增加vaptcha对忘记密码页面和注册界面的支持，修复ip因为获取到x_forwarded_for多个代理ip而导致vaptcha不可用 #1332

xuanmou · 2025-10-12T06:11:23Z

No description provided.

github-actions · 2025-11-27T02:21:45Z

这个 PR 已经 45 天没有任何活动了，将被标记为过时 stale 。删除 stale 的标签或评论，否则将在 10 天内关闭。

Copilot

Pull request overview

This PR extends Vaptcha CAPTCHA support to the forgot password and registration pages, and fixes an issue where the get_the_user_ip() function was failing with multiple proxy IPs in the X-Forwarded-For header.

Key changes:

Added Vaptcha initialization hooks to registration and forgot password forms
Implemented validation functions for Vaptcha on registration and password reset flows
Modified IP extraction logic to handle comma-separated proxy IP lists

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review for a chance to win a $100 gift card. Take the survey.

Copilot · 2025-11-28T02:11:14Z

functions.php

+            }
+            if ($response->success === 0) {
+                $errorcode = $response->msg;
+                return new WP_Error('prooffail', '<strong>错误</strong>：非法数据' . $errorcode);


Missing space before concatenation operator. The error message should be '<strong>错误</strong>：非法数据' . $errorcode with spaces around the . operator for better readability and consistency with PHP coding standards.

Copilot · 2025-11-28T02:11:15Z

functions.php

    }
    add_filter('authenticate', 'checkVaptchaAction', 20, 3);
+
+    function Vaptcha_lostpassword_CHECK($errors)


Function name should follow the codebase naming convention. Change Vaptcha_lostpassword_CHECK to vaptcha_lostpassword_check to match the style used by similar functions like lostpassword_CHECK, turnstile_lostpassword_check, and other captcha verification functions in this file.

Suggested change

function Vaptcha_lostpassword_CHECK($errors)

function vaptcha_lostpassword_check($errors)

Copilot · 2025-11-28T02:11:15Z

functions.php

+        }
+        if (!(isset($_POST['vaptcha_server']) && isset($_POST['vaptcha_token']))) 
+        {
+            return $errors->add('invalid_vaptcha ', '<strong>错误</strong>：请先进行人机验证');


Trailing space after error code identifier 'invalid_vaptcha '. Remove the trailing space to make it 'invalid_vaptcha' for consistency.

Copilot · 2025-11-28T02:11:15Z

functions.php

+        }
+        if (!preg_match('/^https:\/\/([\w-]+\.)+[\w-]*([^<>=?\"\'])*$/', $_POST['vaptcha_server']) || !preg_match('/^[\w\-\$]+$/', $_POST['vaptcha_token'])) 
+        {
+            return $errors->add('invalid_vaptcha ', '<strong>错误</strong>：非法数据');


Trailing space after error code identifier 'invalid_vaptcha '. Remove the trailing space to make it 'invalid_vaptcha' for consistency.

Copilot · 2025-11-28T02:11:15Z

functions.php

+                $errorcode = $response->msg;
+                return $errors->add('invalid_vaptcha ', '<strong>错误</strong>：非法数据' . $errorcode);
+            }
+            return $errors->add('invalid_vaptcha ', '<strong>错误</strong>：人机验证失败');


Trailing space after error code identifier 'invalid_vaptcha '. Remove the trailing space to make it 'invalid_vaptcha' for consistency.

Copilot · 2025-11-28T02:11:16Z

functions.php

+    }
+    add_action('lostpassword_post', 'Vaptcha_lostpassword_CHECK');
+
+    function Vaptcha_registration_CHECK($errors, $sanitized_user_login, $user_email)


Function name should follow the codebase naming convention. Change Vaptcha_registration_CHECK to vaptcha_registration_check to match the style used by similar functions like registration_CAPTCHA_CHECK, turnstile_registration_check, and other captcha verification functions in this file.

Suggested change

function Vaptcha_registration_CHECK($errors, $sanitized_user_login, $user_email)

function vaptcha_registration_check($errors, $sanitized_user_login, $user_email)

Copilot · 2025-11-28T02:11:17Z

functions.php

+    {
+        if (empty($_POST)) 
+        {
+            return false;


The function returns false when $_POST is empty, but this is inconsistent with the expected return type. The lostpassword_post action expects an $errors object to be returned, not false. This should return $errors directly to maintain consistency with the Turnstile implementation (line 3524) which returns $errors for similar conditions.

Suggested change

return false;

return $errors;

Copilot · 2025-11-28T02:11:17Z

functions.php

+            }
+            if ($response->success === 0) {
+                $errorcode = $response->msg;
+                return $errors->add('invalid_vaptcha ', '<strong>错误</strong>：非法数据' . $errorcode);


Trailing space after error code identifier 'invalid_vaptcha '. Remove the trailing space to make it 'invalid_vaptcha' for consistency.

Copilot · 2025-11-28T02:11:17Z

functions.php

+    $ip2 = explode('|', str_replace(',', '|', $ip));
+    return apply_filters('wpb_get_ip', trim($ip2[0])); //解决HTTP_X_FORWARDED_FOR获取到代理地址而导致人机验证不通过


The delimiter handling uses pipe character | but HTTP_X_FORWARDED_FOR typically uses commas (,) as separators, not pipes. The str_replace(',', '|', $ip) converts commas to pipes and then explodes on pipes, which is unnecessarily convoluted. Consider simplifying to: $ip_array = explode(',', $ip); return apply_filters('wpb_get_ip', trim($ip_array[0]));

Suggested change

$ip2 = explode('|', str_replace(',', '|', $ip));

return apply_filters('wpb_get_ip', trim($ip2[0])); //解决HTTP_X_FORWARDED_FOR获取到代理地址而导致人机验证不通过

$ip_array = explode(',', $ip);

return apply_filters('wpb_get_ip', trim($ip_array[0])); //解决HTTP_X_FORWARDED_FOR获取到代理地址而导致人机验证不通过

Copilot · 2025-11-28T02:11:17Z

functions.php

    $ip = $_SERVER['HTTP_CLIENT_IP'] ?? $_SERVER['HTTP_X_FORWARDED_FOR'] ?? $_SERVER['REMOTE_ADDR'];
-    return apply_filters('wpb_get_ip', $ip);
+    $ip2 = explode('|', str_replace(',', '|', $ip));
+    return apply_filters('wpb_get_ip', trim($ip2[0])); //解决HTTP_X_FORWARDED_FOR获取到代理地址而导致人机验证不通过


The function assumes HTTP_CLIENT_IP and HTTP_X_FORWARDED_FOR always contain valid IP addresses, but these headers can be spoofed by clients. While this PR fixes the issue of multiple proxy IPs, consider adding validation to ensure the extracted IP is actually a valid IP address using filter_var($ip, FILTER_VALIDATE_IP) before returning it.

Suggested change

return apply_filters('wpb_get_ip', trim($ip2[0])); //解决HTTP_X_FORWARDED_FOR获取到代理地址而导致人机验证不通过

$user_ip = trim($ip2[0]);

if (!filter_var($user_ip, FILTER_VALIDATE_IP)) {

$user_ip = '';

}

return apply_filters('wpb_get_ip', $user_ip); //解决HTTP_X_FORWARDED_FOR获取到代理地址而导致人机验证不通过

xuanmou added 4 commits October 12, 2025 14:03

增加vaptcha对忘记密码页面和注册界面的支持，修复ip因为获取到x_forwarded_for多个代理ip而导致vaptcha不可用

15030ff

修复ip获取bug

0d4a9c8

修复注册时报错的bug

ff2b033

修复一处代码错误

d704a5e

github-actions bot added the Stale label Nov 27, 2025

KotoriK requested a review from Copilot November 28, 2025 02:05

Copilot started reviewing on behalf of KotoriK November 28, 2025 02:06 View session

Copilot finished reviewing on behalf of KotoriK November 28, 2025 02:08

Copilot AI reviewed Nov 28, 2025

View reviewed changes

github-actions bot removed the Stale label Nov 28, 2025

	function Vaptcha_lostpassword_CHECK($errors)
	function vaptcha_lostpassword_check($errors)

	function Vaptcha_registration_CHECK($errors, $sanitized_user_login, $user_email)
	function vaptcha_registration_check($errors, $sanitized_user_login, $user_email)

		$ip2 = explode('\|', str_replace(',', '\|', $ip));
		return apply_filters('wpb_get_ip', trim($ip2[0])); //解决HTTP_X_FORWARDED_FOR获取到代理地址而导致人机验证不通过

-    return apply_filters('wpb_get_ip', trim($ip2[0])); //解决HTTP_X_FORWARDED_FOR获取到代理地址而导致人机验证不通过
+    $user_ip = trim($ip2[0]);
+    if (!filter_var($user_ip, FILTER_VALIDATE_IP)) {
+        $user_ip = '';
+    }
+    return apply_filters('wpb_get_ip', $user_ip); //解决HTTP_X_FORWARDED_FOR获取到代理地址而导致人机验证不通过

Uh oh!

增加vaptcha对忘记密码页面和注册界面的支持，修复ip因为获取到x_forwarded_for多个代理ip而导致vaptcha不可用 #1332

Are you sure you want to change the base?

增加vaptcha对忘记密码页面和注册界面的支持，修复ip因为获取到x_forwarded_for多个代理ip而导致vaptcha不可用 #1332

Uh oh!

Conversation

xuanmou commented Oct 12, 2025

Uh oh!

github-actions bot commented Nov 27, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Nov 28, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 28, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 28, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 28, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 28, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 28, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 28, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 28, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 28, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 28, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant