From 098d3347a0df808908aab8c554cd7c4febc5e6d9 Mon Sep 17 00:00:00 2001
From: 疯狂的狮子Li <15040126243@163.com>
Date: 星期一, 26 八月 2024 11:43:59 +0800
Subject: [PATCH] !577 发布 5.2.2 正式版 安全性提升 Merge pull request !577 from 疯狂的狮子Li/dev
---
ruoyi-modules/ruoyi-system/src/main/java/org/dromara/system/controller/system/SysProfileController.java | 39 ++++++++++++++++++++++++---------------
1 files changed, 24 insertions(+), 15 deletions(-)
diff --git a/ruoyi-modules/ruoyi-system/src/main/java/org/dromara/system/controller/system/SysProfileController.java b/ruoyi-modules/ruoyi-system/src/main/java/org/dromara/system/controller/system/SysProfileController.java
index 60d1682..893b381 100644
--- a/ruoyi-modules/ruoyi-system/src/main/java/org/dromara/system/controller/system/SysProfileController.java
+++ b/ruoyi-modules/ruoyi-system/src/main/java/org/dromara/system/controller/system/SysProfileController.java
@@ -3,14 +3,19 @@
import cn.dev33.satoken.secure.BCrypt;
import cn.hutool.core.bean.BeanUtil;
import cn.hutool.core.io.FileUtil;
+import lombok.RequiredArgsConstructor;
import org.dromara.common.core.domain.R;
import org.dromara.common.core.utils.StringUtils;
import org.dromara.common.core.utils.file.MimeTypeUtils;
+import org.dromara.common.encrypt.annotation.ApiEncrypt;
+import org.dromara.common.idempotent.annotation.RepeatSubmit;
import org.dromara.common.log.annotation.Log;
import org.dromara.common.log.enums.BusinessType;
+import org.dromara.common.mybatis.helper.DataPermissionHelper;
import org.dromara.common.satoken.utils.LoginHelper;
import org.dromara.common.web.core.BaseController;
import org.dromara.system.domain.bo.SysUserBo;
+import org.dromara.system.domain.bo.SysUserPasswordBo;
import org.dromara.system.domain.bo.SysUserProfileBo;
import org.dromara.system.domain.vo.AvatarVo;
import org.dromara.system.domain.vo.ProfileVo;
@@ -18,7 +23,6 @@
import org.dromara.system.domain.vo.SysUserVo;
import org.dromara.system.service.ISysOssService;
import org.dromara.system.service.ISysUserService;
-import lombok.RequiredArgsConstructor;
import org.springframework.http.MediaType;
import org.springframework.validation.annotation.Validated;
import org.springframework.web.bind.annotation.*;
@@ -48,26 +52,29 @@
SysUserVo user = userService.selectUserById(LoginHelper.getUserId());
ProfileVo profileVo = new ProfileVo();
profileVo.setUser(user);
- profileVo.setRoleGroup(userService.selectUserRoleGroup(user.getUserName()));
- profileVo.setPostGroup(userService.selectUserPostGroup(user.getUserName()));
+ profileVo.setRoleGroup(userService.selectUserRoleGroup(user.getUserId()));
+ profileVo.setPostGroup(userService.selectUserPostGroup(user.getUserId()));
return R.ok(profileVo);
}
/**
- * 淇敼鐢ㄦ埛
+ * 淇敼鐢ㄦ埛淇℃伅
*/
+ @RepeatSubmit
@Log(title = "涓汉淇℃伅", businessType = BusinessType.UPDATE)
@PutMapping
- public R<Void> updateProfile(@RequestBody SysUserProfileBo profile) {
+ public R<Void> updateProfile(@Validated @RequestBody SysUserProfileBo profile) {
SysUserBo user = BeanUtil.toBean(profile, SysUserBo.class);
+ user.setUserId(LoginHelper.getUserId());
+ String username = LoginHelper.getUsername();
if (StringUtils.isNotEmpty(user.getPhonenumber()) && !userService.checkPhoneUnique(user)) {
- return R.fail("淇敼鐢ㄦ埛'" + user.getUserName() + "'澶辫触锛屾墜鏈哄彿鐮佸凡瀛樺湪");
+ return R.fail("淇敼鐢ㄦ埛'" + username + "'澶辫触锛屾墜鏈哄彿鐮佸凡瀛樺湪");
}
if (StringUtils.isNotEmpty(user.getEmail()) && !userService.checkEmailUnique(user)) {
- return R.fail("淇敼鐢ㄦ埛'" + user.getUserName() + "'澶辫触锛岄偖绠辫处鍙峰凡瀛樺湪");
+ return R.fail("淇敼鐢ㄦ埛'" + username + "'澶辫触锛岄偖绠辫处鍙峰凡瀛樺湪");
}
- user.setUserId(LoginHelper.getUserId());
- if (userService.updateUserProfile(user) > 0) {
+ int rows = DataPermissionHelper.ignore(() -> userService.updateUserProfile(user));
+ if (rows > 0) {
return R.ok();
}
return R.fail("淇敼涓汉淇℃伅寮傚父锛岃鑱旂郴绠＄悊鍛�");
@@ -76,22 +83,23 @@
/**
* 閲嶇疆瀵嗙爜
*
- * @param newPassword 鏃у瘑鐮�
- * @param oldPassword 鏂板瘑鐮�
+ * @param bo 鏂版棫瀵嗙爜
*/
+ @RepeatSubmit
+ @ApiEncrypt
@Log(title = "涓汉淇℃伅", businessType = BusinessType.UPDATE)
@PutMapping("/updatePwd")
- public R<Void> updatePwd(String oldPassword, String newPassword) {
+ public R<Void> updatePwd(@Validated @RequestBody SysUserPasswordBo bo) {
SysUserVo user = userService.selectUserById(LoginHelper.getUserId());
String password = user.getPassword();
- if (!BCrypt.checkpw(oldPassword, password)) {
+ if (!BCrypt.checkpw(bo.getOldPassword(), password)) {
return R.fail("淇敼瀵嗙爜澶辫触锛屾棫瀵嗙爜閿欒");
}
- if (BCrypt.checkpw(newPassword, password)) {
+ if (BCrypt.checkpw(bo.getNewPassword(), password)) {
return R.fail("鏂板瘑鐮佷笉鑳戒笌鏃у瘑鐮佺浉鍚�");
}
- if (userService.resetUserPwd(user.getUserId(), BCrypt.hashpw(newPassword)) > 0) {
+ if (userService.resetUserPwd(user.getUserId(), BCrypt.hashpw(bo.getNewPassword())) > 0) {
return R.ok();
}
return R.fail("淇敼瀵嗙爜寮傚父锛岃鑱旂郴绠＄悊鍛�");
@@ -102,6 +110,7 @@
*
* @param avatarfile 鐢ㄦ埛澶村儚
*/
+ @RepeatSubmit
@Log(title = "鐢ㄦ埛澶村儚", businessType = BusinessType.UPDATE)
@PostMapping(value = "/avatar", consumes = MediaType.MULTIPART_FORM_DATA_VALUE)
public R<AvatarVo> avatar(@RequestPart("avatarfile") MultipartFile avatarfile) {
--
Gitblit v1.9.3