Changeset 10578

Timestamp:

01/14/2021 05:44:38 AM (4 years ago)

Author:

dd32

Message:

Support Forums: When a user is blocked on the forums, break their password hash to prevent logins and terminate all current sessions (WordPress & Trac).

See #4691.

File:

• sites/trunk/wordpress.org/public_html/wp-content/plugins/support-forums/inc/class-hooks.php (modified) (2 diffs)

sites/trunk/wordpress.org/public_html/wp-content/plugins/support-forums/inc/class-hooks.php

@@ -128 +128 @@
         // Add a no-reply-to-email suggestion to topic subscription emails
         add_filter( 'bbp_subscription_mail_message', array( $this, 'bbp_subscription_mail_message'), 5, 3 );
+
+        // Break users sessions / passwords when they get blocked.
+        add_action( 'bbp_set_user_role', array( $this, 'user_blocked_password_handler' ), 10, 3 );
     }
 
@@ -1279 +1282 @@
         return $message;
     }
+
+    /**
+     * Catch a user being blocked / unblocked and set their password appropriately.
+     */
+    public function user_blocked_password_handler( $new_role, $user_id, \WP_User $user ) {
+        global $wpdb;
+
+        // ~~~ is a reset password on WordPress.org. Let's ignore those.
+        if ( '~~~' === $user->user_pass ) {
+            return;
+        }
+
+        // bbPress 1.x used `{$user_pass}---{$secret}` while we're using the reverse here.
+        // This is to ensure that anything that uses the password hash as part of a cookie no longer validates.
+        $blocked_prefix  = 'BLOCKED' . substr( wp_hash( 'bb_break_password' ), 0, 13 ) . '---';
+        $blocked_role    = bbp_get_blocked_role();
+        $password_broken = ( 0 === strpos( $user->user_pass, $blocked_prefix ) );
+
+        if ( $blocked_role === $new_role && ! $password_broken ) {
+            // User has been blocked, break their password and sessions.
+            // WordPress doesn't have a way to edit a user password without re-hashing it.
+            $wpdb->update(
+                $wpdb->users,
+                array(
+                    'user_pass' => $blocked_prefix . $user->user_pass,
+                ),
+                array(
+                    'ID' => $user->ID
+                )
+            );
+
+            clean_user_cache( $user );
+
+            // Destroy all of their WordPress sessions.
+            $manager = \WP_Session_Tokens::get_instance( $user->ID );
+            $manager->destroy_all();
+
+        } else if (
+            $password_broken &&
+            ! $user->has_role( $blocked_role )
+        ) {
+            // User was blocked (broken password) but no longer is.
+            // WordPress doesn't have a way to edit a user password without re-hashing it.
+            $wpdb->update(
+                $wpdb->users,
+                array(
+                    'user_pass' => substr( $user->user_pass, strlen( $blocked_prefix ) ),
+                ),
+                array(
+                    'ID' => $user->ID
+                )
+            );
+
+            clean_user_cache( $user );
+        }
+    }
 }