Changeset 6761

Timestamp:

02/26/2018 12:26:40 PM (7 years ago)

Author:

dd32

Message:

2FA: Have WPORG_Two_Factor_Email be it's own provider in it's own right.

By extending WPORG_Two_Factor_Email for WPORG_Two_Factor_Slack it was found that Two_Factor_Email uses self:: a bunch causing the usermeta token override not to take effect.

See #77.

Location:

sites/trunk/wordpress.org/public_html/wp-content/plugins/wporg-two-factor/providers

Files:

• class-wporg-two-factor-email.php (modified) (3 diffs)
• class-wporg-two-factor-slack.php (modified) (1 diff)

sites/trunk/wordpress.org/public_html/wp-content/plugins/wporg-two-factor/providers/class-wporg-two-factor-email.php

@@ -1 +1 @@
 <?php
 
-require_once TWO_FACTOR_DIR . 'providers/class.two-factor-email.php';
+class WPORG_Two_Factor_Email extends Two_Factor_Provider {
 
-class WPORG_Two_Factor_Email extends Two_Factor_Email {
-    /**
-     * Ensures only one instance of this class exists in memory at any one time.
-     *
-     * @since 0.1-dev
-     */
-    static function get_instance() {
+    const TOKEN_META_KEY = '_two_factor_email_token';
+
+    public static function get_instance() {
         static $instance;
-        $class = __CLASS__;
-        if ( ! is_a( $instance, $class ) ) {
+        if ( ! $instance ) {
+            $class = __CLASS__;
             $instance = new $class;
         }
@@ -18 +14 @@
     }
 
+    public function get_label() {
+        return 'Email'; // Not marked for translation as this shouldn't be called/displayed.
+    }
+
+    public function generate_token( $user_id ) {
+        $token = $this->get_code();
+        update_user_meta( $user_id, static::TOKEN_META_KEY, wp_hash( $token ) );
+        return $token;
+    }
+
+    public function user_has_token( $user_id ) {
+        return (bool) $this->get_user_token( $user_id );
+    }
+
+    public function get_user_token( $user_id ) {
+        $hashed_token = get_user_meta( $user_id, static::TOKEN_META_KEY, true );
+
+        if ( ! empty( $hashed_token ) && is_string( $hashed_token ) ) {
+            return $hashed_token;
+        }
+
+        return false;
+    }
+
+    public function validate_token( $user_id, $token ) {
+        $hashed_token = $this->get_user_token( $user_id );
+
+        // Bail if token is empty or it doesn't match.
+        if ( empty( $hashed_token ) || ( wp_hash( $token ) !== $hashed_token ) ) {
+            return false;
+        }
+
+        // Ensure that the token can't be re-used.
+        $this->delete_token( $user_id );
+
+        return true;
+    }
+
+    public function delete_token( $user_id ) {
+        delete_user_meta( $user_id, static::TOKEN_META_KEY );
+    }
+
     public function validate_authentication( $user, $code = '' ) {
-        if ( ! isset( $user->ID ) || ! $code ) {
+        if ( empty( $user->ID ) || ! $code ) {
             return false;
         }
@@ -37 +75 @@
 
         /* translators: %s: site name */
-        $subject = wp_strip_all_tags( sprintf( __( 'Your login confirmation code for %s', 'wporg' ), get_bloginfo( 'name' ) ) );
+        $subject = __( 'Your login confirmation code for WordPress.org', 'wporg' );
         /* translators: %s: token */
-        $message = wp_strip_all_tags( sprintf( __( 'Enter %s to log in.', 'wporg' ), $token ) );
+        $message = __( 'Please enter the following verification code on WordPress.org to complete your login:', 'wporg' );
+        $message .= "\n" . $token;
 
         return wp_mail( $user->user_email, $subject, $message );
     }
 
+    public function authentication_page( $user ) {
+        // N/A
+    }
+
+    public function pre_process_authentication( $user ) {
+        // N/A
+        return false;
+    }
+
+    public function is_available_for_user( $user ) {
+        return true;
+    }
 }

sites/trunk/wordpress.org/public_html/wp-content/plugins/wporg-two-factor/providers/class-wporg-two-factor-slack.php

@@ -5 +5 @@
 class WPORG_Two_Factor_Slack extends WPORG_Two_Factor_Email {
 
-    /**
-     * The user meta token key.
-     *
-     * @type string
-     */
     const TOKEN_META_KEY = '_two_factor_slack_token';
 
-    /**
-     * Ensures only one instance of this class exists in memory at any one time.
-     *
-     * @since 0.1-dev
-     */
-    static function get_instance() {
+    public static function get_instance() {
         static $instance;
-        $class = __CLASS__;
-        if ( ! is_a( $instance, $class ) ) {
+        if ( ! $instance ) {
+            $class = __CLASS__;
             $instance = new $class;
         }