Merge branch 'master' of http://git.zhenyangtang.com.cn/ZYT/zyt

i

server/app/adminapi/controller/tcm/DiagnosisController.php

@@ -429,13 +429,17 @@ class DiagnosisController extends BaseAdminController
      */
     public function getCallRecords()
     {
-        $params = $this->request->get();
-
-        if (empty($params['diagnosis_id'])) {
-            return $this->fail('诊单ID不能为空');
+        $rawDiagnosisId = $this->request->get('diagnosis_id', 0);
+        $diagnosisId = is_int($rawDiagnosisId) || is_string($rawDiagnosisId)
+            ? filter_var($rawDiagnosisId, FILTER_VALIDATE_INT, ['options' => ['min_range' => 1]])
+            : false;
+        if ($diagnosisId === false) {
+            return $this->fail('诊单ID无效');
         }
-
-        $result = DiagnosisLogic::getCallRecords($params);
+        if (!DiagnosisLogic::canViewReadonlyDiagnosis($diagnosisId, (int) $this->adminId, $this->adminInfo)) {
+            return $this->fail(DiagnosisLogic::getError() ?: '诊单不存在或无权访问');
+        }
+        $result = DiagnosisLogic::getCallRecords(['diagnosis_id' => $diagnosisId]);
         return $this->data($result);
     }