defender-security / src / component / security-tweaks / change-admin.php

change-admin.php in Defender Security – Malware Scanner, Login Security & Firewall 3.1.0, at src/component/security-tweaks/change-admin.php

197 lines 4.5 KB

Raw Download Zip

1	<?php
2
3	namespace WP_Defender\Component\Security_Tweaks;
4
5	use Calotes\Component\Response;
6	use WP_Error;
7	use Calotes\Helper\HTTP;
8	use Calotes\Base\Component;
9
10	/**
11	* Class Change_Admin
12	* @package WP_Defender\Component\Security_Tweaks
13	*/
14	class Change_Admin extends Component {
15	public $slug = 'replace-admin-username';
16
17	/**
18	* Check whether the issue has been resolved or not.
19	*
20	* @return bool
21	*/
22	public function check() {
23	return $this->is_resolved();
24	}
25
26	/**
27	* Here is the code for processing, if the return is true, we add it to resolve list, WP_Error if any error.
28	*
29	* @return bool\|\WP_Error
30	*/
31	public function process() {
32	$username = HTTP::post( 'username' );
33	$is_valid = $this->validate( $username );
34
35	if ( is_wp_error( $is_valid ) ) {
36	return $is_valid;
37	}
38
39	return $this->update_username( $username );
40	}
41
42	/**
43	* This is for un-do stuff that has be done in @process.
44	*
45	* @return bool
46	*/
47	public function revert() {
48	return true;
49	}
50
51	/**
52	* Shield up.
53	*
54	* @return bool
55	*/
56	public function shield_up() {
57	return true;
58	}
59
60	/**
61	* Check whether the issue is resolved or not.
62	*
63	* @return bool
64	*/
65	private function is_resolved() {
66	return ! $this->get_user_with_admin_username();
67	}
68
69	/**
70	* Get user with admin username.
71	*
72	* @return \WP_User\|false on failure
73	*/
74	private function get_user_with_admin_username() {
75	return get_user_by( 'login', 'admin' );
76	}
77
78	/**
79	* Validate username.
80	*
81	* @param string $username
82	*
83	* @return bool\|WP_Error on failure
84	*/
85	private function validate( $username ) {
86	if ( empty( $username ) ) {
87	return new WP_Error( 'defender_invalid_username', __( 'The username can\'t be empty!', 'wpdef' ) );
88	}
89
90	if ( 'admin' === strtolower( $username ) ) {
91	return new WP_Error( 'defender_invalid_username',
92	__( 'You can\'t use admin as a username again!', 'wpdef' ) );
93	}
94
95	if ( ! validate_username( $username ) ) {
96	return new WP_Error( 'defender_invalid_username', __( 'The username is invalid!', 'wpdef' ) );
97	}
98
99	if ( username_exists( $username ) ) {
100	return new WP_Error( 'defender_invalid_username', __( 'The username already exists!', 'wpdef' ) );
101	}
102
103	return true;
104	}
105
106	/**
107	* @param string $username
108	*
109	* @return bool\|WP_Error
110	*/
111	private function update_username( $username ) {
112	global $wpdb;
113	$user = $this->get_user_with_admin_username();
114
115	$ret = $wpdb->update(
116	$wpdb->users,
117	[
118	'user_login' => trim( $username )
119	],
120	[
121	'ID' => $user->ID
122	]
123	);
124	if ( ! $ret ) {
125	return new WP_Error( 'update_error', $wpdb->last_error );
126	}
127
128	if ( is_multisite() ) {
129	$site_admins = get_site_option( 'site_admins' );
130
131	if ( is_array( $site_admins ) ) {
132	$pos = array_search( 'admin', array_map( 'strtolower', $site_admins ) );
133
134	if ( false !== $pos ) {
135	$site_admins[ $pos ] = $username;
136	update_site_option( 'site_admins', $site_admins );
137	}
138	}
139	}
140	clean_user_cache( $user );
141	// Log the user out only if it's the user with 'admin' username.
142	if ( $user->ID !== get_current_user_id() ) {
143	return true;
144	}
145	if ( defined( 'WP_DEFENDER_TESTING' ) && true === constant( 'WP_DEFENDER_TESTING' ) ) {
146	// Testing.
147	return true;
148	}
149	$interval = 5;
150	$redirect = $this->get_login_url();
151
152	return new Response(
153	true,
154	array(
155	'message' => sprintf(
156	__( 'Your admin name has changed. You will need to <a href="%s"><strong>%s</strong></a>.<br/>This will auto reload after <span class="hardener-timer">%d</span> seconds.',
157	'wpdef' ),
158	$redirect,
159	're-login',
160	$interval
161	),
162	'redirect' => $redirect,
163	'interval' => $interval,
164	)
165	);
166	}
167
168	/**
169	* Get the login url.
170	*
171	* @return string
172	*/
173	private function get_login_url() {
174	return wp_login_url( network_admin_url( 'admin.php?page=wdf-hardener' ) );
175	}
176
177	/**
178	* Return a summary data of this tweak.
179	*
180	* @return array
181	*/
182	public function to_array() {
183	return [
184	'slug' => $this->slug,
185	'title' => __( 'Change default admin user account', 'wpdef' ),
186	'errorReason' => __( 'You have a user account with the admin username.', 'wpdef' ),
187	'successReason' => __( 'You don\'t have a user account sporting the admin username, great!', 'wpdef' ),
188	'misc' => array(
189	'host' => defender_get_hostname(),
190	),
191	'bulk_description' => __( 'Using the default admin username is widely considered bad practice and opens you up to the easitest form of entry to your website. We will create new admin username for you.',
192	'wpdef' ),
193	'bulk_title' => __( 'Admin User', 'wpdef' ),
194	];
195	}
196	}
197