Skip to content

增加vaptcha对忘记密码页面和注册界面的支持，修复ip因为获取到x_forwarded_for多个代理ip而导致vaptcha不可用 #1332

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
xuanmou wants to merge 4 commits into
base: v3.1
Choose a base branch
from
Open

增加vaptcha对忘记密码页面和注册界面的支持，修复ip因为获取到x_forwarded_for多个代理ip而导致vaptcha不可用 #1332

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
15030ff
增加vaptcha对忘记密码页面和注册界面的支持，修复ip因为获取到x_forwarded_for多个代理ip而导致vaptcha不可用
xuanmou Oct 12, 2025
0d4a9c8
修复ip获取bug
xuanmou Oct 12, 2025
ff2b033
修复注册时报错的bug
xuanmou Oct 12, 2025
d704a5e
修复一处代码错误
xuanmou Oct 12, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
80 changes: 79 additions & 1 deletion functions.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3362,6 +3362,8 @@ function vaptchaInit()
echo $vaptcha->script();
}
add_action('login_form', 'vaptchaInit');
add_action('register_form', 'vaptchaInit');
add_action('lostpassword_form', 'vaptchaInit');

function checkVaptchaAction($user)
{
Expand Down Expand Up @@ -3399,6 +3401,81 @@ function checkVaptchaAction($user)

}
add_filter('authenticate', 'checkVaptchaAction', 20, 3);

function Vaptcha_lostpassword_CHECK($errors)
Copy link

Copilot AI Nov 28, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Function name should follow the codebase naming convention. Change Vaptcha_lostpassword_CHECK to vaptcha_lostpassword_check to match the style used by similar functions like lostpassword_CHECK, turnstile_lostpassword_check, and other captcha verification functions in this file.

Suggested change
function Vaptcha_lostpassword_CHECK($errors)
function vaptcha_lostpassword_check($errors)

Copilot uses AI. Check for mistakes.
{
if (empty($_POST))
{
return false;
Copy link

Copilot AI Nov 28, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The function returns false when $_POST is empty, but this is inconsistent with the expected return type. The lostpassword_post action expects an $errors object to be returned, not false. This should return $errors directly to maintain consistency with the Turnstile implementation (line 3524) which returns $errors for similar conditions.

Suggested change
return false;
return $errors;

Copilot uses AI. Check for mistakes.
}
if (!(isset($_POST['vaptcha_server']) && isset($_POST['vaptcha_token'])))
{
return $errors->add('invalid_vaptcha ', '<strong>错误</strong>：请先进行人机验证');
Copy link

Copilot AI Nov 28, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Trailing space after error code identifier 'invalid_vaptcha '. Remove the trailing space to make it 'invalid_vaptcha' for consistency.

Copilot uses AI. Check for mistakes.
}
if (!preg_match('/^https:\/\/([\w-]+\.)+[\w-]*([^<>=?\"\'])*$/', $_POST['vaptcha_server']) || !preg_match('/^[\w\-\$]+$/', $_POST['vaptcha_token']))
{
return $errors->add('invalid_vaptcha ', '<strong>错误</strong>：非法数据');
Copy link

Copilot AI Nov 28, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Trailing space after error code identifier 'invalid_vaptcha '. Remove the trailing space to make it 'invalid_vaptcha' for consistency.

Copilot uses AI. Check for mistakes.
}
include_once('inc/classes/Vaptcha.php');
$url = $_POST['vaptcha_server'];
$token = $_POST['vaptcha_token'];
$ip = get_the_user_ip();
$vaptcha = new Sakura\API\Vaptcha;
$response = $vaptcha->checkVaptcha($url, $token, $ip);
if ($response->msg && $response->success && $response->score) {
if ($response->success === 1 && $response->score >= 70) {
return $errors;
}
if ($response->success === 0) {
$errorcode = $response->msg;
return $errors->add('invalid_vaptcha ', '<strong>错误</strong>：非法数据' . $errorcode);
Copy link

Copilot AI Nov 28, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Trailing space after error code identifier 'invalid_vaptcha '. Remove the trailing space to make it 'invalid_vaptcha' for consistency.

Copilot uses AI. Check for mistakes.
}
return $errors->add('invalid_vaptcha ', '<strong>错误</strong>：人机验证失败');
Copy link

Copilot AI Nov 28, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Trailing space after error code identifier 'invalid_vaptcha '. Remove the trailing space to make it 'invalid_vaptcha' for consistency.

Copilot uses AI. Check for mistakes.

} else if (is_string($response)) {
return $errors->add('invalid_vaptcha ', '<strong>错误</strong>：' . $response);
Copy link

Copilot AI Nov 28, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Trailing space after error code identifier 'invalid_vaptcha '. Remove the trailing space to make it 'invalid_vaptcha' for consistency.

Copilot uses AI. Check for mistakes.
}
return $errors->add('invalid_vaptcha ', '<strong>错误</strong>：未知错误');
Copy link

Copilot AI Nov 28, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Trailing space after error code identifier 'invalid_vaptcha '. Remove the trailing space to make it 'invalid_vaptcha' for consistency.

Copilot uses AI. Check for mistakes.
}
Comment on lines +3405 to +3439
Copy link

Copilot AI Nov 28, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There is significant code duplication between this function and checkVaptchaAction (lines 3368-3402). The only differences are in line 3409 (return value) and line 3413 (error code). Consider extracting the common validation logic into a shared helper function to improve maintainability and reduce code duplication.

Copilot uses AI. Check for mistakes.
add_action('lostpassword_post', 'Vaptcha_lostpassword_CHECK');

function Vaptcha_registration_CHECK($errors, $sanitized_user_login, $user_email)
Copy link

Copilot AI Nov 28, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Function name should follow the codebase naming convention. Change Vaptcha_registration_CHECK to vaptcha_registration_check to match the style used by similar functions like registration_CAPTCHA_CHECK, turnstile_registration_check, and other captcha verification functions in this file.

Suggested change
function Vaptcha_registration_CHECK($errors, $sanitized_user_login, $user_email)
function vaptcha_registration_check($errors, $sanitized_user_login, $user_email)

Copilot uses AI. Check for mistakes.
{
if (empty($_POST))
{
return new WP_Error();
}
if (!(isset($_POST['vaptcha_server']) && isset($_POST['vaptcha_token'])))
{
return new WP_Error('prooffail', '<strong>错误</strong>：请先进行人机验证');
}
if (!preg_match('/^https:\/\/([\w-]+\.)+[\w-]*([^<>=?\"\'])*$/', $_POST['vaptcha_server']) || !preg_match('/^[\w\-\$]+$/', $_POST['vaptcha_token']))
{
return new WP_Error('prooffail', '<strong>错误</strong>：非法数据');
}
include_once('inc/classes/Vaptcha.php');
$url = $_POST['vaptcha_server'];
$token = $_POST['vaptcha_token'];
$ip = get_the_user_ip();
$vaptcha = new Sakura\API\Vaptcha;
$response = $vaptcha->checkVaptcha($url, $token, $ip);
if ($response->msg && $response->success && $response->score) {
if ($response->success === 1 && $response->score >= 70) {
return $errors;
}
if ($response->success === 0) {
$errorcode = $response->msg;
return new WP_Error('prooffail', '<strong>错误</strong>：非法数据' . $errorcode);
Copy link

Copilot AI Nov 28, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Missing space before concatenation operator. The error message should be '<strong>错误</strong>：非法数据' . $errorcode with spaces around the . operator for better readability and consistency with PHP coding standards.

Copilot uses AI. Check for mistakes.
}
return new WP_Error('prooffail', '<strong>错误</strong>：人机验证失败');

} else if (is_string($response)) {
return new WP_Error('prooffail', '<strong>错误</strong>：' . $response);
}
return new WP_Error('prooffail', '<strong>错误</strong>：未知错误');
}
Comment on lines +3442 to +3476
Copy link

Copilot AI Nov 28, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There is significant code duplication between this function and checkVaptchaAction (lines 3368-3402). The validation logic is nearly identical. Consider extracting the common validation logic into a shared helper function to improve maintainability and reduce code duplication.

Copilot uses AI. Check for mistakes.
add_filter('registration_errors', 'Vaptcha_registration_CHECK', 2, 3);

} else if ((iro_opt('captcha_select') === 'turnstile') && (!empty(iro_opt("turnstile_site_key")) && !empty(iro_opt("turnstile_secret_key")))) {
function turnstile_init() {
include_once('inc/classes/Turnstile.php');
Expand Down Expand Up @@ -3599,7 +3676,8 @@ function get_the_user_ip()
// 简略版
// $ip = $_SERVER['HTTP_CLIENT_IP'] ?: ($_SERVER['HTTP_X_FORWARDED_FOR'] ?: $_SERVER['REMOTE_ADDR']);
$ip = $_SERVER['HTTP_CLIENT_IP'] ?? $_SERVER['HTTP_X_FORWARDED_FOR'] ?? $_SERVER['REMOTE_ADDR'];
return apply_filters('wpb_get_ip', $ip);
$ip2 = explode('|', str_replace(',', '|', $ip));
return apply_filters('wpb_get_ip', trim($ip2[0])); //解决HTTP_X_FORWARDED_FOR获取到代理地址而导致人机验证不通过
Comment on lines +3679 to +3680
Copy link

Copilot AI Nov 28, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The delimiter handling uses pipe character | but HTTP_X_FORWARDED_FOR typically uses commas (,) as separators, not pipes. The str_replace(',', '|', $ip) converts commas to pipes and then explodes on pipes, which is unnecessarily convoluted. Consider simplifying to: $ip_array = explode(',', $ip); return apply_filters('wpb_get_ip', trim($ip_array[0]));

Suggested change
$ip2 = explode('|', str_replace(',', '|', $ip));
return apply_filters('wpb_get_ip', trim($ip2[0])); //解决HTTP_X_FORWARDED_FOR获取到代理地址而导致人机验证不通过
$ip_array = explode(',', $ip);
return apply_filters('wpb_get_ip', trim($ip_array[0])); //解决HTTP_X_FORWARDED_FOR获取到代理地址而导致人机验证不通过

Copilot uses AI. Check for mistakes.
Copy link

Copilot AI Nov 28, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The function assumes HTTP_CLIENT_IP and HTTP_X_FORWARDED_FOR always contain valid IP addresses, but these headers can be spoofed by clients. While this PR fixes the issue of multiple proxy IPs, consider adding validation to ensure the extracted IP is actually a valid IP address using filter_var($ip, FILTER_VALIDATE_IP) before returning it.

Suggested change
return apply_filters('wpb_get_ip', trim($ip2[0])); //解决HTTP_X_FORWARDED_FOR获取到代理地址而导致人机验证不通过
$user_ip = trim($ip2[0]);
if (!filter_var($user_ip, FILTER_VALIDATE_IP)) {
$user_ip = '';
}
return apply_filters('wpb_get_ip', $user_ip); //解决HTTP_X_FORWARDED_FOR获取到代理地址而导致人机验证不通过

Copilot uses AI. Check for mistakes.
}

//归档页信息缓存
Expand Down