fix(identity): validate evidence by file content

assets/js/routes/user-center-auth.js

@@ -103,9 +103,9 @@
             input.value = '';
             if (!files.length) return;
 
-            var unsupported = files.some(function (file) { return !/^image\/(gif|jpe?g|png)$/i.test(file.type); });
+            var unsupported = files.some(function (file) { return !/^image\/(gif|jpe?g|png|webp)$/i.test(file.type); });
             if (unsupported) {
-              toast('证明材料仅支持 GIF、JPG、PNG 图片', 'danger');
+              toast('证明材料仅支持 JPG、PNG、GIF 或 WebP 图片', 'danger');
               return;
             }
             if (files.some(function (file) { return file.size > 2 * 1024 * 1024; })) {

inc/helpers/user-center-renderers/profile-auth.php

@@ -75,7 +75,7 @@ $config = [
 								<div class="preview" data-auth-preview>
 									<button type="button" class="add" data-auth-file-picker aria-label="<?php esc_attr_e('选择证明材料图片', 'aksrt'); ?>"></button>
 								</div>
-								<input class="hide" type="file" data-auth-evidence accept="image/gif,image/jpeg,image/png" multiple>
+								<input class="hide" type="file" data-auth-evidence accept="image/gif,image/jpeg,image/png,image/webp" multiple>
 								<div class="muted-2-color em09 mt6"><?php esc_html_e('最多上传 3 张图片，单张不超过 2MB。材料仅本人和认证审核管理员可查看。', 'aksrt'); ?></div>
 							</div>
 						</div>

src/Identity/EvidenceService.php

@@ -14,6 +14,15 @@ final class EvidenceService {
     public const OWNER_META = '_aksrt_verify_evidence_owner';
     public const APPLICATION_META = '_aksrt_identity_application_uuid';
 
+    private const ALLOWED_MIME_TYPES = ['image/jpeg', 'image/png', 'image/gif', 'image/webp'];
+
+    private const MIME_EXTENSIONS = [
+        'image/jpeg' => 'jpg',
+        'image/png'  => 'png',
+        'image/gif'  => 'gif',
+        'image/webp' => 'webp',
+    ];
+
     public function init(): void {
         add_action('admin_post_aksrt_verify_evidence', [$this, 'serve']);
     }
@@ -36,12 +45,14 @@ final class EvidenceService {
                 $this->delete($ids);
                 return new \WP_Error('aksrt_identity_upload', __('证明材料上传失败，单张图片不能超过 2MB', 'aksrt'));
             }
-            $checked = wp_check_filetype_and_ext($tmp, sanitize_file_name((string) ($file['name'] ?? 'evidence.jpg')));
+            // 按文件内容判定类型：仅凭扩展名会把无扩展名、.jfif 等合法图片误判为不支持。
-            $mime = (string) ($checked['type'] ?? '');
+            $mime = function_exists('wp_get_image_mime')
-            $ext = (string) ($checked['ext'] ?? '');
+                ? (string) wp_get_image_mime($tmp)
-			if (!in_array($mime, ['image/gif', 'image/jpeg', 'image/png'], true) || $ext === '') {
+                : (string) wp_check_filetype_and_ext($tmp, sanitize_file_name((string) ($file['name'] ?? 'evidence.jpg')))['type'];
+            $ext = self::MIME_EXTENSIONS[$mime] ?? '';
+			if (!in_array($mime, self::ALLOWED_MIME_TYPES, true) || $ext === '') {
                 $this->delete($ids);
-                return new \WP_Error('aksrt_identity_upload_type', __('证明材料仅支持 JPG、PNG 或 WebP 图片', 'aksrt'));
+                return new \WP_Error('aksrt_identity_upload_type', __('证明材料仅支持 JPG、PNG、GIF 或 WebP 图片', 'aksrt'));
             }
             $id = media_handle_sideload([
                 'name' => wp_generate_password(24, false, false) . '.' . $ext,
@@ -102,7 +113,7 @@ final class EvidenceService {
         if (!is_string($path) || !is_file($path) || !is_readable($path)) {
             wp_die(esc_html__('证明材料不存在', 'aksrt'), '', ['response' => 404]);
         }
-		if (!in_array($mime, ['image/gif', 'image/jpeg', 'image/png'], true)) {
+		if (!in_array($mime, self::ALLOWED_MIME_TYPES, true)) {
             wp_die(esc_html__('证明材料类型无效', 'aksrt'), '', ['response' => 415]);
         }
         nocache_headers();