Merge remote-tracking branch 'origin/fix_漏洞修复'

2026-09-14 19:33:57 +08:00
parent da13b19b57 c3ea84bfad
commit 72b2413c00
67 changed files with 1012 additions and 133 deletions
@@ -11,6 +11,7 @@ import com.budwk.app.web.commons.auth.satoken.SaTokenDaoRedisImpl;
 import com.budwk.app.web.commons.auth.satoken.StpInterfaceImpl;
 import com.budwk.app.web.commons.base.Globals;
 import com.budwk.app.web.commons.ext.pubsub.WebPubSub;
+import com.budwk.app.web.commons.ext.handler.WkTomcatConfiguration;
 import com.budwk.app.zhgh.dayofficework.message.service.GlobalMessageSendService;
 import lombok.extern.slf4j.Slf4j;
 import org.beetl.core.GroupTemplate;
@@ -65,6 +66,7 @@ public class MainLauncher {
    public static void main(String[] args) throws Exception {
        NbApp nb = new NbApp().setArgs(args).setPrintProcDoc(true);
        nb.getAppContext().setMainPackage("com.budwk");
+        nb.addListener(new WkTomcatConfiguration());
        nb.run();
    }

@@ -93,6 +93,15 @@ public class FlowTodoCenterController {
        return Result.success(pagination);
    }

+    /**
+     * 分页查询当前用户的已办任务，仅返回列表展示及详情跳转所需的信息。
+     *
+     * @param pageNumber 查询页码
+     * @param pageSize 每页记录数
+     * @param searchKeyword 流程名称查询关键字
+     * @param category 流程分类
+     * @return 已办任务分页结果，不包含完整流程变量和任务表单数据
+     */
    @At
    @SaCheckLogin
    public Result done(Integer pageNumber, Integer pageSize, String searchKeyword, String category) {
@@ -106,8 +115,13 @@ public class FlowTodoCenterController {
                  t.h5FormKey,
                  t.createdAt,
                  t.finishTime,
-                  t.variable AS taskVariable,
-                  ins.variable,
+                  -- 保留任务变量字段类型，但已办列表不返回其中的业务表单数据。
+                  '{}' AS taskVariable,
+                  -- 列表仅需流程名称和申请人，避免完整变量中的身份证等信息泄露。
+                  JSON_OBJECT(
+                    'instanceName', ins.variable -> '$.instanceName',
+                    'initiatorName', ins.variable -> '$.initiatorName'
+                  ) AS variable,
                  ins.state AS instanceState,
                  ins.id AS instanceId,
                  ins.businessNo,
@@ -33,6 +33,10 @@ import org.nutz.mvc.upload.TempFile;

 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
+import javax.imageio.ImageIO;
+import javax.imageio.ImageReader;
+import javax.imageio.stream.ImageInputStream;
+import java.io.ByteArrayInputStream;
 import java.io.ByteArrayOutputStream;
 import java.io.File;
 import java.io.IOException;
@@ -43,6 +47,9 @@ import java.nio.file.StandardOpenOption;
 import java.util.Base64;
 import java.util.List;
 import java.util.Map;
+import java.util.Iterator;
+import java.util.Locale;
+import java.util.Set;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
@@ -54,6 +61,9 @@ public class SysFileServiceImpl extends BaseServiceImpl<Sys_file> implements Sys
    static String IMG_BASE64_PATTERN = "<img\\s+[^>]*src\\s*=\\s*['\"](data:image/[^'\"]+;base64,[^'\"]+)['\"][^>]*>";
    private static final int DOWNLOAD_FILE_CACHE_LIMIT = 2000;
    private final Map<String, Sys_file> downloadFileCache = new ConcurrentHashMap<>();
+    private static final Set<String> UPLOAD_SUFFIXES = Set.of("gif", "jpg", "jpeg", "png", "doc", "docx",
+            "xls", "xlsx", "rar", "zip", "7z", "txt", "pdf", "pptx", "ppt", "mp4");
+    private static final Set<String> ACTIVE_SUFFIXES = Set.of("svg", "svgz", "html", "htm", "xhtml", "xml", "js", "mjs", "swf");

    public SysFileServiceImpl(Dao dao) {
        super(dao);
@@ -86,11 +96,13 @@ public class SysFileServiceImpl extends BaseServiceImpl<Sys_file> implements Sys

    @Override
    public void download(String id, HttpServletRequest request, HttpServletResponse response) throws IOException {
-        if (handleCachedFileRequest(id, request, response)) {
-            return;
-        }
+        response.setHeader("X-Content-Type-Options", "nosniff");
+        response.setHeader("Cache-Control", "private, no-store");
        Sys_file sys_file = fetchDownloadFile(id);
-        if (!ObjectUtil.isEmpty(sys_file) && handleCachedImageRequest(sys_file, request, response)) {
+        // 历史主动内容也必须在缓存协商前拦截，避免旧 SVG 继续在业务域下执行。
+        if (sys_file != null && (ACTIVE_SUFFIXES.contains(StrUtil.blankToDefault(sys_file.getSuffix(), "").toLowerCase(Locale.ROOT))
+                || ACTIVE_SUFFIXES.contains(FileUtil.extName(sys_file.getName()).toLowerCase(Locale.ROOT)))) {
+            response.sendError(HttpServletResponse.SC_FORBIDDEN, "不允许访问此类型的附件");
            return;
        }
        if (ObjectUtil.isEmpty(sys_file)) {
@@ -117,16 +129,6 @@ public class SysFileServiceImpl extends BaseServiceImpl<Sys_file> implements Sys
        }
    }

-    private boolean handleCachedFileRequest(String id, HttpServletRequest request, HttpServletResponse response) {
-        String etag = buildFileEtag(id);
-        if (etag.equals(request.getHeader("If-None-Match"))) {
-            response.setStatus(HttpServletResponse.SC_NOT_MODIFIED);
-            setImageCacheHeaders(response, etag);
-            return true;
-        }
-        return false;
-    }
-
    private Sys_file fetchDownloadFile(String id) {
        if (StrUtil.isBlank(id)) {
            return null;
@@ -145,23 +147,15 @@ public class SysFileServiceImpl extends BaseServiceImpl<Sys_file> implements Sys
        return sysFile;
    }

-    private boolean handleCachedImageRequest(Sys_file sysFile, HttpServletRequest request, HttpServletResponse response) {
-        if (!isImage(sysFile)) {
-            return false;
-        }
-        String etag = buildFileEtag(sysFile);
-        if (etag.equals(request.getHeader("If-None-Match"))) {
-            response.setStatus(HttpServletResponse.SC_NOT_MODIFIED);
-            setImageCacheHeaders(response, etag);
-            return true;
-        }
-        return false;
-    }
-
    private boolean writeImageResponse(Sys_file sysFile, byte[] bytes, HttpServletResponse response) throws IOException {
        if (!isImage(sysFile)) {
            return false;
        }
+        String suffix = StrUtil.blankToDefault(sysFile.getSuffix(), FileUtil.extName(sysFile.getName())).toLowerCase(Locale.ROOT);
+        if (!isValidImage(bytes, suffix)) {
+            response.sendError(HttpServletResponse.SC_BAD_REQUEST, "图片内容与文件类型不符");
+            return true;
+        }
        setImageCacheHeaders(response, buildFileEtag(sysFile));
        response.setHeader("Content-Disposition", "inline;filename=" + java.net.URLEncoder.encode(sysFile.getName(), java.nio.charset.StandardCharsets.UTF_8));
        response.setHeader("Content-Length", String.valueOf(bytes.length));
@@ -171,9 +165,9 @@ public class SysFileServiceImpl extends BaseServiceImpl<Sys_file> implements Sys
    }

    private void setImageCacheHeaders(HttpServletResponse response, String etag) {
-        response.setHeader("Cache-Control", "public, max-age=604800, immutable");
+        response.setHeader("Cache-Control", "private, no-cache");
        response.setHeader("ETag", etag);
-        response.setDateHeader("Expires", System.currentTimeMillis() + 604800000L);
+        response.setDateHeader("Expires", 0);
    }

    private String buildFileEtag(Sys_file sysFile) {
@@ -181,12 +175,12 @@ public class SysFileServiceImpl extends BaseServiceImpl<Sys_file> implements Sys
    }

    private String buildFileEtag(String id) {
-        return "\"" + id + "\"";
+        return "\"safe-" + id + "\"";
    }

    private boolean isImage(Sys_file sysFile) {
        String suffix = StrUtil.blankToDefault(sysFile.getSuffix(), FileUtil.extName(sysFile.getName())).toLowerCase();
-        return "jpg".equals(suffix) || "jpeg".equals(suffix) || "png".equals(suffix) || "gif".equals(suffix) || "webp".equals(suffix) || "bmp".equals(suffix) || "svg".equals(suffix);
+        return "jpg".equals(suffix) || "jpeg".equals(suffix) || "png".equals(suffix) || "gif".equals(suffix) || "webp".equals(suffix) || "bmp".equals(suffix);
    }

    private String getImageContentType(Sys_file sysFile) {
@@ -197,7 +191,6 @@ public class SysFileServiceImpl extends BaseServiceImpl<Sys_file> implements Sys
            case "gif" -> "image/gif";
            case "webp" -> "image/webp";
            case "bmp" -> "image/bmp";
-            case "svg" -> "image/svg+xml";
            default -> "application/octet-stream";
        };
    }
@@ -310,6 +303,7 @@ public class SysFileServiceImpl extends BaseServiceImpl<Sys_file> implements Sys
     * 存储文件
     **/
    private String storageFile(String engine, TempFile file, boolean returnFileId) {
+        validateUpload(file);
        // 如果引擎为空，默认使用本地
        if (ObjectUtil.isEmpty(engine)) {
            engine = SysFileEngineTypeEnum.LOCAL.getValue();
@@ -383,6 +377,53 @@ public class SysFileServiceImpl extends BaseServiceImpl<Sys_file> implements Sys
        }
    }

+    /** 所有业务上传共用校验，客户端声明的 MIME 类型不能作为图片真实性依据。 */
+    private void validateUpload(TempFile file) {
+        if (file == null || StrUtil.isBlank(file.getSubmittedFileName())) {
+            throw new BaseException("请选择要上传的文件");
+        }
+        String suffix = FileUtil.extName(file.getSubmittedFileName()).toLowerCase(Locale.ROOT);
+        if (!UPLOAD_SUFFIXES.contains(suffix)) {
+            throw new BaseException("不允许上传此类型的文件");
+        }
+        if (Set.of("gif", "jpg", "jpeg", "png").contains(suffix)) {
+            try {
+                if (!isValidImage(Files.readAllBytes(file.getFile().toPath()), suffix)) {
+                    throw new BaseException("图片内容与文件类型不符");
+                }
+            } catch (IOException e) {
+                throw new BaseException("图片读取失败");
+            }
+        }
+    }
+
+    /** 解码真实图片并限制像素数量，阻止伪装为图片的 SVG 和异常大尺寸图片。 */
+    private boolean isValidImage(byte[] bytes, String suffix) {
+        try (ImageInputStream input = ImageIO.createImageInputStream(new ByteArrayInputStream(bytes))) {
+            if (input == null) {
+                return false;
+            }
+            Iterator<ImageReader> readers = ImageIO.getImageReaders(input);
+            if (!readers.hasNext()) {
+                return false;
+            }
+            ImageReader reader = readers.next();
+            try {
+                reader.setInput(input, true, true);
+                String expected = "jpg".equals(suffix) ? "jpeg" : suffix;
+                if (!expected.equalsIgnoreCase(reader.getFormatName())) {
+                    return false;
+                }
+                long pixels = (long) reader.getWidth(0) * reader.getHeight(0);
+                return pixels > 0 && pixels <= 40000000 && reader.read(0) != null;
+            } finally {
+                reader.dispose();
+            }
+        } catch (IOException | RuntimeException e) {
+            return false;
+        }
+    }
+
    /**
     * 存储文件
     */
@@ -10,6 +10,9 @@ import cn.dev33.satoken.servlet.model.SaStorageForServlet;
 import org.nutz.ioc.loader.annotation.IocBean;
 import org.nutz.mvc.Mvcs;

+import javax.servlet.http.Cookie;
+import javax.servlet.http.HttpServletResponseWrapper;
+
 /**
 * @author wizzer@qq.com
 */
@@ -22,7 +25,20 @@ public class SaTokenContextImpl implements SaTokenContext {

    @Override
    public SaResponse getResponse() {
-        return new SaResponseForServlet(Mvcs.getResp());
+        // 当前 Sa-Token 版本没有 Cookie 安全属性配置，在写入登录 Cookie 时统一补齐。
+        return new SaResponseForServlet(new HttpServletResponseWrapper(Mvcs.getResp()) {
+            /**
+             * 限制登录 Cookie 的脚本访问，并在 HTTPS 请求中仅允许安全传输。
+             *
+             * @param cookie Sa-Token 写入或清除的 Cookie
+             */
+            @Override
+            public void addCookie(Cookie cookie) {
+                cookie.setHttpOnly(true);
+                cookie.setSecure(cookie.getSecure() || Mvcs.getReq().isSecure());
+                super.addCookie(cookie);
+            }
+        });
    }

    @Override
@@ -1,7 +1,6 @@
 package com.budwk.app.web.commons.ext.handler;

-import org.eclipse.jetty.server.Request;
-import org.eclipse.jetty.servlet.ErrorPageErrorHandler;
+import org.nutz.boot.starter.WebServletFace;
 import org.nutz.ioc.loader.annotation.IocBean;
 import org.nutz.json.Json;
 import org.nutz.lang.util.NutMap;
@@ -9,28 +8,63 @@ import org.nutz.log.Log;
 import org.nutz.log.Logs;

 import javax.servlet.RequestDispatcher;
+import javax.servlet.DispatcherType;
+import javax.servlet.Servlet;
 import javax.servlet.ServletException;
 import javax.servlet.ServletRequest;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
+import javax.servlet.http.HttpServlet;
 import java.io.IOException;

 /**
 * 错误页拦截器,登陆后台显示友好提示
 */
@IocBean
-public class WkErrorPageHandler extends ErrorPageErrorHandler {
+public class WkErrorPageHandler extends HttpServlet implements WebServletFace {
    private static final Log log = Logs.get();

+    /**
+     * 返回容器错误处理 Servlet 的注册名称。
+     * @return 独立于业务路由的 Servlet 名称
+     */
    @Override
-    public void handle(String target, Request baseRequest, HttpServletRequest request, HttpServletResponse response) throws IOException, ServletException {
+    public String getName() {
+        return "wkErrorPage";
+    }
+
+    /**
+     * 返回容器错误页的内部派发地址。
+     * @return 错误页映射路径
+     */
+    @Override
+    public String getPathSpec() {
+        return "/__container_error";
+    }
+
+    /**
+     * 将当前错误处理实例交给 NutzBoot 注册。
+     * @return 当前 Servlet 实例
+     */
+    @Override
+    public Servlet getServlet() {
+        return this;
+    }
+
+    @Override
+    protected void service(HttpServletRequest request, HttpServletResponse response) throws IOException, ServletException {
+        if (request.getDispatcherType() != DispatcherType.ERROR) {
+            response.sendError(HttpServletResponse.SC_NOT_FOUND);
+            return;
+        }
        if (response.getStatus() == 403 || response.getStatus() == 404 || response.getStatus() == 500) {
            try {
                if (isAjax(request)) {
+                    response.setContentType("application/json;charset=UTF-8");
                    response.getWriter().write(Json.toJson(new NutMap("code", "-1").setv("msg", response.getStatus() + " error")));
                    return;
                } else {
-                    request.setAttribute("original_request_uri", request.getRequestURI());
+                    request.setAttribute("original_request_uri", request.getAttribute(RequestDispatcher.ERROR_REQUEST_URI));
                    RequestDispatcher rd = request.getRequestDispatcher("/platform/home/" + response.getStatus());
                    rd.forward(request, response);
                    return;
@@ -39,11 +73,11 @@ public class WkErrorPageHandler extends ErrorPageErrorHandler {
                log.error(e);
            }
        }
-        super.handle(target, baseRequest, request, response);
+        // 不回落到容器默认错误页，避免泄露异常堆栈和容器信息。
    }

    private boolean isAjax(ServletRequest req) {
        String value = ((HttpServletRequest) req).getHeader("X-Requested-With");
        return value != null && "XMLHttpRequest".equalsIgnoreCase(value.trim());
    }
-}
+}
@@ -0,0 +1,88 @@
+package com.budwk.app.web.commons.ext.handler;
+
+import com.budwk.app.web.commons.ext.websocket.WkWebSocket;
+import org.apache.catalina.core.StandardContext;
+import org.apache.catalina.Executor;
+import org.apache.catalina.core.StandardThreadExecutor;
+import org.apache.catalina.startup.Tomcat;
+import org.apache.catalina.valves.ErrorReportValve;
+import org.apache.tomcat.websocket.server.WsSci;
+import org.apache.tomcat.util.descriptor.web.FilterMap;
+import org.nutz.boot.NbApp;
+import org.nutz.boot.starter.tomcat.TomcatStarter;
+import org.nutz.boot.tools.NbAppEventListener;
+import org.nutz.ioc.impl.PropertiesProxy;
+
+import java.util.Set;
+import javax.servlet.ServletContextEvent;
+import javax.servlet.ServletContextListener;
+
+/**
+ * 在容器启动前补齐 NutzBoot Tomcat 的 WebSocket 注册和线程池绑定。
+ */
+public class WkTomcatConfiguration implements NbAppEventListener {
+
+    /**
+     * 配置官方嵌入式 Tomcat，保留项目的监听地址与消息推送能力。
+     *
+     * @param app 当前 NutzBoot 应用
+     * @param eventType 只在服务器启动前配置，避免重复注册端点
+     */
+    @Override
+    public void whenStartServers(NbApp app, EventType eventType) {
+        if (eventType != EventType.before) {
+            return;
+        }
+        TomcatStarter starter = app.getAppContext().getIoc().get(TomcatStarter.class);
+        Tomcat tomcat = starter.getServer();
+        PropertiesProxy conf = app.getAppContext().getConf();
+        tomcat.getConnector().setProperty("address", starter.getHost());
+
+        // Starter 创建了共享线程池，但尚未把它交给 Connector 使用。
+        for (Executor executor : tomcat.getService().findExecutors()) {
+            if (executor instanceof StandardThreadExecutor) {
+                StandardThreadExecutor threads = (StandardThreadExecutor) executor;
+                threads.setMinSpareThreads(conf.getInt("tomcat.executor.minSpareThreads", 10));
+                threads.setMaxIdleTime(conf.getInt("tomcat.executor.maxIdleTime", 60000));
+                tomcat.getConnector().getProtocolHandler().setExecutor(threads);
+                break;
+            }
+        }
+
+        // NutzBoot 使用编程式 Context，必须显式运行官方 WebSocket 初始化器。
+        StandardContext context = (StandardContext) tomcat.getHost().findChild(starter.getContextPath());
+        context.setUseHttpOnly(conf.getBoolean("tomcat.session.cookie.httponly", true));
+        context.addServletContainerInitializer(new WsSci(), Set.of(WkWebSocket.class));
+        // Tomcat 的错误页再次 forward 时仍保持 ERROR 派发；让 MVC 渲染原业务错误页。
+        // Nutz 的过滤器在前一个监听器中注册，须等其完成后才能添加映射。
+        context.addApplicationLifecycleListener(new ServletContextListener() {
+            /**
+             * 在 Nutz 注册完成后补充业务错误页的 ERROR 派发映射。
+             * @param event 当前 Servlet 上下文初始化事件
+             */
+            @Override
+            public void contextInitialized(ServletContextEvent event) {
+                FilterMap errorPages = new FilterMap();
+                errorPages.setFilterName("nutz");
+                errorPages.setDispatcher("ERROR");
+                // ERROR 再转发时 URL 匹配路径不变，按目标 Servlet 匹配才能进入 MVC。
+                errorPages.addServletName("default");
+                context.addFilterMap(errorPages);
+            }
+        });
+        // Host 的兜底错误页也不能重新暴露此前已关闭的版本和堆栈。
+        ErrorReportValve errorReport = null;
+        for (org.apache.catalina.Valve valve : tomcat.getHost().getPipeline().getValves()) {
+            if (valve instanceof ErrorReportValve) {
+                errorReport = (ErrorReportValve) valve;
+                break;
+            }
+        }
+        if (errorReport == null) {
+            errorReport = new ErrorReportValve();
+            tomcat.getHost().getPipeline().addValve(errorReport);
+        }
+        errorReport.setShowReport(false);
+        errorReport.setShowServerInfo(false);
+    }
+}
@@ -54,7 +54,7 @@ import java.util.List;
@IocBean
@At("/platform/unionReimburse/apply")
@Api("工会报销申请")
-@Ok("json:full")
+@Ok("json:{locked:'condolenceIdCard|condolenceBirthday|condolenceMobile',ignoreNull:false}")
@Slf4j
 public class UnionReimburseApplyController {

@@ -151,14 +151,11 @@ public class UnionReimburseApplyController {
                	username as userName,
                	loginname as loginName,
                	sex,
-                	mobile,
                	technicalTitle,
                	IFNULL(unitname, '暂无') as unitName,
                	unitid as unitId,
                	unionid as unionId,
                	unionname as unionName,
-                	DATE(birthday) AS birthday,
-                	idCard,
                	unionCode
                from
                	vw_user
@@ -173,6 +170,9 @@ public class UnionReimburseApplyController {
        }
        cnd.and(View_user::getId, "!=", SecurityUtil.getUserId());
        if (!AuthUtil.hasRoleOr(RoleConstant.SYSADMIN.name(), RoleConstant.SCHOOL_UNION_ADMIN.name())) {
+            if (StrUtil.isBlank(SecurityUtil.getUnionId())) {
+                return Result.success(java.util.Collections.emptyList());
+            }
            cnd.and(View_user::getUnionId, "=", SecurityUtil.getUnionId());
        }
        sql.setCondition(cnd);
@@ -34,7 +34,7 @@ import java.util.List;
 */
@IocBean
@At("/platform/unionReimburse/certifierUserSign")
-@Ok("json:full")
+@Ok("json:{locked:'condolenceIdCard|condolenceBirthday|condolenceMobile',ignoreNull:false}")
@Api("证明人签字")
@Slf4j
 public class UnionReimburseCertifierUserSignController {
@@ -68,7 +68,7 @@ import java.util.HashMap;
@IocBean
@At("/platform/unionReimburse/mine")
@Api("工会报销我的")
-@Ok("json:full")
+@Ok("json:{locked:'condolenceIdCard|condolenceBirthday|condolenceMobile',ignoreNull:false}")
@Slf4j
 public class  UnionReimburseMineController {

@@ -29,7 +29,7 @@ import java.util.List;

@IocBean
@At("/platform/unionReimburse/review")
-@Ok("json:full")
+@Ok("json:{locked:'condolenceIdCard|condolenceBirthday|condolenceMobile',ignoreNull:false}")
@Api("工会报销审核")
 public class UnionReimburseReviewController {

@@ -38,7 +38,7 @@ import java.util.List;

@IocBean
@At("/platform/unionReimburse/statistics")
-@Ok("json:full")
+@Ok("json:{locked:'condolenceIdCard|condolenceBirthday|condolenceMobile',ignoreNull:false}")
@Api("慰问统计")
@Slf4j
 public class UnionReimburseStatisticsController {
@@ -4,10 +4,12 @@ import cn.hutool.core.date.DateUtil;
 import cn.hutool.core.util.ObjectUtil;
 import cn.hutool.core.util.StrUtil;
 import com.budwk.app.base.constant.RoleConstant;
+import com.budwk.app.base.exception.BaseException;
 import com.budwk.app.base.page.Pagination;
 import com.budwk.app.base.result.Result;
 import com.budwk.app.base.service.impl.BaseServiceImpl;
 import com.budwk.app.sys.models.Sys_file;
+import com.budwk.app.sys.views.View_user;
 import com.budwk.app.sys.services.SysFileService;
 import com.budwk.app.zhgh.club.model.ClubUser;
 import com.budwk.app.zhgh.dayofficework.outlay.outlayManage.club.model.OutlayManageClub;
@@ -125,6 +127,37 @@ public class UnionReimburseServiceImpl extends BaseServiceImpl<UnionReimburse> i
            if (oldRecord == null) {
                return Result.error("未找到对应的报销记录");
            }
+            if (!isAdmin() && !Objects.equals(oldRecord.getUserId(), SecurityUtil.getUserId())) {
+                return Result.error("无权修改此报销申请");
+            }
+        }
+
+        // 人员身份和敏感资料由服务端补齐，避免前端删减字段导致丢失或被篡改。
+        if (oldRecord == null) {
+            View_user handler = dao().fetch(View_user.class, Cnd.where("id", "=", SecurityUtil.getUserId()));
+            if (handler == null) {
+                return Result.error("经办人信息不存在");
+            }
+            unionReimburse.setUserId(handler.getId());
+            unionReimburse.setUserName(handler.getUsername());
+            unionReimburse.setLoginName(handler.getLoginname());
+            unionReimburse.setUnitId(handler.getUnitId());
+            unionReimburse.setUnitName(handler.getUnitName());
+            unionReimburse.setUnionId(handler.getUnionId());
+            unionReimburse.setUnionName(handler.getUnionName());
+        } else {
+            // 修改历史单据时保留原经办组织，避免人员调动改变经费归属。
+            unionReimburse.setUserId(oldRecord.getUserId());
+            unionReimburse.setUserName(oldRecord.getUserName());
+            unionReimburse.setLoginName(oldRecord.getLoginName());
+            unionReimburse.setUnitId(oldRecord.getUnitId());
+            unionReimburse.setUnitName(oldRecord.getUnitName());
+            unionReimburse.setUnionId(oldRecord.getUnionId());
+            unionReimburse.setUnionName(oldRecord.getUnionName());
+        }
+        Result recipientResult = fillCondolencePersonalData(unionReimburse, oldRecord);
+        if (recipientResult != null) {
+            return recipientResult;
        }

        normalizeInvoiceDetails(unionReimburse);
@@ -179,14 +212,104 @@ public class UnionReimburseServiceImpl extends BaseServiceImpl<UnionReimburse> i
        if (unionReimburse == null) {
            return null;
        }
+        if (!canReadApply(unionReimburse)) {
+            throw new BaseException("无权查看此报销申请");
+        }
        List<UnionReimburseInvoiceDetail> invoiceDetails = this.dao().query(
                UnionReimburseInvoiceDetail.class,
                Cnd.where("reimburseId", "=", id).asc("createdAt")
        );
        unionReimburse.setInvoiceDetails(invoiceDetails == null ? new ArrayList<>() : invoiceDetails);
+        // 申请页和详情页共用此接口，原始身份资料仅保留在服务端业务记录中。
+        unionReimburse.setCondolenceIdCard(null);
+        unionReimburse.setCondolenceBirthday(null);
+        unionReimburse.setCondolenceMobile(null);
        return unionReimburse;
    }

+    /** 保留历史单据的身份资料快照，新选人员须符合人员查询的数据范围。 */
+    private Result fillCondolencePersonalData(UnionReimburse form, UnionReimburse oldRecord) {
+        form.setCondolenceIdCard(null);
+        form.setCondolenceBirthday(null);
+        form.setCondolenceMobile(null);
+        if (!"UNION_REIMBURSE_PROJECT_1".equals(form.getReimburseProject())) {
+            return null;
+        }
+        if (StrUtil.isBlank(form.getCondolenceUserId())) {
+            return null;
+        }
+        if (oldRecord != null && Objects.equals(oldRecord.getCondolenceUserId(), form.getCondolenceUserId())) {
+            form.setCondolenceIdCard(oldRecord.getCondolenceIdCard());
+            form.setCondolenceBirthday(oldRecord.getCondolenceBirthday());
+            form.setCondolenceMobile(oldRecord.getCondolenceMobile());
+            form.setCondolenceUnionId(oldRecord.getCondolenceUnionId());
+            form.setCondolenceUnitId(oldRecord.getCondolenceUnitId());
+            form.setCondolenceUserName(oldRecord.getCondolenceUserName());
+            form.setCondolenceLoginName(oldRecord.getCondolenceLoginName());
+            form.setCondolenceUnitName(oldRecord.getCondolenceUnitName());
+            form.setCondolenceUnionName(oldRecord.getCondolenceUnionName());
+            form.setCondolenceUnionCode(oldRecord.getCondolenceUnionCode());
+            form.setCondolenceSex(oldRecord.getCondolenceSex());
+            return null;
+        }
+        View_user user = dao().fetch(View_user.class, Cnd.where("id", "=", form.getCondolenceUserId()));
+        if (user == null || Objects.equals(user.getId(), SecurityUtil.getUserId())
+                || (!isAdmin() && (StrUtil.isBlank(SecurityUtil.getUnionId())
+                || !Objects.equals(SecurityUtil.getUnionId(), user.getUnionId())))) {
+            return Result.error("无权选择此慰问对象");
+        }
+        form.setCondolenceUserName(user.getUsername());
+        form.setCondolenceLoginName(user.getLoginname());
+        form.setCondolenceUnitId(user.getUnitId());
+        form.setCondolenceUnitName(user.getUnitName());
+        form.setCondolenceUnionId(user.getUnionId());
+        form.setCondolenceUnionName(user.getUnionName());
+        form.setCondolenceUnionCode(user.getUnionCode());
+        form.setCondolenceSex(user.getSex());
+        form.setCondolenceIdCard(user.getIdCard());
+        form.setCondolenceBirthday(user.getBirthday() == null ? null : DateUtil.formatDate(user.getBirthday()));
+        form.setCondolenceMobile(user.getMobile());
+        return null;
+    }
+
+    /** 详情访问沿用经办、审核、统计和流程参与范围，不能仅凭单据 ID 查询。 */
+    private boolean canReadApply(UnionReimburse form) {
+        String userId = SecurityUtil.getUserId();
+        if (StrUtil.isBlank(userId)) {
+            return false;
+        }
+        if (isAdmin() || userId.equals(form.getUserId())) {
+            return true;
+        }
+        if (form.getStateId() != 1 && (AuthUtil.hasPermission("unionReimburse.review")
+                || AuthUtil.hasPermission("h5.unionReimburse.review"))) {
+            return true;
+        }
+        if ((form.getStateId() == 2 || form.getStateId() == 3)
+                && StrUtil.isNotBlank(SecurityUtil.getUnionId())
+                && Objects.equals(SecurityUtil.getUnionId(), form.getCondolenceUnionId())
+                && (AuthUtil.hasPermission("unionReimburse.statistics")
+                || AuthUtil.hasPermission("h5.unionReimburse.statistics"))) {
+            return true;
+        }
+        // 旧流程单据允许任务参与人和抄送人回看，关系必须由数据库确认。
+        Sql sql = Sqls.create("""
+                SELECT COUNT(*) FROM wf_process_instance i
+                WHERE i.businessNo = @id AND (
+                    EXISTS (SELECT 1 FROM wf_process_task t
+                        INNER JOIN wf_process_task_actor a ON a.processTaskId = t.id
+                        WHERE t.processInstanceId = i.id AND a.actorId = @userId)
+                    OR EXISTS (SELECT 1 FROM wf_process_cc_instance c
+                        WHERE c.processInstanceId = i.id AND c.actorId = @userId)
+                )
+                """);
+        sql.setParam("id", form.getId());
+        sql.setParam("userId", userId);
+        sql.setCallback(Sqls.callback.integer());
+        dao().execute(sql);
+        return sql.getInt() > 0;
+    }
+
    @Override
    public void deleteApply(String id) {
        if (StrUtil.isBlank(id)) {
@@ -242,14 +365,11 @@ public class UnionReimburseServiceImpl extends BaseServiceImpl<UnionReimburse> i
                  u.username AS userName,
                  u.loginname AS loginName,
                  u.sex,
-                  u.mobile,
                  u.technicalTitle,
                  IFNULL(u.unitname, '暂无') AS unitName,
                  u.unitid AS unitId,
                  u.unionid AS unionId,
                  u.unionname AS unionName,
-                  DATE(u.birthday) AS birthday,
-                  u.idCard,
                  u.unionCode
                FROM
                  vw_user u
@@ -11,7 +11,6 @@ import lombok.AllArgsConstructor;
 import lombok.Data;
 import lombok.EqualsAndHashCode;
 import lombok.NoArgsConstructor;
-import org.eclipse.jetty.util.StringUtil;
 import org.nutz.dao.entity.annotation.*;
 import org.nutz.dao.interceptor.annotation.PrevInsert;

@@ -161,13 +160,13 @@ public class MallGoods extends BaseModel {
        //循环sku，判定sku是否有效
        for (Map<String, Object> sku : goodsOperationDTO.getSkuList()) {
            //判定参数不能为空
-            if ((!sku.containsKey("price") || StringUtil.isEmpty(sku.get("price").toString()) || Convert.toDouble(sku.get("price")) <= 0)) {
+            if ((!sku.containsKey("price") || CharSequenceUtil.isEmpty(sku.get("price").toString()) || Convert.toDouble(sku.get("price")) <= 0)) {
                throw new BaseException("商品SKU价格不能小于等于0");
            }
 //            if ((!sku.containsKey("cost") || StringUtil.isEmpty(sku.get("cost").toString()) || Convert.toDouble(sku.get("cost")) <= 0)) {
 //                throw new BaseException("商品SKU成本价不能小于等于0");
 //            }
-            if (!sku.containsKey("quantity") || StringUtil.isEmpty(sku.get("quantity").toString()) || Convert.toInt(sku.get("quantity").toString()) < 0) {
+            if (!sku.containsKey("quantity") || CharSequenceUtil.isEmpty(sku.get("quantity").toString()) || Convert.toInt(sku.get("quantity").toString()) < 0) {
                throw new BaseException("商品库存数量不能为负数");
            }
            sku.values().forEach(i -> {
@@ -127,7 +127,6 @@ public class CondolenceApplyController {
 					username as userName,
 					loginname as loginName,
 					sex,
-					mobile,
 					technicalTitle,
 					IFNULL(unitname, '暂无') as unitName,
 					unitid as unitId,
@@ -146,6 +145,9 @@ public class CondolenceApplyController {
 		}
 		if(!AuthUtil.hasRoleOr(RoleConstant.SYSADMIN.name(), RoleConstant.SCHOOL_UNION_ADMIN.name())) {
 			if(AuthUtil.hasRoleOr(RoleConstant.BRANCH_UNION_ADMIN.name(), RoleConstant.BRANCH_UNION_CHAIRMAN.name())) {
+				if (StrUtil.isBlank(SecurityUtil.getUnionId())) {
+					return Result.success(java.util.Collections.emptyList());
+				}
 				cnd.and(View_user::getUnionId, "=", SecurityUtil.getUnionId());
 			} else {
 				cnd.and(View_user::getId, "=", SecurityUtil.getUserId());
@@ -16,16 +16,20 @@ sm4cbc:
  keyHex: 00112233445566778899aabbccddeeff
  ivHex: 0102030405060708090a0b0c0d0e0f10

-jetty:
-  contextPath: /
-  threadpool:
-    idleTimeout: 60000
-    minThreads: 10
+tomcat:
+  contextPath: ""
+  # 容器错误响应不披露版本；Session Cookie 保持 HttpOnly。
+  session:
+    cookie:
+      httponly: true
+  executor:
+    maxIdleTime: 60000
+    minSpareThreads: 10
    maxThreads: 500
  page:
-    403: /error/403.html
-    404: /error/404.html
-    500: /error/500.html
+    403: /__container_error
+    404: /__container_error
+    500: /__container_error
    #结合ftp使用,或用nginx代理ftp路径
  #staticPath: /Users/wizzer/temp/files
  #开发模式静态资源
@@ -14,7 +14,7 @@ var ioc={
        // 单个文件最大尺寸(大约的值，单位为字节，即 2097152 为 2M)
        maxFileSize : 2097152,
        // 正则表达式匹配可以支持的文件名
-        nameFilter : '^(.+[.])(gif|jpg|png|svg)$'
+        nameFilter : '(?i)^(.+[.])(gif|jpg|jpeg|png)$'
        }
    },
    imageUpload : {
@@ -32,7 +32,7 @@ var ioc={
            // 单个文件最大尺寸(大约的值，单位为字节，即 209715200 为 200M)
            maxFileSize : 209715200,
            // 正则表达式匹配可以支持的文件名
-            nameFilter : '^(.+[.])(gif||svg|jpg|png|jpeg|doc|docx|xls|xlsx|rar|zip|7z|txt|pdf|pptx|ppt|mp4)$'
+            nameFilter : '(?i)^(.+[.])(gif|jpg|png|jpeg|doc|docx|xls|xlsx|rar|zip|7z|txt|pdf|pptx|ppt|mp4)$'
        }
    },
    fileUpload : {
@@ -187,31 +187,6 @@ layout("/layouts/platform.html"){
                            </el-form-item>
                        </el-descriptions-item>

-                        <el-descriptions-item label="生日"
-                                              v-if="formData.reimburseProject === 'UNION_REIMBURSE_PROJECT_1'">
-                            <el-form-item prop="condolenceBirthday" label="生日">
-                                <el-input
-                                        :value="formData.condolenceBirthday && $moment(formData.condolenceBirthday).isValid() ?$moment(formData.condolenceBirthday).format('YYYY-MM-DD') : ''"
-                                        show-word-limit placeholder="请输入生日" disabled></el-input>
-                            </el-form-item>
-                        </el-descriptions-item>
-
-                        <el-descriptions-item label="身份证号"
-                                              v-if="formData.reimburseProject === 'UNION_REIMBURSE_PROJECT_1'">
-                            <el-form-item prop="condolenceIdCard" label="身份证号">
-                                <el-input v-model="formData.condolenceIdCard" show-word-limit
-                                          placeholder="请输入身份证号" disabled></el-input>
-                            </el-form-item>
-                        </el-descriptions-item>
-
-                        <el-descriptions-item label="联系方式"
-                                              v-if="formData.reimburseProject === 'UNION_REIMBURSE_PROJECT_1'">
-                            <el-form-item prop="condolenceMobile" label="联系方式">
-                                <el-input v-model="formData.condolenceMobile" show-word-limit
-                                          placeholder="请输入联系方式" disabled></el-input>
-                            </el-form-item>
-                        </el-descriptions-item>
-
                        <el-descriptions-item label="慰问类型"
                                              v-if="formData.reimburseProject === 'UNION_REIMBURSE_PROJECT_1'">
                            <el-form-item label="慰问类型" prop="condolenceTypeId">
@@ -816,7 +791,6 @@ layout("/layouts/platform.html"){
                        trigger: ["change", "blur"]
                    }, {pattern: /^([1-9]{1})(\d{15}|\d{18})$/, message: "请输入正确的银行卡号", trigger: "blur"}],
                    bankOfDeposit: [{required: true, message: "请填写开户行", trigger: ["change", "blur"]}],
-                    condolenceMobile: [{pattern: /^1[3-9]\d{9}$/, message: "请输入正确的手机号码", trigger: "blur"}],
                    condolenceTime: [{required: true, message: "请选择慰问时间", trigger: ["change", "blur"]}],
                    // invoiceNumber: [{required: true, message: "请填写发票张数", trigger: ["change", "blur"]}],
                    // invoice: [{required: true, message: "请填写发票号码", trigger: ["change", "blur"]}],
@@ -1187,10 +1161,7 @@ layout("/layouts/platform.html"){
                        unionId,
                        unionName,
                        unionCode,
-                        sex,
-                        birthday,
-                        idCard,
-                        mobile
+                        sex
                    } = user
                    this.$set(this.formData, "condolenceUserName", userName)
                    this.$set(this.formData, "condolenceLoginName", loginName)
@@ -1200,9 +1171,6 @@ layout("/layouts/platform.html"){
                    this.$set(this.formData, "condolenceUnionName", unionName)
                    this.$set(this.formData, "condolenceUnionCode", unionCode)
                    this.$set(this.formData, "condolenceSex", sex)
-                    this.$set(this.formData, "condolenceBirthday", birthday)
-                    this.$set(this.formData, "condolenceIdCard", idCard)
-                    this.$set(this.formData, "condolenceMobile", mobile)
                }
            },
            typeChange(val) {
@@ -86,18 +86,6 @@ const unionReimburseInfo = {
                            <span>{{ viewData.condolenceSex }}</span>
                        </el-descriptions-item>

-                        <el-descriptions-item label="生日" v-if="viewData.reimburseProject === 'UNION_REIMBURSE_PROJECT_1'">
-                            <span>{{ viewData.condolenceBirthday && $moment(viewData.condolenceBirthday).isValid() ? $moment(viewData.condolenceBirthday).format('YYYY-MM-DD') : '' }}</span>
-                        </el-descriptions-item>
-
-                        <el-descriptions-item label="身份证号" v-if="viewData.reimburseProject === 'UNION_REIMBURSE_PROJECT_1'">
-                            <span>{{ viewData.condolenceIdCard }}</span>
-                        </el-descriptions-item>
-
-                        <el-descriptions-item label="联系方式" v-if="viewData.reimburseProject === 'UNION_REIMBURSE_PROJECT_1'">
-                            <span>{{ viewData.condolenceMobile }}</span>
-                        </el-descriptions-item>
-
                        <el-descriptions-item label="慰问类型" v-if="viewData.reimburseProject === 'UNION_REIMBURSE_PROJECT_1'">
                            <span>{{ viewData.typeName }}</span>
                        </el-descriptions-item>
@@ -579,9 +579,6 @@ layout("/layouts/platform_h5.html"){
                    </van-action-sheet>

                    <van-field label="性别" v-model="formData.condolenceSex" readonly placeholder="自动带出"></van-field>
-                    <van-field label="生日" :value="formatDateText(formData.condolenceBirthday)" readonly placeholder="自动带出"></van-field>
-                    <van-field label="身份证号" v-model="formData.condolenceIdCard" readonly placeholder="自动带出"></van-field>
-                    <van-field label="联系方式" v-model="formData.condolenceMobile" readonly placeholder="自动带出"></van-field>

                    <van-field
                        v-model="formData.typeName"
@@ -1412,7 +1409,7 @@ layout("/layouts/platform_h5.html"){
            },
            normalizeContactFields() {
                // 提交前裁剪联系方式空格，避免系统手机号带空格时后端格式校验失败。
-                const fields = ["mobile", "condolenceMobile"]
+                const fields = ["mobile"]
                fields.forEach((fieldName) => {
                    if (this.formData[fieldName]) {
                        this.$set(this.formData, fieldName, String(this.formData[fieldName]).trim())
@@ -2209,7 +2206,6 @@ layout("/layouts/platform_h5.html"){
                const selectedUser = this.condolenceOptions.find(user => user.id === o.value)
                if (selectedUser) {
                    this.fillCondolenceUser(selectedUser)
-                    this.$set(this.formData, "condolenceMobile", selectedUser.mobile)
                }
            },
            onCondolenceTypeConfirm(o) {
@@ -2341,9 +2337,6 @@ layout("/layouts/platform_h5.html"){
                this.$set(this.formData, "condolenceUnionName", user.unionName)
                this.$set(this.formData, "condolenceUnionCode", user.unionCode)
                this.$set(this.formData, "condolenceSex", user.sex)
-                this.$set(this.formData, "condolenceBirthday", user.birthday)
-                this.$set(this.formData, "condolenceIdCard", user.idCard)
-                this.$set(this.formData, "condolenceMobile", user.mobile)
            },
            // 查询慰问类型
            queryCondolenceType() {
@@ -100,18 +100,6 @@ const UNION_REIMBURSE_INFO = {
                                <div class="union-info-label">性别</div>
                                <div class="union-info-value">{{ viewData.condolenceSex }}</div>
                            </div>
-                            <div class="union-info-row">
-                                <div class="union-info-label">生日</div>
-                                <div class="union-info-value">{{ formatDateText(viewData.condolenceBirthday) }}</div>
-                            </div>
-                            <div class="union-info-row">
-                                <div class="union-info-label">身份证号</div>
-                                <div class="union-info-value">{{ viewData.condolenceIdCard }}</div>
-                            </div>
-                            <div class="union-info-row">
-                                <div class="union-info-label">联系方式</div>
-                                <div class="union-info-value">{{ viewData.condolenceMobile }}</div>
-                            </div>
                            <div class="union-info-row">
                                <div class="union-info-label">慰问类型</div>
                                <div class="union-info-value">{{ viewData.typeName || viewData.condolenceTypeName }}</div>