← All changes | src/component/class-two-fa.php +30 -21 5.7.0 → 6.3.0 View file →

		@@ -74,9 +74,10 @@
74	74	* @return int
75	75	* @since 3.3.0
76	76	*/
77	77	public function get_attempt_limit(): int {
78		- return (int) apply_filters( 'wd_2fa_attempt_limit', self::ATTEMPT_LIMIT );
	78	+ $limit = apply_filters( 'wd_2fa_attempt_limit', self::ATTEMPT_LIMIT );
	79	+ return is_int( $limit ) ? $limit : (int) $limit;
79	80	}
80	81
81	82	/**
82	83	* Get the limit of time.
		@@ -83,9 +84,10 @@
83	84	*
84	85	* @return int
85	86	*/
86	87	public function get_time_limit() {
87		- return (int) apply_filters( 'wd_2fa_time_limit', self::TIME_LIMIT );
	88	+ $limit = apply_filters( 'wd_2fa_time_limit', self::TIME_LIMIT );
	89	+ return is_int( $limit ) ? $limit : (int) $limit;
88	90	}
89	91
90	92	/**
91	93	* Enable OTP for a user.
		@@ -222,9 +224,9 @@
222	224	*
223	225	* @return string The URL to the graphic.
224	226	*/
225	227	public function get_custom_graphic_url( string $url = '' ): string {
226		- if ( empty( $url ) ) {
	228	+ if ( '' === $url ) {
227	229	// Nothing here, surely it will cause broken, fall back to default.
228	230	return defender_asset_url( '/assets/img/2factor-disabled.svg' );
229	231	} else {
230	232	// Image should be under wp-content/.., so we catch that part.
		@@ -310,9 +312,9 @@
310	312	*
311	313	* @return bool True if there is an intersection, false otherwise.
312	314	*/
313	315	public function is_intersected_arrays( array $current_user_roles, array $plugin_user_roles ): bool {
314		- return ! empty( array_intersect( $current_user_roles, $plugin_user_roles ) );
	316	+ return array() !== array_intersect( $current_user_roles, $plugin_user_roles );
315	317	}
316	318
317	319	/**
318	320	* Retrieves all 2FA providers.
		@@ -352,15 +354,15 @@
352	354	*
353	355	* @return array
354	356	*/
355	357	public function get_enabled_providers_for_user( $user = null ): array {
356		- if ( empty( $user ) || ! is_a( $user, 'WP_User' ) ) {
	358	+ if ( ! ( $user instanceof WP_User ) ) {
357	359	$user = wp_get_current_user();
358	360	}
359	361
360	362	$providers = $this->get_providers();
361	363	$enabled_providers = get_user_meta( $user->ID, self::ENABLED_PROVIDERS_USER_KEY, true );
362		- if ( empty( $enabled_providers ) ) {
	364	+ if ( ! is_array( $enabled_providers ) || array() === $enabled_providers ) {
363	365	$enabled_providers = array();
364	366	}
365	367	$enabled_providers = array_intersect( $enabled_providers, array_keys( $providers ) );
366	368
		@@ -382,9 +384,9 @@
382	384	*
383	385	* @return array An array of available 2FA providers.
384	386	*/
385	387	public function get_available_providers_for_user( $user = null ): array {
386		- if ( empty( $user ) || ! is_a( $user, 'WP_User' ) ) {
	388	+ if ( ! ( $user instanceof WP_User ) ) {
387	389	$user = wp_get_current_user();
388	390	}
389	391
390	392	$providers = $this->get_providers();
		@@ -407,15 +409,15 @@
407	409	*
408	410	* @return string|null
409	411	*/
410	412	public function get_default_provider_slug_for_user( $user_id = null ) {
411		- if ( empty( $user_id ) || ! is_numeric( $user_id ) ) {
	413	+ if ( is_null( $user_id ) || ! is_numeric( $user_id ) ) {
412	414	$user_id = get_current_user_id();
413	415	}
414	416
415	417	$available_providers = $this->get_available_providers_for_user( get_userdata( $user_id ) );
416	418	// If there's only one available provider, force that to be the primary.
417		- if ( empty( $available_providers ) ) {
	419	+ if ( array() === $available_providers ) {
418	420	return null;
419	421	} elseif ( 1 === count( $available_providers ) ) {
420	422	$provider_slug = key( $available_providers );
421	423	} else {
		@@ -452,16 +454,16 @@
452	454
453	455	/**
454	456	* Send emergency email to users.
455	457	*
456		- * @param string $login_token This will be generated randomly on frontend each time user refresh, an internal
	458	+ * @param string $login_token This will be generated randomly on frontend each time user refresh, an internal
457	459	* OTP.
458		- * @param string|int $user_id User ID to send email to.
	460	+ * @param int $user_id User ID to send email to.
459	461	*
460	462	* @return boolean|WP_Error
461	463	*/
462		- public function send_otp_to_email( string $login_token, $user_id ) {
463		- if ( empty( $user_id ) || ! is_int( $user_id ) ) {
	464	+ public function send_otp_to_email( string $login_token, int $user_id ) {
	465	+ if ( $user_id <= 0 ) {
464	466	return new WP_Error( Error_Code::INVALID, esc_html__( 'The user is invalid.', 'defender-security' ) );
465	467	}
466	468	$settings = new Two_Fa_Model();
467	469	$hashed_token = get_user_meta( $user_id, self::TOKEN_USER_KEY, true );
		@@ -544,14 +546,14 @@
544	546	* @return void
545	547	* @since 3.0.0
546	548	*/
547	549	public function remove_enabled_provider_for_user( string $provider, $user = null ): void {
548		- if ( empty( $user ) || ! is_a( $user, 'WP_User' ) ) {
	550	+ if ( ! ( $user instanceof WP_User ) ) {
549	551	$user = wp_get_current_user();
550	552	}
551	553
552	554	$enabled_providers = get_user_meta( $user->ID, self::ENABLED_PROVIDERS_USER_KEY, true );
553		- if ( empty( $enabled_providers ) || ! is_array( $enabled_providers ) ) {
	555	+ if ( ! is_array( $enabled_providers ) || array() === $enabled_providers ) {
554	556	return;
555	557	}
556	558
557	559	$pos = array_search( $provider, $enabled_providers, true );
		@@ -601,9 +603,9 @@
601	603	&& ! $skip_priority_lockout_checks
602	604	) {
603	605	$line = get_user_meta( $user_id, 'wd_2fa_attempt_' . $slug, true );
604	606	// Fresh start or there's a record.
605		- if ( empty( $line ) ) {
	607	+ if ( in_array( $line, array( false, '', array() ), true ) ) {
606	608	$count = $this->get_attempt_limit();
607	609	$start_time = time();
608	610	} else {
609	611	[ $count, $start_time ] = explode( '::', $line );
		@@ -687,9 +689,9 @@
687	689	* @throws SodiumException On failure.
688	690	*/
689	691	public function maybe_update( $user_id ) {
690	692	$old_key = get_user_meta( $user_id, Totp::TOTP_SECRET_KEY, true );
691		- if ( ! empty( $old_key ) && is_string( $old_key ) ) {
	693	+ if ( is_string( $old_key ) && '' !== $old_key ) {
692	694	// Is it a plaintext? It was before v3.3.1.
693	695	if ( TOTP::TOTP_LENGTH === mb_strlen( $old_key, '8bit' ) ) {
694	696	return $this->reencrypt_data( $user_id, $old_key );
695	697	}
		@@ -715,9 +717,10 @@
715	717	if ( false === apply_filters( 'wp_defender_2fa_user_enabled', true, $user->ID ) ) {
716	718	return false;
717	719	}
718	720
719		- return ! empty( array_intersect( $this->get_roles( $user ), $roles ) );
	721	+ $common_roles = array_intersect( $this->get_roles( $user ), $roles );
	722	+ return array() !== $common_roles;
720	723	}
721	724
722	725	/**
723	726	* Remove actions when rendering 2FA screen during login.
		@@ -785,11 +788,16 @@
785	788	public function admin_notices() {
786	789	$screen = get_current_screen();
787	790	$screen_id = is_multisite() ? 'users-network' : 'users';
788	791
789		- if ( $screen_id !== $screen->id || ! current_user_can( 'edit_users' ) ) {
	792	+ $cap = is_multisite() ? 'manage_network_options' : 'manage_options';
	793	+ if ( $screen_id !== $screen->id || ! current_user_can( $cap ) ) {
790	794	return;
791	795	}
	796	+ $nonce = defender_get_data_from_request( '_wpnonce', 'g' );
	797	+ if ( ! is_string( $nonce ) || false === wp_verify_nonce( $nonce, 'bulk-users' ) ) {
	798	+ return;
	799	+ }
792	800	$action = defender_get_data_from_request( 'action', 'g' );
793	801	$user_id = defender_get_data_from_request( 'user', 'g' );
794	802	if ( ! isset( $action, $user_id ) ) {
795	803	return;
		@@ -802,9 +810,9 @@
802	810	return;
803	811	}
804	812	// Maybe the value has already been cleared.
805	813	$default_provider = get_user_meta( $user_id, self::DEFAULT_PROVIDER_USER_KEY, true );
806		- if ( empty( $default_provider ) ) {
	814	+ if ( in_array( $default_provider, array( false, '', array() ), true ) ) {
807	815	return;
808	816	}
809	817	// Default and enabled 2fa providers are cleared for user.
810	818	update_user_meta( $user_id, self::DEFAULT_PROVIDER_USER_KEY, '' );
		@@ -833,9 +841,10 @@
833	841	* @return array
834	842	*/
835	843	public function display_user_actions( $actions, WP_User $user ) {
836	844	// Only for users that have one enabled 2fa method at least.
837		- if ( empty( get_user_meta( $user->ID, self::DEFAULT_PROVIDER_USER_KEY, true ) ) ) {
	845	+ $default_provider = get_user_meta( $user->ID, self::DEFAULT_PROVIDER_USER_KEY, true );
	846	+ if ( in_array( $default_provider, array( false, '', array() ), true ) ) {
838	847	return $actions;
839	848	}
840	849
841	850	$cap = is_multisite() ? 'manage_network_options' : 'manage_options';