优化

js/ticket-index.js

@@ -5,6 +5,11 @@ const SUPABASE_URL = 'https://chixssrphfgxvqqigkzo.supabase.co';
         let html5QrCode = null;
 
         document.getElementById('startScanBtn').addEventListener('click', async () => {
+            if (typeof Html5Qrcode === 'undefined') {
+                alert("扫码组件加载失败，请刷新页面后重试。");
+                return;
+            }
+
             document.getElementById('scanner-overlay').style.display = 'flex';
             if (html5QrCode) {
                 try {
@@ -34,6 +39,20 @@ const SUPABASE_URL = 'https://chixssrphfgxvqqigkzo.supabase.co';
 
         document.getElementById('stopScanBtn').addEventListener('click', closeScanner);
 
+        function escapeHtml(value) {
+            return String(value ?? '').replace(/[&<>"']/g, char => ({
+                '&': '&amp;',
+                '<': '&lt;',
+                '>': '&gt;',
+                '"': '&quot;',
+                "'": '&#39;'
+            }[char]));
+        }
+
+        function encodeUrlParam(value) {
+            return encodeURIComponent(String(value ?? ''));
+        }
+
         async function handleSearch() {
             const searchTerm = document.getElementById('searchTerm').value.trim();
             const dateFrom = document.getElementById('dateFrom').value;
@@ -55,7 +74,7 @@ const SUPABASE_URL = 'https://chixssrphfgxvqqigkzo.supabase.co';
 
                 displayResults(data);
             } catch (error) {
-                resultsDiv.innerHTML = `<div class="error-state">查询失败：${error.message}</div>`;
+                resultsDiv.innerHTML = `<div class="error-state">查询失败：${escapeHtml(error.message)}</div>`;
             }
         }
 
@@ -87,22 +106,22 @@ const SUPABASE_URL = 'https://chixssrphfgxvqqigkzo.supabase.co';
                 const amount = (ticket.amount || 0).toLocaleString('zh-CN', { style: 'currency', currency: 'CNY' });
                 const reason = ticket.reason || '';
                 const displayReason = reason.length > 18
-                    ? `<span class="text-truncate" title="${reason}">${reason}</span>`
-                    : reason;
+                    ? `<span class="text-truncate" title="${escapeHtml(reason)}">${escapeHtml(reason)}</span>`
+                    : escapeHtml(reason);
 
                 html += `
                     <tr>
-                        <td class="table-highlight">${ticket.ticket_number || ''}</td>
-                        <td>${ticket.customer_name || ''}</td>
+                        <td class="table-highlight">${escapeHtml(ticket.ticket_number || '')}</td>
+                        <td>${escapeHtml(ticket.customer_name || '')}</td>
                         <td>${displayReason}</td>
                         <td class="table-highlight">${amount}</td>
-                        <td>${ticket.created_at ? new Date(ticket.created_at).toLocaleDateString('zh-CN') : '-'}</td>
+                        <td>${escapeHtml(ticket.created_at ? new Date(ticket.created_at).toLocaleDateString('zh-CN') : '-')}</td>
                         <td>
                             <span class="status-pill ${ticket.processed ? 'done' : 'pending'}">
                                 ${ticket.processed ? '已处理' : '未处理'}
                             </span>
                         </td>
-                        <td><button class="tech-link-button secondary" type="button" onclick="location.href='detail.html?id=${ticket.id}'">查看详情</button></td>
+                        <td><a class="tech-link-button secondary" href="detail.html?id=${encodeUrlParam(ticket.id)}">查看详情</a></td>
                     </tr>
                 `;
             });