对账明细导出：增加 download=1 安全阀并补护栏测试

2026-03-13 21:05:23 +00:00
parent c4c1eedce1
commit dcf1e3d226
4 changed files with 72 additions and 6 deletions
--- a/app/Http/Controllers/Admin/PlatformOrderController.php
+++ b/app/Http/Controllers/Admin/PlatformOrderController.php
@@ -421,6 +421,11 @@ class PlatformOrderController extends Controller
    {
        $this->ensurePlatformAdmin($request);

+        // 安全阀：必须显式声明 download=1，避免浏览器预取/误触发导致频繁导出
+        if ((string) $request->query('download', '') !== '1') {
+            abort(400, 'download=1 required');
+        }
+
        $order->loadMissing(['merchant', 'plan', 'siteSubscription']);

        $paymentReceipts = (array) (data_get($order->meta, 'payment_receipts', []) ?? []);