leietal/senmesh-zc
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: 机构管理员可修改本机构用户信息(modify_org_user_info双档权限+机构范围校验),禁改超管;isSuperior空值防护

Browse Source
This commit is contained in:
leijiaping
2026-10-27 15:18:10 +08:00
parent ef2dab823f
commit 733dcb9fc0
2 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/main/java/com/senmesh/common/util/UserContextHolder.java
View File

@@ -150,7 +150,7 @@ public class UserContextHolder {
*/ */
public static boolean isSuperior() { public static boolean isSuperior() {
IUserDetail userDTO = getLoginUser(); IUserDetail userDTO = getLoginUser();
return userDTO != null && userDTO.getSupeiror(); return userDTO != null && Boolean.TRUE.equals(userDTO.getSupeiror());
} }
/** /**

6
src/main/java/com/senmesh/usercenter/user/service/impl/UserServiceImpl.java
View File

@@ -925,11 +925,15 @@ public class UserServiceImpl implements UserService {
@Transactional @Transactional
@AutoUnLock @AutoUnLock
public Boolean modifyOrgUserInfo(OrgUserEditDTO orgUserEditDTO) { public Boolean modifyOrgUserInfo(OrgUserEditDTO orgUserEditDTO) {
Assert.isTrue(UserContextHolder.isSuperior(), "当前用户无操作权限"); // 平台超管可修改全部用户,机构管理员仅可修改本机构用户
Assert.isTrue(UserContextHolder.isSuperior() || UserContextHolder.isAdministrator(),
"当前用户无操作权限");
ValidateUtils.validateBiz(orgUserEditDTO); ValidateUtils.validateBiz(orgUserEditDTO);
Long userId = orgUserEditDTO.getId(); Long userId = orgUserEditDTO.getId();
this.checkOrgScopeOfOperateUser(userId);
UserDTO userDto = findUserDTO(UserQueryDTO.builder().id(userId).build()); UserDTO userDto = findUserDTO(UserQueryDTO.builder().id(userId).build());
Assert.notNull(userDto, userId + "-用户不可用"); Assert.notNull(userDto, userId + "-用户不可用");
Assert.isTrue(!Boolean.TRUE.equals(userDto.getSupeiror()), "不能修改超级管理员账号");
User user = new User(); User user = new User();
user.setId(userId); user.setId(userId);
//校验 //校验