信函更新

2000s/js/xinhan-index.js

@@ -2,7 +2,19 @@ const SUPABASE_URL = 'https://chixssrphfgxvqqigkzo.supabase.co';
         const SUPABASE_ANON_KEY = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImNoaXhzc3JwaGZneHZxcWlna3pvIiwicm9sZSI6ImFub24iLCJpYXQiOjE3NzQ2OTE0OTEsImV4cCI6MjA5MDI2NzQ5MX0.Az_Ew2J2zdOMcSV0UNAjBS-LPqGpqhsaN4IyZ5R7iqU';
         const sb = supabase.createClient(SUPABASE_URL, SUPABASE_ANON_KEY);
 
+        function escapeHtml(value) {
+            return String(value ?? '').replace(/[&<>"']/g, char => ({
+                '&': '&amp;',
+                '<': '&lt;',
+                '>': '&gt;',
+                '"': '&quot;',
+                "'": '&#39;'
+            }[char]));
+        }
+
         async function handleSearch() {
+            const selfNumberTerm = document.getElementById('selfNumberTerm').value.trim();
+            const trackingNumberTerm = document.getElementById('trackingNumberTerm').value.trim();
             const recipientTerm = document.getElementById('recipientTerm').value.trim();
             const contentTerm = document.getElementById('searchTerm').value.trim();
             const from = document.getElementById('dateFrom').value;
@@ -12,6 +24,8 @@ const SUPABASE_URL = 'https://chixssrphfgxvqqigkzo.supabase.co';
             out.innerHTML = '<div class="loading-state">正在连接信函数据库并执行检索...</div>';
 
             let q = sb.from('xinhan').select('*');
+            if (selfNumberTerm) q = q.ilike('self_number', `%${selfNumberTerm}%`);
+            if (trackingNumberTerm) q = q.ilike('tracking_number', `%${trackingNumberTerm}%`);
             if (recipientTerm) q = q.ilike('recipient', `%${recipientTerm}%`);
             if (contentTerm) q = q.ilike('content', `%${contentTerm}%`);
             if (from) q = q.gte('sent_date', from);
@@ -19,7 +33,7 @@ const SUPABASE_URL = 'https://chixssrphfgxvqqigkzo.supabase.co';
 
             const { data, error } = await q.order('sent_date', { ascending: false });
             if (error) {
-                out.innerHTML = `<div class="error-state">查询失败：${error.message}</div>`;
+                out.innerHTML = `<div class="error-state">查询失败：${escapeHtml(error.message)}</div>`;
                 return;
             }
             renderResults(data || []);
@@ -38,6 +52,8 @@ const SUPABASE_URL = 'https://chixssrphfgxvqqigkzo.supabase.co';
                         <thead>
                             <tr>
                                 <th>ID</th>
+                                <th>自编号</th>
+                                <th>快递号</th>
                                 <th>收件人</th>
                                 <th>目的地</th>
                                 <th>寄出日期</th>
@@ -51,16 +67,18 @@ const SUPABASE_URL = 'https://chixssrphfgxvqqigkzo.supabase.co';
             rows.forEach(row => {
                 const content = row.content || '';
                 const summary = content.length > 60
-                    ? `<span class="text-truncate" title="${content}">${content}</span>`
-                    : content;
+                    ? `<span class="text-truncate" title="${escapeHtml(content)}">${escapeHtml(content)}</span>`
+                    : escapeHtml(content);
 
                 html += `
                     <tr>
-                        <td class="table-highlight">${row.id}</td>
-                        <td>${row.recipient || ''}</td>
-                        <td>${row.destination || ''}</td>
-                        <td>${row.sent_date || ''}</td>
-                        <td>${row.arrival_date || ''}</td>
+                        <td class="table-highlight">${escapeHtml(row.id)}</td>
+                        <td class="table-highlight">${escapeHtml(row.self_number || '')}</td>
+                        <td>${escapeHtml(row.tracking_number || '')}</td>
+                        <td>${escapeHtml(row.recipient || '')}</td>
+                        <td>${escapeHtml(row.destination || '')}</td>
+                        <td>${escapeHtml(row.sent_date || '')}</td>
+                        <td>${escapeHtml(row.arrival_date || '')}</td>
                         <td>${summary}</td>
                     </tr>
                 `;
@@ -71,3 +89,18 @@ const SUPABASE_URL = 'https://chixssrphfgxvqqigkzo.supabase.co';
         }
 
         document.getElementById('searchBtn').addEventListener('click', handleSearch);
+
+        function applyQueryParams() {
+            const params = new URLSearchParams(window.location.search);
+            const selfNumber =
+                params.get('q') ||
+                params.get('self_number') ||
+                params.get('selfNumber');
+
+            if (!selfNumber) return;
+
+            document.getElementById('selfNumberTerm').value = selfNumber.trim();
+            handleSearch();
+        }
+
+        applyQueryParams();