Ticket #30264: 30264.diff

src/wp-admin/admin-ajax.php

@@ -61 +61 @@
         'query-attachments', 'save-attachment', 'save-attachment-compat', 'send-link-to-editor',
         'send-attachment-to-editor', 'save-attachment-order', 'heartbeat', 'get-revision-diffs',
         'save-user-color-scheme', 'update-widget', 'query-themes', 'parse-embed', 'set-attachment-thumbnail',
-        'parse-media-shortcode'
+        'parse-media-shortcode', 'destroy-sessions'
 );
 
 // Register core Ajax calls.

src/wp-admin/includes/ajax-actions.php

@@ -2771 +2771 @@
                 'body' => ob_get_clean()
         ) );
 }
+
+/**
+ * AJAX handler for destroying multiple open sessions for a user.
+ *
+ * @since 4.0
+ *
+ */
+function wp_ajax_destroy_sessions() {
+
+                if ( empty( $_POST['user_id'] ) ) {
+                        $user = new WP_Error( 'no_user_id', __( 'No user ID specified', 'wpsm' ) );
+                }
+
+                $user = new WP_User( absint( $_POST['user_id'] ) );
+
+                if ( !$user->exists() ) {
+                        $user = new WP_Error( 'invalid_user', __( 'The specified user does not exist', 'wpsm' ) );
+                }
+
+                if ( !current_user_can( 'edit_user', $user->ID ) ) {
+                        $user = new WP_Error( 'not_allowed', __( 'You do not have permission to edit this user', 'wpsm' ) );
+                }
+
+                if ( !check_ajax_referer( sprintf( 'destroy_multiple_sessions_%d', $user->ID ), false, false ) ) {
+                        $user = new WP_Error( 'invalid_nonce', __( 'Invalid nonce', 'wpsm' ) );
+                }
+
+
+                if ( is_wp_error( $user ) ) {
+                        wp_send_json_error( array(
+                                'error'   => $user->get_error_code(),
+                                'message' => '<div class="error inline">' .  $user->get_error_message() . '</div>',
+                        ) );
+                }
+
+                if ( isset( $_POST['token'] ) ) {
+                        $keep = wp_unslash( $_POST['token'] );
+                } else {
+                        $keep = null;
+                }
+
+                $sessions = WP_Session_Tokens::get_instance( $user->ID );
+
+                if ( is_string( $keep ) ) {
+                        $sessions->destroy_others( $keep );
+                        $message = __( 'You are now logged out everywhere else' );
+                } else {
+                        $sessions->destroy_all();
+                        $message = __( printf ('%s has been logged out', $user->display_name) );
+                }
+
+                wp_send_json_success( array(
+                        'message' => "<div class='updated inline'>$message</div>" 
+                ) );
+
+        }

src/wp-admin/js/user-profile.js

@@ -1 @@
-/* global ajaxurl, pwsL10n */
+/* global ajaxurl, pwsL10n, sessionmanager */
 (function($){
 
         function check_pass_strength() {
@@ -124 +124 @@
                 });
         });
 
+        $('.session-destroy-other, .session-destroy-all').on('click',function(e){
+
+                var data = {
+                        action      : 'destroy-sessions',
+                        _ajax_nonce : sessionmanager.nonce_multiple,
+                        user_id     : sessionmanager.user_id,
+                        token       : $(this).data('token')
+                };
+
+                $.post( ajaxurl, data, function( response ) {
+
+                        if ( response.success ) {
+                                $('.session-destroy-other, .session-destroy-all').prop( 'disabled', true);
+                                $('.session-destroy-other, .session-destroy-all').before( response.data.message );
+                        } else {
+                                $('.session-destroy-other, .session-destroy-all').before( response.data.message );
+                        }
+
+                }, 'json' );
+
+                e.preventDefault();
+
+        });
+
 })(jQuery);

src/wp-admin/user-edit.php

@@ -25 +25 @@
 
 wp_enqueue_script('user-profile');
 
+wp_localize_script(
+        'user-profile',
+        'sessionmanager',
+        array(
+                'user_id'        => $user_id,
+                'nonce_multiple' => wp_create_nonce( sprintf( 'destroy_multiple_sessions_%d', $user_id ) ),
+        )
+);
+
 $title = IS_PROFILE_PAGE ? __('Profile') : __('Edit User');
 if ( current_user_can('edit_users') && !IS_PROFILE_PAGE )
         $submenu_file = 'users.php';
@@ -289 +298 @@
  */
 do_action( 'personal_options', $profileuser );
 ?>
+
 </table>
 <?php
         if ( IS_PROFILE_PAGE ) {
@@ -474 +484 @@
         </td>
 </tr>
 <?php endif; ?>
+<tr>
+        <th>&nbsp;</th>
+        <td>
+                <?php if ( IS_PROFILE_PAGE ) {
+                        $token = wp_get_session_token();
+                        ?>
+                        <p><button class="button button-secondary hide-if-no-js session-destroy-other" data-token="<?php echo esc_attr( $token ); ?>"><?php _e( 'Log Out of All Other Sessions', 'wpsm' ); ?></button></p>
+                <?php } else { ?>
+                        <p><button class="button button-secondary hide-if-no-js session-destroy-all"><?php _e( 'Log Out of All Sessions', 'wpsm' ); ?></button></p>
+                <?php } ?>
+                <p class="description hide-if-no-js">
+
+                        <?php
+                                if ( IS_PROFILE_PAGE ) {
+                                        _e( 'Leave your account logged in at a public computer? Lose your phone? This will log your account out everywhere except your current browser.' );
+                                } else {
+                                        _e( printf( 'Log $s out of all sessions', $profileuser->display_name ) );
+                                }
+                        ?>
+
+
+                </p>
+        </td>
 </table>
 
 <?php

src/wp-includes/session.php

@@ -131 +131 @@
                 $session = apply_filters( 'attach_session_information', array(), $this->user_id );
                 $session['expiration'] = $expiration;
 
+                // IP address.
+                if ( !empty( $_SERVER['REMOTE_ADDR'] ) ) {
+                        $session['ip'] = $_SERVER['REMOTE_ADDR'];
+                }
+
+                // User-agent.
+                if ( ! empty( $_SERVER['HTTP_USER_AGENT'] ) ) {
+                        $session['ua'] = wp_unslash( $_SERVER['HTTP_USER_AGENT'] );
+                }
+
+                // Timestamp
+                $session['login'] = time();
+
                 $token = wp_generate_password( 43, false, false );
 
                 $this->update( $token, $session );