feat(security): 新增网站安全扩展模块并支持修改手机脱敏验证

src/Attachment/UploadLimits.php

@@ -45,6 +45,7 @@ class UploadLimits {
 	public function init(): void {
 		add_filter('upload_mimes', [$this, 'filter_upload_mimes']);
 		add_filter('getimagesize_mimes_to_exts', [$this, 'filter_image_mimes_to_exts']);
+		add_filter('wp_handle_upload_prefilter', [$this, 'brush_limit_upload'], 90);
 		add_filter('wp_handle_upload_prefilter', [$this, 'rename_upload_file'], 99);
 		add_action('template_redirect', [$this, 'close_attachment_page']);
 	}
@@ -305,6 +306,27 @@ class UploadLimits {
 		return $file;
 	}
 
+	/**
+	 * [防刷机制]上传限制（后台「扩展&增强 → 网站安全」），管理员不受限。
+	 */
+	public function brush_limit_upload(array $file): array {
+		if (!empty($file['error']) || !class_exists('\AKSRT\Extensions\SecurityHardening')) {
+			return $file;
+		}
+		if (current_user_can('manage_options')) {
+			return $file;
+		}
+
+		$security = \AKSRT\Settings\ExtensionRuntime::get_security_settings();
+		$user_id = get_current_user_id();
+		$subject = $user_id > 0 ? (string) $user_id : (function_exists('aksrt_get_client_ip') ? aksrt_get_client_ip() : (string) ($_SERVER['REMOTE_ADDR'] ?? ''));
+		$brush = \AKSRT\Extensions\SecurityHardening::brush_allow('upload', $subject, (int) $security['security_brush_upload_10min'], (int) $security['security_brush_upload_day']);
+		if ($brush !== true) {
+			$file['error'] = (string) $brush;
+		}
+		return $file;
+	}
+
 	/**
 	 * Hide attachment pages from non-admins (returns 404 instead).
 	 */