defender-security / src / component / audit / class-password-audit.php

class-password-audit.php in Defender Security – Malware Scanner, Login Security & Firewall 5.8.1, at src/component/audit/class-password-audit.php

132 lines 3.3 KB

Raw Download Zip

1	<?php
2	/**
3	* Handles user password related audit events.
4	*
5	* @package WP_Defender\Component\Audit
6	*/
7
8	namespace WP_Defender\Component\Audit;
9
10	use WP_User;
11	use WP_Defender\Traits\User;
12	use WP_Defender\Model\Audit_Log;
13
14	/**
15	* Handles user password related audit events, distinguishing between self and admin scenarios.
16	*
17	* @since 5.8.0
18	*/
19	class Password_Audit extends Audit_Event {
20	use User;
21
22	public const ACTION_PASSWORD_CHANGED = 'password-changed';
23	public const CONTEXT_PASSWORD = 'password';
24
25	/**
26	* Returns the hooks to monitor password events.
27	*
28	* @return array
29	*/
30	public function get_hooks(): array {
31	return array(
32	'password_reset' => array(
33	'args' => array( 'user', 'new_pass' ),
34	'event_type' => Audit_Log::EVENT_TYPE_USER,
35	'context' => self::CONTEXT_PASSWORD,
36	'action_type' => self::ACTION_PASSWORD_CHANGED,
37	'callback' => array( $this, 'password_reset' ),
38	),
39	'profile_update' => array(
40	'args' => array( 'user_id', 'old_user_data', 'userdata' ),
41	'event_type' => Audit_Log::EVENT_TYPE_USER,
42	'context' => self::CONTEXT_PASSWORD,
43	'action_type' => self::ACTION_PASSWORD_CHANGED,
44	'callback' => array( $this, 'profile_update' ),
45	),
46	);
47	}
48
49	/**
50	* Callback for logging password changes via profile update.
51	*
52	* @param string $hook_name The name of the hook.
53	* @param array $params The parameters passed to the hook.
54	*
55	* @return bool\|array
56	*/
57	public function profile_update( string $hook_name, array $params ): bool\|array {
58	if ( User_Audit::is_create_user_action() ) {
59	return false;
60	}
61
62	$user_id = $params['user_id'];
63	$post = defender_get_data_from_request( null, 'p' );
64	// Password is not changed.
65	if ( ! isset( $post['pass1'] ) \|\| '' === $post['pass1'] ) {
66	return false;
67	}
68
69	$user = get_user_by( 'id', $user_id );
70	if ( ! $user ) {
71	return false;
72	}
73
74	return $this->build_log( $user );
75	}
76
77	/**
78	* Helper to build the log message.
79	*
80	* @param WP_User $user The user object.
81	*
82	* @return array
83	*/
84	public function build_log( WP_User $user ): array {
85	$username = $user->user_login;
86	$blog_name = is_multisite() ? '[' . get_bloginfo( 'name' ) . ']' : '';
87	$current_user = get_current_user_id();
88	// User changed own password.
89	if ( 0 === $current_user \|\| $current_user === $user->ID ) {
90	return array(
91	sprintf(
92	/* translators: 1: Blog name, 2: Username */
93	esc_html__( '%1$s %2$s changed their password', 'defender-security' ),
94	$blog_name,
95	$username
96	),
97	self::CONTEXT_PASSWORD,
98	);
99	}
100	// Admin changed another user's password.
101	$current_display = $this->get_user_display( $current_user );
102
103	return array(
104	sprintf(
105	/* translators: 1: Blog name, 2: Admin username, 3: Affected username */
106	esc_html__( '%1$s %2$s changed the password for user: %3$s', 'defender-security' ),
107	$blog_name,
108	$current_display,
109	$username
110	),
111	self::CONTEXT_PASSWORD,
112	);
113	}
114
115	/**
116	* Callback for logging password reset events( via reset link )
117	*
118	* @param string $hook_name The name of the hook.
119	* @param array $params The parameters passed to the hook.
120	*
121	* @return bool\|array
122	*/
123	public function password_reset( string $hook_name, array $params ): bool\|array {
124	$user = $params['user'];
125	if ( ! $user instanceof WP_User ) {
126	return false;
127	}
128
129	return $this->build_log( $user );
130	}
131	}
132