← All changes | two-factor-login.php +16 -53 1.2.10 → 1.2.6 View file →

		@@ -4,9 +4,9 @@
4	4	Plugin URI: https://www.simbahosting.co.uk/s3/product/two-factor-authentication/
5	5	Description: Secure your WordPress login forms with two factor authentication - including WooCommerce login forms
6	6	Author: David Nutbourne + David Anderson, original plugin by Oskar Hane
7	7	Author URI: https://www.simbahosting.co.uk
8		-Version: 1.2.10
	8	+Version: 1.2.6
9	9	License: GPLv2 or later
10	10	*/
11	11
12	12	define('SIMBA_TFA_TEXT_DOMAIN', 'two-factor-authentication');
		@@ -14,9 +14,9 @@
14	14	define('SIMBA_TFA_PLUGIN_URL', plugins_url('', __FILE__));
15	15
16	16	class Simba_Two_Factor_Authentication {
17	17
18		- public $version = '1.2.10';
	18	+ public $version = '1.2.6';
19	19	private $php_required = '5.3';
20	20
21	21	private $frontend;
22	22
		@@ -26,10 +26,10 @@
26	26	add_action('all_admin_notices', array($this, 'admin_notice_insufficient_php'));
27	27	$abort = true;
28	28	}
29	29
30		- if (!function_exists('mcrypt_get_iv_size') && !function_exists('openssl_cipher_iv_length')) {
31		- add_action('all_admin_notices', array($this, 'admin_notice_missing_mcrypt_and_openssl'));
	30	+ if (!function_exists('mcrypt_get_iv_size')) {
	31	+ add_action('all_admin_notices', array($this, 'admin_notice_missing_mcrypt'));
32	32	$abort = true;
33	33	}
34	34
35	35	if (!empty($abort)) return;
		@@ -43,13 +43,8 @@
43	43	add_action('woocommerce_before_customer_login_form', array($this, 'woocommerce_before_customer_login_form'));
44	44	// The login form on the checkout doesn't call the woocommerce_before_customer_login_form action
45	45	add_action('woocommerce_before_checkout_form', array($this, 'woocommerce_before_customer_login_form'));
46	46
47		- add_action('affwp_login_fields_before', array($this, 'affwp_login_fields_before'));
48		- if (!defined('TWO_FACTOR_DISABLE') || !TWO_FACTOR_DISABLE) {
49		- add_action('affwp_process_login_form', array($this, 'affwp_process_login_form'));
50		- }
51		-
52	47	if (is_admin()) {
53	48	//Save settings
54	49	add_action('admin_init', array($this, 'check_possible_reset'));
55	50
		@@ -140,10 +135,10 @@
140	135	public function admin_notice_insufficient_php() {
141	136	$this->show_admin_warning('<strong>'.__('Higher PHP version required', 'updraftplus').'</strong><br> '.sprintf(__('The Two Factor Authentication plugin requires PHP version %s or higher - your current version is only %s.', SIMBA_TFA_TEXT_DOMAIN), $this->php_required, PHP_VERSION), 'error');
142	137	}
143	138
144		- public function admin_notice_missing_mcrypt_and_openssl() {
145		- $this->show_admin_warning('<strong>'.__('PHP OpenSSL or mcrypt module required', 'updraftplus').'</strong><br> '.__('The Two Factor Authentication plugin requires either the PHP openssl (preferred) or mcrypt module to be installed. Please ask your web hosting company to install one of them.', SIMBA_TFA_TEXT_DOMAIN), 'error');
	139	+ public function admin_notice_missing_mcrypt() {
	140	+ $this->show_admin_warning('<strong>'.__('PHP Mcrypt module required', 'updraftplus').'</strong><br> '.__('The Two Factor Authentication plugin requires the PHP mcrypt module to be installed. Please ask your web hosting company to install it.', SIMBA_TFA_TEXT_DOMAIN), 'error');
146	141	}
147	142
148	143	public function show_admin_warning($message, $class = "updated") {
149	144	echo '<div class="tfamessage '.$class.'">'."<p>$message</p></div>";
		@@ -209,16 +204,18 @@
209	204
210	205	// Here's where the login action happens. Called on the 'authenticate' action.
211	206	public function tfaVerifyCodeAndUser($user, $username, $password) {
212	207
	208	+ $tfa = $this->getTFA();
	209	+
213	210	if (is_wp_error($user)) return $user;
214	211
215		- $tfa = $this->getTFA();
216	212	$params = $_POST;
217	213	$params['log'] = $username;
218	214	$params['caller'] = $_SERVER['PHP_SELF'] ? $_SERVER['PHP_SELF'] : $_SERVER['REQUEST_URI'];
219	215
220	216	$code_ok = $tfa->authUserFromLogin($params);
	217	+
221	218	if (is_wp_error($code_ok)) return $code_ok;
222	219
223	220	if (!$code_ok) return new WP_Error('authentication_failed', '<strong>'.__('Error:', SIMBA_TFA_TEXT_DOMAIN).'</strong> '.__('The one-time password (TFA code) you entered was incorrect.', SIMBA_TFA_TEXT_DOMAIN));
224	221
		@@ -225,10 +222,11 @@
225	222	if ($user) return $user;
226	223
227	224	return wp_authenticate_username_password(null, $username, $password);
228	225	}
229		-
230		- public function tfaRegisterTwoFactorAuthSettings() {
	226	+
	227	+ public function tfaRegisterTwoFactorAuthSettings()
	228	+ {
231	229	global $wp_roles;
232	230	if (!isset($wp_roles))
233	231	$wp_roles = new WP_Roles();
234	232
		@@ -358,10 +356,8 @@
358	356	public function admin_menu()
359	357	{
360	358	$tfa = $this->getTFA();
361	359
362		- $tfa->potentially_port_private_keys();
363		-
364	360	global $current_user;
365	361	if(!$tfa->isActivatedForUser($current_user->ID)) return;
366	362	add_menu_page(__('Two Factor Authentication', SIMBA_TFA_TEXT_DOMAIN), __('Two Factor Auth', SIMBA_TFA_TEXT_DOMAIN), 'read', 'two-factor-auth-user', array($this, 'tfaShowUserSettingsPage'), SIMBA_TFA_PLUGIN_URL.'/img/tfa_admin_icon_16x16.png', 72);
367	363	}
		@@ -519,9 +515,9 @@
519	515
520	516	$tfa_priv_key_64 = get_user_meta($user_id, 'tfa_priv_key_64', true);
521	517	if(!$tfa_priv_key_64) $tfa_priv_key_64 = $tfa->addPrivateKey($user_id);
522	518
523		- $tfa_priv_key = trim($tfa->getPrivateKeyPlain($tfa_priv_key_64, $user_id), "\x00..\x1F");
	519	+ $tfa_priv_key = trim($tfa->getPrivateKeyPlain($tfa_priv_key_64, $user_id));
524	520
525	521	$tfa_priv_key_32 = Base32::encode($tfa_priv_key);
526	522
527	523	if ('full' == $type) {
		@@ -577,9 +573,9 @@
577	573	$tfa_priv_key_64 = get_user_meta($user_id, 'tfa_priv_key_64', true);
578	574
579	575	if(!$tfa_priv_key_64) $tfa_priv_key_64 = $tfa->addPrivateKey($user_id);
580	576
581		- $tfa_priv_key = trim($tfa->getPrivateKeyPlain($tfa_priv_key_64, $user_id), "\x00..\x1F");
	577	+ $tfa_priv_key = trim($tfa->getPrivateKeyPlain($tfa_priv_key_64, $user_id));
582	578
583	579	$tfa_priv_key_32 = Base32::encode($tfa_priv_key);
584	580
585	581	$algorithm_type = $tfa->getUserAlgorithm($user_id);
		@@ -812,40 +808,12 @@
812	808	public function shortcode_when_not_logged_in() {
813	809	return '';
814	810	}
815	811
816		- // Affiliate-WP login form
817		- public function affwp_login_fields_before() {
818		- $this->before_login_form_generic();
819		- }
820		-
821		- public function affwp_process_login_form() {
822		- if (!function_exists('affiliate_wp')) return;
823		- $affiliate_wp = affiliate_wp();
824		- $login = $affiliate_wp->login;
825		-
826		- $tfa = $this->getTFA();
827		- $params = array(
828		- 'log' => (string)$_POST['affwp_user_login'],
829		- 'caller'=> $_SERVER['PHP_SELF'] ? $_SERVER['PHP_SELF'] : $_SERVER['REQUEST_URI'],
830		- 'two_factor_code' => (string)$_POST['two_factor_code']
831		- );
832		- $code_ok = $tfa->authUserFromLogin($params);
833		- if (is_wp_error($code_ok)) {
834		- $login->add_error($code_ok->get_error_code, $code_ok->get_error_message());
835		- } elseif (!$code_ok) {
836		- $login->add_error('authentication_failed', __('Error:', SIMBA_TFA_TEXT_DOMAIN).' '.__('The one-time password (TFA code) you entered was incorrect.', SIMBA_TFA_TEXT_DOMAIN));
837		- }
838		-
839		- }
840		-
841		- // Shared by some 3rd-party login forms
842		- // For historical reasons there are references to WooCommerce in this code - left for the sake of not fixing what was not broken
843		- private function before_login_form_generic() {
844		-
	812	+ // WooCommerce login form
	813	+ public function woocommerce_before_customer_login_form() {
845	814	$script_ver = (defined('WP_DEBUG') && WP_DEBUG) ? time() : $this->version;
846	815	wp_enqueue_script( 'tfa-wc-ajax-request', SIMBA_TFA_PLUGIN_URL.'/includes/wooextend.js', array('jquery'), $script_ver);
847		-
848	816	$localize = array(
849	817	'ajaxurl' => admin_url('admin-ajax.php'),
850	818	'click_to_enter_otp' => __("Enter One Time Password (if you have one)", SIMBA_TFA_TEXT_DOMAIN),
851	819	'enter_username_first' => __('You have to enter a username first.', SIMBA_TFA_TEXT_DOMAIN),
		@@ -860,13 +828,8 @@
860	828	$localize['spinnerimg'] = includes_url('images/spinner.gif');
861	829	}
862	830
863	831	wp_localize_script( 'tfa-wc-ajax-request', 'simbatfa_wc_settings', $localize);
864		- }
865		-
866		- // WooCommerce login form
867		- public function woocommerce_before_customer_login_form() {
868		- $this->before_login_form_generic();
869	832	}
870	833
871	834	}
872	835