| @@ -102,26 +102,27 @@ | ||
| 102 | 102 | $processed = true; |
| 103 | 103 | } |
| 104 | 104 | |
| 105 | 105 | if ( $processed ) { |
| 106 | + | |
| 106 | 107 | if ( is_wp_error( $errors ) ) { |
| 107 | - aui()->alert( | |
| 108 | - array( | |
| 109 | - 'type' => 'error', | |
| 110 | - 'content' => wp_kses_post( $errors->get_error_message() ) | |
| 111 | - ), | |
| 112 | - true | |
| 113 | - ); | |
| 114 | - } else if ( $redirect ) { | |
| 108 | + echo aui()->alert( | |
| 109 | + array( // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped | |
| 110 | + 'type' => 'error', | |
| 111 | + 'class' => 'text-center', | |
| 112 | + 'content' => wp_kses_post( $errors->get_error_message() ), | |
| 113 | + ) | |
| 114 | + ); | |
| 115 | + } elseif ( $redirect ) { | |
| 115 | 116 | wp_safe_redirect( $redirect ); |
| 116 | 117 | exit(); |
| 117 | - } else { | |
| 118 | - aui()->alert( | |
| 119 | - array( | |
| 120 | - 'type' => 'success', | |
| 121 | - 'content' => wp_kses_post( $message ) | |
| 122 | - ), | |
| 123 | - true | |
| 118 | + } else { | |
| 119 | + echo aui()->alert( | |
| 120 | + array( // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped | |
| 121 | + 'type' => 'success', | |
| 122 | + 'class' => 'text-center', | |
| 123 | + 'content' => wp_kses_post( $message ), | |
| 124 | + ) | |
| 124 | 125 | ); |
| 125 | 126 | } |
| 126 | 127 | } |
| 127 | 128 | |
| @@ -195,9 +196,8 @@ | ||
| 195 | 196 | * @since 1.0.0 |
| 196 | 197 | */ |
| 197 | 198 | public function process_image_crop( $data = array(), $type = 'avatar', $unlink_prev_img = false ) { |
| 198 | 199 | global $wpdb; |
| 199 | - | |
| 200 | 200 | if ( ! is_user_logged_in() ) { |
| 201 | 201 | return false; |
| 202 | 202 | } |
| 203 | 203 | |
| @@ -204,29 +204,8 @@ | ||
| 204 | 204 | if ( empty( $_POST['uwp_crop_nonce'] ) || ! wp_verify_nonce( $_POST['uwp_crop_nonce'], 'uwp_crop_nonce_' . $type ) ) { |
| 205 | 205 | return; |
| 206 | 206 | } |
| 207 | 207 | |
| 208 | - $image_url = ! empty( $data['uwp_crop'] ) ? esc_url( $data['uwp_crop'] ) : ''; | |
| 209 | - | |
| 210 | - if ( empty( $image_url ) ) { | |
| 211 | - return new WP_Error( 'empty_image', __( 'Upload valid image.', 'userswp' ) ); | |
| 212 | - } | |
| 213 | - | |
| 214 | - // Ensure we have a valid URL with an allowed meme type. | |
| 215 | - $image_url = $this->normalize_url( $image_url ); | |
| 216 | - | |
| 217 | - $content_url = str_replace( array( 'https://', 'http://' ) , '', untrailingslashit( WP_CONTENT_URL ) ); | |
| 218 | - $_image_url = str_replace( array( 'https://', 'http://' ), '', $image_url ); | |
| 219 | - if ( strpos( $_image_url, $content_url ) !== 0 ) { | |
| 220 | - return new WP_Error( 'invalid_image', __( 'Invalid image url.', 'userswp' ) ); | |
| 221 | - } | |
| 222 | - | |
| 223 | - $filetype = wp_check_filetype( $image_url ); | |
| 224 | - | |
| 225 | - if ( empty( $filetype['ext'] ) ) { | |
| 226 | - return new WP_Error( 'invalid_image', __( 'Invalid image type.', 'userswp' ) ); | |
| 227 | - } | |
| 228 | - | |
| 229 | 208 | // If is current user's profile (profile.php) |
| 230 | 209 | if ( is_admin() && defined( 'IS_PROFILE_PAGE' ) && IS_PROFILE_PAGE ) { |
| 231 | 210 | $user_id = get_current_user_id(); |
| 232 | 211 | // If is another user's profile page |
| @@ -236,8 +215,21 @@ | ||
| 236 | 215 | } else { |
| 237 | 216 | $user_id = get_current_user_id(); |
| 238 | 217 | } |
| 239 | 218 | |
| 219 | + // Ensure we have a valid URL with an allowed meme type. | |
| 220 | + $image_url = $this->normalize_url( esc_url( $data['uwp_crop'] ) ); | |
| 221 | + $filetype = wp_check_filetype( $image_url ); | |
| 222 | + | |
| 223 | + $errors = new WP_Error(); | |
| 224 | + if ( empty( $image_url ) || empty( $filetype['ext'] ) ) { | |
| 225 | + $errors->add( 'something_wrong', __( 'Something went wrong. Please contact site admin.', 'userswp' ) ); | |
| 226 | + } | |
| 227 | + | |
| 228 | + if ( $errors->has_errors() ) { | |
| 229 | + return $errors; | |
| 230 | + } | |
| 231 | + | |
| 240 | 232 | // Retrieve current thumbnail. |
| 241 | 233 | $current_field = 'avatar' === $type ? 'avatar_thumb' : 'banner_thumb'; |
| 242 | 234 | $current_thumbnail = $this->normalize_url( uwp_get_usermeta( $user_id, $current_field, '' ) ); |
| 243 | 235 | $thumb_postfix = '_uwp_' . $type . '_thumb'; |
| @@ -260,14 +252,13 @@ | ||
| 260 | 252 | $ext = $filetype['ext']; // to get extension |
| 261 | 253 | $name = sanitize_file_name( pathinfo( $image_path, PATHINFO_FILENAME ) ); //file name without extension |
| 262 | 254 | $thumb_image_name = $name . $thumb_postfix . '.' . $ext; |
| 263 | 255 | $thumb_image_location = str_replace( $name . '.' . $ext, $thumb_image_name, $image_path ); |
| 264 | - | |
| 265 | 256 | //Get the new coordinates to crop the image. |
| 266 | - $x = $data['uwpx']; | |
| 267 | - $y = $data['uwpy']; | |
| 268 | - $w = $data['uwpw']; | |
| 269 | - $h = $data['uwph']; | |
| 257 | + $x = $data['x']; | |
| 258 | + $y = $data['y']; | |
| 259 | + $w = $data['w']; | |
| 260 | + $h = $data['h']; | |
| 270 | 261 | //Scale the image based on cropped width setting |
| 271 | 262 | $scale = $full_width / $w; |
| 272 | 263 | //$scale = 1; // no scaling |
| 273 | 264 | |
| @@ -327,11 +318,8 @@ | ||
| 327 | 318 | * |
| 328 | 319 | */ |
| 329 | 320 | public function normalize_url( $url ) { |
| 330 | 321 | |
| 331 | - if ( empty( $url ) ) { | |
| 332 | - return ''; | |
| 333 | - } | |
| 334 | 322 | // Normalize. |
| 335 | 323 | $url = wp_normalize_path( $url ); |
| 336 | 324 | |
| 337 | 325 | // Remove query vars. |
| @@ -360,20 +348,22 @@ | ||
| 360 | 348 | if ( ! is_user_logged_in() ) { |
| 361 | 349 | return false; |
| 362 | 350 | } |
| 363 | 351 | |
| 352 | + if ( empty( $_POST['uwp_reset_nonce'] ) || ! wp_verify_nonce( $_POST['uwp_reset_nonce'], 'uwp_reset_nonce_' . $type ) ) { | |
| 353 | + return; | |
| 354 | + } | |
| 355 | + | |
| 364 | 356 | if ( is_admin() && defined( 'IS_PROFILE_PAGE' ) && IS_PROFILE_PAGE ) { |
| 365 | 357 | $user_id = get_current_user_id(); |
| 366 | - } elseif ( is_admin() && current_user_can( 'manage_options' ) && ! empty( $_GET['user_id'] ) && is_numeric( $_GET['user_id'] ) ) { | |
| 358 | + // If is another user's profile page | |
| 359 | + } elseif ( is_admin() && ! empty( $_GET['user_id'] ) && is_numeric( $_GET['user_id'] ) ) { | |
| 367 | 360 | $user_id = absint( $_GET['user_id'] ); |
| 361 | + // Otherwise something is wrong. | |
| 368 | 362 | } else { |
| 369 | 363 | $user_id = get_current_user_id(); |
| 370 | 364 | } |
| 371 | 365 | |
| 372 | - if ( empty( $_POST['uwp_reset_nonce'] ) || ! wp_verify_nonce( $_POST['uwp_reset_nonce'], 'uwp_reset_nonce_' . $type . '_' . $user_id ) ) { | |
| 373 | - return; | |
| 374 | - } | |
| 375 | - | |
| 376 | 366 | $errors = new WP_Error(); |
| 377 | 367 | if ( empty( $user_id ) ) { |
| 378 | 368 | $errors->add( 'something_wrong', __( 'Something went wrong. Please try again.', 'userswp' ) ); |
| 379 | 369 | } |
| @@ -477,10 +467,10 @@ | ||
| 477 | 467 | } |
| 478 | 468 | } elseif ( ! empty( $notice ) ) { |
| 479 | 469 | echo wp_kses_post( $notice ); |
| 480 | 470 | } |
| 481 | - } | |
| 482 | - } | |
| 471 | +} | |
| 472 | +} | |
| 483 | 473 | |
| 484 | 474 | if ( $type == 'change' ) { |
| 485 | 475 | $user_id = get_current_user_id(); |
| 486 | 476 | $password_nag = get_user_option( 'default_password_nag', $user_id ); |
| @@ -533,15 +523,9 @@ | ||
| 533 | 523 | if ( isset( $data['uwp_register_hp'] ) && '' != $data['uwp_register_hp'] ) { |
| 534 | 524 | wp_die( esc_html__( 'No spam please!', 'userswp' ) ); |
| 535 | 525 | } |
| 536 | 526 | |
| 537 | - $form_id = 1; | |
| 538 | - | |
| 539 | - if ( ! empty( $data['uwp_register_form_id'] ) ) { | |
| 540 | - $form_id = (int) $data['uwp_register_form_id']; | |
| 541 | - } | |
| 542 | - | |
| 543 | - if ( ! isset( $data['uwp_register_nonce'] ) || ! wp_verify_nonce( $data['uwp_register_nonce'], 'uwp-register-nonce-' . $form_id ) ) { | |
| 527 | + if ( ! isset( $data['uwp_register_nonce'] ) || ! wp_verify_nonce( $data['uwp_register_nonce'], 'uwp-register-nonce' ) ) { | |
| 544 | 528 | $message = aui()->alert( |
| 545 | 529 | array( |
| 546 | 530 | 'type' => 'error', |
| 547 | 531 | 'content' => __( 'Security verification failed. Try again.', 'userswp' ), |
| @@ -713,8 +697,14 @@ | ||
| 713 | 697 | 'last_name' => esc_attr( $last_name ), |
| 714 | 698 | 'user_url' => esc_url_raw( $user_url ), |
| 715 | 699 | ); |
| 716 | 700 | |
| 701 | + $form_id = 1; | |
| 702 | + | |
| 703 | + if ( ! empty( $data['uwp_register_form_id'] ) ) { | |
| 704 | + $form_id = (int) $data['uwp_register_form_id']; | |
| 705 | + } | |
| 706 | + | |
| 717 | 707 | // Set user role by form. |
| 718 | 708 | $user_role = uwp_get_register_form_by( $form_id, 'user_role' ); |
| 719 | 709 | |
| 720 | 710 | if ( ! empty( $user_role ) ) { |
| @@ -1175,11 +1165,8 @@ | ||
| 1175 | 1165 | global $wp2fa; |
| 1176 | 1166 | if ( wp_doing_ajax() && isset( $wp2fa ) && ! empty( $wp2fa ) ) { |
| 1177 | 1167 | remove_action( 'wp_login', array( $wp2fa->login, 'wp_login' ), 20 ); |
| 1178 | 1168 | } |
| 1179 | - if ( wp_doing_ajax() && class_exists( '\WP2FA\Authenticator\Login' ) ) { | |
| 1180 | - remove_action( 'wp_login', array( 'WP2FA\Authenticator\Login', 'wp_login' ), 20 ); | |
| 1181 | - } | |
| 1182 | 1169 | |
| 1183 | 1170 | $user = wp_signon( |
| 1184 | 1171 | array( |
| 1185 | 1172 | 'user_login' => $result['username'], |
| @@ -1188,14 +1175,10 @@ | ||
| 1188 | 1175 | ) |
| 1189 | 1176 | ); |
| 1190 | 1177 | |
| 1191 | 1178 | add_action( 'authenticate', 'gglcptch_login_check', 21, 1 ); |
| 1192 | - if ( wp_doing_ajax() && class_exists( '\WP2FA\Authenticator\Login' ) ) { | |
| 1193 | - add_action( 'wp_login', array( 'WP2FA\Authenticator\Login', 'wp_login' ), 20, 2 ); | |
| 1194 | - } | |
| 1195 | 1179 | |
| 1196 | - $wp2fa_available = ( isset( $wp2fa ) && ! empty( $wp2fa ) ) || class_exists( '\WP2FA\Authenticator\Login' ); | |
| 1197 | - if ( wp_doing_ajax() && ! is_wp_error( $user ) && $wp2fa_available ) { | |
| 1180 | + if ( wp_doing_ajax() && ! is_wp_error( $user ) && isset( $wp2fa ) && ! empty( $wp2fa ) ) { | |
| 1198 | 1181 | |
| 1199 | 1182 | $two_fa = $this->check_2fa( $user ); |
| 1200 | 1183 | if ( isset( $two_fa ) && ! empty( $two_fa ) ) { |
| 1201 | 1184 | if ( is_wp_error( $two_fa ) ) { |
| @@ -1285,12 +1268,9 @@ | ||
| 1285 | 1268 | |
| 1286 | 1269 | return $errors; |
| 1287 | 1270 | } |
| 1288 | 1271 | |
| 1289 | - $provider = $this->get_wp2fa_provider_for_user( $user ); | |
| 1290 | - if ( empty( $provider ) ) { | |
| 1291 | - return; | |
| 1292 | - } | |
| 1272 | + $provider = \WP2FA\Authenticator\Login::get_available_providers_for_user( $user ); | |
| 1293 | 1273 | |
| 1294 | 1274 | ob_start(); |
| 1295 | 1275 | ?> |
| 1296 | 1276 | |
| @@ -1341,9 +1321,9 @@ | ||
| 1341 | 1321 | echo aui()->input( |
| 1342 | 1322 | array( // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped |
| 1343 | 1323 | 'type' => 'tel', |
| 1344 | 1324 | 'id' => 'authcode', |
| 1345 | - 'name' => 'authcode', | |
| 1325 | + 'name' => 'wp-2fa-email-code', | |
| 1346 | 1326 | 'placeholder' => esc_attr__( 'Verification Code', 'userswp' ), |
| 1347 | 1327 | 'value' => '', |
| 1348 | 1328 | 'label' => esc_html__( 'Verification Code', 'userswp' ), |
| 1349 | 1329 | 'extra_attributes' => array( |
| @@ -1378,9 +1358,9 @@ | ||
| 1378 | 1358 | </form> |
| 1379 | 1359 | </div> |
| 1380 | 1360 | |
| 1381 | 1361 | <?php |
| 1382 | - $codes_remaining = $this->get_wp2fa_backup_codes_remaining( $user ); | |
| 1362 | + $codes_remaining = \WP2FA\Authenticator\Backup_Codes::codes_remaining_for_user( $user ); | |
| 1383 | 1363 | if ( isset( $codes_remaining ) && $codes_remaining > 0 ) { |
| 1384 | 1364 | ?> |
| 1385 | 1365 | <div class="uwp-2fa-methods-wrap" style="display:none;"> |
| 1386 | 1366 | <form name="validate_2fa_backup_codes_form" id="validate_2fa_backup_codes_form" |
| @@ -1436,76 +1416,9 @@ | ||
| 1436 | 1416 | |
| 1437 | 1417 | return ob_get_clean(); |
| 1438 | 1418 | } |
| 1439 | 1419 | |
| 1440 | - public function get_wp2fa_provider_for_user( $user ) { | |
| 1441 | - if ( class_exists( '\WP2FA\Authenticator\Login' ) && method_exists( '\WP2FA\Authenticator\Login', 'get_available_providers_for_user' ) ) { | |
| 1442 | - $provider = \WP2FA\Authenticator\Login::get_available_providers_for_user( $user ); | |
| 1443 | - if ( is_array( $provider ) ) { | |
| 1444 | - $provider = key( $provider ); | |
| 1445 | - } | |
| 1446 | - | |
| 1447 | - return $provider; | |
| 1448 | - } | |
| 1449 | - | |
| 1450 | - if ( class_exists( '\WP2FA\Admin\Helpers\User_Helper' ) && method_exists( '\WP2FA\Admin\Helpers\User_Helper', 'get_enabled_method_for_user' ) ) { | |
| 1451 | - return \WP2FA\Admin\Helpers\User_Helper::get_enabled_method_for_user( $user ); | |
| 1452 | - } | |
| 1453 | - | |
| 1454 | - return ''; | |
| 1455 | - } | |
| 1456 | - | |
| 1457 | - public function get_wp2fa_backup_codes_remaining( $user ) { | |
| 1458 | - if ( class_exists( '\WP2FA\Methods\Backup_Codes' ) && method_exists( '\WP2FA\Methods\Backup_Codes', 'codes_remaining_for_user' ) ) { | |
| 1459 | - return \WP2FA\Methods\Backup_Codes::codes_remaining_for_user( $user ); | |
| 1460 | - } | |
| 1461 | - | |
| 1462 | - if ( class_exists( '\WP2FA\Authenticator\Backup_Codes' ) && method_exists( '\WP2FA\Authenticator\Backup_Codes', 'codes_remaining_for_user' ) ) { | |
| 1463 | - return \WP2FA\Authenticator\Backup_Codes::codes_remaining_for_user( $user ); | |
| 1464 | - } | |
| 1465 | - | |
| 1466 | - return 0; | |
| 1467 | - } | |
| 1468 | - | |
| 1469 | - public function validate_wp2fa_totp_authentication( $user ) { | |
| 1470 | - if ( class_exists( '\WP2FA\Methods\TOTP' ) && method_exists( '\WP2FA\Methods\TOTP', 'validate_totp_authentication' ) ) { | |
| 1471 | - return \WP2FA\Methods\TOTP::validate_totp_authentication( $user ); | |
| 1472 | - } | |
| 1473 | - | |
| 1474 | - if ( class_exists( '\WP2FA\Authenticator\Login' ) && method_exists( '\WP2FA\Authenticator\Login', 'validate_totp_authentication' ) ) { | |
| 1475 | - return \WP2FA\Authenticator\Login::validate_totp_authentication( $user ); | |
| 1476 | - } | |
| 1477 | - | |
| 1478 | - return false; | |
| 1479 | - } | |
| 1480 | - | |
| 1481 | - public function validate_wp2fa_email_authentication( $user ) { | |
| 1482 | - if ( class_exists( '\WP2FA\Authenticator\Login' ) && method_exists( '\WP2FA\Authenticator\Login', 'validate_email_authentication' ) ) { | |
| 1483 | - return \WP2FA\Authenticator\Login::validate_email_authentication( $user ); | |
| 1484 | - } | |
| 1485 | - | |
| 1486 | - if ( class_exists( '\WP2FA\Authenticator\Authentication' ) && method_exists( '\WP2FA\Authenticator\Authentication', 'validate_token' ) && isset( $_REQUEST['authcode'] ) ) { | |
| 1487 | - return \WP2FA\Authenticator\Authentication::validate_token( $user, sanitize_text_field( wp_unslash( $_REQUEST['authcode'] ) ) ); | |
| 1488 | - } | |
| 1489 | - | |
| 1490 | - return false; | |
| 1491 | - } | |
| 1492 | - | |
| 1493 | - public function validate_wp2fa_backup_codes( $user ) { | |
| 1494 | - if ( class_exists( '\WP2FA\Methods\Backup_Codes' ) && method_exists( '\WP2FA\Methods\Backup_Codes', 'validate_backup_codes' ) ) { | |
| 1495 | - return \WP2FA\Methods\Backup_Codes::validate_backup_codes( $user ); | |
| 1496 | - } | |
| 1497 | - | |
| 1498 | - if ( class_exists( '\WP2FA\Authenticator\Backup_Codes' ) && method_exists( '\WP2FA\Authenticator\Backup_Codes', 'validate_backup_codes' ) ) { | |
| 1499 | - return \WP2FA\Authenticator\Backup_Codes::validate_backup_codes( $user ); | |
| 1500 | - } | |
| 1501 | - | |
| 1502 | - return false; | |
| 1503 | - } | |
| 1504 | - | |
| 1505 | 1420 | public function process_login_2fa() { |
| 1506 | - global $wp2fa; | |
| 1507 | - | |
| 1508 | 1421 | if ( ! isset( $_POST['uwp-auth-id'], $_POST['wp-auth-nonce'] ) ) { |
| 1509 | 1422 | return; |
| 1510 | 1423 | } |
| 1511 | 1424 | |
| @@ -1510,64 +1423,46 @@ | ||
| 1510 | 1423 | } |
| 1511 | 1424 | |
| 1512 | 1425 | $auth_id = (int) $_POST['uwp-auth-id']; |
| 1513 | 1426 | $user = get_userdata( $auth_id ); |
| 1514 | - | |
| 1515 | 1427 | if ( ! $user ) { |
| 1516 | 1428 | $message = aui()->alert( |
| 1517 | - array( | |
| 1429 | + array( | |
| 1518 | 1430 | 'type' => 'error', |
| 1519 | 1431 | 'content' => __( 'Invalid user data. Please try again.', 'userswp' ), |
| 1520 | - ) | |
| 1432 | + ) | |
| 1521 | 1433 | ); |
| 1522 | 1434 | |
| 1523 | 1435 | wp_send_json_error( array( 'message' => $message ) ); |
| 1524 | 1436 | } |
| 1525 | 1437 | |
| 1438 | + global $wp2fa; | |
| 1439 | + | |
| 1526 | 1440 | $nonce = ( isset( $_POST['wp-auth-nonce'] ) ) ? sanitize_textarea_field( wp_unslash( $_POST['wp-auth-nonce'] ) ) : ''; |
| 1441 | + if ( true !== \WP2FA\Authenticator\Login::verify_login_nonce( $user->ID, $nonce ) ) { | |
| 1527 | 1442 | |
| 1528 | - if ( true !== \WP2FA\Authenticator\Login::verify_login_nonce( $user->ID, $nonce ) ) { | |
| 1529 | 1443 | $message = aui()->alert( |
| 1530 | - array( | |
| 1444 | + array( | |
| 1531 | 1445 | 'type' => 'error', |
| 1532 | 1446 | 'content' => __( 'Invalid request! Please try again.', 'userswp' ), |
| 1533 | - ) | |
| 1447 | + ) | |
| 1534 | 1448 | ); |
| 1535 | 1449 | |
| 1536 | 1450 | wp_send_json_error( array( 'message' => $message ) ); |
| 1537 | 1451 | } |
| 1538 | 1452 | |
| 1539 | - if ( isset( $_POST['provider'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Missing | |
| 1540 | - $provider = sanitize_textarea_field( wp_unslash( $_POST['provider'] ) ); // phpcs:ignore WordPress.Security.NonceVerification.Missing | |
| 1541 | - } else { | |
| 1542 | - $provider = ''; | |
| 1543 | - } | |
| 1544 | - | |
| 1545 | - $error = ''; | |
| 1546 | - | |
| 1547 | - try { | |
| 1548 | - $is_enabled = \WP2FA\Admin\Controllers\Settings::is_provider_enabled_for_role( \WP2FA\Admin\Helpers\User_Helper::get_user_role( $user ), $provider ); | |
| 1549 | - | |
| 1550 | - if ( ! $is_enabled ) { | |
| 1551 | - $error = __( 'Invalid 2FA provider for user.', 'userswp' ); | |
| 1453 | + if ( isset( $_POST['provider'] ) ) { | |
| 1454 | + $provider = sanitize_textarea_field( wp_unslash( $_POST['provider'] ) ); | |
| 1455 | + $providers = \WP2FA\Authenticator\Login::get_available_providers_for_user( $user ); | |
| 1456 | + if ( isset( $providers[ $provider ] ) ) { | |
| 1457 | + $provider = $providers[ $provider ]; | |
| 1458 | + } elseif ( isset( $provider ) ) { | |
| 1459 | + $provider = $provider; | |
| 1460 | + } else { | |
| 1461 | + $provider = $provider; | |
| 1552 | 1462 | } |
| 1553 | - } catch ( \Exception $e ) { | |
| 1554 | - $error = $e->getMessage(); | |
| 1555 | 1463 | } |
| 1556 | 1464 | |
| 1557 | - if ( $error ) { | |
| 1558 | - do_action( 'wp_login_failed', $user->user_login ); | |
| 1559 | - | |
| 1560 | - $message = aui()->alert( | |
| 1561 | - array( | |
| 1562 | - 'type' => 'error', | |
| 1563 | - 'content' => $error | |
| 1564 | - ) | |
| 1565 | - ); | |
| 1566 | - | |
| 1567 | - wp_send_json_error( array( 'message' => $message ) ); | |
| 1568 | - } | |
| 1569 | - | |
| 1570 | 1465 | // If this is an email login, or if the user failed validation previously, lets send the code to the user. |
| 1571 | 1466 | if ( 'email' === $provider && true !== \WP2FA\Authenticator\Login::pre_process_email_authentication( $user ) ) { |
| 1572 | 1467 | |
| 1573 | 1468 | } |
| @@ -1572,16 +1467,17 @@ | ||
| 1572 | 1467 | |
| 1573 | 1468 | } |
| 1574 | 1469 | |
| 1575 | 1470 | // Validate TOTP. |
| 1576 | - if ( 'totp' === $provider && true !== $this->validate_wp2fa_totp_authentication( $user ) ) { | |
| 1471 | + if ( 'totp' === $provider && true !== \WP2FA\Authenticator\Login::validate_totp_authentication( $user ) ) { | |
| 1472 | + | |
| 1577 | 1473 | do_action( 'wp_login_failed', $user->user_login ); |
| 1578 | 1474 | |
| 1579 | 1475 | $message = aui()->alert( |
| 1580 | - array( | |
| 1476 | + array( | |
| 1581 | 1477 | 'type' => 'error', |
| 1582 | 1478 | 'content' => __( 'Invalid verification code.', 'userswp' ), |
| 1583 | - ) | |
| 1479 | + ) | |
| 1584 | 1480 | ); |
| 1585 | 1481 | |
| 1586 | 1482 | wp_send_json_error( array( 'message' => $message ) ); |
| 1587 | 1483 | } |
| @@ -1586,26 +1482,27 @@ | ||
| 1586 | 1482 | wp_send_json_error( array( 'message' => $message ) ); |
| 1587 | 1483 | } |
| 1588 | 1484 | |
| 1589 | 1485 | // Validate Email. |
| 1590 | - if ( 'email' === $provider && true !== $this->validate_wp2fa_email_authentication( $user ) ) { | |
| 1486 | + if ( 'email' === $provider && true !== \WP2FA\Authenticator\Login::validate_email_authentication( $user ) ) { | |
| 1487 | + | |
| 1591 | 1488 | do_action( 'wp_login_failed', $user->user_login ); |
| 1592 | 1489 | |
| 1593 | 1490 | if ( isset( $_REQUEST['wp-2fa-email-code-resend'] ) && 1 == $_REQUEST['wp-2fa-email-code-resend'] ) { |
| 1594 | 1491 | $message = aui()->alert( |
| 1595 | - array( | |
| 1492 | + array( | |
| 1596 | 1493 | 'type' => 'info', |
| 1597 | 1494 | 'content' => __( 'A new code has been sent.', 'userswp' ), |
| 1598 | - ) | |
| 1495 | + ) | |
| 1599 | 1496 | ); |
| 1600 | 1497 | |
| 1601 | 1498 | wp_send_json_error( array( 'message' => $message ) ); |
| 1602 | 1499 | } else { |
| 1603 | 1500 | $message = aui()->alert( |
| 1604 | - array( | |
| 1501 | + array( | |
| 1605 | 1502 | 'type' => 'error', |
| 1606 | 1503 | 'content' => __( 'Invalid verification code.', 'userswp' ), |
| 1607 | - ) | |
| 1504 | + ) | |
| 1608 | 1505 | ); |
| 1609 | 1506 | |
| 1610 | 1507 | wp_send_json_error( array( 'message' => $message ) ); |
| 1611 | 1508 | } |
| @@ -1611,16 +1508,17 @@ | ||
| 1611 | 1508 | } |
| 1612 | 1509 | } |
| 1613 | 1510 | |
| 1614 | 1511 | // Backup Codes. |
| 1615 | - if ( 'backup_codes' === $provider && true !== $this->validate_wp2fa_backup_codes( $user ) ) { | |
| 1512 | + if ( 'backup_codes' === $provider && true !== \WP2FA\Authenticator\Login::validate_backup_codes( $user ) ) { | |
| 1513 | + | |
| 1616 | 1514 | do_action( 'wp_login_failed', $user->user_login ); |
| 1617 | 1515 | |
| 1618 | 1516 | $message = aui()->alert( |
| 1619 | - array( | |
| 1517 | + array( | |
| 1620 | 1518 | 'type' => 'error', |
| 1621 | 1519 | 'content' => __( 'Invalid backup code.', 'userswp' ), |
| 1622 | - ) | |
| 1520 | + ) | |
| 1623 | 1521 | ); |
| 1624 | 1522 | |
| 1625 | 1523 | wp_send_json_error( array( 'message' => $message ) ); |
| 1626 | 1524 | } |
| @@ -1628,9 +1526,8 @@ | ||
| 1628 | 1526 | \WP2FA\Authenticator\Login::delete_login_nonce( $user->ID ); |
| 1629 | 1527 | |
| 1630 | 1528 | $rememberme = false; |
| 1631 | 1529 | $remember = ( isset( $_REQUEST['rememberme'] ) ) ? filter_var( $_REQUEST['rememberme'], FILTER_VALIDATE_BOOLEAN ) : ''; |
| 1632 | - | |
| 1633 | 1530 | if ( ! empty( $remember ) ) { |
| 1634 | 1531 | $rememberme = true; |
| 1635 | 1532 | } |
| 1636 | 1533 | |
| @@ -1637,17 +1534,13 @@ | ||
| 1637 | 1534 | wp_set_auth_cookie( $user->ID, $rememberme ); |
| 1638 | 1535 | |
| 1639 | 1536 | do_action( 'two_factor_user_authenticated', $user ); |
| 1640 | 1537 | |
| 1641 | - if ( defined( 'WP_2FA_PREFIX' ) ) { | |
| 1642 | - do_action( WP_2FA_PREFIX . 'user_authenticated', $user ); | |
| 1643 | - } | |
| 1644 | - | |
| 1645 | 1538 | $message = aui()->alert( |
| 1646 | - array( | |
| 1539 | + array( | |
| 1647 | 1540 | 'type' => 'success', |
| 1648 | 1541 | 'content' => __( 'Validation successful. Redirecting...', 'userswp' ), |
| 1649 | - ) | |
| 1542 | + ) | |
| 1650 | 1543 | ); |
| 1651 | 1544 | |
| 1652 | 1545 | wp_send_json_success( array( 'message' => $message ) ); |
| 1653 | 1546 | } |
| @@ -1769,21 +1662,12 @@ | ||
| 1769 | 1662 | |
| 1770 | 1663 | // make sure user account is active before account reset |
| 1771 | 1664 | $mod_value = get_user_meta( $user_data->ID, 'uwp_mod', true ); |
| 1772 | 1665 | if ( $mod_value == 'email_unconfirmed' ) { |
| 1773 | - $resend_link = uwp_get_forgot_page_url(); | |
| 1774 | - $resend_link = add_query_arg( | |
| 1775 | - array( | |
| 1776 | - 'user_id' => $user_data->ID, | |
| 1777 | - 'action' => 'uwp_resend', | |
| 1778 | - '_nonce' => wp_create_nonce('uwp_resend'), | |
| 1779 | - ), | |
| 1780 | - $resend_link | |
| 1781 | - ); | |
| 1782 | 1666 | $message = aui()->alert( |
| 1783 | 1667 | array( |
| 1784 | 1668 | 'type' => 'error', |
| 1785 | - 'content' => sprintf(__('Your account is not activated yet. Please activate your account first. <a href="%s">Resend</a>.', 'userswp'), $resend_link), | |
| 1669 | + 'content' => __( 'Your account is not activated yet. Please activate your account first.', 'userswp' ), | |
| 1786 | 1670 | ) |
| 1787 | 1671 | ); |
| 1788 | 1672 | if ( wp_doing_ajax() ) { |
| 1789 | 1673 | wp_send_json_error( $message ); |
| @@ -1788,8 +1672,9 @@ | ||
| 1788 | 1672 | if ( wp_doing_ajax() ) { |
| 1789 | 1673 | wp_send_json_error( $message ); |
| 1790 | 1674 | } else { |
| 1791 | 1675 | $uwp_notices[] = array( 'forgot' => $message ); |
| 1676 | + | |
| 1792 | 1677 | return; |
| 1793 | 1678 | } |
| 1794 | 1679 | } |
| 1795 | 1680 | |
| @@ -1804,8 +1689,9 @@ | ||
| 1804 | 1689 | } |
| 1805 | 1690 | |
| 1806 | 1691 | $as_password = apply_filters( 'uwp_forgot_message_as_password', false ); |
| 1807 | 1692 | |
| 1693 | + global $wpdb, $wp_hasher; | |
| 1808 | 1694 | $reset_link = ''; |
| 1809 | 1695 | |
| 1810 | 1696 | if ( $as_password ) { |
| 1811 | 1697 | $new_pass = wp_generate_password( 12, false ); |
| @@ -1817,21 +1703,17 @@ | ||
| 1817 | 1703 | $message .= '<p>' . sprintf( __( 'Username: %s', 'userswp' ), $user_data->user_login ) . '</p>'; |
| 1818 | 1704 | $message .= '<p>' . sprintf( __( 'Password: %s', 'userswp' ), $new_pass ) . '</p>'; |
| 1819 | 1705 | |
| 1820 | 1706 | } else { |
| 1821 | - // Use WordPress core to generate, hash (wp_fast_hash in WP 6.8+), and store the reset key. | |
| 1822 | - // This ensures compatibility with check_password_reset_key() on all WP versions. | |
| 1823 | - $key = get_password_reset_key( $user_data ); | |
| 1707 | + $key = wp_generate_password( 20, false ); | |
| 1708 | + do_action( 'retrieve_password_key', $user_data->user_login, $key ); | |
| 1824 | 1709 | |
| 1825 | - if ( is_wp_error( $key ) ) { | |
| 1826 | - if ( wp_doing_ajax() ) { | |
| 1827 | - wp_send_json_error( $key->get_error_message() ); | |
| 1828 | - } else { | |
| 1829 | - $uwp_notices[] = array( 'forgot' => aui()->alert( array( 'type' => 'error', 'content' => $key->get_error_message() ) ) ); | |
| 1830 | - return; | |
| 1831 | - } | |
| 1710 | + if ( empty( $wp_hasher ) ) { | |
| 1711 | + require_once ABSPATH . 'wp-includes/class-phpass.php'; | |
| 1712 | + $wp_hasher = new PasswordHash( 8, true ); | |
| 1832 | 1713 | } |
| 1833 | - | |
| 1714 | + $hashed = $wp_hasher->HashPassword( $key ); | |
| 1715 | + $wpdb->update( $wpdb->users, array( 'user_activation_key' => time() . ':' . $hashed ), array( 'user_login' => $user_data->user_login ) ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching | |
| 1834 | 1716 | $message = '<p>' . __( 'You have requested to reset your password for the following account:', 'userswp' ) . '</p>'; |
| 1835 | 1717 | $message .= home_url( '/' ) . '</p>'; |
| 1836 | 1718 | $message .= '<p>' . sprintf( __( 'Username: %s', 'userswp' ), $user_data->user_login ) . '</p>'; |
| 1837 | 1719 | $message .= '<p>' . __( 'If this was by mistake, just ignore this email and nothing will happen.', 'userswp' ) . '</p>'; |
| @@ -2355,87 +2237,46 @@ | ||
| 2355 | 2237 | * @package userswp |
| 2356 | 2238 | * @since 1.0.0 |
| 2357 | 2239 | */ |
| 2358 | 2240 | public function upload_file_remove() { |
| 2359 | - global $wpdb; | |
| 2360 | - | |
| 2361 | 2241 | check_ajax_referer( 'uwp_basic_nonce', 'security' ); |
| 2362 | 2242 | |
| 2363 | - // Check user logged in. | |
| 2364 | - if ( ! is_user_logged_in() ) { | |
| 2365 | - $message = aui()->alert( array( 'type' => 'error', 'content' => __( 'Access denied!', 'userswp' ) ) ); | |
| 2366 | - wp_send_json_error( array( 'message' => $message ) ); | |
| 2367 | - } | |
| 2368 | - | |
| 2243 | + $htmlvar = esc_sql( strip_tags( $_POST['htmlvar'] ) ); | |
| 2369 | 2244 | $user_id = ! empty( $_POST['uid'] ) ? absint( $_POST['uid'] ) : 0; |
| 2370 | - $htmlvar = ! empty( $_POST['htmlvar'] ) ? sanitize_key( $_POST['htmlvar'] ) : ''; | |
| 2371 | 2245 | |
| 2372 | - if ( empty( $user_id ) || empty( $htmlvar ) ) { | |
| 2373 | - $message = aui()->alert( array( 'type' => 'error', 'content' => __( 'Invalid data!', 'userswp' ) ) ); | |
| 2374 | - wp_send_json_error( array( 'message' => $message ) ); | |
| 2246 | + if ( empty( $user_id ) ) { | |
| 2247 | + wp_die( -1 ); | |
| 2375 | 2248 | } |
| 2376 | 2249 | |
| 2377 | - // Validate the user / admin. | |
| 2378 | - if ( ! ( $user_id == (int) get_current_user_id() || current_user_can( 'manage_options' ) ) ) { | |
| 2379 | - $message = aui()->alert( array( 'type' => 'error', 'content' => __( 'Invalid access!', 'userswp' ) ) ); | |
| 2380 | - wp_send_json_error( array( 'message' => $message ) ); | |
| 2250 | + if ( ! ( is_user_logged_in() && ( $user_id == (int) get_current_user_id() || current_user_can( 'manage_options' ) ) ) ) { | |
| 2251 | + wp_send_json_error( __( 'Invalid access!', 'userswp' ) ); | |
| 2381 | 2252 | } |
| 2382 | 2253 | |
| 2254 | + // Remove file | |
| 2383 | 2255 | if ( $htmlvar == 'banner_thumb' ) { |
| 2384 | - $field_key = 'banner'; | |
| 2256 | + $file = uwp_get_usermeta( $user_id, 'banner_thumb' ); | |
| 2385 | 2257 | $type = 'banner'; |
| 2386 | - } else if ( $htmlvar == 'avatar_thumb' ) { | |
| 2387 | - $field_key = 'avatar'; | |
| 2258 | + } elseif ( $htmlvar == 'avatar_thumb' ) { | |
| 2259 | + $file = uwp_get_usermeta( $user_id, 'avatar_thumb' ); | |
| 2388 | 2260 | $type = 'avatar'; |
| 2389 | 2261 | } else { |
| 2390 | - $field_key = $htmlvar; | |
| 2262 | + $file = ''; | |
| 2391 | 2263 | $type = ''; |
| 2392 | 2264 | } |
| 2393 | 2265 | |
| 2394 | - $field = $wpdb->get_row( $wpdb->prepare( "SELECT * FROM " . uwp_get_table_prefix() . "uwp_form_fields WHERE htmlvar_name = %s LIMIT 1", $field_key ) ); | |
| 2395 | - | |
| 2396 | - // Check field exists. | |
| 2397 | - if ( empty( $field ) ) { | |
| 2398 | - $message = aui()->alert( array( 'type' => 'error', 'content' => __( 'Invalid field!', 'userswp' ) ) ); | |
| 2399 | - wp_send_json_error( array( 'message' => $message ) ); | |
| 2400 | - } | |
| 2401 | - | |
| 2402 | - // Validate field access. | |
| 2403 | - if ( ! empty( $field->for_admin_use ) && ! current_user_can( 'manage_options' ) ) { | |
| 2404 | - $message = aui()->alert( array( 'type' => 'error', 'content' => __( 'You are not allowed to perform this action!', 'userswp' ) ) ); | |
| 2405 | - wp_send_json_error( array( 'message' => $message ) ); | |
| 2406 | - } | |
| 2407 | - | |
| 2408 | - if ( ! in_array( $field->field_type, array( 'file', 'image' ) ) ) { | |
| 2409 | - $message = aui()->alert( array( 'type' => 'error', 'content' => __( 'Invalid field type!', 'userswp' ) ) ); | |
| 2410 | - wp_send_json_error( array( 'message' => $message ) ); | |
| 2411 | - } | |
| 2412 | - | |
| 2413 | - $value = uwp_get_usermeta( $user_id, $htmlvar ); | |
| 2414 | - | |
| 2415 | 2266 | uwp_update_usermeta( $user_id, $htmlvar, '' ); |
| 2416 | 2267 | |
| 2417 | - if ( $value && validate_file( $value ) === 0 ) { | |
| 2268 | + if ( $file ) { | |
| 2418 | 2269 | $uploads = wp_upload_dir(); |
| 2419 | 2270 | $upload_path = $uploads['basedir']; |
| 2271 | + $unlink_file = untrailingslashit( $upload_path ) . '/' . ltrim( $file, '/' ); | |
| 2420 | 2272 | |
| 2421 | - if ( strpos( $value, 'http://' ) === 0 || strpos( $value, 'https://' ) === 0 ) { | |
| 2422 | - // Get the relative url. | |
| 2423 | - $value = uwp_get_file_relative_url( $value ); | |
| 2424 | - } | |
| 2425 | - | |
| 2426 | - $unlink_file = untrailingslashit( $upload_path ) . '/' . trim( $value, '/\\' ); | |
| 2427 | - | |
| 2428 | 2273 | if ( is_file( $unlink_file ) && file_exists( $unlink_file ) ) { |
| 2429 | - wp_delete_file( $unlink_file ); | |
| 2274 | + @unlink( $unlink_file ); | |
| 2275 | + $unlink_ori_file = str_replace( '_uwp_' . $type . '_thumb' . '.', '.', $unlink_file ); | |
| 2430 | 2276 | |
| 2431 | - // For avatar/banner, also remove the original (non-thumb) file. | |
| 2432 | - if ( $type ) { | |
| 2433 | - $unlink_ori_file = str_replace( '_uwp_' . $type . '_thumb' . '.', '.', $unlink_file ); | |
| 2434 | - | |
| 2435 | - if ( is_file( $unlink_ori_file ) && file_exists( $unlink_ori_file ) ) { | |
| 2436 | - wp_delete_file( $unlink_ori_file ); | |
| 2437 | - } | |
| 2277 | + if ( is_file( $unlink_ori_file ) && file_exists( $unlink_ori_file ) ) { | |
| 2278 | + @unlink( $unlink_ori_file ); | |
| 2438 | 2279 | } |
| 2439 | 2280 | } |
| 2440 | 2281 | } |
| 2441 | 2282 | |
| @@ -4469,9 +4310,9 @@ | ||
| 4469 | 4310 | // If no html then we run the standard output. |
| 4470 | 4311 | if ( empty( $html ) ) { |
| 4471 | 4312 | |
| 4472 | 4313 | $design_style = uwp_get_option( 'design_style', 'bootstrap' ); |
| 4473 | - $bs_form_group = $design_style ? 'form-group m-0' : ''; // country wrapper div added by JS adds margin so we remove ours | |
| 4314 | + $bs_form_group = $design_style ? 'form-group m-0' : ''; // country wrapper div added by JS adds marginso we remove ours | |
| 4474 | 4315 | $bs_sr_only = $design_style ? 'sr-only' : ''; |
| 4475 | 4316 | $bs_form_control = $design_style ? 'form-control' : ''; |
| 4476 | 4317 | |
| 4477 | 4318 | ob_start(); // Start buffering; |
| @@ -5034,13 +4875,13 @@ | ||
| 5034 | 4875 | function (event) { |
| 5035 | 4876 | var $form = $(this).closest('form'); |
| 5036 | 4877 | if( ! $form.hasClass('uwp-login-form') ) { |
| 5037 | 4878 | uwp_checkPasswordStrength( |
| 5038 | - $form.find('input[name=password]'), | |
| 5039 | - $form.find('input[name=confirm_password]'), | |
| 5040 | - $form.find('#uwp-password-strength'), | |
| 5041 | - $form.find('button[type="submit"], input[type="submit"]'), | |
| 5042 | - ['black', 'listed', 'word'] | |
| 4879 | + $('input[name=password]', $form), // First password field | |
| 4880 | + $('input[name=confirm_password]', $form), // Second password field | |
| 4881 | + $('#uwp-password-strength', $form), // Strength meter | |
| 4882 | + $('input[type=submit]', $form), // Submit button | |
| 4883 | + ['black', 'listed', 'word'] // Blacklisted words | |
| 5043 | 4884 | ); |
| 5044 | 4885 | } |
| 5045 | 4886 | } |
| 5046 | 4887 | ); |
| @@ -5067,15 +4908,12 @@ | ||
| 5067 | 4908 | public function ajax_forgot_password_form() { |
| 5068 | 4909 | |
| 5069 | 4910 | // add the modal error container |
| 5070 | 4911 | add_action( 'uwp_template_display_notices', array( $this, 'modal_error_container' ) ); |
| 5071 | - $args = array( | |
| 5072 | - 'form_title' => '', | |
| 5073 | - 'css_class' => '' | |
| 5074 | - ); | |
| 4912 | + | |
| 5075 | 4913 | // get the form |
| 5076 | 4914 | ob_start(); |
| 5077 | - uwp_get_template( 'bootstrap/forgot.php', $args ); | |
| 4915 | + uwp_get_template( 'bootstrap/forgot.php' ); | |
| 5078 | 4916 | $form = ob_get_clean(); |
| 5079 | 4917 | |
| 5080 | 4918 | // bs5 |
| 5081 | 4919 | if ( function_exists( 'aui_bs_convert_sd_output' ) ) { |
