ZQ/laws-sinotruk-server
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: 79534 【水平越权】企业标准 部分接口没有处理水平越权

Browse Source
This commit is contained in:
mzaxd
2024-01-30 17:56:44 +08:00
parent ade8374fd5
commit 8aab58761f
3 changed files with 119 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
laws-modules/src/main/java/com/jero/modules/laws/enterprise/service/EnterpriseStandardAuthUserService.java
+38 -5
View File
@@ -10,34 +10,38 @@ import java.util.List;
import java.util.Map;
/**
* @author ThinkBook
* @description 针对表【laws_enterprise_standard_temp_permission(企业标准)】的数据库操作Service
* @createDate 2023-09-07 11:20:30
*/
* @author ThinkBook
* @description 针对表【laws_enterprise_standard_temp_permission(企业标准)】的数据库操作Service
* @createDate 2023-09-07 11:20:30
*/
public interface EnterpriseStandardAuthUserService extends IService<EnterpriseStandardAuthUser> {
void saveTempPermission(LawsStandardTempPermission lawsStandardTempPermission);
/**
* 不校验当前登陆人账号是否有权限
*
* @param lawsStandardTempPermission
*/
void saveTempPermissionTwo(LawsStandardTempPermission lawsStandardTempPermission);
/**
* 查看详情权限设置
*
* @param records
*/
void detailFlagSet(List<Map<String, Object>> records);
/**
* 编辑权限设置
*
* @param records
*/
void editFlagSet(List<Map<String, Object>> records);
/**
* 删除权限设置
*
* @param records
*/
void delFlagSet(List<Map<String, Object>> records);
@@ -48,13 +52,15 @@ public interface EnterpriseStandardAuthUserService extends IService<EnterpriseSt
/**
* 企标编辑保存后 重置授权部门
*
* @param id
* @param string
*/
void resetAuthDept(String id,String string);
void resetAuthDept(String id, String string);
/**
* 临时授权记录分页列表接口
*
* @param tempAuthRecordQueryDto
* @param pageNo
* @param pageSize
@@ -64,9 +70,36 @@ public interface EnterpriseStandardAuthUserService extends IService<EnterpriseSt
/**
* 解除授权
*
* @param authId
*/
void revokeAuth(String authId);
boolean hasESAuth(String userId, List<String> standardIds);
/**
* 指定用户Id是否有指定企标的删除权限
* @param standardId 企标Id
* @param userId 用户Id
*/
boolean hasDelAuth(String standardId, String userId);
/**
* 指定用户Id是否有指定企标的删除权限
* @param standardId 企标Id
* @param userId 用户Id
*/
boolean hasEditAuth(String standardId, String userId);
/**
* 编辑水平越权校验
* @param standardId 企标Id
*/
void isEditHorizontalOverstep(String standardId);
/**
* 删除水平越权校验
* @param standardId 企标Id
*/
void isDeleteHorizontalOverstep(String standardId);
}
laws-modules/src/main/java/com/jero/modules/laws/enterprise/service/impl/EnterpriseStandardAuthUserServiceImpl.java
+77 -1
View File
@@ -82,6 +82,9 @@ public class EnterpriseStandardAuthUserServiceImpl extends ServiceImpl<Enterpris
@Value("#{'${adminRoleCode}'.split(',')}")
private List<String> adminRoleCodeList;
@Resource
private ILawsEnterpriseStandardService esService;
@Override
public void saveTempPermission(LawsStandardTempPermission lawsStandardTempPermission) {
@@ -396,7 +399,7 @@ public class EnterpriseStandardAuthUserServiceImpl extends ServiceImpl<Enterpris
SysUser currentUser = sysUserService.getById(userId);
String username = currentUser.getUsername();
// 获取当前用户的角色roleCode
List<String> roleList = sysUserRoleService.getRole(currentUser.getUsername());
List<String> roleList = sysUserRoleService.getRole(username);
if (roleList != null && roleList.stream().anyMatch(adminRoleCodeList::contains)) {
records.forEach(kv -> kv.put(FieldCommon.EDIT_FLAG, true));
return;
@@ -411,6 +414,79 @@ public class EnterpriseStandardAuthUserServiceImpl extends ServiceImpl<Enterpris
}
}
@Override
public boolean hasDelAuth(String standardId, String userId) {
SysUser currentUser = sysUserService.getById(userId);
String username = currentUser.getUsername();
LawsEnterpriseStandard es = enterpriseStandardService.getById(standardId);
Date currentDate = new Date();
// 获取当前用户的角色roleCode
List<String> roleList = sysUserRoleService.getRole(currentUser.getUsername());
// 管理员能够删除所有试用期的企标
if (roleList != null && roleList.stream().anyMatch(adminRoleCodeList::contains)) {
String tryFlag = es.getTryFlag();
if (tryFlag.equals(YesOrNoEnum.NO.getValue())) {
return false;
}
Date releaseDate = es.getReleaseDate();
int trialPeriodMonths = Integer.parseInt(es.getTrialPeriod()); // 将试用周期转换为天数
Calendar calendar = Calendar.getInstance();
calendar.setTime(releaseDate);
calendar.add(Calendar.MONTH, trialPeriodMonths); // 将试用周期加到发布日期上
Date trialEndDate = calendar.getTime(); // 获取试用期结束日期
// 在适用周期之内的可以删除
return tryFlag.equals(YesOrNoEnum.YES.getValue()) && currentDate.compareTo(trialEndDate) <= 0;
}
// 创建人只能删除自己的试用期的企标
String createBy = es.getCreateBy();
String tryFlag = es.getTryFlag();
if (tryFlag.equals(YesOrNoEnum.NO.getValue())) {
return false;
}
Date releaseDate = es.getReleaseDate();
int trialPeriodMonths = Integer.parseInt(es.getTrialPeriod()); // 将试用周期转换为天数
Calendar calendar = Calendar.getInstance();
calendar.setTime(releaseDate);
calendar.add(Calendar.MONTH, trialPeriodMonths); // 将试用周期加到发布日期上
Date trialEndDate = calendar.getTime(); // 获取试用期结束日期
return username.equals(createBy) && tryFlag.equals(YesOrNoEnum.YES.getValue())
&& currentDate.compareTo(trialEndDate) <= 0;
}
@Override
public boolean hasEditAuth(String standardId, String userId) {
SysUser user = sysUserService.getById(userId);
String username = user.getUsername();
// 获取当前用户的角色roleCode
List<String> roleList = sysUserRoleService.getRole(username);
if (roleList != null && roleList.stream().anyMatch(adminRoleCodeList::contains)) {
return true;
}
LawsEnterpriseStandard es = esService.getById(standardId);
String createBy = es.getCreateBy();
return username.equals(createBy);
}
@Override
public void isEditHorizontalOverstep(String standardId) {
if (hasEditAuth(standardId, UserUtils.getUserId())) {
return;
}
throw new JeroBootException(MessageUtils.getMessage(ResultCommon.YOU_HAVE_NOT_DATA_AUTH, standardId));
}
@Override
public void isDeleteHorizontalOverstep(String standardId) {
if (hasDelAuth(standardId, UserUtils.getUserId())) {
return;
}
throw new JeroBootException(MessageUtils.getMessage(ResultCommon.YOU_HAVE_NOT_DATA_AUTH, standardId));
}
@Override
public void delFlagSet(List<Map<String, Object>> records) {
String userId = UserUtils.getUserId();
laws-modules/src/main/java/com/jero/modules/laws/standard/controller/LawsEnterpriseController.java
+4
View File
@@ -123,6 +123,8 @@ public class LawsEnterpriseController {
@ApiOperationSupport(order = 4)
@RequiresPermissions("enterpriseStandard:edit")
public Result<String> commonEdit(@RequestBody @ApiParam("标签管理") Map<String,Object> parameterMap) {
// 水平越权校验
esAuthUserService.isEditHorizontalOverstep((String) parameterMap.get("id"));
parameterMap.put(FieldCommon.MODULE, MODULE_VALUE);
return Result.OK(lawsCommonService.commonEdit(parameterMap));
}
@@ -192,6 +194,8 @@ public class LawsEnterpriseController {
@ApiOperationSupport(order = 9)
@RequiresPermissions("enterpriseStandard:delete")
public Result<String> singleDelete(@RequestBody @ApiParam(name = "ids", value = "主键（多个用逗号分隔）") Map<String,Object> parameterMap) {
// 水平越权校验
esAuthUserService.isDeleteHorizontalOverstep((String) parameterMap.get("id"));
// 删除标准时同步删除这个标准的收藏数据
lawsStandardCollectionService.deleteByStandardId((String) parameterMap.get("ids"));
lawsStandardSharingService.deleteByStandardId((String) parameterMap.get("ids"));