From b94be824b21b13f01ca98d6920c800c3b553c534 Mon Sep 17 00:00:00 2001
From: yjz <3131811435@qq.com>
Date: Tue, 16 Jan 2024 09:49:06 +0800
Subject: [PATCH] =?UTF-8?q?fix(=E6=96=B0=E6=97=A7=E6=8B=86=E5=88=86?=
 =?UTF-8?q?=E5=8D=95):=2079528?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../controller/SarFileCompareInfoController.java    | 13 +++++++++++++
 .../service/impl/SarFileCompareInfoServiceImpl.java |  4 +++-
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/laws-modules/src/main/java/com/jero/modules/compare/controller/SarFileCompareInfoController.java b/laws-modules/src/main/java/com/jero/modules/compare/controller/SarFileCompareInfoController.java
index d7a44dcc..b2475519 100644
--- a/laws-modules/src/main/java/com/jero/modules/compare/controller/SarFileCompareInfoController.java
+++ b/laws-modules/src/main/java/com/jero/modules/compare/controller/SarFileCompareInfoController.java
@@ -11,6 +11,8 @@ import com.jero.common.api.vo.Result;
 import com.jero.common.api.vo.ResultCommon;
 import com.jero.common.aspect.annotation.AutoLog;
 import com.jero.common.constant.CommonConstant;
+import com.jero.common.constant.enums.LanguageEnum;
+import com.jero.common.exception.JeroBootException;
 import com.jero.common.system.base.controller.JeroController;
 import com.jero.common.system.vo.LoginUser;
 import com.jero.common.util.MessageUtils;
@@ -352,6 +354,15 @@ public class SarFileCompareInfoController extends JeroController<SarFileCompareI
     @ApiOperationSupport(order = 9)
     public Result<?> changeState(@Validated @RequestBody SarFileCompareInfo sarFileCompareInfo) {
         SarFileCompareInfo info = sarFileCompareInfoService.queryById(sarFileCompareInfo.getId());
+        // 水平越权
+        LoginUser loginUser = (LoginUser) SecurityUtils.getSubject().getPrincipal();
+        if (!info.getCreateBy().equals(loginUser.getUsername())){
+            if(LanguageEnum.CN.equals(MessageUtils.getLanguage())) {
+                throw new JeroBootException("无权限!");
+            }else{
+                throw new JeroBootException("No access!");
+            }
+        }
         if (ReleaseConditionEnum.DRAFT.getValue().equals(sarFileCompareInfo.getReleaseState())) {
             info.setReleaseState(ReleaseConditionEnum.PUBLISHED.getValue());
         } else {
@@ -382,6 +393,8 @@ public class SarFileCompareInfoController extends JeroController<SarFileCompareI
     @PostMapping(value = "/editComments")
     @ApiOperationSupport(order = 11)
     public Result<?> editComments(@Validated @RequestBody SarFileCompareInfo sarFileCompareInfo) {
+        // 水平越权
+        sarFileCompareInfoService.isHorizontalOverstep(sarFileCompareInfo.getId());
         SarFileCompareInfo info = sarFileCompareInfoService.getById(sarFileCompareInfo.getId());
         info.setComments(sarFileCompareInfo.getComments());
         sarFileCompareInfoService.editById(info);
diff --git a/laws-modules/src/main/java/com/jero/modules/compare/service/impl/SarFileCompareInfoServiceImpl.java b/laws-modules/src/main/java/com/jero/modules/compare/service/impl/SarFileCompareInfoServiceImpl.java
index 516ebb0c..726f4bff 100644
--- a/laws-modules/src/main/java/com/jero/modules/compare/service/impl/SarFileCompareInfoServiceImpl.java
+++ b/laws-modules/src/main/java/com/jero/modules/compare/service/impl/SarFileCompareInfoServiceImpl.java
@@ -344,7 +344,9 @@ public class SarFileCompareInfoServiceImpl extends ServiceImpl<SarFileCompareInf
         LambdaQueryWrapper<SarFileCompareInfo> queryWrapper = new LambdaQueryWrapper<>();
         List<String> idList = Arrays.asList(ids.split(","));
         queryWrapper.in(SarFileCompareInfo::getId, idList);
-        queryWrapper.and(LambdaQueryWrapper -> LambdaQueryWrapper.eq(SarFileCompareInfo::getCreateBy, loginUser.getUsername()).or().eq(SarFileCompareInfo::getReleaseState, ReleaseConditionEnum.PUBLISHED.getValue()));
+        queryWrapper.and(qw ->
+                qw.eq(SarFileCompareInfo::getCreateBy, loginUser.getUsername())
+                        .or().eq(SarFileCompareInfo::getReleaseState, ReleaseConditionEnum.PUBLISHED.getValue()));
         int count = sarFileCompareInfoService.count(queryWrapper);
         if (count <= 0 || count != idList.size()) {
             if(LanguageEnum.CN.equals(MessageUtils.getLanguage())) {