修复相关漏洞

2026-09-17 09:53:50 +08:00
parent 20ea1bc70c
commit e9894538e8
28 changed files with 757 additions and 51 deletions
@@ -25,6 +25,11 @@ public class OnboardingPublicTaskService : IOnboardingPublicTaskService
    /// 通过有效 Token 获取任务创建时冻结的材料、合同和新版入职登记表信息。
    /// </summary>
    public async Task<OnboardingTaskPublicDetailOutput> Detail(OnboardingTaskPublicAccessInput input)
+    {
+        return await OnboardingConcurrency.RunPublic(_db, input.Token, () => DetailCore(input));
+    }
+
+    private async Task<OnboardingTaskPublicDetailOutput> DetailCore(OnboardingTaskPublicAccessInput input)
    {
        var link = await GetActiveLink(input.Token);
        var task = await _db.Queryable<ObOnboardingTask>().InSingleAsync(link.TaskId)
@@ -136,6 +141,11 @@ public class OnboardingPublicTaskService : IOnboardingPublicTaskService
    /// 保存候选人的固定基础信息并刷新尚未确认的合同变量快照。
    /// </summary>
    public async Task SaveEmployeeInfo(OnboardingTaskPublicSaveInput input)
+    {
+        await OnboardingConcurrency.RunPublic(_db, input.Token, () => SaveEmployeeInfoCore(input), transactional: true);
+    }
+
+    private async Task SaveEmployeeInfoCore(OnboardingTaskPublicSaveInput input)
    {
        var link = await GetActiveLink(input.Token);
        var task = await _db.Queryable<ObOnboardingTask>().InSingleAsync(link.TaskId)
@@ -192,6 +202,12 @@ public class OnboardingPublicTaskService : IOnboardingPublicTaskService
    /// </summary>
    public async Task<OnboardingPublicContractPrepareOutput> PrepareContract(
        OnboardingPublicContractSourceInput input)
+    {
+        return await OnboardingConcurrency.RunPublic(_db, input.Token, () => PrepareContractCore(input));
+    }
+
+    private async Task<OnboardingPublicContractPrepareOutput> PrepareContractCore(
+        OnboardingPublicContractSourceInput input)
    {
        var link = await GetActiveLink(input.Token);
        var contract = await _db.Queryable<ObTaskContract>()
@@ -233,6 +249,11 @@ public class OnboardingPublicTaskService : IOnboardingPublicTaskService
    /// 返回已经准备完成的合同文件，下载阶段不再执行变量校验和文档生成。
    /// </summary>
    public async Task<long> GetContractSourceFileId(OnboardingPublicContractSourceInput input)
+    {
+        return await OnboardingConcurrency.RunPublic(_db, input.Token, () => GetContractSourceFileIdCore(input));
+    }
+
+    private async Task<long> GetContractSourceFileIdCore(OnboardingPublicContractSourceInput input)
    {
        var link = await GetActiveLink(input.Token);
        var contract = await _db.Queryable<ObTaskContract>()