fix: 停用集团任职同时摘掉 IsSuperuser,杜绝超管绕过

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
XingQue
2026-07-29 06:46:14 +08:00
parent ad760a9b42
commit 559e903a0c
2 changed files with 73 additions and 18 deletions

View File

@@ -149,12 +149,15 @@ def build_admin_club_context(user):
def is_system_super_admin(user):
"""系统级超管Django 超管 / admin 账号 / 白名单手机号),非俱乐部 000001 角色。"""
return (
bool(user.IsSuperuser)
or user.UserType == 'admin'
or getattr(user, 'Phone', '') in SUPER_ADMIN_PHONES
)
"""
系统级超管。
白名单手机号:始终超管。
其它账号:仅看 IsSuperuser / UserType=admin停用集团任职时会清掉 IsSuperuser
避免「任职停了仍是集团上帝」。
"""
if getattr(user, 'Phone', '') in SUPER_ADMIN_PHONES:
return True
return bool(user.IsSuperuser) or user.UserType == 'admin'
def is_hardcoded_super_phone(user):