Changeset 12679

Timestamp:

07/04/2020 01:29:50 PM (6 years ago)

Author:

imath

Message:

BP Members: improve our password validation process

We're introducing a new function to validate the member's chosen password: bp_members_validate_user_password().

This function is primarly used to check the password is not empty, and to make sure the password confirmation matches the password. If it's the case, the function will return a WP_Error object with no error message. Otherwise this object will contain an error message.

Plugins can now use the bp_members_validate_user_password filter to add their own error messages according to a custom validation process. See the last unit tests of this commit for an example of use.

Props devnik, tharsheblows

Fixes #8066

Location:

trunk

Files:

• src/bp-members/bp-members-functions.php (modified) (1 diff)
• src/bp-members/screens/register.php (modified) (1 diff)
• src/bp-settings/actions/general.php (modified) (4 diffs)
• tests/phpunit/testcases/members/functions.php (modified) (1 diff)

trunk/src/bp-members/bp-members-functions.php

@@ -1770 +1770 @@
 
 /**
+ * Validate a user password.
+ *
+ * @since 7.0.0
+ *
+ * @param string       $pass         The password.
+ * @param string       $confirm_pass The confirmed password.
+ * @param null|WP_User $userdata     Null or the userdata object when a member updates their password from front-end.
+ * @return WP_Error A WP error object possibly containing error messages.
+ */
+function bp_members_validate_user_password( $pass, $confirm_pass, $userdata = null ) {
+        $errors = new WP_Error();
+
+        if ( ! $pass || ! $confirm_pass ) {
+                $errors->add( 'missing_user_password', __( 'Please make sure you enter your password twice', 'buddypress' ) );
+        }
+
+        if ( $pass && $confirm_pass && $pass !== $confirm_pass ) {
+                $errors->add( 'mismatching_user_password', __( 'The passwords you entered do not match.', 'buddypress' ) );
+        }
+
+        /**
+         * Filter here to add password validation errors.
+         *
+         * @since 7.0.0
+         *
+         * @param WP_Error     $errors       Password validation errors.
+         * @param string       $pass         The password.
+         * @param string       $confirm_pass The confirmed password.
+         * @param null|WP_User $userdata     Null or the userdata object when a member updates their password from front-end.
+         */
+        return apply_filters( 'bp_members_validate_user_password', $errors, $pass, $confirm_pass, $userdata );
+}
+
+/**
  * Validate blog URL and title provided at signup.
  *

trunk/src/bp-members/screens/register.php

@@ -60 +60 @@
 
                 // If there are errors with account details, set them for display.
-                if ( !empty( $account_details['errors']->errors['user_name'] ) )
+                if ( ! empty( $account_details['errors']->errors['user_name'] ) ) {
                         $bp->signup->errors['signup_username'] = $account_details['errors']->errors['user_name'][0];
-
-                if ( !empty( $account_details['errors']->errors['user_email'] ) )
+                }
+
+                if ( ! empty( $account_details['errors']->errors['user_email'] ) ) {
                         $bp->signup->errors['signup_email'] = $account_details['errors']->errors['user_email'][0];
-
-                // Check that both password fields are filled in.
-                if ( empty( $_POST['signup_password'] ) || empty( $_POST['signup_password_confirm'] ) )
-                        $bp->signup->errors['signup_password'] = __( 'Please make sure you enter your password twice', 'buddypress' );
-
-                // Check that the passwords match.
-                if ( ( !empty( $_POST['signup_password'] ) && !empty( $_POST['signup_password_confirm'] ) ) && $_POST['signup_password'] != $_POST['signup_password_confirm'] )
-                        $bp->signup->errors['signup_password'] = __( 'The passwords you entered do not match.', 'buddypress' );
+                }
+
+                $signup_pass = '';
+                if ( isset( $_POST['signup_password'] ) ) {
+                        $signup_pass = wp_unslash( $_POST['signup_password'] );
+                }
+
+                $signup_pass_confirm = '';
+                if ( isset( $_POST['signup_password_confirm'] ) ) {
+                        $signup_pass_confirm = wp_unslash( $_POST['signup_password_confirm'] );
+                }
+
+                // Check the account password for problems.
+                $account_password = bp_members_validate_user_password( $signup_pass, $signup_pass_confirm );
+                $password_error   = $account_password->get_error_message();
+
+                if ( $password_error ) {
+                        $bp->signup->errors['signup_password'] = $password_error;
+                }
 
                 if ( bp_signup_requires_privacy_policy_acceptance() && ! empty( $_POST['signup-privacy-policy-check'] ) && empty( $_POST['signup-privacy-policy-accept'] ) ) {

trunk/src/bp-settings/actions/general.php

@@ -131 +131 @@
                 /* Password Change Attempt ***************************************/
 
-                if ( !empty( $_POST['pass1'] ) && !empty( $_POST['pass2'] ) ) {
-
-                        if ( ( $_POST['pass1'] == $_POST['pass2'] ) && !strpos( " " . wp_unslash( $_POST['pass1'] ), "\\" ) ) {
-
+                if ( ! empty( $_POST['pass1'] ) && ! empty( $_POST['pass2'] ) ) {
+                        $pass         = wp_unslash( $_POST['pass1'] );
+                        $pass_confirm = wp_unslash( $_POST['pass2'] );
+                        $pass_error   = bp_members_validate_user_password( $pass, $pass_confirm, $update_user );
+
+                        if ( ! $pass_error->get_error_message() ) {
                                 // Password change attempt is successful.
-                                if ( ( ! empty( $_POST['pwd'] ) && $_POST['pwd'] != $_POST['pass1'] ) || is_super_admin() )  {
+                                if ( ( ! empty( $_POST['pwd'] ) && wp_unslash( $_POST['pwd'] ) !== $pass ) || is_super_admin() )  {
                                         $update_user->user_pass = $_POST['pass1'];
-                                        $pass_changed = true;
+                                        $pass_error             = false;
+                                        $pass_changed           = true;
 
                                 // The new password is the same as the current password.
                                 } else {
-                                        $pass_error = 'same';
+                                        $pass_error->add( 'same_user_password', __( 'The new password must be different from the current password.', 'buddypress' ) );
                                 }
-
-                        // Password change attempt was unsuccessful.
-                        } else {
-                                $pass_error = 'mismatch';
                         }
 
@@ -155 +154 @@
 
                 // One of the password boxes was left empty.
-                } elseif ( ( empty( $_POST['pass1'] ) && !empty( $_POST['pass2'] ) ) || ( !empty( $_POST['pass1'] ) && empty( $_POST['pass2'] ) ) ) {
-                        $pass_error = 'empty';
+                } elseif ( ( empty( $_POST['pass1'] ) && ! empty( $_POST['pass2'] ) ) || ( ! empty( $_POST['pass1'] ) && empty( $_POST['pass2'] ) ) ) {
+                        $pass_error = new WP_Error( 'empty_user_password', __( 'One of the password fields was empty.', 'buddypress' ) );
                 }
 
@@ -181 +180 @@
         // Password Error.
         } else {
-                $pass_error = 'invalid';
+                $pass_error = new WP_Error( 'invalid_user_password', __( 'Your current password is invalid.', 'buddypress' ) );
         }
 
@@ -203 +202 @@
         }
 
-        // Password feedback.
-        switch ( $pass_error ) {
-                case 'invalid' :
-                        $feedback['pass_error']    = __( 'Your current password is invalid.', 'buddypress' );
-                        break;
-                case 'mismatch' :
-                        $feedback['pass_mismatch'] = __( 'The new password fields did not match.', 'buddypress' );
-                        break;
-                case 'empty' :
-                        $feedback['pass_empty']    = __( 'One of the password fields was empty.', 'buddypress' );
-                        break;
-                case 'same' :
-                        $feedback['pass_same']     = __( 'The new password must be different from the current password.', 'buddypress' );
-                        break;
-                case false :
-                        // No change.
-                        break;
+        if ( is_wp_error( $pass_error ) && $pass_error->get_error_message() ) {
+                $feedback[ $pass_error->get_error_code() ] = $pass_error->get_error_message();
         }
 

trunk/tests/phpunit/testcases/members/functions.php

@@ -579 +579 @@
         public function test_wp_registration_url_should_return_bp_register_page_when_register_page_is_configured_properly() {
                 $this->assertSame( bp_get_signup_page(), wp_registration_url() );
+        }
+
+        /**
+         * @group bp_members_validate_user_password
+         */
+        public function test_bp_members_validate_user_password() {
+                $validate = bp_members_validate_user_password( 'foobar', 'foobar' );
+
+                $this->assertEmpty( $validate->get_error_message() );
+        }
+
+        /**
+         * @group bp_members_validate_user_password
+         */
+        public function test_bp_members_validate_user_password_missing() {
+                $validate = bp_members_validate_user_password( '', '' );
+
+                $this->assertEquals( 'missing_user_password', $validate->get_error_code() );
+
+                $validate = bp_members_validate_user_password( 'foobar', '' );
+
+                $this->assertEquals( 'missing_user_password', $validate->get_error_code() );
+
+                $validate = bp_members_validate_user_password( '', 'foobar' );
+
+                $this->assertEquals( 'missing_user_password', $validate->get_error_code() );
+        }
+
+        /**
+         * @group bp_members_validate_user_password
+         */
+        public function test_bp_members_validate_user_password_mismatching() {
+                $validate = bp_members_validate_user_password( 'foobar', 'barfoo' );
+
+                $this->assertEquals( 'mismatching_user_password', $validate->get_error_code() );
+        }
+
+        /**
+         * @group bp_members_validate_user_password
+         */
+        public function test_bp_members_validate_user_password_too_short() {
+                add_filter( 'bp_members_validate_user_password', array( $this, 'filter_bp_members_validate_user_password' ), 10, 2 );
+
+                $validate = bp_members_validate_user_password( 'one', 'one' );
+
+                remove_filter( 'bp_members_validate_user_password', array( $this, 'filter_bp_members_validate_user_password' ), 10, 2 );
+
+                $this->assertEquals( 'too_short_user_password', $validate->get_error_code() );
+        }
+
+        function filter_bp_members_validate_user_password( $errors, $pass ) {
+                if ( 4 > strlen( $pass ) ) {
+                        $errors->add( 'too_short_user_password', __( 'Your password is too short.', 'buddypress' ) );
+                }
+
+                return $errors;
         }