Ticket #46349: admin_email_reminder.diff

src/wp-admin/css/login.css

@@ -134 +134 @@
         box-shadow: 0 1px 3px rgba(0, 0, 0, 0.13);
 }
 
+.login-action-confirm_admin_email #login {
+        width: 60vw;
+        margin-top: -2vh;
+        
+}
+
+@media screen and (max-width: 700px) {
+        .login-action-confirm_admin_email #login {
+                width: 100vw;
+                margin-top: -2vh;
+        }
+}
+
 .login form .forgetmenot {
         font-weight: 400;
         float: left;
@@ -144 +157 @@
         float: right;
 }
 
+.login .adminemailconfirmform .submit {
+        text-align: center;
+}
+
+.admin-email__later {
+        text-align: left;
+}
+
+#login form p.admin-email__details {
+        margin-bottom: 20px;
+        margin-top: 20px;
+}
+
+.admin-email__details--small {
+        font-size: .9em;
+}
+
+.login h1.admin-email__heading {
+        border-bottom: 1px rgb(241, 241, 241) solid;
+        color: rgb(95, 95, 95);
+        font-weight: normal;
+        padding-bottom: 2%;
+        text-align: left;
+}
+
+.login h2.admin-email__heading {
+        font-weight: normal;
+        padding-bottom: 1%;
+        padding-top: 3%;
+}
+
+.admin-email__actions div {
+        padding-top: 2em;
+}
+
+.login .adminemailconfirmform .button-primary {
+        float: none;
+}
+
 #login form p {
         margin-bottom: 0;
 }

src/wp-includes/default-constants.php

@@ -138 +138 @@
         define( 'MONTH_IN_SECONDS', 30 * DAY_IN_SECONDS );
         define( 'YEAR_IN_SECONDS', 365 * DAY_IN_SECONDS );
         /**#@-*/
+        
+        /**
+         * Admin email maximmum age
+         */
+        if ( ! defined( 'ADMIN_EMAIL_MAX_AGE' ) ) {
+                define( 'ADMIN_EMAIL_MAX_AGE', 180 * DAY_IN_SECONDS );
+        }
 }
 
 /**

src/wp-includes/default-filters.php

@@ -428 +428 @@
 add_filter( 'authenticate', 'wp_authenticate_spam_check', 99 );
 add_filter( 'determine_current_user', 'wp_validate_auth_cookie' );
 add_filter( 'determine_current_user', 'wp_validate_logged_in_cookie', 20 );
+add_filter( 'login_redirect', 'wp_confirm_admin_email', 20, 3 );
 
 // Split term updates.
 add_action( 'admin_init', '_wp_check_for_scheduled_split_terms' );

src/wp-includes/user.php

@@ -187 +187 @@
         return $user;
 }
 
+function wp_confirm_admin_email( $redirect_to, $requested_redirect_to, $user ) {
+
+        if ( ! is_a ( $user , 'WP_User' ) || ! $user->exists() ) {
+                return $redirect_to;
+        }
+
+        if ( ! $user->has_cap( 'manage_options' ) ) {
+                return $redirect_to;
+        }
+
+        $admin_email_lifespan = get_option( 'admin_email_lifespan' );
+
+        if ( ! empty( $admin_email_lifespan ) ) {
+                if ( time() < $admin_email_lifespan ) {
+                        return $redirect_to;
+                }
+        }
+
+        return wp_login_url( $redirect_to ) . '&' . 'action=confirm_admin_email';
+
+}
+
 /**
  * Authenticates a user using the email and password.
  *

src/wp-login.php

@@ -11 +11 @@
 /** Make sure that the WordPress bootstrap has run before continuing. */
 require( dirname( __FILE__ ) . '/wp-load.php' );
 
+        delete_option( 'admin_email_lifespan' );
+
 // Redirect to HTTPS login if forced to use SSL.
 if ( force_ssl_admin() && ! is_ssl() ) {
         if ( 0 === strpos( $_SERVER['REQUEST_URI'], 'http' ) ) {
@@ -444 +446 @@
 }
 
 // Validate action so as to default to the login screen.
-if ( ! in_array( $action, array( 'postpass', 'logout', 'lostpassword', 'retrievepassword', 'resetpass', 'rp', 'register', 'login', 'confirmaction', WP_Recovery_Mode_Link_Service::LOGIN_ACTION_ENTERED ), true ) && false === has_filter( 'login_form_' . $action ) ) {
+if ( ! in_array( $action, array( 'confirm_admin_email', 'postpass', 'logout', 'lostpassword', 'retrievepassword', 'resetpass', 'rp', 'register', 'login', 'confirmaction', WP_Recovery_Mode_Link_Service::LOGIN_ACTION_ENTERED ), true ) && false === has_filter( 'login_form_' . $action ) ) {
         $action = 'login';
 }
 
@@ -501 +503 @@
 $login_link_separator = apply_filters( 'login_link_separator', ' | ' );
 
 switch ( $action ) {
+        
+        case 'confirm_admin_email':
+
+                if( ! is_user_logged_in() ) {
+                        wp_safe_redirect( wp_login_url( $redirect_to ) );
+                }
+
+                if ( ! empty( $_REQUEST['redirect_to'] ) ) {
+                        $redirect_to = $_REQUEST['redirect_to'];
+                } else {
+                        $redirect_to           = admin_url();
+                }
+
+                if ( current_user_can( 'manage_options' ) ) {
+                        $admin_email = get_option( 'admin_email' );
+                } else {
+                        wp_safe_redirect( $redirect_to );
+                }
+
+                $admin_email_lifespan = time() + ADMIN_EMAIL_MAX_AGE;
+                $admin_email_remind_in = time() + round ( ADMIN_EMAIL_MAX_AGE/4 );
+
+                if ( ! empty( $_GET[ 'remind_me_later' ] ) ) {
+                        update_option( 'admin_email_lifespan', $admin_email_remind_in );
+                        wp_safe_redirect( $redirect_to );
+                }
+
+                if ( ! empty( $_POST[ 'correct_email' ] ) ) {
+                        update_option( 'admin_email_lifespan', $admin_email_lifespan );
+                        wp_safe_redirect( $redirect_to );
+                }
+
+                /**
+                * Fires before the admin email confirm form.
+                *
+                * @since 5.2.0
+                *
+                * @param WP_Error $errors A `WP_Error` object containing any errors generated by using invalid credentials. Note that the error object may not contain any errors.
+                *
+                */
+                do_action( 'confirm_admin_email' );
+
+                login_header( __( 'Confirm your admin email' ), '', $errors );
+                ?>
+
+                <form class='adminemailconfirmform' name="adminemailconfirmform" id="adminemailconfirmform" action="<?php echo esc_url( network_site_url( 'wp-login.php?action=confirm_admin_email', 'login_post' ) ); ?>" method="post">
+
+                        <input type="hidden" name="redirect_to" value="<?php echo esc_attr( $redirect_to ); ?>" />
+                        <?php
+                        /**
+                        * Fires inside the lostpassword form tags, before the hidden fields.
+                        *
+                        * @since 2.1.0
+                        */
+                        do_action( 'admin_email_confirm_form' );
+                        ?>
+                        <h1 class="admin-email__heading">
+                                <?php
+                                        _e( 'Admin email verification' );
+                                ?>
+                        </h1>
+                        <p class="admin-email__details">
+                                <?php
+                                        _e( 'We\'d like to verify that the <strong>general admin email</strong> for this website is still correct.' );
+                                ?>
+                                <a href="">
+                                        <?php
+                                                _e( 'Why is this important?' );
+                                        ?>
+                                </a>
+                        </p>
+                        <h2 class="admin-email__heading">
+                                <?php
+                                        _e( 'Current general admin email' );
+                                ?>
+                        </h2>
+                        <p class="admin-email__details">
+                                <?php _e( 'We have the following email address registered as your <strong>general admin email</strong>:' ); ?>
+                        </p>
+
+                        <h2 class="admin-email__heading">
+                                <?php
+                                        echo esc_html( $admin_email );
+                                ?>
+                        </h2>
+                        <p class="admin-email__details--small">
+                                <?php _e( 'This can be different from the email address you just logged in with.' ); ?>
+                                <a href="">
+                                        <?php
+                                                _e( 'Learn more' );
+                                        ?>
+                                </a>
+                        </p>
+
+                        <div class="admin-email__actions">
+                                <div class="admin-email__actions-primary">
+                                        <?php
+                
+                                        $change_link = admin_url( 'options-general.php?highlight=confirm_admin_email' );
+                                        ?>
+                                        <a class="button button-large" href="<?php echo $change_link ?>">
+                                                <?php esc_attr_e( 'Please change' ); ?>
+                                        </a>
+                                        <input type="submit" name="correct_email" id="wp-submit" class="button button-primary button-large" value="<?php esc_attr_e( 'Yes it\'s correct' ); ?>" />
+                                </div>
+                                <div class="admin-email__actions-secondary">
+                                        <p class="admin-email__later">
+                                        <?php
+                
+                                                $remind_me_link = wp_login_url( $redirect_to ) .
+                                                        '&' . 'action=confirm_admin_email' .
+                                                        '&' . 'remind_me_later=true';
+                                        ?>
+                                                <a href="<?php echo $remind_me_link ?>"><?php _e( 'Remind me later' ) ?></a>
+                                        </p>
+                                </div>
+                                
+                        </div>
+                </form>
+
+                <?php
+                login_footer();
+
+        break;
+        
+        
 
         case 'postpass':
                 if ( ! array_key_exists( 'post_password', $_POST ) ) {