Merge branch 'shizhongqi-avatar' into dev

app-ghs/controllers/ShopController.php

@@ -336,7 +336,6 @@ class ShopController extends BaseController
     //切换门店 lqh 2021.1.31
     public function actionToggleShop()
     {
-
         $mainId = $this->mainId;
         $adminId = $this->adminId;
         if (getenv('YII_ENV') == 'production') {

biz-ghs/admin/classes/AdminClass.php

@@ -410,6 +410,13 @@ class AdminClass extends BaseClass
         if (empty($right)) {
             util::fail("没有权限");
         }
+
+        // 判断 $newShop 是否本账号下的门店
+        $exit = ShopAdminClass::exists(['adminId'=>$admin->id, 'mainId'=>$newShop->mainId]);
+        if (!$exit) { // 不存在说明不是本账号下的门店，则直接返回
+            util::fail("切换的不是您的门店");
+        }
+
         $newShopId = $newShop->id ?? 0;
         $lsShopId = $newShop->lsShopId ?? 0;
         $shopAdmin = \biz\shop\classes\ShopAdminClass::changeShopAddRelate($originShopAdmin, $newShop);