Browse Source

perf: 优化部分ids进行字符串分割后的校验

master
insistence 1 year ago
parent
commit
bcf7467308
  1. 1
      ruoyi-fastapi-backend/module_admin/controller/dept_controller.py
  2. 1
      ruoyi-fastapi-backend/module_admin/controller/role_controller.py
  3. 9
      ruoyi-fastapi-backend/module_admin/controller/user_controller.py
  4. 4
      ruoyi-fastapi-backend/module_admin/service/role_service.py

1
ruoyi-fastapi-backend/module_admin/controller/dept_controller.py

@ -101,6 +101,7 @@ async def delete_system_dept(
data_scope_sql: str = Depends(GetDataScope('SysDept')),
):
dept_id_list = dept_ids.split(',')
if dept_id_list:
for dept_id in dept_id_list:
if not current_user.user.admin:
await DeptService.check_dept_data_scope_services(query_db, int(dept_id), data_scope_sql)

1
ruoyi-fastapi-backend/module_admin/controller/role_controller.py

@ -131,6 +131,7 @@ async def delete_system_role(
data_scope_sql: str = Depends(GetDataScope('SysDept')),
):
role_id_list = role_ids.split(',')
if role_id_list:
for role_id in role_id_list:
await RoleService.check_role_allowed_services(RoleModel(roleId=int(role_id)))
if not current_user.user.admin:

9
ruoyi-fastapi-backend/module_admin/controller/user_controller.py

@ -83,7 +83,9 @@ async def add_system_user(
):
if not current_user.user.admin:
await DeptService.check_dept_data_scope_services(query_db, add_user.dept_id, dept_data_scope_sql)
await RoleService.check_role_data_scope_services(query_db, ','.join([str(item) for item in add_user.role_ids]), role_data_scope_sql)
await RoleService.check_role_data_scope_services(
query_db, ','.join([str(item) for item in add_user.role_ids]), role_data_scope_sql
)
add_user.password = PwdUtil.get_password_hash(add_user.password)
add_user.create_by = current_user.user.user_name
add_user.create_time = datetime.now()
@ -111,7 +113,9 @@ async def edit_system_user(
if not current_user.user.admin:
await UserService.check_user_data_scope_services(query_db, edit_user.user_id, user_data_scope_sql)
await DeptService.check_dept_data_scope_services(query_db, edit_user.dept_id, dept_data_scope_sql)
await RoleService.check_role_data_scope_services(query_db, ','.join([str(item) for item in edit_user.role_ids]), role_data_scope_sql)
await RoleService.check_role_data_scope_services(
query_db, ','.join([str(item) for item in edit_user.role_ids]), role_data_scope_sql
)
edit_user.update_by = current_user.user.user_name
edit_user.update_time = datetime.now()
edit_user_result = await UserService.edit_user_services(query_db, edit_user)
@ -130,6 +134,7 @@ async def delete_system_user(
data_scope_sql: str = Depends(GetDataScope('SysUser')),
):
user_id_list = user_ids.split(',')
if user_id_list:
if current_user.user.user_id in user_id_list:
logger.warning('当前登录用户不能删除')

4
ruoyi-fastapi-backend/module_admin/service/role_service.py

@ -92,7 +92,9 @@ class RoleService:
:param data_scope_sql: 数据权限对应的查询sql语句
:return: 校验结果
"""
for role_id in role_ids.split(','):
role_id_list = role_ids.split(',')
if role_id_list:
for role_id in role_id_list:
roles = await RoleDao.get_role_list(
query_db, RolePageQueryModel(roleId=int(role_id)), data_scope_sql, is_page=False
)

Loading…
Cancel
Save