gz
/
channel-backend
6
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix 修复 CVE-2026-2819 工作流接口通过业务id可以越级删除问题

This commit is contained in:
疯狂的狮子Li 2026-03-18 11:35:51 +08:00
parent 0dd3b8dc51
commit 334c85ed61
1 changed files with 21 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
ruoyi-modules/ruoyi-workflow/src/main/java/org/dromara/workflow/service/impl/FlwInstanceServiceImpl.java
View File

@ -193,6 +193,13 @@ public class FlwInstanceServiceImpl implements IFlwInstanceService {
log.warn("未找到对应的流程实例信息，无法执行删除操作。"); log.warn("未找到对应的流程实例信息，无法执行删除操作。");
return false; return false;
} }
String userId = LoginHelper.getUserIdStr();
for (FlowInstance instance : flowInstances) {
if (LoginHelper.isSuperAdmin() || instance.getCreateBy().equals(userId)) {
continue;
}
throw new ServiceException("权限不足，无法删除流程实例信息!");
}
return insService.remove(StreamUtils.toList(flowInstances, FlowInstance::getId)); return insService.remove(StreamUtils.toList(flowInstances, FlowInstance::getId));
} }
@ -210,6 +217,13 @@ public class FlwInstanceServiceImpl implements IFlwInstanceService {
log.warn("未找到对应的流程实例信息，无法执行删除操作。"); log.warn("未找到对应的流程实例信息，无法执行删除操作。");
return false; return false;
} }
String userId = LoginHelper.getUserIdStr();
for (Instance instance : instances) {
if (LoginHelper.isSuperAdmin() || instance.getCreateBy().equals(userId)) {
continue;
}
throw new ServiceException("权限不足，无法删除流程实例信息!");
}
// 获取定义信息 // 获取定义信息
Map<Long, Definition> definitionMap = StreamUtils.toMap( Map<Long, Definition> definitionMap = StreamUtils.toMap(
defService.getByIds(StreamUtils.toList(instances, Instance::getDefinitionId)), defService.getByIds(StreamUtils.toList(instances, Instance::getDefinitionId)),
@ -244,6 +258,13 @@ public class FlwInstanceServiceImpl implements IFlwInstanceService {
log.warn("未找到对应的流程实例信息，无法执行删除操作。"); log.warn("未找到对应的流程实例信息，无法执行删除操作。");
return false; return false;
} }
String userId = LoginHelper.getUserIdStr();
for (Instance instance : instances) {
if (LoginHelper.isSuperAdmin() || instance.getCreateBy().equals(userId)) {
continue;
}
throw new ServiceException("权限不足，无法删除流程实例信息!");
}
// 获取定义信息 // 获取定义信息
Map<Long, Definition> definitionMap = StreamUtils.toMap( Map<Long, Definition> definitionMap = StreamUtils.toMap(
defService.getByIds(StreamUtils.toList(instances, Instance::getDefinitionId)), defService.getByIds(StreamUtils.toList(instances, Instance::getDefinitionId)),