在线采购拦截不属于当前订单sku的下单请求

BBWY.Server.Business/PurchaseOrder/PurchaseOrderBusiness.cs

@@ -131,6 +131,15 @@ namespace BBWY.Server.Business
                 throw new BusinessException("订单不存在");
             if (dbOrder.OrderState != Enums.OrderState.等待采购 && dbOrder.OrderState != Enums.OrderState.待出库)
                 throw new BusinessException("只能为等待采购或待出库的订单进行采购");
+            if (createOnlinePurchaseOrderRequest.CargoParamList == null || createOnlinePurchaseOrderRequest.CargoParamList.Count() == 0)
+                throw new BusinessException("缺少下单参数");
+
+            //拦截不要属于当前订单的请求
+            var orderSkus = fsql.Select<OrderSku>().Where(osku => osku.Price != 0 && osku.OrderId == createOnlinePurchaseOrderRequest.OrderId).ToList();
+
+            if (createOnlinePurchaseOrderRequest.CargoParamList.Any(c => !orderSkus.Any(osku => osku.SkuId == c.BelongSkuId)))
+                throw new BusinessException("非法sku参数,下单sku中存在不属于该笔订单的sku");
+
 
             var oldPourchaseIdList = fsql.Select<OrderCostDetail>().Where(ocd => ocd.OrderId == dbOrder.Id)
                                                                    .ToList(ocd => ocd.PurchaseOrderPKId);
@@ -138,7 +147,6 @@ namespace BBWY.Server.Business
             var deletePurchaseOrder = fsql.Delete<PurchaseOrder>().Where(po => oldPourchaseIdList.Contains(po.Id));
             var deleteOrderCostDetail = fsql.Delete<OrderCostDetail>().Where(ocd => ocd.OrderId == dbOrder.Id);
             var isRepurchase = fsql.Select<OrderCost>(dbOrder.Id).Any();
-            var orderSkus = fsql.Select<OrderSku>().Where(osku => osku.Price != 0 && osku.OrderId == createOnlinePurchaseOrderRequest.OrderId).ToList();
             var orderSkuIds = orderSkus.Select(osku => osku.Id).ToList();
 
             #region 合并重复的采购sku