feat(security): 新增网站安全扩展模块并支持修改手机脱敏验证

inc/modules/user-parts/account-ajax.php

@@ -92,21 +92,6 @@ function aksrt_account_consume_proof(int $user_id, string $kind, string $target,
 	return true;
 }
 
-function aksrt_account_rate_limited(int $user_id, string $scene): bool {
-	$key = 'aksrt_account_rate_' . sanitize_key($scene) . '_' . $user_id;
-	$count = (int) get_transient($key);
-	if ($count >= 8) {
-		return true;
-	}
-
-	set_transient($key, $count + 1, 10 * MINUTE_IN_SECONDS);
-	return false;
-}
-
-function aksrt_account_reset_rate(int $user_id, string $scene): void {
-	delete_transient('aksrt_account_rate_' . sanitize_key($scene) . '_' . $user_id);
-}
-
 function aksrt_account_email_verification_required(): bool {
 	$settings = class_exists('\AKSRT\Settings\Settings') ? \AKSRT\Settings\Settings::get_all() : [];
 	return !empty($settings['email_set_captch']);
@@ -155,11 +140,12 @@ add_action('wp_ajax_aksrt_send_account_email_code', function (): void {
 			wp_send_json_error(aksrt_account_captcha_error_data($captcha));
 		}
 	}
-	$rate_key = 'aksrt_account_email_rate_' . $user_id . '_' . $scene . '_' . md5(strtolower($target));
-	if (get_transient($rate_key)) {
-		wp_send_json_error(['message' => __('操作过于频繁，请稍后再试', 'aksrt')]);
+	if (class_exists('\AKSRT\Extensions\SendLimit')) {
+		$limit = \AKSRT\Extensions\SendLimit::check($target);
+		if (empty($limit['ok'])) {
+			wp_send_json_error(['message' => (string) $limit['message']]);
+		}
 	}
-	set_transient($rate_key, true, 60);
 
 	$code = str_pad((string) random_int(0, 999999), 6, '0', STR_PAD_LEFT);
 	$sent = class_exists('\AKSRT\Settings\Settings')
@@ -170,16 +156,16 @@ add_action('wp_ajax_aksrt_send_account_email_code', function (): void {
 		])
 		: false;
 	if (!$sent) {
-		delete_transient($rate_key);
 		wp_send_json_error(['message' => __('验证码邮件发送失败，请稍后重试', 'aksrt')]);
 	}
 
+	$cooldown = class_exists('\AKSRT\Extensions\SendLimit') ? (int) \AKSRT\Extensions\SendLimit::record($target) : 0;
 	aksrt_account_store_code($user_id, $scene, $target, $code);
 	wp_send_json_success([
 		'message' => $scene === 'verify_email'
 			? __('验证码已发送到您的老邮箱', 'aksrt')
 			: __('验证码已发送到新邮箱', 'aksrt'),
-		'countdown' => 60,
+		'countdown' => $cooldown > 0 ? $cooldown : 60,
 	]);
 });
 
@@ -208,9 +194,15 @@ add_action('wp_ajax_aksrt_verify_account_email', function (): void {
 
 	$code = sanitize_text_field((string) wp_unslash($_POST['code'] ?? ''));
 	if (!aksrt_account_consume_code($user_id, 'verify_email', (string) $user->user_email, $code)) {
+		if (class_exists('\AKSRT\Extensions\SecurityHardening')) {
+			\AKSRT\Extensions\SecurityHardening::error_frequency_record();
+		}
 		wp_send_json_error(['message' => __('验证码错误或已过期', 'aksrt')]);
 	}
 
+	if (class_exists('\AKSRT\Extensions\SecurityHardening')) {
+		\AKSRT\Extensions\SecurityHardening::error_frequency_clear();
+	}
 	aksrt_account_set_proof($user_id, 'email_old', (string) $user->user_email);
 	wp_send_json_success(['message' => __('验证成功', 'aksrt')]);
 });
@@ -250,10 +242,13 @@ add_action('wp_ajax_aksrt_change_password', function (): void {
 		if ($old_password === $password) {
 			wp_send_json_error(['message' => __('新密码和原密码不能相同', 'aksrt')]);
 		}
-		if (aksrt_account_rate_limited($user_id, 'change_password')) {
-			wp_send_json_error(['message' => __('错误次数过多，请稍后再试', 'aksrt')]);
+		if (class_exists('\AKSRT\Extensions\SecurityHardening') && ($wait = \AKSRT\Extensions\SecurityHardening::error_frequency_wait()) > 0) {
+			wp_send_json_error(['message' => sprintf(__('验证错误次数过多，请 %d 秒后再试', 'aksrt'), $wait)]);
 		}
 		if (!wp_check_password($old_password, $user->user_pass, $user_id)) {
+			if (class_exists('\AKSRT\Extensions\SecurityHardening')) {
+				\AKSRT\Extensions\SecurityHardening::error_frequency_record();
+			}
 			wp_send_json_error(['message' => __('原密码错误', 'aksrt')]);
 		}
 	}
@@ -271,7 +266,9 @@ add_action('wp_ajax_aksrt_change_password', function (): void {
 	}
 
 	delete_user_meta($user_id, 'oauth_new');
-	aksrt_account_reset_rate($user_id, 'change_password');
+	if (class_exists('\AKSRT\Extensions\SecurityHardening')) {
+		\AKSRT\Extensions\SecurityHardening::error_frequency_clear();
+	}
 	wp_send_json_success([
 		'message' => $oauth_new
 			? __('密码设置成功', 'aksrt')
@@ -335,6 +332,9 @@ add_action('wp_ajax_aksrt_change_email', function (): void {
 			false
 		)
 	) {
+		if (class_exists('\AKSRT\Extensions\SecurityHardening')) {
+			\AKSRT\Extensions\SecurityHardening::error_frequency_record();
+		}
 		wp_send_json_error(['message' => __('验证码错误或已过期', 'aksrt')]);
 	}
 
@@ -349,6 +349,9 @@ add_action('wp_ajax_aksrt_change_email', function (): void {
 	if ($verification_required) {
 		delete_transient(aksrt_account_code_key($user_id, 'change_email', $new_email));
 	}
+	if (class_exists('\AKSRT\Extensions\SecurityHardening')) {
+		\AKSRT\Extensions\SecurityHardening::error_frequency_clear();
+	}
 	update_user_meta($user_id, 'aksrt_email_verified', 1);
 	if ($old_email !== '' && is_email($old_email) && class_exists('\AKSRT\Settings\Settings')) {
 		\AKSRT\Settings\Settings::send_event_email('change_notice', $old_email, [