kate522
ff4ec1eb43
- 统一验证入口 aksrt_require_captcha()，返回 true|WP_Error，启用场景配置缺失时 fail-closed 拒绝 - 前端公共 API 重构为 window.AKSRTCaptcha（verify/collect/reset/run），单飞锁防并发重复验证，一次性 proof 绑定浏览器 cookie+场景+服务商+主机名 - challenge/exchange REST 端点：challenge 原子占用防票据放大厂商调用，增加频率限制 - 新增 OAuth bind pass：服务端签发 5 分钟一次性令牌，绑定用户+服务商+浏览器，微信扫码延迟消费 - 覆盖场景：评论、登录、注册、绑定第三方、绑定手机、找回密码、修改密码、更改邮箱、资料下载、签到、前台投稿 - 移除 Service 层重复验证与 _auth_code_verified/_defer_login 等客户端可伪造标志，删除下载共享 pass 死代码 - 修复腾讯 TC3 签名 scope、Cloudflare action/cdata/hostname 严格校验、阿里云验签错误码映射 - 后台 Schema 保存对 secret 字段做掩码/保留合并；导入导出过滤 aksrt_captcha_config - 重建 public bundle 与 admin SPA；新增 captcha 运行时/安全/业务契约测试与 harness
94 lines
3.8 KiB
PHP
94 lines
3.8 KiB
PHP
<?php
|
|
/**
|
|
* User center settings: OAuth binding list.
|
|
*
|
|
* Expects extracted $context vars.
|
|
*
|
|
* @package AKSRT
|
|
*/
|
|
|
|
defined('ABSPATH') || exit;
|
|
|
|
$oauth = class_exists('\AKSRT\Auth\OAuth') ? \AKSRT\Auth\OAuth::get_instance() : null;
|
|
$oauth_data = $oauth ? $oauth->get_frontend_bindings_data($user_id) : ['bindings' => [], 'available' => []];
|
|
$binding_name_map = [
|
|
'github' => 'GitHub',
|
|
'gitee' => 'Gitee',
|
|
'qq' => 'QQ',
|
|
'google' => 'Google',
|
|
'weibo' => '微博',
|
|
'weixin' => '微信',
|
|
'weixingzh' => '微信公众号',
|
|
];
|
|
$binding_rows = [];
|
|
foreach ((array) ($oauth_data['bindings'] ?? []) as $binding) {
|
|
$key = sanitize_key((string) ($binding['provider'] ?? $binding['key'] ?? $binding['name'] ?? ''));
|
|
if (!$key) {
|
|
continue;
|
|
}
|
|
$binding_rows[$key] = [
|
|
'key' => $key,
|
|
'name' => (string) ($binding['label'] ?? $binding_name_map[$key] ?? $binding['name'] ?? ucfirst($key)),
|
|
'icon' => $binding['icon'] ?? '',
|
|
'is_bound' => true,
|
|
'url' => '',
|
|
];
|
|
}
|
|
foreach ((array) ($oauth_data['available'] ?? []) as $binding) {
|
|
$key = sanitize_key((string) ($binding['provider'] ?? $binding['key'] ?? $binding['name'] ?? ''));
|
|
if (!$key) {
|
|
continue;
|
|
}
|
|
$binding_rows[$key] = [
|
|
'key' => $key,
|
|
'name' => (string) ($binding['label'] ?? $binding_name_map[$key] ?? $binding['name'] ?? ucfirst($key)),
|
|
'icon' => $binding['icon'] ?? '',
|
|
'is_bound' => false,
|
|
'url' => $binding['start_url'] ?? $binding['url'] ?? '',
|
|
];
|
|
}
|
|
?>
|
|
<div class="settings-section" data-aksrt-captcha-scope>
|
|
<div class="settings-section__header">
|
|
<span class="settings-icon"><i class="fa fas fa-link" aria-hidden="true"></i></span>
|
|
<h3 class="widget-title settings-section__title"><?php esc_html_e('社交账号绑定', 'aksrt'); ?></h3>
|
|
</div>
|
|
|
|
<?php if (!empty($binding_rows)) : ?>
|
|
<p class="settings-hint settings-hint--top"><?php esc_html_e('点击下方按钮管理第三方账号绑定状态：', 'aksrt'); ?></p>
|
|
<?php if (function_exists('aksrt_render_captcha')) : ?>
|
|
<div class="binding-captcha" data-aksrt-oauth-bind-captcha><?php aksrt_render_captcha('bind'); ?></div>
|
|
<?php endif; ?>
|
|
<div class="binding-list">
|
|
<?php foreach ($binding_rows as $binding) : ?>
|
|
<?php if (!empty($binding['is_bound'])) : ?>
|
|
<div class="binding-item">
|
|
<span class="binding-item__icon"><?php echo $binding['icon']; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped ?></span>
|
|
<span class="binding-item__meta">
|
|
<span class="binding-status">
|
|
<i class="fa fas fa-check-circle badge__icon" aria-hidden="true"></i>
|
|
<?php esc_html_e('已绑定', 'aksrt'); ?>
|
|
</span>
|
|
<span class="binding-item__name"><?php echo esc_html($binding['name']); ?></span>
|
|
</span>
|
|
<button type="button" class="binding-unbind-btn" data-provider="<?php echo esc_attr($binding['key']); ?>">
|
|
<?php esc_html_e('解绑', 'aksrt'); ?>
|
|
</button>
|
|
</div>
|
|
<?php else : ?>
|
|
<a href="<?php echo esc_url($binding['url']); ?>" class="binding-item binding-item--linkable" target="_self" data-provider="<?php echo esc_attr($binding['key']); ?>" data-bind-start-url="<?php echo esc_url($binding['url']); ?>">
|
|
<span class="binding-item__icon"><?php echo $binding['icon']; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped ?></span>
|
|
<span class="binding-item__meta">
|
|
<span class="binding-status binding-status--idle"><?php esc_html_e('未绑定', 'aksrt'); ?></span>
|
|
<span class="binding-item__name"><?php echo esc_html($binding['name']); ?></span>
|
|
</span>
|
|
<span class="badge badge--bind"><?php esc_html_e('绑定', 'aksrt'); ?></span>
|
|
</a>
|
|
<?php endif; ?>
|
|
<?php endforeach; ?>
|
|
</div>
|
|
<?php else : ?>
|
|
<p class="settings-empty"><?php esc_html_e('暂无可用的第三方登录服务', 'aksrt'); ?></p>
|
|
<?php endif; ?>
|
|
</div>
|