漏洞修复-[高危] 多处按userId直接查询用户信息 - 无归属校验

fs-admin/src/main/java/com/fs/company/controller/SopStatsOverviewController.java

@@ -129,6 +129,7 @@ public class SopStatsOverviewController extends BaseController {
     /**
      * 获取用户信息信息
      */
+    @PreAuthorize("@ss.hasPermi('sop:statistics:query')")
     @GetMapping(value = "/getPatient/{userId}")
     public AjaxResult getPatient(@PathVariable("userId") Long userId)
     {
@@ -146,6 +147,7 @@ public class SopStatsOverviewController extends BaseController {
     /**
      * 获取用户详细信息
      */
+    @PreAuthorize("@ss.hasPermi('sop:statistics:query')")
     @GetMapping(value = "/userInfo/{userId}")
     public AjaxResult getUserInfo(@PathVariable("userId") Long userId)
     {
@@ -158,6 +160,7 @@ public class SopStatsOverviewController extends BaseController {
      * 获取用户详细信息
      */
 
+    @PreAuthorize("@ss.hasPermi('sop:statistics:query')")
     @GetMapping(value = "/getUserAddr/{userId}")
     public AjaxResult getUserAddr(@PathVariable("userId") Long userId)
     {

fs-company/src/main/java/com/fs/company/controller/store/FsUserController.java

@@ -180,7 +180,12 @@ public class FsUserController extends BaseController
     public AjaxResult getInfo(@PathVariable("userId") Long userId)
     {
         FsUser fsUser = fsUserService.selectFsUserByUserId(userId);
-        fsUser.setPhone(decryptAutoPhoneMk(fsUser.getPhone()));
+        if (fsUser != null) {
+            if (!checkCompanyScope(fsUser.getCompanyId())) {
+                return AjaxResult.error("无权限访问该用户数据");
+            }
+            fsUser.setPhone(decryptAutoPhoneMk(fsUser.getPhone()));
+        }
         return AjaxResult.success(fsUser);
     }
 
@@ -192,6 +197,10 @@ public class FsUserController extends BaseController
     @GetMapping(value = "/getUserAddr/{userId}")
     public AjaxResult getUserAddr(@PathVariable("userId") Long userId)
     {
+        FsUser fsUser = fsUserService.selectFsUserByUserId(userId);
+        if (fsUser != null && !checkCompanyScope(fsUser.getCompanyId())) {
+            return AjaxResult.error("无权限访问该用户数据");
+        }
         List<FsUserAddress> fsUserAddresses = fsUserService.selectFsUserAddressByUserId(userId);
         for (FsUserAddress fsUserAddress : fsUserAddresses) {
             fsUserAddress.setPhone(decryptAutoPhoneMk(fsUserAddress.getPhone()));
@@ -199,6 +208,16 @@ public class FsUserController extends BaseController
         return AjaxResult.success();
     }
 
+    /**
+     * 校验当前登录用户是否具备访问指定用户的权限（按所属企业 companyId）
+     */
+    private boolean checkCompanyScope(Long companyId) {
+        LoginUser loginUser = SecurityUtils.getLoginUser();
+        return loginUser != null && loginUser.getCompany() != null
+                && loginUser.getCompany().getCompanyId() != null
+                && loginUser.getCompany().getCompanyId().equals(companyId);
+    }
+
 
     /**
      * 新增用户

fs-doctor-app/src/main/java/com/fs/app/controller/FsSopDoctorTaskController.java

@@ -167,6 +167,7 @@ public class FsSopDoctorTaskController extends BaseController
     @GetMapping(value = "/getPatient/{userId}")
     public AjaxResult getPatient(@PathVariable("userId") Long userId)
     {
+        getDoctorId();
         List<FsPatientVO> fsPatientVOS = fsPatientService.selectFsPatientByUserId(userId);
         for (FsPatientVO  fsPatientVO: fsPatientVOS) {
             if (fsPatientVO.getPhone()!=null){
@@ -184,6 +185,7 @@ public class FsSopDoctorTaskController extends BaseController
     @GetMapping(value = "/userInfo/{userId}")
     public AjaxResult getUserInfo(@PathVariable("userId") Long userId)
     {
+        getDoctorId();
         FsUser fsUser = fsUserService.selectFsUserByUserId(userId);
         fsUser.setPhone(decryptAutoPhoneMk(fsUser.getPhone()));
         return AjaxResult.success(fsUser);
@@ -196,6 +198,7 @@ public class FsSopDoctorTaskController extends BaseController
     @GetMapping(value = "/getUserAddr/{userId}")
     public AjaxResult getUserAddr(@PathVariable("userId") Long userId)
     {
+        getDoctorId();
         List<FsUserAddress> fsUserAddresses = fsUserService.selectFsUserAddressByUserId(userId);
         for (FsUserAddress fsUserAddress : fsUserAddresses) {
             fsUserAddress.setPhone(decryptAutoPhoneMk(fsUserAddress.getPhone()));