ruoyi-common/ruoyi-common-satoken/src/main/java/org/dromara/common/satoken/core/dao/PlusSaTokenDao.java

@@ -53,7 +53,11 @@ public class PlusSaTokenDao implements SaTokenDaoBySessionFollowObject {
         if (timeout == NEVER_EXPIRE) {
             RedisUtils.setCacheObject(key, value);
         } else {
-            RedisUtils.setCacheObject(key, value, Duration.ofSeconds(timeout));
+            if (RedisUtils.hasKey(key)) {
+                RedisUtils.setCacheObject(key, value, true);
+            } else {
+                RedisUtils.setCacheObject(key, value, Duration.ofSeconds(timeout));
+            }
         }
         CAFFEINE.invalidate(key);
     }
@@ -130,7 +134,11 @@ public class PlusSaTokenDao implements SaTokenDaoBySessionFollowObject {
         if (timeout == NEVER_EXPIRE) {
             RedisUtils.setCacheObject(key, object);
         } else {
-            RedisUtils.setCacheObject(key, object, Duration.ofSeconds(timeout));
+            if (RedisUtils.hasKey(key)) {
+                RedisUtils.setCacheObject(key, object, true);
+            } else {
+                RedisUtils.setCacheObject(key, object, Duration.ofSeconds(timeout));
+            }
         }
         CAFFEINE.invalidate(key);
     }

ruoyi-modules/ruoyi-workflow/src/main/java/org/dromara/workflow/common/enums/TaskStatusEnum.java

@@ -100,15 +100,5 @@ public enum TaskStatusEnum {
         return STATUS_DESC_MAP.getOrDefault(status, StrUtil.EMPTY);
     }
 
-    /**
-     * 判断状态是否为通过或退回
-     *
-     * @param status 状态值
-     * @return true 表示是通过或退回状态
-     */
-    public static boolean isPassOrBack(String status) {
-        return PASS.getStatus().equals(status) || BACK.getStatus().equals(status);
-    }
-
 }
 

ruoyi-modules/ruoyi-workflow/src/main/java/org/dromara/workflow/controller/FlwCategoryController.java

@@ -66,6 +66,7 @@ public class FlwCategoryController extends BaseController {
     @SaCheckPermission("workflow:category:query")
     @GetMapping("/{categoryId}")
     public R<FlowCategoryVo> getInfo(@NotNull(message = "主键不能为空") @PathVariable Long categoryId) {
+        flwCategoryService.checkCategoryDataScope(categoryId);
         return R.ok(flwCategoryService.queryById(categoryId));
     }
 
@@ -92,6 +93,7 @@ public class FlwCategoryController extends BaseController {
     @PutMapping()
     public R<Void> edit(@Validated(EditGroup.class) @RequestBody FlowCategoryBo category) {
         Long categoryId = category.getCategoryId();
+        flwCategoryService.checkCategoryDataScope(categoryId);
         if (!flwCategoryService.checkCategoryNameUnique(category)) {
             return R.fail("修改流程分类'" + category.getCategoryName() + "'失败，流程分类名称已存在");
         } else if (category.getParentId().equals(categoryId)) {

ruoyi-modules/ruoyi-workflow/src/main/java/org/dromara/workflow/listener/WorkflowGlobalListener.java

@@ -83,7 +83,8 @@ public class WorkflowGlobalListener implements GlobalListener {
         String applyNodeCode = flwCommonService.applyNodeCode(definition.getId());
         for (Task flowTask : nextTasks) {
             // 如果办理或者退回并行存在需要指定办理人，则直接覆盖办理人
-            if (variable.containsKey(flowTask.getNodeCode()) && TaskStatusEnum.isPassOrBack(flowParams.getHisStatus())) {
+            if (variable.containsKey(flowTask.getNodeCode()) && (TaskStatusEnum.PASS.getStatus().equals(flowParams.getHisStatus())
+                || TaskStatusEnum.BACK.getStatus().equals(flowParams.getHisStatus()))) {
                 String userIds = variable.get(flowTask.getNodeCode()).toString();
                 flowTask.setPermissionList(List.of(userIds.split(StringUtils.SEPARATOR)));
                 variable.remove(flowTask.getNodeCode());
@@ -136,7 +137,8 @@ public class WorkflowGlobalListener implements GlobalListener {
             return;
         }
         // 只有办理或者退回的时候才执行消息通知和抄送
-        if (!TaskStatusEnum.isPassOrBack(flowParams.getHisStatus())) {
+        if (!StringUtils.equalsAny(flowParams.getHisStatus(),
+            TaskStatusEnum.PASS.getStatus(), TaskStatusEnum.BACK.getStatus())) {
             return;
         }
         if (ObjectUtil.isNull(variable)) {

ruoyi-modules/ruoyi-workflow/src/main/java/org/dromara/workflow/mapper/FlwCategoryMapper.java

@@ -20,6 +20,19 @@ import java.util.stream.Stream;
  */
 public interface FlwCategoryMapper extends BaseMapperPlus<FlowCategory, FlowCategoryVo> {
 
+    /**
+     * 统计指定流程分类ID的分类数量
+     *
+     * @param categoryId 流程分类ID
+     * @return 该流程分类ID的分类数量
+     */
+    @DataPermission({
+        @DataColumn(key = "deptName", value = "createDept")
+    })
+    default long countCategoryById(Long categoryId) {
+        return this.selectCount(new LambdaQueryWrapper<FlowCategory>().eq(FlowCategory::getCategoryId, categoryId));
+    }
+
     /**
      * 根据父流程分类ID查询其所有子流程分类的列表
      *

ruoyi-modules/ruoyi-workflow/src/main/java/org/dromara/workflow/service/IFlwCategoryService.java

@@ -45,6 +45,13 @@ public interface IFlwCategoryService {
      */
     List<Tree<String>> selectCategoryTreeList(FlowCategoryBo category);
 
+    /**
+     * 校验流程分类是否有数据权限
+     *
+     * @param categoryId 流程分类ID
+     */
+    void checkCategoryDataScope(Long categoryId);
+
     /**
      * 校验流程分类名称是否唯一
      *

ruoyi-modules/ruoyi-workflow/src/main/java/org/dromara/workflow/service/impl/FlwCategoryServiceImpl.java

@@ -13,6 +13,7 @@ import org.dromara.common.core.utils.ObjectUtils;
 import org.dromara.common.core.utils.StringUtils;
 import org.dromara.common.core.utils.TreeBuildUtils;
 import org.dromara.common.mybatis.helper.DataBaseHelper;
+import org.dromara.common.satoken.utils.LoginHelper;
 import org.dromara.warm.flow.core.service.DefService;
 import org.dromara.warm.flow.orm.entity.FlowDefinition;
 import org.dromara.workflow.common.ConditionalOnEnable;
@@ -25,7 +26,6 @@ import org.dromara.workflow.service.IFlwCategoryService;
 import org.springframework.cache.annotation.CacheEvict;
 import org.springframework.cache.annotation.Cacheable;
 import org.springframework.stereotype.Service;
-import org.springframework.transaction.annotation.Transactional;
 
 import java.util.ArrayList;
 import java.util.List;
@@ -107,6 +107,24 @@ public class FlwCategoryServiceImpl implements IFlwCategoryService {
         );
     }
 
+    /**
+     * 校验流程分类是否有数据权限
+     *
+     * @param categoryId 流程分类ID
+     */
+    @Override
+    public void checkCategoryDataScope(Long categoryId) {
+        if (ObjectUtil.isNull(categoryId)) {
+            return;
+        }
+        if (LoginHelper.isSuperAdmin()) {
+            return;
+        }
+        if (baseMapper.countCategoryById(categoryId) == 0) {
+            throw new ServiceException("没有权限访问流程分类数据！");
+        }
+    }
+
     /**
      * 校验流程分类名称是否唯一
      *
@@ -169,9 +187,6 @@ public class FlwCategoryServiceImpl implements IFlwCategoryService {
     @Override
     public int insertByBo(FlowCategoryBo bo) {
         FlowCategory info = baseMapper.selectById(bo.getParentId());
-        if (ObjectUtil.isNull(info)) {
-            throw new ServiceException("父级流程分类不存在!");
-        }
         FlowCategory category = MapstructUtils.convert(bo, FlowCategory.class);
         category.setAncestors(info.getAncestors() + StringUtils.SEPARATOR + category.getParentId());
         return baseMapper.insert(category);
@@ -185,7 +200,6 @@ public class FlwCategoryServiceImpl implements IFlwCategoryService {
      */
     @CacheEvict(cacheNames = FlowConstant.FLOW_CATEGORY_NAME, key = "#bo.categoryId")
     @Override
-    @Transactional(rollbackFor = Exception.class)
     public int updateByBo(FlowCategoryBo bo) {
         FlowCategory category = MapstructUtils.convert(bo, FlowCategory.class);
         FlowCategory oldCategory = baseMapper.selectById(category.getCategoryId());
@@ -193,14 +207,14 @@ public class FlwCategoryServiceImpl implements IFlwCategoryService {
             throw new ServiceException("流程分类不存在，无法修改");
         }
         if (!oldCategory.getParentId().equals(category.getParentId())) {
+            // 如果是新父流程分类 则校验是否具有新父流程分类权限 避免越权
+            this.checkCategoryDataScope(category.getParentId());
             FlowCategory newParentCategory = baseMapper.selectById(category.getParentId());
             if (ObjectUtil.isNotNull(newParentCategory)) {
                 String newAncestors = newParentCategory.getAncestors() + StringUtils.SEPARATOR + newParentCategory.getCategoryId();
                 String oldAncestors = oldCategory.getAncestors();
                 category.setAncestors(newAncestors);
                 updateCategoryChildren(category.getCategoryId(), newAncestors, oldAncestors);
-            } else {
-                throw new ServiceException("父级流程分类不存在!");
             }
         } else {
             category.setAncestors(oldCategory.getAncestors());