Changeset 13937

Timestamp:

07/31/2024 05:06:46 AM (7 weeks ago)

Author:

dd32

Message:

Login: Only nag users to setup 2FA every week, not every login.

This only applies to users whom 2FA is optional, but encouraged.

See ​https://github.com/WordPress/wporg-two-factor/pull/288

Location:

sites/trunk

Files:

• common/includes/wporg-sso/wp-plugin.php (modified) (2 diffs)
• wordpress.org/public_html/wp-content/themes/pub/wporg-login/enable-2fa.php (modified) (1 diff)

sites/trunk/common/includes/wporg-sso/wp-plugin.php

@@ -1 +1 @@
 <?php
-use function WordPressdotorg\Two_Factor\user_should_2fa;
+use function WordPressdotorg\Two_Factor\{ user_should_2fa, user_requires_2fa };
 
 /**
@@ -822 +822 @@
         public function maybe_redirect_to_enable_2fa( $redirect, $orig_redirect, $user ) {
             if (
-                ! str_contains( $redirect, '/enable-2fa' ) &&
-                ! is_wp_error( $user ) &&
-                user_should_2fa( $user ) &&
-                ! Two_Factor_Core::is_user_using_two_factor( $user->ID )
+                // No valid user.
+                is_wp_error( $user ) ||
+                // Or we're already going there.
+                str_contains( $redirect, '/enable-2fa' ) ||
+                // Or if the user doesn't need 2FA.
+                ! user_should_2fa( $user ) ||
+                // Or the user is already using 2FA.
+                Two_Factor_Core::is_user_using_two_factor( $user->ID )
             ) {
-                $redirect = add_query_arg(
-                    'redirect_to',
-                    urlencode( $redirect ),
-                    home_url( '/enable-2fa' )
-                );
-            }
-
-            return $redirect;
+                // Then we don't need to redirect to the enable 2FA page.
+                return $redirect;
+            }
+
+            // If the user doesn't REQUIRE 2FA, only nag ever so often.
+            if ( ! user_requires_2fa( $user ) ) {
+                $nag_interval = WEEK_IN_SECONDS;
+                $last_nagged  = (int) get_user_meta( $user->ID, 'last_2fa_nag', true );
+                if ( $last_nagged && $last_nagged > ( time() - $nag_interval ) ) {
+                    return $redirect;
+                }
+            }
+
+            // Redirect to the Enable 2FA nag.
+            return add_query_arg(
+                'redirect_to',
+                urlencode( $redirect ),
+                home_url( '/enable-2fa' )
+            );
         }
 

sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-login/enable-2fa.php

@@ -11 +11 @@
 $should_2fa   = user_should_2fa( $user ); // If they're on this page, this should be truthful.
 $redirect_to  = wp_validate_redirect( wp_unslash( $_REQUEST['redirect_to'] ?? '' ), wporg_login_wordpress_url() );
+
+/*
+ * Record the last time we naged the user about 2FA.
+ * See WPORG_SSO::maybe_redirect_to_enable_2fa().
+ * Note, this isn't in the above function, incase the redirect ultimately filtered to elsewhere.
+ */
+update_user_meta( $user->ID, 'last_2fa_nag', time() );
 
 get_header();