feat: plans export require download=1 safety valve

2026-03-13 22:55:48 +00:00
parent f37ff15e0d
commit e6d3dfaa98
4 changed files with 40 additions and 1 deletions
--- a/app/Http/Controllers/Admin/PlanController.php
+++ b/app/Http/Controllers/Admin/PlanController.php
@@ -22,6 +22,11 @@ class PlanController extends Controller
    {
        $this->ensurePlatformAdmin($request);

+        // 安全阀：必须显式声明 download=1，避免浏览器预取/误触发导致频繁导出
+        if ((string) $request->query('download', '') !== '1') {
+            abort(400, 'download=1 required');
+        }
+
        $filters = [
            'status' => trim((string) $request->query('status', '')),
            'billing_cycle' => trim((string) $request->query('billing_cycle', '')),