youpaishidifu/Sdf1_login
1
1
Fork 0
Code Issues 15 Pull Requests Actions 1 Packages Projects Releases 13 Wiki Activity

v12: PHP密码验证安全修复 + land_api GET参数支持

Browse Source 
安全修复:
- sync.php: 删除verify_web_password端点，禁止PHP自验证密码
- core.php: validateWebAccess大额交易密码验证改为检查web_login_verified（Java验证结果）
- 密码验证强制走web_login_request流程

其他:
- land_api.php: handleAckAdminChanges支持GET参数ids（避免POST Content-Type问题）
This commit is contained in:
ypsdf1
2026-06-25 14:19:08 +08:00
parent 71777e3013
commit 8edc94b848
3 changed files with 19 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
core.php
+16 -7
View File
@@ -1044,18 +1044,27 @@ function validateWebAccess($webToken, $action = 'view', $password = null, $ipAdd
return ['ok' => true, 'mode' => 'full_verified', 'player' => $playerName, 'session' => $sessionToken, 'registered' => $isRegistered, 'online' => $isOnline, 'message' => '交易金额≤1000，免验证'];
}
// >1000债券交易需要密码验证
if ($password) {
if (verifyWebLoginPassword($playerName, $password)) {
// ★ 安全修复：大额交易密码验证必须通过游戏服务器（web_login_verified），禁止PHP自验证
// 检查web_login_verified表：最近10分钟内通过Java验证过 → 允许
$db = getDB();
try {
$db->exec("CREATE TABLE IF NOT EXISTS web_login_verified (player_name TEXT PRIMARY KEY, verified_at INTEGER NOT NULL)");
$stmt = $db->prepare("SELECT verified_at FROM web_login_verified WHERE player_name = :player");
$stmt->bindValue(':player', $playerName, SQLITE3_TEXT);
$result = $stmt->execute();
$row = $result->fetchArray();
$verifiedAt = $row ? (int)$row['verified_at'] : 0;
$validWindow = 600; // 10分钟内有效
if ($verifiedAt > 0 && (time() - $verifiedAt) < $validWindow) {
$sessionToken = recordWebSession($playerName, $ipAddress);
debugLog("validateWebAccess: 密码验证通过", ['player' => $playerName, 'amount' => $amount]);
debugLog("validateWebAccess: Java验证有效", ['player' => $playerName, 'amount' => $amount, 'age' => time() - $verifiedAt]);
return ['ok' => true, 'mode' => 'full_verified', 'player' => $playerName, 'session' => $sessionToken, 'registered' => $isRegistered, 'online' => $isOnline, 'message' => '密码验证通过'];
}
debugLog("validateWebAccess: 密码错误", ['player' => $playerName]);
return ['ok' => false, 'mode' => 'denied', 'message' => '密码错误'];
} catch (\Throwable $e) {
debugLog("validateWebAccess: 查询web_login_verified异常", ['error' => $e->getMessage()]);
}
debugLog("validateWebAccess: 需要密码", ['player' => $playerName, 'amount' => $amount]);
return ['ok' => false, 'mode' => 'need_password', 'player' => $playerName, 'registered' => $isRegistered, 'online' => $isOnline, 'message' => '大额交易需要输入密码确认'];
return ['ok' => false, 'mode' => 'need_password', 'player' => $playerName, 'registered' => $isRegistered, 'online' => $isOnline, 'message' => '大额交易需要在游戏中重新验证密码'];
}
// 8. 其他操作：Token有效，直接允许访问