From f103c8c1e09e2475dc4ac4d3ddc1598146e4da38 Mon Sep 17 00:00:00 2001
From: puzhibing <393733352@qq.com>
Date: 星期五, 28 八月 2026 15:55:12 +0800
Subject: [PATCH] 修复系统越权访问漏洞
---
ruoyi-service/ruoyi-account/src/main/java/com/ruoyi/account/controller/TAppUserController.java | 14 ++++++++------
1 files changed, 8 insertions(+), 6 deletions(-)
diff --git a/ruoyi-service/ruoyi-account/src/main/java/com/ruoyi/account/controller/TAppUserController.java b/ruoyi-service/ruoyi-account/src/main/java/com/ruoyi/account/controller/TAppUserController.java
index 82c6489..da2fa27 100644
--- a/ruoyi-service/ruoyi-account/src/main/java/com/ruoyi/account/controller/TAppUserController.java
+++ b/ruoyi-service/ruoyi-account/src/main/java/com/ruoyi/account/controller/TAppUserController.java
@@ -32,6 +32,7 @@
import com.ruoyi.common.redis.service.RedisService;
import com.ruoyi.common.security.annotation.Logical;
import com.ruoyi.common.security.annotation.RequiresPermissions;
+import com.ruoyi.common.security.annotation.InnerAuth;
import com.ruoyi.common.security.auth.AuthUtil;
import com.ruoyi.common.security.service.TokenService;
import com.ruoyi.common.security.utils.SecurityUtils;
@@ -261,6 +262,7 @@
* 远程调用 积分兑换订单 退款回退积分
* @return
*/
+ @InnerAuth
@PostMapping(value = "/refundPoints/{param}")
public R refundPoints(@PathVariable("param")String param) {
String[] split = param.split("-");
@@ -287,6 +289,7 @@
}
@ApiOperation(value = "管理后台-根据手机号查询用户ids", tags = {"管理后台-活动费用统计"})
+ @RequiresPermissions(value = {"/appUser/select", "/appUser/list"}, logical = Logical.OR)
@PostMapping(value = "/user/getUserIdsByPhone")
public R<List<Long>> getUserIdsByPhone(@RequestParam("phone") String phone) {
return R.ok(appUserService.list(new QueryWrapper<TAppUser>().like("phone",phone)).stream().map(TAppUser::getId).collect(Collectors.toList()));
@@ -692,9 +695,8 @@
@ApiOperation(value = "用户详情积分明细", tags = {"小程序-个人中心"})
@PostMapping(value = "/user/points/page1")
public R<Page<TAppUserIntegralChange>> pointsDetail1(@RequestBody PointsQueryDto pointsQueryDto) {
- if (pointsQueryDto.getUserId()==null){
- pointsQueryDto.setUserId(tokenService.getLoginUserApplet().getUserId());
- }
+ // 强制绑定当前登录用户，防止越权查询他人积分明细
+ pointsQueryDto.setUserId(tokenService.getLoginUserApplet().getUserId());
List<Integer> types = new ArrayList<>();
if (pointsQueryDto.getType()==null){
types.add(1);
@@ -749,9 +751,8 @@
@ApiOperation(value = "余额明细", tags = {"小程序-个人中心"})
@PostMapping(value = "/user/balance/page1")
public R<Page<TExchangeCodeUseRecord>> balanceDetail(@RequestBody ExchangeCodeUseRecordQuery queryDto) {
- if (queryDto.getUserId() == null) {
- queryDto.setUserId(tokenService.getLoginUserApplet().getUserId());
- }
+ // 强制绑定当前登录用户，防止越权查询他人余额明细
+ queryDto.setUserId(tokenService.getLoginUserApplet().getUserId());
return otherClient.exchangeCodeUseRecordPage(queryDto);
}
@@ -1024,6 +1025,7 @@
+ @RequiresPermissions(value = {"/appUser/giftVip", "/appUser/gift_vip"}, logical = Logical.OR)
@PostMapping(value = "/user/give/vip1")
public R giveVip1(@RequestBody GiveVipDto giveVipDto) {
String[] split = giveVipDto.getUserIds().split(",");
--
Gitblit v1.7.1