53 lines
1.6 KiB
PHP
53 lines
1.6 KiB
PHP
<?php
|
||
|
||
namespace Tests\Feature;
|
||
|
||
use Illuminate\Foundation\Testing\RefreshDatabase;
|
||
use Tests\TestCase;
|
||
|
||
class AdminPlatformOrderCreateBackValidationTest extends TestCase
|
||
{
|
||
use RefreshDatabase;
|
||
|
||
protected function loginAsPlatformAdmin(): void
|
||
{
|
||
$this->seed();
|
||
|
||
$this->post('/admin/login', [
|
||
'email' => 'platform.admin@demo.local',
|
||
'password' => 'Platform@123456',
|
||
])->assertRedirect('/admin');
|
||
}
|
||
|
||
public function test_create_should_not_echo_back_hidden_input_when_back_contains_quotes_or_brackets(): void
|
||
{
|
||
$this->loginAsPlatformAdmin();
|
||
|
||
$unsafeBack = '/admin/site-subscriptions?keyword="x"&a=<b>';
|
||
|
||
$res = $this->get('/admin/platform-orders/create?back=' . urlencode($unsafeBack));
|
||
$res->assertOk();
|
||
|
||
// back 被清洗为空：不应回显 hidden back input，也不应出现 unsafeBack
|
||
$res->assertDontSee('name="back"', false);
|
||
$res->assertDontSee($unsafeBack, false);
|
||
|
||
// 返回按钮应回退到默认列表
|
||
$res->assertSee('href="/admin/platform-orders"', false);
|
||
}
|
||
|
||
public function test_create_should_not_echo_back_when_back_contains_nested_back_param(): void
|
||
{
|
||
$this->loginAsPlatformAdmin();
|
||
|
||
$nestedBack = '/admin/site-subscriptions?status=activated&back=/admin/platform-orders';
|
||
|
||
$res = $this->get('/admin/platform-orders/create?back=' . urlencode($nestedBack));
|
||
$res->assertOk();
|
||
|
||
$res->assertDontSee('name="back"', false);
|
||
$res->assertDontSee($nestedBack, false);
|
||
$res->assertSee('href="/admin/platform-orders"', false);
|
||
}
|
||
}
|