fix(资料中心): 81764

laws-modules/src/main/java/com/jero/modules/laws/dataCenter/controller/LawsDataCenterFileController.java

@@ -10,6 +10,7 @@ import com.jero.modules.laws.common.constant.FieldCommon;
 import com.jero.modules.laws.common.util.CurrentUserUtil;
 import com.jero.modules.laws.dataCenter.entity.LawsDataCenterFile;
 import com.jero.modules.laws.dataCenter.service.ILawsDataCenterFileService;
+import com.jero.modules.laws.dataCenter.service.ILawsDataCenterFolderService;
 import com.jero.modules.sys.controller.SysCommonController;
 import io.swagger.annotations.Api;
 import io.swagger.annotations.ApiOperation;
@@ -42,6 +43,8 @@ public class LawsDataCenterFileController extends JeroController<LawsDataCenterF
     private ILawsDataCenterFileService lawsDataCenterFileService;
     @Autowired
     private SysCommonController sysCommonController;
+    @Autowired
+    private ILawsDataCenterFolderService lawsDataCenterFolderService;
 
     private final static String permissionFlag = "profileCenter:table"; // 权限标识
 
@@ -75,6 +78,7 @@ public class LawsDataCenterFileController extends JeroController<LawsDataCenterF
     @PostMapping(value = "/add")
     @RequiresPermissions(permissionFlag)
     public Result<T> add(@Validated @RequestBody LawsDataCenterFile lawsDataCenterFile) {
+        lawsDataCenterFolderService.isHorizontalOverstep(lawsDataCenterFile.getFolderId());
         lawsDataCenterFileService.add(lawsDataCenterFile, true);
         return Result.OK(ResultCommon.OK);
     }
@@ -90,6 +94,7 @@ public class LawsDataCenterFileController extends JeroController<LawsDataCenterF
     @PostMapping(value = "/edit")
     @RequiresPermissions(permissionFlag)
     public Result<T> edit(@Validated @RequestBody LawsDataCenterFile lawsDataCenterFile) {
+        lawsDataCenterFileService.isHorizontalOverstep(lawsDataCenterFile.getId());
         lawsDataCenterFileService.editById(lawsDataCenterFile);
         return Result.OK(ResultCommon.OK);
     }
@@ -108,6 +113,7 @@ public class LawsDataCenterFileController extends JeroController<LawsDataCenterF
         if (!map.containsKey("id") || StringUtils.isEmpty(map.get("id"))) {
             return Result.error("请选择数据!");
         }
+        lawsDataCenterFileService.isHorizontalOverstep(String.valueOf(map.containsKey("id")));
         lawsDataCenterFileService.deleteById(map.get("id"));
         return Result.OK(ResultCommon.OK);
     }
@@ -126,6 +132,7 @@ public class LawsDataCenterFileController extends JeroController<LawsDataCenterF
         if (!map.containsKey("ids") || StringUtils.isEmpty(map.get("ids"))) {
             return Result.error("请选择数据!");
         }
+        lawsDataCenterFileService.isHorizontalOverstep(String.valueOf(map.containsKey("ids")));
         this.lawsDataCenterFileService.deleteByIds(Arrays.asList(map.get("ids").split(",")));
         return Result.OK(ResultCommon.OK);
     }
@@ -157,6 +164,7 @@ public class LawsDataCenterFileController extends JeroController<LawsDataCenterF
         if (file == null) {
             throw new JeroBootException(ResultCommon.NO_CORRESPONDING_DATA_FOUND);
         }
+        lawsDataCenterFileService.isHorizontalOverstep(id);
         // 不是管理员，不是自己上传的文件，并且推送范围不包含自己
         if (!CurrentUserUtil.getRoles().contains(FieldCommon.ROLE_ADMIN)
                 && !CurrentUserUtil.getId().equals(file.getOwnerId())

laws-modules/src/main/java/com/jero/modules/laws/dataCenter/controller/LawsDataCenterFolderController.java

@@ -55,6 +55,8 @@ public class LawsDataCenterFolderController extends JeroController<LawsDataCente
     @PostMapping(value = "/addBrother")
     @RequiresPermissions("profileCenter:addPeer")
     public Result<T> addBrother(@Validated @RequestBody LawsDataCenterFolder lawsDataCenterFolder) {
+        // 水平越权
+        lawsDataCenterFolderService.isHorizontalOverstep(lawsDataCenterFolder.getParentId());
         lawsDataCenterFolderService.add(lawsDataCenterFolder);
         return Result.OK(MessageUtils.getMessage(ResultCommon.OK));
     }
@@ -67,6 +69,8 @@ public class LawsDataCenterFolderController extends JeroController<LawsDataCente
 		if (StringUtils.isBlank(lawsDataCenterFolder.getParentId())) {
             throw new JeroBootException(ResultCommon.EMPTY_COMMON, "parentId");
         }
+        // 水平越权
+        lawsDataCenterFolderService.isHorizontalOverstep(lawsDataCenterFolder.getParentId());
         lawsDataCenterFolderService.add(lawsDataCenterFolder);
         return Result.OK(MessageUtils.getMessage(ResultCommon.OK));
     }
@@ -82,6 +86,8 @@ public class LawsDataCenterFolderController extends JeroController<LawsDataCente
     @PostMapping(value = "/edit")
     @RequiresPermissions("profileCenter:editFolder")
     public Result<T> edit(@Validated @RequestBody LawsDataCenterFolder lawsDataCenterFolder) {
+        // 水平越权
+        lawsDataCenterFolderService.isHorizontalOverstep(lawsDataCenterFolder.getId());
         lawsDataCenterFolderService.editById(lawsDataCenterFolder);
         return Result.OK(MessageUtils.getMessage(ResultCommon.OK));
     }
@@ -100,6 +106,8 @@ public class LawsDataCenterFolderController extends JeroController<LawsDataCente
         if (!map.containsKey("id") || StringUtils.isEmpty(map.get("id"))) {
             return Result.error("请选择数据!");
         }
+        // 水平越权
+        lawsDataCenterFolderService.isHorizontalOverstep(map.get("id"));
         lawsDataCenterFolderService.deleteById(map.get("id"));
         return Result.OK(MessageUtils.getMessage(ResultCommon.OK));
     }

laws-modules/src/main/java/com/jero/modules/laws/dataCenter/mapper/LawsDataCenterFileMapper.java

@@ -7,6 +7,8 @@ import com.baomidou.mybatisplus.extension.plugins.pagination.Page;
 import com.jero.modules.laws.dataCenter.entity.LawsDataCenterFile;
 import org.apache.ibatis.annotations.Param;
 
+import java.util.List;
+
 /**
  * @Description: 资料中心-文件数据
  * @Author: jero-boot
@@ -22,4 +24,11 @@ public interface LawsDataCenterFileMapper extends BaseMapper<LawsDataCenterFile>
      * @return
      */
     Page<LawsDataCenterFile> queryByPage(Page<LawsDataCenterFile> page, @Param(Constants.WRAPPER) QueryWrapper<LawsDataCenterFile> queryWrapper);
+
+    /**
+     *
+     * @param queryWrapper
+     * @return
+     */
+    List<LawsDataCenterFile> queryByList(@Param(Constants.WRAPPER) QueryWrapper<LawsDataCenterFile> queryWrapper);
 }

laws-modules/src/main/java/com/jero/modules/laws/dataCenter/mapper/xml/LawsDataCenterFileMapper.xml

@@ -18,6 +18,14 @@
     </resultMap>
 
     <select id="queryByPage" resultType="com.jero.modules.laws.dataCenter.entity.LawsDataCenterFile">
+        <include refid="select_laws_data_center_file"/>
+    </select>
+
+    <select id="queryByList" resultType="com.jero.modules.laws.dataCenter.entity.LawsDataCenterFile">
+        <include refid="select_laws_data_center_file"/>
+    </select>
+
+    <sql id="select_laws_data_center_file">
         SELECT *
         FROM (SELECT id,
                      create_by,
@@ -37,5 +45,5 @@
                      (SELECT auth_view_ids FROM laws_data_center_folder d WHERE d.id = folder_id) auth_view_ids
               FROM laws_data_center_file) t
             ${ew.customSqlSegment}
-    </select>
+    </sql>
 </mapper>

laws-modules/src/main/java/com/jero/modules/laws/dataCenter/service/ILawsDataCenterFileService.java

@@ -63,4 +63,10 @@ public interface ILawsDataCenterFileService extends IService<LawsDataCenterFile>
 	 * @return
 	 */
     LawsDataCenterFile queryById(String id);
+
+	/**
+	 * 是否水平越权
+	 * @param ids
+	 */
+	void isHorizontalOverstep(String ids);
 }

laws-modules/src/main/java/com/jero/modules/laws/dataCenter/service/ILawsDataCenterFolderService.java

@@ -42,4 +42,10 @@ public interface ILawsDataCenterFolderService extends IService<LawsDataCenterFol
 	 * @return
 	 */
     void deleteById(String id);
+
+	/**
+	 * 是否水平越权
+	 * @param ids
+	 */
+	void isHorizontalOverstep(String ids);
 }

laws-modules/src/main/java/com/jero/modules/laws/dataCenter/service/impl/LawsDataCenterFileServiceImpl.java

@@ -7,7 +7,9 @@ import com.baomidou.mybatisplus.extension.service.impl.ServiceImpl;
 import com.jero.common.api.dto.message.SendMessageDTO;
 import com.jero.common.api.vo.ResultCommon;
 import com.jero.common.api.vo.SendMessageAPI;
+import com.jero.common.constant.enums.LanguageEnum;
 import com.jero.common.exception.JeroBootException;
+import com.jero.common.util.MessageUtils;
 import com.jero.modules.laws.common.constant.FieldCommon;
 import com.jero.modules.laws.common.constant.MessageTemplateCodeCommon;
 import com.jero.modules.laws.common.util.CurrentUserUtil;
@@ -264,4 +266,33 @@ public class LawsDataCenterFileServiceImpl extends ServiceImpl<LawsDataCenterFil
     public LawsDataCenterFile queryById(String id) {
         return getById(id);
     }
+
+	@Override
+	public void isHorizontalOverstep(String ids) {
+		QueryWrapper<LawsDataCenterFile> queryWrapper = new QueryWrapper<>();
+
+		List<String> adminRoleCodeList = Arrays.asList(adminRoleCode.split(","));
+		Collection<String> intersection = CollectionUtils.intersection(Arrays.asList(CurrentUserUtil.getRoles().split(",")), adminRoleCodeList);
+		if (!CurrentUserUtil.getRoles().contains(FieldCommon.ROLE_ADMIN) && CollectionUtils.isEmpty(intersection)) {
+			queryWrapper.and(qw -> qw
+					.eq("owner_id", CurrentUserUtil.getId())
+					.or().like("auth_view_ids", CurrentUserUtil.getId())
+					.or().like("auth_manage_ids", CurrentUserUtil.getId())
+					.or().eq("push_range_ids", CurrentUserUtil.getId())
+			);
+		}else {
+			return;
+		}
+		queryWrapper.orderByDesc("create_time");
+		List<String> idList = Arrays.asList(ids.split(","));
+		queryWrapper.in("id", idList);
+		List<LawsDataCenterFile> list = lawsDataCenterFileMapper.queryByList(queryWrapper);
+		if (list.isEmpty() || list.size() != idList.size()) {
+			if(LanguageEnum.CN.equals(MessageUtils.getLanguage())) {
+				throw new JeroBootException("无权限!");
+			}else{
+				throw new JeroBootException("No access!");
+			}
+		}
+	}
 }

laws-modules/src/main/java/com/jero/modules/laws/dataCenter/service/impl/LawsDataCenterFolderServiceImpl.java

@@ -4,10 +4,12 @@ import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
 import com.baomidou.mybatisplus.core.conditions.update.LambdaUpdateWrapper;
 import com.baomidou.mybatisplus.extension.service.impl.ServiceImpl;
 import com.jero.common.api.vo.ResultCommon;
+import com.jero.common.constant.enums.LanguageEnum;
 import com.jero.common.constant.enums.YesOrNoEnum;
 import com.jero.common.exception.JeroBootException;
 import com.jero.common.system.vo.LoginUser;
 import com.jero.common.util.BeanCopyUtils;
+import com.jero.common.util.MessageUtils;
 import com.jero.common.util.StreamUtils;
 import com.jero.modules.laws.common.util.CurrentUserUtil;
 import com.jero.modules.laws.common.util.TreeNodeComparator;
@@ -228,4 +230,37 @@ public class LawsDataCenterFolderServiceImpl extends ServiceImpl<LawsDataCenterF
 		 * 		lawsDataCenterFileService.update(updateWrapper);
 		 */
     }
+
+	@Override
+	public void isHorizontalOverstep(String ids) {
+		LoginUser loginUser = (LoginUser) SecurityUtils.getSubject().getPrincipal();
+		String roleIds = loginUser.getRoleIds();
+		// 全部数据
+		List<LawsDataCenterFolder> lawsDataCenterFolderList = list(new LambdaQueryWrapper<LawsDataCenterFolder>()
+				.orderByAsc(LawsDataCenterFolder::getSort).orderByAsc(LawsDataCenterFolder::getCreateTime));
+
+		// 非管理员只能看到自己创建的 or 拥有管理权限 or 拥有查看权限的文件夹 or 默认根目录
+		List<String> adminRoleCodeList = Arrays.asList(adminRoleCode.split(","));
+		Collection<String> intersection = CollectionUtils.intersection(Arrays.asList(roleIds.split(",")), adminRoleCodeList);
+		if (!roleIds.contains("admin") && CollectionUtils.isEmpty(intersection)){
+			lawsDataCenterFolderList = lawsDataCenterFolderList.stream()
+					.filter(v -> (StringUtils.isNotBlank(v.getAuthManageIds()) && v.getAuthManageIds().contains(loginUser.getId()))
+							|| (StringUtils.isNotBlank(v.getAuthViewIds()) && v.getAuthViewIds().contains(loginUser.getId()))
+							|| v.getOwnerId().equals(loginUser.getId())
+							|| YesOrNoEnum.YES.getValue().equals(v.getDefaultFolder()))
+					.collect(Collectors.toList());
+		}else {
+			return;
+		}
+
+		List<String> idList = Arrays.asList(ids.split(","));
+		long count = lawsDataCenterFolderList.stream().filter(v -> idList.contains(v.getId())).count();
+		if (count <= 0 || count != idList.size()) {
+			if(LanguageEnum.CN.equals(MessageUtils.getLanguage())) {
+				throw new JeroBootException("无权限!");
+			}else{
+				throw new JeroBootException("No access!");
+			}
+		}
+	}
 }