diff --git a/laws-modules/src/main/java/com/jero/modules/compare/controller/SarFileCompareInfoController.java b/laws-modules/src/main/java/com/jero/modules/compare/controller/SarFileCompareInfoController.java index 4ac033f7..d7a44dcc 100644 --- a/laws-modules/src/main/java/com/jero/modules/compare/controller/SarFileCompareInfoController.java +++ b/laws-modules/src/main/java/com/jero/modules/compare/controller/SarFileCompareInfoController.java @@ -245,6 +245,8 @@ public class SarFileCompareInfoController extends JeroController delete(@RequestBody IdMapBody mapBody) { + // 水平越权 + sarFileCompareInfoService.isHorizontalOverstep(mapBody.getId()); sarFileCompareInfoService.deleteById(mapBody.getId()); return Result.OK("删除成功!"); } @@ -258,6 +260,8 @@ public class SarFileCompareInfoController extends JeroController deleteBatch(@RequestBody IdsMapBody mapBody) { + // 水平越权 + sarFileCompareInfoService.isHorizontalOverstep(mapBody.getIds()); this.sarFileCompareInfoService.deleteByIds(Arrays.asList(mapBody.getIds().split(","))); return Result.OK("批量删除成功!"); } diff --git a/laws-modules/src/main/java/com/jero/modules/compare/controller/SarFileCompareItemCommentController.java b/laws-modules/src/main/java/com/jero/modules/compare/controller/SarFileCompareItemCommentController.java index 70aad410..2c208b8e 100644 --- a/laws-modules/src/main/java/com/jero/modules/compare/controller/SarFileCompareItemCommentController.java +++ b/laws-modules/src/main/java/com/jero/modules/compare/controller/SarFileCompareItemCommentController.java @@ -9,6 +9,7 @@ import com.jero.common.system.base.controller.JeroController; import com.jero.common.system.query.QueryGenerator; import com.jero.modules.compare.entity.SarFileCompareItemComment; import com.jero.modules.compare.entity.SarFileCompareResultVO; +import com.jero.modules.compare.service.ISarFileCompareInfoService; import com.jero.modules.compare.service.ISarFileCompareItemCommentService; import com.jero.modules.system.vo.IdMapBody; import com.jero.modules.system.vo.IdsMapBody; @@ -26,6 +27,7 @@ import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import java.util.Arrays; import java.util.List; +import java.util.stream.Collectors; /** @@ -42,6 +44,9 @@ public class SarFileCompareItemCommentController extends JeroController delete(@RequestBody IdMapBody mapBody) { + // 水平越权 + SarFileCompareItemComment sarFileCompareItemComment = sarFileCompareItemCommentService.getById(mapBody.getId()); + sarFileCompareInfoService.isHorizontalOverstep(sarFileCompareItemComment.getInfoId()); sarFileCompareItemCommentService.deleteById(mapBody.getId()); return Result.OK("删除成功!"); } @@ -139,7 +147,12 @@ public class SarFileCompareItemCommentController extends JeroController deleteBatch(@RequestBody IdsMapBody mapBody) { - this.sarFileCompareItemCommentService.deleteByIds(Arrays.asList(mapBody.getIds().split(","))); + // 水平越权 + List list = Arrays.asList(mapBody.getIds().split(",")); + List sarFileCompareItemComments = sarFileCompareItemCommentService.listByIds(list); + String infoIds = sarFileCompareItemComments.stream().map(SarFileCompareItemComment::getInfoId).collect(Collectors.joining(",")); + sarFileCompareInfoService.isHorizontalOverstep(infoIds); + this.sarFileCompareItemCommentService.deleteByIds(list); return Result.OK("批量删除成功!"); } diff --git a/laws-modules/src/main/java/com/jero/modules/compare/service/ISarFileCompareInfoService.java b/laws-modules/src/main/java/com/jero/modules/compare/service/ISarFileCompareInfoService.java index 7b20ca07..e56ceb8c 100644 --- a/laws-modules/src/main/java/com/jero/modules/compare/service/ISarFileCompareInfoService.java +++ b/laws-modules/src/main/java/com/jero/modules/compare/service/ISarFileCompareInfoService.java @@ -78,4 +78,10 @@ public interface ISarFileCompareInfoService extends IService * @return */ SarFileCompareDetailVO getComparisonDetail(String id); + + /** + * 是否水平越权 + * @param ids + */ + void isHorizontalOverstep(String ids); } diff --git a/laws-modules/src/main/java/com/jero/modules/compare/service/impl/SarFileCompareInfoServiceImpl.java b/laws-modules/src/main/java/com/jero/modules/compare/service/impl/SarFileCompareInfoServiceImpl.java index cd0801f5..516ebb0c 100644 --- a/laws-modules/src/main/java/com/jero/modules/compare/service/impl/SarFileCompareInfoServiceImpl.java +++ b/laws-modules/src/main/java/com/jero/modules/compare/service/impl/SarFileCompareInfoServiceImpl.java @@ -1,6 +1,11 @@ package com.jero.modules.compare.service.impl; +import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper; import com.baomidou.mybatisplus.extension.service.impl.ServiceImpl; +import com.jero.common.constant.enums.LanguageEnum; +import com.jero.common.exception.JeroBootException; +import com.jero.common.system.vo.LoginUser; +import com.jero.common.util.MessageUtils; import com.jero.modules.compare.entity.*; import com.jero.modules.compare.enums.ReleaseConditionEnum; import com.jero.modules.compare.mapper.SarFileCompareInfoMapper; @@ -17,6 +22,7 @@ import com.jero.modules.split.service.IFileSplitItemsEOService; import com.jero.modules.split.service.ISarFileSplitInfoService; import com.jero.modules.split.service.ISarFileSplitMenuEOService; import com.jero.modules.system.util.MyStringUtils; +import org.apache.shiro.SecurityUtils; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.stereotype.Service; @@ -42,6 +48,9 @@ public class SarFileCompareInfoServiceImpl extends ServiceImpl queryWrapper = new LambdaQueryWrapper<>(); + List idList = Arrays.asList(ids.split(",")); + queryWrapper.in(SarFileCompareInfo::getId, idList); + queryWrapper.and(LambdaQueryWrapper -> LambdaQueryWrapper.eq(SarFileCompareInfo::getCreateBy, loginUser.getUsername()).or().eq(SarFileCompareInfo::getReleaseState, ReleaseConditionEnum.PUBLISHED.getValue())); + int count = sarFileCompareInfoService.count(queryWrapper); + if (count <= 0 || count != idList.size()) { + if(LanguageEnum.CN.equals(MessageUtils.getLanguage())) { + throw new JeroBootException("无权限!"); + }else{ + throw new JeroBootException("No access!"); + } + } + } + private List tree(List list) { List compareMenuVos = new ArrayList<>(); //先删除name是总目录的数据 diff --git a/laws-modules/src/main/java/com/jero/modules/compare/service/impl/SarFileCompareItemCommentServiceImpl.java b/laws-modules/src/main/java/com/jero/modules/compare/service/impl/SarFileCompareItemCommentServiceImpl.java index cda8c206..ffab73da 100644 --- a/laws-modules/src/main/java/com/jero/modules/compare/service/impl/SarFileCompareItemCommentServiceImpl.java +++ b/laws-modules/src/main/java/com/jero/modules/compare/service/impl/SarFileCompareItemCommentServiceImpl.java @@ -60,6 +60,9 @@ public class SarFileCompareItemCommentServiceImpl extends ServiceImpl list = null; if (includeComments && MyStringUtils.isEmpty(selectIds)) { //只导出全文评论的情况 diff --git a/laws-modules/src/main/java/com/jero/modules/compare/service/impl/SarFileCompareResCommentServiceImpl.java b/laws-modules/src/main/java/com/jero/modules/compare/service/impl/SarFileCompareResCommentServiceImpl.java index c0fa6fe7..de1450e5 100644 --- a/laws-modules/src/main/java/com/jero/modules/compare/service/impl/SarFileCompareResCommentServiceImpl.java +++ b/laws-modules/src/main/java/com/jero/modules/compare/service/impl/SarFileCompareResCommentServiceImpl.java @@ -6,6 +6,7 @@ import com.google.common.collect.Lists; import com.jero.modules.compare.entity.SarFileCompareResComVO; import com.jero.modules.compare.entity.SarFileCompareResComment; import com.jero.modules.compare.mapper.SarFileCompareResCommentMapper; +import com.jero.modules.compare.service.ISarFileCompareInfoService; import com.jero.modules.compare.service.ISarFileCompareResCommentService; import com.jero.modules.system.entity.SysUser; import com.jero.modules.system.service.ISysUserService; @@ -28,6 +29,8 @@ public class SarFileCompareResCommentServiceImpl extends ServiceImpl queryListByInfoId(String id, String str) { + // 水平越权九 + sarFileCompareInfoService.isHorizontalOverstep(id); if (MyStringUtils.isBlank(str)) { return queryListByInfoId(id); } diff --git a/laws-modules/src/main/java/com/jero/modules/laws/customcompare/controller/LawsCustomCompareInfoController.java b/laws-modules/src/main/java/com/jero/modules/laws/customcompare/controller/LawsCustomCompareInfoController.java index ca369785..e9d9ba13 100644 --- a/laws-modules/src/main/java/com/jero/modules/laws/customcompare/controller/LawsCustomCompareInfoController.java +++ b/laws-modules/src/main/java/com/jero/modules/laws/customcompare/controller/LawsCustomCompareInfoController.java @@ -182,6 +182,8 @@ public class LawsCustomCompareInfoController { @PostMapping(value = "/saveCell") @RequiresPermissions("customComparison:edit") public Result> saveCell(@RequestBody LawsCustomCompareCell lawsCustomCompareCell) { + // 水平越权 + lawsCustomCompareInfoService.isHorizontalOverstep(lawsCustomCompareCell.getInfoId()); lawsCustomCompareCellService.saveOrUpdate(lawsCustomCompareCell); lawsCustomCompareInfoService.editCompareCreateTime(lawsCustomCompareCell.getInfoId()); return Result.OK(MessageUtils.getMessage(ResultCommon.OK)); @@ -196,6 +198,8 @@ public class LawsCustomCompareInfoController { @PostMapping(value = "/saveCellCompareResult") @RequiresPermissions("customComparison:edit") public Result> saveCellCompareResult(@RequestBody LawsCustomCompareInventory lawsCustomCompareCell) { + // 水平越权 + lawsCustomCompareInfoService.isHorizontalOverstep(lawsCustomCompareCell.getInfoId()); lawsCustomCompareInventoryService.saveOrUpdate(lawsCustomCompareCell); lawsCustomCompareInfoService.editCompareCreateTime(lawsCustomCompareCell.getInfoId()); return Result.OK(MessageUtils.getMessage(ResultCommon.OK)); @@ -223,6 +227,7 @@ public class LawsCustomCompareInfoController { @PostMapping(value = "/save") @RequiresPermissions("customComparison:edit") public Result save(@RequestBody LawsCustomCompareInfo lawsCustomCompareInfo) { + // 水平越权 if (StringUtils.isNotBlank(lawsCustomCompareInfo.getId())){ lawsCustomCompareInfoService.isHorizontalOverstep(lawsCustomCompareInfo.getId()); } @@ -243,6 +248,7 @@ public class LawsCustomCompareInfoController { if (StringUtils.isBlank(map.getId())) { return Result.error("请选择数据!"); } + // 水平越权 lawsCustomCompareInfoService.isHorizontalOverstep(map.getId()); lawsCustomCompareInfoService.delById(map.getId()); lawsCustomCompareInfoService.editCompareCreateTime(map.getId()); @@ -261,6 +267,9 @@ public class LawsCustomCompareInfoController { if (StringUtils.isBlank(map.getId())) { return Result.error("请选择数据!"); } + // 水平越权 + LawsCustomCompareInventory lawsCustomCompareInventory = lawsCustomCompareInventoryService.getById(map.getId()); + lawsCustomCompareInfoService.isHorizontalOverstep(lawsCustomCompareInventory.getInfoId()); lawsCustomCompareInventoryService.removeById(map.getId()); lawsCustomCompareInfoService.editCompareCreateTime(map.getId()); return Result.OK(MessageUtils.getMessage(ResultCommon.OK)); diff --git a/laws-modules/src/main/java/com/jero/modules/laws/customcompare/service/impl/LawsCustomCompareInfoServiceImpl.java b/laws-modules/src/main/java/com/jero/modules/laws/customcompare/service/impl/LawsCustomCompareInfoServiceImpl.java index 32a8431c..f8341ea3 100644 --- a/laws-modules/src/main/java/com/jero/modules/laws/customcompare/service/impl/LawsCustomCompareInfoServiceImpl.java +++ b/laws-modules/src/main/java/com/jero/modules/laws/customcompare/service/impl/LawsCustomCompareInfoServiceImpl.java @@ -255,6 +255,8 @@ public class LawsCustomCompareInfoServiceImpl extends ServiceImpl queryInventory(String infoId) { + // 水平越权 + isHorizontalOverstep(infoId); List list = lawsCustomCompareInventoryService.list( new LambdaQueryWrapper() .eq(LawsCustomCompareInventory::getInfoId, infoId)); @@ -325,6 +329,8 @@ public class LawsCustomCompareInfoServiceImpl extends ServiceImpl queryStandardByInfoId(String infoId, Integer pageNo, Integer pageSize){ + // 水平越权 + isHorizontalOverstep(infoId); // 自定义对比_标准 关联表 List list = lawsCustomCompareInfoStandardService.list( new LambdaQueryWrapper() @@ -342,6 +348,8 @@ public class LawsCustomCompareInfoServiceImpl extends ServiceImpl() @@ -352,6 +360,8 @@ public class LawsCustomCompareInfoServiceImpl extends ServiceImpl map) { String infoId = (String) map.get("infoId"); + // 水平越权 + isHorizontalOverstep(infoId); // 获取旧数据信息 List list = lawsCustomCompareInventoryService.list( new LambdaQueryWrapper() @@ -453,7 +465,8 @@ public class LawsCustomCompareInfoServiceImpl extends ServiceImpl roleIds = Arrays.asList(loginUser.getRoleIds().split(",")); QueryWrapper queryWrapper = new QueryWrapper<>(); - queryWrapper.in("id", Arrays.asList(ids.split(","))); + List idList = Arrays.asList(ids.split(",")); + queryWrapper.in("id", idList); if (!roleIds.contains("admin")){ queryWrapper.and(qw -> qw.and(qwi -> qwi.eq(IS_SHOW, LawsCustomCompareCommon.IS_SHOW_0) @@ -463,7 +476,7 @@ public class LawsCustomCompareInfoServiceImpl extends ServiceImpl> queryDocumentSplitDetail(Map parameter) { + isHorizontalOverstep(parameter.get(INFO_ID).toString()); // 查询全部字段列表 List fieldList = lawsCommonMapper.getFieldList(TableNameEnum.DOCUMENT_SPLIT.getTableName()); // 列表展示字段 @@ -1183,6 +1184,8 @@ public class DocumentSplitServiceImpl implements IDocumentSplitService { @Override public List queryTreeMenuByInfoId(String infoId) { + // 水平越权 + isHorizontalOverstep(String.join(",", infoId)); // 目录 SarFileSplitMenuEOPage splitMenuEOPage = new SarFileSplitMenuEOPage(); splitMenuEOPage.setValidFlag("0"); @@ -1199,17 +1202,19 @@ public class DocumentSplitServiceImpl implements IDocumentSplitService { @Override public void isHorizontalOverstep(String ids) { LoginUser loginUser = (LoginUser) SecurityUtils.getSubject().getPrincipal(); - // 发布的只有自己可见,发布的数据所有人可见 + // 未发布的只有自己可见,发布的数据所有人可见 String roleIds = loginUser.getRoleIds(); QueryWrapper queryWrapper = new QueryWrapper<>(); - queryWrapper.in("id", Arrays.asList(ids.split(","))); + List idList = Arrays.asList(ids.split(",")); + queryWrapper.in("id", idList); + queryWrapper.isNull("publish_before_id"); queryWrapper.and(qw -> qw.and(qwi -> qwi.eq(SPLIT_STATUS, DocumentSplitCommon.SPLIT_STATUS1) - .eq("author", loginUser.calcNameWorkNo())) + .eq("author", loginUser.getId())) .or().eq(SPLIT_STATUS, DocumentSplitCommon.SPLIT_STATUS2) .or().eq(roleIds.contains("admin"), "author", "云平台")); int count = sarFileSplitInfoService.count(queryWrapper); - if (count <= 0) { + if (count <= 0 || count!= idList.size()) { if(LanguageEnum.CN.equals(MessageUtils.getLanguage())) { throw new JeroBootException("无权限!"); }else{ @@ -1391,7 +1396,7 @@ public class DocumentSplitServiceImpl implements IDocumentSplitService { queryWrapper.isNull("publish_before_id"); } LoginUser loginUser = (LoginUser) SecurityUtils.getSubject().getPrincipal(); - // 发布的只有自己可见,发布的数据所有人可见 + // 未发布的只有自己可见,发布的数据所有人可见 String roleIds = loginUser.getRoleIds(); queryWrapper.and(qw -> qw.and(qwi -> qwi.eq(SPLIT_STATUS, DocumentSplitCommon.SPLIT_STATUS1)