服务器端授权缺失使任何经过认证的用户都可以升级为平台管理员

public boolean interceptorCheck(HttpServletRequest request, HttpServletResponse response,
                                 String requestMappingValue, List<String> whiteMappingValues) throws IOException {
    if (StringUtils.isEmpty(requestMappingValue)) { ...; return false; }
    for (String mapping : whiteMappingValues) {
        if (requestMappingValue.contains(mapping)) return true;
    }
    if (!this.hasLoginValid(request)) {
        this.logout(request, response);
        return false;
    }
    String operator = HttpRequestUtil.getOperator(request);
    User user = this.userService.getUserByUserName(operator);
    if (user == null) throw new LogiSecurityException(ResultCode.USER_NOT_EXISTS);
    this.initLoginContext(request, response, operator, user.getId());
    return true;
}