From a5436dea67f4ef22f1085bc521b715bad4007184 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E7=96=AF=E7=8B=82=E7=9A=84=E7=8B=AE=E5=AD=90Li?=
 <15040126243@163.com>
Date: Fri, 28 Aug 2026 13:47:58 +0800
Subject: [PATCH] =?UTF-8?q?update=20=E4=BC=98=E5=8C=96=20=E6=A0=A1?=
 =?UTF-8?q?=E9=AA=8C=E5=BD=93=E5=89=8D=E7=99=BB=E5=BD=95=E7=94=A8=E6=88=B7?=
 =?UTF-8?q?=E6=98=AF=E5=90=A6=E5=8F=AF=E4=BB=A5=E8=AF=BB=E5=8F=96=E4=BB=BB?=
 =?UTF-8?q?=E5=8A=A1=E4=BF=A1=E6=81=AF?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../service/impl/FlwTaskServiceImpl.java      | 60 ++++++++++++++++++-
 1 file changed, 59 insertions(+), 1 deletion(-)

diff --git a/ruoyi-modules/ruoyi-workflow/src/main/java/org/dromara/workflow/service/impl/FlwTaskServiceImpl.java b/ruoyi-modules/ruoyi-workflow/src/main/java/org/dromara/workflow/service/impl/FlwTaskServiceImpl.java
index 3ac62e936..5744fe3fb 100644
--- a/ruoyi-modules/ruoyi-workflow/src/main/java/org/dromara/workflow/service/impl/FlwTaskServiceImpl.java
+++ b/ruoyi-modules/ruoyi-workflow/src/main/java/org/dromara/workflow/service/impl/FlwTaskServiceImpl.java
@@ -1,5 +1,7 @@
 package org.dromara.workflow.service.impl;
 
+import cn.dev33.satoken.exception.NotPermissionException;
+import cn.dev33.satoken.stp.StpUtil;
 import cn.hutool.core.bean.BeanUtil;
 import cn.hutool.core.collection.CollUtil;
 import cn.hutool.core.convert.Convert;
@@ -81,6 +83,13 @@ import static org.dromara.workflow.common.constant.FlowConstant.*;
 @Service
 public class FlwTaskServiceImpl implements IFlwTaskService {
 
+    private static final Set<String> TASK_READ_ASSIGNEE_TYPES = Set.of(
+        TaskAssigneeType.APPROVER.getCode(),
+        TaskAssigneeType.TRANSFER.getCode(),
+        TaskAssigneeType.DELEGATE.getCode(),
+        TaskAssigneeType.COPY.getCode()
+    );
+
     private final TaskService taskService;
     private final InsService insService;
     private final DefService defService;
@@ -699,6 +708,7 @@ public class FlwTaskServiceImpl implements IFlwTaskService {
         if (ObjectUtil.isNull(task)) {
             return null;
         }
+        checkTaskReadAccess(task);
         FlowTaskVo flowTaskVo = BeanUtil.toBean(task, FlowTaskVo.class);
         Instance instance = insService.getById(task.getInstanceId());
         if (ObjectUtil.isNull(instance)) {
@@ -960,14 +970,62 @@ public class FlwTaskServiceImpl implements IFlwTaskService {
      */
     @Override
     public List<UserDTO> currentTaskAllUser(List<Long> taskIds) {
+        if (CollUtil.isEmpty(taskIds)) {
+            return Collections.emptyList();
+        }
+        List<Long> validTaskIds = new ArrayList<>();
+        for (Long taskId : taskIds) {
+            if (ObjectUtil.isNull(taskId)) {
+                continue;
+            }
+            Task task = taskService.getById(taskId);
+            if (ObjectUtil.isNotNull(task)) {
+                checkTaskReadAccess(task);
+                validTaskIds.add(taskId);
+            }
+        }
+        if (CollUtil.isEmpty(validTaskIds)) {
+            return Collections.emptyList();
+        }
         // 获取与当前任务关联的用户列表
-        List<User> userList = FlowEngine.userService().getByAssociateds(taskIds);
+        List<User> userList = FlowEngine.userService().getByAssociateds(validTaskIds);
         if (CollUtil.isEmpty(userList)) {
             return Collections.emptyList();
         }
         return userService.selectListByIds(StreamUtils.toList(userList, e -> Convert.toLong(e.getProcessedBy())));
     }
 
+    /**
+     * 校验当前登录用户是否可以读取任务信息。
+     *
+     * <p>任务读取接口同时服务于普通审批和流程监控，不能只依赖管理菜单权限。
+     * 普通用户必须是任务办理关系人、流程发起人或抄送接收人；监控/管理角色
+     * 通过任务列表或编辑权限进入管理读取范围。</p>
+     *
+     * @param task 当前任务
+     */
+    private void checkTaskReadAccess(Task task) {
+        if (LoginHelper.isSuperAdmin()
+            || StpUtil.hasPermission("workflow:task:list")
+            || StpUtil.hasPermission("workflow:task:edit")) {
+            return;
+        }
+        String userId = LoginHelper.getUserIdStr();
+        List<User> associatedUsers = FlowEngine.userService().getByAssociateds(List.of(task.getId()));
+        boolean taskAssignee = CollUtil.isNotEmpty(associatedUsers)
+            && associatedUsers.stream()
+            .anyMatch(user -> Objects.equals(userId, user.getProcessedBy())
+                && TASK_READ_ASSIGNEE_TYPES.contains(Convert.toStr(user.getType())));
+        if (taskAssignee) {
+            return;
+        }
+        Instance instance = insService.getById(task.getInstanceId());
+        if (ObjectUtil.isNotNull(instance) && Objects.equals(instance.getCreateBy(), userId)) {
+            return;
+        }
+        throw new NotPermissionException("无权访问该流程任务");
+    }
+
     /**
      * 按照节点编码查询节点
      *