center/dataease-dm
center/dataease-dm
13
0
Fork 0
forked from github/dataease
Code Pull Requests Activity

fix: 数据集预览和更新增加数据源权限校验，防止使用无权限数据源执行sql

Browse Source
This commit is contained in:
wangjiahao 2022-06-16 16:17:11 +08:00
parent e8b6615759
commit 7673e58088
1 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
backend/src/main/java/io/dataease/controller/dataset/DataSetTableController.java
View File

@ -49,7 +49,8 @@ public class DataSetTableController {
@DePermissions(value = {
@DePermission(type = DePermissionType.DATASET, value = "id", level = ResourceAuthLevel.DATASET_LEVEL_MANAGE),
@DePermission(type = DePermissionType.DATASET, value = "sceneId", level = ResourceAuthLevel.DATASET_LEVEL_MANAGE)
@DePermission(type = DePermissionType.DATASET, value = "sceneId", level = ResourceAuthLevel.DATASET_LEVEL_MANAGE),
@DePermission(type = DePermissionType.DATASOURCE, value = "dataSourceId", level = ResourceAuthLevel.DATASOURCE_LEVEL_USE)
}, logical = Logical.AND)
@ApiOperation("更新")
@PostMapping("update")
@ -135,6 +136,10 @@ public class DataSetTableController {
@ApiOperation("根据sql查询预览数据")
@PostMapping("sqlPreview")
@DePermissions(value = {
@DePermission(type = DePermissionType.DATASET, value = "id", level = ResourceAuthLevel.DATASET_LEVEL_USE),
@DePermission(type = DePermissionType.DATASOURCE, value = "dataSourceId", level = ResourceAuthLevel.DATASOURCE_LEVEL_USE)
}, logical = Logical.AND)
public Map<String, Object> getSQLPreview(@RequestBody DataSetTableRequest dataSetTableRequest) throws Exception {
return dataSetTableService.getSQLPreview(dataSetTableRequest);
}