From 3666c3d530ae9f294ae303bdff1e332e713dd17c Mon Sep 17 00:00:00 2001
From: Peanut <peanut_hzm@163.com>
Date: Sun, 19 Jul 2026 23:42:53 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20=E6=94=B6=E8=97=8F=20toggle=20=E5=A2=9E?=
 =?UTF-8?q?=E5=8A=A0=E5=AE=9E=E4=BD=93=E5=AD=98=E5=9C=A8=E6=80=A7=E5=92=8C?=
 =?UTF-8?q?=E6=9D=83=E9=99=90=E6=A0=A1=E9=AA=8C=EF=BC=88IDOR=20=E4=BF=AE?=
 =?UTF-8?q?=E5=A4=8D=EF=BC=89?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../com/emotion/service/impl/EventFavoriteServiceImpl.java | 7 +++++++
 .../emotion/service/impl/ScriptFavoriteServiceImpl.java    | 7 +++++++
 2 files changed, 14 insertions(+)

diff --git a/server/src/main/java/com/emotion/service/impl/EventFavoriteServiceImpl.java b/server/src/main/java/com/emotion/service/impl/EventFavoriteServiceImpl.java
index 6b64bd0..80657d3 100644
--- a/server/src/main/java/com/emotion/service/impl/EventFavoriteServiceImpl.java
+++ b/server/src/main/java/com/emotion/service/impl/EventFavoriteServiceImpl.java
@@ -4,6 +4,7 @@ import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
 import com.baomidou.mybatisplus.extension.plugins.pagination.Page;
 import com.baomidou.mybatisplus.extension.service.impl.ServiceImpl;
 import com.emotion.common.PageResult;
+import com.emotion.exception.BusinessException;
 import com.emotion.dto.response.EventFavoriteResponse;
 import com.emotion.dto.response.LifeEventResponse;
 import com.emotion.entity.EventFavorite;
@@ -49,6 +50,12 @@ public class EventFavoriteServiceImpl extends ServiceImpl<EventFavoriteMapper, E
             return r;
         }
 
+        // 验证事件存在且属于当前用户
+        LifeEventResponse event = lifeEventService.getEventById(eventId);
+        if (event == null) {
+            throw new BusinessException("事件不存在或无权限访问");
+        }
+
         LambdaQueryWrapper<EventFavorite> w = new LambdaQueryWrapper<>();
         w.eq(EventFavorite::getUserId, userId)
          .eq(EventFavorite::getEventId, eventId)
diff --git a/server/src/main/java/com/emotion/service/impl/ScriptFavoriteServiceImpl.java b/server/src/main/java/com/emotion/service/impl/ScriptFavoriteServiceImpl.java
index 398451d..4b5c63a 100644
--- a/server/src/main/java/com/emotion/service/impl/ScriptFavoriteServiceImpl.java
+++ b/server/src/main/java/com/emotion/service/impl/ScriptFavoriteServiceImpl.java
@@ -4,6 +4,7 @@ import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
 import com.baomidou.mybatisplus.extension.plugins.pagination.Page;
 import com.baomidou.mybatisplus.extension.service.impl.ServiceImpl;
 import com.emotion.common.PageResult;
+import com.emotion.exception.BusinessException;
 import com.emotion.dto.response.EpicScriptResponse;
 import com.emotion.dto.response.ScriptFavoriteResponse;
 import com.emotion.entity.ScriptFavorite;
@@ -49,6 +50,12 @@ public class ScriptFavoriteServiceImpl extends ServiceImpl<ScriptFavoriteMapper,
             return r;
         }
 
+        // 验证剧本存在且属于当前用户
+        EpicScriptResponse script = epicScriptService.getScriptById(scriptId);
+        if (script == null) {
+            throw new BusinessException("剧本不存在或无权限访问");
+        }
+
         LambdaQueryWrapper<ScriptFavorite> w = new LambdaQueryWrapper<>();
         w.eq(ScriptFavorite::getUserId, userId)
          .eq(ScriptFavorite::getScriptId, scriptId)