fix version 1

module/ec/mall/internal/logic/store/set_setting.go

@@ -8,13 +8,14 @@ import (
 	"bsm/full/module/ec/mall/internal/models"
 	pb "bsm/full/module/ec/mall/pb"
 	"git.apinb.com/bsm-sdk/core/errcode"
+	"git.apinb.com/bsm-sdk/core/printer"
 	"git.apinb.com/bsm-sdk/core/service"
 )
 
 // 设置店铺基础配置
 func SetSetting(ctx context.Context, in *pb.StoreBasic) (reply *pb.IdentityStatusReply, err error) {
 	// parse authorization meta.
-	_, err = service.ParseMetaCtx(ctx, &service.ParseOptions{RoleValue: "Mall_Admin"})
+	auth, err := service.ParseMetaCtx(ctx, &service.ParseOptions{RoleValue: "Mall_Admin"})
 	if err != nil {
 		return nil, err
 	}
@@ -22,6 +23,13 @@ func SetSetting(ctx context.Context, in *pb.StoreBasic) (reply *pb.IdentityStatu
 		return nil, errcode.ErrInvalidArgument
 	}
 
+	// 只能修改当前登录者所属店铺的配置，禁止凭请求参数改他人店铺
+	owner, _ := auth.Owner.(map[string]any)
+	storeIdentity, _ := owner["store_identity"].(string)
+	if storeIdentity == "" || in.GetIdentity() != storeIdentity {
+		return nil, errcode.ErrPermissionDenied
+	}
+
 	data := &models.MallStore{
 		Logo:      in.Logo,
 		Title:     in.Title,
@@ -31,12 +39,15 @@ func SetSetting(ctx context.Context, in *pb.StoreBasic) (reply *pb.IdentityStatu
 		Configs:   in.Configs,
 	}
 
-	if err := impl.DBService.Model(&models.MallStore{}).Where("id=? or identity=?", in.GetId(), in.GetIdentity()).Updates(data).Error; err != nil {
-		print(err.Error())
+	tx := impl.DBService.Model(&models.MallStore{}).Where("identity = ?", storeIdentity).Updates(data)
+	if tx.Error != nil {
+		printer.Error(tx.Error.Error())
 		return nil, errcode.ErrDB
 	}
+	if tx.RowsAffected == 0 {
+		return nil, errcode.ErrPermissionDenied
+	}
 
-	// TODO: add your logic code & delete this line.
 	return &pb.IdentityStatusReply{
 		Code:    0,
 		Message: "OK",