weiaisuosi/nanguangszwlback
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

BMS计费管理列表查询数据隔离

Browse Source
This commit is contained in:
秦鸿展
2026-02-25 11:45:09 +08:00
parent 1426aa9d11
commit bcc777539a
7 changed files with 147 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mhd_bms/src/main/java/com/mhd/bms/application/server/billingStatement/BillingStatementApplicationService.java
+83 -8
View File
@@ -72,10 +72,47 @@ public class BillingStatementApplicationService {
public List<BillingStatementPO> queryList(BillingStatementDO billingStatementDO) {
LoginUser loginUser = SecurityUtils.getLoginUser();
if (loginUser != null) {
Long topOrganizationId = loginUser.getUserPo().getTopOrganizationId();
if (topOrganizationId != null && topOrganizationId != 1) {
billingStatementDO.setTopOrganizationId(loginUser.getUserPo().getTopOrganizationId());
if (loginUser != null && loginUser.getUserPo() != null) {
Long userOrganizationId = loginUser.getUserPo().getOrganizationId();
Long frontendOrganizationId = billingStatementDO.getOrganizationId(); // 前端传递的 organizationId
// 当前登录用户的 organizationId 为 2827 时，可查全部组织数据；其他组织只能查自己
if (userOrganizationId != null && userOrganizationId == 2827L) {
// 南光组织（organizationId=2827）：可以查询所有组织的数据
if (frontendOrganizationId != null) {
// 前端传递了 organizationId（包括2827或其他组织），使用前端传递的值进行过滤
billingStatementDO.setOrganizationId(frontendOrganizationId);
billingStatementDO.setTopOrganizationId(null); // 明确设置为 null，避免使用 topOrganizationId 条件
} else {
// 前端没有传递 organizationId，清空组织过滤条件，查询所有组织的数据
billingStatementDO.setOrganizationId(null);
billingStatementDO.setTopOrganizationId(null);
}
} else {
// 其他组织：设置organizationId，只查询当前组织的数据
// 如果前端传递了 organizationId，验证是否与当前登录用户的组织ID一致
if (frontendOrganizationId != null && userOrganizationId != null) {
// 前端传递了 organizationId，验证是否与当前登录用户的组织ID一致
if (!frontendOrganizationId.equals(userOrganizationId)) {
// 前端传递了其他组织的 organizationId，强制使用当前登录用户的组织ID，防止越权查询
billingStatementDO.setOrganizationId(userOrganizationId);
}
// 如果前端传递的 organizationId 与当前登录用户的组织ID一致，使用前端传递的值
} else {
// 前端没有传递 organizationId，使用当前登录用户的组织ID
if (userOrganizationId != null) {
billingStatementDO.setOrganizationId(userOrganizationId);
}
}
// 如果 organizationId 不为 null，则优先使用 organizationId，不使用 topOrganizationId
if (billingStatementDO.getOrganizationId() == null) {
Long topOrganizationId = loginUser.getUserPo().getTopOrganizationId();
if (topOrganizationId != null && topOrganizationId != 1) {
billingStatementDO.setTopOrganizationId(topOrganizationId);
}
} else {
// 如果 organizationId 不为 null，清空 topOrganizationId，确保查询使用 organizationId
billingStatementDO.setTopOrganizationId(null);
}
}
}
return billingStatementDomainService.queryList(billingStatementDO);
@@ -86,10 +123,48 @@ public class BillingStatementApplicationService {
*/
public List<BillingStatementCollectPO> queryCollectList(BillingStatementCollectDO billingStatementCollectDO) {
LoginUser loginUser = SecurityUtils.getLoginUser();
if (loginUser != null) {
Long topOrganizationId = loginUser.getUserPo().getTopOrganizationId();
if (topOrganizationId != null && topOrganizationId != 1) {
billingStatementCollectDO.setTopOrganizationId(loginUser.getUserPo().getTopOrganizationId());
if (loginUser != null && loginUser.getUserPo() != null) {
Long userOrganizationId = loginUser.getUserPo().getOrganizationId();
Long frontendOrganizationId = billingStatementCollectDO.getOrganizationId(); // 前端传递的 organizationId
// 当前登录用户的 organizationId 为 2827 时，可查全部组织数据；其他组织只能查自己
if (userOrganizationId != null && userOrganizationId == 2827L) {
// 南光组织（organizationId=2827）：可以查询所有组织的数据
if (frontendOrganizationId != null) {
// 前端传递了 organizationId（包括2827或其他组织），使用前端传递的值进行过滤
billingStatementCollectDO.setOrganizationId(frontendOrganizationId);
billingStatementCollectDO.setTopOrganizationId(null); // 明确设置为 null，避免使用 topOrganizationId 条件
} else {
// 前端没有传递 organizationId，清空组织过滤条件，查询所有组织的数据
billingStatementCollectDO.setOrganizationId(null);
billingStatementCollectDO.setTopOrganizationId(null);
}
} else {
// 其他组织：设置organizationId，只查询当前组织的数据
// 如果前端传递了 organizationId，验证是否与当前登录用户的组织ID一致
if (frontendOrganizationId != null && userOrganizationId != null) {
// 前端传递了 organizationId，验证是否与当前登录用户的组织ID一致
if (!frontendOrganizationId.equals(userOrganizationId)) {
// 前端传递了其他组织的 organizationId，强制使用当前登录用户的组织ID，防止越权查询
billingStatementCollectDO.setOrganizationId(userOrganizationId);
}
// 如果前端传递的 organizationId 与当前登录用户的组织ID一致，使用前端传递的值
} else {
// 前端没有传递 organizationId，使用当前登录用户的组织ID
if (userOrganizationId != null) {
billingStatementCollectDO.setOrganizationId(userOrganizationId);
}
}
// 如果 organizationId 不为 null，则优先使用 organizationId，不使用 topOrganizationId
if (billingStatementCollectDO.getOrganizationId() == null) {
Long topOrganizationId = loginUser.getUserPo().getTopOrganizationId();
if (topOrganizationId != null && topOrganizationId != 1) {
billingStatementCollectDO.setTopOrganizationId(topOrganizationId);
}
} else {
// 如果 organizationId 不为 null，清空 topOrganizationId，确保查询使用 organizationId
billingStatementCollectDO.setTopOrganizationId(null);
}
}
}
return billingStatementDomainService.queryCollectList(billingStatementCollectDO);
mhd_bms/src/main/java/com/mhd/bms/application/server/businessDocument/BusinessDocumentApplicationService.java
+42 -4
View File
@@ -84,10 +84,48 @@ public class BusinessDocumentApplicationService {
public List<BusinessDocumentPO> queryList(BusinessDocumentDO businessDocumentDO) {
LoginUser loginUser = SecurityUtils.getLoginUser();
if (loginUser != null){
Long topOrganizationId = loginUser.getUserPo().getTopOrganizationId();
if (topOrganizationId != null && topOrganizationId != 1){
businessDocumentDO.setTopOrganizationId(loginUser.getUserPo().getTopOrganizationId());
if (loginUser != null && loginUser.getUserPo() != null) {
Long userOrganizationId = loginUser.getUserPo().getOrganizationId();
Long frontendOrganizationId = businessDocumentDO.getOrganizationId(); // 前端传递的 organizationId
// 当前登录用户的 organizationId 为 2827 时，可查全部组织数据；其他组织只能查自己
if (userOrganizationId != null && userOrganizationId == 2827L) {
// 南光组织（organizationId=2827）：可以查询所有组织的数据
if (frontendOrganizationId != null) {
// 前端传递了 organizationId（包括2827或其他组织），使用前端传递的值进行过滤
businessDocumentDO.setOrganizationId(frontendOrganizationId);
businessDocumentDO.setTopOrganizationId(null); // 明确设置为 null，避免使用 topOrganizationId 条件
} else {
// 前端没有传递 organizationId，清空组织过滤条件，查询所有组织的数据
businessDocumentDO.setOrganizationId(null);
businessDocumentDO.setTopOrganizationId(null);
}
} else {
// 其他组织：设置organizationId，只查询当前组织的数据
// 如果前端传递了 organizationId，验证是否与当前登录用户的组织ID一致
if (frontendOrganizationId != null && userOrganizationId != null) {
// 前端传递了 organizationId，验证是否与当前登录用户的组织ID一致
if (!frontendOrganizationId.equals(userOrganizationId)) {
// 前端传递了其他组织的 organizationId，强制使用当前登录用户的组织ID，防止越权查询
businessDocumentDO.setOrganizationId(userOrganizationId);
}
// 如果前端传递的 organizationId 与当前登录用户的组织ID一致，使用前端传递的值
} else {
// 前端没有传递 organizationId，使用当前登录用户的组织ID
if (userOrganizationId != null) {
businessDocumentDO.setOrganizationId(userOrganizationId);
}
}
// 如果 organizationId 不为 null，则优先使用 organizationId，不使用 topOrganizationId
if (businessDocumentDO.getOrganizationId() == null) {
Long topOrganizationId = loginUser.getUserPo().getTopOrganizationId();
if (topOrganizationId != null && topOrganizationId != 1) {
businessDocumentDO.setTopOrganizationId(topOrganizationId);
}
} else {
// 如果 organizationId 不为 null，清空 topOrganizationId，确保查询使用 organizationId
businessDocumentDO.setTopOrganizationId(null);
}
}
}
return businessDocumentDomainService.queryList(businessDocumentDO);
mhd_bms/src/main/java/com/mhd/bms/domain/billingStatement/repository/po/BillingStatementCollectPO.java
+3
View File
@@ -51,6 +51,9 @@ public class BillingStatementCollectPO extends BaseVOEntity {
@ApiModelProperty("所属组织")
private String organizationName;
@ApiModelProperty("组织ID")
private Long organizationId;
@ApiModelProperty("一级组织表ID")
private Long topOrganizationId;
mhd_bms/src/main/java/com/mhd/bms/domain/billingStatement/repository/todo/BillingStatementCollectDO.java
+3
View File
@@ -45,6 +45,9 @@ public class BillingStatementCollectDO extends BaseVOEntity {
@ApiModelProperty("所属组织")
private String organizationName;
@ApiModelProperty("组织ID")
private Long organizationId;
@ApiModelProperty("一级组织表ID")
private Long topOrganizationId;
mhd_bms/src/main/java/com/mhd/bms/interfaces/dto/billingStatement/BillingStatementCollectDTO.java
+3
View File
@@ -44,6 +44,9 @@ public class BillingStatementCollectDTO extends BaseVOEntity {
@ApiModelProperty("所属组织")
private String organizationName;
@ApiModelProperty("组织ID")
private Long organizationId;
@ApiModelProperty("一级组织表ID")
private Long topOrganizationId;