Changeset 10579

Timestamp:

01/14/2021 06:06:09 AM (4 years ago)

Author:

dd32

Message:

Authentication: Display the blocked user warning upon attempting to login after [10578].

See #4691.

File:

• sites/trunk/common/includes/wporg-sso/wp-plugin.php (modified) (2 diffs)

sites/trunk/common/includes/wporg-sso/wp-plugin.php

@@ -56 +56 @@
 
                 add_filter( 'allow_password_reset', array( $this, 'disable_password_reset_for_blocked_users' ), 10, 2 );
-                add_filter( 'authenticate', array( $this, 'authenticate_block_check' ), 30 );
+                add_filter( 'authenticate', array( $this, 'authenticate_block_check' ), 5, 2 );
 
                 add_filter( 'password_change_email', array( $this, 'replace_admin_email_in_change_emails' ) );
@@ -90 +90 @@
          * @param WP_User|WP_Error|null $user WP_User or WP_Error object if a previous
          *                                    callback failed authentication.
+         * @param string $user_login The user login attmpting to login.
          * @return WP_User|WP_Error WP_User on success, WP_Error on failure.
          */
-        public function authenticate_block_check( $user ) {
-            if ( $user instanceof WP_User && defined( 'WPORG_SUPPORT_FORUMS_BLOGID' ) ) {
-                $support_user = new WP_User( $user->ID, '', WPORG_SUPPORT_FORUMS_BLOGID );
-
-                if ( ! empty( $support_user->allcaps['bbp_blocked'] ) ) {
+        public function authenticate_block_check( $user, $user_login ) {
+
+            $support_user = get_user_by( 'login', $user_login );
+            if ( $support_user && defined( 'WPORG_SUPPORT_FORUMS_BLOGID' ) ) {
+                $support_user->for_site( WPORG_SUPPORT_FORUMS_BLOGID );
+
+                if (
+                    'BLOCKED' === substr( $support_user->user_pass, 0, 7 ) ||
+                    ! empty( $support_user->allcaps['bbp_blocked'] )
+                ) {
+                    // Returning a WP_Error from an authenticate filter doesn't block auth, as a later hooked item can return truthful.
+                    // By removing all actions, we can catch both the bbp_blocked role for old users, and those whose passwords were broken via https://meta.trac.wordpress.org/changeset/10578
+                    remove_all_actions( 'authenticate' );
+
                     return new WP_Error(
                         'blocked_account',