From 25f60fff9e407e4a0e7e261c7de98080f860eafa Mon Sep 17 00:00:00 2001
From: zhangdaiscott <zhangdaiscott@163.com>
Date: Fri, 11 Sep 2026 16:22:05 +0800
Subject: [PATCH] =?UTF-8?q?=E3=80=90=E5=AE=89=E5=85=A8=E4=BF=AE=E5=A4=8D?=
 =?UTF-8?q?=20GHSA-4c6j-45p9-rhrw=E3=80=91=E5=A1=AB=E5=80=BC=E8=A7=84?=
 =?UTF-8?q?=E5=88=99=E7=AE=A1=E7=90=86=E6=8E=A5=E5=8F=A3=E7=BC=BA=E5=B0=91?=
 =?UTF-8?q?=E6=9D=83=E9=99=90=E6=A0=A1=E9=AA=8C?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

/sys/fillRule 的 list、queryById、exportXls、importExcel 四个接口缺少 @RequiresRoles({"admin"})，
任意登录用户（含零角色新注册账号）可导出全部填值规则（ruleCode/ruleClass/ruleParams）并新增规则记录。
补齐 admin 角色限制，与 add/edit/delete/testFillRule 保持一致；
executeRuleByCode 供 Online 表单调用，按公告建议不加限制。

Co-Authored-By: Claude <noreply@anthropic.com>
---
 .../modules/system/controller/SysFillRuleController.java      | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysFillRuleController.java b/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysFillRuleController.java
index b65ae96a9..848d831a4 100644
--- a/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysFillRuleController.java
+++ b/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysFillRuleController.java
@@ -53,6 +53,7 @@ public class SysFillRuleController extends JeecgController<SysFillRule, ISysFill
      */
     @AutoLog(value = "填值规则-分页列表查询")
     @Operation(summary = "填值规则-分页列表查询")
+    @RequiresRoles({"admin"})
     @GetMapping(value = "/list")
     public Result<?> queryPageList(SysFillRule sysFillRule,
                                    @RequestParam(name = "pageNo", defaultValue = "1") Integer pageNo,
@@ -145,6 +146,7 @@ public class SysFillRuleController extends JeecgController<SysFillRule, ISysFill
      */
     @AutoLog(value = "填值规则-通过id查询")
     @Operation(summary = "填值规则-通过id查询")
+    @RequiresRoles({"admin"})
     @GetMapping(value = "/queryById")
     public Result<?> queryById(@RequestParam(name = "id", required = true) String id) {
         SysFillRule sysFillRule = sysFillRuleService.getById(id);
@@ -157,6 +159,7 @@ public class SysFillRuleController extends JeecgController<SysFillRule, ISysFill
      * @param request
      * @param sysFillRule
      */
+    @RequiresRoles({"admin"})
     @RequestMapping(value = "/exportXls")
     public ModelAndView exportXls(HttpServletRequest request, SysFillRule sysFillRule) {
         return super.exportXls(request, sysFillRule, SysFillRule.class, "填值规则");
@@ -169,6 +172,7 @@ public class SysFillRuleController extends JeecgController<SysFillRule, ISysFill
      * @param response
      * @return
      */
+    @RequiresRoles({"admin"})
     @RequestMapping(value = "/importExcel", method = RequestMethod.POST)
     public Result<?> importExcel(HttpServletRequest request, HttpServletResponse response) {
         //update-begin---author:wangshuai ---date:20260803  for：【LHZP-1265】系统编码规则导入重复编码时提示具体Excel行号-----------