From c776371d484425100c43a2c5284e1d2e6c7d3472 Mon Sep 17 00:00:00 2001 From: 杨宇庆 Date: Wed, 6 Nov 2024 15:21:25 +0000 Subject: [PATCH] 【修复】修复会员取消退款接口中未校验用户ID的漏洞 --- yudao-module-mall/yudao-module-trade-biz/src/main/java/cn/iocoder/yudao/module/trade/service/aftersale/AfterSaleServiceImpl.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/yudao-module-mall/yudao-module-trade-biz/src/main/java/cn/iocoder/yudao/module/trade/service/aftersale/AfterSaleServiceImpl.java b/yudao-module-mall/yudao-module-trade-biz/src/main/java/cn/iocoder/yudao/module/trade/service/aftersale/AfterSaleServiceImpl.java index f191723..bcac6b5 100644 --- a/yudao-module-mall/yudao-module-trade-biz/src/main/java/cn/iocoder/yudao/module/trade/service/aftersale/AfterSaleServiceImpl.java +++ b/yudao-module-mall/yudao-module-trade-biz/src/main/java/cn/iocoder/yudao/module/trade/service/aftersale/AfterSaleServiceImpl.java @@ -399,7 +399,7 @@ public class AfterSaleServiceImpl implements AfterSaleService { @AfterSaleLog(operateType = AfterSaleOperateTypeEnum.MEMBER_CANCEL) public void cancelAfterSale(Long userId, Long id) { // 校验售后单的状态，并状态待退款 - AfterSaleDO afterSale = tradeAfterSaleMapper.selectById(id); + AfterSaleDO afterSale = tradeAfterSaleMapper.selectByIdAndUserId(id, userId); if (afterSale == null) { throw exception(AFTER_SALE_NOT_FOUND); } -- libgit2 0.21.4