1.漏洞修复-[严重] 商城订单详情 - 用户ID校验被注释 2.漏洞修复-[严重] 问诊订单详情 - 用户ID校验被注释（IDOR漏洞）3.漏洞修复-[严重] 套餐订单详情 - 用户ID校验被注释

fs-user-app/src/main/java/com/fs/app/controller/InquiryOrderController.java

@@ -601,9 +601,9 @@ public class InquiryOrderController extends  AppBaseController {
     public R getInquiryOrderById(@RequestParam("orderId")Long orderId)
     {
         FsInquiryOrder order=inquiryOrderService.selectFsInquiryOrderByOrderId(orderId);
-//        if(!order.getUserId().equals(Long.parseLong(getUserId()))){
-//            return R.error("非法操作");
-//        }
+        if(!order.getUserId().equals(Long.parseLong(getUserId()))){
+            return R.error("非法操作");
+        }
         if(order!=null&&StringUtils.isNotEmpty(order.getPatientJson())){
             FsInquiryOrderPatientDTO dto=JSONUtil.toBean(order.getPatientJson(),FsInquiryOrderPatientDTO.class);
             dto.setMobile(ParseUtils.parsePhone(dto.getMobile()));
@@ -620,9 +620,9 @@ public class InquiryOrderController extends  AppBaseController {
     {
         Map<String,Object> maps=new HashMap<>();
         FsInquiryOrder order=inquiryOrderService.selectFsInquiryOrderByOrderId(orderId);
-//        if(!order.getUserId().equals(Long.parseLong(getUserId()))){
-//            return R.error("非法操作");
-//        }
+        if(!order.getUserId().equals(Long.parseLong(getUserId()))){
+            return R.error("非法操作");
+        }
         if(order!=null&&StringUtils.isNotEmpty(order.getPatientJson())){
             FsInquiryOrderPatientDTO dto=JSONUtil.toBean(order.getPatientJson(),FsInquiryOrderPatientDTO.class);
             dto.setMobile(ParseUtils.parsePhone(dto.getMobile()));
@@ -695,9 +695,9 @@ public class InquiryOrderController extends  AppBaseController {
     public R getInquiryOrderReport(@RequestParam("orderId")Long orderId)
     {
         FsInquiryOrderReportUVO report=orderReportService.selectFsInquiryOrderReportUVOByOrderId(orderId);
-//        if(!report.getUserId().equals(Long.parseLong(getUserId()))){
-//            return R.error("非法操作");
-//        }
+        if(!report.getUserId().equals(Long.parseLong(getUserId()))){
+            return R.error("非法操作");
+        }
         if(report!=null&&StringUtils.isNotEmpty(report.getPatientJson())){
             FsInquiryOrderPatientDTO dto=JSONUtil.toBean(report.getPatientJson(),FsInquiryOrderPatientDTO.class);
             dto.setMobile(ParseUtils.parsePhone(dto.getMobile()));
@@ -725,9 +725,9 @@ public class InquiryOrderController extends  AppBaseController {
     public R getCompanyUserInquiryOrderById(@RequestParam("orderId")Long orderId)
     {
         FsInquiryOrder order=inquiryOrderService.selectFsInquiryOrderByOrderId(orderId);
-//        if(!order.getCompanyUserId().equals(getCompanyUserId())){
-//            return R.error("非法操作");
-//        }
+        if(!order.getCompanyUserId().equals(getCompanyUserId())){
+            return R.error("非法操作");
+        }
         if(order!=null&&StringUtils.isNotEmpty(order.getPatientJson())){
             FsInquiryOrderPatientDTO dto=JSONUtil.toBean(order.getPatientJson(),FsInquiryOrderPatientDTO.class);
             dto.setMobile(ParseUtils.parsePhone(dto.getMobile()));

fs-user-app/src/main/java/com/fs/app/controller/PackageOrderController.java

@@ -170,9 +170,9 @@ public class PackageOrderController extends  AppBaseController {
     @GetMapping("/getPackageOrderById")
     public R getPackageOrderById(@RequestParam("orderId") Long orderId, HttpServletRequest request){
         FsPackageOrder order=packageOrderService.selectFsPackageOrderByOrderId(orderId);
-//        if(!order.getUserId().equals(Long.parseLong(getUserId()))){
-//            return R.error("非法操作");
-//        }
+        if(!order.getUserId().equals(Long.parseLong(getUserId()))){
+            return R.error("非法操作");
+        }
 
         if(order!=null&& StringUtils.isNotEmpty(order.getPatientJson())){
             FsPatient dto= JSONUtil.toBean(order.getPatientJson(),FsPatient.class);
@@ -194,6 +194,9 @@ public class PackageOrderController extends  AppBaseController {
     @GetMapping("/getSharePackageOrderById")
     public R getSharePackageOrderById(@RequestParam("orderId") Long orderId, HttpServletRequest request){
         FsPackageOrder order=packageOrderService.selectFsPackageOrderByOrderId(orderId);
+        if(!order.getUserId().equals(Long.parseLong(getUserId()))){
+            return R.error("非法操作");
+        }
         FsPackageOrderShareVO vo=new FsPackageOrderShareVO();
         BeanUtils.copyProperties(order,vo);
         return R.ok().put("order",vo);
@@ -204,9 +207,9 @@ public class PackageOrderController extends  AppBaseController {
     @GetMapping("/getCompanyUserPackageOrderById")
     public R getCompanyUserPackageOrderById(@RequestParam("orderId") Long orderId, HttpServletRequest request){
         FsPackageOrder order=packageOrderService.selectFsPackageOrderByOrderId(orderId);
-//        if(!order.getCompanyUserId().equals(getCompanyUserId())){
-//            return R.error("非法操作");
-//        }
+        if(!order.getCompanyUserId().equals(getCompanyUserId())){
+            return R.error("非法操作");
+        }
         if(order!=null&& StringUtils.isNotEmpty(order.getPatientJson())){
             FsPatient dto= JSONUtil.toBean(order.getPatientJson(),FsPatient.class);
             dto.setMobile(ParseUtils.parsePhone(dto.getMobile()));

fs-user-app/src/main/java/com/fs/app/controller/StoreOrderController.java

@@ -115,9 +115,9 @@ public class StoreOrderController extends  AppBaseController {
     @GetMapping("/getStoreOrderById")
     public R getStoreOrderById(@RequestParam("orderId") Long orderId, HttpServletRequest request){
         FsStoreOrder order=orderService.selectFsStoreOrderByOrderId(orderId);
-//        if(!order.getUserId().equals(Long.parseLong(getUserId()))){
-//            return R.error("非法操作");
-//        }
+        if(!order.getUserId().equals(Long.parseLong(getUserId()))){
+            return R.error("非法操作");
+        }
         order.setUserPhone(ParseUtils.parsePhone(order.getUserPhone()));
         order.setUserAddress(ParseUtils.parseIdCard(order.getUserAddress()));
         List<FsStoreOrderItemListUVO> list=orderItemService.selectFsStoreOrderItemListUVOByOrderId(orderId);