From 6d6920a2b300bbc5032936bef743f22947bd01d2 Mon Sep 17 00:00:00 2001
From: wanghao <w0401@foxmail.com>
Date: Tue, 7 Apr 2026 14:41:42 +0800
Subject: [PATCH] =?UTF-8?q?fix(=E5=81=A5=E5=BA=B7=E7=9B=91=E6=B5=8B):=20?=
 =?UTF-8?q?=E4=BF=AE=E5=A4=8D=E6=89=8B=E8=A1=A8=E7=BB=91=E5=AE=9A=E5=8D=95?=
 =?UTF-8?q?=E4=BD=8D=E6=A0=A1=E9=AA=8C=E4=BD=BF=E7=94=A8=E5=89=8D=E7=AB=AF?=
 =?UTF-8?q?=E4=BC=A0=E5=85=A5orgCode=E5=AF=BC=E8=87=B4=E7=9A=84=E6=A0=A1?=
 =?UTF-8?q?=E9=AA=8C=E5=A4=B1=E6=95=88=E9=97=AE=E9=A2=98?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

将绑定校验的orgCode来源从dto改为watchDevice实体，
避免前端未传orgCode时校验必定失败，同时消除伪造绕过风险

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 .../renkang/watch/service/impl/WatchDeviceServiceImpl.java  | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/health-watch/health-watch-biz/src/main/java/com/renkang/watch/service/impl/WatchDeviceServiceImpl.java b/health-watch/health-watch-biz/src/main/java/com/renkang/watch/service/impl/WatchDeviceServiceImpl.java
index 060f1e1..381d34a 100644
--- a/health-watch/health-watch-biz/src/main/java/com/renkang/watch/service/impl/WatchDeviceServiceImpl.java
+++ b/health-watch/health-watch-biz/src/main/java/com/renkang/watch/service/impl/WatchDeviceServiceImpl.java
@@ -301,9 +301,9 @@ public class WatchDeviceServiceImpl extends ServiceImpl<WatchDeviceMapper, Watch
         // 新增手表只能绑定给本单位的人
         LoginUser userById = sysBaseAPI.getUserById(dto.getBindUserId());
 
-        if (userById.getOrgCode() == null || dto.getOrgCode() == null ||
-                userById.getOrgCode().length() < 6 || dto.getOrgCode().length() < 6 ||
-                !userById.getOrgCode().substring(0, 6).equals(dto.getOrgCode().substring(0, 6))) {
+        if (userById.getOrgCode() == null || watchDevice.getOrgCode() == null ||
+                userById.getOrgCode().length() < 6 || watchDevice.getOrgCode().length() < 6 ||
+                !userById.getOrgCode().substring(0, 6).equals(watchDevice.getOrgCode().substring(0, 6))) {
             return Result.error("手表只能绑定给本单位人员");
         }