terrylee/star-cloud
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[FIX] backport hotfix 至 dev：員工卡編輯回填公司 + company_id 寫入保護

Browse Source
This commit is contained in:
sky121113 2026-06-23 11:27:01 +08:00
commit f415e138da
2 changed files with 14 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
app/Http/Controllers/Admin/StaffCardController.php
View File

@ -110,6 +110,15 @@ class StaffCardController extends Controller
$validated['status'] = $request->get('status', $staffCard->status);
// 寫入安全：company_id 不得由前端任意決定或被洗成 null
// - 非系統管理員：強制綁定自身公司 (租戶隔離)
// - 系統管理員：若未帶入公司，保留原本歸屬，避免變成無公司歸屬的孤兒卡 (機台將查無此卡)
if (!auth()->user()->isSystemAdmin()) {
$validated['company_id'] = auth()->user()->company_id;
} elseif (empty($validated['company_id'])) {
$validated['company_id'] = $staffCard->company_id;
}
$staffCard->update($validated);
if ($request->ajax()) {

6
resources/views/admin/data-config/staff-cards/index.blade.php
View File

@ -448,7 +448,11 @@
this.$nextTick(() => {
const select = HSSelect.getInstance('#modal-company-id', true);
if (select) {
select.setValue(this.staffFormFields.company_id || ' ');
// Preline 的 option value 為字串，company_id 為數字時嚴格比對會失配導致回填失敗，
// 故統一轉成字串；空值則以 ' ' 對應 placeholder 選項
const cid = this.staffFormFields.company_id;
const valStr = (cid !== undefined && cid !== null && cid.toString().trim() !== '') ? cid.toString() : ' ';
select.setValue(valStr);
}
});
},