| 1 |
<?php |
| 2 |
if (!defined('ABSPATH')) die('Access denied.'); |
| 3 |
|
| 4 |
class Simba_TFA_Frontend { |
| 5 |
|
| 6 |
private $mother; |
| 7 |
|
| 8 |
/** |
| 9 |
* Class constructor |
| 10 |
* |
| 11 |
* @param Object $mother |
| 12 |
*/ |
| 13 |
public function __construct($mother) { |
| 14 |
|
| 15 |
$this->mother = $mother; |
| 16 |
add_action('wp_ajax_tfa_frontend', array($this, 'ajax')); |
| 17 |
add_shortcode('twofactor_user_settings', array($this, 'tfa_user_settings_front')); |
| 18 |
|
| 19 |
if (!WP_Block_Type_Registry::get_instance()->is_registered('twofactor/user-settings')) { |
| 20 |
register_block_type('twofactor/user-settings', array( |
| 21 |
'editor_script' => 'twofactor-gutenberg-blocks', |
| 22 |
'render_callback' => array($this, 'tfa_user_settings_front'), |
| 23 |
)); |
| 24 |
} |
| 25 |
} |
| 26 |
|
| 27 |
/** |
| 28 |
* Runs upon the WP action wp_ajax_tfa_frontend |
| 29 |
* |
| 30 |
* @uses die() |
| 31 |
*/ |
| 32 |
public function ajax() { |
| 33 |
$totp_controller = $this->mother->get_controller('totp'); |
| 34 |
global $current_user; |
| 35 |
|
| 36 |
$return_array = array(); |
| 37 |
|
| 38 |
if (empty($_POST) || empty($_POST['subaction']) || !isset($_POST['nonce']) || !is_user_logged_in() || !wp_verify_nonce($_POST['nonce'], 'tfa_frontend_nonce')) die('Security check'); |
| 39 |
|
| 40 |
if ('savesettings' == $_POST['subaction']) { |
| 41 |
if (empty($_POST['settings']) || !is_string($_POST['settings'])) die; |
| 42 |
|
| 43 |
parse_str(stripslashes($_POST['settings']), $posted_settings); |
| 44 |
|
| 45 |
if (isset($posted_settings['tfa_algorithm_type'])) { |
| 46 |
$old_algorithm = $totp_controller->get_user_otp_algorithm($current_user->ID); |
| 47 |
|
| 48 |
if ($old_algorithm != $posted_settings['tfa_algorithm_type']) |
| 49 |
$totp_controller->changeUserAlgorithmTo($current_user->ID, $posted_settings['tfa_algorithm_type']); |
| 50 |
|
| 51 |
//Re-fetch the algorithm type, url and private string |
| 52 |
$variables = $this->tfa_fetch_assort_vars(); |
| 53 |
|
| 54 |
$return_array['qr'] = $totp_controller->tfa_qr_code_url($variables['algorithm_type'], $variables['url'], $variables['tfa_priv_key']); |
| 55 |
$return_array['al_type_disp'] = $this->tfa_algorithm_info($variables['algorithm_type']); |
| 56 |
} |
| 57 |
|
| 58 |
if (isset($posted_settings['tfa_enable_tfa'])) { |
| 59 |
|
| 60 |
$allow_enable_or_disable = false; |
| 61 |
|
| 62 |
if (empty($posted_settings['require_current']) || !$posted_settings['tfa_enable_tfa']) { |
| 63 |
$allow_enable_or_disable = true; |
| 64 |
} else { |
| 65 |
|
| 66 |
if (!isset($posted_settings['tfa_enable_current']) || '' == $posted_settings['tfa_enable_current']) { |
| 67 |
$return_array['message'] = __('To enable TFA, you must enter the current code.', 'two-factor-authentication'); |
| 68 |
$return_array['error'] = 'code_absent'; |
| 69 |
} else { |
| 70 |
// Third parameter: don't allow emergency codes |
| 71 |
if ($totp_controller->check_code_for_user($current_user->ID, $posted_settings['tfa_enable_current'], false)) { |
| 72 |
$allow_enable_or_disable = true; |
| 73 |
} else { |
| 74 |
$return_array['error'] = 'code_wrong'; |
| 75 |
$return_array['message'] = apply_filters('simba_tfa_message_code_incorrect', __('The TFA code you entered was incorrect.', 'two-factor-authentication')); |
| 76 |
} |
| 77 |
} |
| 78 |
|
| 79 |
} |
| 80 |
|
| 81 |
if ($allow_enable_or_disable) $this->mother->change_tfa_enabled_status($current_user->ID, $posted_settings['tfa_enable_tfa']); |
| 82 |
} |
| 83 |
|
| 84 |
$return_array['result'] = 'saved'; |
| 85 |
|
| 86 |
echo json_encode($return_array); |
| 87 |
} |
| 88 |
|
| 89 |
die; |
| 90 |
} |
| 91 |
|
| 92 |
/** |
| 93 |
* Make the algorithm information string easier to update |
| 94 |
* |
| 95 |
* @param String $algorithm_type - totp|hotp |
| 96 |
*/ |
| 97 |
public function tfa_algorithm_info($algorithm_type) { |
| 98 |
$al_type_disp = strtoupper($algorithm_type); |
| 99 |
$al_type_desc = ($algorithm_type == 'totp' ? __('a time based', 'two-factor-authentication') : __('an event based', 'two-factor-authentication')); |
| 100 |
|
| 101 |
return array('disp' => $al_type_disp, 'desc' => $al_type_desc); |
| 102 |
} |
| 103 |
|
| 104 |
/** |
| 105 |
* Make the assorted required variables more accessible for ajax |
| 106 |
* |
| 107 |
* Returns: Site URL, private key, emergency codes, algorithm type |
| 108 |
* |
| 109 |
* @return Array |
| 110 |
*/ |
| 111 |
public function tfa_fetch_assort_vars() { |
| 112 |
global $current_user; |
| 113 |
$totp_controller = $this->mother->get_controller('totp'); |
| 114 |
|
| 115 |
$url = preg_replace('/^https?:\/\//i', '', site_url()); |
| 116 |
|
| 117 |
$tfa_priv_key_64 = get_user_meta($current_user->ID, 'tfa_priv_key_64', true); |
| 118 |
|
| 119 |
if (!$tfa_priv_key_64) $tfa_priv_key_64 = $totp_controller->addPrivateKey($current_user->ID); |
| 120 |
|
| 121 |
$tfa_priv_key = trim($totp_controller->getPrivateKeyPlain($tfa_priv_key_64, $current_user->ID)); |
| 122 |
|
| 123 |
$algorithm_type = $totp_controller->get_user_otp_algorithm($current_user->ID); |
| 124 |
|
| 125 |
return apply_filters('simba_tfa_fetch_assort_vars', array( |
| 126 |
'url' => $url, |
| 127 |
'tfa_priv_key_64' => $tfa_priv_key_64, |
| 128 |
'tfa_priv_key' => $tfa_priv_key, |
| 129 |
'emergency_str' => '<em>'.__('No emergency codes left. Sorry.', 'two-factor-authentication').'</em>', |
| 130 |
'algorithm_type' => $algorithm_type |
| 131 |
), $totp_controller, $current_user); |
| 132 |
} |
| 133 |
|
| 134 |
/** |
| 135 |
* Paints out the 'save settings' button |
| 136 |
*/ |
| 137 |
public function save_settings_button() { |
| 138 |
echo '<button style="margin-left: 4px;margin-bottom: 10px" class="simbatfa_settings_save button button-primary">'.__('Save Settings', 'two-factor-authentication').'</button>'; |
| 139 |
} |
| 140 |
|
| 141 |
/** |
| 142 |
* Paint output for the TFA on/off radio |
| 143 |
* |
| 144 |
* @param String $style - valid values are 'show_current' and 'require_current' |
| 145 |
*/ |
| 146 |
public function settings_enable_or_disable_output($style = 'show_current') { |
| 147 |
$this->save_settings_javascript_output(); |
| 148 |
global $current_user; |
| 149 |
?> |
| 150 |
<div class="simbatfa_frontend_settings_box tfa_settings_form"> |
| 151 |
<p><?php $this->mother->paint_enable_tfa_radios($current_user->ID, true, $style); ?></p> |
| 152 |
<button style="margin-left: 4px; margin-bottom: 10px;" class="button button-primary simbatfa_settings_save"><?php _e('Save Settings', 'two-factor-authentication'); ?></button> |
| 153 |
</div> |
| 154 |
<?php |
| 155 |
} |
| 156 |
|
| 157 |
/** |
| 158 |
* Enqueue scripts |
| 159 |
*/ |
| 160 |
public function save_settings_javascript_output() { |
| 161 |
|
| 162 |
static $is_already_added = false; |
| 163 |
if ($is_already_added) return; |
| 164 |
$is_already_added = true; |
| 165 |
|
| 166 |
$suffix = defined('SCRIPT_DEBUG') && SCRIPT_DEBUG ? '' : '.min'; |
| 167 |
wp_register_script('jquery-blockui', $this->mother->includes_url().'/jquery.blockUI' . $suffix . '.js', array('jquery'), '2.60'); |
| 168 |
|
| 169 |
$script_ver = (defined('WP_DEBUG') && WP_DEBUG) ? time() : filemtime($this->mother->includes_dir().'/frontend-settings.js'); |
| 170 |
|
| 171 |
wp_enqueue_script('simba-tfa-frontend-settings', $this->mother->includes_url().'/frontend-settings.js', array('jquery-blockui'), $script_ver); |
| 172 |
|
| 173 |
$ajax_url = admin_url('admin-ajax.php'); |
| 174 |
// It's possible that FORCE_ADMIN_SSL will make that SSL, whilst the user is on the front-end having logged in over non-SSL - and as a result, their login cookies won't get sent, and they're not registered as logged in. |
| 175 |
if (!is_admin() && substr(strtolower($ajax_url), 0, 6) == 'https:' && !is_ssl()) { |
| 176 |
$also_try = 'http:'.substr($ajax_url, 6); |
| 177 |
} else { |
| 178 |
$also_try = ''; |
| 179 |
} |
| 180 |
|
| 181 |
$localize = array( |
| 182 |
'ask' => __('You have unsaved settings.', 'two-factor-authentication'), |
| 183 |
'saving' => __('Saving...', 'two-factor-authentication'), |
| 184 |
'ajax_url' => $ajax_url, |
| 185 |
'also_try' => $also_try, |
| 186 |
'nonce' => wp_create_nonce('tfa_frontend_nonce'), |
| 187 |
'response' => __('Response:', 'two-factor-authentication'), |
| 188 |
); |
| 189 |
|
| 190 |
wp_localize_script('simba-tfa-frontend-settings', 'simba_tfa_frontend', $localize); |
| 191 |
|
| 192 |
} |
| 193 |
|
| 194 |
/** |
| 195 |
* Shortcode function for twofactor_user_settings |
| 196 |
* |
| 197 |
* @param Array $atts - shortcode attributes |
| 198 |
* |
| 199 |
* @return String |
| 200 |
*/ |
| 201 |
public function tfa_user_settings_front($atts = array()) { |
| 202 |
|
| 203 |
if (!is_user_logged_in()) return ''; |
| 204 |
|
| 205 |
$atts = array_change_key_case((array)$atts, CASE_LOWER); |
| 206 |
|
| 207 |
$atts = shortcode_atts(array('show_algorithm_selector' => 'no'), $atts); |
| 208 |
|
| 209 |
$show_algorithm_selector = ('yes' === $atts['show_algorithm_selector']); |
| 210 |
|
| 211 |
global $current_user; |
| 212 |
|
| 213 |
return $this->mother->include_template('shortcode-tfa-user-settings.php', array('is_activated_for_user' => $current_user->ID, 'tfa_frontend' => $this, 'show_algorithm_selector' => $show_algorithm_selector), true); |
| 214 |
|
| 215 |
} |
| 216 |
} |
| 217 |
|
