fix(文档拆分、自定义比对、新旧拆分单对比): 水平越权

laws-modules/src/main/java/com/jero/modules/compare/controller/SarFileCompareInfoController.java

@@ -245,6 +245,8 @@ public class SarFileCompareInfoController extends JeroController<SarFileCompareI
     @PostMapping(value = "/delete")
     @ApiOperationSupport(order = 5)
     public Result<?> delete(@RequestBody IdMapBody mapBody) {
+        // 水平越权
+        sarFileCompareInfoService.isHorizontalOverstep(mapBody.getId());
         sarFileCompareInfoService.deleteById(mapBody.getId());
         return Result.OK("删除成功!");
     }
@@ -258,6 +260,8 @@ public class SarFileCompareInfoController extends JeroController<SarFileCompareI
     @PostMapping(value = "/deleteBatch")
     @ApiOperationSupport(order = 6)
     public Result<?> deleteBatch(@RequestBody IdsMapBody mapBody) {
+        // 水平越权
+        sarFileCompareInfoService.isHorizontalOverstep(mapBody.getIds());
         this.sarFileCompareInfoService.deleteByIds(Arrays.asList(mapBody.getIds().split(",")));
         return Result.OK("批量删除成功!");
     }

laws-modules/src/main/java/com/jero/modules/compare/controller/SarFileCompareItemCommentController.java

@@ -9,6 +9,7 @@ import com.jero.common.system.base.controller.JeroController;
 import com.jero.common.system.query.QueryGenerator;
 import com.jero.modules.compare.entity.SarFileCompareItemComment;
 import com.jero.modules.compare.entity.SarFileCompareResultVO;
+import com.jero.modules.compare.service.ISarFileCompareInfoService;
 import com.jero.modules.compare.service.ISarFileCompareItemCommentService;
 import com.jero.modules.system.vo.IdMapBody;
 import com.jero.modules.system.vo.IdsMapBody;
@@ -26,6 +27,7 @@ import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import java.util.Arrays;
 import java.util.List;
+import java.util.stream.Collectors;
 
 
 /**
@@ -42,6 +44,9 @@ public class SarFileCompareItemCommentController extends JeroController<SarFileC
     @Autowired
     private ISarFileCompareItemCommentService sarFileCompareItemCommentService;
 
+    @Autowired
+    private ISarFileCompareInfoService sarFileCompareInfoService;
+
     /**
      * 分页列表查询
      *
@@ -128,6 +133,9 @@ public class SarFileCompareItemCommentController extends JeroController<SarFileC
     @ApiOperation(value = "新旧拆分单对比条款评论表-通过id删除", notes = "新旧拆分单对比条款评论表-通过id删除")
     @PostMapping(value = "/delete")
     public Result<?> delete(@RequestBody IdMapBody mapBody) {
+        // 水平越权
+        SarFileCompareItemComment sarFileCompareItemComment = sarFileCompareItemCommentService.getById(mapBody.getId());
+        sarFileCompareInfoService.isHorizontalOverstep(sarFileCompareItemComment.getInfoId());
         sarFileCompareItemCommentService.deleteById(mapBody.getId());
         return Result.OK("删除成功!");
     }
@@ -139,7 +147,12 @@ public class SarFileCompareItemCommentController extends JeroController<SarFileC
     @ApiOperation(value = "新旧拆分单对比条款评论表-批量删除", notes = "新旧拆分单对比条款评论表-批量删除")
     @PostMapping(value = "/deleteBatch")
     public Result<?> deleteBatch(@RequestBody IdsMapBody mapBody) {
-        this.sarFileCompareItemCommentService.deleteByIds(Arrays.asList(mapBody.getIds().split(",")));
+        // 水平越权
+        List<String> list = Arrays.asList(mapBody.getIds().split(","));
+        List<SarFileCompareItemComment> sarFileCompareItemComments = sarFileCompareItemCommentService.listByIds(list);
+        String infoIds = sarFileCompareItemComments.stream().map(SarFileCompareItemComment::getInfoId).collect(Collectors.joining(","));
+        sarFileCompareInfoService.isHorizontalOverstep(infoIds);
+        this.sarFileCompareItemCommentService.deleteByIds(list);
         return Result.OK("批量删除成功!");
     }
 

laws-modules/src/main/java/com/jero/modules/compare/service/ISarFileCompareInfoService.java

@@ -78,4 +78,10 @@ public interface ISarFileCompareInfoService extends IService<SarFileCompareInfo>
      * @return
      */
     SarFileCompareDetailVO getComparisonDetail(String id);
+
+    /**
+     * 是否水平越权
+     * @param ids
+     */
+    void isHorizontalOverstep(String ids);
 }

laws-modules/src/main/java/com/jero/modules/compare/service/impl/SarFileCompareInfoServiceImpl.java

@@ -1,6 +1,11 @@
 package com.jero.modules.compare.service.impl;
 
+import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
 import com.baomidou.mybatisplus.extension.service.impl.ServiceImpl;
+import com.jero.common.constant.enums.LanguageEnum;
+import com.jero.common.exception.JeroBootException;
+import com.jero.common.system.vo.LoginUser;
+import com.jero.common.util.MessageUtils;
 import com.jero.modules.compare.entity.*;
 import com.jero.modules.compare.enums.ReleaseConditionEnum;
 import com.jero.modules.compare.mapper.SarFileCompareInfoMapper;
@@ -17,6 +22,7 @@ import com.jero.modules.split.service.IFileSplitItemsEOService;
 import com.jero.modules.split.service.ISarFileSplitInfoService;
 import com.jero.modules.split.service.ISarFileSplitMenuEOService;
 import com.jero.modules.system.util.MyStringUtils;
+import org.apache.shiro.SecurityUtils;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Service;
 
@@ -42,6 +48,9 @@ public class SarFileCompareInfoServiceImpl extends ServiceImpl<SarFileCompareInf
     @Autowired
     private ISarFileSplitInfoService sarFileSplitInfoEOService;
 
+    @Autowired
+    private ISarFileCompareInfoService sarFileCompareInfoService;
+
     @Autowired
     private ISarFileCompareItemService sarFileCompareItemService;
 
@@ -285,6 +294,8 @@ public class SarFileCompareInfoServiceImpl extends ServiceImpl<SarFileCompareInf
 
     @Override
     public SarFileCompareDetailVO getComparisonDetail(String id) {
+        // 水平越权
+        isHorizontalOverstep(id);
         SarFileCompareDetailVO sfVo = new SarFileCompareDetailVO();
         SarFileCompareInfo sfcInfo = this.queryById(id);
         sfVo.setInfoId(id);
@@ -327,6 +338,23 @@ public class SarFileCompareInfoServiceImpl extends ServiceImpl<SarFileCompareInf
         return sfVo;
     }
 
+    @Override
+    public void isHorizontalOverstep(String ids) {
+        LoginUser loginUser = (LoginUser) SecurityUtils.getSubject().getPrincipal();
+        LambdaQueryWrapper<SarFileCompareInfo> queryWrapper = new LambdaQueryWrapper<>();
+        List<String> idList = Arrays.asList(ids.split(","));
+        queryWrapper.in(SarFileCompareInfo::getId, idList);
+        queryWrapper.and(LambdaQueryWrapper -> LambdaQueryWrapper.eq(SarFileCompareInfo::getCreateBy, loginUser.getUsername()).or().eq(SarFileCompareInfo::getReleaseState, ReleaseConditionEnum.PUBLISHED.getValue()));
+        int count = sarFileCompareInfoService.count(queryWrapper);
+        if (count <= 0 || count != idList.size()) {
+            if(LanguageEnum.CN.equals(MessageUtils.getLanguage())) {
+                throw new JeroBootException("无权限!");
+            }else{
+                throw new JeroBootException("No access!");
+            }
+        }
+    }
+
     private List<SarFileCompareMenuVo> tree(List<SarFileCompareMenuVo> list) {
         List<SarFileCompareMenuVo> compareMenuVos = new ArrayList<>();
         //先删除name是总目录的数据

laws-modules/src/main/java/com/jero/modules/compare/service/impl/SarFileCompareItemCommentServiceImpl.java

@@ -60,6 +60,9 @@ public class SarFileCompareItemCommentServiceImpl extends ServiceImpl<SarFileCom
     @Autowired
     private ISarFileCompareItemService SarFileCompareItemServiceImpl;
 
+    @Autowired
+    private ISarFileCompareInfoService sarFileCompareInfoService;
+
     @Value("${jero.path.upload}")
     private String filePath;
     @Value("${jero.path.uploadCos}")
@@ -76,6 +79,8 @@ public class SarFileCompareItemCommentServiceImpl extends ServiceImpl<SarFileCom
      */
     @Override
     public void add(SarFileCompareItemComment sarFileCompareItemComment) {
+        // 水平越权
+        sarFileCompareInfoService.isHorizontalOverstep(sarFileCompareItemComment.getInfoId());
         Date now = new Date();
         sarFileCompareItemComment.setCreateTime(now);
         sarFileCompareItemComment.setUpdateTime(now);
@@ -93,6 +98,8 @@ public class SarFileCompareItemCommentServiceImpl extends ServiceImpl<SarFileCom
      */
     @Override
     public void editById(SarFileCompareItemComment sarFileCompareItemComment) {
+        // 水平越权
+        sarFileCompareInfoService.isHorizontalOverstep(sarFileCompareItemComment.getInfoId());
         SarFileCompareItemComment ic = queryById(sarFileCompareItemComment.getId());
         Date now = new Date();
         ic.setUpdateTime(now);
@@ -167,6 +174,8 @@ public class SarFileCompareItemCommentServiceImpl extends ServiceImpl<SarFileCom
 
     @Override
     public SarFileCompareResultVO queryCompareResult(String infoId,String comment) {
+        // 水平越权
+        sarFileCompareInfoService.isHorizontalOverstep(infoId);
         SarFileCompareResultVO resultVO = new SarFileCompareResultVO();
         SarFileCompareInfo sfcInfo = sarFileCompareInfoServiceImpl.queryById(infoId);
         resultVO.setInfoId(infoId);
@@ -225,6 +234,8 @@ public class SarFileCompareItemCommentServiceImpl extends ServiceImpl<SarFileCom
 
     @Override
     public void exportResXls(HttpServletRequest request,HttpServletResponse response, String infoId, String selectIds, boolean includeComments, String cut,String comment) {
+        // 水平越权
+        sarFileCompareInfoService.isHorizontalOverstep(infoId);
         List<SarFileCompareItemComment> list = null;
         if (includeComments && MyStringUtils.isEmpty(selectIds)) {
             //只导出全文评论的情况

laws-modules/src/main/java/com/jero/modules/compare/service/impl/SarFileCompareResCommentServiceImpl.java

@@ -6,6 +6,7 @@ import com.google.common.collect.Lists;
 import com.jero.modules.compare.entity.SarFileCompareResComVO;
 import com.jero.modules.compare.entity.SarFileCompareResComment;
 import com.jero.modules.compare.mapper.SarFileCompareResCommentMapper;
+import com.jero.modules.compare.service.ISarFileCompareInfoService;
 import com.jero.modules.compare.service.ISarFileCompareResCommentService;
 import com.jero.modules.system.entity.SysUser;
 import com.jero.modules.system.service.ISysUserService;
@@ -28,6 +29,8 @@ public class SarFileCompareResCommentServiceImpl extends ServiceImpl<SarFileComp
     private static SimpleDateFormat sdf = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss");
     @Autowired
     private ISysUserService sysUserService;
+    @Autowired
+    private ISarFileCompareInfoService sarFileCompareInfoService;
 
     /**
      * 保存
@@ -37,6 +40,8 @@ public class SarFileCompareResCommentServiceImpl extends ServiceImpl<SarFileComp
      */
     @Override
     public void add(SarFileCompareResComment sarFileCompareResComment) {
+        // 水平越权九
+        sarFileCompareInfoService.isHorizontalOverstep(sarFileCompareResComment.getInfoId());
         Date now = new Date();
         sarFileCompareResComment.setCreateTime(now);
         sarFileCompareResComment.setUpdateTime(now);
@@ -141,6 +146,8 @@ public class SarFileCompareResCommentServiceImpl extends ServiceImpl<SarFileComp
 
     @Override
     public List<SarFileCompareResComVO> queryListByInfoId(String id, String str) {
+        // 水平越权九
+        sarFileCompareInfoService.isHorizontalOverstep(id);
         if (MyStringUtils.isBlank(str)) {
             return queryListByInfoId(id);
         }

laws-modules/src/main/java/com/jero/modules/laws/customcompare/controller/LawsCustomCompareInfoController.java

@@ -182,6 +182,8 @@ public class LawsCustomCompareInfoController {
     @PostMapping(value = "/saveCell")
     @RequiresPermissions("customComparison:edit")
     public Result<IPage<StandardVO>> saveCell(@RequestBody LawsCustomCompareCell lawsCustomCompareCell) {
+        // 水平越权
+        lawsCustomCompareInfoService.isHorizontalOverstep(lawsCustomCompareCell.getInfoId());
         lawsCustomCompareCellService.saveOrUpdate(lawsCustomCompareCell);
         lawsCustomCompareInfoService.editCompareCreateTime(lawsCustomCompareCell.getInfoId());
         return Result.OK(MessageUtils.getMessage(ResultCommon.OK));
@@ -196,6 +198,8 @@ public class LawsCustomCompareInfoController {
     @PostMapping(value = "/saveCellCompareResult")
     @RequiresPermissions("customComparison:edit")
     public Result<IPage<StandardVO>> saveCellCompareResult(@RequestBody LawsCustomCompareInventory lawsCustomCompareCell) {
+        // 水平越权
+        lawsCustomCompareInfoService.isHorizontalOverstep(lawsCustomCompareCell.getInfoId());
         lawsCustomCompareInventoryService.saveOrUpdate(lawsCustomCompareCell);
         lawsCustomCompareInfoService.editCompareCreateTime(lawsCustomCompareCell.getInfoId());
         return Result.OK(MessageUtils.getMessage(ResultCommon.OK));
@@ -223,6 +227,7 @@ public class LawsCustomCompareInfoController {
     @PostMapping(value = "/save")
     @RequiresPermissions("customComparison:edit")
     public Result<T> save(@RequestBody LawsCustomCompareInfo lawsCustomCompareInfo) {
+        // 水平越权
         if (StringUtils.isNotBlank(lawsCustomCompareInfo.getId())){
             lawsCustomCompareInfoService.isHorizontalOverstep(lawsCustomCompareInfo.getId());
         }
@@ -243,6 +248,7 @@ public class LawsCustomCompareInfoController {
         if (StringUtils.isBlank(map.getId())) {
             return Result.error("请选择数据!");
         }
+        // 水平越权
         lawsCustomCompareInfoService.isHorizontalOverstep(map.getId());
         lawsCustomCompareInfoService.delById(map.getId());
         lawsCustomCompareInfoService.editCompareCreateTime(map.getId());
@@ -261,6 +267,9 @@ public class LawsCustomCompareInfoController {
         if (StringUtils.isBlank(map.getId())) {
             return Result.error("请选择数据!");
         }
+        // 水平越权
+        LawsCustomCompareInventory lawsCustomCompareInventory = lawsCustomCompareInventoryService.getById(map.getId());
+        lawsCustomCompareInfoService.isHorizontalOverstep(lawsCustomCompareInventory.getInfoId());
         lawsCustomCompareInventoryService.removeById(map.getId());
         lawsCustomCompareInfoService.editCompareCreateTime(map.getId());
         return Result.OK(MessageUtils.getMessage(ResultCommon.OK));

laws-modules/src/main/java/com/jero/modules/laws/customcompare/service/impl/LawsCustomCompareInfoServiceImpl.java

@@ -255,6 +255,8 @@ public class LawsCustomCompareInfoServiceImpl extends ServiceImpl<LawsCustomComp
 
     @Override
     public TableDetailVO queryTableDetail(String infoId) {
+        // 水平越权
+        isHorizontalOverstep(infoId);
         TableDetailVO tableDetailVO = new TableDetailVO();
         // 处理表头
         setCountryMap(infoId, tableDetailVO);
@@ -285,6 +287,8 @@ public class LawsCustomCompareInfoServiceImpl extends ServiceImpl<LawsCustomComp
 
     @Override
     public Map<String, Object> queryInventory(String infoId) {
+        // 水平越权
+        isHorizontalOverstep(infoId);
         List<LawsCustomCompareInventory> list = lawsCustomCompareInventoryService.list(
                 new LambdaQueryWrapper<LawsCustomCompareInventory>()
                         .eq(LawsCustomCompareInventory::getInfoId, infoId));
@@ -325,6 +329,8 @@ public class LawsCustomCompareInfoServiceImpl extends ServiceImpl<LawsCustomComp
 
     @Override
     public IPage<StandardVO> queryStandardByInfoId(String infoId, Integer pageNo, Integer pageSize){
+        // 水平越权
+        isHorizontalOverstep(infoId);
         // 自定义对比_标准 关联表
         List<LawsCustomCompareInfoStandard> list = lawsCustomCompareInfoStandardService.list(
                 new LambdaQueryWrapper<LawsCustomCompareInfoStandard>()
@@ -342,6 +348,8 @@ public class LawsCustomCompareInfoServiceImpl extends ServiceImpl<LawsCustomComp
 
     @Override
     public void delStandard(String infoId, String standardId) {
+        // 水平越权
+        isHorizontalOverstep(infoId);
         // 删除自定义对比_标准 关联表数据
         lawsCustomCompareInfoStandardService.remove(
                 new LambdaQueryWrapper<LawsCustomCompareInfoStandard>()
@@ -352,6 +360,8 @@ public class LawsCustomCompareInfoServiceImpl extends ServiceImpl<LawsCustomComp
 
     @Override
     public void exportExcel(String infoId, HttpServletRequest request, HttpServletResponse response) {
+        // 水平越权
+        isHorizontalOverstep(infoId);
         // 获取清单数据
         TableDetailVO tableDetailVO = queryTableDetail(infoId);
         // 获取国家/地区内容和标准内容
@@ -404,6 +414,8 @@ public class LawsCustomCompareInfoServiceImpl extends ServiceImpl<LawsCustomComp
     @Override
     public void editInventory(Map<String, Object> map) {
         String infoId = (String) map.get("infoId");
+        // 水平越权
+        isHorizontalOverstep(infoId);
         // 获取旧数据信息
         List<LawsCustomCompareInventory> list = lawsCustomCompareInventoryService.list(
                 new LambdaQueryWrapper<LawsCustomCompareInventory>()
@@ -453,7 +465,8 @@ public class LawsCustomCompareInfoServiceImpl extends ServiceImpl<LawsCustomComp
         LoginUser loginUser = (LoginUser) SecurityUtils.getSubject().getPrincipal();
         List<String> roleIds = Arrays.asList(loginUser.getRoleIds().split(","));
         QueryWrapper<LawsCustomCompareInfo> queryWrapper = new QueryWrapper<>();
-        queryWrapper.in("id", Arrays.asList(ids.split(",")));
+        List<String> idList = Arrays.asList(ids.split(","));
+        queryWrapper.in("id", idList);
         if (!roleIds.contains("admin")){
             queryWrapper.and(qw ->
                     qw.and(qwi -> qwi.eq(IS_SHOW, LawsCustomCompareCommon.IS_SHOW_0)
@@ -463,7 +476,7 @@ public class LawsCustomCompareInfoServiceImpl extends ServiceImpl<LawsCustomComp
             return;
         }
         int count = count(queryWrapper);
-        if (count <= 0){
+        if (count <= 0 || count != idList.size()){
             if(LanguageEnum.CN.equals(MessageUtils.getLanguage())) {
                 throw new JeroBootException("无权限!");
             }else{

laws-modules/src/main/java/com/jero/modules/laws/documenttool/service/impl/DocumentSplitServiceImpl.java

@@ -223,6 +223,7 @@ public class DocumentSplitServiceImpl implements IDocumentSplitService {
 
     @Override
     public IPage<Map<String, Object>> queryDocumentSplitDetail(Map<String, Object> parameter) {
+        isHorizontalOverstep(parameter.get(INFO_ID).toString());
         // 查询全部字段列表
         List<LawsTag> fieldList = lawsCommonMapper.getFieldList(TableNameEnum.DOCUMENT_SPLIT.getTableName());
         // 列表展示字段
@@ -1183,6 +1184,8 @@ public class DocumentSplitServiceImpl implements IDocumentSplitService {
 
     @Override
     public List<SarFileSplitMenuEO> queryTreeMenuByInfoId(String infoId) {
+        // 水平越权
+        isHorizontalOverstep(String.join(",", infoId));
         // 目录
         SarFileSplitMenuEOPage splitMenuEOPage = new SarFileSplitMenuEOPage();
         splitMenuEOPage.setValidFlag("0");
@@ -1199,17 +1202,19 @@ public class DocumentSplitServiceImpl implements IDocumentSplitService {
     @Override
     public void isHorizontalOverstep(String ids) {
         LoginUser loginUser = (LoginUser) SecurityUtils.getSubject().getPrincipal();
-        // 发布的只有自己可见，发布的数据所有人可见
+        // 未发布的只有自己可见，发布的数据所有人可见
         String roleIds = loginUser.getRoleIds();
         QueryWrapper<SarFileSplitInfoEO> queryWrapper = new QueryWrapper<>();
-        queryWrapper.in("id", Arrays.asList(ids.split(",")));
+        List<String> idList = Arrays.asList(ids.split(","));
+        queryWrapper.in("id", idList);
+        queryWrapper.isNull("publish_before_id");
         queryWrapper.and(qw ->
                 qw.and(qwi -> qwi.eq(SPLIT_STATUS, DocumentSplitCommon.SPLIT_STATUS1)
-                                .eq("author", loginUser.calcNameWorkNo()))
+                                .eq("author", loginUser.getId()))
                         .or().eq(SPLIT_STATUS, DocumentSplitCommon.SPLIT_STATUS2)
                         .or().eq(roleIds.contains("admin"), "author", "云平台"));
         int count = sarFileSplitInfoService.count(queryWrapper);
-        if (count <= 0) {
+        if (count <= 0 || count!= idList.size()) {
             if(LanguageEnum.CN.equals(MessageUtils.getLanguage())) {
                 throw new JeroBootException("无权限!");
             }else{
@@ -1391,7 +1396,7 @@ public class DocumentSplitServiceImpl implements IDocumentSplitService {
             queryWrapper.isNull("publish_before_id");
         }
         LoginUser loginUser = (LoginUser) SecurityUtils.getSubject().getPrincipal();
-        // 发布的只有自己可见，发布的数据所有人可见
+        // 未发布的只有自己可见，发布的数据所有人可见
         String roleIds = loginUser.getRoleIds();
         queryWrapper.and(qw ->
                 qw.and(qwi -> qwi.eq(SPLIT_STATUS, DocumentSplitCommon.SPLIT_STATUS1)