weiaisuosi/nanguangszwlback
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

BMS应收管理列表查询数据隔离

Browse Source
This commit is contained in:
秦鸿展
2026-02-25 13:49:02 +08:00
parent b8732e7139
commit ce0ccc49ee
4 changed files with 90 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mhd_bms/src/main/java/com/mhd/bms/application/server/billManage/BillManageApplicationService.java
+42 -4
View File
@@ -77,10 +77,48 @@ public class BillManageApplicationService {
public List<BillManagePO> queryList(BillManageDO billManageDO) {
LoginUser loginUser = SecurityUtils.getLoginUser();
if (loginUser != null){
Long topOrganizationId = loginUser.getUserPo().getTopOrganizationId();
if (topOrganizationId != null && topOrganizationId != 1){
billManageDO.setTopOrganizationId(loginUser.getUserPo().getTopOrganizationId());
if (loginUser != null && loginUser.getUserPo() != null) {
Long userOrganizationId = loginUser.getUserPo().getOrganizationId();
Long frontendOrganizationId = billManageDO.getOrganizationId(); // 前端传递的 organizationId
// 当前登录用户的 organizationId 为 2827 时，可查全部组织数据；其他组织只能查自己
if (userOrganizationId != null && userOrganizationId == 2827L) {
// 南光组织（organizationId=2827）：可以查询所有组织的数据
if (frontendOrganizationId != null) {
// 前端传递了 organizationId（包括2827或其他组织），使用前端传递的值进行过滤
billManageDO.setOrganizationId(frontendOrganizationId);
billManageDO.setTopOrganizationId(null); // 明确设置为 null，避免使用 topOrganizationId 条件
} else {
// 前端没有传递 organizationId，清空组织过滤条件，查询所有组织的数据
billManageDO.setOrganizationId(null);
billManageDO.setTopOrganizationId(null);
}
} else {
// 其他组织：设置organizationId，只查询当前组织的数据
// 如果前端传递了 organizationId，验证是否与当前登录用户的组织ID一致
if (frontendOrganizationId != null && userOrganizationId != null) {
// 前端传递了 organizationId，验证是否与当前登录用户的组织ID一致
if (!frontendOrganizationId.equals(userOrganizationId)) {
// 前端传递了其他组织的 organizationId，强制使用当前登录用户的组织ID，防止越权查询
billManageDO.setOrganizationId(userOrganizationId);
}
// 如果前端传递的 organizationId 与当前登录用户的组织ID一致，使用前端传递的值
} else {
// 前端没有传递 organizationId，使用当前登录用户的组织ID
if (userOrganizationId != null) {
billManageDO.setOrganizationId(userOrganizationId);
}
}
// 如果 organizationId 不为 null，则优先使用 organizationId，不使用 topOrganizationId
if (billManageDO.getOrganizationId() == null) {
Long topOrganizationId = loginUser.getUserPo().getTopOrganizationId();
if (topOrganizationId != null && topOrganizationId != 1) {
billManageDO.setTopOrganizationId(topOrganizationId);
}
} else {
// 如果 organizationId 不为 null，清空 topOrganizationId，确保查询使用 organizationId
billManageDO.setTopOrganizationId(null);
}
}
}
return billManageDomainService.queryList(billManageDO);
mhd_bms/src/main/java/com/mhd/bms/application/server/receiptManage/ReceiptManageApplicationService.java
+42 -4
View File
@@ -47,10 +47,48 @@ public class ReceiptManageApplicationService {
public List<ReceiptManagePO> queryList(ReceiptManageDO receiptManageDO) {
LoginUser loginUser = SecurityUtils.getLoginUser();
if (loginUser != null){
Long topOrganizationId = loginUser.getUserPo().getTopOrganizationId();
if (topOrganizationId != null && topOrganizationId != 1){
receiptManageDO.setTopOrganizationId(loginUser.getUserPo().getTopOrganizationId());
if (loginUser != null && loginUser.getUserPo() != null) {
Long userOrganizationId = loginUser.getUserPo().getOrganizationId();
Long frontendOrganizationId = receiptManageDO.getOrganizationId(); // 前端传递的 organizationId
// 当前登录用户的 organizationId 为 2827 时，可查全部组织数据；其他组织只能查自己
if (userOrganizationId != null && userOrganizationId == 2827L) {
// 南光组织（organizationId=2827）：可以查询所有组织的数据
if (frontendOrganizationId != null) {
// 前端传递了 organizationId（包括2827或其他组织），使用前端传递的值进行过滤
receiptManageDO.setOrganizationId(frontendOrganizationId);
receiptManageDO.setTopOrganizationId(null); // 明确设置为 null，避免使用 topOrganizationId 条件
} else {
// 前端没有传递 organizationId，清空组织过滤条件，查询所有组织的数据
receiptManageDO.setOrganizationId(null);
receiptManageDO.setTopOrganizationId(null);
}
} else {
// 其他组织：设置organizationId，只查询当前组织的数据
// 如果前端传递了 organizationId，验证是否与当前登录用户的组织ID一致
if (frontendOrganizationId != null && userOrganizationId != null) {
// 前端传递了 organizationId，验证是否与当前登录用户的组织ID一致
if (!frontendOrganizationId.equals(userOrganizationId)) {
// 前端传递了其他组织的 organizationId，强制使用当前登录用户的组织ID，防止越权查询
receiptManageDO.setOrganizationId(userOrganizationId);
}
// 如果前端传递的 organizationId 与当前登录用户的组织ID一致，使用前端传递的值
} else {
// 前端没有传递 organizationId，使用当前登录用户的组织ID
if (userOrganizationId != null) {
receiptManageDO.setOrganizationId(userOrganizationId);
}
}
// 如果 organizationId 不为 null，则优先使用 organizationId，不使用 topOrganizationId
if (receiptManageDO.getOrganizationId() == null) {
Long topOrganizationId = loginUser.getUserPo().getTopOrganizationId();
if (topOrganizationId != null && topOrganizationId != 1) {
receiptManageDO.setTopOrganizationId(topOrganizationId);
}
} else {
// 如果 organizationId 不为 null，清空 topOrganizationId，确保查询使用 organizationId
receiptManageDO.setTopOrganizationId(null);
}
}
}
return receiptManageDomainService.queryList(receiptManageDO);
mhd_bms/src/main/resources/mapper/BillManageMapper.xml
+3
View File
@@ -25,6 +25,9 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
<if test="billManageDO.createByName != null and billManageDO.createByName != ''">
AND create_by_name like concat('%', #{billManageDO.createByName}, '%')
</if>
<if test="billManageDO.organizationId != null">
AND organization_id = #{billManageDO.organizationId}
</if>
<if test="billManageDO.topOrganizationId != null and billManageDO.topOrganizationId != ''">
AND top_organization_id = #{billManageDO.topOrganizationId}
</if>
mhd_bms/src/main/resources/mapper/ReceiptManageMapper.xml
+3
View File
@@ -33,6 +33,9 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
<if test="receiptManageDO.createByName != null and receiptManageDO.createByName != ''">
AND a.create_by_name like concat('%', #{receiptManageDO.createByName}, '%')
</if>
<if test="receiptManageDO.organizationId != null">
AND a.organization_id = #{receiptManageDO.organizationId}
</if>
<if test="receiptManageDO.topOrganizationId != null and receiptManageDO.topOrganizationId != ''">
AND a.top_organization_id = #{receiptManageDO.topOrganizationId}
</if>