Changeset 14262

Timestamp:

12/11/2024 05:36:31 AM (21 months ago)

Author:

dd32

Message:

Plugin Directory: Require 2FA verification to confirm a plugin release.

This replaces the email access links.
All plugin committers are required to have 2FA enabled now.

Closes ​https://github.com/WordPress/wordpress.org/pull/344.
Fixes #7704.

Location:

sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory

Files:

• api/routes/class-plugin-release-confirmation.php (modified) (4 diffs)
• class-template.php (modified) (1 diff)
• email/class-release-confirmation-access.php (deleted)
• shortcodes/class-release-confirmation.php (modified) (6 diffs)

sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/api/routes/class-plugin-release-confirmation.php

@@ -7 +7 @@
 use WordPressdotorg\Plugin_Directory\Tools;
 use WordPressdotorg\Plugin_Directory\Jobs\Plugin_Import;
-use WordPressdotorg\Plugin_Directory\Shortcodes\Release_Confirmation as Release_Confirmation_Shortcode;
 use WordPressdotorg\Plugin_Directory\Email\Release_Confirmation_Enabled as Release_Confirmation_Enabled_Email;
-use WordPressdotorg\Plugin_Directory\Email\Release_Confirmation_Access as Release_Confirmation_Access_Email;
+use Two_Factor_Core;
+use function WordPressdotorg\Two_Factor\Revalidation\{
+        get_status as get_revalidation_status,
+        get_url as get_revalidation_url,
+};
 
 /**
@@ -80 +83 @@
                                 return false;
                         },
-                ] );
-
-                register_rest_route( 'plugins/v1', '/release-confirmation-access', [
-                        'methods'             => \WP_REST_Server::READABLE,
-                        'callback'            => [ $this, 'send_access_email' ],
-                        'args'                => [
-                        ],
-                        'permission_callback' => 'is_user_logged_in',
                 ] );
 
@@ -119 +114 @@
                 $plugin = Plugin_Directory::get_plugin_post( $request['plugin_slug'] );
 
-                return (
-                        Release_Confirmation_Shortcode::can_access() &&
-                        current_user_can( 'plugin_manage_releases', $plugin )
-                );
+                if ( ! $plugin || ! current_user_can( 'plugin_manage_releases', $plugin ) ) {
+                        return false;
+                }
+
+                // Check to see if they've confirmed their 2FA status recently..
+                $status = get_revalidation_status();
+                if ( $status && $status['can_save'] ) {
+                        return true;
+                }
+
+                // Before we say no, check if the user just needs to validate their 2FA.
+                if ( $status && $status['needs_revalidate'] && 'GET' === $request->get_method() ) {
+                        $current_rest_url = add_query_arg(
+                                array(
+                                        '_wpnonce'         => wp_create_nonce( 'wp_rest' ),
+                                        '_wp_http_referer' => wp_get_referer(),
+                                ),
+                                get_rest_url( null, $request->get_route() )
+                        );
+
+                        wp_safe_redirect( get_revalidation_url( $current_rest_url ) );
+                        exit;
+                }
+
+                return false;
         }
 
@@ -300 +316 @@
         }
 
-        /**
-         * Send a Access email
-         */
-        public function send_access_email( $request ) {
-                $result = [
-                        'location' => wp_get_referer() ?: home_url( '/developers/releases/' ),
-                ];
-                $result['location'] = add_query_arg( 'send_access_email', '1', $result['location'] );
-                header( 'Location: ' . $result['location'] );
-
-                $email = new Release_Confirmation_Access_Email(
-                        wp_get_current_user()
-                );
-                $result['sent'] = $email->send();
-
-                return $result;
-        }
-
         public function validate_plugin_tag_callback( $tag, $request ) {
                 $plugin = Plugin_Directory::get_plugin_post( $request['plugin_slug'] );

sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/class-template.php

@@ -999 +999 @@
                         array( '_wpnonce' => wp_create_nonce( 'wp_rest' ) ),
                         $url
-                );
-        }
-
-        /**
-         * Generates a link to email the release confirmation link.
-         *
-         * @param int|\WP_Post|null $post Optional. Post ID or post object. Defaults to global $post.
-         * @return string URL to enable confirmations.
-         */
-        public static function get_release_confirmation_access_link() {
-                return add_query_arg(
-                        array( '_wpnonce' => wp_create_nonce( 'wp_rest' ) ),
-                        home_url( 'wp-json/plugins/v1/release-confirmation-access' )
                 );
         }

sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/shortcodes/class-release-confirmation.php

@@ -5 +5 @@
 use WordPressdotorg\Plugin_Directory\Template;
 use WordPressdotorg\Plugin_Directory\Tools;
+use Two_Factor_Core;
+use function WordPressdotorg\Two_Factor\{
+        Revalidation\get_status as get_revalidation_status,
+        Revalidation\get_js_url as get_revalidation_js_url,
+        get_onboarding_account_url as get_2fa_onboarding_url
+};
 
 /**
@@ -14 +20 @@
 
         const SHORTCODE = 'release-confirmation';
-        const COOKIE    = 'release_confirmation_access_token';
-        const META_KEY  = '_release_confirmation_access_token';
         const URL_PARAM = 'access_token';
 
@@ -59 +63 @@
                 ob_start();
 
-                $should_show_access_notice = false;
-                foreach ( $plugins as $plugin ) {
-                        if ( $plugin->release_confirmation ) {
-                                $should_show_access_notice = true;
-                        }
-                }
-
-                if ( ! self::can_access() && $should_show_access_notice ) {
-                        if ( isset( $_REQUEST['send_access_email'] ) ) {
-                                printf(
-                                        '<div class="plugin-notice notice notice-info notice-alt"><p>%s</p></div>',
-                                        __( 'Check your email for an access link to perform actions.', 'wporg-plugins')
-                                );
-                        } else {
-                                printf(
-                                        '<div class="plugin-notice notice notice-info notice-alt"><p>%s</p></div>',
-                                        sprintf(
-                                                /* translators: %s: URL */
-                                                __( 'Check your email for an access link, or <a href="%s">request a new email</a> to perform actions.', 'wporg-plugins'),
-                                                Template::get_release_confirmation_access_link()
-                                        )
-                                );
-                        }
+                // If the user is not using 2FA, show a notice.
+                if ( ! Two_Factor_Core::is_user_using_two_factor( get_current_user_id() ) ) {
+                        printf(
+                                '<div class="plugin-notice notice notice-error notice-alt"><p>%s</p></div>',
+                                sprintf(
+                                        __( 'Your account has elevated privileges and requires extra security before you can manage plugin releases. Please <a href="%s">enable two-factor authentication now</a>.', 'wporg-plugins' ),
+                                        get_2fa_onboarding_url()
+                                )
+                        );
                 }
 
@@ -246 +236 @@
                 $buttons = [];
 
-                if ( $data['confirmations_required'] && empty( $data['discarded'] ) ) {
+                if (
+                        ! is_user_logged_in() ||
+                        ! Two_Factor_Core::is_user_using_two_factor( get_current_user_id() ) ||
+                        ! current_user_can( 'plugin_manage_releases', $plugin  ) ||
+
+                        // No need to show actions if the release can't be confirmed, or is already confirmed
+                        ! $data['confirmations_required'] ||
+                        $data['confirmed']
+                ) {
+                        return '';
+                }
+
+                if ( empty( $data['discarded'] ) ) {
                         $current_user_confirmed = isset( $data['confirmations'][ wp_get_current_user()->user_login ] );
 
-                        if ( ! $current_user_confirmed && ! $data['confirmed'] ) {
-                                if (
-                                        self::can_access() &&
-                                        current_user_can( 'plugin_manage_releases', $plugin  )
-                                ) {
-                                        $buttons[] = sprintf(
-                                                '<a href="%s" class="wp-element-button button approve-release">%s</a>',
-                                                Template::get_release_confirmation_link( $data['tag'], $plugin ),
-                                                __( 'Confirm', 'wporg-plugins' )
-                                        );
-                                        $buttons[] = sprintf(
-                                                '<a href="%s" class="wp-element-button button approve-release">%s</a>',
-                                                Template::get_release_confirmation_link( $data['tag'], $plugin, 'discard' ),
-                                                __( 'Discard', 'wporg-plugins' )
-                                        );
-                                } else {
-                                        $buttons[] = sprintf(
-                                                '<a class="wp-element-button button approve-release disabled">%s</a>',
-                                                __( 'Confirm', 'wporg-plugins' )
-                                        );
-                                        $buttons[] = sprintf(
-                                                '<a class="wp-element-button button approve-release disabled">%s</a>',
-                                                __( 'Discard', 'wporg-plugins' )
-                                        );
-                                }
-
-                        } elseif ( $current_user_confirmed ) {
+                        if ( ! $current_user_confirmed ) {
+                                $confirm_link = Template::get_release_confirmation_link( $data['tag'], $plugin );
+                                $discard_link = Template::get_release_confirmation_link( $data['tag'], $plugin, 'discard' );
+
+                                $confirm_link = get_revalidation_js_url( $confirm_link );
+                                $discard_link = get_revalidation_js_url( $discard_link );
+
                                 $buttons[] = sprintf(
-                                        '<a class="wp-element-button button approve-release disabled">%s</a>',
-                                        __( 'Confirmed', 'wporg-plugins' )
-                                );
+                                        '<a href="%s" class="wp-element-button button approve-release" data-2fa-required data-2fa-message="%s">%s</a>',
+                                        $confirm_link,
+                                        esc_attr(
+                                                sprintf(
+                                                        /* translators: 1: Version number, 2: Plugin name. */
+                                                        __( 'Confirm your Two-Factor Authentication to release version %1$s of %2$s.', 'wporg-plugins' ),
+                                                        esc_html( $data['version'] ),
+                                                        $plugin->post_title
+                                                )
+                                        ),
+                                        __( 'Confirm', 'wporg-plugins' )
+                                );
+
+                                $buttons[] = sprintf(
+                                        '<a href="%s" class="wp-element-button button approve-release" data-2fa-required data-2fa-message="%s">%s</a>',
+                                        $discard_link,
+                                        esc_attr(
+                                                sprintf(
+                                                        /* translators: 1: Version number, 2: Plugin name. */
+                                                        __( 'Confirm your Two-Factor Authentication to discard the release %1$s for %2$s.', 'wporg-plugins' ),
+                                                        esc_html( $data['version'] ),
+                                                        $plugin->post_title
+                                                )
+                                        ),
+                                        __( 'Discard', 'wporg-plugins' )
+                                );
+
                         }
                 } elseif (
@@ -297 +303 @@
         }
 
-        static function can_access() {
-                if ( ! is_user_logged_in() ) {
-                        return false;
-                }
-
-                // Plugin reviewers can always access the release management functionality, in wp-admin.
-                if ( current_user_can( 'plugin_review' ) && ( is_admin() || wp_is_serving_rest_request() ) ) {
-                        return true;
-                }
-
-                // Must have an access token..
-                if ( empty( $_COOKIE[ self::COOKIE ] ) ) {
-                        return false;
-                }
-
-                // ...and it be valid..
-                $token = get_user_meta( get_current_user_id(), self::META_KEY, true );
-                if (
-                        $token &&
-                        $token['time'] > ( time() - DAY_IN_SECONDS ) &&
-                        wp_check_password( $_COOKIE[ self::COOKIE ], $token['token'] )
-                ) {
-                        return true;
-                }
-
-                return false;
-        }
-
         static function generate_access_url( $user = null ) {
-                if ( ! $user ) {
-                        $user = wp_get_current_user();
-                }
-                if ( ! $user || ! $user->exists() ) {
-                        return false;
-                }
-
-                $time      = time();
-                $plaintext = wp_generate_password( 24, false );
-                $token     = wp_hash_password( $plaintext );
-                update_user_meta( $user->ID, self::META_KEY, compact( 'token', 'time' ) );
-
-                $url = add_query_arg(
-                        self::URL_PARAM,
-                        urlencode( $plaintext ),
-                        home_url( '/developers/releases/' )
-                );
-
-                return $url;
+                return home_url( '/developers/releases/' );
         }
 
@@ -351 +311 @@
                 if ( ! $post || ! is_page() || ! has_shortcode( $post->post_content, self::SHORTCODE ) ) {
                         return;
-                }
-
-                // Migrate URL param to cookie.
-                if ( isset( $_REQUEST[ self::URL_PARAM ] ) ) {
-                        setcookie( self::COOKIE, $_REQUEST[ self::URL_PARAM ], time() + DAY_IN_SECONDS, '/plugins/', 'wordpress.org', true, true );
-                }
-
-                // Expire the cookie when needed. This is not for security, only performance / cleanliness.
-                if ( isset( $_COOKIE[ self::COOKIE ] ) && ! self::can_access() ) {
-                        unset( $_COOKIE[ self::COOKIE ] );
-                        setcookie( self::COOKIE, false, time() - DAY_IN_SECONDS );
                 }