Merge pull request #41 from PlayEdu/fix/missing-backend-permission

fix: 后台接口补全 @BackendPermission 权限注解

CHANGELOG.md

@@ -1,3 +1,7 @@
+## Unreleased
+
+- 修复:后台批量导入学员、章节/课时/附件排序接口缺少权限注解导致的越权问题
+
 ## 2.0
 
 - 新增:`LDAP`同步数据统计

playedu-api/playedu-api/src/main/java/xyz/playedu/api/controller/backend/CourseAttachmentController.java

@@ -141,6 +141,7 @@ public class CourseAttachmentController {
         return JsonResponse.success();
     }
 
+    @BackendPermission(slug = BPermissionConstant.COURSE)
     @PutMapping("/update/sort")
     @Log(title = "线上课-附件-排序调整", businessType = BusinessTypeConstant.UPDATE)
     public JsonResponse updateSort(

playedu-api/playedu-api/src/main/java/xyz/playedu/api/controller/backend/CourseChapterController.java

@@ -95,6 +95,7 @@ public class CourseChapterController {
         return JsonResponse.success();
     }
 
+    @BackendPermission(slug = BPermissionConstant.COURSE)
     @PutMapping("/update/sort")
     @Log(title = "线上课-章节-更新排序", businessType = BusinessTypeConstant.UPDATE)
     public JsonResponse updateSort(

playedu-api/playedu-api/src/main/java/xyz/playedu/api/controller/backend/CourseHourController.java

@@ -224,6 +224,7 @@ public class CourseHourController {
         return JsonResponse.success();
     }
 
+    @BackendPermission(slug = BPermissionConstant.COURSE)
     @PutMapping("/update/sort")
     @Log(title = "线上课-课时-更新排序", businessType = BusinessTypeConstant.UPDATE)
     public JsonResponse updateSort(

playedu-api/playedu-api/src/main/java/xyz/playedu/api/controller/backend/UserController.java

@@ -262,6 +262,7 @@ public class UserController {
         return JsonResponse.success();
     }
 
+    @BackendPermission(slug = BPermissionConstant.USER_STORE)
     @PostMapping("/store-batch")
     @Transactional
     @Log(title = "学员-批量导入", businessType = BusinessTypeConstant.INSERT)