From 5f018be7bbfd24384b23085d1b467da561ec6fd4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E8=B5=B5=E5=BF=A0=E6=9E=97?= <170083662@qq.com> Date: Wed, 5 Aug 2026 19:06:27 +0800 Subject: [PATCH] =?UTF-8?q?feat(security):=20=E4=B8=BACMS=E7=9B=B8?= =?UTF-8?q?=E5=85=B3=E6=8E=A5=E5=8F=A3=E6=B7=BB=E5=8A=A0=E6=9D=83=E9=99=90?= =?UTF-8?q?=E6=8E=A7=E5=88=B6=E6=B3=A8=E8=A7=A3?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - 在CmsBannerController中新增@PreAuthorize注解，限制添加、修改、删除和状态更新接口权限 - 在CmsBannerGroupController中新增@PreAuthorize注解，控制轮播组及其项的增删改权限 - 在CmsCaseController中新增权限校验注解，保护客户案例的增删改及状态修改接口 - 在CmsPageController中为单页管理接口添加权限控制注解 - 在CmsProductController中增加@PreAuthorize注解，针对产品的添加、修改、删除和状态更新操作设置权限验证 - 统一引入org.springframework.security.access.prepost.PreAuthorize实现方法级安全控制 --- .../com/gxwebsoft/cms/controller/CmsBannerController.java | 5 +++++ .../cms/controller/CmsBannerGroupController.java | 8 ++++++++ .../com/gxwebsoft/cms/controller/CmsCaseController.java | 5 +++++ .../com/gxwebsoft/cms/controller/CmsPageController.java | 5 +++++ .../gxwebsoft/cms/controller/CmsProductController.java | 5 +++++ 5 files changed, 28 insertions(+) diff --git a/src/main/java/com/gxwebsoft/cms/controller/CmsBannerController.java b/src/main/java/com/gxwebsoft/cms/controller/CmsBannerController.java index d75424a..b48ac68 100644 --- a/src/main/java/com/gxwebsoft/cms/controller/CmsBannerController.java +++ b/src/main/java/com/gxwebsoft/cms/controller/CmsBannerController.java @@ -8,6 +8,7 @@ import com.gxwebsoft.common.core.web.BaseController; import com.gxwebsoft.common.core.web.PageResult; import io.swagger.v3.oas.annotations.Operation; import io.swagger.v3.oas.annotations.tags.Tag; +import org.springframework.security.access.prepost.PreAuthorize; import org.springframework.web.bind.annotation.*; import javax.annotation.Resource; @@ -46,6 +47,7 @@ public class CmsBannerController extends BaseController { } @Operation(summary = "添加轮播图") + @PreAuthorize("hasAuthority('cms:cmsBanner:save')") @PostMapping() public ApiResult save(@RequestBody CmsBanner cmsBanner) { if (cmsBannerService.save(cmsBanner)) { @@ -55,6 +57,7 @@ public class CmsBannerController extends BaseController { } @Operation(summary = "修改轮播图") + @PreAuthorize("hasAuthority('cms:cmsBanner:update')") @PutMapping() public ApiResult update(@RequestBody CmsBanner cmsBanner) { if (cmsBannerService.updateById(cmsBanner)) { @@ -64,6 +67,7 @@ public class CmsBannerController extends BaseController { } @Operation(summary = "删除轮播图") + @PreAuthorize("hasAuthority('cms:cmsBanner:remove')") @DeleteMapping("/{id}") public ApiResult remove(@PathVariable("id") Integer id) { if (cmsBannerService.removeById(id)) { @@ -73,6 +77,7 @@ public class CmsBannerController extends BaseController { } @Operation(summary = "修改轮播图状态(启用/停用)") + @PreAuthorize("hasAuthority('cms:cmsBanner:update')") @PutMapping("/status") public ApiResult updateStatus(@RequestBody CmsBanner cmsBanner) { CmsBanner entity = new CmsBanner(); diff --git a/src/main/java/com/gxwebsoft/cms/controller/CmsBannerGroupController.java b/src/main/java/com/gxwebsoft/cms/controller/CmsBannerGroupController.java index 6be1cc8..242c872 100644 --- a/src/main/java/com/gxwebsoft/cms/controller/CmsBannerGroupController.java +++ b/src/main/java/com/gxwebsoft/cms/controller/CmsBannerGroupController.java @@ -10,6 +10,7 @@ import com.gxwebsoft.common.core.web.BaseController; import com.gxwebsoft.common.core.web.PageResult; import io.swagger.v3.oas.annotations.Operation; import io.swagger.v3.oas.annotations.tags.Tag; +import org.springframework.security.access.prepost.PreAuthorize; import org.springframework.web.bind.annotation.*; import javax.annotation.Resource; @@ -55,6 +56,7 @@ public class CmsBannerGroupController extends BaseController { } @Operation(summary = "添加轮播组(可携带items一次性创建)") + @PreAuthorize("hasAuthority('cms:cmsBannerGroup:save')") @PostMapping() public ApiResult save(@RequestBody CmsBannerGroup group) { if (cmsBannerGroupService.saveGroup(group)) { @@ -64,6 +66,7 @@ public class CmsBannerGroupController extends BaseController { } @Operation(summary = "修改轮播组(可携带items一次性全量替换)") + @PreAuthorize("hasAuthority('cms:cmsBannerGroup:update')") @PutMapping() public ApiResult update(@RequestBody CmsBannerGroup group) { if (group.getGroupId() == null) { @@ -76,6 +79,7 @@ public class CmsBannerGroupController extends BaseController { } @Operation(summary = "删除轮播组(连带删除组内items)") + @PreAuthorize("hasAuthority('cms:cmsBannerGroup:remove')") @DeleteMapping("/{groupId}") public ApiResult remove(@PathVariable("groupId") Integer groupId) { if (cmsBannerGroupService.removeGroup(groupId)) { @@ -85,6 +89,7 @@ public class CmsBannerGroupController extends BaseController { } @Operation(summary = "修改轮播组状态(启用/停用)") + @PreAuthorize("hasAuthority('cms:cmsBannerGroup:update')") @PutMapping("/status") public ApiResult updateStatus(@RequestBody CmsBannerGroup group) { CmsBannerGroup entity = new CmsBannerGroup(); @@ -99,6 +104,7 @@ public class CmsBannerGroupController extends BaseController { // ---------------- 单项 CRUD（可选，保存组时已全量提交items，以下接口用于单独维护） ---------------- @Operation(summary = "单独新增轮播项") + @PreAuthorize("hasAuthority('cms:cmsBannerGroup:save')") @PostMapping("/{groupId}/item") public ApiResult addItem(@PathVariable("groupId") Integer groupId, @RequestBody CmsBannerItem item) { @@ -117,6 +123,7 @@ public class CmsBannerGroupController extends BaseController { } @Operation(summary = "单独修改轮播项") + @PreAuthorize("hasAuthority('cms:cmsBannerGroup:update')") @PutMapping("/item") public ApiResult updateItem(@RequestBody CmsBannerItem item) { if (item.getItemId() == null) { @@ -129,6 +136,7 @@ public class CmsBannerGroupController extends BaseController { } @Operation(summary = "单独删除轮播项") + @PreAuthorize("hasAuthority('cms:cmsBannerGroup:remove')") @DeleteMapping("/item/{itemId}") public ApiResult removeItem(@PathVariable("itemId") Integer itemId) { if (bannerItemDelete(itemId)) { diff --git a/src/main/java/com/gxwebsoft/cms/controller/CmsCaseController.java b/src/main/java/com/gxwebsoft/cms/controller/CmsCaseController.java index 8e2752e..9277a96 100644 --- a/src/main/java/com/gxwebsoft/cms/controller/CmsCaseController.java +++ b/src/main/java/com/gxwebsoft/cms/controller/CmsCaseController.java @@ -10,6 +10,7 @@ import com.gxwebsoft.common.core.web.PageResult; import com.gxwebsoft.common.system.entity.User; import io.swagger.v3.oas.annotations.Operation; import io.swagger.v3.oas.annotations.tags.Tag; +import org.springframework.security.access.prepost.PreAuthorize; import org.springframework.web.bind.annotation.*; import javax.annotation.Resource; @@ -48,6 +49,7 @@ public class CmsCaseController extends BaseController { } @Operation(summary = "添加客户案例") + @PreAuthorize("hasAuthority('cms:cmsCase:save')") @PostMapping() public ApiResult save(@RequestBody CmsCase cmsCase) { if (cmsCaseService.save(cmsCase)) { @@ -57,6 +59,7 @@ public class CmsCaseController extends BaseController { } @Operation(summary = "修改客户案例") + @PreAuthorize("hasAuthority('cms:cmsCase:update')") @PutMapping() public ApiResult update(@RequestBody CmsCase cmsCase) { if (cmsCaseService.updateById(cmsCase)) { @@ -66,6 +69,7 @@ public class CmsCaseController extends BaseController { } @Operation(summary = "删除客户案例") + @PreAuthorize("hasAuthority('cms:cmsCase:remove')") @DeleteMapping("/{id}") public ApiResult remove(@PathVariable("id") Integer id) { if (cmsCaseService.removeById(id)) { @@ -75,6 +79,7 @@ public class CmsCaseController extends BaseController { } @Operation(summary = "修改案例状态(发布/下线)") + @PreAuthorize("hasAuthority('cms:cmsCase:update')") @PutMapping("/status") public ApiResult updateStatus(@RequestBody CmsCase cmsCase) { CmsCase entity = new CmsCase(); diff --git a/src/main/java/com/gxwebsoft/cms/controller/CmsPageController.java b/src/main/java/com/gxwebsoft/cms/controller/CmsPageController.java index 59ae631..f304914 100644 --- a/src/main/java/com/gxwebsoft/cms/controller/CmsPageController.java +++ b/src/main/java/com/gxwebsoft/cms/controller/CmsPageController.java @@ -11,6 +11,7 @@ import com.gxwebsoft.common.core.web.ApiResult; import com.gxwebsoft.common.core.web.PageResult; import io.swagger.v3.oas.annotations.Operation; import io.swagger.v3.oas.annotations.tags.Tag; +import org.springframework.security.access.prepost.PreAuthorize; import org.springframework.web.bind.annotation.*; import javax.annotation.Resource; @@ -62,6 +63,7 @@ public class CmsPageController extends BaseController { } @Operation(summary = "添加单页") + @PreAuthorize("hasAuthority('cms:cmsPage:save')") @PostMapping() public ApiResult save(@RequestBody CmsPage page) { User loginUser = getLoginUser(); @@ -83,6 +85,7 @@ public class CmsPageController extends BaseController { } @Operation(summary = "修改单页") + @PreAuthorize("hasAuthority('cms:cmsPage:update')") @PutMapping() public ApiResult update(@RequestBody CmsPage page) { if (page.getPageId() == null) { @@ -98,6 +101,7 @@ public class CmsPageController extends BaseController { } @Operation(summary = "删除单页") + @PreAuthorize("hasAuthority('cms:cmsPage:remove')") @DeleteMapping("/{id}") public ApiResult remove(@PathVariable("id") Integer id) { if (cmsPageService.removeById(id)) { @@ -107,6 +111,7 @@ public class CmsPageController extends BaseController { } @Operation(summary = "修改单页状态(草稿/发布/下线)") + @PreAuthorize("hasAuthority('cms:cmsPage:update')") @PutMapping("/status") public ApiResult updateStatus(@RequestBody Map body) { Object idObj = body.get("pageId"); diff --git a/src/main/java/com/gxwebsoft/cms/controller/CmsProductController.java b/src/main/java/com/gxwebsoft/cms/controller/CmsProductController.java index 1992d85..3860500 100644 --- a/src/main/java/com/gxwebsoft/cms/controller/CmsProductController.java +++ b/src/main/java/com/gxwebsoft/cms/controller/CmsProductController.java @@ -9,6 +9,7 @@ import com.gxwebsoft.common.core.web.PageResult; import com.gxwebsoft.common.system.entity.User; import io.swagger.v3.oas.annotations.Operation; import io.swagger.v3.oas.annotations.tags.Tag; +import org.springframework.security.access.prepost.PreAuthorize; import org.springframework.web.bind.annotation.*; import javax.annotation.Resource; @@ -47,6 +48,7 @@ public class CmsProductController extends BaseController { } @Operation(summary = "添加产品") + @PreAuthorize("hasAuthority('cms:cmsProduct:save')") @PostMapping() public ApiResult save(@RequestBody CmsProduct cmsProduct) { User loginUser = getLoginUser(); @@ -60,6 +62,7 @@ public class CmsProductController extends BaseController { } @Operation(summary = "修改产品") + @PreAuthorize("hasAuthority('cms:cmsProduct:update')") @PutMapping() public ApiResult update(@RequestBody CmsProduct cmsProduct) { if (cmsProductService.updateById(cmsProduct)) { @@ -69,6 +72,7 @@ public class CmsProductController extends BaseController { } @Operation(summary = "删除产品") + @PreAuthorize("hasAuthority('cms:cmsProduct:remove')") @DeleteMapping("/{id}") public ApiResult remove(@PathVariable("id") Integer id) { if (cmsProductService.removeById(id)) { @@ -78,6 +82,7 @@ public class CmsProductController extends BaseController { } @Operation(summary = "修改产品状态(在售/下架)") + @PreAuthorize("hasAuthority('cms:cmsProduct:update')") @PutMapping("/status") public ApiResult updateStatus(@RequestBody CmsProduct cmsProduct) { CmsProduct entity = new CmsProduct();