From 4debbf40844883c6c2dbd79b96655616348ac836 Mon Sep 17 00:00:00 2001
From: Shine <shine@channelwill.cn>
Date: Tue, 20 Oct 2026 16:21:26 +0800
Subject: [PATCH 1/2] =?UTF-8?q?fix:=20=E4=BF=AE=E5=A4=8D=E6=9D=83=E9=99=90?=
 =?UTF-8?q?/=E8=A7=92=E8=89=B2=E8=A1=A8=E5=8D=95=E8=8F=9C=E5=8D=95?=
 =?UTF-8?q?=E6=A0=91=E4=B8=8D=E6=B8=B2=E6=9F=93=E5=8F=8A=20flushMenuCache?=
 =?UTF-8?q?=20=E6=9C=AA=E5=AE=9A=E4=B9=89=E9=94=99=E8=AF=AF=20(#30)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

问题 1：multipleselect 模板新增的脚本使用 `$('.{{$selector}}')`，而 `$selector`
本身已是 `#form-id .field_xxx`，拼接后变为 `$('.#form-id .field_xxx')`，jQuery 抛出
选择器语法错误，导致同一批合并执行的脚本中断，其后的 tags、tree 等字段全部未初始化
（表现为“菜单”树为空、HTTP 路径显示为原生多选框）。

- 移除该独立脚本，将“有选中值时禁用占位隐藏 input”的逻辑并入 select-script 的
  Dcat.init 回调（通过 `multiple` 参数开启），按 name 查找兄弟隐藏 input，
  不再使用 `?.`，并避免 `off('change.select2')` 误删 select2 内部监听。
- 同一选择器不能重复 Dcat.init，否则会被 `initialized` 标记跳过，故不能单独注册。

问题 2：Form 的 saved 回调会被 `bindTo($model)` 重新绑定到模型实例，
回调内 `$this->flushMenuCache()` 实际调用的是 Permission/Role 模型上的方法，
抛出 `Call to undefined method ...::flushMenuCache()`。

- HasMenuTreeField 改为提供 `flushMenuCacheOnSaved(Form $form)`，回调内不依赖 `$this`。
- PermissionController、RoleController 统一改用该方法注册。
---
 resources/views/form/multipleselect.blade.php |  8 +-------
 resources/views/form/select-script.blade.php  | 17 +++++++++++++++++
 src/Http/Controllers/HasMenuTreeField.php     | 12 +++++++++---
 src/Http/Controllers/PermissionController.php |  8 +++++---
 src/Http/Controllers/RoleController.php       |  8 +++++---
 5 files changed, 37 insertions(+), 16 deletions(-)

diff --git a/resources/views/form/multipleselect.blade.php b/resources/views/form/multipleselect.blade.php
index c6ed2e195..8e6683173 100755
--- a/resources/views/form/multipleselect.blade.php
+++ b/resources/views/form/multipleselect.blade.php
@@ -20,10 +20,4 @@
     </div>
 </div>
 
-@include('admin::form.select-script')
-
-<script>
-$('.{{$selector}}').off('change.select2').on('change.select2', function () {
-    $(this).closest('.field').find('input[type="hidden"][name="{{$name}}[]"]').prop('disabled', $(this).val()?.length > 0);
-});
-</script>
+@include('admin::form.select-script', ['multiple' => true])
diff --git a/resources/views/form/select-script.blade.php b/resources/views/form/select-script.blade.php
index 8e1ab33b3..085f40343 100644
--- a/resources/views/form/select-script.blade.php
+++ b/resources/views/form/select-script.blade.php
@@ -4,6 +4,23 @@
 <script require="@select2?lang={{ config('app.locale') === 'en' ? '' : str_replace('_', '-', config('app.locale')) }}" init="{!! $selector !!}">
     var configs = {!! admin_javascript_json($configs) !!};
 
+    @if(! empty($multiple))
+    // 多选：有选中值时禁用占位的隐藏 input，避免额外提交空值。
+    // 不能再单独用 Dcat.init 注册同一选择器，否则会被 initialized 标记跳过。
+    $this.each(function () {
+        var $select = $(this),
+            $hidden = $select.siblings('input[type="hidden"][name="' + $select.attr('name') + '"]'),
+            toggle = function () {
+                var val = $select.val();
+
+                $hidden.prop('disabled', !!(val && val.length > 0));
+            };
+
+        $select.on('change', toggle);
+        toggle();
+    });
+    @endif
+
     @yield('admin.select-ajax')
 
     @if(isset($remoteOptions))
diff --git a/src/Http/Controllers/HasMenuTreeField.php b/src/Http/Controllers/HasMenuTreeField.php
index c6298c5ce..7d0de876b 100644
--- a/src/Http/Controllers/HasMenuTreeField.php
+++ b/src/Http/Controllers/HasMenuTreeField.php
@@ -30,10 +30,16 @@ protected function addMenuTreeField(Form $form)
 
     /**
      * Flush menu cache after form saved.
+     *
+     * 注意：Form 的事件回调会被重新绑定到模型实例（见 HasEvents::makeListener），
+     * 回调内的 $this 不再是控制器，因此这里不能依赖 $this，统一通过本方法注册。
      */
-    protected function flushMenuCache()
+    protected function flushMenuCacheOnSaved(Form $form)
     {
-        $model = config('admin.database.menu_model');
-        (new $model())->flushCache();
+        $form->saved(function () {
+            $model = config('admin.database.menu_model');
+
+            (new $model())->flushCache();
+        });
     }
 }
diff --git a/src/Http/Controllers/PermissionController.php b/src/Http/Controllers/PermissionController.php
index 67d1bb164..ad181bbd8 100644
--- a/src/Http/Controllers/PermissionController.php
+++ b/src/Http/Controllers/PermissionController.php
@@ -88,7 +88,7 @@ public function form()
             $with[] = 'menus';
         }
 
-        return Form::make(Permission::with($with), function (Form $form) use ($bindMenu) {
+        $form = Form::make(Permission::with($with), function (Form $form) use ($bindMenu) {
             $permissionTable = config('admin.database.permissions_table');
             $connection = config('admin.database.connection');
             $permissionModel = config('admin.database.permissions_model');
@@ -125,9 +125,11 @@ public function form()
 
             $form->disableViewButton();
             $form->disableViewCheck();
-        })->saved(function () {
-            $this->flushMenuCache();
         });
+
+        $this->flushMenuCacheOnSaved($form);
+
+        return $form;
     }
 
     public function getRoutes()
diff --git a/src/Http/Controllers/RoleController.php b/src/Http/Controllers/RoleController.php
index 86c54f166..f1576df16 100644
--- a/src/Http/Controllers/RoleController.php
+++ b/src/Http/Controllers/RoleController.php
@@ -83,7 +83,7 @@ public function form()
             $with[] = 'menus';
         }
 
-        return Form::make(Role::with($with), function (Form $form) use ($bindMenu) {
+        $form = Form::make(Role::with($with), function (Form $form) use ($bindMenu) {
             $roleTable = config('admin.database.roles_table');
             $connection = config('admin.database.connection');
 
@@ -125,9 +125,11 @@ public function form()
             if ($id == $roleModel::ADMINISTRATOR_ID) {
                 $form->disableDeleteButton();
             }
-        })->saved(function () {
-            $this->flushMenuCache();
         });
+
+        $this->flushMenuCacheOnSaved($form);
+
+        return $form;
     }
 
     public function destroy($id)

From 8a9da3a9ded43868361d946e0907854673649970 Mon Sep 17 00:00:00 2001
From: Shine <shine@channelwill.cn>
Date: Tue, 20 Oct 2026 16:26:24 +0800
Subject: [PATCH 2/2] =?UTF-8?q?ci:=20=E4=BF=AE=E5=A4=8D=20PHP=208.1=20?=
 =?UTF-8?q?=E4=BE=9D=E8=B5=96=E6=97=A0=E6=B3=95=E8=A7=A3=E6=9E=90=E5=8F=8A?=
 =?UTF-8?q?=20PHPStan=20baseline=20=E6=9C=AA=E5=8C=B9=E9=85=8D=E5=AF=BC?=
 =?UTF-8?q?=E8=87=B4=E7=9A=84=20CI=20=E5=A4=B1=E8=B4=A5?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Composer >= 2.10 默认开启 policy.advisories.block，Laravel 10/11 全部版本带安全公告
  被拒绝加载，PHP 8.1 下无可安装版本。仅在 CI 安装前关闭该阻断。
- 新版 PHPStan 不再报告 Zip.php 的 `$folders might not be defined`，
  baseline 条目变为未匹配错误。显式初始化 `$folders = []` 并移除该条目。
---
 .github/workflows/phpstan.yml | 4 ++++
 phpstan-baseline.neon         | 6 ------
 src/Support/Zip.php           | 2 ++
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/phpstan.yml b/.github/workflows/phpstan.yml
index c63f65a95..f0011327d 100644
--- a/.github/workflows/phpstan.yml
+++ b/.github/workflows/phpstan.yml
@@ -33,6 +33,10 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-php-${{ matrix.php }}-composer-
 
+      # Laravel 10/11 已停止安全维护，Composer >= 2.10 默认拒绝加载带安全公告的版本，
+      # 会导致 PHP 8.1 无可安装版本；仅在 CI 中关闭该阻断以保留低版本矩阵。
+      - run: composer config policy.advisories.block false
+
       - run: composer install --no-interaction --prefer-dist
 
       - run: vendor/bin/phpstan analyse --no-progress --memory-limit=512M --error-format=github
diff --git a/phpstan-baseline.neon b/phpstan-baseline.neon
index 2c5ccbd12..36d0e6fa9 100644
--- a/phpstan-baseline.neon
+++ b/phpstan-baseline.neon
@@ -558,12 +558,6 @@ parameters:
 			count: 1
 			path: src/Support/Setting.php
 
-		-
-			message: '#^Variable \$folders might not be defined\.$#'
-			identifier: variable.undefined
-			count: 1
-			path: src/Support/Zip.php
-
 		-
 			message: '#^Result of method Dcat\\Admin\\Tree\:\:disableCreateButton\(\) \(void\) is used\.$#'
 			identifier: method.void
diff --git a/src/Support/Zip.php b/src/Support/Zip.php
index 98cb8487a..0582d503f 100644
--- a/src/Support/Zip.php
+++ b/src/Support/Zip.php
@@ -148,6 +148,8 @@ public function add($source, $options = [])
         $basedir = $options['basedir'];
         $baseglob = $options['baseglob'];
 
+        $folders = [];
+
         if (is_file($source)) {
             $files = [$source];
             $recursive = false;