linxianzhuang/saasshop
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

线索页筛选：透传安全 back（补测试）

Browse Source
This commit is contained in:
萝卜
2026-03-14 15:50:32 +00:00
parent 2d10c80f2b
commit 546ffc21e6
3 changed files with 72 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

35
tests/Feature/AdminPlatformLeadIndexFilterFormDropsUnsafeBackTest.php Normal file
View File

@@ -0,0 +1,35 @@
<?php
namespace Tests\Feature;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Tests\TestCase;
class AdminPlatformLeadIndexFilterFormDropsUnsafeBackTest extends TestCase
{
use RefreshDatabase;
protected function loginAsPlatformAdmin(): void
{
$this->seed();
$this->post('/admin/login', [
'email' => 'platform.admin@demo.local',
'password' => 'Platform@123456',
])->assertRedirect('/admin');
}
public function test_index_filter_form_should_not_keep_back_when_back_is_unsafe(): void
{
$this->loginAsPlatformAdmin();
$unsafeBack = '/admin/platform-orders?status=pending&back=/admin/plans';
$res = $this->get('/admin/platform-leads?back=' . urlencode($unsafeBack));
$res->assertOk();
// unsafe back 不应被写入隐藏字段（避免 nested back 膨胀/绕过）
$res->assertDontSee('name="back"', false);
$res->assertDontSee($unsafeBack, false);
}
}

34
tests/Feature/AdminPlatformLeadIndexFilterFormKeepsSafeBackTest.php Normal file
View File

@@ -0,0 +1,34 @@
<?php
namespace Tests\Feature;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Tests\TestCase;
class AdminPlatformLeadIndexFilterFormKeepsSafeBackTest extends TestCase
{
use RefreshDatabase;
protected function loginAsPlatformAdmin(): void
{
$this->seed();
$this->post('/admin/login', [
'email' => 'platform.admin@demo.local',
'password' => 'Platform@123456',
])->assertRedirect('/admin');
}
public function test_index_filter_form_should_keep_safe_back_as_hidden_input(): void
{
$this->loginAsPlatformAdmin();
$back = '/admin/platform-orders?lead_id=1&status=pending';
$res = $this->get('/admin/platform-leads?back=' . urlencode($back));
$res->assertOk();
// 过滤表单应透传 back，避免“应用筛选”后丢上下文
$res->assertSee('name="back" value="' . $back . '"', false);
}
}