From 26a0a8d1aff3ace51dcaea0379aa5d3285692000 Mon Sep 17 00:00:00 2001 From: zhangwenjian Date: Thu, 8 Oct 2026 20:00:14 +0800 Subject: [PATCH] =?UTF-8?q?fix=F0=9F=94=92:=20add=20AuthCheckRole=20to=20/?= =?UTF-8?q?role-status=20and=20/roledatascope?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The group only had JWT, so any logged-in user could change another role's status or data scope regardless of their own permissions. --- app/admin/router/sys_role.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/admin/router/sys_role.go b/app/admin/router/sys_role.go index 7a4d8f12..dd7a3bd3 100644 --- a/app/admin/router/sys_role.go +++ b/app/admin/router/sys_role.go @@ -23,7 +23,7 @@ func registerSysRoleRouter(v1 *gin.RouterGroup, authMiddleware *jwt.GinJWTMiddle r.PUT("/:id", api.Update) r.DELETE("", api.Delete) } - r1 := v1.Group("").Use(authMiddleware.MiddlewareFunc()) + r1 := v1.Group("").Use(authMiddleware.MiddlewareFunc()).Use(middleware.AuthCheckRole()) { r1.PUT("/role-status", api.Update2Status) r1.PUT("/roledatascope", api.Update2DataScope)