WordPress.org
Get WordPress

Plugin Directory

Changeset 3354773


Ignore:
Timestamp:
09/02/2025 02:03:30 PM (7 months ago)
Author:
SS88_UK
Message:

v1.9.8

Location:
two-factor-2fa-via-email
Files:
12 added
2 edited

Legend:

Unmodified
Added
Removed

  • two-factor-2fa-via-email/trunk/readme.txt

    r3342564 r3354773  
    55Requires at least: 4.6
    66Tested up to: 6.8
    7 Stable tag: 1.9.7
     7Stable tag: 1.9.8
    88Requires PHP: 5.6
    99License: GPL2
    … …  
    133133== Changelog ==
    134134
     135= 1.9.8 =
     136* Thank you for 10,000+ active installations! :-)
     137* Fix: REST API authentication
     138
    135139= 1.9.7 =
    136140* PHP Warning fix on new user

  • two-factor-2fa-via-email/trunk/ss88-two-factor-via-email.php

    r3342562 r3354773  
    44Plugin URI: https://ss88.us/plugins/two-factor-2fa-authentication-via-email-plugin-for-wordpress
    55Description: A lightweight plugin to allow the use of two-factor authentication (2FA) through email. One-click login with this Two-Factor (2FA) Authentication plugin for WordPress.
    6 Version: 1.9.7
     6Version: 1.9.8
    77Author: SS88 LLC
    88Author URI: https://ss88.us
    … …  
    1212class SS88_2FAVE {
    1313
    14     protected $version = '1.9.7';
     14    protected $version = '1.9.8';
    1515    protected $email_tags = [];
    1616    protected $expires = 15;
    … …  
    3636
    3737        add_action('wp_login', [$this, 'wp_login'], 1, 2);
     38        add_filter('rest_authentication_errors', [$this, 'rest_authentication_errors'], 10, 1);
    3839        add_action('login_init', [$this, 'processTokenLogin']);
    3940        add_action('deactivated_plugin', [$this, 'deactivated_plugin']);
    … …  
    214215
    215216    public function wp_login($user_login, $U) {
    216 
    217         // Let's check to see if it's an API call
    218         if(strpos($_SERVER['REQUEST_URI'], '/wp-json/') === 0 || strpos($_SERVER['REQUEST_URI'], '?rest_route=') === 0) {
    219 
    220             if(!$this->isEnabled($U->ID, 'API')) return;
    221 
    222             wp_send_json_error([
    223                 'message' => __('2FA is enabled on this account. Unable to authenticate.', 'two-factor-2fa-via-email')
    224             ], 403);
    225             exit;
    226 
    227         }
    228217
    229218        if(!isset($_GET['token'])) {
    … …  
    259248        }
    260249
     250    }
     251   
     252    public function rest_authentication_errors($result) {
     253       
     254        if (!empty($result)) return $result;
     255       
     256        $AuthorizationHeader = $this->get_basic_auth_header();
     257       
     258        if($AuthorizationHeader) {
     259       
     260            $user = wp_get_current_user();
     261            if ($user && $user->ID && $this->isEnabled($user->ID, 'API')) {
     262                return new WP_Error(
     263                    'rest_forbidden',
     264                    __('2FA is enabled on this account. Unable to authenticate.', 'two-factor-2fa-via-email'),
     265                    ['status' => 403]
     266                );
     267            }
     268           
     269        }
     270
     271        return $result;
     272       
     273    }
     274   
     275    private function get_basic_auth_header() {
     276       
     277        $h = '';
     278        if ( isset( $_SERVER['HTTP_AUTHORIZATION'] ) ) {
     279            $h = $_SERVER['HTTP_AUTHORIZATION'];
     280        } elseif ( isset( $_SERVER['REDIRECT_HTTP_AUTHORIZATION'] ) ) {
     281            $h = $_SERVER['REDIRECT_HTTP_AUTHORIZATION'];
     282        } elseif ( isset( $_SERVER['AUTHORIZATION'] ) ) {
     283            $h = $_SERVER['AUTHORIZATION'];
     284        }
     285
     286       
     287        if ( preg_match('/^(Basic|Bearer|Application)\s+/i', $h) ) {
     288            return $h;
     289        }
     290       
     291        return false;
    261292    }
    262293
Note: See TracChangeset for help on using the changeset viewer.