fix：网管课购买列表按分布查询

mec-web/src/main/java/com/ym/mec/web/controller/PracticeGroupManageController.java

@@ -138,6 +138,21 @@ public class PracticeGroupManageController extends BaseController {
     @GetMapping("studentBuys")
     @PreAuthorize("@pcs.hasPermissions('practiceGroupManage/studentBuys')")
     public Object studentBuys(StudentBuyPracticeQueryInfo queryInfo) {
+        SysUser sysUser = sysUserFeignService.queryUserInfo();
+        if (sysUser == null) {
+            return failed("用户信息获取失败");
+        }
+        Employee employee = employeeDao.get(sysUser.getId());
+        if (StringUtils.isEmpty(queryInfo.getOrganId())) {
+            queryInfo.setOrganId(employee.getOrganIdList());
+        } else if (StringUtils.isEmpty(employee.getOrganIdList())) {
+            return failed("用户所在分部异常");
+        } else {
+            List<String> list = Arrays.asList(employee.getOrganIdList().split(","));
+            if (!list.containsAll(Arrays.asList(queryInfo.getOrganId().split(",")))) {
+                return failed("非法请求");
+            }
+        }
         return succeed(practiceGroupService.studentBuys(queryInfo));
     }
 }