kate522/wordpress-theme-aksrt
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(identity): validate evidence by file content

Browse Source
This commit is contained in:
kate522
2026-10-04 23:13:48 +08:00
parent 90c1f7a62b
commit 2ae2b2fd07
3 changed files with 20 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
assets/js/routes/user-center-auth.js
+2 -2
View File
@@ -103,9 +103,9 @@
input.value = '';
if (!files.length) return;
var unsupported = files.some(function (file) { return !/^image\/(gif|jpe?g|png)$/i.test(file.type); });
var unsupported = files.some(function (file) { return !/^image\/(gif|jpe?g|png|webp)$/i.test(file.type); });
if (unsupported) {
toast('证明材料仅支持 GIF、JPG、PNG 图片', 'danger');
toast('证明材料仅支持 JPG、PNG、GIF 或 WebP 图片', 'danger');
return;
}
if (files.some(function (file) { return file.size > 2 * 1024 * 1024; })) {
inc/helpers/user-center-renderers/profile-auth.php
+1 -1
View File
@@ -75,7 +75,7 @@ $config = [
<div class="preview" data-auth-preview>
<button type="button" class="add" data-auth-file-picker aria-label="<?php esc_attr_e('选择证明材料图片', 'aksrt'); ?>"></button>
</div>
<input class="hide" type="file" data-auth-evidence accept="image/gif,image/jpeg,image/png" multiple>
<input class="hide" type="file" data-auth-evidence accept="image/gif,image/jpeg,image/png,image/webp" multiple>
<div class="muted-2-color em09 mt6"><?php esc_html_e('最多上传 3 张图片，单张不超过 2MB。材料仅本人和认证审核管理员可查看。', 'aksrt'); ?></div>
</div>
</div>
src/Identity/EvidenceService.php
+17 -6
View File
@@ -14,6 +14,15 @@ final class EvidenceService {
public const OWNER_META = '_aksrt_verify_evidence_owner';
public const APPLICATION_META = '_aksrt_identity_application_uuid';
private const ALLOWED_MIME_TYPES = ['image/jpeg', 'image/png', 'image/gif', 'image/webp'];
private const MIME_EXTENSIONS = [
'image/jpeg' => 'jpg',
'image/png' => 'png',
'image/gif' => 'gif',
'image/webp' => 'webp',
];
public function init(): void {
add_action('admin_post_aksrt_verify_evidence', [$this, 'serve']);
}
@@ -36,12 +45,14 @@ final class EvidenceService {
$this->delete($ids);
return new \WP_Error('aksrt_identity_upload', __('证明材料上传失败，单张图片不能超过 2MB', 'aksrt'));
}
$checked = wp_check_filetype_and_ext($tmp, sanitize_file_name((string) ($file['name'] ?? 'evidence.jpg')));
$mime = (string) ($checked['type'] ?? '');
$ext = (string) ($checked['ext'] ?? '');
if (!in_array($mime, ['image/gif', 'image/jpeg', 'image/png'], true) || $ext === '') {
// 按文件内容判定类型：仅凭扩展名会把无扩展名、.jfif 等合法图片误判为不支持。
$mime = function_exists('wp_get_image_mime')
? (string) wp_get_image_mime($tmp)
: (string) wp_check_filetype_and_ext($tmp, sanitize_file_name((string) ($file['name'] ?? 'evidence.jpg')))['type'];
$ext = self::MIME_EXTENSIONS[$mime] ?? '';
if (!in_array($mime, self::ALLOWED_MIME_TYPES, true) || $ext === '') {
$this->delete($ids);
return new \WP_Error('aksrt_identity_upload_type', __('证明材料仅支持 JPG、PNG 或 WebP 图片', 'aksrt'));
return new \WP_Error('aksrt_identity_upload_type', __('证明材料仅支持 JPG、PNG、GIF 或 WebP 图片', 'aksrt'));
}
$id = media_handle_sideload([
'name' => wp_generate_password(24, false, false) . '.' . $ext,
@@ -102,7 +113,7 @@ final class EvidenceService {
if (!is_string($path) || !is_file($path) || !is_readable($path)) {
wp_die(esc_html__('证明材料不存在', 'aksrt'), '', ['response' => 404]);
}
if (!in_array($mime, ['image/gif', 'image/jpeg', 'image/png'], true)) {
if (!in_array($mime, self::ALLOWED_MIME_TYPES, true)) {
wp_die(esc_html__('证明材料类型无效', 'aksrt'), '', ['response' => 415]);
}
nocache_headers();