From 4f0a584efcbe51c5c232ab6f75a8d760b15d5e03 Mon Sep 17 00:00:00 2001
From: 疯狂的狮子Li <15040126243@163.com>
Date: 星期五, 01 四月 2022 17:57:00 +0800
Subject: [PATCH] update springboot 2.6.5 => 2.6.6 修复 CVE-2022-22965 漏洞
---
ruoyi-system/src/main/java/com/ruoyi/system/service/impl/SysRoleServiceImpl.java | 148 ++++++++++++++++++++++++++++++-------------------
1 files changed, 90 insertions(+), 58 deletions(-)
diff --git a/ruoyi-system/src/main/java/com/ruoyi/system/service/impl/SysRoleServiceImpl.java b/ruoyi-system/src/main/java/com/ruoyi/system/service/impl/SysRoleServiceImpl.java
index 70a33ee..e7e5b53 100644
--- a/ruoyi-system/src/main/java/com/ruoyi/system/service/impl/SysRoleServiceImpl.java
+++ b/ruoyi-system/src/main/java/com/ruoyi/system/service/impl/SysRoleServiceImpl.java
@@ -1,15 +1,19 @@
package com.ruoyi.system.service.impl;
-import cn.hutool.core.lang.Validator;
+import cn.hutool.core.collection.CollUtil;
+import cn.hutool.core.util.ObjectUtil;
+import com.baomidou.mybatisplus.core.conditions.Wrapper;
import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
-import com.ruoyi.common.annotation.DataScope;
+import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
+import com.baomidou.mybatisplus.core.toolkit.StringUtils;
+import com.baomidou.mybatisplus.core.toolkit.Wrappers;
+import com.baomidou.mybatisplus.extension.plugins.pagination.Page;
import com.ruoyi.common.constant.UserConstants;
+import com.ruoyi.common.core.domain.PageQuery;
import com.ruoyi.common.core.domain.entity.SysRole;
-import com.ruoyi.common.core.mybatisplus.core.ServicePlusImpl;
import com.ruoyi.common.core.page.TableDataInfo;
-import com.ruoyi.common.exception.CustomException;
-import com.ruoyi.common.utils.PageUtils;
-import com.ruoyi.common.utils.spring.SpringUtils;
+import com.ruoyi.common.exception.ServiceException;
+import com.ruoyi.common.helper.LoginHelper;
import com.ruoyi.system.domain.SysRoleDept;
import com.ruoyi.system.domain.SysRoleMenu;
import com.ruoyi.system.domain.SysUserRole;
@@ -18,7 +22,7 @@
import com.ruoyi.system.mapper.SysRoleMenuMapper;
import com.ruoyi.system.mapper.SysUserRoleMapper;
import com.ruoyi.system.service.ISysRoleService;
-import org.springframework.beans.factory.annotation.Autowired;
+import lombok.RequiredArgsConstructor;
import org.springframework.stereotype.Service;
import org.springframework.transaction.annotation.Transactional;
@@ -27,24 +31,21 @@
/**
* 瑙掕壊 涓氬姟灞傚鐞�
*
- * @author ruoyi
+ * @author Lion Li
*/
+@RequiredArgsConstructor
@Service
-public class SysRoleServiceImpl extends ServicePlusImpl<SysRoleMapper, SysRole, SysRole> implements ISysRoleService {
+public class SysRoleServiceImpl implements ISysRoleService {
- @Autowired
- private SysRoleMenuMapper roleMenuMapper;
-
- @Autowired
- private SysUserRoleMapper userRoleMapper;
-
- @Autowired
- private SysRoleDeptMapper roleDeptMapper;
+ private final SysRoleMapper baseMapper;
+ private final SysRoleMenuMapper roleMenuMapper;
+ private final SysUserRoleMapper userRoleMapper;
+ private final SysRoleDeptMapper roleDeptMapper;
@Override
- @DataScope(deptAlias = "d")
- public TableDataInfo<SysRole> selectPageRoleList(SysRole role) {
- return PageUtils.buildDataInfo(baseMapper.selectPageRoleList(PageUtils.buildPage(), role));
+ public TableDataInfo<SysRole> selectPageRoleList(SysRole role, PageQuery pageQuery) {
+ Page<SysRole> page = baseMapper.selectPageRoleList(pageQuery.build(), this.buildQueryWrapper(role));
+ return TableDataInfo.build(page);
}
/**
@@ -54,9 +55,22 @@
* @return 瑙掕壊鏁版嵁闆嗗悎淇℃伅
*/
@Override
- @DataScope(deptAlias = "d")
public List<SysRole> selectRoleList(SysRole role) {
- return baseMapper.selectRoleList(role);
+ return baseMapper.selectRoleList(this.buildQueryWrapper(role));
+ }
+
+ private Wrapper<SysRole> buildQueryWrapper(SysRole role) {
+ Map<String, Object> params = role.getParams();
+ QueryWrapper<SysRole> wrapper = Wrappers.query();
+ wrapper.eq("r.del_flag", UserConstants.ROLE_NORMAL)
+ .eq(ObjectUtil.isNotNull(role.getRoleId()), "r.role_id", role.getRoleId())
+ .like(StringUtils.isNotBlank(role.getRoleName()), "r.role_name", role.getRoleName())
+ .eq(StringUtils.isNotBlank(role.getStatus()), "r.status", role.getStatus())
+ .like(StringUtils.isNotBlank(role.getRoleKey()), "r.role_key", role.getRoleKey())
+ .between(params.get("beginTime") != null && params.get("endTime") != null,
+ "r.create_time", params.get("beginTime"), params.get("endTime"))
+ .orderByAsc("r.role_sort");
+ return wrapper;
}
/**
@@ -91,7 +105,7 @@
List<SysRole> perms = baseMapper.selectRolePermissionByUserId(userId);
Set<String> permsSet = new HashSet<>();
for (SysRole perm : perms) {
- if (Validator.isNotNull(perm)) {
+ if (ObjectUtil.isNotNull(perm)) {
permsSet.addAll(Arrays.asList(perm.getRoleKey().trim().split(",")));
}
}
@@ -105,7 +119,7 @@
*/
@Override
public List<SysRole> selectRoleAll() {
- return SpringUtils.getAopProxy(this).selectRoleList(new SysRole());
+ return this.selectRoleList(new SysRole());
}
/**
@@ -115,7 +129,7 @@
* @return 閫変腑瑙掕壊ID鍒楄〃
*/
@Override
- public List<Integer> selectRoleListByUserId(Long userId) {
+ public List<Long> selectRoleListByUserId(Long userId) {
return baseMapper.selectRoleListByUserId(userId);
}
@@ -127,7 +141,7 @@
*/
@Override
public SysRole selectRoleById(Long roleId) {
- return getById(roleId);
+ return baseMapper.selectById(roleId);
}
/**
@@ -138,10 +152,10 @@
*/
@Override
public String checkRoleNameUnique(SysRole role) {
- Long roleId = Validator.isNull(role.getRoleId()) ? -1L : role.getRoleId();
- SysRole info = getOne(new LambdaQueryWrapper<SysRole>()
- .eq(SysRole::getRoleName, role.getRoleName()).last("limit 1"));
- if (Validator.isNotNull(info) && info.getRoleId().longValue() != roleId.longValue()) {
+ boolean exist = baseMapper.exists(new LambdaQueryWrapper<SysRole>()
+ .eq(SysRole::getRoleName, role.getRoleName())
+ .ne(ObjectUtil.isNotNull(role.getRoleId()), SysRole::getRoleId, role.getRoleId()));
+ if (exist) {
return UserConstants.NOT_UNIQUE;
}
return UserConstants.UNIQUE;
@@ -155,10 +169,10 @@
*/
@Override
public String checkRoleKeyUnique(SysRole role) {
- Long roleId = Validator.isNull(role.getRoleId()) ? -1L : role.getRoleId();
- SysRole info = getOne(new LambdaQueryWrapper<SysRole>()
- .eq(SysRole::getRoleKey, role.getRoleKey()).last("limit 1"));
- if (Validator.isNotNull(info) && info.getRoleId().longValue() != roleId.longValue()) {
+ boolean exist = baseMapper.exists(new LambdaQueryWrapper<SysRole>()
+ .eq(SysRole::getRoleKey, role.getRoleKey())
+ .ne(ObjectUtil.isNotNull(role.getRoleId()), SysRole::getRoleId, role.getRoleId()));
+ if (exist) {
return UserConstants.NOT_UNIQUE;
}
return UserConstants.UNIQUE;
@@ -171,8 +185,25 @@
*/
@Override
public void checkRoleAllowed(SysRole role) {
- if (Validator.isNotNull(role.getRoleId()) && role.isAdmin()) {
- throw new CustomException("涓嶅厑璁告搷浣滆秴绾х鐞嗗憳瑙掕壊");
+ if (ObjectUtil.isNotNull(role.getRoleId()) && role.isAdmin()) {
+ throw new ServiceException("涓嶅厑璁告搷浣滆秴绾х鐞嗗憳瑙掕壊");
+ }
+ }
+
+ /**
+ * 鏍￠獙瑙掕壊鏄惁鏈夋暟鎹潈闄�
+ *
+ * @param roleId 瑙掕壊id
+ */
+ @Override
+ public void checkRoleDataScope(Long roleId) {
+ if (!LoginHelper.isAdmin()) {
+ SysRole role = new SysRole();
+ role.setRoleId(roleId);
+ List<SysRole> roles = this.selectRoleList(role);
+ if (CollUtil.isEmpty(roles)) {
+ throw new ServiceException("娌℃湁鏉冮檺璁块棶瑙掕壊鏁版嵁锛�");
+ }
}
}
@@ -183,7 +214,7 @@
* @return 缁撴灉
*/
@Override
- public int countUserRoleByRoleId(Long roleId) {
+ public long countUserRoleByRoleId(Long roleId) {
return userRoleMapper.selectCount(new LambdaQueryWrapper<SysUserRole>().eq(SysUserRole::getRoleId, roleId));
}
@@ -194,7 +225,7 @@
* @return 缁撴灉
*/
@Override
- @Transactional
+ @Transactional(rollbackFor = Exception.class)
public int insertRole(SysRole role) {
// 鏂板瑙掕壊淇℃伅
baseMapper.insert(role);
@@ -208,7 +239,7 @@
* @return 缁撴灉
*/
@Override
- @Transactional
+ @Transactional(rollbackFor = Exception.class)
public int updateRole(SysRole role) {
// 淇敼瑙掕壊淇℃伅
baseMapper.updateById(role);
@@ -235,7 +266,7 @@
* @return 缁撴灉
*/
@Override
- @Transactional
+ @Transactional(rollbackFor = Exception.class)
public int authDataScope(SysRole role) {
// 淇敼瑙掕壊淇℃伅
baseMapper.updateById(role);
@@ -261,7 +292,7 @@
list.add(rm);
}
if (list.size() > 0) {
- rows = roleMenuMapper.insertAll(list);
+ rows = roleMenuMapper.insertBatch(list) ? list.size() : 0;
}
return rows;
}
@@ -282,7 +313,7 @@
list.add(rd);
}
if (list.size() > 0) {
- rows = roleDeptMapper.insertAll(list);
+ rows = roleDeptMapper.insertBatch(list) ? list.size() : 0;
}
return rows;
}
@@ -294,7 +325,7 @@
* @return 缁撴灉
*/
@Override
- @Transactional
+ @Transactional(rollbackFor = Exception.class)
public int deleteRoleById(Long roleId) {
// 鍒犻櫎瑙掕壊涓庤彍鍗曞叧鑱�
roleMenuMapper.delete(new LambdaQueryWrapper<SysRoleMenu>().eq(SysRoleMenu::getRoleId, roleId));
@@ -310,13 +341,14 @@
* @return 缁撴灉
*/
@Override
- @Transactional
+ @Transactional(rollbackFor = Exception.class)
public int deleteRoleByIds(Long[] roleIds) {
for (Long roleId : roleIds) {
checkRoleAllowed(new SysRole(roleId));
+ checkRoleDataScope(roleId);
SysRole role = selectRoleById(roleId);
if (countUserRoleByRoleId(roleId) > 0) {
- throw new CustomException(String.format("%1$s宸插垎閰�,涓嶈兘鍒犻櫎", role.getRoleName()));
+ throw new ServiceException(String.format("%1$s宸插垎閰�,涓嶈兘鍒犻櫎", role.getRoleName()));
}
}
List<Long> ids = Arrays.asList(roleIds);
@@ -336,45 +368,45 @@
@Override
public int deleteAuthUser(SysUserRole userRole) {
return userRoleMapper.delete(new LambdaQueryWrapper<SysUserRole>()
- .eq(SysUserRole::getRoleId, userRole.getRoleId())
- .eq(SysUserRole::getUserId, userRole.getUserId()));
+ .eq(SysUserRole::getRoleId, userRole.getRoleId())
+ .eq(SysUserRole::getUserId, userRole.getUserId()));
}
/**
* 鎵归噺鍙栨秷鎺堟潈鐢ㄦ埛瑙掕壊
*
- * @param roleId 瑙掕壊ID
+ * @param roleId 瑙掕壊ID
* @param userIds 闇�瑕佸彇娑堟巿鏉冪殑鐢ㄦ埛鏁版嵁ID
* @return 缁撴灉
*/
@Override
public int deleteAuthUsers(Long roleId, Long[] userIds) {
- return userRoleMapper.delete(new LambdaQueryWrapper<SysUserRole>()
- .eq(SysUserRole::getRoleId, roleId)
- .in(SysUserRole::getUserId, Arrays.asList(userIds)));
+ return userRoleMapper.delete(new LambdaQueryWrapper<SysUserRole>()
+ .eq(SysUserRole::getRoleId, roleId)
+ .in(SysUserRole::getUserId, Arrays.asList(userIds)));
}
/**
* 鎵归噺閫夋嫨鎺堟潈鐢ㄦ埛瑙掕壊
*
- * @param roleId 瑙掕壊ID
- * @param userIds 闇�瑕佸垹闄ょ殑鐢ㄦ埛鏁版嵁ID
+ * @param roleId 瑙掕壊ID
+ * @param userIds 闇�瑕佹巿鏉冪殑鐢ㄦ埛鏁版嵁ID
* @return 缁撴灉
*/
@Override
public int insertAuthUsers(Long roleId, Long[] userIds) {
// 鏂板鐢ㄦ埛涓庤鑹茬鐞�
- int rows = 1;
- List<SysUserRole> list = new ArrayList<SysUserRole>();
+ int rows = 1;
+ List<SysUserRole> list = new ArrayList<SysUserRole>();
for (Long userId : userIds) {
SysUserRole ur = new SysUserRole();
ur.setUserId(userId);
ur.setRoleId(roleId);
list.add(ur);
}
- if (list.size() > 0) {
- rows = userRoleMapper.insertAll(list);
- }
+ if (list.size() > 0) {
+ rows = userRoleMapper.insertBatch(list) ? list.size() : 0;
+ }
return rows;
}
}
--
Gitblit v1.9.3