From 93bf54500f2e816e575441f21a2e83c442ef3dc4 Mon Sep 17 00:00:00 2001 From: unknown Date: Sat, 1 Aug 2026 21:38:36 +0800 Subject: [PATCH] =?UTF-8?q?fix:=20=E6=9C=AC=E5=9C=B0=E7=8E=AF=E5=A2=83?= =?UTF-8?q?=E8=B7=B3=E8=BF=87=E9=98=BF=E9=87=8C=E4=BA=91=E5=9B=9E=E8=B0=83?= =?UTF-8?q?=E5=9C=B0=E5=9D=80?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Fable 5 --- .../Identity/Provider/AliyunProvider.php | 24 ++++++++++++++++--- 1 file changed, 21 insertions(+), 3 deletions(-) diff --git a/src/AKSRT/Identity/Provider/AliyunProvider.php b/src/AKSRT/Identity/Provider/AliyunProvider.php index ea82e677..5736a267 100644 --- a/src/AKSRT/Identity/Provider/AliyunProvider.php +++ b/src/AKSRT/Identity/Provider/AliyunProvider.php @@ -93,6 +93,18 @@ final class AliyunProvider implements ProviderInterface { return ProviderResult::failed($status, sanitize_text_field((string) ($response['ResultObject']['MaterialInfo'] ?? __('实人认证未通过', 'aksrt')))); } + private function is_public_https_url(string $url): bool { + if ($url === '') { + return false; + } + $parts = wp_parse_url($url); + if (!is_array($parts) || strtolower((string) ($parts['scheme'] ?? '')) !== 'https') { + return false; + } + $host = strtolower((string) ($parts['host'] ?? '')); + return $host !== '' && !in_array($host, ['localhost', '127.0.0.1', '::1'], true) && !str_ends_with($host, '.local'); + } + public function verify_callback(\WP_REST_Request $request): bool { $token = sanitize_text_field((string) ($request->get_param('CallbackToken') ?: $request->get_param('callbackToken'))); $session = sanitize_text_field((string) ($request->get_param('certifyId') ?: $request->get_param('CertifyId'))); @@ -126,10 +138,16 @@ final class AliyunProvider implements ProviderInterface { 'CertType' => 'IDENTITY_CARD', 'CertName' => (string) ($request['person_name'] ?? ''), 'CertNo' => preg_replace('/\s+/', '', (string) ($request['id_number'] ?? '')), - 'ReturnUrl' => esc_url_raw((string) ($request['return_url'] ?? '')), - 'CallbackUrl' => rest_url('aksrt/v1/identity/callback/aliyun'), - 'CallbackToken' => $callback_token, ]; + $return_url = esc_url_raw((string) ($request['return_url'] ?? '')); + if ($this->is_public_https_url($return_url)) { + $params['ReturnUrl'] = $return_url; + } + $callback_url = esc_url_raw(rest_url('aksrt/v1/identity/callback/aliyun')); + if ($this->is_public_https_url($callback_url)) { + $params['CallbackUrl'] = $callback_url; + $params['CallbackToken'] = $callback_token; + } $response = $this->rpc('cloudauth.aliyuncs.com', '2019-03-07', 'InitFaceVerify', $params); if (is_wp_error($response)) { return ProviderResult::failed($response->get_error_code(), $response->get_error_message());