test-version22
/
MeterSphere
mirror of https://gitee.com/fit2cloud-feizhiyun/MeterSphere.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

fix(系统设置): 修复checkOwner相关的问题

This commit is contained in:
song-cc-rock 2024-04-15 11:11:31 +08:00 committed by Craftsman
parent d1741bb3ca
commit d145988a86
17 changed files with 293 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
backend/services/project-management/src/main/java/io/metersphere/project/controller/ProjectMemberController.java
View File

@ -12,6 +12,7 @@ import io.metersphere.sdk.constants.PermissionConstants;
import io.metersphere.system.dto.CommentUserInfo;
import io.metersphere.system.dto.sdk.OptionDTO;
import io.metersphere.system.dto.user.UserExtendDTO;
import io.metersphere.system.security.CheckOwner;
import io.metersphere.system.utils.PageUtils;
import io.metersphere.system.utils.Pager;
import io.metersphere.system.utils.SessionUtils;
@ -41,6 +42,7 @@ public class ProjectMemberController {
@PostMapping("/list")
@Operation(summary = "项目管理-成员-列表查询")
@RequiresPermissions(PermissionConstants.PROJECT_USER_READ)
@CheckOwner(resourceId = "#request.getProjectId()", resourceType = "project")
public Pager<List<ProjectUserDTO>> listMember(@Validated @RequestBody ProjectMemberRequest request) {
Page<Object> page = PageHelper.startPage(request.getCurrent(), request.getPageSize(), true);
return PageUtils.setPageInfo(page, projectMemberService.listMember(request));
@ -49,6 +51,7 @@ public class ProjectMemberController {
@GetMapping("/get-member/option/{projectId}")
@Operation(summary = "项目管理-成员-获取成员下拉选项")
@RequiresPermissions(PermissionConstants.PROJECT_USER_READ)
@CheckOwner(resourceId = "#projectId", resourceType = "project")
public List<UserExtendDTO> getMemberOption(@PathVariable String projectId,
@Schema(description = "查询关键字，根据邮箱和用户名查询")
@RequestParam(value = "keyword", required = false) String keyword) {
@ -58,6 +61,7 @@ public class ProjectMemberController {
@GetMapping("/get-role/option/{projectId}")
@Operation(summary = "项目管理-成员-获取用户组下拉选项")
@RequiresPermissions(PermissionConstants.PROJECT_USER_READ)
@CheckOwner(resourceId = "#projectId", resourceType = "project")
public List<OptionDTO> getRoleOption(@PathVariable String projectId) {
return projectMemberService.getRoleOption(projectId);
}
@ -65,6 +69,7 @@ public class ProjectMemberController {
@PostMapping("/add")
@Operation(summary = "项目管理-成员-添加成员")
@RequiresPermissions(PermissionConstants.PROJECT_USER_ADD)
@CheckOwner(resourceId = "#request.getProjectId()", resourceType = "project")
public void addMember(@RequestBody ProjectMemberAddRequest request) {
projectMemberService.addMember(request, SessionUtils.getUserId());
}
@ -72,6 +77,7 @@ public class ProjectMemberController {
@PostMapping("/update")
@Operation(summary = "项目管理-成员-编辑成员")
@RequiresPermissions(PermissionConstants.PROJECT_USER_UPDATE)
@CheckOwner(resourceId = "#request.getProjectId()", resourceType = "project")
public void updateMember(@RequestBody ProjectMemberEditRequest request) {
projectMemberService.updateMember(request, SessionUtils.getUserId());
}
@ -83,6 +89,7 @@ public class ProjectMemberController {
@Parameter(name = "userId", description = "成员ID", schema = @Schema(requiredMode = Schema.RequiredMode.REQUIRED))
})
@RequiresPermissions(PermissionConstants.PROJECT_USER_DELETE)
@CheckOwner(resourceId = "#projectId", resourceType = "project")
public void removeMember(@PathVariable String projectId, @PathVariable String userId) {
projectMemberService.removeMember(projectId, userId, SessionUtils.getUserId());
}
@ -90,6 +97,7 @@ public class ProjectMemberController {
@PostMapping("/add-role")
@Operation(summary = "项目管理-成员-批量添加至用户组")
@RequiresPermissions(PermissionConstants.PROJECT_USER_UPDATE)
@CheckOwner(resourceId = "#request.getProjectId()", resourceType = "project")
public void addMemberRole(@RequestBody ProjectMemberAddRequest request) {
projectMemberService.addRole(request, SessionUtils.getUserId());
}
@ -97,6 +105,7 @@ public class ProjectMemberController {
@PostMapping("/batch/remove")
@Operation(summary = "项目管理-成员-批量从项目移除")
@RequiresPermissions(PermissionConstants.PROJECT_USER_DELETE)
@CheckOwner(resourceId = "#request.getProjectId()", resourceType = "project")
public void batchRemove(@RequestBody ProjectMemberBatchDeleteRequest request) {
projectMemberService.batchRemove(request, SessionUtils.getUserId());
}

6
backend/services/project-management/src/main/java/io/metersphere/project/controller/ProjectStatusFlowSettingController.java
View File

@ -11,6 +11,7 @@ import io.metersphere.system.dto.sdk.request.StatusItemAddRequest;
import io.metersphere.system.dto.sdk.request.StatusItemUpdateRequest;
import io.metersphere.system.log.annotation.Log;
import io.metersphere.system.log.constants.OperationLogType;
import io.metersphere.system.security.CheckProjectOwner;
import io.swagger.v3.oas.annotations.Operation;
import io.swagger.v3.oas.annotations.media.Schema;
import io.swagger.v3.oas.annotations.tags.Tag;
@ -48,6 +49,7 @@ public class ProjectStatusFlowSettingController {
@Operation(summary = "项目管理-模板-状态流设置-设置状态定义，即起始状态，结束状态")
@RequiresPermissions(PermissionConstants.PROJECT_TEMPLATE_UPDATE)
@Log(type = OperationLogType.UPDATE, expression = "#msClass.updateStatusDefinitionLog(#request)", msClass = ProjectStatusFlowSettingLogService.class)
@CheckProjectOwner(resourceId = "#request.getStatusId()", resourceType = "status_item", resourceCol = "scope_id")
public void updateStatusDefinition(@Validated @RequestBody StatusDefinitionUpdateRequest request) {
projectStatusFlowSettingService.updateStatusDefinition(request);
}
@ -55,6 +57,7 @@ public class ProjectStatusFlowSettingController {
@PostMapping("/status/sort/{projectId}/{scene}")
@Operation(summary = "系统设置-组织-状态流设置-状态项排序")
@RequiresPermissions(PermissionConstants.PROJECT_TEMPLATE_UPDATE)
@CheckProjectOwner(resourceId = "#statusIds", resourceType = "status_item", resourceCol = "scope_id")
public void sortStatusItem(@PathVariable
String projectId,
@PathVariable
@ -77,6 +80,7 @@ public class ProjectStatusFlowSettingController {
@Operation(summary = "项目管理-模板-状态流设置-修改状态项")
@RequiresPermissions(PermissionConstants.PROJECT_TEMPLATE_UPDATE)
@Log(type = OperationLogType.UPDATE, expression = "#msClass.updateStatusItemLog(#request)", msClass = ProjectStatusFlowSettingLogService.class)
@CheckProjectOwner(resourceId = "#request.getId()", resourceType = "status_item", resourceCol = "scope_id")
public StatusItem updateStatusItem(@Validated @RequestBody StatusItemUpdateRequest request) {
return projectStatusFlowSettingService.updateStatusItem(request);
}
@ -85,6 +89,7 @@ public class ProjectStatusFlowSettingController {
@Operation(summary = "项目管理-模板-状态流设置-删除状态项")
@RequiresPermissions(PermissionConstants.PROJECT_TEMPLATE_UPDATE)
@Log(type = OperationLogType.UPDATE, expression = "#msClass.deleteStatusItemLog(#id)", msClass = ProjectStatusFlowSettingLogService.class)
@CheckProjectOwner(resourceId = "#id", resourceType = "status_item", resourceCol = "scope_id")
public void deleteStatusItem(@PathVariable String id) {
projectStatusFlowSettingService.deleteStatusItem(id);
}
@ -93,6 +98,7 @@ public class ProjectStatusFlowSettingController {
@Operation(summary = "项目管理-模板-状态流设置-设置状态流转")
@RequiresPermissions(PermissionConstants.PROJECT_TEMPLATE_UPDATE)
@Log(type = OperationLogType.UPDATE, expression = "#msClass.updateStatusFlowLog(#request)", msClass = ProjectStatusFlowSettingLogService.class)
@CheckProjectOwner(resourceId = "#request.getFromId()", resourceType = "status_item", resourceCol = "scope_id")
public void updateStatusFlow(@Validated @RequestBody StatusFlowUpdateRequest request) {
projectStatusFlowSettingService.updateStatusFlow(request);
}

5
backend/services/project-management/src/main/java/io/metersphere/project/controller/ProjectTemplateController.java
View File

@ -9,6 +9,7 @@ import io.metersphere.system.dto.sdk.TemplateDTO;
import io.metersphere.system.dto.sdk.request.TemplateUpdateRequest;
import io.metersphere.system.log.annotation.Log;
import io.metersphere.system.log.constants.OperationLogType;
import io.metersphere.system.security.CheckProjectOwner;
import io.metersphere.system.utils.SessionUtils;
import io.metersphere.validation.groups.Created;
import io.metersphere.validation.groups.Updated;
@ -48,6 +49,7 @@ public class ProjectTemplateController {
@GetMapping("/get/{id}")
@Operation(summary = "获取模版详情")
@RequiresPermissions(PermissionConstants.PROJECT_TEMPLATE_READ)
@CheckProjectOwner(resourceId = "#id", resourceType = "template", resourceCol = "scope_id")
public TemplateDTO get(@PathVariable String id) {
return projectTemplateservice.getTemplateDTOWithCheck(id);
}
@ -64,6 +66,7 @@ public class ProjectTemplateController {
@Operation(summary = "更新模版")
@RequiresPermissions(PermissionConstants.PROJECT_TEMPLATE_UPDATE)
@Log(type = OperationLogType.UPDATE, expression = "#msClass.updateLog(#request)", msClass = ProjectTemplateLogService.class)
@CheckProjectOwner(resourceId = "#request.getId()", resourceType = "template", resourceCol = "scope_id")
public Template update(@Validated({Updated.class}) @RequestBody TemplateUpdateRequest request) {
return projectTemplateservice.update(request);
}
@ -72,6 +75,7 @@ public class ProjectTemplateController {
@Operation(summary = "删除模版")
@RequiresPermissions(PermissionConstants.PROJECT_TEMPLATE_DELETE)
@Log(type = OperationLogType.DELETE, expression = "#msClass.deleteLog(#id)", msClass = ProjectTemplateLogService.class)
@CheckProjectOwner(resourceId = "#id", resourceType = "template", resourceCol = "scope_id")
public void delete(@PathVariable String id) {
projectTemplateservice.delete(id);
}
@ -80,6 +84,7 @@ public class ProjectTemplateController {
@Operation(summary = "设置默认模板")
@RequiresPermissions(PermissionConstants.PROJECT_TEMPLATE_UPDATE)
@Log(type = OperationLogType.UPDATE, expression = "#msClass.setDefaultTemplateLog(#id)", msClass = ProjectTemplateLogService.class)
@CheckProjectOwner(resourceId = "#id", resourceType = "template", resourceCol = "scope_id")
public void setDefaultTemplate(@PathVariable String projectId, @PathVariable String id) {
projectTemplateservice.setDefaultTemplate(projectId, id);
}

9
backend/services/project-management/src/main/java/io/metersphere/project/controller/ProjectUserRoleController.java
View File

@ -18,6 +18,7 @@ import io.metersphere.system.dto.sdk.request.PermissionSettingUpdateRequest;
import io.metersphere.system.dto.user.UserExtendDTO;
import io.metersphere.system.log.annotation.Log;
import io.metersphere.system.log.constants.OperationLogType;
import io.metersphere.system.security.CheckProjectOwner;
import io.metersphere.system.service.UserRoleService;
import io.metersphere.system.utils.PageUtils;
import io.metersphere.system.utils.Pager;
@ -50,6 +51,7 @@ public class ProjectUserRoleController {
@PostMapping("/list")
@Operation(summary = "项目管理-项目与权限-用户组-获取用户组列表")
@RequiresPermissions(PermissionConstants.PROJECT_GROUP_READ)
@CheckProjectOwner(resourceId = "#request.getProjectId()", resourceType = "user_role", resourceCol = "scope_id")
public Pager<List<ProjectUserRoleDTO>> list(@Validated @RequestBody ProjectUserRoleRequest request) {
Page<Object> page = PageHelper.startPage(request.getCurrent(), request.getPageSize());
return PageUtils.setPageInfo(page, projectUserRoleService.list(request));
@ -59,6 +61,7 @@ public class ProjectUserRoleController {
@Operation(summary = "项目管理-项目与权限-用户组-添加用户组")
@RequiresPermissions(PermissionConstants.PROJECT_GROUP_ADD)
@Log(type = OperationLogType.ADD, expression = "#msClass.addLog(#request)", msClass = ProjectUserRoleLogService.class)
@CheckProjectOwner(resourceId = "#request.getScopeId()", resourceType = "user_role", resourceCol = "scope_id")
public UserRole add(@Validated({Created.class}) @RequestBody ProjectUserRoleEditRequest request) {
UserRole userRole = new UserRole();
userRole.setCreateUser(SessionUtils.getUserId());
@ -70,6 +73,7 @@ public class ProjectUserRoleController {
@Operation(summary = "项目管理-项目与权限-用户组-修改用户组")
@RequiresPermissions(PermissionConstants.PROJECT_GROUP_UPDATE)
@Log(type = OperationLogType.UPDATE, expression = "#msClass.updateLog(#request)", msClass = ProjectUserRoleLogService.class)
@CheckProjectOwner(resourceId = "#request.getId()", resourceType = "user_role", resourceCol = "scope_id")
public UserRole update(@Validated({Updated.class}) @RequestBody ProjectUserRoleEditRequest request) {
UserRole userRole = new UserRole();
BeanUtils.copyBean(userRole, request);
@ -81,6 +85,7 @@ public class ProjectUserRoleController {
@RequiresPermissions(PermissionConstants.PROJECT_GROUP_DELETE)
@Parameter(name = "id", description = "用户组ID", schema = @Schema(requiredMode = Schema.RequiredMode.REQUIRED))
@Log(type = OperationLogType.DELETE, expression = "#msClass.deleteLog(#id)", msClass = ProjectUserRoleLogService.class)
@CheckProjectOwner(resourceId = "#id", resourceType = "user_role", resourceCol = "scope_id")
public void delete(@PathVariable String id) {
projectUserRoleService.delete(id, SessionUtils.getUserId());
}
@ -89,6 +94,7 @@ public class ProjectUserRoleController {
@Operation(summary = "项目管理-项目与权限-用户组-获取用户组对应的权限配置")
@Parameter(name = "id", description = "用户组ID", schema = @Schema(requiredMode = Schema.RequiredMode.REQUIRED))
@RequiresPermissions(PermissionConstants.PROJECT_GROUP_READ)
@CheckProjectOwner(resourceId = "#id", resourceType = "user_role", resourceCol = "scope_id")
public List<PermissionDefinitionItem> getPermissionSetting(@PathVariable String id) {
return projectUserRoleService.getPermissionSetting(id);
}
@ -97,6 +103,7 @@ public class ProjectUserRoleController {
@Operation(summary = "项目管理-项目与权限-用户组-修改用户组对应的权限配置")
@RequiresPermissions(PermissionConstants.PROJECT_GROUP_UPDATE)
@Log(type = OperationLogType.UPDATE, expression = "#msClass.updatePermissionSettingLog(#request)", msClass = ProjectUserRoleLogService.class)
@CheckProjectOwner(resourceId = "#request.getUserRoleId()", resourceType = "user_role", resourceCol = "scope_id")
public void updatePermissionSetting(@Validated @RequestBody PermissionSettingUpdateRequest request) {
projectUserRoleService.updatePermissionSetting(request);
}
@ -127,6 +134,7 @@ public class ProjectUserRoleController {
@Operation(summary = "项目管理-项目与权限-用户组-添加用户组成员")
@RequiresPermissions(PermissionConstants.PROJECT_GROUP_UPDATE)
@Log(type = OperationLogType.UPDATE, expression = "#msClass.editMemberLog(#request)", msClass = ProjectUserRoleLogService.class)
@CheckProjectOwner(resourceId = "#request.getUserRoleId()", resourceType = "user_role", resourceCol = "scope_id")
public void addMember(@Validated @RequestBody ProjectUserRoleMemberEditRequest request) {
projectUserRoleService.addMember(request, SessionUtils.getUserId());
}
@ -135,6 +143,7 @@ public class ProjectUserRoleController {
@Operation(summary = "项目管理-项目与权限-用户组-删除用户组成员")
@RequiresPermissions(PermissionConstants.PROJECT_GROUP_UPDATE)
@Log(type = OperationLogType.UPDATE, expression = "#msClass.editMemberLog(#request)", msClass = ProjectUserRoleLogService.class)
@CheckProjectOwner(resourceId = "#request.getUserRoleId()", resourceType = "user_role", resourceCol = "scope_id")
public void removeMember(@Validated @RequestBody ProjectUserRoleMemberEditRequest request) {
projectUserRoleService.removeMember(request);
}

6
backend/services/system-setting/src/main/java/io/metersphere/system/controller/OrganizationStatusFlowSettingController.java
View File

@ -9,6 +9,7 @@ import io.metersphere.system.dto.sdk.request.StatusItemAddRequest;
import io.metersphere.system.dto.sdk.request.StatusItemUpdateRequest;
import io.metersphere.system.log.annotation.Log;
import io.metersphere.system.log.constants.OperationLogType;
import io.metersphere.system.security.CheckOrgOwner;
import io.metersphere.system.service.OrganizationStatusFlowSettingLogService;
import io.metersphere.system.service.OrganizationStatusFlowSettingService;
import io.swagger.v3.oas.annotations.Operation;
@ -48,6 +49,7 @@ public class OrganizationStatusFlowSettingController {
@Operation(summary = "系统设置-组织-状态流设置-设置状态定义，即起始状态，结束状态")
@RequiresPermissions(PermissionConstants.ORGANIZATION_TEMPLATE_UPDATE)
@Log(type = OperationLogType.UPDATE, expression = "#msClass.updateStatusDefinitionLog(#request)", msClass = OrganizationStatusFlowSettingLogService.class)
@CheckOrgOwner(resourceId = "#request.getStatusId()", resourceType = "status_item", resourceCol = "scope_id")
public void updateStatusDefinition(@Validated @RequestBody StatusDefinitionUpdateRequest request) {
organizationStatusFlowSettingService.updateStatusDefinition(request);
}
@ -64,6 +66,7 @@ public class OrganizationStatusFlowSettingController {
@Operation(summary = "系统设置-组织-状态流设置-修改状态项")
@RequiresPermissions(PermissionConstants.ORGANIZATION_TEMPLATE_UPDATE)
@Log(type = OperationLogType.UPDATE, expression = "#msClass.updateStatusItemLog(#request)", msClass = OrganizationStatusFlowSettingLogService.class)
@CheckOrgOwner(resourceId = "#request.getId()", resourceType = "status_item", resourceCol = "scope_id")
public StatusItem updateStatusItem(@Validated @RequestBody StatusItemUpdateRequest request) {
return organizationStatusFlowSettingService.updateStatusItem(request);
}
@ -71,6 +74,7 @@ public class OrganizationStatusFlowSettingController {
@PostMapping("/status/sort/{organizationId}/{scene}")
@Operation(summary = "系统设置-组织-状态流设置-状态项排序")
@RequiresPermissions(PermissionConstants.ORGANIZATION_TEMPLATE_UPDATE)
@CheckOrgOwner(resourceId = "#statusIds", resourceType = "status_item", resourceCol = "scope_id")
public void sortStatusItem(@PathVariable
String organizationId, @PathVariable String scene,
@RequestBody
@ -83,6 +87,7 @@ public class OrganizationStatusFlowSettingController {
@Operation(summary = "系统设置-组织-状态流设置-删除状态项")
@RequiresPermissions(PermissionConstants.ORGANIZATION_TEMPLATE_UPDATE)
@Log(type = OperationLogType.UPDATE, expression = "#msClass.deleteStatusItemLog(#id)", msClass = OrganizationStatusFlowSettingLogService.class)
@CheckOrgOwner(resourceId = "#id", resourceType = "status_item", resourceCol = "scope_id")
public void deleteStatusItem(@PathVariable String id) {
organizationStatusFlowSettingService.deleteStatusItem(id);
}
@ -91,6 +96,7 @@ public class OrganizationStatusFlowSettingController {
@Operation(summary = "系统设置-组织-状态流设置-设置状态流转")
@RequiresPermissions(PermissionConstants.ORGANIZATION_TEMPLATE_UPDATE)
@Log(type = OperationLogType.UPDATE, expression = "#msClass.updateStatusFlowLog(#request)", msClass = OrganizationStatusFlowSettingLogService.class)
@CheckOrgOwner(resourceId = "#request.getFromId()", resourceType = "status_item", resourceCol = "scope_id")
public void updateStatusFlow(@Validated @RequestBody StatusFlowUpdateRequest request) {
organizationStatusFlowSettingService.updateStatusFlow(request);
}

4
backend/services/system-setting/src/main/java/io/metersphere/system/controller/OrganizationTemplateController.java
View File

@ -6,6 +6,7 @@ import io.metersphere.system.dto.sdk.TemplateDTO;
import io.metersphere.system.dto.sdk.request.TemplateUpdateRequest;
import io.metersphere.system.log.annotation.Log;
import io.metersphere.system.log.constants.OperationLogType;
import io.metersphere.system.security.CheckOrgOwner;
import io.metersphere.system.service.OrganizationTemplateLogService;
import io.metersphere.system.service.OrganizationTemplateService;
import io.metersphere.system.utils.SessionUtils;
@ -47,6 +48,7 @@ public class OrganizationTemplateController {
@GetMapping("/get/{id}")
@Operation(summary = "获取模版详情")
@RequiresPermissions(PermissionConstants.ORGANIZATION_TEMPLATE_READ)
@CheckOrgOwner(resourceId = "#id", resourceType = "template", resourceCol = "scope_id")
public TemplateDTO get(@PathVariable String id) {
return organizationTemplateService.geDTOWithCheck(id);
}
@ -63,6 +65,7 @@ public class OrganizationTemplateController {
@Operation(summary = "更新模版")
@RequiresPermissions(PermissionConstants.ORGANIZATION_TEMPLATE_UPDATE)
@Log(type = OperationLogType.ADD, expression = "#msClass.updateLog(#request)", msClass = OrganizationTemplateLogService.class)
@CheckOrgOwner(resourceId = "#request.getId()", resourceType = "template", resourceCol = "scope_id")
public Template update(@Validated({Updated.class}) @RequestBody TemplateUpdateRequest request) {
return organizationTemplateService.update(request);
}
@ -71,6 +74,7 @@ public class OrganizationTemplateController {
@Operation(summary = "删除模版")
@RequiresPermissions(PermissionConstants.ORGANIZATION_TEMPLATE_DELETE)
@Log(type = OperationLogType.DELETE, expression = "#msClass.deleteLog(#id)", msClass = OrganizationTemplateLogService.class)
@CheckOrgOwner(resourceId = "#id", resourceType = "template", resourceCol = "scope_id")
public void delete(@PathVariable String id) {
organizationTemplateService.delete(id);
}

7
backend/services/system-setting/src/main/java/io/metersphere/system/controller/OrganizationUserRoleController.java
View File

@ -14,6 +14,7 @@ import io.metersphere.system.dto.sdk.request.PermissionSettingUpdateRequest;
import io.metersphere.system.dto.user.UserExtendDTO;
import io.metersphere.system.log.annotation.Log;
import io.metersphere.system.log.constants.OperationLogType;
import io.metersphere.system.security.CheckOrgOwner;
import io.metersphere.system.service.OrganizationUserRoleLogService;
import io.metersphere.system.service.OrganizationUserRoleService;
import io.metersphere.system.service.UserRoleService;
@ -70,6 +71,7 @@ public class OrganizationUserRoleController {
@Operation(summary = "系统设置-组织-用户组-修改用户组")
@RequiresPermissions(PermissionConstants.ORGANIZATION_USER_ROLE_READ_UPDATE)
@Log(type = OperationLogType.UPDATE, expression = "#msClass.updateLog(#request)", msClass = OrganizationUserRoleLogService.class)
@CheckOrgOwner(resourceId = "#request.getId()", resourceType = "user_role", resourceCol = "scope_id")
public UserRole update(@Validated({Updated.class}) @RequestBody OrganizationUserRoleEditRequest request) {
UserRole userRole = new UserRole();
BeanUtils.copyBean(userRole, request);
@ -81,6 +83,7 @@ public class OrganizationUserRoleController {
@RequiresPermissions(PermissionConstants.ORGANIZATION_USER_ROLE_READ_DELETE)
@Parameter(name = "id", description = "用户组ID", schema = @Schema(requiredMode = Schema.RequiredMode.REQUIRED))
@Log(type = OperationLogType.DELETE, expression = "#msClass.deleteLog(#id)", msClass = OrganizationUserRoleLogService.class)
@CheckOrgOwner(resourceId = "#id", resourceType = "user_role", resourceCol = "scope_id")
public void delete(@PathVariable String id) {
organizationUserRoleService.delete(id, SessionUtils.getUserId());
}
@ -89,6 +92,7 @@ public class OrganizationUserRoleController {
@Operation(summary = "系统设置-组织-用户组-获取用户组对应的权限配置")
@Parameter(name = "id", description = "用户组ID", schema = @Schema(requiredMode = Schema.RequiredMode.REQUIRED))
@RequiresPermissions(PermissionConstants.ORGANIZATION_USER_ROLE_READ)
@CheckOrgOwner(resourceId = "#id", resourceType = "user_role", resourceCol = "scope_id")
public List<PermissionDefinitionItem> getPermissionSetting(@PathVariable String id) {
return organizationUserRoleService.getPermissionSetting(id);
}
@ -97,6 +101,7 @@ public class OrganizationUserRoleController {
@Operation(summary = "系统设置-组织-用户组-修改用户组对应的权限配置")
@RequiresPermissions(PermissionConstants.ORGANIZATION_USER_ROLE_READ_UPDATE)
@Log(type = OperationLogType.UPDATE, expression = "#msClass.updatePermissionSettingLog(#request)", msClass = OrganizationUserRoleLogService.class)
@CheckOrgOwner(resourceId = "#request.getUserRoleId()", resourceType = "user_role", resourceCol = "scope_id")
public void updatePermissionSetting(@Validated @RequestBody PermissionSettingUpdateRequest request) {
organizationUserRoleService.updatePermissionSetting(request);
}
@ -127,6 +132,7 @@ public class OrganizationUserRoleController {
@Operation(summary = "系统设置-组织-用户组-添加用户组成员")
@RequiresPermissions(PermissionConstants.ORGANIZATION_USER_ROLE_READ_UPDATE)
@Log(type = OperationLogType.UPDATE, expression = "#msClass.editMemberLog(#request)", msClass = OrganizationUserRoleLogService.class)
@CheckOrgOwner(resourceId = "#request.getUserRoleId()", resourceType = "user_role", resourceCol = "scope_id")
public void addMember(@Validated @RequestBody OrganizationUserRoleMemberEditRequest request) {
organizationUserRoleService.addMember(request, SessionUtils.getUserId());
}
@ -135,6 +141,7 @@ public class OrganizationUserRoleController {
@Operation(summary = "系统设置-组织-用户组-删除用户组成员")
@RequiresPermissions(PermissionConstants.ORGANIZATION_USER_ROLE_READ_UPDATE)
@Log(type = OperationLogType.UPDATE, expression = "#msClass.editMemberLog(#request)", msClass = OrganizationUserRoleLogService.class)
@CheckOrgOwner(resourceId = "#request.getUserRoleId()", resourceType = "user_role", resourceCol = "scope_id")
public void removeMember(@Validated @RequestBody OrganizationUserRoleMemberEditRequest request) {
organizationUserRoleService.removeMember(request);
}

4
backend/services/system-setting/src/main/java/io/metersphere/system/mapper/ExtCheckOwnerMapper.java
View File

@ -10,4 +10,8 @@ public interface ExtCheckOwnerMapper {
boolean checkoutOrganizationOwner(@Param("table") String resourceType, @Param("userId") String userId, @Param("ids") List<String> ids);
boolean checkoutOrganization(@Param("userId") String userId, @Param("ids") List<String> ids);
boolean checkoutOrganizationOwnerByScope(@Param("table") String resourceType, @Param("column") String resourceColumn, @Param("userId") String userId, @Param("ids") List<String> ids);
boolean checkoutProjectOwnerByScope(@Param("table") String resourceType, @Param("column") String resourceColumn, @Param("userId") String userId, @Param("ids") List<String> ids);
}

24
backend/services/system-setting/src/main/java/io/metersphere/system/mapper/ExtCheckOwnerMapper.xml
View File

@ -37,4 +37,28 @@
</foreach>)
AND user_id = #{userId}
</select>
<select id="checkoutOrganizationOwnerByScope" resultType="boolean">
SELECT count(1) > 0
FROM user_role_relation
WHERE source_id IN (SELECT ${column}
FROM ${table} JOIN organization ON ${table}.${column} = organization.id AND organization.enable = TRUE
WHERE ${table}.id IN
<foreach collection="ids" item="id" separator="," open="(" close=")">
#{id}
</foreach>)
AND user_id = #{userId}
</select>
<select id="checkoutProjectOwnerByScope" resultType="boolean">
SELECT count(1) > 0
FROM user_role_relation
WHERE source_id IN (SELECT ${column}
FROM ${table} JOIN project ON ${table}.${column} = project.id AND project.enable = TRUE
WHERE ${table}.id IN
<foreach collection="ids" item="id" separator="," open="(" close=")">
#{id}
</foreach>)
AND user_id = #{userId}
</select>
</mapper>

15
backend/services/system-setting/src/main/java/io/metersphere/system/security/CheckOrgOwner.java Normal file
View File

@ -0,0 +1,15 @@
package io.metersphere.system.security;
import java.lang.annotation.*;
@Target({ElementType.METHOD})
@Retention(RetentionPolicy.RUNTIME)
@Documented
public @interface CheckOrgOwner {
String resourceId();
String resourceType();
String resourceCol() default "organization_id";
}

89
backend/services/system-setting/src/main/java/io/metersphere/system/security/CheckOrgOwnerAspect.java Normal file
View File

@ -0,0 +1,89 @@
package io.metersphere.system.security;
import io.metersphere.sdk.constants.InternalUserRole;
import io.metersphere.sdk.exception.MSException;
import io.metersphere.sdk.util.Translator;
import io.metersphere.system.mapper.ExtCheckOwnerMapper;
import io.metersphere.system.utils.SessionUtils;
import jakarta.annotation.Resource;
import org.apache.commons.lang3.StringUtils;
import org.aspectj.lang.JoinPoint;
import org.aspectj.lang.annotation.Aspect;
import org.aspectj.lang.annotation.Before;
import org.aspectj.lang.annotation.Pointcut;
import org.aspectj.lang.reflect.MethodSignature;
import org.springframework.core.StandardReflectionParameterNameDiscoverer;
import org.springframework.expression.EvaluationContext;
import org.springframework.expression.Expression;
import org.springframework.expression.ExpressionParser;
import org.springframework.expression.spel.standard.SpelExpressionParser;
import org.springframework.expression.spel.support.StandardEvaluationContext;
import org.springframework.stereotype.Component;
import java.lang.reflect.Method;
import java.util.List;
@Aspect
@Component
public class CheckOrgOwnerAspect {
private ExpressionParser parser = new SpelExpressionParser();
private StandardReflectionParameterNameDiscoverer discoverer = new StandardReflectionParameterNameDiscoverer();
@Resource
private ExtCheckOwnerMapper extCheckOwnerMapper;
@Pointcut("@annotation(io.metersphere.system.security.CheckOrgOwner)")
public void pointcut() {
}
@Before("pointcut()")
public void before(JoinPoint joinPoint) {
//从切面织入点处通过反射机制获取织入点处的方法
MethodSignature signature = (MethodSignature) joinPoint.getSignature();
//获取切入点所在的方法
Method method = signature.getMethod();
//获取参数对象数组
Object[] args = joinPoint.getArgs();
CheckOrgOwner checkOwner = method.getAnnotation(CheckOrgOwner.class);
long count = SessionUtils.getUser().getUserRoles()
.stream()
.filter(g -> StringUtils.equalsIgnoreCase(g.getId(), InternalUserRole.ADMIN.getValue()))
.count();
if (count > 0) {
return;
}
// 操作内容
//获取方法参数名
String[] params = discoverer.getParameterNames(method);
//将参数纳入Spring管理
EvaluationContext context = new StandardEvaluationContext();
for (int len = 0; len < params.length; len++) {
context.setVariable(params[len], args[len]);
}
String resourceId = checkOwner.resourceId();
String resourceType = checkOwner.resourceType();
String resourceCol = checkOwner.resourceCol();
Expression titleExp = parser.parseExpression(resourceId);
Object v = titleExp.getValue(context, Object.class);
handleOrganizationResource(v, resourceType, resourceCol);
}
private void handleOrganizationResource(Object v, String resourceType, String resourceCol) {
if (v instanceof String id) {
if (!extCheckOwnerMapper.checkoutOrganizationOwnerByScope(resourceType, resourceCol, SessionUtils.getUserId(), List.of(id))) {
throw new MSException(Translator.get("check_owner_case"));
}
}
if (v instanceof List<?> ids) {
// noinspection unchecked
if (!extCheckOwnerMapper.checkoutOrganizationOwnerByScope(resourceType, resourceCol, SessionUtils.getUserId(), (List<String>) ids)) {
throw new MSException(Translator.get("check_owner_case"));
}
}
}
}

15
backend/services/system-setting/src/main/java/io/metersphere/system/security/CheckProjectOwner.java Normal file
View File

@ -0,0 +1,15 @@
package io.metersphere.system.security;
import java.lang.annotation.*;
@Target({ElementType.METHOD})
@Retention(RetentionPolicy.RUNTIME)
@Documented
public @interface CheckProjectOwner {
String resourceId();
String resourceType();
String resourceCol() default "project_id";
}

89
backend/services/system-setting/src/main/java/io/metersphere/system/security/CheckProjectOwnerAspect.java Normal file
View File

@ -0,0 +1,89 @@
package io.metersphere.system.security;
import io.metersphere.sdk.constants.InternalUserRole;
import io.metersphere.sdk.exception.MSException;
import io.metersphere.sdk.util.Translator;
import io.metersphere.system.mapper.ExtCheckOwnerMapper;
import io.metersphere.system.utils.SessionUtils;
import jakarta.annotation.Resource;
import org.apache.commons.lang3.StringUtils;
import org.aspectj.lang.JoinPoint;
import org.aspectj.lang.annotation.Aspect;
import org.aspectj.lang.annotation.Before;
import org.aspectj.lang.annotation.Pointcut;
import org.aspectj.lang.reflect.MethodSignature;
import org.springframework.core.StandardReflectionParameterNameDiscoverer;
import org.springframework.expression.EvaluationContext;
import org.springframework.expression.Expression;
import org.springframework.expression.ExpressionParser;
import org.springframework.expression.spel.standard.SpelExpressionParser;
import org.springframework.expression.spel.support.StandardEvaluationContext;
import org.springframework.stereotype.Component;
import java.lang.reflect.Method;
import java.util.List;
@Aspect
@Component
public class CheckProjectOwnerAspect {
private ExpressionParser parser = new SpelExpressionParser();
private StandardReflectionParameterNameDiscoverer discoverer = new StandardReflectionParameterNameDiscoverer();
@Resource
private ExtCheckOwnerMapper extCheckOwnerMapper;
@Pointcut("@annotation(io.metersphere.system.security.CheckProjectOwner)")
public void pointcut() {
}
@Before("pointcut()")
public void before(JoinPoint joinPoint) {
//从切面织入点处通过反射机制获取织入点处的方法
MethodSignature signature = (MethodSignature) joinPoint.getSignature();
//获取切入点所在的方法
Method method = signature.getMethod();
//获取参数对象数组
Object[] args = joinPoint.getArgs();
CheckProjectOwner checkOwner = method.getAnnotation(CheckProjectOwner.class);
long count = SessionUtils.getUser().getUserRoles()
.stream()
.filter(g -> StringUtils.equalsIgnoreCase(g.getId(), InternalUserRole.ADMIN.getValue()))
.count();
if (count > 0) {
return;
}
// 操作内容
//获取方法参数名
String[] params = discoverer.getParameterNames(method);
//将参数纳入Spring管理
EvaluationContext context = new StandardEvaluationContext();
for (int len = 0; len < params.length; len++) {
context.setVariable(params[len], args[len]);
}
String resourceId = checkOwner.resourceId();
String resourceType = checkOwner.resourceType();
String resourceCol = checkOwner.resourceCol();
Expression titleExp = parser.parseExpression(resourceId);
Object v = titleExp.getValue(context, Object.class);
handleProjectResource(v, resourceType, resourceCol);
}
private void handleProjectResource(Object v, String resourceType, String resourceCol) {
if (v instanceof String id) {
if (!extCheckOwnerMapper.checkoutProjectOwnerByScope(resourceType, resourceCol, SessionUtils.getUserId(), List.of(id))) {
throw new MSException(Translator.get("check_owner_case"));
}
}
if (v instanceof List<?> ids) {
// noinspection unchecked
if (!extCheckOwnerMapper.checkoutProjectOwnerByScope(resourceType, resourceCol, SessionUtils.getUserId(), (List<String>) ids)) {
throw new MSException(Translator.get("check_owner_case"));
}
}
}
}

1
frontend/src/views/bug-management/components/bugCaseTab.vue
View File

@ -301,6 +301,7 @@
}
onMounted(async () => {
getEnabledModules();
getFetch();
});

6
frontend/src/views/bug-management/locale/en-US.ts
View File

@ -25,7 +25,7 @@ export default {
syncBugTipRowTwo: 'Create bug and sync bug？',
bugAutoSync: 'System will auto sync by the project application setting frequency',
syncTime: 'Sync time',
deleteLabel: 'Bug witch created by MeterSphere will in recycle bin and third plant bug will be deleted',
deleteLabel: 'Local bug will in recycle bin and third plant bug will be deleted',
nameIsIncorrect: 'Bug name error',
selectedCount: '( {count} selected)',
batchEdit: 'Batch edit',
@ -35,7 +35,7 @@ export default {
deleteCount: 'delete {count} bugs？',
deleteTipInternal: ' {count} numbers of bug witch created by MeterSphere will in recycle bin',
deleteTipExternal: '{count} numbers of bug will be deleted',
deleteTip: 'Bug witch created by MeterSphere will in recycle bin and third plant bug will be deleted',
deleteTip: 'Local bug will in recycle bin and third plant bug will be deleted',
edit: {
defaultSystemTemplate: 'System template is defaulted',
content: 'Bug content',
@ -80,7 +80,7 @@ export default {
comment: 'Comment',
shareTip: 'Share link has been copied to clipboard',
deleteTitle: 'Delete {name} ？',
deleteContent: 'Bug witch created by MeterSphere will in recycle bin and third plant bug will be deleted',
deleteContent: 'Local bug will in recycle bin and third plant bug will be deleted',
platform_no_active: 'The bug platform has not been integrated, can not preview and edit details normally',
},
batchUpdate: {

6
frontend/src/views/bug-management/locale/zh-CN.ts
View File

@ -25,7 +25,7 @@ export default {
syncBugTipRowTwo: '新增缺陷和更新已有的缺陷？',
bugAutoSync: '系统将按照项目应用设置频率自动同步',
syncTime: '同步时间',
deleteLabel: '删除后，MeterSphere 创建的缺陷进入回收站；第三方平台同步的缺陷将不做回收',
deleteLabel: '删除后, Local 的缺陷进入回收站; 第三方平台同步的缺陷将不做回收',
nameIsIncorrect: '缺陷名称不正确',
selectedCount: '(已选 {count} 条缺陷)',
batchEdit: '批量编辑',
@ -35,7 +35,7 @@ export default {
deleteCount: '确认删除 {count} 个缺陷吗？',
deleteTipInternal: '删除后，{count} 条 MeterSphere 创建的缺陷进入回收站',
deleteTipExternal: '{count} 条第三方平台同步的缺陷将不做回收',
deleteTip: '删除后，MeterSphere 创建的缺陷进入回收站；第三方平台同步的缺陷将不做回收',
deleteTip: '删除后, Local 的缺陷进入回收站; 第三方平台同步的缺陷将不做回收',
edit: {
defaultSystemTemplate: '默认为系统模板',
content: '缺陷内容',
@ -80,7 +80,7 @@ export default {
comment: '评论',
shareTip: '分享链接已复制到剪贴板',
deleteTitle: '确认删除 {name} 吗？',
deleteContent: '删除后，MeterSphere 创建的缺陷进入回收站；第三方平台同步的缺陷将不做回收',
deleteContent: '删除后, Local 的缺陷进入回收站; 第三方平台同步的缺陷将不做回收',
platform_no_active: '该缺陷平台未对接, 无法正常预览及编辑详情相关内容',
},
batchUpdate: {

6
frontend/src/views/project-management/projectAndPermission/menuManagement/menuManagement.vue
View File

@ -268,7 +268,7 @@
v-model="allValueMap['BUG_SYNC_SYNC_ENABLE']"
checked-value="true"
unchecked-value="false"
:disabled="!hasAnyPermission(['PROJECT_APPLICATION_BUG:UPDATE'])"
:disabled="!hasAnyPermission(['PROJECT_APPLICATION_BUG:UPDATE']) || !allValueMap['BUG_SYNC_SYNC_ENABLE']"
:value="allValueMap['BUG_SYNC_SYNC_ENABLE']"
size="small"
type="line"
@ -302,7 +302,9 @@
<a-switch
checked-value="true"
unchecked-value="false"
:disabled="!hasAnyPermission(['PROJECT_APPLICATION_CASE:UPDATE'])"
:disabled="
!hasAnyPermission(['PROJECT_APPLICATION_CASE:UPDATE']) || !allValueMap['CASE_RELATED_CASE_ENABLE']
"
:value="allValueMap['CASE_RELATED_CASE_ENABLE']"
size="small"
type="line"