修复系统越权访问漏洞

puzhibing

2026-08-28 f103c8c1e09e2475dc4ac4d3ddc1598146e4da38

 ruoyi-service/ruoyi-order/src/main/java/com/ruoyi/order/controller/TChargingOrderController.java

@@ -243,6 +243,7 @@


    @ResponseBody
    @RequiresPermissions(value = {"/paymentOrder/refund", "/paymentOrder/refund/select"}, logical = Logical.OR)
    @PostMapping(value = "/pay/order/refund")
    @ApiOperation(value = "退款", tags = {"管理后台-支付订单-订单信息"})
    public R refund(@RequestBody PayOrderRefundDto payOrderQueryDto) {
@@ -319,6 +320,7 @@


    @ResponseBody
    @RequiresPermissions(value = {"/paymentOrder/refund", "/paymentOrder/refund/select"}, logical = Logical.OR)
    @GetMapping(value = "/pay/order/refund/detail")
    @ApiOperation(value = "退款信息", tags = {"管理后台-支付订单-订单信息"})
    public R refundDetail(Long orderId, Integer type) {
@@ -339,6 +341,7 @@
    }

    @ResponseBody
    @RequiresPermissions(value = {"/paymentOrder/order"}, logical = Logical.OR)
    @GetMapping(value = "/pay/order/charging")
    @ApiOperation(value = "充电信息", tags = {"管理后台-支付订单-订单信息"})
    public R<PayOrderChargingInfo> refundDetail(Long orderId) {
@@ -370,6 +373,7 @@
    }

    @ResponseBody
    @RequiresPermissions(value = {"/paymentOrder/order"}, logical = Logical.OR)
    @GetMapping(value = "/pay/order/charging/details")
    @ApiOperation(value = "充电明细", tags = {"管理后台-支付订单-订单信息"})
    public R<List<TChargingOrderAccountingStrategy>> chargingDetail(Long orderId) {