ZQ/laws-sinotruk-server
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: 80955 【水平越权】问答库-部分接口未处理水平越权

Browse Source
This commit is contained in:
mzaxd
2024-02-01 18:28:28 +08:00
parent 89e7c162b1
commit 2b900b833f
1 changed files with 1 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
laws-modules/src/main/java/com/jero/modules/laws/library/service/impl/LawsProblemLibraryServiceImpl.java
+1 -2
View File
@@ -222,12 +222,11 @@ public class LawsProblemLibraryServiceImpl extends ServiceImpl<LawsProblemLibrar
LoginUser currentUser = UserUtils.getCurrentUser(); LoginUser currentUser = UserUtils.getCurrentUser();
List<String> userRoleList = userService.getRole(currentUser.getUsername()); List<String> userRoleList = userService.getRole(currentUser.getUsername());
LawsAnswerLibrary answer = lawsAnswerLibraryService.getById(id); LawsAnswerLibrary answer = lawsAnswerLibraryService.getById(id);
LawsProblemLibrary problem = getById(answer.getProblemId());
// 如果是管理员权限 则跳过验证 // 如果是管理员权限 则跳过验证
List<String> adminRoleList = Arrays.asList(adminRoleCode.split(",")); List<String> adminRoleList = Arrays.asList(adminRoleCode.split(","));
// 如果不是管理员权限 且不是问题创建者 且不是回答创建者 则没有权限 // 如果不是管理员权限 且不是问题创建者 且不是回答创建者 则没有权限
if (adminRoleList.stream().noneMatch(userRoleList::contains)) { if (adminRoleList.stream().noneMatch(userRoleList::contains)) {
if (!currentUser.getUsername().equals(problem.getCreateBy())) { if (!currentUser.getUsername().equals(answer.getUserId())) {
throw new JeroBootException(ResultCommon.NO_PERMISSION); throw new JeroBootException(ResultCommon.NO_PERMISSION);
} }
} }