前端：

saveBefore:function(e){
        var flag=true;
        waf.ajax({
        url:waf.getContextPath() + "/demo/demoEdit.do?method=checkPression",
        data:{permissionItem:"bzd_save"}, //传参
        type:'post',
        dataType:'',
        async:false,
        success:function(data){
            if(data.data==true){
     
      }else{
        _self.showMessage("您没有当前组织下报账单的保存权限 ！");
        flag=false;
        
      }
        }
            });
      return flag;
        }

后端验证

//waf2权限验证
  @RequestMapping(params = { "method=checkPression" })
  @ResponseBody
  public void checkPression(HttpServletRequest request,
      HttpServletResponse response, ModelMap model) throws Exception {
    String permissionItem = request.getParameter("permissionItem"); // 权限编码
    if(StringUtil.isEmpty(permissionItem)){
        JSONUtils.SUCCESS( false);
    }else{
      Context context = WafContext.getInstance().getContext();
      CoreBaseInfo userinfo = UserFactory.getRemoteInstance().getValue(
          WafContext.getInstance().getContext().getCaller());
        CompanyOrgUnitInfo CompanyOrgUnitInfo = (CompanyOrgUnitInfo) context.get(OrgType.Company);
        BOSUuid CurOrgPkid = CompanyOrgUnitInfo.getId();
        BOSUuid userPkid = userinfo.getId();
        ObjectUuidPK CurOrgPk = new ObjectUuidPK(BOSUuid.read(CurOrgPkid.toString()));
        ObjectUuidPK userPk = new ObjectUuidPK(BOSUuid.read(userPkid.toString()));
      boolean hasFunctionPermission = PermissionFactory.getRemoteInstance().hasFunctionPermission(userPk, CurOrgPk, permissionItem);
      
      JSONUtils.SUCCESS( hasFunctionPermission);
    }
     
  }