fix: 78558

【垂直越权】企业标准-设置临时权限接口未处理垂直越权

laws-modules/src/main/java/com/jero/modules/laws/standard/controller/LawsEnterpriseController.java

@@ -28,6 +28,7 @@ import com.jero.modules.tag.enums.TableNameEnum;
 import io.swagger.annotations.Api;
 import io.swagger.annotations.ApiOperation;
 import io.swagger.annotations.ApiParam;
+import org.apache.shiro.authz.annotation.RequiresPermissions;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.web.bind.annotation.*;
 import org.springframework.web.multipart.MultipartFile;
@@ -68,15 +69,13 @@ public class LawsEnterpriseController {
     @Resource
     private EnterpriseStandardReviewMeetingRecordService esReviewMeetingService;
 
-    @Resource
-    private ILawsEnterpriseStandardService enterpriseStandardService;
-
     private static final String MODULE_VALUE = TableNameEnum.ENTERPRISE_STANDARDS.getValue();
 
     @AutoLog(value = "企业法规标准-分页列表查询")
     @ApiOperation(value="企业法规标准-分页列表查询", notes="企业法规标准-分页列表查询")
     @PostMapping(value = "/getCommonPage")
     @ApiOperationSupport(order = 1)
+    @RequiresPermissions("enterpriseStandard:search")
     public Result<IPage<Map<String,Object>>> getCommonPage(@RequestBody Map<String,Object> parameterMap) {
         parameterMap.put(FieldCommon.MODULE, MODULE_VALUE);
         return Result.OK(lawsCommonService.getCommonPage(parameterMap));
@@ -94,6 +93,7 @@ public class LawsEnterpriseController {
     @ApiOperation(value="企业法规标准-新增数据", notes="企业法规标准-新增数据")
     @PostMapping(value = "/commonAdd")
     @ApiOperationSupport(order = 3)
+    @RequiresPermissions("enterpriseStandard:add")
     public Result<String> commonAdd(@RequestBody Map<String,Object> parameterMap) {
         parameterMap.put(FieldCommon.MODULE, MODULE_VALUE);
         return Result.OK(lawsCommonService.commonAdd(parameterMap));
@@ -103,6 +103,7 @@ public class LawsEnterpriseController {
     @ApiOperation(value="企业法规标准-编辑数据", notes="企业法规标准-编辑数据")
     @PostMapping(value = "/commonEdit")
     @ApiOperationSupport(order = 4)
+    @RequiresPermissions("enterpriseStandard:edit")
     public Result<String> commonEdit(@RequestBody Map<String,Object> parameterMap) {
         parameterMap.put(FieldCommon.MODULE, MODULE_VALUE);
         return Result.OK(lawsCommonService.commonEdit(parameterMap));
@@ -112,6 +113,7 @@ public class LawsEnterpriseController {
     @ApiOperation(value="企业法规标准-获取查询条件", notes="企业法规标准-获取查询条件")
     @GetMapping(value = "getQueryCondition")
     @ApiOperationSupport(order = 5)
+    @RequiresPermissions("enterpriseStandard:search")
     public Result<List<LawsTag>> getQueryCondition() {
         return Result.OK(lawsCommonService.getQueryCondition(MODULE_VALUE));
     }
@@ -120,6 +122,7 @@ public class LawsEnterpriseController {
     @ApiOperation(value="企业法规标准-获取表单模型", notes="企业法规标准-获取表单模型")
     @GetMapping(value = "getFormModel")
     @ApiOperationSupport(order = 6)
+    @RequiresPermissions("enterpriseStandard:search")
     public Result<Map<String,Object>> getFormModel(@RequestParam(name="type") String type) {
         return Result.OK(lawsCommonService.getFormModel(MODULE_VALUE, type));
     }
@@ -128,6 +131,7 @@ public class LawsEnterpriseController {
     @ApiOperation(value="企业法规标准-根据id和模块标识获取信息", notes="企业法规标准-根据id和模块标识获取信息")
     @GetMapping(value = "getByIdAndModule")
     @ApiOperationSupport(order = 7)
+    @RequiresPermissions("enterpriseStandard:search")
     public Result<Map<String,Object>> getByIdAndModule(@RequestParam(name="id", required = false) String id,
                                                        @RequestParam(name="type") String type,
                                                        @RequestParam(name="standardNumber", required = false) String standardNumber) {
@@ -139,6 +143,7 @@ public class LawsEnterpriseController {
     @ApiOperation(value="企业法规标准-根据ids和模块标识删除信息", notes="企业法规标准-根据ids和模块标识删除信息")
     @PostMapping(value = "deleteByIdsAndModule")
     @ApiOperationSupport(order = 8)
+    @RequiresPermissions("enterpriseStandard:search")
     public Result<String> deleteByIdsAndModule(@RequestBody Map<String,Object> parameterMap) {
         //删除标准时同步删除这个标准的收藏数据
         lawsStandardCollectionService.deleteByStandardId((String) parameterMap.get("ids"));
@@ -150,6 +155,7 @@ public class LawsEnterpriseController {
     @ApiOperation(value="企业法规标准-列表删除", notes="企业法规标准-列表删除")
     @PostMapping(value = "singleDelete")
     @ApiOperationSupport(order = 9)
+    @RequiresPermissions("enterpriseStandard:delete")
     public Result<String> singleDelete(@RequestBody Map<String,Object> parameterMap) {
         //删除标准时同步删除这个标准的收藏数据
         lawsStandardCollectionService.deleteByStandardId((String) parameterMap.get("ids"));
@@ -161,6 +167,7 @@ public class LawsEnterpriseController {
     @ApiOperation(value="企业法规标准-配置标准", notes="企业法规标准-配置标准")
     @GetMapping(value = "relatedStandard")
     @ApiOperationSupport(order = 10)
+    @RequiresPermissions("enterpriseStandard:configStandard")
     public Result<String> relatedStandard(@RequestParam(name="nodeCode") String nodeCode,
                                           @RequestParam("ids") String ids) {
         lawsNodeRelationService.relatedStandard(nodeCode, ids);
@@ -171,6 +178,7 @@ public class LawsEnterpriseController {
     @ApiOperation(value="企业法规标准-移除标准", notes="企业法规标准-移除标准")
     @GetMapping(value = "removeStandard")
     @ApiOperationSupport(order = 11)
+    @RequiresPermissions("enterpriseStandard:removeStandard")
     public Result<String> removeStandard(@RequestParam(name="nodeCode") String nodeCode,
                                          @RequestParam("ids") String ids) {
         lawsNodeRelationService.removeStandard(nodeCode, ids);
@@ -181,6 +189,7 @@ public class LawsEnterpriseController {
     @ApiOperation(value="企业法规标准-法规更新记录", notes="企业法规标准-法规更新记录")
     @GetMapping(value = "/getUpdateRecordList")
     @ApiOperationSupport(order = 12)
+    @RequiresPermissions("enterpriseStandard:updateRecord")
     public Result<List<LawsUpdateRecord>> getUpdateRecordList(@RequestParam("standardNumber") String standardNumber) {
         LambdaQueryWrapper<LawsUpdateRecord> queryWrapper = new LambdaQueryWrapper<>();
         queryWrapper.eq(LawsUpdateRecord::getUniqueRelationFlag, standardNumber);
@@ -193,6 +202,7 @@ public class LawsEnterpriseController {
     @ApiOperation(value="企业法规标准-临时权限设置", notes="企业法规标准-临时权限设置")
     @PostMapping(value = "/tempPermission")
     @ApiOperationSupport(order = 13)
+    @RequiresPermissions("enterpriseStandard:temporaryPermissSet")
     public Result<?> tempPermission(@RequestBody LawsStandardTempPermission lawsStandardTempPermission) {
         String userIds = lawsStandardTempPermission.getUserIds();
         String deptIds = lawsStandardTempPermission.getDeptIds();
@@ -223,6 +233,7 @@ public class LawsEnterpriseController {
     @ApiOperation(value="企业法规标准-导出", notes="企业法规标准-导出")
     @PostMapping("/exportData")
     @ApiOperationSupport(order = 15)
+    @RequiresPermissions("enterpriseStandard:export")
     public void exportData(HttpServletResponse response, @RequestBody(required = false) Map<String,Object> parameterMap) {
         parameterMap.put(FieldCommon.MODULE, TableNameEnum.ENTERPRISE_STANDARDS.getValue());
         lawsCommonService.commonExport(response, parameterMap, "企业标准", "企业标准");
@@ -232,6 +243,7 @@ public class LawsEnterpriseController {
     @ApiOperation(value="企业法规标准-带文件导出", notes="企业法规标准-带文件导出")
     @PostMapping("/exportDataWithFile")
     @ApiOperationSupport(order = 16)
+    @RequiresPermissions("enterpriseStandard:fileExport")
     public void exportDataWithFile(HttpServletResponse response, @RequestBody(required = false) Map<String,Object> parameterMap) {
         parameterMap.put(FieldCommon.MODULE, TableNameEnum.ENTERPRISE_STANDARDS.getValue());
         lawsCommonService.exportDataWithFile(response, parameterMap, "企业标准", "企业标准");
@@ -241,6 +253,7 @@ public class LawsEnterpriseController {
     @ApiOperation(value="企业法规标准-模板下载", notes="企业法规标准-模板下载")
     @GetMapping("/templateDownload")
     @ApiOperationSupport(order = 17)
+    @RequiresPermissions("enterpriseStandard:templateDownload")
     public void templateDownload(HttpServletResponse response) {
         try {
             lawsCommonService.esTemplateDownload(response);
@@ -253,6 +266,7 @@ public class LawsEnterpriseController {
     @ApiOperation(value="企业法规标准-导入", notes="企业法规标准-导入")
     @PostMapping("/importExcelWithData")
     @ApiOperationSupport(order = 18)
+    @RequiresPermissions("enterpriseStandard:upload")
     public Result<?> importExcelWithData(@RequestParam("file") MultipartFile file) {
         List<String> errorMessages = lawsCommonService.importExcelWithData(file, TableNameEnum.ENTERPRISE_STANDARDS.getValue());
         if (errorMessages.size() > 0) {