From a8a151b98fea24140c17753cfdc366edbe7e7bde Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E6=9C=B1=E9=87=91=E5=8B=87?= <zhujinyong@chandao.com>
Date: Sun, 4 Jan 2026 09:33:50 +0800
Subject: [PATCH] * [apiv2] Check objectID.

---
 module/testreport/zen.php | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/module/testreport/zen.php b/module/testreport/zen.php
index 39f1bbbba1..a80c608271 100644
--- a/module/testreport/zen.php
+++ b/module/testreport/zen.php
@@ -25,8 +25,12 @@ class testreportZen extends testreport
         if($objectType == 'product')
         {
             $productID = $this->product->checkAccess($objectID, $this->products);
+
+            if($this->app->apiVersion && $objectID != $productID) return $this->sendError('Cannot access this product.');
+
             $this->loadModel('qa')->setMenu($productID);
             $this->view->productID = $productID;
+
             return $productID;
         }
 
@@ -34,6 +38,9 @@ class testreportZen extends testreport
         {
             $executions  = $this->execution->getPairs();
             $executionID = $this->execution->checkAccess($objectID, $executions);
+
+            if($this->app->apiVersion && $objectID != $executionID) return $this->sendError('Cannot access this execution.');
+
             $this->execution->setMenu($executionID);
             $this->view->executionID = $executionID;
             return $executionID;
@@ -43,6 +50,9 @@ class testreportZen extends testreport
         {
             $projects  = $this->project->getPairsByProgram();
             $projectID = $this->project->checkAccess($objectID, $projects);
+
+            if($this->app->apiVersion && $objectID != $projectID) return $this->sendError('Cannot access this project.');
+
             $this->project->setMenu($projectID);
             $this->view->projectID = $projectID;
             return $projectID;