漏洞修复-[高危] fs-admin 按userId查询 - 无hospital级别数据隔离

fs-admin/src/main/java/com/fs/his/controller/FsUserController.java

@@ -13,6 +13,8 @@ import com.fs.common.exception.CustomException;
 import com.fs.common.utils.ParseUtils;
 import com.fs.common.utils.SecurityUtils;
 import com.fs.common.utils.StringUtils;
+import com.fs.company.domain.Company;
+import com.fs.company.service.ICompanyService;
 import com.fs.course.dto.BatchSendCourseDTO;
 import com.fs.course.param.FsCourseLinkCreateParam;
 import com.fs.course.service.IFsUserCompanyUserQwService;
@@ -86,6 +88,9 @@ public class FsUserController extends BaseController
     @Autowired
     private IFsUserCompanyUserQwService userCompanyUserQwService;
 
+    @Autowired
+    private ICompanyService companyService;
+
     @Autowired
     private SqlSessionFactory sqlSessionFactory;
 
@@ -287,20 +292,30 @@ public class FsUserController extends BaseController
     /**
      * 获取用户详细信息
      */
+    @PreAuthorize("@ss.hasPermi('his:user:query')")
     @GetMapping(value = "/{userId}")
     public AjaxResult getInfo(@PathVariable("userId") Long userId)
     {
         FsUser fsUser = fsUserService.selectFsUserByUserId(userId);
-        fsUser.setPhone(decryptAutoPhoneMk(fsUser.getPhone()));
+        if (fsUser != null) {
+            if (!checkHospitalScope(fsUser.getCompanyId())) {
+                return AjaxResult.error("无权限访问该用户数据");
+            }
+            fsUser.setPhone(decryptAutoPhoneMk(fsUser.getPhone()));
+        }
         return AjaxResult.success(fsUser);
     }
 
 
 
+    @PreAuthorize("@ss.hasPermi('his:user:query')")
     @GetMapping(value = "/getUserAddr/{userId}")
     public AjaxResult getUserAddr(@PathVariable("userId") Long userId)
     {
-
+        FsUser fsUser = fsUserService.selectFsUserByUserId(userId);
+        if (fsUser != null && !checkHospitalScope(fsUser.getCompanyId())) {
+            return AjaxResult.error("无权限访问该用户数据");
+        }
         List<FsUserAddress> fsUserAddresses = fsUserService.selectFsUserAddressByUserId(userId);
         for (FsUserAddress fsUserAddress : fsUserAddresses) {
             if (fsUserAddress.getPhone()!=null&&fsUserAddress.getPhone()!=""){
@@ -315,6 +330,26 @@ public class FsUserController extends BaseController
         return AjaxResult.success(fsUserAddresses);
     }
 
+    /**
+     * 校验当前登录用户是否具备访问指定用户所属医院数据的权限
+     * 超级管理员放行；非管理员仅能访问本医院（deptId）下商户的用户
+     *
+     * @param companyId 用户所属商户ID
+     * @return true 允许访问，false 拒绝
+     */
+    private boolean checkHospitalScope(Long companyId) {
+        SysUser currentUser = getLoginUser().getUser();
+        if (currentUser.isAdmin()) {
+            return true;
+        }
+        Long deptId = currentUser.getDeptId();
+        if (deptId == null || companyId == null) {
+            return false;
+        }
+        Company company = companyService.selectCompanyById(companyId);
+        return company != null && deptId.equals(company.getDeptId());
+    }
+
 
     /**
      * 新增用户