From 1b95707819370a600eb58b6d522d1dfb94a42f42 Mon Sep 17 00:00:00 2001 From: eoao Date: Fri, 8 May 2026 23:58:03 +0800 Subject: [PATCH] fix: permission vulnerability --- mail-worker/src/api/role-api.js | 2 +- mail-worker/src/security/security.js | 5 +++-- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/mail-worker/src/api/role-api.js b/mail-worker/src/api/role-api.js index 596c217..a3dd20b 100644 --- a/mail-worker/src/api/role-api.js +++ b/mail-worker/src/api/role-api.js @@ -19,7 +19,7 @@ app.put('/role/set', async (c) => { return c.json(result.ok()); }); -app.get('/role/permTree', async (c) => { +app.get('/role/tree', async (c) => { const tree = await permService.tree(c); return c.json(result.ok(tree)); }); diff --git a/mail-worker/src/security/security.js b/mail-worker/src/security/security.js index 9763001..ddb95df 100644 --- a/mail-worker/src/security/security.js +++ b/mail-worker/src/security/security.js @@ -48,6 +48,7 @@ const requirePerms = [ '/user/setStatus', '/user/setType', '/user/list', + '/user/restore', '/user/resetSendCount', '/user/add', '/user/deleteAccount', @@ -74,13 +75,13 @@ const premKey = { 'user:add': ['/user/add'], 'user:reset-send': ['/user/resetSendCount'], 'user:set-pwd': ['/user/setPwd'], - 'user:set-status': ['/user/setStatus'], + 'user:set-status': ['/user/setStatus', '/user/restore'], 'user:set-type': ['/user/setType'], 'user:delete': ['/user/delete','/user/deleteAccount'], 'all-email:query': ['/allEmail/list','/allEmail/latest'], 'all-email:delete': ['/allEmail/delete','/allEmail/batchDelete'], 'setting:query': ['/setting/query'], - 'setting:set': ['/setting/set', '/setting/setBackground','/setting/deleteBackground'], + 'setting:set': ['/setting/set', '/setting/setBackground','/setting/deleteBackground','/setting/setBlacklist'], 'analysis:query': ['/analysis/echarts'], 'reg-key:add': ['/regKey/add'], 'reg-key:query': ['/regKey/list','/regKey/history'],