sileya-ai
/
vr-shopxo-plugin
1
0
Fork 0
Code Issues 3 Pull Requests Packages Projects Releases Wiki Activity
vr-shopxo-plugin/plan.md

51 lines
1.9 KiB
Markdown
Raw Normal View History

council(draft): BackendArchitect - create plan for ghost spec investigation Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-20 10:47:38 +00:00
# Plan — 调研「场馆删除后编辑商品出现规格重复错误」问题
council(draft): SecurityEngineer - create plan.md with Phase 2 security research directions Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-15 05:53:39 +00:00
council(draft): BackendArchitect - create debug plan for "Undefined array key 'id'" error Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-20 01:46:29 +00:00
> 版本：v1.0 | 日期：2026-04-20 | Agent：council/BackendArchitect
council(draft): BackendArchitect - create plan for ghost spec investigation Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-20 10:47:38 +00:00
> 关联：vr_goods_config 全链路数据流追踪
council(review): SecurityEngineer - Phase 2 security audit complete + P1 Verifier.php fix Security audit findings (Task S1/S2/S3/S5 done): - Task S1: Admin auth chain verified (Base extends Common OK) - Task S2: SQL injection audit complete (no injection, P1 code bug found) - FIXED: Verifier.php:45 CONCAT column() syntax error → select()+PHP concat - Task S3: XSS/CSRF audit complete (no risk in admin context) - Task S5: IDOR audit complete (admin context acceptable) - Task S4 (audit log design): still pending Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-15 06:11:43 +00:00
council(plan): BackendArchitect - add Issue #9 architecture decision plan Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-15 11:14:44 +00:00
---
council(draft): Architect - 文档评估计划（Round 1） 评审三份文档： - docs/14_TEMPLATE_RENDER_INVESTIGATION.md - docs/PHASE2_PLAN.md - docs/DEVELOPMENT_LOG.md（第十一、十二章） Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-19 21:25:54 +00:00
## 任务概述
council(plan): BackendArchitect - add Issue #9 architecture decision plan Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-15 11:14:44 +00:00
council(draft): BackendArchitect - create plan for ghost spec investigation Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-20 10:47:38 +00:00
当票务商品的场馆模板被硬删除后，编辑商品时出现「规格不允许重复」错误。
根因：旧的幽灵 spec（来自已删除场馆的 `spec_base_id_map`）仍混入表单，提交时触发去重逻辑。
council(review): SecurityEngineer - Phase 2 security audit complete + P1 Verifier.php fix Security audit findings (Task S1/S2/S3/S5 done): - Task S1: Admin auth chain verified (Base extends Common OK) - Task S2: SQL injection audit complete (no injection, P1 code bug found) - FIXED: Verifier.php:45 CONCAT column() syntax error → select()+PHP concat - Task S3: XSS/CSRF audit complete (no risk in admin context) - Task S5: IDOR audit complete (admin context acceptable) - Task S4 (audit log design): still pending Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-15 06:11:43 +00:00
---
council(draft): SecurityEngineer - create plan.md with Phase 2 security research directions Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-15 05:53:39 +00:00
council(draft): BackendArchitect - create plan for ghost spec investigation Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-20 10:47:38 +00:00
## BackendArchitect 任务清单
council(plan): FrontendDev - Phase 2 bugfix plan: routing + encoding issues Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-16 00:11:57 +00:00
council(draft): BackendArchitect - create plan for ghost spec investigation Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-20 10:47:38 +00:00
- [ ] [Claimed: council/BackendArchitect] **Task 1**: 读取 AdminGoodsSaveHandle.php，分析 vr_goods_config 的读取和解析逻辑
- [ ] [ ] **Task 2**: 找出 spec_base_id_map 如何被转换成规格项（spec items）
- [ ] [ ] **Task 3**: 分析 SeatSkuService.php GetGoodsViewData，模板不存在时的 fallback 行为
- [ ] [ ] **Task 4**: 找出幽灵 spec 的产生环节，确认保存时是否有过滤
- [ ] [ ] **Task 5**: 商品保存时规格去重逻辑位置；vr_goods_config 中多个规格项 spec_base_id 相同时的行为
- [ ] [ ] **Task 6**: 根因分析报告（含具体文件路径和行号）+ 修复方案
fix(P0): vr_ticket Base - inherit ShopXO Common for full auth chain - Change plugin Base from standalone to extend Common - Call IsLogin() + IsPower() + FormTableInit() explicitly (avoids full ViewInit which is unnecessary for API/admin controllers) - Documents permission node format: plugins_vr_ticket-{controller}-{action} - Fixes R1 P0: bypassed auth chain (only LoginInfo, missing IsPower) - Also fixes all child controllers since they call parent::__construct() Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-15 06:00:20 +00:00
council(plan): FrontendDev - Phase 2 bugfix plan: routing + encoding issues Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-16 00:11:57 +00:00
---
council(execute): FrontendDev - Round 4: export button fix + mark Phase 2 complete - Fix P1 bug: ticket/list.html export button (GET→POST form) matching IS_AJAX_POST - Mark all plan.md tasks complete (seat templates, tickets, verifiers, verifications views) - BackendArchitect: AuditService.php (S4 design), Verifier.php CONCAT fix, Verification.php column() fix - BackendArchitect: SeatTemplate.php countSeats fix, TicketService.php transaction fix - BackendArchitect: EventListener.php audit_log table added - SecurityEngineer: S1-S5 security audit complete - [CONSENSUS: YES] all three agents vote YES Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-15 06:20:03 +00:00
council(plan): FrontendDev - Phase 2 bugfix plan: routing + encoding issues Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-16 00:11:57 +00:00
## 阶段划分
fix(P0): vr_ticket Base - inherit ShopXO Common for full auth chain - Change plugin Base from standalone to extend Common - Call IsLogin() + IsPower() + FormTableInit() explicitly (avoids full ViewInit which is unnecessary for API/admin controllers) - Documents permission node format: plugins_vr_ticket-{controller}-{action} - Fixes R1 P0: bypassed auth chain (only LoginInfo, missing IsPower) - Also fixes all child controllers since they call parent::__construct() Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-15 06:00:20 +00:00
council(draft): Architect - 文档评估计划（Round 1） 评审三份文档： - docs/14_TEMPLATE_RENDER_INVESTIGATION.md - docs/PHASE2_PLAN.md - docs/DEVELOPMENT_LOG.md（第十一、十二章） Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-19 21:25:54 +00:00
| 阶段 | 内容 |
|------|------|
council(draft): BackendArchitect - create plan for ghost spec investigation Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-20 10:47:38 +00:00
| **Draft** | Task 1-5：全链路数据流追踪 |
| **Review** | Task 6：输出调研报告至 reviews/council-ghost-spec-BackendArchitect.md |
| **Finalize** | 汇总至 reviews/council-ghost-spec-summary.md |
council(draft): BackendArchitect - add documentation review plan - Add BackendArchitect Round 1 section to plan.md - Claim 4 review tasks: 3 docs + 1 summary - Dimensions: accuracy, completeness, actionability, consistency, misleading risk Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-19 21:25:48 +00:00
---
council(draft): BackendArchitect - create debug plan for "Undefined array key 'id'" error Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-20 01:46:29 +00:00
## 关键文件（只读）
council(draft): BackendArchitect - add documentation review plan - Add BackendArchitect Round 1 section to plan.md - Claim 4 review tasks: 3 docs + 1 summary - Dimensions: accuracy, completeness, actionability, consistency, misleading risk Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-19 21:25:48 +00:00
council(draft): BackendArchitect - create plan for ghost spec investigation Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-20 10:47:38 +00:00
- `shopxo/app/plugins/vr_ticket/hook/AdminGoodsSaveHandle.php`
- `shopxo/app/plugins/vr_ticket/service/SeatSkuService.php`
- `shopxo/app/plugins/vr_ticket/view/goods/ticket_detail.html`
- `shopxo/app/plugins/vr_ticket/admin/Admin.php`
- `shopxo/app/admin/hook/AdminGoodsSave.php`
council(draft): BackendArchitect - add documentation review plan - Add BackendArchitect Round 1 section to plan.md - Claim 4 review tasks: 3 docs + 1 summary - Dimensions: accuracy, completeness, actionability, consistency, misleading risk Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-19 21:25:48 +00:00
council(security): SecurityEngineer - add missing VenueList methods + security audit Security findings: - SQL injection: LOW (query builder + parameter binding) - XSS: LOW (ThinkPHP auto-escape, no |raw detected) - Path traversal: LOW (all view paths hardcoded) - CSRF: MEDIUM (ShopXO framework-level gap, out of scope for plugin) Critical fix: admin/Admin.php was missing VenueList(), VenueSave(), VenueDelete() — sidebar URL "/plugins/vr_ticket/admin/venueList" would return 500 error. Added all three methods with v3.0 seat_map support. P1 garbled name: documented DB fix SQL for shx_plugins + vrt_power tables. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-16 00:53:41 +00:00
---
council(draft): BackendArchitect - create plan for ghost spec investigation Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-20 10:47:38 +00:00
## 执行顺序
docs(plan): 记录 P1+P2 修复已合并到 main Commit: 804d465d0 → main: 49930844f Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-20 02:00:05 +00:00
council(draft): BackendArchitect - create plan for ghost spec investigation Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-20 10:47:38 +00:00
1. Task 1 → 2 → 3：并行读取关键文件
2. Task 4 → 5：基于读取结果追踪 spec 去重逻辑
3. Task 6：输出带行号的根因分析报告