From ce0ccc49ee532ba6d5afcdbda97f6ecda62f5ffe Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E7=A7=A6=E9=B8=BF=E5=B1=95?= <18031053041@163.com> Date: Wed, 25 Feb 2026 13:49:02 +0800 Subject: [PATCH] =?UTF-8?q?BMS=E5=BA=94=E6=94=B6=E7=AE=A1=E7=90=86?= =?UTF-8?q?=E5=88=97=E8=A1=A8=E6=9F=A5=E8=AF=A2=E6=95=B0=E6=8D=AE=E9=9A=94?= =?UTF-8?q?=E7=A6=BB?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../BillManageApplicationService.java | 46 +++++++++++++++++-- .../ReceiptManageApplicationService.java | 46 +++++++++++++++++-- .../resources/mapper/BillManageMapper.xml | 3 ++ .../resources/mapper/ReceiptManageMapper.xml | 3 ++ 4 files changed, 90 insertions(+), 8 deletions(-) diff --git a/mhd_bms/src/main/java/com/mhd/bms/application/server/billManage/BillManageApplicationService.java b/mhd_bms/src/main/java/com/mhd/bms/application/server/billManage/BillManageApplicationService.java index ff58b8a28..d714b7f33 100644 --- a/mhd_bms/src/main/java/com/mhd/bms/application/server/billManage/BillManageApplicationService.java +++ b/mhd_bms/src/main/java/com/mhd/bms/application/server/billManage/BillManageApplicationService.java @@ -77,10 +77,48 @@ public class BillManageApplicationService { public List queryList(BillManageDO billManageDO) { LoginUser loginUser = SecurityUtils.getLoginUser(); - if (loginUser != null){ - Long topOrganizationId = loginUser.getUserPo().getTopOrganizationId(); - if (topOrganizationId != null && topOrganizationId != 1){ - billManageDO.setTopOrganizationId(loginUser.getUserPo().getTopOrganizationId()); + if (loginUser != null && loginUser.getUserPo() != null) { + Long userOrganizationId = loginUser.getUserPo().getOrganizationId(); + Long frontendOrganizationId = billManageDO.getOrganizationId(); // 前端传递的 organizationId + + // 当前登录用户的 organizationId 为 2827 时，可查全部组织数据；其他组织只能查自己 + if (userOrganizationId != null && userOrganizationId == 2827L) { + // 南光组织（organizationId=2827）：可以查询所有组织的数据 + if (frontendOrganizationId != null) { + // 前端传递了 organizationId（包括2827或其他组织），使用前端传递的值进行过滤 + billManageDO.setOrganizationId(frontendOrganizationId); + billManageDO.setTopOrganizationId(null); // 明确设置为 null，避免使用 topOrganizationId 条件 + } else { + // 前端没有传递 organizationId，清空组织过滤条件，查询所有组织的数据 + billManageDO.setOrganizationId(null); + billManageDO.setTopOrganizationId(null); + } + } else { + // 其他组织：设置organizationId，只查询当前组织的数据 + // 如果前端传递了 organizationId，验证是否与当前登录用户的组织ID一致 + if (frontendOrganizationId != null && userOrganizationId != null) { + // 前端传递了 organizationId，验证是否与当前登录用户的组织ID一致 + if (!frontendOrganizationId.equals(userOrganizationId)) { + // 前端传递了其他组织的 organizationId，强制使用当前登录用户的组织ID，防止越权查询 + billManageDO.setOrganizationId(userOrganizationId); + } + // 如果前端传递的 organizationId 与当前登录用户的组织ID一致，使用前端传递的值 + } else { + // 前端没有传递 organizationId，使用当前登录用户的组织ID + if (userOrganizationId != null) { + billManageDO.setOrganizationId(userOrganizationId); + } + } + // 如果 organizationId 不为 null，则优先使用 organizationId，不使用 topOrganizationId + if (billManageDO.getOrganizationId() == null) { + Long topOrganizationId = loginUser.getUserPo().getTopOrganizationId(); + if (topOrganizationId != null && topOrganizationId != 1) { + billManageDO.setTopOrganizationId(topOrganizationId); + } + } else { + // 如果 organizationId 不为 null，清空 topOrganizationId，确保查询使用 organizationId + billManageDO.setTopOrganizationId(null); + } } } return billManageDomainService.queryList(billManageDO); diff --git a/mhd_bms/src/main/java/com/mhd/bms/application/server/receiptManage/ReceiptManageApplicationService.java b/mhd_bms/src/main/java/com/mhd/bms/application/server/receiptManage/ReceiptManageApplicationService.java index 3e1c3aa4b..9ff2f29e5 100644 --- a/mhd_bms/src/main/java/com/mhd/bms/application/server/receiptManage/ReceiptManageApplicationService.java +++ b/mhd_bms/src/main/java/com/mhd/bms/application/server/receiptManage/ReceiptManageApplicationService.java @@ -47,10 +47,48 @@ public class ReceiptManageApplicationService { public List queryList(ReceiptManageDO receiptManageDO) { LoginUser loginUser = SecurityUtils.getLoginUser(); - if (loginUser != null){ - Long topOrganizationId = loginUser.getUserPo().getTopOrganizationId(); - if (topOrganizationId != null && topOrganizationId != 1){ - receiptManageDO.setTopOrganizationId(loginUser.getUserPo().getTopOrganizationId()); + if (loginUser != null && loginUser.getUserPo() != null) { + Long userOrganizationId = loginUser.getUserPo().getOrganizationId(); + Long frontendOrganizationId = receiptManageDO.getOrganizationId(); // 前端传递的 organizationId + + // 当前登录用户的 organizationId 为 2827 时，可查全部组织数据；其他组织只能查自己 + if (userOrganizationId != null && userOrganizationId == 2827L) { + // 南光组织（organizationId=2827）：可以查询所有组织的数据 + if (frontendOrganizationId != null) { + // 前端传递了 organizationId（包括2827或其他组织），使用前端传递的值进行过滤 + receiptManageDO.setOrganizationId(frontendOrganizationId); + receiptManageDO.setTopOrganizationId(null); // 明确设置为 null，避免使用 topOrganizationId 条件 + } else { + // 前端没有传递 organizationId，清空组织过滤条件，查询所有组织的数据 + receiptManageDO.setOrganizationId(null); + receiptManageDO.setTopOrganizationId(null); + } + } else { + // 其他组织：设置organizationId，只查询当前组织的数据 + // 如果前端传递了 organizationId，验证是否与当前登录用户的组织ID一致 + if (frontendOrganizationId != null && userOrganizationId != null) { + // 前端传递了 organizationId，验证是否与当前登录用户的组织ID一致 + if (!frontendOrganizationId.equals(userOrganizationId)) { + // 前端传递了其他组织的 organizationId，强制使用当前登录用户的组织ID，防止越权查询 + receiptManageDO.setOrganizationId(userOrganizationId); + } + // 如果前端传递的 organizationId 与当前登录用户的组织ID一致，使用前端传递的值 + } else { + // 前端没有传递 organizationId，使用当前登录用户的组织ID + if (userOrganizationId != null) { + receiptManageDO.setOrganizationId(userOrganizationId); + } + } + // 如果 organizationId 不为 null，则优先使用 organizationId，不使用 topOrganizationId + if (receiptManageDO.getOrganizationId() == null) { + Long topOrganizationId = loginUser.getUserPo().getTopOrganizationId(); + if (topOrganizationId != null && topOrganizationId != 1) { + receiptManageDO.setTopOrganizationId(topOrganizationId); + } + } else { + // 如果 organizationId 不为 null，清空 topOrganizationId，确保查询使用 organizationId + receiptManageDO.setTopOrganizationId(null); + } } } return receiptManageDomainService.queryList(receiptManageDO); diff --git a/mhd_bms/src/main/resources/mapper/BillManageMapper.xml b/mhd_bms/src/main/resources/mapper/BillManageMapper.xml index 85de3326b..7c92e8e5a 100644 --- a/mhd_bms/src/main/resources/mapper/BillManageMapper.xml +++ b/mhd_bms/src/main/resources/mapper/BillManageMapper.xml @@ -25,6 +25,9 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" AND create_by_name like concat('%', #{billManageDO.createByName}, '%') + + AND organization_id = #{billManageDO.organizationId} + AND top_organization_id = #{billManageDO.topOrganizationId} diff --git a/mhd_bms/src/main/resources/mapper/ReceiptManageMapper.xml b/mhd_bms/src/main/resources/mapper/ReceiptManageMapper.xml index d45b4b2e6..faf9a34ae 100644 --- a/mhd_bms/src/main/resources/mapper/ReceiptManageMapper.xml +++ b/mhd_bms/src/main/resources/mapper/ReceiptManageMapper.xml @@ -33,6 +33,9 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" AND a.create_by_name like concat('%', #{receiptManageDO.createByName}, '%') + + AND a.organization_id = #{receiptManageDO.organizationId} + AND a.top_organization_id = #{receiptManageDO.topOrganizationId}