Changeset 6759

Timestamp:

02/26/2018 07:06:12 AM (7 years ago)

Author:

dd32

Message:

2FA: Enable Email, Slack, and Backup Codes as the backup 2FA method.

See #77.

Location:

sites/trunk/wordpress.org/public_html/wp-content/plugins/wporg-two-factor

Files:

• providers/class-wporg-two-factor-backup-codes.php (modified) (1 diff)
• providers/class-wporg-two-factor-email.php (modified) (1 diff)
• providers/class-wporg-two-factor-primary.php (modified) (1 diff)
• providers/class-wporg-two-factor-secondary.php (modified) (2 diffs)
• providers/class-wporg-two-factor-slack.php (modified) (3 diffs)
• wporg-two-factor.php (modified) (2 diffs)

sites/trunk/wordpress.org/public_html/wp-content/plugins/wporg-two-factor/providers/class-wporg-two-factor-backup-codes.php

@@ -18 +18 @@
     }
 
+    public function validate_authentication( $user, $code = '' ) {
+        return $this->validate_code( $user, $code );
+    }
+
 }

sites/trunk/wordpress.org/public_html/wp-content/plugins/wporg-two-factor/providers/class-wporg-two-factor-email.php

@@ -16 +16 @@
         }
         return $instance;
+    }
+
+    public function validate_authentication( $user, $code = '' ) {
+        if ( ! isset( $user->ID ) || ! $code ) {
+            return false;
+        }
+
+        return $this->validate_token( $user->ID, $code );
     }
 

sites/trunk/wordpress.org/public_html/wp-content/plugins/wporg-two-factor/providers/class-wporg-two-factor-primary.php

@@ -24 +24 @@
         return _x( 'Time Based One-Time Password (Google Authenticator, Authy, etc)', 'Provider Label', 'wporg' );
     }
+
+    public function validate_authentication( $user, $code = '' ) {
+        $key = get_user_meta( $user->ID, self::SECRET_META_KEY, true );
+
+        if ( ! $code ) {
+            $code = $_REQUEST['authcode'];
+        }
+
+        return $this->is_valid_authcode( $key, $code );
+    }
 }

sites/trunk/wordpress.org/public_html/wp-content/plugins/wporg-two-factor/providers/class-wporg-two-factor-secondary.php

@@ -1 +1 @@
 <?php
 
-require_once __DIR__ . '/class-wporg-two-factor-backup-codes.php';
-
-class WPORG_Two_Factor_Secondary extends WPORG_Two_Factor_Backup_Codes { // Temporarily
-// class WPORG_Two_Factor_Secondary extends Two_Factor_Provider { // When it's a proper wrapper.
+class WPORG_Two_Factor_Secondary extends Two_Factor_Provider { // When it's a proper wrapper.
 
     /**
@@ -24 +21 @@
     }
 
-    // protected $providers = [];
+    public function authentication_page( $user ) {
+        if ( ! $user ) {
+            return;
+        }
+
+        $this->send_codes_to_user( $user );
+
+        require_once( ABSPATH . '/wp-admin/includes/template.php' );
+
+        $email_enabled = isset( $this->providers['WPORG_Two_Factor_Email'] ) && $this->providers['WPORG_Two_Factor_Email']->is_available_for_user( $user );
+        $slack_enabled = isset( $this->providers['WPORG_Two_Factor_Slack'] ) && $this->providers['WPORG_Two_Factor_Slack']->is_available_for_user( $user );
+
+        if ( $email_enabled && $slack_enabled ) {
+            echo '<p>' . __( 'Enter the verification code sent to your Email, Slack, or a printed backup code.', 'wporg' ) . '</p>';
+        } elseif ( $email_enabled ) {
+            echo '<p>' . __( 'Enter the verification code sent to your Email, or a printed backup code.', 'wporg' ) . '</p>';
+        } else {
+            echo '<p>' . __( 'Enter a printed backup code.', 'wporg' ) . '</p>';
+        }
+        ?>
+
+        <p>
+            <label for="authcode"><?php esc_html_e( 'Verification Code:', 'wporg' ); ?></label>
+            <input type="tel" name="two-factor-backup-code" id="authcode" class="input" value="" size="20" pattern="[0-9]*" />
+            <?php submit_button( __( 'Authenticate', 'wporg' ) ); ?>
+        </p>
+
+        <?php if ( $email_enabled || $slack_enabled ) { ?>
+            <p class="two-factor-email-resend">
+                <input type="submit" class="button" name="two-factor-backup-resend" value="<?php esc_attr_e( 'Resend Code', 'wporg' ); ?>" />
+            </p>
+        <?php } ?>
+
+        <script type="text/javascript">
+            setTimeout( function(){
+                var d;
+                try{
+                    d = document.getElementById('authcode');
+                    d.value = '';
+                    d.focus();
+                } catch(e){}
+            }, 200);
+        </script>
+        <?php
+    }
+
+    function is_available_for_user( $user ) { return true; }
+
+    protected $providers = [];
 
     protected function __construct() {
-        /*
         $providers = [
             'WPORG_Two_Factor_Email'        => __DIR__ . '/class-wporg-two-factor-email.php',
             'WPORG_Two_Factor_Backup_Codes' => __DIR__ . '/class-wporg-two-factor-backup-codes.php',
             'WPORG_Two_Factor_Slack'        => __DIR__ . '/class-wporg-two-factor-slack.php'
+        ];
+        $providers = apply_filters( 'wporg_two_factor_secondary_providers', $providers );
 
-        ];
-        */
+        // Add some CSS for this clss.
+        add_action( 'login_head', [ $this, 'add_styles' ] );
+
+        foreach ( $providers as $class => $path ) {
+            include_once( $path );
+
+            if ( class_exists( $class ) ) {
+                try {
+                    $this->providers[ $class ] = call_user_func( array( $class, 'get_instance' ) );
+                } catch ( Exception $e ) {
+                    unset( $this->providers[ $class ] );
+                }
+            }
+        }
+
         return parent::__construct();
     }
+
+    // Add some specific styles for this class.
+    public function add_styles() {
+        if ( isset( $_GET['provider'] ) && $_GET['provider'] === __CLASS__ ) {
+            echo '<style>
+                body.login-action-backup_2fa .backup-methods-wrap {
+                    display: none;
+                }
+                body.login-action-backup_2fa input[name="two-factor-backup-resend"] {
+
+                }
+            </style>';
+        }
+    }
+
+    public function pre_process_authentication( $user ) {
+        if ( isset( $_REQUEST['two-factor-backup-resend'] ) ) {
+            return $this->send_codes_to_user( $user, true );
+        }
+
+        return false;
+    }
+
+    // Send codes to the user based on the providers available.
+    //
+    protected function send_codes_to_user( $user, $resend = false ) {
+        $result = false;
+
+        if (
+            isset( $this->providers['WPORG_Two_Factor_Email'] ) &&
+            $this->providers['WPORG_Two_Factor_Email']->is_available_for_user( $user )
+        ) {
+            if (
+                $resend |
+                ! $this->providers['WPORG_Two_Factor_Email']->user_has_token( $user->ID )
+            ) {
+                $result = true;
+                $this->providers['WPORG_Two_Factor_Email']->generate_and_email_token( $user );
+            }
+        }
+
+        if (
+            isset( $this->providers['WPORG_Two_Factor_Slack'] ) &&
+            $this->providers['WPORG_Two_Factor_Slack']->is_available_for_user( $user )
+        ) {
+            if (
+                $resend ||
+                ! $this->providers['WPORG_Two_Factor_Slack']->user_has_token( $user->ID )
+            ) {
+                $result = true;
+                $this->providers['WPORG_Two_Factor_Slack']->generate_and_slack_token( $user );
+            }
+        }
+
+        return $result;
+    }
+
+    function validate_authentication( $user ) {
+        if ( empty( $_POST['two-factor-backup-code'] ) ) {
+            return false;
+        }
+
+        $backup_code = $_POST['two-factor-backup-code'];
+
+        $authenticated = false;
+
+        foreach ( $this->providers as $provider ) {
+            if (
+                $provider->is_available_for_user( $user ) &&
+                $provider->validate_authentication( $user, $backup_code )
+            ) {
+                $authenticated = true;
+                break;
+            }
+        }
+
+        // Also check the Primary method for the user just in case.
+        $primary_provider = WPORG_Two_Factor_Primary::get_instance();
+        if (
+            ! $authenticated &&
+            $primary_provider->is_available_for_user( $user ) &&
+            $primary_provider->validate_authentication( $user, $backup_code )
+        ) {
+            $authenticated = true;
+        }
+
+        if ( $authenticated ) {
+            foreach ( $this->providers as $provider ) {
+                if ( is_callable( [ $provider, 'delete_token' ] ) ) {
+                    $provider->delete_token( $user->ID );
+                }
+            }
+        }
+
+        return $authenticated;
+    }
 }

sites/trunk/wordpress.org/public_html/wp-content/plugins/wporg-two-factor/providers/class-wporg-two-factor-slack.php

@@ -1 +1 @@
 <?php
 
-require_once TWO_FACTOR_DIR . 'providers/class.two-factor-email.php';
+require_once __DIR__ . '/class-wporg-two-factor-email.php';
 
-class WPORG_Two_Factor_Slack extends Two_Factor_Email {
+class WPORG_Two_Factor_Slack extends WPORG_Two_Factor_Email {
 
     /**
@@ -11 +11 @@
      */
     const TOKEN_META_KEY = '_two_factor_slack_token';
-
-    /**
-     * Name of the input field used for code resend.
-     *
-     * @var string
-     */
-    const INPUT_NAME_RESEND_CODE = 'two-factor-slack-code-resend';
 
     /**
@@ -34 +27 @@
 
     public function get_label() {
-        return _x( 'Slack', 'Provider Label', 'wporg' );
+        return 'Slack'; // Not marked for translation as this shouldn't be called/displayed.
     }
 
-    /**
-     * Whether this Two Factor provider is configured and available for the user specified.
-     *
-     * @since 0.1-dev
-     *
-     * @param WP_User $user WP_User object of the logged-in user.
-     * @return boolean
-     */
+    protected function get_slack_details( $user_id ) {
+        global $wpdb;
+
+        static $cached_details = [];
+        if ( isset( $cached_details[ $user_id ] ) ) {
+            return $cached_details[ $user_id ];
+        }
+
+        // TODO abstract this? memcache it?
+        $user_details = $wpdb->get_var( $wpdb->prepare( "SELECT profiledata FROM slack_users WHERE user_id = %d LIMIT 1", $user_id ) );
+        $user_details = $user_details ? json_decode( $user_details ) : false;
+
+        $cached_details[ $user_id ] = $user_details;
+
+        return $user_details;
+    }
+
     public function is_available_for_user( $user ) {
-        // TODO Check if the user has a 2FA slack account.
+        $user_details = $this->get_slack_details( $user->ID );
+
+        // Require the Slack account to exist, and for the user to have 2FA enabled on Slack.
+        return $user_detauls && empty( $user_details->deleted ) && ! empty( $user_details->has_2fa );
+    }
+
+    public function generate_and_email_token( $user ) {
+        return $this->generate_and_slack_token( $user );
+    }
+
+    public function generate_and_slack_token( $user ) {
+        $token = $this->generate_token( $user->ID );
+
+        $message = "Please enter the following verification code on WordPress.org to complete your login:\n{$token}";
+
+        $slack_details = $this->get_slack_details( $user->ID );
+
+        if ( $slack_details->id ) {
+            // TODO: Replace this with a named Slack Bot.
+            return slack_dm( $message, $slack_details->id );
+        }
+
         return false;
     }
 
-    /**
-     * Generate and email the user token.
-     *
-     * @since 0.1-dev
-     *
-     * @param WP_User $user WP_User object of the logged-in user.
-     */
-    public function generate_and_email_token( $user ) {
-        $token = $this->generate_token( $user->ID );
-
-        /* translators: %s: site name */
-        $subject = wp_strip_all_tags( sprintf( __( 'Your login confirmation code for %s', 'wporg' ), get_bloginfo( 'name' ) ) );
-        /* translators: %s: token */
-        $message = wp_strip_all_tags( sprintf( __( 'Enter %s to log in.', 'wporg' ), $token ) );
-
-        $who = '@dd32';
-
-        return slack_dm( $subject . "\n" . $message, $who );
-    }
-
 }

sites/trunk/wordpress.org/public_html/wp-content/plugins/wporg-two-factor/wporg-two-factor.php

@@ -199 +199 @@
      */
     public static function enable_two_factor( $user_id ) {
-        // True if at least one provider method was set.
         return (
             update_user_meta( $user_id, self::PROVIDER_USER_META_KEY,          'WPORG_Two_Factor_Primary' ) &&
@@ -223 +222 @@
     public static function user_two_factor_options( $user ) {
         wp_enqueue_script( 'two-factor-edit', plugins_url( 'js/profile-edit.js' , __FILE__ ), [ 'jquery' ], 1, true );
-        wp_localize_script( 'two-factor-edit', 'two_factor_edit', array( 
+        wp_localize_script( 'two-factor-edit', 'two_factor_edit', array(
             'ajaxurl' => admin_url( 'admin-ajax.php' ),
         ) );