{"record":{"id":"3fade0db8f4bb1fe","repo":"paascloud/paascloud-master","slug":"uac10011023-3fade0","errorCode":"UAC10011023","errorMessage":"ErrorCodeEnum.UAC10011023","messagePattern":"ErrorCodeEnum\\.UAC10011023","errorType":"error_code","errorClass":"UacBizException","httpStatus":null,"severity":"warning","filePath":"paascloud-provider/paascloud-provider-uac/src/main/java/com/paascloud/provider/service/impl/UacUserServiceImpl.java","lineNumber":264,"sourceCode":"\t\t}\n\n\t}\n\n\t@Override\n\t@Transactional(readOnly = true, rollbackFor = Exception.class)\n\tpublic List<UacLog> queryUserLogListWithUserId(Long userId) {\n\t\tif (PublicUtil.isEmpty(userId)) {\n\t\t\tthrow new UacBizException(ErrorCodeEnum.UAC10011001);\n\t\t}\n\t\treturn uacLogService.selectUserLogListByUserId(userId);\n\t}\n\n\t@Override\n\tpublic int modifyUserStatusById(UacUser uacUser, LoginAuthDto authResDto) {\n\t\tLong loginUserId = authResDto.getUserId();\n\t\tLong userId = uacUser.getId();\n\t\tif (loginUserId.equals(userId)) {\n\t\t\tthrow new UacBizException(ErrorCodeEnum.UAC10011023);\n\t\t}\n\t\tUacUser u = uacUserMapper.selectByPrimaryKey(userId);\n\t\tif (u == null) {\n\t\t\tthrow new UacBizException(ErrorCodeEnum.UAC10011011, userId);\n\t\t}\n\n\t\t// 更新用户最后修改人与修改时间\n\t\tuacUser.setVersion(u.getVersion() + 1);\n\t\tuacUser.setUpdateInfo(authResDto);\n\t\treturn uacUserMapper.updateByPrimaryKeySelective(uacUser);\n\t}\n\n\t@Override\n\tpublic void bindUserRoles(BindUserRolesDto bindUserRolesDto, LoginAuthDto authResDto) {\n\n\t\tif (bindUserRolesDto == null) {\n\t\t\tlogger.error(\"参数不能为空\");\n\t\t\tthrow new IllegalArgumentException(\"参数不能为空\");","sourceCodeStart":246,"sourceCodeEnd":282,"githubUrl":"https://github.com/paascloud/paascloud-master/blob/781281a9503332ed3cef44ea618349d14230a127/paascloud-provider/paascloud-provider-uac/src/main/java/com/paascloud/provider/service/impl/UacUserServiceImpl.java#L246-L282","documentation":"UacBizException with ErrorCodeEnum.UAC10011023 (\"越权操作\", privilege escalation attempt) is thrown by UacUserServiceImpl.modifyUserStatusById when the logged-in user attempts to change their own status. Self-modification of account status (enable/disable) is forbidden to prevent users from disabling themselves.","triggerScenarios":"Calling modifyUserStatusById with a UacUser whose id equals authResDto.getUserId() — i.e., the admin API is invoked with the caller's own userId as the target.","commonSituations":"Admin UI's user list includes the current admin's own row and the enable/disable button isn't hidden; scripts iterating all users and toggling status hit their own account; stale authResDto from a reused session.","solutions":["Do not call modifyUserStatusById for the currently logged-in user; filter out the current user's row in the UI","Catch UacBizException with code 10011023 and show 'you cannot modify your own status'","Compare IDs client-side (targetUserId == currentUserId) and disable the action beforehand"],"exampleFix":"// before\nuacUserService.modifyUserStatusById(target, authResDto);\n// after\nif (!Objects.equals(target.getId(), authResDto.getUserId())) {\n    uacUserService.modifyUserStatusById(target, authResDto);\n} else {\n    throw new BusinessException(\"不能修改自己的状态\");\n}","handlingStrategy":"validation","validationCode":"if (Objects.equals(targetUser.getId(), authResDto.getUserId())) {\n    throw new BusinessException(\"cannot modify your own status\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    uacUserService.modifyUserStatusById(uacUser, authResDto);\n} catch (UacBizException e) {\n    if (e.getCode() == 10011023) { /* show 'self-modification not allowed' */ }\n    else throw e;\n}","preventionTips":["Exclude the current login user's row from status-toggle UI","Check target vs current id before any admin user operation"],"tags":["authorization","privilege-escalation","user-management"],"backgroundTag":"permission-denied","analyzedSha":"781281a9503332ed3cef44ea618349d14230a127","analyzedAt":"2026-09-10T10:59:02.070Z","contentChangedAt":"2026-09-10T10:59:02.070Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}