Sea-Studio/MC_Report
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: restrict PUT /tickets to admin's own claims (enforce claim system)

Browse Source
This commit is contained in:
canglan
2026-07-13 18:19:28 +08:00
parent 2a18b4b1a8
commit 8d9e154ce1
1 changed files with 1 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
backend/routes/tickets.js
View File

@@ -181,6 +181,7 @@ router.post('/', optionalAuth, upload.array('files', 5), finalizeUpload, validat
router.put('/:id', authenticate, requireRole('owner','admin'), async (req, res) => { router.put('/:id', authenticate, requireRole('owner','admin'), async (req, res) => {
const t = await getRow('SELECT * FROM tickets WHERE id = ?', [req.params.id]); const t = await getRow('SELECT * FROM tickets WHERE id = ?', [req.params.id]);
if (!t) return res.status(404).json({ error: '工单不存在' }); if (!t) return res.status(404).json({ error: '工单不存在' });
if (req.user.role === 'admin' && t.assigned_to && t.assigned_to !== req.user.id) return res.status(403).json({ error: '只能修改自己负责的工单' });
if (t.status === 'closed' && req.user.role !== 'owner') return res.status(400).json({ error: '已关闭的工单仅服主可操作' }); if (t.status === 'closed' && req.user.role !== 'owner') return res.status(400).json({ error: '已关闭的工单仅服主可操作' });
const fields = {}; const fields = {};
if (req.body.status) fields.status = req.body.status; if (req.body.status) fields.status = req.body.status;