Browse Source

修复:同一 uri 挂在多个菜单下时权限校验误判无权限

三个独立活动(净亏邀请、首充奖励、转盘)共用 admin/promotion 等按钮 uri,
checkMenu 只取第一条菜单比对 role_menu,角色仅授权转盘下的同名按钮时被拒。
改为同 uri 的任一菜单被授权即通过;uri 为空直接判无权限。

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
doge 21 hours ago
parent
commit
611eb23252
1 changed files with 4 additions and 4 deletions
  1. 4 4
      app/Services/MenuService.php

+ 4 - 4
app/Services/MenuService.php

@@ -199,11 +199,11 @@ class MenuService extends BaseService
         if($userId == 1){
             return true;
         }else{
-            $info = self::findOne(['uri' => $uri ,'status' => self::model()::STATUS_SHOW]);
-            if($info){
-                $menuId = $info->id;
+            // 同一 uri 可能挂在多个菜单下(如三个独立活动共用 admin/promotion),任一被授权即可
+            $menuIds = $uri === '' ? [] : self::findAll(['uri' => $uri ,'status' => self::model()::STATUS_SHOW])->pluck('id')->toArray();
+            if($menuIds){
                 $roleIds = RoleUserService::$MODEL::where('user_id',$userId)->pluck('role_id')->toArray();
-                $result = RoleMenuService::$MODEL::where('menu_id', $menuId)->whereIn('role_id', $roleIds)->count();
+                $result = RoleMenuService::$MODEL::whereIn('menu_id', $menuIds)->whereIn('role_id', $roleIds)->count();
                
                 if($result){
                     return true;