From 8b252709a45e24fa83b443af6281ac612862b05d Mon Sep 17 00:00:00 2001
From: 码上秃Hello <19973252123@163.com>
Date: Tue, 15 Aug 2023 11:25:00 +0800
Subject: [PATCH] 修改个人信息：防止用户有目的性的修改其他属性
---
ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/service/impl/SysPermissionServiceImpl.java | 34 ++++++++++++++++++++++++++++------
1 files changed, 28 insertions(+), 6 deletions(-)
diff --git a/ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/service/impl/SysPermissionServiceImpl.java b/ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/service/impl/SysPermissionServiceImpl.java
index 46a8c7a..b506636 100644
--- a/ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/service/impl/SysPermissionServiceImpl.java
+++ b/ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/service/impl/SysPermissionServiceImpl.java
@@ -1,14 +1,22 @@
package com.ruoyi.system.service.impl;
import java.util.HashSet;
+import java.util.List;
import java.util.Set;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Service;
+import org.springframework.util.CollectionUtils;
+import com.ruoyi.system.api.domain.SysRole;
import com.ruoyi.system.api.domain.SysUser;
import com.ruoyi.system.service.ISysMenuService;
import com.ruoyi.system.service.ISysPermissionService;
import com.ruoyi.system.service.ISysRoleService;
+/**
+ * 用户权限处理
+ *
+ * @author ruoyi
+ */
@Service
public class SysPermissionServiceImpl implements ISysPermissionService
{
@@ -25,17 +33,17 @@
* @return 角色权限信息
*/
@Override
- public Set<String> getRolePermission(Long userId)
+ public Set<String> getRolePermission(SysUser user)
{
Set<String> roles = new HashSet<String>();
// 管理员拥有所有权限
- if (SysUser.isAdmin(userId))
+ if (user.isAdmin())
{
roles.add("admin");
}
else
{
- roles.addAll(roleService.selectRolePermissionByUserId(userId));
+ roles.addAll(roleService.selectRolePermissionByUserId(user.getUserId()));
}
return roles;
}
@@ -47,17 +55,31 @@
* @return 菜单权限信息
*/
@Override
- public Set<String> getMenuPermission(Long userId)
+ public Set<String> getMenuPermission(SysUser user)
{
Set<String> perms = new HashSet<String>();
// 管理员拥有所有权限
- if (SysUser.isAdmin(userId))
+ if (user.isAdmin())
{
perms.add("*:*:*");
}
else
{
- perms.addAll(menuService.selectMenuPermsByUserId(userId));
+ List<SysRole> roles = user.getRoles();
+ if (!CollectionUtils.isEmpty(roles))
+ {
+ // 多角色设置permissions属性，以便数据权限匹配权限
+ for (SysRole role : roles)
+ {
+ Set<String> rolePerms = menuService.selectMenuPermsByRoleId(role.getRoleId());
+ role.setPermissions(rolePerms);
+ perms.addAll(rolePerms);
+ }
+ }
+ else
+ {
+ perms.addAll(menuService.selectMenuPermsByUserId(user.getUserId()));
+ }
}
return perms;
}
--
Gitblit v1.9.3