From f0a9768d8e7ee39e4e6b2e1646e8585504095ea3 Mon Sep 17 00:00:00 2001
From: 疯狂的狮子Li <15040126243@163.com>
Date: 星期六, 11 三月 2023 01:32:38 +0800
Subject: [PATCH] update 优化 重构系统业务数据权限 避免可能存在的越权风险
---
ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/controller/system/SysRoleController.java | 10 ++++------
1 files changed, 4 insertions(+), 6 deletions(-)
diff --git a/ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/controller/system/SysRoleController.java b/ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/controller/system/SysRoleController.java
index 96400f6..4ef7c36 100644
--- a/ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/controller/system/SysRoleController.java
+++ b/ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/controller/system/SysRoleController.java
@@ -22,7 +22,6 @@
import com.ruoyi.system.domain.vo.SysRoleVo;
import com.ruoyi.system.domain.vo.SysUserVo;
import com.ruoyi.system.service.ISysDeptService;
-import com.ruoyi.system.service.ISysPermissionService;
import com.ruoyi.system.service.ISysRoleService;
import com.ruoyi.system.service.ISysUserService;
import jakarta.servlet.http.HttpServletResponse;
@@ -46,7 +45,6 @@
private final ISysRoleService roleService;
private final ISysUserService userService;
private final ISysDeptService deptService;
- private final ISysPermissionService permissionService;
/**
* 鑾峰彇瑙掕壊淇℃伅鍒楄〃
@@ -103,7 +101,7 @@
@Log(title = "瑙掕壊绠＄悊", businessType = BusinessType.UPDATE)
@PutMapping
public R<Void> edit(@Validated @RequestBody SysRoleBo role) {
- roleService.checkRoleAllowed(role);
+ roleService.checkRoleAllowed(role.getRoleId());
roleService.checkRoleDataScope(role.getRoleId());
if (!roleService.checkRoleNameUnique(role)) {
return R.fail("淇敼瑙掕壊'" + role.getRoleName() + "'澶辫触锛岃鑹插悕绉板凡瀛樺湪");
@@ -143,7 +141,7 @@
@Log(title = "瑙掕壊绠＄悊", businessType = BusinessType.UPDATE)
@PutMapping("/dataScope")
public R<Void> dataScope(@RequestBody SysRoleBo role) {
- roleService.checkRoleAllowed(role);
+ roleService.checkRoleAllowed(role.getRoleId());
roleService.checkRoleDataScope(role.getRoleId());
return toAjax(roleService.authDataScope(role));
}
@@ -155,9 +153,9 @@
@Log(title = "瑙掕壊绠＄悊", businessType = BusinessType.UPDATE)
@PutMapping("/changeStatus")
public R<Void> changeStatus(@RequestBody SysRoleBo role) {
- roleService.checkRoleAllowed(role);
+ roleService.checkRoleAllowed(role.getRoleId());
roleService.checkRoleDataScope(role.getRoleId());
- return toAjax(roleService.updateRoleStatus(role));
+ return toAjax(roleService.updateRoleStatus(role.getRoleId(), role.getStatus()));
}
/**
--
Gitblit v1.9.3