Changeset 10579

Timestamp:

01/14/2021 06:06:09 AM (6 years ago)

Author:

dd32

Message:

Authentication: Display the blocked user warning upon attempting to login after [10578].

See #4691.

File:

• sites/trunk/common/includes/wporg-sso/wp-plugin.php (modified) (2 diffs)

sites/trunk/common/includes/wporg-sso/wp-plugin.php

@@ -56 +56 @@
 
                                 add_filter( 'allow_password_reset', array( $this, 'disable_password_reset_for_blocked_users' ), 10, 2 );
-                                add_filter( 'authenticate', array( $this, 'authenticate_block_check' ), 30 );
+                                add_filter( 'authenticate', array( $this, 'authenticate_block_check' ), 5, 2 );
 
                                 add_filter( 'password_change_email', array( $this, 'replace_admin_email_in_change_emails' ) );
@@ -90 +90 @@
                  * @param WP_User|WP_Error|null $user WP_User or WP_Error object if a previous
                  *                                    callback failed authentication.
+                 * @param string $user_login The user login attmpting to login.
                  * @return WP_User|WP_Error WP_User on success, WP_Error on failure.
                  */
-                public function authenticate_block_check( $user ) {
-                        if ( $user instanceof WP_User && defined( 'WPORG_SUPPORT_FORUMS_BLOGID' ) ) {
-                                $support_user = new WP_User( $user->ID, '', WPORG_SUPPORT_FORUMS_BLOGID );
-
-                                if ( ! empty( $support_user->allcaps['bbp_blocked'] ) ) {
+                public function authenticate_block_check( $user, $user_login ) {
+
+                        $support_user = get_user_by( 'login', $user_login );
+                        if ( $support_user && defined( 'WPORG_SUPPORT_FORUMS_BLOGID' ) ) {
+                                $support_user->for_site( WPORG_SUPPORT_FORUMS_BLOGID );
+
+                                if (
+                                        'BLOCKED' === substr( $support_user->user_pass, 0, 7 ) ||
+                                        ! empty( $support_user->allcaps['bbp_blocked'] )
+                                ) {
+                                        // Returning a WP_Error from an authenticate filter doesn't block auth, as a later hooked item can return truthful.
+                                        // By removing all actions, we can catch both the bbp_blocked role for old users, and those whose passwords were broken via https://meta.trac.wordpress.org/changeset/10578
+                                        remove_all_actions( 'authenticate' );
+
                                         return new WP_Error(
                                                 'blocked_account',