Merge branch 'master' into pre

# Conflicts:
#	netflix-web/src/main/java/com/cyksj/web/controller/user/UserController.java

netflix-web/src/main/java/com/cyksj/web/controller/payment/OrderController.java

@@ -429,7 +429,8 @@ public class OrderController {
      */
     @PostMapping("/get/zfb/upgrade/orderQrCode")
     public Result<String> zfbWebQrCodeUpgrade(@RequestBody @Validated AlipayOrderDonReq re) throws Exception {
-        AliPayParams aliPayParams = orderDonService.aliPayUpgrade(re, ZfbProductCode.PC_WEB.getProductCode(), BaseZfbConfig.qrPayMode_orderCode);
+        authorizePayment(re.getOrderId(), true);
+        AliPayParams aliPayParams = invokePayment(re.getOrderId(), () -> orderDonService.aliPayUpgrade(re, ZfbProductCode.PC_WEB.getProductCode(), BaseZfbConfig.qrPayMode_orderCode));
 //        response.setContentType("text/html;charset=" + BaseZfbConfig.charset);
         //直接将完整的表单html输出到页面
 //        response.getWriter().write(aliPayParams.getBody());
@@ -444,7 +445,8 @@ public class OrderController {
      */
     @PostMapping("/get/zfb/orderRedirect")
     public Result<String> zfbWebRedirectQrCode(@RequestBody @Validated AlipayOrderDonReq re) throws Exception {
-        AliPayParams aliPayParams = orderDonService.aliPay(re, ZfbProductCode.PC_WEB.getProductCode(), BaseZfbConfig.qrPayMode_redirect);
+        authorizePayment(re.getOrderId(), false);
+        AliPayParams aliPayParams = invokePayment(re.getOrderId(), () -> orderDonService.aliPay(re, ZfbProductCode.PC_WEB.getProductCode(), BaseZfbConfig.qrPayMode_redirect));
         return GatewayResponse.SUCCESS.newBuilder().toResult(aliPayParams.getBody());
     }
 
@@ -753,10 +755,11 @@ public class OrderController {
      */
     @PostMapping("/paypal/pay/{orderId}")
     public Result<String> paypalPay(@PathVariable Long orderId,String successUrl) throws Exception {
+        authorizePayment(orderId, false);
         final String methodName = "paypal支付";
         log.info("{}[start] orderId:{}",methodName,orderId);
 
-        Payment payment = payPalService.createPayment(orderId,successUrl);
+        Payment payment = invokePayment(orderId, () -> payPalService.createPayment(orderId, successUrl));
         String payUrl = "/";
         log.info("paypal links:{}",payment.getLinks());
         for(Links links : payment.getLinks()){
@@ -780,8 +783,9 @@ public class OrderController {
     @PostMapping("/stripe/pay/{orderId}")
     public Result<String> stripePay(@PathVariable Long orderId,String successUrl) throws Exception {
         final String methodName = "stripe支付";
+        authorizePayment(orderId, false);
         log.info("{}[start] orderId:{}",methodName,orderId);
-        String payUrl = stripeService.checkOutStripe(orderId,successUrl);
+        String payUrl = invokePayment(orderId, () -> stripeService.checkOutStripe(orderId, successUrl));
 
         log.info("Stripe支付成功 result:{}[end]",payUrl);
         return GatewayResponse.SUCCESS.newBuilder().toResult(payUrl);
@@ -922,8 +926,20 @@ public class OrderController {
     @GetMapping("/get/midjourney/user")
     public Result<MidjourneyUserView> getMidjourneyUser(Long relationId) {
         long userId = StpUserUtil.getLoginIdAsLong();
-        MidjourneyUserView search = beanSearcher.searchFirst(MidjourneyUserView.class, MapUtils.flatBuilder(request.getParameterMap())
-                .field(MidjourneyUserView::getRelationId, relationId).build());
+        // 归属校验：只允许查询当前登录用户（含绑定关系）名下的车票，避免通过 relationId 越权读取他人付费记录
+        List<Long> userIds = userBindRelationService.getRelationUserIdList(userId, null);
+        if (relationId == null || CollUtil.isEmpty(userIds)) {
+            throw BusinessRuntimeException.getInstance("车票不存在");
+        }
+        GroupsRelation relation = relationMapper.selectById(relationId);
+        if (relation == null || !userIds.contains(relation.getUserId())) {
+            throw BusinessRuntimeException.getInstance("车票不存在");
+        }
+        // 只使用显式条件，不再透传 request 参数，防止参数注入（如 ?userId=xxx）绕过归属校验
+        MidjourneyUserView search = beanSearcher.searchFirst(MidjourneyUserView.class, MapUtils.builder()
+                .field(MidjourneyUserView::getRelationId, relationId)
+                .field(MidjourneyUserView::getUserId, userIds).op(Operator.InList)
+                .build());
         if (search == null) {
             MidjourneyUser midjourneyUser = midjourneyAccountService.getMidjourneyUserToken(userId, relationId);
             search = new MidjourneyUserView();
@@ -1066,10 +1082,11 @@ public class OrderController {
      */
     @PostMapping("/paypalV2/pay/{orderId}")
     public Result<String> paypalV2Pay(@PathVariable Long orderId,String successUrl) throws Exception {
+        authorizePayment(orderId, false);
         final String methodName = "paypal支付";
         log.info("{}[start] orderId:{}",methodName,orderId);
 
-        String payUrl = paypalV2Service.createPayment(orderId,successUrl);
+        String payUrl = invokePayment(orderId, () -> paypalV2Service.createPayment(orderId, successUrl));
         log.info("paypal links:{}",payUrl);
         log.info("paypal支付成功[end]");
 

netflix-web/src/main/java/com/cyksj/web/controller/user/UserController.java

@@ -15,6 +15,7 @@ import com.cyksj.mapper.*;
 import com.cyksj.mapper.manage.coupon.CouponUserMapper;
 import com.cyksj.mapper.manage.exchange.ExchangeCodeMapper;
 import com.cyksj.mapper.manage.distribute.*;
+import com.cyksj.mapper.manage.exchange.ExchangeCodeMapper;
 import com.cyksj.mapper.mirrorshop.UserMirrorShopMapper;
 import com.cyksj.model.dto.UserWhoami;
 import com.cyksj.model.entity.*;
@@ -132,6 +133,7 @@ public class UserController {
     @GetMapping("/get/ticket/code/detail")
     public Result<ExchangeCodeDetailView> getTicketCodeDetail(
             @RequestParam(value = "code", required = false) String code) throws Exception {
+        StpUserUtil.getLoginIdAsLong();
         // Spring already decodes query parameters. Never decode a second time.
         // Accept legacy underscore/hyphen codes, but reject whitespace and encoded payloads.
         if (code == null || !code.matches("[A-Za-z0-9_-]{1,256}")) {