diff --git a/shandan-bianmu/src/main/resources/static/js/business/directory/directory.js b/shandan-bianmu/src/main/resources/static/js/business/directory/directory.js
index a14b604..4c75d92 100644
--- a/shandan-bianmu/src/main/resources/static/js/business/directory/directory.js
+++ b/shandan-bianmu/src/main/resources/static/js/business/directory/directory.js
@@ -143,6 +143,10 @@ function startRender() {
          */
         metaListTable.addTableRowEvent('moveLink', function () {
             var table = layui.table, checkStatus = table.checkStatus('dirMetadataTable'), data = checkStatus.data;
+            if (basicData.id === 'ROOT' && !USER_ROLES.includes('ROLE_SA')){
+                layer.msg('没有权限');
+                return;
+            }
             if (data.length < 1) {
                 layer.confirm("请选择要移动的文件！", function (index) {
                     layer.close(index);
@@ -188,6 +192,7 @@ function startRender() {
             }
         })
         metaListTable.addTableRowEvent('addFile', function () {
+
             upload(basicData, `${ctx}/sys/file/layer/dir?directoryId=${basicData.id}`, function (res) {
                 if (res.success) {
                     refreshDirectoryNode(tempNode, basicData);
@@ -277,6 +282,10 @@ function startRender() {
     }
 
     function upload(basicData, url, callback) {
+        if (basicData.id === 'ROOT' && !USER_ROLES.includes('ROLE_SA')){
+            layer.msg('没有权限');
+            return;
+        }
         if (basicData.reviewStatus == ReviewStatus.PASS || basicData.reviewStatus == ReviewStatus.SUBMITTED) {
             addDataConfirm(open);
         } else {
diff --git a/shandan-common/src/main/resources/view/common/head.html b/shandan-common/src/main/resources/view/common/head.html
index d93748f..2176679 100644
--- a/shandan-common/src/main/resources/view/common/head.html
+++ b/shandan-common/src/main/resources/view/common/head.html
@@ -27,6 +27,14 @@
         if (!publicKey || publicKey == 'null' || publicKey != newPublicKey) {
             sessionStorage.setItem('javaPublicKey', newPublicKey);
         }
+
+        const USER_ROLE_LIST = /*[[${userRoles}]]*/ [];
+        const USER_ROLES = [];
+        if(USER_ROLE_LIST.length > 0){
+            for(const role of USER_ROLE_LIST){
+                USER_ROLES.push(role.roleName);
+            }
+        }
     </script>
 
     <!-- 引入公用库 -->