删除越权漏洞修复中的内部调用注解

longz

2026-08-28 3e6094c1c71f71824890baaf9163d66a76bb4433

 ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/controller/SysUserController.java

@@ -114,10 +114,15 @@
    /**
     * 获取用户选择列表
     */
    @RequiresPermissions(value = {"/systemUserManagement", "/accountingStrategy/select", "/accountingStrategy", "/roleManagement/info"}, logical = Logical.OR)
    @PostMapping("/getChangeUserList")
    @ApiOperation(value = "获取用户选择列表", tags = {"管理后台-获取用户选择列表"})
    public AjaxResult<PageInfo<SysUser>> getChangeUserList(@RequestBody ChangeUserQuery query) {
        return AjaxResult.success(userService.getChangeUserList(query));
        PageInfo<SysUser> pageInfo = userService.getChangeUserList(query);
        if (pageInfo != null && pageInfo.getRecords() != null) {
            pageInfo.getRecords().forEach(u -> u.setPassword(null));
        }
        return AjaxResult.success(pageInfo);
    }

    /**
@@ -193,6 +198,7 @@
    /**
     * 根据用户编号获取详细信息
     */
    @RequiresPermissions(value = {"/systemUserManagement/update"}, logical = Logical.OR)
    @ApiOperation(value = "获取用户详情", tags = {"管理后台-系统用户管理"})
    @GetMapping("/getInfo/{userId}")
    public AjaxResult getInfo(@PathVariable Long userId) {
@@ -208,6 +214,7 @@
            List<Site> data = siteClient.getSiteByIds(siteIds).getData();
            List<String> siteNames = data.stream().map(Site::getName).collect(Collectors.toList());
            sysUser.setSiteNames(siteNames);
            sysUser.setPassword(null);
            ajax.put(AjaxResult.DATA_TAG, sysUser);
            ajax.put("postIds", postService.selectPostListByUserId(userId));
            ajax.put("roleIds", sysUser.getRoles().stream().map(SysRole::getRoleId).collect(Collectors.toList()));
@@ -501,7 +508,6 @@
    /**
     * 获取当前用户信息
     */
    @InnerAuth
    @GetMapping("/info/{username}")
    public R<LoginUser> info(@PathVariable("username") String username) {
        SysUser sysUser = userService.selectUserByUserName(username);
@@ -548,6 +554,7 @@
        Set<String> roles = permissionService.getRolePermission(user);
        // 权限集合
        Set<String> permissions = permissionService.getMenuPermission(user);
        user.setPassword(null);
        AjaxResult ajax = AjaxResult.success();
        ajax.put("user", user);
        ajax.put("roles", roles);
@@ -698,6 +705,7 @@
    /**
     * 状态修改
     */
    @RequiresPermissions(value = {"/systemUserManagement/forbidden"}, logical = Logical.OR)
    @Log(title = "用户管理", businessType = BusinessType.UPDATE)
    @PutMapping("/changeStatus")
    public AjaxResult changeStatus(@RequestBody SysUser user) {
@@ -710,11 +718,14 @@
    /**
     * 根据用户编号获取授权角色
     */
    @RequiresPermissions(value = {"/systemUserManagement", "/roleManagement/info"}, logical = Logical.OR)
    @GetMapping("/authRole/{userId}")
    public AjaxResult authRole(@PathVariable("userId") Long userId) {
        userService.checkUserDataScope(userId);
        AjaxResult ajax = AjaxResult.success();
        SysUser user = userService.selectUserById(userId);
        List<SysRole> roles = roleService.selectRolesByUserId(userId);
        user.setPassword(null);
        ajax.put("user", user);
        ajax.put("roles", SysUser.isAdmin(userId) ? roles : roles.stream().filter(r -> !r.isAdmin()).collect(Collectors.toList()));
        return ajax;
@@ -723,6 +734,7 @@
    /**
     * 用户授权角色
     */
    @RequiresPermissions(value = {"/systemUserManagement/update", "/roleManagement/info"}, logical = Logical.OR)
    @Log(title = "用户管理", businessType = BusinessType.GRANT)
    @PutMapping("/authRole")
    public AjaxResult insertAuthRole(Long userId, Long[] roleIds) {
@@ -734,6 +746,7 @@
    /**
     * 获取部门树列表
     */
    @RequiresPermissions(value = {"/systemUserManagement", "/roleManagement/info"}, logical = Logical.OR)
    @GetMapping("/deptTree")
    public AjaxResult deptTree(SysDept dept) {
        return success(deptService.selectDeptTreeList(dept));