修复系统越权访问漏洞

puzhibing

2026-08-28 67da53ba6c1992b1ec6ec93a489b186ee375b57c

 ruoyi-service/ruoyi-order/src/main/java/com/ruoyi/order/controller/TChargingOrderController.java

@@ -1179,6 +1179,7 @@


    @ResponseBody
    @RequiresPermissions(value = {"/paymentOrder/refund", "/paymentOrder/refund/select"}, logical = Logical.OR)
    @PostMapping(value = "/pay/order/refund")
    @ApiOperation(value = "退款", tags = {"管理后台-支付订单-订单信息"})
    public R refund(@RequestBody PayOrderRefundDto payOrderQueryDto) {
@@ -1275,6 +1276,7 @@


    @ResponseBody
    @RequiresPermissions(value = {"/paymentOrder/refund", "/paymentOrder/refund/select"}, logical = Logical.OR)
    @GetMapping(value = "/pay/order/refund/detail")
    @ApiOperation(value = "退款信息", tags = {"管理后台-支付订单-订单信息"})
    public R refundDetail(Long orderId, Integer type) {
@@ -1295,6 +1297,7 @@
    }

    @ResponseBody
    @RequiresPermissions(value = {"/paymentOrder/order"}, logical = Logical.OR)
    @GetMapping(value = "/pay/order/charging")
    @ApiOperation(value = "充电信息", tags = {"管理后台-支付订单-订单信息"})
    public R<PayOrderChargingInfo> refundDetail(Long orderId) {
@@ -1326,6 +1329,7 @@
    }

    @ResponseBody
    @RequiresPermissions(value = {"/paymentOrder/order"}, logical = Logical.OR)
    @GetMapping(value = "/pay/order/charging/details")
    @ApiOperation(value = "充电明细", tags = {"管理后台-支付订单-订单信息"})
    public R<List<TChargingOrderAccountingStrategy>> chargingDetail(Long orderId) {