diff --git a/src/controller/admin/system/sms.js b/src/controller/admin/system/sms.js
index 02cee03..7ce50f8 100644
--- a/src/controller/admin/system/sms.js
+++ b/src/controller/admin/system/sms.js
@@ -45,6 +45,16 @@ module.exports = class extends Base {
       .page(page, pageSize)
       .countSelect();
 
+    // 验证码脱敏：6位验证码中间4位替换为****
+    const codeBizTypes = ['real_name_auth', 'login', 'change_phone'];
+    if (list.data && list.data.length) {
+      list.data.forEach(item => {
+        if (item.code && codeBizTypes.includes(item.biz_type)) {
+          item.code = item.code.slice(0, 1) + '****' + item.code.slice(-1);
+        }
+      });
+    }
+
     return this.json({ code: 0, data: list });
   }
 
diff --git a/view/admin/patient_detail.html b/view/admin/patient_detail.html
index 22e3b9b..98414f5 100644
--- a/view/admin/patient_detail.html
+++ b/view/admin/patient_detail.html
@@ -156,8 +156,8 @@
   <!-- 固定底部操作栏 -->
   <div class="fixed-bottom-bar">
     <el-button @click="goBack">返 回</el-button>
-    <el-button v-if="patient.status === 0 && canAudit" type="success" @click="handleApprove">审核通过</el-button>
-    <el-button v-if="patient.status === 0 && canAudit" type="danger" @click="showRejectDialog">驳 回</el-button>
+    <el-button v-if="(patient.status === 0 || patient.status === 2) && canAudit" type="success" @click="handleApprove">审核通过</el-button>
+    <el-button v-if="(patient.status === 0 || patient.status === 1) && canAudit" type="danger" @click="showRejectDialog">驳 回</el-button>
   </div>
 
   <!-- 驳回弹窗 -->