diff --git a/mallinkBApi/src/main/java/com/iformall/controller/WxInfoController.java b/mallinkBApi/src/main/java/com/iformall/controller/WxInfoController.java index ba71b60fc..b8235eccf 100644 --- a/mallinkBApi/src/main/java/com/iformall/controller/WxInfoController.java +++ b/mallinkBApi/src/main/java/com/iformall/controller/WxInfoController.java @@ -157,11 +157,11 @@ public class WxInfoController extends BaseController { cUser = cuserFactory.getBUserService(appPlat).handleLoginUser(cUser,null); resultMap.put("token", cUser.getToken()); - request.setAttribute(Constant.LOGIN_USER_KEY, cUser.getId()); - request.setAttribute(Constant.TENANT_ID, buUser.getTenantId()); - if (StringUtils.isNotBlank(buUser.getParentTenantId())) { - request.setAttribute(Constant.PARENT_TENANT_ID, buUser.getParentTenantId()); - } +// request.setAttribute(Constant.LOGIN_USER_KEY, cUser.getId()); +// request.setAttribute(Constant.TENANT_ID, buUser.getTenantId()); +// if (StringUtils.isNotBlank(buUser.getParentTenantId())) { +// request.setAttribute(Constant.PARENT_TENANT_ID, buUser.getParentTenantId()); +// } return new ResultData(resultMap); } diff --git a/mallinkBApi/src/main/java/com/iformall/controller/WxMerchantBUserController.java b/mallinkBApi/src/main/java/com/iformall/controller/WxMerchantBUserController.java index 07cd9f699..e549cf9b4 100644 --- a/mallinkBApi/src/main/java/com/iformall/controller/WxMerchantBUserController.java +++ b/mallinkBApi/src/main/java/com/iformall/controller/WxMerchantBUserController.java @@ -185,7 +185,7 @@ public class WxMerchantBUserController extends BaseController { Map resultMap = new HashMap<>(); resultMap.put("bUserId", orgUser.getId()); resultMap.put("logined", true); - request.setAttribute(Constant.LOGIN_B_USER_KEY, orgUser.getId()); +// request.setAttribute(Constant.LOGIN_B_USER_KEY, orgUser.getId()); return new ResultData(resultMap); } else { return new ResultData(ErrorCode.PASSWORD_ERROR); diff --git a/mallinkBApi/src/main/java/com/iformall/interceptor/AuthorizationInterceptor.java b/mallinkBApi/src/main/java/com/iformall/interceptor/AuthorizationInterceptor.java index 5f57d8ccb..9086f9a6a 100644 --- a/mallinkBApi/src/main/java/com/iformall/interceptor/AuthorizationInterceptor.java +++ b/mallinkBApi/src/main/java/com/iformall/interceptor/AuthorizationInterceptor.java @@ -162,6 +162,12 @@ public class AuthorizationInterceptor extends HandlerInterceptorAdapter { } } + if(!tenantId.equals(buser.getTenantId()) + || !buser.getTenantId().equals(parenTenantId) + || !tenantId.equals(buser.getParentTenantId())){ + throw new MallinkException(ErrorCode.SYS_AUTH_ERROR); + } + request.setAttribute(Constant.LOGIN_B_USER_KEY, buser.getId()); request.setAttribute(Constant.TENANT_ID, tenantId); if (StringUtils.isNotBlank(parenTenantId)) { diff --git a/mallinkCApi/src/main/java/com/iformall/controller/WxUserGrantController.java b/mallinkCApi/src/main/java/com/iformall/controller/WxUserGrantController.java index 626543582..d78616034 100755 --- a/mallinkCApi/src/main/java/com/iformall/controller/WxUserGrantController.java +++ b/mallinkCApi/src/main/java/com/iformall/controller/WxUserGrantController.java @@ -244,8 +244,8 @@ public class WxUserGrantController extends BaseController { } HttpServletRequest request = ((ServletRequestAttributes) RequestContextHolder.getRequestAttributes()).getRequest(); - request.setAttribute(Constant.TENANT_ID, wxMall.getTenantId()); - request.setAttribute(Constant.PARENT_TENANT_ID, wxMall.getParentTenantId()); +// request.setAttribute(Constant.TENANT_ID, wxMall.getTenantId()); +// request.setAttribute(Constant.PARENT_TENANT_ID, wxMall.getParentTenantId()); String ipaddress = IPUtil.getIpAddr(request); CUser cUser = new CUser(); @@ -270,7 +270,7 @@ public class WxUserGrantController extends BaseController { cUser = cuserFactory.getCUserService(appPlat).handleLoginUser(cUser,wxCUserFrom); resultMap.put("token", cUser.getToken()); - request.setAttribute(Constant.LOGIN_USER_KEY, cUser.getId()); +// request.setAttribute(Constant.LOGIN_USER_KEY, cUser.getId()); return new ResultData(resultMap); } diff --git a/mallinkCApi/src/main/java/com/iformall/interceptor/AuthorizationInterceptor.java b/mallinkCApi/src/main/java/com/iformall/interceptor/AuthorizationInterceptor.java index c2ab40178..02a691015 100644 --- a/mallinkCApi/src/main/java/com/iformall/interceptor/AuthorizationInterceptor.java +++ b/mallinkCApi/src/main/java/com/iformall/interceptor/AuthorizationInterceptor.java @@ -92,6 +92,12 @@ public class AuthorizationInterceptor extends HandlerInterceptorAdapter { parenTenantId = cUser.getParentTenantId(); } } + + if(!tenantId.equals(cUser.getTenantId()) + || !cUser.getTenantId().equals(parenTenantId) + || !tenantId.equals(cUser.getParentTenantId())){ + throw new MallinkException(ErrorCode.SYS_AUTH_ERROR); + } // if (StringUtils.isNotBlank(mallTenantId)) { // request.setAttribute(Constant.TENANT_ID, mallTenantId); @@ -106,13 +112,13 @@ public class AuthorizationInterceptor extends HandlerInterceptorAdapter { // } request.setAttribute(Constant.TENANT_ID, tenantId); - if(StringUtils.isNotBlank(parenTenantId)){ - request.setAttribute(Constant.PARENT_TENANT_ID, parenTenantId); - } + request.setAttribute(Constant.PARENT_TENANT_ID, parenTenantId); request.setAttribute(Constant.REQUEST_C_USER_KEY, cUser); if(cUser.basicInfoIs()){ request.setAttribute(Constant.LOGIN_MEMBER_KEY, cUser.getUserId()); + }else{ + request.setAttribute(Constant.LOGIN_MEMBER_KEY, null); } request.setAttribute(Constant.APP_INFO,cUser.getAppinfo());