From 3d572dfd62ba581e1b0fb11df40eca72c7fef9a9 Mon Sep 17 00:00:00 2001
From: "han\\hanst" <songtao.han@xujiesoft.com>
Date: Thu, 27 Aug 2026 15:46:20 +0800
Subject: [PATCH] =?UTF-8?q?=E5=8F=AA=E8=83=BD=E6=9F=A5=E7=9C=8B=E5=B7=B2?=
 =?UTF-8?q?=E7=BB=8F=E6=8E=88=E6=9D=83=E7=9A=84bu=E6=95=B0=E6=8D=AE?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../controller/ProofingInformationController.java   | 13 +++++++++++--
 .../mapper/pms/ProofingInformationMapper.xml        | 10 ++++++++++
 2 files changed, 21 insertions(+), 2 deletions(-)

diff --git a/src/main/java/com/xujie/sys/modules/pms/controller/ProofingInformationController.java b/src/main/java/com/xujie/sys/modules/pms/controller/ProofingInformationController.java
index 1b101ef9..5f4b5c4c 100644
--- a/src/main/java/com/xujie/sys/modules/pms/controller/ProofingInformationController.java
+++ b/src/main/java/com/xujie/sys/modules/pms/controller/ProofingInformationController.java
@@ -385,7 +385,10 @@ public class ProofingInformationController {
     @PostMapping(value = "/queryAllProofing2")
     @ResponseBody
     public R queryAllProofing2(@RequestBody QuerySavedVo querySavedVo) {
-        String userId = String.valueOf(((SysUserEntity) SecurityUtils.getSubject().getPrincipal()).getUserId());
+        SysUserEntity currentUser = (SysUserEntity) SecurityUtils.getSubject().getPrincipal();
+        String userId = String.valueOf(currentUser.getUserId());
+        // 查询条件可由前端自由组合，用户名必须以后端会话为准，防止跨 BU 越权查询。
+        querySavedVo.setUserName(currentUser.getUsername());
         if (querySavedVo.getQuerySavedDetailList() != null && !querySavedVo.getQuerySavedDetailList().isEmpty()) {
             String sql = queryCriteriaConstructorDefault.lastConditionalStatement(querySavedVo);
             querySavedVo.setSql(sql);
@@ -400,7 +403,13 @@ public class ProofingInformationController {
     @PostMapping(value = "/searchAllProofing")
     @ResponseBody
     public R searchAllProofing(@RequestBody ProofDocumentData inData) {
-        String userId = String.valueOf(((SysUserEntity) SecurityUtils.getSubject().getPrincipal()).getUserId());
+        SysUserEntity currentUser = (SysUserEntity) SecurityUtils.getSubject().getPrincipal();
+        String userId = String.valueOf(currentUser.getUserId());
+        // BU 权限过滤依赖 AccessBu.username，必须使用当前登录人而不是前端入参。
+        inData.setUsername(currentUser.getUsername());
+        if (inData.getSite() == null || inData.getSite().trim().isEmpty()) {
+            inData.setSite(currentUser.getSite());
+        }
 
         // 查询所有打样信息（分页）
         PageUtils page = proofingInformationService.queryAllProofing(userId,inData);
diff --git a/src/main/resources/mapper/pms/ProofingInformationMapper.xml b/src/main/resources/mapper/pms/ProofingInformationMapper.xml
index 96a183d6..7bacc55f 100644
--- a/src/main/resources/mapper/pms/ProofingInformationMapper.xml
+++ b/src/main/resources/mapper/pms/ProofingInformationMapper.xml
@@ -1126,6 +1126,11 @@
                  left join plm_project_info as b on ppi.project_id = b.id
                  left join plm_project_part as ppp on ppi.test_part_id = ppp.id
         <where> ppp.status != '草稿'
+            AND (b.site + '-' + b.bu_no) IN (
+            SELECT (site + '-' + bu_no)
+            FROM AccessBu
+            WHERE username = #{query.username}
+            )
         <if test="query.projectNo != null and query.projectNo != ''">
             AND (
             b.project_no like '%' + #{query.projectNo} + '%'
@@ -1269,6 +1274,11 @@
     left join plm_project_info as b on ppi.project_id = b.id
     left join plm_project_part as ppp on ppi.test_part_id = ppp.id
     <where> ppp.status != '草稿'
+        AND (b.site + '-' + b.bu_no) IN (
+        SELECT (site + '-' + bu_no)
+        FROM AccessBu
+        WHERE username = #{params.userName}
+        )
         <if test="params.sql != null and params.sql != ''">
             ${params.sql}
         </if>