fix(bpm): 补充 BPMN 模型视图接口权限校验

为流程实例 BPMN 模型视图接口补充 bpm:process-instance:query 权限校验，避免无权限用户访问流程表单、审批记录和 BPMN XML 等数据。

fix(bpm): 补充 BPMN 模型视图接口权限校验
为流程实例 BPMN 模型视图接口补充 bpm:process-instance:query 权限校验，避免无权限用户访问流程表单、审批记录和 BPMN XML 等数据。
YunaiV
1 parent 76753b32
Showing 1 changed file with 1 additions and 0 deletions
yudao-module-bpm/src/main/java/cn/iocoder/yudao/module/bpm/controller/admin/task/BpmProcessInstanceController.java
@@ -196,6 +196,7 @@ public class BpmProcessInstanceController {
     @GetMapping("/get-bpmn-model-view")
     @Operation(summary = "获取流程实例的 BPMN 模型视图", description = "在【流程详细】界面中，进行调用")
     @Parameter(name = "id", description = "流程实例的编号", required = true)
+    @PreAuthorize("@ss.hasPermission('bpm:process-instance:query')")
     public CommonResult<BpmProcessInstanceBpmnModelViewRespVO> getProcessInstanceBpmnModelView(
             @RequestParam(value = "id") String id) {
         return success(processInstanceService.getProcessInstanceBpmnModelView(id));