linxianzhuang/saasshop
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Admin dashboard: billing quick links carry safe back via BackUrl

Browse Source
This commit is contained in:
萝卜
2026-03-15 00:49:45 +00:00
parent d76a50e37c
commit 84946db852
2 changed files with 53 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
resources/views/admin/dashboard.blade.php
View File

@@ -4,6 +4,17 @@
@section('page_title', '总台管理仪表盘')
@section('content')
@php
$incomingBack = (string) request()->query('back', '');
$safeBackForLinks = \App\Support\BackUrl::sanitizeForLinks($incomingBack);
$platformOrdersQuickLinks = [
'unpaid_pending' => \App\Support\BackUrl::withBack('/admin/platform-orders?payment_status=unpaid&status=pending', $safeBackForLinks),
'paid_pending' => \App\Support\BackUrl::withBack('/admin/platform-orders?payment_status=paid&status=pending', $safeBackForLinks),
'syncable_only' => \App\Support\BackUrl::withBack('/admin/platform-orders?syncable_only=1', $safeBackForLinks),
'sync_failed' => \App\Support\BackUrl::withBack('/admin/platform-orders?sync_status=failed', $safeBackForLinks),
];
@endphp
<div class="two-col mb-20">
<div class="card">
<p>欢迎回来，{{ $adminName }}。当前入口已明确为 <strong>总台管理</strong>，用于平台运营方统一查看站点、渠道、全局配置和平台级业务数据。</p>
@@ -36,10 +47,10 @@
<div class="mt-12">
<div class="muted">快捷筛选：</div>
<div class="actions mt-8">
<a class="btn btn-secondary btn-sm" href="/admin/platform-orders?payment_status=unpaid&status=pending">待支付</a>
<a class="btn btn-secondary btn-sm" href="/admin/platform-orders?payment_status=paid&status=pending">待生效</a>
<a class="btn btn-secondary btn-sm" href="/admin/platform-orders?syncable_only=1">可同步</a>
<a class="btn btn-secondary btn-sm" href="/admin/platform-orders?sync_status=failed">同步失败</a>
<a class="btn btn-secondary btn-sm" href="{!! $platformOrdersQuickLinks['unpaid_pending'] !!}">待支付</a>
<a class="btn btn-secondary btn-sm" href="{!! $platformOrdersQuickLinks['paid_pending'] !!}">待生效</a>
<a class="btn btn-secondary btn-sm" href="{!! $platformOrdersQuickLinks['syncable_only'] !!}">可同步</a>
<a class="btn btn-secondary btn-sm" href="{!! $platformOrdersQuickLinks['sync_failed'] !!}">同步失败</a>
</div>
</div>
</div>

38
tests/Feature/AdminDashboardBillingWorkbenchQuickLinksShouldUseBackUrlTest.php Normal file
View File

@@ -0,0 +1,38 @@
<?php
namespace Tests\Feature;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Tests\TestCase;
class AdminDashboardBillingWorkbenchQuickLinksShouldUseBackUrlTest extends TestCase
{
use RefreshDatabase;
protected function loginAsPlatformAdmin(): void
{
$this->seed();
$this->post('/admin/login', [
'email' => 'platform.admin@demo.local',
'password' => 'Platform@123456',
])->assertRedirect('/admin');
}
public function test_dashboard_quick_links_should_use_back_url_builder_and_not_escape_ampersand(): void
{
$this->loginAsPlatformAdmin();
// 给 dashboard 带一个安全 back，模拟从其它页面回到 dashboard 后再点治理入口
$res = $this->get('/admin?back=' . urlencode('/admin/plans'));
$res->assertOk();
// 期望：链接里带 back=%2Fadmin%2Fplans 且 & 不被 escape 成 &amp;
$res->assertSee('href="/admin/platform-orders?payment_status=unpaid&status=pending&back=%2Fadmin%2Fplans"', false);
$res->assertSee('href="/admin/platform-orders?payment_status=paid&status=pending&back=%2Fadmin%2Fplans"', false);
$res->assertSee('href="/admin/platform-orders?syncable_only=1&back=%2Fadmin%2Fplans"', false);
$res->assertSee('href="/admin/platform-orders?sync_status=failed&back=%2Fadmin%2Fplans"', false);
$res->assertDontSee('&amp;back=', false);
}
}