go-admin-server

go-admin-server copied to clipboard

code in https://github.com/anerg2046/go-admin-server/blob/master/app/http/repo/Role.go , the function Assign . when giving someone privileges it will remove the user's all privileges first. In some Race Conditions , it will make user lose privileges

exploit: requests the api in 50 threads ,

comm users has no privileges,and the slow sql log see delete all the user's casbin_rule

and you can not login the system .

已修改casbin为多协程模式，请更新子模块lib，实际上这个问题核心是casbin的问题，因为最终要落到数据库，如果数据库操作出问题了，casbin的权限管理就会出问题。不过一般来说，对用户的权限操作不会出现并发问题。