Add files via upload

internal/handler/vulnerability.go

@@ -254,7 +254,15 @@ func (h *VulnerabilityHandler) UpdateVulnerability(c *gin.Context) {
 
 	// 更新字段
 	if req.ProjectID != nil {
-		existing.ProjectID = strings.TrimSpace(*req.ProjectID)
+		targetProjectID := strings.TrimSpace(*req.ProjectID)
+		if targetProjectID != "" {
+			session, ok := security.CurrentSession(c)
+			if !ok || !h.db.UserCanAccessResource(session.UserID, session.Scope, "project", targetProjectID) {
+				c.JSON(http.StatusForbidden, gin.H{"error": "无权关联目标项目"})
+				return
+			}
+		}
+		existing.ProjectID = targetProjectID
 	}
 	if req.ConversationTag != nil {
 		existing.ConversationTag = *req.ConversationTag