Commit b93199bd0a12baa0bd17b7082158516bf96cd50b
Committed by
Gitee
Gitee
!1124 【修复】修复会员取消售后接口中未校验用户ID的漏洞
Merge pull request !1124 from 杨宇庆/N/A
Showing
1 changed file
with
1 additions
and
1 deletions
yudao-module-mall/yudao-module-trade-biz/src/main/java/cn/iocoder/yudao/module/trade/service/aftersale/AfterSaleServiceImpl.java
| @@ -399,7 +399,7 @@ public class AfterSaleServiceImpl implements AfterSaleService { | @@ -399,7 +399,7 @@ public class AfterSaleServiceImpl implements AfterSaleService { | ||
| 399 | @AfterSaleLog(operateType = AfterSaleOperateTypeEnum.MEMBER_CANCEL) | 399 | @AfterSaleLog(operateType = AfterSaleOperateTypeEnum.MEMBER_CANCEL) |
| 400 | public void cancelAfterSale(Long userId, Long id) { | 400 | public void cancelAfterSale(Long userId, Long id) { |
| 401 | // 校验售后单的状态，并状态待退款 | 401 | // 校验售后单的状态，并状态待退款 |
| 402 | - AfterSaleDO afterSale = tradeAfterSaleMapper.selectById(id); | 402 | + AfterSaleDO afterSale = tradeAfterSaleMapper.selectByIdAndUserId(id, userId); |
| 403 | if (afterSale == null) { | 403 | if (afterSale == null) { |
| 404 | throw exception(AFTER_SALE_NOT_FOUND); | 404 | throw exception(AFTER_SALE_NOT_FOUND); |
| 405 | } | 405 | } |