部分代码审计

yudao-module-system/yudao-module-system-biz/src/main/java/cn/iocoder/yudao/module/system/controller/admin/dept/DeptController.java

@@ -256,8 +256,8 @@ public class DeptController {
         }
         // 获取部门信息
         DeptDO dept = deptService.getUserDept();
-        if (dept == null) {
-            return null;
+        if (dept == null || (deptId != null && deptId == 0)) {
+            return success(null);
         }
 
         DeptRespVO newDept = BeanUtils.toBean(dept, DeptRespVO.class);

yudao-module-system/yudao-module-system-biz/src/main/java/cn/iocoder/yudao/module/system/controller/admin/user/UserController.java

@@ -136,6 +136,7 @@ public class UserController {
                 });
             }
         }
+
         return success(true);
     }
 
@@ -192,6 +193,7 @@ public class UserController {
     @Operation(summary = "获得老师分页列表")
     @PreAuthorize("@ss.hasPermission('system:user:deptTeacherList')")
     public CommonResult<PageResult<UserRespVO>> getTeacherPageForTeacher(@Valid UserPageReqVO pageReqVO) {
+
         // 获得用户分页列表
         Long deptId =SecurityFrameworkUtils.getLoginUserDeptId();
         if (deptId!=null && deptId!=0) {

yudao-module-system/yudao-module-system-biz/src/main/java/cn/iocoder/yudao/module/system/dal/mysql/studentAttendance/StudentAttendanceMapper.java

@@ -92,8 +92,10 @@ public interface StudentAttendanceMapper extends BaseMapperX<StudentAttendanceDO
 
         if (roleIds != null && !roleIds.isEmpty()) {
             if (roleIds.contains(113L)) {//是教师 只出现在老师工作间下面的学生考勤情况
-                queryWrapper.eqIfPresent(StudentAttendanceDO::getDeptId, dept_id);
-
+                if(dept_id != null && dept_id != 0 ){
+                    queryWrapper.eqIfPresent(StudentAttendanceDO::getDeptId, dept_id);
+                }
+                queryWrapper.eqIfPresent(StudentAttendanceDO::getSupervisorId, loginId);
             } else if (roleIds.contains(112L)) {//是学生，只显示自己的
                 queryWrapper.eqIfPresent(StudentAttendanceDO::getStudentId, loginId);
             }
@@ -127,8 +129,10 @@ public interface StudentAttendanceMapper extends BaseMapperX<StudentAttendanceDO
 
         if (roleIds != null && !roleIds.isEmpty()) {
             if (roleIds.contains(113L)) {//是教师 只出现在老师工作间下面的学生考勤情况
-                queryWrapper.eqIfPresent(StudentAttendanceDO::getDeptId, dept_id);
-
+                if(dept_id != null && dept_id != 0 ){
+                    queryWrapper.eqIfPresent(StudentAttendanceDO::getDeptId, dept_id);
+                }
+                queryWrapper.eqIfPresent(StudentAttendanceDO::getSupervisorId, loginId);
             } else if (roleIds.contains(112L)) {//是学生，只显示自己的
                 queryWrapper.eqIfPresent(StudentAttendanceDO::getStudentId, loginId);
             }
@@ -185,8 +189,10 @@ public interface StudentAttendanceMapper extends BaseMapperX<StudentAttendanceDO
 
         if (roleIds != null && !roleIds.isEmpty()) {
             if (roleIds.contains(113L)) {//如果是导师，只看工作间下面的
-                queryWrapperX.eqIfPresent(StudentAttendanceDO::getDeptId, dept_id);
-
+                if(dept_id != null && dept_id != 0 ){
+                    queryWrapperX.eqIfPresent(StudentAttendanceDO::getDeptId, dept_id);
+                }
+                queryWrapperX.eqIfPresent(StudentAttendanceDO::getSupervisorId, loginId);
             } else if (roleIds.contains(112L)) {//是学生，只看自己的
                 queryWrapperX.eqIfPresent(StudentAttendanceDO::getStudentId, loginId);
 
@@ -220,8 +226,10 @@ public interface StudentAttendanceMapper extends BaseMapperX<StudentAttendanceDO
 
         if (roleIds != null && !roleIds.isEmpty()) {
             if (roleIds.contains(113L)) {//如果是导师，只看工作间下面的
-                queryWrapperX.eqIfPresent(StudentAttendanceDO::getDeptId, dept_id);
-
+                if(dept_id != null && dept_id != 0 ){
+                    queryWrapperX.eqIfPresent(StudentAttendanceDO::getDeptId, dept_id);
+                }
+                queryWrapperX.eqIfPresent(StudentAttendanceDO::getSupervisorId, loginId);
             } else if (roleIds.contains(112L)) {//是学生，只看自己的
                 queryWrapperX.eqIfPresent(StudentAttendanceDO::getStudentId, loginId);
 
@@ -278,7 +286,10 @@ public interface StudentAttendanceMapper extends BaseMapperX<StudentAttendanceDO
 
         if (roleIds != null && !roleIds.isEmpty()) {
             if (roleIds.contains(113L)) {//是教师
-                queryWrapper.eqIfPresent(StudentAttendanceDO::getDeptId, dept_id);
+                if(dept_id != null && dept_id != 0 ){
+                    queryWrapper.eqIfPresent(StudentAttendanceDO::getDeptId, dept_id);
+                }
+                queryWrapper.eqIfPresent(StudentAttendanceDO::getSupervisorId, loginId);
             } else if (roleIds.contains(112L)) {//是学生，只显示自己的
                 queryWrapper.eqIfPresent(StudentAttendanceDO::getStudentId, loginId);
             }  else if (roleIds.contains(114L)) {//是学院
@@ -315,7 +326,10 @@ public interface StudentAttendanceMapper extends BaseMapperX<StudentAttendanceDO
 
         if (roleIds != null && !roleIds.isEmpty()) {
             if (roleIds.contains(113L)) {//是教师
-                queryWrapper.eqIfPresent(StudentAttendanceDO::getDeptId, dept_id);
+                if(dept_id != null && dept_id != 0 ){
+                    queryWrapper.eqIfPresent(StudentAttendanceDO::getDeptId, dept_id);
+                }
+                queryWrapper.eqIfPresent(StudentAttendanceDO::getSupervisorId, loginId);
             } else if (roleIds.contains(112L)) {//是学生，只显示自己的
                 queryWrapper.eqIfPresent(StudentAttendanceDO::getStudentId, loginId);
             }  else if (roleIds.contains(114L)) {//是学院

yudao-module-system/yudao-module-system-biz/src/main/java/cn/iocoder/yudao/module/system/dal/mysql/user/AdminUserMapper.java

@@ -100,8 +100,13 @@ public interface AdminUserMapper extends BaseMapperX<AdminUserDO> {
     }
 
     default PageResult<AdminUserDO> getTeacherPageForTeacher(UserPageReqVO reqVO, Collection<Long> deptIds,Set<Long>roleIds,Long loginId) {
+
         Long deptId =SecurityFrameworkUtils.getLoginUserDeptId();
+
+        deptIds.removeIf(did -> did == 0);
+
         LambdaQueryWrapperX<AdminUserDO> queryWrapperX =new LambdaQueryWrapperX<AdminUserDO>();
+
         queryWrapperX
                 .likeIfPresent(AdminUserDO::getEmail,reqVO.getEmail())
                 .likeIfPresent(AdminUserDO::getUsername, reqVO.getUsername())
@@ -111,22 +116,30 @@ public interface AdminUserMapper extends BaseMapperX<AdminUserDO> {
                 .eqIfPresent(AdminUserDO::getUserType,reqVO.getUserType())//类型查询
                 .likeIfPresent(AdminUserDO::getUserNumber,reqVO.getUserNumber())//学号查询
                 .betweenIfPresent(AdminUserDO::getCreateTime, reqVO.getCreateTime())
-                .inIfPresent(AdminUserDO::getDeptId, deptIds)
+
                 // 添加子查询条件，查找有教师权限的人
                 .eqIfPresent(AdminUserDO::getUserType,3)
                 .orderByDesc(AdminUserDO::getId);
-        queryWrapperX.eqIfPresent(AdminUserDO::getDeptId,deptId);
+        queryWrapperX.ne(AdminUserDO::getDeptId, 0);
+
+        if ( !deptIds.isEmpty() ){
+            queryWrapperX.inIfPresent(AdminUserDO::getDeptId, deptIds);
+        }
+
+        if( deptId != null && deptId != 0 ){
+            queryWrapperX.eqIfPresent(AdminUserDO::getDeptId,deptId);
+        }
 
         return selectPage(reqVO,queryWrapperX);
     }
 
-
     List<AdminUserDO> selectPageForGraduate(
             @Param("reqVO") UserPageReqVO reqVO,
             @Param("deptIds") Collection<Long> deptIds,
             @Param("roleIds") Set<Long> roleIds,
             @Param("deptId") Long deptId,
             @Param("offset") Integer offset,
+            @Param("loginId") Long loginId,
             @Param("type") Integer type
     );
     Long  selectPage1Count(
@@ -135,6 +148,7 @@ public interface AdminUserMapper extends BaseMapperX<AdminUserDO> {
             @Param("roleIds") Set<Long> roleIds,
             @Param("deptId") Long deptId,
             @Param("offset") Integer offset,
+            @Param("loginId") Long loginId,
             @Param("type") Integer type
     );
     // 会根据登录 查在校学生

yudao-module-system/yudao-module-system-biz/src/main/java/cn/iocoder/yudao/module/system/service/user/AdminUserServiceImpl.java

@@ -404,8 +404,8 @@ public class AdminUserServiceImpl implements AdminUserService {
             offset = (reqVO.getPageNo() - 1) * reqVO.getPageSize();
         }
 
-        List<AdminUserDO> result =userMapper.selectPageForGraduate(reqVO, getDeptCondition(reqVO.getDeptId()),roleIds,deptId,offset,0);
-        Long size = userMapper.selectPage1Count(reqVO, getDeptCondition(reqVO.getDeptId()),roleIds,deptId,offset,0);
+        List<AdminUserDO> result =userMapper.selectPageForGraduate(reqVO, getDeptCondition(reqVO.getDeptId()),roleIds,deptId,offset,loginId,0);
+        Long size = userMapper.selectPage1Count(reqVO, getDeptCondition(reqVO.getDeptId()),roleIds,deptId,offset,loginId,0);
 
         // 遍历结果集，设置 photoIsExist
 //        resultPage.getList().stream().forEach(user -> {
@@ -445,8 +445,8 @@ public class AdminUserServiceImpl implements AdminUserService {
             offset = (reqVO.getPageNo() - 1) * reqVO.getPageSize();
         }
 
-        List<AdminUserDO> result =userMapper.selectPageForGraduate(reqVO, getDeptCondition(reqVO.getDeptId()),roleIds,deptId,offset,1);
-        Long size = userMapper.selectPage1Count(reqVO, getDeptCondition(reqVO.getDeptId()),roleIds,deptId,offset,1);
+        List<AdminUserDO> result =userMapper.selectPageForGraduate(reqVO, getDeptCondition(reqVO.getDeptId()),roleIds,deptId,offset,loginId,1);
+        Long size = userMapper.selectPage1Count(reqVO, getDeptCondition(reqVO.getDeptId()),roleIds,deptId,offset,loginId,1);
 
         return new PageResult<>(result, size);
     }

yudao-module-system/yudao-module-system-biz/src/main/resources/Mapper/user/AdminUserMapper.xml

@@ -78,8 +78,20 @@
                 AND a.user_type = 1
             </when>
             <when test="type == 1">
-                AND a.dept_id = #{deptId}
                 AND a.user_type = 1
+                AND (
+                (
+                a.dept_id = #{deptId}
+                AND a.dept_id != 0
+                AND a.dept_id IS NOT NULL
+                AND a.dept_id != ''
+                )
+                OR (
+                a.supervisor_id = #{loginId}
+                AND a.supervisor_id IS NOT NULL
+                AND a.supervisor_id != ''
+                )
+                )
             </when>
         </choose>
         <if test="reqVO.isGraduate != null">
@@ -168,8 +180,20 @@
                 AND a.user_type = 1
             </when>
             <when test="type == 1">
-                AND a.dept_id = #{deptId}
                 AND a.user_type = 1
+                AND (
+                (
+                a.dept_id = #{deptId}
+                AND a.dept_id != 0
+                AND a.dept_id IS NOT NULL
+                AND a.dept_id != ''
+                )
+                OR (
+                a.supervisor_id = #{loginId}
+                AND a.supervisor_id IS NOT NULL
+                AND a.supervisor_id != ''
+                )
+                )
             </when>
         </choose>
         <if test="reqVO.isGraduate != null">