defender-security / src / view / two-fa / otp.php

otp.php in Defender Security – Malware Scanner, Login Security & Firewall 3.1.0, at src/view/two-fa/otp.php

430 lines 12.0 KB

Raw Download Zip

1	<?php
2	if ( ! function_exists( 'login_header_otp' ) ) {
3	//copy from wp-login
4	/**
5	* Output the login page header.
6	*
7	* @param string $title Optional. WordPress login Page title to display in the `<title>` element.
8	* Default 'Log In'.
9	* @param string $message Optional. Message to display in header. Default empty.
10	* @param WP_Error $wp_error Optional. The error to pass. Default empty.
11	*/
12	function login_header_otp( $title = 'Log In', $message = '', $wp_error = '' ) {
13	global $error, $interim_login, $action;
14
15	if ( empty( $wp_error ) ) {
16	$wp_error = new \WP_Error();
17	}
18
19	// Shake it!
20	$shake_error_codes = array(
21	'empty_password',
22	'empty_email',
23	'invalid_email',
24	'invalidcombo',
25	'empty_username',
26	'invalid_username',
27	'incorrect_password',
28	);
29	/**
30	* Filters the error codes array for shaking the login form.
31	*
32	* @param array $shake_error_codes Error codes that shake the login form.
33	*
34	* @since 3.0.0
35	*
36	*/
37	$shake_error_codes = apply_filters( 'shake_error_codes', $shake_error_codes );
38
39	if ( $shake_error_codes && $wp_error->get_error_code() && in_array( $wp_error->get_error_code(),
40	$shake_error_codes ) ) {
41	add_action( 'login_head', 'wp_shake_js', 12 );
42	}
43
44	$separator = is_rtl() ? ' &rsaquo; ' : ' &lsaquo; ';
45
46	?><!DOCTYPE html>
47	<!--[if IE 8]>
48	<html xmlns="http://www.w3.org/1999/xhtml" class="ie8" <?php
49	language_attributes(); ?>>
50	<![endif]-->
51	<!--[if !(IE 8) ]><!-->
52	<html xmlns="http://www.w3.org/1999/xhtml" <?php language_attributes(); ?>>
53	<!--<![endif]-->
54	<head>
55	<meta http-equiv="Content-Type"
56	content="<?php
57	bloginfo( 'html_type' ); ?>; charset=<?php
58	bloginfo( 'charset' ); ?>"/>
59	<meta name="viewport" content="width=device-width">
60	<title><?php
61	echo get_bloginfo( 'name', 'display' ) . $separator . $title; ?></title>
62	<?php
63
64	wp_enqueue_style( 'login' );
65
66	/*
67	* Remove all stored post data on logging out.
68	* This could be added by add_action('login_head'...) like wp_shake_js(),
69	* but maybe better if it's not removable by plugins.
70	*/
71	if ( 'loggedout' == $wp_error->get_error_code() ) {
72	?>
73	<script>if ("sessionStorage" in window) {
74	try {
75	for (var key in sessionStorage) {
76	if (key.indexOf("wp-autosave-") != -1) {
77	sessionStorage.removeItem(key)
78	}
79	}
80	} catch (e) {
81	}
82	}
83	;</script>
84	<?php
85	}
86
87	/**
88	* Enqueue scripts and styles for the login page.
89	*
90	* @since 3.1.0
91	*/
92	do_action( 'login_enqueue_scripts' );
93
94	/**
95	* Fires in the login page header after scripts are enqueued.
96	*
97	* @since 2.1.0
98	*/
99	do_action( 'login_head' );
100
101	if ( is_multisite() ) {
102	$login_header_url = network_home_url();
103	$login_header_title = get_network()->site_name;
104	} else {
105	$login_header_url = __( 'https://wordpress.org/' );
106	$login_header_title = __( 'Powered by WordPress' );
107	}
108
109	/**
110	* Filters link URL of the header logo above login form.
111	*
112	* @param string $login_header_url Login header logo URL.
113	*
114	* @since 2.1.0
115	*
116	*/
117	$login_header_url = apply_filters( 'login_headerurl', $login_header_url );
118
119	/**
120	* Filters the title attribute of the header logo above login form.
121	*
122	* @param string $login_header_title Login header logo title attribute.
123	*
124	* @since 2.1.0
125	*/
126	$login_header_title = apply_filters( 'login_headertitle', $login_header_title );
127
128	$classes = array( 'login-action-' . $action, 'wp-core-ui' );
129	if ( is_rtl() ) {
130	$classes[] = 'rtl';
131	}
132	if ( $interim_login ) {
133	$classes[] = 'interim-login';
134	?>
135	<style type="text/css">html {
136	background-color: transparent;
137	}</style>
138	<?php
139
140	if ( 'success' === $interim_login ) {
141	$classes[] = 'interim-login-success';
142	}
143	}
144	$classes[] = ' locale-' . sanitize_html_class( strtolower( str_replace( '_', '-', get_locale() ) ) );
145
146	/**
147	* Filters the login page body classes.
148	*
149	* @param array $classes An array of body classes.
150	* @param string $action The action that brought the visitor to the login page.
151	*
152	* @since 3.5.0
153	*/
154	$classes = apply_filters( 'login_body_class', $classes, $action );
155
156	?>
157	</head>
158	<body class="login <?php
159	echo esc_attr( implode( ' ', $classes ) ); ?>">
160	<?php
161	/**
162	* Fires in the login page header after the body tag is opened.
163	*
164	* @since 4.6.0
165	*/
166	do_action( 'login_header' );
167	?>
168	<div id="login">
169
170	<h1><a id="otp-logo" href="<?php
171	echo esc_url( $login_header_url ); ?>" title="<?php
172	echo esc_attr( $login_header_title ); ?>"
173	tabindex="-1"><?php
174	bloginfo( 'name' ); ?></a></h1>
175	<?php
176	unset( $login_header_url, $login_header_title );
177	/**
178	* Filters the message to display above the login form.
179	*
180	* @param string $message Login message text.
181	*
182	* @since 2.1.0
183	*/
184	$message = apply_filters( 'login_message', $message );
185	if ( ! empty( $message ) ) {
186	echo $message . "\n";
187	}
188
189	// In case a plugin uses $error rather than the $wp_errors object
190	if ( ! empty( $error ) ) {
191	$wp_error->add( 'error', $error );
192	unset( $error );
193	}
194
195	if ( $wp_error->get_error_code() ) {
196	$errors = '';
197	$messages = '';
198	foreach ( $wp_error->get_error_codes() as $code ) {
199	$severity = $wp_error->get_error_data( $code );
200	foreach ( $wp_error->get_error_messages( $code ) as $error_message ) {
201	if ( 'message' == $severity ) {
202	$messages .= ' ' . $error_message . "<br />\n";
203	} else {
204	$errors .= ' ' . $error_message . "<br />\n";
205	}
206	}
207	}
208	if ( ! empty( $errors ) ) {
209	/**
210	* Filters the error messages displayed above the login form.
211	*
212	* @param string $errors Login error message.
213	*
214	* @since 2.1.0
215	*
216	*/
217	echo '<div id="login_error">' . apply_filters( 'login_errors', $errors ) . "</div>\n";
218	}
219	if ( ! empty( $messages ) ) {
220	/**
221	* Filters instructional messages displayed above the login form.
222	*
223	* @param string $messages Login messages.
224	*
225	* @since 2.5.0
226	*
227	*/
228	echo '<p class="message">' . apply_filters( 'login_messages', $messages ) . "</p>\n";
229	}
230	}
231	}
232	}
233
234	if ( isset( $interim_login ) && 'success' === $interim_login ) {
235	login_header_otp( '', $message );
236
237	$modal_close_script = <<<END
238	<script>
239	jQuery(function ($) {
240	$('.wp-auth-check-close', window.parent.document).trigger('click');
241	});
242	</script>
243	END;
244
245	add_action(
246	'wp_print_footer_scripts',
247	function() use ( $modal_close_script ) {
248	echo $modal_close_script;
249	}
250	);
251	} else {
252	login_header_otp( '', '', $error );
253
254	if ( ! empty( $providers ) ) {
255	foreach ( $providers as $slug => $provider ) { ?>
256	<form method="post" class="wpdef-2fa-form" id="wpdef-2fa-form-<?php esc_attr_e( $slug ); ?>"
257	action="<?php
258	echo esc_url( add_query_arg( 'action', 'defender-verify-otp', site_url( 'wp-login.php', 'login_post' ) ) );
259	?>">
260
261	<?php $provider->authentication_form(); ?>
262
263	<input type="hidden" name="auth_method" value="<?php echo esc_attr( $slug ); ?>"/>
264	<input type="hidden" name="login_token" value="<?php echo esc_attr( $token ); ?>"/>
265	<input type="hidden" name="redirect_to" value="<?php echo esc_attr( $redirect_to ); ?>"/>
266	<input type="hidden" name="password" value="<?php echo esc_attr( $password ); ?>"/>
267	<?php
268	if ( isset( $_REQUEST['interim-login'] ) ) { ?>
269	<input type="hidden" name="interim-login" value="1" />
270	<?php
271	}
272	wp_nonce_field( 'verify_otp' ); ?>
273	</form>
274	<?php }
275	if ( (is_array($providers) \|\| $providers instanceof \Countable ? count( $providers ) : 0) > 1 ) { ?>
276	<div id="wrap-nav">
277	<p><?php _e('Having problems? Try another way to log in', 'wpdef' ); ?></p>
278	<ul id="nav">
279	<?php foreach ( $providers as $slug => $provider ) { ?>
280	<li class="wpdef-2fa-link" id="wpdef-2fa-link-<?php esc_attr_e( $slug ); ?>"
281	data-slug="<?php esc_attr_e( $slug ); ?>">
282
283	<?php echo $provider->get_login_label(); ?>
284
285	</li>
286	<?php } ?>
287	</ul>
288	<img class="def-ajaxloader" src="<?php echo defender_asset_url( '/assets/img/spinner.svg' ); ?>"/>
289	</div>
290	<?php } ?>
291	<p class="notification"></p>
292	<?php } ?>
293	<?php if ( $custom_graphic ) { ?>
294	<style type="text/css">
295	body.login div#login h1 a {
296	background-image: url("<?php echo $custom_graphic ?>");
297	}
298	</style>
299	<?php } ?>
300	<?php
301	$totp_script = <<<END
302	<script>
303	jQuery(function ($) {
304	function two_factor_providers( defaultSlug ) {
305	// Hide all forms and show the one default.
306	$('.wpdef-2fa-form').hide();
307	$('#wpdef-2fa-form-' + defaultSlug).show();
308	// Hide all links and show others except the default.
309	if ( $('.wpdef-2fa-link').length > 0 ) {
310	$('.wpdef-2fa-link').hide();
311	$('.wpdef-2fa-link:not(#wpdef-2fa-link-'+ defaultSlug +')').each(function(){
312	$(this).show();
313	});
314	}
315	}
316	var is_sent = false;
317	// Logic for FallbackEmail method.
318	function resend_code() {
319	// Work with the button 'Resen Code'.
320	var that = $('input[name="button_resend_code"]');
321	if (is_sent === false) {
322	is_sent = true;
323	}
324	let data = {
325	data: JSON.stringify({
326	'token': '{$token}'
327	})
328	};
329	$.ajax({
330	type: 'POST',
331	url: '{$action_fallback_email}',
332	data: data,
333	beforeSend: function () {
334	that.attr('disabled', 'disabled');
335	$('.def-ajaxloader').show();
336	},
337	success: function (data) {
338	that.removeAttr('disabled');
339	$('.def-ajaxloader').hide();
340	$('.notification').text(data.data.message);
341	is_sent = false;
342	}
343	})
344	}
345
346	$('.def-ajaxloader').hide();
347	// Hide all forms and show the one default.
348	var defaultSlug = '{$default_slug}';
349	two_factor_providers( defaultSlug );
350	// Work with links.
351	$('body').on('click', '.wpdef-2fa-link', function () {
352	$('#login_error').remove();
353	// Clear any previous notification.
354	$('.notification').empty();
355	var slug = $(this).data('slug');
356	two_factor_providers( slug );
357	// Switch to 'Fallback Email' method.
358	if ('fallback-email' === slug) {
359	resend_code();
360	}
361	});
362	// Resend code.
363	$('body').on('click', 'input[name="button_resend_code"]', function (e) {
364	e.preventDefault();
365	resend_code();
366	})
367	})
368	</script>
369	END;
370	add_action(
371	'wp_print_footer_scripts',
372	function() use ( $totp_script ) {
373	echo $totp_script;
374	}
375	);
376	?>
377	<?php
378	}
379	?>
380
381	<?php
382	if ( ! function_exists( 'login_footer' ) ) {
383	/**
384	* Outputs the footer for the login page.
385	*
386	* @param string $input_id Which input to auto-focus
387	*/
388	function login_footer( $input_id = '' ) {
389	global $interim_login;
390
391	// Don't allow interim logins to navigate away from the page.
392	if ( ! $interim_login ): ?>
393	<p id="backtoblog"><a href="<?php
394	echo esc_url( home_url( '/' ) ); ?>"><?php
395	/* translators: %s: site title */
396	printf( _x( '← Back to %s', 'site' ), get_bloginfo( 'title', 'display' ) );
397	?></a></p>
398	<?php
399	endif; ?>
400
401	</div>
402
403	<?php
404	if ( ! empty( $input_id ) ) : ?>
405	<script type="text/javascript">
406	try {
407	document.getElementById('<?php echo $input_id; ?>').focus();
408	} catch (e) {
409	}
410	if (typeof wpOnload == 'function') wpOnload();
411	</script>
412	<?php
413	endif; ?>
414
415	<?php
416	/**
417	* Fires in the login page footer.
418	*
419	* @since 3.1.0
420	*/
421	do_action( 'login_footer' ); ?>
422	<div class="clear"></div>
423	</body>
424	</html>
425	<?php
426	}
427	}
428	login_footer();
429	?>
430