public/go-admin
1
0
Fork 0
mirror of https://github.com/go-admin-team/go-admin.git synced 2026-10-14 09:16:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix🔒: add AuthCheckRole to /role-status and /roledatascope

Browse Source 
The group only had JWT, so any logged-in user could change another role's status or data scope regardless of their own permissions.
This commit is contained in:
zhangwenjian
2026-10-08 20:00:14 +08:00
parent 13a52c65df
commit 26a0a8d1af
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/admin/router/sys_role.go
+1 -1
View File
@@ -23,7 +23,7 @@ func registerSysRoleRouter(v1 *gin.RouterGroup, authMiddleware *jwt.GinJWTMiddle
r.PUT("/:id", api.Update)
r.DELETE("", api.Delete)
}
r1 := v1.Group("").Use(authMiddleware.MiddlewareFunc())
r1 := v1.Group("").Use(authMiddleware.MiddlewareFunc()).Use(middleware.AuthCheckRole())
{
r1.PUT("/role-status", api.Update2Status)
r1.PUT("/roledatascope", api.Update2DataScope)