修复任意账户越权问题

RuoYi

2021-07-27 20ce9da509036d856b4297c162442e8a8b414d7b

修复任意账户越权问题

 ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/controller/SysProfileController.java

@@ -75,9 +75,12 @@
        {

            return AjaxResult.error("修改用户'" + user.getUserName() + "'失败，邮箱账号已存在");

        }

        LoginUser loginUser = tokenService.getLoginUser();

        SysUser sysUser = loginUser.getSysUser();

        user.setUserId(sysUser.getUserId());

        user.setPassword(null);

        if (userService.updateUserProfile(user) > 0)

        {

            LoginUser loginUser = tokenService.getLoginUser();

            // 更新缓存用户信息

            loginUser.getSysUser().setNickName(user.getNickName());

            loginUser.getSysUser().setPhonenumber(user.getPhonenumber());