kate522/wordpress-theme-aksrt
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(captcha): 打通人机验证 11 个场景的前后端完整链路

Browse Source 
- 统一验证入口 aksrt_require_captcha()，返回 true|WP_Error，启用场景配置缺失时 fail-closed 拒绝
- 前端公共 API 重构为 window.AKSRTCaptcha（verify/collect/reset/run），单飞锁防并发重复验证，一次性 proof 绑定浏览器 cookie+场景+服务商+主机名
- challenge/exchange REST 端点：challenge 原子占用防票据放大厂商调用，增加频率限制
- 新增 OAuth bind pass：服务端签发 5 分钟一次性令牌，绑定用户+服务商+浏览器，微信扫码延迟消费
- 覆盖场景：评论、登录、注册、绑定第三方、绑定手机、找回密码、修改密码、更改邮箱、资料下载、签到、前台投稿
- 移除 Service 层重复验证与 _auth_code_verified/_defer_login 等客户端可伪造标志，删除下载共享 pass 死代码
- 修复腾讯 TC3 签名 scope、Cloudflare action/cdata/hostname 严格校验、阿里云验签错误码映射
- 后台 Schema 保存对 secret 字段做掩码/保留合并；导入导出过滤 aksrt_captcha_config
- 重建 public bundle 与 admin SPA；新增 captcha 运行时/安全/业务契约测试与 harness
This commit is contained in:
kate522
2026-09-02 13:03:24 +08:00
parent d2e95acd75
commit ff4ec1eb43
45 changed files with 2694 additions and 1435 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/Admin/ImportExportController.php
+50 -4
View File
@@ -87,6 +87,12 @@ class ImportExportController extends ControllerBase {
'permission_callback' => [$this, 'check_permission'],
]);
register_rest_route(self::API_NAMESPACE, '/captcha/test', [
'methods' => 'POST',
'callback' => [$this, 'rest_test_captcha'],
'permission_callback' => [$this, 'check_permission'],
]);
// Backup snapshots
register_rest_route(self::API_NAMESPACE, '/settings/backups', [
'methods' => 'GET',
@@ -118,6 +124,42 @@ class ImportExportController extends ControllerBase {
/* Handlers */
/* ------------------------------------------------------------------ */
public function rest_test_captcha(\WP_REST_Request $request): \WP_REST_Response {
$params = $this->get_json_params($request);
$provider = sanitize_key((string) ($params['provider'] ?? ''));
$token = isset($params['token']) && is_array($params['token']) ? $params['token'] : [];
$allowed_token_fields = [
'tencent_ticket', 'tencent_randstr',
'cf_turnstile_response',
'geetest_lot_number', 'geetest_captcha_output', 'geetest_pass_token', 'geetest_gen_time',
'aliyun_captcha_verify_param',
];
$token = array_intersect_key($token, array_flip($allowed_token_fields));
foreach ($token as $key => $value) {
$token[$key] = is_scalar($value) ? sanitize_text_field((string) $value) : '';
}
$config = function_exists('aksrt_get_captcha_config') ? aksrt_get_captcha_config() : [];
$stored_provider = (string) ($config['active_provider'] ?? '');
if ($provider === '' || $provider !== $stored_provider || !in_array($provider, aksrt_captcha_providers(), true)) {
return $this->error(__('请先保存并启用要测试的人机验证服务商', 'aksrt'), 422);
}
$provider_config = isset($config[$provider]) && is_array($config[$provider]) ? $config[$provider] : [];
if (!aksrt_captcha_provider_is_configured($provider, $provider_config)) {
return $this->error(__('当前人机验证服务商配置不完整', 'aksrt'), 422);
}
$scene = 'admin-captcha-test';
$action = 'aksrt-admin-test';
$result = aksrt_verify_captcha_provider($provider, $provider_config, $token, aksrt_get_client_ip(), $scene, $action);
if (is_wp_error($result)) {
return $this->error($result->get_error_message(), 422);
}
return $this->success(['message' => __('服务端同源验签通过', 'aksrt')]);
}
/**
* Export all AKSRT settings as a JSON-serializable array.
*/
@@ -139,7 +181,7 @@ class ImportExportController extends ControllerBase {
}
// Also export standalone options from the registry
$standalone_keys = \AKSRT\Settings\Settings::STANDALONE_OPTION_KEYS;
$standalone_keys = \AKSRT\Settings\Settings::standalone_export_keys();
$export['standalone'] = [];
foreach ($standalone_keys as $key) {
@@ -180,21 +222,25 @@ class ImportExportController extends ControllerBase {
// Import domain settings
if (!empty($params['domains']) && is_array($params['domains'])) {
foreach ($params['domains'] as $domain => $payload) {
if (!in_array($domain, $schema_provider->get_domain_keys(), true)) {
$results[$domain] = ['status' => 'skipped', 'message' => 'Unknown domain'];
continue;
}
$data = $payload['data'] ?? $payload;
if (!is_array($data)) {
$results[$domain] = ['status' => 'error', 'message' => 'Invalid data format'];
continue;
}
// Validate
$validation = $schema_provider->validate($domain, $data);
$clean = $schema_provider->sanitize_payload((string) $domain, $data);
$validation = $schema_provider->validate((string) $domain, $clean);
if (!$validation['valid']) {
$results[$domain] = ['status' => 'error', 'errors' => $validation['errors']];
continue;
}
if (!$dry_run) {
$schema_provider->write_settings($domain, $data);
$schema_provider->write_settings((string) $domain, $clean);
$results[$domain] = ['status' => 'imported'];
} else {
$results[$domain] = ['status' => 'valid'];
src/Admin/ImportExportControllerPart1.php
+10 -4
View File
@@ -90,18 +90,24 @@ trait ImportExportControllerPart1 {
$payload = $target['payload'];
$domains = $payload['domains'] ?? [];
$standalone = $payload['standalone'] ?? [];
$standalone = \AKSRT\Settings\Settings::filter_sensitive_import(
is_array($payload['standalone'] ?? null) ? $payload['standalone'] : []
);
$provider = SchemaProvider::get_instance();
foreach ($domains as $domain => $domainPayload) {
$data = $domainPayload['data'] ?? $domainPayload;
if (is_array($data)) {
$provider->write_settings((string) $domain, $data);
if (is_array($data) && in_array((string) $domain, $provider->get_domain_keys(), true)) {
$clean = $provider->sanitize_payload((string) $domain, $data);
$validation = $provider->validate((string) $domain, $clean);
if ($validation['valid']) {
$provider->write_settings((string) $domain, $clean);
}
}
}
foreach ($standalone as $key => $value) {
if (is_string($key) && preg_match('/^aksrt_/', $key)) {
if (is_string($key) && in_array($key, \AKSRT\Settings\Settings::standalone_export_keys(), true)) {
update_option($key, $value);
}
}
src/Admin/ImportExportControllerPart2.php
+1 -1
View File
@@ -43,7 +43,7 @@ trait ImportExportControllerPart2 {
];
}
foreach (\AKSRT\Settings\Settings::STANDALONE_OPTION_KEYS as $key) {
foreach (\AKSRT\Settings\Settings::standalone_export_keys() as $key) {
$value = get_option($key);
if ($value !== false) {
$payload['standalone'][$key] = $value;
src/Admin/Schema/SchemaPermissions.php
+20 -14
View File
@@ -10,6 +10,23 @@ defined('ABSPATH') || exit;
class SchemaPermissions {
public static function build(): array {
$provider_meta = function_exists('aksrt_captcha_provider_metadata') ? aksrt_captcha_provider_metadata() : [];
$provider_options = [['label' => '关闭', 'value' => '']];
$provider_fields = [];
foreach ($provider_meta as $provider => $meta) {
$provider_options[] = [
'label' => (string) ($meta['label'] ?? $provider),
'value' => $provider,
];
$provider_fields[] = [
'key' => $provider,
'label' => (string) ($meta['label'] ?? $provider) . ' 配置',
'type' => 'custom',
'default' => function_exists('aksrt_captcha_provider_defaults') ? aksrt_captcha_provider_defaults($provider) : [],
'captcha_provider' => $provider,
];
}
return [
'domain' => 'permissions',
'title' => '功能与权限',
@@ -22,14 +39,8 @@ class SchemaPermissions {
'groups' => [
['key' => 'basic', 'title' => '基础开关', 'fields' => [
['key' => 'enabled', 'label' => '启用人机验证', 'type' => 'switch', 'default' => false],
['key' => 'active_provider', 'label' => '当前服务商', 'type' => 'radio', 'default' => '', 'dependsOn' => ['key' => 'enabled', 'value' => true], 'options' => [
['label' => '关闭', 'value' => ''],
['label' => '腾讯云 Captcha', 'value' => 'tencent'],
['label' => '阿里云 CAPTCHA 2.0', 'value' => 'aliyun'],
['label' => 'Cloudflare Turnstile', 'value' => 'cloudflare'],
['label' => '极验 GeeTest', 'value' => 'geetest'],
]],
['key' => 'enabled_scenarios', 'label' => '启用场景', 'type' => 'checkbox', 'default' => ['comment', 'login', 'register', 'bind', 'bind_phone', 'lostpassword', 'change_password', 'change_email', 'download', 'signin'], 'dependsOn' => ['key' => 'enabled', 'value' => true], 'options' => [
['key' => 'active_provider', 'label' => '当前服务商', 'type' => 'radio', 'default' => '', 'dependsOn' => ['key' => 'enabled', 'value' => true], 'options' => $provider_options],
['key' => 'enabled_scenarios', 'label' => '启用场景', 'type' => 'checkbox', 'default' => [], 'dependsOn' => ['key' => 'enabled', 'value' => true], 'options' => [
['label' => '发表评论', 'value' => 'comment'],
['label' => '用户登录', 'value' => 'login'],
['label' => '用户注册', 'value' => 'register'],
@@ -43,12 +54,7 @@ class SchemaPermissions {
['label' => '前台投稿', 'value' => 'front_submit'],
]],
]],
['key' => 'providers', 'title' => '服务商配置', 'fields' => [
['key' => 'tencent', 'label' => '腾讯云配置', 'type' => 'custom', 'default' => [], 'sanitize_type' => 'array'],
['key' => 'aliyun', 'label' => '阿里云配置', 'type' => 'custom', 'default' => [], 'sanitize_type' => 'array'],
['key' => 'cloudflare', 'label' => 'Cloudflare 配置', 'type' => 'custom', 'default' => [], 'sanitize_type' => 'array'],
['key' => 'geetest', 'label' => '极验配置', 'type' => 'custom', 'default' => [], 'sanitize_type' => 'array'],
]],
['key' => 'providers', 'title' => '服务商配置', 'fields' => $provider_fields],
],
],
'attachment' => [
src/Admin/SchemaProvider.php
+104 -22
View File
@@ -140,10 +140,8 @@ class SchemaProvider {
}
}
if (!empty($data['__clear_secrets']) && is_array($data['__clear_secrets'])) {
$clean['__clear_secrets'] = array_values(array_intersect(
array_map('sanitize_key', $data['__clear_secrets']),
$this->secret_field_keys($schema)
));
$requested = array_values(array_filter(array_map([$this, 'normalize_secret_path'], $data['__clear_secrets'])));
$clean['__clear_secrets'] = array_values(array_intersect($requested, $this->secret_field_paths($schema)));
}
return $clean;
@@ -505,14 +503,14 @@ class SchemaProvider {
if ($section !== '') {
$defaults = $this->get_defaults($domain, $section);
$schema = $this->get_section_schema($domain, $section);
$defaults['__clear_secrets'] = $schema ? $this->secret_field_keys($schema) : [];
$defaults['__clear_secrets'] = $schema ? $this->secret_field_paths($schema) : [];
return $this->write_settings($domain, $defaults, $section);
}
$result = true;
foreach ($this->get_sections($domain) as $section_schema) {
$defaults = $this->collect_defaults($section_schema);
$defaults['__clear_secrets'] = $this->secret_field_keys($section_schema);
$defaults['__clear_secrets'] = $this->secret_field_paths($section_schema);
$result = $this->write_section_settings($section_schema, $defaults) && $result;
}
return $result;
@@ -541,24 +539,33 @@ class SchemaProvider {
}
$data = $this->collect_defaults($schema);
foreach ($this->get_all_fields($schema) as $field) {
if (array_key_exists($field['key'], $stored)) {
$data[$field['key']] = $stored[$field['key']];
}
foreach ($this->get_all_fields($schema) as $field) {
if (array_key_exists($field['key'], $stored)) {
$data[$field['key']] = $stored[$field['key']];
}
$stored_value = array_key_exists($field['key'], $stored) ? $stored[$field['key']] : ($data[$field['key']] ?? '');
if (!empty($field['secret'])) {
$data[$field['key']] = trim((string) $stored_value) !== '' ? '***' : '';
}
}
if (!empty($field['captcha_provider'])) {
$data[$field['key']] = $this->mask_captcha_provider_secrets(
(string) $field['captcha_provider'],
is_array($stored_value) ? $stored_value : []
);
}
}
// Captcha: always surface the normalized positive scene list.
if ($option_key === 'aksrt_captcha_config' && function_exists('aksrt_get_captcha_config')) {
$normalized = aksrt_get_captcha_config();
foreach (['enabled', 'active_provider', 'enabled_scenarios', 'tencent', 'aliyun', 'cloudflare', 'geetest'] as $key) {
if (array_key_exists($key, $normalized)) {
$data[$key] = $normalized[$key];
}
}
foreach (['enabled', 'active_provider', 'enabled_scenarios'] as $key) {
if (array_key_exists($key, $normalized)) {
$data[$key] = $normalized[$key];
}
}
foreach (function_exists('aksrt_captcha_providers') ? aksrt_captcha_providers() : [] as $provider) {
$data[$provider] = $this->mask_captcha_provider_secrets($provider, (array) ($normalized[$provider] ?? []));
}
}
return $data;
@@ -576,13 +583,20 @@ class SchemaProvider {
$fields[(string) $field['key']] = $field;
}
$clear_secrets = isset($data['__clear_secrets']) && is_array($data['__clear_secrets'])
? array_values(array_map('sanitize_key', $data['__clear_secrets']))
? array_values(array_filter(array_map([$this, 'normalize_secret_path'], $data['__clear_secrets'])))
: [];
foreach ($fields as $key => $field) {
if (!empty($field['secret']) && in_array($key, $clear_secrets, true)) {
unset($stored[$key]);
continue;
}
if (!empty($field['captcha_provider'])) {
$provider = (string) $field['captcha_provider'];
$current = isset($stored[$key]) && is_array($stored[$key]) ? $stored[$key] : [];
$incoming = array_key_exists($key, $data) && is_array($data[$key]) ? $data[$key] : [];
$stored[$key] = $this->merge_captcha_provider_config($provider, $current, $incoming, $clear_secrets);
continue;
}
if (!array_key_exists($key, $data)) {
continue;
}
@@ -599,9 +613,17 @@ class SchemaProvider {
// Captcha stores a single positive scene list.
if ($option_key === 'aksrt_captcha_config' && function_exists('aksrt_captcha_scenes')) {
$stored['enabled'] = !empty($stored['enabled']);
$active_provider = sanitize_key((string) ($stored['active_provider'] ?? ''));
$stored['active_provider'] = in_array($active_provider, aksrt_captcha_providers(), true) ? $active_provider : '';
$stored['enabled_scenarios'] = function_exists('aksrt_captcha_sanitize_scene_list')
? aksrt_captcha_sanitize_scene_list($stored['enabled_scenarios'] ?? [])
: (array) ($stored['enabled_scenarios'] ?? []);
foreach (aksrt_captcha_providers() as $provider) {
$stored[$provider] = function_exists('aksrt_captcha_sanitize_provider_config')
? aksrt_captcha_sanitize_provider_config($provider, $stored[$provider] ?? [])
: (array) ($stored[$provider] ?? []);
}
}
$updated = update_option($option_key, $stored);
@@ -617,14 +639,69 @@ class SchemaProvider {
return $updated || true;
}
private function secret_field_keys(array $schema): array {
$keys = [];
private function normalize_secret_path($path): string {
$parts = array_values(array_filter(explode('.', strtolower(trim((string) $path))), static fn(string $part): bool => $part !== ''));
$parts = array_map('sanitize_key', $parts);
return in_array('', $parts, true) ? '' : implode('.', $parts);
}
private function secret_field_paths(array $schema): array {
$paths = [];
foreach ($this->get_all_fields($schema) as $field) {
if (!empty($field['secret']) && !empty($field['key'])) {
$keys[] = sanitize_key((string) $field['key']);
$key = sanitize_key((string) ($field['key'] ?? ''));
if ($key === '') {
continue;
}
if (!empty($field['secret'])) {
$paths[] = $key;
}
if (!empty($field['captcha_provider']) && function_exists('aksrt_captcha_provider_secret_fields')) {
foreach (aksrt_captcha_provider_secret_fields((string) $field['captcha_provider']) as $secret) {
$paths[] = $key . '.' . sanitize_key((string) $secret);
}
}
}
return array_values(array_unique($keys));
return array_values(array_unique($paths));
}
private function mask_captcha_provider_secrets(string $provider, array $config): array {
$clean = function_exists('aksrt_captcha_sanitize_provider_config')
? aksrt_captcha_sanitize_provider_config($provider, $config)
: $config;
foreach (function_exists('aksrt_captcha_provider_secret_fields') ? aksrt_captcha_provider_secret_fields($provider) : [] as $secret) {
$clean[$secret] = trim((string) ($config[$secret] ?? '')) !== '' ? '***' : '';
}
return $clean;
}
private function merge_captcha_provider_config(string $provider, array $stored, array $incoming, array $clear_paths): array {
$current = function_exists('aksrt_captcha_sanitize_provider_config')
? aksrt_captcha_sanitize_provider_config($provider, $stored)
: $stored;
$defaults = function_exists('aksrt_captcha_provider_defaults') ? aksrt_captcha_provider_defaults($provider) : [];
$secret_fields = function_exists('aksrt_captcha_provider_secret_fields') ? aksrt_captcha_provider_secret_fields($provider) : [];
foreach (array_keys($defaults) as $key) {
$path = $provider . '.' . $key;
if (in_array($path, $clear_paths, true)) {
$current[$key] = '';
continue;
}
if (!array_key_exists($key, $incoming) || is_array($incoming[$key]) || is_object($incoming[$key])) {
continue;
}
$value = trim((string) $incoming[$key]);
if (in_array($key, $secret_fields, true) && ($value === '' || $value === '***')) {
continue;
}
$current[$key] = $value;
}
return function_exists('aksrt_captcha_sanitize_provider_config')
? aksrt_captcha_sanitize_provider_config($provider, $current)
: $current;
}
private function secret_field_keys(array $schema): array {
return array_values(array_filter($this->secret_field_paths($schema), static fn(string $path): bool => !str_contains($path, '.')));
}
private function collect_defaults(array $schema): array {
@@ -721,6 +798,11 @@ class SchemaProvider {
}
private function sanitize_field_value($value, array $field) {
if (!empty($field['captcha_provider'])) {
return function_exists('aksrt_captcha_sanitize_provider_config')
? aksrt_captcha_sanitize_provider_config((string) $field['captcha_provider'], $value)
: [];
}
$type = (string) ($field['type'] ?? 'text');
$sanitize_type = (string) ($field['sanitize_type'] ?? '');
if ($sanitize_type === 'business_prefix') {
src/Admin/UserControllerAuthPhoneOperations.php
+51 -36
View File
@@ -29,6 +29,30 @@ trait UserControllerAuthPhoneOperations {
return $nonce !== '' && (bool) wp_verify_nonce($nonce, 'wp_rest');
}
private function auth_require_captcha(string $scene, array $payload): ?\WP_REST_Response {
$result = aksrt_require_captcha($scene, $payload);
if ($result === true) {
return null;
}
if (is_wp_error($result)) {
$data = $result->get_error_data();
$status = is_array($data) ? (int) ($data['status'] ?? 400) : 400;
$message = $result->get_error_message() ?: __('人机验证失败', 'aksrt');
return new \WP_REST_Response([
'success' => false,
'code' => $result->get_error_code() ?: 'aksrt_captcha_failed',
'message' => $message,
], $status > 0 ? $status : 400);
}
return new \WP_REST_Response([
'success' => false,
'code' => 'aksrt_captcha_failed',
'message' => __('人机验证失败', 'aksrt'),
], 400);
}
private function auth_rate_key(string $action, string $subject = ''): string {
$ip = sanitize_text_field((string) ($_SERVER['REMOTE_ADDR'] ?? '0.0.0.0'));
return 'aksrt_auth_rate_' . md5($action . '|' . strtolower($subject) . '|' . $ip);
@@ -144,12 +168,10 @@ trait UserControllerAuthPhoneOperations {
if ($this->auth_rate_limited('code:' . $scene, $target, 5, HOUR_IN_SECONDS)) {
return $this->error(__('请求过于频繁，请稍后再试', 'aksrt'), 429);
}
if (function_exists('aksrt_require_captcha')) {
$captcha_scene = $scene === 'resetpassword' ? 'lostpassword' : $scene;
$captcha = aksrt_require_captcha($captcha_scene, $payload);
if ($captcha !== true) {
return $this->error((string) $captcha);
}
$captcha_scene = $scene === 'resetpassword' ? 'lostpassword' : $scene;
$captcha_error = $this->auth_require_captcha($captcha_scene, $payload);
if ($captcha_error) {
return $captcha_error;
}
$generic = __('如果信息有效，验证码将发送到该账号', 'aksrt');
@@ -207,11 +229,9 @@ trait UserControllerAuthPhoneOperations {
if ($this->auth_rate_limited('login', $target)) {
return $this->error(__('请求过于频繁，请稍后再试', 'aksrt'), 429);
}
if (function_exists('aksrt_require_captcha')) {
$captcha = aksrt_require_captcha($oauth_data ? 'bind' : 'login', $payload);
if ($captcha !== true) {
return $this->error((string) $captcha);
}
$captcha_error = $this->auth_require_captcha($oauth_data ? 'bind' : 'login', $payload);
if ($captcha_error) {
return $captcha_error;
}
$redirect = $this->auth_safe_redirect((string) ($payload['redirect_to'] ?? ''), home_url('/'));
@@ -271,7 +291,7 @@ trait UserControllerAuthPhoneOperations {
$redirect = function_exists('aksrt_get_user_center_url') ? aksrt_get_user_center_url() : $redirect;
return $this->success(['message' => __('账号绑定成功', 'aksrt'), 'redirect' => $redirect]);
}
$result = \AKSRT\Auth\Service::login_user($payload, 'login');
$result = \AKSRT\Auth\Service::login_user($payload);
if (empty($result['success'])) {
return $this->error(__('账号或密码错误', 'aksrt'), 401);
}
@@ -309,25 +329,23 @@ trait UserControllerAuthPhoneOperations {
if (($channel === 'email' && !is_email($target)) || ($channel === 'phone' && !preg_match('/^1[3-9]\d{9}$/', $target))) {
return $this->error(__('请输入有效的邮箱或手机号', 'aksrt'));
}
if (function_exists('aksrt_require_captcha')) {
$captcha = aksrt_require_captcha('register', $payload);
if ($captcha !== true) {
return $this->error((string) $captcha);
}
$captcha_error = $this->auth_require_captcha('register', $payload);
if ($captcha_error) {
return $captcha_error;
}
$verification_completed = false;
if ($signup_verification) {
if (!$this->auth_consume_code('register', $target, sanitize_text_field((string) ($payload['code'] ?? '')), $channel)) {
return $this->error(__('验证码错误或已过期', 'aksrt'));
}
$payload['_auth_code_verified'] = true;
$verification_completed = true;
}
if (!class_exists('\AKSRT\Auth\Service')) {
return $this->error(__('认证服务不可用', 'aksrt'), 500);
}
if ($channel === 'phone') {
$payload['phone'] = $target;
$payload['_defer_login'] = !empty($oauth_data);
$result = \AKSRT\Auth\Service::register_by_phone($payload);
$result = \AKSRT\Auth\Service::register_by_phone($payload, $verification_completed, !empty($oauth_data));
if (empty($result['success'])) {
return $this->error($this->auth_registration_error((string) ($result['error'] ?? __('注册失败', 'aksrt'))));
}
@@ -348,21 +366,20 @@ trait UserControllerAuthPhoneOperations {
$payload['user_email'] = sanitize_email($target);
$payload['user_pass'] = (string) ($payload['password'] ?? '');
$payload['user_pass_confirm'] = (string) ($payload['password_confirm'] ?? $payload['password'] ?? '');
$payload['_defer_login'] = !empty($oauth_data);
$result = \AKSRT\Auth\Service::register_user($payload);
$result = \AKSRT\Auth\Service::register_user($payload, $verification_completed, !empty($oauth_data));
if (empty($result['success'])) {
return $this->error($this->auth_registration_error((string) ($result['error'] ?? __('注册失败', 'aksrt'))));
}
$user_id = (int) ($result['user_id'] ?? 0);
if ($oauth_data && $user_id > 0) {
$binding = \AKSRT\Auth\Service::finalize_oauth_binding($user_id, $oauth_data, $obk);
if (is_wp_error($binding)) {
wp_delete_user($user_id);
return $this->error($binding->get_error_message(), 409);
}
if (is_wp_error($binding)) {
$this->delete_oauth_registration_user($user_id);
return $this->error($binding->get_error_message(), 409);
}
$user = get_user_by('id', $user_id);
if ($user instanceof \WP_User) {
if ($channel === 'email' && !empty($payload['_auth_code_verified'])) {
if ($channel === 'email' && $verification_completed) {
\AKSRT\Auth\Service::mark_verified_email($user_id);
}
\AKSRT\Auth\OAuthAccountService::complete_login($user, true);
@@ -393,11 +410,9 @@ trait UserControllerAuthPhoneOperations {
if ($this->auth_rate_limited('reset-password', $target, 8, HOUR_IN_SECONDS)) {
return $this->error(__('请求过于频繁，请稍后再试', 'aksrt'), 429);
}
if (function_exists('aksrt_require_captcha')) {
$captcha = aksrt_require_captcha('lostpassword', $payload);
if ($captcha !== true) {
return $this->error((string) $captcha);
}
$captcha_error = $this->auth_require_captcha('lostpassword', $payload);
if ($captcha_error) {
return $captcha_error;
}
$user = $this->auth_find_user($target, $channel);
$password = (string) ($payload['password'] ?? '');
@@ -425,10 +440,8 @@ trait UserControllerAuthPhoneOperations {
if (!preg_match('/^1[3-9]\d{9}$/', $phone)) {
return $this->error(__('手机号格式不正确', 'aksrt'));
}
if (function_exists('aksrt_require_captcha')) {
$captcha = aksrt_require_captcha('bind_phone', $payload);
if ($captcha !== true) return $this->error((string) $captcha);
}
$captcha_error = $this->auth_require_captcha('bind_phone', $payload);
if ($captcha_error) return $captcha_error;
if (!class_exists('\AKSRT\Sms\SMS')) return $this->error(__('短信服务不可用', 'aksrt'), 503);
$result = \AKSRT\Sms\SMS::get_instance()->send_code($phone);
return !empty($result['success'])
@@ -439,6 +452,8 @@ trait UserControllerAuthPhoneOperations {
public function user_bind_phone(\WP_REST_Request $request): \WP_REST_Response {
$payload = $this->auth_payload($request);
if (!$this->auth_verify_rest_nonce($request, $payload)) return $this->error(__('安全验证失败', 'aksrt'), 403);
$captcha_error = $this->auth_require_captcha('bind_phone', $payload);
if ($captcha_error) return $captcha_error;
if (!class_exists('\AKSRT\Auth\Service')) return $this->error(__('认证服务不可用', 'aksrt'), 500);
$result = \AKSRT\Auth\Service::bind_phone($payload);
return !empty($result['success']) ? $this->success(['message' => $result['message'] ?? __('绑定成功', 'aksrt')]) : $this->error((string) ($result['error'] ?? __('绑定失败', 'aksrt')));