From 48a0c64057bb04cd12db17caf1ef4de9c35d12f4 Mon Sep 17 00:00:00 2001
From: RuoYi <yzz_ivy@163.com>
Date: 星期日, 19 十二月 2021 19:47:19 +0800
Subject: [PATCH] 升级log4j2到安全版本，防止漏洞风险
---
src/main/java/com/ruoyi/project/system/controller/SysUserController.java | 14 ++++++++------
1 files changed, 8 insertions(+), 6 deletions(-)
diff --git a/src/main/java/com/ruoyi/project/system/controller/SysUserController.java b/src/main/java/com/ruoyi/project/system/controller/SysUserController.java
index cb4ed90..18de675 100644
--- a/src/main/java/com/ruoyi/project/system/controller/SysUserController.java
+++ b/src/main/java/com/ruoyi/project/system/controller/SysUserController.java
@@ -2,6 +2,7 @@
import java.util.List;
import java.util.stream.Collectors;
+import javax.servlet.http.HttpServletResponse;
import org.apache.commons.lang3.ArrayUtils;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.access.prepost.PreAuthorize;
@@ -62,12 +63,12 @@
@Log(title = "鐢ㄦ埛绠＄悊", businessType = BusinessType.EXPORT)
@PreAuthorize("@ss.hasPermi('system:user:export')")
- @GetMapping("/export")
- public AjaxResult export(SysUser user)
+ @PostMapping("/export")
+ public void export(HttpServletResponse response, SysUser user)
{
List<SysUser> list = userService.selectUserList(user);
ExcelUtil<SysUser> util = new ExcelUtil<SysUser>(SysUser.class);
- return util.exportExcel(list, "鐢ㄦ埛鏁版嵁");
+ util.exportExcel(response, list, "鐢ㄦ埛鏁版嵁");
}
@Log(title = "鐢ㄦ埛绠＄悊", businessType = BusinessType.IMPORT)
@@ -82,11 +83,11 @@
return AjaxResult.success(message);
}
- @GetMapping("/importTemplate")
- public AjaxResult importTemplate()
+ @PostMapping("/importTemplate")
+ public void importTemplate(HttpServletResponse response)
{
ExcelUtil<SysUser> util = new ExcelUtil<SysUser>(SysUser.class);
- return util.importTemplateExcel("鐢ㄦ埛鏁版嵁");
+ util.importTemplateExcel(response, "鐢ㄦ埛鏁版嵁");
}
/**
@@ -96,6 +97,7 @@
@GetMapping(value = { "/", "/{userId}" })
public AjaxResult getInfo(@PathVariable(value = "userId", required = false) Long userId)
{
+ userService.checkUserDataScope(userId);
AjaxResult ajax = AjaxResult.success();
List<SysRole> roles = roleService.selectRoleAll();
ajax.put("roles", SysUser.isAdmin(userId) ? roles : roles.stream().filter(r -> !r.isAdmin()).collect(Collectors.toList()));
--
Gitblit v1.9.3