jetpack / modules / protect / math-fallback.php

math-fallback.php in Jetpack – WP Security, Backup, Speed, & Growth 11.2, at modules/protect/math-fallback.php

179 lines 6.7 KB

Raw Download Zip

1	<?php // phpcs:ignore WordPress.Files.FileName.InvalidClassFileName
2
3	if ( ! class_exists( 'Jetpack_Protect_Math_Authenticate' ) ) {
4	/**
5	* The math captcha fallback if we can't talk to the Protect API
6	*/
7	class Jetpack_Protect_Math_Authenticate {
8
9	/**
10	* If the class is loaded.
11	*
12	* @var bool
13	*/
14	public static $loaded;
15
16	/**
17	* Class constructor.
18	*/
19	public function __construct() {
20
21	if ( self::$loaded ) {
22	return;
23	}
24
25	self::$loaded = 1;
26
27	add_action( 'login_form', array( $this, 'math_form' ) );
28
29	if ( isset( $_POST['jetpack_protect_process_math_form'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Missing -- No changes made, just queues the math authenticator hook.
30	add_action( 'init', array( $this, 'process_generate_math_page' ) );
31	}
32	}
33
34	/**
35	* The timeout window.
36	*/
37	private static function time_window() {
38	return ceil( time() / ( MINUTE_IN_SECONDS * 2 ) );
39	}
40
41	/**
42	* Verifies that a user answered the math problem correctly while logging in.
43	*
44	* @return bool Returns true if the math is correct
45	* @throws Error If insuffient $_POST variables are present.
46	* @throws Error Message if the math is wrong.
47	*/
48	public static function math_authenticate() {
49	if ( isset( $_COOKIE['jpp_math_pass'] ) ) {
50	$jetpack_protect = Jetpack_Protect_Module::instance();
51	$transient = $jetpack_protect->get_transient( 'jpp_math_pass_' . sanitize_key( $_COOKIE['jpp_math_pass'] ) );
52
53	if ( ! $transient \|\| $transient < 1 ) {
54	self::generate_math_page();
55	}
56	return true;
57	}
58
59	$ans = isset( $_POST['jetpack_protect_num'] ) ? (int) $_POST['jetpack_protect_num'] : ''; // phpcs:ignore WordPress.Security.NonceVerification.Missing -- answers are salted.
60	$correct_ans = isset( $_POST['jetpack_protect_answer'] ) ? sanitize_key( $_POST['jetpack_protect_answer'] ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Missing
61
62	$time_window = self::time_window();
63	$salt = get_site_option( 'jetpack_protect_key' ) . '\|' . get_site_option( 'admin_email' ) . '\|';
64	$salted_ans_1 = hash_hmac( 'sha1', $ans, $salt . $time_window );
65	$salted_ans_2 = hash_hmac( 'sha1', $ans, $salt . ( $time_window - 1 ) );
66
67	if ( ! $correct_ans \|\| ! $ans ) {
68	self::generate_math_page();
69	} elseif ( ! hash_equals( $salted_ans_1, $correct_ans ) && ! hash_equals( $salted_ans_2, $correct_ans ) ) {
70	wp_die(
71	wp_kses(
72	__(
73	'<strong>You failed to correctly answer the math problem.</strong> This is used to combat spam when the Protect API is unavailable. Please use your browser’s back button to return to the login form, press the "refresh" button to generate a new math problem, and try to log in again.',
74	'jetpack'
75	),
76	array( 'strong' => array() )
77	),
78	'',
79	array( 'response' => 401 )
80	);
81	} else {
82	return true;
83	}
84	}
85
86	/**
87	* Creates an interim page to collect answers to a math captcha
88	*
89	* @param string $error - the error message.
90	*/
91	public static function generate_math_page( $error = false ) {
92	ob_start();
93	?>
94	<h2><?php esc_html_e( 'Please solve this math problem to prove that you are not a bot. Once you solve it, you will need to log in again.', 'jetpack' ); ?></h2>
95	<?php if ( $error ) : ?>
96	<h3><?php esc_html_e( 'Your answer was incorrect, please try again.', 'jetpack' ); ?></h3>
97	<?php endif ?>
98
99	<form action="<?php echo esc_url( wp_login_url() ); ?>" method="post" accept-charset="utf-8">
100	<?php self::math_form(); ?>
101	<input type="hidden" name="jetpack_protect_process_math_form" value="1" id="jetpack_protect_process_math_form" />
102	<p><input type="submit" value="<?php esc_attr_e( 'Continue →', 'jetpack' ); ?>"></p>
103	</form>
104	<?php
105	$mathpage = ob_get_contents();
106	ob_end_clean();
107	wp_die(
108	$mathpage, // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- content is escaped.
109	'',
110	array( 'response' => 401 )
111	);
112	}
113
114	/**
115	* Generates the math page.
116	*/
117	public function process_generate_math_page() {
118	$ans = isset( $_POST['jetpack_protect_num'] ) ? (int) $_POST['jetpack_protect_num'] : ''; // phpcs:ignore WordPress.Security.NonceVerification.Missing -- answers are salted.
119	$correct_ans = isset( $_POST['jetpack_protect_answer'] ) ? sanitize_key( $_POST['jetpack_protect_answer'] ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Missing
120
121	$time_window = self::time_window();
122	$salt = get_site_option( 'jetpack_protect_key' ) . '\|' . get_site_option( 'admin_email' ) . '\|';
123	$salted_ans_1 = hash_hmac( 'sha1', $ans, $salt . $time_window );
124	$salted_ans_2 = hash_hmac( 'sha1', $ans, $salt . ( $time_window - 1 ) );
125
126	if ( ! hash_equals( $salted_ans_1, $correct_ans ) && ! hash_equals( $salted_ans_2, $correct_ans ) ) {
127	self::generate_math_page( true );
128	} else {
129	$temp_pass = substr( hash_hmac( 'sha1', wp_rand( 1, 100000000 ), get_site_option( 'jetpack_protect_key' ) ), 5, 25 );
130
131	$jetpack_protect = Jetpack_Protect_Module::instance();
132	$jetpack_protect->set_transient( 'jpp_math_pass_' . $temp_pass, 3, DAY_IN_SECONDS );
133	setcookie( 'jpp_math_pass', $temp_pass, time() + DAY_IN_SECONDS, COOKIEPATH, COOKIE_DOMAIN, false, true );
134	remove_action( 'login_form', array( $this, 'math_form' ) );
135	return true;
136	}
137	}
138
139	/**
140	* Requires a user to solve a simple equation. Added to any WordPress login form.
141	*
142	* @return VOID outputs html
143	*/
144	public static function math_form() {
145	// Check if jpp_math_pass cookie is set and it matches valid transient.
146	if ( isset( $_COOKIE['jpp_math_pass'] ) ) {
147	$jetpack_protect = Jetpack_Protect_Module::instance();
148	$transient = $jetpack_protect->get_transient( 'jpp_math_pass_' . sanitize_key( $_COOKIE['jpp_math_pass'] ) );
149
150	if ( $transient && $transient > 0 ) {
151	return '';
152	}
153	}
154
155	$num1 = wp_rand( 0, 10 );
156	$num2 = wp_rand( 1, 10 );
157	$ans = $num1 + $num2;
158
159	$time_window = self::time_window();
160	$salt = get_site_option( 'jetpack_protect_key' ) . '\|' . get_site_option( 'admin_email' ) . '\|';
161	$salted_ans = hash_hmac( 'sha1', $ans, $salt . $time_window );
162	?>
163	<div style="margin: 5px 0 20px;">
164	<p style="font-size: 14px;">
165	<?php esc_html_e( 'Prove your humanity', 'jetpack' ); ?>
166	</p>
167	<br/>
168	<label for="jetpack_protect_answer" style="vertical-align:super;">
169	<?php echo esc_html( "$num1   +   $num2   =  " ); ?>
170	</label>
171	<input type="number" id="jetpack_protect_answer" name="jetpack_protect_num" value="" size="2" style="width:50px;height:25px;vertical-align:middle;font-size:13px;" class="input" />
172	<input type="hidden" name="jetpack_protect_answer" value="<?php echo esc_attr( $salted_ans ); ?>" />
173	</div>
174	<?php
175	}
176
177	}
178	}
179