From f103c8c1e09e2475dc4ac4d3ddc1598146e4da38 Mon Sep 17 00:00:00 2001
From: puzhibing <393733352@qq.com>
Date: 星期五, 28 八月 2026 15:55:12 +0800
Subject: [PATCH] 修复系统越权访问漏洞
---
ruoyi-service/ruoyi-order/src/main/java/com/ruoyi/order/controller/TChargingOrderController.java | 4 ++++
1 files changed, 4 insertions(+), 0 deletions(-)
diff --git a/ruoyi-service/ruoyi-order/src/main/java/com/ruoyi/order/controller/TChargingOrderController.java b/ruoyi-service/ruoyi-order/src/main/java/com/ruoyi/order/controller/TChargingOrderController.java
index 1f19098..fe83c06 100644
--- a/ruoyi-service/ruoyi-order/src/main/java/com/ruoyi/order/controller/TChargingOrderController.java
+++ b/ruoyi-service/ruoyi-order/src/main/java/com/ruoyi/order/controller/TChargingOrderController.java
@@ -243,6 +243,7 @@
@ResponseBody
+ @RequiresPermissions(value = {"/paymentOrder/refund", "/paymentOrder/refund/select"}, logical = Logical.OR)
@PostMapping(value = "/pay/order/refund")
@ApiOperation(value = "退款", tags = {"管理后台-支付订单-订单信息"})
public R refund(@RequestBody PayOrderRefundDto payOrderQueryDto) {
@@ -319,6 +320,7 @@
@ResponseBody
+ @RequiresPermissions(value = {"/paymentOrder/refund", "/paymentOrder/refund/select"}, logical = Logical.OR)
@GetMapping(value = "/pay/order/refund/detail")
@ApiOperation(value = "退款信息", tags = {"管理后台-支付订单-订单信息"})
public R refundDetail(Long orderId, Integer type) {
@@ -339,6 +341,7 @@
}
@ResponseBody
+ @RequiresPermissions(value = {"/paymentOrder/order"}, logical = Logical.OR)
@GetMapping(value = "/pay/order/charging")
@ApiOperation(value = "充电信息", tags = {"管理后台-支付订单-订单信息"})
public R<PayOrderChargingInfo> refundDetail(Long orderId) {
@@ -370,6 +373,7 @@
}
@ResponseBody
+ @RequiresPermissions(value = {"/paymentOrder/order"}, logical = Logical.OR)
@GetMapping(value = "/pay/order/charging/details")
@ApiOperation(value = "充电明细", tags = {"管理后台-支付订单-订单信息"})
public R<List<TChargingOrderAccountingStrategy>> chargingDetail(Long orderId) {
--
Gitblit v1.7.1