update

mec-web/src/main/java/com/ym/mec/web/controller/TeacherAttendanceController.java

@@ -91,6 +91,23 @@ public class TeacherAttendanceController extends BaseController {
     @PostMapping("/queryTeacherAttendanceComplaints")
     @PreAuthorize("@pcs.hasPermissions('teacherAttendance/queryTeacherAttendanceComplaints')")
     public Object queryTeacherAttendanceComplaints(TeacherAttendanceComplaintsQueryInfo queryInfo){
+        SysUser sysUser = sysUserFeignService.queryUserInfo();
+        if (sysUser == null) {
+            return failed("用户信息获取失败");
+        }
+        if(!sysUser.getIsSuperAdmin()){
+            Employee employee = employeeDao.get(sysUser.getId());
+            if (StringUtils.isEmpty(queryInfo.getOrganId())) {
+                queryInfo.setOrganId(employee.getOrganIdList());
+            }else if(StringUtils.isEmpty(employee.getOrganIdList())){
+                return failed("用户所在分部异常");
+            }else {
+                List<String> list = Arrays.asList(employee.getOrganIdList().split(","));
+                if(!list.containsAll(Arrays.asList(queryInfo.getOrganId().split(",")))){
+                    return failed("非法请求");
+                }
+            }
+        }
         return succeed(teacherAttendanceService.queryTeacherAttendanceComplaints(queryInfo));
     }