abu/wzj-boot
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix 修复 新建用户可能会存在的越权行为

Browse Source
This commit is contained in:
疯狂的狮子Li 2023-08-30 21:49:19 +08:00
parent 2e3b068341
commit f8d551e226
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
ruoyi-admin/src/main/java/com/ruoyi/web/controller/system/SysUserController.java
View File

@ -141,6 +141,7 @@ public class SysUserController extends BaseController {
@Log(title = "用户管理", businessType = BusinessType.INSERT) @Log(title = "用户管理", businessType = BusinessType.INSERT)
@PostMapping @PostMapping
public R<Void> add(@Validated @RequestBody SysUser user) { public R<Void> add(@Validated @RequestBody SysUser user) {
deptService.checkDeptDataScope(user.getDeptId());
if (!userService.checkUserNameUnique(user)) { if (!userService.checkUserNameUnique(user)) {
return R.fail("新增用户'" + user.getUserName() + "'失败，登录账号已存在"); return R.fail("新增用户'" + user.getUserName() + "'失败，登录账号已存在");
} else if (StringUtils.isNotEmpty(user.getPhonenumber()) && !userService.checkPhoneUnique(user)) { } else if (StringUtils.isNotEmpty(user.getPhonenumber()) && !userService.checkPhoneUnique(user)) {
@ -161,6 +162,7 @@ public class SysUserController extends BaseController {
public R<Void> edit(@Validated @RequestBody SysUser user) { public R<Void> edit(@Validated @RequestBody SysUser user) {
userService.checkUserAllowed(user); userService.checkUserAllowed(user);
userService.checkUserDataScope(user.getUserId()); userService.checkUserDataScope(user.getUserId());
deptService.checkDeptDataScope(user.getDeptId());
if (!userService.checkUserNameUnique(user)) { if (!userService.checkUserNameUnique(user)) {
return R.fail("修改用户'" + user.getUserName() + "'失败，登录账号已存在"); return R.fail("修改用户'" + user.getUserName() + "'失败，登录账号已存在");
} else if (StringUtils.isNotEmpty(user.getPhonenumber()) && !userService.checkPhoneUnique(user)) { } else if (StringUtils.isNotEmpty(user.getPhonenumber()) && !userService.checkPhoneUnique(user)) {