From 546ffc21e6a71e1b19cd8b581276a87b36b16204 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E8=90=9D=E5=8D=9C?= <dev@saasshop.local>
Date: Sat, 14 Mar 2026 15:50:32 +0000
Subject: [PATCH] =?UTF-8?q?=E7=BA=BF=E7=B4=A2=E9=A1=B5=E7=AD=9B=E9=80=89?=
 =?UTF-8?q?=EF=BC=9A=E9=80=8F=E4=BC=A0=E5=AE=89=E5=85=A8=20back=EF=BC=88?=
 =?UTF-8?q?=E8=A1=A5=E6=B5=8B=E8=AF=95=EF=BC=89?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../admin/platform_leads/index.blade.php      |  3 ++
 ...LeadIndexFilterFormDropsUnsafeBackTest.php | 35 +++++++++++++++++++
 ...rmLeadIndexFilterFormKeepsSafeBackTest.php | 34 ++++++++++++++++++
 3 files changed, 72 insertions(+)
 create mode 100644 tests/Feature/AdminPlatformLeadIndexFilterFormDropsUnsafeBackTest.php
 create mode 100644 tests/Feature/AdminPlatformLeadIndexFilterFormKeepsSafeBackTest.php

diff --git a/resources/views/admin/platform_leads/index.blade.php b/resources/views/admin/platform_leads/index.blade.php
index 70baacb..9f7fe5d 100644
--- a/resources/views/admin/platform_leads/index.blade.php
+++ b/resources/views/admin/platform_leads/index.blade.php
@@ -72,6 +72,9 @@
 <div class="card mb-20">
     <h3>筛选</h3>
     <form method="get" action="/admin/platform-leads" class="grid-3">
+        @if($safeBack)
+            <input type="hidden" name="back" value="{!! $safeBack !!}">
+        @endif
         <select name="status">
             <option value="">全部状态</option>
             @foreach(($statusLabels ?? []) as $v => $label)
diff --git a/tests/Feature/AdminPlatformLeadIndexFilterFormDropsUnsafeBackTest.php b/tests/Feature/AdminPlatformLeadIndexFilterFormDropsUnsafeBackTest.php
new file mode 100644
index 0000000..8666f9f
--- /dev/null
+++ b/tests/Feature/AdminPlatformLeadIndexFilterFormDropsUnsafeBackTest.php
@@ -0,0 +1,35 @@
+<?php
+
+namespace Tests\Feature;
+
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+class AdminPlatformLeadIndexFilterFormDropsUnsafeBackTest extends TestCase
+{
+    use RefreshDatabase;
+
+    protected function loginAsPlatformAdmin(): void
+    {
+        $this->seed();
+
+        $this->post('/admin/login', [
+            'email' => 'platform.admin@demo.local',
+            'password' => 'Platform@123456',
+        ])->assertRedirect('/admin');
+    }
+
+    public function test_index_filter_form_should_not_keep_back_when_back_is_unsafe(): void
+    {
+        $this->loginAsPlatformAdmin();
+
+        $unsafeBack = '/admin/platform-orders?status=pending&back=/admin/plans';
+
+        $res = $this->get('/admin/platform-leads?back=' . urlencode($unsafeBack));
+        $res->assertOk();
+
+        // unsafe back 不应被写入隐藏字段（避免 nested back 膨胀/绕过）
+        $res->assertDontSee('name="back"', false);
+        $res->assertDontSee($unsafeBack, false);
+    }
+}
diff --git a/tests/Feature/AdminPlatformLeadIndexFilterFormKeepsSafeBackTest.php b/tests/Feature/AdminPlatformLeadIndexFilterFormKeepsSafeBackTest.php
new file mode 100644
index 0000000..922ce84
--- /dev/null
+++ b/tests/Feature/AdminPlatformLeadIndexFilterFormKeepsSafeBackTest.php
@@ -0,0 +1,34 @@
+<?php
+
+namespace Tests\Feature;
+
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+class AdminPlatformLeadIndexFilterFormKeepsSafeBackTest extends TestCase
+{
+    use RefreshDatabase;
+
+    protected function loginAsPlatformAdmin(): void
+    {
+        $this->seed();
+
+        $this->post('/admin/login', [
+            'email' => 'platform.admin@demo.local',
+            'password' => 'Platform@123456',
+        ])->assertRedirect('/admin');
+    }
+
+    public function test_index_filter_form_should_keep_safe_back_as_hidden_input(): void
+    {
+        $this->loginAsPlatformAdmin();
+
+        $back = '/admin/platform-orders?lead_id=1&status=pending';
+
+        $res = $this->get('/admin/platform-leads?back=' . urlencode($back));
+        $res->assertOk();
+
+        // 过滤表单应透传 back，避免“应用筛选”后丢上下文
+        $res->assertSee('name="back" value="' . $back . '"', false);
+    }
+}