From 535a53a6bfc31742fbc35e9723548dc83fc98f12 Mon Sep 17 00:00:00 2001
From: Yen <yen1130@qq.com>
Date: Thu, 25 Jul 2024 11:26:59 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20=E9=98=B2=E6=AD=A2=E8=B6=8A=E6=9D=83?=
 =?UTF-8?q?=E6=8F=90=E4=BA=A4?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../vtb/service/impl/VtbVerificationBatchServiceImpl.java   | 6 +++++-
 .../vtb/service/impl/VtbVerificationServiceImpl.java        | 5 +++++
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/src/main/java/com/qs/serve/modules/vtb/service/impl/VtbVerificationBatchServiceImpl.java b/src/main/java/com/qs/serve/modules/vtb/service/impl/VtbVerificationBatchServiceImpl.java
index 8b2f5f0b..28d8b47d 100644
--- a/src/main/java/com/qs/serve/modules/vtb/service/impl/VtbVerificationBatchServiceImpl.java
+++ b/src/main/java/com/qs/serve/modules/vtb/service/impl/VtbVerificationBatchServiceImpl.java
@@ -105,7 +105,11 @@ public class VtbVerificationBatchServiceImpl extends ServiceImpl<VtbVerification
         redisService.throwResLock(VtbVerificationBatch.class.getSimpleName(),submitBo.getCostApplyId()+"");
         // 校验核销状态
         VerificationUtil.verifyCostState(costApply);
-
+        if(!costApply.getCreateBy().equals(sysUser.getId())
+                &&costApply.getExtUserId()!=null
+                &&!costApply.getExtUserId().equals(sysUser.getId())){
+            Assert.throwEx("越权提交被拦截了");
+        }
         boolean contractFlag = costApply.getContractFlag()!=null&&costApply.getContractFlag().equals(1);
         if(contractFlag){
             Assert.throwEx("协议类申请请移至OA核销");
diff --git a/src/main/java/com/qs/serve/modules/vtb/service/impl/VtbVerificationServiceImpl.java b/src/main/java/com/qs/serve/modules/vtb/service/impl/VtbVerificationServiceImpl.java
index 3807a329..b1a531cf 100644
--- a/src/main/java/com/qs/serve/modules/vtb/service/impl/VtbVerificationServiceImpl.java
+++ b/src/main/java/com/qs/serve/modules/vtb/service/impl/VtbVerificationServiceImpl.java
@@ -699,6 +699,11 @@ public class VtbVerificationServiceImpl extends ServiceImpl<VtbVerificationMappe
         TbsCostApply costApply = costApplyService.getById(activity.getCostApplyId());
         SysUser sysUser = sysUserService.getById(AuthContextUtils.getSysUserId());
         BmsSupplier supplier = bmsSupplierService.getById(activity.getSupplierId());
+        if(!costApply.getCreateBy().equals(sysUser.getId())
+                &&costApply.getExtUserId()!=null
+                &&!costApply.getExtUserId().equals(sysUser.getId())){
+            Assert.throwEx("越权提交被拦截了");
+        }
         sysUser.checkSyAccount();
         redisService.throwResLock(VtbVerification.class.getSimpleName(),activity.getId()+"");
         //自定义成本中心核销