Skip to content

SysMenuController.java:updateMenuVisible缺少权限检查 #123

@old6ma

Description

@old6ma

这里更改菜单的可见状态缺少了检查是否有权限进行更改的检查,若恶意用户把所有菜单都设置为不可见则可能会引起一些前端界面上的问题,所以应该需要确定用户有编辑菜单的权限
` @operation(summary = "修改菜单显示状态")
@PatchMapping("/{menuId}")
public Result updateMenuVisible(
@parameter(description = "菜单ID") @PathVariable Long menuId,
@parameter(description = "显示状态(1:显示;0:隐藏)") Integer visible

) {
    boolean result =menuService.updateMenuVisible(menuId, visible);
    return Result.judge(result);
}`

可以添加以下代码进行检查
@PreAuthorize("@ss.hasPerm('sys:menu:edit')")

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions