diff --git a/module/user/model.php b/module/user/model.php
index 5805cb673b..5e024627d2 100644
--- a/module/user/model.php
+++ b/module/user/model.php
@@ -2467,122 +2467,145 @@ class userModel extends model
     }
 
     /**
-     * Check program priv
+     * 检查用户是否有此项目集的查看权限。
+     * Check program priv.
      *
-     * @param  object $program
-     * @param  string $account
-     * @param  array  $stakeholders
-     * @param  array  $whiteList
-     * @param  array  $admins
-     * @access public
+     * @param  object  $program
+     * @param  string  $account
+     * @param  array   $stakeholders
+     * @param  array   $whiteList
+     * @param  array   $admins
+     * @access private
      * @return bool
      */
-    public function checkProgramPriv(object $program, string $account, array $stakeholders = array(), array $whiteList = array(), $admins = array()): bool
+    private function checkProgramPriv(object $program, string $account, array $stakeholders = array(), array $whiteList = array(), $admins = array()): bool
     {
+        /* 当前用户为管理员则判断为有权限。 */
         if(strpos($this->app->company->admins, ',' . $account . ',') !== false) return true;
 
+        /* 当前用户为项目集的PM或创建者则判断为有权限。 */
         if($program->PM == $account || $program->openedBy == $account) return true;
 
-        /* Parent program managers. */
+        /* 如果是项目集内公开，则检查所有父项目集的权限。 */
         if($program->parent != 0 && $program->acl == 'program')
         {
             $path    = str_replace(",{$program->id},", ',', "{$program->path}");
             $parents = $this->dao->select('openedBy,PM')->from(TABLE_PROGRAM)->where('id')->in($path)->fetchAll();
-            foreach($parents as $parent) if($parent->PM == $account) return true;
+            foreach($parents as $parent)
+            {
+                /* 当前用户是其中一个父项目集的PM或创建者则判断为有权限。 */
+                if($parent->PM == $account || $parent->openedBy == $account) return true;
+            }
         }
 
-        if($program->acl == 'open') return true;
-
-        if(isset($stakeholders[$account])) return true;
-        if(isset($whiteList[$account]))    return true;
-        if(isset($admins[$account]))       return true;
+        if($program->acl == 'open')        return true; // 如果项目集为公开则判断为有权限。
+        if(isset($stakeholders[$account])) return true; // 如果该用户是项目集的干系人则判断为有权限。
+        if(isset($whiteList[$account]))    return true; // 如果该用户是项目集的白名单成员则判断为有权限。
+        if(isset($admins[$account]))       return true; // 如果该用户是项目集的管理人员则判断为有权限。
 
         return false;
     }
 
     /**
+     * 检查用户是否有此项目或者迭代的查看权限。
      * Check project priv.
      *
-     * @param  object    $project
-     * @param  string    $account
-     * @param  string    $groups
-     * @param  array     $teams
-     * @param  array     $whiteList
-     * @param  array     $admins
-     * @access public
+     * @param  object  $project
+     * @param  string  $account
+     * @param  array   $stakeholders
+     * @param  array   $teams
+     * @param  array   $whiteList
+     * @param  array   $admins
+     * @access private
      * @return bool
      */
-    public function checkProjectPriv(object $project, string $account, array $stakeholders, array $teams, array $whiteList, array $admins = array()): bool
+    private function checkProjectPriv(object $project, string $account, array $stakeholders, array $teams, array $whiteList, array $admins = array()): bool
     {
+        /* 当前用户为管理员则判断为有权限。 */
         if(strpos($this->app->company->admins, ',' . $account . ',') !== false) return true;
-        if($project->PO == $account OR $project->QD == $account OR $project->RD == $account OR $project->PM == $account) return true;
 
-        if($project->acl == 'open')        return true;
-        if(isset($teams[$account]))        return true;
-        if(isset($stakeholders[$account])) return true;
-        if(isset($whiteList[$account]))    return true;
-        if(isset($admins[$account]))       return true;
+        /* 当前用户为项目集的PO、QD、RD、PM则判断为有权限。 */
+        if($project->PO == $account || $project->QD == $account || $project->RD == $account || $project->PM == $account) return true;
 
-        /* Parent program managers. */
+        if($project->acl == 'open')        return true; // 如果项目为公开则判断为有权限。
+        if(isset($stakeholders[$account])) return true; // 如果该用户是项目的干系人则判断为有权限。
+        if(isset($teams[$account]))        return true; // 如果该用户是项目的团队成员则判断为有权限。
+        if(isset($whiteList[$account]))    return true; // 如果该用户是项目的白名单成员则判断为有权限。
+        if(isset($admins[$account]))       return true; // 如果该用户是项目的管理人员则判断为有权限。
+
+        /* 如果是项目类型并且项目集内公开，则检查所有父项目集的权限。 */
         if($project->type == 'project' && $project->parent != 0 && $project->acl == 'program')
         {
             $path     = str_replace(",{$project->id},", ',', "{$project->path}");
             $programs = $this->dao->select('openedBy,PM')->from(TABLE_PROJECT)->where('id')->in($path)->fetchAll();
-            foreach($programs as $program) if($program->PM == $account) return true;
+            foreach($programs as $program)
+            {
+                /* 当前用户是其中一个父项目集的PM或创建者则判断为有权限。 */
+                if($program->PM == $account || $program->openedBy == $account) return true;
+            }
         }
 
-        /* Judge sprint auth. */
-        if(($project->type == 'sprint' or $project->type == 'stage' or $project->type == 'kanban') and $project->acl == 'private')
+        /* 如果是迭代并且是私有的，则检查所属项目的权限。 */
+        if(($project->type == 'sprint' || $project->type == 'stage' || $project->type == 'kanban') && $project->acl == 'private')
         {
-            $parent = $this->dao->select('openedBy,PM')->from(TABLE_PROJECT)->where('id')->eq($project->project)->fetch();
-            if(empty($parent)) return false;
-            if($parent->PM == $account or $parent->openedBy == $account) return true;
+            $project = $this->dao->select('openedBy,PM')->from(TABLE_PROJECT)->where('id')->eq($project->project)->fetch();
+            if(empty($project)) return false;
+
+            /* 当前用户是所属项目的PM或创建者则判断为有权限。 */
+            if($project->PM == $account || $project->openedBy == $account) return true;
         }
 
         return false;
     }
 
     /**
+     * 检查用户是否有此迭代的查看权限。
      * Check sprint priv.
      *
-     * @param  object    $project
-     * @param  string    $account
-     * @param  string    $groups
-     * @param  array     $teams
-     * @param  array     $whiteList
-     * @param  array     $admins
-     * @access public
+     * @param  object  $project
+     * @param  string  $account
+     * @param  array   $stakeholders
+     * @param  array   $teams
+     * @param  array   $whiteList
+     * @param  array   $admins
+     * @access private
      * @return bool
      */
-    public function checkSprintPriv($sprint, $account, $stakeholders, $teams, $whiteList, $admins = array())
+    private function checkSprintPriv(object $sprint, string $account, array $stakeholders, array $teams, array $whiteList, array $admins = array()): bool
     {
         return $this->checkProjectPriv($sprint, $account, $stakeholders, $teams, $whiteList, $admins);
     }
 
     /**
+     * 检查用户是否有此产品的查看权限。
      * Check product priv.
      *
-     * @param  object $product
-     * @param  string $account
-     * @param  array  $linkedProjects
-     * @param  array  $teams
-     * @param  array  $whiteList
-     * @param  array  $admins
-     * @access public
+     * @param  object  $product
+     * @param  string  $account
+     * @param  array   $teams
+     * @param  array   $stakeholders
+     * @param  array   $whiteList
+     * @param  array   $admins
+     * @access private
      * @return bool
      */
-    public function checkProductPriv(object $product, string $account, array $teams, array $stakeholders, array $whiteList, array $admins = array()): bool
+    private function checkProductPriv(object $product, string $account, array $teams, array $stakeholders, array $whiteList, array $admins = array()): bool
     {
-        if(strpos($this->app->company->admins, ',' . $account . ',') !== false) return true;
-        if(strpos(",{$product->reviewer},", ',' . $account . ',') !== false)    return true;
-        if(strpos(",{$product->PMT},", ',' . $account . ',') !== false)         return true;
-        if($product->PO == $account OR $product->QD == $account OR $product->RD == $account OR $product->createdBy == $account OR (isset($product->feedback) && $product->feedback == $account)) return true;
+        if(strpos($this->app->company->admins, ',' . $account . ',') !== false) return true; // 当前用户为管理员则判断为有权限。
+        if(strpos(",{$product->reviewer},",    ',' . $account . ',') !== false) return true; // 当前用户为产品的审批人则判断为有权限。
+        if(strpos(",{$product->PMT},",         ',' . $account . ',') !== false) return true; // 当前用户为产品的PMT则判断为有权限。
+
+        /* 当前产品为公开的则判断为有权限。 */
         if($product->acl == 'open') return true;
 
-        if(isset($teams[$account]))        return true;
-        if(isset($stakeholders[$account])) return true;
-        if(isset($whiteList[$account]))    return true;
-        if(isset($admins[$account]))       return true;
+        /* 当前用户为产品的PO、QD、RD、创建者、反馈者则判断为有权限。 */
+        if($product->PO == $account || $product->QD == $account || $product->RD == $account || $product->createdBy == $account) return true;
+        if(isset($product->feedback) && $product->feedback == $account)                                                         return true;
+
+        if(isset($stakeholders[$account])) return true; // 如果该用户是产品的干系人则判断为有权限。
+        if(isset($teams[$account]))        return true; // 如果该用户是产品的团队成员则判断为有权限。
+        if(isset($whiteList[$account]))    return true; // 如果该用户是产品的白名单成员则判断为有权限。
+        if(isset($admins[$account]))       return true; // 如果该用户是产品的管理人员则判断为有权限。
 
         return false;
     }
@@ -2708,7 +2731,7 @@ class userModel extends model
         $users[$product->createdBy] = $product->createdBy;
         if(isset($product->feedback)) $users[$product->feedback] = $product->feedback;
 
-        if($teams === null and $stakeholders === null)
+        if($teams === null && $stakeholders === null)
         {
             list($productTeams, $productStakeholders) = $this->getProductMembers(array($product->id => $product));
             $teams        = isset($productTeams[$product->id])        ? $productTeams[$product->id]        : array();
@@ -2754,14 +2777,14 @@ class userModel extends model
     {
         if(commonModel::isTutorialMode()) return $this->loadModel('tutorial')->getTeamMembersPairs();
 
-        if(empty($objectIds) and empty($usersToAppended)) return array();
+        if(empty($objectIds) && empty($usersToAppended)) return array();
 
         $keyField = strpos($params, 'useid') !== false ? 'id' : 'account';
         $users = $this->dao->select("t2.id, t2.account, t2.realname")->from(TABLE_TEAM)->alias('t1')
             ->leftJoin(TABLE_USER)->alias('t2')->on('t1.account = t2.account')
             ->where('t1.type')->eq($type)
             ->andWhere('t1.root')->in($objectIds)
-            ->beginIF($params == 'nodeleted' or empty($this->config->user->showDeleted))
+            ->beginIF($params == 'nodeleted' || empty($this->config->user->showDeleted))
             ->andWhere('t2.deleted')->eq('0')
             ->fi()
             ->fetchAll($keyField);
diff --git a/module/user/test/model/checkproductpriv.php b/module/user/test/model/checkproductpriv.php
deleted file mode 100755
index 7f5a168fa2..0000000000
--- a/module/user/test/model/checkproductpriv.php
+++ /dev/null
@@ -1,49 +0,0 @@
-#!/usr/bin/env php
-<?php
-include dirname(__FILE__, 5) . '/test/lib/init.php';
-include dirname(__FILE__, 2) . '/user.class.php';
-
-zdTable('product')->gen(10);
-zdTable('user')->gen(200);
-su('admin');
-
-/**
-
-title=测试 userModel->checkProductPriv();
-cid=1
-pid=1
-
-传入admin，判断admin用户是否有权限 >> 1
-传入产品、用户名，判断test3用户是否对此产品有权限 >> 0
-传入产品、用户名，判断test2用户是否对此产品有权限 >> 1
-传入产品、用户名、干系人、白名单，判断user10用户是否对此产品有权限 >> 1
-传入产品、用户名、干系人、白名单，判断user60用户是否对此产品有权限 >> 0
-
-*/
-
-$user = new userTest();
-$product = new stdclass();
-$product->id        = 1;
-$product->name      = '测试产品';
-$product->PO        = 'test2';
-$product->PM        = '';
-$product->QD        = '';
-$product->RD        = '';
-$product->createdBy = 'pm1';
-$product->acl       = 'private';
-
-$stakeholders['user10'] = 'user10';
-$whiteList['user60']    = 'user60';
-$admins['test6']        = 'test6';
-
-$user->objectModel->app->company->admins = ',admin,';
-
-r($user->checkProductPrivTest(new stdclass(), 'admin'))       && p() && e('1'); //传入admin，判断admin用户是否有权限
-r($user->checkProductPrivTest($product, 'test3')) && p() && e('0'); //传入产品、用户名，判断test3用户是否对此产品有权限
-r($user->checkProductPrivTest($product, 'test2')) && p() && e('1'); //传入产品、用户名，判断test2用户是否对此产品有权限
-r($user->checkProductPrivTest($product, 'user10', array(), $stakeholders)) && p() && e('1'); //传入产品、用户名、干系人、白名单，判断user10用户是否对此产品有权限
-r($user->checkProductPrivTest($product, 'user60', array(), $stakeholders, $whiteList)) && p() && e('1'); //传入产品、用户名、干系人、白名单，判断user60用户是否对此产品有权限
-r($user->checkProductPrivTest($product, 'test6',  array(), $stakeholders, $whiteList, $admins)) && p() && e('1'); //传入产品、用户名、干系人、白名单, admins，判断test6用户是否对此产品有权限
-
-$product->acl = 'open';
-r($user->checkProductPrivTest($product, 'test8')) && p() && e('1'); //传入公开产品，判断test6用户是否对此产品有权限
diff --git a/module/user/test/model/checkprogrampriv.php b/module/user/test/model/checkprogrampriv.php
deleted file mode 100755
index 105d323dac..0000000000
--- a/module/user/test/model/checkprogrampriv.php
+++ /dev/null
@@ -1,43 +0,0 @@
-#!/usr/bin/env php
-<?php
-include dirname(__FILE__, 5) . '/test/lib/init.php';
-include dirname(__FILE__, 2) . '/user.class.php';
-su('admin');
-
-/**
-
-title=测试 userModel->checkProgramPriv();
-cid=1
-pid=1
-
-传入admin，判断admin用户是否有权限 >> 1
-传入项目集、用户名，判断test3用户是否对此项目集有权限 >> 0
-传入项目集、用户名，判断test2用户是否对此项目集有权限 >> 1
-传入项目集、用户名、干系人、白名单，判断user10用户是否对此项目集有权限 >> 1
-传入项目集、用户名、干系人、白名单，判断user60用户是否对此项目集有权限 >> 1
-
-*/
-
-$user = new userTest();
-$program = new stdclass();
-$program->id       = 1;
-$program->name     = '测试项目集';
-$program->PM       = 'test2';
-$program->openedBy = 'pm1';
-$program->acl      = 'private';
-$program->parent   = 0;
-
-$stakeholders['user10'] = 'user10';
-$whiteList['user60']    = 'user60';
-$admins['test6']        = 'test6';
-
-$user->objectModel->app->company->admins = ',admin,';
-r($user->checkProgramPrivTest(new stdclass(), 'admin'))                                && p() && e('1'); //传入admin，判断admin用户是否有权限
-r($user->checkProgramPrivTest($program, 'test3'))                                      && p() && e('0'); //传入项目集、用户名，判断test3用户是否对此项目集有权限
-r($user->checkProgramPrivTest($program, 'test2'))                                      && p() && e('1'); //传入项目集、用户名，判断test2用户是否对此项目集有权限
-r($user->checkProgramPrivTest($program, 'user10', $stakeholders))                      && p() && e('1'); //传入项目集、用户名、干系人、白名单，判断user10用户是否对此项目集有权限
-r($user->checkProgramPrivTest($program, 'user60', $stakeholders, $whiteList))          && p() && e('1'); //传入项目集、用户名、干系人、白名单，判断user60用户是否对此项目集有权限
-r($user->checkProgramPrivTest($program, 'test6',  $stakeholders, $whiteList, $admins)) && p() && e('1'); //传入项目集、用户名、干系人、白名单，admins, 判断test6用户是否对此项目集有权限
-
-$program->acl = 'open';
-r($user->checkProgramPrivTest($program, 'test10')) && p() && e('1'); //传入公开项目集，判断test10用户是否对此项目集有权限
diff --git a/module/user/test/model/checkprojectpriv.php b/module/user/test/model/checkprojectpriv.php
deleted file mode 100755
index 8827eb3644..0000000000
--- a/module/user/test/model/checkprojectpriv.php
+++ /dev/null
@@ -1,48 +0,0 @@
-#!/usr/bin/env php
-<?php
-include dirname(__FILE__, 5) . '/test/lib/init.php';
-include dirname(__FILE__, 2) . '/user.class.php';
-su('admin');
-
-/**
-
-title=测试 userModel->checkProjectPriv();
-cid=1
-pid=1
-
-传入admin，判断admin用户是否有权限 >> 1
-传入项目、用户名，判断test3用户是否对此项目有权限 >> 0
-传入项目、用户名，判断test2用户是否对此项目有权限 >> 1
-传入项目、用户名、干系人、白名单，判断user10用户是否对此项目有权限 >> 1
-传入项目、用户名、干系人、白名单，判断user60用户是否对此项目有权限 >> 1
-
-*/
-
-$user = new userTest();
-$project = new stdclass();
-$project->id       = 10;
-$project->name     = '测试项目';
-$project->type     = 'project';
-$project->parent   = 0;
-$project->PM       = 'test2';
-$project->PO       = '';
-$project->QD       = '';
-$project->RD       = '';
-$project->openedBy = 'pm1';
-$project->acl      = 'private';
-
-$stakeholders['user10'] = 'user10';
-$whiteList['user60']    = 'user60';
-$admins['test6']        = 'test6';
-
-$user->objectModel->app->company->admins = ',admin,';
-
-r($user->checkProjectPrivTest(new stdclass(), 'admin'))                                     && p() && e('1'); //传入admin，判断admin用户是否有权限
-r($user->checkProjectPrivTest($project, 'test3'))                                           && p() && e('0'); //传入项目、用户名，判断test3用户是否对此项目有权限
-r($user->checkProjectPrivTest($project, 'test2'))                                           && p() && e('1'); //传入项目、用户名，判断test2用户是否对此项目有权限
-r($user->checkProjectPrivTest($project, 'user10', $stakeholders, array(), array()))         && p() && e('1'); //传入项目、用户名、干系人、白名单，判断user10用户是否对此项目有权限
-r($user->checkProjectPrivTest($project, 'user60', $stakeholders, array(), $whiteList))      && p() && e('1'); //传入项目、用户名、干系人、白名单，判断user60用户是否对此项目有权限
-r($user->checkProjectPrivTest($project, 'test6', $stakeholders, array(), array(), $admins)) && p() && e('1'); //传入项目、用户名、admins，判断test6用户是否对此项目有权限
-
-$project->acl = 'open';
-r($user->checkProjectPrivTest($project, 'test8')) && p() && e('1'); //传入公开项目，判断test8用户是否对此项目有权限
diff --git a/module/user/test/model/checksprintpriv.php b/module/user/test/model/checksprintpriv.php
deleted file mode 100755
index 6d2db6fafd..0000000000
--- a/module/user/test/model/checksprintpriv.php
+++ /dev/null
@@ -1,41 +0,0 @@
-#!/usr/bin/env php
-<?php
-include dirname(__FILE__, 5) . '/test/lib/init.php';
-include dirname(__FILE__, 2) . '/user.class.php';
-su('admin');
-
-/**
-
-title=测试 userModel->checkSprintPriv();
-cid=1
-pid=1
-
-传入admin，判断admin用户是否有权限 >> 1
-传入执行、用户名，判断test3用户是否对此执行有权限 >> 0
-传入执行、用户名，判断test2用户是否对此执行有权限 >> 1
-传入执行、用户名、干系人、白名单，判断user10用户是否对此执行有权限 >> 1
-传入执行、用户名、干系人、白名单，判断user60用户是否对此执行有权限 >> 1
-
-*/
-
-$user = new userTest();
-$sprint = new stdclass();
-$sprint->id       = 1;
-$sprint->name     = '测试项目集';
-$sprint->type     = 'program';
-$sprint->parent   = 0;
-$sprint->PM       = 'test2';
-$sprint->PO       = '';
-$sprint->QD       = '';
-$sprint->RD       = '';
-$sprint->openedBy = 'pm1';
-$sprint->acl      = 'private';
-
-$stakeholders['user10'] = 'user10';
-$whiteList['user60']    = 'user60';
-
-r($user->checkSprintPrivTest($sprint, 'admin'))                                      && p() && e('1'); //传入admin，判断admin用户是否有权限
-r($user->checkSprintPrivTest($sprint, 'test3'))                                      && p() && e('0'); //传入执行、用户名，判断test3用户是否对此执行有权限
-r($user->checkSprintPrivTest($sprint, 'test2'))                                      && p() && e('1'); //传入执行、用户名，判断test2用户是否对此执行有权限
-r($user->checkSprintPrivTest($sprint, 'user10', $stakeholders, array(), array()))    && p() && e('1'); //传入执行、用户名、干系人、白名单，判断user10用户是否对此执行有权限
-r($user->checkSprintPrivTest($sprint, 'user60', $stakeholders, array(), $whiteList)) && p() && e('1'); //传入执行、用户名、干系人、白名单，判断user60用户是否对此执行有权限
diff --git a/module/user/test/user.class.php b/module/user/test/user.class.php
index b6fb3530ce..14b4537575 100755
--- a/module/user/test/user.class.php
+++ b/module/user/test/user.class.php
@@ -788,69 +788,6 @@ class userTest
         return $this->objectModel->grantUserView(current($users));
     }
 
-    /**
-     * Test check program priv.
-     *
-     * @param  object $program
-     * @param  string $account
-     * @param  array  $stakeholders
-     * @param  array  $whiteList
-     * @param  array  $admins
-     * @access public
-     * @return bool
-     */
-    public function checkProgramPrivTest(object $program, string $account, array $stakeholders = array(), array $whiteList = array(), array $admins = array()): bool
-    {
-        return $this->objectModel->checkProgramPriv($program, $account, $stakeholders, $whiteList, $admins);
-    }
-
-    /**
-     * Test check project priv.
-     *
-     * @param  object $project
-     * @param  string $account
-     * @param  array  $stakeholders
-     * @param  array  $teams
-     * @param  array  $whiteList
-     * @access public
-     * @return void
-     */
-    public function checkProjectPrivTest(object $project, string $account, array $stakeholders = array(), array $teams = array(), array $whiteList = array(), array $admins = array()): bool
-    {
-        return $this->objectModel->checkProjectPriv($project, $account, $stakeholders, $teams, $whiteList, $admins);
-    }
-    /**
-     * Test check sprint priv.
-     *
-     * @param  object $sprint
-     * @param  string $account
-     * @param  array  $stakeholders
-     * @param  array  $teams
-     * @param  array  $whiteList
-     * @access public
-     * @return void
-     */
-    public function checkSprintPrivTest($sprint, $account, $stakeholders = array(), $teams = array(), $whiteList = array())
-    {
-        return $this->objectModel->checkSprintPriv($sprint, $account, $stakeholders, $teams, $whiteList);
-    }
-    /**
-     * Test check product priv.
-     *
-     * @param  object $program
-     * @param  string $account
-     * @param  array  $teams
-     * @param  array  $stakeholders
-     * @param  array  $whiteList
-     * @param  array  $admins
-     * @access public
-     * @return bool
-     */
-    public function checkProductPrivTest(object $product, string $account, array $teams = array(), array $stakeholders = array(), array $whiteList = array(), array $admins = array()): bool
-    {
-        return $this->objectModel->checkProductPriv($product, $account, $teams, $stakeholders, $whiteList, $admins);
-    }
-
     /**
      * Test get project authed users.
      *