plugin-detective / troubleshoot / includes / class-auth.php

class-auth.php in Plugin Detective – Troubleshooting Conflicts 1.2.24, at troubleshoot/includes/class-auth.php

130 lines 3.2 KB

Raw Download Zip

1	<?php
2	/**
3	* Troubleshoot Auth.
4	*
5	* @since 0.0.0
6	* @package Troubleshoot
7	*/
8
9	/**
10	* Troubleshoot Auth.
11	*
12	* @since 0.0.0
13	*/
14	class PDT_Auth {
15	/**
16	* Parent plugin class.
17	*
18	* @since 0.0.0
19	*
20	* @var Troubleshoot
21	*/
22	protected $plugin = null;
23
24	/**
25	* Constructor.
26	*
27	* @since 0.0.0
28	*
29	* @param Troubleshoot $plugin Main plugin object.
30	*/
31	public function __construct( $plugin ) {
32	$this->plugin = $plugin;
33	$this->hooks();
34	}
35
36	/**
37	* Initiate our hooks.
38	*
39	* @since 0.0.0
40	*/
41	public function hooks() {
42
43	}
44
45	public static function get_user( $username, $password, $action ) {
46	$username = sanitize_user($username);
47	$password = trim($password);
48
49	$user = apply_filters( 'authenticate', null, $username, $password );
50	if ( $user == null ) {
51	$user = new WP_Error( 'authentication_failed', __( '<strong>ERROR</strong>: Invalid username, email address or incorrect password.', 'plugin-detective' ) );
52	}
53	if ( is_a( $user, 'WP_Error' ) ) {
54	return $user;
55	}
56
57	if ( !user_can( $user, 'activate_plugins' ) ) {
58	return new WP_Error( 'permission_denied', __( '<strong>ERROR</strong>: This user does not have permission to activate/deactivate plugins', 'plugin-detective' ) );
59	}
60
61	// $slug = sanitize_title( $username.sha1( DB_PASSWORD . $password ).$action );
62	return $user->data;
63	}
64
65	public static function get_nonce( $username, $password, $action ) {
66	$username = sanitize_user($username);
67	$password = trim($password);
68
69	$user = apply_filters( 'authenticate', null, $username, $password );
70	if ( $user == null ) {
71	$user = new WP_Error( 'authentication_failed', __( '<strong>ERROR</strong>: Invalid username, email address or incorrect password.', 'plugin-detective' ) );
72	}
73	if ( is_a( $user, 'WP_Error' ) ) {
74	return $user;
75	}
76
77	if ( !user_can( $user, 'activate_plugins' ) ) {
78	return new WP_Error( 'permission_denied', __( '<strong>ERROR</strong>: This user does not have permission to activate/deactivate plugins', 'plugin-detective' ) );
79	}
80
81	// $slug = sanitize_title( $username.sha1( DB_PASSWORD . $password ).$action );
82	return self::create_nonce( $action );
83	}
84
85	public static function create_nonce( $action ) {
86	$uid = 'api';
87
88	if ( !empty( $_SERVER['HTTP_USER_AGENT'] ) ) {
89	$token = $_SERVER['HTTP_USER_AGENT'];
90	} else {
91	$token = '';
92	}
93	$i = strtotime( gmdate( 'Y-m-d' ) );
94
95	return substr( sha1( DB_PASSWORD . $i . '\|' . $action . '\|' . $uid . '\|' . $token ), -12, 10 );
96	}
97
98	public static function verify_nonce( $nonce, $action ) {
99	$nonce = (string) $nonce;
100	$uid = 'api';
101	if ( !empty( $_SERVER['HTTP_USER_AGENT'] ) ) {
102	$token = $_SERVER['HTTP_USER_AGENT'];
103	} else {
104	$token = '';
105	}
106
107	if ( empty( $nonce ) ) {
108	return false;
109	}
110
111	$i = strtotime( gmdate( 'Y-m-d' ) );
112
113	// Nonce generated today (gmt)
114	$expected = substr( sha1( DB_PASSWORD . $i . '\|' . $action . '\|' . $uid . '\|' . $token ), -12, 10 );
115	if ( hash_equals( $expected, $nonce ) ) {
116	return 1;
117	}
118
119	// Nonce generated yesterday (gmt)
120	$expected = substr( sha1( DB_PASSWORD . ( $i - 246060 ) . '\|' . $action . '\|' . $uid . '\|' . $token ), -12, 10 );
121	if ( hash_equals( $expected, $nonce ) ) {
122	return 2;
123	}
124
125	// Invalid nonce
126	return false;
127	}
128
129	}
130