From 612c4293d16e782e3905edc4e10cf621e1b4e411 Mon Sep 17 00:00:00 2001
From: RuoYi <yzz_ivy@163.com>
Date: Thu, 27 Jan 2022 12:05:04 +0800
Subject: [PATCH] 用户访问控制时校验数据权限，防止越权
---
ruoyi-system/src/main/java/com/ruoyi/system/service/impl/SysUserServiceImpl.java | 11 +++++++++--
1 files changed, 9 insertions(+), 2 deletions(-)
diff --git a/ruoyi-system/src/main/java/com/ruoyi/system/service/impl/SysUserServiceImpl.java b/ruoyi-system/src/main/java/com/ruoyi/system/service/impl/SysUserServiceImpl.java
index e80e7ae..56f3dac 100644
--- a/ruoyi-system/src/main/java/com/ruoyi/system/service/impl/SysUserServiceImpl.java
+++ b/ruoyi-system/src/main/java/com/ruoyi/system/service/impl/SysUserServiceImpl.java
@@ -3,12 +3,13 @@
import java.util.ArrayList;
import java.util.List;
import java.util.stream.Collectors;
-
+import javax.validation.Validator;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Service;
import org.springframework.transaction.annotation.Transactional;
+import org.springframework.util.CollectionUtils;
import com.ruoyi.common.annotation.DataScope;
import com.ruoyi.common.constant.UserConstants;
import com.ruoyi.common.core.domain.entity.SysRole;
@@ -16,6 +17,7 @@
import com.ruoyi.common.exception.ServiceException;
import com.ruoyi.common.utils.SecurityUtils;
import com.ruoyi.common.utils.StringUtils;
+import com.ruoyi.common.utils.bean.BeanValidators;
import com.ruoyi.common.utils.spring.SpringUtils;
import com.ruoyi.system.domain.SysPost;
import com.ruoyi.system.domain.SysUserPost;
@@ -27,7 +29,6 @@
import com.ruoyi.system.mapper.SysUserRoleMapper;
import com.ruoyi.system.service.ISysConfigService;
import com.ruoyi.system.service.ISysUserService;
-import org.springframework.util.CollectionUtils;
/**
* 用户 业务层处理
@@ -56,6 +57,9 @@
@Autowired
private ISysConfigService configService;
+
+ @Autowired
+ protected Validator validator;
/**
* 根据条件分页查询用户列表
@@ -478,6 +482,7 @@
for (Long userId : userIds)
{
checkUserAllowed(new SysUser(userId));
+ checkUserDataScope(userId);
}
// 删除用户与角色关联
userRoleMapper.deleteUserRole(userIds);
@@ -514,6 +519,7 @@
SysUser u = userMapper.selectUserByUserName(user.getUserName());
if (StringUtils.isNull(u))
{
+ BeanValidators.validateWithException(validator, user);
user.setPassword(SecurityUtils.encryptPassword(password));
user.setCreateBy(operName);
this.insertUser(user);
@@ -522,6 +528,7 @@
}
else if (isUpdateSupport)
{
+ BeanValidators.validateWithException(validator, user);
user.setUpdateBy(operName);
this.updateUser(user);
successNum++;
--
Gitblit v1.9.2