diff --git a/jshERP-boot/src/main/java/com/jsh/erp/filter/LogCostFilter.java b/jshERP-boot/src/main/java/com/jsh/erp/filter/LogCostFilter.java
index 2e380882..a43d870c 100644
--- a/jshERP-boot/src/main/java/com/jsh/erp/filter/LogCostFilter.java
+++ b/jshERP-boot/src/main/java/com/jsh/erp/filter/LogCostFilter.java
@@ -38,7 +38,7 @@ public class LogCostFilter implements Filter {
         HttpServletRequest servletRequest = (HttpServletRequest) request;
         HttpServletResponse servletResponse = (HttpServletResponse) response;
         String requestUrl = servletRequest.getRequestURI();
-        if(requestUrl.contains("../") || requestUrl.contains("..;/") || requestUrl.contains("%2e")) {
+        if(requestUrl.contains("../") || requestUrl.contains("..;/") || requestUrl.contains("%2e") || requestUrl.contains("%2E")) {
             servletResponse.setStatus(500);
             servletResponse.getWriter().write("loginOut");
             return;
diff --git a/jshERP-boot/src/main/java/com/jsh/erp/service/UserService.java b/jshERP-boot/src/main/java/com/jsh/erp/service/UserService.java
index 26720855..26f98e90 100644
--- a/jshERP-boot/src/main/java/com/jsh/erp/service/UserService.java
+++ b/jshERP-boot/src/main/java/com/jsh/erp/service/UserService.java
@@ -65,7 +65,12 @@ public class UserService {
     public User getUser(long id)throws Exception {
         User result=null;
         try{
-            result=userMapper.selectByPrimaryKey(id);
+            //先校验是否登录，然后才能查询用户数据
+            HttpServletRequest request = ((ServletRequestAttributes) Objects.requireNonNull(RequestContextHolder.getRequestAttributes())).getRequest();
+            Long userId = this.getUserId(request);
+            if(userId!=null) {
+                result = userMapper.selectByPrimaryKey(id);
+            }
         }catch(Exception e){
             JshException.readFail(logger, e);
         }