ultimatemember/includes/core/class-secure.php

<?php
namespace um\core;

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

if ( ! class_exists( 'um\core\Secure' ) ) {

	/**
	 * Class Secure
	 *
	 * @package um\core
	 *
	 * @since 2.6.8
	 */
	class Secure {

		/**
		 * Banned Administrative Capabilities
		 *
		 * @since 2.6.8
		 *
		 * @var array
		 */
		public $banned_admin_capabilities = array();

		/**
		 * Login constructor.
		 * @since 2.6.8
		 */
		public function __construct() {
			add_action( 'admin_init', array( $this, 'admin_init' ) );

			add_action( 'um_before_login_fields', array( $this, 'reset_password_notice' ) );

			add_action( 'um_before_login_fields', array( $this, 'under_maintanance_notice' ) );

			add_filter( 'um_settings_structure', array( $this, 'add_settings' ) );

			add_action( 'um_submit_form_register', array( $this, 'block_register_forms' ) );

			add_action( 'um_user_login', array( $this, 'login_validate_expired_pass' ), 1 );

			add_action( 'validate_password_reset', array( $this, 'avoid_old_password' ), 1, 2 );

			/**
			 * UM hook
			 *
			 * @type filter
			 * @title um_secure_register_form_banned_capabilities
			 * @description Modify banned capabilities for Register forms
			 * @input_vars
			 * [{"var":"$capabilities","type":"array","desc":"WordPress Administratrive Capabilities"}]
			 * @change_log
			 * ["Since: 2.6.8"]
			 * @usage
			 * <?php add_filter( 'um_secure_register_form_banned_capabilities', 'function_name', 10, 1 ); ?>
			 * @example
			 * <?php
			 * add_filter( 'um_secure_register_form_banned_capabilities', 'my_banned_capabilities', 10, 1 );
			 * function my_banned_capabilities( $capabiities ) {
			 *     // your code here
			 *     $capabiities[ ] = 'read'; // rejects all users with `read` capabilitiy.
			 *     return $capabiities;
			 * }
			 * ?>
			 */
			$this->banned_admin_capabilities = apply_filters(
				'um_secure_register_form_banned_capabilities',
				array(
					'create_sites',
					'delete_sites',
					'manage_network',
					'manage_sites',
					'manage_network_users',
					'manage_network_plugins',
					'manage_network_themes',
					'manage_network_options',
					'upgrade_network',
					'setup_network',
					'activate_plugins',
					'edit_dashboard',
					'edit_theme_options',
					'export',
					'import',
					'list_users',
					'manage_options',
					'promote_users',
					'remove_users',
					'switch_themes',
					'customize',
					'delete_site',
					'update_core',
					'update_plugins',
					'update_themes',
					'install_plugins',
					'install_themes',
					'delete_themes',
					'delete_plugins',
					'edit_plugins',
					'edit_themes',
					'edit_files',
					'edit_users',
					'add_users',
					'create_users',
					'delete_users',
					'level_10',
				)
			);

			/**
			 * Add blocked status in the User column list.
			 */
			add_filter( 'manage_users_custom_column', array( $this, 'manage_users_custom_column' ), 10, 3 );

			/**
			 *  WP Schedule Events for Notification
			 */
			add_action( 'wp', array( $this, 'schedule_events' ) );

			/**
			 * Init
			 */
			add_action( 'init', array( $this, 'init' ) );

		}

		/**
		 * Init
		 *
		 * @since 2.6.8
		 */
		public function init() {

			/**
			 * Checks the integrity of Current User's Capabilities
			 */
			add_action( 'um_after_save_registration_details', array( $this, 'secure_user_capabilities' ), 10 );
			if ( is_user_logged_in() && ! current_user_can( 'manage_options' ) ) { // Exclude current Logged-in Administrator from validation checks.
				add_action( 'um_after_user_updated', array( $this, 'secure_user_capabilities' ), 1 );
			}

		}

		/**
		 * Admin Init
		 *
		 * @since 2.6.8
		 */
		public function admin_init() {

			if ( isset( $_REQUEST['um_secure_expire_all_sessions'] ) ) {
				if ( ! wp_verify_nonce( $_REQUEST['_wpnonce'], 'um-secure-expire-session-nonce' ) ) {
					// This nonce is not valid.
					wp_die( esc_html_e( 'Security check', 'ultimate-member' ) );
				}

				// Get an instance of WP_User_Meta_Session_Tokens
				$sessions_manager = \WP_Session_Tokens::get_instance( null );
				// Remove all the session data for all users.
				$sessions_manager->drop_sessions();
				wp_safe_redirect( admin_url() );
				exit;
			}

		}

		/**
		 * Add Login notice for Reset Password
		 *
		 * @param array $args
		 * @since 2.6.8
		 */
		public function reset_password_notice( $args ) {

			if ( ! UM()->options()->get( 'display_login_form_notice' ) ) {
				return;
			}

			// phpcs:disable WordPress.Security.NonceVerification
			if ( ! isset( $_REQUEST['notice'] ) || 'expired_password' !== $_REQUEST['notice'] ) {
				return;
			}
			// phpcs:enable WordPress.Security.NonceVerification

			echo "<p class='um-notice warning'>";
			echo wp_kses(
				sprintf(
					// translators: One-time change requires you to reset your password
					__( '<strong>Important:</strong> Your password has expired. This (one-time) change requires you to reset your password. Please <a href="%s">click here</a> to reset your password via Email.', 'ultimate-member' ),
					um_get_core_page( 'password-reset' )
				),
				array(
					'strong' => array(),
					'a'      => array(
						'href' => array(),
					),
				)
			);
			echo '</p>';
		}

		/**
		 * Add Login notice for Under Maintance
		 *
		 * @param array $args
		 * @since 2.6.8
		 */
		public function under_maintanance_notice( $args ) {

			if ( ! UM()->options()->get( 'lock_register_forms' ) ) {
				return;
			}

			// phpcs:disable WordPress.Security.NonceVerification
			if ( ! isset( $_REQUEST['notice'] ) || 'maintanance' !== $_REQUEST['notice'] ) {
				return;
			}
			// phpcs:enable WordPress.Security.NonceVerification

			echo "<p class='um-notice warning'>";
			echo wp_kses(
				sprintf(
					// translators: One-time change requires you to reset your password
					__( '<strong>Important:</strong> This site is currently under maintenance. Please check back soon.', 'ultimate-member' ),
					um_get_core_page( 'password-reset' )
				),
				array(
					'strong' => array(),
					'a'      => array(
						'href' => array(),
					),
				)
			);
			echo '</p>';
		}

		/**
		 * Register Secure Settings
		 *
		 * @param array $settings
		 * @since 2.6.8
		 */
		public function add_settings( $settings ) {
			$nonce                       = wp_create_nonce( 'um-secure-expire-session-nonce' );
			$count_users                 = count_users();
			$settings['secure']['title'] = __( 'Secure', 'ultimate-member' );

			$banned_admin_capabilities_options = array();
			foreach ( $this->banned_admin_capabilities as $i => $cap ) {
				if ( in_array( $cap, array( 'manage_options', 'promote_users', 'level_10' ), true ) ) {
					continue;
				}
				$banned_admin_capabilities_options[ $cap ] = $cap;
			}

			$settings['secure']['sections'] =
			array(
				'' =>
				array(
					'title'  => __( 'Secure Ultimate Member', 'ultimate-member' ),
					'fields' => array(
						array(
							'id'          => 'lock_register_forms',
							'type'        => 'checkbox',
							'label'       => __( 'Lock All Register Forms', 'ultimate-member' ),
							'description' => __( 'This prevents all users from registering with Ultimate Member on your site.', 'ultimate-member' ),
						),
						array(
							'id'          => 'display_login_form_notice',
							'type'        => 'checkbox',
							'label'       => __( 'Display Login form notice to reset passwords', 'ultimate-member' ),
							'description' => __( 'Enforces users to reset their passwords( one-time ) and prevent from entering old password.', 'ultimate-member' ),
						),
						array(
							'id'          => 'force_reset_passwords',
							'type'        => 'info_text',
							'label'       => __( 'Expire All Users Sessions', 'ultimate-member' ),
							'value'       => '<a href="' . admin_url( '?um_secure_expire_all_sessions=1&_wpnonce=' . esc_attr( $nonce ) ) . '" class="button">Logout Users(' . esc_attr( $count_users['total_users'] ) . ') </a>',
							'description' => __( 'This will logout all users on your site and forces them to reset passwords <br/>when <strong>"Display Login form notice to reset passwords" is enabled/checked.</strong>', 'ultimate-member' ),
						),
						array(
							'id'          => 'banned_capabilities',
							'type'        => 'multi_checkbox',
							'multi'       => true,
							'columns'     => 2,
							'options'     => $banned_admin_capabilities_options,
							'value'       => UM()->options()->get( 'banned_capabilities' ) ? array_keys( UM()->options()->get( 'banned_capabilities' ) ) : array_keys( $banned_admin_capabilities_options ),
							'label'       => __( 'Banned Administrative Capabilities', 'ultimate-member' ),
							'description' => __( 'All the above are default Administrator & Super Admin capabilities. When someone tries to inject capabilities to the Profile & Register form submission, it will be flagged with this option. The <strong>manage_options</strong>, <strong>promote_users</strong> &amp; <strong>level_10</strong> capabilities are locked to ensure no users will be created with these capabilities.', 'ultimate-member' ),
						),
						array(
							'id'          => 'secure_notify_admins_banned_accounts',
							'type'        => 'checkbox',
							'label'       => __( 'Notify Administrators', 'ultimate-member' ),
							'description' => __( 'When enabled, All administrators will be notified when someone has suspicious activities in Profile & Register forms.', 'ultimate-member' ),
						),
						array(
							'id'          => 'secure_notify_admins_banned_accounts__interval',
							'type'        => 'select',
							'options'     => array(
								'instant' => __( 'Send Immediately', 'ultimate-member' ),
								'hourly'  => __( 'Hourly', 'ultimate-member' ),
								'daily'   => __( 'Daily', 'ultimate-member' ),
							),
							'label'       => __( 'Notification Schedule', 'ultimate-member' ),
							'conditional' => array( 'secure_notify_admins_banned_accounts', '=', 1 ),
						),
					),
				),
			);

			return $settings;
		}

		/**
		 * Block all UM Register form submissions.
		 *
		 * @param array $args Form settings.
		 * @since 2.6.8
		 */
		public function block_register_forms( $args ) {
			if ( UM()->options()->get( 'lock_register_forms' ) ) {
				$login_url = add_query_arg( 'notice', 'maintanance', um_get_core_page( 'login' ) );
				nocache_headers();
				wp_safe_redirect( $login_url );
				exit;
			}
		}

		/**
		 * Validate when user has expired password
		 *
		 * @param array $submitted_data
		 * @since 2.6.8
		 */
		public function login_validate_expired_pass( $submitted_data ) {

			if ( UM()->options()->get( 'display_login_form_notice' ) ) {
				$has_expired = get_user_meta( um_user( 'ID' ), 'um_secure_has_reset_password', true );
				if ( ! $has_expired ) {
					$login_url = add_query_arg( 'notice', 'expired_password', um_get_core_page( 'login' ) );
					wp_safe_redirect( $login_url );
					exit;
				}
			}
		}

		/**
		 * Prevent users from using Old Passwords on Password Reset form
		 *
		 * @param object $errors
		 * @param object $user
		 * @since 2.6.8
		 */
		public function avoid_old_password( $errors, $user ) {
			$wp_hasher = new \PasswordHash( 8, true );

			if ( isset( $_REQUEST['user_password'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification
				$new_user_pass = $_REQUEST['user_password']; // phpcs:ignore WordPress.Security.NonceVerification
				if ( $wp_hasher->CheckPassword( $new_user_pass, $user->data->user_pass ) ) {
					UM()->form()->add_error( 'user_password', __( 'Your new password cannot be same as old password.', 'ultimate-member' ) );
					$errors->add( 'block_old_password', __( 'Your new password cannot be same as old password.', 'ultimate-member' ) );
				} else {
					update_user_meta( $user->data->ID, 'um_secure_has_reset_password', true );
					update_user_meta( $user->data->ID, 'um_secure_has_reset_password__timestamp', current_time( 'mysql' ) );
				}
			}
		}

		/**
		 * Secure user capabilities and revoke administrative ones
		 * @since 2.6.8
		 */
		public function secure_user_capabilities( $user_id ) {
			global $wpdb;
			// Fetch the WP_User object of our user.
			um_fetch_user( $user_id );
			$user            = new \WP_User( $user_id );
			$has_admin_cap   = false;
			$arr_banned_caps = array();

			if ( UM()->options()->get( 'banned_capabilities' ) ) {
				$arr_banned_caps = array_keys( UM()->options()->get( 'banned_capabilities' ) );
			} else {
				$arr_banned_caps = $this->banned_admin_capabilities;
			}

			// Add locked administratrive capabilities
			$arr_banned_caps[] = 'manage_options';
			$arr_banned_caps[] = 'promote_users';

			foreach ( $arr_banned_caps as $i => $cap ) {
				/**
				 * When there's at least one administrator cap added to the user,
				 * immediately revoke caps and mark as rejected.
				 */
				if ( $user->has_cap( $cap ) ) {
					$has_admin_cap = true;
					$this->revoke_caps( $user );
					break;
				}
			}

			/**
			 * Double-check if *_user_level has been modified with the highest level
			 * when user has no administrative capabilities.
			 */
			$user_level = um_user( $wpdb->get_blog_prefix() . 'user_level' );
			if ( ! empty( $user_level ) ) {
				if ( 10 === $user_level ) {
					$this->revoke_caps( $user );
					$has_admin_cap = true;
				}
			}

			if ( $has_admin_cap ) {
				/**
				 * Notify Administrators Immediately
				 */
				if ( UM()->options()->get( 'secure_notify_admins_banned_accounts' ) ) {
					$interval = UM()->options()->get( 'secure_notify_admins_banned_accounts__interval' );
					if ( 'instant' === $interval ) {
						$this->send_email( array( $user->get( 'ID' ) ) );
					}
				}

				// Destroy Sessions & Redirect.
				wp_destroy_current_session();
				wp_logout();
				session_unset();
				$redirect = apply_filters( 'um_secure_blocked_user_redirect_immediately', true );
				if ( $redirect ) {
					$login_url = add_query_arg( 'err', 'inactive', um_get_core_page( 'login' ) );
					wp_safe_redirect( $login_url );
					exit;
				}

				return true;

			}

			return false;
		}

		/**
		 * Revoke Caps & Mark rejected as suspicious
		 *
		 * @param string $cap Capability slug
		 * @param object $user \WP_User
		 *
		 * @since 2.6.8
		 */
		public function revoke_caps( $user ) {
			$captured = array(
				'capabilities' => $user->allcaps,
				'submitted'    => UM()->form()->post_form,
				'roles'        => $user->roles,
			);
			update_user_meta( $user->get( 'ID' ), 'um_user_blocked__metadata', $captured );
			$user->remove_all_caps();
			if ( is_user_logged_in() ) {
				UM()->user()->set_status( 'inactive' );
			} else {
				UM()->user()->set_status( 'rejected' );
			}
			update_user_meta( $user->get( 'ID' ), 'um_user_blocked', 'suspicious_activity' );
			update_user_meta( $user->get( 'ID' ), 'um_user_blocked__datetime', current_time( 'mysql' ) );
		}

		/**
		 * Append blocked status to the `account_status` column rows
		 *
		 * @param string $val Default column row value
		 * @param string $column_name Current column name
		 * @param integer $user_id   User ID in loop
		 *
		 * @since 2.6.8
		 *
		 * @return string $val
		 */
		public function manage_users_custom_column( $val, $column_name, $user_id ) {
			if ( 'account_status' === $column_name ) {
				$is_blocked = get_user_meta( $user_id, 'um_user_blocked', true );
				if ( ! empty( $is_blocked ) ) {
					$datetime = get_user_meta( $user_id, 'um_user_blocked__datetime', true );
					$val      = $val . '<div><small>' . __( 'Blocked Due to Suspicious Activity', 'ultimate-member' ) . '</small></div>';
					if ( ! empty( $datetime ) ) {
						$val = $val . '<div><small>' . human_time_diff( strtotime( $datetime ), strtotime( current_time( 'mysql' ) ) ) . ' ' . __( 'ago', 'ultimate-member' ) . '</small></div>';
					}
				}
			}
			return $val;
		}

		/**
		 * Register Events
		 *
		 * @since 2.6.8
		 */
		public function schedule_events() {

			if ( UM()->options()->get( 'secure_notify_admins_banned_accounts' ) ) {
				add_action( 'um_secure_notify_administrator_hourly', array( $this, 'notify_administrators_hourly' ) );
				add_action( 'um_secure_notify_administrator_daily', array( $this, 'notify_administrators_daily' ) );

				if ( ! wp_next_scheduled( 'um_secure_notify_administrator_hourly' ) ) {
					wp_schedule_event( current_time( 'mysql' ), 'hourly', 'um_secure_notify_administrator_hourly' );
				}

				if ( ! wp_next_scheduled( 'um_secure_notify_administrator_daily' ) ) {
					wp_schedule_event( current_time( 'mysql' ), 'daily', 'um_secure_notify_administrator_daily' );
				}
			}
		}

		/**
		 * Notify Administrators hourly - Suspicious activities in an hour
		 *
		 * @since 2.6.8
		 */
		public function notify_administrators_hourly() {

			$interval = UM()->options()->get( 'secure_notify_admins_banned_accounts__interval' );
			if ( 'hourly' === $interval ) {
				$args = array(
					'fields'     => 'ID',
					'meta_query' => array(
						'relation' => 'AND',
						array(
							'key'     => 'um_user_blocked__datetime',
							'value'   => gmdate( 'Y-m-d H:i:s', strtotime( '-1 hour' ) ),
							'compare' => '>=',
							'type'    => 'DATETIME',
						),
					),
				);

				$users = new \WP_User_Query( $args );

				$this->send_email( array_values( $users->get_results() ) );
			}

		}

		/**
		 * Notify Administrators daily - Today's suspicious activity
		 *
		 * @since 2.6.8
		 */
		public function notify_administrators_daily() {

			$interval = UM()->options()->get( 'secure_notify_admins_banned_accounts__interval' );
			if ( 'daily' === $interval ) {
				$args = array(
					'fields'     => 'ID',
					'relation'   => 'AND',
					'meta_query' => array(
						'relation' => 'AND',
						array(
							'key'     => 'um_user_blocked__datetime',
							'value'   => gmdate( 'Y-m-d H:i:s', strtotime( '-1 day' ) ),
							'compare' => '>=',
							'type'    => 'DATE',
						),
						array(
							'key'     => 'um_user_blocked__datetime',
							'value'   => gmdate( 'Y-m-d H:i:s', strtotime( 'now' ) ),
							'compare' => '<=',
							'type'    => 'DATE',
						),
					),
				);

				$users = new \WP_User_Query( $args );

				$this->send_email( array_values( $users->get_results() ) );

			}

		}

		/**
		 * Get Email template
		 *
		 * @param bool $single Whether the template is for single or multiple user activities
		 * @param array $profile_urls Profile URLs to include in the email body
		 *
		 * @since 2.6.8
		 */
		public function get_email_template( $single = true, $profile_urls = array() ) {
			$action = '';
			if ( ! is_user_logged_in() ) {
				$action = 'Rejected';
			} else {
				$action = 'Deactivated';
			}

			$body = '';
			if ( $single ) {
				$body  = 'This is to inform you that there\'s a suspicious activity with the following account: ';
				$body .= '<br/>';
				$body .= '{user_profile_link}';
				$body .= '<br/><br/>';
				$body .= 'Due to that we have set the account status to ' . $action . ', Revoked Roles & Destroyed the Login Session.';
				$body .= '</br>';
			} else {
				$body  = 'This is to inform you that there are suspicious activities with the following accounts: ';
				$body .= '</br>';
				$body .= '{user_profile_link}';
				$body .= '</br></br>';
				$body .= 'Due to that we have set each account\'s status to ' . $action . ', revoked roles & destroyed the login session.';
				$body .= '</br>';
			}

			$urls  = implode( '</br>', $profile_urls );
			$body  = str_replace( '{user_profile_link}', $urls, $body );
			$body .= '<br/><br/>- Sent via Ultimate Member plugin. ';

			return $body;
		}

		/**
		 * Send Email
		 *
		 * @param array $user_ids User IDs.
		 *
		 * @since 2.6.8
		 */
		public function send_email( $user_ids = array() ) {

			if ( empty( $user_ids ) ) {
				return '';
			}
			$multiple_recipients = array();
			$admins              = get_users( 'role=Administrator' );
			foreach ( $admins as $user ) {
				$multiple_recipients[] = $user->user_email;
			}

			$subject = _n( 'Suspicious Account Activity on ', 'Suspicious Accounts & Activities on ', count( $user_ids ), 'ultimate-member' ) . wp_parse_url( get_site_url() )['host'];

			if ( count( $user_ids ) <= 1 ) {
				$url  = UM()->user()->get_profile_link( $user_ids[0] );
				$body = $this->get_email_template( true, array( $url ) );
			} else {
				$arr_urls = array();
				foreach ( $user_ids as $i => $uid ) {
					$arr_urls[] = UM()->user()->get_profile_link( $uid );
				}
				$body = $this->get_email_template( false, $arr_urls );
			}

			wp_mail( $multiple_recipients, $subject, $body );

		}

	}


}