删除越权漏洞修复中的内部调用注解

longz

2026-08-28 3e6094c1c71f71824890baaf9163d66a76bb4433

 ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/controller/SysUserRoleController.java

@@ -17,6 +17,8 @@
import com.ruoyi.common.log.annotation.Log;
import com.ruoyi.common.log.enums.BusinessType;
import com.ruoyi.common.security.annotation.RequiresPermissions;
import com.ruoyi.common.security.annotation.InnerAuth;
import com.ruoyi.common.security.annotation.Logical;
import com.ruoyi.common.core.web.controller.BaseController;
import com.ruoyi.common.core.web.domain.AjaxResult;
import com.ruoyi.common.core.utils.poi.ExcelUtil;
@@ -37,7 +39,7 @@
   /**
    * 查询用户和角色关联列表
    */
   @RequiresPermissions("car:role:list")
   @RequiresPermissions(value = {"/systemUserManagement", "/roleManagement/info"}, logical = Logical.OR)
   @GetMapping("/list")
   public TableDataInfo list(SysUserRole sysUserRole) {
      startPage();
@@ -48,7 +50,7 @@
   /**
    * 导出用户和角色关联列表
    */
   @RequiresPermissions("car:role:export")
   @RequiresPermissions(value = {"/systemUserManagement", "/roleManagement/info"}, logical = Logical.OR)
   @Log(title = "用户和角色关联", businessType = BusinessType.EXPORT)
   @PostMapping("/export")
   public void export(HttpServletResponse response, SysUserRole sysUserRole) {
@@ -60,7 +62,7 @@
   /**
    * 获取用户和角色关联详细信息
    */
   @RequiresPermissions("car:role:query")
   @RequiresPermissions(value = {"/systemUserManagement", "/roleManagement/info"}, logical = Logical.OR)
   @GetMapping(value = "/{userId}")
   public AjaxResult getInfo(@PathVariable("userId") Long userId) {
      return success(sysUserRoleService.selectSysUserRoleByUserId(userId));
@@ -69,7 +71,7 @@
   /**
    * 新增用户和角色关联
    */
   @RequiresPermissions("car:role:add")
   @RequiresPermissions(value = {"/systemUserManagement/add", "/systemUserManagement/update"}, logical = Logical.OR)
   @Log(title = "用户和角色关联", businessType = BusinessType.INSERT)
   @PostMapping
   public AjaxResult add(@RequestBody SysUserRole sysUserRole) {
@@ -79,7 +81,7 @@
   /**
    * 修改用户和角色关联
    */
   @RequiresPermissions("car:role:edit")
   @RequiresPermissions(value = {"/systemUserManagement/update", "/systemUserManagement/del"}, logical = Logical.OR)
   @Log(title = "用户和角色关联", businessType = BusinessType.UPDATE)
   @PutMapping
   public AjaxResult edit(@RequestBody SysUserRole sysUserRole) {
@@ -89,7 +91,7 @@
   /**
    * 删除用户和角色关联
    */
   @RequiresPermissions("car:role:remove")
   @RequiresPermissions(value = {"/systemUserManagement/del"}, logical = Logical.OR)
   @Log(title = "用户和角色关联", businessType = BusinessType.DELETE)
   @DeleteMapping("/{userIds}")
   public AjaxResult remove(@PathVariable Long[] userIds) {