Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Account Protection: Add more structure surrounding password rules
- Loading branch information
1 parent
e6ee25f
commit 994ea25
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -22,6 +22,20 @@ class Validation_Service { | |
| */ | ||
| private $connection_manager; | ||
|
|
||
| /** | ||
| * Validation rules. | ||
| * | ||
| * @var array | ||
| */ | ||
| private $rules = array( | ||
| Min_Length_Rule::class, | ||
| Not_Empty_Validation_Rule::class, | ||
|
Check failure on line 32 in projects/packages/account-protection/src/class-validation-service.php
|
||
| No_Backslash_Rule::class, | ||
| Not_Recent_Rule::class, | ||
| Not_Compromised_Rule::class, | ||
| No_Userdata_Rule::class, | ||
| ); | ||
|
|
||
| /** | ||
| * Constructor for dependency injection. | ||
| * | ||
|
|
@@ -50,125 +64,42 @@ protected function request_suffixes( string $password_prefix ) { | |
| } | ||
|
|
||
| /** | ||
| * Get the validation errors. | ||
| * | ||
| * @param string $password The password to check. | ||
| * @param array $userdata The user data to check against, or null if not provided. | ||
|
Check failure on line 70 in projects/packages/account-protection/src/class-validation-service.php
|
||
| * | ||
| * @return string[] List of broken rule IDs. | ||
| */ | ||
| public function get_validation_errors( string $password, array $userdata = null ) { | ||
|
Check failure on line 74 in projects/packages/account-protection/src/class-validation-service.php
|
||
| $broken_rules = array(); | ||
|
|
||
| foreach ( $this->rules as $rule ) { | ||
| $rule = new $rule( $this ); | ||
|
|
||
| // Get the number of parameters the callback accepts; | ||
| $param_names = array_map( | ||
| function ( $param ) { | ||
| return $param->getName(); | ||
| }, | ||
| ( new \ReflectionMethod( $rule, 'callback' ) )->getParameters() | ||
| ); | ||
|
|
||
| // Assemble the arguments required by the callback. | ||
| $args = array( $password ); | ||
| if ( in_array( 'userdata', $param_names, true ) ) { | ||
| $args[] = $userdata; | ||
| } | ||
|
|
||
| // Call the callback. | ||
| $validation_callback_result = call_user_func_array( array( $rule, 'callback' ), $args ); | ||
|
|
||
| if ( ! $validation_callback_result ) { | ||
| $broken_rules[] = $rule->id; | ||
| } | ||
| } | ||
|
|
||
| return $broken_rules; | ||
| } | ||
|
|
||
| /** | ||
|
|
@@ -197,41 +128,37 @@ public function is_invalid_length( string $password ): bool { | |
| /** | ||
| * Check if the password matches any user data. | ||
| * | ||
| * @param string $password The password to check. | ||
| * @param array $userdata The user data. | ||
| * | ||
| * @return bool True if the password matches any user data, false otherwise. | ||
| */ | ||
| public function matches_user_data( string $password, array $userdata ): bool { | ||
| $data_to_match = array( | ||
| $userdata['user_login'] ?? '', | ||
| $userdata['display_name'] ?? '', | ||
| $userdata['first_name'] ?? '', | ||
| $userdata['last_name'] ?? '', | ||
| $userdata['user_email'] ?? '', | ||
| $userdata['nickname'] ?? '', | ||
| ); | ||
|
|
||
| if ( $userdata['user_email'] ) { | ||
| $email_parts = explode( '@', $userdata['user_email'] ); // [email protected] | ||
| $email_username = $email_parts[0]; // 'test' | ||
| $email_domain = $email_parts[1]; // 'example.com' | ||
| $email_provider = explode( '.', $email_domain )[0]; // 'example' | ||
|
|
||
| $data_to_match[] = $email_username; | ||
| $data_to_match[] = $email_provider; | ||
| } | ||
|
|
||
| foreach ( $data_to_match as $data ) { | ||
| if ( strlen( $data ) <= 3 ) { | ||
| continue; | ||
| } | ||
|
|
||
| if ( strpos( strtolower( $password ), strtolower( $data ) ) !== false ) { | ||
| return true; | ||
| } | ||
| } | ||
|
|
@@ -246,7 +173,7 @@ public function matches_user_data( $user, string $password ): bool { | |
| * | ||
| * @return bool True if the password is in the list of compromised/common passwords, false otherwise. | ||
| */ | ||
| public function is_compromised_password( string $password ): bool { | ||
| if ( ! $this->connection_manager->is_connected() ) { | ||
| return false; | ||
| } | ||
|
|
@@ -296,18 +223,21 @@ public function is_current_password( int $user_id, string $password ): bool { | |
| /** | ||
| * Check if the password has been used recently by the user. | ||
| * | ||
| * @param string $password The password to check. | ||
| * @param array $userdata The user data. | ||
| * | ||
| * @return bool True if the password was recently used, false otherwise. | ||
| */ | ||
| public function is_recent_password( string $password, array $userdata ): bool { | ||
| if ( ! array_key_exists( 'ID', $userdata ) ) { | ||
| return false; | ||
| } | ||
|
|
||
| if ( $this->is_current_password( $userdata['ID'], $password ) ) { | ||
| return true; | ||
| } | ||
|
|
||
| $recent_passwords = get_user_meta( $userdata['ID'], Config::PASSWORD_MANAGER_RECENT_PASSWORD_HASHES_USER_META_KEY, true ); | ||
| if ( empty( $recent_passwords ) || ! is_array( $recent_passwords ) ) { | ||
| return false; | ||
| } | ||
|
|
||
Oops, something went wrong.