fix version 1

module/social/feed/internal/logic/post/action.go

@@ -22,6 +22,11 @@ func Action(ctx context.Context, in *pb.PostActionRequest) (reply *pb.DataStatus
 	if in.GetActionOp() == "" || in.GetActionType() == "" || in.GetIdentity() == "" {
 		return nil, errcode.ErrInvalidArgument
 	}
+	// 白名单校验，避免非法操作/类别拼出空列名或未绑定目标表的更新语句
+	if (in.ActionOp != "ilike" && in.ActionOp != "unlike") ||
+		(in.ActionType != "post" && in.ActionType != "comment") {
+		return nil, errcode.ErrInvalidArgument
+	}
 	if err := models.LikeAction(in.ActionOp, in.ActionType, in.Identity); err != nil {
 		printer.Error(err.Error())
 		return nil, err

module/social/feed/internal/logic/post/change.go

@@ -15,7 +15,7 @@ import (
 
 // 修改推文
 func Change(ctx context.Context, in *pb.PostItem) (reply *pb.DataStatusReply, err error) {
-	_, err = service.ParseMetaCtx(ctx, nil)
+	auth, err := service.ParseMetaCtx(ctx, nil)
 	if err != nil {
 		return nil, err
 	}
@@ -31,17 +31,22 @@ func Change(ctx context.Context, in *pb.PostItem) (reply *pb.DataStatusReply, er
 	if len(in.GetAttachs()) != 0 {
 		for _, val := range in.Attachs {
 			postData.Attachs = append(postData.Attachs, models.FeedRelateAttach{
-				Identity:   utils.UUID(),
-				AttachType: val.AttachType,
-				Url:        val.Url,
+				PostIdentity: in.Identity,
+				Identity:     utils.UUID(),
+				AttachType:   val.AttachType,
+				Url:          val.Url,
 			})
 		}
 	}
-	err = models.ChargePost(&postData)
+	// 只能修改自己发布的动态
+	affected, err := models.ChargePost(&postData, auth.Identity)
 	if err != nil {
 		printer.Error(err.Error())
 		return nil, errcode.ErrDB
 	}
+	if affected == 0 {
+		return nil, errcode.ErrPermissionDenied
+	}
 	return &pb.DataStatusReply{
 		Data:    postData.Identity,
 		Timeseq: time.Now().UnixNano(),

module/social/feed/internal/logic/post/delete_comment.go

@@ -14,18 +14,22 @@ import (
 
 // 删除评论
 func DeleteComment(ctx context.Context, in *pb.IdentRequest) (reply *pb.DataStatusReply, err error) {
-	_, err = service.ParseMetaCtx(ctx, nil)
+	auth, err := service.ParseMetaCtx(ctx, nil)
 	if err != nil {
 		return nil, err
 	}
 	if in.GetId() == 0 && in.GetIdentity() == "" {
 		return nil, errcode.ErrInvalidArgument
 	}
-	err = models.DeleteComment(in.Identity)
+	// 只能删除自己发表的评论
+	affected, err := models.DeleteComment(in.Identity, auth.Identity)
 	if err != nil {
 		printer.Error(err.Error())
 		return nil, errcode.ErrDB
 	}
+	if affected == 0 {
+		return nil, errcode.ErrPermissionDenied
+	}
 	return &pb.DataStatusReply{
 		Data:    vars.OK,
 		Timeseq: time.Now().UnixNano(),

module/social/feed/internal/logic/post/fetch.go

@@ -10,20 +10,27 @@ import (
 	"git.apinb.com/bsm-sdk/core/service"
 )
 
+// maxPageSize 单页最大条数，避免一次请求拉取过多数据
+const maxPageSize int64 = 50
+
 // 推文列表
 func Fetch(ctx context.Context, in *pb.FetchRequest) (reply *pb.PostListReply, err error) {
-	_, err = service.ParseMetaCtx(ctx, nil)
+	auth, err := service.ParseMetaCtx(ctx, nil)
 	if err != nil {
 		return nil, err
 	}
+	// 归一化分页参数：页码下限 1，单页条数上限 maxPageSize
 	if in.GetPageNo() <= 0 {
 		in.PageNo = 1
 	}
 	if in.GetPageSize() <= 0 {
 		in.PageSize = 10
 	}
+	if in.GetPageSize() > maxPageSize {
+		in.PageSize = maxPageSize
+	}
 
-	data, cnt, err := models.PostList(in.PageNo, in.PageSize, in.Params["key"])
+	data, cnt, err := models.PostList(in.PageNo, in.PageSize, in.Params["key"], auth.Identity)
 	if err != nil {
 		printer.Error(err.Error())
 		return nil, errcode.ErrDB

module/social/feed/internal/logic/post/remove.go

@@ -14,7 +14,7 @@ import (
 
 // 删除推文
 func Remove(ctx context.Context, in *pb.IdentRequest) (reply *pb.DataStatusReply, err error) {
-	_, err = service.ParseMetaCtx(ctx, nil)
+	auth, err := service.ParseMetaCtx(ctx, nil)
 	if err != nil {
 		return nil, err
 	}
@@ -22,11 +22,15 @@ func Remove(ctx context.Context, in *pb.IdentRequest) (reply *pb.DataStatusReply
 		return nil, errcode.ErrInvalidArgument
 	}
 
-	err = models.DeletePost(in.Identity)
+	// 只能删除自己发布的动态
+	affected, err := models.DeletePost(in.Identity, auth.Identity)
 	if err != nil {
 		printer.Error(err.Error())
 		return nil, errcode.ErrDB
 	}
+	if affected == 0 {
+		return nil, errcode.ErrPermissionDenied
+	}
 
 	return &pb.DataStatusReply{
 		Data:    vars.OK,