Changeset 14262 for sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/shortcodes/class-release-confirmation.php

Timestamp:

12/11/2024 05:36:31 AM (18 months ago)

Author:

dd32

Message:

Plugin Directory: Require 2FA verification to confirm a plugin release.

This replaces the email access links.
All plugin committers are required to have 2FA enabled now.

Closes ​https://github.com/WordPress/wordpress.org/pull/344.
Fixes #7704.

File:

• sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/shortcodes/class-release-confirmation.php (modified) (6 diffs)

sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/shortcodes/class-release-confirmation.php

@@ -5 +5 @@
 use WordPressdotorg\Plugin_Directory\Template;
 use WordPressdotorg\Plugin_Directory\Tools;
+use Two_Factor_Core;
+use function WordPressdotorg\Two_Factor\{
+    Revalidation\get_status as get_revalidation_status,
+    Revalidation\get_js_url as get_revalidation_js_url,
+    get_onboarding_account_url as get_2fa_onboarding_url
+};
 
 /**
@@ -14 +20 @@
 
     const SHORTCODE = 'release-confirmation';
-    const COOKIE    = 'release_confirmation_access_token';
-    const META_KEY  = '_release_confirmation_access_token';
     const URL_PARAM = 'access_token';
 
@@ -59 +63 @@
         ob_start();
 
-        $should_show_access_notice = false;
-        foreach ( $plugins as $plugin ) {
-            if ( $plugin->release_confirmation ) {
-                $should_show_access_notice = true;
-            }
-        }
-
-        if ( ! self::can_access() && $should_show_access_notice ) {
-            if ( isset( $_REQUEST['send_access_email'] ) ) {
-                printf(
-                    '<div class="plugin-notice notice notice-info notice-alt"><p>%s</p></div>',
-                    __( 'Check your email for an access link to perform actions.', 'wporg-plugins')
-                );
-            } else {
-                printf(
-                    '<div class="plugin-notice notice notice-info notice-alt"><p>%s</p></div>',
-                    sprintf(
-                        /* translators: %s: URL */
-                        __( 'Check your email for an access link, or <a href="%s">request a new email</a> to perform actions.', 'wporg-plugins'),
-                        Template::get_release_confirmation_access_link()
-                    )
-                );
-            }
+        // If the user is not using 2FA, show a notice.
+        if ( ! Two_Factor_Core::is_user_using_two_factor( get_current_user_id() ) ) {
+            printf(
+                '<div class="plugin-notice notice notice-error notice-alt"><p>%s</p></div>',
+                sprintf(
+                    __( 'Your account has elevated privileges and requires extra security before you can manage plugin releases. Please <a href="%s">enable two-factor authentication now</a>.', 'wporg-plugins' ),
+                    get_2fa_onboarding_url()
+                )
+            );
         }
 
@@ -246 +236 @@
         $buttons = [];
 
-        if ( $data['confirmations_required'] && empty( $data['discarded'] ) ) {
+        if (
+            ! is_user_logged_in() ||
+            ! Two_Factor_Core::is_user_using_two_factor( get_current_user_id() ) ||
+            ! current_user_can( 'plugin_manage_releases', $plugin  ) ||
+
+            // No need to show actions if the release can't be confirmed, or is already confirmed
+            ! $data['confirmations_required'] ||
+            $data['confirmed']
+        ) {
+            return '';
+        }
+
+        if ( empty( $data['discarded'] ) ) {
             $current_user_confirmed = isset( $data['confirmations'][ wp_get_current_user()->user_login ] );
 
-            if ( ! $current_user_confirmed && ! $data['confirmed'] ) {
-                if (
-                    self::can_access() &&
-                    current_user_can( 'plugin_manage_releases', $plugin  )
-                ) {
-                    $buttons[] = sprintf(
-                        '<a href="%s" class="wp-element-button button approve-release">%s</a>',
-                        Template::get_release_confirmation_link( $data['tag'], $plugin ),
-                        __( 'Confirm', 'wporg-plugins' )
-                    );
-                    $buttons[] = sprintf(
-                        '<a href="%s" class="wp-element-button button approve-release">%s</a>',
-                        Template::get_release_confirmation_link( $data['tag'], $plugin, 'discard' ),
-                        __( 'Discard', 'wporg-plugins' )
-                    );
-                } else {
-                    $buttons[] = sprintf(
-                        '<a class="wp-element-button button approve-release disabled">%s</a>',
-                        __( 'Confirm', 'wporg-plugins' )
-                    );
-                    $buttons[] = sprintf(
-                        '<a class="wp-element-button button approve-release disabled">%s</a>',
-                        __( 'Discard', 'wporg-plugins' )
-                    );
-                }
-
-            } elseif ( $current_user_confirmed ) {
+            if ( ! $current_user_confirmed ) {
+                $confirm_link = Template::get_release_confirmation_link( $data['tag'], $plugin );
+                $discard_link = Template::get_release_confirmation_link( $data['tag'], $plugin, 'discard' );
+
+                $confirm_link = get_revalidation_js_url( $confirm_link );
+                $discard_link = get_revalidation_js_url( $discard_link );
+
                 $buttons[] = sprintf(
-                    '<a class="wp-element-button button approve-release disabled">%s</a>',
-                    __( 'Confirmed', 'wporg-plugins' )
-                );
+                    '<a href="%s" class="wp-element-button button approve-release" data-2fa-required data-2fa-message="%s">%s</a>',
+                    $confirm_link,
+                    esc_attr(
+                        sprintf(
+                            /* translators: 1: Version number, 2: Plugin name. */
+                            __( 'Confirm your Two-Factor Authentication to release version %1$s of %2$s.', 'wporg-plugins' ),
+                            esc_html( $data['version'] ),
+                            $plugin->post_title
+                        )
+                    ),
+                    __( 'Confirm', 'wporg-plugins' )
+                );
+
+                $buttons[] = sprintf(
+                    '<a href="%s" class="wp-element-button button approve-release" data-2fa-required data-2fa-message="%s">%s</a>',
+                    $discard_link,
+                    esc_attr(
+                        sprintf(
+                            /* translators: 1: Version number, 2: Plugin name. */
+                            __( 'Confirm your Two-Factor Authentication to discard the release %1$s for %2$s.', 'wporg-plugins' ),
+                            esc_html( $data['version'] ),
+                            $plugin->post_title
+                        )
+                    ),
+                    __( 'Discard', 'wporg-plugins' )
+                );
+
             }
         } elseif (
@@ -297 +303 @@
     }
 
-    static function can_access() {
-        if ( ! is_user_logged_in() ) {
-            return false;
-        }
-
-        // Plugin reviewers can always access the release management functionality, in wp-admin.
-        if ( current_user_can( 'plugin_review' ) && ( is_admin() || wp_is_serving_rest_request() ) ) {
-            return true;
-        }
-
-        // Must have an access token..
-        if ( empty( $_COOKIE[ self::COOKIE ] ) ) {
-            return false;
-        }
-
-        // ...and it be valid..
-        $token = get_user_meta( get_current_user_id(), self::META_KEY, true );
-        if (
-            $token &&
-            $token['time'] > ( time() - DAY_IN_SECONDS ) &&
-            wp_check_password( $_COOKIE[ self::COOKIE ], $token['token'] )
-        ) {
-            return true;
-        }
-
-        return false;
-    }
-
     static function generate_access_url( $user = null ) {
-        if ( ! $user ) {
-            $user = wp_get_current_user();
-        }
-        if ( ! $user || ! $user->exists() ) {
-            return false;
-        }
-
-        $time      = time();
-        $plaintext = wp_generate_password( 24, false );
-        $token     = wp_hash_password( $plaintext );
-        update_user_meta( $user->ID, self::META_KEY, compact( 'token', 'time' ) );
-
-        $url = add_query_arg(
-            self::URL_PARAM,
-            urlencode( $plaintext ),
-            home_url( '/developers/releases/' )
-        );
-
-        return $url;
+        return home_url( '/developers/releases/' );
     }
 
@@ -351 +311 @@
         if ( ! $post || ! is_page() || ! has_shortcode( $post->post_content, self::SHORTCODE ) ) {
             return;
-        }
-
-        // Migrate URL param to cookie.
-        if ( isset( $_REQUEST[ self::URL_PARAM ] ) ) {
-            setcookie( self::COOKIE, $_REQUEST[ self::URL_PARAM ], time() + DAY_IN_SECONDS, '/plugins/', 'wordpress.org', true, true );
-        }
-
-        // Expire the cookie when needed. This is not for security, only performance / cleanliness.
-        if ( isset( $_COOKIE[ self::COOKIE ] ) && ! self::can_access() ) {
-            unset( $_COOKIE[ self::COOKIE ] );
-            setcookie( self::COOKIE, false, time() - DAY_IN_SECONDS );
         }