From 146c268dff91432c368d610e7fdea9a3a75fdba8 Mon Sep 17 00:00:00 2001
From: 丶Stone <244251889@qq.com>
Date: 星期三, 30 八月 2023 21:35:57 +0800
Subject: [PATCH] !416 fix 修复可能会存在的越权行为 * fix 修复可能会存在的越权行为
---
ruoyi-modules/ruoyi-system/src/main/java/org/dromara/system/service/impl/SysRoleServiceImpl.java | 12 ++++++++++--
1 files changed, 10 insertions(+), 2 deletions(-)
diff --git a/ruoyi-modules/ruoyi-system/src/main/java/org/dromara/system/service/impl/SysRoleServiceImpl.java b/ruoyi-modules/ruoyi-system/src/main/java/org/dromara/system/service/impl/SysRoleServiceImpl.java
index 44491a7..79fada2 100644
--- a/ruoyi-modules/ruoyi-system/src/main/java/org/dromara/system/service/impl/SysRoleServiceImpl.java
+++ b/ruoyi-modules/ruoyi-system/src/main/java/org/dromara/system/service/impl/SysRoleServiceImpl.java
@@ -283,6 +283,9 @@
*/
@Override
public int updateRoleStatus(Long roleId, String status) {
+ if (UserConstants.ROLE_DISABLE.equals(status) && this.countUserRoleByRoleId(roleId) > 0) {
+ throw new ServiceException("瑙掕壊宸插垎閰嶏紝涓嶈兘绂佺敤!");
+ }
return baseMapper.update(null,
new LambdaUpdateWrapper<SysRole>()
.set(SysRole::getStatus, status)
@@ -379,7 +382,7 @@
checkRoleAllowed(BeanUtil.toBean(role, SysRoleBo.class));
checkRoleDataScope(roleId);
if (countUserRoleByRoleId(roleId) > 0) {
- throw new ServiceException(String.format("%1$s宸插垎閰�,涓嶈兘鍒犻櫎", role.getRoleName()));
+ throw new ServiceException(String.format("%1$s宸插垎閰嶏紝涓嶈兘鍒犻櫎!", role.getRoleName()));
}
}
List<Long> ids = Arrays.asList(roleIds);
@@ -453,6 +456,11 @@
@Override
public void cleanOnlineUserByRole(Long roleId) {
+ // 濡傛灉瑙掕壊鏈粦瀹氱敤鎴� 鐩存帴杩斿洖
+ Long num = userRoleMapper.selectCount(new LambdaQueryWrapper<SysUserRole>().eq(SysUserRole::getRoleId, roleId));
+ if (num == 0) {
+ return;
+ }
List<String> keys = StpUtil.searchTokenValue("", 0, -1, false);
if (CollUtil.isEmpty(keys)) {
return;
@@ -461,7 +469,7 @@
keys.parallelStream().forEach(key -> {
String token = StringUtils.substringAfterLast(key, ":");
// 濡傛灉宸茬粡杩囨湡鍒欒烦杩�
- if (StpUtil.stpLogic.getTokenActivityTimeoutByToken(token) < -1) {
+ if (StpUtil.stpLogic.getTokenActiveTimeoutByToken(token) < -1) {
return;
}
LoginUser loginUser = LoginHelper.getLoginUser(token);
--
Gitblit v1.9.3