From 03588990f6ffcaec4f8c59933c8c510cd6dc9aab Mon Sep 17 00:00:00 2001
From: xxx <616896861@qq.com>
Date: Wed, 13 May 2026 20:39:27 -0700
Subject: [PATCH] =?UTF-8?q?fix:=20=E5=90=8E=E5=8F=B0=E6=8E=A5=E5=8F=A3?=
 =?UTF-8?q?=E8=A1=A5=E5=85=A8=20@BackendPermission=20=E6=9D=83=E9=99=90?=
 =?UTF-8?q?=E6=B3=A8=E8=A7=A3?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

修复以下接口未声明 slug 导致低权限管理员可越权调用：
- POST /backend/v1/user/store-batch 批量导入学员 -> USER_STORE
- PUT  /backend/v1/course/{courseId}/attachment/update/sort -> COURSE
- PUT  /backend/v1/course/{courseId}/chapter/update/sort    -> COURSE
- PUT  /backend/v1/course/{courseId}/hour/update/sort       -> COURSE
---
 .../api/controller/backend/CourseAttachmentController.java       | 1 +
 .../playedu/api/controller/backend/CourseChapterController.java  | 1 +
 .../xyz/playedu/api/controller/backend/CourseHourController.java | 1 +
 .../java/xyz/playedu/api/controller/backend/UserController.java  | 1 +
 4 files changed, 4 insertions(+)

diff --git a/playedu-api/playedu-api/src/main/java/xyz/playedu/api/controller/backend/CourseAttachmentController.java b/playedu-api/playedu-api/src/main/java/xyz/playedu/api/controller/backend/CourseAttachmentController.java
index d34ccadc..337eeb42 100644
--- a/playedu-api/playedu-api/src/main/java/xyz/playedu/api/controller/backend/CourseAttachmentController.java
+++ b/playedu-api/playedu-api/src/main/java/xyz/playedu/api/controller/backend/CourseAttachmentController.java
@@ -141,6 +141,7 @@ public class CourseAttachmentController {
         return JsonResponse.success();
     }
 
+    @BackendPermission(slug = BPermissionConstant.COURSE)
     @PutMapping("/update/sort")
     @Log(title = "线上课-附件-排序调整", businessType = BusinessTypeConstant.UPDATE)
     public JsonResponse updateSort(
diff --git a/playedu-api/playedu-api/src/main/java/xyz/playedu/api/controller/backend/CourseChapterController.java b/playedu-api/playedu-api/src/main/java/xyz/playedu/api/controller/backend/CourseChapterController.java
index 8b0273d3..7d7359af 100644
--- a/playedu-api/playedu-api/src/main/java/xyz/playedu/api/controller/backend/CourseChapterController.java
+++ b/playedu-api/playedu-api/src/main/java/xyz/playedu/api/controller/backend/CourseChapterController.java
@@ -95,6 +95,7 @@ public class CourseChapterController {
         return JsonResponse.success();
     }
 
+    @BackendPermission(slug = BPermissionConstant.COURSE)
     @PutMapping("/update/sort")
     @Log(title = "线上课-章节-更新排序", businessType = BusinessTypeConstant.UPDATE)
     public JsonResponse updateSort(
diff --git a/playedu-api/playedu-api/src/main/java/xyz/playedu/api/controller/backend/CourseHourController.java b/playedu-api/playedu-api/src/main/java/xyz/playedu/api/controller/backend/CourseHourController.java
index 63bbe14e..c373593d 100644
--- a/playedu-api/playedu-api/src/main/java/xyz/playedu/api/controller/backend/CourseHourController.java
+++ b/playedu-api/playedu-api/src/main/java/xyz/playedu/api/controller/backend/CourseHourController.java
@@ -224,6 +224,7 @@ public class CourseHourController {
         return JsonResponse.success();
     }
 
+    @BackendPermission(slug = BPermissionConstant.COURSE)
     @PutMapping("/update/sort")
     @Log(title = "线上课-课时-更新排序", businessType = BusinessTypeConstant.UPDATE)
     public JsonResponse updateSort(
diff --git a/playedu-api/playedu-api/src/main/java/xyz/playedu/api/controller/backend/UserController.java b/playedu-api/playedu-api/src/main/java/xyz/playedu/api/controller/backend/UserController.java
index fb4ef9ba..36c9b63e 100644
--- a/playedu-api/playedu-api/src/main/java/xyz/playedu/api/controller/backend/UserController.java
+++ b/playedu-api/playedu-api/src/main/java/xyz/playedu/api/controller/backend/UserController.java
@@ -262,6 +262,7 @@ public class UserController {
         return JsonResponse.success();
     }
 
+    @BackendPermission(slug = BPermissionConstant.USER_STORE)
     @PostMapping("/store-batch")
     @Transactional
     @Log(title = "学员-批量导入", businessType = BusinessTypeConstant.INSERT)