p38192567
/
ruoyi-vue-pro1
mirror of https://gitee.com/zhijiantianya/ruoyi-vue-pro.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

!1124 【修复】修复会员取消售后接口中未校验用户ID的漏洞 

Merge pull request !1124 from 杨宇庆/N/A
This commit is contained in:
芋道源码 2024-11-09 07:29:00 +00:00 committed by Gitee
parent 14dc2e3849 c776371d48
commit b93199bd0a
No known key found for this signature in database
GPG Key ID: 173E9B9CA92EEF8F
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
yudao-module-mall/yudao-module-trade-biz/src/main/java/cn/iocoder/yudao/module/trade/service/aftersale/AfterSaleServiceImpl.java
View File

@ -399,7 +399,7 @@ public class AfterSaleServiceImpl implements AfterSaleService {
@AfterSaleLog(operateType = AfterSaleOperateTypeEnum.MEMBER_CANCEL) @AfterSaleLog(operateType = AfterSaleOperateTypeEnum.MEMBER_CANCEL)
public void cancelAfterSale(Long userId, Long id) { public void cancelAfterSale(Long userId, Long id) {
// 校验售后单的状态，并状态待退款 // 校验售后单的状态，并状态待退款
AfterSaleDO afterSale = tradeAfterSaleMapper.selectById(id); AfterSaleDO afterSale = tradeAfterSaleMapper.selectByIdAndUserId(id, userId);
if (afterSale == null) { if (afterSale == null) {
throw exception(AFTER_SALE_NOT_FOUND); throw exception(AFTER_SALE_NOT_FOUND);
} }