部分代码审计

yudao-module-system/yudao-module-system-api/src/main/java/cn/iocoder/yudao/module/system/enums/ErrorCodeConstants.java

@@ -56,6 +56,10 @@ public interface ErrorCodeConstants {
     ErrorCode DEPT_NOT_ENABLE = new ErrorCode(1_002_004_006, "部门({})不处于开启状态，不允许选择");
     ErrorCode DEPT_PARENT_IS_CHILD = new ErrorCode(1_002_004_007, "不能设置自己的子部门为父部门");
 
+    ErrorCode DEPT_PHONE_FOUND = new ErrorCode(1_002_004_008, "当前联系电话已经存在");
+
+    ErrorCode DEPT_EMAIL_FOUND = new ErrorCode(1_002_004_009, "当前邮箱已经存在");
+
     // ========== 岗位模块 1-002-005-000 ==========
     ErrorCode POST_NOT_FOUND = new ErrorCode(1_002_005_000, "当前岗位不存在");
     ErrorCode POST_NOT_ENABLE = new ErrorCode(1_002_005_001, "岗位({}) 不处于开启状态，不允许选择");

yudao-module-system/yudao-module-system-biz/src/main/java/cn/iocoder/yudao/module/system/controller/admin/dept/DeptController.java

@@ -35,6 +35,7 @@ import java.util.Objects;
 import java.util.stream.Collectors;
 
 import static cn.iocoder.yudao.framework.common.pojo.CommonResult.success;
+import static cn.iocoder.yudao.framework.common.util.collection.CollectionUtils.convertList;
 
 @Tag(name = "管理后台 - 部门")
 @RestController
@@ -54,9 +55,11 @@ public class DeptController {
     @PreAuthorize("@ss.hasPermission('system:dept:create')")
     public CommonResult<Long> createDept(@Valid @RequestBody DeptSaveReqVO createReqVO) {
         Long deptId = deptService.createDept(createReqVO);
+
         if(createReqVO.getLeaderUserId() == null){
             return success(deptId);
         }
+        // 重读插入了
         if (!createReqVO.getLeaderUserId().equals("") && !createReqVO.getLeaderUserId().isEmpty()) {
             for (Long teacherId : createReqVO.getLeaderUserId()) {//设置负责人的工作间
                 AdminUserDO teacher = adminUserService.getUser(teacherId);
@@ -71,29 +74,36 @@ public class DeptController {
     @Operation(summary = "更新部门")
     @PreAuthorize("@ss.hasPermission('system:dept:update')")
     public CommonResult<Boolean> updateDept(@Valid @RequestBody DeptSaveReqVO updateReqVO) {
-        deptService.updateDept(updateReqVO);
         DeptDO originDept =deptService.getDept(updateReqVO.getId());
+        deptService.updateDept(updateReqVO);
         DeptSaveReqVO originNewDept = BeanUtils.toBean(originDept, DeptSaveReqVO.class);
-        List<Long>originLeaderList =originNewDept.getLeaderUserId();
-        if (originLeaderList!=null){
-            for (Long teacherId : updateReqVO.getLeaderUserId()) {//负责人的工作间
-                //给教师删除所有的dept
-                AdminUserDO teacher = adminUserService.getUser(teacherId);
-                //TODO设置成测绘学院(默认)
-                 teacher.setDeptId(0L);
-                adminUserService.updateUser(BeanUtils.toBean(teacher, UserSaveReqVO.class));
+        List<Long> originLeaderList = originNewDept.getLeaderUserId();
+        List<Long> newLeaderList =  updateReqVO.getLeaderUserId();
+
+        if(newLeaderList == null || newLeaderList.isEmpty()){
+            List<AdminUserDO> teachers = adminUserService.getUserList(newLeaderList);
+            for (AdminUserDO teacher : teachers) {//负责人的工作间
+                    teacher.setDeptId(0L);
+                    adminUserService.updateUser(BeanUtils.toBean(teacher, UserSaveReqVO.class));
             }
-        }
-        if(updateReqVO.getLeaderUserId() == null){
             return success(true);
         }
-        if (!updateReqVO.getLeaderUserId().equals("") && !updateReqVO.getLeaderUserId().isEmpty()) {
-            for (Long teacherId : updateReqVO.getLeaderUserId()) {//负责人的工作间
-                //添加
-                AdminUserDO teacher = adminUserService.getUser(teacherId);
+        // 新的负责人为空时，直接清空 ，如果不为空，则与原先有三种情况，增、减、同
+        if (originLeaderList != null ){
+            for (Long teacherId : originLeaderList) {//负责人的工作间
+                if(!newLeaderList.contains(teacherId)){
+                    //给教师删除所有的dept
+                    AdminUserDO teacher = adminUserService.getUser(teacherId);
+                    //TODO设置成测绘学院(默认)
+                    teacher.setDeptId(0L);
+                    adminUserService.updateUser(BeanUtils.toBean(teacher, UserSaveReqVO.class));
+                }
+                newLeaderList.remove(teacherId);
+            }
+            List<AdminUserDO> teachers = adminUserService.getUserList(newLeaderList);
+            for (AdminUserDO teacher : teachers) {//负责人的工作间
                 teacher.setDeptId(updateReqVO.getId());
                 adminUserService.updateUser(BeanUtils.toBean(teacher, UserSaveReqVO.class));
-
             }
         }
         return success(true);

yudao-module-system/yudao-module-system-biz/src/main/java/cn/iocoder/yudao/module/system/service/dept/DeptServiceImpl.java

@@ -5,6 +5,7 @@ import cn.hutool.core.util.ObjectUtil;
 import cn.iocoder.yudao.framework.common.enums.CommonStatusEnum;
 import cn.iocoder.yudao.framework.common.util.object.BeanUtils;
 import cn.iocoder.yudao.framework.datapermission.core.annotation.DataPermission;
+import cn.iocoder.yudao.framework.mybatis.core.query.LambdaQueryWrapperX;
 import cn.iocoder.yudao.module.system.controller.admin.dept.vo.dept.DeptListReqVO;
 import cn.iocoder.yudao.module.system.controller.admin.dept.vo.dept.DeptSaveReqVO;
 import cn.iocoder.yudao.module.system.dal.dataobject.dept.DeptDO;
@@ -49,6 +50,9 @@ public class DeptServiceImpl implements DeptService {
         // 校验部门名的唯一性
         validateDeptNameUnique(null, createReqVO.getParentId(), createReqVO.getName());
 
+        // 校验联系电话和邮箱
+        validateDeptEmailExists(createReqVO.getEmail());
+        validateDeptPhoneExists(createReqVO.getPhone());
         // 插入部门
         DeptDO dept = BeanUtils.toBean(createReqVO, DeptDO.class);
         deptMapper.insert(dept);
@@ -64,11 +68,26 @@ public class DeptServiceImpl implements DeptService {
         }
         // 校验自己存在
         validateDeptExists(updateReqVO.getId());
+
+        if (updateReqVO.getId() == null) {
+            return;
+        }
+        DeptDO dept = deptMapper.selectById(updateReqVO.getId());
+        if (dept == null) {
+            throw exception(DEPT_NOT_FOUND);
+        }
+
         // 校验父部门的有效性
 //        validateParentDept(updateReqVO.getId(), updateReqVO.getParentId());
         // 校验部门名的唯一性
 //        validateDeptNameUnique(updateReqVO.getId(), updateReqVO.getParentId(), updateReqVO.getName());
-
+        // 校验联系电话和邮箱
+        if(!dept.getEmail().equals(updateReqVO.getEmail())){
+            validateDeptEmailExists(updateReqVO.getEmail());
+        }
+        if(!dept.getPhone().equals(updateReqVO.getPhone())){
+            validateDeptPhoneExists(updateReqVO.getPhone());
+        }
         // 更新部门
         DeptDO updateObj = BeanUtils.toBean(updateReqVO, DeptDO.class);
         deptMapper.updateById(updateObj);
@@ -88,6 +107,30 @@ public class DeptServiceImpl implements DeptService {
         deptMapper.deleteById(id);
     }
 
+    @VisibleForTesting
+    void validateDeptPhoneExists(String phone) {
+        if (phone == null) {
+            return;
+        }
+        DeptDO dept = deptMapper.selectOne(
+                new LambdaQueryWrapperX<DeptDO>().eq(DeptDO::getPhone, phone)
+        );
+        if (dept != null) {
+            throw exception(DEPT_PHONE_FOUND);
+        }
+    }
+    @VisibleForTesting
+    void validateDeptEmailExists(String email) {
+        if (email == null) {
+            return;
+        }
+        DeptDO dept = deptMapper.selectOne(
+                new LambdaQueryWrapperX<DeptDO>().eq(DeptDO::getEmail, email)
+        );
+        if (dept != null) {
+            throw exception(DEPT_EMAIL_FOUND);
+        }
+    }
     @VisibleForTesting
     void validateDeptExists(Long id) {
         if (id == null) {
@@ -205,6 +248,9 @@ public class DeptServiceImpl implements DeptService {
         Map<Long, DeptDO> deptMap = getDeptMap(ids);
         // 校验
         ids.forEach(id -> {
+            if(id == 0L){
+                return;
+            }
             DeptDO dept = deptMap.get(id);
             if (dept == null) {
                 throw exception(DEPT_NOT_FOUND);

yudao-module-system/yudao-module-system-biz/src/main/java/cn/iocoder/yudao/module/system/service/user/AdminUserServiceImpl.java

@@ -146,11 +146,14 @@ public class AdminUserServiceImpl implements AdminUserService {
         // 2.1 更新用户
         AdminUserDO updateObj = BeanUtils.toBean(updateReqVO, AdminUserDO.class);
         if ("3".equals(updateReqVO.getUserType())){//是导师直接添加为负责人
-            // TODO 删除原部门负责人,,,有问题，多个里面删不了，单独的可以
+
             //获取原来的工作间删除负责人
             AdminUserDO user = getUser(updateObj.getId());
+
             DeptDO originDept = deptService.getDept(user.getDeptId());
+
             DeptSaveReqVO originNewDept = BeanUtils.toBean(originDept, DeptSaveReqVO.class);
+
             if (originDept!=null) {
                 List<Long> originLeaderIdList = originNewDept.getLeaderUserId();
                 if (originLeaderIdList == null) {
@@ -167,8 +170,12 @@ public class AdminUserServiceImpl implements AdminUserService {
             List<Long> leaderIdList = newDept.getLeaderUserId();
             if (leaderIdList == null) {
                 leaderIdList = new ArrayList<>();
+                leaderIdList.add(updateReqVO.getId());
+            }else{
+                if(!leaderIdList.contains(updateReqVO.getId())){
+                    leaderIdList.add(updateReqVO.getId());
+                }
             }
-            leaderIdList.add(updateObj.getId());
             newDept.setLeaderUserId(leaderIdList);
             deptService.updateDept(newDept);
         }