From dbc7c6a3e94d270bf3da9b83e7c593bd719ee497 Mon Sep 17 00:00:00 2001 From: Austin Date: Thu, 15 Oct 2026 13:02:32 +0800 Subject: [PATCH] =?UTF-8?q?fix(avatar):=20=E7=A7=9F=E6=88=B7=E8=B7=AF?= =?UTF-8?q?=E5=BE=84=E6=96=87=E4=BB=B6=20ACL=20=E8=A1=A5=E9=BD=90=E5=A4=B4?= =?UTF-8?q?=E5=83=8F=E6=94=BE=E8=A1=8C=E6=9D=A1?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit fileMapper.UserHasAccess 恒经 TenantFileUserHasAccess，共享库多租户 模式走 tenant_adapter 的 SQL；此前第 9 条（头像链接行对登录用户放行） 只加在了基础路径 FileUserHasAccess，导致共享库环境下他人下载头像仍 403。同步补齐，与 FileUserHasAccess 保持一致。 --- server/db/mysql/tenant_adapter.go | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/server/db/mysql/tenant_adapter.go b/server/db/mysql/tenant_adapter.go index c7d458c..98e4ccb 100644 --- a/server/db/mysql/tenant_adapter.go +++ b/server/db/mysql/tenant_adapter.go @@ -5585,6 +5585,17 @@ func (a *adapter) TenantFileUserHasAccess(id t.TenantID, fid string, uid t.Uid) WHERE gf.tenant_id=fu.tenant_id AND (gf.file_id=? OR gf.file_id LIKE CONCAT(?,'.%%')) AND gf.status='active' AND s.deletedat IS NULL AND INSTR(s.modewant,'R')>0 AND INSTR(s.modegiven,'R')>0 ) + OR EXISTS ( + -- 用户头像/资料文件：设置头像时写入的链接行有两种形态—— + -- userid 形态（topic/msgid 为 NULL，userid=头像主人）与 + -- 纯数字 uid topic 形态（store 层已把 usr 前缀 topic 归一为 userid 形态）。 + -- 头像属于公开资料，对任何登录用户放行；与 FileUserHasAccess 的第 9 条保持一致。 + SELECT 1 FROM im_filemsglinks AS fml + WHERE fml.tenant_id=fu.tenant_id AND fml.fileid=fu.id AND fml.msgid IS NULL AND ( + (fml.topic IS NULL AND fml.userid IS NOT NULL) + OR fml.topic REGEXP '^[0-9]+$' + ) + ) ) LIMIT 1`, tenantFriendshipsTable(id), tenantMessagesTable(id))), id, decodeUID(fileID), fileID.String32(), "%/"+fileID.String32(), t.UploadCompleted, decodeUID(uid), decodeUID(uid), decodeUID(uid), t.RelationshipFriend, decodeUID(uid), decodeUID(uid), t.GroupMemberStatusActive, decodeUID(uid), decodeUID(uid),