| 1 |
<?php |
| 2 |
/** |
| 3 |
* Troubleshoot Auth. |
| 4 |
* |
| 5 |
* @since 0.0.0 |
| 6 |
* @package Troubleshoot |
| 7 |
*/ |
| 8 |
|
| 9 |
/** |
| 10 |
* Troubleshoot Auth. |
| 11 |
* |
| 12 |
* @since 0.0.0 |
| 13 |
*/ |
| 14 |
class PDT_Auth { |
| 15 |
/** |
| 16 |
* Parent plugin class. |
| 17 |
* |
| 18 |
* @since 0.0.0 |
| 19 |
* |
| 20 |
* @var Troubleshoot |
| 21 |
*/ |
| 22 |
protected $plugin = null; |
| 23 |
|
| 24 |
/** |
| 25 |
* Constructor. |
| 26 |
* |
| 27 |
* @since 0.0.0 |
| 28 |
* |
| 29 |
* @param Troubleshoot $plugin Main plugin object. |
| 30 |
*/ |
| 31 |
public function __construct( $plugin ) { |
| 32 |
$this->plugin = $plugin; |
| 33 |
$this->hooks(); |
| 34 |
} |
| 35 |
|
| 36 |
/** |
| 37 |
* Initiate our hooks. |
| 38 |
* |
| 39 |
* @since 0.0.0 |
| 40 |
*/ |
| 41 |
public function hooks() { |
| 42 |
|
| 43 |
} |
| 44 |
|
| 45 |
/** |
| 46 |
* Authenticate a username/password and require plugin-management capability. |
| 47 |
* |
| 48 |
* Every failure mode — unknown username, wrong password, or a valid login |
| 49 |
* that lacks the activate_plugins capability — returns the SAME generic |
| 50 |
* error. Distinct codes/messages here would let an unauthenticated caller |
| 51 |
* probe which usernames exist (user enumeration), so they are deliberately |
| 52 |
* collapsed into one indistinguishable response. |
| 53 |
* |
| 54 |
* @since 0.0.0 |
| 55 |
* |
| 56 |
* @param string $username Raw username input. |
| 57 |
* @param string $password Raw password input. |
| 58 |
* @return WP_User|WP_Error Plugin-capable user on success, or one generic error. |
| 59 |
*/ |
| 60 |
public static function authenticate( $username, $password ) { |
| 61 |
$username = sanitize_user( $username ); |
| 62 |
$password = trim( $password ); |
| 63 |
|
| 64 |
$user = apply_filters( 'authenticate', null, $username, $password ); |
| 65 |
|
| 66 |
if ( ! is_a( $user, 'WP_User' ) || ! user_can( $user, 'activate_plugins' ) ) { |
| 67 |
return new WP_Error( 'authentication_failed', __( '<strong>ERROR</strong>: Authentication failed.', 'plugin-detective' ) ); |
| 68 |
} |
| 69 |
|
| 70 |
return $user; |
| 71 |
} |
| 72 |
|
| 73 |
public static function create_nonce( $action, $uid = null ) { |
| 74 |
if ( null === $uid ) { |
| 75 |
$uid = get_current_user_id(); |
| 76 |
} |
| 77 |
$uid = (int) $uid; |
| 78 |
|
| 79 |
if ( ! empty( $_SERVER['HTTP_USER_AGENT'] ) ) { |
| 80 |
$token = sanitize_text_field( wp_unslash( $_SERVER['HTTP_USER_AGENT'] ) ); |
| 81 |
} else { |
| 82 |
$token = ''; |
| 83 |
} |
| 84 |
$i = strtotime( gmdate( 'Y-m-d' ) ); |
| 85 |
|
| 86 |
// Bind the token to the user it was issued for so a low-privileged user's |
| 87 |
// nonce can never stand in for an administrator's. The uid travels with the |
| 88 |
// token (the app treats it as opaque) and is re-verified on each request. |
| 89 |
return $uid . ':' . substr( sha1( DB_PASSWORD . $i . '|' . $action . '|' . $uid . '|' . $token ), -12, 10 ); |
| 90 |
} |
| 91 |
|
| 92 |
public static function verify_nonce( $nonce, $action ) { |
| 93 |
$nonce = (string) $nonce; |
| 94 |
if ( empty( $nonce ) ) { |
| 95 |
return false; |
| 96 |
} |
| 97 |
|
| 98 |
// Tokens are "<uid>:<hash>" — recover the uid so the hash is checked against |
| 99 |
// the user it was minted for. Returns that uid on success for the caller's |
| 100 |
// capability re-check; false otherwise. |
| 101 |
$parts = explode( ':', $nonce, 2 ); |
| 102 |
if ( count( $parts ) !== 2 || '' === $parts[1] ) { |
| 103 |
return false; |
| 104 |
} |
| 105 |
$uid = (int) $parts[0]; |
| 106 |
$provided = $parts[1]; |
| 107 |
|
| 108 |
if ( ! empty( $_SERVER['HTTP_USER_AGENT'] ) ) { |
| 109 |
$token = sanitize_text_field( wp_unslash( $_SERVER['HTTP_USER_AGENT'] ) ); |
| 110 |
} else { |
| 111 |
$token = ''; |
| 112 |
} |
| 113 |
|
| 114 |
$i = strtotime( gmdate( 'Y-m-d' ) ); |
| 115 |
|
| 116 |
// Nonce generated today (gmt) |
| 117 |
$expected = substr( sha1( DB_PASSWORD . $i . '|' . $action . '|' . $uid . '|' . $token ), -12, 10 ); |
| 118 |
if ( hash_equals( $expected, $provided ) ) { |
| 119 |
return $uid; |
| 120 |
} |
| 121 |
|
| 122 |
// Nonce generated yesterday (gmt) |
| 123 |
$expected = substr( sha1( DB_PASSWORD . ( $i - 24*60*60 ) . '|' . $action . '|' . $uid . '|' . $token ), -12, 10 ); |
| 124 |
if ( hash_equals( $expected, $provided ) ) { |
| 125 |
return $uid; |
| 126 |
} |
| 127 |
|
| 128 |
// Invalid nonce |
| 129 |
return false; |
| 130 |
} |
| 131 |
|
| 132 |
} |
| 133 |
|
