🔒 修复安全问题. 安全测试【越权访问】。使用非admin账号且没有获取菜单的权限账号(test),进行接口调用,可以调通获取信息。
This commit is contained in:
1 parent
04353a43b7
commit
4d805b172a
2 files changed
+6
No files matched your search
@@ -52,6 +52,7 @@ public class ${className}Controller {
|
||||
*/
|
||||
@ApiOperation(value = "分页查询", notes = "分页查询")
|
||||
@GetMapping("/page" )
|
||||
@PreAuthorize("@pms.hasPermission('${moduleName}_${pathName}_page')" )
|
||||
public R get${className}Page(Page page, ${className} ${classname}) {
|
||||
return R.ok(${classname}Service.page(page, Wrappers.query(${classname})));
|
||||
}
|
||||
@@ -64,6 +65,7 @@ public class ${className}Controller {
|
||||
*/
|
||||
@ApiOperation(value = "通过id查询", notes = "通过id查询")
|
||||
@GetMapping("/{${pk.lowerAttrName}}" )
|
||||
@PreAuthorize("@pms.hasPermission('${moduleName}_${pathName}_get')" )
|
||||
public R getById(@PathVariable("${pk.lowerAttrName}" ) ${pk.attrType} ${pk.lowerAttrName}) {
|
||||
return R.ok(${classname}Service.getById(${pk.lowerAttrName}));
|
||||
}
|
||||
|
||||
Reference in new issue
Block a user