yumoqing
89592b9585
security: 财务后台权限收敛到财务角色,堵住全平台余额/账务泄漏
- scripts/load_path.py: 按角色分层重写权限矩阵(any/logined/财务角色/分销商角色),
默认先清理 /accounting/ 全部旧授权再重建;财务后台(余额台账/账户/科目/分录/日志/
信用管理/币种汇率)从 logined 收敛到 owner.superuser/admin/account +
reseller.admin/accountant/operator;客户自服务页(已按本机构过滤)保留 logined
- accounting/init.py get_accdetail: 补 account.orgid=当前机构 过滤,堵按 accountid 越权查明细
- wwwroot/get_user_balance.dspy: 改为只查登录用户本人余额(原可按任意 username 查他人余额,
且存在 swait 拼写错误导致 500)
2026-08-27 18:13:15 +08:00
..
2026-08-25 15:01:21 +08:00
2026-06-29 13:24:43 +08:00
2025-12-25 17:24:01 +08:00
2025-12-25 15:17:48 +08:00
2025-12-25 15:17:48 +08:00
2026-07-17 16:05:05 +08:00
2026-07-17 16:05:05 +08:00
2026-07-17 17:59:09 +08:00
2026-06-29 10:48:29 +08:00
2026-08-27 18:13:15 +08:00
2025-12-25 15:17:48 +08:00
2026-06-29 10:48:29 +08:00
2026-06-11 14:02:39 +08:00
2026-04-01 17:59:26 +08:00
2026-06-18 13:33:16 +08:00
2026-06-16 17:32:38 +08:00
2026-01-04 16:55:47 +08:00
2026-03-30 14:38:47 +08:00
2026-01-04 16:55:47 +08:00
2026-01-04 16:59:46 +08:00
2026-08-17 13:55:33 +08:00
2026-06-29 10:43:31 +08:00
2025-10-23 22:32:26 +08:00
2026-05-25 18:40:40 +08:00
2026-05-25 18:40:40 +08:00
2026-05-25 18:40:40 +08:00
2026-05-25 18:40:40 +08:00
2025-12-25 16:52:33 +08:00