fix

wallet/controllers/ExploreAppController.php

@@ -99,6 +99,13 @@ class ExploreAppController extends BaseController
                 goto doEnd;
             }
             $model = ExploreAppCategory::findOne($id);
+
+            if ($model->platform_id != $platform_id) {
+                $msg = '无权修改';
+                $code = -1;
+                goto doEnd;
+            }
+
             $model->setScenario(ExploreAppCategory::SCENARIOS_UPDATE);
             unset($params['id']);
             $params['platform_id'] = $platform_id;
@@ -146,6 +153,13 @@ class ExploreAppController extends BaseController
                 goto doEnd;
             }
             $model = ExploreAppCategory::find()->where(['id' => $id, 'platform_id' => $platform_id])->one();
+
+            if ($model->platform_id != $platform_id) {
+                $msg = '无权修改';
+                $code = -1;
+                goto doEnd;
+            }
+
             if (!$model->delete()) {
                 $msg = '删除失败';
                 $code = -1;
@@ -247,6 +261,13 @@ class ExploreAppController extends BaseController
                 goto doEnd;
             }
             $model = ExploreApp::findOne($id);
+
+            if ($model->platform_id != $platform_id) {
+                $msg = '无权修改';
+                $code = -1;
+                goto doEnd;
+            }
+
             $model->setScenario(ExploreApp::SCENARIOS_UPDATE);
             unset($params['id']);
             $params['platform_id'] = $platform_id;
@@ -288,6 +309,13 @@ class ExploreAppController extends BaseController
         }
         if (Yii::$app->request->isDelete) {
             $model = ExploreApp::find()->where(['id' => $id, 'platform_id' => $platform_id])->one();
+
+            if ($model->platform_id != $platform_id) {
+                $msg = '无权修改';
+                $code = -1;
+                goto doEnd;
+            }
+
             if (false == $model || !$model->delete()) {
                 $msg = '删除失败';
                 $code = -1;