支付审批，项目校验

app/lib/stage_im.js

@@ -1037,7 +1037,7 @@ class StageIm {
     _sortImData() {
         const st = (['fj', 'sz'].indexOf(this.tender.info.s_type) >= 0 && [imType.zl.value, imType.bw.value].indexOf(stage.im_type) >= 0)
             ? SortType.TZ
-            : (stage.im_type !== imType.tz.value && stage.im_type !== imType.bb.value ? SortType.GCL : SortType.TZ);
+            : (this.stage.im_type !== imType.tz.value && this.stage.im_type !== imType.bb.value ? SortType.GCL : SortType.TZ);
         if (st === SortType.GCL) {
             const helper = this.ctx.helper;
             this.ImData.sort(function(x, y) {

app/middleware/payment_tender_check.js

@@ -30,6 +30,7 @@ module.exports = options => {
                 throw '当前未打开标段';
             }
             const tender = yield this.service.paymentTender.getDataById(this.params.id);
+            if (tender.pid !== this.session.sessionProject.id) throw '您无权查看该项目';
             const projectInfo = yield this.service.project.getDataById(this.session.sessionProject.id);
             const modes = projectInfo.payment_setting ? JSON.parse(projectInfo.payment_setting) : _.cloneDeep(paymentConst.setting_modes);
             for (const m in paymentConst.setting_modes) {