From 99debbf259037e20bd6c2f8425322dca3fad10fa Mon Sep 17 00:00:00 2001 From: sky121113 Date: Tue, 23 Jun 2026 11:18:13 +0800 Subject: [PATCH] =?UTF-8?q?[FIX]=20=E5=93=A1=E5=B7=A5=E5=8D=A1=E7=B7=A8?= =?UTF-8?q?=E8=BC=AF=E5=BD=88=E7=AA=97=E6=9C=AA=E5=9B=9E=E5=A1=AB=E6=89=80?= =?UTF-8?q?=E5=B1=AC=E5=85=AC=E5=8F=B8=EF=BC=8C=E4=B8=A6=E9=98=B2=E6=AD=A2?= =?UTF-8?q?=E5=84=B2=E5=AD=98=E6=99=82=E6=B4=97=E6=8E=89=20company=5Fid?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 1. 修正系統管理員開啟「編輯員工識別卡」時，所屬公司下拉顯示為「選擇公司」空值的問題：Preline 的 option value 為字串，原本直接以數字型別的 company_id 呼叫 setValue，嚴格比對失配導致無法回填，現統一轉為字串 (對齊 ads / welcome-gifts / pickup-codes 既有寫法)。 2. 強化 StaffCardController@update 的寫入安全 (RBAC 1.3)：非系統管理員一律強制綁定自身 company_id；系統管理員若未帶入公司則保留原本歸屬，避免在上述空值狀態按下儲存時把 company_id 洗成 null，造成機台刷卡「查無此員工卡」的孤兒卡。 3. 影響範圍：資料設定 → 員工識別管理之新增/編輯彈窗 (resources/views/admin/data-config/staff-cards/index.blade.php) 與 App\Http\Controllers\Admin\StaffCardController；僅前端回填與後端寫入保護，不更動資料表結構與既有正常卡片資料。 Co-Authored-By: Claude Opus 4.8 (1M context) --- app/Http/Controllers/Admin/StaffCardController.php | 9 +++++++++ .../views/admin/data-config/staff-cards/index.blade.php | 6 +++++- 2 files changed, 14 insertions(+), 1 deletion(-) diff --git a/app/Http/Controllers/Admin/StaffCardController.php b/app/Http/Controllers/Admin/StaffCardController.php index 8cbf835..3cf4542 100644 --- a/app/Http/Controllers/Admin/StaffCardController.php +++ b/app/Http/Controllers/Admin/StaffCardController.php @@ -110,6 +110,15 @@ class StaffCardController extends Controller $validated['status'] = $request->get('status', $staffCard->status); + // 寫入安全：company_id 不得由前端任意決定或被洗成 null + // - 非系統管理員：強制綁定自身公司 (租戶隔離) + // - 系統管理員：若未帶入公司，保留原本歸屬，避免變成無公司歸屬的孤兒卡 (機台將查無此卡) + if (!auth()->user()->isSystemAdmin()) { + $validated['company_id'] = auth()->user()->company_id; + } elseif (empty($validated['company_id'])) { + $validated['company_id'] = $staffCard->company_id; + } + $staffCard->update($validated); if ($request->ajax()) { diff --git a/resources/views/admin/data-config/staff-cards/index.blade.php b/resources/views/admin/data-config/staff-cards/index.blade.php index 9f858c0..d8d5a0d 100644 --- a/resources/views/admin/data-config/staff-cards/index.blade.php +++ b/resources/views/admin/data-config/staff-cards/index.blade.php @@ -448,7 +448,11 @@ this.$nextTick(() => { const select = HSSelect.getInstance('#modal-company-id', true); if (select) { - select.setValue(this.staffFormFields.company_id || ' '); + // Preline 的 option value 為字串，company_id 為數字時嚴格比對會失配導致回填失敗， + // 故統一轉成字串；空值則以 ' ' 對應 placeholder 選項 + const cid = this.staffFormFields.company_id; + const valStr = (cid !== undefined && cid !== null && cid.toString().trim() !== '') ? cid.toString() : ' '; + select.setValue(valStr); } }); },