feat(captcha): 打通人机验证 11 个场景的前后端完整链路
- 统一验证入口 aksrt_require_captcha()，返回 true|WP_Error，启用场景配置缺失时 fail-closed 拒绝 - 前端公共 API 重构为 window.AKSRTCaptcha（verify/collect/reset/run），单飞锁防并发重复验证，一次性 proof 绑定浏览器 cookie+场景+服务商+主机名 - challenge/exchange REST 端点：challenge 原子占用防票据放大厂商调用，增加频率限制 - 新增 OAuth bind pass：服务端签发 5 分钟一次性令牌，绑定用户+服务商+浏览器，微信扫码延迟消费 - 覆盖场景：评论、登录、注册、绑定第三方、绑定手机、找回密码、修改密码、更改邮箱、资料下载、签到、前台投稿 - 移除 Service 层重复验证与 _auth_code_verified/_defer_login 等客户端可伪造标志，删除下载共享 pass 死代码 - 修复腾讯 TC3 签名 scope、Cloudflare action/cdata/hostname 严格校验、阿里云验签错误码映射 - 后台 Schema 保存对 secret 字段做掩码/保留合并；导入导出过滤 aksrt_captcha_config - 重建 public bundle 与 admin SPA；新增 captcha 运行时/安全/业务契约测试与 harness
This commit is contained in:
@@ -29,6 +29,30 @@ trait UserControllerAuthPhoneOperations {
|
||||
return $nonce !== '' && (bool) wp_verify_nonce($nonce, 'wp_rest');
|
||||
}
|
||||
|
||||
private function auth_require_captcha(string $scene, array $payload): ?\WP_REST_Response {
|
||||
$result = aksrt_require_captcha($scene, $payload);
|
||||
if ($result === true) {
|
||||
return null;
|
||||
}
|
||||
|
||||
if (is_wp_error($result)) {
|
||||
$data = $result->get_error_data();
|
||||
$status = is_array($data) ? (int) ($data['status'] ?? 400) : 400;
|
||||
$message = $result->get_error_message() ?: __('人机验证失败', 'aksrt');
|
||||
return new \WP_REST_Response([
|
||||
'success' => false,
|
||||
'code' => $result->get_error_code() ?: 'aksrt_captcha_failed',
|
||||
'message' => $message,
|
||||
], $status > 0 ? $status : 400);
|
||||
}
|
||||
|
||||
return new \WP_REST_Response([
|
||||
'success' => false,
|
||||
'code' => 'aksrt_captcha_failed',
|
||||
'message' => __('人机验证失败', 'aksrt'),
|
||||
], 400);
|
||||
}
|
||||
|
||||
private function auth_rate_key(string $action, string $subject = ''): string {
|
||||
$ip = sanitize_text_field((string) ($_SERVER['REMOTE_ADDR'] ?? '0.0.0.0'));
|
||||
return 'aksrt_auth_rate_' . md5($action . '|' . strtolower($subject) . '|' . $ip);
|
||||
@@ -144,12 +168,10 @@ trait UserControllerAuthPhoneOperations {
|
||||
if ($this->auth_rate_limited('code:' . $scene, $target, 5, HOUR_IN_SECONDS)) {
|
||||
return $this->error(__('请求过于频繁，请稍后再试', 'aksrt'), 429);
|
||||
}
|
||||
if (function_exists('aksrt_require_captcha')) {
|
||||
$captcha_scene = $scene === 'resetpassword' ? 'lostpassword' : $scene;
|
||||
$captcha = aksrt_require_captcha($captcha_scene, $payload);
|
||||
if ($captcha !== true) {
|
||||
return $this->error((string) $captcha);
|
||||
}
|
||||
$captcha_scene = $scene === 'resetpassword' ? 'lostpassword' : $scene;
|
||||
$captcha_error = $this->auth_require_captcha($captcha_scene, $payload);
|
||||
if ($captcha_error) {
|
||||
return $captcha_error;
|
||||
}
|
||||
|
||||
$generic = __('如果信息有效，验证码将发送到该账号', 'aksrt');
|
||||
@@ -207,11 +229,9 @@ trait UserControllerAuthPhoneOperations {
|
||||
if ($this->auth_rate_limited('login', $target)) {
|
||||
return $this->error(__('请求过于频繁，请稍后再试', 'aksrt'), 429);
|
||||
}
|
||||
if (function_exists('aksrt_require_captcha')) {
|
||||
$captcha = aksrt_require_captcha($oauth_data ? 'bind' : 'login', $payload);
|
||||
if ($captcha !== true) {
|
||||
return $this->error((string) $captcha);
|
||||
}
|
||||
$captcha_error = $this->auth_require_captcha($oauth_data ? 'bind' : 'login', $payload);
|
||||
if ($captcha_error) {
|
||||
return $captcha_error;
|
||||
}
|
||||
$redirect = $this->auth_safe_redirect((string) ($payload['redirect_to'] ?? ''), home_url('/'));
|
||||
|
||||
@@ -271,7 +291,7 @@ trait UserControllerAuthPhoneOperations {
|
||||
$redirect = function_exists('aksrt_get_user_center_url') ? aksrt_get_user_center_url() : $redirect;
|
||||
return $this->success(['message' => __('账号绑定成功', 'aksrt'), 'redirect' => $redirect]);
|
||||
}
|
||||
$result = \AKSRT\Auth\Service::login_user($payload, 'login');
|
||||
$result = \AKSRT\Auth\Service::login_user($payload);
|
||||
if (empty($result['success'])) {
|
||||
return $this->error(__('账号或密码错误', 'aksrt'), 401);
|
||||
}
|
||||
@@ -309,25 +329,23 @@ trait UserControllerAuthPhoneOperations {
|
||||
if (($channel === 'email' && !is_email($target)) || ($channel === 'phone' && !preg_match('/^1[3-9]\d{9}$/', $target))) {
|
||||
return $this->error(__('请输入有效的邮箱或手机号', 'aksrt'));
|
||||
}
|
||||
if (function_exists('aksrt_require_captcha')) {
|
||||
$captcha = aksrt_require_captcha('register', $payload);
|
||||
if ($captcha !== true) {
|
||||
return $this->error((string) $captcha);
|
||||
}
|
||||
$captcha_error = $this->auth_require_captcha('register', $payload);
|
||||
if ($captcha_error) {
|
||||
return $captcha_error;
|
||||
}
|
||||
$verification_completed = false;
|
||||
if ($signup_verification) {
|
||||
if (!$this->auth_consume_code('register', $target, sanitize_text_field((string) ($payload['code'] ?? '')), $channel)) {
|
||||
return $this->error(__('验证码错误或已过期', 'aksrt'));
|
||||
}
|
||||
$payload['_auth_code_verified'] = true;
|
||||
$verification_completed = true;
|
||||
}
|
||||
if (!class_exists('\AKSRT\Auth\Service')) {
|
||||
return $this->error(__('认证服务不可用', 'aksrt'), 500);
|
||||
}
|
||||
if ($channel === 'phone') {
|
||||
$payload['phone'] = $target;
|
||||
$payload['_defer_login'] = !empty($oauth_data);
|
||||
$result = \AKSRT\Auth\Service::register_by_phone($payload);
|
||||
$result = \AKSRT\Auth\Service::register_by_phone($payload, $verification_completed, !empty($oauth_data));
|
||||
if (empty($result['success'])) {
|
||||
return $this->error($this->auth_registration_error((string) ($result['error'] ?? __('注册失败', 'aksrt'))));
|
||||
}
|
||||
@@ -348,21 +366,20 @@ trait UserControllerAuthPhoneOperations {
|
||||
$payload['user_email'] = sanitize_email($target);
|
||||
$payload['user_pass'] = (string) ($payload['password'] ?? '');
|
||||
$payload['user_pass_confirm'] = (string) ($payload['password_confirm'] ?? $payload['password'] ?? '');
|
||||
$payload['_defer_login'] = !empty($oauth_data);
|
||||
$result = \AKSRT\Auth\Service::register_user($payload);
|
||||
$result = \AKSRT\Auth\Service::register_user($payload, $verification_completed, !empty($oauth_data));
|
||||
if (empty($result['success'])) {
|
||||
return $this->error($this->auth_registration_error((string) ($result['error'] ?? __('注册失败', 'aksrt'))));
|
||||
}
|
||||
$user_id = (int) ($result['user_id'] ?? 0);
|
||||
if ($oauth_data && $user_id > 0) {
|
||||
$binding = \AKSRT\Auth\Service::finalize_oauth_binding($user_id, $oauth_data, $obk);
|
||||
if (is_wp_error($binding)) {
|
||||
wp_delete_user($user_id);
|
||||
return $this->error($binding->get_error_message(), 409);
|
||||
}
|
||||
if (is_wp_error($binding)) {
|
||||
$this->delete_oauth_registration_user($user_id);
|
||||
return $this->error($binding->get_error_message(), 409);
|
||||
}
|
||||
$user = get_user_by('id', $user_id);
|
||||
if ($user instanceof \WP_User) {
|
||||
if ($channel === 'email' && !empty($payload['_auth_code_verified'])) {
|
||||
if ($channel === 'email' && $verification_completed) {
|
||||
\AKSRT\Auth\Service::mark_verified_email($user_id);
|
||||
}
|
||||
\AKSRT\Auth\OAuthAccountService::complete_login($user, true);
|
||||
@@ -393,11 +410,9 @@ trait UserControllerAuthPhoneOperations {
|
||||
if ($this->auth_rate_limited('reset-password', $target, 8, HOUR_IN_SECONDS)) {
|
||||
return $this->error(__('请求过于频繁，请稍后再试', 'aksrt'), 429);
|
||||
}
|
||||
if (function_exists('aksrt_require_captcha')) {
|
||||
$captcha = aksrt_require_captcha('lostpassword', $payload);
|
||||
if ($captcha !== true) {
|
||||
return $this->error((string) $captcha);
|
||||
}
|
||||
$captcha_error = $this->auth_require_captcha('lostpassword', $payload);
|
||||
if ($captcha_error) {
|
||||
return $captcha_error;
|
||||
}
|
||||
$user = $this->auth_find_user($target, $channel);
|
||||
$password = (string) ($payload['password'] ?? '');
|
||||
@@ -425,10 +440,8 @@ trait UserControllerAuthPhoneOperations {
|
||||
if (!preg_match('/^1[3-9]\d{9}$/', $phone)) {
|
||||
return $this->error(__('手机号格式不正确', 'aksrt'));
|
||||
}
|
||||
if (function_exists('aksrt_require_captcha')) {
|
||||
$captcha = aksrt_require_captcha('bind_phone', $payload);
|
||||
if ($captcha !== true) return $this->error((string) $captcha);
|
||||
}
|
||||
$captcha_error = $this->auth_require_captcha('bind_phone', $payload);
|
||||
if ($captcha_error) return $captcha_error;
|
||||
if (!class_exists('\AKSRT\Sms\SMS')) return $this->error(__('短信服务不可用', 'aksrt'), 503);
|
||||
$result = \AKSRT\Sms\SMS::get_instance()->send_code($phone);
|
||||
return !empty($result['success'])
|
||||
@@ -439,6 +452,8 @@ trait UserControllerAuthPhoneOperations {
|
||||
public function user_bind_phone(\WP_REST_Request $request): \WP_REST_Response {
|
||||
$payload = $this->auth_payload($request);
|
||||
if (!$this->auth_verify_rest_nonce($request, $payload)) return $this->error(__('安全验证失败', 'aksrt'), 403);
|
||||
$captcha_error = $this->auth_require_captcha('bind_phone', $payload);
|
||||
if ($captcha_error) return $captcha_error;
|
||||
if (!class_exists('\AKSRT\Auth\Service')) return $this->error(__('认证服务不可用', 'aksrt'), 500);
|
||||
$result = \AKSRT\Auth\Service::bind_phone($payload);
|
||||
return !empty($result['success']) ? $this->success(['message' => $result['message'] ?? __('绑定成功', 'aksrt')]) : $this->error((string) ($result['error'] ?? __('绑定失败', 'aksrt')));
|
||||
|
||||
Reference in New Issue
Block a user