BJ_ZTEITS-Developers / parking-cloud-yudao

Commit 5d1fd70dc3e61bf64e7ce3328a71cc60001175c6

Authored by YunaiV
1 parent cd47e9dd

fix(erp): 修复销售订单误用销售出库权限 

将 ErpSaleOrderController 的权限标识从 erp:sale-out:* 修正为
erp:sale-order:*，避免拥有销售出库权限的用户越权访问销售订单接口。

Fixes: https://github.com/YunaiV/ruoyi-vue-pro/issues/1161
Inline Side-by-side
Showing 1 changed file with 8 additions and 8 deletions
yudao-module-erp/src/main/java/cn/iocoder/yudao/module/erp/controller/admin/sale/ErpSaleOrderController.java
  View file @5d1fd70
... ... @@ -61,14 +61,14 @@ public class ErpSaleOrderController {
61 61  
62 62 @PostMapping("/create")
63 63 @Operation(summary = "创建销售订单")
64   - @PreAuthorize("@ss.hasPermission('erp:sale-out:create')")
  64 + @PreAuthorize("@ss.hasPermission('erp:sale-order:create')")
65 65 public CommonResult<Long> createSaleOrder(@Valid @RequestBody ErpSaleOrderSaveReqVO createReqVO) {
66 66 return success(saleOrderService.createSaleOrder(createReqVO));
67 67 }
68 68  
69 69 @PutMapping("/update")
70 70 @Operation(summary = "更新销售订单")
71   - @PreAuthorize("@ss.hasPermission('erp:sale-out:update')")
  71 + @PreAuthorize("@ss.hasPermission('erp:sale-order:update')")
72 72 public CommonResult<Boolean> updateSaleOrder(@Valid @RequestBody ErpSaleOrderSaveReqVO updateReqVO) {
73 73 saleOrderService.updateSaleOrder(updateReqVO);
74 74 return success(true);
... ... @@ -76,7 +76,7 @@ public class ErpSaleOrderController {
76 76  
77 77 @PutMapping("/update-status")
78 78 @Operation(summary = "更新销售订单的状态")
79   - @PreAuthorize("@ss.hasPermission('erp:sale-out:update-status')")
  79 + @PreAuthorize("@ss.hasPermission('erp:sale-order:update-status')")
80 80 public CommonResult<Boolean> updateSaleOrderStatus(@RequestParam("id") Long id,
81 81 @RequestParam("status") Integer status) {
82 82 saleOrderService.updateSaleOrderStatus(id, status);
... ... @@ -86,7 +86,7 @@ public class ErpSaleOrderController {
86 86 @DeleteMapping("/delete")
87 87 @Operation(summary = "删除销售订单")
88 88 @Parameter(name = "ids", description = "编号数组", required = true)
89   - @PreAuthorize("@ss.hasPermission('erp:sale-out:delete')")
  89 + @PreAuthorize("@ss.hasPermission('erp:sale-order:delete')")
90 90 public CommonResult<Boolean> deleteSaleOrder(@RequestParam("ids") List<Long> ids) {
91 91 saleOrderService.deleteSaleOrder(ids);
92 92 return success(true);
... ... @@ -95,7 +95,7 @@ public class ErpSaleOrderController {
95 95 @GetMapping("/get")
96 96 @Operation(summary = "获得销售订单")
97 97 @Parameter(name = "id", description = "编号", required = true, example = "1024")
98   - @PreAuthorize("@ss.hasPermission('erp:sale-out:query')")
  98 + @PreAuthorize("@ss.hasPermission('erp:sale-order:query')")
99 99 public CommonResult<ErpSaleOrderRespVO> getSaleOrder(@RequestParam("id") Long id) {
100 100 ErpSaleOrderDO saleOrder = saleOrderService.getSaleOrder(id);
101 101 if (saleOrder == null) {
... ... @@ -115,7 +115,7 @@ public class ErpSaleOrderController {
115 115  
116 116 @GetMapping("/page")
117 117 @Operation(summary = "获得销售订单分页")
118   - @PreAuthorize("@ss.hasPermission('erp:sale-out:query')")
  118 + @PreAuthorize("@ss.hasPermission('erp:sale-order:query')")
119 119 public CommonResult<PageResult<ErpSaleOrderRespVO>> getSaleOrderPage(@Valid ErpSaleOrderPageReqVO pageReqVO) {
120 120 PageResult<ErpSaleOrderDO> pageResult = saleOrderService.getSaleOrderPage(pageReqVO);
121 121 return success(buildSaleOrderVOPageResult(pageResult));
... ... @@ -123,7 +123,7 @@ public class ErpSaleOrderController {
123 123  
124 124 @GetMapping("/export-excel")
125 125 @Operation(summary = "导出销售订单 Excel")
126   - @PreAuthorize("@ss.hasPermission('erp:sale-out:export')")
  126 + @PreAuthorize("@ss.hasPermission('erp:sale-order:export')")
127 127 @ApiAccessLog(operateType = EXPORT)
128 128 public void exportSaleOrderExcel(@Valid ErpSaleOrderPageReqVO pageReqVO,
129 129 HttpServletResponse response) throws IOException {
... ... @@ -161,4 +161,4 @@ public class ErpSaleOrderController {
161 161 });
162 162 }
163 163  
164   -}
165 164 \ No newline at end of file
  165 +}
... ...