增加vaptcha对忘记密码页面和注册界面的支持，修复ip因为获取到x_forwarded_for多个代理ip而导致vaptcha不可用 by xuanmou · Pull Request #1332 · mirai-mamori/Sakurairo

xuanmou · 2025-10-12T06:11:23Z

No description provided.

github-actions · 2025-11-27T02:21:45Z

这个 PR 已经 45 天没有任何活动了，将被标记为过时 stale 。删除 stale 的标签或评论，否则将在 10 天内关闭。

Copilot

Pull request overview

This PR extends Vaptcha CAPTCHA support to the forgot password and registration pages, and fixes an issue where the get_the_user_ip() function was failing with multiple proxy IPs in the X-Forwarded-For header.

Key changes:

Added Vaptcha initialization hooks to registration and forgot password forms
Implemented validation functions for Vaptcha on registration and password reset flows
Modified IP extraction logic to handle comma-separated proxy IP lists

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review for a chance to win a $100 gift card. Take the survey.

Copilot · 2025-11-28T02:11:14Z

functions.php

+            }
+            if ($response->success === 0) {
+                $errorcode = $response->msg;
+                return new WP_Error('prooffail', '<strong>错误</strong>：非法数据' . $errorcode);


Missing space before concatenation operator. The error message should be '错误：非法数据' . $errorcode with spaces around the . operator for better readability and consistency with PHP coding standards.

Copilot · 2025-11-28T02:11:15Z

functions.php

    }
    add_filter('authenticate', 'checkVaptchaAction', 20, 3);
+
+    function Vaptcha_lostpassword_CHECK($errors)


Function name should follow the codebase naming convention. Change Vaptcha_lostpassword_CHECK to vaptcha_lostpassword_check to match the style used by similar functions like lostpassword_CHECK, turnstile_lostpassword_check, and other captcha verification functions in this file.

Suggested change

function Vaptcha_lostpassword_CHECK($errors)

function vaptcha_lostpassword_check($errors)

Copilot · 2025-11-28T02:11:15Z

functions.php

+        }
+        if (!(isset($_POST['vaptcha_server']) && isset($_POST['vaptcha_token']))) 
+        {
+            return $errors->add('invalid_vaptcha ', '<strong>错误</strong>：请先进行人机验证');


Trailing space after error code identifier 'invalid_vaptcha '. Remove the trailing space to make it 'invalid_vaptcha' for consistency.

Copilot · 2025-11-28T02:11:15Z

functions.php

+        }
+        if (!preg_match('/^https:\/\/([\w-]+\.)+[\w-]*([^<>=?\"\'])*$/', $_POST['vaptcha_server']) || !preg_match('/^[\w\-\$]+$/', $_POST['vaptcha_token'])) 
+        {
+            return $errors->add('invalid_vaptcha ', '<strong>错误</strong>：非法数据');


Trailing space after error code identifier 'invalid_vaptcha '. Remove the trailing space to make it 'invalid_vaptcha' for consistency.

Copilot · 2025-11-28T02:11:15Z

functions.php

+                $errorcode = $response->msg;
+                return $errors->add('invalid_vaptcha ', '<strong>错误</strong>：非法数据' . $errorcode);
+            }
+            return $errors->add('invalid_vaptcha ', '<strong>错误</strong>：人机验证失败');


Trailing space after error code identifier 'invalid_vaptcha '. Remove the trailing space to make it 'invalid_vaptcha' for consistency.

Copilot · 2025-11-28T02:11:16Z

functions.php

+    }
+    add_action('lostpassword_post', 'Vaptcha_lostpassword_CHECK');
+
+    function Vaptcha_registration_CHECK($errors, $sanitized_user_login, $user_email)


Function name should follow the codebase naming convention. Change Vaptcha_registration_CHECK to vaptcha_registration_check to match the style used by similar functions like registration_CAPTCHA_CHECK, turnstile_registration_check, and other captcha verification functions in this file.

Suggested change

function Vaptcha_registration_CHECK($errors, $sanitized_user_login, $user_email)

function vaptcha_registration_check($errors, $sanitized_user_login, $user_email)

Copilot · 2025-11-28T02:11:17Z

functions.php

+    {
+        if (empty($_POST)) 
+        {
+            return false;


The function returns false when $_POST is empty, but this is inconsistent with the expected return type. The lostpassword_post action expects an $errors object to be returned, not false. This should return $errors directly to maintain consistency with the Turnstile implementation (line 3524) which returns $errors for similar conditions.

Suggested change

return false;

return $errors;

Copilot · 2025-11-28T02:11:17Z

functions.php

+            }
+            if ($response->success === 0) {
+                $errorcode = $response->msg;
+                return $errors->add('invalid_vaptcha ', '<strong>错误</strong>：非法数据' . $errorcode);


Trailing space after error code identifier 'invalid_vaptcha '. Remove the trailing space to make it 'invalid_vaptcha' for consistency.

Copilot · 2025-11-28T02:11:17Z

functions.php

+    $ip2 = explode('|', str_replace(',', '|', $ip));
+    return apply_filters('wpb_get_ip', trim($ip2[0])); //解决HTTP_X_FORWARDED_FOR获取到代理地址而导致人机验证不通过


The delimiter handling uses pipe character | but HTTP_X_FORWARDED_FOR typically uses commas (,) as separators, not pipes. The str_replace(',', '|', $ip) converts commas to pipes and then explodes on pipes, which is unnecessarily convoluted. Consider simplifying to: $ip_array = explode(',', $ip); return apply_filters('wpb_get_ip', trim($ip_array[0]));

Suggested change

$ip2 = explode('|', str_replace(',', '|', $ip));

return apply_filters('wpb_get_ip', trim($ip2[0])); //解决HTTP_X_FORWARDED_FOR获取到代理地址而导致人机验证不通过

$ip_array = explode(',', $ip);

return apply_filters('wpb_get_ip', trim($ip_array[0])); //解决HTTP_X_FORWARDED_FOR获取到代理地址而导致人机验证不通过

Copilot · 2025-11-28T02:11:17Z

functions.php

    $ip = $_SERVER['HTTP_CLIENT_IP'] ?? $_SERVER['HTTP_X_FORWARDED_FOR'] ?? $_SERVER['REMOTE_ADDR'];
-    return apply_filters('wpb_get_ip', $ip);
+    $ip2 = explode('|', str_replace(',', '|', $ip));
+    return apply_filters('wpb_get_ip', trim($ip2[0])); //解决HTTP_X_FORWARDED_FOR获取到代理地址而导致人机验证不通过


The function assumes HTTP_CLIENT_IP and HTTP_X_FORWARDED_FOR always contain valid IP addresses, but these headers can be spoofed by clients. While this PR fixes the issue of multiple proxy IPs, consider adding validation to ensure the extracted IP is actually a valid IP address using filter_var($ip, FILTER_VALIDATE_IP) before returning it.

Suggested change

return apply_filters('wpb_get_ip', trim($ip2[0])); //解决HTTP_X_FORWARDED_FOR获取到代理地址而导致人机验证不通过

$user_ip = trim($ip2[0]);

if (!filter_var($user_ip, FILTER_VALIDATE_IP)) {

$user_ip = '';

}

return apply_filters('wpb_get_ip', $user_ip); //解决HTTP_X_FORWARDED_FOR获取到代理地址而导致人机验证不通过

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 21 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-01-15T15:06:51Z

functions.php

+        if (!preg_match('/^https:\/\/([\w-]+\.)+[\w-]*([^<>=?\"\'])*$/', $_POST['vaptcha_server']) || !preg_match('/^[\w\-\$]+$/', $_POST['vaptcha_token'])) 
+        {


Inconsistent brace style: The opening brace is on a new line, which is inconsistent with the coding style used elsewhere in this file. The brace should be on the same line as the if statement for consistency.

Copilot · 2026-01-15T15:06:51Z

functions.php

+        if (!preg_match('/^https:\/\/([\w-]+\.)+[\w-]*([^<>=?\"\'])*$/', $_POST['vaptcha_server']) || !preg_match('/^[\w\-\$]+$/', $_POST['vaptcha_token'])) 
+        {


Inconsistent brace style: The opening brace is on a new line, which is inconsistent with the coding style used elsewhere in this file. The brace should be on the same line as the if statement for consistency.

Copilot · 2026-01-15T15:06:51Z

functions.php

+            }
+            if ($response->success === 0) {
+                $errorcode = $response->msg;
+                return $errors->add('invalid_vaptcha ', '<strong>错误</strong>：非法数据' . $errorcode);


Missing space after error message concatenation. There should be a space between '非法数据' and the error code to improve readability. Consider changing this to '错误：非法数据: ' . $errorcode to add proper spacing.

Suggested change

return $errors->add('invalid_vaptcha ', '错误：非法数据' . $errorcode);

return $errors->add('invalid_vaptcha ', '错误：非法数据: ' . $errorcode);

Copilot · 2026-01-15T15:06:51Z

functions.php

+        }
+        if (!(isset($_POST['vaptcha_server']) && isset($_POST['vaptcha_token']))) 
+        {
+            return $errors->add('invalid_vaptcha ', '<strong>错误</strong>：请先进行人机验证');


The error code key has a trailing space ('invalid_vaptcha ') which is inconsistent with WordPress conventions and the pattern used in other parts of the code. This should be 'invalid_vaptcha' without the trailing space for consistency.

Copilot · 2026-01-15T15:06:52Z

functions.php

+                $errorcode = $response->msg;
+                return $errors->add('invalid_vaptcha ', '<strong>错误</strong>：非法数据' . $errorcode);
+            }
+            return $errors->add('invalid_vaptcha ', '<strong>错误</strong>：人机验证失败');


The error code key has a trailing space ('invalid_vaptcha ') which is inconsistent with WordPress conventions. This should be 'invalid_vaptcha' without the trailing space for consistency.

Copilot · 2026-01-15T15:06:56Z

functions.php

+    function Vaptcha_lostpassword_CHECK($errors)
+    {
+        if (empty($_POST)) 
+        {
+            return false;
+        }


Missing REQUEST_METHOD check. The turnstile implementation checks if $_SERVER['REQUEST_METHOD'] !== 'POST' and returns early. This function should follow the same pattern to avoid processing on non-POST requests.

Copilot · 2026-01-15T15:06:56Z

functions.php

+    $ip2 = explode('|', str_replace(',', '|', $ip));
+    return apply_filters('wpb_get_ip', trim($ip2[0])); //解决HTTP_X_FORWARDED_FOR获取到代理地址而导致人机验证不通过


Potential undefined array index: The code accesses $ip2[0] without checking if the array is empty. If $ip is an empty string or contains only delimiters, $ip2[0] might not exist, resulting in a PHP warning. Add a check to ensure the array is not empty before accessing the first element.

Copilot · 2026-01-15T15:06:56Z

functions.php

+        if (empty($_POST)) 
+        {


Inconsistent brace style: The opening brace is on a new line, which is inconsistent with the coding style used elsewhere in this file. The brace should be on the same line as the if statement for consistency.

Copilot · 2026-01-15T15:06:57Z

functions.php

+        } else if (is_string($response)) {
+            return $errors->add('invalid_vaptcha ', '<strong>错误</strong>：' . $response);
+        }
+        return $errors->add('invalid_vaptcha ', '<strong>错误</strong>：未知错误');


The error code key has a trailing space ('invalid_vaptcha ') which is inconsistent with WordPress conventions. This should be 'invalid_vaptcha' without the trailing space for consistency.

Copilot · 2026-01-15T15:06:57Z

functions.php

+    function Vaptcha_registration_CHECK($errors, $sanitized_user_login, $user_email)
+    {
+        if (empty($_POST)) 
+        {
+            return new WP_Error();
+        }


Missing REQUEST_METHOD check. The turnstile implementation checks if $_SERVER['REQUEST_METHOD'] !== 'POST' and returns early. This function should follow the same pattern to avoid processing on non-POST requests.

xuanmou added 4 commits October 12, 2025 14:03

增加vaptcha对忘记密码页面和注册界面的支持，修复ip因为获取到x_forwarded_for多个代理ip而导致vaptcha不可用

15030ff

修复ip获取bug

0d4a9c8

修复注册时报错的bug

ff2b033

修复一处代码错误

d704a5e

github-actions bot added the Stale label Nov 27, 2025

KotoriK requested a review from Copilot November 28, 2025 02:05

Copilot started reviewing on behalf of KotoriK November 28, 2025 02:06 View session

Copilot finished reviewing on behalf of KotoriK November 28, 2025 02:08

Copilot AI reviewed Nov 28, 2025

View reviewed changes

github-actions bot removed the Stale label Nov 28, 2025

Shiroiame-Kusu changed the base branch from v3.1 to preview January 5, 2026 14:41

Shiroiame-Kusu requested a review from Copilot January 15, 2026 15:00

Copilot started reviewing on behalf of Shiroiame-Kusu January 15, 2026 15:00 View session

Copilot AI reviewed Jan 15, 2026

View reviewed changes

	function Vaptcha_lostpassword_CHECK($errors)
	function vaptcha_lostpassword_check($errors)

	function Vaptcha_registration_CHECK($errors, $sanitized_user_login, $user_email)
	function vaptcha_registration_check($errors, $sanitized_user_login, $user_email)

		$ip2 = explode('\|', str_replace(',', '\|', $ip));
		return apply_filters('wpb_get_ip', trim($ip2[0])); //解决HTTP_X_FORWARDED_FOR获取到代理地址而导致人机验证不通过

-    return apply_filters('wpb_get_ip', trim($ip2[0])); //解决HTTP_X_FORWARDED_FOR获取到代理地址而导致人机验证不通过
+    $user_ip = trim($ip2[0]);
+    if (!filter_var($user_ip, FILTER_VALIDATE_IP)) {
+        $user_ip = '';
+    }
+    return apply_filters('wpb_get_ip', $user_ip); //解决HTTP_X_FORWARDED_FOR获取到代理地址而导致人机验证不通过

		if (!preg_match('/^https:\/\/([\w-]+\.)+[\w-]([^<>=?\"\'])$/', $_POST['vaptcha_server']) \|\| !preg_match('/^[\w\-\$]+$/', $_POST['vaptcha_token']))
		{

	return $errors->add('invalid_vaptcha ', '<strong>错误</strong>：非法数据' . $errorcode);
	return $errors->add('invalid_vaptcha ', '<strong>错误</strong>：非法数据: ' . $errorcode);

Uh oh!

Conversation

xuanmou commented Oct 12, 2025

Uh oh!

github-actions bot commented Nov 27, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Nov 28, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 28, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 28, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 28, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 28, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 28, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 28, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 28, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 28, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 28, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Jan 15, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 15, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 15, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 15, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 15, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 15, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 15, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 15, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 15, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 15, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development