Commit c20c828b5000f51fb46886cb51647929fb5e2d5f
1 parent
76753b32
fix(bpm): 补充 BPMN 模型视图接口权限校验
为流程实例 BPMN 模型视图接口补充 bpm:process-instance:query 权限校验， 避免无权限用户访问流程表单、审批记录和 BPMN XML 等数据。
Showing
1 changed file
with
1 additions
and
0 deletions
yudao-module-bpm/src/main/java/cn/iocoder/yudao/module/bpm/controller/admin/task/BpmProcessInstanceController.java
| @@ -196,6 +196,7 @@ public class BpmProcessInstanceController { | @@ -196,6 +196,7 @@ public class BpmProcessInstanceController { | ||
| 196 | @GetMapping("/get-bpmn-model-view") | 196 | @GetMapping("/get-bpmn-model-view") |
| 197 | @Operation(summary = "获取流程实例的 BPMN 模型视图", description = "在【流程详细】界面中，进行调用") | 197 | @Operation(summary = "获取流程实例的 BPMN 模型视图", description = "在【流程详细】界面中，进行调用") |
| 198 | @Parameter(name = "id", description = "流程实例的编号", required = true) | 198 | @Parameter(name = "id", description = "流程实例的编号", required = true) |
| 199 | + @PreAuthorize("@ss.hasPermission('bpm:process-instance:query')") | ||
| 199 | public CommonResult<BpmProcessInstanceBpmnModelViewRespVO> getProcessInstanceBpmnModelView( | 200 | public CommonResult<BpmProcessInstanceBpmnModelViewRespVO> getProcessInstanceBpmnModelView( |
| 200 | @RequestParam(value = "id") String id) { | 201 | @RequestParam(value = "id") String id) { |
| 201 | return success(processInstanceService.getProcessInstanceBpmnModelView(id)); | 202 | return success(processInstanceService.getProcessInstanceBpmnModelView(id)); |