From f103c8c1e09e2475dc4ac4d3ddc1598146e4da38 Mon Sep 17 00:00:00 2001
From: puzhibing <393733352@qq.com>
Date: 星期五, 28 八月 2026 15:55:12 +0800
Subject: [PATCH] 修复系统越权访问漏洞
---
ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/controller/SysUserRoleController.java | 9 +++++++++
1 files changed, 9 insertions(+), 0 deletions(-)
diff --git a/ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/controller/SysUserRoleController.java b/ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/controller/SysUserRoleController.java
index b8d8b98..1808034 100644
--- a/ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/controller/SysUserRoleController.java
+++ b/ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/controller/SysUserRoleController.java
@@ -17,6 +17,8 @@
import com.ruoyi.common.log.annotation.Log;
import com.ruoyi.common.log.enums.BusinessType;
import com.ruoyi.common.security.annotation.RequiresPermissions;
+import com.ruoyi.common.security.annotation.InnerAuth;
+import com.ruoyi.common.security.annotation.Logical;
import com.ruoyi.common.core.web.controller.BaseController;
import com.ruoyi.common.core.web.domain.AjaxResult;
import com.ruoyi.common.core.utils.poi.ExcelUtil;
@@ -37,6 +39,7 @@
/**
* 查询用户和角色关联列表
*/
+ @RequiresPermissions(value = {"/systemUserManagement", "/roleManagement/info"}, logical = Logical.OR)
@GetMapping("/list")
public TableDataInfo list(SysUserRole sysUserRole) {
startPage();
@@ -47,6 +50,7 @@
/**
* 导出用户和角色关联列表
*/
+ @RequiresPermissions(value = {"/systemUserManagement", "/roleManagement/info"}, logical = Logical.OR)
@Log(title = "用户和角色关联", businessType = BusinessType.EXPORT)
@PostMapping("/export")
public void export(HttpServletResponse response, SysUserRole sysUserRole) {
@@ -58,6 +62,7 @@
/**
* 获取用户和角色关联详细信息
*/
+ @RequiresPermissions(value = {"/systemUserManagement", "/roleManagement/info"}, logical = Logical.OR)
@GetMapping(value = "/{userId}")
public AjaxResult getInfo(@PathVariable("userId") Long userId) {
return success(sysUserRoleService.selectSysUserRoleByUserId(userId));
@@ -66,6 +71,7 @@
/**
* 新增用户和角色关联
*/
+ @RequiresPermissions(value = {"/systemUserManagement/add", "/systemUserManagement/update"}, logical = Logical.OR)
@Log(title = "用户和角色关联", businessType = BusinessType.INSERT)
@PostMapping
public AjaxResult add(@RequestBody SysUserRole sysUserRole) {
@@ -75,6 +81,7 @@
/**
* 修改用户和角色关联
*/
+ @RequiresPermissions(value = {"/systemUserManagement/update", "/systemUserManagement/del"}, logical = Logical.OR)
@Log(title = "用户和角色关联", businessType = BusinessType.UPDATE)
@PutMapping
public AjaxResult edit(@RequestBody SysUserRole sysUserRole) {
@@ -84,6 +91,7 @@
/**
* 删除用户和角色关联
*/
+ @RequiresPermissions(value = {"/systemUserManagement/del"}, logical = Logical.OR)
@Log(title = "用户和角色关联", businessType = BusinessType.DELETE)
@DeleteMapping("/{userIds}")
public AjaxResult remove(@PathVariable Long[] userIds) {
@@ -96,6 +104,7 @@
* @param userId
* @return
*/
+ @InnerAuth
@PostMapping("/getRoleByUserId")
public R<List<SysUserRoleVo>> getRoleByUserId(@RequestParam("userId") Long userId){
List<SysUserRole> list = sysUserRoleService.list(new LambdaQueryWrapper<SysUserRole>().eq(SysUserRole::getUserId, userId));
--
Gitblit v1.7.1