← All changes | troubleshoot/includes/class-auth.php +132 -129 1.1.6 → 1.2.35 View file →

		@@ -1,129 +1,132 @@
1		-<?php
2		-/**
3		- * Troubleshoot Auth.
4		- *
5		- * @since 0.0.0
6		- * @package Troubleshoot
7		- */
8		-
9		-/**
10		- * Troubleshoot Auth.
11		- *
12		- * @since 0.0.0
13		- */
14		-class PDT_Auth {
15		- /**
16		- * Parent plugin class.
17		- *
18		- * @since 0.0.0
19		- *
20		- * @var Troubleshoot
21		- */
22		- protected $plugin = null;
23		-
24		- /**
25		- * Constructor.
26		- *
27		- * @since 0.0.0
28		- *
29		- * @param Troubleshoot $plugin Main plugin object.
30		- */
31		- public function __construct( $plugin ) {
32		- $this->plugin = $plugin;
33		- $this->hooks();
34		- }
35		-
36		- /**
37		- * Initiate our hooks.
38		- *
39		- * @since 0.0.0
40		- */
41		- public function hooks() {
42		-
43		- }
44		-
45		- public static function get_user( $username, $password, $action ) {
46		- $username = sanitize_user($username);
47		- $password = trim($password);
48		-
49		- $user = apply_filters( 'authenticate', null, $username, $password );
50		- if ( $user == null ) {
51		- $user = new WP_Error( 'authentication_failed', __( '<strong>ERROR</strong>: Invalid username, email address or incorrect password.', 'plugin-detective' ) );
52		- }
53		- if ( is_a( $user, 'WP_Error' ) ) {
54		- return $user;
55		- }
56		-
57		- if ( !user_can( $user, 'activate_plugins' ) ) {
58		- return new WP_Error( 'permission_denied', __( '<strong>ERROR</strong>: This user does not have permission to activate/deactivate plugins', 'plugin-detective' ) );
59		- }
60		-
61		- // $slug = sanitize_title( $username.sha1( DB_PASSWORD . $password ).$action );
62		- return $user->data;
63		- }
64		-
65		- public static function get_nonce( $username, $password, $action ) {
66		- $username = sanitize_user($username);
67		- $password = trim($password);
68		-
69		- $user = apply_filters( 'authenticate', null, $username, $password );
70		- if ( $user == null ) {
71		- $user = new WP_Error( 'authentication_failed', __( '<strong>ERROR</strong>: Invalid username, email address or incorrect password.', 'plugin-detective' ) );
72		- }
73		- if ( is_a( $user, 'WP_Error' ) ) {
74		- return $user;
75		- }
76		-
77		- if ( !user_can( $user, 'activate_plugins' ) ) {
78		- return new WP_Error( 'permission_denied', __( '<strong>ERROR</strong>: This user does not have permission to activate/deactivate plugins', 'plugin-detective' ) );
79		- }
80		-
81		- // $slug = sanitize_title( $username.sha1( DB_PASSWORD . $password ).$action );
82		- return self::create_nonce( $action );
83		- }
84		-
85		- public static function create_nonce( $action ) {
86		- $uid = 'api';
87		-
88		- if ( !empty( $_SERVER['HTTP_USER_AGENT'] ) ) {
89		- $token = $_SERVER['HTTP_USER_AGENT'];
90		- } else {
91		- $token = '';
92		- }
93		- $i = strtotime( gmdate( 'Y-m-d' ) );
94		-
95		- return substr( sha1( DB_PASSWORD . $i . '|' . $action . '|' . $uid . '|' . $token ), -12, 10 );
96		- }
97		-
98		- public static function verify_nonce( $nonce, $action ) {
99		- $nonce = (string) $nonce;
100		- $uid = 'api';
101		- if ( !empty( $_SERVER['HTTP_USER_AGENT'] ) ) {
102		- $token = $_SERVER['HTTP_USER_AGENT'];
103		- } else {
104		- $token = '';
105		- }
106		-
107		- if ( empty( $nonce ) ) {
108		- return false;
109		- }
110		-
111		- $i = strtotime( gmdate( 'Y-m-d' ) );
112		-
113		- // Nonce generated today (gmt)
114		- $expected = substr( sha1( DB_PASSWORD . $i . '|' . $action . '|' . $uid . '|' . $token ), -12, 10 );
115		- if ( hash_equals( $expected, $nonce ) ) {
116		- return 1;
117		- }
118		-
119		- // Nonce generated yesterday (gmt)
120		- $expected = substr( sha1( DB_PASSWORD . ( $i - 24*60*60 ) . '|' . $action . '|' . $uid . '|' . $token ), -12, 10 );
121		- if ( hash_equals( $expected, $nonce ) ) {
122		- return 2;
123		- }
124		-
125		- // Invalid nonce
126		- return false;
127		- }
128		-
129		-}
	1	+<?php
	2	+/**
	3	+ * Troubleshoot Auth.
	4	+ *
	5	+ * @since 0.0.0
	6	+ * @package Troubleshoot
	7	+ */
	8	+
	9	+/**
	10	+ * Troubleshoot Auth.
	11	+ *
	12	+ * @since 0.0.0
	13	+ */
	14	+class PDT_Auth {
	15	+ /**
	16	+ * Parent plugin class.
	17	+ *
	18	+ * @since 0.0.0
	19	+ *
	20	+ * @var Troubleshoot
	21	+ */
	22	+ protected $plugin = null;
	23	+
	24	+ /**
	25	+ * Constructor.
	26	+ *
	27	+ * @since 0.0.0
	28	+ *
	29	+ * @param Troubleshoot $plugin Main plugin object.
	30	+ */
	31	+ public function __construct( $plugin ) {
	32	+ $this->plugin = $plugin;
	33	+ $this->hooks();
	34	+ }
	35	+
	36	+ /**
	37	+ * Initiate our hooks.
	38	+ *
	39	+ * @since 0.0.0
	40	+ */
	41	+ public function hooks() {
	42	+
	43	+ }
	44	+
	45	+ /**
	46	+ * Authenticate a username/password and require plugin-management capability.
	47	+ *
	48	+ * Every failure mode — unknown username, wrong password, or a valid login
	49	+ * that lacks the activate_plugins capability — returns the SAME generic
	50	+ * error. Distinct codes/messages here would let an unauthenticated caller
	51	+ * probe which usernames exist (user enumeration), so they are deliberately
	52	+ * collapsed into one indistinguishable response.
	53	+ *
	54	+ * @since 0.0.0
	55	+ *
	56	+ * @param string $username Raw username input.
	57	+ * @param string $password Raw password input.
	58	+ * @return WP_User|WP_Error Plugin-capable user on success, or one generic error.
	59	+ */
	60	+ public static function authenticate( $username, $password ) {
	61	+ $username = sanitize_user( $username );
	62	+ $password = trim( $password );
	63	+
	64	+ $user = apply_filters( 'authenticate', null, $username, $password );
	65	+
	66	+ if ( ! is_a( $user, 'WP_User' ) || ! user_can( $user, 'activate_plugins' ) ) {
	67	+ return new WP_Error( 'authentication_failed', __( '<strong>ERROR</strong>: Authentication failed.', 'plugin-detective' ) );
	68	+ }
	69	+
	70	+ return $user;
	71	+ }
	72	+
	73	+ public static function create_nonce( $action, $uid = null ) {
	74	+ if ( null === $uid ) {
	75	+ $uid = get_current_user_id();
	76	+ }
	77	+ $uid = (int) $uid;
	78	+
	79	+ if ( ! empty( $_SERVER['HTTP_USER_AGENT'] ) ) {
	80	+ $token = sanitize_text_field( wp_unslash( $_SERVER['HTTP_USER_AGENT'] ) );
	81	+ } else {
	82	+ $token = '';
	83	+ }
	84	+ $i = strtotime( gmdate( 'Y-m-d' ) );
	85	+
	86	+ // Bind the token to the user it was issued for so a low-privileged user's
	87	+ // nonce can never stand in for an administrator's. The uid travels with the
	88	+ // token (the app treats it as opaque) and is re-verified on each request.
	89	+ return $uid . ':' . substr( sha1( DB_PASSWORD . $i . '|' . $action . '|' . $uid . '|' . $token ), -12, 10 );
	90	+ }
	91	+
	92	+ public static function verify_nonce( $nonce, $action ) {
	93	+ $nonce = (string) $nonce;
	94	+ if ( empty( $nonce ) ) {
	95	+ return false;
	96	+ }
	97	+
	98	+ // Tokens are "<uid>:<hash>" — recover the uid so the hash is checked against
	99	+ // the user it was minted for. Returns that uid on success for the caller's
	100	+ // capability re-check; false otherwise.
	101	+ $parts = explode( ':', $nonce, 2 );
	102	+ if ( count( $parts ) !== 2 || '' === $parts[1] ) {
	103	+ return false;
	104	+ }
	105	+ $uid = (int) $parts[0];
	106	+ $provided = $parts[1];
	107	+
	108	+ if ( ! empty( $_SERVER['HTTP_USER_AGENT'] ) ) {
	109	+ $token = sanitize_text_field( wp_unslash( $_SERVER['HTTP_USER_AGENT'] ) );
	110	+ } else {
	111	+ $token = '';
	112	+ }
	113	+
	114	+ $i = strtotime( gmdate( 'Y-m-d' ) );
	115	+
	116	+ // Nonce generated today (gmt)
	117	+ $expected = substr( sha1( DB_PASSWORD . $i . '|' . $action . '|' . $uid . '|' . $token ), -12, 10 );
	118	+ if ( hash_equals( $expected, $provided ) ) {
	119	+ return $uid;
	120	+ }
	121	+
	122	+ // Nonce generated yesterday (gmt)
	123	+ $expected = substr( sha1( DB_PASSWORD . ( $i - 24*60*60 ) . '|' . $action . '|' . $uid . '|' . $token ), -12, 10 );
	124	+ if ( hash_equals( $expected, $provided ) ) {
	125	+ return $uid;
	126	+ }
	127	+
	128	+ // Invalid nonce
	129	+ return false;
	130	+ }
	131	+
	132	+}