From f103c8c1e09e2475dc4ac4d3ddc1598146e4da38 Mon Sep 17 00:00:00 2001
From: puzhibing <393733352@qq.com>
Date: 星期五, 28 八月 2026 15:55:12 +0800
Subject: [PATCH] 修复系统越权访问漏洞
---
ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/controller/SysUserController.java | 33 ++++++++++++++++++++++++++++++++-
1 files changed, 32 insertions(+), 1 deletions(-)
diff --git a/ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/controller/SysUserController.java b/ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/controller/SysUserController.java
index 4371be0..5b4be9f 100644
--- a/ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/controller/SysUserController.java
+++ b/ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/controller/SysUserController.java
@@ -100,10 +100,15 @@
/**
* 获取用户选择列表
*/
+ @RequiresPermissions(value = {"/systemUserManagement", "/accountingStrategy/select", "/accountingStrategy", "/roleManagement/info"}, logical = Logical.OR)
@PostMapping("/getChangeUserList")
@ApiOperation(value = "获取用户选择列表", tags = {"管理后台-获取用户选择列表"})
public AjaxResult<PageInfo<SysUser>> getChangeUserList(@RequestBody ChangeUserQuery query) {
- return AjaxResult.success(userService.getChangeUserList(query));
+ PageInfo<SysUser> pageInfo = userService.getChangeUserList(query);
+ if (pageInfo != null && pageInfo.getRecords() != null) {
+ pageInfo.getRecords().forEach(u -> u.setPassword(null));
+ }
+ return AjaxResult.success(pageInfo);
}
/**
@@ -179,6 +184,7 @@
/**
* 根据用户编号获取详细信息
*/
+ @RequiresPermissions(value = {"/systemUserManagement/update"}, logical = Logical.OR)
@ApiOperation(value = "获取用户详情", tags = {"管理后台-系统用户管理"})
@GetMapping("/getInfo/{userId}")
public AjaxResult getInfo(@PathVariable Long userId) {
@@ -194,6 +200,7 @@
List<Site> data = siteClient.getSiteByIds(siteIds).getData();
List<String> siteNames = data.stream().map(Site::getName).collect(Collectors.toList());
sysUser.setSiteNames(siteNames);
+ sysUser.setPassword(null);
ajax.put(AjaxResult.DATA_TAG, sysUser);
ajax.put("postIds", postService.selectPostListByUserId(userId));
ajax.put("roleIds", sysUser.getRoles().stream().map(SysRole::getRoleId).collect(Collectors.toList()));
@@ -310,12 +317,14 @@
}
+ @InnerAuth
@PostMapping("/getUserList")
public R<List<SysUser>> getUserList(@RequestBody List<Integer> userIds) {
List<SysUser> list = userService.list(new LambdaQueryWrapper<SysUser>().in(SysUser::getUserId, userIds));
return R.ok(list);
}
+ @InnerAuth
@PostMapping("/getSysUserFromCompanyId")
public R<List<CompanyUserListVo>> getSysUserFromCompanyId(@RequestBody CompanySysUserReq companySysUserReq) {
LambdaQueryWrapper<SysUser> sysUserLambdaQueryWrapper = new LambdaQueryWrapper<>();
@@ -363,6 +372,7 @@
}
return R.ok(companyUserListVos);
}
+ @InnerAuth
@PostMapping("/isAdmin")
public R<Integer> isAdmin(@RequestBody Long userId){
SysUserRole one = sysUserRoleService.getOne(new LambdaQueryWrapper<SysUserRole>().eq(SysUserRole::getUserId, userId));
@@ -370,6 +380,7 @@
return R.ok(id.intValue());
}
+ @InnerAuth
@PostMapping("/getSysUser")
public R<SysUser> getSysUser(@RequestParam("userId") Long userId) {
try {
@@ -381,6 +392,7 @@
}
}
+ @InnerAuth
@PostMapping("/updateSysUser")
@Transactional(rollbackFor = Exception.class)
public R<Boolean> updateSysUser(@RequestBody SysUser sysUser) {
@@ -403,6 +415,7 @@
}
+ @InnerAuth
@PostMapping("/companySaveSysUser")
public R<List<Integer>> companySaveSysUser(@RequestBody CompanyAddSysUserDto dto) {
List<CompanyUserListVo> list = dto.getList();
@@ -452,6 +465,7 @@
}
+ @InnerAuth
@PostMapping("/addTRepairSysUser")
public R<List<Integer>> addTRepairSysUser(@RequestBody TRepairShopAddDto dto) {
List<TRepairShopAdd> list = dto.getList();
@@ -532,6 +546,7 @@
Set<String> roles = permissionService.getRolePermission(user);
// 权限集合
Set<String> permissions = permissionService.getMenuPermission(user);
+ user.setPassword(null);
AjaxResult ajax = AjaxResult.success();
ajax.put("user", user);
ajax.put("roles", roles);
@@ -558,6 +573,7 @@
/**
* 状态修改
*/
+ @RequiresPermissions(value = {"/systemUserManagement/forbidden"}, logical = Logical.OR)
@Log(title = "用户管理", businessType = BusinessType.UPDATE)
@PutMapping("/changeStatus")
public AjaxResult changeStatus(@RequestBody SysUser user) {
@@ -570,11 +586,14 @@
/**
* 根据用户编号获取授权角色
*/
+ @RequiresPermissions(value = {"/systemUserManagement", "/roleManagement/info"}, logical = Logical.OR)
@GetMapping("/authRole/{userId}")
public AjaxResult authRole(@PathVariable("userId") Long userId) {
+ userService.checkUserDataScope(userId);
AjaxResult ajax = AjaxResult.success();
SysUser user = userService.selectUserById(userId);
List<SysRole> roles = roleService.selectRolesByUserId(userId);
+ user.setPassword(null);
ajax.put("user", user);
ajax.put("roles", SysUser.isAdmin(userId) ? roles : roles.stream().filter(r -> !r.isAdmin()).collect(Collectors.toList()));
return ajax;
@@ -583,6 +602,7 @@
/**
* 用户授权角色
*/
+ @RequiresPermissions(value = {"/systemUserManagement/update", "/roleManagement/info"}, logical = Logical.OR)
@Log(title = "用户管理", businessType = BusinessType.GRANT)
@PutMapping("/authRole")
public AjaxResult insertAuthRole(Long userId, Long[] roleIds) {
@@ -594,11 +614,13 @@
/**
* 获取部门树列表
*/
+ @RequiresPermissions(value = {"/systemUserManagement", "/roleManagement/info"}, logical = Logical.OR)
@GetMapping("/deptTree")
public AjaxResult deptTree(SysDept dept) {
return success(deptService.selectDeptTreeList(dept));
}
+ @InnerAuth
@PostMapping("/updateUser")
public R<Boolean> updateUser(@RequestBody SysUser sysUser){
return R.ok(userService.updateById(sysUser));
@@ -609,6 +631,7 @@
* @param userId
* @return
*/
+ @InnerAuth
@PostMapping("/queryRoleByUserId/{userId}")
public R<SysRole> queryRoleByUserId(@PathVariable("userId") Long userId){
SysUserRole one = sysUserRoleService.getOne(Wrappers.lambdaQuery(SysUserRole.class)
@@ -625,6 +648,7 @@
}
+ @InnerAuth
@PostMapping("/queryRoleByRoleId/{roleId}")
public R<SysRole> queryRoleByRoleId(@PathVariable("roleId") Long roleId){
return R.ok( roleService.getOne(Wrappers.lambdaQuery(SysRole.class)
@@ -637,6 +661,7 @@
* @param phoneList
* @return
*/
+ @InnerAuth
@PostMapping("/queryUserByPhoneList")
public R<List<SysUser>> queryUserByPhoneList(@RequestBody List<String> phoneList){
List<SysUser> list = userService.list(Wrappers.lambdaQuery(SysUser.class)
@@ -650,6 +675,7 @@
* @param dtoList
* @return
*/
+ @InnerAuth
@PostMapping("/addUserRole")
public R<Boolean> addUserRole(@RequestBody List<SysUserRoleDTO> dtoList){
List<SysUserRole> userRoles = new ArrayList<>();
@@ -667,6 +693,7 @@
* @param phone
* @return
*/
+ @InnerAuth
@PostMapping("/queryUserByPhone")
public R<SysUser> queryUserByPhone(@RequestBody String phone){
SysUser user = userService.getOne(Wrappers.lambdaQuery(SysUser.class)
@@ -682,6 +709,7 @@
* @return
*/
@ResponseBody
+ @InnerAuth
@PostMapping("/queryUserByUserName")
public R<SysUser> queryUserByUserName(@RequestBody String userName){
SysUser user = userService.getOne(Wrappers.lambdaQuery(SysUser.class)
@@ -696,6 +724,7 @@
* @param user
*/
@ResponseBody
+ @InnerAuth
@PostMapping("/addSysUser")
@Transactional(rollbackFor = Exception.class)
public R<Long> addSysUser(@RequestBody SysUser user) {
@@ -727,6 +756,7 @@
@ResponseBody
+ @InnerAuth
@PostMapping("/resetPassword")
public R resetPassword(@RequestBody SysUser user) {
user.setPassword(SecurityUtils.encryptPassword(user.getPassword()));
@@ -737,6 +767,7 @@
@ResponseBody
+ @InnerAuth
@PostMapping("/getSysUserById")
public SysUser getSysUserById(@RequestParam("userId") Long userId){
return userService.getById(userId);
--
Gitblit v1.7.1