ZQ/laws-sinotruk-server
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix 78578 【水平越权】动态消息--部分接口没处理水平越权

Browse Source
This commit is contained in:
liao
2023-11-27 10:04:43 +08:00
parent 45e0c5dd8d
commit 6246f3697a
2 changed files with 47 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
laws-modules/src/main/java/com/jero/modules/laws/standard/service/impl/LawsNewsFeedServiceImpl.java
+43 -12
View File
@@ -143,11 +143,7 @@ public class LawsNewsFeedServiceImpl extends ServiceImpl<LawsNewsFeedMapper, Law
}
// 判断是否拥有操作权限（管理员和编辑人拥有权限）
LoginUser loginUser = (LoginUser) SecurityUtils.getSubject().getPrincipal();
if (StringUtils.isNotBlank(lawsNewsFeed.getWriter())
&& !lawsNewsFeed.getWriter().equals(loginUser.getId())
&& !loginUser.getRoleIds().contains(FieldCommon.ROLE_ADMIN)) {
throw new JeroBootException(ResultCommon.NO_PERMISSION);
}
isHaveOperateAuth(lawsNewsFeed);
lawsNewsFeed.setWriter(loginUser.getId());
saveOrUpdate(lawsNewsFeed);
@@ -175,6 +171,46 @@ public class LawsNewsFeedServiceImpl extends ServiceImpl<LawsNewsFeedMapper, Law
}
}
/**
* @Author: liao
* @Date: 2023/11/27 9:29
* @Description: 是否拥有操作权限
**/
private void isHaveOperateAuth(LawsNewsFeed lawsNewsFeed) {
LoginUser loginUser = (LoginUser) SecurityUtils.getSubject().getPrincipal();
if (StringUtils.isNotBlank(lawsNewsFeed.getWriter())
&& !lawsNewsFeed.getWriter().equals(loginUser.getId())
&& !loginUser.getRoleIds().contains(FieldCommon.ROLE_ADMIN)) {
throw new JeroBootException(ResultCommon.NO_PERMISSION);
}
}
/**
* @Author: liao
* @Date: 2023/11/27 9:34
* @Description: 是否拥有查看权限
**/
private void isHaveQueryAuth(LawsNewsFeed lawsNewsFeed) {
String userId = CurrentUserUtil.getId();
String roles = CurrentUserUtil.getRoles();
// 如果是编辑者，直接返回
if (userId.equals(lawsNewsFeed.getWriter())) return;
// 如果发布状态为未发布，直接报错
if (0 == lawsNewsFeed.getReleaseStatus()) {
throw new JeroBootException(ResultCommon.HORIZONTAL_TRANSGRESSION);
}
// 管理员角色或者推送范围为全体用户，直接返回
if (roles.contains(FieldCommon.ROLE_ADMIN) || 2 == lawsNewsFeed.getPushRangeFlag()) return;
// 普通用户，且有推送范围
LambdaQueryWrapper<LawsPushRange> queryWrapper = new LambdaQueryWrapper<>();
queryWrapper.eq(LawsPushRange::getUniqueRelationFlag, lawsNewsFeed.getId());
queryWrapper.eq(LawsPushRange::getUserId, userId);
LawsPushRange lawsPushRange = lawsPushRangeService.getOne(queryWrapper, false);
if (lawsPushRange == null) {
throw new JeroBootException(ResultCommon.HORIZONTAL_TRANSGRESSION);
}
}
/**
* @Author: liao
* @Date: 2023/11/10 15:20
@@ -223,14 +259,8 @@ public class LawsNewsFeedServiceImpl extends ServiceImpl<LawsNewsFeedMapper, Law
*/
@Override
public void deleteByIds(List<String> ids) {
LoginUser loginUser = (LoginUser) SecurityUtils.getSubject().getPrincipal();
List<LawsNewsFeed> newsFeedList = listByIds(ids);
List<String> writerList = newsFeedList.stream().map(LawsNewsFeed::getWriter)
.distinct().collect(Collectors.toList());
if ((writerList.size() > 1 || !loginUser.getId().equals(writerList.get(0)))
&& !loginUser.getRoleIds().contains(FieldCommon.ROLE_ADMIN)) {
throw new JeroBootException(ResultCommon.NO_PERMISSION);
}
newsFeedList.forEach(lawsNewsFeed -> isHaveOperateAuth(lawsNewsFeed));
removeByIds(ids);
}
@@ -246,6 +276,7 @@ public class LawsNewsFeedServiceImpl extends ServiceImpl<LawsNewsFeedMapper, Law
if (Objects.isNull(lawsNewsFeed)) {
throw new JeroBootException(ResultCommon.NO_CORRESPONDING_DATA_FOUND);
}
isHaveQueryAuth(lawsNewsFeed);
// 阅读次数加1
if ("query".equals(type)) {
lawsNewsFeed.setReadCount(lawsNewsFeed.getReadCount() + 1);
laws-modules/src/main/java/com/jero/modules/personal/controller/LawsStandardSharingController.java
+4 -1
View File
@@ -258,12 +258,15 @@ public class LawsStandardSharingController extends JeroController<LawsStandardSh
SysUser user = sysUserService.getById(sysUser.getId());
String recipientId = lawsStandardSharing.getRecipientId();
Date date = new Date();
LawsNewsFeed lawsNewsFeed = lawsNewsFeedService.getById(lawsStandardSharing.getStandardId());
if (0 == lawsNewsFeed.getReleaseStatus()) {
throw new JeroBootException("未发布的消息不能进行分享");
}
List<LawsStandardSharing> sharings = new ArrayList<>();
List<String> recipientIdList = Arrays.asList(recipientId.split(","));
for (int i = 0; i < recipientIdList.size(); i++) {
LawsStandardSharing sharing = new LawsStandardSharing();
sharing.setStandardId(lawsStandardSharing.getStandardId());
LawsNewsFeed lawsNewsFeed = lawsNewsFeedService.getById(lawsStandardSharing.getStandardId());
sharing.setRubric(lawsNewsFeed.getDynamicHeading());
sharing.setSource(CommonConstant.STANDARD_SOURCE_4);
sharing.setSharerId(sysUser.getId());