defender-security / src / view / two-fa / otp.php

otp.php in Defender Security – Malware Scanner, Login Security & Firewall 3.0.1, at src/view/two-fa/otp.php

429 lines 11.9 KB

Raw Download Zip

1	<?php
2	if ( ! function_exists( 'login_header_otp' ) ) {
3	//copy from wp-login
4	/**
5	* Output the login page header.
6	*
7	* @param string $title Optional. WordPress login Page title to display in the `<title>` element.
8	* Default 'Log In'.
9	* @param string $message Optional. Message to display in header. Default empty.
10	* @param WP_Error $wp_error Optional. The error to pass. Default empty.
11	*/
12	function login_header_otp( $title = 'Log In', $message = '', $wp_error = '' ) {
13	global $error, $interim_login, $action;
14
15	if ( empty( $wp_error ) ) {
16	$wp_error = new \WP_Error();
17	}
18
19	// Shake it!
20	$shake_error_codes = array(
21	'empty_password',
22	'empty_email',
23	'invalid_email',
24	'invalidcombo',
25	'empty_username',
26	'invalid_username',
27	'incorrect_password',
28	);
29	/**
30	* Filters the error codes array for shaking the login form.
31	*
32	* @param array $shake_error_codes Error codes that shake the login form.
33	*
34	* @since 3.0.0
35	*
36	*/
37	$shake_error_codes = apply_filters( 'shake_error_codes', $shake_error_codes );
38
39	if ( $shake_error_codes && $wp_error->get_error_code() && in_array( $wp_error->get_error_code(),
40	$shake_error_codes ) ) {
41	add_action( 'login_head', 'wp_shake_js', 12 );
42	}
43
44	$separator = is_rtl() ? ' &rsaquo; ' : ' &lsaquo; ';
45
46	?><!DOCTYPE html>
47	<!--[if IE 8]>
48	<html xmlns="http://www.w3.org/1999/xhtml" class="ie8" <?php
49	language_attributes(); ?>>
50	<![endif]-->
51	<!--[if !(IE 8) ]><!-->
52	<html xmlns="http://www.w3.org/1999/xhtml" <?php language_attributes(); ?>>
53	<!--<![endif]-->
54	<head>
55	<meta http-equiv="Content-Type"
56	content="<?php
57	bloginfo( 'html_type' ); ?>; charset=<?php
58	bloginfo( 'charset' ); ?>"/>
59	<title><?php
60	echo get_bloginfo( 'name', 'display' ) . $separator . $title; ?></title>
61	<?php
62
63	wp_enqueue_style( 'login' );
64
65	/*
66	* Remove all stored post data on logging out.
67	* This could be added by add_action('login_head'...) like wp_shake_js(),
68	* but maybe better if it's not removable by plugins.
69	*/
70	if ( 'loggedout' == $wp_error->get_error_code() ) {
71	?>
72	<script>if ("sessionStorage" in window) {
73	try {
74	for (var key in sessionStorage) {
75	if (key.indexOf("wp-autosave-") != -1) {
76	sessionStorage.removeItem(key)
77	}
78	}
79	} catch (e) {
80	}
81	}
82	;</script>
83	<?php
84	}
85
86	/**
87	* Enqueue scripts and styles for the login page.
88	*
89	* @since 3.1.0
90	*/
91	do_action( 'login_enqueue_scripts' );
92
93	/**
94	* Fires in the login page header after scripts are enqueued.
95	*
96	* @since 2.1.0
97	*/
98	do_action( 'login_head' );
99
100	if ( is_multisite() ) {
101	$login_header_url = network_home_url();
102	$login_header_title = get_network()->site_name;
103	} else {
104	$login_header_url = __( 'https://wordpress.org/' );
105	$login_header_title = __( 'Powered by WordPress' );
106	}
107
108	/**
109	* Filters link URL of the header logo above login form.
110	*
111	* @param string $login_header_url Login header logo URL.
112	*
113	* @since 2.1.0
114	*
115	*/
116	$login_header_url = apply_filters( 'login_headerurl', $login_header_url );
117
118	/**
119	* Filters the title attribute of the header logo above login form.
120	*
121	* @param string $login_header_title Login header logo title attribute.
122	*
123	* @since 2.1.0
124	*/
125	$login_header_title = apply_filters( 'login_headertitle', $login_header_title );
126
127	$classes = array( 'login-action-' . $action, 'wp-core-ui' );
128	if ( is_rtl() ) {
129	$classes[] = 'rtl';
130	}
131	if ( $interim_login ) {
132	$classes[] = 'interim-login';
133	?>
134	<style type="text/css">html {
135	background-color: transparent;
136	}</style>
137	<?php
138
139	if ( 'success' === $interim_login ) {
140	$classes[] = 'interim-login-success';
141	}
142	}
143	$classes[] = ' locale-' . sanitize_html_class( strtolower( str_replace( '_', '-', get_locale() ) ) );
144
145	/**
146	* Filters the login page body classes.
147	*
148	* @param array $classes An array of body classes.
149	* @param string $action The action that brought the visitor to the login page.
150	*
151	* @since 3.5.0
152	*/
153	$classes = apply_filters( 'login_body_class', $classes, $action );
154
155	?>
156	</head>
157	<body class="login <?php
158	echo esc_attr( implode( ' ', $classes ) ); ?>">
159	<?php
160	/**
161	* Fires in the login page header after the body tag is opened.
162	*
163	* @since 4.6.0
164	*/
165	do_action( 'login_header' );
166	?>
167	<div id="login">
168
169	<h1><a id="otp-logo" href="<?php
170	echo esc_url( $login_header_url ); ?>" title="<?php
171	echo esc_attr( $login_header_title ); ?>"
172	tabindex="-1"><?php
173	bloginfo( 'name' ); ?></a></h1>
174	<?php
175	unset( $login_header_url, $login_header_title );
176	/**
177	* Filters the message to display above the login form.
178	*
179	* @param string $message Login message text.
180	*
181	* @since 2.1.0
182	*/
183	$message = apply_filters( 'login_message', $message );
184	if ( ! empty( $message ) ) {
185	echo $message . "\n";
186	}
187
188	// In case a plugin uses $error rather than the $wp_errors object
189	if ( ! empty( $error ) ) {
190	$wp_error->add( 'error', $error );
191	unset( $error );
192	}
193
194	if ( $wp_error->get_error_code() ) {
195	$errors = '';
196	$messages = '';
197	foreach ( $wp_error->get_error_codes() as $code ) {
198	$severity = $wp_error->get_error_data( $code );
199	foreach ( $wp_error->get_error_messages( $code ) as $error_message ) {
200	if ( 'message' == $severity ) {
201	$messages .= ' ' . $error_message . "<br />\n";
202	} else {
203	$errors .= ' ' . $error_message . "<br />\n";
204	}
205	}
206	}
207	if ( ! empty( $errors ) ) {
208	/**
209	* Filters the error messages displayed above the login form.
210	*
211	* @param string $errors Login error message.
212	*
213	* @since 2.1.0
214	*
215	*/
216	echo '<div id="login_error">' . apply_filters( 'login_errors', $errors ) . "</div>\n";
217	}
218	if ( ! empty( $messages ) ) {
219	/**
220	* Filters instructional messages displayed above the login form.
221	*
222	* @param string $messages Login messages.
223	*
224	* @since 2.5.0
225	*
226	*/
227	echo '<p class="message">' . apply_filters( 'login_messages', $messages ) . "</p>\n";
228	}
229	}
230	}
231	}
232
233	if ( isset( $interim_login ) && 'success' === $interim_login ) {
234	login_header_otp( '', $message );
235
236	$modal_close_script = <<<END
237	<script>
238	jQuery(function ($) {
239	$('.wp-auth-check-close', window.parent.document).trigger('click');
240	});
241	</script>
242	END;
243
244	add_action(
245	'wp_print_footer_scripts',
246	function() use ( $modal_close_script ) {
247	echo $modal_close_script;
248	}
249	);
250	} else {
251	login_header_otp( '', '', $error );
252
253	if ( ! empty( $providers ) ) {
254	foreach ( $providers as $slug => $provider ) { ?>
255	<form method="post" class="wpdef-2fa-form" id="wpdef-2fa-form-<?php esc_attr_e( $slug ); ?>"
256	action="<?php
257	echo esc_url( add_query_arg( 'action', 'defender-verify-otp', site_url( 'wp-login.php', 'login_post' ) ) );
258	?>">
259
260	<?php $provider->authentication_form(); ?>
261
262	<input type="hidden" name="auth_method" value="<?php echo esc_attr( $slug ); ?>"/>
263	<input type="hidden" name="login_token" value="<?php echo esc_attr( $token ); ?>"/>
264	<input type="hidden" name="redirect_to" value="<?php echo esc_attr( $redirect_to ); ?>"/>
265	<input type="hidden" name="password" value="<?php echo esc_attr( $password ); ?>"/>
266	<?php
267	if ( isset( $_REQUEST['interim-login'] ) ) { ?>
268	<input type="hidden" name="interim-login" value="1" />
269	<?php
270	}
271	wp_nonce_field( 'verify_otp' ); ?>
272	</form>
273	<?php }
274	if ( (is_array($providers) \|\| $providers instanceof \Countable ? count( $providers ) : 0) > 1 ) { ?>
275	<div id="wrap-nav">
276	<p><?php _e('Having problems? Try another way to log in', 'wpdef' ); ?></p>
277	<ul id="nav">
278	<?php foreach ( $providers as $slug => $provider ) { ?>
279	<li class="wpdef-2fa-link" id="wpdef-2fa-link-<?php esc_attr_e( $slug ); ?>"
280	data-slug="<?php esc_attr_e( $slug ); ?>">
281
282	<?php echo $provider->get_login_label(); ?>
283
284	</li>
285	<?php } ?>
286	</ul>
287	<img class="def-ajaxloader" src="<?php echo defender_asset_url( '/assets/img/spinner.svg' ); ?>"/>
288	</div>
289	<?php } ?>
290	<p class="notification"></p>
291	<?php } ?>
292	<?php if ( $custom_graphic ) { ?>
293	<style type="text/css">
294	body.login div#login h1 a {
295	background-image: url("<?php echo $custom_graphic ?>");
296	}
297	</style>
298	<?php } ?>
299	<?php
300	$totp_script = <<<END
301	<script>
302	jQuery(function ($) {
303	function two_factor_providers( defaultSlug ) {
304	// Hide all forms and show the one default.
305	$('.wpdef-2fa-form').hide();
306	$('#wpdef-2fa-form-' + defaultSlug).show();
307	// Hide all links and show others except the default.
308	if ( $('.wpdef-2fa-link').length > 0 ) {
309	$('.wpdef-2fa-link').hide();
310	$('.wpdef-2fa-link:not(#wpdef-2fa-link-'+ defaultSlug +')').each(function(){
311	$(this).show();
312	});
313	}
314	}
315	var is_sent = false;
316	// Logic for FallbackEmail method.
317	function resend_code() {
318	// Work with the button 'Resen Code'.
319	var that = $('input[name="button_resend_code"]');
320	if (is_sent === false) {
321	is_sent = true;
322	}
323	let data = {
324	data: JSON.stringify({
325	'token': '{$token}'
326	})
327	};
328	$.ajax({
329	type: 'POST',
330	url: '{$action_fallback_email}',
331	data: data,
332	beforeSend: function () {
333	that.attr('disabled', 'disabled');
334	$('.def-ajaxloader').show();
335	},
336	success: function (data) {
337	that.removeAttr('disabled');
338	$('.def-ajaxloader').hide();
339	$('.notification').text(data.data.message);
340	is_sent = false;
341	}
342	})
343	}
344
345	$('.def-ajaxloader').hide();
346	// Hide all forms and show the one default.
347	var defaultSlug = '{$default_slug}';
348	two_factor_providers( defaultSlug );
349	// Work with links.
350	$('body').on('click', '.wpdef-2fa-link', function () {
351	$('#login_error').remove();
352	// Clear any previous notification.
353	$('.notification').empty();
354	var slug = $(this).data('slug');
355	two_factor_providers( slug );
356	// Switch to 'Fallback Email' method.
357	if ('fallback-email' === slug) {
358	resend_code();
359	}
360	});
361	// Resend code.
362	$('body').on('click', 'input[name="button_resend_code"]', function (e) {
363	e.preventDefault();
364	resend_code();
365	})
366	})
367	</script>
368	END;
369	add_action(
370	'wp_print_footer_scripts',
371	function() use ( $totp_script ) {
372	echo $totp_script;
373	}
374	);
375	?>
376	<?php
377	}
378	?>
379
380	<?php
381	if ( ! function_exists( 'login_footer' ) ) {
382	/**
383	* Outputs the footer for the login page.
384	*
385	* @param string $input_id Which input to auto-focus
386	*/
387	function login_footer( $input_id = '' ) {
388	global $interim_login;
389
390	// Don't allow interim logins to navigate away from the page.
391	if ( ! $interim_login ): ?>
392	<p id="backtoblog"><a href="<?php
393	echo esc_url( home_url( '/' ) ); ?>"><?php
394	/* translators: %s: site title */
395	printf( _x( '← Back to %s', 'site' ), get_bloginfo( 'title', 'display' ) );
396	?></a></p>
397	<?php
398	endif; ?>
399
400	</div>
401
402	<?php
403	if ( ! empty( $input_id ) ) : ?>
404	<script type="text/javascript">
405	try {
406	document.getElementById('<?php echo $input_id; ?>').focus();
407	} catch (e) {
408	}
409	if (typeof wpOnload == 'function') wpOnload();
410	</script>
411	<?php
412	endif; ?>
413
414	<?php
415	/**
416	* Fires in the login page footer.
417	*
418	* @since 3.1.0
419	*/
420	do_action( 'login_footer' ); ?>
421	<div class="clear"></div>
422	</body>
423	</html>
424	<?php
425	}
426	}
427	login_footer();
428	?>
429