fix(stability): 支付并发事务内加锁、组合支付流水记录、省市区树形缓存与地址安全防越权 (TDD)

addons/shopro/model/UserAddress.php

@@ -86,7 +86,12 @@ class UserAddress extends Model
                 'address'       => $address
             ]);
         } else {
-            $edit = self::update([
+            // 防 IDOR 越权：更新时必须校验地址归属当前用户
+            $currentAddress = self::get(['id' => $id, 'user_id' => $user->id]);
+            if (!$currentAddress) {
+                new Exception('未找到该收货地址');
+            }
+            $edit = $currentAddress->save([
                 'consignee'     => $consignee,
                 'phone'         => $phone,
                 'province_id'   => $province->id,
@@ -98,9 +103,7 @@ class UserAddress extends Model
                 'is_default'    => $is_default,
                 'latitude'      => (isset($latitude) && $latitude) ? $latitude : null,
                 'longitude'     => (isset($longitude) && $longitude) ? $longitude : null,
-                'user_id'       => $user->id,
-                'address'       => $address,
-                'id'            => $id
+                'address'       => $address
             ]);
         }
         return $edit;
@@ -117,6 +120,10 @@ class UserAddress extends Model
     {
         $user = User::info();
         extract($params);
-        return self::get(['id' => $id, 'user_id' => $user->id])->delete();
+        $addr = self::get(['id' => $id, 'user_id' => $user->id]);
+        if (!$addr) {
+            new Exception('未找到该收货地址');
+        }
+        return $addr->delete();
     }
 }