|
|
89592b9585
|
security: 财务后台权限收敛到财务角色，堵住全平台余额/账务泄漏
- scripts/load_path.py: 按角色分层重写权限矩阵（any/logined/财务角色/分销商角色），
默认先清理 /accounting/ 全部旧授权再重建；财务后台(余额台账/账户/科目/分录/日志/
信用管理/币种汇率)从 logined 收敛到 owner.superuser/admin/account +
reseller.admin/accountant/operator；客户自服务页(已按本机构过滤)保留 logined
- accounting/init.py get_accdetail: 补 account.orgid=当前机构 过滤，堵按 accountid 越权查明细
- wwwroot/get_user_balance.dspy: 改为只查登录用户本人余额(原可按任意 username 查他人余额，
且存在 swait 拼写错误导致 500)
|
2026-08-27 18:13:15 +08:00 |
|
|
|
a65422d06b
|
fix: move fetch_forex_rates to PATHS_ANY for cron access
|
2026-07-14 10:44:58 +08:00 |
|
|
|
f9cb644e07
|
fix: currency/exchange_rate DDL 加 utf8mb4_unicode_ci 防止 collation mismatch
|
2026-07-10 11:40:03 +08:00 |
|
|
|
5f752a6287
|
feat: BOC forex rate fetcher — /api/fetch_forex_rates.dspy
|
2026-07-09 11:46:35 +08:00 |
|
|
|
898c215f9d
|
chore: update migration SQL for all 5 DBs + RBAC for currency/exchange_rate CRUD
|
2026-07-07 17:44:47 +08:00 |
|
|
|
3f6c71b4d5
|
feat: multi-currency support — currency/exchange_rate tables + migration
|
2026-07-07 15:43:01 +08:00 |
|
Hermes Agent
|
56ae61a992
|
fix: 授信表单改为客户名称查找模式 + 代客充值RBAC路径注册
1. 授信表单: accountid改为customer_name文本输入，后端先精确后模糊查找客户
2. 代客充值: load_path.py添加proxy_recharge.ui和proxy_recharge_submit.dspy路径
|
2026-06-22 17:26:03 +08:00 |
|
Hermes Agent
|
f00057bb75
|
移除临时文件，添加/更新.gitignore
|
2026-06-22 15:00:22 +08:00 |
|
|
|
7475b30527
|
bugfix
|
2026-06-10 17:59:36 +08:00 |
|
|
|
c637d76a25
|
fix: replace wildcard patterns with explicit per-file entries in load_path.py
|
2026-06-04 13:03:27 +08:00 |
|
|
|
195a7bfb46
|
fix: wrap Tabular in VBox with cheight for proper scrolling
|
2026-05-29 22:09:45 +08:00 |
|
|
|
8f36013ad6
|
refactor: use wildcard % in load_path.py for auto-coverage
|
2026-05-29 00:52:18 +08:00 |
|
|
|
5da6ddd7d5
|
feat: expose credit limit functions via ServerEnv and register RBAC paths
|
2026-05-28 22:39:48 +08:00 |
|
|
|
cb52542567
|
feat: add load_path.py RBAC permission registration script
|
2026-05-27 13:16:01 +08:00 |
|
