漏洞修复- [高危] fs-admin问诊订单相关接口全部缺少`@PreAuthorize`

fs-admin/src/main/java/com/fs/his/controller/FsInquiryOrderController.java

@@ -53,8 +53,9 @@ public class FsInquiryOrderController extends BaseController
     /**
      * 查询问诊订单列表
      */
+    @PreAuthorize("@ss.hasPermi('his:inquiryOrder:list')")
     @GetMapping("/list")
-   public TableDataInfo list(FsInquiryOrderParam fsInquiryOrder)
+    public TableDataInfo list(FsInquiryOrderParam fsInquiryOrder)
     {
         startPage();
         if(!StringUtils.isEmpty(fsInquiryOrder.getCreateTimeRange())){
@@ -225,6 +226,7 @@ public class FsInquiryOrderController extends BaseController
     @Transactional
     @RepeatSubmit
     @ApiOperation("取消订单")
+    @PreAuthorize("@ss.hasPermi('his:inquiryOrder:cancelOrder')")
     @PostMapping("/cancelOrder")
     public R cancelOrder(@Validated @RequestBody FsInquiryOrderCancelParam param ){
         param.setType(4);
@@ -258,7 +260,7 @@ public class FsInquiryOrderController extends BaseController
 
 
 
-
+    @PreAuthorize("@ss.hasPermi('his:inquiryOrder:msgList')")
     @GetMapping("/msgList")
     public TableDataInfo msgList(Long orderId)
     {
@@ -271,6 +273,7 @@ public class FsInquiryOrderController extends BaseController
     /**
      * 查询订单log列表
      */
+    @PreAuthorize("@ss.hasPermi('his:inquiryOrder:logList')")
     @GetMapping("/logList/{orderId}")
     public TableDataInfo logList(@PathVariable("orderId") String orderId)
     {

fs-admin/src/main/java/com/fs/his/controller/FsInquiryPatientInfoController.java

@@ -44,7 +44,7 @@ public class FsInquiryPatientInfoController extends BaseController {
     public AjaxResult edit(@RequestBody FsInquiryPatientParam param){
         return toAjax(patientInfoService.updateFsInquiryPatientInfo(param));
     }
-
+    @PreAuthorize("@ss.hasPermi('his:inquiryPatientInfo:query')")
     @GetMapping("/detail/{inquiryOrderId}")
     public AjaxResult get(@PathVariable("inquiryOrderId") Long inquiryOrderId){
         return AjaxResult.success(patientInfoService.selectFsInquiryPatientInfo(inquiryOrderId));