give / src / DonorDashboards / Routes / LoginRoute.php

LoginRoute.php in GiveWP – Donation Plugin and Fundraising Platform 4.16.1, at src/DonorDashboards/Routes/LoginRoute.php

154 lines 5.6 KB

Raw Download Zip

1	<?php
2
3	namespace Give\DonorDashboards\Routes;
4
5	use Give\API\RestRoute;
6	use WP_REST_Request;
7	use WP_REST_Response;
8
9	/**
10	* @since 2.10.0
11	*/
12	class LoginRoute implements RestRoute
13	{
14
15	/** @var string */
16	protected $endpoint = 'donor-dashboard/login';
17
18	/**
19	* @inheritDoc
20	*/
21	public function registerRoute()
22	{
23	register_rest_route(
24	'give-api/v2',
25	$this->endpoint,
26	[
27	[
28	'methods' => 'POST',
29	'callback' => [$this, 'handleRequest'],
30	'permission_callback' => '__return_true',
31	],
32	'args' => [
33	'login' => [
34	'type' => 'string',
35	'required' => true,
36	'sanitize_callback' => 'sanitize_text_field',
37	],
38	'password' => [
39	'type' => 'string',
40	'required' => true,
41	'sanitize_callback' => 'sanitize_text_field',
42	],
43	],
44	]
45	);
46	}
47
48	/**
49	* Handles login request.
50	*
51	* Authentication is delegated to wp_signon() so that the request runs
52	* through WordPress's `authenticate` filter chain. This lets brute-force
53	* protection plugins (Wordfence, Login LockDown, Jetpack Protect, Solid
54	* Security, etc.) intercept and block attempts, and ensures the core
55	* `wp_login_failed` action fires on failure so plugins that hook it (Limit
56	* Login Attempts, etc.) can count the attempt. Core authentication failures
57	* (wrong password, unknown username/email) return a single generic response
58	* so the endpoint cannot be used to enumerate valid accounts. A lockout from
59	* a protection plugin is surfaced as a 429 with that plugin's message so a
60	* rate-limited user understands why the login was refused.
61	*
62	* @since 4.15.5 Route through wp_signon() and return a generic failure
63	* response to prevent brute-force-protection bypass (CWE-307)
64	* and user enumeration (CWE-204); surface lockout messages as 429.
65	* @since 2.10.0
66	*
67	* @param WP_REST_Request $request
68	*
69	* @return WP_REST_Response
70	*/
71	public function handleRequest(WP_REST_Request $request)
72	{
73	$login = $request->get_param('login');
74	$password = $request->get_param('password');
75
76	// wp_signon() runs the `authenticate` filter chain (so lockout plugins
77	// can intercept and block), fires `wp_login_failed` on failure, and sets
78	// the auth cookie on success.
79	$user = wp_signon(
80	[
81	'user_login' => $login,
82	'user_password' => $password,
83	'remember' => false,
84	]
85	);
86
87	if (is_wp_error($user)) {
88	// Core authentication errors (wrong password, unknown username/email)
89	// are collapsed into a single generic message so the endpoint cannot
90	// be used to enumerate accounts. Any other error code originates from
91	// a brute-force protection plugin (lockout) — surface its message so
92	// a locked-out user understands why the login was refused.
93	$coreAuthErrorCodes = [
94	'incorrect_password',
95	'invalid_username',
96	'invalid_email',
97	'empty_username',
98	'empty_password',
99	];
100
101	$isLockout = ! in_array($user->get_error_code(), $coreAuthErrorCodes, true);
102
103	// Note: the logical result is returned in the body `status` field and
104	// the HTTP status is left at 200, matching the endpoint's original
105	// contract. The Donor Dashboard front-end reads the result from the
106	// body; returning a non-2xx HTTP status would make its Axios request
107	// reject and leave the form stuck in a loading state.
108	if ($isLockout) {
109	$lockoutMessage = wp_strip_all_tags($user->get_error_message());
110
111	return new WP_REST_Response(
112	[
113	'status' => 429,
114	'response' => 'too_many_attempts',
115	'body_response' => [
116	'message' => '' !== $lockoutMessage
117	? $lockoutMessage
118	: __('Too many failed login attempts. Please try again later.', 'give'),
119	],
120	]
121	);
122	}
123
124	return new WP_REST_Response(
125	[
126	'status' => 401,
127	'response' => 'login_failed',
128	'body_response' => [
129	'message' => __('The provided credentials are invalid.', 'give'),
130	],
131	]
132	);
133	}
134
135	// wp_signon() sets the auth cookie and fires `wp_login`, but does not set
136	// the current user for the active request. Set it so the rest of this
137	// request is authenticated, then fire only GiveWP's own hook so existing
138	// integrations keep working, without duplicating the cookie or `wp_login`.
139	wp_set_current_user($user->ID, $user->user_login);
140	do_action('give_log_user_in', $user->ID, $user->user_login, $password);
141
142	return new WP_REST_Response(
143	[
144	'status' => 200,
145	'response' => 'login_successful',
146	'body_response' => [
147	'login' => $user->user_login,
148	'id' => $user->ID,
149	],
150	]
151	);
152	}
153	}
154