风险修复

yunze-admin/src/main/java/com/yunze/web/controller/yunze/sysgl/YzUserController.java

@@ -15,6 +15,7 @@ import com.yunze.common.utils.poi.ExcelUtil;
 import com.yunze.common.utils.spring.SpringUtils;
 import com.yunze.common.utils.yunze.AesEncryptUtil;
 import com.yunze.framework.web.service.TokenService;
+import com.yunze.system.service.ISysDeptService;
 import com.yunze.system.service.ISysPostService;
 import com.yunze.system.service.ISysRoleService;
 import com.yunze.system.service.ISysUserService;
@@ -51,7 +52,8 @@ public class YzUserController extends MyBaseController
 
     @Autowired
     private TokenService tokenService;
-
+    @Autowired
+    private ISysDeptService deptService;
     /**
      * 用户 列表
      */
@@ -171,7 +173,22 @@ public class YzUserController extends MyBaseController
     @PutMapping
     public AjaxResult edit(@Validated @RequestBody SysUser user)
     {
+        // 1. 基础权限与数据范围校验
         userService.checkUserAllowed(user);
+        userService.checkUserDataScope(user.getUserId());
+        deptService.checkDeptDataScope(user.getDeptId());
+        roleService.checkRoleDataScope(user.getRoleIds());
+        // 2. 【关键修复 + 优化】用户名唯一性校验：防止普通用户篡改为 admin 等关键用户名
+        // 优化点：先获取数据库中该用户原始的 userName，仅当新用户名与原用户名不同时才校验唯一性
+        SysUser existingUser = userService.selectUserById(user.getUserId());
+        if (existingUser == null) {
+            return AjaxResult.error("用户不存在");
+        }
+        if (!StringUtils.equals(existingUser.getUserName(), user.getUserName())) {
+            if (UserConstants.NOT_UNIQUE.equals(userService.checkUserNameUnique(user.getUserName()))) {
+                return AjaxResult.error("修改用户'" + user.getUserName() + "'失败，登录账号已存在");
+            }
+        }
         if (StringUtils.isNotEmpty(user.getPhonenumber())
                 && UserConstants.NOT_UNIQUE.equals(userService.checkPhoneUnique(user)))
         {

yunze-ui/src/api/newcard/card/index.js

@@ -0,0 +1,66 @@
+import request from '@/utils/request'
+
+export function list(params) {
+  return request({
+    url: '/newCard/getList',
+    method: 'get',
+    params: params
+  })
+}
+
+export function SynCardNetType(map) {
+  return request({
+    url: '/newCard/SynCardNetType',
+    method: 'post',
+    data: map
+  })
+}
+
+export function SynCardAll(map) {
+  return request({
+    url: '/newCard/SynCardAll',
+    method: 'post',
+    data: map
+  })
+}
+
+export function SynUpdateCardStatus(map) {
+  return request({
+    url: '/newCard/SynUpdateCardStatus',
+    method: 'post',
+    data: map
+  })
+}
+
+export function SynCardChangeHistory(map) {
+  return request({
+    url: '/newCard/SynCardChangeHistory',
+    method: 'post',
+    data: map
+  })
+}
+
+export function SynCardLocal(map) {
+  return request({
+    url: '/newCard/SynCardLocal',
+    method: 'post',
+    data: map
+  })
+}
+
+export function exportRegionData(map) {
+  return request({
+    url: '/newCard/exportRegionData',
+    method: 'post',
+    responseType: 'arraybuffer',
+    data: map
+  })
+}
+
+export function apnInfo(map) {
+  return request({
+    url: '/newCard/apnInfo',
+    method: 'post',
+    data: map
+  })
+}

yunze-ui/src/api/newcard/module/module.js

@@ -0,0 +1,16 @@
+import request from '@/utils/request'
+
+export function list(query) {
+  return request({
+    url: '/module/getModuleList',
+    method: 'post',
+    data: query
+  })
+}
+export function outModuleInventory(query) {
+  return request({
+    url: '/module/outModuleInventory',
+    method: 'post',
+    data: query
+  })
+}

yunze-ui/src/api/newcard/sendsms/sendsms.js

@@ -0,0 +1,15 @@
+import request from '@/utils/request'
+export function sendToDevice(query) {
+  return request({
+    url: '/sendSms/sendToDevice',
+    method: 'post',
+    data: query
+  })
+}
+export function queryReceiveSms(query) {
+  return request({
+    url: '/sendSms/queryReceiveSms',
+    method: 'post',
+    data: query
+  })
+}