← All changes | jetpack_vendor/automattic/jetpack-sync/src/modules/class-protect.php +87 -0 16.2-beta → 16.3 View file →

		@@ -1,0 +1,87 @@
	1	+<?php
	2	+/**
	3	+ * Protect sync module.
	4	+ *
	5	+ * @package automattic/jetpack-sync
	6	+ */
	7	+
	8	+namespace Automattic\Jetpack\Sync\Modules;
	9	+
	10	+use Automattic\Jetpack\Constants as Jetpack_Constants;
	11	+use Automattic\Jetpack\Waf\Brute_Force_Protection\Brute_Force_Protection;
	12	+
	13	+if ( ! defined( 'ABSPATH' ) ) {
	14	+ exit( 0 );
	15	+}
	16	+
	17	+/**
	18	+ * Class to handle sync for Protect.
	19	+ * Logs BruteProtect failed logins via sync.
	20	+ */
	21	+class Protect extends Module {
	22	+ /**
	23	+ * Sync module name.
	24	+ *
	25	+ * @access public
	26	+ *
	27	+ * @return string
	28	+ */
	29	+ public function name() {
	30	+ return 'protect';
	31	+ }
	32	+
	33	+ /**
	34	+ * Initialize Protect action listeners.
	35	+ *
	36	+ * @access public
	37	+ *
	38	+ * @param callable $callback Action handler callable.
	39	+ */
	40	+ public function init_listeners( $callback ) {
	41	+ add_action( 'jpp_log_failed_attempt', array( $this, 'maybe_log_failed_login_attempt' ) );
	42	+ add_action( 'jetpack_valid_failed_login_attempt', $callback );
	43	+ }
	44	+
	45	+ /**
	46	+ * Provide a fallback value for has_login_ability.
	47	+ *
	48	+ * @access private
	49	+ */
	50	+ private function has_login_ability_fallback() {
	51	+ // Fall back to the Brute Force Protection class if it is available.
	52	+ if ( class_exists( 'Brute_Force_Protection' ) ) {
	53	+ $brute_force_protection = Brute_Force_Protection::instance();
	54	+ return $brute_force_protection->has_login_ability();
	55	+ }
	56	+
	57	+ // If the login ability cannot be determined, the feature is not active,
	58	+ // or something is wrong, default to not syncing failed login attempts.
	59	+ return false;
	60	+ }
	61	+
	62	+ /**
	63	+ * Maybe log a failed login attempt.
	64	+ *
	65	+ * @access public
	66	+ *
	67	+ * @param array $failed_attempt Failed attempt data.
	68	+ */
	69	+ public function maybe_log_failed_login_attempt( $failed_attempt ) {
	70	+ /**
	71	+ * Filter which provides Jetpack's decision as to whether the current requestor can attempt logging in.
	72	+ *
	73	+ * Example: When Jetpack's Brute Force Login Protection is active, this filter will return false if the user is currently locked out.
	74	+ *
	75	+ * @since 3.5.1
	76	+ *
	77	+ * @package sync
	78	+ *
	79	+ * @return bool True if the user should be allowed to attempt logging in, false otherwise.
	80	+ */
	81	+ $has_login_ability = apply_filters( 'jetpack_has_login_ability', $this->has_login_ability_fallback() );
	82	+
	83	+ if ( $has_login_ability && ! Jetpack_Constants::is_true( 'XMLRPC_REQUEST' ) ) {
	84	+ do_action( 'jetpack_valid_failed_login_attempt', $failed_attempt );
	85	+ }
	86	+ }
	87	+}