【严重安全漏洞】用户可加入任意租户 #9196

jeecgboot模式的租户未做申请加入租户和审批逻辑，所以这俩接口注释掉

jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysTenantController.java

@@ -507,26 +507,26 @@ public class SysTenantController {
         return result;
     }
 
-    /**
-     * 加入租户通过门牌号【低代码应用专用接口】
-     * @param sysTenant
-     */
-    @PostMapping("/joinTenantByHouseNumber")
-    public Result<Integer> joinTenantByHouseNumber(@RequestBody SysTenant sysTenant){
-        LoginUser sysUser = (LoginUser) SecurityUtils.getSubject().getPrincipal();
-        Integer tenantId = sysTenantService.joinTenantByHouseNumber(sysTenant, sysUser.getId());
-        Result<Integer> result = new Result<>();
-        if(tenantId != 0){
-            result.setMessage("申请加入组织成功");
-            result.setSuccess(true);
-            result.setResult(tenantId);
-            return result;
-        }else{
-            result.setMessage("该门牌号不存在");
-            result.setSuccess(false);
-            return result;
-        }
-    }
+//    /**
+//     * 加入租户通过门牌号【低代码应用专用接口】
+//     * @param sysTenant
+//     */
+//    @PostMapping("/joinTenantByHouseNumber")
+//    public Result<Integer> joinTenantByHouseNumber(@RequestBody SysTenant sysTenant){
+//        LoginUser sysUser = (LoginUser) SecurityUtils.getSubject().getPrincipal();
+//        Integer tenantId = sysTenantService.joinTenantByHouseNumber(sysTenant, sysUser.getId());
+//        Result<Integer> result = new Result<>();
+//        if(tenantId != 0){
+//            result.setMessage("申请加入组织成功");
+//            result.setSuccess(true);
+//            result.setResult(tenantId);
+//            return result;
+//        }else{
+//            result.setMessage("该门牌号不存在");
+//            result.setSuccess(false);
+//            return result;
+//        }
+//    }
     
     /**
      * 分页获取租户用户数据(vue3用户租户页面)【低代码应用专用接口】
@@ -713,6 +713,7 @@ public class SysTenantController {
      * @return
      */
     @PostMapping("/invitationUser")
+    @RequiresPermissions("system:tenant:invitation:user")
     public Result<String> invitationUser(@RequestParam(name="phone") String phone,
                                          @RequestParam(name="departId",defaultValue = "") String departId){
         return sysTenantService.invitationUser(phone,departId);
@@ -911,43 +912,43 @@ public class SysTenantController {
         return Result.ok(pageList);
     }
 
-    /**
-     * 同意或拒绝加入租户
-     */
-    @PutMapping("/agreeOrRefuseJoinTenant")
-    public Result<String> agreeOrRefuseJoinTenant(@RequestParam("tenantId") Integer tenantId, 
-                                                  @RequestParam("status") String status){
-        //是否开启系统管理模块的多租户数据隔离【SAAS多租户模式】
-        LoginUser sysUser = (LoginUser) SecurityUtils.getSubject().getPrincipal();
-        String userId = sysUser.getId();
-        SysTenant tenant = sysTenantService.getById(tenantId);
-        if(null == tenant){
-            return Result.error("不存在该组织");
-        }
-        SysUserTenant sysUserTenant = relationService.getUserTenantByTenantId(userId, tenantId);
-        if (null == sysUserTenant) {
-            return Result.error("该用户不存在该组织中，无权修改");
-        }
-        String content = "";
-        SysUser user = new SysUser();
-        user.setUsername(sysUserTenant.getCreateBy());
-        String realname = oConvertUtils.getString(sysUser.getRealname(),sysUser.getUsername());
-        //成功加入
-        if(CommonConstant.USER_TENANT_NORMAL.equals(status)){
-            //修改租户状态
-            relationService.agreeJoinTenant(userId,tenantId);
-            content = content + realname + "已同意您发送的加入 " + tenant.getName() + " 的邀请";
-            sysTenantService.sendMsgForAgreeAndRefuseJoin(user, content);
-            return Result.OK("您已同意该组织的邀请");
-        }else if(CommonConstant.USER_TENANT_REFUSE.equals(status)){
-            //直接删除关系表即可
-            relationService.refuseJoinTenant(userId,tenantId);
-            content = content + realname + "拒绝了您发送的加入 " + tenant.getName() + " 的邀请";
-            sysTenantService.sendMsgForAgreeAndRefuseJoin(user, content);
-            return Result.OK("您已成功拒绝该组织的邀请");
-        }
-        return Result.error("类型不匹配，禁止修改数据");
-    }
+//    /**
+//     * 同意或拒绝加入租户
+//     */
+//    @PutMapping("/agreeOrRefuseJoinTenant")
+//    public Result<String> agreeOrRefuseJoinTenant(@RequestParam("tenantId") Integer tenantId, 
+//                                                  @RequestParam("status") String status){
+//        //是否开启系统管理模块的多租户数据隔离【SAAS多租户模式】
+//        LoginUser sysUser = (LoginUser) SecurityUtils.getSubject().getPrincipal();
+//        String userId = sysUser.getId();
+//        SysTenant tenant = sysTenantService.getById(tenantId);
+//        if(null == tenant){
+//            return Result.error("不存在该组织");
+//        }
+//        SysUserTenant sysUserTenant = relationService.getUserTenantByTenantId(userId, tenantId);
+//        if (null == sysUserTenant) {
+//            return Result.error("该用户不存在该组织中，无权修改");
+//        }
+//        String content = "";
+//        SysUser user = new SysUser();
+//        user.setUsername(sysUserTenant.getCreateBy());
+//        String realname = oConvertUtils.getString(sysUser.getRealname(),sysUser.getUsername());
+//        //成功加入
+//        if(CommonConstant.USER_TENANT_NORMAL.equals(status)){
+//            //修改租户状态
+//            relationService.agreeJoinTenant(userId,tenantId);
+//            content = content + realname + "已同意您发送的加入 " + tenant.getName() + " 的邀请";
+//            sysTenantService.sendMsgForAgreeAndRefuseJoin(user, content);
+//            return Result.OK("您已同意该组织的邀请");
+//        }else if(CommonConstant.USER_TENANT_REFUSE.equals(status)){
+//            //直接删除关系表即可
+//            relationService.refuseJoinTenant(userId,tenantId);
+//            content = content + realname + "拒绝了您发送的加入 " + tenant.getName() + " 的邀请";
+//            sysTenantService.sendMsgForAgreeAndRefuseJoin(user, content);
+//            return Result.OK("您已成功拒绝该组织的邀请");
+//        }
+//        return Result.error("类型不匹配，禁止修改数据");
+//    }
     
     /**
      * 目前只给敲敲云租户下删除用户使用