From 67da53ba6c1992b1ec6ec93a489b186ee375b57c Mon Sep 17 00:00:00 2001
From: puzhibing <393733352@qq.com>
Date: 星期五, 28 八月 2026 16:19:36 +0800
Subject: [PATCH] 修复系统越权访问漏洞
---
ruoyi-service/ruoyi-order/src/main/java/com/ruoyi/order/controller/TChargingOrderController.java | 4 ++++
1 files changed, 4 insertions(+), 0 deletions(-)
diff --git a/ruoyi-service/ruoyi-order/src/main/java/com/ruoyi/order/controller/TChargingOrderController.java b/ruoyi-service/ruoyi-order/src/main/java/com/ruoyi/order/controller/TChargingOrderController.java
index 18b830f..9cfc129 100644
--- a/ruoyi-service/ruoyi-order/src/main/java/com/ruoyi/order/controller/TChargingOrderController.java
+++ b/ruoyi-service/ruoyi-order/src/main/java/com/ruoyi/order/controller/TChargingOrderController.java
@@ -1179,6 +1179,7 @@
@ResponseBody
+ @RequiresPermissions(value = {"/paymentOrder/refund", "/paymentOrder/refund/select"}, logical = Logical.OR)
@PostMapping(value = "/pay/order/refund")
@ApiOperation(value = "退款", tags = {"管理后台-支付订单-订单信息"})
public R refund(@RequestBody PayOrderRefundDto payOrderQueryDto) {
@@ -1275,6 +1276,7 @@
@ResponseBody
+ @RequiresPermissions(value = {"/paymentOrder/refund", "/paymentOrder/refund/select"}, logical = Logical.OR)
@GetMapping(value = "/pay/order/refund/detail")
@ApiOperation(value = "退款信息", tags = {"管理后台-支付订单-订单信息"})
public R refundDetail(Long orderId, Integer type) {
@@ -1295,6 +1297,7 @@
}
@ResponseBody
+ @RequiresPermissions(value = {"/paymentOrder/order"}, logical = Logical.OR)
@GetMapping(value = "/pay/order/charging")
@ApiOperation(value = "充电信息", tags = {"管理后台-支付订单-订单信息"})
public R<PayOrderChargingInfo> refundDetail(Long orderId) {
@@ -1326,6 +1329,7 @@
}
@ResponseBody
+ @RequiresPermissions(value = {"/paymentOrder/order"}, logical = Logical.OR)
@GetMapping(value = "/pay/order/charging/details")
@ApiOperation(value = "充电明细", tags = {"管理后台-支付订单-订单信息"})
public R<List<TChargingOrderAccountingStrategy>> chargingDetail(Long orderId) {
--
Gitblit v1.7.1