Changeset 43070

Timestamp:

05/01/2018 11:36:37 PM (6 years ago)

Author:

SergeyBiryukov

Message:

Privacy: fixes and updates for the method to confirm user requests by email.

• Improve function and variable names.
• Allow extra data to be passed with the request.
• Make the option/user meta names more consistent.
• Adds an inline comment explaining use of hash.

Props mikejolley.
Merges [42964] to the 4.9 branch.
See #43443.

Location:

branches/4.9

Files:

• . (modified) (1 prop)
• src/wp-includes/user.php (modified) (10 diffs)
• src/wp-login.php (modified) (2 diffs)

branches/4.9/src/wp-includes/user.php

@@ -2738 +2738 @@
  * @since 5.0.0
  *
- * @param string $action_name        Name of the action that is being confirmed.
- * @param string $action_description User facing description of the action they will be confirming.
- * @param string $email              User email address. This can be the address of a registered or non-registered user. Defaults to logged in user email address.
- *
- * @return WP_ERROR|bool Will return true/false based on the success of sending the email, or a WP_Error object.
- */
-function send_confirm_account_action_email( $action_name, $action_description = '', $email = '' ) {
+ * @param string $email              User email address. This can be the address of a registered or non-registered user. Defaults to logged in user email address. 
+ * @param string $action_name        Name of the action that is being confirmed. Defaults to 'confirm_email'.
+ * @param string $action_description User facing description of the action they will be confirming. Defaults to "confirm your email address".
+ * @param array  $request_data       Misc data you want to send with the verification request and pass to the actions once the request is confirmed.
+ * @return WP_Error|bool Will return true/false based on the success of sending the email, or a WP_Error object.
+ */
+function wp_send_account_verification_key( $email = '', $action_name = '', $action_description = '', $request_data = array() ) {
+    if ( ! function_exists( 'wp_get_current_user' ) ) {
+        return new WP_Error( 'invalid', __( 'This function cannot be used before init.' ) );
+    }
+
     $action_name        = sanitize_key( $action_name );
     $action_description = wp_kses_post( $action_description );
 
     if ( empty( $action_name ) ) {
-        return new WP_Error( 'invalid_action', __( 'Invalid action' ) );
+        $action_name = 'confirm_email';
+    }
+
+    if ( empty( $action_description ) ) {
+        $action_description = __( 'Confirm your email address.' );
     }
 
@@ -2769 +2777 @@
     }
 
+    $confirm_key = wp_get_account_verification_key( $email, $action_name, $request_data );
+
+    if ( is_wp_error( $confirm_key ) ) {
+        return $confirm_key;
+    }
+
     // We could be dealing with a registered user account, or a visitor.
     $is_registered_user = $user && ! is_wp_error( $user );
-    $uid                = $is_registered_user ? $user->ID : hash( 'sha256', $email );
-    $confirm_key        = get_confirm_account_action_key( $action_name, $email );
-
-    if ( is_wp_error( $confirm_key ) ) {
-        return $confirm_key;
-    }
-
-    // Prepare the email content.
-    if ( ! $action_description ) {
-        $action_description = $action_name;
+
+    if ( $is_registered_user ) {
+        $uid = $user->ID;
+    } else {
+        // Generate a UID for this email address so we don't send the actual email in the query string. Hash is not supported on all systems.
+        $uid = function_exists( 'hash' ) ? hash( 'sha256', $email ) : sha1( $email );
     }
 
@@ -2787 +2797 @@
         'Howdy,
 
-An account linked to your email address has requested to perform
-the following action:
+A request has been made to perform the following action on your account:
 
      ###DESCRIPTION###
 
-To confirm this action, please click on the following link:
+To confirm this, please click on the following link:
 ###CONFIRM_URL###
 
@@ -2810 +2819 @@
         'description' => $action_description,
         'confirm_url' => add_query_arg( array(
-            'action'         => 'emailconfirm',
+            'action'         => 'verifyaccount',
             'confirm_action' => $action_name,
             'uid'            => $uid,
@@ -2830 +2839 @@
      * ###SITEURL###            The URL to the site.
      *
+     * @since 5.0.0
+     * 
      * @param string $email_text     Text in the email.
      * @param array  $email_data {
@@ -2842 +2853 @@
      * }
      */
-    $content = apply_filters( 'confirm_account_action_email_content', $email_text, $email_data );
+    $content = apply_filters( 'account_verification_email_content', $email_text, $email_data );
 
     $content = str_replace( '###DESCRIPTION###', $email_data['description'], $content );
@@ -2851 +2862 @@
 
     /* translators: %s Site name. */
-    return wp_mail( $email_data['email'], sprintf( __( '[%s] Confirm Account Action' ), wp_specialchars_decode( get_option( 'blogname' ), ENT_QUOTES ) ), $content );
+    return wp_mail( $email_data['email'], sprintf( __( '[%s] Confirm Action' ), wp_specialchars_decode( get_option( 'blogname' ), ENT_QUOTES ) ), $content );
 }
 
@@ -2859 +2870 @@
  * @since 5.0.0
  *
- * @param string $action_name Name of the action this key is being generated for.
- * @param string $email       User email address. This can be the address of a registered or non-registered user.
- *
+ * @param string $email        User email address. This can be the address of a registered or non-registered user.
+ * @param string $action_name  Name of the action this key is being generated for.
+ * @param array  $request_data Misc data you want to send with the verification request and pass to the actions once the request is confirmed.
  * @return string|WP_Error Confirmation key on success. WP_Error on error.
  */
-function get_confirm_account_action_key( $action_name, $email ) {
+function wp_get_account_verification_key( $email, $action_name, $request_data = array() ) {
     global $wp_hasher;
 
@@ -2890 +2901 @@
 
     $hashed_key = $wp_hasher->HashPassword( $key );
+    $value      = array(
+        'action'       => $action_name,
+        'time'         => time(),
+        'hash'         => $hashed_key,
+        'email'        => $email,
+        'request_data' => $request_data,
+    );
 
     if ( $is_registered_user ) {
-        $key_saved = (bool) update_user_meta( $user->ID, '_account_action_' . $action_name, implode( ':', array( time(), $hashed_key ) ) );
+        $key_saved = (bool) update_user_meta( $user->ID, '_verify_action_' . $action_name, wp_json_encode( $value ) );
     } else {
-        $key_saved = (bool) update_site_option( '_account_action_' . hash( 'sha256', $email ) . '_' . $action_name, implode( ':', array( time(), $hashed_key, $email ) ) );
+        $uid       = function_exists( 'hash' ) ? hash( 'sha256', $email ) : sha1( $email );
+        $key_saved = (bool) update_site_option( '_verify_action_' . $action_name . '_' . $uid, wp_json_encode( $value ) );
     }
 
     if ( false === $key_saved ) {
-        return new WP_Error( 'no_confirm_account_action_key_update', __( 'Could not save confirm account action key to database.' ) );
+        return new WP_Error( 'no_account_verification_key_update', __( 'Could not save confirm account action key to database.' ) );
     }
 
@@ -2909 +2928 @@
  * @since 5.0.0
  *
- * @param string $action_name Name of the action this key is being generated for.
  * @param string $key         Key to confirm.
  * @param string $uid         Email hash or user ID.
- *
+ * @param string $action_name Name of the action this key is being generated for.
  * @return array|WP_Error WP_Error on failure, action name and user email address on success.
  */
-function check_confirm_account_action_key( $action_name, $key, $uid ) {
+function wp_check_account_verification_key( $key, $uid, $action_name ) {
     global $wp_hasher;
 
-    if ( ! empty( $action_name ) && ! empty( $key ) && ! empty( $uid ) ) {
-        $user = false;
-
-        if ( is_numeric( $uid ) ) {
-            $user = get_user_by( 'id', absint( $uid ) );
-        }
-
-        // We could be dealing with a registered user account, or a visitor.
-        $is_registered_user = $user && ! is_wp_error( $user );
-        $key_request_time = '';
-        $saved_key        = '';
-        $email            = '';
-
-        if ( empty( $wp_hasher ) ) {
-            require_once ABSPATH . WPINC . '/class-phpass.php';
-            $wp_hasher = new PasswordHash( 8, true );
-        }
-
-        // Get the saved key from the database.
-        if ( $is_registered_user ) {
-            $confirm_action_data = get_user_meta( $user->ID, '_account_action_' . $action_name, true );
-            $email               = $user->user_email;
-
-            if ( false !== strpos( $confirm_action_data, ':' ) ) {
-                list( $key_request_time, $saved_key ) = explode( ':', $confirm_action_data, 2 );
-            }
-        } else {
-            $confirm_action_data = get_site_option( '_account_action_' . $uid . '_' . $action_name, '' );
-
-            if ( false !== strpos( $confirm_action_data, ':' ) ) {
-                list( $key_request_time, $saved_key, $email ) = explode( ':', $confirm_action_data, 3 );
-            }
-        }
-
-        if ( ! $saved_key ) {
-            return new WP_Error( 'invalid_key', __( 'Invalid key' ) );
-        }
-
-        /**
-         * Filters the expiration time of confirm keys.
-         *
-         * @param int $expiration The expiration time in seconds.
-         */
-        $expiration_duration = apply_filters( 'account_action_expiration', DAY_IN_SECONDS );
-        $expiration_time     = $key_request_time + $expiration_duration;
-
-        if ( $wp_hasher->CheckPassword( $key, $saved_key ) ) {
-            if ( $expiration_time && time() < $expiration_time ) {
-                $return = array(
-                    'action' => $action_name,
-                    'email'  => $email,
-                );
-            } else {
-                $return = new WP_Error( 'expired_key', __( 'The confirmation email has expired.' ) );
-            }
-
-            // Clean up stored keys.
-            if ( $is_registered_user ) {
-                delete_user_meta( $user->ID, '_account_action_' . $action_name );
-            } else {
-                delete_site_option( '_account_action_' . $uid . '_' . $action_name );
-            }
-
-            return $return;
-        }
-    }
-
-    return new WP_Error( 'invalid_key', __( 'Invalid key' ) );
-}
+    if ( empty( $action_name ) || empty( $key ) || empty( $uid ) ) {
+        return new WP_Error( 'invalid_key', __( 'Invalid key' ) );
+    }
+
+    $user = false;
+
+    if ( is_numeric( $uid ) ) {
+        $user = get_user_by( 'id', absint( $uid ) );
+    }
+
+    // We could be dealing with a registered user account, or a visitor.
+    $is_registered_user = ( $user && ! is_wp_error( $user ) );
+    $key_request_time   = '';
+    $saved_key          = '';
+    $email              = '';
+
+    if ( empty( $wp_hasher ) ) {
+        require_once ABSPATH . WPINC . '/class-phpass.php';
+        $wp_hasher = new PasswordHash( 8, true );
+    }
+
+    // Get the saved key from the database.
+    if ( $is_registered_user ) {
+        $raw_data = get_user_meta( $user->ID, '_verify_action_' . $action_name, true );
+        $email    = $user->user_email;
+
+        if ( false !== strpos( $confirm_action_data, ':' ) ) {
+            list( $key_request_time, $saved_key ) = explode( ':', $confirm_action_data, 2 );
+        }
+    } else {
+        $raw_data = get_site_option( '_verify_action_' . $action_name . '_' . $uid, '' );
+
+        if ( false !== strpos( $confirm_action_data, ':' ) ) {
+            list( $key_request_time, $saved_key, $email ) = explode( ':', $confirm_action_data, 3 );
+        }
+    }
+
+    $data             = json_decode( $raw_data, true );
+    $key_request_time = (int) isset( $data['time'] ) ? $data['time'] : 0;
+    $saved_key        = isset( $data['hash'] ) ? $data['hash'] : '';
+    $email            = sanitize_email( isset( $data['email'] ) ? $data['email'] : '' );
+    $request_data     = isset( $data['request_data'] ) ? $data['request_data'] : array();
+
+    if ( ! $saved_key ) {
+        return new WP_Error( 'invalid_key', __( 'Invalid key' ) );
+    }
+
+    if ( ! $key_request_time || ! $email ) {
+        return new WP_Error( 'invalid_key', __( 'Invalid action' ) );
+    }
+
+    /**
+     * Filters the expiration time of confirm keys.
+     *
+     * @since 5.0.0
+     * 
+     * @param int $expiration The expiration time in seconds.
+     */
+    $expiration_duration = apply_filters( 'account_verification_expiration', DAY_IN_SECONDS );
+    $expiration_time     = $key_request_time + $expiration_duration;
+
+    if ( ! $wp_hasher->CheckPassword( $key, $saved_key ) ) {
+        return new WP_Error( 'invalid_key', __( 'Invalid key' ) );
+    }
+
+    if ( $expiration_time && time() < $expiration_time ) {
+        $return = array(
+            'action'       => $action_name,
+            'email'        => $email,
+            'request_data' => $request_data,
+        );
+    } else {
+        $return = new WP_Error( 'expired_key', __( 'The confirmation email has expired.' ) );
+    }
+
+    // Clean up stored keys.
+    if ( $is_registered_user ) {
+        delete_user_meta( $user->ID, '_verify_action_' . $action_name );
+    } else {
+        delete_site_option( '_verify_action_' . $action_name . '_' . $uid );
+    }
+
+    return $return;
+}

branches/4.9/src/wp-login.php

@@ -414 +414 @@
 
 // validate action so as to default to the login screen
-if ( !in_array( $action, array( 'postpass', 'logout', 'lostpassword', 'retrievepassword', 'resetpass', 'rp', 'register', 'login', 'emailconfirm' ), true ) && false === has_filter( 'login_form_' . $action ) )
+if ( !in_array( $action, array( 'postpass', 'logout', 'lostpassword', 'retrievepassword', 'resetpass', 'rp', 'register', 'login', 'verifyaccount' ), true ) && false === has_filter( 'login_form_' . $action ) )
     $action = 'login';
 
@@ -839 +839 @@
 break;
 
-case 'emailconfirm' :
+case 'verifyaccount' :
     if ( isset( $_GET['confirm_action'], $_GET['confirm_key'], $_GET['uid'] ) ) {
-        $action_name = sanitize_key( wp_unslash( $_GET['confirm_action'] ) );
         $key         = sanitize_text_field( wp_unslash( $_GET['confirm_key'] ) );
         $uid         = sanitize_text_field( wp_unslash( $_GET['uid'] ) );
-        $result      = check_confirm_account_action_key( $action_name, $key, $uid );
+        $action_name = sanitize_key( wp_unslash( $_GET['confirm_action'] ) );
+        $result      = wp_check_account_verification_key( $key, $uid, $action_name );
     } else {
         $result = new WP_Error( 'invalid_key', __( 'Invalid key' ) );