root
289 lines
11 KiB
PHP
289 lines
11 KiB
PHP
<?php
|
|
/**
|
|
* 二次风控（byApiRisk）处理，供 f_check.php 与模拟测试复用
|
|
*/
|
|
require_once dirname(__DIR__) . '/DbHelper.php';
|
|
require_once __DIR__ . '/FpUrlHelper.php';
|
|
require_once __DIR__ . '/VisitorApiAudit.php';
|
|
require_once __DIR__ . '/RiskSecondaryGate.php';
|
|
require_once __DIR__ . '/RiskSecondaryCache.php';
|
|
require_once __DIR__ . '/VisitorLogSchema.php';
|
|
require_once __DIR__ . '/ClientIpResolver.php';
|
|
|
|
class FCheckHandler
|
|
{
|
|
/**
|
|
* @param string $hdata base64(JSON)
|
|
* @return array{ok:bool,status?:int,result?:bool,reason?:string,link?:string,message?:string,fingerprint_info?:array,api_request?:array,api_response?:array,cached?:bool}
|
|
*/
|
|
public static function processFromHdata($hdata)
|
|
{
|
|
$decodedString = base64_decode((string) $hdata, true);
|
|
$fingerprint_info = is_string($decodedString) ? json_decode($decodedString, true) : null;
|
|
if (!is_array($fingerprint_info) || empty($fingerprint_info['domain'])) {
|
|
return [
|
|
'ok' => false,
|
|
'status' => 400,
|
|
'message' => '无效的指纹数据',
|
|
];
|
|
}
|
|
return self::process($fingerprint_info, (string) $hdata);
|
|
}
|
|
|
|
/**
|
|
* @param array $fingerprint_info
|
|
* @param string|null $hdata base64 payload sent to API；为空时自动生成
|
|
* @return array{ok:bool,status?:int,result?:bool,reason?:string,link?:string,message?:string,fingerprint_info?:array,api_request?:array,api_response?:array,cached?:bool}
|
|
*/
|
|
public static function process(array $fingerprint_info, $hdata = null)
|
|
{
|
|
$fp_host = parse_url($fingerprint_info['domain'], PHP_URL_HOST);
|
|
if (empty($fp_host)) {
|
|
$fp_host = $_SERVER['HTTP_HOST'] ?? '';
|
|
}
|
|
if (!class_exists('ConfigLoader', false)) {
|
|
require_once dirname(__DIR__, 2) . '/config/ConfigLoader.php';
|
|
}
|
|
$config_name = ConfigLoader::loadByHost($fp_host);
|
|
$log_id = (int) ($fingerprint_info['log_id'] ?? 0);
|
|
|
|
if (!RiskSecondaryGate::isEnabled()) {
|
|
$_SESSION['visit_to_3'] = 3;
|
|
$_SESSION['check_result'] = 'true';
|
|
|
|
$resolved = FpUrlHelper::resolve($config_name, true);
|
|
$fp_url = $resolved['url'];
|
|
$response = [
|
|
'reason' => '',
|
|
'result' => true,
|
|
'link' => $fp_url !== '' ? $fp_url : FpUrlHelper::fallbackUrl(),
|
|
];
|
|
|
|
if ($log_id > 0) {
|
|
self::updateLog($log_id, [
|
|
'result' => 'true',
|
|
'reason' => '二次风控已关闭',
|
|
'fp_url' => $response['link'],
|
|
], $fingerprint_info, null, null);
|
|
}
|
|
|
|
return array_merge(['ok' => true, 'status' => 200, 'fingerprint_info' => $fingerprint_info], $response);
|
|
}
|
|
|
|
$clientIp = ClientIpResolver::resolve();
|
|
$cached = RiskSecondaryCache::get($clientIp);
|
|
if ($cached !== null) {
|
|
return self::finishFromCache($cached, $config_name, $log_id, $fingerprint_info);
|
|
}
|
|
|
|
if ($hdata === null || $hdata === '') {
|
|
$json = json_encode($fingerprint_info, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
|
|
$hdata = base64_encode($json !== false ? $json : '{}');
|
|
}
|
|
|
|
$jsonData = [
|
|
'id' => COSTM_IP_SCORE,
|
|
'hdata' => $hdata,
|
|
'referer' => $fingerprint_info['referer'] ?? '',
|
|
'domain' => $fingerprint_info['domain'],
|
|
'ip' => $fingerprint_info['ip'] ?? '',
|
|
'risk_enhanced' => defined('CLOAK_RISK_ENHANCED') && strtoupper(CLOAK_RISK_ENHANCED) === 'ON' ? 1 : 0,
|
|
'risk_number' => CLOAK_RISK_NUMBER,
|
|
];
|
|
|
|
$ch = curl_init('www.tiktokba.com/cloak/byApiRisk');
|
|
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
|
|
curl_setopt($ch, CURLOPT_IPRESOLVE, CURL_IPRESOLVE_V4);
|
|
curl_setopt($ch, CURLOPT_USERAGENT, get_SERVER_value('HTTP_USER_AGENT'));
|
|
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
|
|
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
|
|
curl_setopt($ch, CURLOPT_ENCODING, '');
|
|
curl_setopt($ch, CURLOPT_HTTPHEADER, [
|
|
'Content-type: application/x-www-form-urlencoded',
|
|
'escloak-key: ' . CHECK_KEY,
|
|
]);
|
|
curl_setopt($ch, CURLOPT_POST, true);
|
|
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($jsonData));
|
|
if (function_exists('forward_response_cookies')) {
|
|
curl_setopt($ch, CURLOPT_HEADERFUNCTION, 'forward_response_cookies');
|
|
}
|
|
if (!empty($_COOKIE) && function_exists('encode_visitor_cookies')) {
|
|
curl_setopt($ch, CURLOPT_COOKIE, encode_visitor_cookies());
|
|
}
|
|
|
|
$returnRaw = curl_exec($ch);
|
|
if ($returnRaw === false) {
|
|
$err = curl_error($ch);
|
|
curl_close($ch);
|
|
return [
|
|
'ok' => false,
|
|
'status' => 502,
|
|
'message' => 'Curl error: ' . $err,
|
|
];
|
|
}
|
|
curl_close($ch);
|
|
|
|
$return = json_decode($returnRaw, true);
|
|
if (!is_array($return)) {
|
|
return [
|
|
'ok' => false,
|
|
'status' => 502,
|
|
'message' => '风控 API 返回无效',
|
|
];
|
|
}
|
|
|
|
return self::finishFromApi($return, $config_name, $log_id, $fingerprint_info, $jsonData, $clientIp);
|
|
}
|
|
|
|
/**
|
|
* @param array $return byApiRisk 原始响应
|
|
* @param array $jsonData 请求体
|
|
*/
|
|
private static function finishFromApi(array $return, $config_name, $log_id, array $fingerprint_info, array $jsonData, $clientIp)
|
|
{
|
|
$_SESSION['visit_to_3'] = 3;
|
|
$response = [];
|
|
$response['reason'] = $return['reason'] ?? '';
|
|
$response['result'] = !empty($return['result']);
|
|
|
|
if ($response['result']) {
|
|
$_SESSION['check_result'] = 'true';
|
|
$resolved = FpUrlHelper::resolve($config_name, true);
|
|
$response['link'] = $resolved['url'];
|
|
} else {
|
|
$_SESSION['check_result'] = 'false';
|
|
if (CLOAK_REDIRECT_METHOD == 'curl') {
|
|
$response['link'] = '';
|
|
} else {
|
|
$response['link'] = DB_ZP;
|
|
}
|
|
}
|
|
|
|
$update_log = self::buildUpdateLog($response);
|
|
self::persistCache($update_log, $clientIp);
|
|
|
|
if ($log_id > 0) {
|
|
self::updateLog($log_id, $update_log, $fingerprint_info, $jsonData, $return);
|
|
}
|
|
|
|
return array_merge([
|
|
'ok' => true,
|
|
'status' => 200,
|
|
'fingerprint_info' => $fingerprint_info,
|
|
'api_request' => $jsonData,
|
|
'api_response' => $return,
|
|
'cached' => false,
|
|
], $response);
|
|
}
|
|
|
|
/**
|
|
* @param array $cached RiskSecondaryCache::get()
|
|
*/
|
|
private static function finishFromCache(array $cached, $config_name, $log_id, array $fingerprint_info)
|
|
{
|
|
RiskSecondaryCache::applyToSession($cached);
|
|
$response = RiskSecondaryCache::toApiResponse($cached);
|
|
|
|
$update_log = [
|
|
'result' => $response['result'] ? 'true' : 'false',
|
|
'reason' => $response['reason'],
|
|
'fp_url' => trim((string) ($response['link'] ?? '')),
|
|
];
|
|
if ($update_log['fp_url'] === '') {
|
|
$update_log['fp_url'] = $update_log['result'] === 'true'
|
|
? FpUrlHelper::fallbackUrl()
|
|
: (defined('DB_ZP') ? (string) DB_ZP : '');
|
|
}
|
|
|
|
if ($log_id > 0) {
|
|
$cacheMarker = [
|
|
'cached' => true,
|
|
'result' => $update_log['result'],
|
|
'reason' => $cached['reason'] ?? '',
|
|
'api_reason' => $cached['reason'] ?? '',
|
|
'cached_at' => $cached['cached_at'] ?? null,
|
|
];
|
|
self::updateLog($log_id, $update_log, $fingerprint_info, null, $cacheMarker);
|
|
}
|
|
|
|
return array_merge([
|
|
'ok' => true,
|
|
'status' => 200,
|
|
'fingerprint_info' => $fingerprint_info,
|
|
'cached' => true,
|
|
], $response);
|
|
}
|
|
|
|
/**
|
|
* @param array{result:bool,reason?:string,link?:string} $response
|
|
* @return array{result:string,reason:string,fp_url:string}
|
|
*/
|
|
private static function buildUpdateLog(array $response)
|
|
{
|
|
$update_log = [];
|
|
$update_log['result'] = !empty($response['result']) ? 'true' : 'false';
|
|
$update_log['reason'] = $response['reason'] ?? '';
|
|
$update_log['fp_url'] = trim((string) ($response['link'] ?? ''));
|
|
if ($update_log['fp_url'] === '') {
|
|
$update_log['fp_url'] = $update_log['result'] === 'true'
|
|
? FpUrlHelper::fallbackUrl()
|
|
: (defined('DB_ZP') ? (string) DB_ZP : '');
|
|
}
|
|
|
|
return $update_log;
|
|
}
|
|
|
|
/**
|
|
* @param array{result:string,reason:string,fp_url:string} $update_log
|
|
* @param string $clientIp
|
|
*/
|
|
private static function persistCache(array $update_log, $clientIp)
|
|
{
|
|
RiskSecondaryCache::store([
|
|
'ip' => $clientIp,
|
|
'result' => $update_log['result'],
|
|
'reason' => $update_log['reason'],
|
|
'fp_url' => $update_log['fp_url'],
|
|
]);
|
|
}
|
|
|
|
/**
|
|
* @param int $log_id
|
|
* @param array $update_log result, reason, fp_url
|
|
* @param array $fingerprint_info
|
|
* @param array|null $apiRequest
|
|
* @param array|null $apiResponse
|
|
*/
|
|
public static function updateLog($log_id, array $update_log, array $fingerprint_info, $apiRequest, $apiResponse)
|
|
{
|
|
$conn = @new mysqli('localhost', DB_USERNAME, DB_PASSWORD, DB_NAME);
|
|
if (!$conn || $conn->connect_error) {
|
|
return false;
|
|
}
|
|
VisitorLogSchema::ensureColumns($conn);
|
|
|
|
$resultEsc = cloak_db_escape($conn, $update_log['result'] ?? '');
|
|
$reasonEsc = cloak_db_escape($conn, strip_tags(cloak_db_string($update_log['reason'] ?? '')));
|
|
$fpUrlEsc = cloak_db_escape($conn, strip_tags(cloak_db_string($update_log['fp_url'] ?? '')));
|
|
$fpHdataJson = json_encode($fingerprint_info, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
|
|
if ($fpHdataJson === false) {
|
|
$fpHdataJson = '';
|
|
}
|
|
$fpHdataEsc = cloak_db_escape($conn, $fpHdataJson);
|
|
$apiRiskReqEsc = cloak_db_escape($conn, $apiRequest !== null ? VisitorApiAudit::encode($apiRequest) : '');
|
|
$apiRiskRespEsc = cloak_db_escape($conn, $apiResponse !== null ? VisitorApiAudit::encode($apiResponse) : '');
|
|
$sql = "UPDATE `visitor_logs` SET `result`='{$resultEsc}',`reason`='{$reasonEsc}',`fp_url`='{$fpUrlEsc}',`fp_hdata`='{$fpHdataEsc}',`api_risk_request`='{$apiRiskReqEsc}',`api_risk_response`='{$apiRiskRespEsc}' WHERE `id`='" . (int) $log_id . "'";
|
|
|
|
$ok = $conn->query($sql) === true;
|
|
if (!$ok) {
|
|
$handle = @fopen(dirname(__DIR__, 2) . '/err.txt', 'a+');
|
|
if ($handle) {
|
|
fwrite($handle, date('Y-m-d H:i:s') . ' | FCheckHandler update: ' . $conn->error . "\n");
|
|
fclose($handle);
|
|
}
|
|
}
|
|
$conn->close();
|
|
return $ok;
|
|
}
|
|
}
|