217,8 @@ public class ProcessStandardComplianceCheckServiceImpl extends ServiceImpl<Proce
// 获取task
BasicTaskInfoDTO processTask = processInfoVO.getBasicTaskInfoDTO();
String taskId = processTask.getTaskId();
if (StrUtil.isBlank(taskId) || !actFlowCommonService.taskExists(taskId)) {
throw new JeroBootException("taskId为空或任务不存在");
}
// 校验是否有权限操作此待办
processHandleService.validTask(taskId);
String prcId = actFlowCommonService.getProcessInstanceIdByTaskId(taskId);
BasicProcessInfoDTO processInfo = new BasicProcessInfoDTO();
processInfo.setProcessInstanceId(prcId);
@@ -269,10 +268,8 @@ public class ProcessStandardComplianceCheckServiceImpl extends ServiceImpl<Proce
public void submit(ProcessInfoVO<ProcessSccVO> processInfoVO) {
BasicTaskInfoDTO processTask = processInfoVO.getBasicTaskInfoDTO();
String taskId = processTask.getTaskId();
// 获取task
if (StrUtil.isBlank(taskId) || !actFlowCommonService.taskExists(taskId)) {
throw new JeroBootException("taskId为空或任务不存在");
}
// 校验是否有权限操作此待办
processHandleService.validTask(taskId);
// 获取当前节点的id
ProcessApprovalRecord record = actFlowCommonService.getNodeIdByTaskId(taskId);
String xmlNodeId = record.getNodeId();