← All changes | callback/wings/security.php +70 -26 5.72 → 6.36 View file →

		@@ -1,8 +1,16 @@
1	1	<?php
2	2	if (!defined('ABSPATH')) exit;
3	3	if (!class_exists('BVSecurityCallback')) :
4	4	class BVSecurityCallback extends BVCallbackBase {
	5	+ private $settings;
	6	+
	7	+ public function __construct() {
	8	+ $this->settings = new WPRWPSettings();
	9	+ }
	10	+
	11	+ // phpcs:disable WordPress.WP.AlternativeFunctions.file_system_operations_fread
	12	+ // Here we need fread as we are using popen which returns a handler
5	13	function getCrontab() {
6	14	$resp = array();
7	15
8	16	if (function_exists('exec')) {
		@@ -31,34 +39,52 @@
31	39	}
32	40
33	41	return $resp;
34	42	}
	43	+ // phpcs:enable WordPress.WP.AlternativeFunctions.file_system_operations_fread
35	44
36		- public function setupWP2FA($user_id, $secret, $to_encrypt = true, $cipher_algo = null) {
37		- if ($to_encrypt === true) {
38		- if (empty($cipher_algo)) {
39		- $cipher_algo = WPRWP2FA::$cipher_algo;
	45	+ public function setupWP2FA($secrets_by_uids, $to_encrypt, $cipher_algo, $enabled) {
	46	+ if (!is_array($secrets_by_uids)) {
	47	+ return array("status" => false, "message" => "secrets_by_uids is not an array.");
	48	+ }
	49	+
	50	+ $result = array();
	51	+ foreach ($secrets_by_uids as $user_id => $secret) {
	52	+ if (empty($user_id) || !is_string($secret)) {
	53	+ continue;
40	54	}
41	55
42		- if (defined('SECURE_AUTH_KEY')) {
43		- $encryption_result = WPRHelper::opensslEncrypt($secret, $cipher_algo, SECURE_AUTH_KEY);
44		- if ($encryption_result[0] === false) {
45		- return array("status" => false, "message" => $encryption_result[1]);
	56	+ if ($to_encrypt === true) {
	57	+ if (empty($cipher_algo)) {
	58	+ $cipher_algo = WPRWP2FA::$cipher_algo;
46	59	}
47		- $secret = $encryption_result[1];
48		- } else {
49		- return array("status" => false, "message" => "Encryption key not found.");
	60	+
	61	+ if (defined('SECURE_AUTH_KEY')) {
	62	+ $encryption_result = WPRHelper::opensslEncrypt($secret, $cipher_algo, SECURE_AUTH_KEY);
	63	+ if ($encryption_result[0] === false) {
	64	+ return array("status" => false, "message" => $encryption_result[1]);
	65	+ }
	66	+ $secret = $encryption_result[1];
	67	+ } else {
	68	+ return array("status" => false, "message" => "Encryption key not found.");
	69	+ }
50	70	}
	71	+
	72	+ $secret_info = array(
	73	+ "secret" => base64_encode($secret),
	74	+ "is_encrypted" => $to_encrypt
	75	+ );
	76	+
	77	+ $result[$user_id][WPRWP2FA::SECRET_META_KEY] = update_user_meta($user_id, WPRWP2FA::SECRET_META_KEY, $secret_info);
	78	+ $result[$user_id][WPRWP2FA::FLAG_META_KEY] = update_user_meta($user_id, WPRWP2FA::FLAG_META_KEY, true);
51	79	}
52	80
53		- $secret_info = array(
54		- "secret" => base64_encode($secret),
55		- "is_encrypted" => $to_encrypt
56		- );
	81	+ if (is_bool($enabled)) {
	82	+ $config = array("enabled" => $enabled);
	83	+ $result[WPRWP2FA::$wp_2fa_option] = $this->settings->updateOption(WPRWP2FA::$wp_2fa_option, $config);
	84	+ }
57	85
58		- update_user_meta($user_id, WPRWP2FA::SECRET_META_KEY, $secret_info);
59		- update_user_meta($user_id, WPRWP2FA::FLAG_META_KEY, true);
60		- return array("status" => true);
	86	+ return array("status" => true, "result" => $result);
61	87	}
62	88
63	89	public function verifyWP2FACode($user_id, $code, $cipher_algo = null) {
64	90	$encoded_secret_info = get_user_meta($user_id, WPRWP2FA::SECRET_META_KEY, true);
		@@ -98,32 +124,50 @@
98	124	"enabled" => $enabled
99	125	);
100	126	}
101	127
102		- public function deleteWP2FAKeys($user_ids) {
	128	+ public function deleteWP2FAKeys($user_ids, $is_disable = false) {
	129	+ $result = array();
	130	+
103	131	foreach ($user_ids as $user_id) {
104		- delete_user_meta($user_id, WPRWP2FA::FLAG_META_KEY);
105		- delete_user_meta($user_id, WPRWP2FA::SECRET_META_KEY);
	132	+ $secret_deleted = delete_user_meta($user_id, WPRWP2FA::SECRET_META_KEY);
	133	+ $flag_deleted = delete_user_meta($user_id, WPRWP2FA::FLAG_META_KEY);
	134	+ $result[$user_id] = array(
	135	+ WPRWP2FA::SECRET_META_KEY => $secret_deleted,
	136	+ WPRWP2FA::FLAG_META_KEY => $flag_deleted
	137	+ );
106	138	}
107		- return array("status" => true);
	139	+
	140	+ if ($is_disable === true) {
	141	+ $result[WPRWP2FA::$wp_2fa_option] = $this->settings->deleteOption(WPRWP2FA::$wp_2fa_option);
	142	+ }
	143	+
	144	+ return array("status" => true, "result" => $result);
108	145	}
109	146
110	147	public function process($request) {
	148	+ $params = $request->params;
	149	+
111	150	switch ($request->method) {
112	151	case "gtcrntb":
113	152	$resp = $this->getCrontab();
114	153	break;
115	154	case "stupwp2fa":
116		- $resp = $this->setupWP2FA($request->params['user_id'], $request->params['secret'], $request->params['to_encrypt'], $request->params['cipher_algo']);
	155	+ $enable_wp_2fa = null;
	156	+ if (array_key_exists('enable_wp_2fa', $request->params)) {
	157	+ $enable_wp_2fa = $request->params['enable_wp_2fa'];
	158	+ }
	159	+
	160	+ $resp = $this->setupWP2FA($params['secrets_by_uids'], $params['to_encrypt'], $params['cipher_algo'], $enable_wp_2fa);
117	161	break;
118	162	case "vrfywp2fa":
119		- $resp = $this->verifyWP2FACode($request->params['user_id'], $request->params['code'], $request->params['cipher_algo']);
	163	+ $resp = $this->verifyWP2FACode($params['user_id'], $params['code'], $params['cipher_algo']);
120	164	break;
121	165	case "rdwp2fa":
122		- $resp = $this->readWP2FAKeys($request->params['user_id']);
	166	+ $resp = $this->readWP2FAKeys($params['user_id']);
123	167	break;
124	168	case "dltewp2fa":
125		- $resp = $this->deleteWP2FAKeys($request->params['user_ids']);
	169	+ $resp = $this->deleteWP2FAKeys($params['user_ids'], $params['is_disable']);
126	170	break;
127	171	default:
128	172	$resp = false;
129	173	}