kate522
ff4ec1eb43
- 统一验证入口 aksrt_require_captcha()，返回 true|WP_Error，启用场景配置缺失时 fail-closed 拒绝 - 前端公共 API 重构为 window.AKSRTCaptcha（verify/collect/reset/run），单飞锁防并发重复验证，一次性 proof 绑定浏览器 cookie+场景+服务商+主机名 - challenge/exchange REST 端点：challenge 原子占用防票据放大厂商调用，增加频率限制 - 新增 OAuth bind pass：服务端签发 5 分钟一次性令牌，绑定用户+服务商+浏览器，微信扫码延迟消费 - 覆盖场景：评论、登录、注册、绑定第三方、绑定手机、找回密码、修改密码、更改邮箱、资料下载、签到、前台投稿 - 移除 Service 层重复验证与 _auth_code_verified/_defer_login 等客户端可伪造标志，删除下载共享 pass 死代码 - 修复腾讯 TC3 签名 scope、Cloudflare action/cdata/hostname 严格校验、阿里云验签错误码映射 - 后台 Schema 保存对 secret 字段做掩码/保留合并；导入导出过滤 aksrt_captcha_config - 重建 public bundle 与 admin SPA；新增 captcha 运行时/安全/业务契约测试与 harness
65 lines
3.2 KiB
JavaScript
65 lines
3.2 KiB
JavaScript
'use strict';
|
|
|
|
const assert = require('node:assert/strict');
|
|
const fs = require('node:fs');
|
|
const path = require('node:path');
|
|
const test = require('node:test');
|
|
|
|
const root = path.resolve(__dirname, '..', '..');
|
|
const read = (file) => fs.readFileSync(path.join(root, file), 'utf8');
|
|
|
|
test('comment REST admission is request-local and preprocess keeps native captcha enforcement', () => {
|
|
const controller = read('src/Core/CommentActions.php');
|
|
const moderation = read('src/Auth/Moderation.php');
|
|
|
|
assert.match(controller, /aksrt_require_captcha\('comment', \$params\)/);
|
|
assert.match(controller, /begin_captcha_verified_comment_request\(\)[\s\S]*?try \{[\s\S]*?wp_new_comment[\s\S]*?finally \{[\s\S]*?end_captcha_verified_comment_request\(\)/);
|
|
assert.match(moderation, /private \$captcha_verified_comment_request_depth = 0/);
|
|
assert.match(moderation, /if \(\$this->captcha_verified_comment_request_depth === 0\) \{/);
|
|
assert.doesNotMatch(controller + moderation, /function_exists\('aksrt_require_captcha'\)/);
|
|
assert.doesNotMatch(controller + moderation, /\$_(?:POST|REQUEST)\[[^\]]*captcha[^\]]*verified|set_transient\([^\n]*comment/i);
|
|
});
|
|
|
|
test('captcha business failures preserve WP_Error codes and never stringify opaque results', () => {
|
|
const sources = [
|
|
read('src/Core/CommentActions.php'),
|
|
read('src/Auth/Moderation.php'),
|
|
read('src/Admin/UserControllerAuthPhoneOperations.php'),
|
|
read('inc/modules/user-parts/account-ajax.php'),
|
|
read('src/Core/FrontSubmit.php'),
|
|
].join('\n');
|
|
|
|
assert.match(sources, /get_error_code\(\)/);
|
|
assert.match(sources, /get_error_message\(\)/);
|
|
assert.doesNotMatch(sources, /\(string\)\s*\$(?:captcha|verify|result)/);
|
|
});
|
|
|
|
test('password and email account flows verify captcha once per distinct HTTP request', () => {
|
|
const account = read('inc/modules/user-parts/account-ajax.php');
|
|
const methodBody = (action, nextAction = '') => {
|
|
const start = account.indexOf(`add_action('${action}'`);
|
|
const end = nextAction ? account.indexOf(`add_action('${nextAction}'`, start + 1) : account.length;
|
|
return account.slice(start, end === -1 ? account.length : end);
|
|
};
|
|
|
|
const send = methodBody('wp_ajax_aksrt_send_email_code', 'wp_ajax_aksrt_change_password');
|
|
const password = methodBody('wp_ajax_aksrt_change_password', 'wp_ajax_aksrt_change_email');
|
|
const email = methodBody('wp_ajax_aksrt_change_email');
|
|
|
|
assert.equal((send.match(/aksrt_require_captcha\(/g) || []).length, 1);
|
|
assert.match(send, /aksrt_require_captcha\( \$scene,/);
|
|
assert.equal((password.match(/aksrt_require_captcha\(/g) || []).length, 1);
|
|
assert.match(password, /aksrt_require_captcha\( 'change_password'/);
|
|
assert.equal((email.match(/aksrt_require_captcha\(/g) || []).length, 1);
|
|
assert.match(email, /aksrt_require_captcha\( 'change_email'/);
|
|
});
|
|
|
|
test('legacy public SMS-code AJAX surface is removed while SMS service remains', () => {
|
|
const sms = read('src/Sms/SMS.php');
|
|
|
|
assert.doesNotMatch(sms, /aksrt_send_sms_code/);
|
|
assert.doesNotMatch(sms, /function ajax_send_code\s*\(/);
|
|
assert.match(sms, /public function send_code\(string \$phone\): array/);
|
|
assert.match(sms, /public function verify_code\(string \$phone, string \$code\): array/);
|
|
});
|