From 6fa1a6584351d1ff136c51abfa9eb527fa38a660 Mon Sep 17 00:00:00 2001 From: canglan Date: Sun, 12 Jul 2026 21:02:21 +0800 Subject: [PATCH] fix: admin cant view admin_complaint/result_appeal via URL, appeal close also closes parent --- backend/routes/tickets.js | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/backend/routes/tickets.js b/backend/routes/tickets.js index ef9a0e2..34800e0 100644 --- a/backend/routes/tickets.js +++ b/backend/routes/tickets.js @@ -90,6 +90,7 @@ router.get('/:id', authenticate, async (req, res) => { FROM tickets t LEFT JOIN users u ON t.user_id = u.id LEFT JOIN users a ON t.assigned_to = a.id WHERE t.id = ?`, [req.params.id]); if (!t) return res.status(404).json({ error: '工单不存在' }); if (req.user.role === 'player' && t.user_id !== req.user.id) return res.status(403).json({ error: '无权查看' }); + if (req.user.role === 'admin' && (t.is_admin_complaint || t.type === 'result_appeal' || t.type === 'suggestion')) return res.status(403).json({ error: '无权查看' }); t.responses = await query(`SELECT r.*, u.username, u.role FROM responses r LEFT JOIN users u ON r.user_id = u.id WHERE r.ticket_id = ? ORDER BY r.created_at ASC`, [req.params.id]); t.attachments = await query('SELECT * FROM attachments WHERE ticket_id = ?', [req.params.id]); t.transfers = await query(`SELECT tf.*, fu.username as from_username, fu.game_name as from_game_name, tu.username as to_username, tu.game_name as to_game_name @@ -192,7 +193,7 @@ router.put('/:id', authenticate, requireRole('owner','admin'), async (req, res) if (req.body.status && req.body.status !== t.status) { await query("INSERT INTO responses(ticket_id, user_id, content, is_staff) VALUES (?,?,?,1)", [req.params.id, req.user.id, `状态变更为: ${SL[req.body.status]||req.body.status}`]); - if (t.type === 'result_appeal' && (req.body.status === 'resolved' || req.body.status === 'rejected')) { + if (t.type === 'result_appeal' && (req.body.status === 'resolved' || req.body.status === 'rejected' || req.body.status === 'closed')) { await query(`UPDATE tickets SET status = 'closed' WHERE id = ?`, [t.parent_ticket_id]); await query("INSERT INTO responses(ticket_id, user_id, content, is_staff) VALUES (?,?,?,1)", [t.parent_ticket_id, req.user.id, `【系统】申诉已处理，原工单已关闭`]); }