diff --git a/app/Http/Controllers/Admin/PlatformOrderController.php b/app/Http/Controllers/Admin/PlatformOrderController.php index a53b0c7..652abd6 100644 --- a/app/Http/Controllers/Admin/PlatformOrderController.php +++ b/app/Http/Controllers/Admin/PlatformOrderController.php @@ -660,14 +660,19 @@ class PlatformOrderController extends Controller $data = $request->validate([ 'site_subscription_id' => ['required', 'integer', 'exists:site_subscriptions,id'], + 'back' => ['nullable', 'string', 'max:2000'], ]); + $safeBack = \App\Support\BackUrl::sanitizeForLinks((string) ($data['back'] ?? '')); + if ((string) ($order->order_type ?? '') !== 'renewal') { - return redirect()->back()->with('warning', '仅「续费」类型订单允许绑定订阅。'); + return ($safeBack !== '' ? redirect($safeBack) : redirect()->back()) + ->with('warning', '仅「续费」类型订单允许绑定订阅。'); } if ((int) ($order->site_subscription_id ?? 0) > 0) { - return redirect()->back()->with('warning', '该订单已绑定订阅,无需重复操作。'); + return ($safeBack !== '' ? redirect($safeBack) : redirect()->back()) + ->with('warning', '该订单已绑定订阅,无需重复操作。'); } $subId = (int) $data['site_subscription_id']; @@ -675,14 +680,16 @@ class PlatformOrderController extends Controller // 强约束:订阅上下文必须与订单一致 if ((int) ($sub->merchant_id ?? 0) !== (int) ($order->merchant_id ?? 0)) { - return redirect()->back()->withErrors([ - 'site_subscription_id' => '订阅所属站点与订单站点不一致,禁止绑定(避免串单)。', - ]); + return ($safeBack !== '' ? redirect($safeBack) : redirect()->back()) + ->withErrors([ + 'site_subscription_id' => '订阅所属站点与订单站点不一致,禁止绑定(避免串单)。', + ]); } if ((int) ($sub->plan_id ?? 0) !== (int) ($order->plan_id ?? 0)) { - return redirect()->back()->withErrors([ - 'site_subscription_id' => '订阅套餐与订单套餐不一致,禁止绑定(避免跨套餐续费)。', - ]); + return ($safeBack !== '' ? redirect($safeBack) : redirect()->back()) + ->withErrors([ + 'site_subscription_id' => '订阅套餐与订单套餐不一致,禁止绑定(避免跨套餐续费)。', + ]); } $order->site_subscription_id = $sub->id; @@ -703,7 +710,8 @@ class PlatformOrderController extends Controller $order->save(); - return redirect()->back()->with('success', '已绑定订阅:' . (string) ($sub->subscription_no ?? $sub->id)); + return ($safeBack !== '' ? redirect($safeBack) : redirect()->back()) + ->with('success', '已绑定订阅:' . (string) ($sub->subscription_no ?? $sub->id)); } public function activateSubscription(Request $request, PlatformOrder $order, SubscriptionActivationService $service): RedirectResponse diff --git a/resources/views/admin/site_subscriptions/index.blade.php b/resources/views/admin/site_subscriptions/index.blade.php index a607c57..f6520d3 100644 --- a/resources/views/admin/site_subscriptions/index.blade.php +++ b/resources/views/admin/site_subscriptions/index.blade.php @@ -39,6 +39,12 @@ $incomingBack = (string) request()->query('back', ''); $safeBackForLinks = \App\Support\BackUrl::sanitizeForLinks($incomingBack); + // “从订单详情页来挑订阅”的治理交互: + // - attach_order_id:表示把选中的订阅绑定回某个订单 + // - attach_back:绑定成功后回跳到哪里(通常是订单详情页) + $attachOrderId = (int) request()->query('attach_order_id', 0); + $safeAttachBackForLinks = \App\Support\BackUrl::sanitizeForLinks((string) request()->query('attach_back', '')); + // 用于摘要卡等入口:保留当前 query 并覆盖字段,同时安全透传 back。 $safeFullUrlWithQuery = function (array $overrides = []) use ($safeBackForLinks) { return \App\Support\BackUrl::currentPathWithQuery($overrides, $safeBackForLinks); @@ -300,6 +306,25 @@