From df2a55b8408a40232fd45abdd0b73d91e79ba950 Mon Sep 17 00:00:00 2001
From: chenyuan <chenyuan@example.com>
Date: Tue, 23 Jun 2026 15:33:22 +0800
Subject: [PATCH] fix: guard student updates by class owner

---
 .../controller/stu/UserController.java            | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/src/main/java/com/sztzjy/linkCommerce/controller/stu/UserController.java b/src/main/java/com/sztzjy/linkCommerce/controller/stu/UserController.java
index 7893d3c..0c3c6f2 100644
--- a/src/main/java/com/sztzjy/linkCommerce/controller/stu/UserController.java
+++ b/src/main/java/com/sztzjy/linkCommerce/controller/stu/UserController.java
@@ -852,7 +852,15 @@ public class UserController {
     @PostMapping("/updateStudent")
     @ApiOperation("学生管理-编辑学生账号信息")
     @AnonymousAccess
-    public ResultEntity updateStudent(@RequestBody Userinfo userInfo) {
+    public ResultEntity updateStudent(@RequestBody Userinfo userInfo, @RequestParam(required = false) String operatorId) {
+        String targetClassId = userInfo.getSchoolClassId();
+        if (StringUtils.isBlank(targetClassId) && StringUtils.isNotBlank(userInfo.getUserId())) {
+            Userinfo existing = userinfoMapper.selectByPrimaryKey(userInfo.getUserId());
+            targetClassId = existing == null ? null : existing.getSchoolClassId();
+        }
+        if (StringUtils.isNotBlank(operatorId) && !canOperateClass(operatorId, targetClassId)) {
+            return new ResultEntity<>(HttpStatus.BAD_REQUEST, "只能维护自己创建班级的学生");
+        }
         int i = userinfoMapper.updateByPrimaryKey(userInfo);
         if (i == 1) {
             return new ResultEntity<>(HttpStatus.OK, "编辑学生账号信息成功！");
@@ -879,7 +887,10 @@ public class UserController {
     @PostMapping("/updateStudentPassword")
     @ApiOperation("学生管理-初始化密码")
     @AnonymousAccess
-    public ResultEntity updateStudentPassword(@RequestParam String userId) {
+    public ResultEntity updateStudentPassword(@RequestParam String userId, @RequestParam(required = false) String operatorId) {
+        if (StringUtils.isNotBlank(operatorId) && !canOperateStudent(operatorId, userId)) {
+            return new ResultEntity<>(HttpStatus.BAD_REQUEST, "只能维护自己创建班级的学生");
+        }
         Userinfo userInfo = userinfoMapper.selectByPrimaryKey(userId);
         userInfo.setPassword("123qwe");
         int i = userinfoMapper.updateByPrimaryKey(userInfo);