chenxudong
/
electromagnetic-data-new
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

增加导出功能的权限校验。

This commit is contained in:
chenxudong 2025-01-10 10:24:47 +08:00
parent 8dc4c731d0
commit e4024a2dae
4 changed files with 19 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
electrmangnetic/src/main/java/com/electromagnetic/industry/software/manage/config/LoginInterceptor.java
View File

@ -2,6 +2,7 @@ package com.electromagnetic.industry.software.manage.config;
import cn.hutool.core.date.SystemClock;
import com.electromagnetic.industry.software.common.cons.UserConstants;
import com.electromagnetic.industry.software.common.enums.AdminTypeEnum;
import com.electromagnetic.industry.software.common.pojo.UserLoginInfo;
import com.electromagnetic.industry.software.common.util.TokenUtil;
import com.electromagnetic.industry.software.common.util.UserThreadLocal;
@ -36,12 +37,12 @@ public class LoginInterceptor implements HandlerInterceptor {
}
private boolean checkSysAdminOperation(HttpServletRequest request, HttpServletResponse response) {
// String requestURI = request.getRequestURI();
// if (requestURI.startsWith("/data/ed/prj") && !UserThreadLocal.getAdminType().equals(AdminTypeEnum.SYSTEM.getValue())) {
// log.warn("{}没有层级操作权限，当前用户类型是{}", UserThreadLocal.getUsername(), UserThreadLocal.getAdminType());
// response.setStatus(HttpServletResponse.SC_FORBIDDEN);
// return false;
// }
String requestURI = request.getRequestURI();
if (requestURI.startsWith("/data/ed/prj") && !UserThreadLocal.getAdminType().equals(AdminTypeEnum.SYSTEM.getValue())) {
log.warn("{}没有层级操作权限，当前用户类型是{}", UserThreadLocal.getUsername(), UserThreadLocal.getAdminType());
response.setStatus(HttpServletResponse.SC_FORBIDDEN);
return false;
}
return true;
}

2
electrmangnetic/src/main/java/com/electromagnetic/industry/software/manage/service/PermissionService.java
View File

@ -42,5 +42,5 @@ public interface PermissionService {
* 检查文件id列表是否可具有导出权限
* @param ids
*/
String[] filterExportIds(String[] ids);
Map<String, Boolean> filterExportIds(String[] ids);
}

4
electrmangnetic/src/main/java/com/electromagnetic/industry/software/manage/service/serviceimpl/EdFileInfoServiceImpl.java
View File

@ -610,6 +610,10 @@ public class EdFileInfoServiceImpl extends ServiceImpl<EdFileInfoMapper, EdFileI
public ResponseEntity<InputStreamResource> batchExport(String dataIdArr, HttpServletResponse response) throws IOException {
String userDownloadDataDir = downloadDataDir + File.separator + UserThreadLocal.getUserId();
String[] ids = dataIdArr.split(",");
Map<String, Boolean> map = permissionService.filterExportIds(ids);
if (map.containsValue(Boolean.FALSE)) {
throw new BizException(-1, "有未授权的层级接口，禁止导出");
}
Map<String, EdFileInfo> maps = new HashMap<>();
for (String id : ids) {
Map<String, EdFileInfo> edFileInfos = this.baseMapper.selectList(Wrappers.lambdaQuery(EdFileInfo.class)

17
electrmangnetic/src/main/java/com/electromagnetic/industry/software/manage/service/serviceimpl/PermissionServiceImpl.java
View File

@ -123,23 +123,22 @@ public class PermissionServiceImpl implements PermissionService {
* @param ids
*/
@Override
public String[] filterExportIds(String[] ids){
public Map<String, Boolean> filterExportIds(String[] ids) {
Map<String, Boolean> map = new HashMap<>();
if (ids.length==0) {
return ids;
return map;
}
String userId=UserThreadLocal.getUserId();
List<String> roleIds = getRoles(userId);
List<String> result = new ArrayList<>();
for (String id : ids) {
LambdaQueryWrapper<RolePermission> queryWrapper = new LambdaQueryWrapper<>();
queryWrapper.eq(RolePermission::getFileId, id)
.eq(RolePermission::getPermissionCode, FilePermission.EXPORT.getCode())
.in(RolePermission::getRoleId, roleIds);
List<RolePermission> list = rolePermissionMapper.selectList(queryWrapper);
if (!list.isEmpty()) {
result.add(id);
}
}
return result.toArray(new String[0]);
long count = rolePermissionMapper.selectCount(queryWrapper);
map.put(id, count > 0);
}
return map;
}
}