ZQ/laws-sinotruk-server
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix 80384 未符合项 数据权限校验失败

Browse Source
This commit is contained in:
lijiarao
2024-01-24 10:20:44 +08:00
parent 870f3994b4
commit 01c377e153
6 changed files with 32 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
laws-base/laws-base-core/src/main/java/com/jero/common/api/vo/ResultCommon.java
+2
View File
@@ -69,6 +69,8 @@ public class ResultCommon {
public static final String HORIZONTAL_TRANSGRESSION = "horizontal.transgression"; // 水平越权
public static final String NO_PERMISSIONS_PLEASE_SELECT = "horizontal.transgression.select"; // 暂无权限，请重新选择
public static final String SELECT_LEVEL_TWO_TREE_NODE = "select.level.two.tree.node"; // 请先选择二级及以下体系
public static final String EXPORT_ERROR = "export.error"; // 导出ZIP压缩包失败
laws-modules/src/main/java/com/jero/modules/projectLibrary/controller/LawsEvaluationNotMetController.java
+6 -9
View File
@@ -4,7 +4,6 @@ import javax.servlet.http.HttpServletRequest;
import com.jero.common.api.vo.Result;
import com.jero.common.exception.JeroBootException;
import com.jero.common.system.vo.LoginUser;
import com.jero.common.util.MessageUtils;
import com.jero.common.api.vo.ResultCommon;
import com.jero.modules.laws.common.constant.FieldCommon;
import com.jero.modules.laws.common.util.CurrentUserUtil;
@@ -29,7 +28,6 @@ import org.apache.poi.ss.formula.functions.T;
import java.util.Arrays;
import java.util.Date;
import java.util.List;
import java.util.Map;
/**
@@ -111,7 +109,7 @@ public class LawsEvaluationNotMetController extends JeroController<LawsEvaluatio
}
List<String> idList = Arrays.asList(ids.split(","));
//检查所选数据是否均是待整改状态、当前时间大于预计整改完成日期
if (this.check(idList)) {
if (!this.check(idList)) {
throw new JeroBootException(ResultCommon.CANNOT_CLOSE);
}
lawsEvaluationNotMetService.batchClose(idList);
@@ -126,16 +124,15 @@ public class LawsEvaluationNotMetController extends JeroController<LawsEvaluatio
List<LawsEvaluationNotMet> notMets = lawsEvaluationNotMetService.listByIds(ids);
for (LawsEvaluationNotMet notMet : notMets) {
//管理员和设计工程师可以操作未符合项
if (!roleIds.contains(FieldCommon.ROLE_ADMIN) || !userId.equals(notMet.getEngineerId())){
throw new JeroBootException(ResultCommon.HORIZONTAL_TRANSGRESSION);
if (!roleIds.contains(FieldCommon.ROLE_ADMIN) && !userId.equals(notMet.getEngineerId())){
throw new JeroBootException(ResultCommon.NO_PERMISSIONS_PLEASE_SELECT);
}
String state = notMet.getState();
Date expectedTime = notMet.getExpectedTime();
// 判断expectedTime是否小于今日
boolean isLessThanToday = expectedTime.before(date);
if (!state.equals(AssessCommon.TO_BE_RECTIFIED) || !isLessThanToday){
//判断是否是待整改，超期
if (!state.equals(AssessCommon.TO_BE_RECTIFIED) && !state.equals(AssessCommon.OVERDUE)) {
return false;
}
}
return true;
}
laws-modules/src/main/java/com/jero/modules/projectLibrary/service/impl/LawsEvaluationNotMetServiceImpl.java
+15 -10
View File
@@ -2,7 +2,6 @@ package com.jero.modules.projectLibrary.service.impl;
import cn.hutool.core.date.DateTime;
import cn.hutool.core.date.DateUtil;
import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
import com.baomidou.mybatisplus.core.conditions.update.LambdaUpdateWrapper;
import com.jero.common.api.vo.ResultCommon;
@@ -20,9 +19,7 @@ import com.jero.modules.projectLibrary.common.AssessCommon;
import com.jero.modules.projectLibrary.entity.LawsEvaluationNotMet;
import com.jero.modules.projectLibrary.mapper.LawsEvaluationNotMetMapper;
import com.jero.modules.projectLibrary.service.ILawsEvaluationNotMetService;
import io.swagger.annotations.ApiModelProperty;
import org.apache.commons.lang3.StringUtils;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Service;
import org.springframework.transaction.annotation.Transactional;
import com.jero.common.exception.JeroBootException;
@@ -169,18 +166,22 @@ public class LawsEvaluationNotMetServiceImpl extends ServiceImpl<LawsEvaluationN
@Override
public void editById(LawsEvaluationNotMet lawsEvaluationNotMet) {
String id = lawsEvaluationNotMet.getId();
checkPermission(id);
//保存标准id和来源到未符合项
setStandardIdAndSource(lawsEvaluationNotMet);
saveOrUpdate(lawsEvaluationNotMet);
}
private void checkPermission(String id) {
LawsEvaluationNotMet notMet = this.getById(id);
LoginUser loginUser = CurrentUserUtil.getLoginUser();
String roleIds = loginUser.getRoleIds();
String userId = loginUser.getId();
//管理员和设计工程师可以操作未符合项
if (!roleIds.contains(FieldCommon.ROLE_ADMIN) || !userId.equals(notMet.getEngineerId())){
throw new JeroBootException(ResultCommon.HORIZONTAL_TRANSGRESSION);
if (!roleIds.contains(FieldCommon.ROLE_ADMIN) && !userId.equals(notMet.getEngineerId())){
throw new JeroBootException(ResultCommon.NO_PERMISSIONS_PLEASE_SELECT);
}
//保存标准id和来源到未符合项
setStandardIdAndSource(lawsEvaluationNotMet);
saveOrUpdate(lawsEvaluationNotMet);
}
}
/**
* 通过id删除
@@ -190,7 +191,8 @@ public class LawsEvaluationNotMetServiceImpl extends ServiceImpl<LawsEvaluationN
*/
@Override
public void deleteById(String id) {
removeById(id);
checkPermission(id);
removeById(id);
}
/**
@@ -201,6 +203,9 @@ public class LawsEvaluationNotMetServiceImpl extends ServiceImpl<LawsEvaluationN
*/
@Override
public void deleteByIds(List<String> ids) {
for (String id : ids) {
checkPermission(id);
}
removeByIds(ids);
}
laws-single-startup/src/main/resources/i18n/messages.properties
+3 -2
View File
@@ -35,7 +35,7 @@ the.job.number.cannot.be.empty.export=Line {0},job number cannot be empty
the.real.name.cannot.be.empty.export=Line {0},real name cannot be empty
job.number.does.not.exist.export=Line {0},job number does not exist
duplicate.job.number.export=Line {0},duplicate job number
cannot.close=Expired data that is not pending rectification cannot be closed
cannot.close=\u4E0D\u662F\u5F85\u6574\u6539\u6216\u8D85\u671F\u7684\u6570\u636E\u4E0D\u80FD\u5173\u95ED
no.corresponding.record.found=\u672A\u627E\u5230\u5BF9\u5E94\u8BB0\u5F55
parameters.cannot.be.null=\u53C2\u6570\u4E0D\u80FD\u4E3A\u7A7A
@@ -69,4 +69,5 @@ tag.add.error.2=\u6BCF\u5F20\u8868\u6700\u591A\u670950\u4E2A\u5B57\u6BB5\u3002
task.urging.error=\u53EA\u80FD\u50AC\u529E\u5F85\u529E\u4EFB\u52A1
invalid.esp=\u65E0\u6548\u7684\u4F01\u6807\u8BA1\u5212\uFF0C\u8BF7\u91CD\u65B0\u9009\u62E9
can.not.edit.abolish.or.archive.es=\u5DF2\u5E9F\u6B62\u6216\u5DF2\u5F52\u6863\u7684\u4F01\u6807\u8BA1\u5212\u4E0D\u80FD\u7F16\u8F91,\u8BF7\u91CD\u65B0\u9009\u62E9
task.urging.error.2=\u6682\u65E0\u8BE5\u6D41\u7A0B\u50AC\u529E\u6743\u9650
task.urging.error.2=\u6682\u65E0\u8BE5\u6D41\u7A0B\u50AC\u529E\u6743\u9650
horizontal.transgression.select=\u6682\u65E0\u6743\u9650\uFF0C\u8BF7\u91CD\u65B0\u9009\u62E9
laws-single-startup/src/main/resources/i18n/messages_en.properties
+3 -2
View File
@@ -37,7 +37,7 @@ the.job.number.cannot.be.empty.export=Line {0},job number cannot be empty
the.real.name.cannot.be.empty.export=Line {0},real name cannot be empty
job.number.does.not.exist.export=Line {0},job number does not exist
duplicate.job.number.export=Line {0},duplicate job number
cannot.close=Expired data that is not pending rectification cannot be closed
cannot.close=Data that is not pending rectification or overdue cannot be closed
@@ -74,4 +74,5 @@ tag.add.error.2=each table can have a maximum of 50 fields.
task.urging.error=Can only remind to do tasks
invalid.esp=Invalid enterprise standard, please check
can.not.edit.abolish.or.archive.es=Can not edit abolished or archived enterprise standards, please check
task.urging.error.2=I currently do not have the authority to urge this process
task.urging.error.2=I currently do not have the authority to urge this process
horizontal.transgression.select=no permission at the moment please reselect
laws-single-startup/src/main/resources/i18n/messages_zh.properties
+3 -2
View File
@@ -36,7 +36,7 @@ the.job.number.cannot.be.empty.export=\u7B2C{0}\u884C,\u5DE5\u53F7\u4E0D\u80FD\u
the.real.name.cannot.be.empty.export=\u7B2C{0}\u884C,\u59D3\u540D\u4E0D\u80FD\u4E3A\u7A7A
job.number.does.not.exist.export=\u7B2C{0}\u884C,\u5DE5\u53F7\u4E0D\u5B58\u5728
duplicate.job.number.export=\u7B2C{0}\u884C,\u5DE5\u53F7\u91CD\u590D
cannot.close=\u4E0D\u662F\u5F85\u6574\u6539\u5DF2\u8FC7\u671F\u7684\u6570\u636E\u4E0D\u80FD\u5173\u95ED
cannot.close=\u4E0D\u662F\u5F85\u6574\u6539\u6216\u8D85\u671F\u7684\u6570\u636E\u4E0D\u80FD\u5173\u95ED
@@ -74,4 +74,5 @@ tag.add.error.2=\u6BCF\u5F20\u8868\u6700\u591A\u670950\u4E2A\u5B57\u6BB5\u3002
task.urging.error=\u53EA\u80FD\u50AC\u529E\u5F85\u529E\u4EFB\u52A1
invalid.esp=\u65E0\u6548\u7684\u4F01\u6807\u8BA1\u5212\uFF0C\u8BF7\u91CD\u65B0\u9009\u62E9
can.not.edit.abolish.or.archive.es=\u5DF2\u5E9F\u6B62\u6216\u5DF2\u5F52\u6863\u7684\u4F01\u6807\u8BA1\u5212\u4E0D\u80FD\u7F16\u8F91,\u8BF7\u91CD\u65B0\u9009\u62E9
task.urging.error.2=\u6682\u65E0\u8BE5\u6D41\u7A0B\u50AC\u529E\u6743\u9650
task.urging.error.2=\u6682\u65E0\u8BE5\u6D41\u7A0B\u50AC\u529E\u6743\u9650
horizontal.transgression.select=\u6682\u65E0\u6743\u9650\uFF0C\u8BF7\u91CD\u65B0\u9009\u62E9