← All changes | src/controller/class-password-reset.php +16 -28 5.7.0 → 6.3.0 View file →

		@@ -51,9 +51,8 @@
51	51	$this->model = $this->get_model();
52	52	$this->service = wd_di()->get( \WP_Defender\Component\Password_Protection::class );
53	53	$default_values = $this->model->get_default_values();
54	54	$this->default_msg = $default_values['message'];
55		- add_filter( 'wp_defender_advanced_tools_data', array( $this, 'script_data' ) );
56	55	$this->register_routes();
57	56	if ( $this->model->is_active() ) {
58	57	// Update site url on sub-site when MaskLogin is disabled.
59	58	if (
		@@ -64,9 +63,9 @@
64	63	}
65	64	add_action( 'validate_password_reset', array( $this, 'handle_reset_check_password' ), 10, 2 );
66	65	add_action( 'profile_update', array( $this, 'handle_update_user' ), 10, 2 );
67	66	add_action( 'password_reset', array( $this, 'handle_password_reset' ), 10 );
68		- add_action( 'wp_authenticate_user', array( $this, 'handle_login_password' ), 999, 2 );
	67	+ add_filter( 'wp_authenticate_user', array( $this, 'handle_login_password' ), 999, 2 );
69	68	// No use 'user_profile_update_errors' because there aren't checks for password resetting for logged user in.
70	69	}
71	70	}
72	71
		@@ -114,9 +113,9 @@
114	113	public function handle_login_password( $user, $password ) {
115	114	if ( is_wp_error( $user ) || ! $user instanceof WP_User ) {
116	115	return $user;
117	116	}
118		- if ( empty( $password ) ) {
	117	+ if ( ! is_string( $password ) || '' === trim( $password ) ) {
119	118	return new WP_Error(
120	119	'defender_invalid_password',
121	120	esc_html__( 'Invalid user data.', 'defender-security' )
122	121	);
		@@ -131,11 +130,11 @@
131	130	*
132	131	* @param WP_Error $errors Error object.
133	132	* @param WP_Error|WP_User $user WP_User object or WP_Error.
134	133	*
135		- * @return null|WP_Error
	134	+ * @return void
136	135	*/
137		- public function handle_reset_check_password( WP_Error $errors, $user ) {
	136	+ public function handle_reset_check_password( WP_Error $errors, $user ): void {
138	137	if ( is_wp_error( $user ) ) {
139	138	return;
140	139	}
141	140
		@@ -144,21 +143,25 @@
144	143	}
145	144
146	145	// Check if display_reset_password_warning cookie enabled then show warning message on reset password page.
147	146	if ( isset( $_COOKIE['display_reset_password_warning'] ) ) {
148		- $message = empty( $this->model->message ) ? $this->default_msg : $this->model->message;
	147	+ $message = ! isset( $this->model->message ) || ! is_string( $this->model->message ) || '' === trim( $this->model->message )
	148	+ ? $this->default_msg
	149	+ : $this->model->message;
149	150	$errors->add( 'defender_password_reset', $message );
150	151	// Remove the one time cookie notice once it's displayed.
151	152	$this->service->remove_cookie_notice( 'display_reset_password_warning' );
152	153
153		- return $errors;
	154	+ return;
154	155	}
155	156
156	157	$login_password = $this->service->get_submitted_password();
	158	+ $user_id = isset( $user->ID ) ? $user->ID : 0;
	159	+ $user_id = is_int( $user_id ) ? $user_id : (int) $user_id;
157	160	if (
158		- ! empty( $user->ID )
159		- && ! empty( $login_password )
160		- && wp_check_password( $login_password, get_userdata( $user->ID )->user_pass, $user->ID )
	161	+ 0 < $user_id
	162	+ && is_string( $login_password ) && '' !== trim( $login_password )
	163	+ && wp_check_password( $login_password, get_userdata( $user_id )->user_pass, $user_id )
161	164	) {
162	165	$message = wp_kses(
163	166	esc_html__( 'This password has been used already. Please choose a different one.', 'defender-security' ),
164	167	array( 'strong' => array() )
		@@ -163,13 +166,9 @@
163	166	esc_html__( 'This password has been used already. Please choose a different one.', 'defender-security' ),
164	167	array( 'strong' => array() )
165	168	);
166	169	$errors->add( 'defender_password_reset', $message );
167		-
168		- return $errors;
169	170	}
170		-
171		- return $errors;
172	171	}
173	172
174	173	/**
175	174	* Update the time when a user resets their password.
		@@ -200,21 +199,8 @@
200	199	$this->service->handle_password_updated( $user );
201	200	}
202	201
203	202	/**
204		- * Provide data to the frontend via localized script.
205		- *
206		- * @param array $data Data collection is ready to passed.
207		- *
208		- * @return array Modified data array with added this controller data.
209		- */
210		- public function script_data( array $data ): array {
211		- $data['password_reset'] = $this->data_frontend();
212		-
213		- return $data;
214		- }
215		-
216		- /**
217	203	* Save settings.
218	204	*
219	205	* @param Request $request The request object containing new settings data.
220	206	*
		@@ -306,9 +292,11 @@
306	292	return array_merge(
307	293	array(
308	294	'model' => $model->export(),
309	295	'all_roles' => wp_list_pluck( get_editable_roles(), 'name' ),
310		- 'reset_last' => empty( $model->force_time ) ? '' : $this->format_date_time( $model->force_time ),
	296	+ 'reset_last' => ! isset( $model->force_time ) || ! is_int( $model->force_time ) || 0 >= $model->force_time
	297	+ ? ''
	298	+ : $this->format_date_time( $model->force_time ),
311	299	'default_message' => $this->default_msg,
312	300	),
313	301	$this->dump_routes_and_nonces()
314	302	);