Completed
Push — update/sso-allow-3rd-party-act... ( ef4bc5...73d615 )
by
unknown
19:00 queued 10:42
created

Jetpack_SSO_Helpers::is_two_step_required()   A

Complexity

Conditions 1
Paths 1

Size

Total Lines 12
Code Lines 2

Duplication

Lines 0
Ratio 0 %

Importance

Changes 0
Metric Value
cc 1
eloc 2
nc 1
nop 0
dl 0
loc 12
rs 9.4285
c 0
b 0
f 0
1
<?php
2
3
if ( ! class_exists( 'Jetpack_SSO_Helpers' ) ) :
4
5
/**
6
 * A collection of helper functions used in the SSO module.
7
 *
8
 * @since 4.1.0
9
 */
10
class Jetpack_SSO_Helpers {
11
	/**
12
	 * An array used to store the contents of $_GET before overriding $_GET.
13
	 * @var array
14
	 */
15
	static $stashed_get_params = array();
0 ignored issues
show
Coding Style introduced by
The visibility should be declared for property $stashed_get_params.

The PSR-2 coding standard requires that all properties in a class have their visibility explicitly declared. If you declare a property using

class A {
    var $property;
}

the property is implicitly global.

To learn more about the PSR-2, please see the PHP-FIG site on the PSR-2.

Loading history...
16
17
	/**
18
	 * An array used to store the content of $_POST before overriding $_POST.
19
	 * @var array
20
	 */
21
	static $stashed_post_params = array();
0 ignored issues
show
Coding Style introduced by
The visibility should be declared for property $stashed_post_params.

The PSR-2 coding standard requires that all properties in a class have their visibility explicitly declared. If you declare a property using

class A {
    var $property;
}

the property is implicitly global.

To learn more about the PSR-2, please see the PHP-FIG site on the PSR-2.

Loading history...
22
23
	/**
24
	 * Determine if the login form should be hidden or not
25
	 *
26
	 * @return bool
27
	 **/
28
	static function should_hide_login_form() {
29
		/**
30
		 * Remove the default log in form, only leave the WordPress.com log in button.
31
		 *
32
		 * @module sso
33
		 *
34
		 * @since 3.1.0
35
		 *
36
		 * @param bool get_option( 'jetpack_sso_remove_login_form', false ) Should the default log in form be removed. Default to false.
37
		 */
38
		return (bool) apply_filters( 'jetpack_remove_login_form', get_option( 'jetpack_sso_remove_login_form', false ) );
39
	}
40
41
	/**
42
	 * Returns a boolean value for whether logging in by matching the WordPress.com user email to a
43
	 * Jetpack site user's email is allowed.
44
	 *
45
	 * @return bool
46
	 */
47
	static function match_by_email() {
48
		$match_by_email = ( 1 == get_option( 'jetpack_sso_match_by_email', true ) ) ? true: false;
49
		$match_by_email = defined( 'WPCC_MATCH_BY_EMAIL' ) ? WPCC_MATCH_BY_EMAIL : $match_by_email;
50
51
		/**
52
		 * Link the local account to an account on WordPress.com using the same email address.
53
		 *
54
		 * @module sso
55
		 *
56
		 * @since 2.6.0
57
		 *
58
		 * @param bool $match_by_email Should we link the local account to an account on WordPress.com using the same email address. Default to false.
59
		 */
60
		return (bool) apply_filters( 'jetpack_sso_match_by_email', $match_by_email );
61
	}
62
63
	/**
64
	 * Returns a boolean for whether users are allowed to register on the Jetpack site with SSO,
65
	 * even though the site disallows normal registrations.
66
	 *
67
	 * @return bool
68
	 */
69
	static function new_user_override( $user_data = null ) {
70
		$new_user_override = defined( 'WPCC_NEW_USER_OVERRIDE' ) ? WPCC_NEW_USER_OVERRIDE : false;
71
72
		/**
73
		 * Allow users to register on your site with a WordPress.com account, even though you disallow normal registrations. 
74
		 * If you return a string that corresponds to a user role, the user will be given that role.
75
		 *
76
		 * @module sso
77
		 *
78
		 * @since 2.6.0
79
		 * @since 4.6   $user_data object is now passed to the jetpack_sso_new_user_override filter
80
		 *
81
		 * @param bool        $new_user_override Allow users to register on your site with a WordPress.com account. Default to false.
82
		 * @param object|null $user_data         An object containing the user data returned from WordPress.com.
83
		 */
84
		$role = apply_filters( 'jetpack_sso_new_user_override', $new_user_override, $user_data );
85
86
		if ( $role ) {
87
			if ( is_string( $role ) && get_role( $role ) ) {
88
				return $role;
89
			} else {
90
				return get_option( 'default_role' );
91
			}
92
		}
93
94
		return false;
95
	}
96
97
	/**
98
	 * Returns a boolean value for whether two-step authentication is required for SSO.
99
	 *
100
	 * @since 4.1.0
101
	 *
102
	 * @return bool
103
	 */
104
	static function is_two_step_required() {
105
		/**
106
		 * Is it required to have 2-step authentication enabled on WordPress.com to use SSO?
107
		 *
108
		 * @module sso
109
		 *
110
		 * @since 2.8.0
111
		 *
112
		 * @param bool get_option( 'jetpack_sso_require_two_step' ) Does SSO require 2-step authentication?
113
		 */
114
		return (bool) apply_filters( 'jetpack_sso_require_two_step', get_option( 'jetpack_sso_require_two_step', false ) );
115
	}
116
117
	/**
118
	 * Returns a boolean for whether a user that is attempting to log in will be automatically
119
	 * redirected to WordPress.com to begin the SSO flow.
120
	 *
121
	 * @return bool
122
	 */
123
	static function bypass_login_forward_wpcom() {
124
		/**
125
		 * Redirect the site's log in form to WordPress.com's log in form.
126
		 *
127
		 * @module sso
128
		 *
129
		 * @since 3.1.0
130
		 *
131
		 * @param bool false Should the site's log in form be automatically forwarded to WordPress.com's log in form.
132
		 */
133
		return (bool) apply_filters( 'jetpack_sso_bypass_login_forward_wpcom', false );
134
	}
135
136
	/**
137
	 * Returns a boolean for whether the SSO login form should be displayed as the default
138
	 * when both the default and SSO login form allowed.
139
	 *
140
	 * @since 4.1.0
141
	 *
142
	 * @return bool
143
	 */
144
	static function show_sso_login() {
145
		if ( self::should_hide_login_form() ) {
146
			return true;
147
		}
148
149
		/**
150
		 * Display the SSO login form as the default when both the default and SSO login forms are enabled.
151
		 *
152
		 * @module sso
153
		 *
154
		 * @since 4.1.0
155
		 *
156
		 * @param bool true Should the SSO login form be displayed by default when the default login form is also enabled?
157
		 */
158
		return (bool) apply_filters( 'jetpack_sso_default_to_sso_login', true );
159
	}
160
161
	/**
162
	 * Returns a boolean for whether the two step required checkbox, displayed on the Jetpack admin page, should be disabled.
163
	 *
164
	 * @since 4.1.0
165
	 *
166
	 * @return bool
167
	 */
168
	static function is_require_two_step_checkbox_disabled() {
169
		return (bool) has_filter( 'jetpack_sso_require_two_step' );
170
	}
171
172
	/**
173
	 * Returns a boolean for whether the match by email checkbox, displayed on the Jetpack admin page, should be disabled.
174
	 *
175
	 * @since 4.1.0
176
	 *
177
	 * @return bool
178
	 */
179
	static function is_match_by_email_checkbox_disabled() {
180
		return defined( 'WPCC_MATCH_BY_EMAIL' ) || has_filter( 'jetpack_sso_match_by_email' );
181
	}
182
183
	/**
184
	 * Returns an array of hosts that SSO will redirect to.
185
	 *
186
	 * Instead of accessing JETPACK__API_BASE within the method directly, we set it as the
187
	 * default for $api_base due to restrictions with testing constants in our tests.
188
	 *
189
	 * @since 4.3.0
190
	 * @since 4.6.0 Added public-api.wordpress.com as an allowed redirect
191
	 *
192
	 * @param array $hosts
193
	 * @param string $api_base
194
	 *
195
	 * @return array
196
	 */
197
	static function allowed_redirect_hosts( $hosts, $api_base = JETPACK__API_BASE ) {
198
		if ( empty( $hosts ) ) {
199
			$hosts = array();
200
		}
201
202
		$hosts[] = 'wordpress.com';
203
		$hosts[] = 'jetpack.wordpress.com';
204
		$hosts[] = 'public-api.wordpress.com';
205
206
		if (
207
			( Jetpack::is_development_mode() || Jetpack::is_development_version() ) &&
208
			( false === strpos( $api_base, 'jetpack.wordpress.com/jetpack' ) )
209
		) {
210
			$base_url_parts = parse_url( esc_url_raw( $api_base ) );
211
			if ( $base_url_parts && ! empty( $base_url_parts[ 'host' ] ) ) {
212
				$hosts[] = $base_url_parts[ 'host' ];
213
			}
214
		}
215
216
		return array_unique( $hosts );
217
	}
218
219
	static function generate_user( $user_data ) {
220
		$username = $user_data->login;
221
222
		/**
223
		 * Determines how many times the SSO module can attempt to randomly generate a user.
224
		 *
225
		 * @module sso
226
		 *
227
		 * @since 4.3.2
228
		 *
229
		 * @param int 5 By default, SSO will attempt to random generate a user up to 5 times.
230
		 */
231
		$num_tries = intval( apply_filters( 'jetpack_sso_allowed_username_generate_retries', 5 ) );
232
233
		$tries = 0;
234
		while ( ( $exists = username_exists( $username ) ) && $tries++ < $num_tries ) {
235
			$username = $user_data->login . '_' . $user_data->ID . '_' . mt_rand();
236
		}
237
238
		if ( $exists ) {
239
			return false;
240
		}
241
242
		$password = wp_generate_password( 20 );
243
		$user_id  = wp_create_user( $username, $password, $user_data->email );
244
		$user     = get_userdata( $user_id );
245
246
		$user->display_name = $user_data->display_name;
247
		$user->first_name   = $user_data->first_name;
248
		$user->last_name    = $user_data->last_name;
249
		$user->url          = $user_data->url;
250
		$user->description  = $user_data->description;
251
252
		if ( isset( $user_data->role ) && $user_data->role ) {
253
			$user->role     = $user_data->role;
0 ignored issues
show
Coding Style introduced by
Equals sign not aligned correctly; expected 1 space but found 5 spaces

This check looks for improperly formatted assignments.

Every assignment must have exactly one space before and one space after the equals operator.

To illustrate:

$a = "a";
$ab = "ab";
$abc = "abc";

will have no issues, while

$a   = "a";
$ab  = "ab";
$abc = "abc";

will report issues in lines 1 and 2.

Loading history...
254
		}
255
256
		wp_update_user( $user );
257
258
		update_user_meta( $user->ID, 'wpcom_user_id', $user_data->ID );
259
		
260
		return $user;
261
	}
262
263
	static function extend_auth_cookie_expiration_for_sso() {
264
		/**
265
		 * Determines how long the auth cookie is valid for when a user logs in with SSO.
266
		 *
267
		 * @module sso
268
		 *
269
		 * @since 4.4.0
270
		 *
271
		 * @param int YEAR_IN_SECONDS
272
		 */
273
		return intval( apply_filters( 'jetpack_sso_auth_cookie_expirtation', YEAR_IN_SECONDS ) );
274
	}
275
276
	/**
277
	 * Determines if the SSO form should be displayed for the current action.
278
	 *
279
	 * @param string $action
280
	 *
281
	 * @return bool  Is SSO allowed for the current action?
282
	 */
283
	static function display_sso_form_for_action( $action ) {
284
		/**
285
		 * Allows plugins the ability to overwrite actions where the SSO form is allowed to be used.
286
		 *
287
		 * @module sso
288
		 *
289
		 * @since 4.6.0
290
		 *
291
		 * @param array $allowed_actions_for_sso
292
		 */
293
		$allowed_actions_for_sso = (array) apply_filters( 'jetpack_sso_allowed_actions', array(
294
			'login',
295
			'jetpack_json_api_authorization',
296
		) );
297
		return in_array( $action, $allowed_actions_for_sso );
298
	}
299
300
	/**
301
	 * Given a URL that is the original request which kicked off the SSO flow, this function returns whether
302
	 * the request was for Jetpack JSON API authorization by checking the value of `$action`.
303
	 *
304
	 * @param string $original_request
305
	 *
306
	 * @return bool Was the original request for JSON API authorization?
307
	 */
308
	static function is_sso_for_json_api_auth( $original_request ) {
309
		$original_request = esc_url_raw( $original_request );
310
311
		$parsed_url = wp_parse_url( $original_request );
312
		if ( empty( $parsed_url ) || empty( $parsed_url['query'] ) ) {
313
			return false;
314
		}
315
316
		$args = array();
317
		wp_parse_str( $parsed_url['query'], $args );
318
319
		if ( empty( $args ) || empty( $args['action'] ) ) {
320
			return false;
321
		}
322
323
		return 'jetpack_json_api_authorization' === $args['action'];
324
	}
325
326
	/**
327
	 * Given a URL that is the original request which kicked off the SSO flow, this function stores the contents of
328
	 * $_GET and $_POST into static variables of this class and then updates $_GET and $_POST to match the original
329
	 * request. This is done so that we can verify the JSON API authorization request.
330
	 *
331
	 * @param string $original_request
332
	 *
333
	 * @return bool Were the superglobal values updated to mathch the original request?
334
	 */
335
	static function set_superglobal_values_for_json_api_auth( $original_request ) {
336
		$original_request = esc_url_raw( $original_request );
337
338
		$parsed_url = wp_parse_url( $original_request );
339
		if ( empty( $parsed_url ) || empty( $parsed_url['query'] ) ) {
340
			return false;
341
		}
342
343
		$args = array();
344
		wp_parse_str( $parsed_url['query'], $args );
345
346
		if ( empty( $args ) || empty( $args['action'] ) ) {
347
			return false;
348
		}
349
350
		if ( 'jetpack_json_api_authorization' !== $args['action'] ) {
351
			return false;
352
		}
353
354
		self::$stashed_get_params = $_GET;
355
		self::$stashed_post_params = $_POST;
356
357
		$_GET = $args;
358
		$_POST['jetpack_json_api_original_query'] = $original_request;
359
360
		return true;
361
	}
362
363
	/**
364
	 * This function is meant to be run after calling self::set_superglobal_values_for_json_api_auth( $original_request)
365
	 * and resets the superglobals back to their original values.
366
	 */
367
	static function reset_superglobal_values_after_json_api_auth() {
368
		$_POST = self::$stashed_post_params;
369
		$_GET = self::$stashed_get_params;
370
	}
371
}
372
373
endif;
374