修复了已知问题

This commit is contained in:
2026-06-19 19:49:58 +08:00
parent 7f5e76551c
commit 479fd8bbd8
2 changed files with 4 additions and 3 deletions

View File

@@ -97,8 +97,9 @@ def verify_kefu_permission(request, username_from_frontend=None):
except ObjectDoesNotExist:
return None, Response({'code': 403, 'msg': '客服账号不存在'}, status=403)
else:
# 管理员无需客服扩展表,用 True 占位以通过 kefu_obj is None 检查
kefu = True
# 管理员无需客服扩展表,用占位对象以通过 kefu_obj is None 检查
from types import SimpleNamespace
kefu = SimpleNamespace(user=current_user)
# ---------- 3. 越权检测只记录前端篡改username的情况 ----------
if username_from_frontend and current_user.Phone != username_from_frontend: