This commit is contained in:
TermiNexus committed 2026-06-19 02:05:40 +08:00
1 parent 854767a2c2
commit 6f6af7553a
1 file changed
+3
+3
View File
@@ -90,6 +90,9 @@ def verify_kefu_permission(request, username_from_frontend=None):
return None, Response({'code': 403, 'msg': '客服账号已被禁用'}, status=403)
except ObjectDoesNotExist:
return None, Response({'code': 403, 'msg': '客服账号不存在'}, status=403)
else:
# 管理员无需客服扩展表,用 True 占位以通过 kefu_obj is None 检查
kefu = True
# ---------- 3. 越权检测(只记录前端篡改username的情况) ----------
if username_from_frontend and current_user.Phone != username_from_frontend: