ZQ/laws-sinotruk-server
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix 81716 【水平越权】车型项目库-部分接口未处理水平越权

Browse Source
This commit is contained in:
lijiarao
2024-02-04 17:15:33 +08:00
parent 83f10c6a46
commit 1b8fe8c232
3 changed files with 55 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
laws-modules/src/main/java/com/jero/modules/projectLibrary/service/ILawsProjectLibraryService.java
+3 -1
View File
@@ -31,7 +31,9 @@ public interface ILawsProjectLibraryService extends IService<LawsProjectLibrary>
*/
void editById(LawsProjectLibrary lawsProjectLibrary);
/**
void checkPermission(LawsProjectLibrary projectLibrary);
/**
* 通过id删除
*/
void deleteById(String id);
laws-modules/src/main/java/com/jero/modules/projectLibrary/service/impl/LawsAssessServiceImpl.java
+9 -1
View File
@@ -15,10 +15,12 @@ import com.jero.modules.projectLibrary.common.AssessCommon;
import com.jero.modules.projectLibrary.entity.LawsAssess;
import com.jero.modules.projectLibrary.entity.LawsAssessResults;
import com.jero.modules.projectLibrary.entity.LawsEvaluationNotMet;
import com.jero.modules.projectLibrary.entity.LawsProjectLibrary;
import com.jero.modules.projectLibrary.mapper.LawsAssessMapper;
import com.jero.modules.projectLibrary.service.ILawsAssessResultsService;
import com.jero.modules.projectLibrary.service.ILawsAssessService;
import com.jero.modules.projectLibrary.service.ILawsEvaluationNotMetService;
import com.jero.modules.projectLibrary.service.ILawsProjectLibraryService;
import com.jero.modules.projectLibrary.vo.DecompositionOrderSourceVO;
import com.jero.modules.projectLibrary.vo.LawsAssessAddVo;
import com.jero.modules.split.entity.SarFileSplitInfoEO;
@@ -66,6 +68,8 @@ public class LawsAssessServiceImpl extends ServiceImpl<LawsAssessMapper, LawsAss
private ILawsAssessResultsService lawsAssessResultsService;
@Resource
private ILawsEvaluationNotMetService notMetService;
@Resource
private ILawsProjectLibraryService lawsProjectLibraryService;
/**
* 分页查询
*
@@ -139,13 +143,17 @@ public class LawsAssessServiceImpl extends ServiceImpl<LawsAssessMapper, LawsAss
@Override
public void deleteById(String id) {
LawsAssess lawsAssess = getById(id);
String projectId = lawsAssess.getProjectId();
//校验权限
LawsProjectLibrary projectLibrary = lawsProjectLibraryService.getById(projectId);
lawsProjectLibraryService.checkPermission(projectLibrary);
String processStatus = lawsAssess.getProcessStatus();
if (AssessCommon.UNDER_EVALUATION.equals(processStatus)){
throw new JeroBootException(ResultCommon.ERROR);
}
//未符合项中有整改中、审批中的数据时，不允许删除
LambdaQueryWrapper<LawsEvaluationNotMet> queryWrapper = new LambdaQueryWrapper<>();
queryWrapper.eq(LawsEvaluationNotMet::getProjectId, lawsAssess.getProjectId());
queryWrapper.eq(LawsEvaluationNotMet::getProjectId, projectId);
queryWrapper.in(LawsEvaluationNotMet::getStandardId, lawsAssess.getStandardId());
List<LawsEvaluationNotMet> notMetList = notMetService.list(queryWrapper);
for (LawsEvaluationNotMet notMet : notMetList) {
laws-modules/src/main/java/com/jero/modules/projectLibrary/service/impl/LawsProjectLibraryServiceImpl.java
+43
View File
@@ -5,6 +5,8 @@ import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
import com.baomidou.mybatisplus.core.conditions.update.LambdaUpdateWrapper;
import com.jero.common.api.vo.ResultCommon;
import com.jero.common.constant.CommonConstant;
import com.jero.common.system.vo.LoginUser;
import com.jero.modules.laws.common.util.CurrentUserUtil;
import com.jero.modules.projectLibrary.common.AssessCommon;
import com.jero.modules.projectLibrary.entity.LawsAssess;
import com.jero.modules.projectLibrary.entity.LawsEvaluationNotMet;
@@ -22,6 +24,8 @@ import org.springframework.transaction.annotation.Transactional;
import com.jero.common.exception.JeroBootException;
import java.util.List;
import java.util.Date;
import java.util.Objects;
import com.baomidou.mybatisplus.extension.service.impl.ServiceImpl;
import com.jero.common.system.query.QueryGenerator;
@@ -79,15 +83,29 @@ public class LawsProjectLibraryServiceImpl extends ServiceImpl<LawsProjectLibrar
*/
@Override
public void editById(LawsProjectLibrary lawsProjectLibrary) {
LawsProjectLibrary projectLibrary = getById(lawsProjectLibrary.getId());
checkPermission(projectLibrary);
saveOrUpdate(lawsProjectLibrary);
}
/**
* 校验权限
* @param projectLibrary
*/
@Override
public void checkPermission(LawsProjectLibrary projectLibrary){
LoginUser loginUser = CurrentUserUtil.getLoginUser();
if (!loginUser.getIsAdmin()&& !Objects.equals(loginUser.getUsername(),projectLibrary.getCreateBy())){
throw new JeroBootException(ResultCommon.NO_PERMISSIONS_PLEASE_SELECT);
}
}
/**
* 通过id删除
*/
@Override
public void deleteById(String id) {
LawsProjectLibrary projectLibrary = getById(id);
checkPermission(projectLibrary);
List<LawsAssess> allByProjectIdNotDeleted = lawsAssessService.getAllByProjectIdNotDeleted(id);
for (LawsAssess lawsAssess : allByProjectIdNotDeleted) {
String processStatus = lawsAssess.getProcessStatus();
@@ -117,6 +135,31 @@ public class LawsProjectLibraryServiceImpl extends ServiceImpl<LawsProjectLibrar
public void deleteByIds(List<String> ids) {
LambdaUpdateWrapper<LawsProjectLibrary> wrapper = new LambdaUpdateWrapper<>();
wrapper.in(LawsProjectLibrary::getId, ids);
List<LawsProjectLibrary> projectLibraryList = this.list(wrapper);
for (LawsProjectLibrary projectLibrary : projectLibraryList) {
checkPermission(projectLibrary);
String id = projectLibrary.getId();
List<LawsAssess> allByProjectIdNotDeleted = lawsAssessService.getAllByProjectIdNotDeleted(id);
for (LawsAssess lawsAssess : allByProjectIdNotDeleted) {
String processStatus = lawsAssess.getProcessStatus();
if (AssessCommon.UNDER_EVALUATION.equals(processStatus)){
throw new JeroBootException(ResultCommon.ASSESS_DELETE_ERROR2);
}
//未符合项中有整改中、审批中的数据时，不允许删除
LambdaQueryWrapper<LawsEvaluationNotMet> queryWrapper = new LambdaQueryWrapper<>();
queryWrapper.eq(LawsEvaluationNotMet::getProjectId, lawsAssess.getProjectId());
queryWrapper.in(LawsEvaluationNotMet::getStandardId, lawsAssess.getStandardId());
List<LawsEvaluationNotMet> notMetList = notMetService.list(queryWrapper);
for (LawsEvaluationNotMet notMet : notMetList) {
String state = notMet.getState();
if (AssessCommon.RECTIFICATION.equals(state)||
AssessCommon.UNDER_APPROVAL.equals(state)){
throw new JeroBootException(ResultCommon.ASSESS_DELETE_ERROR);
}
}
}
}
wrapper.set(LawsProjectLibrary::getDelFlag, CommonConstant.DEL_FLAG_1.toString());
update(wrapper);
}