From 20ce9da509036d856b4297c162442e8a8b414d7b Mon Sep 17 00:00:00 2001
From: RuoYi <yzz_ivy@163.com>
Date: Tue, 27 Jul 2021 13:08:37 +0800
Subject: [PATCH] 修复任意账户越权问题
---
ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/controller/SysLogininforController.java | 47 +++++++++++++++++++++++++++++++++++++----------
1 files changed, 37 insertions(+), 10 deletions(-)
diff --git a/ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/controller/SysLogininforController.java b/ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/controller/SysLogininforController.java
index f5cf843..77cf00c 100644
--- a/ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/controller/SysLogininforController.java
+++ b/ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/controller/SysLogininforController.java
@@ -4,19 +4,23 @@
import java.util.List;
import javax.servlet.http.HttpServletResponse;
import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.web.bind.annotation.DeleteMapping;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PathVariable;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.RestController;
+import com.ruoyi.common.core.constant.Constants;
+import com.ruoyi.common.core.utils.ServletUtils;
+import com.ruoyi.common.core.utils.ip.IpUtils;
import com.ruoyi.common.core.utils.poi.ExcelUtil;
import com.ruoyi.common.core.web.controller.BaseController;
import com.ruoyi.common.core.web.domain.AjaxResult;
import com.ruoyi.common.core.web.page.TableDataInfo;
import com.ruoyi.common.log.annotation.Log;
import com.ruoyi.common.log.enums.BusinessType;
+import com.ruoyi.common.security.annotation.PreAuthorize;
import com.ruoyi.system.domain.SysLogininfor;
import com.ruoyi.system.service.ISysLogininforService;
@@ -32,7 +36,7 @@
@Autowired
private ISysLogininforService logininforService;
- @PreAuthorize("@ss.hasPermi('system:logininfor:list')")
+ @PreAuthorize(hasPermi = "system:logininfor:list")
@GetMapping("/list")
public TableDataInfo list(SysLogininfor logininfor)
{
@@ -40,31 +44,54 @@
List<SysLogininfor> list = logininforService.selectLogininforList(logininfor);
return getDataTable(list);
}
-
- @Log(title = "登陆日志", businessType = BusinessType.EXPORT)
- @PreAuthorize("@ss.hasPermi('system:logininfor:export')")
+
+ @Log(title = "登录日志", businessType = BusinessType.EXPORT)
+ @PreAuthorize(hasPermi = "system:logininfor:export")
@PostMapping("/export")
public void export(HttpServletResponse response, SysLogininfor logininfor) throws IOException
{
List<SysLogininfor> list = logininforService.selectLogininforList(logininfor);
ExcelUtil<SysLogininfor> util = new ExcelUtil<SysLogininfor>(SysLogininfor.class);
- util.exportExcel(response, list, "登陆日志");
+ util.exportExcel(response, list, "登录日志");
}
- @PreAuthorize("@ss.hasPermi('system:logininfor:remove')")
- @Log(title = "登陆日志", businessType = BusinessType.DELETE)
+ @PreAuthorize(hasPermi = "system:logininfor:remove")
+ @Log(title = "登录日志", businessType = BusinessType.DELETE)
@DeleteMapping("/{infoIds}")
public AjaxResult remove(@PathVariable Long[] infoIds)
{
return toAjax(logininforService.deleteLogininforByIds(infoIds));
}
- @PreAuthorize("@ss.hasPermi('system:logininfor:remove')")
- @Log(title = "登陆日志", businessType = BusinessType.DELETE)
+ @PreAuthorize(hasPermi = "system:logininfor:remove")
+ @Log(title = "登录日志", businessType = BusinessType.DELETE)
@DeleteMapping("/clean")
public AjaxResult clean()
{
logininforService.cleanLogininfor();
return AjaxResult.success();
}
+
+ @PostMapping
+ public AjaxResult add(@RequestParam("username") String username, @RequestParam("status") String status,
+ @RequestParam("message") String message)
+ {
+ String ip = IpUtils.getIpAddr(ServletUtils.getRequest());
+
+ // 封装对象
+ SysLogininfor logininfor = new SysLogininfor();
+ logininfor.setUserName(username);
+ logininfor.setIpaddr(ip);
+ logininfor.setMsg(message);
+ // 日志状态
+ if (Constants.LOGIN_SUCCESS.equals(status) || Constants.LOGOUT.equals(status))
+ {
+ logininfor.setStatus("0");
+ }
+ else if (Constants.LOGIN_FAIL.equals(status))
+ {
+ logininfor.setStatus("1");
+ }
+ return toAjax(logininforService.insertLogininfor(logininfor));
+ }
}
--
Gitblit v1.9.3