diff --git a/resources/views/admin/platform_orders/show.blade.php b/resources/views/admin/platform_orders/show.blade.php index 29065e6..2889acf 100644 --- a/resources/views/admin/platform_orders/show.blade.php +++ b/resources/views/admin/platform_orders/show.blade.php @@ -27,6 +27,23 @@ 'refund_inconsistent' => 1, ]), $orderShowSelf); @endphp +@php + $incomingBack = (string) request()->query('back', ''); + // back 安全护栏: + // - 仅允许站内相对路径(/ 开头) + // - 拒绝引号/尖括号 + // - 拒绝 nested back=(避免 URL 膨胀/绕过) + // 说明:下方 href 采用原样输出以避免 & 影响断言。 + $safeBackForLinks = \App\Support\BackUrl::sanitizeForLinks($incomingBack); + + // 若 back 指向的平台订单列表带 lead_id,则在详情页也提示当前来源线索(更不迷路)。 + $leadIdFromBack = 0; + if ($safeBackForLinks !== '') { + $parts = parse_url($safeBackForLinks); + parse_str((string) ($parts['query'] ?? ''), $q); + $leadIdFromBack = (int) ($q['lead_id'] ?? 0); + } +@endphp
{{ json_encode($order->meta, JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE) }}
-