class-settings.php
378 lines
| 1 | <?php |
| 2 | /** |
| 3 | * Responsible for the plugin settings iterations |
| 4 | * |
| 5 | * @package wp2fa |
| 6 | * @subpackage admin_controllers |
| 7 | * @copyright 2021 WP White Security |
| 8 | * @license https://www.apache.org/licenses/LICENSE-2.0 Apache License 2.0 |
| 9 | * @link https://wordpress.org/plugins/wp-2fa/ |
| 10 | */ |
| 11 | |
| 12 | namespace WP2FA\Admin\Controllers; |
| 13 | |
| 14 | use WP2FA\WP2FA; |
| 15 | use WP2FA\Admin\User; |
| 16 | use WP2FA\Admin\Helpers\WP_Helper; |
| 17 | use WP2FA\Admin\Helpers\User_Helper; |
| 18 | |
| 19 | defined( 'ABSPATH' ) || exit; // Exit if accessed directly. |
| 20 | |
| 21 | /** |
| 22 | * WP2FA Settings controller |
| 23 | */ |
| 24 | class Settings { |
| 25 | |
| 26 | /** |
| 27 | * The name of the WP2FA WP admin settings page |
| 28 | * |
| 29 | * @var string |
| 30 | */ |
| 31 | private static $settings_page_name = 'wp-2fa-policies'; |
| 32 | |
| 33 | /** |
| 34 | * The link to the WP admin settings page |
| 35 | * |
| 36 | * @var string |
| 37 | */ |
| 38 | private static $settings_page_link = ''; |
| 39 | |
| 40 | /** |
| 41 | * The name of the WP2FA WP admin setup page |
| 42 | * |
| 43 | * @var string |
| 44 | */ |
| 45 | private static $setup_page_name = 'wp-2fa-setup'; |
| 46 | |
| 47 | /** |
| 48 | * The link to the WP admin setup page |
| 49 | * |
| 50 | * @var string |
| 51 | */ |
| 52 | private static $setup_page_link = ''; |
| 53 | |
| 54 | /** |
| 55 | * The link to the custom settings page (if one is presented) |
| 56 | * |
| 57 | * @var string |
| 58 | */ |
| 59 | private static $custom_setup_page_link = null; |
| 60 | |
| 61 | /** |
| 62 | * Array with all the backup methods available |
| 63 | * |
| 64 | * @var array |
| 65 | * |
| 66 | * @since 2.0.0 |
| 67 | */ |
| 68 | private static $backup_methods = null; |
| 69 | |
| 70 | /** |
| 71 | * All available providers for the plugin |
| 72 | * For the specific role @see get_all_providers_for_role() |
| 73 | * |
| 74 | * @var array |
| 75 | * |
| 76 | * @since 2.2.0 |
| 77 | */ |
| 78 | private static $all_providers = array(); |
| 79 | |
| 80 | /** |
| 81 | * All the available providers by user roles |
| 82 | * |
| 83 | * @var array |
| 84 | * |
| 85 | * @since 2.2.0 |
| 86 | */ |
| 87 | private static $all_providers_for_roles = array(); |
| 88 | |
| 89 | /** |
| 90 | * Returns the link to the WP admin settings page, based on the current WP install |
| 91 | * |
| 92 | * @return string |
| 93 | */ |
| 94 | public static function get_settings_page_link() { |
| 95 | if ( '' === self::$settings_page_link ) { |
| 96 | if ( WP_Helper::is_multisite() ) { |
| 97 | self::$settings_page_link = add_query_arg( 'page', self::$settings_page_name, network_admin_url( 'admin.php' ) ); |
| 98 | } else { |
| 99 | self::$settings_page_link = add_query_arg( 'page', self::$settings_page_name, admin_url( 'admin.php' ) ); |
| 100 | } |
| 101 | } |
| 102 | |
| 103 | return self::$settings_page_link; |
| 104 | } |
| 105 | |
| 106 | /** |
| 107 | * Returns the link to the WP admin settings page, based on the current WP install |
| 108 | * |
| 109 | * @return string |
| 110 | */ |
| 111 | public static function get_setup_page_link() { |
| 112 | if ( '' === self::$setup_page_link ) { |
| 113 | if ( WP_Helper::is_multisite() ) { |
| 114 | self::$setup_page_link = add_query_arg( 'show', self::$setup_page_name, network_admin_url( 'profile.php' ) ); |
| 115 | } else { |
| 116 | self::$setup_page_link = add_query_arg( 'show', self::$setup_page_name, admin_url( 'profile.php' ) ); |
| 117 | } |
| 118 | } |
| 119 | |
| 120 | return self::$setup_page_link; |
| 121 | } |
| 122 | |
| 123 | /** |
| 124 | * Extracts the custom settings page URL |
| 125 | * |
| 126 | * @param mixed $user - User for which to extract the setting, null, WP_User or user id - @see get_role_or_default_setting method of this class. |
| 127 | * |
| 128 | * @return string |
| 129 | */ |
| 130 | public static function get_custom_page_link( $user = null ): string { |
| 131 | if ( null === self::$custom_setup_page_link ) { |
| 132 | self::$custom_setup_page_link = self::get_role_or_default_setting( 'custom-user-page-id', $user ); |
| 133 | |
| 134 | if ( ! empty( self::$custom_setup_page_link ) ) { |
| 135 | $custom_slug = ''; |
| 136 | if ( WP_Helper::is_multisite() ) { |
| 137 | switch_to_blog( get_main_site_id() ); |
| 138 | |
| 139 | $custom_slug = get_post_field( 'post_name', get_post( self::$custom_setup_page_link ) ); |
| 140 | self::$custom_setup_page_link = trailingslashit( get_site_url() ) . $custom_slug; |
| 141 | |
| 142 | restore_current_blog(); |
| 143 | } else { |
| 144 | $custom_slug = get_post_field( 'post_name', get_post( self::$custom_setup_page_link ) ); |
| 145 | self::$custom_setup_page_link = trailingslashit( get_site_url() ) . $custom_slug; |
| 146 | } |
| 147 | } |
| 148 | } |
| 149 | |
| 150 | return self::$custom_setup_page_link; |
| 151 | } |
| 152 | |
| 153 | /** |
| 154 | * Check all the roles for given setting |
| 155 | * |
| 156 | * @param string $setting_name - The name of the setting to check for. |
| 157 | * |
| 158 | * @return boolean |
| 159 | * |
| 160 | * @since 2.0.0 |
| 161 | */ |
| 162 | public static function check_setting_in_all_roles( string $setting_name ): bool { |
| 163 | $roles = WP_Helper::get_roles(); |
| 164 | |
| 165 | foreach ( $roles as $role ) { |
| 166 | if ( ! empty( WP2FA::get_wp2fa_setting( $setting_name, false, false, $role ) ) ) { |
| 167 | return true; |
| 168 | } |
| 169 | } |
| 170 | |
| 171 | return false; |
| 172 | } |
| 173 | |
| 174 | /** |
| 175 | * Return setting specific for the given role or default setting (based on user) |
| 176 | * |
| 177 | * @param string $setting_name - The name of the setting. |
| 178 | * @param mixed $user - \WP_User or any string or null - if string the current user will be used, if null global plugin setting will be used. |
| 179 | * @param mixed $role - The name of the role (or null). |
| 180 | * @param boolean $get_default_on_empty - Get default setting on empty setting value. |
| 181 | * @param boolean $get_default_value - Extracts default value. |
| 182 | * |
| 183 | * @return mixed |
| 184 | * |
| 185 | * @since 2.0.0 |
| 186 | */ |
| 187 | public static function get_role_or_default_setting( string $setting_name, $user = null, $role = null, $get_default_on_empty = false, $get_default_value = false ) { |
| 188 | /** |
| 189 | * No user specified - get the default settings |
| 190 | */ |
| 191 | if ( null === $user ) { |
| 192 | return WP2FA::get_wp2fa_setting( $setting_name, $get_default_on_empty, $get_default_value ); |
| 193 | } |
| 194 | |
| 195 | /** |
| 196 | * There is an User - extract the role |
| 197 | */ |
| 198 | if ( $user instanceof \WP_User || is_int( $user ) ) { |
| 199 | if ( null === $role ) { |
| 200 | $role = User_Helper::get_user_role( $user ); |
| 201 | } |
| 202 | return WP2FA::get_wp2fa_setting( $setting_name, $get_default_on_empty, $get_default_value, $role ); |
| 203 | } |
| 204 | |
| 205 | /** |
| 206 | * Current user - lets extract the role |
| 207 | */ |
| 208 | if ( null === $role ) { |
| 209 | /** |
| 210 | * No logged in current user, ergo no roles - fall back to defaults |
| 211 | */ |
| 212 | if ( 0 === User::get_instance()->get_2fa_wp_user()->ID ) { |
| 213 | return WP2FA::get_wp2fa_setting( $setting_name, $get_default_on_empty, $get_default_value ); |
| 214 | } |
| 215 | |
| 216 | $role = User_Helper::get_user_role(); |
| 217 | } |
| 218 | |
| 219 | return WP2FA::get_wp2fa_setting( $setting_name, $get_default_on_empty, $get_default_value, $role ); |
| 220 | } |
| 221 | |
| 222 | /** |
| 223 | * Returns all the backup methods currently supported |
| 224 | * |
| 225 | * @return array |
| 226 | * |
| 227 | * @since 2.0.0 |
| 228 | */ |
| 229 | public static function get_backup_methods(): array { |
| 230 | |
| 231 | if ( null === self::$backup_methods ) { |
| 232 | |
| 233 | /** |
| 234 | * Gives the ability to add additional backup methods |
| 235 | * |
| 236 | * @param array The array with all the backup methods currently supported. |
| 237 | * |
| 238 | * @since 2.0.0 |
| 239 | */ |
| 240 | self::$backup_methods = apply_filters( WP_2FA_PREFIX . 'backup_methods_list', array() ); |
| 241 | } |
| 242 | |
| 243 | return self::$backup_methods; |
| 244 | } |
| 245 | |
| 246 | /** |
| 247 | * Get backup methods enabled for user based on its role |
| 248 | * |
| 249 | * @param \WP_User $user - The WP user which we must check. |
| 250 | * |
| 251 | * @return array |
| 252 | * |
| 253 | * @since 2.0.0 |
| 254 | */ |
| 255 | public static function get_enabled_backup_methods_for_user_role( \WP_User $user ): array { |
| 256 | $backup_methods = self::get_backup_methods(); |
| 257 | |
| 258 | /** |
| 259 | * Extensions could change the enabled backup methods array. |
| 260 | * |
| 261 | * @param array - Backup methods array. |
| 262 | * @param \WP_User - The user to check for. |
| 263 | * |
| 264 | * @since 2.0.0 |
| 265 | */ |
| 266 | return apply_filters( WP_2FA_PREFIX . 'backup_methods_enabled', $backup_methods, $user ); |
| 267 | } |
| 268 | |
| 269 | /** |
| 270 | * Returns all enabled providers for specific role |
| 271 | * |
| 272 | * @param string $role - The name of the role to check for. |
| 273 | * |
| 274 | * @return array |
| 275 | * |
| 276 | * @throws \Exception - if the role is wrong - throws an exception. |
| 277 | * |
| 278 | * @since 2.2.0 |
| 279 | */ |
| 280 | public static function get_enabled_providers_for_role( string $role ) { |
| 281 | |
| 282 | if ( WP_Helper::is_role_exists( $role ) ) { |
| 283 | self::get_all_roles_providers(); |
| 284 | |
| 285 | return self::$all_providers_for_roles[ $role ]; |
| 286 | } |
| 287 | |
| 288 | throw new \Exception( 'Role provided does not exists - "' . $role . '"' ); |
| 289 | } |
| 290 | |
| 291 | /** |
| 292 | * Checks if given provider is enabled for the given role. |
| 293 | * |
| 294 | * @param string $role - The name of the role. |
| 295 | * @param string $provider - The name of the provider. |
| 296 | * |
| 297 | * @return boolean |
| 298 | * |
| 299 | * @throws \Exception - If the provider is not registered in the plugin. |
| 300 | * |
| 301 | * @since 2.2.0 |
| 302 | */ |
| 303 | public static function is_provider_enabled_for_role( string $role, string $provider ): bool { |
| 304 | self::get_providers(); |
| 305 | |
| 306 | if ( in_array( $provider, self::$all_providers, true ) ) { |
| 307 | self::get_enabled_providers_for_role( $role ); |
| 308 | if ( isset( self::$all_providers_for_roles[ $role ][ $provider ] ) ) { |
| 309 | return true; |
| 310 | } |
| 311 | |
| 312 | return false; |
| 313 | } |
| 314 | |
| 315 | throw new \Exception( 'Non existing provider ' . $provider ); |
| 316 | } |
| 317 | |
| 318 | /** |
| 319 | * Returns all providers by roles. |
| 320 | * If given role does not have specified settings set - falls back to the default settings. |
| 321 | * |
| 322 | * @return array |
| 323 | * |
| 324 | * @since 2.2.0 |
| 325 | */ |
| 326 | public static function get_all_roles_providers() { |
| 327 | if ( empty( self::$all_providers_for_roles ) ) { |
| 328 | $roles = WP_Helper::get_roles(); |
| 329 | $providers = self::get_providers(); |
| 330 | |
| 331 | foreach ( $roles as $role ) { |
| 332 | self::$all_providers_for_roles[ $role ] = array(); |
| 333 | foreach ( $providers as $provider ) { |
| 334 | if ( 'backup_codes' === $provider ) { |
| 335 | self::$all_providers_for_roles[ $role ][ $provider ] = WP2FA::get_wp2fa_setting( $provider . '_enabled', false, false, $role ); |
| 336 | } elseif ( 'email-backup' === $provider ) { |
| 337 | self::$all_providers_for_roles[ $role ][ $provider ] = WP2FA::get_wp2fa_setting( 'enable-' . $provider, false, false, $role ); |
| 338 | } elseif ( 'oob' === $provider ) { |
| 339 | self::$all_providers_for_roles[ $role ][ $provider ] = WP2FA::get_wp2fa_setting( 'enable_' . $provider . '_email', false, false, $role ); |
| 340 | } else { |
| 341 | self::$all_providers_for_roles[ $role ][ $provider ] = WP2FA::get_wp2fa_setting( 'enable_' . $provider, false, false, $role ); |
| 342 | } |
| 343 | } |
| 344 | self::$all_providers_for_roles[ $role ] = array_filter( self::$all_providers_for_roles[ $role ] ); |
| 345 | } |
| 346 | } |
| 347 | |
| 348 | return self::$all_providers_for_roles; |
| 349 | } |
| 350 | |
| 351 | /** |
| 352 | * Grab list of all register providers in the plugin. |
| 353 | * |
| 354 | * @return array |
| 355 | */ |
| 356 | public static function get_providers() { |
| 357 | if ( empty( self::$all_providers ) ) { |
| 358 | self::$all_providers = array( |
| 359 | 'totp', |
| 360 | 'email', |
| 361 | 'backup_codes', |
| 362 | ); |
| 363 | |
| 364 | /** |
| 365 | * Filter the supplied providers. |
| 366 | * |
| 367 | * This lets third-parties either remove providers (such as Email), or |
| 368 | * add their own providers (such as text message or Clef). |
| 369 | * |
| 370 | * @param array $provider array if available options. |
| 371 | */ |
| 372 | self::$all_providers = apply_filters( WP_2FA_PREFIX . 'providers', self::$all_providers ); |
| 373 | } |
| 374 | |
| 375 | return self::$all_providers; |
| 376 | } |
| 377 | } |
| 378 |