diff --git a/app/Http/Controllers/User/WorkOrder/ReplyController.php b/app/Http/Controllers/User/WorkOrder/ReplyController.php
index 5542383..d68be36 100644
--- a/app/Http/Controllers/User/WorkOrder/ReplyController.php
+++ b/app/Http/Controllers/User/WorkOrder/ReplyController.php
@@ -2,10 +2,10 @@
 
 namespace App\Http\Controllers\User\WorkOrder;
 
-use App\Http\Controllers\Controller;
-use App\Http\Requests\User\WorkOrder\WorkOrderRequest;
-use App\Models\WorkOrder\Reply;
 use Illuminate\Http\Request;
+use App\Models\WorkOrder\Reply;
+use App\Models\WorkOrder\WorkOrder;
+use App\Http\Controllers\Controller;
 
 class ReplyController extends Controller
 {
@@ -14,13 +14,13 @@ class ReplyController extends Controller
      *
      * @return \Illuminate\Http\Response
      */
-    public function index(WorkOrderRequest $request)
+    public function index(WorkOrder $workOrder)
     {
-        //
+        if (auth()->id() !== $workOrder->user_id) {
+            return $this->notFound('无法找到对应的工单。');
+        }
 
-        $workOrder_id = $request->route('workOrder')['id'];
-
-        $replies = Reply::workOrderId($workOrder_id)->simplePaginate(10);
+        $replies = Reply::workOrderId($workOrder->id)->simplePaginate(10);
 
         return $this->success($replies);
     }
@@ -31,8 +31,12 @@ public function index(WorkOrderRequest $request)
      * @param  \Illuminate\Http\Request  $request
      * @return \Illuminate\Http\Response
      */
-    public function store(WorkOrderRequest $request)
+    public function store(Request $request, WorkOrder $workOrder)
     {
+        if (auth()->id() !== $workOrder->user_id) {
+            return $this->notFound('无法找到对应的工单。');
+        }
+
         // add reply
         $this->validate($request, [
             'content' => 'string|required|min:1|max:1000',
@@ -41,7 +45,7 @@ public function store(WorkOrderRequest $request)
 
         $reply = Reply::create([
             'content' => $request->toArray()['content'],
-            'work_order_id' => $request->route('workOrder')->id,
+            'work_order_id' => $workOrder->id,
         ]);
 
 
diff --git a/app/Http/Controllers/User/WorkOrder/WorkOrderController.php b/app/Http/Controllers/User/WorkOrder/WorkOrderController.php
index e41ad0f..6b6c9dd 100644
--- a/app/Http/Controllers/User/WorkOrder/WorkOrderController.php
+++ b/app/Http/Controllers/User/WorkOrder/WorkOrderController.php
@@ -5,19 +5,20 @@
 use Illuminate\Http\Request;
 use App\Models\WorkOrder\WorkOrder;
 use App\Http\Controllers\Controller;
-use App\Http\Requests\User\WorkOrder\WorkOrderRequest;
 
 class WorkOrderController extends Controller
 {
     //
-    public function index(Request $request, WorkOrder $workOrder) {
+    public function index(WorkOrder $workOrder)
+    {
 
         $workOrder = $workOrder->thisUser()->with(['user', 'module', 'host'])->simplePaginate(10);
 
         return $this->success($workOrder);
     }
 
-    public function store(Request $request) {
+    public function store(Request $request)
+    {
         $this->validate($request, [
             'title' => 'required|max:255',
             'content' => 'required',
@@ -25,29 +26,42 @@ public function store(Request $request) {
             'host_id' => 'nullable|sometimes|exists:hosts,id',
         ]);
 
+
+        $request_data = $request->toArray();
+
         // module_id 和 host_id 必须有个要填写
-        if (!$request->module_id && !$request->host_id) {
+        if (isset($request_data['module_id']) && isset($request_data['host_id'])) {
             return $this->error('module_id 和 host_id 至少要填写一个');
         }
 
         $workOrder = WorkOrder::create([
             'title' => $request->title,
             'content' => $request->content,
-            'module_id' => $request->module_id,
-            'host_id' => $request->host_id,
+            'module_id' => $request_data['module_id'] ?? null,
+            'host_id' => $request_data['host_id'] ?? null,
             'status' => 'pending',
         ]);
 
         return $this->success($workOrder);
-
     }
 
-    public function show(WorkOrderRequest $request, WorkOrder $workOrder) {
+    public function show(WorkOrder $workOrder)
+    {
+        if (auth()->id() !== $workOrder->user_id) {
+            return $this->notFound('无法找到对应的工单。');
+        }
+
         $workOrder->load(['module', 'host']);
         return $this->success($workOrder);
     }
 
-    public function update(WorkOrderRequest $request, WorkOrder $workOrder) {
+    public function update(Request $request, WorkOrder $workOrder)
+    {
+
+        if (auth()->id() !== $workOrder->user_id) {
+            return $this->notFound('无法找到对应的工单。');
+        }
+
         $this->validate($request, [
             'status' => 'nullable|sometimes|string|in:closed',
         ]);
diff --git a/routes/api.php b/routes/api.php
index 2f0832e..fb3532d 100644
--- a/routes/api.php
+++ b/routes/api.php
@@ -60,20 +60,22 @@
         'uses' => 'User\WorkOrder\WorkOrderController@destroy'
     ]);
 
-    $router->group(['prefix' => '{workOrder}/replies'], function () use ($router) {
-        $router->get('/', [
-            'uses' => 'User\WorkOrder\ReplyController@index'
-        ]);
-        $router->post('/', [
-            'uses' => 'User\WorkOrder\ReplyController@store'
-        ]);
-        // $router->patch('/{reply}', [
-        //     'uses' => 'User\WorkOrder\ReplyController@update'
-        // ]);
-        // $router->delete('/{reply}', [
-        //     'uses' => 'User\WorkOrder\ReplyController@destroy'
-        // ]);
-    });
+    $router->get('/{workOrder}/replies', [
+        'uses' => 'User\WorkOrder\ReplyController@index'
+    ]);
+    $router->post('/{workOrder}/replies', [
+        'uses' => 'User\WorkOrder\ReplyController@store'
+    ]);
+
+    // $router->group(['prefix' => ''], function () use ($router) {
+
+    //     // $router->patch('/{reply}', [
+    //     //     'uses' => 'User\WorkOrder\ReplyController@update'
+    //     // ]);
+    //     // $router->delete('/{reply}', [
+    //     //     'uses' => 'User\WorkOrder\ReplyController@destroy'
+    //     // ]);
+    // });
 });
 
 $router->group(['prefix' => 'modules/{module}'], function () use ($router) {