lxd/FlowPacs
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

!891 修补会员退货接口中未校验用户ID的安全漏洞

Browse Source 
Merge pull request !891 from 杨宇庆/N/A
This commit is contained in:
芋道源码 2024-02-29 13:01:34 +00:00 committed by Gitee
commit 801c405881
No known key found for this signature in database
GPG Key ID: 173E9B9CA92EEF8F
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
yudao-module-mall/yudao-module-trade-biz/src/main/java/cn/iocoder/yudao/module/trade/service/aftersale/AfterSaleServiceImpl.java
View File

@ -245,7 +245,7 @@ public class AfterSaleServiceImpl implements AfterSaleService {
@AfterSaleLog(operateType = AfterSaleOperateTypeEnum.MEMBER_DELIVERY)
public void deliveryAfterSale(Long userId, AppAfterSaleDeliveryReqVO deliveryReqVO) {
// 校验售后单存在，并状态未退货
AfterSaleDO afterSale = tradeAfterSaleMapper.selectById(deliveryReqVO.getId());
AfterSaleDO afterSale = tradeAfterSaleMapper.selectByIdAndUserId(deliveryReqVO.getId(), userId);
if (afterSale == null) {
throw exception(AFTER_SALE_NOT_FOUND);
}