給一個央企做官網，登錄模塊用的thinkphp驗證碼類。但是2019-6-10到12號，國家要求央企檢驗官網漏洞，防止黑客攻擊，正直貿易戰激烈升級時期，所以各事業單位很重視官網安全性，於是乎集團總部就委托了寧波一個專業檢測公司用專業工具檢測出，后台驗證碼能用打碼工具暴力破解，發函要求整改。so，就有了下面的極速驗證圖形
一：注冊獲取key
注冊；創建應用；獲取key；
二：導入sdk
/ThinkPHP/Library/Org/Xb/GeetestLip.class.php（此處GeetestLip.class.php是我重新命名的geetest類文件，原名為class.geetestlib.php）
此處牽扯到thinkphp引入第三方類，我把第三方類放到Org/Util/Xb下面了，同時對該類文件加入命名空間如下，否則實例化類時找不到文件
三：生成驗證樣式
admin/view/public/cdtsh_log_smfyws.php
<!doctype html>
<html>
<head>
<meta charset="GBK" />
<title>網站管理系統后台</title>
<script language="javascript" type="text/javascript" src="__JS__/jquery.js"></script>
<link rel="stylesheet" href="__CSS__/jquery.validator.css">
<script type="text/javascript" src="__JS__/jquery.validator.js"></script>
<script type="text/javascript" src="__JS__/zh_CN.js"></script>
<link href="__CSS__/admin_login.css?v20130227" rel="stylesheet" />
<script>
$(document).ready(function(){
var verifyimg = $(".verifyimg").attr("src");
$(".reloadverify").click(function(){
if( verifyimg.indexOf('?')>0){
$(".verifyimg").attr("src", verifyimg+'&random='+Math.random());
}else{
$(".verifyimg").attr("src", verifyimg.replace(/\?.*$/,'')+'?'+Math.random());
}
});
});
</script>
</head>
<body>
<div class="wrap">
<h1><a href="javascript:;" style="height: 116px; width: 250px;">后台管理中心</a></h1>
<form method="post" action="{:U('Admin/Public/cdtsh_log_smfyws')}">
<div class="login">
<ul>
<li>
<input class="input" id="username" name="username"type="text" title="用戶名" data-rule="required;username" placeholder="用戶名" />
<span class="msg-box n-right" style="position:absolute; left: 248px; top: 12px; " for="username"></span>
</li>
<li>
<input class="input" name="password" type="password" title="密碼" data-rule="required;password" placeholder="密碼"/>
<span class="msg-box n-right" style="position:absolute;left: 248px; top: 12px;" for="password"></span>
</li>
<li>
<input class="input" id="verify" name="verify" type="text" style="width:130px;" title="密碼" data-ok=" " placeholder="驗證碼" data-tip="輸入驗證碼！" title="驗證碼" data-rule="required;text;remote[{:U('Admin/Public/check_verify')}]" />
<div class="yanzhengma_box" id="verifyshow"> <img class="verifyimg reloadverify" style=" cursor: pointer;" align="right" src="{:U('public/verify')}" title="點擊刷新"> </div>
<span class="msg-box n-right" style="position:absolute;left: 248px; top: 12px;" for="verify"></span>
</li>
</ul>
<ul>
<!--<input type="button" value="異步驗證登錄" onclick="check_verify()">-->
<!--<input type="submit" value="post提交登錄">-->
<div id="captcha"></div>
</ul>
<button type="submit" class="btn" id="subbtn">登錄</button>
</div>
</form>
</div>
<script src="http://static.geetest.com/static/tools/gt.js"></script>
<script>
var handler = function (captchaObj) {
// 將驗證碼加到id為captcha的元素里
captchaObj.appendTo("#captcha");
};
// 獲取驗證碼
$.get("{:U('Admin/Public/verifys')}", function(data) {
// 使用initGeetest接口
// 參數1：配置參數，與創建Geetest實例時接受的參數一致
// 參數2：回調，回調的第一個參數驗證碼對象，之后可以使用它做appendTo之類的事件
initGeetest({
gt: data.gt,
challenge: data.challenge,
product: "float", // 產品形式
offline: !data.success,
new_captcha:'true',
width:'260px',
}, handler);
},'json');
</script>
</body>
</html>
四：驗證函數
/Application/Common/Common/function.php
/** * geetest檢測驗證碼 */ function geetest_chcek_verify($data){ $geetest_id = "7149e2021d7938157e"; $geetest_key = "62b92039e1e9cf9455"; $geetest=new \Org\Util\Xb\GeetestLib($geetest_id,$geetest_key); $user_id=$_SESSION['geetest']['user_id']; $ip_address=$_SESSION['geetest']['ip_address']; $dataa = array( "user_id" => $user_id, # 網站用戶id "client_type" => "web", #web:電腦上的瀏覽器；h5:手機上的瀏覽器，包括移動應用內完全內置的web_view；native：通過原生SDK植入APP應用的方式 "ip_address" => $ip_address, # 請在此處傳輸用戶請求驗證時所攜帶的IP ); if ($_SESSION['geetest']['gtserver']==1){ $result=$geetest->success_validate($data['geetest_challenge'], $data['geetest_validate'], $data['geetest_seccode'], $dataa); //return $result; if ($result) { //return 11; return true; } else{ //return 22; return false; } }else{ if ($geetest->fail_validate($data['geetest_challenge'],$data['geetest_validate'],$data['geetest_seccode'])) { //return 33; return true; }else{ //return 44; return false; } } } //獲取id地址 function GetIP() { if (!empty($_SERVER["HTTP_CLIENT_IP"])) { $cip = $_SERVER["HTTP_CLIENT_IP"]; } elseif (!empty($_SERVER["HTTP_X_FORWARDED_FOR"])) { $cip = $_SERVER["HTTP_X_FORWARDED_FOR"]; } elseif (!empty($_SERVER["REMOTE_ADDR"])) { $cip = $_SERVER["REMOTE_ADDR"]; } else { $cip = "無法獲取！"; } return $cip; }
五：php 生成驗證碼 並 驗證
//極速驗證 public function verifys(){ //require_once dirname(dirname(dirname(__FILE__))) . '/lib/class.geetestlib.php'; //require_once dirname(dirname(__FILE__)) . '/config/config.php'; // $GtSdk = new GeetestLib(CAPTCHA_ID, PRIVATE_KEY); $geetest_id = "7149e2021d7938157e9"; $geetest_key = "62b92039e1e9cf"; $geetest=new \Org\Util\Xb\GeetestLib($geetest_id,$geetest_key); //dump($geetest);die; $user_id = "test"; $data = array( "user_id" => $user_id, # 網站用戶id "client_type" => "web", #web:電腦上的瀏覽器；h5:手機上的瀏覽器，包括移動應用內完全內置的web_view；native：通過原生SDK植入APP應用的方式 "ip_address" => GetIP(), # 請在此處傳輸用戶請求驗證時所攜帶的IP ); $status = $geetest->pre_process($data,1); //dump($status); $_SESSION['geetest']=array( 'gtserver'=>$status, 'user_id'=>$user_id, 'ip_address'=>GetIP(), ); echo $geetest->get_response_str(); } public function cdtsh_log_smfyws() { if ($_SESSION['userid']) { $this->redirect('Admin/Index/Index'); } else { if (IS_POST) { $username = $_POST['username']; $password = $_POST['password']; //$geetest_challenge = $_POST['geetest_challenge']; //$geetest_validate = $_POST['geetest_validate']; //$geetest_seccode = $_POST['geetest_seccode']; $data=I('post.'); if($data['geetest_challenge']=="" || $data['geetest_validate']=="" ||$data['geetest_seccode']=="" ){ $this->error('請進行圖形驗證'); }else{ //dump(geetest_chcek_verify($data)); if (geetest_chcek_verify($data)){ //echo '驗證成功'; if ($this->loginAdmin($username, $password)) { $data = M("User")->where("username='".$username."' and password='".md5($password)."'")->find(); if ($data["status"] != 1) { //判斷是否禁用 $this->recordLoginAdmin($_POST['username'], $_POST['password'], 0, "賬號禁用"); //記錄登錄日志 $this->error('該帳號禁用'); } else { $save["lastlogin_time"] = time(); $save["lastlogin_ip"] = get_client_ip(); $save["login_num"] = $data["login_num"] + 1; $status = M("user")->where(array("id" => $data['id']))->save($save); $_SESSION['userid'] = $data['id']; $_SESSION['user'] = $data['username']; $_SESSION['rid'] = $data['a_Id']; $this->recordLoginAdmin($_POST['username'], $_POST['password'], 1); //記錄登錄日志 $this->redirect('Admin/Index/Index'); //$this->success('登錄成功',U('Admin/Index/Index')); } } else { $this->recordLoginAdmin($_POST['username'], $_POST['password'], 0, "賬號密碼錯誤"); //記錄登錄日志 $this->error('登錄失敗'); } }else{ //echo '圖形驗證失敗'; $this->error('圖形驗證失敗'); } } } else { $this->display(); } } }
到這里就結束了