github/JeecgBoot
1
0
Fork 0
mirror of https://github.com/jeecgboot/JeecgBoot.git synced 2026-09-14 16:09:10 +00:00
Code Issues Packages Projects Releases Wiki Activity

【安全修复 GHSA-4c6j-45p9-rhrw】填值规则管理接口缺少权限校验

Browse Source 
/sys/fillRule 的 list、queryById、exportXls、importExcel 四个接口缺少 @RequiresRoles({"admin"})，
任意登录用户（含零角色新注册账号）可导出全部填值规则（ruleCode/ruleClass/ruleParams）并新增规则记录。
补齐 admin 角色限制，与 add/edit/delete/testFillRule 保持一致；
executeRuleByCode 供 Online 表单调用，按公告建议不加限制。

Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
zhangdaiscott 2026-09-11 16:22:05 +08:00
parent 34191cdee6
commit 25f60fff9e
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysFillRuleController.java
View File

@ -53,6 +53,7 @@ public class SysFillRuleController extends JeecgController<SysFillRule, ISysFill
*/ */
@AutoLog(value = "填值规则-分页列表查询") @AutoLog(value = "填值规则-分页列表查询")
@Operation(summary = "填值规则-分页列表查询") @Operation(summary = "填值规则-分页列表查询")
@RequiresRoles({"admin"})
@GetMapping(value = "/list") @GetMapping(value = "/list")
public Result<?> queryPageList(SysFillRule sysFillRule, public Result<?> queryPageList(SysFillRule sysFillRule,
@RequestParam(name = "pageNo", defaultValue = "1") Integer pageNo, @RequestParam(name = "pageNo", defaultValue = "1") Integer pageNo,
@ -145,6 +146,7 @@ public class SysFillRuleController extends JeecgController<SysFillRule, ISysFill
*/ */
@AutoLog(value = "填值规则-通过id查询") @AutoLog(value = "填值规则-通过id查询")
@Operation(summary = "填值规则-通过id查询") @Operation(summary = "填值规则-通过id查询")
@RequiresRoles({"admin"})
@GetMapping(value = "/queryById") @GetMapping(value = "/queryById")
public Result<?> queryById(@RequestParam(name = "id", required = true) String id) { public Result<?> queryById(@RequestParam(name = "id", required = true) String id) {
SysFillRule sysFillRule = sysFillRuleService.getById(id); SysFillRule sysFillRule = sysFillRuleService.getById(id);
@ -157,6 +159,7 @@ public class SysFillRuleController extends JeecgController<SysFillRule, ISysFill
* @param request * @param request
* @param sysFillRule * @param sysFillRule
*/ */
@RequiresRoles({"admin"})
@RequestMapping(value = "/exportXls") @RequestMapping(value = "/exportXls")
public ModelAndView exportXls(HttpServletRequest request, SysFillRule sysFillRule) { public ModelAndView exportXls(HttpServletRequest request, SysFillRule sysFillRule) {
return super.exportXls(request, sysFillRule, SysFillRule.class, "填值规则"); return super.exportXls(request, sysFillRule, SysFillRule.class, "填值规则");
@ -169,6 +172,7 @@ public class SysFillRuleController extends JeecgController<SysFillRule, ISysFill
* @param response * @param response
* @return * @return
*/ */
@RequiresRoles({"admin"})
@RequestMapping(value = "/importExcel", method = RequestMethod.POST) @RequestMapping(value = "/importExcel", method = RequestMethod.POST)
public Result<?> importExcel(HttpServletRequest request, HttpServletResponse response) { public Result<?> importExcel(HttpServletRequest request, HttpServletResponse response) {
//update-begin---author:wangshuai ---date:20260803 for：【LHZP-1265】系统编码规则导入重复编码时提示具体Excel行号----------- //update-begin---author:wangshuai ---date:20260803 for：【LHZP-1265】系统编码规则导入重复编码时提示具体Excel行号-----------