Ticket #46349: 46349.diff

src/wp-admin/css/login.css

@@ -134 +134 @@
         box-shadow: 0 1px 3px rgba(0, 0, 0, 0.13);
 }
 
+.login-action-confirm_admin_email #login {
+        width: 60vw;
+        margin-top: -2vh;
+
+}
+
+@media screen and (max-width: 700px) {
+        .login-action-confirm_admin_email #login {
+                width: 100vw;
+                margin-top: -2vh;
+        }
+}
+
 .login form .forgetmenot {
         font-weight: 400;
         float: left;
@@ -144 +157 @@
         float: right;
 }
 
+.login .adminemailconfirmform .submit {
+        text-align: center;
+}
+
+.admin-email__later {
+        text-align: left;
+}
+
+#login form p.admin-email__details {
+        margin-bottom: 20px;
+        margin-top: 20px;
+}
+
+.admin-email__details--small {
+        margin-top: 20px;
+        margin-bottom: 20px;
+        font-size: .9em;
+}
+
+.login h1.admin-email__heading {
+        border-bottom: 1px rgb(241, 241, 241) solid;
+        color: rgb(95, 95, 95);
+        font-weight: normal;
+        padding-bottom: 2%;
+        text-align: left;
+}
+
+.login h2.admin-email__heading {
+        font-weight: normal;
+        padding-bottom: 1%;
+        padding-top: 3%;
+}
+
+.admin-email__actions div {
+        padding-top: 2em;
+}
+
+.login .adminemailconfirmform .button-primary {
+        float: none;
+}
+
 #login form p {
         margin-bottom: 0;
 }

src/wp-includes/user.php

@@ -187 +187 @@
         return $user;
 }
 
+function wp_confirm_admin_email( $redirect_to, $requested_redirect_to, $user ) {
+
+        if ( ! is_a ( $user , 'WP_User' ) || ! $user->exists() ) {
+                return $redirect_to;
+        }
+
+        if ( ! $user->has_cap( 'manage_options' ) ) {
+                return $redirect_to;
+        }
+
+        $admin_email_lifespan = get_option( 'admin_email_lifespan' );
+
+        if ( ! empty( $admin_email_lifespan ) ) {
+                if ( time() < $admin_email_lifespan ) {
+                        return $redirect_to;
+                }
+        }
+
+        return wp_login_url( $redirect_to ) . '&' . 'action=confirm_admin_email';
+
+}
+
 /**
  * Authenticates a user using the email and password.
  *

src/wp-login.php

@@ -444 +444 @@
 }
 
 // Validate action so as to default to the login screen.
-if ( ! in_array( $action, array( 'postpass', 'logout', 'lostpassword', 'retrievepassword', 'resetpass', 'rp', 'register', 'login', 'confirmaction', WP_Recovery_Mode_Link_Service::LOGIN_ACTION_ENTERED ), true ) && false === has_filter( 'login_form_' . $action ) ) {
+if ( ! in_array( $action, array( 'confirm_admin_email', 'postpass', 'logout', 'lostpassword', 'retrievepassword', 'resetpass', 'rp', 'register', 'login', 'confirmaction', WP_Recovery_Mode_Link_Service::LOGIN_ACTION_ENTERED ), true ) && false === has_filter( 'login_form_' . $action ) ) {
         $action = 'login';
 }
 
@@ -502 +502 @@
 
 switch ( $action ) {
 
+        case 'confirm_admin_email':
+
+                if( ! is_user_logged_in() ) {
+                        wp_safe_redirect( wp_login_url( $redirect_to ) );
+                }
+
+                if ( ! empty( $_REQUEST['redirect_to'] ) ) {
+                        $redirect_to = $_REQUEST['redirect_to'];
+                } else {
+                        $redirect_to           = admin_url();
+                }
+
+                if ( current_user_can( 'manage_options' ) ) {
+                        $admin_email = get_option( 'admin_email' );
+                } else {
+                        wp_safe_redirect( $redirect_to );
+                }
+
+        $admin_email_max_age = apply_filters( 'admin_email_max_age', 180 * DAY_IN_SECONDS );
+
+        $admin_email_lifespan = time() + $admin_email_max_age;
+                $admin_email_remind_in = time() + round ( $admin_email_max_age/4 );
+
+                if ( ! empty( $_GET[ 'remind_me_later' ] ) ) {
+                        update_option( 'admin_email_lifespan', $admin_email_remind_in );
+                        wp_safe_redirect( $redirect_to );
+                }
+
+                if ( ! empty( $_POST[ 'correct_email' ] ) ) {
+                        update_option( 'admin_email_lifespan', $admin_email_lifespan );
+                        wp_safe_redirect( $redirect_to );
+                }
+
+                /**
+                * Fires before the admin email confirm form.
+                *
+                * @since 5.2.0
+                *
+                * @param WP_Error $errors A `WP_Error` object containing any errors generated by using invalid credentials. Note that the error object may not contain any errors.
+                *
+                */
+                do_action( 'confirm_admin_email' );
+
+                login_header( __( 'Confirm your admin email' ), '', $errors );
+                ?>
+
+                <form class='adminemailconfirmform' name="adminemailconfirmform" id="adminemailconfirmform" action="<?php echo esc_url( network_site_url( 'wp-login.php?action=confirm_admin_email', 'login_post' ) ); ?>" method="post">
+
+                        <input type="hidden" name="redirect_to" value="<?php echo esc_attr( $redirect_to ); ?>" />
+                        <?php
+                        /**
+                        * Fires inside the lostpassword form tags, before the hidden fields.
+                        *
+                        * @since 2.1.0
+                        */
+                        do_action( 'admin_email_confirm_form' );
+                        ?>
+                        <h1 class="admin-email__heading">
+                                <?php
+                                        _e( 'Admin email verification' );
+                                ?>
+                        </h1>
+                        <p class="admin-email__details">
+                                <?php
+                                        _e( 'We\'d like to verify that the <strong>general admin email</strong> for this website is still correct.' );
+                                ?>
+                                <a href="">
+                                        <?php
+                                                _e( 'Why is this important?' );
+                                        ?>
+                                </a>
+                        </p>
+                        <h2 class="admin-email__heading">
+                                <?php
+                                        _e( 'Current general admin email' );
+                                ?>
+                        </h2>
+                        <p class="admin-email__details">
+                                <?php _e( 'We have the following email address registered as your <strong>general admin email</strong>:' ); ?>
+                        </p>
+
+                        <h2 class="admin-email__heading">
+                                <?php
+                                        echo esc_html( $admin_email );
+                                ?>
+                        </h2>
+                        <p class="admin-email__details--small">
+                                <?php _e( 'This can be different from the email address you just logged in with.' ); ?>
+                                <a href="">
+                                        <?php
+                                                _e( 'Learn more' );
+                                        ?>
+                                </a>
+                        </p>
+
+                        <div class="admin-email__actions">
+                                <div class="admin-email__actions-primary">
+                                        <?php
+
+                                        $change_link = admin_url( 'options-general.php?highlight=confirm_admin_email' );
+                                        ?>
+                                        <a class="button button-large" href="<?php echo $change_link ?>">
+                                                <?php esc_attr_e( 'Please change' ); ?>
+                                        </a>
+                                        <input type="submit" name="correct_email" id="wp-submit" class="button button-primary button-large" value="<?php esc_attr_e( 'Yes it\'s correct' ); ?>" />
+                                </div>
+                                <div class="admin-email__actions-secondary">
+                                        <p class="admin-email__later">
+                                        <?php
+
+                                                $remind_me_link = wp_login_url( $redirect_to ) .
+                                                        '&' . 'action=confirm_admin_email' .
+                                                        '&' . 'remind_me_later=true';
+                                        ?>
+                                                <a href="<?php echo $remind_me_link ?>"><?php _e( 'Remind me later' ) ?></a>
+                                        </p>
+                                </div>
+
+                        </div>
+                </form>
+
+                <?php
+                login_footer();
+
+        break;
+
+
+
         case 'postpass':
                 if ( ! array_key_exists( 'post_password', $_POST ) ) {
                         wp_safe_redirect( wp_get_referer() );
@@ -969 +1097 @@
                  */
                 $redirect_to = apply_filters( 'login_redirect', $redirect_to, $requested_redirect_to, $user );
 
+        $redirect_to = wp_confirm_admin_email( $redirect_to, $requested_redirect_to, $user );
+
                 if ( ! is_wp_error( $user ) && ! $reauth ) {
                         if ( $interim_login ) {
                                 $message       = '<p class="message">' . __( 'You have logged in successfully.' ) . '</p>';