← All changes | src/component/class-strong-password.php +63 -34 5.7.2 → 6.3.0 View file →

		@@ -99,12 +99,17 @@
99	99	return $user;
100	100	}
101	101
102	102	// Check if the user's role requires strong password enforcement.
103		- if ( ! $this->should_enforce_for_user( $user ) ) {
	103	+ if ( ! $this->should_enforce_for_user( $user, $this->model ) ) {
104	104	return $user;
105	105	}
106	106
	107	+ // Skip enforcement on WooCommerce requests — dedicated Woo filters handle them based on settings.
	108	+ if ( $this->is_woo_request() ) {
	109	+ return $user;
	110	+ }
	111	+
107	112	// Validate the strength of the provided password.
108	113	if ( $this->is_weak_password( $password ) ) {
109	114	$this->helper->trigger_redirect( $user, self::CODE, self::COOKIE_KEY );
110	115	exit;
		@@ -179,13 +184,13 @@
179	184	} else {
180	185	$user_obj = null;
181	186	}
182	187	// Prevent strong password enforcement for exempt users.
183		- if ( isset( $user_obj ) && ! $this->should_enforce_for_user( $user_obj ) ) {
	188	+ if ( isset( $user_obj ) && ! $this->should_enforce_for_user( $user_obj, $this->model ) ) {
184	189	return;
185	190	}
186	191	global $user;
187		- if ( isset( $user ) && ! $this->should_enforce_for_user( $user ) ) {
	192	+ if ( isset( $user ) && ! $this->should_enforce_for_user( $user, $this->model ) ) {
188	193	return;
189	194	}
190	195	// Collect all locations.
191	196	$pages = array( 'profile.php', 'user-new.php', 'user-edit.php', 'wp-login.php' );
		@@ -209,10 +214,10 @@
209	214	wp_localize_script(
210	215	'wd-strong-password',
211	216	'wpdef_pws_strings',
212	217	array(
213		- 'message' => esc_html__( 'Hint: Your password must follow the guidelines below.', 'defender-security' ),
214		- 'requirements' => array(
	218	+ 'message' => esc_html__( 'Hint: Your password must follow the guidelines below.', 'defender-security' ),
	219	+ 'requirements' => array(
215	220	'length' => esc_html__( 'At least 12 characters', 'defender-security' ),
216	221	'case' => esc_html__( 'Uppercase and lowercase letters', 'defender-security' ),
217	222	'symbol' => esc_html__( 'At least one symbol', 'defender-security' ),
218	223	'number' => esc_html__( 'At least one number', 'defender-security' ),
		@@ -217,8 +222,11 @@
217	222	'symbol' => esc_html__( 'At least one symbol', 'defender-security' ),
218	223	'number' => esc_html__( 'At least one number', 'defender-security' ),
219	224	'zxcvbn' => esc_html__( 'Avoid common words or sequences of letters/numbers', 'defender-security' ),
220	225	),
	226	+ 'woo_locations' => isset( $this->model->forms['woocommerce'] ) && is_array( $this->model->forms['woocommerce'] )
	227	+ ? $this->model->forms['woocommerce']
	228	+ : array(),
221	229	)
222	230	);
223	231	add_filter( 'password_hint', '__return_empty_string' );
224	232	}
		@@ -241,9 +249,9 @@
241	249	return;
242	250	}
243	251
244	252	// When updating the profile check if user's role preference is enabled.
245		- if ( ! $this->should_enforce_for_user( $user ) ) {
	253	+ if ( ! $this->should_enforce_for_user( $user, $this->model ) ) {
246	254	return;
247	255	}
248	256
249	257	$login_password = $this->helper->get_submitted_password();
		@@ -264,12 +272,17 @@
264	272	if ( null === $user ) {
265	273	return;
266	274	}
267	275
268		- if ( ! $this->should_enforce_for_user( $user ) ) {
	276	+ if ( ! $this->should_enforce_for_user( $user, $this->model ) ) {
269	277	return;
270	278	}
271	279
	280	+ // WooCommerce also fires this core hook — gate on the lost-password form setting.
	281	+ if ( $this->is_woo_request() && ! $this->is_woo_form_enabled( Woocommerce::WOO_LOST_PASSWORD_FORM ) ) {
	282	+ return;
	283	+ }
	284	+
272	285	// Check if display_strong_password_warning cookie enabled then show warning message on reset password page.
273	286	$cookie_value = isset( $_COOKIE[ self::COOKIE_KEY ] ) ? sanitize_text_field( wp_unslash( $_COOKIE[ self::COOKIE_KEY ] ) ) : '';
274	287
275	288	// If the cookie is set, show the warning message.
		@@ -296,14 +309,14 @@
296	309	/**
297	310	* Generate a strong password with a mix of character types.
298	311	*
299	312	* @param string $password The password to be generated.
300		- * @param int $length The length of the password to be generated (12 or 24).
	313	+ * @param int $length The length of the password to be generated (12).
301	314	*
302	315	* @return string Strong password.
303	316	*/
304	317	public function generate_password( $password, $length ) {
305		- if ( ! in_array( $length, array( 12, 24 ), true ) ) {
	318	+ if ( 12 !== $length ) {
306	319	return $password;
307	320	}
308	321
309	322	$upper = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ';
		@@ -334,8 +347,12 @@
334	347	* @param string $wc_message WooCommerce default error message.
335	348	* @return string WooCommerce error message.
336	349	*/
337	350	public function add_woocommerce_error_message( $wc_message ) {
	351	+ if ( ! isset( $this->model->forms['woocommerce'] ) ) {
	352	+ return $wc_message;
	353	+ }
	354	+
338	355	if ( isset( $_COOKIE[ self::COOKIE_KEY ] ) && function_exists( 'wc_print_notice' ) && ! $this->cookie_handled ) {
339	356	$message = $this->model->get_message();
340	357	wc_print_notice( $message, 'error' );
341	358	$this->helper->remove_cookie_notice( self::COOKIE_KEY );
		@@ -350,8 +367,12 @@
350	367	*
351	368	* @return WP_Error Modified error object.
352	369	*/
353	370	public function during_woo_registration( $errors ) {
	371	+ if ( ! isset( $this->model->forms['woocommerce'] ) || ! is_array( $this->model->forms['woocommerce'] ) || ! in_array( Woocommerce::WOO_REGISTER_FORM, $this->model->forms['woocommerce'], true ) ) {
	372	+ return $errors;
	373	+ }
	374	+
354	375	$password = $this->helper->get_submitted_password();
355	376
356	377	if (
357	378	'' !== $password &&
		@@ -374,12 +395,16 @@
374	395	if ( ! $user instanceof stdClass || ! isset( $user->user_pass ) ) {
375	396	return;
376	397	}
377	398
378		- if ( ! $this->should_enforce_for_user( $user ) ) {
	399	+ if ( ! $this->should_enforce_for_user( $user, $this->model ) ) {
379	400	return;
380	401	}
381	402
	403	+ if ( ! isset( $this->model->forms['woocommerce'] ) || ! is_array( $this->model->forms['woocommerce'] ) ) {
	404	+ return;
	405	+ }
	406	+
382	407	$password = $this->helper->get_submitted_password();
383	408
384	409	if (
385	410	'' !== $password &&
		@@ -403,8 +428,11 @@
403	428	if ( '' === $password ) {
404	429	return $validation_error;
405	430	}
406	431
	432	+ if ( $this->is_woo_request() && ! $this->is_woo_form_enabled( Woocommerce::WOO_LOGIN_FORM ) ) {
	433	+ return $validation_error;
	434	+ }
407	435	$user = get_user_by( 'login', $username );
408	436	if ( ! $user ) {
409	437	$user = get_user_by( 'email', $username );
410	438	}
		@@ -412,41 +440,42 @@
412	440	if ( ! $user ) {
413	441	return $validation_error;
414	442	}
415	443
416		- if ( ! $this->should_enforce_for_user( $user ) ) {
	444	+ if ( ! $this->should_enforce_for_user( $user, $this->model ) ) {
417	445	return $validation_error;
418	446	}
419	447
420		- return $this->during_core_authentication( $user, $password );
	448	+ if ( ! wp_check_password( $password, $user->user_pass, $user->ID ) ) {
	449	+ return $validation_error;
	450	+ }
	451	+
	452	+ if ( $this->is_weak_password( $password ) ) {
	453	+ $this->helper->trigger_redirect( $user, self::CODE, self::COOKIE_KEY );
	454	+ exit;
	455	+ }
	456	+
	457	+ return $validation_error;
421	458	}
422	459
423	460	/**
424		- * Modify the lost password URL.
	461	+ * Determine if current request is coming from WooCommerce flows.
	462	+ */
	463	+ private function is_woo_request(): bool {
	464	+ return $this->woo->is_activated() && $this->woo->is_wc_login_context();
	465	+ }
	466	+
	467	+ /**
	468	+ * Check whether a specific WooCommerce form is enabled in settings.
425	469	*
426		- * @param string $redirect The redirect URL.
427		- *
428		- * @return string Modified lost password URL.
	470	+ * @param string $form Form slug.
429	471	*/
430		- public function lostpassword_url( $redirect = '' ) {
431		- $args = array(
432		- 'action' => 'lostpassword',
433		- );
434		-
435		- if ( '' !== $redirect ) {
436		- $args['redirect_to'] = rawurlencode( $redirect );
	472	+ private function is_woo_form_enabled( string $form ): bool {
	473	+ if ( ! isset( $this->model->plugins['woocommerce'] ) || ! $this->model->plugins['woocommerce'] ) {
	474	+ return false;
437	475	}
438	476
439		- if ( is_multisite() ) {
440		- $blog_details = get_site();
441		- if ( null !== $blog_details ) {
442		- $wp_login_path = $blog_details->path . 'wp-login.php';
443		- } else {
444		- $wp_login_path = 'wp-login.php';
445		- }
446		- } else {
447		- $wp_login_path = 'wp-login.php';
448		- }
	477	+ $forms = $this->model->forms['woocommerce'] ?? array();
449	478
450		- return add_query_arg( $args, network_site_url( $wp_login_path, 'login' ) );
	479	+ return in_array( $form, $forms, true );
451	480	}
452	481	}