paascloud/paascloud-master · warning · UacBizException

UAC10011023

UAC10011023

Error message

ErrorCodeEnum.UAC10011023

What it means

UacBizException with ErrorCodeEnum.UAC10011023 ("越权操作", privilege escalation attempt) is thrown by UacUserServiceImpl.modifyUserStatusById when the logged-in user attempts to change their own status. Self-modification of account status (enable/disable) is forbidden to prevent users from disabling themselves.

Solutions

1. Do not call modifyUserStatusById for the currently logged-in user; filter out the current user's row in the UI
2. Catch UacBizException with code 10011023 and show 'you cannot modify your own status'
3. Compare IDs client-side (targetUserId == currentUserId) and disable the action beforehand

Example fix

// before
uacUserService.modifyUserStatusById(target, authResDto);
// after
if (!Objects.equals(target.getId(), authResDto.getUserId())) {
    uacUserService.modifyUserStatusById(target, authResDto);
} else {
    throw new BusinessException("不能修改自己的状态");
}

if (Objects.equals(targetUser.getId(), authResDto.getUserId())) {
    throw new BusinessException("cannot modify your own status");
}

try {
    uacUserService.modifyUserStatusById(uacUser, authResDto);
} catch (UacBizException e) {
    if (e.getCode() == 10011023) { /* show 'self-modification not allowed' */ }
    else throw e;
}

When it happens

Trigger: Calling modifyUserStatusById with a UacUser whose id equals authResDto.getUserId() — i.e., the admin API is invoked with the caller's own userId as the target.

Common situations: Admin UI's user list includes the current admin's own row and the enable/disable button isn't hidden; scripts iterating all users and toggling status hit their own account; stale authResDto from a reused session.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• UAC10011040
• UAC10011023
• UAC10011025
• UAC10011026
• UAC10011001

AI-assisted analysis of paascloud/paascloud-master@781281a950 (2026-09-10). Data as JSON: /api/errors/3fade0db8f4bb1fe. Report an issue: GitHub.

Appendix: source

Thrown at paascloud-provider/paascloud-provider-uac/src/main/java/com/paascloud/provider/service/impl/UacUserServiceImpl.java:264

		}

	}

	@Override
	@Transactional(readOnly = true, rollbackFor = Exception.class)
	public List<UacLog> queryUserLogListWithUserId(Long userId) {
		if (PublicUtil.isEmpty(userId)) {
			throw new UacBizException(ErrorCodeEnum.UAC10011001);
		}
		return uacLogService.selectUserLogListByUserId(userId);
	}

	@Override
	public int modifyUserStatusById(UacUser uacUser, LoginAuthDto authResDto) {
		Long loginUserId = authResDto.getUserId();
		Long userId = uacUser.getId();
		if (loginUserId.equals(userId)) {
			throw new UacBizException(ErrorCodeEnum.UAC10011023);
		}
		UacUser u = uacUserMapper.selectByPrimaryKey(userId);
		if (u == null) {
			throw new UacBizException(ErrorCodeEnum.UAC10011011, userId);
		}

		// 更新用户最后修改人与修改时间
		uacUser.setVersion(u.getVersion() + 1);
		uacUser.setUpdateInfo(authResDto);
		return uacUserMapper.updateByPrimaryKeySelective(uacUser);
	}

	@Override
	public void bindUserRoles(BindUserRolesDto bindUserRolesDto, LoginAuthDto authResDto) {

		if (bindUserRolesDto == null) {
			logger.error("参数不能为空");
			throw new IllegalArgumentException("参数不能为空");

View on GitHub (pinned to 781281a950)