用户详情添加防止水平越权，诗画短信过期3月改为6月

pjcloud-thirdparty/pjcloud-thirdparty-biz/src/main/java/com/bsd/pjcloud/thirdparty/controller/ThirdPartyOAth2Cotroller.java

@@ -320,12 +320,12 @@ public class ThirdPartyOAth2Cotroller {
         String generate = DeviceFingerprintUtil.generate(httpServletRequest);
         R<UserTrustedDeviceEntity> userTrustedDeviceR = remoteUserTrustedDeviceService.getUserTrustedDeviceByIdAndMD5(dto.getMobilePhone(), generate, SH_DEVICE_NAME);
         if (userTrustedDeviceR.getData() != null) {
-            userTrustedDeviceR.getData().setExpireTime(LocalDateTime.now().plusMonths(3));
+            userTrustedDeviceR.getData().setExpireTime(LocalDateTime.now().plusMonths(6));
             remoteUserTrustedDeviceService.updateById(userTrustedDeviceR.getData());
         } else {
             UserTrustedDeviceEntity userTrustedDevice = new UserTrustedDeviceEntity();
             userTrustedDevice.setMobilePhone(dto.getMobilePhone());
-            userTrustedDevice.setExpireTime(LocalDateTime.now().plusMonths(3));
+            userTrustedDevice.setExpireTime(LocalDateTime.now().plusMonths(6));
             userTrustedDevice.setDeviceName(SH_DEVICE_NAME);
             userTrustedDevice.setDeviceFingerprint(generate);
             remoteUserTrustedDeviceService.save(userTrustedDevice);

pjcloud-upms/pjcloud-upms-biz/src/main/java/com/bsd/pjcloud/admin/controller/SysUserController.java

@@ -47,6 +47,7 @@ import com.bsd.pjcloud.common.excel.annotation.ResponseExcel;
 import com.bsd.pjcloud.common.log.annotation.SysLog;
 import com.bsd.pjcloud.common.security.annotation.HasPermission;
 import com.bsd.pjcloud.common.security.annotation.Inner;
+import com.bsd.pjcloud.common.security.component.PermissionService;
 import com.bsd.pjcloud.common.security.service.PjcloudUser;
 import com.bsd.pjcloud.common.security.util.SecurityUtils;
 import com.bsd.pjcloud.flow.task.dto.ProcessNodeRecordAssignUserParamDto;
@@ -65,12 +66,14 @@ import lombok.AllArgsConstructor;
 import org.apache.commons.lang3.StringUtils;
 import org.springdoc.core.annotations.ParameterObject;
 import org.springframework.http.HttpHeaders;
+import org.springframework.http.HttpStatus;
 import org.springframework.transaction.annotation.Transactional;
 import org.springframework.util.CollectionUtils;
 import org.springframework.validation.BindingResult;
 import org.springframework.validation.annotation.Validated;
 import org.springframework.web.bind.annotation.*;
 import org.springframework.web.multipart.MultipartFile;
+import org.springframework.web.server.ResponseStatusException;
 
 import java.util.ArrayList;
 import java.util.List;
@@ -99,6 +102,8 @@ public class SysUserController {
 
     private final SysUserRoleService sysUserRoleService;
 
+    private final PermissionService permissionService;
+
     /* ************************************* start 回调 start ************************************* */
 
     @Inner(value = false)
@@ -194,6 +199,7 @@ public class SysUserController {
 
     @GetMapping("/get-by-user-id")
     public R getByUserId(@RequestParam Long userId) {
+        assertUserDetailAllowed(userId);
         SysUser user = userService.getOne(Wrappers.<SysUser>query().lambda().eq(SysUser::getUserId, userId));
         if (user == null) return R.failed(MsgUtils.getMessage(ErrorCodes.SYS_USER_USERINFO_EMPTY, userId));
         return R.ok(userService.findUserInfo(user));
@@ -226,6 +232,7 @@ public class SysUserController {
      */
     @GetMapping("/details/{id}")
     public R user(@PathVariable Long id) {
+        assertUserDetailAllowed(id);
         return R.ok(userService.selectUserVoById(id));
     }
 
@@ -571,4 +578,21 @@ public class SysUserController {
         }).collect(Collectors.toList());
         return R.ok(userVOList);
     }
+
+    /**
+     * 用户详情：仅本人或具备用户管理类权限的管理员可查看指定 userId
+     */
+    private void assertUserDetailAllowed(Long targetUserId) {
+        PjcloudUser current = SecurityUtils.getUser();
+        if (current == null || current.getId() == null) {
+            throw new ResponseStatusException(HttpStatus.UNAUTHORIZED, MsgUtils.getMessage(ErrorCodes.SYS_USER_QUERY_ERROR));
+        }
+        if (targetUserId != null && targetUserId.equals(current.getId())) {
+            return;
+        }
+        if (permissionService.hasPermission("sys_user_add", "sys_user_edit", "sys_user_del", "sys_user_export")) {
+            return;
+        }
+        throw new ResponseStatusException(HttpStatus.FORBIDDEN, "无权限查看该用户信息");
+    }
 }