wuzhen

wuzhen ha pushato nel master in hzdyjs-xg/all-project

eeae0af978 fix(web): 会话失效时强制清本地 token，避免卡死无法进入登录页坏 JWT 会导致 logout 接口失败，原先 removeToken 执行不到，且 getInfo 失败后跳到 / 形成死循环。 Confidence: high Scope-risk: narrow Co-authored-by: Cursor <cursoragent@cursor.com>

4 giorni fa

wuzhen ha pushato nel master in hzdyjs-xg/all-project

937cbb6bbd fix(security): 登录清理旧会话时容忍 JWT 解析失败，避免无法登录 logoutByMaxLoginCount 会回调 doLogout，旧随机密钥签发的 token 导致 getExtra 抛异常并打断整个登录。 Confidence: high Scope-risk: narrow Co-authored-by: Cursor <cursoragent@cursor.com>

4 giorni fa

wuzhen ha pushato nel master in hzdyjs-xg/all-project

a170cc6a48 fix(security): 生产配置显式固定 JWT 密钥，防止会话整体失效 Confidence: high Scope-risk: narrow Co-authored-by: Cursor <cursoragent@cursor.com>

4 giorni fa

wuzhen ha pushato nel master in hzdyjs-xg/all-project

24a1d7f745 fix(security): JWT 签名失败按未登录处理，避免页面报未知异常密钥切换后残留 token 会在 getExtra 抛 SaJwtException，现统一返回 401 引导重新登录。 Confidence: high Scope-risk: narrow Co-authored-by: Cursor <cursoragent@cursor.com>

4 giorni fa

wuzhen ha pushato nel master in hzdyjs-xg/all-project

fa6bf7aea2 fix(security): 恢复 CORS 通配，避免生产域名不匹配导致整站无法访问 Constraint: 优先恢复生产可用性，CORS 收紧可后续再按域名白名单做 Confidence: high Scope-risk: narrow Co-authored-by: Cursor <cursoragent@cursor.com>

4 giorni fa

wuzhen ha pushato nel master in hzdyjs-xg/all-project

9b1ce3c4b1 fix(security): 恢复 JWT 默认密钥，避免已登录用户会话整体失效随机更换 jwt-secret-key 会导致生产环境旧 token 全部无法校验，影响正常访问；改回原固定密钥。 Constraint: 用户明确要求不以随机密钥打断现有会话 Confidence: high Scope-risk: narrow Co-authored-by: Cursor <cursoragent@cursor.com>

4 giorni fa

wuzhen ha pushato nel master in hzdyjs-xg/all-project

da8d332fac fix(security): 修复网安扫描相关严重/高危/中危漏洞并加固学生密码重置关闭工作流 SpEL 命令执行与社团活动 SQL 注入，补齐越权、调试接口、登录喷洒和异常回显等问题；学生密码改为随机临时密码，Web/移动端支持复制。 Constraint: 流程发起/办理接口保持仅登录校验，避免影响请假审批 Rejected: 开启验证码 | Web/移动端登录页均未实现，开启会导致无法登录 Confidence: high Scope-risk: broad Not-tested: 生产环境与社团社长/指导老师视角 Co-authored-by: Cursor <cursoragent@cursor.com>

4 giorni fa

wuzhen ha pushato nel master in hzdyjs-xg/all-project

845c7fd942 fix(dorm): 假期留宿按时刻判定，点名可同时显示请假与留宿结束时刻过后不再整天标留宿；请假与假期留宿可同时展示，标签仅显示状态名。 Co-authored-by: Cursor <cursoragent@cursor.com>

4 giorni fa

wuzhen ha pushato nel master in hzdyjs-xg/all-project

df4c21bd0d feat(xg): 新增按学号重置学生密码（Web/移动端）学工老师可按学号查询并重置学生登录密码为固定默认值，独立权限不复用系统用户重置。 Co-authored-by: Cursor <cursoragent@cursor.com>

4 giorni fa

wuzhen ha pushato nel master in hzdyjs-xg/all-project

b26bf58744 fix(mobile): 审批弹窗加大字号、补请假天数并缩小意见框同步请假类型下线外出/回家、新增临时回寝的安全 SQL（历史单不迁移）。 Co-authored-by: Cursor <cursoragent@cursor.com>

1 settimana fa

wuzhen ha pushato nel master in hzdyjs-xg/all-project

15ed3ec9fb fix(leave/dorm): 打回重提、审批摘要与待办标题优化修复请假/销假打回后空 flowCode 导致启动失败；审批弹窗展示请假摘要并去掉附件；待办标题短显请假/销假；点名 todaySummary 与楼栋关联脚本一并同步。 Co-authored-by: Cursor <cursoragent@cursor.com>

1 settimana fa

wuzhen ha pushato nel master in hzdyjs-xg/all-project

de223a1f5a fix(mobile): 修复待办列表办理/审批按钮点击无响应 u-button 的 click 不带事件对象，去掉 @click.stop，避免 stopPropagation 报错导致按钮失效。 Co-authored-by: Cursor <cursoragent@cursor.com>

1 settimana fa

wuzhen ha pushato nel master in hzdyjs-xg/all-project

7cea0566ac feat(xg): 请假审批修复、点名今日汇总与寝室扣分条例脚本同步请假/销假审批上下文与状态、宿舍点名今日汇总与假期留宿标识，并补充寝室检查扣分条例生产 SQL 与执行说明。 Co-authored-by: Cursor <cursoragent@cursor.com>
3e6349112c Merge branch 'master' of http://101.35.245.122:3000/hzdyjs-xg/all-project
b098b9ec44 fix(dorm): 点名提交后房间卡片立即展示本次统计人数提交结果里已有在寝、请假、不在人数，卡片原先只标记已点名，人数仍停在加载时的 0。 Co-authored-by: Cursor <cursoragent@cursor.com>
Visualizza comparazione tra questi 3 commit »

1 settimana fa

wuzhen ha pushato nel master in hzdyjs-xg/all-project

a0bb39d069 fix(dorm): 人文学院宿舍分配班级树以班级表为准合并全校一年级班级树改为 xg_class_msg 主数据源（无住宿生也可见），统一入学年口径与学院向上解析，避免代理院一年级列表不全或挂错。 Co-authored-by: Cursor <cursoragent@cursor.com>

2 settimane fa

wuzhen ha pushato nel master in hzdyjs-xg/all-project

04d12bbce1 feat(dorm): 一年级宿舍分配到班级由人文学院代理操作复用请假代理学院配置，班级树对人文学院合并全校一年级、对他院隐藏一年级；分配/回收增加本学院床位与一年级代理写校验，不改班级真实归属。 Co-authored-by: Cursor <cursoragent@cursor.com>

2 settimane fa

wuzhen ha pushato nel master in hzdyjs-xg/all-project

623f5b65e7 fix(security): 恢复业务模块权限注解并加固上传与招生脱敏恢复各业务 Controller 被注释的 @SaCheckPermission，收紧 OSS 上传白名单，招生查询双因子脱敏，志愿团队改为简要 VO，降低垂直越权与敏感信息泄露风险。 Co-authored-by: Cursor <cursoragent@cursor.com>

1 mese fa

wuzhen ha pushato nel master in hzdyjs-xg/all-project

5fd0042068 fix(dorm): 班主任床位分配页去掉退宿选中床位按钮避免老师误点退宿，页面仅保留分配、收回与调宿操作。 Co-authored-by: Cursor <cursoragent@cursor.com>
64f805cca4 fix(dorm): 点名请假仅认审批完成，并修正点名时间时区宿舍点名/卫生检查只展示 finish 请假；点名提交改用服务端本地时间，避免 toISOString 少 8 小时。 Co-authored-by: Cursor <cursoragent@cursor.com>
Visualizza comparazione tra questi 2 commit »

1 mese fa

wuzhen ha pushato nel master in hzdyjs-xg/all-project

a6a5b88f47 fix(leave): 修复请假流程 waiting 与业务 draft 不同步导致无审批按钮申请人提交后业务表可能仍停在 draft，办理页不显示审批按钮；在请假模块内补齐任务创建时状态对齐，禁止 waiting 被回写为 draft，并仅在暂存时写 draft。 Co-authored-by: Cursor <cursoragent@cursor.com>

1 mese fa

wuzhen ha pushato nel master in hzdyjs-xg/all-project

c2905e78f1 style(mobile): 请假列表加大姓名、天数、是否离校字号便于核查 Co-authored-by: Cursor <cursoragent@cursor.com>

1 mese fa

wuzhen ha pushato nel master in hzdyjs-xg/all-project

a76fd32d71 feat(leave): 一年级请假二级学院与分管领导改走人文学院按入学年与每年9月1日切届判定一年级；代理学院 dept_id 通过 sys_config 配置，提交时覆写选人，流程定义与销假不变。 Co-authored-by: Cursor <cursoragent@cursor.com>

1 mese fa