From c30a24a8e4bd5ca4104631aa40692f19b59fb301 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E6=9C=B1=E9=87=91=E5=8B=87?= <zhujinyong@chandao.com>
Date: Sun, 4 Jan 2026 11:39:44 +0800
Subject: [PATCH] * [apiv2] Fix bug#66974.

---
 framework/api/router.class.php | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/framework/api/router.class.php b/framework/api/router.class.php
index fd7975749b..0331152f67 100644
--- a/framework/api/router.class.php
+++ b/framework/api/router.class.php
@@ -470,6 +470,8 @@ class api extends router
             'userID'        => TABLE_USER,
             'ticket'        => TABLE_TICKET,
             'ticketID'      => TABLE_TICKET,
+            'dept'          => TABLE_DEPT,
+            'deptID'        => TABLE_DEPT,
         ];
 
         $params = array_merge($this->params, $_POST);
@@ -478,7 +480,10 @@ class api extends router
             if(isset($objectMap[$key]) && $value)
             {
                 $table  = $objectMap[$key];
-                $object = $this->dao->select('*')->from($table)->where('id')->eq($value)->andWhere('deleted')->eq('0')->fetch();
+                $object = $this->dao->select('*')->from($table)
+                    ->where('id')->eq($value)
+                    ->beginIF(!in_array($key, ['dept', 'deptID']))->andWhere('deleted')->eq('0')->fi()
+                    ->fetch();
                 if(!$object) return $this->control->sendError(ucfirst(str_replace('ID', '', $key)) . ' does not exist.');
 
                 if(!$this->checkObjectPriv($object, $table)) return $this->control->sendError(ucfirst(str_replace('ID', '', $key)) . ' is not allowed.');