From d6867d34c09939ce7fd2fd3a088eace3a83761ae Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E8=90=9D=E5=8D=9C?= Date: Fri, 13 Mar 2026 19:39:03 +0000 Subject: [PATCH] =?UTF-8?q?=E5=B9=B3=E5=8F=B0=E8=AE=A2=E5=8D=95=E8=AF=A6?= =?UTF-8?q?=E6=83=85=EF=BC=9A=E5=85=B3=E8=81=94=E8=AE=A2=E9=98=85=E9=93=BE?= =?UTF-8?q?=E6=8E=A5=E8=A1=A5=E9=BD=90=20back=20=E4=B8=94=E9=81=BF?= =?UTF-8?q?=E5=85=8D=20back=20=E5=B5=8C=E5=A5=97?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../admin/platform_orders/show.blade.php | 23 +++- ...atedSubscriptionLinksAreNotEscapedTest.php | 82 ++++++++++++++ ...elatedSubscriptionLinksContainBackTest.php | 105 ++++++++++++++++++ ...SubscriptionLinksShouldNotNestBackTest.php | 82 ++++++++++++++ 4 files changed, 287 insertions(+), 5 deletions(-) create mode 100644 tests/Feature/AdminPlatformOrderShowRelatedSubscriptionLinksAreNotEscapedTest.php create mode 100644 tests/Feature/AdminPlatformOrderShowRelatedSubscriptionLinksContainBackTest.php create mode 100644 tests/Feature/AdminPlatformOrderShowRelatedSubscriptionLinksShouldNotNestBackTest.php diff --git a/resources/views/admin/platform_orders/show.blade.php b/resources/views/admin/platform_orders/show.blade.php index 8bdd9f8..19b6772 100644 --- a/resources/views/admin/platform_orders/show.blade.php +++ b/resources/views/admin/platform_orders/show.blade.php @@ -238,10 +238,11 @@ 订阅管理 @php - $subBack = '/admin/platform-orders/' . $order->id; + // 用 orderShowSelf 作为 back（已剔除 back query，避免嵌套膨胀） + $subBack = $orderShowSelf; $openSubUrl = '/admin/site-subscriptions/' . $order->siteSubscription->id . '?' . \Illuminate\Support\Arr::query(['back' => $subBack]); @endphp - 打开订阅详情 + 打开订阅详情 ｜ @php $openSubSyncableUrl = '/admin/site-subscriptions/' . $order->siteSubscription->id . '?' . \Illuminate\Support\Arr::query([ @@ -249,11 +250,23 @@ 'order_sync_status' => 'syncable', ]) . '#syncable-batch'; @endphp - 查看可同步订单 + 查看可同步订单 ｜ - 同站点订阅 + @php + $sameMerchantSubsUrl = '/admin/site-subscriptions?' . \Illuminate\Support\Arr::query([ + 'merchant_id' => $order->siteSubscription->merchant_id, + 'back' => $orderShowSelf, + ]); + @endphp + 同站点订阅 ｜ - 同套餐订阅 + @php + $samePlanSubsUrl = '/admin/site-subscriptions?' . \Illuminate\Support\Arr::query([ + 'plan_id' => $order->siteSubscription->plan_id, + 'back' => $orderShowSelf, + ]); + @endphp + 同套餐订阅 状态{{ $order->siteSubscription->status }} diff --git a/tests/Feature/AdminPlatformOrderShowRelatedSubscriptionLinksAreNotEscapedTest.php b/tests/Feature/AdminPlatformOrderShowRelatedSubscriptionLinksAreNotEscapedTest.php new file mode 100644 index 0000000..6f2a836 --- /dev/null +++ b/tests/Feature/AdminPlatformOrderShowRelatedSubscriptionLinksAreNotEscapedTest.php @@ -0,0 +1,82 @@ +seed(); + + $this->post('/admin/login', [ + 'email' => 'platform.admin@demo.local', + 'password' => 'Platform@123456', + ])->assertRedirect('/admin'); + } + + public function test_related_subscription_links_should_not_render_amp_escaped_query_delimiter(): void + { + $this->loginAsPlatformAdmin(); + + $merchant = Merchant::query()->firstOrFail(); + $plan = Plan::query()->create([ + 'code' => 'po_show_related_sub_no_escape_plan', + 'name' => '平台订单详情关联订阅链接不转义测试套餐', + 'billing_cycle' => 'monthly', + 'price' => 10, + 'list_price' => 10, + 'status' => 'active', + 'sort' => 10, + 'published_at' => now(), + ]); + + $sub = SiteSubscription::query()->create([ + 'merchant_id' => $merchant->id, + 'plan_id' => $plan->id, + 'status' => 'activated', + 'source' => 'manual', + 'subscription_no' => 'SUB_PO_SHOW_RELATED_NO_ESCAPE_0001', + 'plan_name' => $plan->name, + 'billing_cycle' => $plan->billing_cycle, + 'period_months' => 1, + 'amount' => 10, + 'starts_at' => now()->subDay(), + 'ends_at' => now()->addMonth(), + 'activated_at' => now()->subDay(), + ]); + + $order = PlatformOrder::query()->create([ + 'merchant_id' => $merchant->id, + 'plan_id' => $plan->id, + 'site_subscription_id' => $sub->id, + 'order_no' => 'PO_SHOW_RELATED_NO_ESCAPE_0001', + 'order_type' => 'new_purchase', + 'status' => 'pending', + 'payment_status' => 'unpaid', + 'plan_name' => $plan->name, + 'billing_cycle' => $plan->billing_cycle, + 'period_months' => 1, + 'quantity' => 1, + 'payable_amount' => 10, + 'paid_amount' => 0, + 'placed_at' => now(), + 'meta' => [], + ]); + + $res = $this->get('/admin/platform-orders/' . $order->id); + $res->assertOk(); + + // 关键点：openSubSyncableUrl 带两个 query 参数，不能被渲染成 & + $res->assertDontSee('order_sync_status=syncable&', false); + $res->assertDontSee('back=%2Fadmin%2Fplatform-orders%2F' . $order->id . '&', false); + } +} diff --git a/tests/Feature/AdminPlatformOrderShowRelatedSubscriptionLinksContainBackTest.php b/tests/Feature/AdminPlatformOrderShowRelatedSubscriptionLinksContainBackTest.php new file mode 100644 index 0000000..3bb820a --- /dev/null +++ b/tests/Feature/AdminPlatformOrderShowRelatedSubscriptionLinksContainBackTest.php @@ -0,0 +1,105 @@ +seed(); + + $this->post('/admin/login', [ + 'email' => 'platform.admin@demo.local', + 'password' => 'Platform@123456', + ])->assertRedirect('/admin'); + } + + public function test_related_subscription_links_should_carry_back_to_platform_order_show(): void + { + $this->loginAsPlatformAdmin(); + + $merchant = Merchant::query()->firstOrFail(); + $plan = Plan::query()->create([ + 'code' => 'po_show_related_sub_back_plan', + 'name' => '平台订单详情关联订阅 back 链接测试套餐', + 'billing_cycle' => 'monthly', + 'price' => 10, + 'list_price' => 10, + 'status' => 'active', + 'sort' => 10, + 'published_at' => now(), + ]); + + $sub = SiteSubscription::query()->create([ + 'merchant_id' => $merchant->id, + 'plan_id' => $plan->id, + 'status' => 'activated', + 'source' => 'manual', + 'subscription_no' => 'SUB_PO_SHOW_RELATED_BACK_0001', + 'plan_name' => $plan->name, + 'billing_cycle' => $plan->billing_cycle, + 'period_months' => 1, + 'amount' => 10, + 'starts_at' => now()->subDay(), + 'ends_at' => now()->addMonth(), + 'activated_at' => now()->subDay(), + ]); + + $order = PlatformOrder::query()->create([ + 'merchant_id' => $merchant->id, + 'plan_id' => $plan->id, + 'site_subscription_id' => $sub->id, + 'order_no' => 'PO_SHOW_RELATED_BACK_0001', + 'order_type' => 'new_purchase', + 'status' => 'pending', + 'payment_status' => 'unpaid', + 'plan_name' => $plan->name, + 'billing_cycle' => $plan->billing_cycle, + 'period_months' => 1, + 'quantity' => 1, + 'payable_amount' => 10, + 'paid_amount' => 0, + 'placed_at' => now(), + 'meta' => [], + ]); + + $res = $this->get('/admin/platform-orders/' . $order->id); + $res->assertOk(); + + $back = '/admin/platform-orders/' . $order->id; + + $openSubUrl = '/admin/site-subscriptions/' . $sub->id . '?' . Arr::query([ + 'back' => $back, + ]); + + $openSubSyncableUrl = '/admin/site-subscriptions/' . $sub->id . '?' . Arr::query([ + 'back' => $back, + 'order_sync_status' => 'syncable', + ]) . '#syncable-batch'; + + $sameMerchantSubsUrl = '/admin/site-subscriptions?' . Arr::query([ + 'merchant_id' => $merchant->id, + 'back' => $back, + ]); + + $samePlanSubsUrl = '/admin/site-subscriptions?' . Arr::query([ + 'plan_id' => $plan->id, + 'back' => $back, + ]); + + $res->assertSee($openSubUrl, false); + $res->assertSee($openSubSyncableUrl, false); + $res->assertSee($sameMerchantSubsUrl, false); + $res->assertSee($samePlanSubsUrl, false); + } +} diff --git a/tests/Feature/AdminPlatformOrderShowRelatedSubscriptionLinksShouldNotNestBackTest.php b/tests/Feature/AdminPlatformOrderShowRelatedSubscriptionLinksShouldNotNestBackTest.php new file mode 100644 index 0000000..670ff4b --- /dev/null +++ b/tests/Feature/AdminPlatformOrderShowRelatedSubscriptionLinksShouldNotNestBackTest.php @@ -0,0 +1,82 @@ +seed(); + + $this->post('/admin/login', [ + 'email' => 'platform.admin@demo.local', + 'password' => 'Platform@123456', + ])->assertRedirect('/admin'); + } + + public function test_related_subscription_links_back_should_not_contain_nested_back(): void + { + $this->loginAsPlatformAdmin(); + + $merchant = Merchant::query()->firstOrFail(); + $plan = Plan::query()->create([ + 'code' => 'po_show_related_sub_no_nested_back_plan', + 'name' => '平台订单详情关联订阅 back 不嵌套测试套餐', + 'billing_cycle' => 'monthly', + 'price' => 10, + 'list_price' => 10, + 'status' => 'active', + 'sort' => 10, + 'published_at' => now(), + ]); + + $sub = SiteSubscription::query()->create([ + 'merchant_id' => $merchant->id, + 'plan_id' => $plan->id, + 'status' => 'activated', + 'source' => 'manual', + 'subscription_no' => 'SUB_PO_SHOW_NO_NEST_0001', + 'plan_name' => $plan->name, + 'billing_cycle' => $plan->billing_cycle, + 'period_months' => 1, + 'amount' => 10, + 'starts_at' => now()->subDay(), + 'ends_at' => now()->addMonth(), + 'activated_at' => now()->subDay(), + ]); + + $order = PlatformOrder::query()->create([ + 'merchant_id' => $merchant->id, + 'plan_id' => $plan->id, + 'site_subscription_id' => $sub->id, + 'order_no' => 'PO_SHOW_NO_NEST_0001', + 'order_type' => 'new_purchase', + 'status' => 'pending', + 'payment_status' => 'unpaid', + 'plan_name' => $plan->name, + 'billing_cycle' => $plan->billing_cycle, + 'period_months' => 1, + 'quantity' => 1, + 'payable_amount' => 10, + 'paid_amount' => 0, + 'placed_at' => now(), + 'meta' => [], + ]); + + // 带 back 访问订单详情页（模拟从列表进入） + $res = $this->get('/admin/platform-orders/' . $order->id . '?back=' . urlencode('/admin/platform-orders?status=pending')); + $res->assertOk(); + + // 关联订阅的 back 应该回到“订单详情（去掉 back）”，不应出现 back=...back= 的嵌套 + $res->assertDontSee('back%3D', false); + } +}