defender-security / src / component / security-tweaks / class-change-admin.php

class-change-admin.php in Defender Security – Malware Scanner, Login Security & Firewall 5.4.1, at src/component/security-tweaks/class-change-admin.php

232 lines 5.7 KB

Raw Download Zip

1	<?php
2	/**
3	* Security Tweaks Component for changing the default 'admin' username.
4	*
5	* @package WP_Defender\Component\Security_Tweaks
6	*/
7
8	namespace WP_Defender\Component\Security_Tweaks;
9
10	use WP_User;
11	use WP_Error;
12	use Calotes\Helper\HTTP;
13	use Calotes\Component\Response;
14
15	/**
16	* Handle the security tweak of changing the default 'admin' username to a user-defined one.
17	*/
18	class Change_Admin extends Abstract_Security_Tweaks {
19
20	/**
21	* Slug identifier for the component.
22	*
23	* @var string
24	*/
25	public string $slug = 'replace-admin-username';
26
27	/**
28	* Check whether the issue has been resolved or not.
29	*
30	* @return bool
31	*/
32	public function check(): bool {
33	return $this->is_resolved();
34	}
35
36	/**
37	* If the return is true or Response, we add it to resolve list. WP_Error if any error.
38	*
39	* @return bool\|WP_Error\|Response
40	*/
41	public function process() {
42	$username = HTTP::post( 'username' );
43	$is_valid = $this->validate( $username );
44
45	if ( is_wp_error( $is_valid ) ) {
46	return $is_valid;
47	}
48
49	return $this->update_username( $username );
50	}
51
52	/**
53	* This is for un-do stuff that has be done in @process.
54	*
55	* @return bool
56	*/
57	public function revert(): bool {
58	return true;
59	}
60
61	/**
62	* Shield up.
63	*
64	* @return bool
65	*/
66	public function shield_up(): bool {
67	return true;
68	}
69
70	/**
71	* Check whether the issue is resolved or not.
72	*
73	* @return bool
74	*/
75	private function is_resolved() {
76	return ! $this->get_user_with_admin_username();
77	}
78
79	/**
80	* Get user with admin username.
81	*
82	* @return WP_User\|false on failure
83	*/
84	private function get_user_with_admin_username() {
85	return get_user_by( 'login', 'admin' );
86	}
87
88	/**
89	* Validate username.
90	*
91	* @param string $username to validate.
92	*
93	* @return bool\|WP_Error on failure
94	*/
95	private function validate( $username ) {
96	if ( empty( $username ) ) {
97	return new WP_Error( 'defender_invalid_username', esc_html__( 'The username can\'t be empty!', 'defender-security' ) );
98	}
99
100	if ( 'admin' === strtolower( $username ) ) {
101	return new WP_Error(
102	'defender_invalid_username',
103	esc_html__( 'You can\'t use admin as a username again!', 'defender-security' )
104	);
105	}
106
107	if ( ! validate_username( $username ) ) {
108	return new WP_Error( 'defender_invalid_username', esc_html__( 'The username is invalid!', 'defender-security' ) );
109	}
110
111	if ( username_exists( $username ) ) {
112	return new WP_Error( 'defender_invalid_username', esc_html__( 'The username already exists!', 'defender-security' ) );
113	}
114
115	return true;
116	}
117
118	/**
119	* Updates the 'admin' username to a new username.
120	* Performs the update in the database and handles multisite admin updates if applicable.
121	*
122	* @param string $username The new username.
123	*
124	* @return bool\|WP_Error\|Response True on success, WP_Error on database error, Response on logout requirement.
125	*/
126	private function update_username( $username ) {
127	global $wpdb;
128	$user = $this->get_user_with_admin_username();
129
130	$ret = $wpdb->update( // phpcs:ignore WordPress.DB.DirectDatabaseQuery
131	$wpdb->users,
132	array( 'user_login' => trim( $username ) ),
133	array( 'ID' => $user->ID )
134	);
135	if ( ! $ret ) {
136	return new WP_Error( 'update_error', $wpdb->last_error );
137	}
138
139	if ( is_multisite() ) {
140	$site_admins = get_site_option( 'site_admins' );
141
142	if ( is_array( $site_admins ) ) {
143	$pos = array_search( 'admin', array_map( 'strtolower', $site_admins ), true );
144
145	if ( false !== $pos ) {
146	$site_admins[ $pos ] = $username;
147	update_site_option( 'site_admins', $site_admins );
148	}
149	}
150	}
151	clean_user_cache( $user );
152	// Log the user out only if it's the user with 'admin' username.
153	if ( get_current_user_id() !== $user->ID ) {
154	return true;
155	}
156	if ( defined( 'WP_DEFENDER_TESTING' ) && true === constant( 'WP_DEFENDER_TESTING' ) ) {
157	// Testing.
158	return true;
159	}
160	$interval = 5;
161	$redirect = $this->get_login_url();
162
163	return new Response(
164	true,
165	array(
166	'message' => sprintf(
167	/* translators: 1. Redirect link. 2. Line break. 3. Interval. */
168	esc_html__(
169	'Your admin name has changed. You will need to %1$s.%2$s This will auto reload after %3$s seconds.',
170	'defender-security'
171	),
172	'<a href="' . $redirect . '"><strong>' . esc_html__( 're-login', 'defender-security' ) . '</strong></a>',
173	'<br>',
174	'<span class="hardener-timer">' . $interval . '</span>'
175	),
176	'redirect' => $redirect,
177	'interval' => $interval,
178	)
179	);
180	}
181
182	/**
183	* Get the login url.
184	*
185	* @return string
186	*/
187	private function get_login_url(): string {
188	return wp_login_url( network_admin_url( 'admin.php?page=wdf-hardener' ) );
189	}
190
191	/**
192	* Retrieve the tweak's label.
193	*
194	* @return string
195	*/
196	public function get_label(): string {
197	return esc_html__( 'Change default admin user account', 'defender-security' );
198	}
199
200	/**
201	* Get the error reason.
202	*
203	* @return string
204	*/
205	public function get_error_reason(): string {
206	return esc_html__( 'You have a user account with the admin username.', 'defender-security' );
207	}
208
209	/**
210	* Return a summary data of this tweak.
211	*
212	* @return array
213	*/
214	public function to_array(): array {
215	return array(
216	'slug' => $this->slug,
217	'title' => $this->get_label(),
218	'errorReason' => $this->get_error_reason(),
219	'successReason' => esc_html__(
220	'You don\'t have a user account with the default admin username, great!',
221	'defender-security'
222	),
223	'misc' => array( 'host' => defender_get_hostname() ),
224	'bulk_description' => esc_html__(
225	'Using the default admin username is widely considered bad practice and opens you up to the easitest form of entry to your website. We will create new admin username for you.',
226	'defender-security'
227	),
228	'bulk_title' => esc_html__( 'Admin User', 'defender-security' ),
229	);
230	}
231	}
232