← All changes | src/controller/class-password-protection.php +37 -39 5.4.0 → 6.3.0 View file →

		@@ -13,8 +13,9 @@
13	13	use Countable;
14	14	use WP_Defender\Event;
15	15	use Calotes\Component\Request;
16	16	use Calotes\Component\Response;
	17	+use WP_Defender\Integrations\Woocommerce;
17	18	use WP_Defender\Component\Config\Config_Hub_Helper;
18	19
19	20	/**
20	21	* Handles password protection.
		@@ -19,9 +20,8 @@
19	20	/**
20	21	* Handles password protection.
21	22	*/
22	23	class Password_Protection extends Event {
23		-
24	24	/**
25	25	* The model for handling the data.
26	26	*
27	27	* @var \WP_Defender\Model\Setting\Password_Protection
		@@ -49,9 +49,8 @@
49	49	$this->model = wd_di()->get( \WP_Defender\Model\Setting\Password_Protection::class );
50	50	$this->service = wd_di()->get( \WP_Defender\Component\Password_Protection::class );
51	51	$default_values = $this->model->get_default_values();
52	52	$this->default_msg = $default_values['message'];
53		- add_filter( 'wp_defender_advanced_tools_data', array( $this, 'script_data' ) );
54	53	$this->register_routes();
55	54	if ( $this->model->is_active() ) {
56	55	// Update site url on sub-site when MaskLogin is disabled.
57	56	if (
		@@ -59,11 +58,14 @@
59	58	&& ! wd_di()->get( \WP_Defender\Model\Setting\Mask_Login::class )->is_active()
60	59	) {
61	60	add_filter( 'network_site_url', array( $this, 'filter_site_url' ), 100, 2 );
62	61	}
63		- add_action( 'wp_authenticate_user', array( $this, 'handle_login_password' ), 100, 2 );
	62	+ add_filter( 'wp_authenticate_user', array( $this, 'handle_login_password' ), 100, 2 );
64	63	add_action( 'validate_password_reset', array( $this, 'handle_reset_check_password' ), 100, 2 );
65	64	add_action( 'user_profile_update_errors', array( $this, 'handle_profile_update_password' ), 1, 3 );
	65	+ if ( wd_di()->get( Woocommerce::class )->is_wc_login_context() ) {
	66	+ add_filter( 'woocommerce_reset_password_message', array( $this->service, 'add_woocommerce_error_message' ) );
	67	+ }
66	68	}
67	69	}
68	70
69	71	/**
		@@ -98,9 +100,9 @@
98	100	public function handle_login_password( $user, $password ) {
99	101	if ( is_wp_error( $user ) || ! $user instanceof WP_User ) {
100	102	return $user;
101	103	}
102		- if ( empty( $password ) ) {
	104	+ if ( ! is_string( $password ) || '' === trim( $password ) ) {
103	105	return new WP_Error(
104	106	'defender_invalid_password',
105	107	esc_html__( 'Invalid user data.', 'defender-security' )
106	108	);
		@@ -115,11 +117,11 @@
115	117	*
116	118	* @param WP_Error $errors Error object.
117	119	* @param WP_User|WP_Error $user WP_User object or WP_Error.
118	120	*
119		- * @return void|WP_Error
	121	+ * @return void
120	122	*/
121		- public function handle_reset_check_password( WP_Error $errors, $user ) {
	123	+ public function handle_reset_check_password( WP_Error $errors, $user ): void {
122	124	if ( is_wp_error( $user ) ) {
123	125	return;
124	126	}
125	127
		@@ -127,10 +129,12 @@
127	129	return;
128	130	}
129	131
130	132	// Check if display_pwned_password_warning cookie enabled then show warning message on reset password page.
131		- if ( isset( $_COOKIE['display_pwned_password_warning'] ) ) {
132		- $message = empty( $this->model->pwned_actions['force_change_message'] )
	133	+ if ( ! defender_get_data_from_request( 'wc_reset_password', 'p' ) && isset( $_COOKIE['display_pwned_password_warning'] ) ) {
	134	+ $message = ! isset( $this->model->pwned_actions['force_change_message'] )
	135	+ || ! is_string( $this->model->pwned_actions['force_change_message'] )
	136	+ || '' === trim( $this->model->pwned_actions['force_change_message'] )
133	137	? $this->default_msg
134	138	: $this->model->pwned_actions['force_change_message'];
135	139	$errors->add( 'defender_password_protection', $message );
136	140	// Remove the one time cookie notice once it's displayed.
		@@ -140,20 +144,20 @@
140	144	$login_password = $this->service->get_submitted_password();
141	145	if ( $login_password ) {
142	146	$is_pwned = $this->service->check_pwned_password( $login_password );
143	147	if ( is_wp_error( $is_pwned ) ) {
144		- return $errors;
	148	+ return;
145	149	}
146	150
147	151	if ( $is_pwned ) {
148		- $message = empty( $this->model->pwned_actions['force_change_message'] )
	152	+ $message = ! isset( $this->model->pwned_actions['force_change_message'] )
	153	+ || ! is_string( $this->model->pwned_actions['force_change_message'] )
	154	+ || '' === trim( $this->model->pwned_actions['force_change_message'] )
149	155	? $this->default_msg
150	156	: $this->model->pwned_actions['force_change_message'];
151	157	$errors->add( 'defender_password_protection', $message );
152	158	}
153	159	}
154		-
155		- return $errors;
156	160	}
157	161
158	162	/**
159	163	* Handle password update on new user registration and user profile update.
		@@ -161,11 +165,11 @@
161	165	* @param WP_Error $errors The errors object to add error messages to.
162	166	* @param bool $update Whether the profile is being updated.
163	167	* @param stdClass $user The user object being updated.
164	168	*
165		- * @return WP_Error The updated errors object.
	169	+ * @return void
166	170	*/
167		- public function handle_profile_update_password( WP_Error $errors, bool $update, stdClass $user ) {
	171	+ public function handle_profile_update_password( WP_Error $errors, bool $update, stdClass $user ): void {
168	172	if ( $errors->get_error_message( 'pass' ) ||
169	173	is_wp_error( $user ) ||
170	174	! isset( $user->user_pass )
171	175	) {
		@@ -180,20 +184,20 @@
180	184	$login_password = $this->service->get_submitted_password();
181	185	if ( $login_password ) {
182	186	$is_pwned = $this->service->check_pwned_password( $login_password );
183	187	if ( is_wp_error( $is_pwned ) ) {
184		- return $errors;
	188	+ return;
185	189	}
186	190
187	191	if ( $is_pwned ) {
188		- $message = empty( $this->model->pwned_actions['force_change_message'] )
	192	+ $message = ! isset( $this->model->pwned_actions['force_change_message'] )
	193	+ || ! is_string( $this->model->pwned_actions['force_change_message'] )
	194	+ || '' === trim( $this->model->pwned_actions['force_change_message'] )
189	195	? $this->default_msg
190	196	: $this->model->pwned_actions['force_change_message'];
191	197	$errors->add( 'defender_password_protection', $message );
192	198	}
193	199	}
194		-
195		- return $errors;
196	200	}
197	201
198	202	/**
199	203	* Get model.
		@@ -208,21 +212,8 @@
208	212	return new \WP_Defender\Model\Setting\Password_Protection();
209	213	}
210	214
211	215	/**
212		- * Provide data to the frontend via localized script.
213		- *
214		- * @param array $data Data collection is ready to passed.
215		- *
216		- * @return array Modified data array with added this controller data.
217		- */
218		- public function script_data( array $data ): array {
219		- $data['password_protection'] = $this->data_frontend();
220		-
221		- return $data;
222		- }
223		-
224		- /**
225	216	* Save settings.
226	217	*
227	218	* @param Request $request The request object containing new settings data.
228	219	*
		@@ -242,9 +233,11 @@
242	233
243	234	$response = array(
244	235	'auto_close' => true,
245	236	);
246		- if ( $this->model->enabled && empty( $this->model->user_roles ) ) {
	237	+ if ( $this->model->enabled && (
	238	+ ! isset( $this->model->user_roles ) || ! is_array( $this->model->user_roles ) || array() === $this->model->user_roles
	239	+ ) ) {
247	240	// we need to control this message in front.
248	241	$response['warning'] = sprintf(
249	242	/* translators: 1. Open tag. 2. Close tag. */
250	243	esc_html__( 'You need to check at least one of the %1$sPwned checks preferences below%2$s and save your settings to enable Password Protection.', 'defender-security' ),
		@@ -257,9 +250,9 @@
257	250
258	251	if ( $this->maybe_track() ) {
259	252	$prev_data = $this->get_model()->get_old_settings();
260	253
261		- if ( ! empty( $prev_data ) ) {
	254	+ if ( array() !== $prev_data ) {
262	255	if ( $this->model->enabled && ! $prev_data['enabled'] ) {
263	256	$need_track = true;
264	257	$event = 'def_feature_activated';
265	258	} elseif ( ! $this->model->enabled && $prev_data['enabled'] ) {
		@@ -351,9 +344,9 @@
351	344	*
352	345	* @param array $data Data to be imported into the model.
353	346	*/
354	347	public function import_data( array $data ) {
355		- if ( ! empty( $data ) ) {
	348	+ if ( array() !== $data ) {
356	349	// Upgrade for old versions.
357	350	$data = $this->adapt_data( $data );
358	351	$model = $this->get_model();
359	352	$model->import( $data );
		@@ -383,22 +376,27 @@
383	376	);
384	377	}
385	378
386	379	/**
387		- * Generates configuration strings based on the provided configuration and whether the product is a pro version.
	380	+ * Generates configuration strings based on the provided configuration.
388	381	*
389	382	* @param mixed $config The configuration data.
390		- * @param bool $is_pro Indicates if the product is a pro version.
391	383	*
392	384	* @return array Returns an array of configuration strings.
393	385	*/
394		- public function config_strings( $config, bool $is_pro ): array {
395		- if ( empty( $config['enabled'] ) || empty( $config['user_roles'] ) ) {
	386	+ public function config_strings( $config ): array {
	387	+ $is_enabled = isset( $config['enabled'] ) ? (bool) $config['enabled'] : false;
	388	+ if (
	389	+ ! $is_enabled ||
	390	+ ! isset( $config['user_roles'] ) ||
	391	+ ! is_array( $config['user_roles'] ) ||
	392	+ array() === $config['user_roles']
	393	+ ) {
396	394	return array( esc_html__( 'Inactive', 'defender-security' ) );
397	395	}
398	396
399	397	return array(
400		- $config['enabled'] && ( is_array( $config['user_roles'] ) || $config['user_roles'] instanceof Countable ? count( $config['user_roles'] ) : 0 ) > 0
	398	+ $is_enabled && ( is_array( $config['user_roles'] ) || $config['user_roles'] instanceof Countable ? count( $config['user_roles'] ) : 0 ) > 0
401	399	? esc_html__( 'Active', 'defender-security' )
402	400	: esc_html__( 'Inactive', 'defender-security' ),
403	401	);
404	402	}