Browse Source

fix: 开通/关闭转账按钮缺少权限控制,非admin账户可见 - 前端加 v-hasPerm + 后端加 @PreAuthorize

alphaH 1 day ago
parent
commit
a048a05187

+ 2 - 1
frontend/src/views/module_payment/enterprise/index.vue

@@ -59,8 +59,9 @@
                     @click="handleOpenDetail(scope.row)">
                     详情
                   </el-button>
-                  <el-button
+                  <el-button v-if="!isAdmin"
                     size="small" link
+                    v-hasPerm="['module_payment:enterprise:transfer-toggle']"
                     :type="scope.row.transfer_enabled ? 'danger' : 'success'"
                     :loading="scope.row._toggling"
                     @click="handleToggleTransfer(scope.row)">

+ 1 - 0
java/src/main/java/com/payment/platform/module/payment/enterprise/controller/EnterpriseController.java

@@ -60,6 +60,7 @@ public class EnterpriseController {
         return Result.ok(enterpriseService.detail(enterpriseId));
     }
 
+    @PreAuthorize("@perm.hasAny('module_payment:enterprise:transfer-toggle')")
     @PutMapping("/{enterprise_id}")
     public Result<EnterpriseVO> update(@PathVariable(name = "enterprise_id") String enterpriseId, @Valid @RequestBody EnterpriseUpdateDTO body) {
         return Result.ok(enterpriseService.update(enterpriseId, body));