diff --git a/src/main/java/com/gxwebsoft/cms/controller/CmsWebsiteController.java b/src/main/java/com/gxwebsoft/cms/controller/CmsWebsiteController.java
index 0800627..d8027ba 100644
--- a/src/main/java/com/gxwebsoft/cms/controller/CmsWebsiteController.java
+++ b/src/main/java/com/gxwebsoft/cms/controller/CmsWebsiteController.java
@@ -81,6 +81,7 @@ public class CmsWebsiteController extends BaseController {
         //return success(cmsWebsiteService.getByIdRel(id));
     }
 
+    @PreAuthorize("hasAuthority('cms:website:save')")
     @ApiOperation("添加网站信息记录表")
     @PostMapping()
     public ApiResult<?> save(@RequestBody CmsWebsite cmsWebsite) {
@@ -95,6 +96,7 @@ public class CmsWebsiteController extends BaseController {
         return fail("添加失败");
     }
 
+    @PreAuthorize("hasAuthority('cms:website:update')")
     @ApiOperation("修改网站信息记录表")
     @PutMapping()
     public ApiResult<?> update(@RequestBody CmsWebsite cmsWebsite) {
@@ -104,6 +106,7 @@ public class CmsWebsiteController extends BaseController {
         return fail("修改失败");
     }
 
+    @PreAuthorize("hasAuthority('cms:website:remove')")
     @ApiOperation("删除网站信息记录表")
     @DeleteMapping("/{id}")
     public ApiResult<?> remove(@PathVariable("id") Integer id) {
@@ -113,6 +116,7 @@ public class CmsWebsiteController extends BaseController {
         return fail("删除失败");
     }
 
+    @PreAuthorize("hasAuthority('cms:website:save')")
     @ApiOperation("批量添加网站信息记录表")
     @PostMapping("/batch")
     public ApiResult<?> saveBatch(@RequestBody List<CmsWebsite> list) {
@@ -122,6 +126,7 @@ public class CmsWebsiteController extends BaseController {
         return fail("添加失败");
     }
 
+    @PreAuthorize("hasAuthority('cms:website:update')")
     @ApiOperation("批量修改网站信息记录表")
     @PutMapping("/batch")
     public ApiResult<?> removeBatch(@RequestBody BatchParam<CmsWebsite> batchParam) {
@@ -131,6 +136,7 @@ public class CmsWebsiteController extends BaseController {
         return fail("修改失败");
     }
 
+    @PreAuthorize("hasAuthority('cms:website:remove')")
     @ApiOperation("批量删除网站信息记录表")
     @DeleteMapping("/batch")
     public ApiResult<?> removeBatch(@RequestBody List<Integer> ids) {
diff --git a/src/main/java/com/gxwebsoft/common/system/controller/AliOssController.java b/src/main/java/com/gxwebsoft/common/system/controller/AliOssController.java
index bccec6c..836ba95 100644
--- a/src/main/java/com/gxwebsoft/common/system/controller/AliOssController.java
+++ b/src/main/java/com/gxwebsoft/common/system/controller/AliOssController.java
@@ -70,6 +70,7 @@ public class AliOssController extends BaseController {
     // 获取租户ID
     String tenantId = request.getHeader("TenantId");
     String companyId = request.getHeader("CompanyId");
+    String merchantId = request.getHeader("MerchantId");
     String groupId = request.getHeader("GroupId");
     String appId = request.getHeader("AppId");
     if(StrUtil.isBlank(tenantId)){
@@ -138,6 +139,9 @@ public class AliOssController extends BaseController {
       if(StrUtil.isNotBlank(companyId)){
         result.setCompanyId(Integer.valueOf(companyId));
       }
+      if(StrUtil.isNotBlank(merchantId)){
+        result.setMerchantId(Long.valueOf(merchantId));
+      }
       if(StrUtil.isNotBlank(groupId)){
         result.setGroupId(Integer.valueOf(groupId));
       }
diff --git a/src/main/java/com/gxwebsoft/common/system/controller/DomainController.java b/src/main/java/com/gxwebsoft/common/system/controller/DomainController.java
index d6e7b30..bf69b26 100644
--- a/src/main/java/com/gxwebsoft/common/system/controller/DomainController.java
+++ b/src/main/java/com/gxwebsoft/common/system/controller/DomainController.java
@@ -31,8 +31,6 @@ public class DomainController extends BaseController {
     @Resource
     private DomainService domainService;
 
-    @PreAuthorize("hasAuthority('sys:domain:list')")
-    @OperationLog
     @ApiOperation("分页查询授权域名")
     @GetMapping("/page")
     public ApiResult<PageResult<Domain>> page(DomainParam param) {
@@ -40,8 +38,6 @@ public class DomainController extends BaseController {
         return success(domainService.pageRel(param));
     }
 
-    @PreAuthorize("hasAuthority('sys:domain:list')")
-    @OperationLog
     @ApiOperation("查询全部授权域名")
     @GetMapping()
     public ApiResult<List<Domain>> list(DomainParam param) {
diff --git a/src/main/java/com/gxwebsoft/common/system/controller/RoleController.java b/src/main/java/com/gxwebsoft/common/system/controller/RoleController.java
index bbb422f..544b132 100644
--- a/src/main/java/com/gxwebsoft/common/system/controller/RoleController.java
+++ b/src/main/java/com/gxwebsoft/common/system/controller/RoleController.java
@@ -32,8 +32,6 @@ public class RoleController extends BaseController {
     @Resource
     private RoleService roleService;
 
-    @PreAuthorize("hasAuthority('sys:role:list')")
-    @OperationLog
     @ApiOperation("分页查询角色")
     @GetMapping("/page")
     public ApiResult<PageResult<Role>> page(RoleParam param) {
@@ -42,8 +40,6 @@ public class RoleController extends BaseController {
         return success(roleService.page(page, page.getWrapper()));
     }
 
-    @PreAuthorize("hasAuthority('sys:role:list')")
-    @OperationLog
     @ApiOperation("查询全部角色")
     @GetMapping()
     public ApiResult<List<Role>> list(RoleParam param) {
@@ -52,8 +48,6 @@ public class RoleController extends BaseController {
         return success(roleService.list(page.getOrderWrapper()));
     }
 
-    @PreAuthorize("hasAuthority('sys:role:list')")
-    @OperationLog
     @ApiOperation("根据id查询角色")
     @GetMapping("/{id}")
     public ApiResult<Role> get(@PathVariable("id") Integer id) {
diff --git a/src/main/java/com/gxwebsoft/common/system/controller/UserController.java b/src/main/java/com/gxwebsoft/common/system/controller/UserController.java
index 6d6bbe9..9606508 100644
--- a/src/main/java/com/gxwebsoft/common/system/controller/UserController.java
+++ b/src/main/java/com/gxwebsoft/common/system/controller/UserController.java
@@ -412,9 +412,8 @@ public class UserController extends BaseController {
       return success("统计成功",totalBalance);
     }
 
-    @PreAuthorize("hasAuthority('sys:auth:user')")
-    @PutMapping("/updateUserMerchantId")
     @ApiOperation("更新商户ID")
+    @PutMapping("/updateUserMerchantId")
     public ApiResult<?> updateUserMerchantId(@RequestBody User user){
       if (userService.updateUser(user)) {
         return success("更新成功");
diff --git a/src/main/java/com/gxwebsoft/common/system/entity/FileRecord.java b/src/main/java/com/gxwebsoft/common/system/entity/FileRecord.java
index d3814cb..51ce35e 100644
--- a/src/main/java/com/gxwebsoft/common/system/entity/FileRecord.java
+++ b/src/main/java/com/gxwebsoft/common/system/entity/FileRecord.java
@@ -49,6 +49,9 @@ public class FileRecord implements Serializable {
     @ApiModelProperty("企业ID")
     private Integer companyId;
 
+    @ApiModelProperty("商户ID")
+    private Long merchantId;
+
     @ApiModelProperty("创建人")
     private Integer createUserId;
 
diff --git a/src/main/java/com/gxwebsoft/common/system/entity/User.java b/src/main/java/com/gxwebsoft/common/system/entity/User.java
index 70d6d9e..19090b6 100644
--- a/src/main/java/com/gxwebsoft/common/system/entity/User.java
+++ b/src/main/java/com/gxwebsoft/common/system/entity/User.java
@@ -174,6 +174,9 @@ public class User implements UserDetails {
     @ApiModelProperty(value = "商户名称")
     private String merchantName;
 
+    @ApiModelProperty(value = "商户LOGO")
+    private String merchantAvatar;
+
     @ApiModelProperty(value = "是否管理员")
     private Boolean isAdmin;
 
diff --git a/src/main/java/com/gxwebsoft/common/system/mapper/xml/FileRecordMapper.xml b/src/main/java/com/gxwebsoft/common/system/mapper/xml/FileRecordMapper.xml
index cd59549..616d3b4 100644
--- a/src/main/java/com/gxwebsoft/common/system/mapper/xml/FileRecordMapper.xml
+++ b/src/main/java/com/gxwebsoft/common/system/mapper/xml/FileRecordMapper.xml
@@ -26,12 +26,15 @@
             <if test="param.companyId != null">
               AND a.company_id = #{param.companyId}
             </if>
+            <if test="param.merchantId != null">
+              AND a.merchant_id = #{param.merchantId}
+            </if>
             <if test="param.createUserId != null">
                 AND a.create_user_id = #{param.createUserId}
             </if>
-          <if test="param.groupId != null">
-            AND a.group_id = #{param.groupId}
-          </if>
+            <if test="param.groupId != null">
+              AND a.group_id = #{param.groupId}
+            </if>
             <if test="param.comments != null">
                 AND a.comments LIKE CONCAT('%', #{param.comments}, '%')
             </if>
diff --git a/src/main/java/com/gxwebsoft/common/system/param/FileRecordParam.java b/src/main/java/com/gxwebsoft/common/system/param/FileRecordParam.java
index 39e5edf..14f5e3d 100644
--- a/src/main/java/com/gxwebsoft/common/system/param/FileRecordParam.java
+++ b/src/main/java/com/gxwebsoft/common/system/param/FileRecordParam.java
@@ -46,6 +46,10 @@ public class FileRecordParam extends BaseParam {
     @ApiModelProperty("企业ID")
     private Integer companyId;
 
+    @QueryField(type = QueryType.EQ)
+    @ApiModelProperty("商户ID")
+    private Long merchantId;
+
     @QueryField(type = QueryType.EQ)
     @ApiModelProperty("创建人")
     private Integer createUserId;