' . esc_html__('微信扫码登录', 'aksrt') . '
'; + return new \WP_REST_Response([ + 'success' => true, + 'data' => [ + 'mode' => 'scan', + 'qr_html' => $html, + 'check_url' => '/auth/check-qrcode-login', + 'token' => $state, + ], + ], 200); + } catch (\Throwable $e) { + // Fallback to static QR form if API fails. + $qr = (string) ($cfg['code_qrcode'] ?? ''); + if ($qr === '') { + return new \WP_REST_Response(['success' => false, 'message' => $e->getMessage()], 400); + } + $html = '' . esc_html__('请使用公众号二维码 + 验证码登录', 'aksrt') . '
'; + return new \WP_REST_Response([ + 'success' => true, + 'data' => ['mode' => 'code', 'qr_html' => $html, 'check_url' => '', 'token' => ''], + ], 200); + } + } + + public function rest_check_qrcode_login(\WP_REST_Request $request) { + $params = $request->get_json_params(); + if (!is_array($params)) { + $params = $request->get_params(); + } + $token = sanitize_text_field((string) ($params['token'] ?? $request->get_param('token') ?? '')); + if ($token === '') { + return new \WP_REST_Response(['success' => false, 'message' => __('缺少 token', 'aksrt')], 400); + } + $row = $this->get_scan_state($token); + if (!$row) { + return new \WP_REST_Response(['success' => true, 'data' => ['logged_in' => false, 'status' => 'expired']], 200); + } + if (($row['status'] ?? '') === 'ok' && !empty($row['user_id'])) { + $user = get_user_by('id', (int) $row['user_id']); + if ($user instanceof \WP_User) { + wp_set_current_user($user->ID); + wp_set_auth_cookie($user->ID, true); + do_action('wp_login', $user->user_login, $user); + $this->delete_scan_state($token); + return new \WP_REST_Response([ + 'success' => true, + 'data' => [ + 'logged_in' => true, + 'redirect' => function_exists('aksrt_get_user_center_url') ? aksrt_get_user_center_url() : home_url('/'), + 'user' => [ + 'id' => $user->ID, + 'display_name' => $user->display_name, + ], + ], + ], 200); + } + } + return new \WP_REST_Response([ + 'success' => true, + 'data' => ['logged_in' => false, 'status' => (string) ($row['status'] ?? 'pending')], + ], 200); + } + + public function rest_code_login(\WP_REST_Request $request) { + $params = $request->get_json_params(); + if (!is_array($params)) { + $params = $request->get_params(); + } + $code = strtoupper(sanitize_text_field((string) ($params['code'] ?? ''))); + if ($code === '') { + return new \WP_REST_Response(['success' => false, 'message' => __('请输入验证码', 'aksrt')], 400); + } + $openid = $this->consume_code($code); + if ($openid === null) { + return new \WP_REST_Response(['success' => false, 'message' => __('验证码无效或已过期', 'aksrt')], 400); + } + $user = $this->login_or_create_by_openid($openid, []); + if (is_wp_error($user)) { + return new \WP_REST_Response(['success' => false, 'message' => $user->get_error_message()], 400); + } + return new \WP_REST_Response([ + 'success' => true, + 'data' => [ + 'logged_in' => true, + 'redirect' => function_exists('aksrt_get_user_center_url') ? aksrt_get_user_center_url() : home_url('/'), + 'user' => [ + 'id' => $user->ID, + 'display_name' => $user->display_name, + ], + ], + ], 200); + } + + /** + * WeChat server URL verification: /?aksrt_weixingzh=1&signature&echostr + */ + public function maybe_server_verify(): void { + if (empty($_GET['aksrt_weixingzh']) || empty($_GET['echostr']) || empty($_GET['signature'])) { + return; + } + $cfg = self::settings(); + if (!empty($cfg['token_nocheck'])) { + echo (string) wp_unslash($_GET['echostr']); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped + exit; + } + $token = (string) ($cfg['token'] ?? ''); + $tmp = [(string) $token, (string) ($_GET['timestamp'] ?? ''), (string) ($_GET['nonce'] ?? '')]; + sort($tmp, SORT_STRING); + if (sha1(implode($tmp)) === (string) $_GET['signature']) { + echo (string) wp_unslash($_GET['echostr']); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped + exit; + } + status_header(403); + exit; + } + + /** + * Receive WeChat server push (XML) on same endpoint. + */ + public function maybe_server_message(): void { + if (empty($_GET['aksrt_weixingzh']) || empty($_GET['signature']) || !empty($_GET['echostr'])) { + return; + } + if (($_SERVER['REQUEST_METHOD'] ?? '') !== 'POST') { + return; + } + $raw = file_get_contents('php://input'); + if (!is_string($raw) || $raw === '') { + exit; + } + $xml = @simplexml_load_string($raw, 'SimpleXMLElement', LIBXML_NOCDATA); + if (!$xml) { + exit; + } + $from = (string) ($xml->FromUserName ?? ''); + $to = (string) ($xml->ToUserName ?? ''); + $msg_type = (string) ($xml->MsgType ?? ''); + $event = strtolower((string) ($xml->Event ?? '')); + $content = trim((string) ($xml->Content ?? '')); + $cfg = self::settings(); + $keyword = (string) ($cfg['code_keyword'] ?? '登录'); + + // Scene scan login (service QR). + if ($msg_type === 'event' && in_array($event, ['subscribe', 'scan'], true)) { + $scene = (string) ($xml->EventKey ?? ''); + $scene = ltrim($scene, 'qrscene_'); + if ($scene !== '') { + $this->mark_scan_by_scene($scene, $from); + } + $reply = (string) ($cfg['subscribe_msg'] ?? $cfg['scan_msg'] ?? ''); + if ($reply !== '') { + $this->echo_text_reply($from, $to, $reply); + } + echo 'success'; + exit; + } + + // Keyword → verification code. + if ($msg_type === 'text' && $content !== '' && mb_strtolower($content) === mb_strtolower($keyword)) { + $code = $this->issue_code($from); + $tpl = (string) ($cfg['code_reply'] ?? __('您的验证码是：%s，有效期 %d 分钟。', 'aksrt')); + // Support %s/%d and %code%/%time%. + $msg = $tpl; + if (str_contains($msg, '%code%')) { + $msg = str_replace('%code%', $code, $msg); + } + if (str_contains($msg, '%time%')) { + $msg = str_replace('%time%', '5', $msg); + } + if (substr_count($msg, '%') >= 2 && str_contains($msg, '%s')) { + $msg = sprintf($msg, $code, 5); + } elseif (str_contains($msg, '%s')) { + $msg = sprintf($msg, $code); + } + $this->echo_text_reply($from, $to, $msg); + exit; + } + + // Optional auto replies. + if ($msg_type === 'text' && !empty($cfg['auto_reply_text'])) { + $this->echo_text_reply($from, $to, (string) $cfg['auto_reply_text']); + exit; + } + echo 'success'; + exit; + } + + private function echo_text_reply(string $to_user, string $from_user, string $content): void { + $time = time(); + $content = htmlspecialchars($content, ENT_XML1 | ENT_QUOTES, 'UTF-8'); + echo "',
+ $uid,
+ $interval * 1000,
+ $loop ? '1' : '0',
+ $height
+ );
+ echo '
';
+ echo $args['after_widget']; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
+
+ // Inline init once per widget (no extra enqueue dependency).
+ ?>
+
+ normalize_slides($instance['slides'] ?? []);
+ if (!$slides) {
+ $slides = [
+ ['image' => '', 'href' => '', 'title' => '', 'desc' => ''],
+ ['image' => '', 'href' => '', 'title' => '', 'desc' => ''],
+ ];
+ }
+ ?>
+ ';
+ foreach ($slides as $i => $slide) {
+ $active = $i === 0 ? ' is-active' : '';
+ echo '
';
+ if ($nav) {
+ echo '';
+ echo '';
+ }
+ if ($dots) {
+ echo '';
+ }
+ echo '';
+ $img = '![' . esc_attr($slide['title']) . '](' . esc_url($slide['image']) . ')
';
+ if ($slide['href'] !== '') {
+ printf(
+ '%s',
+ esc_url($slide['href']),
+ $blank ? ' target="_blank" rel="noopener noreferrer"' : '',
+ $img // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
+ );
+ } else {
+ echo $img; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
+ }
+ if ($slide['title'] !== '' || $slide['desc'] !== '') {
+ echo '';
+ }
+ echo '
';
+ }
+ echo '+ +
++ +
++ +
+
+
+
+
+
+
+
+
+
+
+
+
+ + " placeholder=""> + " placeholder=""> + " placeholder=""> + " placeholder=""> +
+ normalize_slides($new_instance['slides'] ?? []); + return [ + 'title' => sanitize_text_field((string) ($new_instance['title'] ?? '')), + 'interval' => max(2, min(20, (int) ($new_instance['interval'] ?? 4))), + 'height' => max(80, min(800, (int) ($new_instance['height'] ?? 220))), + 'loop' => !empty($new_instance['loop']) ? 1 : 0, + 'button' => !empty($new_instance['button']) ? 1 : 0, + 'pagination' => !empty($new_instance['pagination']) ? 1 : 0, + 'blank' => !empty($new_instance['blank']) ? 1 : 0, + 'slides' => $slides, + ]; + } + + /** + * @param mixed $raw + * @return array
+
+
+
+
+
+
+
+
+
+
+
+
+