kate522/wordpress-theme-aksrt
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(captcha): 打通人机验证 11 个场景的前后端完整链路

Browse Source 
- 统一验证入口 aksrt_require_captcha()，返回 true|WP_Error，启用场景配置缺失时 fail-closed 拒绝
- 前端公共 API 重构为 window.AKSRTCaptcha（verify/collect/reset/run），单飞锁防并发重复验证，一次性 proof 绑定浏览器 cookie+场景+服务商+主机名
- challenge/exchange REST 端点：challenge 原子占用防票据放大厂商调用，增加频率限制
- 新增 OAuth bind pass：服务端签发 5 分钟一次性令牌，绑定用户+服务商+浏览器，微信扫码延迟消费
- 覆盖场景：评论、登录、注册、绑定第三方、绑定手机、找回密码、修改密码、更改邮箱、资料下载、签到、前台投稿
- 移除 Service 层重复验证与 _auth_code_verified/_defer_login 等客户端可伪造标志，删除下载共享 pass 死代码
- 修复腾讯 TC3 签名 scope、Cloudflare action/cdata/hostname 严格校验、阿里云验签错误码映射
- 后台 Schema 保存对 secret 字段做掩码/保留合并；导入导出过滤 aksrt_captcha_config
- 重建 public bundle 与 admin SPA；新增 captcha 运行时/安全/业务契约测试与 harness
This commit is contained in:
kate522
2026-09-02 13:03:24 +08:00
parent d2e95acd75
commit ff4ec1eb43
45 changed files with 2694 additions and 1435 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/Admin/ImportExportController.php
+50 -4
View File
@@ -87,6 +87,12 @@ class ImportExportController extends ControllerBase {
'permission_callback' => [$this, 'check_permission'],
]);
register_rest_route(self::API_NAMESPACE, '/captcha/test', [
'methods' => 'POST',
'callback' => [$this, 'rest_test_captcha'],
'permission_callback' => [$this, 'check_permission'],
]);
// Backup snapshots
register_rest_route(self::API_NAMESPACE, '/settings/backups', [
'methods' => 'GET',
@@ -118,6 +124,42 @@ class ImportExportController extends ControllerBase {
/* Handlers */
/* ------------------------------------------------------------------ */
public function rest_test_captcha(\WP_REST_Request $request): \WP_REST_Response {
$params = $this->get_json_params($request);
$provider = sanitize_key((string) ($params['provider'] ?? ''));
$token = isset($params['token']) && is_array($params['token']) ? $params['token'] : [];
$allowed_token_fields = [
'tencent_ticket', 'tencent_randstr',
'cf_turnstile_response',
'geetest_lot_number', 'geetest_captcha_output', 'geetest_pass_token', 'geetest_gen_time',
'aliyun_captcha_verify_param',
];
$token = array_intersect_key($token, array_flip($allowed_token_fields));
foreach ($token as $key => $value) {
$token[$key] = is_scalar($value) ? sanitize_text_field((string) $value) : '';
}
$config = function_exists('aksrt_get_captcha_config') ? aksrt_get_captcha_config() : [];
$stored_provider = (string) ($config['active_provider'] ?? '');
if ($provider === '' || $provider !== $stored_provider || !in_array($provider, aksrt_captcha_providers(), true)) {
return $this->error(__('请先保存并启用要测试的人机验证服务商', 'aksrt'), 422);
}
$provider_config = isset($config[$provider]) && is_array($config[$provider]) ? $config[$provider] : [];
if (!aksrt_captcha_provider_is_configured($provider, $provider_config)) {
return $this->error(__('当前人机验证服务商配置不完整', 'aksrt'), 422);
}
$scene = 'admin-captcha-test';
$action = 'aksrt-admin-test';
$result = aksrt_verify_captcha_provider($provider, $provider_config, $token, aksrt_get_client_ip(), $scene, $action);
if (is_wp_error($result)) {
return $this->error($result->get_error_message(), 422);
}
return $this->success(['message' => __('服务端同源验签通过', 'aksrt')]);
}
/**
* Export all AKSRT settings as a JSON-serializable array.
*/
@@ -139,7 +181,7 @@ class ImportExportController extends ControllerBase {
}
// Also export standalone options from the registry
$standalone_keys = \AKSRT\Settings\Settings::STANDALONE_OPTION_KEYS;
$standalone_keys = \AKSRT\Settings\Settings::standalone_export_keys();
$export['standalone'] = [];
foreach ($standalone_keys as $key) {
@@ -180,21 +222,25 @@ class ImportExportController extends ControllerBase {
// Import domain settings
if (!empty($params['domains']) && is_array($params['domains'])) {
foreach ($params['domains'] as $domain => $payload) {
if (!in_array($domain, $schema_provider->get_domain_keys(), true)) {
$results[$domain] = ['status' => 'skipped', 'message' => 'Unknown domain'];
continue;
}
$data = $payload['data'] ?? $payload;
if (!is_array($data)) {
$results[$domain] = ['status' => 'error', 'message' => 'Invalid data format'];
continue;
}
// Validate
$validation = $schema_provider->validate($domain, $data);
$clean = $schema_provider->sanitize_payload((string) $domain, $data);
$validation = $schema_provider->validate((string) $domain, $clean);
if (!$validation['valid']) {
$results[$domain] = ['status' => 'error', 'errors' => $validation['errors']];
continue;
}
if (!$dry_run) {
$schema_provider->write_settings($domain, $data);
$schema_provider->write_settings((string) $domain, $clean);
$results[$domain] = ['status' => 'imported'];
} else {
$results[$domain] = ['status' => 'valid'];
src/Admin/ImportExportControllerPart1.php
+10 -4
View File
@@ -90,18 +90,24 @@ trait ImportExportControllerPart1 {
$payload = $target['payload'];
$domains = $payload['domains'] ?? [];
$standalone = $payload['standalone'] ?? [];
$standalone = \AKSRT\Settings\Settings::filter_sensitive_import(
is_array($payload['standalone'] ?? null) ? $payload['standalone'] : []
);
$provider = SchemaProvider::get_instance();
foreach ($domains as $domain => $domainPayload) {
$data = $domainPayload['data'] ?? $domainPayload;
if (is_array($data)) {
$provider->write_settings((string) $domain, $data);
if (is_array($data) && in_array((string) $domain, $provider->get_domain_keys(), true)) {
$clean = $provider->sanitize_payload((string) $domain, $data);
$validation = $provider->validate((string) $domain, $clean);
if ($validation['valid']) {
$provider->write_settings((string) $domain, $clean);
}
}
}
foreach ($standalone as $key => $value) {
if (is_string($key) && preg_match('/^aksrt_/', $key)) {
if (is_string($key) && in_array($key, \AKSRT\Settings\Settings::standalone_export_keys(), true)) {
update_option($key, $value);
}
}
src/Admin/ImportExportControllerPart2.php
+1 -1
View File
@@ -43,7 +43,7 @@ trait ImportExportControllerPart2 {
];
}
foreach (\AKSRT\Settings\Settings::STANDALONE_OPTION_KEYS as $key) {
foreach (\AKSRT\Settings\Settings::standalone_export_keys() as $key) {
$value = get_option($key);
if ($value !== false) {
$payload['standalone'][$key] = $value;
src/Admin/Schema/SchemaPermissions.php
+20 -14
View File
@@ -10,6 +10,23 @@ defined('ABSPATH') || exit;
class SchemaPermissions {
public static function build(): array {
$provider_meta = function_exists('aksrt_captcha_provider_metadata') ? aksrt_captcha_provider_metadata() : [];
$provider_options = [['label' => '关闭', 'value' => '']];
$provider_fields = [];
foreach ($provider_meta as $provider => $meta) {
$provider_options[] = [
'label' => (string) ($meta['label'] ?? $provider),
'value' => $provider,
];
$provider_fields[] = [
'key' => $provider,
'label' => (string) ($meta['label'] ?? $provider) . ' 配置',
'type' => 'custom',
'default' => function_exists('aksrt_captcha_provider_defaults') ? aksrt_captcha_provider_defaults($provider) : [],
'captcha_provider' => $provider,
];
}
return [
'domain' => 'permissions',
'title' => '功能与权限',
@@ -22,14 +39,8 @@ class SchemaPermissions {
'groups' => [
['key' => 'basic', 'title' => '基础开关', 'fields' => [
['key' => 'enabled', 'label' => '启用人机验证', 'type' => 'switch', 'default' => false],
['key' => 'active_provider', 'label' => '当前服务商', 'type' => 'radio', 'default' => '', 'dependsOn' => ['key' => 'enabled', 'value' => true], 'options' => [
['label' => '关闭', 'value' => ''],
['label' => '腾讯云 Captcha', 'value' => 'tencent'],
['label' => '阿里云 CAPTCHA 2.0', 'value' => 'aliyun'],
['label' => 'Cloudflare Turnstile', 'value' => 'cloudflare'],
['label' => '极验 GeeTest', 'value' => 'geetest'],
]],
['key' => 'enabled_scenarios', 'label' => '启用场景', 'type' => 'checkbox', 'default' => ['comment', 'login', 'register', 'bind', 'bind_phone', 'lostpassword', 'change_password', 'change_email', 'download', 'signin'], 'dependsOn' => ['key' => 'enabled', 'value' => true], 'options' => [
['key' => 'active_provider', 'label' => '当前服务商', 'type' => 'radio', 'default' => '', 'dependsOn' => ['key' => 'enabled', 'value' => true], 'options' => $provider_options],
['key' => 'enabled_scenarios', 'label' => '启用场景', 'type' => 'checkbox', 'default' => [], 'dependsOn' => ['key' => 'enabled', 'value' => true], 'options' => [
['label' => '发表评论', 'value' => 'comment'],
['label' => '用户登录', 'value' => 'login'],
['label' => '用户注册', 'value' => 'register'],
@@ -43,12 +54,7 @@ class SchemaPermissions {
['label' => '前台投稿', 'value' => 'front_submit'],
]],
]],
['key' => 'providers', 'title' => '服务商配置', 'fields' => [
['key' => 'tencent', 'label' => '腾讯云配置', 'type' => 'custom', 'default' => [], 'sanitize_type' => 'array'],
['key' => 'aliyun', 'label' => '阿里云配置', 'type' => 'custom', 'default' => [], 'sanitize_type' => 'array'],
['key' => 'cloudflare', 'label' => 'Cloudflare 配置', 'type' => 'custom', 'default' => [], 'sanitize_type' => 'array'],
['key' => 'geetest', 'label' => '极验配置', 'type' => 'custom', 'default' => [], 'sanitize_type' => 'array'],
]],
['key' => 'providers', 'title' => '服务商配置', 'fields' => $provider_fields],
],
],
'attachment' => [
src/Admin/SchemaProvider.php
+104 -22
View File
@@ -140,10 +140,8 @@ class SchemaProvider {
}
}
if (!empty($data['__clear_secrets']) && is_array($data['__clear_secrets'])) {
$clean['__clear_secrets'] = array_values(array_intersect(
array_map('sanitize_key', $data['__clear_secrets']),
$this->secret_field_keys($schema)
));
$requested = array_values(array_filter(array_map([$this, 'normalize_secret_path'], $data['__clear_secrets'])));
$clean['__clear_secrets'] = array_values(array_intersect($requested, $this->secret_field_paths($schema)));
}
return $clean;
@@ -505,14 +503,14 @@ class SchemaProvider {
if ($section !== '') {
$defaults = $this->get_defaults($domain, $section);
$schema = $this->get_section_schema($domain, $section);
$defaults['__clear_secrets'] = $schema ? $this->secret_field_keys($schema) : [];
$defaults['__clear_secrets'] = $schema ? $this->secret_field_paths($schema) : [];
return $this->write_settings($domain, $defaults, $section);
}
$result = true;
foreach ($this->get_sections($domain) as $section_schema) {
$defaults = $this->collect_defaults($section_schema);
$defaults['__clear_secrets'] = $this->secret_field_keys($section_schema);
$defaults['__clear_secrets'] = $this->secret_field_paths($section_schema);
$result = $this->write_section_settings($section_schema, $defaults) && $result;
}
return $result;
@@ -541,24 +539,33 @@ class SchemaProvider {
}
$data = $this->collect_defaults($schema);
foreach ($this->get_all_fields($schema) as $field) {
if (array_key_exists($field['key'], $stored)) {
$data[$field['key']] = $stored[$field['key']];
}
foreach ($this->get_all_fields($schema) as $field) {
if (array_key_exists($field['key'], $stored)) {
$data[$field['key']] = $stored[$field['key']];
}
$stored_value = array_key_exists($field['key'], $stored) ? $stored[$field['key']] : ($data[$field['key']] ?? '');
if (!empty($field['secret'])) {
$data[$field['key']] = trim((string) $stored_value) !== '' ? '***' : '';
}
}
if (!empty($field['captcha_provider'])) {
$data[$field['key']] = $this->mask_captcha_provider_secrets(
(string) $field['captcha_provider'],
is_array($stored_value) ? $stored_value : []
);
}
}
// Captcha: always surface the normalized positive scene list.
if ($option_key === 'aksrt_captcha_config' && function_exists('aksrt_get_captcha_config')) {
$normalized = aksrt_get_captcha_config();
foreach (['enabled', 'active_provider', 'enabled_scenarios', 'tencent', 'aliyun', 'cloudflare', 'geetest'] as $key) {
if (array_key_exists($key, $normalized)) {
$data[$key] = $normalized[$key];
}
}
foreach (['enabled', 'active_provider', 'enabled_scenarios'] as $key) {
if (array_key_exists($key, $normalized)) {
$data[$key] = $normalized[$key];
}
}
foreach (function_exists('aksrt_captcha_providers') ? aksrt_captcha_providers() : [] as $provider) {
$data[$provider] = $this->mask_captcha_provider_secrets($provider, (array) ($normalized[$provider] ?? []));
}
}
return $data;
@@ -576,13 +583,20 @@ class SchemaProvider {
$fields[(string) $field['key']] = $field;
}
$clear_secrets = isset($data['__clear_secrets']) && is_array($data['__clear_secrets'])
? array_values(array_map('sanitize_key', $data['__clear_secrets']))
? array_values(array_filter(array_map([$this, 'normalize_secret_path'], $data['__clear_secrets'])))
: [];
foreach ($fields as $key => $field) {
if (!empty($field['secret']) && in_array($key, $clear_secrets, true)) {
unset($stored[$key]);
continue;
}
if (!empty($field['captcha_provider'])) {
$provider = (string) $field['captcha_provider'];
$current = isset($stored[$key]) && is_array($stored[$key]) ? $stored[$key] : [];
$incoming = array_key_exists($key, $data) && is_array($data[$key]) ? $data[$key] : [];
$stored[$key] = $this->merge_captcha_provider_config($provider, $current, $incoming, $clear_secrets);
continue;
}
if (!array_key_exists($key, $data)) {
continue;
}
@@ -599,9 +613,17 @@ class SchemaProvider {
// Captcha stores a single positive scene list.
if ($option_key === 'aksrt_captcha_config' && function_exists('aksrt_captcha_scenes')) {
$stored['enabled'] = !empty($stored['enabled']);
$active_provider = sanitize_key((string) ($stored['active_provider'] ?? ''));
$stored['active_provider'] = in_array($active_provider, aksrt_captcha_providers(), true) ? $active_provider : '';
$stored['enabled_scenarios'] = function_exists('aksrt_captcha_sanitize_scene_list')
? aksrt_captcha_sanitize_scene_list($stored['enabled_scenarios'] ?? [])
: (array) ($stored['enabled_scenarios'] ?? []);
foreach (aksrt_captcha_providers() as $provider) {
$stored[$provider] = function_exists('aksrt_captcha_sanitize_provider_config')
? aksrt_captcha_sanitize_provider_config($provider, $stored[$provider] ?? [])
: (array) ($stored[$provider] ?? []);
}
}
$updated = update_option($option_key, $stored);
@@ -617,14 +639,69 @@ class SchemaProvider {
return $updated || true;
}
private function secret_field_keys(array $schema): array {
$keys = [];
private function normalize_secret_path($path): string {
$parts = array_values(array_filter(explode('.', strtolower(trim((string) $path))), static fn(string $part): bool => $part !== ''));
$parts = array_map('sanitize_key', $parts);
return in_array('', $parts, true) ? '' : implode('.', $parts);
}
private function secret_field_paths(array $schema): array {
$paths = [];
foreach ($this->get_all_fields($schema) as $field) {
if (!empty($field['secret']) && !empty($field['key'])) {
$keys[] = sanitize_key((string) $field['key']);
$key = sanitize_key((string) ($field['key'] ?? ''));
if ($key === '') {
continue;
}
if (!empty($field['secret'])) {
$paths[] = $key;
}
if (!empty($field['captcha_provider']) && function_exists('aksrt_captcha_provider_secret_fields')) {
foreach (aksrt_captcha_provider_secret_fields((string) $field['captcha_provider']) as $secret) {
$paths[] = $key . '.' . sanitize_key((string) $secret);
}
}
}
return array_values(array_unique($keys));
return array_values(array_unique($paths));
}
private function mask_captcha_provider_secrets(string $provider, array $config): array {
$clean = function_exists('aksrt_captcha_sanitize_provider_config')
? aksrt_captcha_sanitize_provider_config($provider, $config)
: $config;
foreach (function_exists('aksrt_captcha_provider_secret_fields') ? aksrt_captcha_provider_secret_fields($provider) : [] as $secret) {
$clean[$secret] = trim((string) ($config[$secret] ?? '')) !== '' ? '***' : '';
}
return $clean;
}
private function merge_captcha_provider_config(string $provider, array $stored, array $incoming, array $clear_paths): array {
$current = function_exists('aksrt_captcha_sanitize_provider_config')
? aksrt_captcha_sanitize_provider_config($provider, $stored)
: $stored;
$defaults = function_exists('aksrt_captcha_provider_defaults') ? aksrt_captcha_provider_defaults($provider) : [];
$secret_fields = function_exists('aksrt_captcha_provider_secret_fields') ? aksrt_captcha_provider_secret_fields($provider) : [];
foreach (array_keys($defaults) as $key) {
$path = $provider . '.' . $key;
if (in_array($path, $clear_paths, true)) {
$current[$key] = '';
continue;
}
if (!array_key_exists($key, $incoming) || is_array($incoming[$key]) || is_object($incoming[$key])) {
continue;
}
$value = trim((string) $incoming[$key]);
if (in_array($key, $secret_fields, true) && ($value === '' || $value === '***')) {
continue;
}
$current[$key] = $value;
}
return function_exists('aksrt_captcha_sanitize_provider_config')
? aksrt_captcha_sanitize_provider_config($provider, $current)
: $current;
}
private function secret_field_keys(array $schema): array {
return array_values(array_filter($this->secret_field_paths($schema), static fn(string $path): bool => !str_contains($path, '.')));
}
private function collect_defaults(array $schema): array {
@@ -721,6 +798,11 @@ class SchemaProvider {
}
private function sanitize_field_value($value, array $field) {
if (!empty($field['captcha_provider'])) {
return function_exists('aksrt_captcha_sanitize_provider_config')
? aksrt_captcha_sanitize_provider_config((string) $field['captcha_provider'], $value)
: [];
}
$type = (string) ($field['type'] ?? 'text');
$sanitize_type = (string) ($field['sanitize_type'] ?? '');
if ($sanitize_type === 'business_prefix') {
src/Admin/UserControllerAuthPhoneOperations.php
+51 -36
View File
@@ -29,6 +29,30 @@ trait UserControllerAuthPhoneOperations {
return $nonce !== '' && (bool) wp_verify_nonce($nonce, 'wp_rest');
}
private function auth_require_captcha(string $scene, array $payload): ?\WP_REST_Response {
$result = aksrt_require_captcha($scene, $payload);
if ($result === true) {
return null;
}
if (is_wp_error($result)) {
$data = $result->get_error_data();
$status = is_array($data) ? (int) ($data['status'] ?? 400) : 400;
$message = $result->get_error_message() ?: __('人机验证失败', 'aksrt');
return new \WP_REST_Response([
'success' => false,
'code' => $result->get_error_code() ?: 'aksrt_captcha_failed',
'message' => $message,
], $status > 0 ? $status : 400);
}
return new \WP_REST_Response([
'success' => false,
'code' => 'aksrt_captcha_failed',
'message' => __('人机验证失败', 'aksrt'),
], 400);
}
private function auth_rate_key(string $action, string $subject = ''): string {
$ip = sanitize_text_field((string) ($_SERVER['REMOTE_ADDR'] ?? '0.0.0.0'));
return 'aksrt_auth_rate_' . md5($action . '|' . strtolower($subject) . '|' . $ip);
@@ -144,12 +168,10 @@ trait UserControllerAuthPhoneOperations {
if ($this->auth_rate_limited('code:' . $scene, $target, 5, HOUR_IN_SECONDS)) {
return $this->error(__('请求过于频繁，请稍后再试', 'aksrt'), 429);
}
if (function_exists('aksrt_require_captcha')) {
$captcha_scene = $scene === 'resetpassword' ? 'lostpassword' : $scene;
$captcha = aksrt_require_captcha($captcha_scene, $payload);
if ($captcha !== true) {
return $this->error((string) $captcha);
}
$captcha_scene = $scene === 'resetpassword' ? 'lostpassword' : $scene;
$captcha_error = $this->auth_require_captcha($captcha_scene, $payload);
if ($captcha_error) {
return $captcha_error;
}
$generic = __('如果信息有效，验证码将发送到该账号', 'aksrt');
@@ -207,11 +229,9 @@ trait UserControllerAuthPhoneOperations {
if ($this->auth_rate_limited('login', $target)) {
return $this->error(__('请求过于频繁，请稍后再试', 'aksrt'), 429);
}
if (function_exists('aksrt_require_captcha')) {
$captcha = aksrt_require_captcha($oauth_data ? 'bind' : 'login', $payload);
if ($captcha !== true) {
return $this->error((string) $captcha);
}
$captcha_error = $this->auth_require_captcha($oauth_data ? 'bind' : 'login', $payload);
if ($captcha_error) {
return $captcha_error;
}
$redirect = $this->auth_safe_redirect((string) ($payload['redirect_to'] ?? ''), home_url('/'));
@@ -271,7 +291,7 @@ trait UserControllerAuthPhoneOperations {
$redirect = function_exists('aksrt_get_user_center_url') ? aksrt_get_user_center_url() : $redirect;
return $this->success(['message' => __('账号绑定成功', 'aksrt'), 'redirect' => $redirect]);
}
$result = \AKSRT\Auth\Service::login_user($payload, 'login');
$result = \AKSRT\Auth\Service::login_user($payload);
if (empty($result['success'])) {
return $this->error(__('账号或密码错误', 'aksrt'), 401);
}
@@ -309,25 +329,23 @@ trait UserControllerAuthPhoneOperations {
if (($channel === 'email' && !is_email($target)) || ($channel === 'phone' && !preg_match('/^1[3-9]\d{9}$/', $target))) {
return $this->error(__('请输入有效的邮箱或手机号', 'aksrt'));
}
if (function_exists('aksrt_require_captcha')) {
$captcha = aksrt_require_captcha('register', $payload);
if ($captcha !== true) {
return $this->error((string) $captcha);
}
$captcha_error = $this->auth_require_captcha('register', $payload);
if ($captcha_error) {
return $captcha_error;
}
$verification_completed = false;
if ($signup_verification) {
if (!$this->auth_consume_code('register', $target, sanitize_text_field((string) ($payload['code'] ?? '')), $channel)) {
return $this->error(__('验证码错误或已过期', 'aksrt'));
}
$payload['_auth_code_verified'] = true;
$verification_completed = true;
}
if (!class_exists('\AKSRT\Auth\Service')) {
return $this->error(__('认证服务不可用', 'aksrt'), 500);
}
if ($channel === 'phone') {
$payload['phone'] = $target;
$payload['_defer_login'] = !empty($oauth_data);
$result = \AKSRT\Auth\Service::register_by_phone($payload);
$result = \AKSRT\Auth\Service::register_by_phone($payload, $verification_completed, !empty($oauth_data));
if (empty($result['success'])) {
return $this->error($this->auth_registration_error((string) ($result['error'] ?? __('注册失败', 'aksrt'))));
}
@@ -348,21 +366,20 @@ trait UserControllerAuthPhoneOperations {
$payload['user_email'] = sanitize_email($target);
$payload['user_pass'] = (string) ($payload['password'] ?? '');
$payload['user_pass_confirm'] = (string) ($payload['password_confirm'] ?? $payload['password'] ?? '');
$payload['_defer_login'] = !empty($oauth_data);
$result = \AKSRT\Auth\Service::register_user($payload);
$result = \AKSRT\Auth\Service::register_user($payload, $verification_completed, !empty($oauth_data));
if (empty($result['success'])) {
return $this->error($this->auth_registration_error((string) ($result['error'] ?? __('注册失败', 'aksrt'))));
}
$user_id = (int) ($result['user_id'] ?? 0);
if ($oauth_data && $user_id > 0) {
$binding = \AKSRT\Auth\Service::finalize_oauth_binding($user_id, $oauth_data, $obk);
if (is_wp_error($binding)) {
wp_delete_user($user_id);
return $this->error($binding->get_error_message(), 409);
}
if (is_wp_error($binding)) {
$this->delete_oauth_registration_user($user_id);
return $this->error($binding->get_error_message(), 409);
}
$user = get_user_by('id', $user_id);
if ($user instanceof \WP_User) {
if ($channel === 'email' && !empty($payload['_auth_code_verified'])) {
if ($channel === 'email' && $verification_completed) {
\AKSRT\Auth\Service::mark_verified_email($user_id);
}
\AKSRT\Auth\OAuthAccountService::complete_login($user, true);
@@ -393,11 +410,9 @@ trait UserControllerAuthPhoneOperations {
if ($this->auth_rate_limited('reset-password', $target, 8, HOUR_IN_SECONDS)) {
return $this->error(__('请求过于频繁，请稍后再试', 'aksrt'), 429);
}
if (function_exists('aksrt_require_captcha')) {
$captcha = aksrt_require_captcha('lostpassword', $payload);
if ($captcha !== true) {
return $this->error((string) $captcha);
}
$captcha_error = $this->auth_require_captcha('lostpassword', $payload);
if ($captcha_error) {
return $captcha_error;
}
$user = $this->auth_find_user($target, $channel);
$password = (string) ($payload['password'] ?? '');
@@ -425,10 +440,8 @@ trait UserControllerAuthPhoneOperations {
if (!preg_match('/^1[3-9]\d{9}$/', $phone)) {
return $this->error(__('手机号格式不正确', 'aksrt'));
}
if (function_exists('aksrt_require_captcha')) {
$captcha = aksrt_require_captcha('bind_phone', $payload);
if ($captcha !== true) return $this->error((string) $captcha);
}
$captcha_error = $this->auth_require_captcha('bind_phone', $payload);
if ($captcha_error) return $captcha_error;
if (!class_exists('\AKSRT\Sms\SMS')) return $this->error(__('短信服务不可用', 'aksrt'), 503);
$result = \AKSRT\Sms\SMS::get_instance()->send_code($phone);
return !empty($result['success'])
@@ -439,6 +452,8 @@ trait UserControllerAuthPhoneOperations {
public function user_bind_phone(\WP_REST_Request $request): \WP_REST_Response {
$payload = $this->auth_payload($request);
if (!$this->auth_verify_rest_nonce($request, $payload)) return $this->error(__('安全验证失败', 'aksrt'), 403);
$captcha_error = $this->auth_require_captcha('bind_phone', $payload);
if ($captcha_error) return $captcha_error;
if (!class_exists('\AKSRT\Auth\Service')) return $this->error(__('认证服务不可用', 'aksrt'), 500);
$result = \AKSRT\Auth\Service::bind_phone($payload);
return !empty($result['success']) ? $this->success(['message' => $result['message'] ?? __('绑定成功', 'aksrt')]) : $this->error((string) ($result['error'] ?? __('绑定失败', 'aksrt')));
src/Auth/Moderation.php
+21 -4
View File
@@ -29,6 +29,13 @@ class Moderation {
*/
private $forced_approved_map = [];
/**
* Request-local depth for comment submissions already admitted by the REST controller.
*
* @var int
*/
private $captcha_verified_comment_request_depth = 0;
public static function get_instance(): self {
if (null === self::$instance) {
self::$instance = new self();
@@ -50,6 +57,14 @@ class Moderation {
add_action('manage_comments_custom_column', [$this, 'render_comments_custom_column'], 10, 2);
}
public function begin_captcha_verified_comment_request(): void {
$this->captcha_verified_comment_request_depth++;
}
public function end_captcha_verified_comment_request(): void {
$this->captcha_verified_comment_request_depth = max(0, $this->captcha_verified_comment_request_depth - 1);
}
public function get_config(): array {
$defaults = [
'enabled' => false,
@@ -90,17 +105,19 @@ class Moderation {
);
}
// 人机验证：覆盖 REST 与原生 wp-comments-post 两条提交合同（与审核开关无关）
if (function_exists('aksrt_require_captcha')) {
// 人机验证：原生 wp-comments-post 必须验证；REST 已在 Controller 准入时验证一次。
if ($this->captcha_verified_comment_request_depth === 0) {
$payload = is_array($_POST ?? null) ? wp_unslash($_POST) : [];
if (isset($payload['captcha']) && is_array($payload['captcha'])) {
$payload = array_merge($payload, $payload['captcha']);
}
$captcha_result = aksrt_require_captcha('comment', $payload);
if ($captcha_result !== true) {
$msg = is_string($captcha_result) ? $captcha_result : __('人机验证失败', 'aksrt');
$msg = is_wp_error($captcha_result)
? $captcha_result->get_error_message()
: __('人机验证失败', 'aksrt');
wp_die(
esc_html($msg),
esc_html($msg !== '' ? $msg : __('人机验证失败', 'aksrt')),
esc_html__('评论提交失败', 'aksrt'),
['response' => 400, 'back_link' => true]
);
src/Auth/OAuth.php
+124 -5
View File
@@ -9,6 +9,9 @@ defined('ABSPATH') || exit;
final class OAuth {
private const BIND_PASS_KIND = 'oauth_bind_pass';
private const BIND_PASS_TTL = 5 * MINUTE_IN_SECONDS;
private static $instance = null;
private OAuthProviderBroker $broker;
@@ -32,6 +35,7 @@ final class OAuth {
}
}, 30);
add_action('template_redirect', [$this, 'handle_routes'], 8);
add_action('rest_api_init', [$this, 'register_rest_routes']);
add_action('wp_ajax_aksrt_oauth_unbind', [$this, 'ajax_unbind']);
}
@@ -47,6 +51,109 @@ final class OAuth {
});
}
public function register_rest_routes(): void {
register_rest_route('aksrt/v1', '/oauth/bind-pass', [
'methods' => 'POST',
'callback' => [$this, 'rest_issue_bind_pass'],
'permission_callback' => static function (): bool {
return is_user_logged_in();
},
]);
}
public function rest_issue_bind_pass(\WP_REST_Request $request): \WP_REST_Response {
$user_id = get_current_user_id();
$nonce = sanitize_text_field((string) $request->get_header('X-WP-Nonce'));
if ($user_id <= 0 || $nonce === '' || !wp_verify_nonce($nonce, 'wp_rest')) {
return new \WP_REST_Response([
'success' => false,
'code' => 'oauth_bind_nonce_invalid',
'message' => __('安全验证失败，请刷新页面重试', 'aksrt'),
], 403);
}
$payload = $request->get_json_params();
$payload = is_array($payload) ? $payload : [];
$provider = sanitize_key((string) ($payload['provider'] ?? ''));
if (!in_array($provider, OAuthProviderCatalog::enabled_login_keys(), true)) {
return new \WP_REST_Response([
'success' => false,
'code' => 'oauth_bind_provider_invalid',
'message' => __('该第三方登录方式不可用', 'aksrt'),
], 400);
}
$url = $this->get_auth_url($provider, 'bind');
if ($url === '') {
return new \WP_REST_Response([
'success' => false,
'code' => 'oauth_bind_provider_invalid',
'message' => __('该第三方登录方式不可用', 'aksrt'),
], 400);
}
$redirect = OAuthUrlPolicy::validated_redirect((string) ($payload['redirect_to'] ?? ''), home_url('/'));
$url = add_query_arg('redirect_to', $redirect, $url);
if (!aksrt_is_captcha_enabled_for('bind')) {
return new \WP_REST_Response([
'success' => true,
'data' => ['url' => $url],
], 200);
}
$result = aksrt_require_captcha('bind', $payload);
if ($result !== true) {
return new \WP_REST_Response([
'success' => false,
'code' => is_wp_error($result) ? $result->get_error_code() : 'aksrt_captcha_failed',
'message' => is_wp_error($result) ? $result->get_error_message() : __('人机验证失败，请重试', 'aksrt'),
], 400);
}
try {
$pass = OAuthTransactionStore::issue(self::BIND_PASS_KIND, [
'user_id' => $user_id,
'provider' => $provider,
], self::BIND_PASS_TTL, true);
} catch (\Throwable $e) {
return new \WP_REST_Response([
'success' => false,
'code' => 'oauth_bind_pass_issue_failed',
'message' => __('无法创建绑定会话，请稍后重试', 'aksrt'),
], 500);
}
$url = add_query_arg('bind_pass', $pass, $url);
return new \WP_REST_Response([
'success' => true,
'data' => ['url' => $url],
], 200);
}
public static function validate_bind_pass(string $token, string $provider, int $user_id, bool $consume = true): bool {
if (!aksrt_is_captcha_enabled_for('bind')) {
return true;
}
if ($token === '' || $user_id <= 0) {
return false;
}
$matches = static function (?array $row) use ($provider, $user_id): bool {
$payload = is_array($row['payload'] ?? null) ? $row['payload'] : [];
return $row !== null
&& (int) ($payload['user_id'] ?? 0) === $user_id
&& hash_equals(sanitize_key($provider), sanitize_key((string) ($payload['provider'] ?? '')));
};
$row = OAuthTransactionStore::peek($token, self::BIND_PASS_KIND, true);
if (!$matches($row)) {
return false;
}
if (!$consume) {
return true;
}
return $matches(OAuthTransactionStore::claim($token, self::BIND_PASS_KIND, true));
}
public function maybe_flush_rewrite_rules(): void {
$version = defined('AKSRT_VERSION') ? AKSRT_VERSION . ':oauth-v2' : 'oauth-v2';
if (get_option('aksrt_oauth_routes_flushed') !== $version) {
@@ -186,6 +293,17 @@ final class OAuth {
if (!OAuthProviderCatalog::master_enabled() || !in_array($provider, OAuthProviderCatalog::enabled_login_keys(), true)) {
$this->redirect_error('provider_disabled', $provider, $action);
}
$user_id = get_current_user_id();
if ($action === 'bind' && $user_id <= 0) {
wp_safe_redirect(function_exists('aksrt_get_login_url') ? aksrt_get_login_url() : wp_login_url());
exit;
}
if ($action === 'bind') {
$bind_pass = sanitize_text_field((string) ($_GET['bind_pass'] ?? ''));
if (!self::validate_bind_pass($bind_pass, $provider, $user_id, true)) {
$this->redirect_error('bind_verification_required', $provider, $action);
}
}
if (OAuthProviderCatalog::proxy_mode() === 'client') {
$url = OAuthProxyClient::get_instance()->get_proxy_auth_url($provider, $action);
if ($url === '') {
@@ -194,11 +312,6 @@ final class OAuth {
wp_redirect($url); // phpcs:ignore WordPress.Security.SafeRedirect.wp_redirect_wp_redirect
exit;
}
$user_id = get_current_user_id();
if ($action === 'bind' && $user_id <= 0) {
wp_safe_redirect(function_exists('aksrt_get_login_url') ? aksrt_get_login_url() : wp_login_url());
exit;
}
$redirect = isset($_GET['redirect_to']) ? OAuthUrlPolicy::validated_redirect((string) $_GET['redirect_to'], home_url('/')) : home_url('/');
$redirect_uri = home_url('/oauth/callback/');
try {
@@ -264,6 +377,12 @@ final class OAuth {
wp_safe_redirect(function_exists('aksrt_get_login_url') ? aksrt_get_login_url() : wp_login_url());
exit;
}
if ($action === 'bind') {
$bind_pass = sanitize_text_field((string) ($_GET['bind_pass'] ?? ''));
if (!self::validate_bind_pass($bind_pass, 'clogin_' . $type, get_current_user_id(), true)) {
$this->redirect_error('bind_verification_required', 'clogin_' . $type, $action);
}
}
$redirect = isset($_GET['redirect_to']) ? OAuthUrlPolicy::validated_redirect((string) $_GET['redirect_to'], home_url('/')) : home_url('/');
try {
$state = OAuthTransactionStore::issue('clogin', [
src/Auth/Service.php
+1 -8
View File
@@ -117,16 +117,9 @@ final class Service {
return true;
}
public static function login_user(array $post, string $captcha_scene = 'login'): array {
public static function login_user(array $post): array {
$resolved_login = self::resolve_email_to_username((string) ($post['log'] ?? ''));
if (function_exists('aksrt_require_captcha')) {
$captcha_result = aksrt_require_captcha($captcha_scene, $post);
if ($captcha_result !== true) {
return ['success' => false, 'error' => $captcha_result];
}
}
$creds = [
'user_login' => $resolved_login,
'user_password' => (string) ($post['pwd'] ?? ''),
src/Auth/ServicePart1a.php
+7 -14
View File
@@ -10,7 +10,7 @@ defined('ABSPATH') || exit;
trait ServicePart1a {
public static function register_user(array $post): array {
public static function register_user(array $post, bool $verification_completed = false, bool $defer_login = false): array {
$user_login = sanitize_user(wp_unslash($post['user_login'] ?? ''), true);
$user_email = sanitize_email(wp_unslash($post['user_email'] ?? ''));
$password = (string) ($post['user_pass'] ?? '');
@@ -19,7 +19,7 @@ trait ServicePart1a {
if (
class_exists('\AKSRT\Settings\Settings')
&& \AKSRT\Settings\Settings::signup_verification_enabled()
&& empty($post['_auth_code_verified'])
&& !$verification_completed
) {
return ['success' => false, 'error' => __('请先完成邮箱或手机验证', 'aksrt')];
}
@@ -83,13 +83,6 @@ trait ServicePart1a {
return ['success' => false, 'error' => $password_check];
}
if (empty($post['_auth_code_verified']) && function_exists('aksrt_require_captcha')) {
$captcha_result = aksrt_require_captcha('register', $post);
if ($captcha_result !== true) {
return ['success' => false, 'error' => $captcha_result];
}
}
$ref_service = class_exists('\AKSRT\Payment\ReferralAttribution')
? \AKSRT\Payment\ReferralAttribution::get_instance()
: null;
@@ -143,15 +136,15 @@ trait ServicePart1a {
return ['success' => false, 'error' => __('注册成功，但读取用户信息失败，请联系管理员', 'aksrt')];
}
if (
empty($post['_defer_login'])
&& !empty($post['_auth_code_verified'])
&& class_exists('\AKSRT\Settings\Settings')
if (
!$defer_login
&& $verification_completed
&& class_exists('\AKSRT\Settings\Settings')
&& \AKSRT\Settings\Settings::signup_verification_enabled()
) {
self::mark_email_verified($user_id);
}
if (empty($post['_defer_login'])) {
if (!$defer_login) {
wp_set_auth_cookie((int) $user_id, true);
do_action('wp_login', $user->user_login, $user);
}
src/Auth/ServicePart1b.php
+3 -10
View File
@@ -15,7 +15,7 @@ trait ServicePart1b {
* @param array $post POST 数据 (phone, code, password, ref)
* @return array{success: bool, user_id?: int, error?: string, redirect?: string}
*/
public static function register_by_phone(array $post): array {
public static function register_by_phone(array $post, bool $verification_completed = false, bool $defer_login = false): array {
$phone = sanitize_text_field((string) ($post['phone'] ?? ''));
$pass = (string) ($post['password'] ?? '');
$confirm = (string) ($post['password_confirm'] ?? '');
@@ -24,7 +24,7 @@ trait ServicePart1b {
if (!preg_match('/^1[3-9]\d{9}$/', $phone)) {
return ['success' => false, 'error' => __('手机号格式不正确', 'aksrt')];
}
if (empty($post['_auth_code_verified'])) {
if (!$verification_completed) {
return ['success' => false, 'error' => __('请先完成手机验证', 'aksrt')];
}
if ($username === '' || !validate_username($username) || mb_strlen($username) < 3 || mb_strlen($username) > 60) {
@@ -111,7 +111,7 @@ trait ServicePart1b {
// 自动登录
$user = get_userdata($user_id);
if (empty($post['_defer_login'])) {
if (!$defer_login) {
wp_set_current_user($user_id);
wp_set_auth_cookie($user_id, true);
if ($user instanceof \WP_User) {
@@ -150,13 +150,6 @@ trait ServicePart1b {
return ['success' => false, 'error' => __('手机号格式不正确', 'aksrt')];
}
if (function_exists('aksrt_require_captcha')) {
$captcha_result = aksrt_require_captcha('bind_phone', $post);
if ($captcha_result !== true) {
return ['success' => false, 'error' => $captcha_result];
}
}
// 验证 SMS 验证码
if (class_exists('\AKSRT\Sms\SMS')) {
$verify_result = \AKSRT\Sms\SMS::get_instance()->verify_code($phone, $code);
src/Auth/WeixinGzh.php
+38 -11
View File
@@ -102,10 +102,19 @@ final class WeixinGzh {
if (is_wp_error($context)) {
return $this->error_response($context->get_error_message(), 403);
}
$config = self::settings();
if ((string) ($config['gzh_type'] ?? '') === 'subscribe') {
return $this->code_mode_response($config, $context);
}
$config = self::settings();
$mode = (string) ($config['gzh_type'] ?? '');
if ($context['action'] === 'bind') {
$data = $this->request_data($request);
$bind_pass = sanitize_text_field((string) ($data['bind_pass'] ?? ''));
if (!OAuth::validate_bind_pass($bind_pass, 'weixingzh', $context['user_id'], false)) {
return $this->error_response(__('请先完成人机验证后再绑定', 'aksrt'), 403);
}
$context['bind_pass'] = $bind_pass;
}
if ($mode === 'subscribe') {
return $this->code_mode_response($config, $context);
}
$appid = trim((string) ($config['appid'] ?? ''));
$secret = trim((string) ($config['appsecret'] ?? ''));
@@ -118,9 +127,10 @@ final class WeixinGzh {
'openid' => '',
'profile' => [],
'redirect_to' => $context['redirect_to'],
'action' => $context['action'],
'user_id' => $context['user_id'],
], self::SCAN_TTL, true);
'action' => $context['action'],
'user_id' => $context['user_id'],
'bind_pass' => (string) ($context['bind_pass'] ?? ''),
], self::SCAN_TTL, true);
if (!$this->store_scene_mapping($scene, $transaction)) {
throw new \RuntimeException('scene_mapping_failed');
}
@@ -211,11 +221,21 @@ final class WeixinGzh {
if (is_wp_error($context)) {
return $this->error_response($context->get_error_message(), 403);
}
$bind_pass = '';
if ($context['action'] === 'bind') {
$bind_pass = sanitize_text_field((string) ($data['bind_pass'] ?? ''));
if (!OAuth::validate_bind_pass($bind_pass, 'weixingzh', $context['user_id'], false)) {
return $this->error_response(__('请先完成人机验证后再绑定', 'aksrt'), 403);
}
}
$claimed = $this->claim_code_transaction($code, $context);
if (!$claimed) {
return $this->error_response(__('验证码无效、已过期或尝试次数过多', 'aksrt'), 400);
}
$payload = is_array($claimed['payload'] ?? null) ? $claimed['payload'] : [];
if ($context['action'] === 'bind') {
$payload['bind_pass'] = $bind_pass;
}
return $this->complete_browser_identity($payload);
}
@@ -297,9 +317,12 @@ final class WeixinGzh {
$html .= '<form class="aksrt-weixingzh-code-form" data-aksrt-weixingzh-code>';
$html .= '<p class="muted-2-color em09">' . esc_html(sprintf(__('关注公众号后发送「%s」获取验证码', 'aksrt'), $keyword)) . '</p>';
$html .= '<input type="hidden" name="action" value="' . esc_attr($context['action']) . '" />';
$html .= '<input type="hidden" name="user_id" value="' . esc_attr((string) $context['user_id']) . '" />';
$html .= '<input type="hidden" name="redirect_to" value="' . esc_attr($context['redirect_to']) . '" />';
$html .= '<input type="text" name="code" class="form-control" minlength="6" maxlength="12" autocomplete="one-time-code" placeholder="' . esc_attr__('请输入验证码', 'aksrt') . '" required />';
$html .= '<input type="hidden" name="user_id" value="' . esc_attr((string) $context['user_id']) . '" />';
$html .= '<input type="hidden" name="redirect_to" value="' . esc_attr($context['redirect_to']) . '" />';
if (!empty($context['bind_pass'])) {
$html .= '<input type="hidden" name="bind_pass" value="' . esc_attr((string) $context['bind_pass']) . '" />';
}
$html .= '<input type="text" name="code" class="form-control" minlength="6" maxlength="12" autocomplete="one-time-code" placeholder="' . esc_attr__('请输入验证码', 'aksrt') . '" required />';
$html .= '<button type="submit" class="but c-blue btn-block mt10">' . esc_html__('登录', 'aksrt') . '</button>';
$html .= '</form>';
return new \WP_REST_Response([
@@ -374,6 +397,10 @@ final class WeixinGzh {
if (!$this->binding_user_matches($payload)) {
return $this->error_response(__('绑定会话与当前用户不匹配', 'aksrt'), 403);
}
$bind_pass = sanitize_text_field((string) ($payload['bind_pass'] ?? ''));
if (!OAuth::validate_bind_pass($bind_pass, 'weixingzh', get_current_user_id(), true)) {
return $this->error_response(__('绑定验证已过期，请重新完成人机验证', 'aksrt'), 403);
}
$result = OAuthAccountService::bind(get_current_user_id(), 'weixingzh', $identity);
if (is_wp_error($result)) {
return $this->error_response($result->get_error_message(), 409);
@@ -382,7 +409,7 @@ final class WeixinGzh {
$redirect = add_query_arg(['oauth_action' => 'bind', 'oauth_provider' => 'weixingzh'], $redirect);
return new \WP_REST_Response([
'success' => true,
'data' => ['logged_in' => false, 'bound' => true, 'status' => 'bound', 'redirect' => $redirect],
'data' => ['logged_in' => false, 'bound' => true, 'status' => 'bound', 'redirect' => $redirect],
], 200);
}
src/Content/Download.php
+7 -12
View File
@@ -203,18 +203,13 @@ class Download {
}
}
$need_captcha = function_exists('aksrt_is_captcha_enabled_for') && aksrt_is_captcha_enabled_for('download');
if ($need_captcha && function_exists('aksrt_require_captcha')) {
$cap_payload = isset($params['captcha']) && is_array($params['captcha']) ? $params['captcha'] : [];
// 场景未启用时 require 直接放行；启用时强制校验 token。
if (function_exists('aksrt_is_captcha_enabled_for') && aksrt_is_captcha_enabled_for('download')) {
$verify = aksrt_require_captcha('download', $cap_payload);
if ($verify !== true) {
$msg = is_string($verify) ? $verify : __('人机验证失败', 'aksrt');
return new \WP_Error('aksrt_captcha_failed', $msg, ['status' => 400]);
}
}
}
$cap_payload = isset($params['captcha']) && is_array($params['captcha']) ? $params['captcha'] : [];
$verify = aksrt_require_captcha('download', $cap_payload);
if ($verify !== true) {
$code = is_wp_error($verify) ? $verify->get_error_code() : 'aksrt_captcha_failed';
$msg = is_wp_error($verify) ? $verify->get_error_message() : __('人机验证失败', 'aksrt');
return new \WP_Error($code ?: 'aksrt_captcha_failed', $msg, ['status' => 400]);
}
// Purchase is one-shot via cashier (resource order). Token issue does not re-deduct.
$config = $this->config();
src/Core/CommentActions.php
+23 -10
View File
@@ -284,15 +284,18 @@ class CommentActions {
], 403);
}
if (function_exists('aksrt_require_captcha')) {
$captcha_result = aksrt_require_captcha('comment', $params);
if ($captcha_result !== true) {
return new \WP_REST_Response([
'success' => false,
'code' => 'captcha_failed',
'message' => (string) $captcha_result,
], 400);
}
$captcha_result = aksrt_require_captcha('comment', $params);
if ($captcha_result !== true) {
$captcha_error = is_wp_error($captcha_result) ? $captcha_result : null;
$captcha_data = $captcha_error ? $captcha_error->get_error_data() : null;
$captcha_status = is_array($captcha_data) ? (int) ($captcha_data['status'] ?? 400) : 400;
return new \WP_REST_Response([
'success' => false,
'code' => $captcha_error ? ($captcha_error->get_error_code() ?: 'captcha_failed') : 'captcha_failed',
'message' => $captcha_error
? ($captcha_error->get_error_message() ?: __('人机验证失败', 'aksrt'))
: __('人机验证失败', 'aksrt'),
], $captcha_status > 0 ? $captcha_status : 400);
}
$user = wp_get_current_user();
@@ -335,7 +338,17 @@ class CommentActions {
}
}
$comment_id = wp_new_comment(wp_slash($commentdata), true);
$comment_id = null;
if (class_exists('\AKSRT\Auth\Moderation')) {
\AKSRT\Auth\Moderation::get_instance()->begin_captcha_verified_comment_request();
}
try {
$comment_id = wp_new_comment(wp_slash($commentdata), true);
} finally {
if (class_exists('\AKSRT\Auth\Moderation')) {
\AKSRT\Auth\Moderation::get_instance()->end_captcha_verified_comment_request();
}
}
if (is_wp_error($comment_id)) {
return new \WP_REST_Response([
'success' => false,
src/Core/FrontSubmit.php
+9 -4
View File
@@ -363,6 +363,9 @@ class FrontSubmit {
}
$data['posts_id'] = $post_id;
$action = (($data['status'] ?? '') === 'draft') ? 'posts_draft' : 'posts_save';
if ($action !== 'posts_draft') {
$this->verify_captcha();
}
$result = $this->persist($data, $action);
$this->send_result($result);
}
@@ -425,13 +428,15 @@ class FrontSubmit {
}
private function verify_captcha(): void {
if (!function_exists('aksrt_require_captcha')) {
return;
}
$verify = aksrt_require_captcha('front_submit', $_POST);
if ($verify !== true) {
$captcha_error = is_wp_error($verify) ? $verify : null;
$message = $captcha_error
? $captcha_error->get_error_message()
: __('人机验证失败，请重试', 'aksrt');
wp_send_json_error([
'message' => is_string($verify) ? $verify : __('人机验证失败，请重试', 'aksrt'),
'code' => $captcha_error ? ($captcha_error->get_error_code() ?: 'aksrt_captcha_failed') : 'aksrt_captcha_failed',
'message' => $message !== '' ? $message : __('人机验证失败，请重试', 'aksrt'),
], 400);
}
}
src/Credits/Signin.php
+10 -11
View File
@@ -103,17 +103,16 @@ class Signin {
$today_str = $this->today_date();
// 人机验证（若启用）
if (function_exists('aksrt_require_captcha')) {
$body = $request->get_json_params();
$cap_payload = is_array($body) && isset($body['captcha']) && is_array($body['captcha'])
? $body['captcha']
: (is_array($body) ? $body : []);
$verify = aksrt_require_captcha('signin', $cap_payload);
if ($verify !== true) {
$msg = is_string($verify) ? $verify : __('人机验证失败', 'aksrt');
return new \WP_Error('aksrt_captcha_failed', $msg, ['status' => 400]);
}
}
$body = $request->get_json_params();
$cap_payload = is_array($body) && isset($body['captcha']) && is_array($body['captcha'])
? $body['captcha']
: (is_array($body) ? $body : []);
$verify = aksrt_require_captcha('signin', $cap_payload);
if ($verify !== true) {
$code = is_wp_error($verify) ? $verify->get_error_code() : 'aksrt_captcha_failed';
$msg = is_wp_error($verify) ? $verify->get_error_message() : __('人机验证失败', 'aksrt');
return new \WP_Error($code ?: 'aksrt_captcha_failed', $msg, ['status' => 400]);
}
$existing_record = $this->get_record($user_id, $today_str);
if (is_array($existing_record)) {
src/Settings/Settings.php
+16 -5
View File
@@ -47,11 +47,16 @@ class Settings {
'aksrt_identity_secrets',
];
public const SCHEMA_MANAGED_STANDALONE_OPTION_KEYS = [
'aksrt_captcha_config',
];
/**
* 包含 secret 字段的 option key — 空值保留旧值策略。
* 包含 secret 字段的 option key — 永不进入独立导入导出。
*/
public const SECRET_OPTION_KEYS = [
'aksrt_mail_smtp',
'aksrt_captcha_config',
'aksrt_identity_secrets',
];
@@ -601,15 +606,20 @@ class Settings {
return \AKSRT\Identity\SecretStore::status($provider);
}
public static function standalone_export_keys(): array {
return array_values(array_diff(self::STANDALONE_OPTION_KEYS, self::SCHEMA_MANAGED_STANDALONE_OPTION_KEYS, self::SECRET_OPTION_KEYS));
}
/**
* Remove secrets from settings export and backup payloads.
* Remove duplicate schema-managed options and secrets from settings payloads.
*
* @param array<string,mixed> $payload
* @return array<string,mixed>
*/
public static function redact_sensitive_settings(array $payload): array {
if (isset($payload['standalone']) && is_array($payload['standalone'])) {
foreach (self::SECRET_OPTION_KEYS as $option_key) {
$blocked = array_merge(self::SCHEMA_MANAGED_STANDALONE_OPTION_KEYS, self::SECRET_OPTION_KEYS);
foreach ($blocked as $option_key) {
unset($payload['standalone'][$option_key]);
}
}
@@ -623,10 +633,11 @@ class Settings {
* @return array<string,mixed>
*/
public static function filter_sensitive_import(array $standalone): array {
foreach (self::SECRET_OPTION_KEYS as $option_key) {
$blocked = array_merge(self::SCHEMA_MANAGED_STANDALONE_OPTION_KEYS, self::SECRET_OPTION_KEYS);
foreach ($blocked as $option_key) {
unset($standalone[$option_key]);
}
return $standalone;
return array_intersect_key($standalone, array_flip(self::standalone_export_keys()));
}
src/Sms/SMS.php
-56
View File
@@ -17,8 +17,6 @@ class SMS {
}
public function init(): void {
add_action('wp_ajax_aksrt_send_sms_code', [$this, 'ajax_send_code']);
add_action('wp_ajax_nopriv_aksrt_send_sms_code', [$this, 'ajax_send_code']);
add_action('wp_ajax_aksrt_sms_test', [$this, 'ajax_test_provider']);
add_action('wp_ajax_aksrt_sms_status', [$this, 'ajax_provider_status']);
}
@@ -250,60 +248,6 @@ class SMS {
* AJAX Handlers
* ----------------------------------------------------------------*/
/**
* 手机号格式校验（对齐 legacy：支持中国号和国际号）
*/
private function validate_phone(string $phone): bool {
$config = $this->get_provider_config();
$limit_ch = !isset($config['sms_number_limit_ch']) || !empty($config['sms_number_limit_ch']);
if ($limit_ch) {
// 仅中国大陆手机号
return (bool) preg_match('/^1[3-9]\d{9}$/', $phone);
}
// 国际手机号：5 位以上数字，可选 + 前缀
return (bool) preg_match('/^(?:\d{5,}|\+\d{6,})$/', $phone);
}
/**
* AJAX 发送验证码
*/
public function ajax_send_code(): void {
check_ajax_referer('aksrt_sms', '_nonce');
$phone = sanitize_text_field((string) ($_POST['phone'] ?? ''));
if (!$this->validate_phone($phone)) {
wp_send_json_error(['message' => __('手机号格式不正确', 'aksrt')]);
}
$scene = sanitize_key((string) ($_POST['scene'] ?? 'register'));
if (!array_key_exists($scene, function_exists('aksrt_captcha_scenes') ? aksrt_captcha_scenes() : [])) {
$scene = 'register';
}
if (function_exists('aksrt_require_captcha')) {
$captcha_result = aksrt_require_captcha($scene, wp_unslash($_POST));
if ($captcha_result !== true) {
wp_send_json_error(['message' => $captcha_result ?: __('人机验证失败', 'aksrt')]);
}
}
$result = $this->send_code($phone);
if ($result['success']) {
wp_send_json_success([
'message' => $result['message'],
'remaining_time' => $result['remaining_time'] ?? 60,
]);
}
$error_data = ['message' => $result['message']];
if (isset($result['remaining_time'])) {
$error_data['remaining_time'] = $result['remaining_time'];
}
wp_send_json_error($error_data);
}
/**
* AJAX: Test SMS provider (admin only).
*/