删除越权漏洞修复中的内部调用注解

longz

2026-08-28 3e6094c1c71f71824890baaf9163d66a76bb4433

 ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/controller/SysUserController.java

@@ -331,14 +331,12 @@
    }


    @InnerAuth
    @PostMapping("/getUserList")
    public R<List<SysUser>> getUserList(@RequestBody List<Integer> userIds) {
        List<SysUser> list = userService.list(new LambdaQueryWrapper<SysUser>().in(SysUser::getUserId, userIds));
        return R.ok(list);
    }

    @InnerAuth
    @PostMapping("/getSysUserFromCompanyId")
    public R<List<CompanyUserListVo>> getSysUserFromCompanyId(@RequestBody CompanySysUserReq companySysUserReq) {
        LambdaQueryWrapper<SysUser> sysUserLambdaQueryWrapper = new LambdaQueryWrapper<>();
@@ -386,7 +384,6 @@
        }
        return R.ok(companyUserListVos);
    }
    @InnerAuth
    @PostMapping("/isAdmin")
    public R<Integer> isAdmin(@RequestBody Long userId){
        SysUserRole one = sysUserRoleService.getOne(new LambdaQueryWrapper<SysUserRole>().eq(SysUserRole::getUserId, userId));
@@ -394,7 +391,6 @@
        return R.ok(id.intValue());
    }

    @InnerAuth
    @PostMapping("/getSysUser")
    public R<SysUser> getSysUser(@RequestParam("userId") Long userId) {
        try {
@@ -406,7 +402,6 @@
        }
    }

    @InnerAuth
    @PostMapping("/updateSysUser")
    @Transactional(rollbackFor = Exception.class)
    public R<Boolean> updateSysUser(@RequestBody SysUser sysUser) {
@@ -429,7 +424,6 @@
    }


    @InnerAuth
    @PostMapping("/companySaveSysUser")
    public R<List<Integer>> companySaveSysUser(@RequestBody CompanyAddSysUserDto dto) {
        List<CompanyUserListVo> list = dto.getList();
@@ -479,7 +473,6 @@
    }


    @InnerAuth
    @PostMapping("/addTRepairSysUser")
    public R<List<Integer>> addTRepairSysUser(@RequestBody TRepairShopAddDto dto) {
        List<TRepairShopAdd> list = dto.getList();
@@ -515,7 +508,6 @@
    /**
     * 获取当前用户信息
     */
    @InnerAuth
    @GetMapping("/info/{username}")
    public R<LoginUser> info(@PathVariable("username") String username) {
        SysUser sysUser = userService.selectUserByUserName(username);
@@ -760,7 +752,6 @@
        return success(deptService.selectDeptTreeList(dept));
    }

    @InnerAuth
    @PostMapping("/updateUser")
    public R<Boolean>  updateUser(@RequestBody SysUser sysUser){
        return R.ok(userService.updateById(sysUser));
@@ -771,7 +762,6 @@
     * @param userId
     * @return
     */
    @InnerAuth
    @PostMapping("/queryRoleByUserId/{userId}")
    public R<SysRole> queryRoleByUserId(@PathVariable("userId") Long userId){
        SysUserRole one = sysUserRoleService.getOne(Wrappers.lambdaQuery(SysUserRole.class)
@@ -788,7 +778,6 @@
    }


    @InnerAuth
    @PostMapping("/queryRoleByRoleId/{roleId}")
    public R<SysRole> queryRoleByRoleId(@PathVariable("roleId") Long roleId){
        return R.ok( roleService.getOne(Wrappers.lambdaQuery(SysRole.class)
@@ -801,7 +790,6 @@
     * @param phoneList
     * @return
     */
    @InnerAuth
    @PostMapping("/queryUserByPhoneList")
    public R<List<SysUser>> queryUserByPhoneList(@RequestBody List<String> phoneList){
        List<SysUser> list = userService.list(Wrappers.lambdaQuery(SysUser.class)
@@ -815,7 +803,6 @@
     * @param dtoList
     * @return
     */
    @InnerAuth
    @PostMapping("/addUserRole")
    public R<Boolean> addUserRole(@RequestBody List<SysUserRoleDTO> dtoList){
        List<SysUserRole> userRoles = new ArrayList<>();
@@ -833,7 +820,6 @@
     * @param phone
     * @return
     */
    @InnerAuth
    @PostMapping("/queryUserByPhone")
    public R<SysUser>  queryUserByPhone(@RequestBody String phone){
        SysUser user = userService.getOne(Wrappers.lambdaQuery(SysUser.class)
@@ -849,7 +835,6 @@
     * @return
     */
    @ResponseBody
    @InnerAuth
    @PostMapping("/queryUserByUserName")
    public R<SysUser> queryUserByUserName(@RequestBody String userName){
        SysUser user = userService.getOne(Wrappers.lambdaQuery(SysUser.class)
@@ -864,7 +849,6 @@
     * @param user
     */
    @ResponseBody
    @InnerAuth
    @PostMapping("/addSysUser")
    @Transactional(rollbackFor = Exception.class)
    public R<Long> addSysUser(@RequestBody SysUser user) {
@@ -896,7 +880,6 @@
    
    
    @ResponseBody
    @InnerAuth
    @PostMapping("/resetPassword")
    public R resetPassword(@RequestBody SysUser user) {
        user.setPassword(SecurityUtils.encryptPassword(user.getPassword()));
@@ -907,7 +890,6 @@
    
    
    @ResponseBody
    @InnerAuth
    @PostMapping("/getSysUserById")
    public SysUser getSysUserById(@RequestParam("userId") Long userId){
        return userService.getById(userId);