tongbu

@@ -39,11 +39,11 @@ class AdminFaultAuditController extends AdminBaseController{
             ->field('a.*,b.serial_number,b.hospital,u.phone')
             ->field('a.*,b.serial_number,b.hospital,u.phone')
             ->join('equipment b','a.eq_name=b.name')
             ->join('equipment b','a.eq_name=b.name')
             ->join('users u','a.users_id=u.id')
             ->join('users u','a.users_id=u.id')
+            ->where('b.is_delete',0)
             ->where($where)
             ->where($where)
             ->order('a.state','ase')
             ->order('a.state','ase')
             ->order('a.create_time','desc')
             ->order('a.create_time','desc')
             ->paginate(10);
             ->paginate(10);
-
         $this->assign('page',$data->render());
         $this->assign('page',$data->render());
         $this->assign('data',$data);
         $this->assign('data',$data);
         $this->assign('fault_type', isset($param['fault_type']) ? $param['fault_type'] : '');
         $this->assign('fault_type', isset($param['fault_type']) ? $param['fault_type'] : '');

@@ -374,6 +374,10 @@ class App
         $controller = strip_tags($result[1] ?: $config['default_controller']);
         $controller = strip_tags($result[1] ?: $config['default_controller']);
         $controller = $convert ? strtolower($controller) : $controller;
         $controller = $convert ? strtolower($controller) : $controller;
 
 
+        if (!preg_match('/^[A-Za-z](\w|\.)*$/', $controller)) {
+            throw new HttpException(404, 'controller not exists:' . $controller);
+        }
+
         // 获取操作名
         // 获取操作名
         $actionName = strip_tags($result[2] ?: $config['default_action']);
         $actionName = strip_tags($result[2] ?: $config['default_action']);
         $actionName = $convert ? strtolower($actionName) : $actionName;
         $actionName = $convert ? strtolower($actionName) : $actionName;