← All changes | src/component/class-two-fa.php +38 -31 5.4.1 → 6.3.0 View file →

		@@ -74,9 +74,10 @@
74	74	* @return int
75	75	* @since 3.3.0
76	76	*/
77	77	public function get_attempt_limit(): int {
78		- return (int) apply_filters( 'wd_2fa_attempt_limit', self::ATTEMPT_LIMIT );
	78	+ $limit = apply_filters( 'wd_2fa_attempt_limit', self::ATTEMPT_LIMIT );
	79	+ return is_int( $limit ) ? $limit : (int) $limit;
79	80	}
80	81
81	82	/**
82	83	* Get the limit of time.
		@@ -83,9 +84,10 @@
83	84	*
84	85	* @return int
85	86	*/
86	87	public function get_time_limit() {
87		- return (int) apply_filters( 'wd_2fa_time_limit', self::TIME_LIMIT );
	88	+ $limit = apply_filters( 'wd_2fa_time_limit', self::TIME_LIMIT );
	89	+ return is_int( $limit ) ? $limit : (int) $limit;
88	90	}
89	91
90	92	/**
91	93	* Enable OTP for a user.
		@@ -163,19 +165,17 @@
163	165	if ( is_plugin_active_for_network( 'jetpack/jetpack.php' ) ) {
164	166	// Loop through all sites.
165	167	$is_conflict = $settings->is_conflict( 'jetpack/jetpack.php' );
166	168	if ( 0 === $is_conflict ) {
167		- // No data, init.
168		- global $wpdb;
169		- $blogs = $wpdb->get_col( // phpcs:ignore WordPress.DB.DirectDatabaseQuery
170		- "SELECT blog_id FROM `{$wpdb->base_prefix}blogs`"
171		- );
172		- foreach ( $blogs as $id ) {
173		- $options = get_blog_option( $id, 'jetpack_active_modules', array() );
174		- if ( array_search( 'sso', $options, true ) ) {
175		- $settings->mark_as_conflict( 'jetpack/jetpack.php' );
	169	+ $blog_ids = get_sites( array( 'fields' => 'ids' ) );
	170	+ if ( is_array( $blog_ids ) ) {
	171	+ foreach ( $blog_ids as $id ) {
	172	+ $options = get_blog_option( $id, 'jetpack_active_modules', array() );
	173	+ if ( array_search( 'sso', $options, true ) ) {
	174	+ $settings->mark_as_conflict( 'jetpack/jetpack.php' );
176	175
177		- return true;
	176	+ return true;
	177	+ }
178	178	}
179	179	}
180	180	} else {
181	181	// Get the data from cache.
		@@ -224,9 +224,9 @@
224	224	*
225	225	* @return string The URL to the graphic.
226	226	*/
227	227	public function get_custom_graphic_url( string $url = '' ): string {
228		- if ( empty( $url ) ) {
	228	+ if ( '' === $url ) {
229	229	// Nothing here, surely it will cause broken, fall back to default.
230	230	return defender_asset_url( '/assets/img/2factor-disabled.svg' );
231	231	} else {
232	232	// Image should be under wp-content/.., so we catch that part.
		@@ -312,9 +312,9 @@
312	312	*
313	313	* @return bool True if there is an intersection, false otherwise.
314	314	*/
315	315	public function is_intersected_arrays( array $current_user_roles, array $plugin_user_roles ): bool {
316		- return ! empty( array_intersect( $current_user_roles, $plugin_user_roles ) );
	316	+ return array() !== array_intersect( $current_user_roles, $plugin_user_roles );
317	317	}
318	318
319	319	/**
320	320	* Retrieves all 2FA providers.
		@@ -354,15 +354,15 @@
354	354	*
355	355	* @return array
356	356	*/
357	357	public function get_enabled_providers_for_user( $user = null ): array {
358		- if ( empty( $user ) || ! is_a( $user, 'WP_User' ) ) {
	358	+ if ( ! ( $user instanceof WP_User ) ) {
359	359	$user = wp_get_current_user();
360	360	}
361	361
362	362	$providers = $this->get_providers();
363	363	$enabled_providers = get_user_meta( $user->ID, self::ENABLED_PROVIDERS_USER_KEY, true );
364		- if ( empty( $enabled_providers ) ) {
	364	+ if ( ! is_array( $enabled_providers ) || array() === $enabled_providers ) {
365	365	$enabled_providers = array();
366	366	}
367	367	$enabled_providers = array_intersect( $enabled_providers, array_keys( $providers ) );
368	368
		@@ -384,9 +384,9 @@
384	384	*
385	385	* @return array An array of available 2FA providers.
386	386	*/
387	387	public function get_available_providers_for_user( $user = null ): array {
388		- if ( empty( $user ) || ! is_a( $user, 'WP_User' ) ) {
	388	+ if ( ! ( $user instanceof WP_User ) ) {
389	389	$user = wp_get_current_user();
390	390	}
391	391
392	392	$providers = $this->get_providers();
		@@ -409,15 +409,15 @@
409	409	*
410	410	* @return string|null
411	411	*/
412	412	public function get_default_provider_slug_for_user( $user_id = null ) {
413		- if ( empty( $user_id ) || ! is_numeric( $user_id ) ) {
	413	+ if ( is_null( $user_id ) || ! is_numeric( $user_id ) ) {
414	414	$user_id = get_current_user_id();
415	415	}
416	416
417	417	$available_providers = $this->get_available_providers_for_user( get_userdata( $user_id ) );
418	418	// If there's only one available provider, force that to be the primary.
419		- if ( empty( $available_providers ) ) {
	419	+ if ( array() === $available_providers ) {
420	420	return null;
421	421	} elseif ( 1 === count( $available_providers ) ) {
422	422	$provider_slug = key( $available_providers );
423	423	} else {
		@@ -454,16 +454,16 @@
454	454
455	455	/**
456	456	* Send emergency email to users.
457	457	*
458		- * @param string $login_token This will be generated randomly on frontend each time user refresh, an internal
	458	+ * @param string $login_token This will be generated randomly on frontend each time user refresh, an internal
459	459	* OTP.
460		- * @param string|int $user_id User ID to send email to.
	460	+ * @param int $user_id User ID to send email to.
461	461	*
462	462	* @return boolean|WP_Error
463	463	*/
464		- public function send_otp_to_email( string $login_token, $user_id ) {
465		- if ( empty( $user_id ) || ! is_int( $user_id ) ) {
	464	+ public function send_otp_to_email( string $login_token, int $user_id ) {
	465	+ if ( $user_id <= 0 ) {
466	466	return new WP_Error( Error_Code::INVALID, esc_html__( 'The user is invalid.', 'defender-security' ) );
467	467	}
468	468	$settings = new Two_Fa_Model();
469	469	$hashed_token = get_user_meta( $user_id, self::TOKEN_USER_KEY, true );
		@@ -546,14 +546,14 @@
546	546	* @return void
547	547	* @since 3.0.0
548	548	*/
549	549	public function remove_enabled_provider_for_user( string $provider, $user = null ): void {
550		- if ( empty( $user ) || ! is_a( $user, 'WP_User' ) ) {
	550	+ if ( ! ( $user instanceof WP_User ) ) {
551	551	$user = wp_get_current_user();
552	552	}
553	553
554	554	$enabled_providers = get_user_meta( $user->ID, self::ENABLED_PROVIDERS_USER_KEY, true );
555		- if ( empty( $enabled_providers ) || ! is_array( $enabled_providers ) ) {
	555	+ if ( ! is_array( $enabled_providers ) || array() === $enabled_providers ) {
556	556	return;
557	557	}
558	558
559	559	$pos = array_search( $provider, $enabled_providers, true );
		@@ -603,9 +603,9 @@
603	603	&& ! $skip_priority_lockout_checks
604	604	) {
605	605	$line = get_user_meta( $user_id, 'wd_2fa_attempt_' . $slug, true );
606	606	// Fresh start or there's a record.
607		- if ( empty( $line ) ) {
	607	+ if ( in_array( $line, array( false, '', array() ), true ) ) {
608	608	$count = $this->get_attempt_limit();
609	609	$start_time = time();
610	610	} else {
611	611	[ $count, $start_time ] = explode( '::', $line );
		@@ -689,9 +689,9 @@
689	689	* @throws SodiumException On failure.
690	690	*/
691	691	public function maybe_update( $user_id ) {
692	692	$old_key = get_user_meta( $user_id, Totp::TOTP_SECRET_KEY, true );
693		- if ( ! empty( $old_key ) && is_string( $old_key ) ) {
	693	+ if ( is_string( $old_key ) && '' !== $old_key ) {
694	694	// Is it a plaintext? It was before v3.3.1.
695	695	if ( TOTP::TOTP_LENGTH === mb_strlen( $old_key, '8bit' ) ) {
696	696	return $this->reencrypt_data( $user_id, $old_key );
697	697	}
		@@ -717,9 +717,10 @@
717	717	if ( false === apply_filters( 'wp_defender_2fa_user_enabled', true, $user->ID ) ) {
718	718	return false;
719	719	}
720	720
721		- return ! empty( array_intersect( $this->get_roles( $user ), $roles ) );
	721	+ $common_roles = array_intersect( $this->get_roles( $user ), $roles );
	722	+ return array() !== $common_roles;
722	723	}
723	724
724	725	/**
725	726	* Remove actions when rendering 2FA screen during login.
		@@ -787,11 +788,16 @@
787	788	public function admin_notices() {
788	789	$screen = get_current_screen();
789	790	$screen_id = is_multisite() ? 'users-network' : 'users';
790	791
791		- if ( $screen_id !== $screen->id || ! current_user_can( 'edit_users' ) ) {
	792	+ $cap = is_multisite() ? 'manage_network_options' : 'manage_options';
	793	+ if ( $screen_id !== $screen->id || ! current_user_can( $cap ) ) {
792	794	return;
793	795	}
	796	+ $nonce = defender_get_data_from_request( '_wpnonce', 'g' );
	797	+ if ( ! is_string( $nonce ) || false === wp_verify_nonce( $nonce, 'bulk-users' ) ) {
	798	+ return;
	799	+ }
794	800	$action = defender_get_data_from_request( 'action', 'g' );
795	801	$user_id = defender_get_data_from_request( 'user', 'g' );
796	802	if ( ! isset( $action, $user_id ) ) {
797	803	return;
		@@ -804,9 +810,9 @@
804	810	return;
805	811	}
806	812	// Maybe the value has already been cleared.
807	813	$default_provider = get_user_meta( $user_id, self::DEFAULT_PROVIDER_USER_KEY, true );
808		- if ( empty( $default_provider ) ) {
	814	+ if ( in_array( $default_provider, array( false, '', array() ), true ) ) {
809	815	return;
810	816	}
811	817	// Default and enabled 2fa providers are cleared for user.
812	818	update_user_meta( $user_id, self::DEFAULT_PROVIDER_USER_KEY, '' );
		@@ -835,9 +841,10 @@
835	841	* @return array
836	842	*/
837	843	public function display_user_actions( $actions, WP_User $user ) {
838	844	// Only for users that have one enabled 2fa method at least.
839		- if ( empty( get_user_meta( $user->ID, self::DEFAULT_PROVIDER_USER_KEY, true ) ) ) {
	845	+ $default_provider = get_user_meta( $user->ID, self::DEFAULT_PROVIDER_USER_KEY, true );
	846	+ if ( in_array( $default_provider, array( false, '', array() ), true ) ) {
840	847	return $actions;
841	848	}
842	849
843	850	$cap = is_multisite() ? 'manage_network_options' : 'manage_options';