漏洞扫描修改

mhd_finance/src/main/java/com/linke/finance/application/server/approvalDocument/ApprovalDocumentApplicationService.java

@@ -7,11 +7,15 @@ import com.linke.finance.domain.approvalDocument.repository.todo.ApprovalDocumen
 import com.linke.finance.domain.approvalDocument.repository.todo.WorkflowProcessInstancesByIdDO;
 import com.linke.finance.domain.approvalDocument.service.ApprovalDocumentDomainService;
 import com.linke.finance.interfaces.vo.ApprovalStatsVO;
+import com.mhd.common.core.domain.po.UserPo;
 import com.mhd.common.security.utils.SecurityUtils;
 import com.mhd.system.api.model.LoginUser;
 import lombok.extern.slf4j.Slf4j;
+import org.apache.catalina.User;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Service;
+
+import java.rmi.ServerException;
 import java.util.List;
 /**
  * 审批单据ApplicationService
@@ -30,8 +34,12 @@ public class ApprovalDocumentApplicationService {
      * 分页查询审批单据列表
      */
 
-    public List<ApprovalDocumentPO> queryList(ApprovalDocumentDO approvalDocumentDO) {
+    public List<ApprovalDocumentPO> queryList(ApprovalDocumentDO approvalDocumentDO) throws Exception{
         LoginUser loginUser = SecurityUtils.getLoginUser();
+        UserPo userPo=loginUser.getUserPo();
+        if(!userPo.getRoleCode().equals("plat_admin")){
+            throw new ServerException("您没有权限访问");
+        }
         if (loginUser != null){
             Long topOrganizationId = loginUser.getUserPo().getTopOrganizationId();
             if (topOrganizationId != null && topOrganizationId != 1){

mhd_finance/src/main/java/com/linke/finance/interfaces/facade/approvalDocument/ApprovalDocumentApi.java

@@ -7,6 +7,8 @@ import com.linke.finance.interfaces.dto.approvalDocument.DingDingHuiDiaoDTO;
 import com.linke.finance.interfaces.vo.ApprovalStatsVO;
 import com.linke.finance.until.DingCallbackCrypto;
 import com.mhd.common.core.domain.entity.R;
+
+import java.rmi.ServerException;
 import java.util.List;
 import java.util.Map;
 
@@ -56,8 +58,17 @@ public class ApprovalDocumentApi extends BaseController{
         //转换实体
         ApprovalDocumentDO approvalDocumentDO = approvalDocumentAssembler.toDO(approvalDocumentDTO);
         startPage();
-        List<ApprovalDocumentPO> list = approvalDocumentApplicationService.queryList(approvalDocumentDO);
-        return getDataTable(list);
+        List<ApprovalDocumentPO> list = null;
+        try {
+            list = approvalDocumentApplicationService.queryList(approvalDocumentDO);
+            return getDataTable(list);
+        } catch (ServerException e) {
+            e.printStackTrace();
+            return null;
+        } catch (Exception e) {
+            e.printStackTrace();
+            return null;
+        }
     }
 
     /**