fix: scc流程提交审批增加水平越权校验

laws-modules/src/main/java/com/jero/modules/activiti/process/fb/service/IProcessHandleService.java

@@ -41,6 +41,13 @@ public interface IProcessHandleService {
      **/
     void isMyTask(String taskId);
 
+    /**
+     * @Author: liao
+     * @Date: 2023/11/6 11:59
+     * @Description: 判断Task
+     **/
+    void validTask(String taskId);
+
     /**
      * @Author: liao
      * @Date: 2023/11/6 14:22

laws-modules/src/main/java/com/jero/modules/activiti/process/fb/service/impl/ProcessHandleServiceImpl.java

@@ -257,9 +257,43 @@ public class ProcessHandleServiceImpl implements IProcessHandleService {
         if (Objects.isNull(task)) {
             throw new JeroBootException(ResultCommon.TASK_NOT_EXISTS);
         }
-        //if (!CurrentUserUtil.getId().equals(task.getAssignee())) {
+        LambdaQueryWrapper<ProcessApprovalRecord> lambdaQueryWrapper = new LambdaQueryWrapper<>();
-        //    throw new JeroBootException(ResultCommon.NO_PERMISSION);
+        lambdaQueryWrapper.eq(ProcessApprovalRecord::getTaskId, taskId);
-        //}
+        ProcessApprovalRecord processApprovalRecord = processApprovalRecordService.getOne(lambdaQueryWrapper, false);
+        if (!CurrentUserUtil.getId().equals(processApprovalRecord.getUserId())) {
+            throw new JeroBootException(ResultCommon.TASK_NOT_EXISTS);
+        }
+        String curUserId = CurrentUserUtil.getId();
+        if (!curUserId.equals(processApprovalRecord.getUserId())) {
+            throw new JeroBootException(ResultCommon.NO_PERMISSION);
+        }
+    }
+
+
+    /**
+     * @Author: liao
+     * @Date: 2023/11/6 12:00
+     * @Description: 判断是否是自己的任务
+     **/
+    @Override
+    public void validTask(String taskId) {
+        if (StringUtils.isBlank(taskId)) {
+            throw new JeroBootException(ResultCommon.EMPTY_COMMON, "taskId");
+        }
+        Task task = taskService.createTaskQuery().taskId(taskId).singleResult();
+        if (Objects.isNull(task)) {
+            throw new JeroBootException(ResultCommon.TASK_NOT_EXISTS);
+        }
+        LambdaQueryWrapper<ProcessApprovalRecord> lambdaQueryWrapper = new LambdaQueryWrapper<>();
+        lambdaQueryWrapper.eq(ProcessApprovalRecord::getTaskId, taskId);
+        ProcessApprovalRecord processApprovalRecord = processApprovalRecordService.getOne(lambdaQueryWrapper, false);
+        if (!CurrentUserUtil.getId().equals(processApprovalRecord.getUserId())) {
+            throw new JeroBootException(ResultCommon.TASK_NOT_EXISTS);
+        }
+        String curUserId = CurrentUserUtil.getId();
+        if (!curUserId.equals(processApprovalRecord.getUserId())) {
+            throw new JeroBootException(ResultCommon.NO_PERMISSION);
+        }
     }
 
 

laws-modules/src/main/java/com/jero/modules/activiti/process/standardComplianceCheck/service/impl/ProcessStandardComplianceCheckServiceImpl.java

@@ -217,9 +217,8 @@ public class ProcessStandardComplianceCheckServiceImpl extends ServiceImpl<Proce
         // 获取task
         BasicTaskInfoDTO processTask = processInfoVO.getBasicTaskInfoDTO();
         String taskId = processTask.getTaskId();
-        if (StrUtil.isBlank(taskId) || !actFlowCommonService.taskExists(taskId)) {
+        // 校验是否有权限操作此待办
-            throw new JeroBootException("taskId为空或任务不存在");
+        processHandleService.validTask(taskId);
-        }
         String prcId = actFlowCommonService.getProcessInstanceIdByTaskId(taskId);
         BasicProcessInfoDTO processInfo = new BasicProcessInfoDTO();
         processInfo.setProcessInstanceId(prcId);
@@ -269,10 +268,8 @@ public class ProcessStandardComplianceCheckServiceImpl extends ServiceImpl<Proce
     public void submit(ProcessInfoVO<ProcessSccVO> processInfoVO) {
         BasicTaskInfoDTO processTask = processInfoVO.getBasicTaskInfoDTO();
         String taskId = processTask.getTaskId();
-        // 获取task
+        // 校验是否有权限操作此待办
-        if (StrUtil.isBlank(taskId) || !actFlowCommonService.taskExists(taskId)) {
+        processHandleService.validTask(taskId);
-            throw new JeroBootException("taskId为空或任务不存在");
-        }
         // 获取当前节点的id
         ProcessApprovalRecord record = actFlowCommonService.getNodeIdByTaskId(taskId);
         String xmlNodeId = record.getNodeId();