zhangwenjian 07ff92aa55 fix🐛: lock privileged fields on self-edit ...

The profile page posts the whole user object back, including roleId, deptId and
status, because it renders from a full SysUser it fetched earlier. A caller
editing their own record can therefore hand back a tampered roleId.

Self-edits now reload those three fields from the database and ignore whatever
the request carried. For an honest client this is a no-op - the values it sends
are already its own - so the profile page keeps working unchanged.

Claude-Session: https://claude.ai/code/session_01HPTAw8b8tAdFNFn8rKdPYx

2026-09-04 17:23:07 +08:00

..

dto

refactor🎨: move the operation log status constants out of app/admin

2026-09-01 17:45:40 +08:00

sys_api_permission_test.go

fix🐛: refuse an out-of-scope API update with the permission message

2026-09-01 14:17:20 +08:00

sys_api.go

fix🐛: refuse an out-of-scope API update with the permission message

2026-09-01 14:17:20 +08:00

sys_config.go

chore🔧: move to go-admin-core v2

2026-08-23 13:26:46 +08:00

sys_dept.go

chore🔧: move to go-admin-core v2

2026-08-23 13:26:46 +08:00

sys_dict_data.go

chore🔧: move to go-admin-core v2

2026-08-23 13:26:46 +08:00

sys_dict_type.go

chore🔧: move to go-admin-core v2

2026-08-23 13:26:46 +08:00

sys_login_log.go

chore🔧: move to go-admin-core v2

2026-08-23 13:26:46 +08:00

sys_menu_softdelete_test.go

test🧪: run the assertion through the function it is about

2026-08-22 11:40:38 +08:00

sys_menu.go

chore🔧: move to go-admin-core v2

2026-08-23 13:26:46 +08:00

sys_opera_log.go

chore🔧: move to go-admin-core v2

2026-08-23 13:26:46 +08:00

sys_post.go

chore🔧: move to go-admin-core v2

2026-08-23 13:26:46 +08:00

sys_role_menu.go

chore🔧: move to go-admin-core v2

2026-08-23 13:26:46 +08:00

sys_role.go

chore🔧: move to go-admin-core v2

2026-08-23 13:26:46 +08:00

sys_user.go

fix🐛: lock privileged fields on self-edit

2026-09-04 17:23:07 +08:00