defender-security / src / controller / class-strong-password.php

class-strong-password.php in Defender Security – Malware Scanner, Login Security & Firewall 5.3.1, at src/controller/class-strong-password.php

228 lines 6.0 KB

Raw Download Zip

1	<?php
2	/**
3	* Handle strong password module.
4	*
5	* @package WP_Defender\Controller
6	*/
7
8	namespace WP_Defender\Controller;
9
10	use WP_Defender\Event;
11	use Calotes\Component\Request;
12	use Calotes\Component\Response;
13	use WP_Defender\Component\Config\Config_Hub_Helper;
14	use WP_Defender\Component\Strong_Password as Service;
15	use WP_Defender\Model\Setting\Strong_Password as Settings;
16
17	/**
18	* Handle strong password module.
19	*/
20	class Strong_Password extends Event {
21
22	/**
23	* The model for the strong password module.
24	*
25	* @var Settings\|null
26	*/
27	protected ?Settings $model = null;
28
29	/**
30	* The service for the strong password module.
31	*
32	* @var Service\|null
33	*/
34	protected ?Service $service = null;
35
36	/**
37	* Helper instance for reuse methods from pwned password protection.
38	*
39	* @var Password_Protection\|null
40	*/
41	private ?Password_Protection $helper;
42
43	/**
44	* Initializes the model and service, registers routes, and sets up scheduled events if the model is active.
45	*/
46	public function __construct() {
47	$this->model = wd_di()->get( Settings::class );
48	$this->service = wd_di()->get( Service::class );
49	$this->helper = wd_di()->get( Password_Protection::class );
50	add_filter( 'wp_defender_advanced_tools_data', array( $this, 'script_data' ) );
51	$this->register_routes();
52	if ( $this->model->is_active() ) {
53	// Update site url on sub-site when MaskLogin is disabled.
54	if (
55	is_multisite() && ! is_main_site()
56	&& ! wd_di()->get( \WP_Defender\Model\Setting\Mask_Login::class )->is_active()
57	) {
58	add_filter( 'network_site_url', array( $this->helper, 'filter_site_url' ), 100, 2 );
59	}
60	if ( is_admin() ) {
61	add_action( 'admin_enqueue_scripts', array( $this->service, 'scripts' ) );
62	add_action( 'user_profile_update_errors', array( $this->service, 'on_profile_update' ), 100, 3 );
63	}
64	add_action( 'login_enqueue_scripts', array( $this->service, 'scripts' ) );
65	add_action( 'validate_password_reset', array( $this->service, 'on_password_reset' ), 100, 2 );
66	add_action( 'wp_authenticate_user', array( $this->service, 'during_authentication' ), 100, 2 );
67	add_filter( 'random_password', array( $this->service, 'generate_password' ), 10, 2 );
68	}
69	}
70
71	/**
72	* Provide data to the frontend via localized script.
73	*
74	* @param array $data Data collection is ready to passed.
75	*
76	* @return array Modified data array with added this controller data.
77	*/
78	public function script_data( array $data ): array {
79	$data['strong_password'] = $this->data_frontend();
80
81	return $data;
82	}
83
84	/**
85	* All the variables that we will show on frontend, both in the main page, or dashboard widget.
86	*
87	* @return array
88	*/
89	public function data_frontend(): array {
90	return array_merge(
91	array(
92	'is_active' => $this->model->is_active(),
93	'model' => $this->model->export(),
94	'all_roles' => wp_list_pluck( get_editable_roles(), 'name' ),
95	),
96	$this->dump_routes_and_nonces()
97	);
98	}
99
100	/**
101	* Save settings.
102	*
103	* @param Request $request The request object containing new settings data.
104	*
105	* @return Response
106	* @defender_route
107	*/
108	public function save_settings( Request $request ): Response {
109	$model_data = $request->get_data_by_model( $this->model );
110	$this->model->import( $model_data );
111	if ( $this->model->validate() ) {
112	$this->model->save();
113	Config_Hub_Helper::set_clear_active_flag();
114
115	$response = array(
116	'auto_close' => true,
117	);
118	if ( $this->model->enabled && empty( $this->model->user_roles ) ) {
119	// we need to control this message in front.
120	$response['warning'] = sprintf(
121	/* translators: 1. Open tag. 2. Close tag. */
122	esc_html__( 'You need to check at least one of the %1$sStrong Passwords checks preferences below%2$s and save your settings to enable Strong Password Protection.', 'defender-security' ),
123	'<b>',
124	'</b>'
125	);
126
127	return new Response( true, array_merge( $response, $this->data_frontend() ) );
128	}
129
130	if ( $this->maybe_track() ) {
131	$prev_data = $this->model->get_old_settings();
132	if ( ! empty( $prev_data ) ) {
133	if ( $this->model->enabled && ! $prev_data['enabled'] ) {
134	$need_track = true;
135	$event = 'def_feature_activated';
136	} elseif ( ! $this->model->enabled && $prev_data['enabled'] ) {
137	$need_track = true;
138	$event = 'def_feature_deactivated';
139	} else {
140	$need_track = false;
141	}
142
143	if ( $need_track ) {
144	$data = array(
145	'Feature' => 'Strong Password',
146	'Triggered From' => 'Feature page',
147	);
148	$this->track_feature( $event, $data );
149	}
150	}
151	}
152
153	return new Response( true, array_merge( $response, $this->data_frontend() ) );
154	}
155
156	return new Response(
157	false,
158	array(
159	'message' => $this->model->get_formatted_errors(),
160	)
161	);
162	}
163
164	/**
165	* Export the data of this module, we will use this for export to HUB, create a preset etc.
166	*
167	* @return array
168	*/
169	public function to_array() {
170	return array();
171	}
172
173	/**
174	* Import the data of other source into this, it can be when HUB trigger the import, or user apply a preset.
175	*
176	* @param array $data Data from other source.
177	*
178	* @return null\|void
179	*/
180	public function import_data( array $data ) {
181	}
182
183	/**
184	* Remove all settings, configs generated in this container runtime.
185	*
186	* @return mixed
187	*/
188	public function remove_settings() {
189	}
190
191	/**
192	* Remove all data.
193	*/
194	public function remove_data() {
195	$this->delete_visited_meta();
196	}
197
198	/**
199	* Export strings.
200	*
201	* @return array
202	*/
203	public function export_strings() {
204	return array();
205	}
206
207	/**
208	* Provides data for the dashboard widget.
209	*
210	* @return array An array of dashboard widget data.
211	*/
212	public function dashboard_widget(): array {
213	return array( 'model' => $this->model->export() );
214	}
215
216	/**
217	* Delete the 'wd_password_rules_visited' meta key.
218	* We can remove it in the future releases and use delete_meta_key() of Breadcrumbs class.
219	*
220	* @return void
221	*/
222	private function delete_visited_meta() {
223	global $wpdb;
224
225	$wpdb->delete( $wpdb->usermeta, array( 'meta_key' => 'wd_password_rules_visited' ) ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery, WordPress.DB.SlowDBQuery
226	}
227	}
228