feat: site subscriptions export require download=1 safety valve

2026-03-13 22:52:55 +00:00
parent 1f832477c0
commit f37ff15e0d
4 changed files with 40 additions and 1 deletions
--- a/app/Http/Controllers/Admin/SiteSubscriptionController.php
+++ b/app/Http/Controllers/Admin/SiteSubscriptionController.php
@@ -211,6 +211,11 @@ class SiteSubscriptionController extends Controller
    {
        $this->ensurePlatformAdmin($request);

+        // 安全阀：必须显式声明 download=1，避免浏览器预取/误触发导致频繁导出
+        if ((string) $request->query('download', '') !== '1') {
+            abort(400, 'download=1 required');
+        }
+
        $filters = [
            'status' => trim((string) $request->query('status', '')),
            'keyword' => trim((string) $request->query('keyword', '')),