linxianzhuang/saasshop
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

套餐筛选表单：仅透传安全back（补测试）

Browse Source
This commit is contained in:
萝卜
2026-03-14 16:26:18 +00:00
parent 1439e0da62
commit 4096b4d9ad
3 changed files with 71 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
resources/views/admin/plans/index.blade.php
View File

@@ -142,6 +142,9 @@
<div class="card mb-20">
<h3>筛选条件</h3>
<form method="get" action="/admin/plans" class="grid-3">
@if($safeBackForLinks !== '')
<input type="hidden" name="back" value="{!! $safeBackForLinks !!}">
@endif
<select name="status">
<option value="">全部状态</option>
@foreach(($filterOptions['statuses'] ?? []) as $value => $label)

35
tests/Feature/AdminPlanIndexFilterFormDropsUnsafeBackTest.php Normal file
View File

@@ -0,0 +1,35 @@
<?php
namespace Tests\Feature;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Tests\TestCase;
class AdminPlanIndexFilterFormDropsUnsafeBackTest extends TestCase
{
use RefreshDatabase;
protected function loginAsPlatformAdmin(): void
{
$this->seed();
$this->post('/admin/login', [
'email' => 'platform.admin@demo.local',
'password' => 'Platform@123456',
])->assertRedirect('/admin');
}
public function test_index_filter_form_should_drop_unsafe_back_as_hidden_input(): void
{
$this->loginAsPlatformAdmin();
// 外链 back：必须丢弃（非 / 开头）
$back = 'https://evil.test/a';
$res = $this->get('/admin/plans?back=' . urlencode($back));
$res->assertOk();
$res->assertDontSee('name="back"', false);
$res->assertDontSee('value="' . $back . '"', false);
}
}

33
tests/Feature/AdminPlanIndexFilterFormKeepsSafeBackTest.php Normal file
View File

@@ -0,0 +1,33 @@
<?php
namespace Tests\Feature;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Tests\TestCase;
class AdminPlanIndexFilterFormKeepsSafeBackTest extends TestCase
{
use RefreshDatabase;
protected function loginAsPlatformAdmin(): void
{
$this->seed();
$this->post('/admin/login', [
'email' => 'platform.admin@demo.local',
'password' => 'Platform@123456',
])->assertRedirect('/admin');
}
public function test_index_filter_form_should_keep_safe_back_as_hidden_input(): void
{
$this->loginAsPlatformAdmin();
$back = '/admin/platform-orders?plan_id=3&status=pending';
$res = $this->get('/admin/plans?back=' . urlencode($back));
$res->assertOk();
$res->assertSee('name="back" value="' . $back . '"', false);
}
}