RuoYi пре 1 година
родитељ
комит
0680d1ed1f

+ 4 - 0
ruoyi-common/ruoyi-common-core/src/main/java/com/ruoyi/common/core/text/Convert.java

@@ -364,6 +364,10 @@ public class Convert
364
      */
364
      */
365
     public static String[] toStrArray(String str)
365
     public static String[] toStrArray(String str)
366
     {
366
     {
367
+        if (StringUtils.isEmpty(str))
368
+        {
369
+            return new String[] {};
370
+        }
367
         return toStrArray(",", str);
371
         return toStrArray(",", str);
368
     }
372
     }
369
 
373
 

+ 19 - 9
ruoyi-common/ruoyi-common-datascope/src/main/java/com/ruoyi/common/datascope/aspect/DataScopeAspect.java

@@ -92,16 +92,22 @@ public class DataScopeAspect
92
     {
92
     {
93
         StringBuilder sqlString = new StringBuilder();
93
         StringBuilder sqlString = new StringBuilder();
94
         List<String> conditions = new ArrayList<String>();
94
         List<String> conditions = new ArrayList<String>();
95
+        List<String> scopeCustomIds = new ArrayList<String>();
96
+        user.getRoles().forEach(role -> {
97
+            if (DATA_SCOPE_CUSTOM.equals(role.getDataScope()) && StringUtils.containsAny(role.getPermissions(), Convert.toStrArray(permission)))
98
+            {
99
+                scopeCustomIds.add(Convert.toStr(role.getRoleId()));
100
+            }
101
+        });
95
 
102
 
96
         for (SysRole role : user.getRoles())
103
         for (SysRole role : user.getRoles())
97
         {
104
         {
98
             String dataScope = role.getDataScope();
105
             String dataScope = role.getDataScope();
99
-            if (!DATA_SCOPE_CUSTOM.equals(dataScope) && conditions.contains(dataScope))
106
+            if (conditions.contains(dataScope))
100
             {
107
             {
101
                 continue;
108
                 continue;
102
             }
109
             }
103
-            if (StringUtils.isNotEmpty(permission) && StringUtils.isNotEmpty(role.getPermissions())
104
-                    && !StringUtils.containsAny(role.getPermissions(), Convert.toStrArray(permission)))
110
+            if (!StringUtils.containsAny(role.getPermissions(), Convert.toStrArray(permission)))
105
             {
111
             {
106
                 continue;
112
                 continue;
107
             }
113
             }
@@ -113,9 +119,15 @@ public class DataScopeAspect
113
             }
119
             }
114
             else if (DATA_SCOPE_CUSTOM.equals(dataScope))
120
             else if (DATA_SCOPE_CUSTOM.equals(dataScope))
115
             {
121
             {
116
-                sqlString.append(StringUtils.format(
117
-                        " OR {}.dept_id IN ( SELECT dept_id FROM sys_role_dept WHERE role_id = {} ) ", deptAlias,
118
-                        role.getRoleId()));
122
+                if (scopeCustomIds.size() > 1)
123
+                {
124
+                    // 多个自定数据权限使用in查询,避免多次拼接。
125
+                    sqlString.append(StringUtils.format(" OR {}.dept_id IN ( SELECT dept_id FROM sys_role_dept WHERE role_id in ({}) ) ", deptAlias, String.join(",", scopeCustomIds)));
126
+                }
127
+                else
128
+                {
129
+                    sqlString.append(StringUtils.format(" OR {}.dept_id IN ( SELECT dept_id FROM sys_role_dept WHERE role_id = {} ) ", deptAlias, role.getRoleId()));
130
+                }
119
             }
131
             }
120
             else if (DATA_SCOPE_DEPT.equals(dataScope))
132
             else if (DATA_SCOPE_DEPT.equals(dataScope))
121
             {
133
             {
@@ -123,9 +135,7 @@ public class DataScopeAspect
123
             }
135
             }
124
             else if (DATA_SCOPE_DEPT_AND_CHILD.equals(dataScope))
136
             else if (DATA_SCOPE_DEPT_AND_CHILD.equals(dataScope))
125
             {
137
             {
126
-                sqlString.append(StringUtils.format(
127
-                        " OR {}.dept_id IN ( SELECT dept_id FROM sys_dept WHERE dept_id = {} or find_in_set( {} , ancestors ) )",
128
-                        deptAlias, user.getDeptId(), user.getDeptId()));
138
+                sqlString.append(StringUtils.format(" OR {}.dept_id IN ( SELECT dept_id FROM sys_dept WHERE dept_id = {} or find_in_set( {} , ancestors ) )", deptAlias, user.getDeptId(), user.getDeptId()));
129
             }
139
             }
130
             else if (DATA_SCOPE_SELF.equals(dataScope))
140
             else if (DATA_SCOPE_SELF.equals(dataScope))
131
             {
141
             {

+ 17 - 10
ruoyi-common/ruoyi-common-security/src/main/java/com/ruoyi/common/security/handler/GlobalExceptionHandler.java

@@ -1,13 +1,6 @@
1
 package com.ruoyi.common.security.handler;
1
 package com.ruoyi.common.security.handler;
2
 
2
 
3
-import com.ruoyi.common.core.constant.HttpStatus;
4
-import com.ruoyi.common.core.exception.DemoModeException;
5
-import com.ruoyi.common.core.exception.InnerAuthException;
6
-import com.ruoyi.common.core.exception.ServiceException;
7
-import com.ruoyi.common.core.exception.auth.NotPermissionException;
8
-import com.ruoyi.common.core.exception.auth.NotRoleException;
9
-import com.ruoyi.common.core.utils.StringUtils;
10
-import com.ruoyi.common.core.web.domain.AjaxResult;
3
+import javax.servlet.http.HttpServletRequest;
11
 import org.slf4j.Logger;
4
 import org.slf4j.Logger;
12
 import org.slf4j.LoggerFactory;
5
 import org.slf4j.LoggerFactory;
13
 import org.springframework.validation.BindException;
6
 import org.springframework.validation.BindException;
@@ -17,7 +10,16 @@ import org.springframework.web.bind.MissingPathVariableException;
17
 import org.springframework.web.bind.annotation.ExceptionHandler;
10
 import org.springframework.web.bind.annotation.ExceptionHandler;
18
 import org.springframework.web.bind.annotation.RestControllerAdvice;
11
 import org.springframework.web.bind.annotation.RestControllerAdvice;
19
 import org.springframework.web.method.annotation.MethodArgumentTypeMismatchException;
12
 import org.springframework.web.method.annotation.MethodArgumentTypeMismatchException;
20
-import javax.servlet.http.HttpServletRequest;
13
+import com.ruoyi.common.core.constant.HttpStatus;
14
+import com.ruoyi.common.core.exception.DemoModeException;
15
+import com.ruoyi.common.core.exception.InnerAuthException;
16
+import com.ruoyi.common.core.exception.ServiceException;
17
+import com.ruoyi.common.core.exception.auth.NotPermissionException;
18
+import com.ruoyi.common.core.exception.auth.NotRoleException;
19
+import com.ruoyi.common.core.text.Convert;
20
+import com.ruoyi.common.core.utils.StringUtils;
21
+import com.ruoyi.common.core.utils.html.EscapeUtil;
22
+import com.ruoyi.common.core.web.domain.AjaxResult;
21
 
23
 
22
 /**
24
 /**
23
  * 全局异常处理器
25
  * 全局异常处理器
@@ -91,8 +93,13 @@ public class GlobalExceptionHandler
91
     public AjaxResult handleMethodArgumentTypeMismatchException(MethodArgumentTypeMismatchException e, HttpServletRequest request)
93
     public AjaxResult handleMethodArgumentTypeMismatchException(MethodArgumentTypeMismatchException e, HttpServletRequest request)
92
     {
94
     {
93
         String requestURI = request.getRequestURI();
95
         String requestURI = request.getRequestURI();
96
+        String value = Convert.toStr(e.getValue());
97
+        if (StringUtils.isNotEmpty(value))
98
+        {
99
+            value = EscapeUtil.clean(value);
100
+        }
94
         log.error("请求参数类型不匹配'{}',发生系统异常.", requestURI, e);
101
         log.error("请求参数类型不匹配'{}',发生系统异常.", requestURI, e);
95
-        return AjaxResult.error(String.format("请求参数类型不匹配,参数[%s]要求类型为:'%s',但输入值为:'%s'", e.getName(), e.getRequiredType().getName(), e.getValue()));
102
+        return AjaxResult.error(String.format("请求参数类型不匹配,参数[%s]要求类型为:'%s',但输入值为:'%s'", e.getName(), e.getRequiredType().getName(), value));
96
     }
103
     }
97
 
104
 
98
     /**
105
     /**