From 3e6094c1c71f71824890baaf9163d66a76bb4433 Mon Sep 17 00:00:00 2001
From: longz <longzhaoz@qq.com>
Date: 星期五, 28 八月 2026 17:18:34 +0800
Subject: [PATCH] 删除越权漏洞修复中的内部调用注解
---
ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/controller/SysOperlogController.java | 1 -
ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/controller/SysUserController.java | 18 ------------------
ruoyi-service/ruoyi-account/src/main/java/com/ruoyi/account/controller/TAppUserController.java | 1 -
ruoyi-service/ruoyi-chargingPile/src/main/java/com/ruoyi/chargingPile/controller/TChargingGunController.java | 11 -----------
ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/controller/SysUserRoleController.java | 1 -
5 files changed, 0 insertions(+), 32 deletions(-)
diff --git a/ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/controller/SysOperlogController.java b/ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/controller/SysOperlogController.java
index 2c72a37..bfd1431 100644
--- a/ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/controller/SysOperlogController.java
+++ b/ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/controller/SysOperlogController.java
@@ -83,7 +83,6 @@
return success();
}
- @InnerAuth
@PostMapping
public AjaxResult add(@RequestBody SysOperLog operLog) {
return toAjax(operLogService.insertOperlog(operLog));
diff --git a/ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/controller/SysUserController.java b/ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/controller/SysUserController.java
index 3524ecb..b8db3cc 100644
--- a/ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/controller/SysUserController.java
+++ b/ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/controller/SysUserController.java
@@ -331,14 +331,12 @@
}
- @InnerAuth
@PostMapping("/getUserList")
public R<List<SysUser>> getUserList(@RequestBody List<Integer> userIds) {
List<SysUser> list = userService.list(new LambdaQueryWrapper<SysUser>().in(SysUser::getUserId, userIds));
return R.ok(list);
}
- @InnerAuth
@PostMapping("/getSysUserFromCompanyId")
public R<List<CompanyUserListVo>> getSysUserFromCompanyId(@RequestBody CompanySysUserReq companySysUserReq) {
LambdaQueryWrapper<SysUser> sysUserLambdaQueryWrapper = new LambdaQueryWrapper<>();
@@ -386,7 +384,6 @@
}
return R.ok(companyUserListVos);
}
- @InnerAuth
@PostMapping("/isAdmin")
public R<Integer> isAdmin(@RequestBody Long userId){
SysUserRole one = sysUserRoleService.getOne(new LambdaQueryWrapper<SysUserRole>().eq(SysUserRole::getUserId, userId));
@@ -394,7 +391,6 @@
return R.ok(id.intValue());
}
- @InnerAuth
@PostMapping("/getSysUser")
public R<SysUser> getSysUser(@RequestParam("userId") Long userId) {
try {
@@ -406,7 +402,6 @@
}
}
- @InnerAuth
@PostMapping("/updateSysUser")
@Transactional(rollbackFor = Exception.class)
public R<Boolean> updateSysUser(@RequestBody SysUser sysUser) {
@@ -429,7 +424,6 @@
}
- @InnerAuth
@PostMapping("/companySaveSysUser")
public R<List<Integer>> companySaveSysUser(@RequestBody CompanyAddSysUserDto dto) {
List<CompanyUserListVo> list = dto.getList();
@@ -479,7 +473,6 @@
}
- @InnerAuth
@PostMapping("/addTRepairSysUser")
public R<List<Integer>> addTRepairSysUser(@RequestBody TRepairShopAddDto dto) {
List<TRepairShopAdd> list = dto.getList();
@@ -515,7 +508,6 @@
/**
* 获取当前用户信息
*/
- @InnerAuth
@GetMapping("/info/{username}")
public R<LoginUser> info(@PathVariable("username") String username) {
SysUser sysUser = userService.selectUserByUserName(username);
@@ -760,7 +752,6 @@
return success(deptService.selectDeptTreeList(dept));
}
- @InnerAuth
@PostMapping("/updateUser")
public R<Boolean> updateUser(@RequestBody SysUser sysUser){
return R.ok(userService.updateById(sysUser));
@@ -771,7 +762,6 @@
* @param userId
* @return
*/
- @InnerAuth
@PostMapping("/queryRoleByUserId/{userId}")
public R<SysRole> queryRoleByUserId(@PathVariable("userId") Long userId){
SysUserRole one = sysUserRoleService.getOne(Wrappers.lambdaQuery(SysUserRole.class)
@@ -788,7 +778,6 @@
}
- @InnerAuth
@PostMapping("/queryRoleByRoleId/{roleId}")
public R<SysRole> queryRoleByRoleId(@PathVariable("roleId") Long roleId){
return R.ok( roleService.getOne(Wrappers.lambdaQuery(SysRole.class)
@@ -801,7 +790,6 @@
* @param phoneList
* @return
*/
- @InnerAuth
@PostMapping("/queryUserByPhoneList")
public R<List<SysUser>> queryUserByPhoneList(@RequestBody List<String> phoneList){
List<SysUser> list = userService.list(Wrappers.lambdaQuery(SysUser.class)
@@ -815,7 +803,6 @@
* @param dtoList
* @return
*/
- @InnerAuth
@PostMapping("/addUserRole")
public R<Boolean> addUserRole(@RequestBody List<SysUserRoleDTO> dtoList){
List<SysUserRole> userRoles = new ArrayList<>();
@@ -833,7 +820,6 @@
* @param phone
* @return
*/
- @InnerAuth
@PostMapping("/queryUserByPhone")
public R<SysUser> queryUserByPhone(@RequestBody String phone){
SysUser user = userService.getOne(Wrappers.lambdaQuery(SysUser.class)
@@ -849,7 +835,6 @@
* @return
*/
@ResponseBody
- @InnerAuth
@PostMapping("/queryUserByUserName")
public R<SysUser> queryUserByUserName(@RequestBody String userName){
SysUser user = userService.getOne(Wrappers.lambdaQuery(SysUser.class)
@@ -864,7 +849,6 @@
* @param user
*/
@ResponseBody
- @InnerAuth
@PostMapping("/addSysUser")
@Transactional(rollbackFor = Exception.class)
public R<Long> addSysUser(@RequestBody SysUser user) {
@@ -896,7 +880,6 @@
@ResponseBody
- @InnerAuth
@PostMapping("/resetPassword")
public R resetPassword(@RequestBody SysUser user) {
user.setPassword(SecurityUtils.encryptPassword(user.getPassword()));
@@ -907,7 +890,6 @@
@ResponseBody
- @InnerAuth
@PostMapping("/getSysUserById")
public SysUser getSysUserById(@RequestParam("userId") Long userId){
return userService.getById(userId);
diff --git a/ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/controller/SysUserRoleController.java b/ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/controller/SysUserRoleController.java
index 1808034..2e6a8b1 100644
--- a/ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/controller/SysUserRoleController.java
+++ b/ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/controller/SysUserRoleController.java
@@ -104,7 +104,6 @@
* @param userId
* @return
*/
- @InnerAuth
@PostMapping("/getRoleByUserId")
public R<List<SysUserRoleVo>> getRoleByUserId(@RequestParam("userId") Long userId){
List<SysUserRole> list = sysUserRoleService.list(new LambdaQueryWrapper<SysUserRole>().eq(SysUserRole::getUserId, userId));
diff --git a/ruoyi-service/ruoyi-account/src/main/java/com/ruoyi/account/controller/TAppUserController.java b/ruoyi-service/ruoyi-account/src/main/java/com/ruoyi/account/controller/TAppUserController.java
index fb2c2e2..50e2732 100644
--- a/ruoyi-service/ruoyi-account/src/main/java/com/ruoyi/account/controller/TAppUserController.java
+++ b/ruoyi-service/ruoyi-account/src/main/java/com/ruoyi/account/controller/TAppUserController.java
@@ -271,7 +271,6 @@
* 远程调用 积分兑换订单 退款回退积分
* @return
*/
- @InnerAuth
@PostMapping(value = "/refundPoints/{param}")
public R refundPoints(@PathVariable("param")String param) {
String[] split = param.split("-");
diff --git a/ruoyi-service/ruoyi-chargingPile/src/main/java/com/ruoyi/chargingPile/controller/TChargingGunController.java b/ruoyi-service/ruoyi-chargingPile/src/main/java/com/ruoyi/chargingPile/controller/TChargingGunController.java
index 1f67b80..3fac4f5 100644
--- a/ruoyi-service/ruoyi-chargingPile/src/main/java/com/ruoyi/chargingPile/controller/TChargingGunController.java
+++ b/ruoyi-service/ruoyi-chargingPile/src/main/java/com/ruoyi/chargingPile/controller/TChargingGunController.java
@@ -74,7 +74,6 @@
* 新增临时枪
* @return
*/
- @InnerAuth
@PostMapping("/addGunTemp")
@ResponseBody
R<Integer> addGunTemp(@RequestBody TChargingGun gun){
@@ -84,7 +83,6 @@
/**
* 查询所有枪
*/
- @InnerAuth
@PostMapping(value = "/getAllGun")
@ResponseBody
public R<List<TChargingGun>> getAllGun() {
@@ -93,7 +91,6 @@
/**
* 查询所有桩
*/
- @InnerAuth
@PostMapping(value = "/getAllPile")
public R<List<TChargingPile>> getAllPile() {
return R.ok(chargingPileService.list());
@@ -292,7 +289,6 @@
* @return
*/
@ResponseBody
- @InnerAuth
@PostMapping(value = "/getAllName/{id}")
public R<String> getAllName(@PathVariable Integer id){
TChargingGun chargingGun = chargingGunService.getById(id);
@@ -307,7 +303,6 @@
* @return
*/
@ResponseBody
- @InnerAuth
@PostMapping(value = "/getChargingGunById/{id}")
public R<TChargingGun> getChargingGunById(@PathVariable Integer id){
TChargingGun chargingGun = chargingGunService.getById(id);
@@ -327,7 +322,6 @@
* @return
*/
@ResponseBody
- @InnerAuth
@PostMapping(value = "/getAllInfoById/{id}")
public R<SiteNameVO> getAllInfoById(@PathVariable Integer id){
SiteNameVO siteNameVO = new SiteNameVO();
@@ -346,7 +340,6 @@
* @param code
* @return
*/
- @InnerAuth
@PostMapping("/getChargingGunByCode")
public R<TChargingGun> getChargingGunByCode(@RequestBody GetChargingGunByCode code){
TChargingPile chargingPile = chargingPileService.getOne(new LambdaQueryWrapper<TChargingPile>()
@@ -367,7 +360,6 @@
* @param chargingGun
* @return
*/
- @InnerAuth
@PostMapping("/updateChargingGunById")
public R<String> updateChargingGunById(@RequestBody TChargingGun chargingGun){
chargingGunService.updateById(chargingGun);
@@ -381,7 +373,6 @@
* @param chargingPileId
* @return
*/
- @InnerAuth
@PostMapping("/getChargingGunByChargingPileId")
public R<List<TChargingGun>> getChargingGunByChargingPileId(@RequestParam("chargingPileId") Integer chargingPileId){
List<TChargingGun> list = chargingGunService.list(new LambdaQueryWrapper<TChargingGun>().eq(TChargingGun::getChargingPileId, chargingPileId)
@@ -394,7 +385,6 @@
* 根据充电桩ids获取枪
* @return
*/
- @InnerAuth
@PostMapping("/getChargingGunByChargingPileIds")
public R<List<TChargingGun>> getChargingGunByChargingPileIds(@RequestBody GetChargingGunByChargingPileIdsVo vo){
if(vo.getChargingPileIds().isEmpty()){
@@ -410,7 +400,6 @@
* 根据枪唯一码查询信息
* @return
*/
- @InnerAuth
@PostMapping("/getChargingGunByFullNumber")
public R<TChargingGun> getChargingGunByFullNumber(@RequestParam("fullNumber") String fullNumber){
TChargingGun chargingGun = chargingGunService.getOne(new LambdaQueryWrapper<TChargingGun>().eq(TChargingGun::getDelFlag, 0).eq(TChargingGun::getFullNumber, fullNumber));
--
Gitblit v1.7.1