From a33aba1b132f2e2f855ae74eedd8d811d7a5b31e Mon Sep 17 00:00:00 2001 From: ypsdf1 Date: Mon, 26 Oct 2026 21:49:50 +0800 Subject: [PATCH] =?UTF-8?q?=E7=AC=AC57=E6=89=B9=E7=BB=AD12:=20=E4=BF=AE?= =?UTF-8?q?=E5=A4=8Dtoken=E6=9C=89=E6=95=88=E6=9C=9F=E8=AF=AF=E5=88=A4+?= =?UTF-8?q?=E7=BB=91=E9=82=AE=E7=AE=B1=E5=BC=B9=E7=AA=97=E9=82=AE=E7=AE=B1?= =?UTF-8?q?=E5=AD=97=E6=AE=B5=E7=BC=BA=E5=A4=B1?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - core.php: validateWebAccess view操作不再要求web_login_verified—— token 10分钟内有效即直接放行，在线玩家无需二次密码（之前逻辑要求 Java推送web_login_verified才放行，导致自动注册token延期即失效） - api/account.php: acctBindEmailPoll SQL补email字段——前端 acctBindEmailCodeStep(d.email)拿不到邮箱，绑邮箱弹窗蒸发 --- api/account.php | 3 ++- core.php | 21 +++------------------ 2 files changed, 5 insertions(+), 19 deletions(-) diff --git a/api/account.php b/api/account.php index c676b3c..a4c47f0 100644 --- a/api/account.php +++ b/api/account.php @@ -991,7 +991,7 @@ function acctBindEmailPoll() { if ($id <= 0) error('缺少请求id'); $db = getDB(); - $stmt = $db->prepare("SELECT id, player_name, status, created_at, expire_at, approved_at, fail_reason FROM web_email_bind_requests WHERE id = :id"); + $stmt = $db->prepare("SELECT id, player_name, email, status, created_at, expire_at, approved_at, fail_reason FROM web_email_bind_requests WHERE id = :id"); $stmt->bindValue(':id', $id, SQLITE3_INTEGER); $row = $stmt->execute()->fetchArray(SQLITE3_ASSOC); if (!$row) error('请求不存在'); @@ -1025,6 +1025,7 @@ function acctBindEmailPoll() { 'status' => $status, 'left' => $left, 'fail_reason' => (string)$row['fail_reason'], + 'email' => (string)$row['email'], ], 'ok'); } diff --git a/core.php b/core.php index 6b24914..09a20ce 100644 --- a/core.php +++ b/core.php @@ -3445,7 +3445,7 @@ function validateWebAccess($webToken, $action = 'view', $password = null, $ipAdd 'ip' => $ipAddress ]); - // 4. view操作：Token有效 + 在线 + Java推送web_login_verified → 允许访问 + // 4. view操作：Token有效 + 在线 → 直接放行（token 10分钟内有效，不要求web_login_verified） if ($action === 'view') { if (!$isRegistered) { // ★ 玩家未在游戏中注册 → 允许Web注册，录入注册请求等待插件同步 @@ -3457,24 +3457,9 @@ function validateWebAccess($webToken, $action = 'view', $password = null, $ipAdd debugLog("validateWebAccess: 需要密码(不在线)", ['player' => $playerName]); return ['ok' => false, 'mode' => 'need_password', 'player' => $playerName, 'registered' => true, 'online' => false, 'message' => '请输入游戏登录密码以同步登录游戏']; } - // ★ 在线但未通过Java推送web_login_verified → 也需要密码（防止偷token自动登录） - $isWebVerified = false; - try { - // ★ 使用token的有效期作为窗口（而非硬编码5分钟），确保与token生命周期一致 - $verifiedWindow = time() - $expireSeconds; - $wvStmt = $db->prepare("SELECT 1 FROM web_login_verified WHERE player_name = :player AND verified_at >= :expire"); - $wvStmt->bindValue(':player', $playerName, SQLITE3_TEXT); - $wvStmt->bindValue(':expire', $verifiedWindow, SQLITE3_INTEGER); - $wvResult = $wvStmt->execute(); - $wvRow = $wvResult->fetchArray(); - if ($wvRow) $isWebVerified = true; - } catch (\Throwable $e) {} - if (!$isWebVerified) { - debugLog("validateWebAccess: 需要密码(在线但未验证)", ['player' => $playerName]); - return ['ok' => false, 'mode' => 'need_password', 'player' => $playerName, 'registered' => true, 'online' => true, 'message' => '请输入游戏登录密码以验证身份']; - } + // ★ token有效+在线 → 直接放行（10分钟内有效，不需要web_login_verified） $sessionToken = recordWebSession($playerName, $ipAddress); - debugLog("validateWebAccess: 验证成功(Java已确认)", ['player' => $playerName, 'mode' => 'full']); + debugLog("validateWebAccess: 验证成功(token有效)", ['player' => $playerName, 'mode' => 'full']); return ['ok' => true, 'mode' => 'full', 'player' => $playerName, 'session' => $sessionToken, 'registered' => $isRegistered, 'online' => $isOnline, 'message' => '验证成功']; }