feat: 添加权限检查和合同类型验证到列设置功能

app/controller/contract_controller.js

@@ -409,9 +409,11 @@ module.exports = app => {
          */
         async colSet(ctx) {
             try {
+                if (!ctx.session.sessionUser.is_admin) throw '无权进行列设置';
                 const colType = ctx.request.body.col_type;
                 const colSet = JSON.parse(ctx.request.body.col_set);
                 const contractType = ctx.request.body.type;
+                if ([contractConst.type.expenses, contractConst.type.income].indexOf(contractType) < 0) throw '合同类型错误';
                 await ctx.service.contractColSet.setContractColSet(ctx.subProject.id, ctx.contractOptions.tid, contractType, colType, colSet);
                 ctx.redirect(ctx.request.header.referer);
             } catch (err) {