Changeset 6759

Timestamp:

02/26/2018 07:06:12 AM (9 years ago)

Author:

dd32

Message:

2FA: Enable Email, Slack, and Backup Codes as the backup 2FA method.

See #77.

Location:

sites/trunk/wordpress.org/public_html/wp-content/plugins/wporg-two-factor

Files:

• providers/class-wporg-two-factor-backup-codes.php (modified) (1 diff)
• providers/class-wporg-two-factor-email.php (modified) (1 diff)
• providers/class-wporg-two-factor-primary.php (modified) (1 diff)
• providers/class-wporg-two-factor-secondary.php (modified) (2 diffs)
• providers/class-wporg-two-factor-slack.php (modified) (3 diffs)
• wporg-two-factor.php (modified) (2 diffs)

sites/trunk/wordpress.org/public_html/wp-content/plugins/wporg-two-factor/providers/class-wporg-two-factor-backup-codes.php

@@ -18 +18 @@
         }
 
+        public function validate_authentication( $user, $code = '' ) {
+                return $this->validate_code( $user, $code );
+        }
+
 }

sites/trunk/wordpress.org/public_html/wp-content/plugins/wporg-two-factor/providers/class-wporg-two-factor-email.php

@@ -16 +16 @@
                 }
                 return $instance;
+        }
+
+        public function validate_authentication( $user, $code = '' ) {
+                if ( ! isset( $user->ID ) || ! $code ) {
+                        return false;
+                }
+
+                return $this->validate_token( $user->ID, $code );
         }
 

sites/trunk/wordpress.org/public_html/wp-content/plugins/wporg-two-factor/providers/class-wporg-two-factor-primary.php

@@ -24 +24 @@
                 return _x( 'Time Based One-Time Password (Google Authenticator, Authy, etc)', 'Provider Label', 'wporg' );
         }
+
+        public function validate_authentication( $user, $code = '' ) {
+                $key = get_user_meta( $user->ID, self::SECRET_META_KEY, true );
+
+                if ( ! $code ) {
+                        $code = $_REQUEST['authcode'];
+                }
+
+                return $this->is_valid_authcode( $key, $code );
+        }
 }

sites/trunk/wordpress.org/public_html/wp-content/plugins/wporg-two-factor/providers/class-wporg-two-factor-secondary.php

@@ -1 +1 @@
 <?php
 
-require_once __DIR__ . '/class-wporg-two-factor-backup-codes.php';
-
-class WPORG_Two_Factor_Secondary extends WPORG_Two_Factor_Backup_Codes { // Temporarily
-// class WPORG_Two_Factor_Secondary extends Two_Factor_Provider { // When it's a proper wrapper.
+class WPORG_Two_Factor_Secondary extends Two_Factor_Provider { // When it's a proper wrapper.
 
         /**
@@ -24 +21 @@
         }
 
-        // protected $providers = [];
+        public function authentication_page( $user ) {
+                if ( ! $user ) {
+                        return;
+                }
+
+                $this->send_codes_to_user( $user );
+
+                require_once( ABSPATH . '/wp-admin/includes/template.php' );
+
+                $email_enabled = isset( $this->providers['WPORG_Two_Factor_Email'] ) && $this->providers['WPORG_Two_Factor_Email']->is_available_for_user( $user );
+                $slack_enabled = isset( $this->providers['WPORG_Two_Factor_Slack'] ) && $this->providers['WPORG_Two_Factor_Slack']->is_available_for_user( $user );
+
+                if ( $email_enabled && $slack_enabled ) {
+                        echo '<p>' . __( 'Enter the verification code sent to your Email, Slack, or a printed backup code.', 'wporg' ) . '</p>';
+                } elseif ( $email_enabled ) {
+                        echo '<p>' . __( 'Enter the verification code sent to your Email, or a printed backup code.', 'wporg' ) . '</p>';
+                } else {
+                        echo '<p>' . __( 'Enter a printed backup code.', 'wporg' ) . '</p>';
+                }
+                ?>
+
+                <p>
+                        <label for="authcode"><?php esc_html_e( 'Verification Code:', 'wporg' ); ?></label>
+                        <input type="tel" name="two-factor-backup-code" id="authcode" class="input" value="" size="20" pattern="[0-9]*" />
+                        <?php submit_button( __( 'Authenticate', 'wporg' ) ); ?>
+                </p>
+
+                <?php if ( $email_enabled || $slack_enabled ) { ?>
+                        <p class="two-factor-email-resend">
+                                <input type="submit" class="button" name="two-factor-backup-resend" value="<?php esc_attr_e( 'Resend Code', 'wporg' ); ?>" />
+                        </p>
+                <?php } ?>
+
+                <script type="text/javascript">
+                        setTimeout( function(){
+                                var d;
+                                try{
+                                        d = document.getElementById('authcode');
+                                        d.value = '';
+                                        d.focus();
+                                } catch(e){}
+                        }, 200);
+                </script>
+                <?php
+        }
+
+        function is_available_for_user( $user ) { return true; }
+
+        protected $providers = [];
 
         protected function __construct() {
-                /*
                 $providers = [
                         'WPORG_Two_Factor_Email'        => __DIR__ . '/class-wporg-two-factor-email.php',
                         'WPORG_Two_Factor_Backup_Codes' => __DIR__ . '/class-wporg-two-factor-backup-codes.php',
                         'WPORG_Two_Factor_Slack'        => __DIR__ . '/class-wporg-two-factor-slack.php'
+                ];
+                $providers = apply_filters( 'wporg_two_factor_secondary_providers', $providers );
 
-                ];
-                */
+                // Add some CSS for this clss.
+                add_action( 'login_head', [ $this, 'add_styles' ] );
+
+                foreach ( $providers as $class => $path ) {
+                        include_once( $path );
+
+                        if ( class_exists( $class ) ) {
+                                try {
+                                        $this->providers[ $class ] = call_user_func( array( $class, 'get_instance' ) );
+                                } catch ( Exception $e ) {
+                                        unset( $this->providers[ $class ] );
+                                }
+                        }
+                }
+
                 return parent::__construct();
         }
+
+        // Add some specific styles for this class.
+        public function add_styles() {
+                if ( isset( $_GET['provider'] ) && $_GET['provider'] === __CLASS__ ) {
+                        echo '<style>
+                                body.login-action-backup_2fa .backup-methods-wrap {
+                                        display: none;
+                                }
+                                body.login-action-backup_2fa input[name="two-factor-backup-resend"] {
+
+                                }
+                        </style>';
+                }
+        }
+
+        public function pre_process_authentication( $user ) {
+                if ( isset( $_REQUEST['two-factor-backup-resend'] ) ) {
+                        return $this->send_codes_to_user( $user, true );
+                }
+
+                return false;
+        }
+
+        // Send codes to the user based on the providers available.
+        //
+        protected function send_codes_to_user( $user, $resend = false ) {
+                $result = false;
+
+                if (
+                        isset( $this->providers['WPORG_Two_Factor_Email'] ) &&
+                        $this->providers['WPORG_Two_Factor_Email']->is_available_for_user( $user )
+                ) {
+                        if (
+                                $resend |
+                                ! $this->providers['WPORG_Two_Factor_Email']->user_has_token( $user->ID )
+                        ) {
+                                $result = true;
+                                $this->providers['WPORG_Two_Factor_Email']->generate_and_email_token( $user );
+                        }
+                }
+
+                if (
+                        isset( $this->providers['WPORG_Two_Factor_Slack'] ) &&
+                        $this->providers['WPORG_Two_Factor_Slack']->is_available_for_user( $user )
+                ) {
+                        if (
+                                $resend ||
+                                ! $this->providers['WPORG_Two_Factor_Slack']->user_has_token( $user->ID )
+                        ) {
+                                $result = true;
+                                $this->providers['WPORG_Two_Factor_Slack']->generate_and_slack_token( $user );
+                        }
+                }
+
+                return $result;
+        }
+
+        function validate_authentication( $user ) {
+                if ( empty( $_POST['two-factor-backup-code'] ) ) {
+                        return false;
+                }
+
+                $backup_code = $_POST['two-factor-backup-code'];
+
+                $authenticated = false;
+
+                foreach ( $this->providers as $provider ) {
+                        if (
+                                $provider->is_available_for_user( $user ) &&
+                                $provider->validate_authentication( $user, $backup_code )
+                        ) {
+                                $authenticated = true;
+                                break;
+                        }
+                }
+
+                // Also check the Primary method for the user just in case.
+                $primary_provider = WPORG_Two_Factor_Primary::get_instance();
+                if (
+                        ! $authenticated &&
+                        $primary_provider->is_available_for_user( $user ) &&
+                        $primary_provider->validate_authentication( $user, $backup_code )
+                ) {
+                        $authenticated = true;
+                }
+
+                if ( $authenticated ) {
+                        foreach ( $this->providers as $provider ) {
+                                if ( is_callable( [ $provider, 'delete_token' ] ) ) {
+                                        $provider->delete_token( $user->ID );
+                                }
+                        }
+                }
+
+                return $authenticated;
+        }
 }

sites/trunk/wordpress.org/public_html/wp-content/plugins/wporg-two-factor/providers/class-wporg-two-factor-slack.php

@@ -1 +1 @@
 <?php
 
-require_once TWO_FACTOR_DIR . 'providers/class.two-factor-email.php';
+require_once __DIR__ . '/class-wporg-two-factor-email.php';
 
-class WPORG_Two_Factor_Slack extends Two_Factor_Email {
+class WPORG_Two_Factor_Slack extends WPORG_Two_Factor_Email {
 
         /**
@@ -11 +11 @@
          */
         const TOKEN_META_KEY = '_two_factor_slack_token';
-
-        /**
-         * Name of the input field used for code resend.
-         *
-         * @var string
-         */
-        const INPUT_NAME_RESEND_CODE = 'two-factor-slack-code-resend';
 
         /**
@@ -34 +27 @@
 
         public function get_label() {
-                return _x( 'Slack', 'Provider Label', 'wporg' );
+                return 'Slack'; // Not marked for translation as this shouldn't be called/displayed.
         }
 
-        /**
-         * Whether this Two Factor provider is configured and available for the user specified.
-         *
-         * @since 0.1-dev
-         *
-         * @param WP_User $user WP_User object of the logged-in user.
-         * @return boolean
-         */
+        protected function get_slack_details( $user_id ) {
+                global $wpdb;
+
+                static $cached_details = [];
+                if ( isset( $cached_details[ $user_id ] ) ) {
+                        return $cached_details[ $user_id ];
+                }
+
+                // TODO abstract this? memcache it?
+                $user_details = $wpdb->get_var( $wpdb->prepare( "SELECT profiledata FROM slack_users WHERE user_id = %d LIMIT 1", $user_id ) );
+                $user_details = $user_details ? json_decode( $user_details ) : false;
+
+                $cached_details[ $user_id ] = $user_details;
+
+                return $user_details;
+        }
+
         public function is_available_for_user( $user ) {
-                // TODO Check if the user has a 2FA slack account.
+                $user_details = $this->get_slack_details( $user->ID );
+
+                // Require the Slack account to exist, and for the user to have 2FA enabled on Slack.
+                return $user_detauls && empty( $user_details->deleted ) && ! empty( $user_details->has_2fa );
+        }
+
+        public function generate_and_email_token( $user ) {
+                return $this->generate_and_slack_token( $user );
+        }
+
+        public function generate_and_slack_token( $user ) {
+                $token = $this->generate_token( $user->ID );
+
+                $message = "Please enter the following verification code on WordPress.org to complete your login:\n{$token}";
+
+                $slack_details = $this->get_slack_details( $user->ID );
+
+                if ( $slack_details->id ) {
+                        // TODO: Replace this with a named Slack Bot.
+                        return slack_dm( $message, $slack_details->id );
+                }
+
                 return false;
         }
 
-        /**
-         * Generate and email the user token.
-         *
-         * @since 0.1-dev
-         *
-         * @param WP_User $user WP_User object of the logged-in user.
-         */
-        public function generate_and_email_token( $user ) {
-                $token = $this->generate_token( $user->ID );
-
-                /* translators: %s: site name */
-                $subject = wp_strip_all_tags( sprintf( __( 'Your login confirmation code for %s', 'wporg' ), get_bloginfo( 'name' ) ) );
-                /* translators: %s: token */
-                $message = wp_strip_all_tags( sprintf( __( 'Enter %s to log in.', 'wporg' ), $token ) );
-
-                $who = '@dd32';
-
-                return slack_dm( $subject . "\n" . $message, $who );
-        }
-
 }

sites/trunk/wordpress.org/public_html/wp-content/plugins/wporg-two-factor/wporg-two-factor.php

@@ -199 +199 @@
          */
         public static function enable_two_factor( $user_id ) {
-                // True if at least one provider method was set.
                 return (
                         update_user_meta( $user_id, self::PROVIDER_USER_META_KEY,          'WPORG_Two_Factor_Primary' ) &&
@@ -223 +222 @@
         public static function user_two_factor_options( $user ) {
                 wp_enqueue_script( 'two-factor-edit', plugins_url( 'js/profile-edit.js' , __FILE__ ), [ 'jquery' ], 1, true );
-                wp_localize_script( 'two-factor-edit', 'two_factor_edit', array( 
+                wp_localize_script( 'two-factor-edit', 'two_factor_edit', array(
                         'ajaxurl' => admin_url( 'admin-ajax.php' ),
                 ) );