Server:@ROLE:ONWER请求的userId和登录userId不符时抛异常

TommyLemon · TommyLemon · commit b3c58142c851 · 2017-12-10T14:37:21.000+08:00
diff --git a/APIJSON-Java-Server/APIJSON-Eclipse/src/main/java/apijson/demo/server/Verifier.java b/APIJSON-Java-Server/APIJSON-Eclipse/src/main/java/apijson/demo/server/Verifier.java
@@ -126,7 +126,10 @@ public static boolean verify(SQLConfig config, User visitor) throws Exception {
 			return true;
 		}
 		RequestRole role = config.getRole();
-
+		if (role == null) {
+			role = RequestRole.UNKNOWN;
+		}
+		
 		long userId = visitor == null ? 0 : visitor.getId();
 		//TODO 暂时去掉，方便测试
 		if (role != RequestRole.UNKNOWN) {//未登录的角色
@@ -143,9 +146,7 @@ public static boolean verify(SQLConfig config, User visitor) throws Exception {
 		String userIdkey = Controller.USER_.equals(config.getTable()) || Controller.PRIVACY_.equals(config.getTable())
 				? Controller.ID : Controller.USER_ID;
 
-		if (role == null) {
-			role = RequestRole.UNKNOWN;
-		}
+		Number requestId;
 		switch (role) {
 		case LOGIN://verifyRole通过就行
 			break;
@@ -160,7 +161,7 @@ public static boolean verify(SQLConfig config, User visitor) throws Exception {
 			}
 
 			//key!{}:[] 或 其它没有明确id的条件 等 可以和key{}:list组合。类型错误就报错
-			Number requestId = (Number) config.getWhere(userIdkey, true);//JSON里数值不能保证是Long，可能是Integer
+			requestId = (Number) config.getWhere(userIdkey, true);//JSON里数值不能保证是Long，可能是Integer
 			JSONArray requestIdArray = (JSONArray) config.getWhere(userIdkey + "{}", true);//不能是 &{}， |{} 不要传，直接{}
 			if (requestId != null) {
 				if (requestIdArray == null) {
@@ -181,16 +182,18 @@ public static boolean verify(SQLConfig config, User visitor) throws Exception {
 						throw new UnsupportedDataTypeException(table + ".id类型错误，id类型必须是Long！");
 					}
 					if (list.contains(new Long("" + id)) == false) {//Integer等转为Long才能正确判断。强转崩溃
-						if (method == null) {
-							method = GET;
-						}
 						throw new IllegalAccessException(userIdkey + " = " + id + " 的 " + table
 								+ " 不允许 " + role.name() + " 用户的 " + method.name() + " 请求！");
 					}
 				}
 			}
 			break;
 		case OWNER:
+			requestId = (Number) config.getWhere(userIdkey, true);//JSON里数值不能保证是Long，可能是Integer
+			if (requestId != null && requestId.longValue() != userId) {
+				throw new IllegalAccessException(userIdkey + " = " + requestId + " 的 " + table
+						+ " 不允许 " + role.name() + " 用户的 " + method.name() + " 请求！");
+			}
 			config.addWhere(userIdkey, userId);
 			break;
 		case ADMIN://这里不好做，在特定接口内部判断？ TODO  /get/admin + 固定秘钥  Parser#noVerify，之后全局跳过验证
@@ -253,9 +256,9 @@ public static void verifyLogin(Long userId) throws Exception {
 			throw new NotLoggedInException("未登录，请登录后再操作！");
 		}
 	}
-	
-	
-	
+
+
+
 	/**验证是否重复
 	 * @param table
 	 * @param key
@@ -296,7 +299,7 @@ public static void verifyRepeat(String table, String key, Object value, long exc
 			throw new ConflictException(key + ": " + value + " 已经存在，不能重复！");
 		}
 	}
-	
+
 
 	/**获取来访用户的id
 	 * @author Lemon
diff --git a/APIJSON-Java-Server/APIJSON-Eclipse/src/main/java/zuo/biao/apijson/server/sql/SQLConfig.java b/APIJSON-Java-Server/APIJSON-Eclipse/src/main/java/zuo/biao/apijson/server/sql/SQLConfig.java
@@ -160,6 +160,7 @@ public SQLConfig(RequestMethod method, int count, int page) {
 		setPage(page);
 	}
 
+	@NotNull
 	public RequestMethod getMethod() {
 		if (method == null) {
 			method = GET;
@@ -182,6 +183,7 @@ public SQLConfig setId(long id) {
 	}
 
 	public RequestRole getRole() {
+		//不能 @NotNull , Parser#getSQLObject 内当getRole() == null时填充默认值
 		return role;
 	}
 	public SQLConfig setRole(String roleName) {

Original file line number	Diff line number	Diff line change
`@@ -160,6 +160,7 @@ public SQLConfig(RequestMethod method, int count, int page) {`
`160`	`160`	`setPage(page);`
`161`	`161`	`}`
`162`	`162`
	`163`	`+ @NotNull`
`163`	`164`	`public RequestMethod getMethod() {`
`164`	`165`	`if (method == null) {`
`165`	`166`	`method = GET;`
`@@ -182,6 +183,7 @@ public SQLConfig setId(long id) {`
`182`	`183`	`}`
`183`	`184`
`184`	`185`	`public RequestRole getRole() {`
	`186`	`+ //不能 @NotNull , Parser#getSQLObject 内当getRole() == null时填充默认值`
`185`	`187`	`return role;`
`186`	`188`	`}`
`187`	`189`	`public SQLConfig setRole(String roleName) {`