diff --git a/ssjygl-xsx-common/src/main/java/com/cowr/ssjygl/customer/CustomerService.java b/ssjygl-xsx-common/src/main/java/com/cowr/ssjygl/customer/CustomerService.java
index ba31a36..343ac0b 100644
--- a/ssjygl-xsx-common/src/main/java/com/cowr/ssjygl/customer/CustomerService.java
+++ b/ssjygl-xsx-common/src/main/java/com/cowr/ssjygl/customer/CustomerService.java
@@ -2,8 +2,12 @@ package com.cowr.ssjygl.customer;
 
 import com.cowr.common.Const;
 import com.cowr.common.base.BaseService;
+import com.cowr.common.enums.UserTypeEnum;
 import com.cowr.common.view.PageParam;
+import com.cowr.common.view.Result;
 import com.cowr.model.Customer;
+import com.cowr.model.CustomerReceiver;
+import com.cowr.model.Sysuser;
 import com.jfinal.kit.StrKit;
 import com.jfinal.plugin.activerecord.Db;
 import com.jfinal.plugin.activerecord.Page;
@@ -21,6 +25,35 @@ import java.util.List;
 public class CustomerService extends BaseService {
     public static final CustomerService me = new CustomerService();
 
+    public Result get(int id, Sysuser sysuser) {
+        if (sysuser.getType() == UserTypeEnum.CUSTOMER.getTypeid()) {
+            if (sysuser.getType() == UserTypeEnum.CUSTOMER.getTypeid()
+                    && sysuser.getEntityId() != null
+                    && !sysuser.getEntityId().equals(id)
+            ) {
+                return Result.failed("登录用户和订单信息不匹配");
+            }
+        }
+
+        Customer customer = Customer.dao.findById(id);
+        if (customer == null) {
+            return Result.failed("未找到记录");
+        }
+
+        Record out = customer.toRecord();
+
+        CustomerReceiver receiver = CustomerReceiver.dao.findFirst(
+                "select * from customer_receiver t where t.customer_id = ? limit 1", id);
+
+        if (receiver != null) {
+            out.set("receiver_name", receiver.getName());
+            out.set("receiver_phone", receiver.getPhone());
+            out.set("receiver_address", receiver.getAddress());
+        }
+
+        return Result.success(out);
+    }
+
     public Page<Record> find(PageParam pp, String name, Integer del, Integer type) {
         String selectsql = " select \n" +
                 " t.*\n" +
diff --git a/ssjygl-xsx-local/src/main/java/com/cowr/local/ssjygl/customer/CustomerController.java b/ssjygl-xsx-local/src/main/java/com/cowr/local/ssjygl/customer/CustomerController.java
index 44f9066..344931f 100644
--- a/ssjygl-xsx-local/src/main/java/com/cowr/local/ssjygl/customer/CustomerController.java
+++ b/ssjygl-xsx-local/src/main/java/com/cowr/local/ssjygl/customer/CustomerController.java
@@ -2,7 +2,9 @@ package com.cowr.local.ssjygl.customer;
 
 import com.cowr.common.view.PageParam;
 import com.cowr.common.view.Result;
+import com.cowr.local.ssjygl.system.sysuser.SysuserSyncService;
 import com.cowr.model.Customer;
+import com.cowr.model.Sysuser;
 import com.cowr.ssjygl.customer.CustomerPKValidator;
 import com.cowr.ssjygl.customer.CustomerService;
 import com.jfinal.aop.Before;
@@ -53,8 +55,15 @@ public class CustomerController extends Controller {
      */
     @Before(CustomerPKValidator.class)
     public void get() {
+        Sysuser tokenuser = SysuserSyncService.me.getSysuserByToken(get("token"));
+
+        if (tokenuser == null) {
+            renderJson(Result.noauth());
+            return;
+        }
+
         Customer model = getModel(Customer.class, "", true); // 忽略不在model中的字段
-        renderJson(CustomerService.me.findByPk(model));
+        renderJson(CustomerService.me.get(model.getId(), tokenuser));
     }
 
     /**
diff --git a/ssjygl-xsx-service/src/main/java/com/cowr/service/ssjygl/customer/CustomerController.java b/ssjygl-xsx-service/src/main/java/com/cowr/service/ssjygl/customer/CustomerController.java
index bb5eb9a..71f6030 100644
--- a/ssjygl-xsx-service/src/main/java/com/cowr/service/ssjygl/customer/CustomerController.java
+++ b/ssjygl-xsx-service/src/main/java/com/cowr/service/ssjygl/customer/CustomerController.java
@@ -128,8 +128,15 @@ public class CustomerController extends Controller {
      */
     @Before(CustomerPKValidator.class)
     public void get() {
+        Sysuser tokenuser = SysuserSyncService.me.getSysuserByToken(get("token"));
+
+        if (tokenuser == null) {
+            renderJson(Result.noauth());
+            return;
+        }
+
         Customer model = getModel(Customer.class, "", true); // 忽略不在model中的字段
-        renderJson(CustomerService.me.findByPk(model));
+        renderJson(CustomerService.me.get(model.getId(), tokenuser));
     }
 
     /**
diff --git a/ssjygl-xsx-service/src/main/java/com/cowr/service/ssjygl/customer/CustomerSyncService.java b/ssjygl-xsx-service/src/main/java/com/cowr/service/ssjygl/customer/CustomerSyncService.java
index ccbf4a0..0845eba 100644
--- a/ssjygl-xsx-service/src/main/java/com/cowr/service/ssjygl/customer/CustomerSyncService.java
+++ b/ssjygl-xsx-service/src/main/java/com/cowr/service/ssjygl/customer/CustomerSyncService.java
@@ -1,6 +1,7 @@
 package com.cowr.service.ssjygl.customer;
 
 import com.cowr.common.enums.Enums;
+import com.cowr.common.enums.UserTypeEnum;
 import com.cowr.common.view.Result;
 import com.cowr.model.Customer;
 import com.cowr.model.CustomerReceiver;
@@ -45,7 +46,7 @@ public class CustomerSyncService extends BaseSyncService {
                         }
                         SyncTask synctask = new SyncTask();
 
-                        if(StrKit.notBlank(receiver_name, receiver_phone, receiver_address)){
+                        if (StrKit.notBlank(receiver_name, receiver_phone, receiver_address)) {
                             CustomerReceiver receiver = new CustomerReceiver();
                             receiver.setCustomerId(model.getId());
                             receiver.setName(receiver_name);
@@ -57,7 +58,7 @@ public class CustomerSyncService extends BaseSyncService {
                             ret = receiver.save()
                                     && ModifyLogService.me.save(receiver, null, Enums.DataOpType.SAVE.getId(), sysuser);
 
-                            if(!ret){
+                            if (!ret) {
                                 return false;
                             }
                         }
@@ -99,6 +100,16 @@ public class CustomerSyncService extends BaseSyncService {
                 return Result.failed(false, "按主键未找到对应记录");
             }
 
+            if (sysuser.getType() == UserTypeEnum.CUSTOMER.getTypeid()) {
+                if (sysuser.getType() == UserTypeEnum.CUSTOMER.getTypeid()
+                        && oldobj.getId() != null
+                        && sysuser.getEntityId() != null
+                        && !sysuser.getEntityId().equals(oldobj.getId())
+                ) {
+                    return Result.failed("登录用户和订单信息不匹配");
+                }
+            }
+
             Customer saveold = oldobj.clone();
 
             if (model.getName() != null) {
@@ -144,7 +155,7 @@ public class CustomerSyncService extends BaseSyncService {
                         SyncTask synctask = new SyncTask();
                         synctask.addUpdateData(model);
 
-                        if(StrKit.notBlank(receiver_name, receiver_phone, receiver_address)) {
+                        if (StrKit.notBlank(receiver_name, receiver_phone, receiver_address)) {
                             CustomerReceiver receiver = CustomerReceiver.dao.findFirst(
                                     "select * from customer_receiver t where t.customer_id = ? limit 1", model.getId());