@@ -2315,6 +2323,7 @@ function setTheme(color) {
b.style.backgroundPosition = '';
b.style.backgroundRepeat = '';
b.style.backgroundAttachment = '';
+ b.classList.remove('bg-img-mode');
document.documentElement.style.setProperty('--bg', color);
b.style.background = color;
localStorage.removeItem('sdf1_admin_bgimg');
diff --git a/api/twofa.php b/api/twofa.php
index 11da327..cb1b494 100644
--- a/api/twofa.php
+++ b/api/twofa.php
@@ -1,14 +1,23 @@
PHP（secret 校验）：
- * push_qr 存一条二维码载荷（token -> otpauth URI）
+ * push_qr 存一条二维码载荷（token -> otpauth URI）
+ * pull_state 拉取该玩家网页端绑定状态（bound/secret/bound_at/updated_at）
+ * push_state 推送 Java 端绑定/解绑结果（网页端无记录或记录更旧时落库）
* 玩家浏览器（持有随机 token 即可读）：
- * get 按 t 取回 otpauth URI
+ * get 按 t 取回 otpauth URI
+ *
+ * 同步语义见 Java 端 TwoFactorManager.applyWebState()：
+ * 单向导入（网页绑定游戏未绑定）/ 解绑传播（网页解绑且更晚）/
+ * 密钥冲突取时间新者；恢复代码两端格式不同（网页16位明文 vs 游戏6位哈希），各自维护。
*/
while (ob_get_level() > 0) { @ob_end_clean(); }
@@ -117,6 +126,98 @@ try {
break;
}
+ // ===== Java -> PHP：拉取网页端 2FA 绑定状态（第47批双向同步） =====
+ case 'pull_state': {
+ twofaRequireSecret();
+ $player = (string) getParam('player', '');
+ if ($player === '' || strlen($player) > 32) error('玩家名不合法', 400);
+
+ $db = getDB();
+ $stmt = $db->prepare("SELECT totp_secret, bound_at, updated_at
+ FROM web_account_2fa WHERE player_name = :p");
+ $stmt->bindValue(':p', $player, SQLITE3_TEXT);
+ $row = $stmt->execute()->fetchArray(SQLITE3_ASSOC);
+
+ if (!$row) {
+ success(['exists' => false, 'bound' => false,
+ 'secret' => '', 'bound_at' => 0, 'updated_at' => 0]);
+ }
+ $bound = ((int) $row['bound_at'] > 0 && (string) $row['totp_secret'] !== '');
+ success([
+ 'exists' => true,
+ 'bound' => $bound,
+ // 明文密钥仅回给持 SECRET_KEY 的 Java 服务端，绝不出现在浏览器接口
+ 'secret' => $bound ? (string) $row['totp_secret'] : '',
+ 'bound_at' => (int) $row['bound_at'],
+ 'updated_at' => (int) $row['updated_at'],
+ ]);
+ break;
+ }
+
+ // ===== Java -> PHP：推送 Java 端绑定/解绑结果（第47批双向同步） =====
+ case 'push_state': {
+ twofaRequireSecret();
+ $player = (string) getParam('player', '');
+ $bound = (string) getParam('bound', '') === '1';
+ // ★ TOTP 密钥参数名必须是 twofa_secret：'secret' 已被通信密钥占用
+ $secret = (string) getParam('twofa_secret', '');
+ $boundAt = (int) getParam('bound_at', '0');
+ if ($player === '' || strlen($player) > 32) error('玩家名不合法', 400);
+ if ($bound && !preg_match('/^[A-Z2-7]{16,64}$/', $secret)) {
+ error('密钥格式错误', 400);
+ }
+
+ $db = getDB();
+ $stmt = $db->prepare("SELECT bound_at, recovery_codes
+ FROM web_account_2fa WHERE player_name = :p");
+ $stmt->bindValue(':p', $player, SQLITE3_TEXT);
+ $row = $stmt->execute()->fetchArray(SQLITE3_ASSOC);
+ $existingAt = $row ? (int) $row['bound_at'] : -1; // -1 = 无记录
+
+ $now = time();
+ if ($bound) {
+ // 仅当网页端无记录、未绑定、或绑定时间更旧时覆盖；
+ // 网页端已绑定且不比我们旧 → 不动（网页端用户主动操作优先）
+ $webNewer = ($existingAt > 0 && $boundAt > 0 && $existingAt >= $boundAt);
+ if ($webNewer) {
+ success(['applied' => false, 'reason' => 'web_side_newer']);
+ }
+ // 游戏端恢复代码是 SHA-256 哈希且格式与网页端（16位明文 JSON）不兼容，
+ // 推送时清空网页端恢复代码列表，避免网页端用旧代码通过第二层验证
+ $stmt = $db->prepare("INSERT INTO web_account_2fa
+ (player_name, totp_secret, recovery_codes, bound_at, updated_at)
+ VALUES (:p, :s, '', :b, :u)
+ ON CONFLICT(player_name) DO UPDATE SET
+ totp_secret = :s, recovery_codes = '',
+ bound_at = :b, updated_at = :u");
+ $stmt->bindValue(':p', $player, SQLITE3_TEXT);
+ $stmt->bindValue(':s', $secret, SQLITE3_TEXT);
+ $stmt->bindValue(':b', $boundAt > 0 ? $boundAt : $now, SQLITE3_INTEGER);
+ $stmt->bindValue(':u', $now, SQLITE3_INTEGER);
+ $stmt->execute();
+ success(['applied' => true, 'action' => 'bound']);
+ } else {
+ // 解绑：仅当网页端记录不比我们新时清空（防覆盖网页端更晚的重新绑定）
+ $webNewer = ($existingAt > 0 && $boundAt > 0 && $existingAt > $boundAt);
+ if ($webNewer) {
+ success(['applied' => false, 'reason' => 'web_side_newer']);
+ }
+ if ($existingAt === 0) {
+ success(['applied' => false, 'reason' => 'already_unbound']);
+ }
+ if ($existingAt > 0) {
+ $stmt = $db->prepare("UPDATE web_account_2fa SET
+ totp_secret = '', recovery_codes = '', bound_at = 0, updated_at = :u
+ WHERE player_name = :p");
+ $stmt->bindValue(':p', $player, SQLITE3_TEXT);
+ $stmt->bindValue(':u', $now, SQLITE3_INTEGER);
+ $stmt->execute();
+ }
+ success(['applied' => true, 'action' => 'unbound']);
+ }
+ break;
+ }
+
default:
error('未知操作', 400);
}
diff --git a/api/wallpaper.php b/api/wallpaper.php
index b6c95be..4ebc314 100644
--- a/api/wallpaper.php
+++ b/api/wallpaper.php
@@ -1,10 +1,14 @@
'wallpaper.php?action=image&u=' . rawurlencode($direct),
+ 'direct' => $direct,
+ 'source' => 'bing',
+ 'title' => isset($img['title']) ? $img['title'] : '',
+ 'copyright' => isset($img['copyright']) ? $img['copyright'] : '',
+ 'date' => isset($img['startdate']) ? $img['startdate'] : '',
+ );
+ break;
}
- $img = $j['images'][0];
- $direct = 'https://www.bing.com' . $img['urlbase'] . '_1920x1080.jpg';
- $data = array(
- // 前端优先用代理地址（防防盗链），direct 作兜底直连
- 'url' => 'wallpaper.php?action=image&u=' . rawurlencode($direct),
- 'direct' => $direct,
- 'title' => isset($img['title']) ? $img['title'] : '',
- 'copyright' => isset($img['copyright']) ? $img['copyright'] : '',
- 'date' => isset($img['startdate']) ? $img['startdate'] : '',
- );
+
+ // 源3：NASA 每日天文图 APOD（DEMO_KEY 限速，但有6小时缓存，服务器低频调用足够）
+ if ($data === null) {
+ $body = wpjFetch('https://api.nasa.gov/planetary/apod?api_key=DEMO_KEY&hd=true', 8, 'https://api.nasa.gov/');
+ $j = json_decode($body, true);
+ if (is_array($j) && !empty($j['hdurl']) && preg_match('#^https?://#i', $j['hdurl'])) {
+ $direct = $j['hdurl'];
+ $data = array(
+ 'url' => 'wallpaper.php?action=image&u=' . rawurlencode($direct),
+ 'direct' => $direct,
+ 'source' => 'nasa',
+ 'title' => isset($j['title']) ? $j['title'] : 'NASA 每日天文图',
+ 'copyright' => isset($j['copyright']) ? $j['copyright'] : 'NASA APOD',
+ 'date' => isset($j['date']) ? $j['date'] : date('Y-m-d'),
+ );
+ }
+ }
+
+ // 源4：picsum 固定尺寸摄影图（无 key、永不应答失败的最后兜底；302 跳转浏览器直接可用）
+ if ($data === null) {
+ $direct = 'https://picsum.photos/1920/1080';
+ $data = array(
+ 'url' => $direct,
+ 'direct' => $direct,
+ 'source' => 'picsum',
+ 'title' => '随机摄影图',
+ 'copyright' => 'Photos from Unsplash (picsum.photos)',
+ 'date' => date('Y-m-d'),
+ );
+ }
+
wpjCacheSet('bing', $data);
wpjOut(true, 'ok', $data);
}
-/* ===== 图片转发（仅 bing 白名单，防 SSRF） ===== */
+/* ===== 图片转发（白名单域，防 SSRF；第47批随多源扩充） ===== */
if ($act === 'image') {
$u = isset($_GET['u']) ? (string)$_GET['u'] : '';
$host = @parse_url($u, PHP_URL_HOST);
if ($u === '' || !is_string($host) || $host === '') { wpjOut(false, '参数无效'); }
$host = strtolower($host);
- $allow = array('www.bing.com', 'bing.com', 'th.bing.com', 'cn.bing.com');
+ $allow = array(
+ // 必应（源1/2）
+ 'www.bing.com', 'bing.com', 'th.bing.com', 'cn.bing.com',
+ // NASA APOD（源3，hdurl 指向 apod.nasa.gov / www.nasa.gov 等）
+ 'apod.nasa.gov', 'www.nasa.gov', 'images-api.nasa.gov',
+ // picsum 兜底链（源4，302 目标域）
+ 'picsum.photos', 'fastly.picsum.photos', 'images.unsplash.com',
+ );
if (!in_array($host, $allow, true)) { wpjOut(false, '不支持的图片源'); }
- $bin = wpjFetch($u, 10, 'https://www.bing.com/');
+ $referer = 'https://www.bing.com/';
+ if ($host === 'apod.nasa.gov' || $host === 'www.nasa.gov' || $host === 'images-api.nasa.gov') {
+ $referer = 'https://apod.nasa.gov/';
+ } elseif ($host === 'picsum.photos' || $host === 'fastly.picsum.photos' || $host === 'images.unsplash.com') {
+ $referer = 'https://picsum.photos/';
+ }
+ $bin = wpjFetch($u, 10, $referer);
if (!is_string($bin) || strlen($bin) < 1000) { wpjOut(false, '图片下载失败'); }
// 粗校验图片魔数，防返回HTML错误页被当图片缓存
$head = substr($bin, 0, 3);
diff --git a/player.php b/player.php
index 9b2d614..4250ef4 100644
--- a/player.php
+++ b/player.php
@@ -91,6 +91,15 @@ if ($currentVersion !== $BUILD_VERSION) {
background: var(--card); border: 1px solid var(--border); border-radius: 8px;
padding: 20px; margin-bottom: 16px;
}
+ /* 第47批：图片壁纸模式下卡片/侧栏自适应半透明+毛玻璃；纯色/默认模式不受影响 */
+ body.bg-img-mode .card, body.bg-img-mode .sidebar {
+ background: rgba(22,27,34,0.55);
+ backdrop-filter: blur(14px) saturate(1.4);
+ -webkit-backdrop-filter: blur(14px) saturate(1.4);
+ }
+ body.bg-img-mode.light-theme .card, body.bg-img-mode.light-theme .sidebar {
+ background: rgba(255,255,255,0.55);
+ }
.card h2 { font-size: 16px; margin-bottom: 12px; color: var(--accent); }
.grid { display: grid; grid-template-columns: repeat(auto-fill, minmax(200px, 1fr)); gap: 12px; }
.item-card {
@@ -2711,6 +2720,7 @@ if ($currentVersion !== $BUILD_VERSION) {
b.style.backgroundPosition = 'center center';
b.style.backgroundRepeat = 'no-repeat';
b.style.backgroundAttachment = 'fixed';
+ b.classList.add('bg-img-mode');
document.documentElement.style.setProperty('--bg', 'rgba(13,17,23,' + Math.min(0.9, dim + 0.25) + ')');
localStorage.setItem('sdf1_player_bgimg', JSON.stringify({ type: 'img', url: url, dim: dim }));
if (!silent) toast('背景图片已应用', 'success');
@@ -2798,6 +2808,7 @@ if ($currentVersion !== $BUILD_VERSION) {
b.style.backgroundPosition = '';
b.style.backgroundRepeat = '';
b.style.backgroundAttachment = '';
+ b.classList.remove('bg-img-mode');
document.documentElement.style.removeProperty('--bg');
b.style.background = '';
const ov = document.getElementById('themePickerOverlay');
@@ -2854,7 +2865,7 @@ if ($currentVersion !== $BUILD_VERSION) {
支持任意直链 jpg/png/webp；对方站点防盗链可能导致加载失败
@@ -2886,6 +2897,7 @@ if ($currentVersion !== $BUILD_VERSION) {
b.style.backgroundPosition = '';
b.style.backgroundRepeat = '';
b.style.backgroundAttachment = '';
+ b.classList.remove('bg-img-mode');
document.documentElement.style.setProperty('--bg', color);
b.style.background = color;
localStorage.removeItem('sdf1_player_bgimg');