[security vulnerability] Free Payment of Orders

[GatekeeperBuster]

Recently, our team found a vulnerability causing the free payment of orders in the latest version of the project.

The vulnerability logic is present in the file:
https://github.com/macrozheng/mall/blob/master/mall-portal/src/main/java/com/macro/mall/portal/service/impl/OmsPortalOrderServiceImpl.java#L246

The issue arises from the lack of verification of the user's privilege level when updating the order status using orderMapper.updateByPrimaryKeySelective(). Additionally, access to the corresponding callback API /order/paySuccess (located at: https://github.com/macrozheng/mall/blob/master/mall-portal/src/main/java/com/macro/mall/portal/controller/OmsPortalOrderController.java#L51) has not been restricted to the normal user. As a result, attackers can manipulate the param orderId and change the payment status of unpaid orders to achieve free payment.

To address this vulnerability, we recommend that developers implement access control policies to restrict the modification of order status.