ZQ/laws-sinotruk-server
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(文档拆分、自定义比对、新旧拆分单对比): 水平越权

Browse Source
This commit is contained in:
yjz
2024-01-04 22:32:22 +08:00
parent c078a70d0d
commit 4c984e9532
9 changed files with 104 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
laws-modules/src/main/java/com/jero/modules/compare/controller/SarFileCompareInfoController.java
+4
View File
@@ -245,6 +245,8 @@ public class SarFileCompareInfoController extends JeroController<SarFileCompareI
@PostMapping(value = "/delete")
@ApiOperationSupport(order = 5)
public Result<?> delete(@RequestBody IdMapBody mapBody) {
// 水平越权
sarFileCompareInfoService.isHorizontalOverstep(mapBody.getId());
sarFileCompareInfoService.deleteById(mapBody.getId());
return Result.OK("删除成功!");
}
@@ -258,6 +260,8 @@ public class SarFileCompareInfoController extends JeroController<SarFileCompareI
@PostMapping(value = "/deleteBatch")
@ApiOperationSupport(order = 6)
public Result<?> deleteBatch(@RequestBody IdsMapBody mapBody) {
// 水平越权
sarFileCompareInfoService.isHorizontalOverstep(mapBody.getIds());
this.sarFileCompareInfoService.deleteByIds(Arrays.asList(mapBody.getIds().split(",")));
return Result.OK("批量删除成功!");
}
laws-modules/src/main/java/com/jero/modules/compare/controller/SarFileCompareItemCommentController.java
+14 -1
View File
@@ -9,6 +9,7 @@ import com.jero.common.system.base.controller.JeroController;
import com.jero.common.system.query.QueryGenerator;
import com.jero.modules.compare.entity.SarFileCompareItemComment;
import com.jero.modules.compare.entity.SarFileCompareResultVO;
import com.jero.modules.compare.service.ISarFileCompareInfoService;
import com.jero.modules.compare.service.ISarFileCompareItemCommentService;
import com.jero.modules.system.vo.IdMapBody;
import com.jero.modules.system.vo.IdsMapBody;
@@ -26,6 +27,7 @@ import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.util.Arrays;
import java.util.List;
import java.util.stream.Collectors;
/**
@@ -42,6 +44,9 @@ public class SarFileCompareItemCommentController extends JeroController<SarFileC
@Autowired
private ISarFileCompareItemCommentService sarFileCompareItemCommentService;
@Autowired
private ISarFileCompareInfoService sarFileCompareInfoService;
/**
* 分页列表查询
*
@@ -128,6 +133,9 @@ public class SarFileCompareItemCommentController extends JeroController<SarFileC
@ApiOperation(value = "新旧拆分单对比条款评论表-通过id删除", notes = "新旧拆分单对比条款评论表-通过id删除")
@PostMapping(value = "/delete")
public Result<?> delete(@RequestBody IdMapBody mapBody) {
// 水平越权
SarFileCompareItemComment sarFileCompareItemComment = sarFileCompareItemCommentService.getById(mapBody.getId());
sarFileCompareInfoService.isHorizontalOverstep(sarFileCompareItemComment.getInfoId());
sarFileCompareItemCommentService.deleteById(mapBody.getId());
return Result.OK("删除成功!");
}
@@ -139,7 +147,12 @@ public class SarFileCompareItemCommentController extends JeroController<SarFileC
@ApiOperation(value = "新旧拆分单对比条款评论表-批量删除", notes = "新旧拆分单对比条款评论表-批量删除")
@PostMapping(value = "/deleteBatch")
public Result<?> deleteBatch(@RequestBody IdsMapBody mapBody) {
this.sarFileCompareItemCommentService.deleteByIds(Arrays.asList(mapBody.getIds().split(",")));
// 水平越权
List<String> list = Arrays.asList(mapBody.getIds().split(","));
List<SarFileCompareItemComment> sarFileCompareItemComments = sarFileCompareItemCommentService.listByIds(list);
String infoIds = sarFileCompareItemComments.stream().map(SarFileCompareItemComment::getInfoId).collect(Collectors.joining(","));
sarFileCompareInfoService.isHorizontalOverstep(infoIds);
this.sarFileCompareItemCommentService.deleteByIds(list);
return Result.OK("批量删除成功!");
}
laws-modules/src/main/java/com/jero/modules/compare/service/ISarFileCompareInfoService.java
+6
View File
@@ -78,4 +78,10 @@ public interface ISarFileCompareInfoService extends IService<SarFileCompareInfo>
* @return
*/
SarFileCompareDetailVO getComparisonDetail(String id);
/**
* 是否水平越权
* @param ids
*/
void isHorizontalOverstep(String ids);
}
laws-modules/src/main/java/com/jero/modules/compare/service/impl/SarFileCompareInfoServiceImpl.java
+28
View File
@@ -1,6 +1,11 @@
package com.jero.modules.compare.service.impl;
import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
import com.baomidou.mybatisplus.extension.service.impl.ServiceImpl;
import com.jero.common.constant.enums.LanguageEnum;
import com.jero.common.exception.JeroBootException;
import com.jero.common.system.vo.LoginUser;
import com.jero.common.util.MessageUtils;
import com.jero.modules.compare.entity.*;
import com.jero.modules.compare.enums.ReleaseConditionEnum;
import com.jero.modules.compare.mapper.SarFileCompareInfoMapper;
@@ -17,6 +22,7 @@ import com.jero.modules.split.service.IFileSplitItemsEOService;
import com.jero.modules.split.service.ISarFileSplitInfoService;
import com.jero.modules.split.service.ISarFileSplitMenuEOService;
import com.jero.modules.system.util.MyStringUtils;
import org.apache.shiro.SecurityUtils;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Service;
@@ -42,6 +48,9 @@ public class SarFileCompareInfoServiceImpl extends ServiceImpl<SarFileCompareInf
@Autowired
private ISarFileSplitInfoService sarFileSplitInfoEOService;
@Autowired
private ISarFileCompareInfoService sarFileCompareInfoService;
@Autowired
private ISarFileCompareItemService sarFileCompareItemService;
@@ -285,6 +294,8 @@ public class SarFileCompareInfoServiceImpl extends ServiceImpl<SarFileCompareInf
@Override
public SarFileCompareDetailVO getComparisonDetail(String id) {
// 水平越权
isHorizontalOverstep(id);
SarFileCompareDetailVO sfVo = new SarFileCompareDetailVO();
SarFileCompareInfo sfcInfo = this.queryById(id);
sfVo.setInfoId(id);
@@ -327,6 +338,23 @@ public class SarFileCompareInfoServiceImpl extends ServiceImpl<SarFileCompareInf
return sfVo;
}
@Override
public void isHorizontalOverstep(String ids) {
LoginUser loginUser = (LoginUser) SecurityUtils.getSubject().getPrincipal();
LambdaQueryWrapper<SarFileCompareInfo> queryWrapper = new LambdaQueryWrapper<>();
List<String> idList = Arrays.asList(ids.split(","));
queryWrapper.in(SarFileCompareInfo::getId, idList);
queryWrapper.and(LambdaQueryWrapper -> LambdaQueryWrapper.eq(SarFileCompareInfo::getCreateBy, loginUser.getUsername()).or().eq(SarFileCompareInfo::getReleaseState, ReleaseConditionEnum.PUBLISHED.getValue()));
int count = sarFileCompareInfoService.count(queryWrapper);
if (count <= 0 || count != idList.size()) {
if(LanguageEnum.CN.equals(MessageUtils.getLanguage())) {
throw new JeroBootException("无权限!");
}else{
throw new JeroBootException("No access!");
}
}
}
private List<SarFileCompareMenuVo> tree(List<SarFileCompareMenuVo> list) {
List<SarFileCompareMenuVo> compareMenuVos = new ArrayList<>();
//先删除name是总目录的数据
laws-modules/src/main/java/com/jero/modules/compare/service/impl/SarFileCompareItemCommentServiceImpl.java
+11
View File
@@ -60,6 +60,9 @@ public class SarFileCompareItemCommentServiceImpl extends ServiceImpl<SarFileCom
@Autowired
private ISarFileCompareItemService SarFileCompareItemServiceImpl;
@Autowired
private ISarFileCompareInfoService sarFileCompareInfoService;
@Value("${jero.path.upload}")
private String filePath;
@Value("${jero.path.uploadCos}")
@@ -76,6 +79,8 @@ public class SarFileCompareItemCommentServiceImpl extends ServiceImpl<SarFileCom
*/
@Override
public void add(SarFileCompareItemComment sarFileCompareItemComment) {
// 水平越权
sarFileCompareInfoService.isHorizontalOverstep(sarFileCompareItemComment.getInfoId());
Date now = new Date();
sarFileCompareItemComment.setCreateTime(now);
sarFileCompareItemComment.setUpdateTime(now);
@@ -93,6 +98,8 @@ public class SarFileCompareItemCommentServiceImpl extends ServiceImpl<SarFileCom
*/
@Override
public void editById(SarFileCompareItemComment sarFileCompareItemComment) {
// 水平越权
sarFileCompareInfoService.isHorizontalOverstep(sarFileCompareItemComment.getInfoId());
SarFileCompareItemComment ic = queryById(sarFileCompareItemComment.getId());
Date now = new Date();
ic.setUpdateTime(now);
@@ -167,6 +174,8 @@ public class SarFileCompareItemCommentServiceImpl extends ServiceImpl<SarFileCom
@Override
public SarFileCompareResultVO queryCompareResult(String infoId,String comment) {
// 水平越权
sarFileCompareInfoService.isHorizontalOverstep(infoId);
SarFileCompareResultVO resultVO = new SarFileCompareResultVO();
SarFileCompareInfo sfcInfo = sarFileCompareInfoServiceImpl.queryById(infoId);
resultVO.setInfoId(infoId);
@@ -225,6 +234,8 @@ public class SarFileCompareItemCommentServiceImpl extends ServiceImpl<SarFileCom
@Override
public void exportResXls(HttpServletRequest request,HttpServletResponse response, String infoId, String selectIds, boolean includeComments, String cut,String comment) {
// 水平越权
sarFileCompareInfoService.isHorizontalOverstep(infoId);
List<SarFileCompareItemComment> list = null;
if (includeComments && MyStringUtils.isEmpty(selectIds)) {
//只导出全文评论的情况
laws-modules/src/main/java/com/jero/modules/compare/service/impl/SarFileCompareResCommentServiceImpl.java
+7
View File
@@ -6,6 +6,7 @@ import com.google.common.collect.Lists;
import com.jero.modules.compare.entity.SarFileCompareResComVO;
import com.jero.modules.compare.entity.SarFileCompareResComment;
import com.jero.modules.compare.mapper.SarFileCompareResCommentMapper;
import com.jero.modules.compare.service.ISarFileCompareInfoService;
import com.jero.modules.compare.service.ISarFileCompareResCommentService;
import com.jero.modules.system.entity.SysUser;
import com.jero.modules.system.service.ISysUserService;
@@ -28,6 +29,8 @@ public class SarFileCompareResCommentServiceImpl extends ServiceImpl<SarFileComp
private static SimpleDateFormat sdf = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss");
@Autowired
private ISysUserService sysUserService;
@Autowired
private ISarFileCompareInfoService sarFileCompareInfoService;
/**
* 保存
@@ -37,6 +40,8 @@ public class SarFileCompareResCommentServiceImpl extends ServiceImpl<SarFileComp
*/
@Override
public void add(SarFileCompareResComment sarFileCompareResComment) {
// 水平越权九
sarFileCompareInfoService.isHorizontalOverstep(sarFileCompareResComment.getInfoId());
Date now = new Date();
sarFileCompareResComment.setCreateTime(now);
sarFileCompareResComment.setUpdateTime(now);
@@ -141,6 +146,8 @@ public class SarFileCompareResCommentServiceImpl extends ServiceImpl<SarFileComp
@Override
public List<SarFileCompareResComVO> queryListByInfoId(String id, String str) {
// 水平越权九
sarFileCompareInfoService.isHorizontalOverstep(id);
if (MyStringUtils.isBlank(str)) {
return queryListByInfoId(id);
}
laws-modules/src/main/java/com/jero/modules/laws/customcompare/controller/LawsCustomCompareInfoController.java
+9
View File
@@ -182,6 +182,8 @@ public class LawsCustomCompareInfoController {
@PostMapping(value = "/saveCell")
@RequiresPermissions("customComparison:edit")
public Result<IPage<StandardVO>> saveCell(@RequestBody LawsCustomCompareCell lawsCustomCompareCell) {
// 水平越权
lawsCustomCompareInfoService.isHorizontalOverstep(lawsCustomCompareCell.getInfoId());
lawsCustomCompareCellService.saveOrUpdate(lawsCustomCompareCell);
lawsCustomCompareInfoService.editCompareCreateTime(lawsCustomCompareCell.getInfoId());
return Result.OK(MessageUtils.getMessage(ResultCommon.OK));
@@ -196,6 +198,8 @@ public class LawsCustomCompareInfoController {
@PostMapping(value = "/saveCellCompareResult")
@RequiresPermissions("customComparison:edit")
public Result<IPage<StandardVO>> saveCellCompareResult(@RequestBody LawsCustomCompareInventory lawsCustomCompareCell) {
// 水平越权
lawsCustomCompareInfoService.isHorizontalOverstep(lawsCustomCompareCell.getInfoId());
lawsCustomCompareInventoryService.saveOrUpdate(lawsCustomCompareCell);
lawsCustomCompareInfoService.editCompareCreateTime(lawsCustomCompareCell.getInfoId());
return Result.OK(MessageUtils.getMessage(ResultCommon.OK));
@@ -223,6 +227,7 @@ public class LawsCustomCompareInfoController {
@PostMapping(value = "/save")
@RequiresPermissions("customComparison:edit")
public Result<T> save(@RequestBody LawsCustomCompareInfo lawsCustomCompareInfo) {
// 水平越权
if (StringUtils.isNotBlank(lawsCustomCompareInfo.getId())){
lawsCustomCompareInfoService.isHorizontalOverstep(lawsCustomCompareInfo.getId());
}
@@ -243,6 +248,7 @@ public class LawsCustomCompareInfoController {
if (StringUtils.isBlank(map.getId())) {
return Result.error("请选择数据!");
}
// 水平越权
lawsCustomCompareInfoService.isHorizontalOverstep(map.getId());
lawsCustomCompareInfoService.delById(map.getId());
lawsCustomCompareInfoService.editCompareCreateTime(map.getId());
@@ -261,6 +267,9 @@ public class LawsCustomCompareInfoController {
if (StringUtils.isBlank(map.getId())) {
return Result.error("请选择数据!");
}
// 水平越权
LawsCustomCompareInventory lawsCustomCompareInventory = lawsCustomCompareInventoryService.getById(map.getId());
lawsCustomCompareInfoService.isHorizontalOverstep(lawsCustomCompareInventory.getInfoId());
lawsCustomCompareInventoryService.removeById(map.getId());
lawsCustomCompareInfoService.editCompareCreateTime(map.getId());
return Result.OK(MessageUtils.getMessage(ResultCommon.OK));
laws-modules/src/main/java/com/jero/modules/laws/customcompare/service/impl/LawsCustomCompareInfoServiceImpl.java
+15 -2
View File
@@ -255,6 +255,8 @@ public class LawsCustomCompareInfoServiceImpl extends ServiceImpl<LawsCustomComp
@Override
public TableDetailVO queryTableDetail(String infoId) {
// 水平越权
isHorizontalOverstep(infoId);
TableDetailVO tableDetailVO = new TableDetailVO();
// 处理表头
setCountryMap(infoId, tableDetailVO);
@@ -285,6 +287,8 @@ public class LawsCustomCompareInfoServiceImpl extends ServiceImpl<LawsCustomComp
@Override
public Map<String, Object> queryInventory(String infoId) {
// 水平越权
isHorizontalOverstep(infoId);
List<LawsCustomCompareInventory> list = lawsCustomCompareInventoryService.list(
new LambdaQueryWrapper<LawsCustomCompareInventory>()
.eq(LawsCustomCompareInventory::getInfoId, infoId));
@@ -325,6 +329,8 @@ public class LawsCustomCompareInfoServiceImpl extends ServiceImpl<LawsCustomComp
@Override
public IPage<StandardVO> queryStandardByInfoId(String infoId, Integer pageNo, Integer pageSize){
// 水平越权
isHorizontalOverstep(infoId);
// 自定义对比_标准 关联表
List<LawsCustomCompareInfoStandard> list = lawsCustomCompareInfoStandardService.list(
new LambdaQueryWrapper<LawsCustomCompareInfoStandard>()
@@ -342,6 +348,8 @@ public class LawsCustomCompareInfoServiceImpl extends ServiceImpl<LawsCustomComp
@Override
public void delStandard(String infoId, String standardId) {
// 水平越权
isHorizontalOverstep(infoId);
// 删除自定义对比_标准 关联表数据
lawsCustomCompareInfoStandardService.remove(
new LambdaQueryWrapper<LawsCustomCompareInfoStandard>()
@@ -352,6 +360,8 @@ public class LawsCustomCompareInfoServiceImpl extends ServiceImpl<LawsCustomComp
@Override
public void exportExcel(String infoId, HttpServletRequest request, HttpServletResponse response) {
// 水平越权
isHorizontalOverstep(infoId);
// 获取清单数据
TableDetailVO tableDetailVO = queryTableDetail(infoId);
// 获取国家/地区内容和标准内容
@@ -404,6 +414,8 @@ public class LawsCustomCompareInfoServiceImpl extends ServiceImpl<LawsCustomComp
@Override
public void editInventory(Map<String, Object> map) {
String infoId = (String) map.get("infoId");
// 水平越权
isHorizontalOverstep(infoId);
// 获取旧数据信息
List<LawsCustomCompareInventory> list = lawsCustomCompareInventoryService.list(
new LambdaQueryWrapper<LawsCustomCompareInventory>()
@@ -453,7 +465,8 @@ public class LawsCustomCompareInfoServiceImpl extends ServiceImpl<LawsCustomComp
LoginUser loginUser = (LoginUser) SecurityUtils.getSubject().getPrincipal();
List<String> roleIds = Arrays.asList(loginUser.getRoleIds().split(","));
QueryWrapper<LawsCustomCompareInfo> queryWrapper = new QueryWrapper<>();
queryWrapper.in("id", Arrays.asList(ids.split(",")));
List<String> idList = Arrays.asList(ids.split(","));
queryWrapper.in("id", idList);
if (!roleIds.contains("admin")){
queryWrapper.and(qw ->
qw.and(qwi -> qwi.eq(IS_SHOW, LawsCustomCompareCommon.IS_SHOW_0)
@@ -463,7 +476,7 @@ public class LawsCustomCompareInfoServiceImpl extends ServiceImpl<LawsCustomComp
return;
}
int count = count(queryWrapper);
if (count <= 0){
if (count <= 0 || count != idList.size()){
if(LanguageEnum.CN.equals(MessageUtils.getLanguage())) {
throw new JeroBootException("无权限!");
}else{
laws-modules/src/main/java/com/jero/modules/laws/documenttool/service/impl/DocumentSplitServiceImpl.java
+10 -5
View File
@@ -223,6 +223,7 @@ public class DocumentSplitServiceImpl implements IDocumentSplitService {
@Override
public IPage<Map<String, Object>> queryDocumentSplitDetail(Map<String, Object> parameter) {
isHorizontalOverstep(parameter.get(INFO_ID).toString());
// 查询全部字段列表
List<LawsTag> fieldList = lawsCommonMapper.getFieldList(TableNameEnum.DOCUMENT_SPLIT.getTableName());
// 列表展示字段
@@ -1183,6 +1184,8 @@ public class DocumentSplitServiceImpl implements IDocumentSplitService {
@Override
public List<SarFileSplitMenuEO> queryTreeMenuByInfoId(String infoId) {
// 水平越权
isHorizontalOverstep(String.join(",", infoId));
// 目录
SarFileSplitMenuEOPage splitMenuEOPage = new SarFileSplitMenuEOPage();
splitMenuEOPage.setValidFlag("0");
@@ -1199,17 +1202,19 @@ public class DocumentSplitServiceImpl implements IDocumentSplitService {
@Override
public void isHorizontalOverstep(String ids) {
LoginUser loginUser = (LoginUser) SecurityUtils.getSubject().getPrincipal();
// 发布的只有自己可见，发布的数据所有人可见
// 未发布的只有自己可见，发布的数据所有人可见
String roleIds = loginUser.getRoleIds();
QueryWrapper<SarFileSplitInfoEO> queryWrapper = new QueryWrapper<>();
queryWrapper.in("id", Arrays.asList(ids.split(",")));
List<String> idList = Arrays.asList(ids.split(","));
queryWrapper.in("id", idList);
queryWrapper.isNull("publish_before_id");
queryWrapper.and(qw ->
qw.and(qwi -> qwi.eq(SPLIT_STATUS, DocumentSplitCommon.SPLIT_STATUS1)
.eq("author", loginUser.calcNameWorkNo()))
.eq("author", loginUser.getId()))
.or().eq(SPLIT_STATUS, DocumentSplitCommon.SPLIT_STATUS2)
.or().eq(roleIds.contains("admin"), "author", "云平台"));
int count = sarFileSplitInfoService.count(queryWrapper);
if (count <= 0) {
if (count <= 0 || count!= idList.size()) {
if(LanguageEnum.CN.equals(MessageUtils.getLanguage())) {
throw new JeroBootException("无权限!");
}else{
@@ -1391,7 +1396,7 @@ public class DocumentSplitServiceImpl implements IDocumentSplitService {
queryWrapper.isNull("publish_before_id");
}
LoginUser loginUser = (LoginUser) SecurityUtils.getSubject().getPrincipal();
// 发布的只有自己可见，发布的数据所有人可见
// 未发布的只有自己可见，发布的数据所有人可见
String roleIds = loginUser.getRoleIds();
queryWrapper.and(qw ->
qw.and(qwi -> qwi.eq(SPLIT_STATUS, DocumentSplitCommon.SPLIT_STATUS1)