fix: 80955 【水平越权】问答库-部分接口未处理水平越权

This commit is contained in:
2024-02-02 16:38:35 +08:00
parent c456271451
commit 61b8fdbf5b
@@ -225,8 +225,9 @@ public class LawsProblemLibraryServiceImpl extends ServiceImpl<LawsProblemLibrar
// 如果是管理员权限 则跳过验证
List<String> adminRoleList = Arrays.asList(adminRoleCode.split(","));
// 如果不是管理员权限 且不是问题创建者 且不是回答创建者 则没有权限
SysUser user = userService.getById(answer.getUserId());
if (adminRoleList.stream().noneMatch(userRoleList::contains)) {
if (!currentUser.getUsername().equals(answer.getUserId())) {
if (!currentUser.getUsername().equals(user.getUsername())) {
throw new JeroBootException(ResultCommon.NO_PERMISSION);
}
}