禁止通过setUserInfo接口修改用户角色防止越权

piexlmax · piexlmax · commit 64ca2a482e9a · 2022-02-09T11:57:53.000+08:00
diff --git a/server/api/v1/system/sys_user.go b/server/api/v1/system/sys_user.go
@@ -276,6 +276,7 @@ func (b *BaseApi) SetUserInfo(c *gin.Context) {
 	_ = c.ShouldBindJSON(&user)
 	user.Username = ""
 	user.Password = ""
+	user.AuthorityId = ""
 	if err := utils.Verify(user, utils.IdVerify); err != nil {
 		response.FailWithMessage(err.Error(), c)
 		return
@@ -301,6 +302,7 @@ func (b *BaseApi) SetSelfInfo(c *gin.Context) {
 	_ = c.ShouldBindJSON(&user)
 	user.Username = ""
 	user.Password = ""
+	user.AuthorityId = ""
 	user.ID = utils.GetUserID(c)
 	if err, ReqUser := userService.SetUserInfo(user); err != nil {
 		global.GVA_LOG.Error("设置失败!", zap.Error(err))
