非本人的病历不能修改

src/main/java/cn/hnthyy/thmz/controller/mz/MzBlRecordController.java

@@ -1,8 +1,10 @@
 package cn.hnthyy.thmz.controller.mz;
 
 import cn.hnthyy.thmz.Utils.DateUtil;
+import cn.hnthyy.thmz.Utils.TokenUtil;
 import cn.hnthyy.thmz.comment.UserLoginToken;
 import cn.hnthyy.thmz.entity.his.mz.*;
+import cn.hnthyy.thmz.entity.thmz.User;
 import cn.hnthyy.thmz.enums.GenderEnum;
 import cn.hnthyy.thmz.service.his.mz.EmployeeService;
 import cn.hnthyy.thmz.service.his.mz.MzBlRecordService;
@@ -14,6 +16,7 @@ import org.apache.commons.lang3.StringUtils;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.web.bind.annotation.*;
 
+import javax.servlet.http.HttpServletRequest;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
@@ -204,7 +207,7 @@ public class MzBlRecordController {
      */
     @UserLoginToken
     @RequestMapping(value = "/setEmrProcess", method = {RequestMethod.POST})
-    public Map<String, Object> setEmrProcess(@RequestBody MzBlRecord mzBlRecord) {
+    public Map<String, Object> setEmrProcess(@RequestBody MzBlRecord mzBlRecord, HttpServletRequest httpServletRequest) {
         Map<String, Object> resultMap = new HashMap<>();
         try {
             if (mzBlRecord == null) {
@@ -233,6 +236,12 @@ public class MzBlRecordController {
                 resultMap.put("message", "修改门诊病历的处理意见失败,病历不存在");
                 return resultMap;
             }
+            User tokenUser = TokenUtil.getUser(httpServletRequest);
+            if(!tokenUser.getUserIdCode().equals(dbMzBlRecord.getDoctorCode())){
+                resultMap.put("code", -1);
+                resultMap.put("message", "修改门诊病历的处理意见失败,您无法修改非您本人接诊的病历！");
+                return resultMap;
+            }
             if (dbMzBlRecord.getEmrProcess().indexOf("_补充处理：") > 0) {
                 dbMzBlRecord.setEmrProcess(dbMzBlRecord.getEmrProcess().substring(0, dbMzBlRecord.getEmrProcess().indexOf("_补充处理：")));
             }