漏洞修复-[严重] 企业微信会话列表 - 无归属校验

fs-company/src/main/java/com/fs/company/controller/qw/QwMsgController.java

@@ -127,6 +127,14 @@ public class QwMsgController extends BaseController
     @GetMapping("/conversationList/{userId}")
     @ApiOperation("获取会话")
     public R conversations(@PathVariable("userId")Long qwUserId){
+        //校验归属：仅允许查看当前登录员工名下的企微用户会话
+        LoginUser loginUser = tokenService.getLoginUser(ServletUtils.getRequest());
+        Long employeeUserId = loginUser.getUser().getUserId();
+        List<QwUser> qwUsers = qwMsgService.qwUserList(employeeUserId);
+        boolean owned = qwUsers.stream().anyMatch(qwUser -> qwUser.getId().equals(qwUserId));
+        if (!owned) {
+            return R.error("无权限访问该会话");
+        }
         List<QwContactListVO> list = qwMsgService.selectQwConversationByUserId(qwUserId);
         for (QwContactListVO contract:list) {
             if(StringUtils.isEmpty(contract.getDisplayName())){