From f0a9768d8e7ee39e4e6b2e1646e8585504095ea3 Mon Sep 17 00:00:00 2001
From: 疯狂的狮子Li <15040126243@163.com>
Date: 星期六, 11 三月 2023 01:32:38 +0800
Subject: [PATCH] update 优化 重构系统业务数据权限 避免可能存在的越权风险
---
ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/controller/system/SysUserController.java | 10 +++++-----
1 files changed, 5 insertions(+), 5 deletions(-)
diff --git a/ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/controller/system/SysUserController.java b/ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/controller/system/SysUserController.java
index bc067a5..b071853 100644
--- a/ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/controller/system/SysUserController.java
+++ b/ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/controller/system/SysUserController.java
@@ -145,7 +145,7 @@
@Log(title = "鐢ㄦ埛绠＄悊", businessType = BusinessType.UPDATE)
@PutMapping
public R<Void> edit(@Validated @RequestBody SysUserBo user) {
- userService.checkUserAllowed(user);
+ userService.checkUserAllowed(user.getUserId());
userService.checkUserDataScope(user.getUserId());
if (!userService.checkUserNameUnique(user)) {
return R.fail("淇敼鐢ㄦ埛'" + user.getUserName() + "'澶辫触锛岀櫥褰曡处鍙峰凡瀛樺湪");
@@ -179,10 +179,10 @@
@Log(title = "鐢ㄦ埛绠＄悊", businessType = BusinessType.UPDATE)
@PutMapping("/resetPwd")
public R<Void> resetPwd(@RequestBody SysUserBo user) {
- userService.checkUserAllowed(user);
+ userService.checkUserAllowed(user.getUserId());
userService.checkUserDataScope(user.getUserId());
user.setPassword(BCrypt.hashpw(user.getPassword()));
- return toAjax(userService.resetUserPwd(user.getUserId(),user.getPassword()));
+ return toAjax(userService.resetUserPwd(user.getUserId(), user.getPassword()));
}
/**
@@ -192,9 +192,9 @@
@Log(title = "鐢ㄦ埛绠＄悊", businessType = BusinessType.UPDATE)
@PutMapping("/changeStatus")
public R<Void> changeStatus(@RequestBody SysUserBo user) {
- userService.checkUserAllowed(user);
+ userService.checkUserAllowed(user.getUserId());
userService.checkUserDataScope(user.getUserId());
- return toAjax(userService.updateUserStatus(user));
+ return toAjax(userService.updateUserStatus(user.getUserId(), user.getStatus()));
}
/**
--
Gitblit v1.9.3