feat(ui): 登录起全链路页面接通 + 逐页面验证(47 项)+ 修复订单列表越权泄漏
前端: - utils/request.js 统一请求层(token/错误码/401 引导登录) - utils/api.js 接口清单(与后端控制器一一对应) - pages/login 登录(手机号+验证码+角色选择) - pages/service/list|detail 服务列表/详情 - pages/order/create 下单(地址/预约/急单/费用试算/自动支付) - pages/order/list|detail|review 订单列表/详情轨迹/评价 - pages/master/apply|hall|orders 师傅入驻/订单大厅/接单履约 - YJYF/YJYF 首页接 home/index 真实类目 + 路由跳转 后端 Bug 修复(严重): - TP5 中 count() 会重置查询条件,导致 Order::index / Master::hall / Master::orders 在 select 时丢失 where 条件 → 泄漏全部用户订单/跨用户数据 - 改为闭包重建查询,已验证修复
这个提交包含在:
@@ -160,19 +160,23 @@ class Order extends Base
|
||||
$page = max(1, (int)$this->request->param('page', 1));
|
||||
$limit = min(50, max(1, (int)$this->request->param('limit', 10)));
|
||||
|
||||
$query = Db::name('order')->where('user_id', $this->uid());
|
||||
if ($status === 'active') {
|
||||
$query->where('status', 'in', OrderStatus::activeValues());
|
||||
} elseif ($status === 'completed') {
|
||||
$query->where('status', OrderStatus::COMPLETED);
|
||||
} elseif ($status === 'cancelled') {
|
||||
$query->where('status', OrderStatus::CANCELLED);
|
||||
} elseif ($status !== 'all' && $status !== '') {
|
||||
$query->where('status', (int)$status);
|
||||
}
|
||||
// 注意:TP5 中 count() 执行后查询条件会被重置,必须重新构建查询
|
||||
$build = function () use ($status) {
|
||||
$q = Db::name('order')->where('user_id', $this->uid());
|
||||
if ($status === 'active') {
|
||||
$q->where('status', 'in', OrderStatus::activeValues());
|
||||
} elseif ($status === 'completed') {
|
||||
$q->where('status', OrderStatus::COMPLETED);
|
||||
} elseif ($status === 'cancelled') {
|
||||
$q->where('status', OrderStatus::CANCELLED);
|
||||
} elseif ($status !== 'all' && $status !== '') {
|
||||
$q->where('status', (int)$status);
|
||||
}
|
||||
return $q;
|
||||
};
|
||||
|
||||
$total = $query->count();
|
||||
$list = $query->order('id desc')->page($page, $limit)->select();
|
||||
$total = $build()->count();
|
||||
$list = $build()->order('id desc')->page($page, $limit)->select();
|
||||
foreach ($list as &$row) {
|
||||
$row = $this->formatOrder($row);
|
||||
}
|
||||
|
||||
在新工单中引用
屏蔽一个用户