defender-security / src / controller / password-reset.php

password-reset.php in Defender Security – Malware Scanner, Login Security & Firewall 3.1.0, at src/controller/password-reset.php

278 lines 7.0 KB

Raw Download Zip

1	<?php
2
3	namespace WP_Defender\Controller;
4
5	use Calotes\Component\Request;
6	use Calotes\Component\Response;
7	use WP_Defender\Component\Config\Config_Hub_Helper;
8	use WP_Defender\Controller;
9	use WP_Defender\Traits\Formats;
10
11	/**
12	* Class Password_Reset
13	*
14	* @package WP_Defender\Controller
15	*/
16	class Password_Reset extends Controller {
17	use Formats;
18
19	/**
20	* Use for cache
21	*
22	* @var \WP_Defender\Model\Setting\Password_Reset
23	*/
24	protected $model;
25
26	/**
27	* @var \WP_Defender\Component\Password_Protection
28	*/
29	protected $service;
30
31	/**
32	* @var string
33	*/
34	public $default_msg;
35
36	public function __construct() {
37	$this->model = $this->get_model();
38	$this->service = wd_di()->get( \WP_Defender\Component\Password_Protection::class );
39	$default_values = $this->model->get_default_values();
40	$this->default_msg = $default_values['message'];
41	add_filter( 'wp_defender_advanced_tools_data', array( $this, 'script_data' ) );
42	$this->register_routes();
43	if ( $this->model->is_active() ) {
44	// Update site url on sub-site when MaskLogin is disabled.
45	if (
46	is_multisite() && ! is_main_site()
47	&& ! wd_di()->get( \WP_Defender\Model\Setting\Mask_Login::class )->is_active()
48	) {
49	add_filter( 'network_site_url', array( &$this, 'filter_site_url' ), 100, 2 );
50	}
51	add_action( 'validate_password_reset', array( $this, 'handle_reset_check_password' ), 10, 2 );
52	add_action( 'profile_update', array( $this, 'handle_update_user' ), 10, 2 );
53	add_action( 'password_reset', array( $this, 'handle_password_reset' ), 10 );
54	add_action( 'wp_authenticate_user', array( $this, 'handle_login_password' ), 999, 2 );
55	// No use 'user_profile_update_errors' because there aren't checks for password resetting for logged user in.
56	}
57	}
58
59	/**
60	* Update 'network_site_url' if:
61	* not empty URL path,
62	* it's link to reset password
63	* @param string $url
64	* @param string $path
65	*
66	* @return string
67	*/
68	public function filter_site_url( $url, $path ) {
69	if ( $path && is_string( $path )
70	&& ! empty( $_GET['action'] ) && in_array( $_GET['action'], array( 'rp', 'resetpass' ), true )
71	&& false !== stristr( $url, 'wp-login.php' )
72	) {
73	return get_option( 'siteurl' ) . '/' . ltrim( $path, '/' );
74	}
75	return $url;
76	}
77
78	/**
79	* @return \WP_Defender\Model\Setting\Password_Reset
80	*/
81	private function get_model() {
82	if ( is_object( $this->model ) ) {
83	return $this->model;
84	}
85
86	return new \WP_Defender\Model\Setting\Password_Reset();
87	}
88
89	/**
90	* @param \WP_User\|\WP_Error $user WP_User object or WP_Error.
91	* @param string $password Password plain string.
92	*
93	* @return \WP_User\|\WP_Error Return user object or error object.
94	*/
95	public function handle_login_password( $user, $password ) {
96	$this->service->do_force_reset( $user, $password );
97
98	return $user;
99	}
100
101	/**
102	* Handle password update on password reset.
103	*
104	* @param \WP_Error $errors
105	* @param \WP_Error\|\WP_User $user
106	*
107	* @return void\|\WP_Error
108	*/
109	public function handle_reset_check_password( $errors, $user ) {
110	if ( is_wp_error( $user ) ) {
111	return;
112	}
113
114	if ( ! $this->service->is_enabled_by_user_role( $user, $this->model->user_roles ) ) {
115	return;
116	}
117
118	// Check if display_reset_password_warning cookie enabled then show warning message on reset password page.
119	if ( isset( $_COOKIE['display_reset_password_warning'] ) ) {
120	$message = empty( $this->model->message ) ? $this->default_msg : $this->model->message;
121	$errors->add( 'defender_password_reset', $message );
122	// Remove the one time cookie notice once it's displayed.
123	$this->service->remove_cookie_notice(
124	'display_reset_password_warning',
125	true
126	);
127
128	return $errors;
129	}
130
131	$login_password = $this->service->get_submitted_password();
132	if (
133	! empty( $user->ID )
134	&& ! empty( $login_password )
135	&& wp_check_password( $login_password, get_userdata( $user->ID )->user_pass, $user->ID )
136	) {
137	$message = wp_kses(
138	__( 'This password has been used already. Please choose a different one.', 'wpdef' ),
139	array( 'strong' => array() )
140	);
141	$errors->add( 'defender_password_reset', $message );
142
143	return $errors;
144	}
145
146	return $errors;
147	}
148
149	/**
150	* Update the time when a user resets their password.
151	*
152	* @param \WP_User $user
153	*/
154	public function handle_password_reset( $user ) {
155	$this->service->handle_password_updated( $user );
156	}
157
158	/**
159	* Update password data when a user object is set or updated.
160	*
161	* @param int $user_id
162	* @param object $old_user_data
163	*/
164	public function handle_update_user( $user_id, $old_user_data ) {
165
166	$user = get_userdata( $user_id );
167
168	if ( $user->user_pass === $old_user_data->user_pass ) {
169	return;
170	}
171
172	$this->service->handle_password_updated( $user );
173	}
174
175	/**
176	* @param $data
177	*
178	* @return array
179	*/
180	public function script_data( $data ) {
181	$data['password_reset'] = $this->data_frontend();
182
183	return $data;
184	}
185
186	/**
187	* Save settings.
188	* @defender_route
189	*/
190	public function save_settings( Request $request ) {
191	$data = $request->get_data_by_model( $this->model );
192	$this->model->import( $data );
193	if ( $this->model->validate() ) {
194	$this->model->save();
195	Config_Hub_Helper::set_clear_active_flag();
196
197	$response = array(
198	'message' => __( 'Your settings have been updated.', 'wpdef' ),
199	);
200
201	return new Response( true, array_merge( $response, $this->data_frontend() ) );
202	}
203
204	return new Response(
205	false,
206	array(
207	'message' => $this->model->get_formatted_errors(),
208	)
209	);
210	}
211
212	/**
213	* @defender_route
214	* @param Request $request
215	*
216	* @return Response
217	*/
218	public function toggle_reset( Request $request ) {
219	$response = [];
220	$data = $request->get_data_by_model( $this->model );
221	if ( isset( $data['expire_force'] ) && true === $data['expire_force'] ) {
222	$data['force_time'] = time();
223	$response = array(
224	'message' => __( 'Selected user roles are required to reset their password upon next login.', 'wpdef' ),
225	);
226	} else {
227	$response['message'] = __( 'Passwords reset is no longer required.', 'wpdef' );
228	}
229	$this->model->import( $data );
230	if ( $this->model->validate() ) {
231	$this->model->save();
232	Config_Hub_Helper::set_clear_active_flag();
233
234	return new Response( true, array_merge( $response, $this->data_frontend() ) );
235	}
236
237	return new Response(
238	false,
239	array(
240	'message' => $this->model->get_formatted_errors(),
241	)
242	);
243	}
244
245	public function remove_settings() {}
246
247	public function remove_data() {
248	delete_metadata( 'user', null, 'wd_last_password_change', null, true );
249	}
250
251	public function data_frontend() {
252	$model = $this->get_model();
253
254	return array_merge(
255	array(
256	'model' => $model->export(),
257	'all_roles' => wp_list_pluck( get_editable_roles(), 'name' ),
258	'reset_last' => empty( $model->force_time ) ? '' : $this->format_date_time( $model->force_time ),
259	'default_message' => $this->default_msg,
260	),
261	$this->dump_routes_and_nonces()
262	);
263	}
264
265	public function import_data( $data ) {
266	$model = $this->get_model();
267
268	$model->import( $data );
269	if ( $model->validate() ) {
270	$model->save();
271	}
272	}
273
274	public function to_array() {}
275
276	public function export_strings() {}
277	}
278