From b49cdbbc9516352d1f4511e4223fa9d089b057b9 Mon Sep 17 00:00:00 2001
From: RuoYi <yzz_ivy@163.com>
Date: 星期四, 27 一月 2022 12:12:30 +0800
Subject: [PATCH] 用户访问控制时校验数据权限，防止越权
---
src/main/java/com/ruoyi/project/system/service/impl/SysUserServiceImpl.java | 101 ++++++++++++++++++++++++++++++++++++++++----------
1 files changed, 81 insertions(+), 20 deletions(-)
diff --git a/src/main/java/com/ruoyi/project/system/service/impl/SysUserServiceImpl.java b/src/main/java/com/ruoyi/project/system/service/impl/SysUserServiceImpl.java
index 65114a3..ddb46f7 100644
--- a/src/main/java/com/ruoyi/project/system/service/impl/SysUserServiceImpl.java
+++ b/src/main/java/com/ruoyi/project/system/service/impl/SysUserServiceImpl.java
@@ -2,15 +2,20 @@
import java.util.ArrayList;
import java.util.List;
+import java.util.stream.Collectors;
+import javax.validation.Validator;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Service;
import org.springframework.transaction.annotation.Transactional;
+import org.springframework.util.CollectionUtils;
import com.ruoyi.common.constant.UserConstants;
-import com.ruoyi.common.exception.CustomException;
+import com.ruoyi.common.exception.ServiceException;
import com.ruoyi.common.utils.SecurityUtils;
import com.ruoyi.common.utils.StringUtils;
+import com.ruoyi.common.utils.bean.BeanValidators;
+import com.ruoyi.common.utils.spring.SpringUtils;
import com.ruoyi.framework.aspectj.lang.annotation.DataScope;
import com.ruoyi.project.system.domain.SysPost;
import com.ruoyi.project.system.domain.SysRole;
@@ -53,6 +58,9 @@
@Autowired
private ISysConfigService configService;
+ @Autowired
+ protected Validator validator;
+
/**
* 鏍规嵁鏉′欢鍒嗛〉鏌ヨ鐢ㄦ埛鍒楄〃
*
@@ -64,6 +72,32 @@
public List<SysUser> selectUserList(SysUser user)
{
return userMapper.selectUserList(user);
+ }
+
+ /**
+ * 鏍规嵁鏉′欢鍒嗛〉鏌ヨ宸插垎閰嶇敤鎴疯鑹插垪琛�
+ *
+ * @param user 鐢ㄦ埛淇℃伅
+ * @return 鐢ㄦ埛淇℃伅闆嗗悎淇℃伅
+ */
+ @Override
+ @DataScope(deptAlias = "d", userAlias = "u")
+ public List<SysUser> selectAllocatedList(SysUser user)
+ {
+ return userMapper.selectAllocatedList(user);
+ }
+
+ /**
+ * 鏍规嵁鏉′欢鍒嗛〉鏌ヨ鏈垎閰嶇敤鎴疯鑹插垪琛�
+ *
+ * @param user 鐢ㄦ埛淇℃伅
+ * @return 鐢ㄦ埛淇℃伅闆嗗悎淇℃伅
+ */
+ @Override
+ @DataScope(deptAlias = "d", userAlias = "u")
+ public List<SysUser> selectUnallocatedList(SysUser user)
+ {
+ return userMapper.selectUnallocatedList(user);
}
/**
@@ -100,16 +134,11 @@
public String selectUserRoleGroup(String userName)
{
List<SysRole> list = roleMapper.selectRolesByUserName(userName);
- StringBuffer idsStr = new StringBuffer();
- for (SysRole role : list)
+ if (CollectionUtils.isEmpty(list))
{
- idsStr.append(role.getRoleName()).append(",");
+ return StringUtils.EMPTY;
}
- if (StringUtils.isNotEmpty(idsStr.toString()))
- {
- return idsStr.substring(0, idsStr.length() - 1);
- }
- return idsStr.toString();
+ return list.stream().map(SysRole::getRoleName).collect(Collectors.joining(","));
}
/**
@@ -122,16 +151,11 @@
public String selectUserPostGroup(String userName)
{
List<SysPost> list = postMapper.selectPostsByUserName(userName);
- StringBuffer idsStr = new StringBuffer();
- for (SysPost post : list)
+ if (CollectionUtils.isEmpty(list))
{
- idsStr.append(post.getPostName()).append(",");
+ return StringUtils.EMPTY;
}
- if (StringUtils.isNotEmpty(idsStr.toString()))
- {
- return idsStr.substring(0, idsStr.length() - 1);
- }
- return idsStr.toString();
+ return list.stream().map(SysPost::getPostName).collect(Collectors.joining(","));
}
/**
@@ -197,7 +221,27 @@
{
if (StringUtils.isNotNull(user.getUserId()) && user.isAdmin())
{
- throw new CustomException("涓嶅厑璁告搷浣滆秴绾х鐞嗗憳鐢ㄦ埛");
+ throw new ServiceException("涓嶅厑璁告搷浣滆秴绾х鐞嗗憳鐢ㄦ埛");
+ }
+ }
+
+ /**
+ * 鏍￠獙鐢ㄦ埛鏄惁鏈夋暟鎹潈闄�
+ *
+ * @param userId 鐢ㄦ埛id
+ */
+ @Override
+ public void checkUserDataScope(Long userId)
+ {
+ if (!SysUser.isAdmin(SecurityUtils.getUserId()))
+ {
+ SysUser user = new SysUser();
+ user.setUserId(userId);
+ List<SysUser> users = SpringUtils.getAopProxy(this).selectUserList(user);
+ if (StringUtils.isEmpty(users))
+ {
+ throw new ServiceException("娌℃湁鏉冮檺璁块棶鐢ㄦ埛鏁版嵁锛�");
+ }
}
}
@@ -218,6 +262,18 @@
// 鏂板鐢ㄦ埛涓庤鑹茬鐞�
insertUserRole(user);
return rows;
+ }
+
+ /**
+ * 娉ㄥ唽鐢ㄦ埛淇℃伅
+ *
+ * @param user 鐢ㄦ埛淇℃伅
+ * @return 缁撴灉
+ */
+ @Override
+ public boolean registerUser(SysUser user)
+ {
+ return userMapper.insertUser(user) > 0;
}
/**
@@ -248,6 +304,8 @@
* @param userId 鐢ㄦ埛ID
* @param roleIds 瑙掕壊缁�
*/
+ @Override
+ @Transactional
public void insertUserAuth(Long userId, Long[] roleIds)
{
userRoleMapper.deleteUserRoleByUserId(userId);
@@ -424,6 +482,7 @@
for (Long userId : userIds)
{
checkUserAllowed(new SysUser(userId));
+ checkUserDataScope(userId);
}
// 鍒犻櫎鐢ㄦ埛涓庤鑹插叧鑱�
userRoleMapper.deleteUserRole(userIds);
@@ -445,7 +504,7 @@
{
if (StringUtils.isNull(userList) || userList.size() == 0)
{
- throw new CustomException("瀵煎叆鐢ㄦ埛鏁版嵁涓嶈兘涓虹┖锛�");
+ throw new ServiceException("瀵煎叆鐢ㄦ埛鏁版嵁涓嶈兘涓虹┖锛�");
}
int successNum = 0;
int failureNum = 0;
@@ -460,6 +519,7 @@
SysUser u = userMapper.selectUserByUserName(user.getUserName());
if (StringUtils.isNull(u))
{
+ BeanValidators.validateWithException(validator, user);
user.setPassword(SecurityUtils.encryptPassword(password));
user.setCreateBy(operName);
this.insertUser(user);
@@ -468,6 +528,7 @@
}
else if (isUpdateSupport)
{
+ BeanValidators.validateWithException(validator, user);
user.setUpdateBy(operName);
this.updateUser(user);
successNum++;
@@ -490,7 +551,7 @@
if (failureNum > 0)
{
failureMsg.insert(0, "寰堟姳姝夛紝瀵煎叆澶辫触锛佸叡 " + failureNum + " 鏉℃暟鎹牸寮忎笉姝ｇ‘锛岄敊璇涓嬶細");
- throw new CustomException(failureMsg.toString());
+ throw new ServiceException(failureMsg.toString());
}
else
{
--
Gitblit v1.9.3