From 7f714c7179233affc2715f38f59946e5906654a3 Mon Sep 17 00:00:00 2001
From: longz <longzhaoz@qq.com>
Date: 星期五, 28 八月 2026 17:44:30 +0800
Subject: [PATCH] 删除越权漏洞修复中的内部调用注解

---
 ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/controller/SysUserController.java |   18 ------------------
 1 files changed, 0 insertions(+), 18 deletions(-)

diff --git a/ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/controller/SysUserController.java b/ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/controller/SysUserController.java
index 5b4be9f..02bbe59 100644
--- a/ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/controller/SysUserController.java
+++ b/ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/controller/SysUserController.java
@@ -317,14 +317,12 @@
     }
 
 
-    @InnerAuth
     @PostMapping("/getUserList")
     public R<List<SysUser>> getUserList(@RequestBody List<Integer> userIds) {
         List<SysUser> list = userService.list(new LambdaQueryWrapper<SysUser>().in(SysUser::getUserId, userIds));
         return R.ok(list);
     }
 
-    @InnerAuth
     @PostMapping("/getSysUserFromCompanyId")
     public R<List<CompanyUserListVo>> getSysUserFromCompanyId(@RequestBody CompanySysUserReq companySysUserReq) {
         LambdaQueryWrapper<SysUser> sysUserLambdaQueryWrapper = new LambdaQueryWrapper<>();
@@ -372,7 +370,6 @@
         }
         return R.ok(companyUserListVos);
     }
-    @InnerAuth
     @PostMapping("/isAdmin")
     public R<Integer> isAdmin(@RequestBody Long userId){
         SysUserRole one = sysUserRoleService.getOne(new LambdaQueryWrapper<SysUserRole>().eq(SysUserRole::getUserId, userId));
@@ -380,7 +377,6 @@
         return R.ok(id.intValue());
     }
 
-    @InnerAuth
     @PostMapping("/getSysUser")
     public R<SysUser> getSysUser(@RequestParam("userId") Long userId) {
         try {
@@ -392,7 +388,6 @@
         }
     }
 
-    @InnerAuth
     @PostMapping("/updateSysUser")
     @Transactional(rollbackFor = Exception.class)
     public R<Boolean> updateSysUser(@RequestBody SysUser sysUser) {
@@ -415,7 +410,6 @@
     }
 
 
-    @InnerAuth
     @PostMapping("/companySaveSysUser")
     public R<List<Integer>> companySaveSysUser(@RequestBody CompanyAddSysUserDto dto) {
         List<CompanyUserListVo> list = dto.getList();
@@ -465,7 +459,6 @@
     }
 
 
-    @InnerAuth
     @PostMapping("/addTRepairSysUser")
     public R<List<Integer>> addTRepairSysUser(@RequestBody TRepairShopAddDto dto) {
         List<TRepairShopAdd> list = dto.getList();
@@ -501,7 +494,6 @@
     /**
      * 获取当前用户信息
      */
-    @InnerAuth
     @GetMapping("/info/{username}")
     public R<LoginUser> info(@PathVariable("username") String username) {
         SysUser sysUser = userService.selectUserByUserName(username);
@@ -620,7 +612,6 @@
         return success(deptService.selectDeptTreeList(dept));
     }
 
-    @InnerAuth
     @PostMapping("/updateUser")
     public R<Boolean>  updateUser(@RequestBody SysUser sysUser){
         return R.ok(userService.updateById(sysUser));
@@ -631,7 +622,6 @@
      * @param userId
      * @return
      */
-    @InnerAuth
     @PostMapping("/queryRoleByUserId/{userId}")
     public R<SysRole> queryRoleByUserId(@PathVariable("userId") Long userId){
         SysUserRole one = sysUserRoleService.getOne(Wrappers.lambdaQuery(SysUserRole.class)
@@ -648,7 +638,6 @@
     }
 
 
-    @InnerAuth
     @PostMapping("/queryRoleByRoleId/{roleId}")
     public R<SysRole> queryRoleByRoleId(@PathVariable("roleId") Long roleId){
         return R.ok( roleService.getOne(Wrappers.lambdaQuery(SysRole.class)
@@ -661,7 +650,6 @@
      * @param phoneList
      * @return
      */
-    @InnerAuth
     @PostMapping("/queryUserByPhoneList")
     public R<List<SysUser>> queryUserByPhoneList(@RequestBody List<String> phoneList){
         List<SysUser> list = userService.list(Wrappers.lambdaQuery(SysUser.class)
@@ -675,7 +663,6 @@
      * @param dtoList
      * @return
      */
-    @InnerAuth
     @PostMapping("/addUserRole")
     public R<Boolean> addUserRole(@RequestBody List<SysUserRoleDTO> dtoList){
         List<SysUserRole> userRoles = new ArrayList<>();
@@ -693,7 +680,6 @@
      * @param phone
      * @return
      */
-    @InnerAuth
     @PostMapping("/queryUserByPhone")
     public R<SysUser>  queryUserByPhone(@RequestBody String phone){
         SysUser user = userService.getOne(Wrappers.lambdaQuery(SysUser.class)
@@ -709,7 +695,6 @@
      * @return
      */
     @ResponseBody
-    @InnerAuth
     @PostMapping("/queryUserByUserName")
     public R<SysUser> queryUserByUserName(@RequestBody String userName){
         SysUser user = userService.getOne(Wrappers.lambdaQuery(SysUser.class)
@@ -724,7 +709,6 @@
      * @param user
      */
     @ResponseBody
-    @InnerAuth
     @PostMapping("/addSysUser")
     @Transactional(rollbackFor = Exception.class)
     public R<Long> addSysUser(@RequestBody SysUser user) {
@@ -756,7 +740,6 @@
     
     
     @ResponseBody
-    @InnerAuth
     @PostMapping("/resetPassword")
     public R resetPassword(@RequestBody SysUser user) {
         user.setPassword(SecurityUtils.encryptPassword(user.getPassword()));
@@ -767,7 +750,6 @@
     
     
     @ResponseBody
-    @InnerAuth
     @PostMapping("/getSysUserById")
     public SysUser getSysUserById(@RequestParam("userId") Long userId){
         return userService.getById(userId);

--
Gitblit v1.7.1