Changeset 6737

Timestamp:

02/25/2018 04:46:39 AM (8 years ago)

Author:

obenland

Message:

2FA: First pass at new user edit UI.

Needs more work around changing devices, backup codes, and (possibly) application passwords.

See #77.

Location:

sites/trunk/wordpress.org/public_html/wp-content/plugins/wporg-two-factor

Files:

• js (added)
• js/profile-edit.js (added)
• wporg-two-factor.php (modified) (2 diffs)

sites/trunk/wordpress.org/public_html/wp-content/plugins/wporg-two-factor/wporg-two-factor.php

@@ -14 +14 @@
         public function __construct() {
                 add_filter( 'two_factor_providers', [ $this, 'two_factor_providers' ] );
+
+                remove_action( 'edit_user_profile', [ 'Two_Factor_Core', 'user_two_factor_options' ] );
+                remove_action( 'show_user_profile', [ 'Two_Factor_Core', 'user_two_factor_options' ] );
+
+                if ( ! is_admin() ) {
+                        add_action( 'edit_user_profile', [ $this, 'user_two_factor_options' ] );
+                        add_action( 'show_user_profile', [ $this, 'user_two_factor_options' ] );
+                }
+
+                add_action( 'wp_ajax_two-factor-totp-verify-code',[ $this, 'ajax_verify_code' ] );
+                add_action( 'wp_ajax_two-factor-disable',[ $this, 'ajax_disable' ] );
         }
 
@@ -31 +42 @@
                 return $wporg_providers;
         }
+
+        /**
+         * Displays the UI to set up and remove 2FA.
+         *
+         * @param \WP_User $user User object.
+         */
+        public function user_two_factor_options( $user ) {
+                wp_enqueue_script( 'two-factor-edit', plugins_url( 'js/profile-edit.js' , __FILE__ ), [ 'jquery' ], 1, true );
+
+                $key       = get_user_meta( $user->ID, Two_Factor_Totp::SECRET_META_KEY, true );
+                $is_active = !! $key;
+                ?>
+
+                <h2 class="entry-title"><?php esc_html_e( 'Two Factor Authentication', 'wporg' ); ?></h2>
+                <?php Two_Factor_Totp::admin_notices(); ?>
+                <fieldset id="two-factor-active" class="bbp-form two-factor" <?php if ( ! $is_active ) { echo 'style="display:none;"'; } ?>>
+                        <legend><?php esc_html_e( 'Two Factor Authentication', 'wporg' ); ?></legend>
+                        <div><?php echo wp_kses_post( __( '<strong>Status:</strong> Two Factor Authentication is currently <span>ACTIVE</span>.', 'wporg' ) ); ?></div>
+                        <div><?php esc_html_e( 'While enabled, logging in to WordPress.org requires you to enter a unique passcode, generated by an app on your mobile device, in addition to your username and password.', 'wporg' ); ?></div>
+                        <div><?php esc_html_e( 'Switching to a new device? Follow these steps to avoid losing access to your account.', 'wporg' ); ?></div>
+                        <div><button type="cancel" class="button button-secondary alignright"><?php esc_html_e( 'Disable Two Factor Authentication', 'wporg' ); ?></button></div>
+                </fieldset>
+                <?php
+                if ( empty( $key ) ) {
+                        $key = Two_Factor_Totp::generate_key();
+                }
+
+                wp_nonce_field( 'user_two_factor_totp_options', '_nonce_user_two_factor_totp_options' );
+                ?>
+                <fieldset id="two-factor-start" class="bbp-form two-factor" <?php if ( $is_active ) { echo 'style="display:none;"'; } ?>>
+                        <legend><?php esc_html_e( 'Two Factor Authentication', 'wporg' ); ?></legend>
+                        <div><?php esc_html_e( 'Two-Step Authentication adds an extra layer of security to your account. Once enabled, logging in to WordPress.org will require you to enter a unique passcode generated by an app on your mobile device, in addition to your username and password.', 'wporg' ); ?></div>
+                        <div><button type="button" id="two-factor-start-toggle" class="button button-primary"><?php esc_html_e( 'Get Started', 'wporg' ); ?></button></div>
+                </fieldset>
+
+                <fieldset id="two-factor-qr-code" class="bbp-form two-factor" style="display: none;">
+                        <legend><?php esc_html_e( 'Two Factor Authentication', 'wporg' ); ?></legend>
+                        <div>
+                                <p><?php esc_html_e( 'Scan this QR code with your mobile app.', 'wporg' ); ?></p>
+                                <p><button type="button" class="button-link"><?php esc_html_e( 'Can&#8217;t scan the code?', 'wporg' ); ?></button></p>
+                                <img src="<?php echo esc_url( Two_Factor_Totp::get_google_qr_code( 'wordpress.org:' . $user->user_login, $key, 'wordpress.org' ) ); ?>" id="two-factor-totp-qrcode" />
+                                <p><?php esc_html_e( 'Then enter the authentication code provided by the app:', 'wporg' ); ?></p>
+                                <p>
+                                        <label class="screen-reader-text" for="two-factor-totp-authcode"><?php esc_html_e( 'Authentication Code:', 'wporg' ); ?></label>
+                                        <input type="hidden" name="two-factor-totp-key" value="<?php echo esc_attr( $key ) ?>" />
+                                        <input type="tel" name="two-factor-totp-authcode" class="input" value="" size="20" pattern="[0-9]*" placeholder="<?php esc_attr_e( 'e.g. 123456', 'wporg' ); ?>" />
+                                </p>
+                                <button type="cancel" class="button button-secondary alignleft"><?php esc_html_e( 'Cancel', 'wporg' ); ?></button>
+                                <button type="submit" class="button button-primary alignright"><?php esc_html_e( 'Enable', 'wporg' ); ?></button>
+                        </div>
+                </fieldset>
+
+                <fieldset id="two-factor-key-code" class="bbp-form two-factor" style="display: none;">
+                        <legend><?php esc_html_e( 'Two Factor Authentication', 'wporg' ); ?></legend>
+                        <div>
+                                <p><?php esc_html_e( 'Enter this time code into your mobile app.', 'wporg' ); ?></p>
+                                <p><button type="button" class="button-link"><?php esc_html_e( 'Prefer to scan the code?', 'wporg' ); ?></button></p>
+                                <p class="key"><strong><?php echo esc_html( $key ); ?></strong></p>
+                                <p><?php esc_html_e( 'Then enter the authentication code provided by the app:', 'wporg' ); ?></p>
+                                <p>
+                                        <label class="screen-reader-text" for="two-factor-totp-authcode"><?php esc_html_e( 'Authentication Code:', 'wporg' ); ?></label>
+                                        <input type="hidden" name="two-factor-totp-key" value="<?php echo esc_attr( $key ) ?>" />
+                                        <input type="tel" name="two-factor-totp-authcode" class="input" value="" size="20" pattern="[0-9]*" placeholder="<?php esc_attr_e( 'e.g. 123456', 'wporg' ); ?>" />
+                                </p>
+                                <button type="cancel" class="button button-secondary alignleft"><?php esc_html_e( 'Cancel', 'wporg' ); ?></button>
+                                <button type="submit" class="button button-primary alignright"><?php esc_html_e( 'Enable', 'wporg' ); ?></button>
+                        </div>
+                </fieldset>
+
+                <style>
+                        #bbpress-forums fieldset.two-factor:not(#two-factor-start) > div {
+                                margin-left: 20%;
+                                width: 60% !important;
+                        }
+                        #bbpress-forums .two-factor button.button-link {
+                                color: #4ca6cf;
+                                padding: 0;
+                        }
+                        #bbpress-forums .two-factor .key {
+                                padding: 2rem 0;
+                        }
+                </style>
+
+                <?php
+        }
+
+        /**
+         * AJAX handler to verify a user's 2FA code.
+         */
+        public function ajax_verify_code() {
+                check_ajax_referer( 'user_two_factor_totp_options', '_nonce_user_two_factor_totp_options' );
+
+                $user_id = absint( $_POST['user_id'] );
+                if ( ! current_user_can( 'edit_user', $user_id ) ) {
+                        wp_send_json_error( __( 'You do not have permission to edit this user.' ) );
+                }
+
+                if ( empty( $_POST['authcode'] ) ) {
+                        wp_send_json_error( __( 'Please enter a valid authorization code.' ) );
+                }
+
+                if ( Two_Factor_Totp::is_valid_authcode( $_POST['key'], $_POST['authcode'] ) ) {
+                        if ( ! update_user_meta( $user_id, Two_Factor_Totp::SECRET_META_KEY, $_POST['key'] ) ) {
+                                wp_send_json_error( __( 'Unable to save Two Factor Authentication code. Please try again.', 'wporg' ) );
+                        }
+
+                        wp_send_json_success();
+                }
+
+                wp_send_json_error( __( 'The authentication code you entered was not valid. Please try again.', 'wporg' ) );
+        }
+
+        /**
+         * AJAX handler to disable 2FA.
+         */
+        public function ajax_disable() {
+                check_ajax_referer( 'user_two_factor_totp_options', '_nonce_user_two_factor_totp_options' );
+
+                $user_id = absint( $_POST['user_id'] );
+                if ( ! current_user_can( 'edit_user', $user_id ) ) {
+                        wp_send_json_error( __( 'You do not have permission to edit this user.' ) );
+                };
+
+                if ( ! delete_user_meta( $user_id, Two_Factor_Totp::SECRET_META_KEY ) ) {
+                        wp_send_json_error( __( 'Unable to remove Two Factor Authentication code. Please try again.', 'wporg' ) );
+                }
+
+                if ( ! update_user_meta( $user_id, Two_Factor_Core::ENABLED_PROVIDERS_USER_META_KEY, [] ) ) {
+                        wp_send_json_error( __( 'Unable to remove Two Factor Authentication code. Please try again.', 'wporg' ) );
+                }
+
+                wp_send_json_success( __( 'Two Factor authentication disabled. Your account is now less secure.', 'wporg' ) );
+        }
 }
 new WPORG_Two_Factor();