pengjunjie/JeecgBoot
1
0
Fork 1
mirror of https://github.com/jeecgboot/JeecgBoot.git synced 2025-12-26 16:26:41 +08:00
Code Issues Packages Projects Releases Wiki Activity

【严重安全漏洞】用户可加入任意租户 #9196

Browse Source 
jeecgboot模式的租户未做申请加入租户和审批逻辑，所以这俩接口注释掉
This commit is contained in:
JEECG
2025-12-15 17:02:16 +08:00
parent 17a81e89a5
commit e1c8f00bf2
1 changed files with 58 additions and 57 deletions
Download Patch File Download Diff File Expand all files Collapse all files

115
jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysTenantController.java
View File

@ -507,26 +507,26 @@ public class SysTenantController {
return result; return result;
} }
/** // /**
* 加入租户通过门牌号【低代码应用专用接口】 // * 加入租户通过门牌号【低代码应用专用接口】
* @param sysTenant // * @param sysTenant
*/ // */
@PostMapping("/joinTenantByHouseNumber") // @PostMapping("/joinTenantByHouseNumber")
public Result<Integer> joinTenantByHouseNumber(@RequestBody SysTenant sysTenant){ // public Result<Integer> joinTenantByHouseNumber(@RequestBody SysTenant sysTenant){
LoginUser sysUser = (LoginUser) SecurityUtils.getSubject().getPrincipal(); // LoginUser sysUser = (LoginUser) SecurityUtils.getSubject().getPrincipal();
Integer tenantId = sysTenantService.joinTenantByHouseNumber(sysTenant, sysUser.getId()); // Integer tenantId = sysTenantService.joinTenantByHouseNumber(sysTenant, sysUser.getId());
Result<Integer> result = new Result<>(); // Result<Integer> result = new Result<>();
if(tenantId != 0){ // if(tenantId != 0){
result.setMessage("申请加入组织成功"); // result.setMessage("申请加入组织成功");
result.setSuccess(true); // result.setSuccess(true);
result.setResult(tenantId); // result.setResult(tenantId);
return result; // return result;
}else{ // }else{
result.setMessage("该门牌号不存在"); // result.setMessage("该门牌号不存在");
result.setSuccess(false); // result.setSuccess(false);
return result; // return result;
} // }
} // }
/** /**
* 分页获取租户用户数据(vue3用户租户页面)【低代码应用专用接口】 * 分页获取租户用户数据(vue3用户租户页面)【低代码应用专用接口】
@ -713,6 +713,7 @@ public class SysTenantController {
* @return * @return
*/ */
@PostMapping("/invitationUser") @PostMapping("/invitationUser")
@RequiresPermissions("system:tenant:invitation:user")
public Result<String> invitationUser(@RequestParam(name="phone") String phone, public Result<String> invitationUser(@RequestParam(name="phone") String phone,
@RequestParam(name="departId",defaultValue = "") String departId){ @RequestParam(name="departId",defaultValue = "") String departId){
return sysTenantService.invitationUser(phone,departId); return sysTenantService.invitationUser(phone,departId);
@ -911,43 +912,43 @@ public class SysTenantController {
return Result.ok(pageList); return Result.ok(pageList);
} }
/** // /**
* 同意或拒绝加入租户 // * 同意或拒绝加入租户
*/ // */
@PutMapping("/agreeOrRefuseJoinTenant") // @PutMapping("/agreeOrRefuseJoinTenant")
public Result<String> agreeOrRefuseJoinTenant(@RequestParam("tenantId") Integer tenantId, // public Result<String> agreeOrRefuseJoinTenant(@RequestParam("tenantId") Integer tenantId,
@RequestParam("status") String status){ // @RequestParam("status") String status){
//是否开启系统管理模块的多租户数据隔离【SAAS多租户模式】 // //是否开启系统管理模块的多租户数据隔离【SAAS多租户模式】
LoginUser sysUser = (LoginUser) SecurityUtils.getSubject().getPrincipal(); // LoginUser sysUser = (LoginUser) SecurityUtils.getSubject().getPrincipal();
String userId = sysUser.getId(); // String userId = sysUser.getId();
SysTenant tenant = sysTenantService.getById(tenantId); // SysTenant tenant = sysTenantService.getById(tenantId);
if(null == tenant){ // if(null == tenant){
return Result.error("不存在该组织"); // return Result.error("不存在该组织");
} // }
SysUserTenant sysUserTenant = relationService.getUserTenantByTenantId(userId, tenantId); // SysUserTenant sysUserTenant = relationService.getUserTenantByTenantId(userId, tenantId);
if (null == sysUserTenant) { // if (null == sysUserTenant) {
return Result.error("该用户不存在该组织中，无权修改"); // return Result.error("该用户不存在该组织中，无权修改");
} // }
String content = ""; // String content = "";
SysUser user = new SysUser(); // SysUser user = new SysUser();
user.setUsername(sysUserTenant.getCreateBy()); // user.setUsername(sysUserTenant.getCreateBy());
String realname = oConvertUtils.getString(sysUser.getRealname(),sysUser.getUsername()); // String realname = oConvertUtils.getString(sysUser.getRealname(),sysUser.getUsername());
//成功加入 // //成功加入
if(CommonConstant.USER_TENANT_NORMAL.equals(status)){ // if(CommonConstant.USER_TENANT_NORMAL.equals(status)){
//修改租户状态 // //修改租户状态
relationService.agreeJoinTenant(userId,tenantId); // relationService.agreeJoinTenant(userId,tenantId);
content = content + realname + "已同意您发送的加入 " + tenant.getName() + " 的邀请"; // content = content + realname + "已同意您发送的加入 " + tenant.getName() + " 的邀请";
sysTenantService.sendMsgForAgreeAndRefuseJoin(user, content); // sysTenantService.sendMsgForAgreeAndRefuseJoin(user, content);
return Result.OK("您已同意该组织的邀请"); // return Result.OK("您已同意该组织的邀请");
}else if(CommonConstant.USER_TENANT_REFUSE.equals(status)){ // }else if(CommonConstant.USER_TENANT_REFUSE.equals(status)){
//直接删除关系表即可 // //直接删除关系表即可
relationService.refuseJoinTenant(userId,tenantId); // relationService.refuseJoinTenant(userId,tenantId);
content = content + realname + "拒绝了您发送的加入 " + tenant.getName() + " 的邀请"; // content = content + realname + "拒绝了您发送的加入 " + tenant.getName() + " 的邀请";
sysTenantService.sendMsgForAgreeAndRefuseJoin(user, content); // sysTenantService.sendMsgForAgreeAndRefuseJoin(user, content);
return Result.OK("您已成功拒绝该组织的邀请"); // return Result.OK("您已成功拒绝该组织的邀请");
} // }
return Result.error("类型不匹配，禁止修改数据"); // return Result.error("类型不匹配，禁止修改数据");
} // }
/** /**
* 目前只给敲敲云租户下删除用户使用 * 目前只给敲敲云租户下删除用户使用