文件操作 - Login.php

文件: /home/www/public/wp-content/plugins/ionos-security/inc/Controllers/CredentialsChecking/Login.php

编辑文件内容

<?php
namespace Ionos\Security\Controllers\CredentialsChecking;

use Ionos\Security\Controllers\CredentialsChecking\Checkers\CheckerBase;
use Ionos\Security\Controllers\CredentialsChecking\Checkers\HaveIBeenPwned;
use Ionos\Security\Models\CredentialsChecking\Credentials;
use Ionos\LoginRedirect\LoginRedirect;
use WP_Error;
use WP_User;

/**
 * Registers everything related to the login page.
 */
class Login {
	/**
		* Handle for the scripts and styles.
		*/
	const HANDLE = 'ionos-credentials-checking';

/**
	 * The class name of the checker that is used to check if credentials are compromised.
	 *
	 * @var CheckerBase
	 */
	private static $checker_class = HaveIBeenPwned::class;

/**
	 * Registers the login redirect.
	 *
	 * @since 1.0.0
	 */
	public static function init() {
		LoginRedirect::register_redirect();
	}

/**
	 * Registers hooks for wp-login.
	 *
	 * @since 1.0.0
	 */
	public static function register_wp_login_hooks() {
		add_action( 'check_passwords', [ __CLASS__, 'check_passwords' ], 10, 3 );

if ( is_login() ) {
			add_action( 'login_form_icc_leak_detected', [ __CLASS__, 'show_view' ] );

add_action( 'validate_password_reset', [ __CLASS__, 'validate_password_reset' ], 10, 2 );
			add_filter( 'authenticate', [ __CLASS__, 'authenticate' ], 100, 3 );
		}
	}

/**
	 * Shows the information view for leaked passwords. It is used as hook callback.
	 *
	 * @since 1.0.0
	 */
	public static function show_view() {
		$action = filter_input( INPUT_GET, 'action', FILTER_SANITIZE_FULL_SPECIAL_CHARS );

if ( $action === 'icc_leak_detected' ) {
			$template_path = IONOS_SECURITY_DIR . '/inc/Views/CredentialsChecking/leak-detected.php';
		}

if ( ! is_readable( $template_path ) ) {
			return;
		}

add_action( 'login_enqueue_scripts', [ __CLASS__, 'enqueue_styles' ] );
		add_action(
			'login_header',
			function () use ( $template_path ) {
				load_template( $template_path, true );
			}
		);
	}

/**
	 * Checks at login if the credentials have been leaked, when the wp_authenticate_user filter is applied.
	 *
	 * @since 1.0.0
	 *
	 * @param null|WP_User|WP_Error $user     WP_User if the user is authenticated.
	 *                                        WP_Error or null otherwise.
	 * @param string                $username Username or email address.
	 * @param string                $password User password.
	 *
	 * @return WP_Error|WP_User
	 */
	public static function authenticate( $user, $username, $password ) {
		if ( is_wp_error( $user ) || $user === null || empty( $password ) ) {
			return $user;
		}

$is_password_leaked = CredentialsChecking::has_leaked_flag( $user->ID );

// Don't check for a leak, on a flagged account.
		if ( $is_password_leaked === false ) {
			$is_password_leaked = self::is_leaked( new Credentials( $user, $password ) );
			update_user_meta( $user->ID, CredentialsChecking::LEAKED_CREDENTIALS_FLAG_NAME, $is_password_leaked );
		}

if ( CredentialsChecking::is_email_healthy( $user->user_email ) === false || $is_password_leaked === false ) {
			return $user;
		}

add_filter( 'ionos_login_redirect_to', [ __CLASS__, 'redirect_to_leaked_notice' ], 200 );
		return new WP_Error( 'ionos_password_leaked', __( 'It looks like your password has been compromised. To protect the security of your account, it‘s crucial that you change your password immediately. This will ensure that your personal and sensitive information remains safe and secure. An email was sent to your email address. Please follow the instruction to reset your password.', 'ionos-security' ) );
	}

/**
	 * Checks if the new password has been leaked, when the user tries to change it. It is used as hook callback.
	 *
	 * @since 1.0.0
	 *
	 * @param string $user_login The user login.
	 * @param string $pass1      The new password.
	 * @param string $pass2      The new password repeated.
	 */
	public static function check_passwords( $user_login, $pass1, $pass2 ) {
		if ( $pass1 !== $pass2 ) {
			return;
		}

$credentials = new Credentials( $user_login, $pass1 );

if ( ! self::is_leaked( $credentials ) ) {
			$user = wp_get_current_user();
			update_user_meta( $user->ID, CredentialsChecking::LEAKED_CREDENTIALS_FLAG_NAME, false );
			return;
		}

add_action(
			'user_profile_update_errors',
			/**
			 * Adds an error and shows an admin notice if the user tries to set a password which has been leaked.
			 *
			 * @param $errors WP_Error[]
			 */
			function ( $errors ) {
				$errors->add( 'password_leaked', __( 'The entered password has already been leaked. Please choose another one.', 'ionos-security' ) );
			},
			10,
			1
		);
	}

/**
	 * Checks if the new password has been leaked, when the user tries to reset it. It is used as hook callback.
	 *
	 * @since 1.0.0
	 *
	 * @param WP_Error[] $errors An array that contains the errors which happened during the password reset.
	 * @param WP_User    $user Current user.
	 */
	public static function validate_password_reset( $errors, $user ) {
		$pass1 = filter_input( INPUT_POST, 'pass1' );
		$pass2 = filter_input( INPUT_POST, 'pass2' );

if ( empty( $pass1 ) || $pass1 !== $pass2 ) {
			return;
		}

$credentials = new Credentials( '', $pass1 );
		if ( true === self::is_leaked( $credentials ) ) {
			$errors->add( 'password_leaked', __( 'The entered password has already been leaked. Please choose another one.', 'ionos-security' ) );
		} else {
			update_user_meta( $user->ID, CredentialsChecking::LEAKED_CREDENTIALS_FLAG_NAME, false );
		}
	}

/**
	 * Checks if the credentials are leaked.
	 *
	 * @since 1.0.0
	 *
	 * @param Credentials $credentials The credentials to check.
	 *
	 * @return bool
	 */
	private static function is_leaked( $credentials ) {
		return ( self::$checker_class )::is_leaked( $credentials );
	}

/**
	 * Redirects the user to a notice which shows if the user's credentials have been leaked and sends a password reset email . It is used as hook callback.
	 *
	 * @since 1.0.0
	 */
	public static function redirect_to_leaked_notice() {
		wp_logout();

$user_login = filter_input( INPUT_POST, 'log' );
		if ( empty( $user_login ) ) {
			return;
		}

retrieve_password( $user_login );

$url = add_query_arg(
			[
				'action' => 'icc_leak_detected',
			],
			wp_login_url()
		);

wp_safe_redirect( $url );
		exit;
	}

/**
	 * Enqueues the styles for this feature. It is used as hook callback.
	 *
	 * @since 1.0.0
	 */
	public static function enqueue_styles() {
		$assets = include_once IONOS_SECURITY_DIR . '/build/credentials-checking.asset.php';
		wp_enqueue_style(
			self::HANDLE,
			plugins_url( 'build/credentials-checking.css', IONOS_SECURITY_FILE ),
			$assets['dependencies'],
			$assets['version']
		);
	}
}

文件操作 - Login.php

文件: /home/www/public/wp-content/plugins/ionos-security/inc/Controllers/CredentialsChecking/Login.php

编辑文件内容

修改文件时间

删除文件