BJ_ZTEITS-Developers / parking-cloud-yudao

Commit c779a476617c58a38904191094d22df254b42542

Authored by YunaiV
1 parent 5d1fd70d

fix(crm): 修复跟进记录详情越权读取 

跟进记录详情接口按 id 查询后，增加关联 CRM 业务对象的 READ 权限校验，
避免用户通过自增 id 越权读取其他用户的跟进记录。

Fixes: https://github.com/YunaiV/ruoyi-vue-pro/issues/1159
Inline Side-by-side
Showing 1 changed file with 15 additions and 0 deletions
yudao-module-crm/src/main/java/cn/iocoder/yudao/module/crm/controller/admin/followup/CrmFollowUpRecordController.java
  View file @c779a47
... ... @@ -11,9 +11,12 @@ import cn.iocoder.yudao.module.crm.controller.admin.followup.vo.CrmFollowUpRecor
11 11 import cn.iocoder.yudao.module.crm.dal.dataobject.business.CrmBusinessDO;
12 12 import cn.iocoder.yudao.module.crm.dal.dataobject.contact.CrmContactDO;
13 13 import cn.iocoder.yudao.module.crm.dal.dataobject.followup.CrmFollowUpRecordDO;
  14 +import cn.iocoder.yudao.module.crm.enums.common.CrmBizTypeEnum;
  15 +import cn.iocoder.yudao.module.crm.enums.permission.CrmPermissionLevelEnum;
14 16 import cn.iocoder.yudao.module.crm.service.business.CrmBusinessService;
15 17 import cn.iocoder.yudao.module.crm.service.contact.CrmContactService;
16 18 import cn.iocoder.yudao.module.crm.service.followup.CrmFollowUpRecordService;
  19 +import cn.iocoder.yudao.module.crm.service.permission.CrmPermissionService;
17 20 import cn.iocoder.yudao.module.system.api.user.AdminUserApi;
18 21 import cn.iocoder.yudao.module.system.api.user.dto.AdminUserRespDTO;
19 22 import io.swagger.v3.oas.annotations.Operation;
... ... @@ -27,10 +30,13 @@ import org.springframework.web.bind.annotation.*;
27 30 import java.util.ArrayList;
28 31 import java.util.Map;
29 32  
  33 +import static cn.iocoder.yudao.framework.common.exception.util.ServiceExceptionUtil.exception;
30 34 import static cn.iocoder.yudao.framework.common.pojo.CommonResult.success;
31 35 import static cn.iocoder.yudao.framework.common.util.collection.CollectionUtils.convertSet;
32 36 import static cn.iocoder.yudao.framework.common.util.collection.CollectionUtils.convertSetByFlatMap;
33 37 import static cn.iocoder.yudao.framework.security.core.util.SecurityFrameworkUtils.getLoginUserId;
  38 +import static cn.iocoder.yudao.module.crm.enums.ErrorCodeConstants.CRM_PERMISSION_DENIED;
  39 +import static cn.iocoder.yudao.module.crm.enums.ErrorCodeConstants.FOLLOW_UP_RECORD_NOT_EXISTS;
34 40  
35 41  
36 42 @Tag(name = "管理后台 - 跟进记录")
... ... @@ -45,6 +51,8 @@ public class CrmFollowUpRecordController {
45 51 private CrmContactService contactService;
46 52 @Resource
47 53 private CrmBusinessService businessService;
  54 + @Resource
  55 + private CrmPermissionService permissionService;
48 56  
49 57 @Resource
50 58 private AdminUserApi adminUserApi;
... ... @@ -68,6 +76,13 @@ public class CrmFollowUpRecordController {
68 76 @Parameter(name = "id", description = "编号", required = true, example = "1024")
69 77 public CommonResult<CrmFollowUpRecordRespVO> getFollowUpRecord(@RequestParam("id") Long id) {
70 78 CrmFollowUpRecordDO followUpRecord = followUpRecordService.getFollowUpRecord(id);
  79 + if (followUpRecord == null) {
  80 + throw exception(FOLLOW_UP_RECORD_NOT_EXISTS);
  81 + }
  82 + if (!permissionService.hasPermission(followUpRecord.getBizType(), followUpRecord.getBizId(),
  83 + getLoginUserId(), CrmPermissionLevelEnum.READ)) {
  84 + throw exception(CRM_PERMISSION_DENIED, CrmBizTypeEnum.getNameByType(followUpRecord.getBizType()));
  85 + }
71 86 return success(BeanUtils.toBean(followUpRecord, CrmFollowUpRecordRespVO.class));
72 87 }
73 88  
... ...