From f103c8c1e09e2475dc4ac4d3ddc1598146e4da38 Mon Sep 17 00:00:00 2001
From: puzhibing <393733352@qq.com>
Date: 星期五, 28 八月 2026 15:55:12 +0800
Subject: [PATCH] 修复系统越权访问漏洞
---
ruoyi-auth/src/main/java/com/ruoyi/auth/controller/TokenController.java | 2 ++
1 files changed, 2 insertions(+), 0 deletions(-)
diff --git a/ruoyi-auth/src/main/java/com/ruoyi/auth/controller/TokenController.java b/ruoyi-auth/src/main/java/com/ruoyi/auth/controller/TokenController.java
index ae18b27..aea270f 100644
--- a/ruoyi-auth/src/main/java/com/ruoyi/auth/controller/TokenController.java
+++ b/ruoyi-auth/src/main/java/com/ruoyi/auth/controller/TokenController.java
@@ -60,6 +60,8 @@
}
map.put("roleName",roles.get(0).getRoleName());
+ // 登录响应脱敏，禁止返回密码哈希
+ userInfo.getSysUser().setPassword(null);
map.put("info", userInfo);
if(userInfo.getSysUser().getRoleType() == 2){
Partner partner = partnerClient.getPartnerById(userInfo.getSysUser().getObjectId()).getData();
--
Gitblit v1.7.1