kate522/wordpress-theme-aksrt
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(security): 新增网站安全扩展模块并支持修改手机脱敏验证

Browse Source
This commit is contained in:
kate522
2026-10-06 09:26:55 +08:00
parent 224f86ec08
commit af72364078
30 changed files with 1389 additions and 73 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/Admin/UserControllerAuthPhoneOperations.php
+105 -10
View File
@@ -196,6 +196,14 @@ trait UserControllerAuthPhoneOperations {
return $this->success(['message' => $generic, 'countdown' => (int) ($result['remaining_time'] ?? 60)]);
}
// [防刷机制]验证码发送限制（短信通道由 SMS::send_code 内部接入）。
if (class_exists('\AKSRT\Extensions\SendLimit')) {
$limit = \AKSRT\Extensions\SendLimit::check($target);
if (empty($limit['ok'])) {
return $this->error((string) $limit['message'], 429);
}
}
$code = (string) random_int(100000, 999999);
$scene_event = [
'login' => 'login_code',
@@ -221,8 +229,9 @@ trait UserControllerAuthPhoneOperations {
}
return $this->error(__('验证码发送失败，请稍后再试', 'aksrt'), 500);
}
$cooldown = class_exists('\AKSRT\Extensions\SendLimit') ? (int) \AKSRT\Extensions\SendLimit::record($target) : 0;
$this->auth_store_code($scene, $target, $code);
return $this->success(['message' => $generic, 'countdown' => 60]);
return $this->success(['message' => $generic, 'countdown' => $cooldown > 0 ? $cooldown : 60]);
}
@@ -465,13 +474,35 @@ trait UserControllerAuthPhoneOperations {
$settings = class_exists('\AKSRT\Settings\Settings') ? \AKSRT\Settings\Settings::get_all() : [];
if (empty($settings['bind_phone'])) return $this->error(__('手机号绑定功能暂未开启', 'aksrt'), 403);
$stage = sanitize_key((string) ($payload['stage'] ?? 'bind_new_phone'));
$phone = sanitize_text_field((string) ($payload['phone'] ?? ''));
if (!\AKSRT\Sms\SMS::is_phonenumber($phone)) return $this->error(__('手机号格式不正确', 'aksrt'));
$user_id = get_current_user_id();
$current_phone = (string) get_user_meta($user_id, 'phone_number', true);
if ($stage === 'reset_old_phone') {
// 前端在修改已通过校验的中间位后调用：销毁已发放的老号验证码状态。
if ($current_phone !== '') {
delete_transient($this->auth_code_key('account_verify_old_phone_' . $user_id, $current_phone));
}
return $this->success(['message' => __('已取消本次验证', 'aksrt')]);
}
if ($stage === 'verify_old_phone') {
if ($current_phone === '' || !hash_equals($current_phone, $phone)) return $this->error(__('当前绑定手机号已变化，请刷新页面重试', 'aksrt'), 409);
// 老号验证只接收脱敏中间位，发送目标恒为服务端绑定号，
// 避免客户端提交任意号码导致向第三方手机号发码。
if ($current_phone === '') return $this->error(__('当前绑定手机号已变化，请刷新页面重试', 'aksrt'), 409);
$parts = function_exists('aksrt_phone_mask_parts') ? aksrt_phone_mask_parts($current_phone) : null;
if ($parts !== null) {
$middle = sanitize_text_field((string) ($payload['middle'] ?? ''));
if (!$this->auth_middle_matches($parts, $middle)) {
if (class_exists('\AKSRT\Extensions\SecurityHardening')) {
\AKSRT\Extensions\SecurityHardening::error_frequency_record();
}
return $this->error(__('填写的号码与绑定手机号不一致', 'aksrt'), 400);
}
}
$phone = $current_phone;
} elseif ($stage === 'bind_new_phone') {
$phone = sanitize_text_field((string) ($payload['phone'] ?? ''));
if (!\AKSRT\Sms\SMS::is_phonenumber($phone)) return $this->error(__('手机号格式不正确', 'aksrt'));
if ($current_phone !== '' && !hash_equals($current_phone, $phone)) {
$proof = get_transient('aksrt_account_phone_old_' . $user_id);
if (!is_array($proof) || !hash_equals($current_phone, (string) ($proof['phone'] ?? ''))) return $this->error(__('请先验证老手机号', 'aksrt'), 403);
@@ -484,9 +515,11 @@ trait UserControllerAuthPhoneOperations {
}
$captcha_error = $this->auth_require_captcha('bind_phone', $payload);
if ($captcha_error) return $captcha_error;
if (class_exists('\AKSRT\Extensions\SecurityHardening')) {
$wait = \AKSRT\Extensions\SecurityHardening::error_frequency_wait();
if ($wait > 0) return $this->error(sprintf(__('验证错误次数过多，请 %d 秒后再试', 'aksrt'), $wait), 429);
}
if (!class_exists('\AKSRT\Sms\SMS')) return $this->error(__('短信服务不可用', 'aksrt'), 503);
$rate_subject = $stage . '|' . $user_id . '|' . $phone;
if ($this->auth_rate_limited('account-phone-code', $rate_subject, 5, HOUR_IN_SECONDS)) return $this->error(__('验证码请求过于频繁，请稍后再试', 'aksrt'), 429);
$code = (string) random_int(100000, 999999);
$result = \AKSRT\Sms\SMS::get_instance()->send_code($phone, $code);
if (empty($result['success'])) return $this->error((string) ($result['message'] ?? __('发送失败', 'aksrt')));
@@ -494,6 +527,53 @@ trait UserControllerAuthPhoneOperations {
return $this->success(['message' => __('验证码短信已发送', 'aksrt'), 'countdown' => (int) ($result['remaining_time'] ?? 60)]);
}
/**
* 校验客户端提交的脱敏中间位是否与绑定号一致（不发短信）。
*/
public function user_phone_match(\WP_REST_Request $request): \WP_REST_Response {
$payload = $this->auth_payload($request);
if (!$this->auth_verify_rest_nonce($request, $payload)) return $this->error(__('安全验证失败', 'aksrt'), 403);
$settings = class_exists('\AKSRT\Settings\Settings') ? \AKSRT\Settings\Settings::get_all() : [];
if (empty($settings['bind_phone'])) return $this->error(__('手机号绑定功能暂未开启', 'aksrt'), 403);
$user_id = get_current_user_id();
$current_phone = (string) get_user_meta($user_id, 'phone_number', true);
$parts = function_exists('aksrt_phone_mask_parts') ? aksrt_phone_mask_parts($current_phone) : null;
if ($parts === null) return $this->error(__('当前绑定手机号不支持此验证方式', 'aksrt'), 409);
// 中间位是可枚举面：错误频率限制 + 每用户/IP 每小时尝试上限双保险。
if (class_exists('\AKSRT\Extensions\SecurityHardening')) {
$wait = \AKSRT\Extensions\SecurityHardening::error_frequency_wait();
if ($wait > 0) return $this->error(sprintf(__('验证错误次数过多，请 %d 秒后再试', 'aksrt'), $wait), 429);
}
$ip = function_exists('aksrt_get_client_ip') ? aksrt_get_client_ip() : (string) ($_SERVER['REMOTE_ADDR'] ?? '');
if ($this->auth_rate_limited('phone-match', (string) $user_id . '|' . $ip, 20, HOUR_IN_SECONDS)) {
return $this->error(__('尝试次数过多，请稍后再试', 'aksrt'), 429);
}
$middle = sanitize_text_field((string) ($payload['middle'] ?? ''));
if (!$this->auth_middle_matches($parts, $middle)) {
if (class_exists('\AKSRT\Extensions\SecurityHardening')) {
\AKSRT\Extensions\SecurityHardening::error_frequency_record();
}
return $this->error(__('填写的号码与绑定手机号不一致', 'aksrt'), 400);
}
if (class_exists('\AKSRT\Extensions\SecurityHardening')) {
\AKSRT\Extensions\SecurityHardening::error_frequency_clear();
}
return $this->success(['match' => true]);
}
/**
* 比对脱敏中间位：长度必须与隐藏位数一致，按位恒时比较。
*/
private function auth_middle_matches(array $parts, string $middle): bool {
$middle = preg_replace('/\D+/', '', $middle);
if ($middle === '' || strlen($middle) !== (int) $parts['hidden_length']) {
return false;
}
return hash_equals((string) $parts['hidden'], $middle);
}
public function user_verify_phone(\WP_REST_Request $request): \WP_REST_Response {
$payload = $this->auth_payload($request);
if (!$this->auth_verify_rest_nonce($request, $payload)) return $this->error(__('安全验证失败', 'aksrt'), 403);
@@ -503,10 +583,17 @@ trait UserControllerAuthPhoneOperations {
if ($captcha_error) return $captcha_error;
$user_id = get_current_user_id();
$current_phone = (string) get_user_meta($user_id, 'phone_number', true);
$phone = sanitize_text_field((string) ($payload['phone'] ?? ''));
$code = sanitize_text_field((string) ($payload['code'] ?? ''));
if ($current_phone === '' || !hash_equals($current_phone, $phone)) return $this->error(__('当前绑定手机号已变化，请刷新页面重试', 'aksrt'), 409);
if (!$this->auth_consume_code('account_verify_old_phone_' . $user_id, $current_phone, $code)) return $this->error(__('验证码错误或已过期', 'aksrt'));
if ($current_phone === '') return $this->error(__('当前绑定手机号已变化，请刷新页面重试', 'aksrt'), 409);
if (!$this->auth_consume_code('account_verify_old_phone_' . $user_id, $current_phone, $code)) {
if (class_exists('\AKSRT\Extensions\SecurityHardening')) {
\AKSRT\Extensions\SecurityHardening::error_frequency_record();
}
return $this->error(__('验证码错误或已过期', 'aksrt'));
}
if (class_exists('\AKSRT\Extensions\SecurityHardening')) {
\AKSRT\Extensions\SecurityHardening::error_frequency_clear();
}
set_transient('aksrt_account_phone_old_' . $user_id, ['phone' => $current_phone], 30 * MINUTE_IN_SECONDS);
return $this->success(['message' => __('手机号验证成功', 'aksrt')]);
}
@@ -533,10 +620,18 @@ trait UserControllerAuthPhoneOperations {
$agreement = function_exists('aksrt_get_auth_agreement_view') ? aksrt_get_auth_agreement_view() : ['enabled' => false, 'required' => false];
if (!empty($agreement['required']) && empty($payload['agree_terms'])) return $this->error(__('请先同意相关协议', 'aksrt'), 400);
$code_scene = 'account_bind_new_phone_' . $user_id;
if (!$this->auth_consume_code($code_scene, $phone, $code, false)) return $this->error(__('验证码错误或已过期', 'aksrt'));
if (!$this->auth_consume_code($code_scene, $phone, $code, false)) {
if (class_exists('\AKSRT\Extensions\SecurityHardening')) {
\AKSRT\Extensions\SecurityHardening::error_frequency_record();
}
return $this->error(__('验证码错误或已过期', 'aksrt'));
}
if (!class_exists('\AKSRT\Auth\Service')) return $this->error(__('认证服务不可用', 'aksrt'), 500);
$result = \AKSRT\Auth\Service::bind_phone($payload, true);
if (empty($result['success'])) return $this->error((string) ($result['error'] ?? __('绑定失败', 'aksrt')));
if (class_exists('\AKSRT\Extensions\SecurityHardening')) {
\AKSRT\Extensions\SecurityHardening::error_frequency_clear();
}
delete_transient($this->auth_code_key($code_scene, $phone));
delete_transient('aksrt_account_phone_old_' . $user_id);
return $this->success(['message' => $result['message'] ?? __('绑定成功', 'aksrt')]);