class.jetpack-sso-helpers.php — Jetpack – WP Security, Backup, Speed, & Growth 13.3.3

jetpack / modules / sso / class.jetpack-sso-helpers.php

jetpack / modules / sso Last commit date

class.jetpack-sso-helpers.php

449 lines

1	<?php // phpcs:ignore WordPress.Files.FileName.InvalidClassFileName
2	/**
3	* A collection of helper functions used in the SSO module.
4	*
5	* @package automattic/jetpack
6	*/
7
8	use Automattic\Jetpack\Connection\Manager as Connection_Manager;
9
10	if ( ! class_exists( 'Jetpack_SSO_Helpers' ) ) :
11
12	/**
13	* A collection of helper functions used in the SSO module.
14	*
15	* @since 4.1.0
16	*/
17	class Jetpack_SSO_Helpers {
18	/**
19	* Determine if the login form should be hidden or not
20	*
21	* @return bool
22	**/
23	public static function should_hide_login_form() {
24	/**
25	* Remove the default log in form, only leave the WordPress.com log in button.
26	*
27	* @module sso
28	*
29	* @since 3.1.0
30	*
31	* @param bool get_option( 'jetpack_sso_remove_login_form', false ) Should the default log in form be removed. Default to false.
32	*/
33	return (bool) apply_filters( 'jetpack_remove_login_form', get_option( 'jetpack_sso_remove_login_form', false ) );
34	}
35
36	/**
37	* Returns a boolean value for whether logging in by matching the WordPress.com user email to a
38	* Jetpack site user's email is allowed.
39	*
40	* @return bool
41	*/
42	public static function match_by_email() {
43	$match_by_email = defined( 'WPCC_MATCH_BY_EMAIL' ) ? WPCC_MATCH_BY_EMAIL : (bool) get_option( 'jetpack_sso_match_by_email', true );
44
45	/**
46	* Link the local account to an account on WordPress.com using the same email address.
47	*
48	* @module sso
49	*
50	* @since 2.6.0
51	*
52	* @param bool $match_by_email Should we link the local account to an account on WordPress.com using the same email address. Default to false.
53	*/
54	return (bool) apply_filters( 'jetpack_sso_match_by_email', $match_by_email );
55	}
56
57	/**
58	* Returns a boolean for whether users are allowed to register on the Jetpack site with SSO,
59	* even though the site disallows normal registrations.
60	*
61	* @param object\|null $user_data WordPress.com user information.
62	* @return bool
63	*/
64	public static function new_user_override( $user_data = null ) {
65	$new_user_override = defined( 'WPCC_NEW_USER_OVERRIDE' ) ? WPCC_NEW_USER_OVERRIDE : false;
66
67	/**
68	* Allow users to register on your site with a WordPress.com account, even though you disallow normal registrations.
69	* If you return a string that corresponds to a user role, the user will be given that role.
70	*
71	* @module sso
72	*
73	* @since 2.6.0
74	* @since 4.6 $user_data object is now passed to the jetpack_sso_new_user_override filter
75	*
76	* @param bool $new_user_override Allow users to register on your site with a WordPress.com account. Default to false.
77	* @param object\|null $user_data An object containing the user data returned from WordPress.com.
78	*/
79	$role = apply_filters( 'jetpack_sso_new_user_override', $new_user_override, $user_data );
80
81	if ( $role ) {
82	if ( is_string( $role ) && get_role( $role ) ) {
83	return $role;
84	} else {
85	return get_option( 'default_role' );
86	}
87	}
88
89	return false;
90	}
91
92	/**
93	* Returns a boolean value for whether two-step authentication is required for SSO.
94	*
95	* @since 4.1.0
96	*
97	* @return bool
98	*/
99	public static function is_two_step_required() {
100	/**
101	* Is it required to have 2-step authentication enabled on WordPress.com to use SSO?
102	*
103	* @module sso
104	*
105	* @since 2.8.0
106	*
107	* @param bool get_option( 'jetpack_sso_require_two_step' ) Does SSO require 2-step authentication?
108	*/
109	return (bool) apply_filters( 'jetpack_sso_require_two_step', get_option( 'jetpack_sso_require_two_step', false ) );
110	}
111
112	/**
113	* Returns a boolean for whether a user that is attempting to log in will be automatically
114	* redirected to WordPress.com to begin the SSO flow.
115	*
116	* @return bool
117	*/
118	public static function bypass_login_forward_wpcom() {
119	/**
120	* Redirect the site's log in form to WordPress.com's log in form.
121	*
122	* @module sso
123	*
124	* @since 3.1.0
125	*
126	* @param bool false Should the site's log in form be automatically forwarded to WordPress.com's log in form.
127	*/
128	return (bool) apply_filters( 'jetpack_sso_bypass_login_forward_wpcom', false );
129	}
130
131	/**
132	* Returns a boolean for whether the SSO login form should be displayed as the default
133	* when both the default and SSO login form allowed.
134	*
135	* @since 4.1.0
136	*
137	* @return bool
138	*/
139	public static function show_sso_login() {
140	if ( self::should_hide_login_form() ) {
141	return true;
142	}
143
144	/**
145	* Display the SSO login form as the default when both the default and SSO login forms are enabled.
146	*
147	* @module sso
148	*
149	* @since 4.1.0
150	*
151	* @param bool true Should the SSO login form be displayed by default when the default login form is also enabled?
152	*/
153	return (bool) apply_filters( 'jetpack_sso_default_to_sso_login', true );
154	}
155
156	/**
157	* Returns a boolean for whether the two step required checkbox, displayed on the Jetpack admin page, should be disabled.
158	*
159	* @since 4.1.0
160	*
161	* @return bool
162	*/
163	public static function is_require_two_step_checkbox_disabled() {
164	return (bool) has_filter( 'jetpack_sso_require_two_step' );
165	}
166
167	/**
168	* Returns a boolean for whether the match by email checkbox, displayed on the Jetpack admin page, should be disabled.
169	*
170	* @since 4.1.0
171	*
172	* @return bool
173	*/
174	public static function is_match_by_email_checkbox_disabled() {
175	return defined( 'WPCC_MATCH_BY_EMAIL' ) \|\| has_filter( 'jetpack_sso_match_by_email' );
176	}
177
178	/**
179	* Returns an array of hosts that SSO will redirect to.
180	*
181	* Instead of accessing JETPACK__API_BASE within the method directly, we set it as the
182	* default for $api_base due to restrictions with testing constants in our tests.
183	*
184	* @since 4.3.0
185	* @since 4.6.0 Added public-api.wordpress.com as an allowed redirect
186	*
187	* @param array $hosts Allowed redirect hosts.
188	* @param string $api_base Base API URL.
189	*
190	* @return array
191	*/
192	public static function allowed_redirect_hosts( $hosts, $api_base = JETPACK__API_BASE ) {
193	if ( empty( $hosts ) ) {
194	$hosts = array();
195	}
196
197	$hosts[] = 'wordpress.com';
198	$hosts[] = 'jetpack.wordpress.com';
199	$hosts[] = 'public-api.wordpress.com';
200	$hosts[] = 'jetpack.com';
201
202	if ( ! str_contains( $api_base, 'jetpack.wordpress.com/jetpack' ) ) {
203	$base_url_parts = wp_parse_url( esc_url_raw( $api_base ) );
204	if ( $base_url_parts && ! empty( $base_url_parts['host'] ) ) {
205	$hosts[] = $base_url_parts['host'];
206	}
207	}
208
209	return array_unique( $hosts );
210	}
211
212	/**
213	* Generate a new user from a SSO attempt.
214	*
215	* @param object $user_data WordPress.com user information.
216	*/
217	public static function generate_user( $user_data ) {
218	$username = $user_data->login;
219	/**
220	* Determines how many times the SSO module can attempt to randomly generate a user.
221	*
222	* @module sso
223	*
224	* @since 4.3.2
225	*
226	* @param int 5 By default, SSO will attempt to random generate a user up to 5 times.
227	*/
228	$num_tries = (int) apply_filters( 'jetpack_sso_allowed_username_generate_retries', 5 );
229
230	$exists = username_exists( $username );
231	$tries = 0;
232	while ( $exists && $tries++ < $num_tries ) {
233	$username = $user_data->login . '_' . $user_data->ID . '_' . wp_rand();
234	$exists = username_exists( $username );
235	}
236
237	if ( $exists ) {
238	return false;
239	}
240
241	$user = (object) array();
242	$user->user_pass = wp_generate_password( 20 );
243	$user->user_login = wp_slash( $username );
244	$user->user_email = wp_slash( $user_data->email );
245	$user->display_name = $user_data->display_name;
246	$user->first_name = $user_data->first_name;
247	$user->last_name = $user_data->last_name;
248	$user->url = $user_data->url;
249	$user->description = $user_data->description;
250
251	if ( isset( $user_data->role ) && $user_data->role ) {
252	$user->role = $user_data->role;
253	}
254
255	$created_user_id = wp_insert_user( $user );
256
257	update_user_meta( $created_user_id, 'wpcom_user_id', $user_data->ID );
258	return get_userdata( $created_user_id );
259	}
260
261	/**
262	* Determines how long the auth cookie is valid for when a user logs in with SSO.
263	*
264	* @return int result of the jetpack_sso_auth_cookie_expiration filter.
265	*/
266	public static function extend_auth_cookie_expiration_for_sso() {
267	/**
268	* Determines how long the auth cookie is valid for when a user logs in with SSO.
269	*
270	* @module sso
271	*
272	* @since 4.4.0
273	* @since 6.1.0 Fixed a typo. Filter was previously jetpack_sso_auth_cookie_expirtation.
274	*
275	* @param int YEAR_IN_SECONDS
276	*/
277	return (int) apply_filters( 'jetpack_sso_auth_cookie_expiration', YEAR_IN_SECONDS );
278	}
279
280	/**
281	* Determines if the SSO form should be displayed for the current action.
282	*
283	* @since 4.6.0
284	*
285	* @param string $action SSO action being performed.
286	*
287	* @return bool Is SSO allowed for the current action?
288	*/
289	public static function display_sso_form_for_action( $action ) {
290	/**
291	* Allows plugins the ability to overwrite actions where the SSO form is allowed to be used.
292	*
293	* @module sso
294	*
295	* @since 4.6.0
296	*
297	* @param array $allowed_actions_for_sso
298	*/
299	$allowed_actions_for_sso = (array) apply_filters(
300	'jetpack_sso_allowed_actions',
301	array(
302	'login',
303	'jetpack-sso',
304	'jetpack_json_api_authorization',
305	)
306	);
307	return in_array( $action, $allowed_actions_for_sso, true );
308	}
309
310	/**
311	* This method returns an environment array that is meant to simulate `$_REQUEST` when the initial
312	* JSON API auth request was made.
313	*
314	* @since 4.6.0
315	*
316	* @return array\|bool
317	*/
318	public static function get_json_api_auth_environment() {
319	if ( empty( $_COOKIE['jetpack_sso_original_request'] ) ) {
320	return false;
321	}
322
323	$original_request = esc_url_raw( wp_unslash( $_COOKIE['jetpack_sso_original_request'] ) );
324
325	$parsed_url = wp_parse_url( $original_request );
326	if ( empty( $parsed_url ) \|\| empty( $parsed_url['query'] ) ) {
327	return false;
328	}
329
330	$args = array();
331	wp_parse_str( $parsed_url['query'], $args );
332
333	if ( empty( $args ) \|\| empty( $args['action'] ) ) {
334	return false;
335	}
336
337	if ( 'jetpack_json_api_authorization' !== $args['action'] ) {
338	return false;
339	}
340
341	return array_merge(
342	$args,
343	array( 'jetpack_json_api_original_query' => $original_request )
344	);
345	}
346
347	/**
348	* Check if the site has a custom login page URL, and return it.
349	* If default login page URL is used (`wp-login.php`), `null` will be returned.
350	*
351	* @return string\|null
352	*/
353	public static function get_custom_login_url() {
354	$login_url = wp_login_url();
355
356	if ( str_ends_with( $login_url, 'wp-login.php' ) ) {
357	// No custom URL found.
358	return null;
359	}
360
361	$site_url = trailingslashit( site_url() );
362
363	if ( ! str_starts_with( $login_url, $site_url ) ) {
364	// Something went wrong, we can't properly extract the custom URL.
365	return null;
366	}
367
368	// Extracting the "path" part of the URL, because we don't need the `site_url` part.
369	return str_ireplace( $site_url, '', $login_url );
370	}
371
372	/**
373	* Clear the cookies that store the profile information for the last
374	* WPCOM user to connect.
375	*/
376	public static function clear_wpcom_profile_cookies() {
377	if ( isset( $_COOKIE[ 'jetpack_sso_wpcom_name_' . COOKIEHASH ] ) ) {
378	setcookie(
379	'jetpack_sso_wpcom_name_' . COOKIEHASH,
380	' ',
381	time() - YEAR_IN_SECONDS,
382	COOKIEPATH,
383	COOKIE_DOMAIN,
384	is_ssl(),
385	true
386	);
387	}
388
389	if ( isset( $_COOKIE[ 'jetpack_sso_wpcom_gravatar_' . COOKIEHASH ] ) ) {
390	setcookie(
391	'jetpack_sso_wpcom_gravatar_' . COOKIEHASH,
392	' ',
393	time() - YEAR_IN_SECONDS,
394	COOKIEPATH,
395	COOKIE_DOMAIN,
396	is_ssl(),
397	true
398	);
399	}
400	}
401
402	/**
403	* Remove an SSO connection for a user.
404	*
405	* @param int $user_id The local user id.
406	*/
407	public static function delete_connection_for_user( $user_id ) {
408	$wpcom_user_id = get_user_meta( $user_id, 'wpcom_user_id', true );
409	if ( ! $wpcom_user_id ) {
410	return;
411	}
412
413	$xml = new Jetpack_IXR_Client(
414	array(
415	'wpcom_user_id' => $user_id,
416	)
417	);
418	$xml->query( 'jetpack.sso.removeUser', $wpcom_user_id );
419
420	if ( $xml->isError() ) {
421	return false;
422	}
423
424	// Clean up local data stored for SSO.
425	delete_user_meta( $user_id, 'wpcom_user_id' );
426	delete_user_meta( $user_id, 'wpcom_user_data' );
427	self::clear_wpcom_profile_cookies();
428
429	return $xml->getResponse();
430	}
431
432	/**
433	* Check if a local user is already connected to WordPress.com.
434	*
435	* @since 13.3
436	*
437	* @param int $user_id Local User information.
438	*/
439	public static function is_user_connected( $user_id = 0 ) {
440	if ( ! $user_id ) {
441	$user_id = get_current_user_id();
442	}
443
444	return ( new Connection_Manager( 'jetpack' ) )->is_user_connected( $user_id );
445	}
446	}
447
448	endif;
449