修复系统越权访问漏洞

puzhibing

2026-08-28 67da53ba6c1992b1ec6ec93a489b186ee375b57c

 ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/controller/SysUserController.java

@@ -114,10 +114,15 @@
    /**
     * 获取用户选择列表
     */
    @RequiresPermissions(value = {"/systemUserManagement", "/accountingStrategy/select", "/accountingStrategy", "/roleManagement/info"}, logical = Logical.OR)
    @PostMapping("/getChangeUserList")
    @ApiOperation(value = "获取用户选择列表", tags = {"管理后台-获取用户选择列表"})
    public AjaxResult<PageInfo<SysUser>> getChangeUserList(@RequestBody ChangeUserQuery query) {
        return AjaxResult.success(userService.getChangeUserList(query));
        PageInfo<SysUser> pageInfo = userService.getChangeUserList(query);
        if (pageInfo != null && pageInfo.getRecords() != null) {
            pageInfo.getRecords().forEach(u -> u.setPassword(null));
        }
        return AjaxResult.success(pageInfo);
    }

    /**
@@ -193,6 +198,7 @@
    /**
     * 根据用户编号获取详细信息
     */
    @RequiresPermissions(value = {"/systemUserManagement/update"}, logical = Logical.OR)
    @ApiOperation(value = "获取用户详情", tags = {"管理后台-系统用户管理"})
    @GetMapping("/getInfo/{userId}")
    public AjaxResult getInfo(@PathVariable Long userId) {
@@ -208,6 +214,7 @@
            List<Site> data = siteClient.getSiteByIds(siteIds).getData();
            List<String> siteNames = data.stream().map(Site::getName).collect(Collectors.toList());
            sysUser.setSiteNames(siteNames);
            sysUser.setPassword(null);
            ajax.put(AjaxResult.DATA_TAG, sysUser);
            ajax.put("postIds", postService.selectPostListByUserId(userId));
            ajax.put("roleIds", sysUser.getRoles().stream().map(SysRole::getRoleId).collect(Collectors.toList()));
@@ -324,12 +331,14 @@
    }


    @InnerAuth
    @PostMapping("/getUserList")
    public R<List<SysUser>> getUserList(@RequestBody List<Integer> userIds) {
        List<SysUser> list = userService.list(new LambdaQueryWrapper<SysUser>().in(SysUser::getUserId, userIds));
        return R.ok(list);
    }

    @InnerAuth
    @PostMapping("/getSysUserFromCompanyId")
    public R<List<CompanyUserListVo>> getSysUserFromCompanyId(@RequestBody CompanySysUserReq companySysUserReq) {
        LambdaQueryWrapper<SysUser> sysUserLambdaQueryWrapper = new LambdaQueryWrapper<>();
@@ -377,6 +386,7 @@
        }
        return R.ok(companyUserListVos);
    }
    @InnerAuth
    @PostMapping("/isAdmin")
    public R<Integer> isAdmin(@RequestBody Long userId){
        SysUserRole one = sysUserRoleService.getOne(new LambdaQueryWrapper<SysUserRole>().eq(SysUserRole::getUserId, userId));
@@ -384,6 +394,7 @@
        return R.ok(id.intValue());
    }

    @InnerAuth
    @PostMapping("/getSysUser")
    public R<SysUser> getSysUser(@RequestParam("userId") Long userId) {
        try {
@@ -395,6 +406,7 @@
        }
    }

    @InnerAuth
    @PostMapping("/updateSysUser")
    @Transactional(rollbackFor = Exception.class)
    public R<Boolean> updateSysUser(@RequestBody SysUser sysUser) {
@@ -417,6 +429,7 @@
    }


    @InnerAuth
    @PostMapping("/companySaveSysUser")
    public R<List<Integer>> companySaveSysUser(@RequestBody CompanyAddSysUserDto dto) {
        List<CompanyUserListVo> list = dto.getList();
@@ -466,6 +479,7 @@
    }


    @InnerAuth
    @PostMapping("/addTRepairSysUser")
    public R<List<Integer>> addTRepairSysUser(@RequestBody TRepairShopAddDto dto) {
        List<TRepairShopAdd> list = dto.getList();
@@ -548,6 +562,7 @@
        Set<String> roles = permissionService.getRolePermission(user);
        // 权限集合
        Set<String> permissions = permissionService.getMenuPermission(user);
        user.setPassword(null);
        AjaxResult ajax = AjaxResult.success();
        ajax.put("user", user);
        ajax.put("roles", roles);
@@ -698,6 +713,7 @@
    /**
     * 状态修改
     */
    @RequiresPermissions(value = {"/systemUserManagement/forbidden"}, logical = Logical.OR)
    @Log(title = "用户管理", businessType = BusinessType.UPDATE)
    @PutMapping("/changeStatus")
    public AjaxResult changeStatus(@RequestBody SysUser user) {
@@ -710,11 +726,14 @@
    /**
     * 根据用户编号获取授权角色
     */
    @RequiresPermissions(value = {"/systemUserManagement", "/roleManagement/info"}, logical = Logical.OR)
    @GetMapping("/authRole/{userId}")
    public AjaxResult authRole(@PathVariable("userId") Long userId) {
        userService.checkUserDataScope(userId);
        AjaxResult ajax = AjaxResult.success();
        SysUser user = userService.selectUserById(userId);
        List<SysRole> roles = roleService.selectRolesByUserId(userId);
        user.setPassword(null);
        ajax.put("user", user);
        ajax.put("roles", SysUser.isAdmin(userId) ? roles : roles.stream().filter(r -> !r.isAdmin()).collect(Collectors.toList()));
        return ajax;
@@ -723,6 +742,7 @@
    /**
     * 用户授权角色
     */
    @RequiresPermissions(value = {"/systemUserManagement/update", "/roleManagement/info"}, logical = Logical.OR)
    @Log(title = "用户管理", businessType = BusinessType.GRANT)
    @PutMapping("/authRole")
    public AjaxResult insertAuthRole(Long userId, Long[] roleIds) {
@@ -734,11 +754,13 @@
    /**
     * 获取部门树列表
     */
    @RequiresPermissions(value = {"/systemUserManagement", "/roleManagement/info"}, logical = Logical.OR)
    @GetMapping("/deptTree")
    public AjaxResult deptTree(SysDept dept) {
        return success(deptService.selectDeptTreeList(dept));
    }

    @InnerAuth
    @PostMapping("/updateUser")
    public R<Boolean>  updateUser(@RequestBody SysUser sysUser){
        return R.ok(userService.updateById(sysUser));
@@ -749,6 +771,7 @@
     * @param userId
     * @return
     */
    @InnerAuth
    @PostMapping("/queryRoleByUserId/{userId}")
    public R<SysRole> queryRoleByUserId(@PathVariable("userId") Long userId){
        SysUserRole one = sysUserRoleService.getOne(Wrappers.lambdaQuery(SysUserRole.class)
@@ -765,6 +788,7 @@
    }


    @InnerAuth
    @PostMapping("/queryRoleByRoleId/{roleId}")
    public R<SysRole> queryRoleByRoleId(@PathVariable("roleId") Long roleId){
        return R.ok( roleService.getOne(Wrappers.lambdaQuery(SysRole.class)
@@ -777,6 +801,7 @@
     * @param phoneList
     * @return
     */
    @InnerAuth
    @PostMapping("/queryUserByPhoneList")
    public R<List<SysUser>> queryUserByPhoneList(@RequestBody List<String> phoneList){
        List<SysUser> list = userService.list(Wrappers.lambdaQuery(SysUser.class)
@@ -790,6 +815,7 @@
     * @param dtoList
     * @return
     */
    @InnerAuth
    @PostMapping("/addUserRole")
    public R<Boolean> addUserRole(@RequestBody List<SysUserRoleDTO> dtoList){
        List<SysUserRole> userRoles = new ArrayList<>();
@@ -807,6 +833,7 @@
     * @param phone
     * @return
     */
    @InnerAuth
    @PostMapping("/queryUserByPhone")
    public R<SysUser>  queryUserByPhone(@RequestBody String phone){
        SysUser user = userService.getOne(Wrappers.lambdaQuery(SysUser.class)
@@ -822,6 +849,7 @@
     * @return
     */
    @ResponseBody
    @InnerAuth
    @PostMapping("/queryUserByUserName")
    public R<SysUser> queryUserByUserName(@RequestBody String userName){
        SysUser user = userService.getOne(Wrappers.lambdaQuery(SysUser.class)
@@ -836,6 +864,7 @@
     * @param user
     */
    @ResponseBody
    @InnerAuth
    @PostMapping("/addSysUser")
    @Transactional(rollbackFor = Exception.class)
    public R<Long> addSysUser(@RequestBody SysUser user) {
@@ -867,6 +896,7 @@
    
    
    @ResponseBody
    @InnerAuth
    @PostMapping("/resetPassword")
    public R resetPassword(@RequestBody SysUser user) {
        user.setPassword(SecurityUtils.encryptPassword(user.getPassword()));
@@ -877,6 +907,7 @@
    
    
    @ResponseBody
    @InnerAuth
    @PostMapping("/getSysUserById")
    public SysUser getSysUserById(@RequestParam("userId") Long userId){
        return userService.getById(userId);