Просмотр исходного кода

用户访问控制时校验数据权限,防止越权

RuoYi лет назад: 4
Родитель
Сommit
1a1d6562d2

+ 5 - 3
ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/controller/SysDeptController.java

@@ -126,16 +126,17 @@ public class SysDeptController extends BaseController
126
     @PutMapping
126
     @PutMapping
127
     public AjaxResult edit(@Validated @RequestBody SysDept dept)
127
     public AjaxResult edit(@Validated @RequestBody SysDept dept)
128
     {
128
     {
129
+        Long deptId = dept.getDeptId();
130
+        deptService.checkDeptDataScope(deptId);
129
         if (UserConstants.NOT_UNIQUE.equals(deptService.checkDeptNameUnique(dept)))
131
         if (UserConstants.NOT_UNIQUE.equals(deptService.checkDeptNameUnique(dept)))
130
         {
132
         {
131
             return AjaxResult.error("修改部门'" + dept.getDeptName() + "'失败,部门名称已存在");
133
             return AjaxResult.error("修改部门'" + dept.getDeptName() + "'失败,部门名称已存在");
132
         }
134
         }
133
-        else if (dept.getParentId().equals(dept.getDeptId()))
135
+        else if (dept.getParentId().equals(deptId))
134
         {
136
         {
135
             return AjaxResult.error("修改部门'" + dept.getDeptName() + "'失败,上级部门不能是自己");
137
             return AjaxResult.error("修改部门'" + dept.getDeptName() + "'失败,上级部门不能是自己");
136
         }
138
         }
137
-        else if (StringUtils.equals(UserConstants.DEPT_DISABLE, dept.getStatus())
138
-                && deptService.selectNormalChildrenDeptById(dept.getDeptId()) > 0)
139
+        else if (StringUtils.equals(UserConstants.DEPT_DISABLE, dept.getStatus()) && deptService.selectNormalChildrenDeptById(deptId) > 0)
139
         {
140
         {
140
             return AjaxResult.error("该部门包含未停用的子部门!");
141
             return AjaxResult.error("该部门包含未停用的子部门!");
141
         }
142
         }
@@ -159,6 +160,7 @@ public class SysDeptController extends BaseController
159
         {
160
         {
160
             return AjaxResult.error("部门存在用户,不允许删除");
161
             return AjaxResult.error("部门存在用户,不允许删除");
161
         }
162
         }
163
+        deptService.checkDeptDataScope(deptId);
162
         return toAjax(deptService.deleteDeptById(deptId));
164
         return toAjax(deptService.deleteDeptById(deptId));
163
     }
165
     }
164
 }
166
 }

+ 4 - 0
ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/controller/SysRoleController.java

@@ -102,6 +102,7 @@ public class SysRoleController extends BaseController
102
     public AjaxResult edit(@Validated @RequestBody SysRole role)
102
     public AjaxResult edit(@Validated @RequestBody SysRole role)
103
     {
103
     {
104
         roleService.checkRoleAllowed(role);
104
         roleService.checkRoleAllowed(role);
105
+        roleService.checkRoleDataScope(role.getRoleId());
105
         if (UserConstants.NOT_UNIQUE.equals(roleService.checkRoleNameUnique(role)))
106
         if (UserConstants.NOT_UNIQUE.equals(roleService.checkRoleNameUnique(role)))
106
         {
107
         {
107
             return AjaxResult.error("修改角色'" + role.getRoleName() + "'失败,角色名称已存在");
108
             return AjaxResult.error("修改角色'" + role.getRoleName() + "'失败,角色名称已存在");
@@ -123,6 +124,7 @@ public class SysRoleController extends BaseController
123
     public AjaxResult dataScope(@RequestBody SysRole role)
124
     public AjaxResult dataScope(@RequestBody SysRole role)
124
     {
125
     {
125
         roleService.checkRoleAllowed(role);
126
         roleService.checkRoleAllowed(role);
127
+        roleService.checkRoleDataScope(role.getRoleId());
126
         return toAjax(roleService.authDataScope(role));
128
         return toAjax(roleService.authDataScope(role));
127
     }
129
     }
128
 
130
 
@@ -135,6 +137,7 @@ public class SysRoleController extends BaseController
135
     public AjaxResult changeStatus(@RequestBody SysRole role)
137
     public AjaxResult changeStatus(@RequestBody SysRole role)
136
     {
138
     {
137
         roleService.checkRoleAllowed(role);
139
         roleService.checkRoleAllowed(role);
140
+        roleService.checkRoleDataScope(role.getRoleId());
138
         role.setUpdateBy(SecurityUtils.getUsername());
141
         role.setUpdateBy(SecurityUtils.getUsername());
139
         return toAjax(roleService.updateRoleStatus(role));
142
         return toAjax(roleService.updateRoleStatus(role));
140
     }
143
     }
@@ -213,6 +216,7 @@ public class SysRoleController extends BaseController
213
     @PutMapping("/authUser/selectAll")
216
     @PutMapping("/authUser/selectAll")
214
     public AjaxResult selectAuthUserAll(Long roleId, Long[] userIds)
217
     public AjaxResult selectAuthUserAll(Long roleId, Long[] userIds)
215
     {
218
     {
219
+        roleService.checkRoleDataScope(roleId);
216
         return toAjax(roleService.insertAuthUsers(roleId, userIds));
220
         return toAjax(roleService.insertAuthUsers(roleId, userIds));
217
     }
221
     }
218
 }
222
 }

+ 4 - 0
ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/controller/SysUserController.java

@@ -223,6 +223,7 @@ public class SysUserController extends BaseController
223
     public AjaxResult edit(@Validated @RequestBody SysUser user)
223
     public AjaxResult edit(@Validated @RequestBody SysUser user)
224
     {
224
     {
225
         userService.checkUserAllowed(user);
225
         userService.checkUserAllowed(user);
226
+        userService.checkUserDataScope(user.getUserId());
226
         if (StringUtils.isNotEmpty(user.getPhonenumber())
227
         if (StringUtils.isNotEmpty(user.getPhonenumber())
227
                 && UserConstants.NOT_UNIQUE.equals(userService.checkPhoneUnique(user)))
228
                 && UserConstants.NOT_UNIQUE.equals(userService.checkPhoneUnique(user)))
228
         {
229
         {
@@ -261,6 +262,7 @@ public class SysUserController extends BaseController
261
     public AjaxResult resetPwd(@RequestBody SysUser user)
262
     public AjaxResult resetPwd(@RequestBody SysUser user)
262
     {
263
     {
263
         userService.checkUserAllowed(user);
264
         userService.checkUserAllowed(user);
265
+        userService.checkUserDataScope(user.getUserId());
264
         user.setPassword(SecurityUtils.encryptPassword(user.getPassword()));
266
         user.setPassword(SecurityUtils.encryptPassword(user.getPassword()));
265
         user.setUpdateBy(SecurityUtils.getUsername());
267
         user.setUpdateBy(SecurityUtils.getUsername());
266
         return toAjax(userService.resetPwd(user));
268
         return toAjax(userService.resetPwd(user));
@@ -275,6 +277,7 @@ public class SysUserController extends BaseController
275
     public AjaxResult changeStatus(@RequestBody SysUser user)
277
     public AjaxResult changeStatus(@RequestBody SysUser user)
276
     {
278
     {
277
         userService.checkUserAllowed(user);
279
         userService.checkUserAllowed(user);
280
+        userService.checkUserDataScope(user.getUserId());
278
         user.setUpdateBy(SecurityUtils.getUsername());
281
         user.setUpdateBy(SecurityUtils.getUsername());
279
         return toAjax(userService.updateUserStatus(user));
282
         return toAjax(userService.updateUserStatus(user));
280
     }
283
     }
@@ -302,6 +305,7 @@ public class SysUserController extends BaseController
302
     @PutMapping("/authRole")
305
     @PutMapping("/authRole")
303
     public AjaxResult insertAuthRole(Long userId, Long[] roleIds)
306
     public AjaxResult insertAuthRole(Long userId, Long[] roleIds)
304
     {
307
     {
308
+        userService.checkUserDataScope(userId);
305
         userService.insertUserAuth(userId, roleIds);
309
         userService.insertUserAuth(userId, roleIds);
306
         return success();
310
         return success();
307
     }
311
     }

+ 1 - 0
ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/service/impl/SysRoleServiceImpl.java

@@ -361,6 +361,7 @@ public class SysRoleServiceImpl implements ISysRoleService
361
         for (Long roleId : roleIds)
361
         for (Long roleId : roleIds)
362
         {
362
         {
363
             checkRoleAllowed(new SysRole(roleId));
363
             checkRoleAllowed(new SysRole(roleId));
364
+            checkRoleDataScope(roleId);
364
             SysRole role = selectRoleById(roleId);
365
             SysRole role = selectRoleById(roleId);
365
             if (countUserRoleByRoleId(roleId) > 0)
366
             if (countUserRoleByRoleId(roleId) > 0)
366
             {
367
             {

+ 1 - 0
ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/service/impl/SysUserServiceImpl.java

@@ -482,6 +482,7 @@ public class SysUserServiceImpl implements ISysUserService
482
         for (Long userId : userIds)
482
         for (Long userId : userIds)
483
         {
483
         {
484
             checkUserAllowed(new SysUser(userId));
484
             checkUserAllowed(new SysUser(userId));
485
+            checkUserDataScope(userId);
485
         }
486
         }
486
         // 删除用户与角色关联
487
         // 删除用户与角色关联
487
         userRoleMapper.deleteUserRole(userIds);
488
         userRoleMapper.deleteUserRole(userIds);