From 5ed72723a745d508e8b5d6aee86ad6330d2142c5 Mon Sep 17 00:00:00 2001 From: yjz <3131811435@qq.com> Date: Mon, 5 Feb 2024 11:25:47 +0800 Subject: [PATCH] =?UTF-8?q?fix(=E8=B5=84=E6=96=99=E4=B8=AD=E5=BF=83):=2081?= =?UTF-8?q?764?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../LawsDataCenterFileController.java | 8 +++++ .../LawsDataCenterFolderController.java | 8 +++++ .../mapper/LawsDataCenterFileMapper.java | 9 +++++ .../mapper/xml/LawsDataCenterFileMapper.xml | 10 +++++- .../service/ILawsDataCenterFileService.java | 6 ++++ .../service/ILawsDataCenterFolderService.java | 6 ++++ .../impl/LawsDataCenterFileServiceImpl.java | 31 ++++++++++++++++ .../impl/LawsDataCenterFolderServiceImpl.java | 35 +++++++++++++++++++ 8 files changed, 112 insertions(+), 1 deletion(-) diff --git a/laws-modules/src/main/java/com/jero/modules/laws/dataCenter/controller/LawsDataCenterFileController.java b/laws-modules/src/main/java/com/jero/modules/laws/dataCenter/controller/LawsDataCenterFileController.java index b7c2702c..ecd2350c 100644 --- a/laws-modules/src/main/java/com/jero/modules/laws/dataCenter/controller/LawsDataCenterFileController.java +++ b/laws-modules/src/main/java/com/jero/modules/laws/dataCenter/controller/LawsDataCenterFileController.java @@ -10,6 +10,7 @@ import com.jero.modules.laws.common.constant.FieldCommon; import com.jero.modules.laws.common.util.CurrentUserUtil; import com.jero.modules.laws.dataCenter.entity.LawsDataCenterFile; import com.jero.modules.laws.dataCenter.service.ILawsDataCenterFileService; +import com.jero.modules.laws.dataCenter.service.ILawsDataCenterFolderService; import com.jero.modules.sys.controller.SysCommonController; import io.swagger.annotations.Api; import io.swagger.annotations.ApiOperation; @@ -42,6 +43,8 @@ public class LawsDataCenterFileController extends JeroController add(@Validated @RequestBody LawsDataCenterFile lawsDataCenterFile) { + lawsDataCenterFolderService.isHorizontalOverstep(lawsDataCenterFile.getFolderId()); lawsDataCenterFileService.add(lawsDataCenterFile, true); return Result.OK(ResultCommon.OK); } @@ -90,6 +94,7 @@ public class LawsDataCenterFileController extends JeroController edit(@Validated @RequestBody LawsDataCenterFile lawsDataCenterFile) { + lawsDataCenterFileService.isHorizontalOverstep(lawsDataCenterFile.getId()); lawsDataCenterFileService.editById(lawsDataCenterFile); return Result.OK(ResultCommon.OK); } @@ -108,6 +113,7 @@ public class LawsDataCenterFileController extends JeroController addBrother(@Validated @RequestBody LawsDataCenterFolder lawsDataCenterFolder) { + // 水平越权 + lawsDataCenterFolderService.isHorizontalOverstep(lawsDataCenterFolder.getParentId()); lawsDataCenterFolderService.add(lawsDataCenterFolder); return Result.OK(MessageUtils.getMessage(ResultCommon.OK)); } @@ -67,6 +69,8 @@ public class LawsDataCenterFolderController extends JeroController edit(@Validated @RequestBody LawsDataCenterFolder lawsDataCenterFolder) { + // 水平越权 + lawsDataCenterFolderService.isHorizontalOverstep(lawsDataCenterFolder.getId()); lawsDataCenterFolderService.editById(lawsDataCenterFolder); return Result.OK(MessageUtils.getMessage(ResultCommon.OK)); } @@ -100,6 +106,8 @@ public class LawsDataCenterFolderController extends JeroController * @return */ Page queryByPage(Page page, @Param(Constants.WRAPPER) QueryWrapper queryWrapper); + + /** + * + * @param queryWrapper + * @return + */ + List queryByList(@Param(Constants.WRAPPER) QueryWrapper queryWrapper); } diff --git a/laws-modules/src/main/java/com/jero/modules/laws/dataCenter/mapper/xml/LawsDataCenterFileMapper.xml b/laws-modules/src/main/java/com/jero/modules/laws/dataCenter/mapper/xml/LawsDataCenterFileMapper.xml index df55034a..b61c052b 100644 --- a/laws-modules/src/main/java/com/jero/modules/laws/dataCenter/mapper/xml/LawsDataCenterFileMapper.xml +++ b/laws-modules/src/main/java/com/jero/modules/laws/dataCenter/mapper/xml/LawsDataCenterFileMapper.xml @@ -18,6 +18,14 @@ + + + + SELECT * FROM (SELECT id, create_by, @@ -37,5 +45,5 @@ (SELECT auth_view_ids FROM laws_data_center_folder d WHERE d.id = folder_id) auth_view_ids FROM laws_data_center_file) t ${ew.customSqlSegment} - + \ No newline at end of file diff --git a/laws-modules/src/main/java/com/jero/modules/laws/dataCenter/service/ILawsDataCenterFileService.java b/laws-modules/src/main/java/com/jero/modules/laws/dataCenter/service/ILawsDataCenterFileService.java index 428adb91..6187b6e2 100644 --- a/laws-modules/src/main/java/com/jero/modules/laws/dataCenter/service/ILawsDataCenterFileService.java +++ b/laws-modules/src/main/java/com/jero/modules/laws/dataCenter/service/ILawsDataCenterFileService.java @@ -63,4 +63,10 @@ public interface ILawsDataCenterFileService extends IService * @return */ LawsDataCenterFile queryById(String id); + + /** + * 是否水平越权 + * @param ids + */ + void isHorizontalOverstep(String ids); } diff --git a/laws-modules/src/main/java/com/jero/modules/laws/dataCenter/service/ILawsDataCenterFolderService.java b/laws-modules/src/main/java/com/jero/modules/laws/dataCenter/service/ILawsDataCenterFolderService.java index ff44b986..0077319f 100644 --- a/laws-modules/src/main/java/com/jero/modules/laws/dataCenter/service/ILawsDataCenterFolderService.java +++ b/laws-modules/src/main/java/com/jero/modules/laws/dataCenter/service/ILawsDataCenterFolderService.java @@ -42,4 +42,10 @@ public interface ILawsDataCenterFolderService extends IService queryWrapper = new QueryWrapper<>(); + + List adminRoleCodeList = Arrays.asList(adminRoleCode.split(",")); + Collection intersection = CollectionUtils.intersection(Arrays.asList(CurrentUserUtil.getRoles().split(",")), adminRoleCodeList); + if (!CurrentUserUtil.getRoles().contains(FieldCommon.ROLE_ADMIN) && CollectionUtils.isEmpty(intersection)) { + queryWrapper.and(qw -> qw + .eq("owner_id", CurrentUserUtil.getId()) + .or().like("auth_view_ids", CurrentUserUtil.getId()) + .or().like("auth_manage_ids", CurrentUserUtil.getId()) + .or().eq("push_range_ids", CurrentUserUtil.getId()) + ); + }else { + return; + } + queryWrapper.orderByDesc("create_time"); + List idList = Arrays.asList(ids.split(",")); + queryWrapper.in("id", idList); + List list = lawsDataCenterFileMapper.queryByList(queryWrapper); + if (list.isEmpty() || list.size() != idList.size()) { + if(LanguageEnum.CN.equals(MessageUtils.getLanguage())) { + throw new JeroBootException("无权限!"); + }else{ + throw new JeroBootException("No access!"); + } + } + } } diff --git a/laws-modules/src/main/java/com/jero/modules/laws/dataCenter/service/impl/LawsDataCenterFolderServiceImpl.java b/laws-modules/src/main/java/com/jero/modules/laws/dataCenter/service/impl/LawsDataCenterFolderServiceImpl.java index 8b2b1a11..1fff2794 100644 --- a/laws-modules/src/main/java/com/jero/modules/laws/dataCenter/service/impl/LawsDataCenterFolderServiceImpl.java +++ b/laws-modules/src/main/java/com/jero/modules/laws/dataCenter/service/impl/LawsDataCenterFolderServiceImpl.java @@ -4,10 +4,12 @@ import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper; import com.baomidou.mybatisplus.core.conditions.update.LambdaUpdateWrapper; import com.baomidou.mybatisplus.extension.service.impl.ServiceImpl; import com.jero.common.api.vo.ResultCommon; +import com.jero.common.constant.enums.LanguageEnum; import com.jero.common.constant.enums.YesOrNoEnum; import com.jero.common.exception.JeroBootException; import com.jero.common.system.vo.LoginUser; import com.jero.common.util.BeanCopyUtils; +import com.jero.common.util.MessageUtils; import com.jero.common.util.StreamUtils; import com.jero.modules.laws.common.util.CurrentUserUtil; import com.jero.modules.laws.common.util.TreeNodeComparator; @@ -228,4 +230,37 @@ public class LawsDataCenterFolderServiceImpl extends ServiceImpl lawsDataCenterFolderList = list(new LambdaQueryWrapper() + .orderByAsc(LawsDataCenterFolder::getSort).orderByAsc(LawsDataCenterFolder::getCreateTime)); + + // 非管理员只能看到自己创建的 or 拥有管理权限 or 拥有查看权限的文件夹 or 默认根目录 + List adminRoleCodeList = Arrays.asList(adminRoleCode.split(",")); + Collection intersection = CollectionUtils.intersection(Arrays.asList(roleIds.split(",")), adminRoleCodeList); + if (!roleIds.contains("admin") && CollectionUtils.isEmpty(intersection)){ + lawsDataCenterFolderList = lawsDataCenterFolderList.stream() + .filter(v -> (StringUtils.isNotBlank(v.getAuthManageIds()) && v.getAuthManageIds().contains(loginUser.getId())) + || (StringUtils.isNotBlank(v.getAuthViewIds()) && v.getAuthViewIds().contains(loginUser.getId())) + || v.getOwnerId().equals(loginUser.getId()) + || YesOrNoEnum.YES.getValue().equals(v.getDefaultFolder())) + .collect(Collectors.toList()); + }else { + return; + } + + List idList = Arrays.asList(ids.split(",")); + long count = lawsDataCenterFolderList.stream().filter(v -> idList.contains(v.getId())).count(); + if (count <= 0 || count != idList.size()) { + if(LanguageEnum.CN.equals(MessageUtils.getLanguage())) { + throw new JeroBootException("无权限!"); + }else{ + throw new JeroBootException("No access!"); + } + } + } }