{"record":{"id":"4d551f3a1ca33d00","repo":"paascloud/paascloud-master","slug":"uac10011023-4d551f","errorCode":"UAC10011023","errorMessage":"越权操作","messagePattern":"越权操作","errorType":"error_code","errorClass":"UacBizException","httpStatus":null,"severity":"error","filePath":"paascloud-provider/paascloud-provider-uac/src/main/java/com/paascloud/provider/web/admin/UacUserMainController.java","lineNumber":157,"sourceCode":"\t\tint result = uacUserService.deleteUserById(userId);\n\t\treturn handleResult(result);\n\t}\n\n\t/**\n\t * 获取用户绑定角色页面数据.\n\t *\n\t * @param userId the user id\n\t *\n\t * @return the bind role\n\t */\n\t@PostMapping(value = \"/getBindRole/{userId}\")\n\t@ApiOperation(httpMethod = \"POST\", value = \"获取用户绑定角色页面数据\")\n\tpublic Wrapper<UserBindRoleVo> getBindRole(@ApiParam(name = \"userId\", value = \"角色id\") @PathVariable Long userId) {\n\t\tlogger.info(\"获取用户绑定角色页面数据. userId={}\", userId);\n\t\tLoginAuthDto loginAuthDto = super.getLoginAuthDto();\n\t\tLong currentUserId = loginAuthDto.getUserId();\n\t\tif (Objects.equals(userId, currentUserId)) {\n\t\t\tthrow new UacBizException(ErrorCodeEnum.UAC10011023);\n\t\t}\n\n\t\tUserBindRoleVo bindUserDto = uacUserService.getUserBindRoleDto(userId);\n\t\treturn WrapMapper.ok(bindUserDto);\n\t}\n\n\t/**\n\t * 用户绑定角色.\n\t *\n\t * @param bindUserRolesDto the bind user roles dto\n\t *\n\t * @return the wrapper\n\t */\n\t@PostMapping(value = \"/bindRole\")\n\t@LogAnnotation\n\t@ApiOperation(httpMethod = \"POST\", value = \"用户绑定角色\")\n\tpublic Wrapper<Integer> bindUserRoles(@ApiParam(name = \"bindUserRolesDto\", value = \"用户绑定角色Dto\") @RequestBody BindUserRolesDto bindUserRolesDto) {\n\t\tlogger.info(\"用户绑定角色 bindUserRolesDto={}\", bindUserRolesDto);","sourceCodeStart":139,"sourceCodeEnd":175,"githubUrl":"https://github.com/paascloud/paascloud-master/blob/781281a9503332ed3cef44ea618349d14230a127/paascloud-provider/paascloud-provider-uac/src/main/java/com/paascloud/provider/web/admin/UacUserMainController.java#L139-L175","documentation":"UacBizException with code UAC10011023 thrown by UacUserMainController.getBindRole when the requested userId equals the currently authenticated user's id. Users are not permitted to view their own role-binding page, as a safeguard against self-modification of role assignments.","triggerScenarios":"POST /user/bindRole/{userId} (getBindRole) where the path userId equals loginAuthDto.getUserId(), i.e. an admin opens the bind-role page for their own account.","commonSituations":"Admin clicking 'bind roles' on their own row in the user management UI; scripted bulk fetch of bind-role data that includes the caller's own id; UI not filtering out the current user from the actionable list.","solutions":["Request the bind-role data for a different userId than the logged-in user","Filter the current user out of the UI list before offering the bind-role action","Handle UAC10011023 in the client and show a 'cannot manage your own roles' message","If self-management is required, the business rule in getBindRole must be changed in code"],"exampleFix":"// before\nPOST /user/bindRole/1001  // current user id is 1001 -> 越权操作\n// after\nPOST /user/bindRole/1002  // target a different user, or manage own roles via a dedicated flow","handlingStrategy":"try-catch","validationCode":"if (targetUserId === currentUserId) {\n  showNotice('不能管理自己的角色绑定');\n  return; // don't call the API\n}","typeGuard":"function canViewBindRole(targetUserId, currentUserId) { return targetUserId !== currentUserId; }","tryCatchPattern":"try { return await getBindRole(userId); }\ncatch (e) {\n  if (String(e.message).includes('越权操作')) {\n    // show 'cannot manage own roles' and redirect to user list\n  }\n}","preventionTips":["Filter the logged-in user out of actionable rows in the user management UI","Check target userId against the session user before calling bind-role endpoints","Treat self-role-management as forbidden in UX design","Return a friendly message when UAC10011023 is received"],"tags":["authorization","rest-api","business-rule"],"backgroundTag":"permission-denied","analyzedSha":"781281a9503332ed3cef44ea618349d14230a127","analyzedAt":"2026-09-10T10:59:02.070Z","contentChangedAt":"2026-09-10T10:59:02.070Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}