fix: 80955 【水平越权】问答库-部分接口未处理水平越权
This commit is contained in:
+2
-1
@@ -225,8 +225,9 @@ public class LawsProblemLibraryServiceImpl extends ServiceImpl<LawsProblemLibrar
|
||||
// 如果是管理员权限 则跳过验证
|
||||
List<String> adminRoleList = Arrays.asList(adminRoleCode.split(","));
|
||||
// 如果不是管理员权限 且不是问题创建者 且不是回答创建者 则没有权限
|
||||
SysUser user = userService.getById(answer.getUserId());
|
||||
if (adminRoleList.stream().noneMatch(userRoleList::contains)) {
|
||||
if (!currentUser.getUsername().equals(answer.getUserId())) {
|
||||
if (!currentUser.getUsername().equals(user.getUsername())) {
|
||||
throw new JeroBootException(ResultCommon.NO_PERMISSION);
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user