From f103c8c1e09e2475dc4ac4d3ddc1598146e4da38 Mon Sep 17 00:00:00 2001
From: puzhibing <393733352@qq.com>
Date: 星期五, 28 八月 2026 15:55:12 +0800
Subject: [PATCH] 修复系统越权访问漏洞
---
ruoyi-gateway/src/main/java/com/ruoyi/gateway/filter/AuthFilter.java | 25 +++++++++++++++++++++++++
1 files changed, 25 insertions(+), 0 deletions(-)
diff --git a/ruoyi-gateway/src/main/java/com/ruoyi/gateway/filter/AuthFilter.java b/ruoyi-gateway/src/main/java/com/ruoyi/gateway/filter/AuthFilter.java
index 2a9d1a6..90cbfb3 100644
--- a/ruoyi-gateway/src/main/java/com/ruoyi/gateway/filter/AuthFilter.java
+++ b/ruoyi-gateway/src/main/java/com/ruoyi/gateway/filter/AuthFilter.java
@@ -38,6 +38,9 @@
@Component
public class AuthFilter implements GlobalFilter, Ordered {
private static final Logger log = LoggerFactory.getLogger(AuthFilter.class);
+
+ /** 小程序token可访问的管理后台路径前缀白名单 */
+ private static final String[] APPLET_SYSTEM_WHITELIST = { "/system/faq/" };
// 排除过滤的 uri 地址，nacos自行添加
@Autowired
@@ -81,6 +84,11 @@
String userid = JwtUtils.getUserId(claims);
String username = JwtUtils.getUserName(claims);
String userType = JwtUtils.getUserType(claims);
+
+ // 小程序token禁止访问管理后台 /system/** 接口（白名单除外）
+ if ("applet".equals(userType) && !isAppletAllowed(url)) {
+ return unauthorizedResponse(exchange, "无权限访问该接口");
+ }
// 设置用户信息到请求
addHeader(mutate, SecurityConstants.USER_KEY, userkey);
@@ -91,6 +99,23 @@
removeHeader(mutate, SecurityConstants.FROM_SOURCE);
return chain.filter(exchange.mutate().request(mutate.build()).build());
}
+
+ /**
+ * 小程序token是否允许访问该路径
+ * @param url 请求路径
+ * @return true=允许
+ */
+ private boolean isAppletAllowed(String url) {
+ if (!url.startsWith("/system/")) {
+ return true;
+ }
+ for (String whitelist : APPLET_SYSTEM_WHITELIST) {
+ if (url.startsWith(whitelist)) {
+ return true;
+ }
+ }
+ return false;
+ }
private void addHeader(ServerHttpRequest.Builder mutate, String name, Object value) {
if (value == null) {
--
Gitblit v1.7.1