ZQ/laws-sinotruk-server
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: 80955 【水平越权】问答库-部分接口未处理水平越权

Browse Source
This commit is contained in:
mzaxd
2024-01-31 17:33:53 +08:00
parent 0fc7ac867a
commit 7013baaae8
2 changed files with 151 additions and 101 deletions
Download Patch File Download Diff File Expand all files Collapse all files
laws-modules/src/main/java/com/jero/modules/laws/library/controller/LawsProblemLibraryController.java
+99 -98
View File
@@ -24,120 +24,121 @@ import org.apache.commons.lang3.StringUtils;
import org.apache.poi.ss.formula.functions.T;
/**
/**
* @Description: 问答库-问题
* @Author: jero-boot
* @Date: 2023-09-28
* @Date: 2023-09-28
* @Version: V1.0
*/
@Api(tags="问答库")
@Api(tags = "问答库")
@RestController
@RequestMapping("/laws/library/lawsProblemLibrary")
@Slf4j
public class LawsProblemLibraryController extends JeroController<LawsProblemLibrary, ILawsProblemLibraryService> {
@Autowired
private ILawsProblemLibraryService lawsProblemLibraryService;
@AutoLog(value = "问答库-分页列表查询")
@ApiOperation(value="问答库-分页列表查询", notes="问答库-问题-分页列表查询")
@GetMapping(value = "/page")
@RequiresPermissions("businessSupport:questionAnswer:search")
public Result<IPage<LawsProblemLibrary>> queryPageList(LawsProblemLibrary lawsProblemLibrary,
@RequestParam(name="pageNo", defaultValue="1") Integer pageNo,
@RequestParam(name="pageSize", defaultValue="10") Integer pageSize,
HttpServletRequest req) {
IPage<LawsProblemLibrary> pageList = lawsProblemLibraryService.queryPage(lawsProblemLibrary, pageNo, pageSize, req);
return Result.OK(pageList);
}
@Autowired
private ILawsProblemLibraryService lawsProblemLibraryService;
@AutoLog(value = "问答库-提出问题")
@ApiOperation(value="问答库-提出问题", notes="问答库-提出问题")
@PostMapping(value = "/addProblem")
@RequiresPermissions("businessSupport:questionAnswer:quiz")
public Result<T> addProblem(@Validated @RequestBody LawsProblemLibrary lawsProblemLibrary) {
lawsProblemLibraryService.addProblem(lawsProblemLibrary);
return Result.OK(ResultCommon.OK);
}
@AutoLog(value = "问答库-分页列表查询")
@ApiOperation(value = "问答库-分页列表查询", notes = "问答库-问题-分页列表查询")
@GetMapping(value = "/page")
@RequiresPermissions("businessSupport:questionAnswer:search")
public Result<IPage<LawsProblemLibrary>> queryPageList(LawsProblemLibrary lawsProblemLibrary,
@RequestParam(name = "pageNo", defaultValue = "1") Integer pageNo,
@RequestParam(name = "pageSize", defaultValue = "10") Integer pageSize,
HttpServletRequest req) {
IPage<LawsProblemLibrary> pageList = lawsProblemLibraryService.queryPage(lawsProblemLibrary, pageNo, pageSize, req);
return Result.OK(pageList);
}
@AutoLog(value = "国内标准-提出问题")
@ApiOperation(value="国内标准-提出问题", notes="国内标准-提出问题")
@PostMapping(value = "/addProblem/GB")
@RequiresPermissions("domesticStandard:submitQuestion")
public Result<T> addProblemGB(@Validated @RequestBody LawsProblemLibrary lawsProblemLibrary) {
lawsProblemLibrary.setType("1");
lawsProblemLibraryService.addProblem(lawsProblemLibrary);
return Result.OK(ResultCommon.OK);
}
@AutoLog(value = "问答库-提出问题")
@ApiOperation(value = "问答库-提出问题", notes = "问答库-提出问题")
@PostMapping(value = "/addProblem")
@RequiresPermissions("businessSupport:questionAnswer:quiz")
public Result<T> addProblem(@Validated @RequestBody LawsProblemLibrary lawsProblemLibrary) {
lawsProblemLibraryService.addProblem(lawsProblemLibrary);
return Result.OK(ResultCommon.OK);
}
@AutoLog(value = "海外标准-提出问题")
@ApiOperation(value="海外标准-提出问题", notes="海外标准-提出问题")
@PostMapping(value = "/addProblem/FB")
@RequiresPermissions("overseasStandard:submitQuestion")
public Result<T> addProblemFB(@Validated @RequestBody LawsProblemLibrary lawsProblemLibrary) {
lawsProblemLibrary.setType("2");
lawsProblemLibraryService.addProblem(lawsProblemLibrary);
return Result.OK(ResultCommon.OK);
}
@AutoLog(value = "国内标准-提出问题")
@ApiOperation(value = "国内标准-提出问题", notes = "国内标准-提出问题")
@PostMapping(value = "/addProblem/GB")
@RequiresPermissions("domesticStandard:submitQuestion")
public Result<T> addProblemGB(@Validated @RequestBody LawsProblemLibrary lawsProblemLibrary) {
lawsProblemLibrary.setType("1");
lawsProblemLibraryService.addProblem(lawsProblemLibrary);
return Result.OK(ResultCommon.OK);
}
@AutoLog(value = "企业标准-提出问题")
@ApiOperation(value="企业标准-提出问题", notes="企业标准-提出问题")
@PostMapping(value = "/addProblem/QB")
@RequiresPermissions("enterpriseStandard:detail:submitQuestion")
public Result<T> addProblemQB(@Validated @RequestBody LawsProblemLibrary lawsProblemLibrary) {
lawsProblemLibrary.setType("3");
lawsProblemLibraryService.addProblem(lawsProblemLibrary);
return Result.OK(ResultCommon.OK);
}
@AutoLog(value = "海外标准-提出问题")
@ApiOperation(value = "海外标准-提出问题", notes = "海外标准-提出问题")
@PostMapping(value = "/addProblem/FB")
@RequiresPermissions("overseasStandard:submitQuestion")
public Result<T> addProblemFB(@Validated @RequestBody LawsProblemLibrary lawsProblemLibrary) {
lawsProblemLibrary.setType("2");
lawsProblemLibraryService.addProblem(lawsProblemLibrary);
return Result.OK(ResultCommon.OK);
}
@AutoLog(value = "问答库-回答问题")
@ApiOperation(value="问答库-回答问题", notes="问答库-回答问题")
@PostMapping(value = "/addAnswer")
@RequiresPermissions("quiz:detail:answerSubmit")
public Result<T> addAnswer(@Validated @RequestBody LawsAnswerLibrary lawsAnswerLibrary) {
lawsProblemLibraryService.addAnswer(lawsAnswerLibrary);
return Result.OK(ResultCommon.OK);
}
@AutoLog(value = "企业标准-提出问题")
@ApiOperation(value = "企业标准-提出问题", notes = "企业标准-提出问题")
@PostMapping(value = "/addProblem/QB")
@RequiresPermissions("enterpriseStandard:detail:submitQuestion")
public Result<T> addProblemQB(@Validated @RequestBody LawsProblemLibrary lawsProblemLibrary) {
lawsProblemLibrary.setType("3");
lawsProblemLibraryService.addProblem(lawsProblemLibrary);
return Result.OK(ResultCommon.OK);
}
@AutoLog(value = "问答库-通过id查询")
@ApiOperation(value="问答库-通过id查询", notes="问答库-通过id查询")
@GetMapping(value = "/queryById")
@Translation
@RequiresPermissions("businessSupport:questionAnswer:detail")
public Result<LawsProblemLibrary> queryById(@RequestParam(name="id") String id) {
LawsProblemLibrary lawsProblemLibrary = lawsProblemLibraryService.queryById(id);
return Result.OK(lawsProblemLibrary);
}
@AutoLog(value = "问答库-回答问题")
@ApiOperation(value = "问答库-回答问题", notes = "问答库-回答问题")
@PostMapping(value = "/addAnswer")
@RequiresPermissions("quiz:detail:answerSubmit")
public Result<T> addAnswer(@Validated @RequestBody LawsAnswerLibrary lawsAnswerLibrary) {
lawsProblemLibraryService.addAnswer(lawsAnswerLibrary);
return Result.OK(ResultCommon.OK);
}
@AutoLog(value = "问答库-通过id删除问题")
@ApiOperation(value="问答库-通过id删除问题", notes="问答库-通过id删除问题")
@PostMapping(value = "/deleteProblem")
@RequiresPermissions("businessSupport:questionAnswer:delete")
public Result<T> deleteProblem(@RequestBody Map<String, String> map) {
if(!map.containsKey("id") || StringUtils.isEmpty(map.get("id"))){
return Result.error(MessageUtils.getMessage(ResultCommon.SELECT_DATA));
}
lawsProblemLibraryService.deleteProblem(map.get("id"));
return Result.OK(ResultCommon.OK);
}
@AutoLog(value = "问答库-通过id查询")
@ApiOperation(value = "问答库-通过id查询", notes = "问答库-通过id查询")
@GetMapping(value = "/queryById")
@Translation
@RequiresPermissions("businessSupport:questionAnswer:detail")
public Result<LawsProblemLibrary> queryById(@RequestParam(name = "id") String id) {
LawsProblemLibrary lawsProblemLibrary = lawsProblemLibraryService.queryById(id);
return Result.OK(lawsProblemLibrary);
}
@AutoLog(value = "问答库-通过id删除回答")
@ApiOperation(value="问答库-通过id删除回答", notes="问答库-通过id删除回答")
@PostMapping(value = "/deleteAnswer")
@RequiresPermissions("quiz:detail:deleteAnswer")
public Result<T> deleteAnswer(@RequestBody Map<String, String> map) {
if(!map.containsKey("id") || StringUtils.isEmpty(map.get("id"))){
return Result.error(MessageUtils.getMessage(ResultCommon.SELECT_DATA));
}
lawsProblemLibraryService.deleteAnswer(map.get("id"));
return Result.OK(ResultCommon.OK);
}
@AutoLog(value = "问答库-通过id删除问题")
@ApiOperation(value = "问答库-通过id删除问题", notes = "问答库-通过id删除问题")
@PostMapping(value = "/deleteProblem")
@RequiresPermissions("businessSupport:questionAnswer:delete")
public Result<T> deleteProblem(@RequestBody Map<String, String> map) {
if (!map.containsKey("id") || StringUtils.isEmpty(map.get("id"))) {
return Result.error(MessageUtils.getMessage(ResultCommon.SELECT_DATA));
}
lawsProblemLibraryService.deleteProblem(map.get("id"));
return Result.OK(ResultCommon.OK);
}
@AutoLog(value = "问答库-是否置顶")
@ApiOperation(value="问答库-是否置顶", notes="问答库-是否置顶")
@GetMapping(value = "/isTop")
@RequiresPermissions("quiz:detail:topOrCancel")
public Result<T> isTop(@RequestParam(name="id") String id) {
lawsProblemLibraryService.isTop(id);
return Result.OK(ResultCommon.OK);
}
@AutoLog(value = "问答库-通过id删除回答")
@ApiOperation(value = "问答库-通过id删除回答", notes = "问答库-通过id删除回答")
@PostMapping(value = "/deleteAnswer")
@RequiresPermissions("quiz:detail:deleteAnswer")
public Result<T> deleteAnswer(@RequestBody Map<String, String> map) {
if (!map.containsKey("id") || StringUtils.isEmpty(map.get("id"))) {
return Result.error(MessageUtils.getMessage(ResultCommon.SELECT_DATA));
}
lawsProblemLibraryService.deleteAnswer(map.get("id"));
return Result.OK(ResultCommon.OK);
}
@AutoLog(value = "问答库-是否置顶")
@ApiOperation(value = "问答库-是否置顶", notes = "问答库-是否置顶")
@GetMapping(value = "/isTop")
@RequiresPermissions("quiz:detail:topOrCancel")
public Result<T> isTop(@RequestParam(name = "id") String id) {
lawsProblemLibraryService.isTop(id);
return Result.OK(ResultCommon.OK);
}
}
laws-modules/src/main/java/com/jero/modules/laws/library/service/impl/LawsProblemLibraryServiceImpl.java
+52 -3
View File
@@ -1,5 +1,6 @@
package com.jero.modules.laws.library.service.impl;
import cn.hutool.core.util.StrUtil;
import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
import com.baomidou.mybatisplus.core.conditions.update.LambdaUpdateWrapper;
@@ -16,6 +17,7 @@ import com.jero.modules.laws.library.entity.LawsProblemLibrary;
import com.jero.modules.laws.library.mapper.LawsProblemLibraryMapper;
import com.jero.modules.laws.library.service.ILawsAnswerLibraryService;
import com.jero.modules.laws.library.service.ILawsProblemLibraryService;
import com.jero.modules.sys.utils.UserUtils;
import com.jero.modules.system.entity.SysDepart;
import com.jero.modules.system.entity.SysDictItem;
import com.jero.modules.system.entity.SysUser;
@@ -25,6 +27,7 @@ import org.apache.commons.collections4.CollectionUtils;
import org.apache.commons.lang3.StringUtils;
import org.apache.shiro.SecurityUtils;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.stereotype.Service;
import org.springframework.transaction.annotation.Transactional;
import com.jero.common.exception.JeroBootException;
@@ -36,7 +39,9 @@ import com.baomidou.mybatisplus.extension.service.impl.ServiceImpl;
import com.jero.common.system.query.QueryGenerator;
import javax.annotation.Resource;
import javax.management.relation.Role;
import javax.servlet.http.HttpServletRequest;
import com.baomidou.mybatisplus.core.metadata.IPage;
import com.baomidou.mybatisplus.extension.plugins.pagination.Page;
@@ -44,7 +49,7 @@ import com.baomidou.mybatisplus.extension.plugins.pagination.Page;
/**
* @Description: 问答库-问题
* @Author: jero-boot
* @Date: 2023-09-28
* @Date: 2023-09-28
* @Version: V1.0
*/
@Service
@@ -62,6 +67,12 @@ public class LawsProblemLibraryServiceImpl extends ServiceImpl<LawsProblemLibrar
@Resource
private SendMessageAPI sendMessageAPI;
@Resource
private ISysUserService userService;
@Value("${adminRoleCode}")
private String adminRoleCode;
@Override
public IPage<LawsProblemLibrary> queryPage(LawsProblemLibrary lawsProblemLibrary, Integer pageNo, Integer pageSize,
HttpServletRequest req) {
@@ -115,6 +126,12 @@ public class LawsProblemLibraryServiceImpl extends ServiceImpl<LawsProblemLibrar
throw new JeroBootException(ResultCommon.EMPTY_COMMON, "problemId");
}
// 处理水平越权 自己提的问题自己不能回复
LawsProblemLibrary problem = getById(lawsAnswerLibrary.getProblemId());
if (loginUser.getUsername().equals(problem.getCreateBy())) {
throw new JeroBootException(ResultCommon.NO_PERMISSION);
}
lawsAnswerLibrary.setUserId(loginUser.getId());
lawsAnswerLibrary.setOrgCode(loginUser.getOrgCode());
lawsAnswerLibrary.setIsTop(0);
@@ -137,7 +154,7 @@ public class LawsProblemLibraryServiceImpl extends ServiceImpl<LawsProblemLibrar
@Override
public LawsProblemLibrary queryById(String id) {
LawsProblemLibrary lawsProblemLibrary = getById(id);
if(Objects.isNull(lawsProblemLibrary)) {
if (Objects.isNull(lawsProblemLibrary)) {
throw new JeroBootException(ResultCommon.NO_CORRESPONDING_DATA_FOUND);
}
@@ -183,6 +200,12 @@ public class LawsProblemLibraryServiceImpl extends ServiceImpl<LawsProblemLibrar
**/
@Override
public void deleteProblem(String id) {
// 处理水平越权 只有创建人可以删除问题
LoginUser currentUser = UserUtils.getCurrentUser();
LawsProblemLibrary problem = getById(id);
if (!currentUser.getUsername().equals(problem.getCreateBy())) {
throw new JeroBootException(ResultCommon.NO_PERMISSION);
}
removeById(id);
}
@@ -193,6 +216,19 @@ public class LawsProblemLibraryServiceImpl extends ServiceImpl<LawsProblemLibrar
**/
@Override
public void deleteAnswer(String id) {
// 处理水平越权 管理员和创建者才可以删除所有评论 其他人只能删除自己的评论
LoginUser currentUser = UserUtils.getCurrentUser();
List<String> userRoleList = userService.getRole(currentUser.getUsername());
LawsAnswerLibrary answer = lawsAnswerLibraryService.getById(id);
LawsProblemLibrary problem = getById(answer.getProblemId());
// 如果是管理员权限 则跳过验证
List<String> adminRoleList = Arrays.asList(adminRoleCode.split(","));
// 如果不是管理员权限 且不是问题创建者 且不是回答创建者 则没有权限
if (adminRoleList.stream().noneMatch(userRoleList::contains)) {
if (!currentUser.getUsername().equals(problem.getCreateBy())) {
throw new JeroBootException(ResultCommon.NO_PERMISSION);
}
}
lawsAnswerLibraryService.removeById(id);
}
@@ -204,9 +240,22 @@ public class LawsProblemLibraryServiceImpl extends ServiceImpl<LawsProblemLibrar
@Override
public void isTop(String id) {
LawsAnswerLibrary lawsAnswerLibrary = lawsAnswerLibraryService.getById(id);
if(Objects.isNull(lawsAnswerLibrary)) {
if (Objects.isNull(lawsAnswerLibrary)) {
throw new JeroBootException(ResultCommon.NO_CORRESPONDING_DATA_FOUND);
}
// 处理水平越权 管理员和创建者才可以删除所有评论 其他人只能删除自己的评论
LoginUser currentUser = UserUtils.getCurrentUser();
List<String> userRoleList = userService.getRole(currentUser.getUsername());
// 如果是管理员权限 则跳过验证
List<String> adminRoleList = Arrays.asList(adminRoleCode.split(","));
// 如果不是管理员权限 且不是问题创建者 且不是回答创建者 则没有权限
if (adminRoleList.stream().noneMatch(userRoleList::contains)) {
LawsProblemLibrary problem = getById(lawsAnswerLibrary.getProblemId());
if (!currentUser.getUsername().equals(problem.getCreateBy())) {
throw new JeroBootException(ResultCommon.NO_PERMISSION);
}
}
if (0 == lawsAnswerLibrary.getIsTop()) {
lawsAnswerLibrary.setIsTop(1);
// 发送消息