zianxin/pigx
1
0 Fork 0
mirror of http://git.pig4cloud.com/pig/pigx.git synced 2026-11-08 12:39:05 +08:00
Code Issues Packages Projects Releases Wiki Activity

🔒密码修改#5544 用户修改接口存在越权漏洞

Browse Source 
# Conflicts:
#	pigx-upms/pigx-upms-biz/src/main/java/com/pig4cloud/pigx/admin/service/impl/SysUserServiceImpl.java
This commit is contained in:
冷冷 committed 2024-04-22 13:58:34 +08:00
1 parent 87e7346bd7
commit 6c9e0fa90e
1 file changed
+5 -8
Download Patch File Download Diff File Expand all files Collapse all files
pigx-upms/pigx-upms-biz/src/main/java/com/pig4cloud/pigx/admin/service/impl/SysUserServiceImpl.java
+5 -8
View File
@@ -437,16 +437,12 @@ public class SysUserServiceImpl extends ServiceImpl<SysUserMapper, SysUser> impl
@Override
@CacheEvict(value = CacheConstants.USER_DETAILS, key = "#userDto.username")
public R changePassword(UserDTO userDto) {
UserVO userVO = baseMapper.getUserVoByUsername(userDto.getUsername());
if (Objects.isNull(userVO)) {
return R.failed("用户不存在");
}
SysUser user = baseMapper.selectById(SecurityUtils.getUser().getId());
if (StrUtil.isEmpty(userDto.getPassword())) {
return R.failed("原密码不能为空");
}
if (!ENCODER.matches(userDto.getPassword(), userVO.getPassword())) {
if (!ENCODER.matches(userDto.getPassword(), user.getPassword())) {
log.info("原密码错误，修改个人信息失败:{}", userDto.getUsername());
return R.failed(MsgUtils.getMessage(ErrorCodes.SYS_USER_UPDATE_PASSWORDERROR));
}
@@ -456,8 +452,9 @@ public class SysUserServiceImpl extends ServiceImpl<SysUserMapper, SysUser> impl
}
String password = ENCODER.encode(userDto.getNewpassword1());
this.update(Wrappers.<SysUser>lambdaUpdate().set(SysUser::getPassword, password).eq(SysUser::getUserId,
userVO.getUserId()));
this.update(Wrappers.<SysUser>lambdaUpdate()
.set(SysUser::getPassword, password)
.eq(SysUser::getUserId, user.getUserId()));
return R.ok();
}