jetpack / modules / protect / math-fallback.php

math-fallback.php in Jetpack – WP Security, Backup, Speed, & Growth 6.1.3, at modules/protect/math-fallback.php

136 lines 4.7 KB

Raw Download Zip

1	<?php
2
3	if ( ! class_exists( 'Jetpack_Protect_Math_Authenticate' ) ) {
4	/*
5	* The math captcha fallback if we can't talk to the Protect API
6	*/
7	class Jetpack_Protect_Math_Authenticate {
8
9	static $loaded;
10
11	function __construct() {
12
13	if ( self::$loaded ) {
14	return;
15	}
16
17	self::$loaded = 1;
18
19	add_action( 'login_form', array( $this, 'math_form' ) );
20
21	if( isset( $_POST[ 'jetpack_protect_process_math_form' ] ) ) {
22	add_action( 'init', array( $this, 'process_generate_math_page' ) );
23	}
24	}
25
26	/**
27	* Verifies that a user answered the math problem correctly while logging in.
28	*
29	* @return bool Returns true if the math is correct
30	* @throws Error if insuffient $_POST variables are present.
31	* @throws Error message if the math is wrong
32	*/
33	static function math_authenticate() {
34	$salt = get_site_option( 'jetpack_protect_key' ) . get_site_option( 'admin_email' );
35	$ans = isset( $_POST['jetpack_protect_num'] ) ? (int) $_POST['jetpack_protect_num'] : '' ;
36	$salted_ans = sha1( $salt . $ans );
37	$correct_ans = isset( $_POST[ 'jetpack_protect_answer' ] ) ? $_POST[ 'jetpack_protect_answer' ] : '' ;
38
39	if( isset( $_COOKIE[ 'jpp_math_pass' ] ) ) {
40	$jetpack_protect = Jetpack_Protect_Module::instance();
41	$transient = $jetpack_protect->get_transient( 'jpp_math_pass_' . $_COOKIE[ 'jpp_math_pass' ] );
42
43	if( !$transient \|\| $transient < 1 ) {
44	Jetpack_Protect_Math_Authenticate::generate_math_page();
45	}
46	return true;
47	}
48
49	if ( ! $correct_ans \|\| !$_POST['jetpack_protect_num'] ) {
50	Jetpack_Protect_Math_Authenticate::generate_math_page();
51	} elseif ( $salted_ans != $correct_ans ) {
52	wp_die(
53	__( '<strong>You failed to correctly answer the math problem.</strong> This is used to combat spam when the Protect API is unavailable. Please use your browser\'s back button to return to the login form, press the "refresh" button to generate a new math problem, and try to log in again.', 'jetpack' ),
54	'',
55	array ( 'response' => 401 )
56	);
57	} else {
58	return true;
59	}
60	}
61
62	/**
63	* Creates an interim page to collect answers to a math captcha
64	*
65	* @return none, execution stopped
66	*/
67	static function generate_math_page( $error = false ) {
68	$salt = get_site_option( 'jetpack_protect_key' ) . get_site_option( 'admin_email' );
69	$num1 = rand( 0, 10 );
70	$num2 = rand( 1, 10 );
71	$sum = $num1 + $num2;
72	$ans = sha1( $salt . $sum );
73	ob_start();
74	?>
75	<h2><?php _e( 'Please solve this math problem to prove that you are not a bot. Once you solve it, you will need to log in again.', 'jetpack' ); ?></h2>
76	<?php if ($error): ?>
77	<h3><?php _e( 'Your answer was incorrect, please try again.', 'jetpack' ); ?></h3>
78	<?php endif ?>
79
80	<form action="<?php echo wp_login_url(); ?>" method="post" accept-charset="utf-8">
81	<?php Jetpack_Protect_Math_Authenticate::math_form(); ?>
82	<input type="hidden" name="jetpack_protect_process_math_form" value="1" id="jetpack_protect_process_math_form" />
83	<p><input type="submit" value="<?php esc_html_e( 'Continue →', 'jetpack' ); ?>"></p>
84	</form>
85	<?php
86	$mathpage = ob_get_contents();
87	ob_end_clean();
88	wp_die(
89	$mathpage,
90	'',
91	array ( 'response' => 401 )
92	);
93	}
94
95	public function process_generate_math_page() {
96	$salt = get_site_option( 'jetpack_protect_key' ) . get_site_option( 'admin_email' );
97	$ans = (int)$_POST['jetpack_protect_num'];
98	$salted_ans = sha1( $salt . $ans );
99	$correct_ans = $_POST[ 'jetpack_protect_answer' ];
100
101	if ( $salted_ans != $correct_ans ) {
102	Jetpack_Protect_Math_Authenticate::generate_math_page(true);
103	} else {
104	$temp_pass = substr( sha1( rand( 1, 100000000 ) . get_site_option( 'jetpack_protect_key' ) ), 5, 25 );
105
106	$jetpack_protect = Jetpack_Protect_Module::instance();
107	$jetpack_protect->set_transient( 'jpp_math_pass_' . $temp_pass, 3, DAY_IN_SECONDS );
108	setcookie('jpp_math_pass', $temp_pass, time() + DAY_IN_SECONDS, COOKIEPATH, COOKIE_DOMAIN, false);
109	return true;
110	}
111	}
112
113	/**
114	* Requires a user to solve a simple equation. Added to any WordPress login form.
115	*
116	* @return VOID outputs html
117	*/
118	static function math_form() {
119	$salt = get_site_option( 'jetpack_protect_key' ) . get_site_option( 'admin_email' );
120	$num1 = rand( 0, 10 );
121	$num2 = rand( 1, 10 );
122	$sum = $num1 + $num2;
123	$ans = sha1( $salt . $sum );
124	?>
125	<div style="margin: 5px 0 20px;">
126	<strong><?php esc_html_e( 'Prove your humanity:', 'jetpack' ); ?> </strong>
127	<?php echo $num1 ?>   +   <?php echo $num2 ?>   =
128	<input type="input" name="jetpack_protect_num" value="" size="2" />
129	<input type="hidden" name="jetpack_protect_answer" value="<?php echo $ans; ?>" />
130	</div>
131	<?php
132	}
133
134	}
135	}
136