Permission verification interceptor causes level overrealization

Here is the permission verification interceptor of the code, there is something wrong with this code
![输入图片说明](https://foruda.gitee.com/images/1740911054745305668/88998012_2100186.png "屏幕截图")
Confirm the corresponding permissions by querying the fields in the table
![输入图片说明](https://foruda.gitee.com/images/1740911247814615006/d80da7e1_2100186.png "屏幕截图")
Let's log in to the students first,
![输入图片说明](https://foruda.gitee.com/images/1740911538728596791/73a6e8be_2100186.png "屏幕截图")
Here, we access paths outside of the permissions, such as accessing /teacer/list, /student/list

![输入图片说明](https://foruda.gitee.com/images/1740911575621233372/2cd5a509_2100186.png "屏幕截图")
![输入图片说明](https://foruda.gitee.com/images/1740911603449438381/c8ed16a2_2100186.png "屏幕截图")
![输入图片说明](https://foruda.gitee.com/images/1740911618610877751/c6edb43d_2100186.png "屏幕截图")
Why did the interceptor checking fail to intercept successfully?
Here, we found through idea dynamic debugging, where the code will be processed and will be true forever
![输入图片说明](https://foruda.gitee.com/images/1740911728987096057/4f75b078_2100186.png "屏幕截图")
![输入图片说明](https://foruda.gitee.com/images/1740911836710498209/36eb0d9b_2100186.png "屏幕截图")

```
 for (Auth auth : list) {
        if (url.contains(auth.getUrl()) || auth.getUrl().contains(url.split("/")[0])) {
          return true;
        }
```
This code is always true, so it will not intercept it. It should be changed to url.split("/")[1]
Through the student account, you can access other teachers and students' account password information beyond your authority, as well as other interface information, as well as other interface information

黄勇康/student-manage

内容风险标识

评论 (0)

黄勇康/student-manage .gitee-modal { width: 500px !important; }

内容风险标识