opensource/RuoYi-Vue-Plus
2
0
Fork 1
mirror of https://gitee.com/dromara/RuoYi-Vue-Plus.git synced 2026-09-20 18:15:56 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix 修复可能会存在的越权行为

Browse Source
This commit is contained in:
jenn 2023-08-30 20:35:14 +08:00
parent 378632fa10
commit 511b3b4f86
2 changed files with 28 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
ruoyi-modules/ruoyi-system/src/main/java/org/dromara/system/service/ISysUserService.java
View File

@ -119,6 +119,13 @@ public interface ISysUserService {
*/ */
void checkUserDataScope(Long userId); void checkUserDataScope(Long userId);
/**
* 校验部门是否有数据权限
*
* @param deptId 部门id
*/
void checkDeptDataScope(Long deptId);
/** /**
* 新增用户信息 * 新增用户信息
* *

35
ruoyi-modules/ruoyi-system/src/main/java/org/dromara/system/service/impl/SysUserServiceImpl.java
View File

@ -265,6 +265,25 @@ public class SysUserServiceImpl implements ISysUserService, UserService {
} }
} }
/**
* 校验部门是否有数据权限
*
* @param deptId 部门id
*/
@Override
public void checkDeptDataScope(Long deptId) {
if (ObjectUtil.isNull(deptId)) {
return;
}
if (LoginHelper.isSuperAdmin()) {
return;
}
SysDeptVo dept = deptMapper.selectDeptById(deptId);
if (ObjectUtil.isNull(dept)) {
throw new ServiceException("没有权限访问部门数据！");
}
}
/** /**
* 新增保存用户信息 * 新增保存用户信息
* *
@ -274,13 +293,7 @@ public class SysUserServiceImpl implements ISysUserService, UserService {
@Override @Override
@Transactional(rollbackFor = Exception.class) @Transactional(rollbackFor = Exception.class)
public int insertUser(SysUserBo user) { public int insertUser(SysUserBo user) {
// 检测部门操作权限 this.checkDeptDataScope(user.getDeptId());
if (ObjectUtil.isNotNull(user.getDeptId()) && !LoginHelper.isSuperAdmin()){
SysDeptVo dept = deptMapper.selectDeptById(user.getDeptId());
if (ObjectUtil.isNull(dept)) {
throw new ServiceException("没有权限访问部门数据！");
}
}
SysUser sysUser = MapstructUtils.convert(user, SysUser.class); SysUser sysUser = MapstructUtils.convert(user, SysUser.class);
// 新增用户信息 // 新增用户信息
int rows = baseMapper.insert(sysUser); int rows = baseMapper.insert(sysUser);
@ -316,13 +329,7 @@ public class SysUserServiceImpl implements ISysUserService, UserService {
@Override @Override
@Transactional(rollbackFor = Exception.class) @Transactional(rollbackFor = Exception.class)
public int updateUser(SysUserBo user) { public int updateUser(SysUserBo user) {
// 检测部门操作权限 this.checkDeptDataScope(user.getDeptId());
if (ObjectUtil.isNotNull(user.getDeptId()) && !LoginHelper.isSuperAdmin()){
SysDeptVo dept = deptMapper.selectDeptById(user.getDeptId());
if (ObjectUtil.isNull(dept)) {
throw new ServiceException("没有权限访问部门数据！");
}
}
// 新增用户与角色管理 // 新增用户与角色管理
insertUserRole(user, true); insertUserRole(user, true);
// 新增用户与岗位管理 // 新增用户与岗位管理