diff --git a/ljwx-boot/README.md b/ljwx-boot/README.md
index ac9a1f8..2709094 100644
--- a/ljwx-boot/README.md
+++ b/ljwx-boot/README.md
@@ -2,7 +2,7 @@


-
+
[](./LICENSE)
[](https://github.com/brunoGao)
@@ -18,6 +18,36 @@
### 🚀 最新更新
+#### v1.3.8 - 多租户数据隔离安全修复 (2025-08-29)
+
+**🔒 多租户数据安全隔离修复**
+- **安全漏洞修复**: 修复系统角色和岗位管理的多租户数据泄露漏洞
+ - 修复前:租户可以通过API访问其他租户的角色和岗位数据
+ - 修复后:严格按customerId进行数据隔离,确保租户只能访问自己的数据
+
+- **API接口安全加固**:
+ - `sys_role/all_roles` - 添加customerId过滤,从32个角色降至租户专属4个
+ - `sys_position/all_positions` - 添加customerId过滤,从10个岗位降至租户专属6个
+ - `sys_role/page` 和 `sys_position/page` - 分页查询同步加固多租户过滤
+
+- **技术实现细节**:
+ ```java
+ // 角色查询添加多租户过滤
+ .eq(ObjectUtils.isNotEmpty(customerId), SysRole::getCustomerId, customerId)
+
+ // 岗位查询添加多租户过滤
+ .eq(ObjectUtils.isNotEmpty(orgId), SysPosition::getOrgId, orgId)
+ .eq(ObjectUtils.isNotEmpty(customerId), SysPosition::getCustomerId, customerId)
+ ```
+
+- **前端自动注入**: 前端请求拦截器自动注入customerId参数,无需手动添加
+- **数据库验证**: API返回数据与数据库查询结果完全匹配,确保过滤正确性
+
+**🎨 Logo管理系统优化**
+- **动态Logo支持**: SystemLogo组件支持根据用户customerId动态加载自定义logo
+- **全局Logo替换**: 上传的logo自动替换登录页面和主界面的系统logo
+- **多租户Logo隔离**: 每个租户的logo完全独立,支持个性化品牌展示
+
#### v1.3.7 - 多租户客户配置管理功能完整实现 (2025-08-28)
**🏢 多租户客户配置管理系统**
diff --git a/ljwx-boot/ljwx-boot-admin/src/main/java/com/ljwx/admin/controller/customer/TCustomerConfigController.java b/ljwx-boot/ljwx-boot-admin/src/main/java/com/ljwx/admin/controller/customer/TCustomerConfigController.java
index 605ce80..6f6ab87 100644
--- a/ljwx-boot/ljwx-boot-admin/src/main/java/com/ljwx/admin/controller/customer/TCustomerConfigController.java
+++ b/ljwx-boot/ljwx-boot-admin/src/main/java/com/ljwx/admin/controller/customer/TCustomerConfigController.java
@@ -21,21 +21,37 @@ package com.ljwx.admin.controller.customer;
import cn.dev33.satoken.annotation.SaCheckPermission;
import com.ljwx.common.api.Result;
+import com.ljwx.infrastructure.config.LogoConfig;
+import com.ljwx.modules.customer.service.LogoUploadService;
import com.ljwx.infrastructure.page.PageQuery;
import com.ljwx.infrastructure.page.RPage;
import com.ljwx.modules.customer.domain.dto.config.TCustomerConfigAddDTO;
import com.ljwx.modules.customer.domain.dto.config.TCustomerConfigDeleteDTO;
import com.ljwx.modules.customer.domain.dto.config.TCustomerConfigSearchDTO;
import com.ljwx.modules.customer.domain.dto.config.TCustomerConfigUpdateDTO;
+import com.ljwx.modules.customer.domain.entity.TCustomerConfig;
import com.ljwx.modules.customer.domain.vo.TCustomerConfigVO;
import com.ljwx.modules.customer.facade.ITCustomerConfigFacade;
+import com.ljwx.modules.customer.service.ITCustomerConfigService;
import io.swagger.v3.oas.annotations.Operation;
import io.swagger.v3.oas.annotations.Parameter;
import io.swagger.v3.oas.annotations.tags.Tag;
import jakarta.validation.Valid;
import lombok.NonNull;
import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.core.io.FileSystemResource;
+import org.springframework.core.io.Resource;
+import org.springframework.http.HttpHeaders;
+import org.springframework.http.MediaType;
+import org.springframework.http.ResponseEntity;
import org.springframework.web.bind.annotation.*;
+import org.springframework.web.multipart.MultipartFile;
+
+import java.io.File;
+import java.time.LocalDateTime;
+import java.util.HashMap;
+import java.util.Map;
/**
* Controller 控制层
@@ -47,13 +63,23 @@ import org.springframework.web.bind.annotation.*;
*/
@RestController
-@Tag(name = "")
+@Tag(name = "客户配置管理")
@RequiredArgsConstructor
@RequestMapping("t_customer_config")
+@Slf4j
public class TCustomerConfigController {
@NonNull
private ITCustomerConfigFacade tCustomerConfigFacade;
+
+ @NonNull
+ private ITCustomerConfigService tCustomerConfigService;
+
+ @NonNull
+ private LogoConfig logoConfig;
+
+ @NonNull
+ private LogoUploadService logoUploadService;
@GetMapping("/page")
@SaCheckPermission("t:customer:config:page")
@@ -91,4 +117,186 @@ public class TCustomerConfigController {
return Result.status(tCustomerConfigFacade.batchDelete(tCustomerConfigDeleteDTO));
}
+ // ==================== Logo管理相关接口 ====================
+
+ /**
+ * 上传客户logo
+ */
+ @PostMapping("/logo/upload")
+ @SaCheckPermission("t:customer:config:logo:upload")
+ @Operation(operationId = "6", summary = "上传客户logo")
+ public Result