From f103c8c1e09e2475dc4ac4d3ddc1598146e4da38 Mon Sep 17 00:00:00 2001
From: puzhibing <393733352@qq.com>
Date: 星期五, 28 八月 2026 15:55:12 +0800
Subject: [PATCH] 修复系统越权访问漏洞

---
 ruoyi-service/ruoyi-chargingPile/src/main/java/com/ruoyi/chargingPile/controller/TChargingGunController.java |   12 ++++++++++++
 1 files changed, 12 insertions(+), 0 deletions(-)

diff --git a/ruoyi-service/ruoyi-chargingPile/src/main/java/com/ruoyi/chargingPile/controller/TChargingGunController.java b/ruoyi-service/ruoyi-chargingPile/src/main/java/com/ruoyi/chargingPile/controller/TChargingGunController.java
index 6308748..81fd3bb 100644
--- a/ruoyi-service/ruoyi-chargingPile/src/main/java/com/ruoyi/chargingPile/controller/TChargingGunController.java
+++ b/ruoyi-service/ruoyi-chargingPile/src/main/java/com/ruoyi/chargingPile/controller/TChargingGunController.java
@@ -23,6 +23,7 @@
 import com.ruoyi.common.log.enums.OperatorType;
 import com.ruoyi.common.security.annotation.Logical;
 import com.ruoyi.common.security.annotation.RequiresPermissions;
+import com.ruoyi.common.security.annotation.InnerAuth;
 import com.ruoyi.common.security.service.TokenService;
 import com.ruoyi.common.security.utils.SecurityUtils;
 import com.ruoyi.order.api.feignClient.ChargingOrderClient;
@@ -71,6 +72,7 @@
      * 新增临时枪
      * @return
      */
+    @InnerAuth
     @PostMapping("/addGunTemp")
     @ResponseBody
     R<Integer> addGunTemp(@RequestBody TChargingGun gun){
@@ -80,6 +82,7 @@
     /**
      * 查询所有枪
      */
+    @InnerAuth
     @PostMapping(value = "/getAllGun")
     @ResponseBody
     public R<List<TChargingGun>> getAllGun() {
@@ -88,6 +91,7 @@
     /**
      * 查询所有桩
      */
+    @InnerAuth
     @PostMapping(value = "/getAllPile")
     public R<List<TChargingPile>> getAllPile() {
         return R.ok(chargingPileService.list());
@@ -250,6 +254,7 @@
      * @return
      */
     @ResponseBody
+    @InnerAuth
     @PostMapping(value = "/getAllName/{id}")
     public R<String> getAllName(@PathVariable Integer id){
         TChargingGun chargingGun = chargingGunService.getById(id);
@@ -264,6 +269,7 @@
      * @return
      */
     @ResponseBody
+    @InnerAuth
     @PostMapping(value = "/getChargingGunById/{id}")
     public R<TChargingGun> getChargingGunById(@PathVariable Integer id){
         TChargingGun chargingGun = chargingGunService.getById(id);
@@ -275,6 +281,7 @@
      * @return
      */
     @ResponseBody
+    @InnerAuth
     @PostMapping(value = "/getAllInfoById/{id}")
     public R<SiteNameVO> getAllInfoById(@PathVariable Integer id){
         SiteNameVO siteNameVO = new SiteNameVO();
@@ -293,6 +300,7 @@
      * @param code
      * @return
      */
+    @InnerAuth
     @PostMapping("/getChargingGunByCode")
     public R<TChargingGun> getChargingGunByCode(@RequestBody GetChargingGunByCode code){
         TChargingPile chargingPile = chargingPileService.getOne(new LambdaQueryWrapper<TChargingPile>()
@@ -313,6 +321,7 @@
      * @param chargingGun
      * @return
      */
+    @InnerAuth
     @PostMapping("/updateChargingGunById")
     public R<String> updateChargingGunById(@RequestBody TChargingGun chargingGun){
         chargingGunService.updateById(chargingGun);
@@ -326,6 +335,7 @@
      * @param chargingPileId
      * @return
      */
+    @InnerAuth
     @PostMapping("/getChargingGunByChargingPileId")
     public R<List<TChargingGun>> getChargingGunByChargingPileId(@RequestParam("chargingPileId") Integer chargingPileId){
         List<TChargingGun> list = chargingGunService.list(new LambdaQueryWrapper<TChargingGun>().eq(TChargingGun::getChargingPileId, chargingPileId)
@@ -338,6 +348,7 @@
      * 根据充电桩ids获取枪
      * @return
      */
+    @InnerAuth
     @PostMapping("/getChargingGunByChargingPileIds")
     public R<List<TChargingGun>> getChargingGunByChargingPileIds(@RequestBody GetChargingGunByChargingPileIdsVo vo){
         if(vo.getChargingPileIds().isEmpty()){
@@ -353,6 +364,7 @@
      * 根据枪唯一码查询信息
      * @return
      */
+    @InnerAuth
     @PostMapping("/getChargingGunByFullNumber")
     public R<TChargingGun> getChargingGunByFullNumber(@RequestParam("fullNumber") String fullNumber){
         TChargingGun chargingGun = chargingGunService.getOne(new LambdaQueryWrapper<TChargingGun>().eq(TChargingGun::getDelFlag, 0).eq(TChargingGun::getFullNumber, fullNumber));

--
Gitblit v1.7.1