From c3ea84bfad5ec519a7ce2712121b664169632002 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E7=A8=8B=E8=AF=9A?= <1009578407@qq.com>
Date: Fri, 11 Sep 2026 16:28:57 +0800
Subject: [PATCH] =?UTF-8?q?fix:20260904=E4=BB=A3=E7=A0=81=E6=89=AB?=
 =?UTF-8?q?=E6=8F=8F=E6=BC=8F=E6=B4=9E=E9=97=AE=E9=A2=98=E4=BF=AE=E5=A4=8D?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../controller/FlowTodoCenterController.java   | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/src/main/java/com/budwk/app/flow/controller/FlowTodoCenterController.java b/src/main/java/com/budwk/app/flow/controller/FlowTodoCenterController.java
index f0da0ce0..d3776898 100644
--- a/src/main/java/com/budwk/app/flow/controller/FlowTodoCenterController.java
+++ b/src/main/java/com/budwk/app/flow/controller/FlowTodoCenterController.java
@@ -93,6 +93,15 @@ public class FlowTodoCenterController {
         return Result.success(pagination);
     }
 
+    /**
+     * 分页查询当前用户的已办任务，仅返回列表展示及详情跳转所需的信息。
+     *
+     * @param pageNumber 查询页码
+     * @param pageSize 每页记录数
+     * @param searchKeyword 流程名称查询关键字
+     * @param category 流程分类
+     * @return 已办任务分页结果，不包含完整流程变量和任务表单数据
+     */
     @At
     @SaCheckLogin
     public Result done(Integer pageNumber, Integer pageSize, String searchKeyword, String category) {
@@ -106,8 +115,13 @@ public class FlowTodoCenterController {
                   t.h5FormKey,
                   t.createdAt,
                   t.finishTime,
-                  t.variable AS taskVariable,
-                  ins.variable,
+                  -- 保留任务变量字段类型，但已办列表不返回其中的业务表单数据。
+                  '{}' AS taskVariable,
+                  -- 列表仅需流程名称和申请人，避免完整变量中的身份证等信息泄露。
+                  JSON_OBJECT(
+                    'instanceName', ins.variable -> '$.instanceName',
+                    'initiatorName', ins.variable -> '$.initiatorName'
+                  ) AS variable,
                   ins.state AS instanceState,
                   ins.id AS instanceId,
                   ins.businessNo,