two-factor-authentication / includes / admin_settings.php

admin_settings.php in Two Factor Authentication 1.1, at includes/admin_settings.php

154 lines 5.5 KB

Raw Download Zip

1	<?php
2
3	if (!defined('ABSPATH')) die('Access denied.');
4
5	if (!is_admin() \|\| !current_user_can('manage_options')) exit;
6
7	global $wp_roles;
8	global $simba_two_factor_authentication;
9
10	$tfa->setUserHMACTypes();
11
12	?><div class="wrap">
13
14	<div style="max-width: 800px;">
15
16	<?php screen_icon(); ?>
17	<h2><?php echo sprintf(__('Two Factor Authentication (Version: %s) - Admin Settings', SIMBA_TFA_TEXT_DOMAIN), $simba_two_factor_authentication->version); ?> </h2>
18
19	<a href="http://updraftplus.com">UpdraftPlus - <?php _e('WordPress Backups', SIMBA_TFA_TEXT_DOMAIN); ?></a> \|
20	<a href="https://profiles.wordpress.org/davidanderson#content-plugins"><?php _e('More Free Plugins', SIMBA_TFA_TEXT_DOMAIN);?></a> \|
21	<a href="https://www.simbahosting.co.uk/s3/shop/"><?php _e('Premium Plugins', SIMBA_TFA_TEXT_DOMAIN);?></a> \|
22	<a href="https://twitter.com/updraftplus"><?php _e('Twitter', SIMBA_TFA_TEXT_DOMAIN);?></a> \|
23	<a href="https://wordpress.org/support/plugin/two-factor-authentication/"><?php _e("Support", SIMBA_TFA_TEXT_DOMAIN);?></a> \|
24	<a href="http://david.dw-perspective.org.uk"><?php _e("Lead developer's homepage", SIMBA_TFA_TEXT_DOMAIN);?></a>
25	<br>
26
27	<?php
28	if (is_multisite()) {
29	if (is_super_admin()) {
30	?>
31	<p style="font-size: 120%; font-weight: bold;">
32	<?php _e('N.B. These two-factor settings apply to your entire WordPress network. (i.e. They are not localised to one particular site).', SIMBA_TFA_TEXT_DOMAIN);?>
33	</p>
34	<?php
35	} else {
36	// Should not be possible to reach this; but an extra check does not hurt.
37	die('Security check');
38	}
39	}
40	?>
41
42	<form method="post" action="options.php" style="margin-top: 12px">
43	<?php
44	settings_fields('tfa_user_roles_group');
45	?>
46	<h2><?php _e('User roles', SIMBA_TFA_TEXT_DOMAIN); ?></h2>
47	<?php _e('Choose which user roles will have two factor authentication enabled.', SIMBA_TFA_TEXT_DOMAIN); ?>
48	<p>
49	<?php
50	$simba_two_factor_authentication->tfaListUserRolesCheckboxes();
51	?></p>
52	<?php submit_button(); ?>
53	</form>
54
55	<div>
56	<hr>
57	<form method="post" action="options.php" style="margin-top: 40px">
58	<?php
59	settings_fields('tfa_xmlrpc_status_group');
60	?>
61	<h2><?php _e('XMLRPC requests', SIMBA_TFA_TEXT_DOMAIN); ?></h2>
62	<?php
63
64	echo '<p>';
65	echo __("XMLRPC is a feature within WordPress allowing other computers to talk to your WordPress install. For example, it could be used by an app on your tablet that allows you to blog directly from the app (instead of needing the WordPress dashboard).");
66
67	echo '<p></p>';
68
69	echo __("Unfortunately, XMLRPC also provides a way for attackers to perform actions on your WordPress site, using only a password (i.e. without a two-factor password). More unfortunately, authors of legitimate programmes using XMLRPC have not yet added two-factor support to their code.", SIMBA_TFA_TEXT_DOMAIN);
70
71	echo '<p></p>';
72
73	echo __(" i.e. XMLRPC requests coming in to WordPress (whether from a legitimate app, or from an attacker) can only be verified using the password - not with a two-factor code. As a result, there not be an ideal option to pick below. You may have to choose between the convenience of using your apps, or the security of two factor authentication.", SIMBA_TFA_TEXT_DOMAIN);
74
75	echo '</p>';
76	?>
77	<p>
78	<?php
79	$simba_two_factor_authentication->tfaListXMLRPCStatusRadios();
80	?></p>
81	<?php submit_button(); ?>
82	</form>
83	</div>
84
85	<hr>
86	<form method="post" action="options.php" style="margin-top: 40px">
87	<?php
88	settings_fields('simba_tfa_default_hmac_group');
89	?>
90	<h2><?php _e('Default algorithm', SIMBA_TFA_TEXT_DOMAIN); ?></h2>
91	<?php _e('Your users can change this in their own settings if they want.', SIMBA_TFA_TEXT_DOMAIN); ?>
92	<p>
93	<?php
94	$simba_two_factor_authentication->tfaListDefaultHMACRadios();
95	?></p>
96	<?php submit_button(); ?>
97	</form>
98	<hr>
99	<br><br>
100	<h2><?php _e('Change user settings', SIMBA_TFA_TEXT_DOMAIN); ?></h2>
101	<p>
102	<?php _e("If some of your users lose their two-factor device and don't have access to their emergency codes, you can reset their settings by switching to their account.", SIMBA_TFA_TEXT_DOMAIN); ?>
103
104	<a href="https://wordpress.org/plugins/user-switching/"><?php _e('This plugin provides one way to do that.', SIMBA_TFA_TEXT_DOMAIN); ?></a>
105
106	<br>
107	<p>
108	<?php
109
110	// Disabled
111	if (1==0) {
112	//List users and type of tfa
113	foreach($wp_roles->role_names as $id => $name)
114	{
115	$setting = $simba_two_factor_authentication->get_option('tfa_'.$id);
116	$setting = $setting === false \|\| $setting ? 1 : 0;
117	if(!$setting)
118	continue;
119
120	$users_q = new WP_User_Query( array(
121	'role' => $name
122	));
123	$users = $users_q->get_results();
124
125	if(!$users)
126	continue;
127
128	print '<h3>'.$name.'s</h3>';
129
130	foreach( $users as $user )
131	{
132	$userdata = get_userdata( $user->ID );
133	$tfa_type = get_user_meta($user->ID, 'simbatfa_delivery_type', true);
134	print '<span style="font-size: 1.2em">'.esc_attr( $userdata->user_nicename ).'</span>';
135	if(!$tfa_type)
136	print ' - '.__('Default', SIMBA_TFA_TEXT_DOMAIN);
137	else
138	print ' - <a class="button" href="'.add_query_arg(array('tfa_change_to_email' => 1, 'tfa_user_id' => $user->ID)).'">'.__('Change to email', SIMBA_TFA_TEXT_DOMAIN).'</a>';
139	print '<br>';
140	}
141	}
142	}
143
144	?>
145	</p>
146	<hr>
147	<h2><?php _e('Translations', SIMBA_TFA_TEXT_DOMAIN); ?></h2>
148	<p>
149	<?php _e("If you translate this plugin, please send the translations .po-file to us so we can include it in future releases - paste a link in the plugin's support forum.", SIMBA_TFA_TEXT_DOMAIN); ?>
150	<br>
151	</p>
152
153	</div>
154	</div>