进行测试吧

core/CoreApp/controllers/Customer.php

@@ -1093,7 +1093,7 @@ class Customer extends Start_Controller {
 		}
     }
 	//修改客户分类
-	public function _mdedit($arg_array)
+	public function _mdedit_xxxxxbak($arg_array)
 	{
 		$user = $this->user->get_api($_SESSION['api']);
 		if($user)
@@ -1495,6 +1495,470 @@ class Customer extends Start_Controller {
 		$this->data['user'] = $u['userid'];
 		$this->_Template('customer_mdedit',$this->data);
 	}
+
+	/**
+	 * _mdeditv1 - 修复版线下单添加方法
+	 * 解决: PHP Notice/Warning 污染 JSON 响应导致前端解析失败显示"超时"的问题
+	 * 改进: ob_start 输出缓冲 + 防御性检查 + 安全预算计算 + insert 返回值检查
+	 */
+	public function _mdedit($arg_array)
+	{
+		// 开启输出缓冲，捕获任何意外的 PHP 输出（Notice/Warning/Error）
+		ob_start();
+
+		$user = $this->user->get_api($_SESSION['api']);
+		if($user)
+		{
+			$uu = $user;
+			$fgshop = "";$sid = "";
+			$u = $user;
+			$user = explode('|',trim($user['shop'],'|'));
+			foreach ($user as $value) 
+			{
+				$fgshop .= " shop = ".$value." or";
+				$sid .= " id = ".$value." or";
+			}
+		}
+		$post = $this->input->post(NULL, TRUE);
+		if(isset($post['shop']))
+		{
+			$fpcount = $this->input->post('fpcount',true);
+			if(!$fpcount)
+			{
+				ob_clean();
+				echo json_encode(array('msg'=>'需要先清理浏览器缓存，刷新当前页面后再试！','success'=>false));exit;
+			}
+			$customerid = $this->input->post('customerid',true);
+			$shop = $this->input->post('shop',true);
+			$sp = $this->shop->read($shop);
+			// 防御性检查：店铺信息读取失败
+			if(!$sp || !isset($sp['id']))
+			{
+				ob_clean();
+				echo json_encode(array('msg'=>'店铺信息不存在，请检查店铺选择！','success'=>false));exit;
+			}
+			$num = $this->fullorder->find_count('shop = "'.$sp['id'].'" and gtime = "'.date('Ymd',time()).'"');
+			$post['source'] = 1;//订单类型：1.线下订单2.PC3.手机
+			$post['state'] = 207;//订单状态：207等待发货
+			$post['review'] = 2;//审核状态：1.未送审2.待审核3.不通过4取消重审5.审核通过6.自动通过
+			$post['print'] = 1;//打印状态：1.不可打印2.未打印3.已打印
+			$post['library'] = 1;//出库状态：1.未出库2.已出库3.已退库
+			$post['libraryconfirm'] = 1;//出库确认：1.不允许2.允许
+			$post['link'] = isset($sp['link']) ? $sp['link'] : '';
+			$post['issku'] = isset($sp['sku']) ? $sp['sku'] : '';
+			if($post['print'] != 3)
+			{
+				$post['librarynot'] = "订单未打印，未审核或未通过";//不能出库原因
+			}
+			$orderinfo = $this->input->post('orderinfo',true);
+			$post['shop'] = $sp['id'];
+			$post['user'] = isset($sp['shopuser']) ? $sp['shopuser'] : '';
+			$post['number'] = (isset($sp['shortname']) ? $sp['shortname'] : '').'-'.date('ymd',time()).'-'.(substr(strval($num+1+1000),1,3));//编号 
+			if($orderinfo != "")
+			{
+				$ordefin = $this->fullorder->get_orderinfo($orderinfo);
+				if($ordefin)
+				{
+					ob_clean();
+					echo json_encode(array('msg'=>'订单号重复！','success'=>false));exit;
+				}
+				else
+				{
+					$post['orderinfo'] = $orderinfo;
+				}
+			}
+			else
+			{
+				$post['orderinfo'] = (isset($sp['id']) ? $sp['id'] : '').date('ymdHis',time()).rand(0,1);//订单号
+			}
+			if($post['paypal'] != '')
+			{
+				$pp = $this->fullorder->get_paypal($post['paypal']);	
+				if($pp)
+				{
+					ob_clean();
+					echo json_encode(array('msg'=>'此交易号的订单已存在！','success'=>false));exit;
+				}
+			}
+			$post['client'] = $this->input->post('client',true);//客户名称
+			$btime = $this->input->post('buytime',true);//付款时间
+			$post['buytime'] = strtotime($btime);//时间转UX
+			$post['dtime'] = time();//订单时间
+			$post['gtime'] = date('Ymd',time());//格式化时间
+			$post['pay'] = $this->input->post('pay',true);//支付方式
+			$post['capital'] = $this->input->post('capital',true);//资金状态
+			$post['type'] = $this->input->post('warehouse',true);//发货仓库
+			$post['currency'] = $this->input->post('currency',true);//币种
+			$currency = $this->typeclass->read($post['currency']);
+			// 防御性检查：币种信息读取失败
+			if(!$currency || !isset($currency['title']))
+			{
+				ob_clean();
+				echo json_encode(array('msg'=>'币种信息不存在，请检查币种选择！','success'=>false));exit;
+			}
+			$post['currencytitle'] = $currency['title'];//币种名称
+			$post['freight'] = $this->input->post('freight',true);//运费
+			$post['expressmoney'] = $this->input->post('expressmoney',true);//物流金额
+			$post['shouldmoney'] = $this->input->post('shouldmoney',true);//应收金额
+			$post['skje'] = $post['shouldmoney'];//收款金额
+			$product = $this->input->post('product');//产品名称
+			$product = str_replace(array('%26','%2B'),array('&','+'),$product);
+			$post['product'] = preg_replace('/( |　| |\s)/',' ',$product);
+			$orderremarks = $this->input->post('orderremarks');//订单备注
+			$orderremarks = str_replace(array('%26','%2B'),array('&','+'),$orderremarks);
+			$post['orderremarks'] = preg_replace('/( |　| |\s)/',' ',$orderremarks);
+			$shipremarks = $this->input->post('shipremarks');//仓库品名
+			$shipremarks = str_replace(array('%26','%2B'),array('&','+'),$shipremarks);//仓库品名
+			$post['shipremarks'] = preg_replace('/( |　| |\s)/',' ',$shipremarks);
+			$post['email'] = $this->input->post('email',true);//邮箱
+			$name = $this->input->post('name',true);//名称
+			$post['name'] = preg_replace('/( |　| |\s)/',' ',$name);
+			$post['phone'] = $this->input->post('phone',true);//电话
+			$post['phone'] = preg_replace('/\D/s','',$post['phone']);
+			$post['country'] = $this->input->post('country',true);//国家
+			$ct = $this->country->read($post['country']);//国家
+			// 防御性检查：国家信息读取失败
+			if(!$ct || !isset($ct['lb']))
+			{
+				ob_clean();
+				echo json_encode(array('msg'=>'国家信息不存在，请检查国家选择！','success'=>false));exit;
+			}
+			$post['al'] = $ct['lb'];//国家二字码
+			$post['province'] = $this->input->post('province',true);//省、州
+			$post['province'] = preg_replace("/^[\s\v".chr(227).chr(128)."]+/","", $post['province']); //替换开头空字符
+			$post['province'] = preg_replace("/[\s\v".chr(227).chr(128)."]+$/","", $post['province']); //替换结尾空字符
+			$post['city'] = $this->input->post('city',true);//城市
+			$post['city'] = preg_replace("/^[\s\v".chr(227).chr(128)."]+/","", $post['city']); //替换开头空字符
+			$post['city'] = preg_replace("/[\s\v".chr(227).chr(128)."]+$/","", $post['city']); //替换结尾空字符
+			$post['zipcode'] = $this->input->post('zipcode',true);//邮编
+			$post['zipcode'] = preg_replace("/^[\s\v".chr(227).chr(128)."]+/","", $post['zipcode']); //替换开头空字符
+			$post['zipcode'] = preg_replace("/[\s\v".chr(227).chr(128)."]+$/","", $post['zipcode']); //替换结尾空字符
+			$post['address'] = $this->input->post('address',true);//地址
+			$post['printtype'] = $this->input->post('printtype',true);//打印类型
+			$fpdata = $this->input->post('fpdata');//购买产品内容
+			$fpdata = str_replace(array('%26','%2B'),array('&','+'),$fpdata);
+			$post['fpdata'] = $fpdata;
+			$post['sbpm'] = $this->input->post('sbpm',true);//申报品名
+			$post['zwpm'] = $this->input->post('zwpm',true);//中文品名
+			$post['ts'] = $this->input->post('ts',true);//条数
+			$post['dtsbjz'] = $this->input->post('dtsbjz',true);//单条申报价
+			$post['zsbjz'] = $this->input->post('zsbjz',true);//总申报价
+			$post['zzl'] = $this->input->post('zzl',true);//总重量
+			$post['zjs'] = $this->input->post('zjs',true);//总件数
+			$post['express'] = $this->input->post('express',true);//快递公司
+			$post['printtype'] = $this->input->post('printtype',true);//打印类型
+			$post['quantity'] = $this->input->post('quantity',true);//数量
+			$post['paypal'] = $this->input->post('paypal',true);//支付号
+			$post['guarantee'] = $this->input->post('guarantee',true);//卖家保障
+			$post['msg'] = $this->input->post('msg',true);//发送留言类型
+			$post['ioss'] = $this->input->post('ioss',true);
+			$post['sbpm'] = $this->input->post('sbpm',true);
+			$pay = $this->pay->get_typeclass($post['pay']);
+			$yga = $post['shouldmoney'];
+			$post['budget'] = 0;
+			// 使用安全方法替代 eval()，避免公式字符串异常导致 Parse Error 污染 JSON
+			if($pay)
+			{
+				$ygc = isset($pay['estimaterate']) ? $pay['estimaterate'] : '';
+				$ifbudget = $this->_safeCalcBudget($yga, $ygc);
+				$post['estimaterate'] = isset($pay['estimaterate']) ? $pay['estimaterate'] : '';
+				if($ifbudget > 0)
+				{
+					$post['budget'] = $ifbudget;//预估到帐金额
+				}
+			}
+			else
+			{
+				$ygb = isset($sp['estimaterate']) ? $sp['estimaterate'] : '';//店铺默认到账公式
+				$ifbudget = $this->_safeCalcBudget($yga, $ygb);
+				$post['estimaterate'] = isset($sp['estimaterate']) ? $sp['estimaterate'] : '';
+				if($ifbudget > 0)
+				{
+					$post['budget'] = $ifbudget;//预估到帐金额
+				}
+			}
+			$baddress = $this->input->post('baddress',true);
+			$saddress = $this->input->post('saddress',true);
+			$baddress = array_reverse(explode(',',$baddress));
+			$saddress = array_reverse(explode(',',$saddress));
+			$bar = '';$sar = '';
+			$cr = $this->country->read($post['country']);
+			if($cr && isset($cr['lb']))
+			{
+				$baddress[1] = $cr['lb'];
+				$saddress[1] = $cr['lb'];
+			}
+			$baddress = array_reverse($baddress);
+			$saddress = array_reverse($saddress);
+			for($i=0;$i<count($baddress);$i++)
+			{
+				$bar .= $baddress[$i].',';
+			}
+			for($i=0;$i<count($saddress);$i++)
+			{
+				$sar .= $saddress[$i].',';
+			}
+			$post['baddress'] = rtrim($bar,',');//卖家保障
+			$post['saddress'] = rtrim($sar,',');//卖家保障
+			$whlabel = $this->input->post('whlabel',true);
+			if($post['express'] == 2 && (stripos($post['name'],'&') !== false || stripos($post['name'],"'") !== false))
+			{
+				ob_clean();
+				echo json_encode(array('msg'=>'USPS收件人或公司名不可用特殊符号！','success'=>false));exit;
+			}
+			if(strlen($post['client']) > 35 || strlen($post['name']) > 35)//收件人姓名或公司名不允许超过35位
+			{
+				ob_clean();
+				echo json_encode(array('msg'=>'收件人姓名或公司名不可超过35个字符！','success'=>false));exit;
+			}
+			if(($post['express'] == '5' || $post['express'] == '24' || $post['express'] == '42' || $post['express'] == '31') && $post['country'] != 192)
+			{
+				ob_clean();
+				echo json_encode(array('msg'=>'非美国无法选择Fedex、DHL官方-美国！','success'=>false));exit;
+			}
+			if($post['express'] == '3' && $post['country'] != 192 && $post['country'] != 35)
+			{
+				ob_clean();
+				echo json_encode(array('msg'=>'非美国和加拿大无法选择UPS！','success'=>false));exit;
+			}
+			if($post['express'] == '3' && $post['country'] == 35 && $post['zsbjz'] > 20)
+			{
+				ob_clean();
+				echo json_encode(array('msg'=>'UPS加拿大最高申报不可超过20','success'=>false));exit;
+			}
+			if($post['express'] == '2' && $post['warehouse'] != 5)
+			{
+				ob_clean();
+				echo json_encode(array('msg'=>'非美国仓无法选择USPS！','success'=>false));exit;
+			}
+			if($post['express'] == '99' && isset($post['bx']) && $post['bx'] > 0)
+			{
+				ob_clean();
+				echo json_encode(array('msg'=>'此物流不允许购买保险','success'=>false));exit;
+			}
+			if($post['express'] == 42 && $post['sbpm'] != 'Human Hair Wigs' && $post['sbpm'] != 'Human Hair Goods')
+			{
+				ob_clean();
+				echo json_encode(array('msg'=>'此快递方式必须选择Human Hair Wigs/Human Hair Goods！','success'=>false));exit;
+			}
+			if($post['country'] != 192 && $post['express'] == 1 && $post['sbpm'] != 'Synthetic Hair Wigs' && $post['sbpm'] != 'Synthetic Hair Goods')
+			{
+				ob_clean();
+				echo json_encode(array('msg'=>'非美国选择官方DHL必须选择Synthetic Hair Wigs/Synthetic Hair Goods','success'=>false));exit;
+			}
+			if($post['pay'] == '22' && ($post['paypal'] == '' || $post['guarantee'] == ''))
+			{
+				ob_clean();
+				echo json_encode(array('msg'=>'交易号和卖家保障必须填写','success'=>false));exit;
+			}
+			if($post['pay'] == '23' && $post['paypal'] == '')
+			{
+				ob_clean();
+				echo json_encode(array('msg'=>'交易号必须填写','success'=>false));exit;
+			}
+			if(empty($post['paypal'])){
+				ob_clean();
+				echo json_encode(array('msg'=>'交易号必须填写','success'=>false));exit;
+			}
+			$express = $this->express->read($post['express']);
+			// 防御性检查：快递公司信息读取失败
+			if(!$express)
+			{
+				ob_clean();
+				echo json_encode(array('msg'=>'快递公司信息不存在，请重新选择！','success'=>false));exit;
+			}
+			if($post['zsbjz'] > $express['sbjz'])
+			{
+				ob_clean();
+				echo json_encode(array('msg'=>'总申报价值不可超出'.$express['sbjz'],'success'=>false));exit;
+			}
+			if($post['shouldmoney'] > $express['shouldmoney'] && $express['shouldmoney'] != 0)
+			{
+				ob_clean();
+				echo json_encode(array('msg'=>'订单金额不可超出'.$express['shouldmoney'],'success'=>false));exit;
+			}
+			if($express['ioss'] == 1 && $post['ioss'] == '')
+			{
+				ob_clean();
+				echo json_encode(array('msg'=>'此快递方式必须选择IOSS！','success'=>false));exit;
+			}
+			if(strlen($post['address']) > $express['addresssize'] || (isset($post['address2']) && strlen($post['address2']) > $express['addresssize']))
+			{
+				ob_clean();
+				echo json_encode(array('msg'=>'此快递方地址不可超出'.$express['addresssize'].'个字符','success'=>false));exit;
+			}
+			if(strlen($post['address']) < 5)
+			{
+				ob_clean();
+				echo json_encode(array('msg'=>'地址不可留空！','success'=>false));exit;
+			}
+			if($post['express'] == '2' && $post['zzl'] > '16' && isset($post['js']) && $post['js'] == '0')
+			{
+				ob_clean();
+				echo json_encode(array('msg'=>'重量大于16不可按Ground Advantage提交！','success'=>false));exit;
+			}
+			if($post['express'] == '2' && isset($post['js']) && $post['js'] == '0' && isset($post['qm']) && $post['qm'] == '1')
+			{
+				ob_clean();
+				echo json_encode(array('msg'=>'Ground Advantage不可使用签名服务！','success'=>false));exit;
+			}
+			if(($post['express'] == '3' || $post['express'] == '42' || $post['express'] == '24') && $post['shouldmoney'] < 1)
+			{
+				ob_clean();
+				echo json_encode(array('msg'=>'零金额订单不可发 UPS/DHL官方-美国/Fedex(杭州)','success'=>false));exit;
+			}
+			if($post['express'] == '42' && $post['zsbjz'] < 1)
+			{
+				ob_clean();
+				echo json_encode(array('msg'=>'零申报金额不可发 DHL官方-美国','success'=>false));exit;
+			}
+			if($post['express'] == '6' && $post['province'] == '')
+			{
+				ob_clean();
+				echo json_encode(array('msg'=>'选择DPEX必须填写州信息','success'=>false));exit;
+			}
+
+			//仅独立站 地址美国对电话 10或者11位进行判断
+			if($post['country'] == 192){
+				if((strlen($post['phone'])!= 10) && (strlen($post['phone'])!= 11)){
+					ob_clean();
+					echo json_encode(array('msg'=>'美国电话号码应为10/11位！','success'=>false));exit;
+				}
+			}
+
+			//减少代码复用吧
+			$lo_ret = $this->logic_order->checkEditCustomer($post);
+			if($lo_ret['code'] != 1){
+				ob_clean();
+				echo json_encode(array('msg'=>$lo_ret['msg'],'success'=>false));exit;
+			}
+
+			$dtctitle = array();
+			$dictionaries = $this->typeclass->find_all();
+			foreach ($dictionaries as $v)
+			{
+				$dtctitle[$v['id']] = array($v['title'],$v['bqsku']);
+			}
+			$fpdata = $post['fpdata'];
+			if(stripos($fpdata,'-128-') !== false || stripos($fpdata,'-127-') !== false)
+			{
+				$dfp =  explode(';',trim($fpdata,';'));
+				$fdata = '';
+				foreach ($dfp as $k=>$v)
+				{
+					$ptitleb = '';
+					$fp = explode('|',trim($v,'|'));
+					$fp0 = explode(',',$fp[0]);
+					if(isset($fp0[1]))
+					{
+						$fp1 = explode('-',trim($fp0[1],'-'));
+					}
+					else
+					{
+						$fp1 = explode('-',trim($fp[0],'-'));
+					}
+					foreach ($fp1 as $vv)
+					{
+						$ptitleb .= isset($dtctitle[$vv])?$dtctitle[$vv][0].' ':'';
+					}
+					if(isset($fp0[1]))
+					{
+						$ptitleb .= $dtctitle[$fp0[0]][1].'inch ';
+						$fp[1] = $ptitleb;
+					}
+					$fdata .= implode("|",$fp).";";
+				}
+				$fpdata = $fdata;
+			}
+			
+			$warehouse = $this->warehouse->read($post['type']);
+			// 防御性检查：仓库信息读取失败
+			if(!$warehouse)
+			{
+				ob_clean();
+				echo json_encode(array('msg'=>'仓库信息不存在，请重新选择！','success'=>false));exit;
+			}
+			if($warehouse['bdcountry'] != 0 && $post['country'] != $warehouse['bdcountry'])
+			{
+				ob_clean();
+				echo json_encode(array('msg'=>'当前国家无法选择'.$warehouse['title'].'！','success'=>false));exit;
+			}
+			$kcyz = $this->ck->get_kc($post['state'],$warehouse,$post['shop'],$post['number'],$whlabel,$fpdata);
+			if($kcyz['t'] > '0')
+			{
+				// get_kc 内部已经输出 JSON，直接退出
+				ob_end_flush();
+				echo $kcyz['m'];exit;
+			}
+			else if($kcyz['fpdata'] != '')
+			{
+				$post['whlabel'] = $kcyz['whlabel'];
+				$post['fpdata'] = $kcyz['fpdata'];
+			}
+			$fl = $this->ck->get_fl($warehouse['hz'],$whlabel,$fpdata);
+			$post['sfxh'] = isset($fl['sfxh']) ? $fl['sfxh'] : '';
+			$post['ckfl'] = isset($fl['ckfl']) ? $fl['ckfl'] : '';
+			
+			//查询净重开始
+			$post['jweight'] = $this->weight->get_weightcx($post['fpdata']);
+			//查询净重结束
+
+			$cusnum = $this->customer->read($customerid);
+			if($cusnum)
+			{
+				$this->customer->save(array('num'=>$cusnum['num']+1,'time'=>$post['buytime']),$customerid);
+			}
+			unset($post['id']);
+			// insert 操作并检查返回值
+			$insertResult = $this->fullorder->insert($post);
+			if(!$insertResult)
+			{
+				// 数据库写入失败，清理缓冲后返回明确错误
+				$dbError = $this->db->error();
+				ob_clean();
+				echo json_encode(array('msg'=>'下单失败，数据库写入错误，请重试！','success'=>false));exit;
+			}
+			// 成功：清理缓冲，确保只输出纯净 JSON
+			ob_end_clean();
+			echo json_encode(array('msg'=>'下单成功','success'=>true));exit;	
+		}
+		// ========== 以下为模板渲染（非 POST 请求） ==========
+		$arg_array = $arg_array[0];//用户ID
+		$customer = $this->customer->read($arg_array);//用户信息
+		$this->data['customer'] = $customer;
+		$country = $this->country->find_all('1=1','id,name','name asc');//国家
+		$this->data['country'] = $country;
+		$express = $this->express->find_all();//物流商
+		$this->data['express'] = $express;
+		$bm = $this->country->read($customer['country']);
+		$this->data['bm'] = $bm;
+		$wlshop = $this->shop->find_all('1=1 and '.rtrim($sid,'or'));
+		$this->data['wlshop'] = $wlshop;
+		$this->data['user'] = $u['userid'];
+		// 恢复输出缓冲，正常渲染模板
+		ob_end_flush();
+		$this->_Template('customer_mdedit',$this->data);
+	}
+
+	/**
+	 * 安全预算计算 - 替代危险的 eval()
+	 * 只允许数字、小数点、加减乘除、括号，防止非法公式导致 Parse Error
+	 */
+	private function _safeCalcBudget($amount, $formula)
+	{
+		if (empty($formula) || !is_numeric($amount)) {
+			return 0;
+		}
+		$formula = trim($formula);
+		// 只允许安全的数学表达式字符
+		if (!preg_match('/^[0-9\.\+\-\*\/\(\)]+$/', $formula)) {
+			return 0;
+		}
+		$expression = "return {$amount}*1.{$formula};";
+		$result = @eval($expression);
+		return ($result !== false) ? $result : 0;
+	}
+
 	//上传excel
 	public function _excela()
 	{