kate522/wordpress-theme-aksrt
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(identity): validate evidence by file content

Browse Source
This commit is contained in:
kate522
2026-10-04 23:13:48 +08:00
parent 90c1f7a62b
commit 2ae2b2fd07
3 changed files with 20 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/Identity/EvidenceService.php
+17 -6
View File
@@ -14,6 +14,15 @@ final class EvidenceService {
public const OWNER_META = '_aksrt_verify_evidence_owner';
public const APPLICATION_META = '_aksrt_identity_application_uuid';
private const ALLOWED_MIME_TYPES = ['image/jpeg', 'image/png', 'image/gif', 'image/webp'];
private const MIME_EXTENSIONS = [
'image/jpeg' => 'jpg',
'image/png' => 'png',
'image/gif' => 'gif',
'image/webp' => 'webp',
];
public function init(): void {
add_action('admin_post_aksrt_verify_evidence', [$this, 'serve']);
}
@@ -36,12 +45,14 @@ final class EvidenceService {
$this->delete($ids);
return new \WP_Error('aksrt_identity_upload', __('证明材料上传失败，单张图片不能超过 2MB', 'aksrt'));
}
$checked = wp_check_filetype_and_ext($tmp, sanitize_file_name((string) ($file['name'] ?? 'evidence.jpg')));
$mime = (string) ($checked['type'] ?? '');
$ext = (string) ($checked['ext'] ?? '');
if (!in_array($mime, ['image/gif', 'image/jpeg', 'image/png'], true) || $ext === '') {
// 按文件内容判定类型：仅凭扩展名会把无扩展名、.jfif 等合法图片误判为不支持。
$mime = function_exists('wp_get_image_mime')
? (string) wp_get_image_mime($tmp)
: (string) wp_check_filetype_and_ext($tmp, sanitize_file_name((string) ($file['name'] ?? 'evidence.jpg')))['type'];
$ext = self::MIME_EXTENSIONS[$mime] ?? '';
if (!in_array($mime, self::ALLOWED_MIME_TYPES, true) || $ext === '') {
$this->delete($ids);
return new \WP_Error('aksrt_identity_upload_type', __('证明材料仅支持 JPG、PNG 或 WebP 图片', 'aksrt'));
return new \WP_Error('aksrt_identity_upload_type', __('证明材料仅支持 JPG、PNG、GIF 或 WebP 图片', 'aksrt'));
}
$id = media_handle_sideload([
'name' => wp_generate_password(24, false, false) . '.' . $ext,
@@ -102,7 +113,7 @@ final class EvidenceService {
if (!is_string($path) || !is_file($path) || !is_readable($path)) {
wp_die(esc_html__('证明材料不存在', 'aksrt'), '', ['response' => 404]);
}
if (!in_array($mime, ['image/gif', 'image/jpeg', 'image/png'], true)) {
if (!in_array($mime, self::ALLOWED_MIME_TYPES, true)) {
wp_die(esc_html__('证明材料类型无效', 'aksrt'), '', ['response' => 415]);
}
nocache_headers();