From faed5d342638c2b300527f460f5b68ca9d47c5ff Mon Sep 17 00:00:00 2001 From: zhangwenjian Date: Thu, 8 Oct 2026 20:00:15 +0800 Subject: [PATCH] =?UTF-8?q?fix=F0=9F=94=92:=20add=20AuthCheckRole=20to=20/?= =?UTF-8?q?set-config?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The group only had JWT, so any logged-in user could read and overwrite the system settings regardless of their own permissions. --- app/admin/router/sys_config.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/admin/router/sys_config.go b/app/admin/router/sys_config.go index db194f80..be6e04a9 100644 --- a/app/admin/router/sys_config.go +++ b/app/admin/router/sys_config.go @@ -34,7 +34,7 @@ func registerSysConfigRouter(v1 *gin.RouterGroup, authMiddleware *jwt.GinJWTMidd r2.GET("", api.Get2SysApp) } - r3 := v1.Group("/set-config").Use(authMiddleware.MiddlewareFunc()) + r3 := v1.Group("/set-config").Use(authMiddleware.MiddlewareFunc()).Use(middleware.AuthCheckRole()) { r3.PUT("", api.Update2Set) r3.GET("", api.Get2Set)