Changeset 10268

Timestamp:

09/16/2020 07:14:02 AM (6 years ago)

Author:

dd32

Message:

Plugin Directory: Include better user warning flags in the plugin author card.

Props Ipstenu.
Fixes #5356.

File:

• sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/admin/metabox/class-author-card.php (modified) (6 diffs)

sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/admin/metabox/class-author-card.php

@@ -26 +26 @@
                 '5.102.171.',
                 '38.78.',
+                '42.109.',
                 '47.15.',
                 '49.50.124.',
@@ -37 +38 @@
                 '94.103.41.',
                 '109.123.',
+                '101.0.',
                 '110.55.1.251',
                 '110.55.4.248',
+                '114.31.',
                 '116.193.162.',
                 '119.235.251.',
@@ -163 +166 @@
                 <div class="profile-user-notes">
                         <?php
+                        // Check user status.
                         if ( defined( 'WPORG_SUPPORT_FORUMS_BLOGID' ) ) {
                                 $user     = new \WP_User( $author, '', WPORG_SUPPORT_FORUMS_BLOGID );
@@ -197 +201 @@
                         }
 
+                        // Include any warning flags.
+                        $warning_flags = self::get_user_flags( $user->ID );
+                        if ( $warning_flags ) {
+                                echo '<strong>' . __( 'Warning Flags:', 'wporg-plugins' ) . '</strong>';
+                                echo '<ul class="plugin-flagged">';
+                                foreach ( $warning_flags as $flag => $reasons ) {
+                                        echo '<li class="plugin-flagged-' . esc_attr( $flag ) . '"><strong>' . esc_html( strtoupper( $flag ) ) . ' (' . esc_html( count( $reasons ) ) . '):</strong> ' . esc_html( implode( '; ', $reasons ) ) . '</li>';
+                                }
+                                echo '</ul>';
+                        }
+
+                        // Check IPs.
+                        $post_ids = get_posts( array(
+                                'fields'         => 'ids',
+                                'post_type'      => 'plugin',
+                                'post_status'    => 'any',
+                                'author'         => $author->ID,
+                                'meta_key'       => '_author_ip',
+                                'posts_per_page' => -1,
+                        ) );
+
+                        $user_ips = array_unique( array_map( function( $post_id ) {
+                                return get_post_meta( $post_id, '_author_ip', true );
+                        }, $post_ids ) );
+
+                        if ( $user_ips ) {
+                                sort( $user_ips, SORT_NUMERIC );
+
+                                /* translators: %s: comma-separated list of plugin author's IP addresses */
+                                printf(
+                                        '<p>' . __( 'IPs : %s', 'wporg-plugins' ) . '</p>',
+                                        implode( ', ', array_map( array( __NAMESPACE__ . '\Author_Card', 'link_ip' ), $user_ips ) )
+                                );
+                        }
+
+                        // Include any user notes.
                         if ( ! empty( $user_notes ) ) {
                                 _e( 'User notes:', 'wporg-plugins' );
@@ -218 +258 @@
                 </div>
 
-                <?php
-                $post_ids = get_posts( array(
-                        'fields'         => 'ids',
-                        'post_type'      => 'plugin',
-                        'post_status'    => 'any',
-                        'author'         => $author->ID,
-                        'meta_key'       => '_author_ip',
-                        'posts_per_page' => -1,
-                ) );
-
-                $user_ips = array_unique( array_map( function( $post_id ) {
-                        return get_post_meta( $post_id, '_author_ip', true );
-                }, $post_ids ) );
-
-                if ( $user_ips ) :
-                        sort( $user_ips, SORT_NUMERIC );
-
-                        /* translators: %s: comma-separated list of plugin author's IP addresses */
-                        printf(
-                                '<p>' . __( 'IPs : %s', 'wporg-plugins' ) . '</p>',
-                                implode( ', ', array_map( array( __NAMESPACE__ . '\Author_Card', 'link_ip' ), $user_ips ) )
-                        );
-                endif;
-                ?>
-
-                <?php if ( $author->user_pass == '~~~' ) : ?>
-                        <p><strong><?php _e( 'Has not logged in since we reset passwords in June 2011', 'wporg-plugins' ); ?></strong></p>
-                <?php endif; ?>
-
                 <div class="profile-plugins">
                         <?php
@@ -314 +325 @@
 
                 return $output_ip;
+        }
+
+        protected static function get_user_flags( $user_id ) {
+                $author  = get_user_by( 'id', $user_id );
+                $flagged = array(
+                        'low'  => [],
+                        'med'  => [],
+                        'high' => [],
+                );
+
+                // Check for login.
+                if ( $author->user_pass == '~~~' ) {
+                        array_push( $flagged['high'], 'has not logged in since we reset passwords in June 2011' );
+                }
+
+                // Check for Yahoo.
+                if ( false !== stripos( $author->user_email, 'yahoo' ) ) {
+                        array_push( $flagged['med'], 'account email contains yahoo and may not get our emails.' );
+                }
+
+                // There has been an uptick in users with names ending in numbers AND being very new, submitting
+                // a lot of plugins after being banned.
+                $two_weeks_ago = time() - ( 2 * WEEK_IN_SECONDS );
+                $four_days_ago = time() - ( 4 * DAY_IN_SECONDS );
+                if ( is_numeric( substr( $author->user_login, - 1, 1 ) ) && strtotime( $author->user_registered ) > $four_days_ago ) {
+                        // Username ends in numbers and is less than 4 days old.
+                        array_push( $flagged['high'], 'account registered less than 4 days ago and username ends in numbers' );
+                } elseif ( is_numeric( substr( $author->user_login, - 1, 1 ) ) ) {
+                        // Username just ends in numbers.
+                        array_push( $flagged['med'], 'username ends in numbers' );
+                } elseif ( strtotime( $author->user_registered ) > $two_weeks_ago && strtotime( $author->user_registered ) < $four_days_ago ) {
+                        // User account was registered less than 2 weeks ago (but longer than 4 days).
+                        array_push( $flagged['low'], 'account registered less than 2 weeks ago' );
+                        // If they have 4+ plugins in 2 weeks, it MAY be an issue.
+                        if ( 4 <= count( $author_plugins ) ) {
+                                array_push( $flagged['med'], 'high number of submitted plugins in a short timeframe' );
+                        }
+                } elseif ( strtotime( $author->user_registered ) > $four_days_ago ) {
+                        // User account was registered less than 4 days ago.
+                        array_push( $flagged['med'], 'account registered less than 4 days ago' );
+                        // If they have 2+ plugins in 4 days, it's a problem.
+                        if ( 2 <= count( $author_plugins ) ) {
+                                array_push( $flagged['high'], 'high number of submitted plugins in a short timeframe' );
+                        }
+                }
+
+                // Check IPs.
+                $post_ids = get_posts( array(
+                        'fields'         => 'ids',
+                        'post_type'      => 'plugin',
+                        'post_status'    => 'any',
+                        'author'         => $author->ID,
+                        'meta_key'       => '_author_ip',
+                        'posts_per_page' => -1,
+                ) );
+
+                $user_ips = array_unique( array_map( function( $post_id ) {
+                        return get_post_meta( $post_id, '_author_ip', true );
+                }, $post_ids ) );
+
+                if ( $user_ips ) {
+                        sort( $user_ips, SORT_NUMERIC );
+
+                        foreach ( $user_ips as $check_ip ) {
+                                // if IP is 100% bad, it's a high flag.
+                                if ( in_array( $check_ip, self::$iffy_ips ) ) {
+                                        array_push( $flagged['high'], 'uses known bad IP - ' . $check_ip );
+                                } else {
+                                        foreach ( self::$iffy_ips as $check_iffy_ip ) {
+                                                if ( false !== strpos( $check_ip, $check_iffy_ip ) ) {
+                                                        array_push( $flagged['med'], 'IP is partial match to known bad IPs - ' . $check_ip . ' vs ' . $check_iffy_ip );
+                                                }
+                                        }
+                                }
+                        }
+                }
+
+                // Remove any keys that have no warnngs.
+                foreach ( $flagged as $level => $reasons ) {
+                        if ( ! $reasons ) {
+                                unset( $flagged[ $level ] );
+                        }
+                }
+
+                return $flagged;
+
         }