lxd/FlowPacs
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

!892 修补会员取消售后接口中未校验用户ID的安全漏洞

Browse Source 
Merge pull request !892 from 杨宇庆/N/A
This commit is contained in:
芋道源码 2024-02-29 13:03:22 +00:00 committed by Gitee
commit 556e3786a8
No known key found for this signature in database
GPG Key ID: 173E9B9CA92EEF8F
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
yudao-module-mall/yudao-module-trade-biz/src/main/java/cn/iocoder/yudao/module/trade/service/aftersale/AfterSaleServiceImpl.java
View File

@ -383,7 +383,7 @@ public class AfterSaleServiceImpl implements AfterSaleService {
@AfterSaleLog(operateType = AfterSaleOperateTypeEnum.MEMBER_CANCEL) @AfterSaleLog(operateType = AfterSaleOperateTypeEnum.MEMBER_CANCEL)
public void cancelAfterSale(Long userId, Long id) { public void cancelAfterSale(Long userId, Long id) {
// 校验售后单的状态，并状态待退款 // 校验售后单的状态，并状态待退款
AfterSaleDO afterSale = tradeAfterSaleMapper.selectById(id); AfterSaleDO afterSale = tradeAfterSaleMapper.selectByIdAndUserId(id, userId);
if (afterSale == null) { if (afterSale == null) {
throw exception(AFTER_SALE_NOT_FOUND); throw exception(AFTER_SALE_NOT_FOUND);
} }