Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

修复：只有超级管理员账号可以修改自己资料BUG #69

Open
wants to merge 1 commit into
base: thinkphp
Choose a base branch
from
Open

修复：只有超级管理员账号可以修改自己资料BUG #69

wants to merge 1 commit into from

Conversation

hhun
Copy link

@hhun hhun commented May 21, 2024

修改自己账号的资料，无需鉴权。

@JaguarJack
Copy link
Owner

auth 不光包含权限 还包含 token 认证的

@hhun
Copy link
Author

hhun commented May 21, 2024 •
edited
Loading

auth 不光包含权限 还包含 token 认证的

token 没有认证时，$request->user()->id 等于 0
更新是 id=0 的数据，系统没有id为0的数据，也就不会修改任何数据。
所以没有登陆时，不鉴权就修改不了别人的数据。

@JaguarJack
Copy link
Owner

JaguarJack commented May 22, 2024 •
edited
Loading

auth 不光包含权限 还包含 token 认证的

token 没有认证时，$request->user()->id 等于 0 更新是 id=0 的数据，系统没有id为0的数据，也就不会修改任何数据。 所以没有登陆时，不鉴权就修改不了别人的数据。

从功能层面的确没问题，但是从严格的代码层面，最好还是加上 token 认证的 middleware

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@hhun @JaguarJack