hhyykk/ipms-sjy
1
1
Fork 0
mirror of https://gitee.com/hhyykk/ipms-sjy.git synced 2025-08-06 14:21:52 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

【修复】修复会员取消退款接口中未校验用户ID的漏洞

Browse Source 
Signed-off-by: 杨宇庆 <hiyyq@qq.com>
This commit is contained in:
杨宇庆
2024-11-06 15:21:25 +00:00
committed by Gitee
parent d97ba8d4d8
commit c776371d48
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
yudao-module-mall/yudao-module-trade-biz/src/main/java/cn/iocoder/yudao/module/trade/service/aftersale/AfterSaleServiceImpl.java
View File

@@ -399,7 +399,7 @@ public class AfterSaleServiceImpl implements AfterSaleService {
@AfterSaleLog(operateType = AfterSaleOperateTypeEnum.MEMBER_CANCEL) @AfterSaleLog(operateType = AfterSaleOperateTypeEnum.MEMBER_CANCEL)
public void cancelAfterSale(Long userId, Long id) { public void cancelAfterSale(Long userId, Long id) {
// 校验售后单的状态，并状态待退款 // 校验售后单的状态，并状态待退款
AfterSaleDO afterSale = tradeAfterSaleMapper.selectById(id); AfterSaleDO afterSale = tradeAfterSaleMapper.selectByIdAndUserId(id, userId);
if (afterSale == null) { if (afterSale == null) {
throw exception(AFTER_SALE_NOT_FOUND); throw exception(AFTER_SALE_NOT_FOUND);
} }