ZQ/laws-sinotruk-server
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: 80955 【水平越权】问答库-部分接口未处理水平越权

Browse Source
This commit is contained in:
mzaxd
2024-02-02 16:38:35 +08:00
parent c456271451
commit 61b8fdbf5b
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
laws-modules/src/main/java/com/jero/modules/laws/library/service/impl/LawsProblemLibraryServiceImpl.java
+2 -1
View File
@@ -225,8 +225,9 @@ public class LawsProblemLibraryServiceImpl extends ServiceImpl<LawsProblemLibrar
// 如果是管理员权限 则跳过验证 // 如果是管理员权限 则跳过验证
List<String> adminRoleList = Arrays.asList(adminRoleCode.split(",")); List<String> adminRoleList = Arrays.asList(adminRoleCode.split(","));
// 如果不是管理员权限 且不是问题创建者 且不是回答创建者 则没有权限 // 如果不是管理员权限 且不是问题创建者 且不是回答创建者 则没有权限
SysUser user = userService.getById(answer.getUserId());
if (adminRoleList.stream().noneMatch(userRoleList::contains)) { if (adminRoleList.stream().noneMatch(userRoleList::contains)) {
if (!currentUser.getUsername().equals(answer.getUserId())) { if (!currentUser.getUsername().equals(user.getUsername())) {
throw new JeroBootException(ResultCommon.NO_PERMISSION); throw new JeroBootException(ResultCommon.NO_PERMISSION);
} }
} }