BJ_ZTEITS-Developers / parking-cloud-yudao

Commit 5d1fd70dc3e61bf64e7ce3328a71cc60001175c6

Authored by YunaiV
1 parent cd47e9dd

fix(erp): 修复销售订单误用销售出库权限 

将 ErpSaleOrderController 的权限标识从 erp:sale-out:* 修正为
erp:sale-order:*，避免拥有销售出库权限的用户越权访问销售订单接口。

Fixes: https://github.com/YunaiV/ruoyi-vue-pro/issues/1161
Inline Side-by-side
Showing 1 changed file with 8 additions and 8 deletions
yudao-module-erp/src/main/java/cn/iocoder/yudao/module/erp/controller/admin/sale/ErpSaleOrderController.java
  View file @5d1fd70
@@ -61,14 +61,14 @@ public class ErpSaleOrderController { @@ -61,14 +61,14 @@ public class ErpSaleOrderController {
61 61
62 @PostMapping("/create") 62 @PostMapping("/create")
63 @Operation(summary = "创建销售订单") 63 @Operation(summary = "创建销售订单")
64 - @PreAuthorize("@ss.hasPermission('erp:sale-out:create')") 64 + @PreAuthorize("@ss.hasPermission('erp:sale-order:create')")
65 public CommonResult<Long> createSaleOrder(@Valid @RequestBody ErpSaleOrderSaveReqVO createReqVO) { 65 public CommonResult<Long> createSaleOrder(@Valid @RequestBody ErpSaleOrderSaveReqVO createReqVO) {
66 return success(saleOrderService.createSaleOrder(createReqVO)); 66 return success(saleOrderService.createSaleOrder(createReqVO));
67 } 67 }
68 68
69 @PutMapping("/update") 69 @PutMapping("/update")
70 @Operation(summary = "更新销售订单") 70 @Operation(summary = "更新销售订单")
71 - @PreAuthorize("@ss.hasPermission('erp:sale-out:update')") 71 + @PreAuthorize("@ss.hasPermission('erp:sale-order:update')")
72 public CommonResult<Boolean> updateSaleOrder(@Valid @RequestBody ErpSaleOrderSaveReqVO updateReqVO) { 72 public CommonResult<Boolean> updateSaleOrder(@Valid @RequestBody ErpSaleOrderSaveReqVO updateReqVO) {
73 saleOrderService.updateSaleOrder(updateReqVO); 73 saleOrderService.updateSaleOrder(updateReqVO);
74 return success(true); 74 return success(true);
@@ -76,7 +76,7 @@ public class ErpSaleOrderController { @@ -76,7 +76,7 @@ public class ErpSaleOrderController {
76 76
77 @PutMapping("/update-status") 77 @PutMapping("/update-status")
78 @Operation(summary = "更新销售订单的状态") 78 @Operation(summary = "更新销售订单的状态")
79 - @PreAuthorize("@ss.hasPermission('erp:sale-out:update-status')") 79 + @PreAuthorize("@ss.hasPermission('erp:sale-order:update-status')")
80 public CommonResult<Boolean> updateSaleOrderStatus(@RequestParam("id") Long id, 80 public CommonResult<Boolean> updateSaleOrderStatus(@RequestParam("id") Long id,
81 @RequestParam("status") Integer status) { 81 @RequestParam("status") Integer status) {
82 saleOrderService.updateSaleOrderStatus(id, status); 82 saleOrderService.updateSaleOrderStatus(id, status);
@@ -86,7 +86,7 @@ public class ErpSaleOrderController { @@ -86,7 +86,7 @@ public class ErpSaleOrderController {
86 @DeleteMapping("/delete") 86 @DeleteMapping("/delete")
87 @Operation(summary = "删除销售订单") 87 @Operation(summary = "删除销售订单")
88 @Parameter(name = "ids", description = "编号数组", required = true) 88 @Parameter(name = "ids", description = "编号数组", required = true)
89 - @PreAuthorize("@ss.hasPermission('erp:sale-out:delete')") 89 + @PreAuthorize("@ss.hasPermission('erp:sale-order:delete')")
90 public CommonResult<Boolean> deleteSaleOrder(@RequestParam("ids") List<Long> ids) { 90 public CommonResult<Boolean> deleteSaleOrder(@RequestParam("ids") List<Long> ids) {
91 saleOrderService.deleteSaleOrder(ids); 91 saleOrderService.deleteSaleOrder(ids);
92 return success(true); 92 return success(true);
@@ -95,7 +95,7 @@ public class ErpSaleOrderController { @@ -95,7 +95,7 @@ public class ErpSaleOrderController {
95 @GetMapping("/get") 95 @GetMapping("/get")
96 @Operation(summary = "获得销售订单") 96 @Operation(summary = "获得销售订单")
97 @Parameter(name = "id", description = "编号", required = true, example = "1024") 97 @Parameter(name = "id", description = "编号", required = true, example = "1024")
98 - @PreAuthorize("@ss.hasPermission('erp:sale-out:query')") 98 + @PreAuthorize("@ss.hasPermission('erp:sale-order:query')")
99 public CommonResult<ErpSaleOrderRespVO> getSaleOrder(@RequestParam("id") Long id) { 99 public CommonResult<ErpSaleOrderRespVO> getSaleOrder(@RequestParam("id") Long id) {
100 ErpSaleOrderDO saleOrder = saleOrderService.getSaleOrder(id); 100 ErpSaleOrderDO saleOrder = saleOrderService.getSaleOrder(id);
101 if (saleOrder == null) { 101 if (saleOrder == null) {
@@ -115,7 +115,7 @@ public class ErpSaleOrderController { @@ -115,7 +115,7 @@ public class ErpSaleOrderController {
115 115
116 @GetMapping("/page") 116 @GetMapping("/page")
117 @Operation(summary = "获得销售订单分页") 117 @Operation(summary = "获得销售订单分页")
118 - @PreAuthorize("@ss.hasPermission('erp:sale-out:query')") 118 + @PreAuthorize("@ss.hasPermission('erp:sale-order:query')")
119 public CommonResult<PageResult<ErpSaleOrderRespVO>> getSaleOrderPage(@Valid ErpSaleOrderPageReqVO pageReqVO) { 119 public CommonResult<PageResult<ErpSaleOrderRespVO>> getSaleOrderPage(@Valid ErpSaleOrderPageReqVO pageReqVO) {
120 PageResult<ErpSaleOrderDO> pageResult = saleOrderService.getSaleOrderPage(pageReqVO); 120 PageResult<ErpSaleOrderDO> pageResult = saleOrderService.getSaleOrderPage(pageReqVO);
121 return success(buildSaleOrderVOPageResult(pageResult)); 121 return success(buildSaleOrderVOPageResult(pageResult));
@@ -123,7 +123,7 @@ public class ErpSaleOrderController { @@ -123,7 +123,7 @@ public class ErpSaleOrderController {
123 123
124 @GetMapping("/export-excel") 124 @GetMapping("/export-excel")
125 @Operation(summary = "导出销售订单 Excel") 125 @Operation(summary = "导出销售订单 Excel")
126 - @PreAuthorize("@ss.hasPermission('erp:sale-out:export')") 126 + @PreAuthorize("@ss.hasPermission('erp:sale-order:export')")
127 @ApiAccessLog(operateType = EXPORT) 127 @ApiAccessLog(operateType = EXPORT)
128 public void exportSaleOrderExcel(@Valid ErpSaleOrderPageReqVO pageReqVO, 128 public void exportSaleOrderExcel(@Valid ErpSaleOrderPageReqVO pageReqVO,
129 HttpServletResponse response) throws IOException { 129 HttpServletResponse response) throws IOException {
@@ -161,4 +161,4 @@ public class ErpSaleOrderController { @@ -161,4 +161,4 @@ public class ErpSaleOrderController {
161 }); 161 });
162 } 162 }
163 163
164 -}  
165 \ No newline at end of file 164 \ No newline at end of file
  165 +}