Merge pull request #2448 from liuliaozhong/3.7.x_issue_2111

fix: 作业模板编辑鉴权时未校验关联的查看权限 #2111
TencentBlueKing · Sep 15, 2023 · 22f2be3 · 22f2be3
2 parents 19c9138 + 2aaf2a0
commit 22f2be3
Showing 1 changed file with 11 additions and 1 deletion.
diff --git a/...anage/src/main/java/com/tencent/bk/job/manage/api/web/impl/WebPermissionResourceImpl.java b/...anage/src/main/java/com/tencent/bk/job/manage/api/web/impl/WebPermissionResourceImpl.java
@@ -234,10 +234,20 @@ private Response<AuthResultVO> checkJobTemplateOperationPermission(
                 );
             case "edit":
                 templateId = Long.parseLong(resourceId);
+                AuthResult authEditResult = templateAuthService.authEditJobTemplate(
+                    username,
+                    appResourceScope,
+                    templateId
+                );
+                AuthResult authViewResult = templateAuthService.authViewJobTemplate(
+                    username,
+                    appResourceScope,
+                    templateId
+                );
                 return Response.buildSuccessResp(
                     webAuthService.toAuthResultVO(
                         isReturnApplyUrl,
-                        templateAuthService.authEditJobTemplate(username, appResourceScope, templateId)
+                        authEditResult.mergeAuthResult(authViewResult)
                     )
                 );
             case "delete":