From d60156015be9e9cc130a579755be66c164a17859 Mon Sep 17 00:00:00 2001 From: YunaiV Date: Tue, 19 May 2026 14:18:09 +0800 Subject: [PATCH] ✨ feat(im): 增加频道的检查 --- yudao-module-im/src/main/java/cn/iocoder/yudao/module/im/controller/admin/channel/ImChannelMaterialController.java | 12 ------------ yudao-module-im/src/main/java/cn/iocoder/yudao/module/im/dal/mysql/channel/ImChannelMessageMapper.java | 36 +++++++++--------------------------- yudao-module-im/src/main/java/cn/iocoder/yudao/module/im/service/channel/ImChannelMessageService.java | 8 -------- yudao-module-im/src/main/java/cn/iocoder/yudao/module/im/service/channel/ImChannelMessageServiceImpl.java | 5 ----- 4 files changed, 9 insertions(+), 52 deletions(-) diff --git a/yudao-module-im/src/main/java/cn/iocoder/yudao/module/im/controller/admin/channel/ImChannelMaterialController.java b/yudao-module-im/src/main/java/cn/iocoder/yudao/module/im/controller/admin/channel/ImChannelMaterialController.java index 403c035..e2427a1 100644 --- a/yudao-module-im/src/main/java/cn/iocoder/yudao/module/im/controller/admin/channel/ImChannelMaterialController.java +++ b/yudao-module-im/src/main/java/cn/iocoder/yudao/module/im/controller/admin/channel/ImChannelMaterialController.java @@ -5,7 +5,6 @@ import cn.iocoder.yudao.framework.common.util.object.BeanUtils; import cn.iocoder.yudao.module.im.controller.admin.manager.channel.vo.material.ImChannelMaterialRespVO; import cn.iocoder.yudao.module.im.dal.dataobject.channel.ImChannelMaterialDO; import cn.iocoder.yudao.module.im.service.channel.ImChannelMaterialService; -import cn.iocoder.yudao.module.im.service.channel.ImChannelMessageService; import io.swagger.v3.oas.annotations.Operation; import io.swagger.v3.oas.annotations.Parameter; import io.swagger.v3.oas.annotations.tags.Tag; @@ -16,10 +15,7 @@ import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.bind.annotation.RequestParam; import org.springframework.web.bind.annotation.RestController; -import static cn.iocoder.yudao.framework.common.exception.util.ServiceExceptionUtil.exception; import static cn.iocoder.yudao.framework.common.pojo.CommonResult.success; -import static cn.iocoder.yudao.framework.web.core.util.WebFrameworkUtils.getLoginUserId; -import static cn.iocoder.yudao.module.im.enums.ErrorCodeConstants.IM_CHANNEL_MATERIAL_NOT_EXISTS; @Tag(name = "用户 APP - IM 频道素材") @RestController @@ -29,19 +25,11 @@ public class ImChannelMaterialController { @Resource private ImChannelMaterialService channelMaterialService; - @Resource - private ImChannelMessageService channelMessageService; - // TODO @AI：要不，还是不校验了。会存在一个情况，有人转发图文消息到私聊里。（先不考虑这块的安全性了；简化简化！） @GetMapping("/get") @Operation(summary = "获取素材详情；用于客户端点击图文卡片渲染详情页") @Parameter(name = "id", description = "素材编号", required = true, example = "1024") public CommonResult getMaterial(@RequestParam("id") Long id) { - // 防横向越权：仅允许拉取自己曾经收到过的素材，否则视为不存在 - if (!channelMessageService.isUserReceivedMaterial(getLoginUserId(), id)) { - throw exception(IM_CHANNEL_MATERIAL_NOT_EXISTS); - } - // 获取素材详情 ImChannelMaterialDO material = channelMaterialService.validateMaterialExists(id); return success(BeanUtils.toBean(material, ImChannelMaterialRespVO.class)); } diff --git a/yudao-module-im/src/main/java/cn/iocoder/yudao/module/im/dal/mysql/channel/ImChannelMessageMapper.java b/yudao-module-im/src/main/java/cn/iocoder/yudao/module/im/dal/mysql/channel/ImChannelMessageMapper.java index d99b8e4..333c25f 100644 --- a/yudao-module-im/src/main/java/cn/iocoder/yudao/module/im/dal/mysql/channel/ImChannelMessageMapper.java +++ b/yudao-module-im/src/main/java/cn/iocoder/yudao/module/im/dal/mysql/channel/ImChannelMessageMapper.java @@ -6,8 +6,6 @@ import cn.iocoder.yudao.framework.mybatis.core.query.LambdaQueryWrapperX; import cn.iocoder.yudao.module.im.controller.admin.manager.channel.vo.message.ImChannelMessagePageReqVO; import cn.iocoder.yudao.module.im.dal.dataobject.channel.ImChannelMessageDO; import org.apache.ibatis.annotations.Mapper; -import org.apache.ibatis.annotations.Param; -import org.apache.ibatis.annotations.Select; import java.util.List; @@ -19,7 +17,6 @@ import java.util.List; @Mapper public interface ImChannelMessageMapper extends BaseMapperX { - // TODO @AI：代码风格，和别的 message 一致； /** * 拉取指定用户应收的频道消息 *

@@ -30,30 +27,15 @@ public interface ImChannelMessageMapper extends BaseMapperX * @param size 返回条数 * @return 频道消息列表；按 id 升序 */ - @Select("SELECT * FROM im_channel_message " - + "WHERE deleted = 0 " - + "AND id > #{minId} " - + "AND (receiver_user_ids IS NULL " - + " OR receiver_user_ids = '' " - + " OR FIND_IN_SET(#{userId}, receiver_user_ids)) " - + "ORDER BY id ASC " - + "LIMIT #{size}") - List selectListByUserAndMinId(@Param("userId") Long userId, - @Param("minId") Long minId, - @Param("size") Integer size); - - // TODO @AI：代码风格，和别的 message 一致； - /** - * 校验用户是否曾经收到过指定素材（receiver_user_ids 为空表示全员）；用于详情接口归属校验 - */ - @Select("SELECT EXISTS(SELECT 1 FROM im_channel_message " - + "WHERE deleted = 0 AND material_id = #{materialId} " - + "AND (receiver_user_ids IS NULL " - + " OR receiver_user_ids = '' " - + " OR FIND_IN_SET(#{userId}, receiver_user_ids)) " - + "LIMIT 1)") - boolean existsByUserAndMaterial(@Param("userId") Long userId, - @Param("materialId") Long materialId); + default List selectListByUserAndMinId(Long userId, Long minId, Integer size) { + return selectList(new LambdaQueryWrapperX() + .gt(ImChannelMessageDO::getId, minId) + .and(w -> w.isNull(ImChannelMessageDO::getReceiverUserIds) + .or().eq(ImChannelMessageDO::getReceiverUserIds, "") + .or().apply("FIND_IN_SET({0}, receiver_user_ids)", userId)) + .orderByAsc(ImChannelMessageDO::getId) + .last("LIMIT " + size)); + } default Long selectCountByMaterialId(Long materialId) { return selectCount(ImChannelMessageDO::getMaterialId, materialId); diff --git a/yudao-module-im/src/main/java/cn/iocoder/yudao/module/im/service/channel/ImChannelMessageService.java b/yudao-module-im/src/main/java/cn/iocoder/yudao/module/im/service/channel/ImChannelMessageService.java index 4d3c848..e2a21f0 100644 --- a/yudao-module-im/src/main/java/cn/iocoder/yudao/module/im/service/channel/ImChannelMessageService.java +++ b/yudao-module-im/src/main/java/cn/iocoder/yudao/module/im/service/channel/ImChannelMessageService.java @@ -28,14 +28,6 @@ public interface ImChannelMessageService { */ List getMessageListForPull(Long userId, Long minId, Integer size); - /** - * 校验用户是否曾经收到过指定素材；防横向越权 - * - * @param userId 当前用户编号 - * @param materialId 素材编号 - * @return 是否曾收到（receiver_user_ids 命中 / 全员） - */ - boolean isUserReceivedMaterial(Long userId, Long materialId); // ==================== 管理后台 ==================== diff --git a/yudao-module-im/src/main/java/cn/iocoder/yudao/module/im/service/channel/ImChannelMessageServiceImpl.java b/yudao-module-im/src/main/java/cn/iocoder/yudao/module/im/service/channel/ImChannelMessageServiceImpl.java index c37a3d0..cfeeb58 100644 --- a/yudao-module-im/src/main/java/cn/iocoder/yudao/module/im/service/channel/ImChannelMessageServiceImpl.java +++ b/yudao-module-im/src/main/java/cn/iocoder/yudao/module/im/service/channel/ImChannelMessageServiceImpl.java @@ -47,11 +47,6 @@ public class ImChannelMessageServiceImpl implements ImChannelMessageService { return channelMessageMapper.selectListByUserAndMinId(userId, minId, size); } - @Override - public boolean isUserReceivedMaterial(Long userId, Long materialId) { - return channelMessageMapper.existsByUserAndMaterial(userId, materialId); - } - // ==================== 管理后台 ==================== @Override -- libgit2 0.21.4