public/RuoYi-Vue-Plus
1
0
Fork 0
mirror of https://gitee.com/dromara/RuoYi-Vue-Plus.git synced 2026-03-19 03:58:50 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix 修复 CVE-2026-2819 工作流接口通过业务id可以越级删除问题

Browse Source
This commit is contained in:
疯狂的狮子Li
2026-03-18 11:35:51 +08:00
parent 0dd3b8dc51
commit 334c85ed61
1 changed files with 21 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
ruoyi-modules/ruoyi-workflow/src/main/java/org/dromara/workflow/service/impl/FlwInstanceServiceImpl.java
View File

@@ -193,6 +193,13 @@ public class FlwInstanceServiceImpl implements IFlwInstanceService {
log.warn("未找到对应的流程实例信息，无法执行删除操作。");
return false;
}
String userId = LoginHelper.getUserIdStr();
for (FlowInstance instance : flowInstances) {
if (LoginHelper.isSuperAdmin() || instance.getCreateBy().equals(userId)) {
continue;
}
throw new ServiceException("权限不足，无法删除流程实例信息!");
}
return insService.remove(StreamUtils.toList(flowInstances, FlowInstance::getId));
}
@@ -210,6 +217,13 @@ public class FlwInstanceServiceImpl implements IFlwInstanceService {
log.warn("未找到对应的流程实例信息，无法执行删除操作。");
return false;
}
String userId = LoginHelper.getUserIdStr();
for (Instance instance : instances) {
if (LoginHelper.isSuperAdmin() || instance.getCreateBy().equals(userId)) {
continue;
}
throw new ServiceException("权限不足，无法删除流程实例信息!");
}
// 获取定义信息
Map<Long, Definition> definitionMap = StreamUtils.toMap(
defService.getByIds(StreamUtils.toList(instances, Instance::getDefinitionId)),
@@ -244,6 +258,13 @@ public class FlwInstanceServiceImpl implements IFlwInstanceService {
log.warn("未找到对应的流程实例信息，无法执行删除操作。");
return false;
}
String userId = LoginHelper.getUserIdStr();
for (Instance instance : instances) {
if (LoginHelper.isSuperAdmin() || instance.getCreateBy().equals(userId)) {
continue;
}
throw new ServiceException("权限不足，无法删除流程实例信息!");
}
// 获取定义信息
Map<Long, Definition> definitionMap = StreamUtils.toMap(
defService.getByIds(StreamUtils.toList(instances, Instance::getDefinitionId)),