Skip to content

Y
yd-backend
Commit 6e8c844f by hongzhong
Options

等保调整，增加部分接口鉴权，防止水平越权,团队成员明细查询优化

parent cc8065f3
Showing with 44 additions and 21 deletions
yd-api/src/main/java/com/yd/api/agms/service/impl/AgmsPractitionerServiceImpl.java
...@@ -50,7 +50,7 @@ public class AgmsPractitionerServiceImpl implements AgmsPractitionerService { ...@@ -50,7 +50,7 @@ public class AgmsPractitionerServiceImpl implements AgmsPractitionerService {
mdDropOptionIds=(Long[]) ConvertUtils.convert(requestVO.getMdDropOptionId().split(","),Long.class); mdDropOptionIds=(Long[]) ConvertUtils.convert(requestVO.getMdDropOptionId().split(","),Long.class);
} }
//等保调整 //等保调整
List<AclCustomer> findByObjSortable = aclPractitionerDALService.getAclCustomers(requestVO.getPractitionerId()); List<AclCustomer> findByObjSortable = aclPractitionerDALService.getAclCustomers(requestVO.getPractitionerId(),null);
if(null == findByObjSortable ){ if(null == findByObjSortable ){
responseVO.setCommonResult(new CommonResult(false,ZHBErrorConfig.getErrorInfo("630028"))); responseVO.setCommonResult(new CommonResult(false,ZHBErrorConfig.getErrorInfo("630028")));
return responseVO; return responseVO;
......
yd-api/src/main/java/com/yd/api/market/service/impl/MarketServiceImpl.java
...@@ -84,7 +84,7 @@ public class MarketServiceImpl implements MarketService { ...@@ -84,7 +84,7 @@ public class MarketServiceImpl implements MarketService {
PosterQueryResponseVO responseVO = new PosterQueryResponseVO(); PosterQueryResponseVO responseVO = new PosterQueryResponseVO();
Long practitionerId = requestVO.getPractitionerId(); Long practitionerId = requestVO.getPractitionerId();
//等保调整 //等保调整
List<AclCustomer> findByObjSortable = aclPractitionerDALService.getAclCustomers(practitionerId); List<AclCustomer> findByObjSortable = aclPractitionerDALService.getAclCustomers(practitionerId,null);
if(null == findByObjSortable ){ if(null == findByObjSortable ){
responseVO.setCommonResult(new CommonResult(false,ZHBErrorConfig.getErrorInfo("630028"))); responseVO.setCommonResult(new CommonResult(false,ZHBErrorConfig.getErrorInfo("630028")));
return responseVO; return responseVO;
......
yd-api/src/main/java/com/yd/api/practitioner/service/impl/PractitionerBasicInfoServiceImpl.java
...@@ -124,7 +124,7 @@ public class PractitionerBasicInfoServiceImpl implements PractitionerBasicInfoSe ...@@ -124,7 +124,7 @@ public class PractitionerBasicInfoServiceImpl implements PractitionerBasicInfoSe
if (practitionerId != null) { if (practitionerId != null) {
//等保调整 //等保调整
List<AclCustomer> findByObjSortable = aclPractitionerDALService.getAclCustomers(practitionerId); List<AclCustomer> findByObjSortable = aclPractitionerDALService.getAclCustomers(practitionerId,null);
if(null == findByObjSortable ){ if(null == findByObjSortable ){
responseVO.setCommonResult(new CommonResult(false,ZHBErrorConfig.getErrorInfo("630028"))); responseVO.setCommonResult(new CommonResult(false,ZHBErrorConfig.getErrorInfo("630028")));
return responseVO; return responseVO;
...@@ -388,7 +388,7 @@ public class PractitionerBasicInfoServiceImpl implements PractitionerBasicInfoSe ...@@ -388,7 +388,7 @@ public class PractitionerBasicInfoServiceImpl implements PractitionerBasicInfoSe
List<PayScaleInfo> resultList = new ArrayList<>(); List<PayScaleInfo> resultList = new ArrayList<>();
//等保调整 //等保调整
List<AclCustomer> findByObjSortable = aclPractitionerDALService.getAclCustomers(requestVO.getPractitionerId()); List<AclCustomer> findByObjSortable = aclPractitionerDALService.getAclCustomers(requestVO.getPractitionerId(),null);
if(null == findByObjSortable ){ if(null == findByObjSortable ){
responseVO.setCommonResult(new CommonResult(false,ZHBErrorConfig.getErrorInfo("630028"))); responseVO.setCommonResult(new CommonResult(false,ZHBErrorConfig.getErrorInfo("630028")));
return responseVO; return responseVO;
...@@ -776,7 +776,7 @@ public class PractitionerBasicInfoServiceImpl implements PractitionerBasicInfoSe ...@@ -776,7 +776,7 @@ public class PractitionerBasicInfoServiceImpl implements PractitionerBasicInfoSe
practitionerIdList = practitionerService.getPractitionerIdBySidList(requestVO.getSId(),systemType,1); practitionerIdList = practitionerService.getPractitionerIdBySidList(requestVO.getSId(),systemType,1);
}else{ }else{
//等保调整 //等保调整
List<AclCustomer> findByObjSortable = aclPractitionerDALService.getAclCustomers(practitionerId); List<AclCustomer> findByObjSortable = aclPractitionerDALService.getAclCustomers(practitionerId,1L);
if(null == findByObjSortable ){ if(null == findByObjSortable ){
resp.setCommonResult(new CommonResult(false,ZHBErrorConfig.getErrorInfo("630028"))); resp.setCommonResult(new CommonResult(false,ZHBErrorConfig.getErrorInfo("630028")));
return resp; return resp;
...@@ -937,7 +937,7 @@ public class PractitionerBasicInfoServiceImpl implements PractitionerBasicInfoSe ...@@ -937,7 +937,7 @@ public class PractitionerBasicInfoServiceImpl implements PractitionerBasicInfoSe
//等保调整 //等保调整
Long practitionerId = requestVO.getPractitionerId(); Long practitionerId = requestVO.getPractitionerId();
if (null != practitionerId) { if (null != practitionerId) {
List<AclCustomer> findByObjSortable = aclPractitionerDALService.getAclCustomers(practitionerId); List<AclCustomer> findByObjSortable = aclPractitionerDALService.getAclCustomers(practitionerId,null);
if(null == findByObjSortable ){ if(null == findByObjSortable ){
responseVO.setCommonResult(new CommonResult(false,ZHBErrorConfig.getErrorInfo("630028"))); responseVO.setCommonResult(new CommonResult(false,ZHBErrorConfig.getErrorInfo("630028")));
return responseVO; return responseVO;
...@@ -1075,7 +1075,7 @@ public class PractitionerBasicInfoServiceImpl implements PractitionerBasicInfoSe ...@@ -1075,7 +1075,7 @@ public class PractitionerBasicInfoServiceImpl implements PractitionerBasicInfoSe
return responseBody; return responseBody;
} }
//等保调整 //等保调整
List<AclCustomer> findByObjSortable = aclPractitionerDALService.getAclCustomers(requestVO.getPractitionerId()); List<AclCustomer> findByObjSortable = aclPractitionerDALService.getAclCustomers(requestVO.getPractitionerId(),null);
if(null == findByObjSortable ){ if(null == findByObjSortable ){
responseBody.setCommonResult(new CommonResult(false,ZHBErrorConfig.getErrorInfo("630028"))); responseBody.setCommonResult(new CommonResult(false,ZHBErrorConfig.getErrorInfo("630028")));
return responseBody; return responseBody;
......
yd-api/src/main/java/com/yd/api/practitioner/service/impl/PractitionerHiringServiceImpl.java
...@@ -421,7 +421,7 @@ public class PractitionerHiringServiceImpl implements PractitionerHiringService ...@@ -421,7 +421,7 @@ public class PractitionerHiringServiceImpl implements PractitionerHiringService
Long approvingStatus = requestVO.getApprovingStatus(); Long approvingStatus = requestVO.getApprovingStatus();
//等保调整 //等保调整
List<AclCustomer> findByObjSortable = aclPractitionerDALService.getAclCustomers(practitionerId); List<AclCustomer> findByObjSortable = aclPractitionerDALService.getAclCustomers(practitionerId,null);
if(null == findByObjSortable ){ if(null == findByObjSortable ){
responseVO.setCommonResult(new CommonResult(false,ZHBErrorConfig.getErrorInfo("630028"))); responseVO.setCommonResult(new CommonResult(false,ZHBErrorConfig.getErrorInfo("630028")));
return responseVO; return responseVO;
...@@ -850,7 +850,7 @@ public class PractitionerHiringServiceImpl implements PractitionerHiringService ...@@ -850,7 +850,7 @@ public class PractitionerHiringServiceImpl implements PractitionerHiringService
resp.setCommonResult(new CommonResult(false, "practitionerId不能为空")); resp.setCommonResult(new CommonResult(false, "practitionerId不能为空"));
} else { } else {
//等保调整 //等保调整
List<AclCustomer> findByObjSortable = aclPractitionerDALService.getAclCustomers(practitionerId); List<AclCustomer> findByObjSortable = aclPractitionerDALService.getAclCustomers(practitionerId,null);
if(null == findByObjSortable ){ if(null == findByObjSortable ){
resp.setCommonResult(new CommonResult(false,ZHBErrorConfig.getErrorInfo("630028"))); resp.setCommonResult(new CommonResult(false,ZHBErrorConfig.getErrorInfo("630028")));
return resp; return resp;
......
yd-api/src/main/java/com/yd/api/practitioner/service/impl/PractitionerServiceImpl.java
...@@ -617,7 +617,7 @@ public class PractitionerServiceImpl implements com.yd.api.practitioner.service. ...@@ -617,7 +617,7 @@ public class PractitionerServiceImpl implements com.yd.api.practitioner.service.
SettingQueryResponseVO responseVO = new SettingQueryResponseVO(); SettingQueryResponseVO responseVO = new SettingQueryResponseVO();
Long practitionerId = requestVO.getPractitionerId();//入参经纪人id Long practitionerId = requestVO.getPractitionerId();//入参经纪人id
//等保调整 //等保调整
List<AclCustomer> findByObjSortable = aclPractitionerDALService.getAclCustomers(practitionerId); List<AclCustomer> findByObjSortable = aclPractitionerDALService.getAclCustomers(practitionerId,null);
if(null == findByObjSortable ){ if(null == findByObjSortable ){
responseVO.setCommonResult(new CommonResult(false,ZHBErrorConfig.getErrorInfo("630028"))); responseVO.setCommonResult(new CommonResult(false,ZHBErrorConfig.getErrorInfo("630028")));
return responseVO; return responseVO;
...@@ -786,7 +786,7 @@ public class PractitionerServiceImpl implements com.yd.api.practitioner.service. ...@@ -786,7 +786,7 @@ public class PractitionerServiceImpl implements com.yd.api.practitioner.service.
OwnOpportunityQueryResponseVO responseVO = new OwnOpportunityQueryResponseVO(); OwnOpportunityQueryResponseVO responseVO = new OwnOpportunityQueryResponseVO();
Long practitionerId = requestVO.getPractitionerId(); Long practitionerId = requestVO.getPractitionerId();
//等保调整 //等保调整
List<AclCustomer> findByObjSortable = aclPractitionerDALService.getAclCustomers(practitionerId); List<AclCustomer> findByObjSortable = aclPractitionerDALService.getAclCustomers(practitionerId,null);
if(null == findByObjSortable ){ if(null == findByObjSortable ){
responseVO.setCommonResult(new CommonResult(false,ZHBErrorConfig.getErrorInfo("630028"))); responseVO.setCommonResult(new CommonResult(false,ZHBErrorConfig.getErrorInfo("630028")));
return responseVO; return responseVO;
...@@ -1364,7 +1364,7 @@ public class PractitionerServiceImpl implements com.yd.api.practitioner.service. ...@@ -1364,7 +1364,7 @@ public class PractitionerServiceImpl implements com.yd.api.practitioner.service.
Long practitionerId = requestVO.getPractitionerId(); Long practitionerId = requestVO.getPractitionerId();
if(practitionerId != null){ if(practitionerId != null){
//等保调整 //等保调整
List<AclCustomer> findByObjSortable = aclPractitionerDALService.getAclCustomers(practitionerId); List<AclCustomer> findByObjSortable = aclPractitionerDALService.getAclCustomers(practitionerId,null);
if(null == findByObjSortable ){ if(null == findByObjSortable ){
responseVO.setCommonResult(new CommonResult(false,ZHBErrorConfig.getErrorInfo("630028"))); responseVO.setCommonResult(new CommonResult(false,ZHBErrorConfig.getErrorInfo("630028")));
return responseVO; return responseVO;
...@@ -1895,7 +1895,7 @@ public class PractitionerServiceImpl implements com.yd.api.practitioner.service. ...@@ -1895,7 +1895,7 @@ public class PractitionerServiceImpl implements com.yd.api.practitioner.service.
//经纪人id //经纪人id
Long practitionerId = requestVO.getPractitionerId(); Long practitionerId = requestVO.getPractitionerId();
//等保调整 //等保调整
List<AclCustomer> findByObjSortable = aclPractitionerDALService.getAclCustomers(practitionerId); List<AclCustomer> findByObjSortable = aclPractitionerDALService.getAclCustomers(practitionerId,null);
if(null == findByObjSortable ){ if(null == findByObjSortable ){
responseVO.setCommonResult(new CommonResult(false,ZHBErrorConfig.getErrorInfo("630028"))); responseVO.setCommonResult(new CommonResult(false,ZHBErrorConfig.getErrorInfo("630028")));
return responseVO; return responseVO;
...@@ -2306,7 +2306,7 @@ public class PractitionerServiceImpl implements com.yd.api.practitioner.service. ...@@ -2306,7 +2306,7 @@ public class PractitionerServiceImpl implements com.yd.api.practitioner.service.
//通过团队长经纪人id,查询此团队所有经纪人id //通过团队长经纪人id,查询此团队所有经纪人id
Long practitionerId = requestVO.getPractitionerId(); Long practitionerId = requestVO.getPractitionerId();
//等保调整 //等保调整
List<AclCustomer> findByObjSortable = aclPractitionerDALService.getAclCustomers(practitionerId); List<AclCustomer> findByObjSortable = aclPractitionerDALService.getAclCustomers(practitionerId,null);
if(null == findByObjSortable ){ if(null == findByObjSortable ){
responseVO.setCommonResult(new CommonResult(false,ZHBErrorConfig.getErrorInfo("630028"))); responseVO.setCommonResult(new CommonResult(false,ZHBErrorConfig.getErrorInfo("630028")));
return responseVO; return responseVO;
...@@ -2720,7 +2720,7 @@ public class PractitionerServiceImpl implements com.yd.api.practitioner.service. ...@@ -2720,7 +2720,7 @@ public class PractitionerServiceImpl implements com.yd.api.practitioner.service.
Long practitionerId = requestVO.getPractitionerId(); Long practitionerId = requestVO.getPractitionerId();
if(practitionerId != null){ if(practitionerId != null){
//等保调整 //等保调整
List<AclCustomer> findByObjSortable = aclPractitionerDALService.getAclCustomers(practitionerId); List<AclCustomer> findByObjSortable = aclPractitionerDALService.getAclCustomers(practitionerId,null);
if(null == findByObjSortable ){ if(null == findByObjSortable ){
responseVO.setCommonResult(new CommonResult(false,ZHBErrorConfig.getErrorInfo("630028"))); responseVO.setCommonResult(new CommonResult(false,ZHBErrorConfig.getErrorInfo("630028")));
return responseVO; return responseVO;
......
yd-api/src/main/java/com/yd/api/practitioner/service/impl/ScheduleTrackServiceImpl.java
...@@ -212,7 +212,7 @@ public class ScheduleTrackServiceImpl implements ScheduleTrackService { ...@@ -212,7 +212,7 @@ public class ScheduleTrackServiceImpl implements ScheduleTrackService {
List<ScheduleTrackVO> showList = new ArrayList<>(); List<ScheduleTrackVO> showList = new ArrayList<>();
try { try {
//等保调整 //等保调整
List<AclCustomer> findByObjSortable = aclPractitionerDALService.getAclCustomers(practitionerId); List<AclCustomer> findByObjSortable = aclPractitionerDALService.getAclCustomers(practitionerId,null);
if(null == findByObjSortable ){ if(null == findByObjSortable ){
resp.setCommonResult(new CommonResult(false,ZHBErrorConfig.getErrorInfo("630028"))); resp.setCommonResult(new CommonResult(false,ZHBErrorConfig.getErrorInfo("630028")));
return resp; return resp;
...@@ -290,7 +290,7 @@ public class ScheduleTrackServiceImpl implements ScheduleTrackService { ...@@ -290,7 +290,7 @@ public class ScheduleTrackServiceImpl implements ScheduleTrackService {
Long practitionerId = requestVO.getPractitionerId(); Long practitionerId = requestVO.getPractitionerId();
try { try {
//等保调整 //等保调整
List<AclCustomer> findByObjSortable = aclPractitionerDALService.getAclCustomers(practitionerId); List<AclCustomer> findByObjSortable = aclPractitionerDALService.getAclCustomers(practitionerId,null);
if(null == findByObjSortable ){ if(null == findByObjSortable ){
resp.setCommonResult(new CommonResult(false,ZHBErrorConfig.getErrorInfo("630028"))); resp.setCommonResult(new CommonResult(false,ZHBErrorConfig.getErrorInfo("630028")));
return resp; return resp;
...@@ -394,7 +394,7 @@ public class ScheduleTrackServiceImpl implements ScheduleTrackService { ...@@ -394,7 +394,7 @@ public class ScheduleTrackServiceImpl implements ScheduleTrackService {
String time = requestVO.getTime(); String time = requestVO.getTime();
//等保调整 //等保调整
List<AclCustomer> findByObjSortable = aclPractitionerDALService.getAclCustomers(practitionerId); List<AclCustomer> findByObjSortable = aclPractitionerDALService.getAclCustomers(practitionerId,null);
if(null == findByObjSortable ){ if(null == findByObjSortable ){
resp.setCommonResult(new CommonResult(false,ZHBErrorConfig.getErrorInfo("630028"))); resp.setCommonResult(new CommonResult(false,ZHBErrorConfig.getErrorInfo("630028")));
return resp; return resp;
......
yd-api/src/main/java/com/yd/dal/service/customer/AclPractitionerDALService.java
...@@ -214,5 +214,5 @@ public interface AclPractitionerDALService { ...@@ -214,5 +214,5 @@ public interface AclPractitionerDALService {
/** /**
水平越权处理，从token中获取当前用户（手机号），然后根据客户id查看是否有权限，查不到数据则说明没有权限 水平越权处理，从token中获取当前用户（手机号），然后根据客户id查看是否有权限，查不到数据则说明没有权限
*/ */
List<AclCustomer> getAclCustomers(Long practitionerId); List<AclCustomer> getAclCustomers(Long practitionerId,Long flag);
} }
yd-api/src/main/java/com/yd/dal/service/customer/impl/AclPractitionerDALServiceImpl.java
package com.yd.dal.service.customer.impl; package com.yd.dal.service.customer.impl;
import com.google.common.base.Strings; import com.google.common.base.Strings;
import com.yd.api.practitioner.service.PractitionerService;
import com.yd.api.practitioner.vo.payscale.PayScaleInfo; import com.yd.api.practitioner.vo.payscale.PayScaleInfo;
import com.yd.api.practitioner.vo.subordinate.TeamMemberDetail; import com.yd.api.practitioner.vo.subordinate.TeamMemberDetail;
import com.yd.dal.entity.customer.AclCustomer; import com.yd.dal.entity.customer.AclCustomer;
...@@ -41,6 +42,10 @@ public class AclPractitionerDALServiceImpl implements AclPractitionerDALService ...@@ -41,6 +42,10 @@ public class AclPractitionerDALServiceImpl implements AclPractitionerDALService
private JwtTokenUtil jwtTokenUtil; private JwtTokenUtil jwtTokenUtil;
@Autowired @Autowired
private AclCustomerMapper aclCustomerMapper; private AclCustomerMapper aclCustomerMapper;
@Autowired
PractitionerService practitionerService;
@Autowired
private AclPractitionerDALService aclPractitionerDALService;
@Override @Override
public AclPractitioner findByCustomerIdIsActive(Long customerId, int isActive) { public AclPractitioner findByCustomerIdIsActive(Long customerId, int isActive) {
return aclPractitionerMapper.findByCustomerIdIsActive(customerId,isActive); return aclPractitionerMapper.findByCustomerIdIsActive(customerId,isActive);
...@@ -248,7 +253,7 @@ public class AclPractitionerDALServiceImpl implements AclPractitionerDALService ...@@ -248,7 +253,7 @@ public class AclPractitionerDALServiceImpl implements AclPractitionerDALService
} }
@Override @Override
public List<AclCustomer> getAclCustomers(Long practitionerId) { public List<AclCustomer> getAclCustomers(Long practitionerId,Long flag) {
RequestAttributes requestAttributes = RequestContextHolder.getRequestAttributes(); RequestAttributes requestAttributes = RequestContextHolder.getRequestAttributes();
HttpServletRequest request = (HttpServletRequest) requestAttributes.resolveReference(RequestAttributes.REFERENCE_REQUEST); HttpServletRequest request = (HttpServletRequest) requestAttributes.resolveReference(RequestAttributes.REFERENCE_REQUEST);
String userId = ""; String userId = "";
...@@ -270,8 +275,26 @@ public class AclPractitionerDALServiceImpl implements AclPractitionerDALService ...@@ -270,8 +275,26 @@ public class AclPractitionerDALServiceImpl implements AclPractitionerDALService
} }
AclPractitioner practitioner = aclPractitionerMapper.selectByPrimaryKey(practitionerId); AclPractitioner practitioner = aclPractitionerMapper.selectByPrimaryKey(practitionerId);
if(null != practitioner){ if(null != practitioner){
Long customerId = null;
//我的团队，特殊处理
if(null != flag){
AclPractitioner practitioner1 = aclPractitionerMapper.selectByMobileNo(userId);
List<AclPractitioner> practitionerList = aclPractitionerDALService.findByIds(practitionerService.getPractitionerIdList(practitioner1.getId(),null));
if(null != practitionerList && practitionerList.size() > 0){
for(AclPractitioner acl:practitionerList){
if(practitioner.getCustomerId().equals(acl.getCustomerId())){
customerId = acl.getCustomerId();
userId = practitioner.getMobileNo();
break;
}
}
}
}
if(null == customerId || null == flag){
customerId=practitioner.getCustomerId();
}
AclCustomer aclCustomer = new AclCustomer(); AclCustomer aclCustomer = new AclCustomer();
aclCustomer.setId(practitioner.getCustomerId()); aclCustomer.setId(customerId);
aclCustomer.setMobileNo(userId); aclCustomer.setMobileNo(userId);
List<AclCustomer> findByObjSortable = aclCustomerMapper.findByObj(aclCustomer); List<AclCustomer> findByObjSortable = aclCustomerMapper.findByObj(aclCustomer);
if(findByObjSortable == null || findByObjSortable.size() == 0){ if(findByObjSortable == null || findByObjSortable.size() == 0){
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment