From 7479eb0e77f1fec1659e7ef6449af37a426b081d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E8=90=9D=E5=8D=9C?= <dev@saasshop.local>
Date: Sat, 14 Mar 2026 02:09:07 +0000
Subject: [PATCH] =?UTF-8?q?fix(back):=20=E8=AE=A2=E9=98=85=E8=AF=A6?=
 =?UTF-8?q?=E6=83=85=E9=A1=B5=20back=20=E6=A0=A1=E9=AA=8C=E6=8B=92?=
 =?UTF-8?q?=E7=BB=9D=20nested=20back=20+=20=E6=8A=A4=E6=A0=8F=E6=B5=8B?=
 =?UTF-8?q?=E8=AF=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../admin/site_subscriptions/show.blade.php   |  7 ++-
 ...SiteSubscriptionShowBackValidationTest.php | 63 +++++++++++++++++++
 2 files changed, 69 insertions(+), 1 deletion(-)
 create mode 100644 tests/Feature/AdminSiteSubscriptionShowBackValidationTest.php

diff --git a/resources/views/admin/site_subscriptions/show.blade.php b/resources/views/admin/site_subscriptions/show.blade.php
index 03774a4..66e4e5d 100644
--- a/resources/views/admin/site_subscriptions/show.blade.php
+++ b/resources/views/admin/site_subscriptions/show.blade.php
@@ -121,7 +121,12 @@
         @php
             $back = (string) request()->query('back', '');
             // back 安全校验：只接受相对路径，且拒绝引号/尖括号（由于下方 href 采用原样输出以避免 &amp; 影响回链/断言）
-            $safeBack = (str_starts_with($back, '/') && !preg_match('/["\'<>]/', $back)) ? $back : '';
+            $safeBack = (str_starts_with($back, '/')
+                && !preg_match('/["\'<>]/', $back)
+                // back 本身不应再包含 back（避免无限嵌套导致 URL 膨胀）
+                && !preg_match('/(?:^|[?&])back=/', $back))
+                ? $back
+                : '';
         @endphp
 
         @if($safeBack)
diff --git a/tests/Feature/AdminSiteSubscriptionShowBackValidationTest.php b/tests/Feature/AdminSiteSubscriptionShowBackValidationTest.php
new file mode 100644
index 0000000..188f5b7
--- /dev/null
+++ b/tests/Feature/AdminSiteSubscriptionShowBackValidationTest.php
@@ -0,0 +1,63 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Models\Merchant;
+use App\Models\Plan;
+use App\Models\SiteSubscription;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+class AdminSiteSubscriptionShowBackValidationTest extends TestCase
+{
+    use RefreshDatabase;
+
+    protected function loginAsPlatformAdmin(): void
+    {
+        $this->seed();
+
+        $this->post('/admin/login', [
+            'email' => 'platform.admin@demo.local',
+            'password' => 'Platform@123456',
+        ])->assertRedirect('/admin');
+    }
+
+    public function test_show_should_not_render_back_link_when_back_contains_nested_back_param(): void
+    {
+        $this->loginAsPlatformAdmin();
+
+        $merchant = Merchant::query()->firstOrFail();
+        $plan = Plan::query()->create([
+            'code' => 'sub_show_back_nested_plan',
+            'name' => '订阅详情 nested back 校验测试套餐',
+            'billing_cycle' => 'monthly',
+            'price' => 10,
+            'list_price' => 10,
+            'status' => 'active',
+            'sort' => 10,
+            'published_at' => now(),
+        ]);
+
+        $sub = SiteSubscription::query()->create([
+            'merchant_id' => $merchant->id,
+            'plan_id' => $plan->id,
+            'status' => 'active',
+            'source' => 'manual',
+            'subscription_no' => 'SUB_SHOW_BACK_NESTED_0001',
+            'plan_name' => $plan->name,
+            'billing_cycle' => $plan->billing_cycle,
+            'period_months' => 1,
+            'amount' => 10,
+            'starts_at' => now(),
+            'ends_at' => now()->addMonth(),
+        ]);
+
+        $nestedBack = '/admin/site-subscriptions?status=active&back=/admin/platform-orders';
+
+        $res = $this->get('/admin/site-subscriptions/' . $sub->id . '?back=' . urlencode($nestedBack));
+        $res->assertOk();
+
+        $res->assertDontSee('返回上一页（保留上下文）');
+        $res->assertDontSee($nestedBack, false);
+    }
+}