up

app/Http/Controllers/Admin/AuthController.php

@@ -13,6 +13,7 @@ use App\Models\OperateLog;
 use App\Models\Permission;
 use App\Models\RoleHasPermission;
 use App\Services\AdminSmsChallengeService;
+use Illuminate\Support\Facades\Log;
 use Illuminate\Support\Facades\Validator;
 
 class AuthController extends Controller
@@ -253,7 +254,16 @@ class AuthController extends Controller
             $smsSign = Config::getValueByKey('sms_sign');
             $challengeId = $service->issueChallenge($all['mobile'], request()->ip(), function ($code) use ($all, $smsSign) {
                 $content = "{$smsSign}验证码{$code}，您正在登陆苏州科技商学院信息化系统，请在5分钟内完成验证。";
-                return (bool) ymSms($all['mobile'], $content);
+                try {
+                    return (bool) ymSms($all['mobile'], $content);
+                } catch (\Throwable $e) {
+                    // Do not expose provider/network errors or the mobile number to the client.
+                    Log::error('admin_sms_provider_error', [
+                        'mobile_hash' => hash('sha256', (string) $all['mobile']),
+                        'exception' => get_class($e),
+                    ]);
+                    return false;
+                }
             }, (string) request()->userAgent());
         }