zianxin/pigx
1
0 Fork 0
mirror of http://git.pig4cloud.com/pig/pigx.git synced 2026-11-10 21:19:00 +08:00
Code Issues Packages Projects Releases Wiki Activity

🔒 修复安全问题. 安全测试【越权访问】。使用非admin账号且没有获取菜单的权限账号(test)，进行接口调用，可以调通获取信息。

Browse Source
This commit is contained in:
Lucky committed 2020-05-18 10:53:34 +08:00
1 parent 04353a43b7
commit 4d805b172a
2 files changed
+6
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

pigx-visual/pigx-codegen/src/main/resources/template/Controller.java.vm
+2
View File
@@ -52,6 +52,7 @@ public class ${className}Controller {
*/
@ApiOperation(value = "分页查询", notes = "分页查询")
@GetMapping("/page" )
@PreAuthorize("@pms.hasPermission('${moduleName}_${pathName}_page')" )
public R get${className}Page(Page page, ${className} ${classname}) {
return R.ok(${classname}Service.page(page, Wrappers.query(${classname})));
}
@@ -64,6 +65,7 @@ public class ${className}Controller {
*/
@ApiOperation(value = "通过id查询", notes = "通过id查询")
@GetMapping("/{${pk.lowerAttrName}}" )
@PreAuthorize("@pms.hasPermission('${moduleName}_${pathName}_get')" )
public R getById(@PathVariable("${pk.lowerAttrName}" ) ${pk.attrType} ${pk.lowerAttrName}) {
return R.ok(${classname}Service.getById(${pk.lowerAttrName}));
}
pigx-visual/pigx-codegen/src/main/resources/template/menu.sql.vm
+4
View File
@@ -14,3 +14,7 @@ insert into `sys_menu` ( `parent_id`, `permission`, `type`, `path`, `icon`, `de
SELECT @parentId, '${moduleName}_${pathName}_edit', '1', null, '1', '0', '2018-05-15 21:35:18', '1', '2018-07-29 13:38:59', '${comments}修改', 1;
insert into `sys_menu` ( `parent_id`, `permission`, `type`, `path`, `icon`, `del_flag`, `create_time`, `sort`, `update_time`, `name`, `tenant_id`)
SELECT @parentId, '${moduleName}_${pathName}_del', '1', null, '1', '0', '2018-05-15 21:35:18', '2', '2018-07-29 13:38:59', '${comments}删除', 1;
insert into `sys_menu` ( `parent_id`, `permission`, `type`, `path`, `icon`, `del_flag`, `create_time`, `sort`, `update_time`, `name`, `tenant_id`)
SELECT @parentId, '${moduleName}_${pathName}_get', '1', null, '1', '0', '2018-05-15 21:35:18', '2', '2018-07-29 13:38:59', '${comments}获取', 1;
insert into `sys_menu` ( `parent_id`, `permission`, `type`, `path`, `icon`, `del_flag`, `create_time`, `sort`, `update_time`, `name`, `tenant_id`)
SELECT @parentId, '${moduleName}_${pathName}_page', '1', null, '1', '0', '2018-05-15 21:35:18', '2', '2018-07-29 13:38:59', '${comments}列表', 1;