← All changes | callback/wings/security.php +58 -28 5.73 → 6.36 View file →

		@@ -7,8 +7,10 @@
7	7	public function __construct() {
8	8	$this->settings = new WPRWPSettings();
9	9	}
10	10
	11	+ // phpcs:disable WordPress.WP.AlternativeFunctions.file_system_operations_fread
	12	+ // Here we need fread as we are using popen which returns a handler
11	13	function getCrontab() {
12	14	$resp = array();
13	15
14	16	if (function_exists('exec')) {
		@@ -37,38 +39,52 @@
37	39	}
38	40
39	41	return $resp;
40	42	}
	43	+ // phpcs:enable WordPress.WP.AlternativeFunctions.file_system_operations_fread
41	44
42		- public function setupWP2FA($user_id, $secret, $to_encrypt = true, $cipher_algo = null, $enabled = null) {
43		- if ($to_encrypt === true) {
44		- if (empty($cipher_algo)) {
45		- $cipher_algo = WPRWP2FA::$cipher_algo;
	45	+ public function setupWP2FA($secrets_by_uids, $to_encrypt, $cipher_algo, $enabled) {
	46	+ if (!is_array($secrets_by_uids)) {
	47	+ return array("status" => false, "message" => "secrets_by_uids is not an array.");
	48	+ }
	49	+
	50	+ $result = array();
	51	+ foreach ($secrets_by_uids as $user_id => $secret) {
	52	+ if (empty($user_id) || !is_string($secret)) {
	53	+ continue;
46	54	}
47	55
48		- if (defined('SECURE_AUTH_KEY')) {
49		- $encryption_result = WPRHelper::opensslEncrypt($secret, $cipher_algo, SECURE_AUTH_KEY);
50		- if ($encryption_result[0] === false) {
51		- return array("status" => false, "message" => $encryption_result[1]);
	56	+ if ($to_encrypt === true) {
	57	+ if (empty($cipher_algo)) {
	58	+ $cipher_algo = WPRWP2FA::$cipher_algo;
52	59	}
53		- $secret = $encryption_result[1];
54		- } else {
55		- return array("status" => false, "message" => "Encryption key not found.");
	60	+
	61	+ if (defined('SECURE_AUTH_KEY')) {
	62	+ $encryption_result = WPRHelper::opensslEncrypt($secret, $cipher_algo, SECURE_AUTH_KEY);
	63	+ if ($encryption_result[0] === false) {
	64	+ return array("status" => false, "message" => $encryption_result[1]);
	65	+ }
	66	+ $secret = $encryption_result[1];
	67	+ } else {
	68	+ return array("status" => false, "message" => "Encryption key not found.");
	69	+ }
56	70	}
	71	+
	72	+ $secret_info = array(
	73	+ "secret" => base64_encode($secret),
	74	+ "is_encrypted" => $to_encrypt
	75	+ );
	76	+
	77	+ $result[$user_id][WPRWP2FA::SECRET_META_KEY] = update_user_meta($user_id, WPRWP2FA::SECRET_META_KEY, $secret_info);
	78	+ $result[$user_id][WPRWP2FA::FLAG_META_KEY] = update_user_meta($user_id, WPRWP2FA::FLAG_META_KEY, true);
57	79	}
58	80
59		- $secret_info = array(
60		- "secret" => base64_encode($secret),
61		- "is_encrypted" => $to_encrypt
62		- );
63		- update_user_meta($user_id, WPRWP2FA::SECRET_META_KEY, $secret_info);
64		- update_user_meta($user_id, WPRWP2FA::FLAG_META_KEY, true);
65		-
66	81	if (is_bool($enabled)) {
67	82	$config = array("enabled" => $enabled);
68		- $this->settings->updateOption(WPRWP2FA::$wp_2fa_option, $config);
	83	+ $result[WPRWP2FA::$wp_2fa_option] = $this->settings->updateOption(WPRWP2FA::$wp_2fa_option, $config);
69	84	}
70		- return array("status" => true);
	85	+
	86	+ return array("status" => true, "result" => $result);
71	87	}
72	88
73	89	public function verifyWP2FACode($user_id, $code, $cipher_algo = null) {
74	90	$encoded_secret_info = get_user_meta($user_id, WPRWP2FA::SECRET_META_KEY, true);
		@@ -108,17 +124,30 @@
108	124	"enabled" => $enabled
109	125	);
110	126	}
111	127
112		- public function deleteWP2FAKeys($user_ids) {
	128	+ public function deleteWP2FAKeys($user_ids, $is_disable = false) {
	129	+ $result = array();
	130	+
113	131	foreach ($user_ids as $user_id) {
114		- delete_user_meta($user_id, WPRWP2FA::FLAG_META_KEY);
115		- delete_user_meta($user_id, WPRWP2FA::SECRET_META_KEY);
	132	+ $secret_deleted = delete_user_meta($user_id, WPRWP2FA::SECRET_META_KEY);
	133	+ $flag_deleted = delete_user_meta($user_id, WPRWP2FA::FLAG_META_KEY);
	134	+ $result[$user_id] = array(
	135	+ WPRWP2FA::SECRET_META_KEY => $secret_deleted,
	136	+ WPRWP2FA::FLAG_META_KEY => $flag_deleted
	137	+ );
116	138	}
117		- return array("status" => true);
	139	+
	140	+ if ($is_disable === true) {
	141	+ $result[WPRWP2FA::$wp_2fa_option] = $this->settings->deleteOption(WPRWP2FA::$wp_2fa_option);
	142	+ }
	143	+
	144	+ return array("status" => true, "result" => $result);
118	145	}
119	146
120	147	public function process($request) {
	148	+ $params = $request->params;
	149	+
121	150	switch ($request->method) {
122	151	case "gtcrntb":
123	152	$resp = $this->getCrontab();
124	153	break;
		@@ -126,18 +155,19 @@
126	155	$enable_wp_2fa = null;
127	156	if (array_key_exists('enable_wp_2fa', $request->params)) {
128	157	$enable_wp_2fa = $request->params['enable_wp_2fa'];
129	158	}
130		- $resp = $this->setupWP2FA($request->params['user_id'], $request->params['secret'], $request->params['to_encrypt'], $request->params['cipher_algo'], $enable_wp_2fa);
	159	+
	160	+ $resp = $this->setupWP2FA($params['secrets_by_uids'], $params['to_encrypt'], $params['cipher_algo'], $enable_wp_2fa);
131	161	break;
132	162	case "vrfywp2fa":
133		- $resp = $this->verifyWP2FACode($request->params['user_id'], $request->params['code'], $request->params['cipher_algo']);
	163	+ $resp = $this->verifyWP2FACode($params['user_id'], $params['code'], $params['cipher_algo']);
134	164	break;
135	165	case "rdwp2fa":
136		- $resp = $this->readWP2FAKeys($request->params['user_id']);
	166	+ $resp = $this->readWP2FAKeys($params['user_id']);
137	167	break;
138	168	case "dltewp2fa":
139		- $resp = $this->deleteWP2FAKeys($request->params['user_ids']);
	169	+ $resp = $this->deleteWP2FAKeys($params['user_ids'], $params['is_disable']);
140	170	break;
141	171	default:
142	172	$resp = false;
143	173	}