feat(ui): 登录起全链路页面接通 + 逐页面验证(47 项)+ 修复订单列表越权泄漏

前端:
- utils/request.js 统一请求层(token/错误码/401 引导登录)
- utils/api.js 接口清单(与后端控制器一一对应)
- pages/login 登录(手机号+验证码+角色选择)
- pages/service/list|detail 服务列表/详情
- pages/order/create 下单(地址/预约/急单/费用试算/自动支付)
- pages/order/list|detail|review 订单列表/详情轨迹/评价
- pages/master/apply|hall|orders 师傅入驻/订单大厅/接单履约
- YJYF/YJYF 首页接 home/index 真实类目 + 路由跳转

后端 Bug 修复(严重):
- TP5 中 count() 会重置查询条件,导致 Order::index / Master::hall / Master::orders
  在 select 时丢失 where 条件 → 泄漏全部用户订单/跨用户数据
- 改为闭包重建查询,已验证修复
这个提交包含在:
linda
2026-10-28 15:52:39 +08:00
父节点 376ce7b5c9
当前提交 78722b3912
共有 17 个文件被更改,包括 1926 次插入 和 50 次删除

查看文件

@@ -155,13 +155,17 @@ class Master extends Base
$page = max(1, (int)$this->request->param('page', 1));
$limit = min(30, max(1, (int)$this->request->param('limit', 10)));
$query = Db::name('order')->where('status', OrderStatus::PENDING_ACCEPT)->where('master_id', 0);
if (!empty($catIds)) {
$query->where('cat_id', 'in', $catIds);
}
// TP5 中 count() 会重置查询条件,故用闭包重建
$build = function () use ($catIds) {
$q = Db::name('order')->where('status', OrderStatus::PENDING_ACCEPT)->where('master_id', 0);
if (!empty($catIds)) {
$q->where('cat_id', 'in', $catIds);
}
return $q;
};
$total = $query->count();
$list = $query->order('urgent desc, id desc')->page($page, $limit)->select();
$total = $build()->count();
$list = $build()->order('urgent desc, id desc')->page($page, $limit)->select();
foreach ($list as &$row) {
$row['appoint_text'] = $row['appoint_time'] ? date('m-d H:i', (int)$row['appoint_time']) : '尽快上门';
@@ -340,17 +344,21 @@ class Master extends Base
$page = max(1, (int)$this->request->param('page', 1));
$limit = min(30, max(1, (int)$this->request->param('limit', 10)));
$query = Db::name('order')->where('master_id', $master['id']);
if ($status === 'active') {
$query->where('status', 'in', [OrderStatus::ACCEPTED, OrderStatus::SCHEDULED, OrderStatus::ARRIVED, OrderStatus::WORKING]);
} elseif ($status === 'verify') {
$query->where('status', OrderStatus::PENDING_VERIFY);
} elseif ($status === 'completed') {
$query->where('status', OrderStatus::COMPLETED);
}
// TP5 中 count() 会重置查询条件,故用闭包重建
$build = function () use ($master, $status) {
$q = Db::name('order')->where('master_id', $master['id']);
if ($status === 'active') {
$q->where('status', 'in', [OrderStatus::ACCEPTED, OrderStatus::SCHEDULED, OrderStatus::ARRIVED, OrderStatus::WORKING]);
} elseif ($status === 'verify') {
$q->where('status', OrderStatus::PENDING_VERIFY);
} elseif ($status === 'completed') {
$q->where('status', OrderStatus::COMPLETED);
}
return $q;
};
$total = $query->count();
$list = $query->order('id desc')->page($page, $limit)->select();
$total = $build()->count();
$list = $build()->order('id desc')->page($page, $limit)->select();
foreach ($list as &$row) {
$row['status_text'] = OrderStatus::label($row['status']);
$row['pay_amount'] = (float)$row['pay_amount'];