linxianzhuang/saasshop
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(back): render safeBack raw with stronger validation on index/form pages

Browse Source
This commit is contained in:
萝卜
2026-03-14 01:16:02 +00:00
parent c2b213af9c
commit 4116ea5f9f
4 changed files with 24 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
resources/views/admin/plans/index.blade.php
View File

@@ -32,11 +32,15 @@
@php
$incomingBack = (string) request()->query('back', '');
$safeBack = str_starts_with($incomingBack, '/') ? $incomingBack : '';
// 为避免 & 被 Blade escape 成 & 导致回退上下文丢失，这里需要原样输出 href。
// 安全护栏：必须为站内相对路径，并拒绝引号/尖括号，降低 XSS 风险。
$safeBack = (str_starts_with($incomingBack, '/') && !preg_match('/["\'<>]/', $incomingBack))
? $incomingBack
: '';
@endphp
@if($safeBack)
<div class="mt-10">
<a href="{{ $safeBack }}" class="muted">← 返回上一页（保留上下文）</a>
<a href="{!! $safeBack !!}" class="muted">← 返回上一页（保留上下文）</a>
</div>
@endif
</div>

8
resources/views/admin/platform_orders/form.blade.php
View File

@@ -88,11 +88,15 @@
<div class="form-actions">
@php
$incomingBack = (string) ($defaults['back'] ?? '');
$safeBack = str_starts_with($incomingBack, '/') ? $incomingBack : '';
// 为避免 & 被 Blade escape 成 &amp; 导致回退上下文丢失，这里需要原样输出 href。
// 安全护栏：必须为站内相对路径，并拒绝引号/尖括号，降低 XSS 风险。
$safeBack = (str_starts_with($incomingBack, '/') && !preg_match('/["\'<>]/', $incomingBack))
? $incomingBack
: '';
@endphp
@if($safeBack)
<a href="{{ $safeBack }}" class="btn-secondary">返回（保留上下文）</a>
<a href="{!! $safeBack !!}" class="btn-secondary">返回（保留上下文）</a>
@else
<a href="/admin/platform-orders" class="btn-secondary">返回</a>
@endif

8
resources/views/admin/platform_orders/index.blade.php
View File

@@ -23,11 +23,15 @@
@php
$back = (string) request()->query('back', '');
$safeBack = str_starts_with($back, '/') ? $back : '';
// 为避免 & 被 Blade escape 成 &amp; 导致回退上下文丢失，这里需要原样输出 href。
// 安全护栏：必须为站内相对路径，并拒绝引号/尖括号，降低 XSS 风险。
$safeBack = (str_starts_with($back, '/') && !preg_match('/["\'<>]/', $back))
? $back
: '';
@endphp
@if($safeBack)
<div class="mt-10">
<a href="{{ $safeBack }}" class="muted">← 返回上一页（保留上下文）</a>
<a href="{!! $safeBack !!}" class="muted">← 返回上一页（保留上下文）</a>
</div>
@endif

8
resources/views/admin/site_subscriptions/index.blade.php
View File

@@ -40,11 +40,15 @@
@php
$incomingBack = (string) request()->query('back', '');
$safeBack = str_starts_with($incomingBack, '/') ? $incomingBack : '';
// 为避免 & 被 Blade escape 成 &amp; 导致回退上下文丢失，这里需要原样输出 href。
// 安全护栏：必须为站内相对路径，并拒绝引号/尖括号，降低 XSS 风险。
$safeBack = (str_starts_with($incomingBack, '/') && !preg_match('/["\'<>]/', $incomingBack))
? $incomingBack
: '';
@endphp
@if($safeBack)
<div class="mt-10">
<a href="{{ $safeBack }}" class="muted">← 返回上一页（保留上下文）</a>
<a href="{!! $safeBack !!}" class="muted">← 返回上一页（保留上下文）</a>
</div>
@endif
</div>