🔒 修复安全问题. 安全测试【越权访问】。使用非admin账号且没有获取菜单的权限账号(test),进行接口调用,可以调通获取信息。

This commit is contained in:
Lucky committed 2020-05-18 10:53:34 +08:00
1 parent 04353a43b7
commit 4d805b172a
2 files changed
+6

No files matched your search

@@ -52,6 +52,7 @@ public class ${className}Controller {
*/
@ApiOperation(value = "分页查询", notes = "分页查询")
@GetMapping("/page" )
@PreAuthorize("@pms.hasPermission('${moduleName}_${pathName}_page')" )
public R get${className}Page(Page page, ${className} ${classname}) {
return R.ok(${classname}Service.page(page, Wrappers.query(${classname})));
}
@@ -64,6 +65,7 @@ public class ${className}Controller {
*/
@ApiOperation(value = "通过id查询", notes = "通过id查询")
@GetMapping("/{${pk.lowerAttrName}}" )
@PreAuthorize("@pms.hasPermission('${moduleName}_${pathName}_get')" )
public R getById(@PathVariable("${pk.lowerAttrName}" ) ${pk.attrType} ${pk.lowerAttrName}) {
return R.ok(${classname}Service.getById(${pk.lowerAttrName}));
}