fix(user): 修复用户查询权限判断逻辑
- 将权限判断条件从 OR 改为 AND 操作符 - 确保非超级管理员用户无法显示所有数据 - 修复了权限控制的安全漏洞
This commit is contained in:
parent
36ad7c0bfa
commit
dbbe383313
|
|
@ -186,7 +186,7 @@ public class UserControllerService {
|
|||
if (Objects.nonNull(request.getDeptId())) {
|
||||
request.setDeptIds(deptService.getWithChildren(request.getDeptId()));
|
||||
}
|
||||
if (!request.getShowAll() || !UserUtil.getRoles().contains(Constant.SUPER_ADMIN)) {
|
||||
if (!request.getShowAll() && !UserUtil.getRoles().contains(Constant.SUPER_ADMIN)) {
|
||||
request.setCreateById(UserUtil.getUserId());
|
||||
}
|
||||
IPage<UserVO> pu = uService.search(request);
|
||||
|
|
|
|||
Loading…
Reference in New Issue