权限 bug

server/apps/supervision/views.py

@@ -216,12 +216,15 @@ class RecordViewSet(PageOrNot, CreateUpdateCustomMixin, ModelViewSet):
                 queryset = queryset.filter(belong_dept__in = belong_depts)
             elif '本级' in data_range:
                 queryset = queryset.filter(belong_dept = user.dept)
-        if not self.request.query_params.get('pageoff', None):
-            queryset = queryset.exclude(state='待发布')
         if self.request.query_params.get('only', None) == 'true':
             queryset = queryset.filter(belong_dept = user.dept)
         return queryset
 
+    def filter_queryset(self, queryset):
+        if not self.request.query_params.get('pageoff', None):
+            queryset = queryset.exclude(state='待发布')
+        return super().filter_queryset(queryset)
+
     @action(methods=['get'], detail=False, perms_map = {'get':'*'})
     def todos(self, request, *args, **kwargs):
         ret={}
@@ -234,7 +237,7 @@ class RecordViewSet(PageOrNot, CreateUpdateCustomMixin, ModelViewSet):
         return Response(ret)
 
     def update(self, request, *args, **kwargs):
-        instance = Record.objects.get(pk=kwargs['pk'])
+        instance = self.get_object()
         instance.note = request.data.get('note', None)
         instance.update_by = request.user
         instance.save()