Ticket #19714: authenticate.2.diff

wp-includes/default-filters.php

@@ -299 +299 @@
 add_filter( 'heartbeat_received',        'wp_auth_check', 10, 2 );
 add_filter( 'heartbeat_nopriv_received', 'wp_auth_check', 10, 2 );
 
+// Default authentication filters
+add_filter('authenticate', 'wp_authenticate_username_password', 20, 3);
+add_filter('authenticate', 'wp_authenticate_cookie', 30, 3);
+add_filter('authenticate', 'wp_authenticate_spam_check', 99);
+
 unset($filter, $action);

wp-includes/pluggable.php

@@ -479 +479 @@
 
         $ignore_codes = array('empty_username', 'empty_password');
 
-        if (is_wp_error($user) && !in_array($user->get_error_code(), $ignore_codes) ) {
+        if (is_wp_error($user) && $user->get_error_codes() != $ignore_codes) {
                 do_action('wp_login_failed', $username);
         }
 

wp-includes/user.php

@@ -48 +48 @@
         global $auth_secure_cookie; // XXX ugly hack to pass this to wp_authenticate_cookie
         $auth_secure_cookie = $secure_cookie;
 
-        add_filter('authenticate', 'wp_authenticate_cookie', 30, 3);
-
         $user = wp_authenticate($credentials['user_login'], $credentials['user_password']);
 
         if ( is_wp_error($user) ) {
@@ -68 +66 @@
 /**
  * Authenticate the user using the username and password.
  */
-add_filter('authenticate', 'wp_authenticate_username_password', 20, 3);
 function wp_authenticate_username_password($user, $username, $password) {
         if ( is_a($user, 'WP_User') ) { return $user; }
 
         if ( empty($username) || empty($password) ) {
+                if ( is_wp_error($user) )
+                        return $user;
+
                 $error = new WP_Error();
 
                 if ( empty($username) )
@@ -89 +89 @@
         if ( !$user )
                 return new WP_Error( 'invalid_username', sprintf( __( '<strong>ERROR</strong>: Invalid username. <a href="%s" title="Password Lost and Found">Lost your password</a>?' ), wp_lostpassword_url() ) );
 
-        if ( is_multisite() ) {
-                // Is user marked as spam?
-                if ( 1 == $user->spam )
-                        return new WP_Error( 'spammer_account', __( '<strong>ERROR</strong>: Your account has been marked as a spammer.' ) );
-
-                // Is a user's blog marked as spam?
-                if ( !is_super_admin( $user->ID ) && isset( $user->primary_blog ) ) {
-                        $details = get_blog_details( $user->primary_blog );
-                        if ( is_object( $details ) && $details->spam == 1 )
-                                return new WP_Error( 'blog_suspended', __( 'Site Suspended.' ) );
-                }
-        }
-
         $user = apply_filters('wp_authenticate_user', $user, $password);
         if ( is_wp_error($user) )
                 return $user;
@@ -141 +128 @@
 }
 
 /**
+ * For multisite blogs, check if the authenticated user has been marked as a
+ * spammer, or if the user's primary blog has been marked as spam.
+ */
+function wp_authenticate_spam_check($user) {
+        if ( $user && is_a($user, 'WP_User') && is_multisite() ) {
+                $spammed = is_user_spammy( $user );
+                $spammed = apply_filters( 'check_is_user_spammed', $spammed, $user );
+                if ( is_wp_error( $spammed ) )
+                        return $spammed;
+                elseif ( $spammed )
+                        return new WP_Error( 'spammer_account', __( '<strong>ERROR</strong>: Your account has been marked as a spammer.' ) );
+        }
+
+        return $user;
+}
+
+/**
  * Number of posts user has written.
  *
  * @since 3.0.0