From a6630670be4c13fb8eb37fe53e495c379296dca0 Mon Sep 17 00:00:00 2001 From: LinkinStar Date: Tue, 6 Dec 2022 14:45:29 +0800 Subject: [PATCH] fix(rank): Incorrect permission verification user can update answer that put by himself. admin can vote up anyway. --- internal/controller/answer_controller.go | 2 +- internal/service/rank/rank_service.go | 4 ++++ 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/internal/controller/answer_controller.go b/internal/controller/answer_controller.go index 53deb265..2b91d779 100644 --- a/internal/controller/answer_controller.go +++ b/internal/controller/answer_controller.go @@ -161,7 +161,7 @@ func (ac *AnswerController) Update(ctx *gin.Context) { canList, err := ac.rankService.CheckOperationPermissions(ctx, req.UserID, []string{ rank.AnswerEditRank, rank.AnswerEditWithoutReviewRank, - }, "") + }, req.ID) if err != nil { handler.HandleResponse(ctx, err, nil) return diff --git a/internal/service/rank/rank_service.go b/internal/service/rank/rank_service.go index 22bae247..88db3347 100644 --- a/internal/service/rank/rank_service.go +++ b/internal/service/rank/rank_service.go @@ -170,6 +170,10 @@ func (rs *RankService) CheckVotePermission(ctx context.Context, userID, objectID if !exist { return can, nil } + // administrator have all permissions + if userInfo.IsAdmin { + return true, nil + } objectInfo, err := rs.objectInfoService.GetInfo(ctx, objectID) if err != nil {