← All changes | src/controller/class-password-protection.php +32 -37 5.7.1 → 6.3.0 View file →

		@@ -49,9 +49,8 @@
49	49	$this->model = wd_di()->get( \WP_Defender\Model\Setting\Password_Protection::class );
50	50	$this->service = wd_di()->get( \WP_Defender\Component\Password_Protection::class );
51	51	$default_values = $this->model->get_default_values();
52	52	$this->default_msg = $default_values['message'];
53		- add_filter( 'wp_defender_advanced_tools_data', array( $this, 'script_data' ) );
54	53	$this->register_routes();
55	54	if ( $this->model->is_active() ) {
56	55	// Update site url on sub-site when MaskLogin is disabled.
57	56	if (
		@@ -59,9 +58,9 @@
59	58	&& ! wd_di()->get( \WP_Defender\Model\Setting\Mask_Login::class )->is_active()
60	59	) {
61	60	add_filter( 'network_site_url', array( $this, 'filter_site_url' ), 100, 2 );
62	61	}
63		- add_action( 'wp_authenticate_user', array( $this, 'handle_login_password' ), 100, 2 );
	62	+ add_filter( 'wp_authenticate_user', array( $this, 'handle_login_password' ), 100, 2 );
64	63	add_action( 'validate_password_reset', array( $this, 'handle_reset_check_password' ), 100, 2 );
65	64	add_action( 'user_profile_update_errors', array( $this, 'handle_profile_update_password' ), 1, 3 );
66	65	if ( wd_di()->get( Woocommerce::class )->is_wc_login_context() ) {
67	66	add_filter( 'woocommerce_reset_password_message', array( $this->service, 'add_woocommerce_error_message' ) );
		@@ -101,9 +100,9 @@
101	100	public function handle_login_password( $user, $password ) {
102	101	if ( is_wp_error( $user ) || ! $user instanceof WP_User ) {
103	102	return $user;
104	103	}
105		- if ( empty( $password ) ) {
	104	+ if ( ! is_string( $password ) || '' === trim( $password ) ) {
106	105	return new WP_Error(
107	106	'defender_invalid_password',
108	107	esc_html__( 'Invalid user data.', 'defender-security' )
109	108	);
		@@ -118,11 +117,11 @@
118	117	*
119	118	* @param WP_Error $errors Error object.
120	119	* @param WP_User|WP_Error $user WP_User object or WP_Error.
121	120	*
122		- * @return void|WP_Error
	121	+ * @return void
123	122	*/
124		- public function handle_reset_check_password( WP_Error $errors, $user ) {
	123	+ public function handle_reset_check_password( WP_Error $errors, $user ): void {
125	124	if ( is_wp_error( $user ) ) {
126	125	return;
127	126	}
128	127
		@@ -131,9 +130,11 @@
131	130	}
132	131
133	132	// Check if display_pwned_password_warning cookie enabled then show warning message on reset password page.
134	133	if ( ! defender_get_data_from_request( 'wc_reset_password', 'p' ) && isset( $_COOKIE['display_pwned_password_warning'] ) ) {
135		- $message = empty( $this->model->pwned_actions['force_change_message'] )
	134	+ $message = ! isset( $this->model->pwned_actions['force_change_message'] )
	135	+ || ! is_string( $this->model->pwned_actions['force_change_message'] )
	136	+ || '' === trim( $this->model->pwned_actions['force_change_message'] )
136	137	? $this->default_msg
137	138	: $this->model->pwned_actions['force_change_message'];
138	139	$errors->add( 'defender_password_protection', $message );
139	140	// Remove the one time cookie notice once it's displayed.
		@@ -143,20 +144,20 @@
143	144	$login_password = $this->service->get_submitted_password();
144	145	if ( $login_password ) {
145	146	$is_pwned = $this->service->check_pwned_password( $login_password );
146	147	if ( is_wp_error( $is_pwned ) ) {
147		- return $errors;
	148	+ return;
148	149	}
149	150
150	151	if ( $is_pwned ) {
151		- $message = empty( $this->model->pwned_actions['force_change_message'] )
	152	+ $message = ! isset( $this->model->pwned_actions['force_change_message'] )
	153	+ || ! is_string( $this->model->pwned_actions['force_change_message'] )
	154	+ || '' === trim( $this->model->pwned_actions['force_change_message'] )
152	155	? $this->default_msg
153	156	: $this->model->pwned_actions['force_change_message'];
154	157	$errors->add( 'defender_password_protection', $message );
155	158	}
156	159	}
157		-
158		- return $errors;
159	160	}
160	161
161	162	/**
162	163	* Handle password update on new user registration and user profile update.
		@@ -164,11 +165,11 @@
164	165	* @param WP_Error $errors The errors object to add error messages to.
165	166	* @param bool $update Whether the profile is being updated.
166	167	* @param stdClass $user The user object being updated.
167	168	*
168		- * @return WP_Error The updated errors object.
	169	+ * @return void
169	170	*/
170		- public function handle_profile_update_password( WP_Error $errors, bool $update, stdClass $user ) {
	171	+ public function handle_profile_update_password( WP_Error $errors, bool $update, stdClass $user ): void {
171	172	if ( $errors->get_error_message( 'pass' ) ||
172	173	is_wp_error( $user ) ||
173	174	! isset( $user->user_pass )
174	175	) {
		@@ -183,20 +184,20 @@
183	184	$login_password = $this->service->get_submitted_password();
184	185	if ( $login_password ) {
185	186	$is_pwned = $this->service->check_pwned_password( $login_password );
186	187	if ( is_wp_error( $is_pwned ) ) {
187		- return $errors;
	188	+ return;
188	189	}
189	190
190	191	if ( $is_pwned ) {
191		- $message = empty( $this->model->pwned_actions['force_change_message'] )
	192	+ $message = ! isset( $this->model->pwned_actions['force_change_message'] )
	193	+ || ! is_string( $this->model->pwned_actions['force_change_message'] )
	194	+ || '' === trim( $this->model->pwned_actions['force_change_message'] )
192	195	? $this->default_msg
193	196	: $this->model->pwned_actions['force_change_message'];
194	197	$errors->add( 'defender_password_protection', $message );
195	198	}
196	199	}
197		-
198		- return $errors;
199	200	}
200	201
201	202	/**
202	203	* Get model.
		@@ -211,21 +212,8 @@
211	212	return new \WP_Defender\Model\Setting\Password_Protection();
212	213	}
213	214
214	215	/**
215		- * Provide data to the frontend via localized script.
216		- *
217		- * @param array $data Data collection is ready to passed.
218		- *
219		- * @return array Modified data array with added this controller data.
220		- */
221		- public function script_data( array $data ): array {
222		- $data['password_protection'] = $this->data_frontend();
223		-
224		- return $data;
225		- }
226		-
227		- /**
228	216	* Save settings.
229	217	*
230	218	* @param Request $request The request object containing new settings data.
231	219	*
		@@ -245,9 +233,11 @@
245	233
246	234	$response = array(
247	235	'auto_close' => true,
248	236	);
249		- if ( $this->model->enabled && empty( $this->model->user_roles ) ) {
	237	+ if ( $this->model->enabled && (
	238	+ ! isset( $this->model->user_roles ) || ! is_array( $this->model->user_roles ) || array() === $this->model->user_roles
	239	+ ) ) {
250	240	// we need to control this message in front.
251	241	$response['warning'] = sprintf(
252	242	/* translators: 1. Open tag. 2. Close tag. */
253	243	esc_html__( 'You need to check at least one of the %1$sPwned checks preferences below%2$s and save your settings to enable Password Protection.', 'defender-security' ),
		@@ -260,9 +250,9 @@
260	250
261	251	if ( $this->maybe_track() ) {
262	252	$prev_data = $this->get_model()->get_old_settings();
263	253
264		- if ( ! empty( $prev_data ) ) {
	254	+ if ( array() !== $prev_data ) {
265	255	if ( $this->model->enabled && ! $prev_data['enabled'] ) {
266	256	$need_track = true;
267	257	$event = 'def_feature_activated';
268	258	} elseif ( ! $this->model->enabled && $prev_data['enabled'] ) {
		@@ -354,9 +344,9 @@
354	344	*
355	345	* @param array $data Data to be imported into the model.
356	346	*/
357	347	public function import_data( array $data ) {
358		- if ( ! empty( $data ) ) {
	348	+ if ( array() !== $data ) {
359	349	// Upgrade for old versions.
360	350	$data = $this->adapt_data( $data );
361	351	$model = $this->get_model();
362	352	$model->import( $data );
		@@ -386,22 +376,27 @@
386	376	);
387	377	}
388	378
389	379	/**
390		- * Generates configuration strings based on the provided configuration and whether the product is a pro version.
	380	+ * Generates configuration strings based on the provided configuration.
391	381	*
392	382	* @param mixed $config The configuration data.
393		- * @param bool $is_pro Indicates if the product is a pro version.
394	383	*
395	384	* @return array Returns an array of configuration strings.
396	385	*/
397		- public function config_strings( $config, bool $is_pro ): array {
398		- if ( empty( $config['enabled'] ) || empty( $config['user_roles'] ) ) {
	386	+ public function config_strings( $config ): array {
	387	+ $is_enabled = isset( $config['enabled'] ) ? (bool) $config['enabled'] : false;
	388	+ if (
	389	+ ! $is_enabled ||
	390	+ ! isset( $config['user_roles'] ) ||
	391	+ ! is_array( $config['user_roles'] ) ||
	392	+ array() === $config['user_roles']
	393	+ ) {
399	394	return array( esc_html__( 'Inactive', 'defender-security' ) );
400	395	}
401	396
402	397	return array(
403		- $config['enabled'] && ( is_array( $config['user_roles'] ) || $config['user_roles'] instanceof Countable ? count( $config['user_roles'] ) : 0 ) > 0
	398	+ $is_enabled && ( is_array( $config['user_roles'] ) || $config['user_roles'] instanceof Countable ? count( $config['user_roles'] ) : 0 ) > 0
404	399	? esc_html__( 'Active', 'defender-security' )
405	400	: esc_html__( 'Inactive', 'defender-security' ),
406	401	);
407	402	}