admin/prop-ai-hr
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(aihr): protect mobile practice audio

Browse Source
This commit is contained in:
admin
2026-07-14 10:36:32 +08:00
parent cc93bc3b50
commit 9810c9253c
4 changed files with 13 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrMobileController.java
+10
View File
@@ -158,6 +158,16 @@ public class AihrMobileController {
response.sendError(HttpServletResponse.SC_FORBIDDEN, "无权访问该录音");
return;
}
if (UserType.SYS_USER.getUserType().equals(loginUser.getUserType())
&& !StpUtil.hasRoleOr(TenantConstants.SUPER_ADMIN_ROLE_KEY, "hr_operator")) {
response.sendError(HttpServletResponse.SC_FORBIDDEN, "无权访问该录音");
return;
}
if (!UserType.APP_USER.getUserType().equals(loginUser.getUserType())
&& !UserType.SYS_USER.getUserType().equals(loginUser.getUserType())) {
response.sendError(HttpServletResponse.SC_FORBIDDEN, "无权访问该录音");
return;
}
ossService.download(ossId, response);
}
backend/ruoyi-modules/ruoyi-aihr/src/test/java/org/dromara/aihr/service/AihrPracticeSeedServiceTest.java
+1
View File
@@ -421,6 +421,7 @@ public class AihrPracticeSeedServiceTest {
assertTrue(controllerSource.contains("private static boolean supervisorRoleRequested(String role)"));
assertTrue(controllerSource.contains("UserType.SYS_USER.getUserType().equals(loginUser.getUserType())"));
assertTrue(controllerSource.contains("StpUtil.hasRoleOr(TenantConstants.SUPER_ADMIN_ROLE_KEY, \"hr_operator\")"));
assertTrue(controllerSource.contains("response.sendError(HttpServletResponse.SC_FORBIDDEN, \"无权访问该录音\")"));
assertFalse(controllerSource.contains("private static String supervisorScopeExtPartyId()"));
assertFalse(controllerSource.contains("supervisor H5 keeps team-scope"));
}