Making WordPress.org


Ignore:
Timestamp:
11/13/2016 07:01:01 PM (7 years ago)
Author:
ocean90
Message:

WordPress.org SSO: Disable login and password reset for blocked users.

File:
1 edited

Legend:

Unmodified
Added
Removed
  • sites/trunk/common/includes/wporg-sso/wp-plugin.php

    r4203 r4353  
    3535                remove_action( 'after_password_reset', 'wp_password_change_notification' );
    3636
     37                add_filter( 'allow_password_reset', array( $this, 'disable_password_reset_for_blocked_users' ), 10, 2 );
     38                add_filter( 'authenticate', array( $this, 'authenticate_block_check' ), 30 );
     39
    3740                add_filter( 'password_change_email', array( $this, 'replace_admin_email_in_change_emails' ) );
    3841                add_filter( 'email_change_email', array( $this, 'replace_admin_email_in_change_emails' ) );
    3942            }
     43        }
     44
     45        /**
     46         * Checks if the authenticated user has been marked as blocked.
     47         *
     48         * @param WP_User|WP_Error|null $user WP_User or WP_Error object if a previous
     49         *                                    callback failed authentication.
     50         * @return WP_User|WP_Error WP_User on success, WP_Error on failure.
     51         */
     52        public function authenticate_block_check( $user ) {
     53            if ( $user instanceof WP_User && defined( 'WPORG_SUPPORT_FORUMS_BLOGID' ) ) {
     54                $support_user = new WP_User( $user->ID, '', WPORG_SUPPORT_FORUMS_BLOGID );
     55
     56                if ( ! empty( $support_user->allcaps['bbp_blocked'] ) ) {
     57                    return new WP_Error( 'blocked_account', __( '<strong>ERROR</strong>: Your account has been disabled.', 'wporg-sso' ) );
     58                }
     59            }
     60
     61            return $user;
     62        }
     63
     64        /**
     65         * Disables password reset for blocked users.
     66         *
     67         * @param bool $allow   Whether to allow the password to be reset.
     68         * @param int  $user_id The ID of the user attempting to reset a password.
     69         * @return bool True if user is blocked, false if not.
     70         */
     71        public function disable_password_reset_for_blocked_users( $allow, $user_id ) {
     72            if ( ! defined( 'WPORG_SUPPORT_FORUMS_BLOGID' ) ) {
     73                return $allow;
     74            }
     75
     76            $user = new WP_User( $user_id, '', WPORG_SUPPORT_FORUMS_BLOGID );
     77            $is_blocked = ! empty( $user->allcaps['bbp_blocked'] );
     78            return ! $is_blocked;
    4079        }
    4180
Note: See TracChangeset for help on using the changeset viewer.