feat(captcha): 打通人机验证 11 个场景的前后端完整链路
- 统一验证入口 aksrt_require_captcha()，返回 true|WP_Error，启用场景配置缺失时 fail-closed 拒绝 - 前端公共 API 重构为 window.AKSRTCaptcha（verify/collect/reset/run），单飞锁防并发重复验证，一次性 proof 绑定浏览器 cookie+场景+服务商+主机名 - challenge/exchange REST 端点：challenge 原子占用防票据放大厂商调用，增加频率限制 - 新增 OAuth bind pass：服务端签发 5 分钟一次性令牌，绑定用户+服务商+浏览器，微信扫码延迟消费 - 覆盖场景：评论、登录、注册、绑定第三方、绑定手机、找回密码、修改密码、更改邮箱、资料下载、签到、前台投稿 - 移除 Service 层重复验证与 _auth_code_verified/_defer_login 等客户端可伪造标志，删除下载共享 pass 死代码 - 修复腾讯 TC3 签名 scope、Cloudflare action/cdata/hostname 严格校验、阿里云验签错误码映射 - 后台 Schema 保存对 secret 字段做掩码/保留合并；导入导出过滤 aksrt_captcha_config - 重建 public bundle 与 admin SPA；新增 captcha 运行时/安全/业务契约测试与 harness
This commit is contained in:
kate522 committed
1 parent
d2e95acd75
commit
ff4ec1eb43
45 files changed
+2694
-1435
No files matched your search
+35
-54
@@ -326,26 +326,12 @@
|
||||
}
|
||||
|
||||
// ===== 主流程 =====
|
||||
function collectCaptchaPayload(sourceEl) {
|
||||
const box = sourceEl ? sourceEl.closest('[data-aksrt-download-box]') : null;
|
||||
const container = box ? box.querySelector('[data-aksrt-download-captcha]') : null;
|
||||
if (!container) return {};
|
||||
const out = {};
|
||||
const keys = [
|
||||
'captcha_verified',
|
||||
'cf_turnstile_response',
|
||||
'tencent_ticket', 'tencent_randstr', 'tencent_sid',
|
||||
'geetest_lot_number', 'geetest_captcha_output', 'geetest_pass_token', 'geetest_gen_time',
|
||||
'aliyun_captcha_verify_param',
|
||||
];
|
||||
keys.forEach(function (k) {
|
||||
const el = container.querySelector('input[name="' + k + '"]');
|
||||
if (el && el.value !== '') out[k] = el.value;
|
||||
});
|
||||
return out;
|
||||
}
|
||||
function captchaScope(sourceEl) {
|
||||
const box = sourceEl ? sourceEl.closest('[data-aksrt-download-box]') : null;
|
||||
return box ? (box.querySelector('[data-aksrt-download-captcha]') || box) : sourceEl;
|
||||
}
|
||||
|
||||
function isCaptchaActive(sourceEl) {
|
||||
function isCaptchaActive(sourceEl) {
|
||||
const card = sourceEl ? sourceEl.closest('[data-aksrt-download-box]') : null;
|
||||
if (!card) return false;
|
||||
return card.getAttribute('data-captcha') === '1';
|
||||
@@ -370,22 +356,20 @@
|
||||
);
|
||||
}
|
||||
|
||||
function ensureCaptchaThen(sourceEl, callback) {
|
||||
if (!isCaptchaActive(sourceEl)) { callback(); return; }
|
||||
const state = window.AKSRTCaptchaState;
|
||||
const scene = state && state.scenes && state.scenes.download;
|
||||
if (!scene || typeof scene.verify !== 'function') {
|
||||
// captcha 组件未就绪：不直发，避免绕过服务端门槛
|
||||
if (window.console && console.warn) {
|
||||
console.warn('[AKSRT] download captcha not ready');
|
||||
function ensureCaptchaThen(sourceEl, callback) {
|
||||
if (!isCaptchaActive(sourceEl)) { callback({}); return; }
|
||||
const captcha = window.AKSRTCaptcha;
|
||||
if (!captcha) {
|
||||
if (window.console && console.warn) console.warn('[AKSRT] download captcha not ready');
|
||||
alert('验证码组件加载中，请稍候再试');
|
||||
return;
|
||||
}
|
||||
alert('验证码组件加载中，请稍候再试');
|
||||
return;
|
||||
captcha.run('download', captchaScope(sourceEl)).then(function (payload) {
|
||||
if (payload !== null) callback(payload);
|
||||
});
|
||||
}
|
||||
scene.verify(function () { callback(); });
|
||||
}
|
||||
|
||||
function performDownloadRequest(button) {
|
||||
function performDownloadRequest(button, captchaPayload) {
|
||||
const card = button.closest('[data-aksrt-download-box]');
|
||||
if (!card) return;
|
||||
const postId = parseInt(card.getAttribute('data-post-id'), 10);
|
||||
@@ -396,10 +380,9 @@
|
||||
const original = button.innerHTML;
|
||||
button.innerHTML = '<i class="fa fas fa-spinner fa-spin" aria-hidden="true"></i> 处理中…';
|
||||
|
||||
const restNonce = window.aksrtData.restNonce || '';
|
||||
const captchaPayload = collectCaptchaPayload(button);
|
||||
const restNonce = window.aksrtData.restNonce || '';
|
||||
|
||||
fetch(REST_BASE + '/download/request', {
|
||||
fetch(REST_BASE + '/download/request', {
|
||||
method: 'POST',
|
||||
credentials: 'same-origin',
|
||||
headers: {
|
||||
@@ -416,28 +399,26 @@
|
||||
.then(function (r) {
|
||||
button.disabled = false;
|
||||
button.innerHTML = original;
|
||||
if (!r.ok || (r.json && r.json.code)) {
|
||||
renderError(r.json.message || '请稍后重试', r.json.data || {}, button, r.json.code);
|
||||
// 验证码已被消费，重置以便用户重试
|
||||
try {
|
||||
const scene = window.AKSRTCaptchaState && window.AKSRTCaptchaState.scenes && window.AKSRTCaptchaState.scenes.download;
|
||||
if (scene && typeof scene.reset === 'function') scene.reset();
|
||||
} catch (_) { /* ignore */ }
|
||||
return;
|
||||
}
|
||||
if (!r.ok || (r.json && r.json.code)) {
|
||||
renderError(r.json.message || '请稍后重试', r.json.data || {}, button, r.json.code);
|
||||
return;
|
||||
}
|
||||
renderSuccess(r.json, button);
|
||||
})
|
||||
.catch(function () {
|
||||
button.disabled = false;
|
||||
button.innerHTML = original;
|
||||
renderError('网络错误，请稍后重试', {}, button);
|
||||
});
|
||||
}
|
||||
.catch(function () {
|
||||
button.disabled = false;
|
||||
button.innerHTML = original;
|
||||
renderError('网络错误，请稍后重试', {}, button);
|
||||
})
|
||||
.finally(function () {
|
||||
if (window.AKSRTCaptcha) window.AKSRTCaptcha.reset('download', captchaScope(button));
|
||||
});
|
||||
}
|
||||
|
||||
function requestDownload(button) {
|
||||
ensureCaptchaThen(button, function () {
|
||||
performDownloadRequest(button);
|
||||
});
|
||||
function requestDownload(button) {
|
||||
ensureCaptchaThen(button, function (captchaPayload) {
|
||||
performDownloadRequest(button, captchaPayload);
|
||||
});
|
||||
}
|
||||
|
||||
function pollOrderPaid(orderNumber, returnFocusEl) {
|
||||
|
||||
Reference in new issue
Block a user