class-jetpack-force-2fa.php — Jetpack – WP Security, Backup, Speed, & Growth 12.7.3

jetpack / modules / sso / class-jetpack-force-2fa.php

jetpack / modules / sso Last commit date

class-jetpack-force-2fa.php 2 years ago class.jetpack-sso-helpers.php 3 years ago class.jetpack-sso-notices.php 4 years ago jetpack-sso-login-rtl.css 4 years ago jetpack-sso-login-rtl.min.css 4 years ago jetpack-sso-login.css 4 years ago jetpack-sso-login.js 6 years ago jetpack-sso-login.min.css 4 years ago

class-jetpack-force-2fa.php

175 lines

1	<?php
2	/**
3	* Force Jetpack 2FA Functionality
4	*
5	* Ported from original repo at https://github.com/automattic/jetpack-force-2fa
6	*
7	* @package automattic/jetpack
8	*/
9
10	/**
11	* Force users to use two factor authentication.
12	*/
13	class Jetpack_Force_2FA {
14
15	/**
16	* The role to force 2FA for.
17	*
18	* Defaults to manage_options via the plugins_loaded function.
19	* Can be modified with the jetpack_force_2fa_cap filter.
20	*
21	* @var string
22	*/
23	private $role;
24
25	/**
26	* Constructor.
27	*/
28	public function __construct() {
29	add_action( 'after_setup_theme', array( $this, 'plugins_loaded' ) );
30	}
31
32	/**
33	* Load the plugin via the plugins_loaded hook.
34	*/
35	public function plugins_loaded() {
36	/**
37	* Filter the role to force 2FA for.
38	* Defaults to manage_options.
39	*
40	* @param string $role The role to force 2FA for.
41	* @return string
42	* @since 12.7
43	* @module SSO
44	*/
45	$this->role = apply_filters( 'jetpack_force_2fa_cap', 'manage_options' );
46
47	// Bail if Jetpack SSO is not active
48	if ( ! class_exists( 'Jetpack' ) \|\| ! Jetpack::is_active() \|\| ! Jetpack::is_module_active( 'sso' ) ) {
49	add_action( 'admin_notices', array( $this, 'admin_notice' ) );
50	return;
51	}
52
53	$this->force_2fa();
54	}
55
56	/**
57	* Display an admin notice if Jetpack SSO is not active.
58	*/
59	public function admin_notice() {
60	/**
61	* Filter if an admin notice is deplayed when Force 2FA is required, but SSO is not enabled.
62	* Defaults to true.
63	*
64	* @param bool $display_notice Whether to display the notice.
65	* @return bool
66	* @since 12.7
67	* @module SSO
68	*/
69	if ( apply_filters( 'jetpack_force_2fa_dependency_notice', true ) && current_user_can( $this->role ) ) {
70	printf( '<div class="%1$s"><p>%2$s</p></div>', 'notice notice-warning', 'Jetpack Force 2FA requires Jetpack and the Jetpack SSO module.' );
71	}
72	}
73
74	/**
75	* Force 2FA when using Jetpack SSO and force Jetpack SSO.
76	*
77	* @return void
78	*/
79	private function force_2fa() {
80	// Allows WP.com login to a local account if it matches the local account.
81	add_filter( 'jetpack_sso_match_by_email', '__return_true', 9999 );
82
83	// multisite
84	if ( is_multisite() ) {
85
86	// Hide the login form
87	add_filter( 'jetpack_remove_login_form', '__return_true', 9999 );
88	add_filter( 'jetpack_sso_bypass_login_forward_wpcom', '__return_true', 9999 );
89	add_filter( 'jetpack_sso_display_disclaimer', '__return_false', 9999 );
90
91	add_filter(
92	'wp_authenticate_user',
93	function () {
94	return new WP_Error( 'wpcom-required', $this->get_login_error_message() ); },
95	9999
96	);
97
98	add_filter( 'jetpack_sso_require_two_step', '__return_true' );
99
100	add_filter( 'allow_password_reset', '__return_false' );
101	} else {
102	// Not multisite.
103
104	// Completely disable the standard login form for admins.
105	add_filter(
106	'wp_authenticate_user',
107	function ( $user ) {
108	if ( is_wp_error( $user ) ) {
109	return $user;
110	}
111	if ( $user->has_cap( $this->role ) ) {
112	return new WP_Error( 'wpcom-required', $this->get_login_error_message(), $user->user_login );
113	}
114	return $user;
115	},
116	9999
117	);
118
119	add_filter(
120	'allow_password_reset',
121	function ( $allow, $user_id ) {
122	if ( user_can( $user_id, $this->role ) ) {
123	return false;
124	}
125	return $allow; },
126	9999,
127	2
128	);
129
130	add_action( 'jetpack_sso_pre_handle_login', array( $this, 'jetpack_set_two_step' ) );
131	}
132	}
133
134	/**
135	* Specifically set the two step filter for Jetpack SSO.
136	*
137	* @param Object $user_data The user data from WordPress.com.
138	*
139	* @return void
140	*/
141	public function jetpack_set_two_step( $user_data ) {
142	$user = Jetpack_SSO::get_user_by_wpcom_id( $user_data->ID );
143
144	// Borrowed from Jetpack. Ignores the match_by_email setting.
145	if ( empty( $user ) ) {
146	$user = get_user_by( 'email', $user_data->email );
147	}
148
149	if ( $user && $user->has_cap( $this->role ) ) {
150	add_filter( 'jetpack_sso_require_two_step', '__return_true' );
151	}
152	}
153
154	/**
155	* Get the login error message.
156	*
157	* @return string
158	*/
159	private function get_login_error_message() {
160	/**
161	* Filter the login error message.
162	* Defaults to a message that explains the user must use a WordPress.com account with 2FA enabled.
163	*
164	* @param string $message The login error message.
165	* @return string
166	* @since 12.7
167	* @module SSO
168	*/
169	return apply_filters(
170	'jetpack_force_2fa_login_error_message',
171	sprintf( 'For added security, please log in using your WordPress.com account.<br /><br />Note: Your account must have <a href="%1$s" target="_blank">Two Step Authentication</a> enabled, which can be configured from <a href="%2$s" target="_blank">Security Settings</a>.', 'https://support.wordpress.com/security/two-step-authentication/', 'https://wordpress.com/me/security/two-step' )
172	);
173	}
174	}
175