ly
/
Stwzhj-Cloud-Plus
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix 修复 新建用户可能会存在的越权行为

2.X
疯狂的狮子Li 2023-08-30 21:46:50 +08:00
parent d1d8fb442e
commit 6ca9f3603d
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
ruoyi-modules/ruoyi-system/src/main/java/org/dromara/system/controller/system/SysUserController.java
View File

@ -151,6 +151,7 @@ public class SysUserController extends BaseController {
@Log(title = "用户管理", businessType = BusinessType.INSERT) @Log(title = "用户管理", businessType = BusinessType.INSERT)
@PostMapping @PostMapping
public R<Void> add(@Validated @RequestBody SysUserBo user) { public R<Void> add(@Validated @RequestBody SysUserBo user) {
deptService.checkDeptDataScope(user.getDeptId());
if (!userService.checkUserNameUnique(user)) { if (!userService.checkUserNameUnique(user)) {
return R.fail("新增用户'" + user.getUserName() + "'失败，登录账号已存在"); return R.fail("新增用户'" + user.getUserName() + "'失败，登录账号已存在");
} else if (StringUtils.isNotEmpty(user.getPhonenumber()) && !userService.checkPhoneUnique(user)) { } else if (StringUtils.isNotEmpty(user.getPhonenumber()) && !userService.checkPhoneUnique(user)) {
@ -176,6 +177,7 @@ public class SysUserController extends BaseController {
public R<Void> edit(@Validated @RequestBody SysUserBo user) { public R<Void> edit(@Validated @RequestBody SysUserBo user) {
userService.checkUserAllowed(user.getUserId()); userService.checkUserAllowed(user.getUserId());
userService.checkUserDataScope(user.getUserId()); userService.checkUserDataScope(user.getUserId());
deptService.checkDeptDataScope(user.getDeptId());
if (!userService.checkUserNameUnique(user)) { if (!userService.checkUserNameUnique(user)) {
return R.fail("修改用户'" + user.getUserName() + "'失败，登录账号已存在"); return R.fail("修改用户'" + user.getUserName() + "'失败，登录账号已存在");
} else if (StringUtils.isNotEmpty(user.getPhonenumber()) && !userService.checkPhoneUnique(user)) { } else if (StringUtils.isNotEmpty(user.getPhonenumber()) && !userService.checkPhoneUnique(user)) {