feat: 忘记密码增设脱敏邮箱二次手动输入一致性核对安全锁

resources/js/password-forgot.js

@@ -139,6 +139,9 @@ async function submitAccountDetect(event) {
             const hasEmail = body.has_email;
             const hasWechat = body.has_wechat;
 
+            const hintLabel = document.getElementById("masked-email-hint");
+            const emailInput = document.getElementById("email");
+
             if (hasEmail && hasWechat) {
                 summary.innerHTML = `检测到账号 <strong style="color:var(--gold);">${currentUsername}</strong> 已同时绑定了微信和邮箱。您可以选择以下任意一种方式找回密码：`;
                 tabs.style.display = "grid";
@@ -149,15 +152,24 @@ async function submitAccountDetect(event) {
                     wechatTabBtn.classList.add("active");
                 }
                 panelWechat.style.display = "block";
+                
+                if (hintLabel) {
+                    hintLabel.innerHTML = `📬 绑定的邮箱提示：<span style="color:#fff;">${body.masked_email}</span>`;
+                }
+                if (emailInput instanceof HTMLInputElement) {
+                    emailInput.value = "";
+                }
             } else if (hasWechat) {
                 summary.innerHTML = `检测到账号 <strong style="color:var(--gold);">${currentUsername}</strong> 仅绑定了微信。系统不支持邮箱找回，建议您使用微信助手进行重置：`;
                 panelWechat.style.display = "block";
             } else if (hasEmail) {
                 summary.innerHTML = `检测到账号 <strong style="color:var(--gold);">${currentUsername}</strong> 仅绑定了邮箱。建议您使用邮箱发送重置链接找回：`;
                 panelEmail.style.display = "block";
-                const emailInput = document.getElementById("email");
+                if (hintLabel) {
+                    hintLabel.innerHTML = `📬 绑定的邮箱提示：<span style="color:#fff;">${body.masked_email}</span>`;
+                }
                 if (emailInput instanceof HTMLInputElement) {
-                    emailInput.value = body.masked_email;
+                    emailInput.value = "";
                 }
             } else {
                 summary.innerHTML = `检测到账号 <strong style="color:var(--gold);">${currentUsername}</strong> 尚未绑定微信或邮箱找回途径：`;
@@ -195,6 +207,9 @@ async function submitPasswordRecovery(event) {
     hideAlert();
 
     try {
+        const emailInput = document.getElementById("email");
+        const emailVal = emailInput instanceof HTMLInputElement ? emailInput.value.trim() : "";
+
         const response = await fetch(form.getAttribute("data-password-email-url") ?? "", {
             method: "POST",
             headers: {
@@ -204,6 +219,7 @@ async function submitPasswordRecovery(event) {
             },
             body: JSON.stringify({
                 username: currentUsername,
+                email: emailVal,
             }),
         });
         const body = await response.json();

resources/views/password-forgot.blade.php

@@ -351,21 +351,23 @@
 
                 <!-- 模块二：邮箱重置发送表单 -->
                 <div id="panel-email" class="channel-pane" style="display: none;">
+                    <!-- 脱敏提示标签 -->
+                    <div id="masked-email-hint" style="margin-bottom: 14px; font-size: 13.5px; color: var(--gold); font-weight: bold; line-height: 1.6; padding: 10px; border: 1px dashed rgba(198,163,91,0.3); background: rgba(198,163,91,0.02);"></div>
+                    
                     <form id="password-recovery-form" data-password-email-url="{{ route('password.email') }}">
-                        <label for="email">已绑定邮箱</label>
+                        <label for="email">二次安全确认：请输入绑定的完整邮箱</label>
                         <input
                             id="email"
                             name="email"
                             type="email"
                             maxlength="255"
-                            placeholder="账号绑定的邮箱地址"
-                            autocomplete="email"
-                            readonly
+                            placeholder="请输入绑定的完整邮箱地址以进行二次确认"
+                            autocomplete="off"
                             required
                         >
-                        <div class="tip" style="margin-bottom: 15px;">出于安全目的，此邮箱仅作脱敏验证。系统将向该邮箱投递密码重置链接。</div>
+                        <div class="tip" style="margin-top: 10px; margin-bottom: 15px;">为保障安全，邮箱已作脱敏隐藏。请手动输入完全一致的完整绑定邮箱，否则无法发送重置链接。</div>
 
-                        <button id="submit-btn" type="submit" style="width: 100%;" {{ $smtpEnabled ? '' : 'disabled' }}>发送重置邮件</button>
+                        <button id="submit-btn" type="submit" style="width: 100%;" {{ $smtpEnabled ? '' : 'disabled' }}>二次验证并发送重置邮件</button>
                     </form>
                 </div>