fix: 80955 【水平越权】问答库-部分接口未处理水平越权

laws-modules/src/main/java/com/jero/modules/laws/library/controller/LawsProblemLibraryController.java

@@ -24,120 +24,121 @@ import org.apache.commons.lang3.StringUtils;
 import org.apache.poi.ss.formula.functions.T;
 
 
- /**
+/**
  * @Description: 问答库-问题
  * @Author: jero-boot
- * @Date:   2023-09-28
+ * @Date: 2023-09-28
  * @Version: V1.0
  */
-@Api(tags="问答库")
+@Api(tags = "问答库")
 @RestController
 @RequestMapping("/laws/library/lawsProblemLibrary")
 @Slf4j
 public class LawsProblemLibraryController extends JeroController<LawsProblemLibrary, ILawsProblemLibraryService> {
-	@Autowired
-	private ILawsProblemLibraryService lawsProblemLibraryService;
 
-	 @AutoLog(value = "问答库-分页列表查询")
+    @Autowired
-	 @ApiOperation(value="问答库-分页列表查询", notes="问答库-问题-分页列表查询")
+    private ILawsProblemLibraryService lawsProblemLibraryService;
-	 @GetMapping(value = "/page")
-	 @RequiresPermissions("businessSupport:questionAnswer:search")
-	 public Result<IPage<LawsProblemLibrary>> queryPageList(LawsProblemLibrary lawsProblemLibrary,
-															@RequestParam(name="pageNo", defaultValue="1") Integer pageNo,
-															@RequestParam(name="pageSize", defaultValue="10") Integer pageSize,
-															HttpServletRequest req) {
-		 IPage<LawsProblemLibrary> pageList = lawsProblemLibraryService.queryPage(lawsProblemLibrary, pageNo, pageSize, req);
-		 return Result.OK(pageList);
-	 }
 
-	 @AutoLog(value = "问答库-提出问题")
+    @AutoLog(value = "问答库-分页列表查询")
-	 @ApiOperation(value="问答库-提出问题", notes="问答库-提出问题")
+    @ApiOperation(value = "问答库-分页列表查询", notes = "问答库-问题-分页列表查询")
-	 @PostMapping(value = "/addProblem")
+    @GetMapping(value = "/page")
-	 @RequiresPermissions("businessSupport:questionAnswer:quiz")
+    @RequiresPermissions("businessSupport:questionAnswer:search")
-	 public Result<T> addProblem(@Validated @RequestBody LawsProblemLibrary lawsProblemLibrary) {
+    public Result<IPage<LawsProblemLibrary>> queryPageList(LawsProblemLibrary lawsProblemLibrary,
-		 lawsProblemLibraryService.addProblem(lawsProblemLibrary);
+                                                           @RequestParam(name = "pageNo", defaultValue = "1") Integer pageNo,
-		 return Result.OK(ResultCommon.OK);
+                                                           @RequestParam(name = "pageSize", defaultValue = "10") Integer pageSize,
-	 }
+                                                           HttpServletRequest req) {
+        IPage<LawsProblemLibrary> pageList = lawsProblemLibraryService.queryPage(lawsProblemLibrary, pageNo, pageSize, req);
+        return Result.OK(pageList);
+    }
 
-	 @AutoLog(value = "国内标准-提出问题")
+    @AutoLog(value = "问答库-提出问题")
-	 @ApiOperation(value="国内标准-提出问题", notes="国内标准-提出问题")
+    @ApiOperation(value = "问答库-提出问题", notes = "问答库-提出问题")
-	 @PostMapping(value = "/addProblem/GB")
+    @PostMapping(value = "/addProblem")
-	 @RequiresPermissions("domesticStandard:submitQuestion")
+    @RequiresPermissions("businessSupport:questionAnswer:quiz")
-	 public Result<T> addProblemGB(@Validated @RequestBody LawsProblemLibrary lawsProblemLibrary) {
+    public Result<T> addProblem(@Validated @RequestBody LawsProblemLibrary lawsProblemLibrary) {
-		 lawsProblemLibrary.setType("1");
+        lawsProblemLibraryService.addProblem(lawsProblemLibrary);
-		 lawsProblemLibraryService.addProblem(lawsProblemLibrary);
+        return Result.OK(ResultCommon.OK);
-		 return Result.OK(ResultCommon.OK);
+    }
-	 }
 
-	 @AutoLog(value = "海外标准-提出问题")
+    @AutoLog(value = "国内标准-提出问题")
-	 @ApiOperation(value="海外标准-提出问题", notes="海外标准-提出问题")
+    @ApiOperation(value = "国内标准-提出问题", notes = "国内标准-提出问题")
-	 @PostMapping(value = "/addProblem/FB")
+    @PostMapping(value = "/addProblem/GB")
-	 @RequiresPermissions("overseasStandard:submitQuestion")
+    @RequiresPermissions("domesticStandard:submitQuestion")
-	 public Result<T> addProblemFB(@Validated @RequestBody LawsProblemLibrary lawsProblemLibrary) {
+    public Result<T> addProblemGB(@Validated @RequestBody LawsProblemLibrary lawsProblemLibrary) {
-		 lawsProblemLibrary.setType("2");
+        lawsProblemLibrary.setType("1");
-		 lawsProblemLibraryService.addProblem(lawsProblemLibrary);
+        lawsProblemLibraryService.addProblem(lawsProblemLibrary);
-		 return Result.OK(ResultCommon.OK);
+        return Result.OK(ResultCommon.OK);
-	 }
+    }
 
-	 @AutoLog(value = "企业标准-提出问题")
+    @AutoLog(value = "海外标准-提出问题")
-	 @ApiOperation(value="企业标准-提出问题", notes="企业标准-提出问题")
+    @ApiOperation(value = "海外标准-提出问题", notes = "海外标准-提出问题")
-	 @PostMapping(value = "/addProblem/QB")
+    @PostMapping(value = "/addProblem/FB")
-	 @RequiresPermissions("enterpriseStandard:detail:submitQuestion")
+    @RequiresPermissions("overseasStandard:submitQuestion")
-	 public Result<T> addProblemQB(@Validated @RequestBody LawsProblemLibrary lawsProblemLibrary) {
+    public Result<T> addProblemFB(@Validated @RequestBody LawsProblemLibrary lawsProblemLibrary) {
-		 lawsProblemLibrary.setType("3");
+        lawsProblemLibrary.setType("2");
-		 lawsProblemLibraryService.addProblem(lawsProblemLibrary);
+        lawsProblemLibraryService.addProblem(lawsProblemLibrary);
-		 return Result.OK(ResultCommon.OK);
+        return Result.OK(ResultCommon.OK);
-	 }
+    }
 
-	 @AutoLog(value = "问答库-回答问题")
+    @AutoLog(value = "企业标准-提出问题")
-	 @ApiOperation(value="问答库-回答问题", notes="问答库-回答问题")
+    @ApiOperation(value = "企业标准-提出问题", notes = "企业标准-提出问题")
-	 @PostMapping(value = "/addAnswer")
+    @PostMapping(value = "/addProblem/QB")
-	 @RequiresPermissions("quiz:detail:answerSubmit")
+    @RequiresPermissions("enterpriseStandard:detail:submitQuestion")
-	 public Result<T> addAnswer(@Validated @RequestBody LawsAnswerLibrary lawsAnswerLibrary) {
+    public Result<T> addProblemQB(@Validated @RequestBody LawsProblemLibrary lawsProblemLibrary) {
-		 lawsProblemLibraryService.addAnswer(lawsAnswerLibrary);
+        lawsProblemLibrary.setType("3");
-		 return Result.OK(ResultCommon.OK);
+        lawsProblemLibraryService.addProblem(lawsProblemLibrary);
-	 }
+        return Result.OK(ResultCommon.OK);
+    }
 
-	 @AutoLog(value = "问答库-通过id查询")
+    @AutoLog(value = "问答库-回答问题")
-	 @ApiOperation(value="问答库-通过id查询", notes="问答库-通过id查询")
+    @ApiOperation(value = "问答库-回答问题", notes = "问答库-回答问题")
-	 @GetMapping(value = "/queryById")
+    @PostMapping(value = "/addAnswer")
-	 @Translation
+    @RequiresPermissions("quiz:detail:answerSubmit")
-	 @RequiresPermissions("businessSupport:questionAnswer:detail")
+    public Result<T> addAnswer(@Validated @RequestBody LawsAnswerLibrary lawsAnswerLibrary) {
-	 public Result<LawsProblemLibrary> queryById(@RequestParam(name="id") String id) {
+        lawsProblemLibraryService.addAnswer(lawsAnswerLibrary);
-		 LawsProblemLibrary lawsProblemLibrary = lawsProblemLibraryService.queryById(id);
+        return Result.OK(ResultCommon.OK);
-		 return Result.OK(lawsProblemLibrary);
+    }
-	 }
 
-	 @AutoLog(value = "问答库-通过id删除问题")
+    @AutoLog(value = "问答库-通过id查询")
-	 @ApiOperation(value="问答库-通过id删除问题", notes="问答库-通过id删除问题")
+    @ApiOperation(value = "问答库-通过id查询", notes = "问答库-通过id查询")
-	 @PostMapping(value = "/deleteProblem")
+    @GetMapping(value = "/queryById")
-	 @RequiresPermissions("businessSupport:questionAnswer:delete")
+    @Translation
-	 public Result<T> deleteProblem(@RequestBody Map<String, String> map) {
+    @RequiresPermissions("businessSupport:questionAnswer:detail")
-		 if(!map.containsKey("id") || StringUtils.isEmpty(map.get("id"))){
+    public Result<LawsProblemLibrary> queryById(@RequestParam(name = "id") String id) {
-			 return Result.error(MessageUtils.getMessage(ResultCommon.SELECT_DATA));
+        LawsProblemLibrary lawsProblemLibrary = lawsProblemLibraryService.queryById(id);
-		 }
+        return Result.OK(lawsProblemLibrary);
-		 lawsProblemLibraryService.deleteProblem(map.get("id"));
+    }
-		 return Result.OK(ResultCommon.OK);
-	 }
 
-	 @AutoLog(value = "问答库-通过id删除回答")
+    @AutoLog(value = "问答库-通过id删除问题")
-	 @ApiOperation(value="问答库-通过id删除回答", notes="问答库-通过id删除回答")
+    @ApiOperation(value = "问答库-通过id删除问题", notes = "问答库-通过id删除问题")
-	 @PostMapping(value = "/deleteAnswer")
+    @PostMapping(value = "/deleteProblem")
-	 @RequiresPermissions("quiz:detail:deleteAnswer")
+    @RequiresPermissions("businessSupport:questionAnswer:delete")
-	 public Result<T> deleteAnswer(@RequestBody Map<String, String> map) {
+    public Result<T> deleteProblem(@RequestBody Map<String, String> map) {
-		 if(!map.containsKey("id") || StringUtils.isEmpty(map.get("id"))){
+        if (!map.containsKey("id") || StringUtils.isEmpty(map.get("id"))) {
-			 return Result.error(MessageUtils.getMessage(ResultCommon.SELECT_DATA));
+            return Result.error(MessageUtils.getMessage(ResultCommon.SELECT_DATA));
-		 }
+        }
-		 lawsProblemLibraryService.deleteAnswer(map.get("id"));
+        lawsProblemLibraryService.deleteProblem(map.get("id"));
-		 return Result.OK(ResultCommon.OK);
+        return Result.OK(ResultCommon.OK);
-	 }
+    }
 
-	 @AutoLog(value = "问答库-是否置顶")
+    @AutoLog(value = "问答库-通过id删除回答")
-	 @ApiOperation(value="问答库-是否置顶", notes="问答库-是否置顶")
+    @ApiOperation(value = "问答库-通过id删除回答", notes = "问答库-通过id删除回答")
-	 @GetMapping(value = "/isTop")
+    @PostMapping(value = "/deleteAnswer")
-	 @RequiresPermissions("quiz:detail:topOrCancel")
+    @RequiresPermissions("quiz:detail:deleteAnswer")
-	 public Result<T> isTop(@RequestParam(name="id") String id) {
+    public Result<T> deleteAnswer(@RequestBody Map<String, String> map) {
-		 lawsProblemLibraryService.isTop(id);
+        if (!map.containsKey("id") || StringUtils.isEmpty(map.get("id"))) {
-		 return Result.OK(ResultCommon.OK);
+            return Result.error(MessageUtils.getMessage(ResultCommon.SELECT_DATA));
-	 }
+        }
+        lawsProblemLibraryService.deleteAnswer(map.get("id"));
+        return Result.OK(ResultCommon.OK);
+    }
+
+    @AutoLog(value = "问答库-是否置顶")
+    @ApiOperation(value = "问答库-是否置顶", notes = "问答库-是否置顶")
+    @GetMapping(value = "/isTop")
+    @RequiresPermissions("quiz:detail:topOrCancel")
+    public Result<T> isTop(@RequestParam(name = "id") String id) {
+        lawsProblemLibraryService.isTop(id);
+        return Result.OK(ResultCommon.OK);
+    }
 }

laws-modules/src/main/java/com/jero/modules/laws/library/service/impl/LawsProblemLibraryServiceImpl.java

@@ -1,5 +1,6 @@
 package com.jero.modules.laws.library.service.impl;
 
+import cn.hutool.core.util.StrUtil;
 import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
 import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
 import com.baomidou.mybatisplus.core.conditions.update.LambdaUpdateWrapper;
@@ -16,6 +17,7 @@ import com.jero.modules.laws.library.entity.LawsProblemLibrary;
 import com.jero.modules.laws.library.mapper.LawsProblemLibraryMapper;
 import com.jero.modules.laws.library.service.ILawsAnswerLibraryService;
 import com.jero.modules.laws.library.service.ILawsProblemLibraryService;
+import com.jero.modules.sys.utils.UserUtils;
 import com.jero.modules.system.entity.SysDepart;
 import com.jero.modules.system.entity.SysDictItem;
 import com.jero.modules.system.entity.SysUser;
@@ -25,6 +27,7 @@ import org.apache.commons.collections4.CollectionUtils;
 import org.apache.commons.lang3.StringUtils;
 import org.apache.shiro.SecurityUtils;
 import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.beans.factory.annotation.Value;
 import org.springframework.stereotype.Service;
 import org.springframework.transaction.annotation.Transactional;
 import com.jero.common.exception.JeroBootException;
@@ -36,7 +39,9 @@ import com.baomidou.mybatisplus.extension.service.impl.ServiceImpl;
 import com.jero.common.system.query.QueryGenerator;
 
 import javax.annotation.Resource;
+import javax.management.relation.Role;
 import javax.servlet.http.HttpServletRequest;
+
 import com.baomidou.mybatisplus.core.metadata.IPage;
 import com.baomidou.mybatisplus.extension.plugins.pagination.Page;
 
@@ -44,7 +49,7 @@ import com.baomidou.mybatisplus.extension.plugins.pagination.Page;
 /**
  * @Description: 问答库-问题
  * @Author: jero-boot
- * @Date:   2023-09-28
+ * @Date: 2023-09-28
  * @Version: V1.0
  */
 @Service
@@ -62,6 +67,12 @@ public class LawsProblemLibraryServiceImpl extends ServiceImpl<LawsProblemLibrar
     @Resource
     private SendMessageAPI sendMessageAPI;
 
+    @Resource
+    private ISysUserService userService;
+
+    @Value("${adminRoleCode}")
+    private String adminRoleCode;
+
     @Override
     public IPage<LawsProblemLibrary> queryPage(LawsProblemLibrary lawsProblemLibrary, Integer pageNo, Integer pageSize,
                                                HttpServletRequest req) {
@@ -115,6 +126,12 @@ public class LawsProblemLibraryServiceImpl extends ServiceImpl<LawsProblemLibrar
             throw new JeroBootException(ResultCommon.EMPTY_COMMON, "problemId");
         }
 
+        // 处理水平越权 自己提的问题自己不能回复
+        LawsProblemLibrary problem = getById(lawsAnswerLibrary.getProblemId());
+        if (loginUser.getUsername().equals(problem.getCreateBy())) {
+            throw new JeroBootException(ResultCommon.NO_PERMISSION);
+        }
+
         lawsAnswerLibrary.setUserId(loginUser.getId());
         lawsAnswerLibrary.setOrgCode(loginUser.getOrgCode());
         lawsAnswerLibrary.setIsTop(0);
@@ -137,7 +154,7 @@ public class LawsProblemLibraryServiceImpl extends ServiceImpl<LawsProblemLibrar
     @Override
     public LawsProblemLibrary queryById(String id) {
         LawsProblemLibrary lawsProblemLibrary = getById(id);
-        if(Objects.isNull(lawsProblemLibrary)) {
+        if (Objects.isNull(lawsProblemLibrary)) {
             throw new JeroBootException(ResultCommon.NO_CORRESPONDING_DATA_FOUND);
         }
 
@@ -183,6 +200,12 @@ public class LawsProblemLibraryServiceImpl extends ServiceImpl<LawsProblemLibrar
      **/
     @Override
     public void deleteProblem(String id) {
+        // 处理水平越权 只有创建人可以删除问题
+        LoginUser currentUser = UserUtils.getCurrentUser();
+        LawsProblemLibrary problem = getById(id);
+        if (!currentUser.getUsername().equals(problem.getCreateBy())) {
+            throw new JeroBootException(ResultCommon.NO_PERMISSION);
+        }
         removeById(id);
     }
 
@@ -193,6 +216,19 @@ public class LawsProblemLibraryServiceImpl extends ServiceImpl<LawsProblemLibrar
      **/
     @Override
     public void deleteAnswer(String id) {
+        // 处理水平越权 管理员和创建者才可以删除所有评论 其他人只能删除自己的评论
+        LoginUser currentUser = UserUtils.getCurrentUser();
+        List<String> userRoleList = userService.getRole(currentUser.getUsername());
+        LawsAnswerLibrary answer = lawsAnswerLibraryService.getById(id);
+        LawsProblemLibrary problem = getById(answer.getProblemId());
+        // 如果是管理员权限 则跳过验证
+        List<String> adminRoleList = Arrays.asList(adminRoleCode.split(","));
+        // 如果不是管理员权限 且不是问题创建者 且不是回答创建者 则没有权限
+        if (adminRoleList.stream().noneMatch(userRoleList::contains)) {
+            if (!currentUser.getUsername().equals(problem.getCreateBy())) {
+                throw new JeroBootException(ResultCommon.NO_PERMISSION);
+            }
+        }
         lawsAnswerLibraryService.removeById(id);
     }
 
@@ -204,9 +240,22 @@ public class LawsProblemLibraryServiceImpl extends ServiceImpl<LawsProblemLibrar
     @Override
     public void isTop(String id) {
         LawsAnswerLibrary lawsAnswerLibrary = lawsAnswerLibraryService.getById(id);
-        if(Objects.isNull(lawsAnswerLibrary)) {
+        if (Objects.isNull(lawsAnswerLibrary)) {
             throw new JeroBootException(ResultCommon.NO_CORRESPONDING_DATA_FOUND);
         }
+        // 处理水平越权 管理员和创建者才可以删除所有评论 其他人只能删除自己的评论
+        LoginUser currentUser = UserUtils.getCurrentUser();
+        List<String> userRoleList = userService.getRole(currentUser.getUsername());
+        // 如果是管理员权限 则跳过验证
+        List<String> adminRoleList = Arrays.asList(adminRoleCode.split(","));
+        // 如果不是管理员权限 且不是问题创建者 且不是回答创建者 则没有权限
+        if (adminRoleList.stream().noneMatch(userRoleList::contains)) {
+            LawsProblemLibrary problem = getById(lawsAnswerLibrary.getProblemId());
+            if (!currentUser.getUsername().equals(problem.getCreateBy())) {
+                throw new JeroBootException(ResultCommon.NO_PERMISSION);
+            }
+        }
+
         if (0 == lawsAnswerLibrary.getIsTop()) {
             lawsAnswerLibrary.setIsTop(1);
             // 发送消息