ZQ/laws-sinotruk-server
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(资料中心): 81764

Browse Source
This commit is contained in:
yjz
2024-02-05 11:25:47 +08:00
parent b8c91c29f8
commit 5ed72723a7
8 changed files with 112 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
laws-modules/src/main/java/com/jero/modules/laws/dataCenter/controller/LawsDataCenterFileController.java
+8
View File
@@ -10,6 +10,7 @@ import com.jero.modules.laws.common.constant.FieldCommon;
import com.jero.modules.laws.common.util.CurrentUserUtil;
import com.jero.modules.laws.dataCenter.entity.LawsDataCenterFile;
import com.jero.modules.laws.dataCenter.service.ILawsDataCenterFileService;
import com.jero.modules.laws.dataCenter.service.ILawsDataCenterFolderService;
import com.jero.modules.sys.controller.SysCommonController;
import io.swagger.annotations.Api;
import io.swagger.annotations.ApiOperation;
@@ -42,6 +43,8 @@ public class LawsDataCenterFileController extends JeroController<LawsDataCenterF
private ILawsDataCenterFileService lawsDataCenterFileService;
@Autowired
private SysCommonController sysCommonController;
@Autowired
private ILawsDataCenterFolderService lawsDataCenterFolderService;
private final static String permissionFlag = "profileCenter:table"; // 权限标识
@@ -75,6 +78,7 @@ public class LawsDataCenterFileController extends JeroController<LawsDataCenterF
@PostMapping(value = "/add")
@RequiresPermissions(permissionFlag)
public Result<T> add(@Validated @RequestBody LawsDataCenterFile lawsDataCenterFile) {
lawsDataCenterFolderService.isHorizontalOverstep(lawsDataCenterFile.getFolderId());
lawsDataCenterFileService.add(lawsDataCenterFile, true);
return Result.OK(ResultCommon.OK);
}
@@ -90,6 +94,7 @@ public class LawsDataCenterFileController extends JeroController<LawsDataCenterF
@PostMapping(value = "/edit")
@RequiresPermissions(permissionFlag)
public Result<T> edit(@Validated @RequestBody LawsDataCenterFile lawsDataCenterFile) {
lawsDataCenterFileService.isHorizontalOverstep(lawsDataCenterFile.getId());
lawsDataCenterFileService.editById(lawsDataCenterFile);
return Result.OK(ResultCommon.OK);
}
@@ -108,6 +113,7 @@ public class LawsDataCenterFileController extends JeroController<LawsDataCenterF
if (!map.containsKey("id") || StringUtils.isEmpty(map.get("id"))) {
return Result.error("请选择数据!");
}
lawsDataCenterFileService.isHorizontalOverstep(String.valueOf(map.containsKey("id")));
lawsDataCenterFileService.deleteById(map.get("id"));
return Result.OK(ResultCommon.OK);
}
@@ -126,6 +132,7 @@ public class LawsDataCenterFileController extends JeroController<LawsDataCenterF
if (!map.containsKey("ids") || StringUtils.isEmpty(map.get("ids"))) {
return Result.error("请选择数据!");
}
lawsDataCenterFileService.isHorizontalOverstep(String.valueOf(map.containsKey("ids")));
this.lawsDataCenterFileService.deleteByIds(Arrays.asList(map.get("ids").split(",")));
return Result.OK(ResultCommon.OK);
}
@@ -157,6 +164,7 @@ public class LawsDataCenterFileController extends JeroController<LawsDataCenterF
if (file == null) {
throw new JeroBootException(ResultCommon.NO_CORRESPONDING_DATA_FOUND);
}
lawsDataCenterFileService.isHorizontalOverstep(id);
// 不是管理员，不是自己上传的文件，并且推送范围不包含自己
if (!CurrentUserUtil.getRoles().contains(FieldCommon.ROLE_ADMIN)
&& !CurrentUserUtil.getId().equals(file.getOwnerId())
laws-modules/src/main/java/com/jero/modules/laws/dataCenter/controller/LawsDataCenterFolderController.java
+8
View File
@@ -55,6 +55,8 @@ public class LawsDataCenterFolderController extends JeroController<LawsDataCente
@PostMapping(value = "/addBrother")
@RequiresPermissions("profileCenter:addPeer")
public Result<T> addBrother(@Validated @RequestBody LawsDataCenterFolder lawsDataCenterFolder) {
// 水平越权
lawsDataCenterFolderService.isHorizontalOverstep(lawsDataCenterFolder.getParentId());
lawsDataCenterFolderService.add(lawsDataCenterFolder);
return Result.OK(MessageUtils.getMessage(ResultCommon.OK));
}
@@ -67,6 +69,8 @@ public class LawsDataCenterFolderController extends JeroController<LawsDataCente
if (StringUtils.isBlank(lawsDataCenterFolder.getParentId())) {
throw new JeroBootException(ResultCommon.EMPTY_COMMON, "parentId");
}
// 水平越权
lawsDataCenterFolderService.isHorizontalOverstep(lawsDataCenterFolder.getParentId());
lawsDataCenterFolderService.add(lawsDataCenterFolder);
return Result.OK(MessageUtils.getMessage(ResultCommon.OK));
}
@@ -82,6 +86,8 @@ public class LawsDataCenterFolderController extends JeroController<LawsDataCente
@PostMapping(value = "/edit")
@RequiresPermissions("profileCenter:editFolder")
public Result<T> edit(@Validated @RequestBody LawsDataCenterFolder lawsDataCenterFolder) {
// 水平越权
lawsDataCenterFolderService.isHorizontalOverstep(lawsDataCenterFolder.getId());
lawsDataCenterFolderService.editById(lawsDataCenterFolder);
return Result.OK(MessageUtils.getMessage(ResultCommon.OK));
}
@@ -100,6 +106,8 @@ public class LawsDataCenterFolderController extends JeroController<LawsDataCente
if (!map.containsKey("id") || StringUtils.isEmpty(map.get("id"))) {
return Result.error("请选择数据!");
}
// 水平越权
lawsDataCenterFolderService.isHorizontalOverstep(map.get("id"));
lawsDataCenterFolderService.deleteById(map.get("id"));
return Result.OK(MessageUtils.getMessage(ResultCommon.OK));
}
laws-modules/src/main/java/com/jero/modules/laws/dataCenter/mapper/LawsDataCenterFileMapper.java
+9
View File
@@ -7,6 +7,8 @@ import com.baomidou.mybatisplus.extension.plugins.pagination.Page;
import com.jero.modules.laws.dataCenter.entity.LawsDataCenterFile;
import org.apache.ibatis.annotations.Param;
import java.util.List;
/**
* @Description: 资料中心-文件数据
* @Author: jero-boot
@@ -22,4 +24,11 @@ public interface LawsDataCenterFileMapper extends BaseMapper<LawsDataCenterFile>
* @return
*/
Page<LawsDataCenterFile> queryByPage(Page<LawsDataCenterFile> page, @Param(Constants.WRAPPER) QueryWrapper<LawsDataCenterFile> queryWrapper);
/**
*
* @param queryWrapper
* @return
*/
List<LawsDataCenterFile> queryByList(@Param(Constants.WRAPPER) QueryWrapper<LawsDataCenterFile> queryWrapper);
}
laws-modules/src/main/java/com/jero/modules/laws/dataCenter/mapper/xml/LawsDataCenterFileMapper.xml
+9 -1
View File
@@ -18,6 +18,14 @@
</resultMap>
<select id="queryByPage" resultType="com.jero.modules.laws.dataCenter.entity.LawsDataCenterFile">
<include refid="select_laws_data_center_file"/>
</select>
<select id="queryByList" resultType="com.jero.modules.laws.dataCenter.entity.LawsDataCenterFile">
<include refid="select_laws_data_center_file"/>
</select>
<sql id="select_laws_data_center_file">
SELECT *
FROM (SELECT id,
create_by,
@@ -37,5 +45,5 @@
(SELECT auth_view_ids FROM laws_data_center_folder d WHERE d.id = folder_id) auth_view_ids
FROM laws_data_center_file) t
${ew.customSqlSegment}
</select>
</sql>
</mapper>
laws-modules/src/main/java/com/jero/modules/laws/dataCenter/service/ILawsDataCenterFileService.java
+6
View File
@@ -63,4 +63,10 @@ public interface ILawsDataCenterFileService extends IService<LawsDataCenterFile>
* @return
*/
LawsDataCenterFile queryById(String id);
/**
* 是否水平越权
* @param ids
*/
void isHorizontalOverstep(String ids);
}
laws-modules/src/main/java/com/jero/modules/laws/dataCenter/service/ILawsDataCenterFolderService.java
+6
View File
@@ -42,4 +42,10 @@ public interface ILawsDataCenterFolderService extends IService<LawsDataCenterFol
* @return
*/
void deleteById(String id);
/**
* 是否水平越权
* @param ids
*/
void isHorizontalOverstep(String ids);
}
laws-modules/src/main/java/com/jero/modules/laws/dataCenter/service/impl/LawsDataCenterFileServiceImpl.java
+31
View File
@@ -7,7 +7,9 @@ import com.baomidou.mybatisplus.extension.service.impl.ServiceImpl;
import com.jero.common.api.dto.message.SendMessageDTO;
import com.jero.common.api.vo.ResultCommon;
import com.jero.common.api.vo.SendMessageAPI;
import com.jero.common.constant.enums.LanguageEnum;
import com.jero.common.exception.JeroBootException;
import com.jero.common.util.MessageUtils;
import com.jero.modules.laws.common.constant.FieldCommon;
import com.jero.modules.laws.common.constant.MessageTemplateCodeCommon;
import com.jero.modules.laws.common.util.CurrentUserUtil;
@@ -264,4 +266,33 @@ public class LawsDataCenterFileServiceImpl extends ServiceImpl<LawsDataCenterFil
public LawsDataCenterFile queryById(String id) {
return getById(id);
}
@Override
public void isHorizontalOverstep(String ids) {
QueryWrapper<LawsDataCenterFile> queryWrapper = new QueryWrapper<>();
List<String> adminRoleCodeList = Arrays.asList(adminRoleCode.split(","));
Collection<String> intersection = CollectionUtils.intersection(Arrays.asList(CurrentUserUtil.getRoles().split(",")), adminRoleCodeList);
if (!CurrentUserUtil.getRoles().contains(FieldCommon.ROLE_ADMIN) && CollectionUtils.isEmpty(intersection)) {
queryWrapper.and(qw -> qw
.eq("owner_id", CurrentUserUtil.getId())
.or().like("auth_view_ids", CurrentUserUtil.getId())
.or().like("auth_manage_ids", CurrentUserUtil.getId())
.or().eq("push_range_ids", CurrentUserUtil.getId())
);
}else {
return;
}
queryWrapper.orderByDesc("create_time");
List<String> idList = Arrays.asList(ids.split(","));
queryWrapper.in("id", idList);
List<LawsDataCenterFile> list = lawsDataCenterFileMapper.queryByList(queryWrapper);
if (list.isEmpty() || list.size() != idList.size()) {
if(LanguageEnum.CN.equals(MessageUtils.getLanguage())) {
throw new JeroBootException("无权限!");
}else{
throw new JeroBootException("No access!");
}
}
}
}
laws-modules/src/main/java/com/jero/modules/laws/dataCenter/service/impl/LawsDataCenterFolderServiceImpl.java
+35
View File
@@ -4,10 +4,12 @@ import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
import com.baomidou.mybatisplus.core.conditions.update.LambdaUpdateWrapper;
import com.baomidou.mybatisplus.extension.service.impl.ServiceImpl;
import com.jero.common.api.vo.ResultCommon;
import com.jero.common.constant.enums.LanguageEnum;
import com.jero.common.constant.enums.YesOrNoEnum;
import com.jero.common.exception.JeroBootException;
import com.jero.common.system.vo.LoginUser;
import com.jero.common.util.BeanCopyUtils;
import com.jero.common.util.MessageUtils;
import com.jero.common.util.StreamUtils;
import com.jero.modules.laws.common.util.CurrentUserUtil;
import com.jero.modules.laws.common.util.TreeNodeComparator;
@@ -228,4 +230,37 @@ public class LawsDataCenterFolderServiceImpl extends ServiceImpl<LawsDataCenterF
* lawsDataCenterFileService.update(updateWrapper);
*/
}
@Override
public void isHorizontalOverstep(String ids) {
LoginUser loginUser = (LoginUser) SecurityUtils.getSubject().getPrincipal();
String roleIds = loginUser.getRoleIds();
// 全部数据
List<LawsDataCenterFolder> lawsDataCenterFolderList = list(new LambdaQueryWrapper<LawsDataCenterFolder>()
.orderByAsc(LawsDataCenterFolder::getSort).orderByAsc(LawsDataCenterFolder::getCreateTime));
// 非管理员只能看到自己创建的 or 拥有管理权限 or 拥有查看权限的文件夹 or 默认根目录
List<String> adminRoleCodeList = Arrays.asList(adminRoleCode.split(","));
Collection<String> intersection = CollectionUtils.intersection(Arrays.asList(roleIds.split(",")), adminRoleCodeList);
if (!roleIds.contains("admin") && CollectionUtils.isEmpty(intersection)){
lawsDataCenterFolderList = lawsDataCenterFolderList.stream()
.filter(v -> (StringUtils.isNotBlank(v.getAuthManageIds()) && v.getAuthManageIds().contains(loginUser.getId()))
|| (StringUtils.isNotBlank(v.getAuthViewIds()) && v.getAuthViewIds().contains(loginUser.getId()))
|| v.getOwnerId().equals(loginUser.getId())
|| YesOrNoEnum.YES.getValue().equals(v.getDefaultFolder()))
.collect(Collectors.toList());
}else {
return;
}
List<String> idList = Arrays.asList(ids.split(","));
long count = lawsDataCenterFolderList.stream().filter(v -> idList.contains(v.getId())).count();
if (count <= 0 || count != idList.size()) {
if(LanguageEnum.CN.equals(MessageUtils.getLanguage())) {
throw new JeroBootException("无权限!");
}else{
throw new JeroBootException("No access!");
}
}
}
}