“wuzhen”andCursor
da8d332fac
关闭工作流 SpEL 命令执行与社团活动 SQL 注入，补齐越权、调试接口、登录喷洒和异常回显等问题；学生密码改为随机临时密码，Web/移动端支持复制。 Constraint: 流程发起/办理接口保持仅登录校验，避免影响请假审批 Rejected: 开启验证码 | Web/移动端登录页均未实现，开启会导致无法登录 Confidence: high Scope-risk: broad Not-tested: 生产环境与社团社长/指导老师视角 Co-authored-by: Cursor <cursoragent@cursor.com>
52 lines
2.6 KiB
SQL
52 lines
2.6 KiB
SQL
-- =============================================================================
|
|
-- 工作流管理类接口权限按钮（安全整改：流程定义/实例/全部待办接口原先仅校验登录）
|
|
-- 日期：2026-10-26
|
|
-- 挂载菜单：流程定义(11620)、流程实例(11621)、待办任务(11631)
|
|
-- 授权方式：给已拥有对应菜单的角色补授权，不改变现有可见范围
|
|
-- 执行后需要相关用户重新登录（或清理 Redis 中的登录缓存）权限才会生效
|
|
-- 执行：开发/生产库均可幂等执行
|
|
-- =============================================================================
|
|
|
|
INSERT INTO `sys_menu` (
|
|
`menu_id`, `menu_name`, `parent_id`, `order_num`, `path`, `component`, `query_param`,
|
|
`is_frame`, `is_cache`, `menu_type`, `visible`, `status`, `perms`, `icon`,
|
|
`create_dept`, `create_by`, `create_time`, `remark`
|
|
)
|
|
SELECT t.menu_id, t.menu_name, t.parent_id, t.order_num, '#', '', NULL,
|
|
1, 0, 'F', '0', '0', t.perms, '#', 103, 1, NOW(), t.remark
|
|
FROM (
|
|
SELECT 2026102620000000101 AS menu_id, '流程定义查询' AS menu_name, 11620 AS parent_id, 1 AS order_num,
|
|
'workflow:definition:list' AS perms, '流程定义列表/详情/设计器读取' AS remark
|
|
UNION ALL
|
|
SELECT 2026102620000000102, '流程定义维护', 11620, 2,
|
|
'workflow:definition:edit', '流程定义新增/修改/发布/导入/删除/设计器保存'
|
|
UNION ALL
|
|
SELECT 2026102620000000103, '流程实例管理', 11621, 1,
|
|
'workflow:instance:manage', '全部实例查询/作废/挂起/变量/删除他人实例/撤销他人流程'
|
|
UNION ALL
|
|
SELECT 2026102620000000104, '全部待办管理', 11631, 1,
|
|
'workflow:task:manage', '全部待办/已办查询与修改办理人'
|
|
) t
|
|
WHERE NOT EXISTS (SELECT 1 FROM `sys_menu` m WHERE m.menu_id = t.menu_id);
|
|
|
|
INSERT INTO `sys_role_menu` (`role_id`, `menu_id`)
|
|
SELECT DISTINCT rm.role_id, m.menu_id
|
|
FROM `sys_role_menu` rm
|
|
JOIN (
|
|
SELECT 11620 AS parent_id, 2026102620000000101 AS menu_id UNION ALL
|
|
SELECT 11620, 2026102620000000102 UNION ALL
|
|
SELECT 11621, 2026102620000000103 UNION ALL
|
|
SELECT 11631, 2026102620000000104
|
|
) m ON rm.menu_id = m.parent_id
|
|
WHERE NOT EXISTS (
|
|
SELECT 1 FROM `sys_role_menu` x WHERE x.role_id = rm.role_id AND x.menu_id = m.menu_id
|
|
);
|
|
|
|
-- 核对：哪些角色拿到了工作流管理权限（应只有管理员类角色）
|
|
SELECT r.role_id, r.role_key, r.role_name, m.perms
|
|
FROM sys_role_menu rm
|
|
JOIN sys_role r ON r.role_id = rm.role_id
|
|
JOIN sys_menu m ON m.menu_id = rm.menu_id
|
|
WHERE m.menu_id BETWEEN 2026102620000000101 AND 2026102620000000104
|
|
ORDER BY r.role_id, m.perms;
|