diff --git a/resources/views/admin/platform_orders/index.blade.php b/resources/views/admin/platform_orders/index.blade.php
index eedc065..489df73 100644
--- a/resources/views/admin/platform_orders/index.blade.php
+++ b/resources/views/admin/platform_orders/index.blade.php
@@ -738,7 +738,7 @@
@forelse($orders as $order)
| {{ $order->id }} |
- {{ $order->order_no }} |
+ {{ $order->order_no }} |
@if($order->merchant)
{{ $order->merchant->name }}
diff --git a/resources/views/admin/platform_orders/show.blade.php b/resources/views/admin/platform_orders/show.blade.php
index c89b19d..9089f0f 100644
--- a/resources/views/admin/platform_orders/show.blade.php
+++ b/resources/views/admin/platform_orders/show.blade.php
@@ -544,6 +544,16 @@
+ @php
+ $back = (string) request()->query('back', '');
+ $safeBack = str_starts_with($back, '/') ? $back : '';
+ @endphp
+
+ @if($safeBack)
+ ← 返回上一页(保留上下文)
+ |
+ @endif
+
← 返回平台订单列表
@endsection
diff --git a/tests/Feature/AdminPlatformOrderIndexOrderNoLinkWithBackTest.php b/tests/Feature/AdminPlatformOrderIndexOrderNoLinkWithBackTest.php
new file mode 100644
index 0000000..dd85eaf
--- /dev/null
+++ b/tests/Feature/AdminPlatformOrderIndexOrderNoLinkWithBackTest.php
@@ -0,0 +1,62 @@
+seed();
+
+ $this->post('/admin/login', [
+ 'email' => 'platform.admin@demo.local',
+ 'password' => 'Platform@123456',
+ ])->assertRedirect('/admin');
+ }
+
+ public function test_order_no_link_in_index_contains_back_param(): void
+ {
+ $this->loginAsPlatformAdmin();
+
+ $merchant = \App\Models\Merchant::query()->firstOrFail();
+ $plan = \App\Models\Plan::query()->create([
+ 'code' => 'po_index_back_plan_01',
+ 'name' => '平台订单列表 back 参数测试套餐',
+ 'billing_cycle' => 'monthly',
+ 'price' => 10,
+ 'list_price' => 10,
+ 'status' => 'active',
+ 'sort' => 10,
+ 'published_at' => now(),
+ ]);
+
+ $order = \App\Models\PlatformOrder::query()->create([
+ 'merchant_id' => $merchant->id,
+ 'plan_id' => $plan->id,
+ 'order_no' => 'PO_INDEX_BACK_0001',
+ 'order_type' => 'new_purchase',
+ 'status' => 'pending',
+ 'payment_status' => 'unpaid',
+ 'plan_name' => $plan->name,
+ 'billing_cycle' => $plan->billing_cycle,
+ 'period_months' => 1,
+ 'quantity' => 1,
+ 'payable_amount' => 10,
+ 'paid_amount' => 0,
+ 'placed_at' => now(),
+ 'meta' => [],
+ ]);
+
+ // index 页应存在该订单行链接,且链接带 back(保留筛选上下文)
+ $res = $this->get('/admin/platform-orders?status=pending');
+ $res->assertOk();
+
+ $expectedBack = urlencode('/admin/platform-orders?status=pending');
+ $res->assertSee('/admin/platform-orders/' . $order->id . '?back=' . $expectedBack, false);
+ }
+}
diff --git a/tests/Feature/AdminPlatformOrderShowBackLinkTest.php b/tests/Feature/AdminPlatformOrderShowBackLinkTest.php
new file mode 100644
index 0000000..9078128
--- /dev/null
+++ b/tests/Feature/AdminPlatformOrderShowBackLinkTest.php
@@ -0,0 +1,102 @@
+seed();
+
+ $this->post('/admin/login', [
+ 'email' => 'platform.admin@demo.local',
+ 'password' => 'Platform@123456',
+ ])->assertRedirect('/admin');
+ }
+
+ public function test_show_page_renders_safe_back_link_when_back_query_present(): void
+ {
+ $this->loginAsPlatformAdmin();
+
+ $merchant = Merchant::query()->firstOrFail();
+ $plan = Plan::query()->create([
+ 'code' => 'po_show_back_link_plan',
+ 'name' => '平台订单详情返回链接测试套餐',
+ 'billing_cycle' => 'monthly',
+ 'price' => 10,
+ 'list_price' => 10,
+ 'status' => 'active',
+ 'sort' => 10,
+ 'published_at' => now(),
+ ]);
+
+ $order = PlatformOrder::query()->create([
+ 'merchant_id' => $merchant->id,
+ 'plan_id' => $plan->id,
+ 'order_no' => 'PO_SHOW_BACK_0001',
+ 'order_type' => 'new_purchase',
+ 'status' => 'pending',
+ 'payment_status' => 'unpaid',
+ 'plan_name' => $plan->name,
+ 'billing_cycle' => $plan->billing_cycle,
+ 'period_months' => 1,
+ 'quantity' => 1,
+ 'payable_amount' => 10,
+ 'paid_amount' => 0,
+ 'placed_at' => now(),
+ 'meta' => [],
+ ]);
+
+ $back = '/admin/platform-orders?status=pending';
+ $this->get('/admin/platform-orders/' . $order->id . '?back=' . urlencode($back))
+ ->assertOk()
+ ->assertSee('返回上一页(保留上下文)')
+ ->assertSee($back, false);
+ }
+
+ public function test_show_page_does_not_render_back_link_when_back_is_not_relative_path(): void
+ {
+ $this->loginAsPlatformAdmin();
+
+ $merchant = Merchant::query()->firstOrFail();
+ $plan = Plan::query()->create([
+ 'code' => 'po_show_back_link_plan2',
+ 'name' => '平台订单详情返回链接测试套餐2',
+ 'billing_cycle' => 'monthly',
+ 'price' => 10,
+ 'list_price' => 10,
+ 'status' => 'active',
+ 'sort' => 10,
+ 'published_at' => now(),
+ ]);
+
+ $order = PlatformOrder::query()->create([
+ 'merchant_id' => $merchant->id,
+ 'plan_id' => $plan->id,
+ 'order_no' => 'PO_SHOW_BACK_0002',
+ 'order_type' => 'new_purchase',
+ 'status' => 'pending',
+ 'payment_status' => 'unpaid',
+ 'plan_name' => $plan->name,
+ 'billing_cycle' => $plan->billing_cycle,
+ 'period_months' => 1,
+ 'quantity' => 1,
+ 'payable_amount' => 10,
+ 'paid_amount' => 0,
+ 'placed_at' => now(),
+ 'meta' => [],
+ ]);
+
+ $this->get('/admin/platform-orders/' . $order->id . '?back=https://evil.example.com')
+ ->assertOk()
+ ->assertDontSee('返回上一页(保留上下文)');
+ }
+}
|