用户访问控制时校验数据权限，防止越权

RuoYi

2022-01-27 b49cdbbc9516352d1f4511e4223fa9d089b057b9

 src/main/java/com/ruoyi/project/system/controller/SysUserController.java

@@ -148,6 +148,7 @@
    public AjaxResult edit(@Validated @RequestBody SysUser user)

    {

        userService.checkUserAllowed(user);

        userService.checkUserDataScope(user.getUserId());

        if (StringUtils.isNotEmpty(user.getPhonenumber())

                && UserConstants.NOT_UNIQUE.equals(userService.checkPhoneUnique(user)))

        {

@@ -186,6 +187,7 @@
    public AjaxResult resetPwd(@RequestBody SysUser user)

    {

        userService.checkUserAllowed(user);

        userService.checkUserDataScope(user.getUserId());

        user.setPassword(SecurityUtils.encryptPassword(user.getPassword()));

        user.setUpdateBy(getUsername());

        return toAjax(userService.resetPwd(user));

@@ -200,6 +202,7 @@
    public AjaxResult changeStatus(@RequestBody SysUser user)

    {

        userService.checkUserAllowed(user);

        userService.checkUserDataScope(user.getUserId());

        user.setUpdateBy(getUsername());

        return toAjax(userService.updateUserStatus(user));

    }

@@ -227,6 +230,7 @@
    @PutMapping("/authRole")

    public AjaxResult insertAuthRole(Long userId, Long[] roleIds)

    {

        userService.checkUserDataScope(userId);

        userService.insertUserAuth(userId, roleIds);

        return success();

    }