feat: platform orders export require download=1 safety valve

2026-03-13 22:40:56 +00:00
parent 6a666b4c2a
commit 1f832477c0
11 changed files with 53 additions and 14 deletions
--- a/app/Http/Controllers/Admin/PlatformOrderController.php
+++ b/app/Http/Controllers/Admin/PlatformOrderController.php
@@ -977,6 +977,11 @@ class PlatformOrderController extends Controller
    {
        $this->ensurePlatformAdmin($request);

+        // 安全阀：必须显式声明 download=1，避免浏览器预取/误触发导致频繁导出
+        if ((string) $request->query('download', '') !== '1') {
+            abort(400, 'download=1 required');
+        }
+
        $filters = [
            'status' => trim((string) $request->query('status', '')),
            'payment_status' => trim((string) $request->query('payment_status', '')),