fix

src/main/java/au/com/royalpay/payment/manage/mappers/system/OrgMapper.java

@@ -45,4 +45,6 @@ public interface OrgMapper {
     JSONObject findOrgByBDId(@Param("bd_id") int bd_id);
 
     PageList<JSONObject> listOrgWithPages(JSONObject paraams, PageBounds order);
+
+    List<JSONObject> listOrgAndChild(@Param("org_id") int org_id);
 }

src/main/java/au/com/royalpay/payment/manage/organizations/core/OrgManager.java

@@ -27,4 +27,5 @@ public interface OrgManager {
 
     List<JSONObject> listAllOrg();
 
+    JSONObject checkOrg(JSONObject manager, JSONObject params);
 }

src/main/java/au/com/royalpay/payment/manage/organizations/core/impls/OrgManagerImpl.java

@@ -4,6 +4,7 @@ import au.com.royalpay.payment.manage.mappers.system.OrgMapper;
 import au.com.royalpay.payment.manage.organizations.beans.OrgInfo;
 import au.com.royalpay.payment.manage.organizations.core.OrgManager;
 import au.com.royalpay.payment.tools.exceptions.BadRequestException;
+import au.com.royalpay.payment.tools.exceptions.ForbiddenException;
 import au.com.royalpay.payment.tools.permission.enums.ManagerRole;
 import au.com.royalpay.payment.tools.utils.PageListUtils;
 import com.alibaba.fastjson.JSONArray;
@@ -11,12 +12,14 @@ import com.alibaba.fastjson.JSONObject;
 import com.github.miemiedev.mybatis.paginator.domain.Order;
 import com.github.miemiedev.mybatis.paginator.domain.PageBounds;
 import com.github.miemiedev.mybatis.paginator.domain.PageList;
+import org.apache.ibatis.annotations.Param;
 import org.springframework.stereotype.Service;
 
 import javax.annotation.Resource;
 import java.util.ArrayList;
 import java.util.Date;
 import java.util.List;
+import java.util.stream.Collectors;
 
 /**
  * Created by yixian on 2016-10-18.
@@ -132,4 +135,30 @@ public class OrgManagerImpl implements OrgManager {
         }
     }
 
+    @Override
+    public JSONObject checkOrg(JSONObject manager, JSONObject params){
+        if (params.getString("org_id")==null){
+            if (manager.getInteger("org_id")!=null){
+                List<JSONObject> orgs = orgMapper.listOrgAndChild(manager.getIntValue("org_id"));
+                if (orgs.size()>1){
+                    List<Integer> orgIds = orgs.stream().map(org->org.getIntValue("org_id")).collect(Collectors.toList());
+                    params.put("org_ids",orgIds);
+                }else {
+                    params.put("org_id",manager.getIntValue("org_id"));
+                }
+            }
+        }else {
+            if (manager.getInteger("org_id")!=null){
+                List<JSONObject> orgs = orgMapper.listOrgAndChild(manager.getIntValue("org_id"));
+                List<Integer> orgIds = orgs.stream().map(org->org.getIntValue("org_id")).collect(Collectors.toList());
+                if (!orgIds.contains(params.getString("org_id"))){
+                    throw new ForbiddenException("You have no permission to query the org");
+                }
+
+            }
+
+        }
+        return params;
+    }
+
 }

src/main/java/au/com/royalpay/payment/manage/tradelog/core/impls/TradeLogServiceImpl.java

@@ -20,6 +20,7 @@ import au.com.royalpay.payment.manage.mappers.system.CustomerMapper;
 import au.com.royalpay.payment.manage.mappers.system.CustomerRelationAlipayMapper;
 import au.com.royalpay.payment.manage.mappers.system.OrgMapper;
 import au.com.royalpay.payment.manage.merchants.core.ClientManager;
+import au.com.royalpay.payment.manage.organizations.core.OrgManager;
 import au.com.royalpay.payment.manage.tradelog.beans.PreRefundQueryBean;
 import au.com.royalpay.payment.manage.tradelog.beans.TradeLogQuery;
 import au.com.royalpay.payment.manage.tradelog.core.TradeLogService;
@@ -121,7 +122,7 @@ public class TradeLogServiceImpl implements TradeLogService {
     private ClientCustomersMapper clientCustomersMapper;
 
     @Resource
-    private OrgMapper orgMapper;
+    private OrgManager orgManager;
 
     // @Value("classpath:/jasper/trans_flow.jasper")
 //    @Value("classpath:/jasper/trans_flow_new.jasper")
@@ -179,28 +180,7 @@ public class TradeLogServiceImpl implements TradeLogService {
                 params.put("bd_group_bd", query.getGroup_bd());
             }
         }
-        if (manager.getInteger("org_id") != null) {
+        orgManager.checkOrg(manager,params);
-            if(params.getString("org_id") == null) {
-                JSONObject org = orgMapper.findOne(manager.getInteger("org_id"));
-                if(org.getString("parent_org_id") != null){
-                    params.put("org_id",manager.getInteger("org_id"));
-                }else {
-                    JSONObject param = new JSONObject();
-                    param.put("parent_org_id", manager.getIntValue("org_id"));
-                    param.put("type", 0);
-                    List<Integer> orgIds = new ArrayList<>();
-                    List<JSONObject> childOrgs = orgMapper.listOrgsWithChid(param);
-                    if(childOrgs.size()>0){
-                        for (JSONObject object : childOrgs) {
-                            orgIds.add(object.getIntValue("org_id"));
-                        }
-                        orgIds.add(manager.getIntValue("org_id"));
-                        params.put("org_ids", orgIds);
-                    }
-                }
-
-            }
-        }
         PageList<JSONObject> logs = orderMapper.listOrders(params, new PageBounds(query.getPage(), query.getLimit(), Order.formString("create_time.desc")));
         JSONObject result = PageListUtils.buildPageListResult(logs);
         JSONObject analysis = orderMapper.analysisOrders(params);
@@ -208,6 +188,8 @@ public class TradeLogServiceImpl implements TradeLogService {
         return result;
     }
 
+
+
     @Override
     public List<JSONObject> listOrderRefunds(String orderId, String timezone) {
         List<JSONObject> refunds = refundMapper.listOrderRefunds(orderId, new PageBounds(Order.formString("create_time.desc")));

src/main/resources/au/com/royalpay/payment/manage/mappers/payment/OrderMapper.xml

@@ -177,7 +177,7 @@
             <if test="trade_type!=null">and o.gateway in
                 <foreach collection="trade_type" item="gateway" open="(" close=")" separator=",">#{gateway}</foreach>
             </if>
-            <if test="org_id!=null">and p.org_id=#{org_id}</if>
+            <if test="org_id!=null and org_ids==null">and p.org_id=#{org_id}</if>
             <if test="from!=null">and o.create_time &gt;= #{from}</if>
             <if test="to!=null">and o.create_time &lt; #{to}</if>
             <if test="date!=null">and date(o.create_time)=date(#{date})</if>

src/main/resources/au/com/royalpay/payment/manage/mappers/system/OrgMapper.xml

@@ -31,6 +31,10 @@
         </if>
     </select>
 
+    <select id="listOrgAndChild" resultType="com.alibaba.fastjson.JSONObject">
+        select * FROM sys_org where is_valid=1 and type=0 and (org_id=#{org_id} or parent_org_id=#{org_id})
+    </select>
+
     <!--<select id="getReferres" resultType="com.alibaba.fastjson.JSONObject">-->
         <!--SELECT m.manager_id,m.display_name,o.org_id,o.name org_name FROM sys_managers m-->
         <!--RIGHT JOIN sys_org o on o.org_id = m.org_id-->

src/main/ui/static/config/managers/templates/new_manager.html

@@ -36,17 +36,17 @@
                     </div>
                     <div class="alert alert-danger" ng-if="errmsg" ng-bind="errmsg"></div>
                 </div>
-                <div class="form-group">
+                <div class="form-group" ng-class="{'has-error':accountForm.email.$invalid && accountForm.email.$dirty}">
                     <label class="control-label" for="email-input">Email</label>
                     <input class="form-control" type="email" id="email-input" name="email"
                            ng-model="manager.email">
                 </div>
-                <div class="form-group">
+                <div class="form-group" ng-class="{'has-error':accountForm.phone.$invalid && accountForm.phone.$dirty}">
                     <label class="control-label" for="phone-input">Phone</label>
                     <input class="form-control" type="text" id="phone-input" name="phone"
                            ng-model="manager.phone">
                 </div>
-                <div class="form-group">
+                <div class="form-group" ng-class="{'has-error':accountForm.wechat.$invalid && accountForm.wechat.$dirty}">
                     <label class="control-label" for="wechat-input">WeChat Account</label>
                     <input class="form-control" type="text" id="wechat-input" name="wechat"
                            ng-model="manager.wechat">