feat(ui): 登录起全链路页面接通 + 逐页面验证(47 项)+ 修复订单列表越权泄漏
前端: - utils/request.js 统一请求层(token/错误码/401 引导登录) - utils/api.js 接口清单(与后端控制器一一对应) - pages/login 登录(手机号+验证码+角色选择) - pages/service/list|detail 服务列表/详情 - pages/order/create 下单(地址/预约/急单/费用试算/自动支付) - pages/order/list|detail|review 订单列表/详情轨迹/评价 - pages/master/apply|hall|orders 师傅入驻/订单大厅/接单履约 - YJYF/YJYF 首页接 home/index 真实类目 + 路由跳转 后端 Bug 修复(严重): - TP5 中 count() 会重置查询条件,导致 Order::index / Master::hall / Master::orders 在 select 时丢失 where 条件 → 泄漏全部用户订单/跨用户数据 - 改为闭包重建查询,已验证修复
这个提交包含在:
@@ -155,13 +155,17 @@ class Master extends Base
|
||||
$page = max(1, (int)$this->request->param('page', 1));
|
||||
$limit = min(30, max(1, (int)$this->request->param('limit', 10)));
|
||||
|
||||
$query = Db::name('order')->where('status', OrderStatus::PENDING_ACCEPT)->where('master_id', 0);
|
||||
if (!empty($catIds)) {
|
||||
$query->where('cat_id', 'in', $catIds);
|
||||
}
|
||||
// TP5 中 count() 会重置查询条件,故用闭包重建
|
||||
$build = function () use ($catIds) {
|
||||
$q = Db::name('order')->where('status', OrderStatus::PENDING_ACCEPT)->where('master_id', 0);
|
||||
if (!empty($catIds)) {
|
||||
$q->where('cat_id', 'in', $catIds);
|
||||
}
|
||||
return $q;
|
||||
};
|
||||
|
||||
$total = $query->count();
|
||||
$list = $query->order('urgent desc, id desc')->page($page, $limit)->select();
|
||||
$total = $build()->count();
|
||||
$list = $build()->order('urgent desc, id desc')->page($page, $limit)->select();
|
||||
|
||||
foreach ($list as &$row) {
|
||||
$row['appoint_text'] = $row['appoint_time'] ? date('m-d H:i', (int)$row['appoint_time']) : '尽快上门';
|
||||
@@ -340,17 +344,21 @@ class Master extends Base
|
||||
$page = max(1, (int)$this->request->param('page', 1));
|
||||
$limit = min(30, max(1, (int)$this->request->param('limit', 10)));
|
||||
|
||||
$query = Db::name('order')->where('master_id', $master['id']);
|
||||
if ($status === 'active') {
|
||||
$query->where('status', 'in', [OrderStatus::ACCEPTED, OrderStatus::SCHEDULED, OrderStatus::ARRIVED, OrderStatus::WORKING]);
|
||||
} elseif ($status === 'verify') {
|
||||
$query->where('status', OrderStatus::PENDING_VERIFY);
|
||||
} elseif ($status === 'completed') {
|
||||
$query->where('status', OrderStatus::COMPLETED);
|
||||
}
|
||||
// TP5 中 count() 会重置查询条件,故用闭包重建
|
||||
$build = function () use ($master, $status) {
|
||||
$q = Db::name('order')->where('master_id', $master['id']);
|
||||
if ($status === 'active') {
|
||||
$q->where('status', 'in', [OrderStatus::ACCEPTED, OrderStatus::SCHEDULED, OrderStatus::ARRIVED, OrderStatus::WORKING]);
|
||||
} elseif ($status === 'verify') {
|
||||
$q->where('status', OrderStatus::PENDING_VERIFY);
|
||||
} elseif ($status === 'completed') {
|
||||
$q->where('status', OrderStatus::COMPLETED);
|
||||
}
|
||||
return $q;
|
||||
};
|
||||
|
||||
$total = $query->count();
|
||||
$list = $query->order('id desc')->page($page, $limit)->select();
|
||||
$total = $build()->count();
|
||||
$list = $build()->order('id desc')->page($page, $limit)->select();
|
||||
foreach ($list as &$row) {
|
||||
$row['status_text'] = OrderStatus::label($row['status']);
|
||||
$row['pay_amount'] = (float)$row['pay_amount'];
|
||||
|
||||
在新工单中引用
屏蔽一个用户