linxianzhuang/saasshop
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

平台订单筛选表单：仅透传安全back（补测试）

Browse Source
This commit is contained in:
萝卜
2026-03-14 16:12:03 +00:00
parent 0ce233bded
commit f20b8d89cb
3 changed files with 71 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
resources/views/admin/platform_orders/index.blade.php
View File

@@ -249,6 +249,9 @@
<div class="card mb-20">
<h3>筛选条件</h3>
<form method="get" action="/admin/platform-orders" class="grid-3">
@if($safeBackForLinks !== '')
<input type="hidden" name="back" value="{!! $safeBackForLinks !!}">
@endif
<select name="status">
<option value="">全部订单状态</option>
@foreach(($filterOptions['statuses'] ?? []) as $value => $label)

35
tests/Feature/AdminPlatformOrderIndexFilterFormDropsUnsafeBackTest.php Normal file
View File

@@ -0,0 +1,35 @@
<?php
namespace Tests\Feature;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Tests\TestCase;
class AdminPlatformOrderIndexFilterFormDropsUnsafeBackTest extends TestCase
{
use RefreshDatabase;
protected function loginAsPlatformAdmin(): void
{
$this->seed();
$this->post('/admin/login', [
'email' => 'platform.admin@demo.local',
'password' => 'Platform@123456',
])->assertRedirect('/admin');
}
public function test_index_filter_form_should_drop_unsafe_back_as_hidden_input(): void
{
$this->loginAsPlatformAdmin();
// 含引号的 back：必须丢弃
$back = "/admin/platform-leads?keyword=\"on\"";
$res = $this->get('/admin/platform-orders?back=' . urlencode($back));
$res->assertOk();
$res->assertDontSee('name="back"', false);
$res->assertDontSee('value="' . $back . '"', false);
}
}

33
tests/Feature/AdminPlatformOrderIndexFilterFormKeepsSafeBackTest.php Normal file
View File

@@ -0,0 +1,33 @@
<?php
namespace Tests\Feature;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Tests\TestCase;
class AdminPlatformOrderIndexFilterFormKeepsSafeBackTest extends TestCase
{
use RefreshDatabase;
protected function loginAsPlatformAdmin(): void
{
$this->seed();
$this->post('/admin/login', [
'email' => 'platform.admin@demo.local',
'password' => 'Platform@123456',
])->assertRedirect('/admin');
}
public function test_index_filter_form_should_keep_safe_back_as_hidden_input(): void
{
$this->loginAsPlatformAdmin();
$back = '/admin/platform-leads?status=new&keyword=demo';
$res = $this->get('/admin/platform-orders?back=' . urlencode($back));
$res->assertOk();
$res->assertSee('name="back" value="' . $back . '"', false);
}
}