Changeset 13926

Timestamp:

07/26/2024 03:59:52 AM (7 weeks ago)

Author:

dd32

Message:

Login: Remind users to enable 2FA upon login if they should have it enabled.

Currently this is only for "special" users, but user_should_2fa() will be extended to other roles soon.

Closes ​https://github.com/WordPress/wordpress.org/pull/351
See ​https://github.com/WordPress/wporg-two-factor/pull/288

Location:

sites/trunk

Files:

• common/includes/wporg-sso/wp-plugin.php (modified) (4 diffs)
• wordpress.org/public_html/wp-content/themes/pub/wporg-login/enable-2fa.php (added)

sites/trunk/common/includes/wporg-sso/wp-plugin.php

@@ -1 +1 @@
 <?php
+use function WordPressdotorg\Two_Factor\user_should_2fa;
+
 /**
  * WordPress-specific WPORG SSO: redirects all WP login and registration screens to our SSO ones.
@@ -27 +29 @@
             // Primarily for logged in users.
             'updated-tos'     => '/updated-policies',
+            'enable-2fa'      => '/enable-2fa',
             'logout'          => '/logout',
 
@@ -94 +97 @@
                     // Updated TOS interceptor.
                     add_filter( 'send_auth_cookies', [ $this, 'maybe_block_auth_cookies' ], 100, 5 );
+
+                    // Maybe nag about 2FA
+                    add_filter( 'login_redirect', [ $this, 'maybe_redirect_to_enable_2fa' ], 1000, 3 );
                 }
             }
@@ -811 +817 @@
 
         /**
+         * Redirects the user to a "please enable 2fa" page after login.
+         */
+        public function maybe_redirect_to_enable_2fa( $redirect, $orig_redirect, $user ) {
+            if (
+                ! str_contains( $redirect, '/enable-2fa' ) &&
+                ! is_wp_error( $user ) &&
+                user_should_2fa( $user ) &&
+                ! Two_Factor_Core::is_user_using_two_factor( $user->ID )
+            ) {
+                $redirect = add_query_arg(
+                    'redirect_to',
+                    urlencode( $redirect ),
+                    home_url( '/enable-2fa' )
+                );
+            }
+
+            return $redirect;
+        }
+
+        /**
          * Whether the given user_id has agreed to the current version of the TOS.
          */