fix: 80955 【水平越权】问答库-部分接口未处理水平越权

2024-02-01 18:28:28 +08:00
parent 89e7c162b1
commit 2b900b833f
1 changed files with 1 additions and 2 deletions
@@ -222,12 +222,11 @@ public class LawsProblemLibraryServiceImpl extends ServiceImpl<LawsProblemLibrar
        LoginUser currentUser = UserUtils.getCurrentUser();
        List<String> userRoleList = userService.getRole(currentUser.getUsername());
        LawsAnswerLibrary answer = lawsAnswerLibraryService.getById(id);
-        LawsProblemLibrary problem = getById(answer.getProblemId());
        // 如果是管理员权限 则跳过验证
        List<String> adminRoleList = Arrays.asList(adminRoleCode.split(","));
        // 如果不是管理员权限 且不是问题创建者 且不是回答创建者 则没有权限
        if (adminRoleList.stream().noneMatch(userRoleList::contains)) {
-            if (!currentUser.getUsername().equals(problem.getCreateBy())) {
+            if (!currentUser.getUsername().equals(answer.getUserId())) {
                throw new JeroBootException(ResultCommon.NO_PERMISSION);
            }
        }