【类 型】：fix

【原  因】: 追溯 “权限监测” 修改前的代码
【过  程】：
【影  响】：

# 类型 包含:
# feat：新功能（feature）
# fix：修补bug
# docs：文档（documentation）
# style： 格式（不影响代码运行的变动）
# refactor：重构（即不是新增功能，也不是修改bug的代码变动）
# test：增加测试
# chore：构建过程或辅助工具的变动

FlyCube/Common/Conf/config.php

@@ -25,6 +25,7 @@ return array(
 		'payLogger_path' => 'C:/phpstudy_pro/cert/logs/wechat.log', //微信支付日志路径文件
 	),
 	'LimitApi' => "*", //限制可以访问api的域名  通配符* 开放所有域名
+	'powerId' => '2dc23dcfecc05fb1', //主管理员的shop_id 用于权限判断
 	'jwtKey' => 'T!o@k_en', //签发 解析token的key
 	//mqtt
 	'mqtt' => array(

FlyCube/MpApi/Controller/AdminController.class.php

@@ -13,9 +13,8 @@ class AdminController extends PublicController
 	 */
 	public function getShopList()
 	{
-		// 权限判断
-		if (!$this->isPower()) {
-			$where['shop_id'] = $this->tokenShop_id;
+		if ($this->tokenShop_id != C('powerId')) {
+			$where['shop_id'] = $this->tokenShop_id; //非总管理员 只返回自己的账户信息
 		}
 
 		$shopDb = D('shop');
@@ -31,7 +30,7 @@ class AdminController extends PublicController
 	public function addShop()
 	{
 		// 非总管理员，拒绝操作
-		if ($this->tokenPower != 'master') {
+		if ($this->tokenShop_id != C('powerId')) {
 			echo json_encode(array('status' => 0, 'msg' => '没有权限'));
 			exit;
 		}
@@ -84,6 +83,7 @@ class AdminController extends PublicController
 		$shopDb = D('shop');
 		$adminuserDb = D('adminuser');
 
+
 		// 开启事务
 		$shopDb->startTrans();
 
@@ -129,7 +129,8 @@ class AdminController extends PublicController
 	 */
 	public function saveShop()
 	{
-		$this->isPower(); //总管理员 可接收任何shop_id 非总管理员 只可以调用自身shop_id 否则会中断
+		//总管理员 可接收任何shop_id 非总管理员 只可以调用自身shop_id 否则会中断
+		$this->isPower();
 
 		if ($_REQUEST['shop_id'] && $_REQUEST['name']  && $_REQUEST['price_min'] && $_REQUEST['weight_max'] && $_REQUEST['default_transport_price'] && $_REQUEST['default_pack_price']) {
 			//data数据
@@ -180,9 +181,8 @@ class AdminController extends PublicController
 	 */
 	public function getAdminList()
 	{
-		// 权限判断
-		if (!$this->isPower()) {
-			$where['shop_id'] = $this->tokenShop_id;
+		if ($this->tokenShop_id != C('powerId')) {
+			$where['shop_id'] = $this->tokenShop_id; //非总管理员 只返回自己的账户信息
 		}
 		$where['del'] = '0';
 		$adminuserDb = D('adminuser');
@@ -197,7 +197,8 @@ class AdminController extends PublicController
 	 */
 	public function addAdmin()
 	{
-		$this->isPower(); //总管理员 可接收任何shop_id 非总管理员 只可以调用自身shop_id 否则会中断
+		//总管理员 可接收任何shop_id 非总管理员 只可以调用自身shop_id 否则会中断
+		$this->isPower();
 
 		if ($_REQUEST['name'] && $_REQUEST['uname'] && $_REQUEST['pwd']) {
 			//如果有上传图片得操作 执行如下
@@ -239,7 +240,8 @@ class AdminController extends PublicController
 	 */
 	public function saveAdmin()
 	{
-		$this->isPower(); //总管理员 可接收任何shop_id 非总管理员 只可以调用自身shop_id 否则会中断
+		// 总管理员 可接收任何shop_id，非总管理员只能调用自身shop_id，否则会中断
+		$this->isPower();
 
 		if ($_REQUEST['id'] && $_REQUEST['uname'] && $_REQUEST['shop_id']) {
 			$adminDb = D('adminuser');
@@ -320,9 +322,8 @@ class AdminController extends PublicController
 	 */
 	public function deleteAdmin()
 	{
-		// 权限判断
-		if (!$this->isPower()) {
-			$where['shop_id'] = $this->tokenShop_id;
+		if ($this->tokenShop_id != C('powerId')) {
+			$where['shop_id'] = $this->tokenShop_id; //非总管理员
 		}
 
 		if ($_REQUEST['idArr']) {
@@ -332,7 +333,7 @@ class AdminController extends PublicController
 				: explode(',', strval($_REQUEST['idArr']));
 
 			// 判断是否包含自身 ID
-			if (in_array($this->tokenAdmin_id, $idArr)) {
+			if (in_array($this->admin_id, $idArr)) {
 				echo json_encode(['status' => 0, 'msg' => '不能删除自身']);
 				exit;
 			}
@@ -371,9 +372,12 @@ class AdminController extends PublicController
 	 */
 	public function pubMessage()
 	{
-		$this->isPower(); //总管理员 可接收任何shop_id 非总管理员 只可以调用自身shop_id 否则会中断
-
+		if ($this->tokenShop_id != C('powerId')) {
+			$shop_id = $this->tokenShop_id; //非总管理员
+		} else {
 			$shop_id = $_REQUEST['shop_id'];
+		}
+
 		// 参数校验
 		if (!isset($_REQUEST['idArr']) || !isset($_REQUEST['tit']) || !isset($_REQUEST['message']) || !isset($_REQUEST['endTime']) || !isset($_REQUEST['message']) || !isset($_REQUEST['shop_id'])) {
 			echo json_encode(array('status' => 0, 'msg' => '参数不完整'));
@@ -391,7 +395,7 @@ class AdminController extends PublicController
 		foreach ($idArr as $admin_id) {
 			$dataList[] = array(
 				'shop_id' => $shop_id,
-				'by_admin_id' => $this->tokenAdmin_id,
+				'by_admin_id' => $this->admin_id,
 				'admin_id' => intval($admin_id),
 				'message'  => $message,
 				'tit' => $tit,
@@ -415,11 +419,11 @@ class AdminController extends PublicController
 	public function getMessageList()
 	{
 		// 权限判断
-		if (!$this->isPower()) {
+		if ($this->tokenShop_id != C('powerId')) {
 			$where['m.shop_id'] = $this->tokenShop_id; // 非总管理员 只返回自己的账户信息
 		}
 
-		$adminId = $this->tokenAdmin_id; //当前管理员
+		$adminId = $this->admin_id; //当前管理员
 		$now = time();
 
 		// 构造查询条件
@@ -471,7 +475,7 @@ class AdminController extends PublicController
 	public function getAllMessageList()
 	{
 		// 权限判断
-		if (!$this->isPower()) { //非管理员 只返回自己的店铺
+		if ($this->tokenShop_id != C('powerId')) {
 			$where['m.shop_id'] = $this->tokenShop_id;
 		}
 
@@ -543,7 +547,7 @@ class AdminController extends PublicController
 	public function deleteMessage()
 	{
 		// 权限判断（总管理员可操作所有单位）
-		if (!$this->isPower()) {
+		if ($this->tokenShop_id != C('powerId')) {
 			$where['shop_id'] = $this->tokenShop_id;
 		}
 
@@ -578,9 +582,8 @@ class AdminController extends PublicController
 	 */
 	public function getCategoryList()
 	{
-		// 权限判断（总管理员可操作所有单位）
-		if (!$this->isPower()) {
-			$where['shop_id'] = $this->tokenShop_id;
+		if ($this->tokenShop_id != C('powerId')) {
+			$where['shop_id'] = $this->tokenShop_id; //非总管理员 只返回自己的账户信息
 		}
 
 		$order['sort'] = 'desc';
@@ -680,18 +683,14 @@ class AdminController extends PublicController
 			echo json_encode(array('status' => 0, 'msg' => '参数有误'));
 		}
 	}
-	/**
-	 * @description: 删除分类
-	 */
 	public function deleteCategory()
 	{
-		// 权限判断（总管理员可操作所有单位）
-		if (!$this->isPower()) {
-			$where['shop_id'] = $this->tokenShop_id;
-		}
+		//总管理员 可接收任何shop_id 非总管理员 只可以调用自身shop_id 否则会中断
+		$this->isPower();
 
 		if ($_REQUEST['delIdArr'] && $_REQUEST['shop_id']) {
 			//where条件
+			$where['shop_id'] = $_REQUEST['shop_id'];
 			$where['id'] = array("in", $_REQUEST['delIdArr']);
 			$categoryDb = D('category');
 			if ($categoryDb->where($where)->delete()) {
@@ -708,9 +707,8 @@ class AdminController extends PublicController
 	 */
 	public function getSpuList()
 	{
-		// 权限判断（总管理员可操作所有单位）
-		if (!$this->isPower()) {
-			$where['shop_id'] = $this->tokenShop_id;
+		if ($this->tokenShop_id != C('powerId')) {
+			$where['shop_id'] = $this->tokenShop_id; //非总管理员 只返回自己的账户信息
 		}
 		$where['del'] = '0';
 		$order['sort'] = 'desc';
@@ -888,9 +886,8 @@ class AdminController extends PublicController
 	 */
 	public function deleteSpu()
 	{
-		// 权限判断
-		if (!$this->isPower()) {
-			$where['shop_id'] = $this->tokenShop_id;
+		if ($this->tokenShop_id != C('powerId')) {
+			$where['shop_id'] = $this->tokenShop_id; //非总管理员 只返回自己的账户信息
 		}
 
 		if ($_REQUEST['idArr']) {
@@ -914,9 +911,8 @@ class AdminController extends PublicController
 	 */
 	public function getSkuList()
 	{
-		// 权限判断
-		if (!$this->isPower()) {
-			$where['shop_id'] = $this->tokenShop_id;
+		if ($this->tokenShop_id != C('powerId')) {
+			$where['shop_id'] = $this->tokenShop_id; //非总管理员 只返回自己的账户信息
 		}
 
 		$where['del'] = '0';
@@ -1026,9 +1022,8 @@ class AdminController extends PublicController
 	 */
 	public function deleteSku()
 	{
-		// 权限判断
-		if (!$this->isPower()) {
-			$where['shop_id'] = $this->tokenShop_id;
+		if ($this->tokenShop_id != C('powerId')) {
+			$where['shop_id'] = $this->tokenShop_id; //非总管理员 只返回自己的账户信息
 		}
 
 		if ($_REQUEST['idArr']) {
@@ -1052,8 +1047,7 @@ class AdminController extends PublicController
 	 */
 	public function getPaidOrderList()
 	{
-		// 权限判断
-		if (!$this->isPower()) {
+		if ($this->tokenShop_id != C('powerId')) {
 			$where['o.shop_id'] = $this->tokenShop_id; // 非总管理员只返回自己的订单
 		}
 
@@ -1090,9 +1084,12 @@ class AdminController extends PublicController
 	 */
 	public function getOrderList()
 	{
-		// 权限判断
-		if (!$this->isPower()) {
-			$where['shop_id'] = $this->tokenShop_id;
+		//总管理员 可接收任何shop_id 非总管理员 只可以调用自身shop_id 否则会中断
+		$this->isPower();
+
+		// 添加 shop_id 条件
+		if ($_REQUEST['shop_id'] != '') {
+			$where['shop_id'] = $_REQUEST['shop_id'];
 		}
 
 		// 添加 start_time 和 end_time 条件
@@ -1156,9 +1153,8 @@ class AdminController extends PublicController
 	 */
 	public function getOrderDetails()
 	{
-		// 权限判断
-		if (!$this->isPower()) {
-			$where['shop_id'] = $this->tokenShop_id;
+		if ($this->tokenShop_id != C('powerId')) {
+			$where['shop_id'] = $this->tokenShop_id; //非总管理员 只返回自己的账户信息
 		}
 
 		if ($_REQUEST['id']) {

FlyCube/MpApi/Controller/LoginController.class.php

@@ -54,7 +54,7 @@ class LoginController extends Controller
 				//删除多余信息
 				unset($adminInfo['pwd']);
 				//创建token
-				$token = $this->makeToken(array('shop_id' => $this->shop_id, 'admin_id' => $adminInfo['id'], 'power' => $adminInfo['power']));
+				$token = $this->makeToken(array('shop_id' => $this->shop_id, 'admin_id' => $adminInfo['id']));
 				//登陆成功 返回token
 				echo json_encode(array('status' => 1, 'msg' => '登陆成功', 'adminInfo' => $adminInfo, 'token' => $token), JSON_UNESCAPED_UNICODE);
 			} else {

FlyCube/MpApi/Controller/PlaneController.class.php

@@ -21,8 +21,7 @@ class PlaneController extends PublicController
 	 */
 	public function getPlaneClassList()
 	{
-		// 权限判断（总管理员可操作所有单位）
-		if (!$this->isPower()) {
+		if ($this->tokenShop_id != C('powerId')) { //非总管理员
 			$where['shop_id'] = $this->tokenShop_id;
 		}
 		$where['del'] = "0";
@@ -39,7 +38,8 @@ class PlaneController extends PublicController
 	 */
 	public function addPlaneClass()
 	{
-		$this->isPower(); //总管理员 可接收任何shop_id 非总管理员 只可以调用自身shop_id 否则会中断
+		//总管理员 可接收任何shop_id 非总管理员 只可以调用自身shop_id 否则会中断
+		$this->isPower();
 
 		if ($_REQUEST['shop_id'] && $_REQUEST['class_name']) {
 			$data['shop_id'] = $_REQUEST['shop_id'];
@@ -65,7 +65,8 @@ class PlaneController extends PublicController
 	 */
 	public function savePlaneClass()
 	{
-		$this->isPower(); //总管理员 可接收任何shop_id 非总管理员 只可以调用自身shop_id 否则会中断
+		//总管理员 可接收任何shop_id 非总管理员 只可以调用自身shop_id 否则会中断
+		$this->isPower();
 
 		if ($_REQUEST['shop_id'] && $_REQUEST['class_name'] && $_REQUEST['id']) {
 			$data['class_name'] = $_REQUEST['class_name'];
@@ -92,7 +93,9 @@ class PlaneController extends PublicController
 	 */
 	public function deletePlaneClass()
 	{
-		$this->isPower(); //总管理员 可接收任何shop_id 非总管理员 只可以调用自身shop_id 否则会中断
+		if ($this->tokenShop_id != C('powerId')) { // 非总管理员
+			$where['shop_id'] = $this->tokenShop_id;
+		}
 
 		if (isset($_REQUEST['idArr']) && !empty($_REQUEST['idArr'])) {
 			$idArr = explode(',', $_REQUEST['idArr']);
@@ -112,7 +115,9 @@ class PlaneController extends PublicController
 				'del' => '0'
 			];
 
-			$bindWhere['shop_id'] = $_REQUEST['shop_id'];
+			if ($this->tokenShop_id != C('powerId')) {
+				$bindWhere['shop_id'] = $this->tokenShop_id;
+			}
 
 			$linkedPlanes = $airDb->where($bindWhere)->field('id,name,bind_class_id')->select();
 
@@ -130,7 +135,9 @@ class PlaneController extends PublicController
 			// 关联飞机为空，执行软删除
 			$classDb = D('airplane_class');
 			$delWhere = ['id' => ['in', $idArr]];
-			$delWhere['shop_id'] = $_REQUEST['shop_id'];
+			if (isset($where['shop_id'])) {
+				$delWhere['shop_id'] = $where['shop_id'];
+			}
 			$data = ['del' => '1'];
 
 			if ($classDb->where($delWhere)->save($data) !== false) {
@@ -149,14 +156,15 @@ class PlaneController extends PublicController
 	 */
 	public function getAirList()
 	{
-		// 权限判断
-		if (!$this->isPower()) {
-			$where['a.shop_id'] = $this->tokenShop_id;
-		}
 		$airDb = D('airplane_register'); // 飞机表
 
 		$prefix = C('DB_PREFIX'); // 获取表前缀
 
+		$where = [];
+
+		if ($this->tokenShop_id != C('powerId')) { // 非总管理员
+			$where['a.shop_id'] = $this->tokenShop_id;
+		}
 		$where['a.del'] = '0';
 
 		// 需要的字段，带表别名
@@ -192,7 +200,7 @@ class PlaneController extends PublicController
 	 */
 	public function addAir()
 	{
-		$this->isPower(); //总管理员 可接收任何shop_id 非总管理员 只可以调用自身shop_id 否则会中断
+		$this->isPower();
 
 		if ($_REQUEST['shop_id'] && $_REQUEST['name'] && $_REQUEST['date']) {
 			$data['shop_id'] = $_REQUEST['shop_id'];
@@ -255,8 +263,7 @@ class PlaneController extends PublicController
 	 */
 	public function deleteAir()
 	{
-		// 权限判断（总管理员可操作所有单位）
-		if (!$this->isPower()) {
+		if ($this->tokenShop_id != C('powerId')) { //非总管理员
 			$where['shop_id'] = $this->tokenShop_id;
 		}
 		if (isset($_REQUEST['idArr'])) {
@@ -283,8 +290,7 @@ class PlaneController extends PublicController
 	 */
 	public function crosFrequency()
 	{
-		// 权限判断（总管理员可操作所有单位）
-		if (!$this->isPower()) {
+		if ($this->tokenShop_id != C('powerId')) { //非总管理员
 			$where['shop_id'] = $this->tokenShop_id;
 		}
 		if ($_REQUEST['macAdd'] && $_REQUEST['id']) {
@@ -308,11 +314,9 @@ class PlaneController extends PublicController
 	 */
 	public function getSiteList()
 	{
-		// 权限判断（总管理员可操作所有单位）
-		if (!$this->isPower()) {
+		if ($this->tokenShop_id != C('powerId')) { //非总管理员
 			$where['shop_id'] = $this->tokenShop_id;
 		}
-
 		$siteDb = D('receive_site');
 		$field = array('id', 'shop_id', 'sitename', 'qr', 'photo', 'bind_route', 'runing', 'describe');
 		if ($siteList = $siteDb->where($where)->field($field)->select()) {
@@ -326,7 +330,8 @@ class PlaneController extends PublicController
 	 */
 	public function addSite()
 	{
-		$this->isPower(); //总管理员 可接收任何shop_id 非总管理员 只可以调用自身shop_id 否则会中断
+		//总管理员 可接收任何shop_id 非总管理员 只可以调用自身shop_id 否则会中断
+		$this->isPower();
 
 		if ($_REQUEST['shop_id'] && $_REQUEST['sitename']) {
 			$rsDb = D('receive_site');
@@ -387,7 +392,8 @@ class PlaneController extends PublicController
 	 */
 	public function saveSite()
 	{
-		$this->isPower(); //总管理员 可接收任何shop_id 非总管理员 只可以调用自身shop_id 否则会中断
+		//总管理员 可接收任何shop_id 非总管理员 只可以调用自身shop_id 否则会中断
+		$this->isPower();
 
 		if ($_REQUEST['shop_id'] && $_REQUEST['sitename']) {
 			$rsDb = D('receive_site');
@@ -463,8 +469,7 @@ class PlaneController extends PublicController
 	 */
 	public function deleteSite()
 	{
-		// 权限判断
-		if (!$this->isPower()) {
+		if ($this->tokenShop_id != C('powerId')) { //非总管理员
 			$where['shop_id'] = $this->tokenShop_id;
 		}
 		$where['id'] = array("in", $_REQUEST['idArr']);
@@ -537,8 +542,7 @@ class PlaneController extends PublicController
 	 */
 	public function getRouteList()
 	{
-		// 权限判断
-		if (!$this->isPower()) {
+		if ($this->tokenShop_id != C('powerId')) { //非总管理员
 			$where['shop_id'] = $this->tokenShop_id;
 		}
 		$where['del'] = "0";
@@ -585,7 +589,8 @@ class PlaneController extends PublicController
 	 */
 	public function addRoute()
 	{
-		$this->isPower(); //总管理员 可接收任何shop_id 非总管理员 只可以调用自身shop_id 否则会中断
+		//总管理员 可接收任何shop_id 非总管理员 只可以调用自身shop_id 否则会中断
+		$this->isPower();
 
 		if ($_REQUEST['shop_id'] && $_REQUEST['name'] && $_REQUEST['upFile']) {
 			$routeDb = D('route');
@@ -617,7 +622,8 @@ class PlaneController extends PublicController
 	 */
 	public function saveRoute()
 	{
-		$this->isPower(); //总管理员 可接收任何shop_id 非总管理员 只可以调用自身shop_id 否则会中断
+		//总管理员 可接收任何shop_id 非总管理员 只可以调用自身shop_id 否则会中断
+		$this->isPower();
 
 		if ($_REQUEST['shop_id'] && $_REQUEST['name'] && $_REQUEST['id']) {
 			$where['id'] = $_REQUEST['id'];
@@ -653,11 +659,9 @@ class PlaneController extends PublicController
 	 */
 	public function deleteRoute()
 	{
-		// 权限判断
-		if (!$this->isPower()) {
+		if ($this->tokenShop_id != C('powerId')) { //非总管理员
 			$where['shop_id'] = $this->tokenShop_id;
 		}
-
 		// 获取要删除的航线ID数组
 		$idArr = explode(',', strval($_REQUEST['idArr']));
 
@@ -699,9 +703,10 @@ class PlaneController extends PublicController
 	public function setNoflyData()
 	{
 		if ($_REQUEST['shop_id']) {
-			// 权限判断
-			if (!$this->isPower()) {
+			if ($this->tokenShop_id != C('powerId')) {
 				$where['shop_id'] = $this->tokenShop_id;
+			} else {
+				$where['shop_id'] = $_REQUEST['shop_id'];
 			}
 
 			$noflyDb = D('nofly');
@@ -747,11 +752,19 @@ class PlaneController extends PublicController
 	 */
 	public function getNoflyData()
 	{
-		// 权限判断
-		if (!$this->isPower()) {
-			$where['shop_id'] = $this->tokenShop_id;
+		if (!isset($_REQUEST['shop_id'])) {
+			echo json_encode(['status' => 0, 'msg' => '缺少参数 shop_id']);
+			exit;
 		}
 
+		$shop_id = $_REQUEST['shop_id'];
+
+		if ($this->tokenShop_id != C('powerId')) {
+			$shop_id = $this->tokenShop_id;
+		}
+
+		$where['shop_id'] = $shop_id;
+
 		$noflyDb = D('nofly');
 		$field = ['id', 'shop_id', 'nofly_data', 'restrictfly_data', 'restrictfly_height'];
 		$noflyData = $noflyDb->where($where)->field($field)->find();
@@ -888,8 +901,7 @@ class PlaneController extends PublicController
 	 */
 	public function questAss()
 	{
-		// 权限判断
-		if (!$this->isPower()) {
+		if ($this->tokenShop_id != C('powerId')) { //非总管理员
 			$where['shop_id'] = $this->tokenShop_id;
 		}
 		//前端提交数据校验
@@ -962,10 +974,6 @@ class PlaneController extends PublicController
 	 */
 	public function getFlyDataByIdArr()
 	{
-		// 权限判断
-		if (!$this->isPower()) {
-			$where['a.shop_id'] = $this->tokenShop_id;
-		}
 		$idArrStr = I('post.idArr');
 		$startTime = I('post.startTime', 0, 'intval');
 		$endTime = I('post.endTime', 0, 'intval');
@@ -992,6 +1000,11 @@ class PlaneController extends PublicController
 			'f.start_time' => array('between', array($startTime, $endTime)),
 		);
 
+		// 非总管理员需加店铺限制
+		if ($this->tokenShop_id != C('powerId')) {
+			$where['a.shop_id'] = $this->tokenShop_id;
+		}
+
 		// 查询字段
 		$fields = array(
 			'f.id',
@@ -1025,8 +1038,7 @@ class PlaneController extends PublicController
 	 */
 	public function deleteFlyDataByIdArr()
 	{
-		// 权限判断
-		if (!$this->isPower()) {
+		if ($this->tokenShop_id != C('powerId')) { //非总管理员
 			$where['shop_id'] = $this->tokenShop_id;
 		}
 

FlyCube/MpApi/Controller/PublicController.class.php

@@ -14,8 +14,7 @@ use PhpMqtt\Client\ConnectionSettings;
 class PublicController extends Controller
 {
 	protected $tokenShop_id;
-	protected $tokenAdmin_id;
-	protected $tokenPower;
+	protected $admin_id;
 	//****************
 	//构造函数
 	//****************
@@ -33,8 +32,7 @@ class PublicController extends Controller
 			$decoded = JWT::decode($token, new Key($jwtKey, 'HS256'));
 			// Token 没有过期，继续处理 token验证通过 获取shop_id admin_id
 			$this->tokenShop_id = $decoded->shop_id;
-			$this->tokenAdmin_id = $decoded->admin_id;
-			$this->tokenPower = $decoded->power;
+			$this->admin_id = $decoded->admin_id;
 		} catch (\Firebase\JWT\ExpiredException $e) {
 			// Token 过期
 			echo json_encode(array('status' => 'noPermission', 'msg' => 'Token 已过期'));
@@ -55,9 +53,7 @@ class PublicController extends Controller
 	 */
 	protected function isPower()
 	{
-		if ($this->tokenPower == 'master') { //总管理员
-			return true;
-		} else {
+		if ($this->tokenShop_id != C('powerId')) { //非总管理员
 			if ($this->tokenShop_id != $_REQUEST['shop_id']) { // 提交的不是自己shopid退出
 				echo json_encode(array('status' => 0, 'msg' => '没有权限'));
 				exit;