diff --git a/src/main/java/au/com/royalpay/payment/manage/riskbusiness/core/impl/RiskBusinessServiceImpl.java b/src/main/java/au/com/royalpay/payment/manage/riskbusiness/core/impl/RiskBusinessServiceImpl.java
index ed13c38ff..50105af90 100644
--- a/src/main/java/au/com/royalpay/payment/manage/riskbusiness/core/impl/RiskBusinessServiceImpl.java
+++ b/src/main/java/au/com/royalpay/payment/manage/riskbusiness/core/impl/RiskBusinessServiceImpl.java
@@ -108,10 +108,16 @@ public class RiskBusinessServiceImpl implements RiskBusinessService, ManagerTodo
     @Override
     public JSONObject getRiskEventsByPage(JSONObject params, JSONObject manager) {
 
-        // TODO: 2018/10/19 BD看到的result_type应该是1或者4，后续改进
+        // 如果登录的角色是BD，添加查询条件result_type为1或者4，order_type为1或者2
         if (ManagerRole.BD_USER.hasRole(manager.getIntValue("role"))) {
             params.put("bd_id", manager.getString("manager_id"));
-            params.put("result_type", RiskResultTypeEnum.SEND_EMAIL_TO_BD.getResultType());
+            List<Integer> orderTypes = Arrays.asList(RiskOrderTypeEnum.WECHAT_ORDER.getOrderType(),
+                    RiskOrderTypeEnum.ALIPAY_ORDER.getOrderType());
+            params.put("order_types", orderTypes);
+
+            List<Integer> resultTypes = Arrays.asList(RiskResultTypeEnum.SEND_EMAIL_TO_BD.getResultType(),
+                    RiskResultTypeEnum.MATERIAL_NOT_PASS.getResultType());
+            params.put("result_types", resultTypes);
         }
 
         PageList<JSONObject> riskEvents = riskEventMapper.listRisksByPage(params, new PageBounds(params.getInteger("page"), 10, Order.formString("create_time.desc")));
@@ -574,7 +580,6 @@ public class RiskBusinessServiceImpl implements RiskBusinessService, ManagerTodo
 
     @Override
     public void checkTodo(JSONObject manager, List<TodoNotice> notices) {
-        // TODO: 2018/10/19  后面把if判断里面的权限改一下
         if (ManagerRole.BD_USER.hasRole(manager.getIntValue("role"))) {
             JSONObject params = new JSONObject();
             params.put("bd_id", manager.getString("manager_id"));
@@ -586,7 +591,10 @@ public class RiskBusinessServiceImpl implements RiskBusinessService, ManagerTodo
                     params.put("client_moniker", client.getString("client_moniker"));
                     List<JSONObject> riskEventList = riskEventMapper.findAll(params);
                     for (JSONObject event : riskEventList) {
-                        if (event.getIntValue("result_type") == 1) {
+                        Integer resultType = event.getIntValue("result_type");
+                        Integer orderType = event.getIntValue("order_type");
+                        // Integer是对象，所以用equals方法比较
+                        if ((resultType.equals(RiskResultTypeEnum.SEND_EMAIL_TO_BD.getResultType()) || resultType.equals(RiskResultTypeEnum.MATERIAL_NOT_PASS.getResultType())) && (orderType.equals(RiskOrderTypeEnum.WECHAT_ORDER.getOrderType()) || orderType.equals(RiskOrderTypeEnum.ALIPAY_ORDER.getOrderType()))) {
                             noticeFlag = true;
                             break;
                         }
diff --git a/src/main/java/au/com/royalpay/payment/manage/riskbusiness/web/RiskFileUploadController.java b/src/main/java/au/com/royalpay/payment/manage/riskbusiness/web/RiskFileUploadController.java
index 50a7c8500..68bb91911 100644
--- a/src/main/java/au/com/royalpay/payment/manage/riskbusiness/web/RiskFileUploadController.java
+++ b/src/main/java/au/com/royalpay/payment/manage/riskbusiness/web/RiskFileUploadController.java
@@ -42,6 +42,7 @@ public class RiskFileUploadController {
      */
     @RequestMapping(value = "/{codeKey}", method = RequestMethod.POST)
     public void upload(@PathVariable String codeKey, @RequestBody JSONObject material) {
+        riskUploadService.checkUploadMailKey(codeKey, material.getString("risk_id"));
         riskUploadService.submitMaterial(material);
         riskUploadService.deleteUploadMailKey(codeKey);
     }
diff --git a/src/main/resources/au/com/royalpay/payment/manage/mappers/riskbusiness/RiskEventMapper.xml b/src/main/resources/au/com/royalpay/payment/manage/mappers/riskbusiness/RiskEventMapper.xml
index e0c574170..575f2e469 100644
--- a/src/main/resources/au/com/royalpay/payment/manage/mappers/riskbusiness/RiskEventMapper.xml
+++ b/src/main/resources/au/com/royalpay/payment/manage/mappers/riskbusiness/RiskEventMapper.xml
@@ -51,7 +51,14 @@
         </if>
 
         <if test="bd_id != null">
-            LEFT JOIN sys_client_bd scb
+            LEFT JOIN(
+                SELECT DISTINCT client_id
+                FROM sys_client_bd
+                WHERE
+                    is_valid = 1
+                    AND bd_id = #{bd_id}
+                    AND end_date &gt; NOW()
+            ) scb
             ON sc.client_id = scb.client_id
         </if>
         <where>
@@ -61,12 +68,24 @@
             <if test="client_moniker != null">
                 AND re.client_moniker = #{client_moniker}
             </if>
-            <if test="order_type != null">
+            <if test="order_type != null and order_types == null">
                 AND re.order_type = #{order_type}
             </if>
-            <if test="result_type != null">
+            <if test="order_types != null">
+                <foreach collection="order_types" item="order_type" open="and re.order_type in (" close=")" separator=",">
+                    #{order_type}
+                </foreach>
+            </if>
+
+            <if test="result_type != null and result_types == null">
                 AND re.result_type = #{result_type}
             </if>
+            <if test="result_types != null">
+                <foreach collection="result_types" item="result_type" open="AND re.result_type IN (" close=")" separator=",">
+                    #{result_type}
+                </foreach>
+            </if>
+
             <if test="order_ids != null">
                 AND re.order_ids LIKE CONCAT('%', #{order_ids}, '%')
             </if>
@@ -82,9 +101,6 @@
             <if test="reply_email_date != null">
                 AND re.reply_email_date = #{reply_email_date}
             </if>
-            <if test="bd_id != null">
-                AND scb.bd_id = #{bd_id}
-            </if>
 
         </where>
     </select>
diff --git a/src/main/ui/static/analysis/risk_business.js b/src/main/ui/static/analysis/risk_business.js
index fff773ec3..c1924b7f6 100644
--- a/src/main/ui/static/analysis/risk_business.js
+++ b/src/main/ui/static/analysis/risk_business.js
@@ -24,8 +24,8 @@ define(['angular', 'jquery', 'uiRouter', './monitoring/analysis-monitoring'],
 
         var resultTypesMap = {
             "0": "未处理",
-            "1": "已发送邮件至BD",
-            "2": "BD已提交材料，等待审核",
+            "1": "已发送邮件",
+            "2": "已提交材料，等待审核",
             "3": "材料审核通过",
             "4": "材料审核不通过，已打回",
             "5": "已处理"
@@ -377,6 +377,7 @@ define(['angular', 'jquery', 'uiRouter', './monitoring/analysis-monitoring'],
             $scope.clientInfo = $scope.riskEvent.clientInfo;
             $scope.material={};
             $scope.material.update_time=$filter('date')(new Date(), 'yyyy-MM-dd HH:mm:ss');
+            $scope.material.risk_id = $scope.riskEvent.risk_id;
             $scope.uploadFile1 = function (files) {
                 if (files && files.length) {
                     var urls = new Array();
@@ -516,7 +517,8 @@ define(['angular', 'jquery', 'uiRouter', './monitoring/analysis-monitoring'],
                 }
             };
             $scope.submit = function (form) {
-                $http.post('/risk/upload/'+$scope.codeKey, $scope.material).then(function (resp) {
+                var codeKey = $scope.riskEvent.submit_url.substring($scope.riskEvent.submit_url.lastIndexOf('/') + 1);
+                $http.post('/risk/upload/' + codeKey, $scope.material).then(function (resp) {
                     // commonDialog.alert({title: 'Success', content: 'Submit successfully', type: 'success'});
                     alert('Submit successfully');
                     window.location.href="/risk_upload_success.html";
diff --git a/src/main/ui/static/analysis/templates/audit_material.html b/src/main/ui/static/analysis/templates/audit_material.html
index 16c92636e..b62e28732 100644
--- a/src/main/ui/static/analysis/templates/audit_material.html
+++ b/src/main/ui/static/analysis/templates/audit_material.html
@@ -153,17 +153,6 @@
                 </div>
 
             </div>
-            <!--<div class="form-group" ng-repeat="(key, value) in fileObject">-->
-                <!--<div class="col-sm-12">-->
-                    <!--<label class="control-label col-sm-2">{{key}}</label>-->
-                    <!--<div class="col-sm-4">-->
-                        <!--<div class="form-control-static">-->
-                            <!--<a ng-if="value" target="_blank" ng-href="{{value}}">-->
-                                <!--<img ng-src="{{value}}" class="col-sm-8"></a>-->
-                        <!--</div>-->
-                    <!--</div>-->
-                <!--</div>-->
-            <!--</div>-->
 
         </div>
     </div>
diff --git a/src/main/ui/static/analysis/templates/bd_upload_material.html b/src/main/ui/static/analysis/templates/bd_upload_material.html
index 010dfa15e..00983f23b 100644
--- a/src/main/ui/static/analysis/templates/bd_upload_material.html
+++ b/src/main/ui/static/analysis/templates/bd_upload_material.html
@@ -1,6 +1,6 @@
 <div class="register-box-body register-box-bg">
     <p class="login-box-msg">Easy Business，Easy Payment</p>
-    <p class="small text-info">{{clientInfo.short_name}}</p>
+    <p class="small text-info login-box-msg">{{clientInfo.short_name}}</p>
     <form novalidate name="uploadForm">
         <div class="panel-body">
             <div class="form-horizontal">
diff --git a/src/main/ui/static/analysis/templates/riskEvent_detail.html b/src/main/ui/static/analysis/templates/riskEvent_detail.html
index 78c510c4b..7e191973b 100644
--- a/src/main/ui/static/analysis/templates/riskEvent_detail.html
+++ b/src/main/ui/static/analysis/templates/riskEvent_detail.html
@@ -267,7 +267,7 @@
                                     </div>
 
                                     <a role="button"
-                                       ng-if="'100'|withRole"
+                                       ng-if="('100'|withRole) && (riskEvent.result_type == 1 || riskEvent.result_type == 4)"
                                        class="btn btn-info"
                                        ui-sref=".upload_material">
                                         Upload Material