‘

B3WeChat/Rpcs/WeChatUserRpc.cs

@@ -1,6 +1,7 @@
 using BWP.B3WeChat.BL;
 using BWP.B3WeChat.BO;
 using BWP.B3WeChat.BO.NamedValueTemplate;
+using Forks.EnterpriseServices.DomainObjects2;
 using Forks.EnterpriseServices.DomainObjects2.DQuery;
 using Forks.EnterpriseServices.JsonRpc;
 using System;
@@ -14,34 +15,49 @@ namespace BWP.B3WeChat.Rpcs
   [Rpc]
   public static class WeChatUserRpc
   {
-    [Rpc(RpcFlags.SkipAuth)]
+    [Rpc]
     public static ApproveMessage LoadMessage(string messageID)
     {
-      return ApproveMessageBL.Instance.Load(messageID);
+      var message = ApproveMessageBL.Instance.Load(messageID);
+
+      if (message != null && message.OpenID != WeChatUserContext.Current.OpenID)
+      {
+        throw new Exception("此消息不属于你");
+      }
+
+      return message;
     }
 
     [Rpc]
     public static ApproveMessage[] MyMessages()
     {
-      var query = new DmoQuery(typeof(ApproveMessage));
-
+      var query = new DQueryDom(new JoinAlias(typeof(ApproveMessage)));
       query.Where.Conditions.Add(DQCondition.EQ("OpenID", WeChatUserContext.Current.OpenID));
       query.OrderBy.Expressions.Add(DQOrderByExpression.Create("CreateTime", true));
-
-      return query.EExecuteList().Cast<ApproveMessage>().ToArray();
+      return query.EExecuteDmoList<ApproveMessage>("ID", "Title", "CreateTime", "ApproveResult").ToArray();
     }
 
-    [Rpc(RpcFlags.SkipAuth)]
+    [Rpc]
     public static void Approve(ApproveMessage message)
     {
+      if (message.OpenID != WeChatUserContext.Current.OpenID)
+      {
+        throw new Exception("此消息不属于你");
+      }
+
       ApproveMessageBL.Instance.Approve(message);
    
     }
 
 
-    [Rpc(RpcFlags.SkipAuth)]
+    [Rpc]
     public static void Reject(ApproveMessage message)
     {
+      if (message.OpenID != WeChatUserContext.Current.OpenID)
+      {
+        throw new Exception("此消息不属于你");
+      }
+
       ApproveMessageBL.Instance.Reject(message);
 
     }

B3WeChat/WeChatUserContext.cs

@@ -40,6 +40,10 @@ namespace BWP.B3WeChat
         else
         {
           var user = BLContext.User;
+          if (!user.Name.StartsWith("wechat_"))
+          {
+            throw new Exception("not a wechat user");
+          }
           var context = new WeChatUserContext();
           context.mOpenID = user.Name.Substring(7);
           var query = new DmoQuery(typeof(CustomerUser));