opensource/RuoYi-Vue-Plus
2
0
Fork 1
mirror of https://gitee.com/dromara/RuoYi-Vue-Plus.git synced 2026-09-21 02:25:56 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix 修复可能会存在的越权行为

Browse Source
This commit is contained in:
jenn 2023-08-30 00:06:01 +08:00
parent ef2bd5e6a4
commit 378632fa10
1 changed files with 15 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
ruoyi-modules/ruoyi-system/src/main/java/org/dromara/system/service/impl/SysUserServiceImpl.java
View File

@ -27,6 +27,7 @@ import org.dromara.system.domain.SysUser;
import org.dromara.system.domain.SysUserPost; import org.dromara.system.domain.SysUserPost;
import org.dromara.system.domain.SysUserRole; import org.dromara.system.domain.SysUserRole;
import org.dromara.system.domain.bo.SysUserBo; import org.dromara.system.domain.bo.SysUserBo;
import org.dromara.system.domain.vo.SysDeptVo;
import org.dromara.system.domain.vo.SysPostVo; import org.dromara.system.domain.vo.SysPostVo;
import org.dromara.system.domain.vo.SysRoleVo; import org.dromara.system.domain.vo.SysRoleVo;
import org.dromara.system.domain.vo.SysUserVo; import org.dromara.system.domain.vo.SysUserVo;
@ -273,6 +274,13 @@ public class SysUserServiceImpl implements ISysUserService, UserService {
@Override @Override
@Transactional(rollbackFor = Exception.class) @Transactional(rollbackFor = Exception.class)
public int insertUser(SysUserBo user) { public int insertUser(SysUserBo user) {
// 检测部门操作权限
if (ObjectUtil.isNotNull(user.getDeptId()) && !LoginHelper.isSuperAdmin()){
SysDeptVo dept = deptMapper.selectDeptById(user.getDeptId());
if (ObjectUtil.isNull(dept)) {
throw new ServiceException("没有权限访问部门数据！");
}
}
SysUser sysUser = MapstructUtils.convert(user, SysUser.class); SysUser sysUser = MapstructUtils.convert(user, SysUser.class);
// 新增用户信息 // 新增用户信息
int rows = baseMapper.insert(sysUser); int rows = baseMapper.insert(sysUser);
@ -308,6 +316,13 @@ public class SysUserServiceImpl implements ISysUserService, UserService {
@Override @Override
@Transactional(rollbackFor = Exception.class) @Transactional(rollbackFor = Exception.class)
public int updateUser(SysUserBo user) { public int updateUser(SysUserBo user) {
// 检测部门操作权限
if (ObjectUtil.isNotNull(user.getDeptId()) && !LoginHelper.isSuperAdmin()){
SysDeptVo dept = deptMapper.selectDeptById(user.getDeptId());
if (ObjectUtil.isNull(dept)) {
throw new ServiceException("没有权限访问部门数据！");
}
}
// 新增用户与角色管理 // 新增用户与角色管理
insertUserRole(user, true); insertUserRole(user, true);
// 新增用户与岗位管理 // 新增用户与岗位管理