未验证 提交 b8a9e2e0 编写于 作者: Q qiaozhanwei 提交者: GitHub

modify general user can't create,delete,update token (#3538)

Co-authored-by: Nqiaozhanwei <qiaozhanwei@analysys.com.cn>
上级 0505ebf4
...@@ -84,7 +84,9 @@ public class AccessTokenService extends BaseService { ...@@ -84,7 +84,9 @@ public class AccessTokenService extends BaseService {
*/ */
public Map<String, Object> createToken(User loginUser, int userId, String expireTime, String token) { public Map<String, Object> createToken(User loginUser, int userId, String expireTime, String token) {
Map<String, Object> result = new HashMap<>(5); Map<String, Object> result = new HashMap<>(5);
if(check(result, !isAdmin(loginUser), Status.USER_NO_OPERATION_PERM)){
if (!hasPerm(loginUser,userId)){
putMsg(result, Status.USER_NO_OPERATION_PERM);
return result; return result;
} }
...@@ -140,10 +142,6 @@ public class AccessTokenService extends BaseService { ...@@ -140,10 +142,6 @@ public class AccessTokenService extends BaseService {
public Map<String, Object> delAccessTokenById(User loginUser, int id) { public Map<String, Object> delAccessTokenById(User loginUser, int id) {
Map<String, Object> result = new HashMap<>(5); Map<String, Object> result = new HashMap<>(5);
if(check(result, !isAdmin(loginUser), Status.USER_NO_OPERATION_PERM)){
return result;
}
AccessToken accessToken = accessTokenMapper.selectById(id); AccessToken accessToken = accessTokenMapper.selectById(id);
if (accessToken == null) { if (accessToken == null) {
...@@ -152,8 +150,7 @@ public class AccessTokenService extends BaseService { ...@@ -152,8 +150,7 @@ public class AccessTokenService extends BaseService {
return result; return result;
} }
if (loginUser.getId() != accessToken.getUserId() && if (!hasPerm(loginUser,accessToken.getUserId())){
loginUser.getUserType() != UserType.ADMIN_USER) {
putMsg(result, Status.USER_NO_OPERATION_PERM); putMsg(result, Status.USER_NO_OPERATION_PERM);
return result; return result;
} }
...@@ -176,9 +173,11 @@ public class AccessTokenService extends BaseService { ...@@ -176,9 +173,11 @@ public class AccessTokenService extends BaseService {
public Map<String, Object> updateToken(User loginUser, int id, int userId, String expireTime, String token) { public Map<String, Object> updateToken(User loginUser, int id, int userId, String expireTime, String token) {
Map<String, Object> result = new HashMap<>(5); Map<String, Object> result = new HashMap<>(5);
if(check(result, !isAdmin(loginUser), Status.USER_NO_OPERATION_PERM)){ if (!hasPerm(loginUser,userId)){
putMsg(result, Status.USER_NO_OPERATION_PERM);
return result; return result;
} }
AccessToken accessToken = accessTokenMapper.selectById(id); AccessToken accessToken = accessTokenMapper.selectById(id);
if (accessToken == null) { if (accessToken == null) {
logger.error("access token not exist, access token id {}", id); logger.error("access token not exist, access token id {}", id);
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册