Changeset 12679

Timestamp:

07/04/2020 01:29:50 PM (4 years ago)

Author:

imath

Message:

BP Members: improve our password validation process

We're introducing a new function to validate the member's chosen password: bp_members_validate_user_password().

This function is primarly used to check the password is not empty, and to make sure the password confirmation matches the password. If it's the case, the function will return a WP_Error object with no error message. Otherwise this object will contain an error message.

Plugins can now use the bp_members_validate_user_password filter to add their own error messages according to a custom validation process. See the last unit tests of this commit for an example of use.

Props devnik, tharsheblows

Fixes #8066

Location:

trunk

Files:

• src/bp-members/bp-members-functions.php (modified) (1 diff)
• src/bp-members/screens/register.php (modified) (1 diff)
• src/bp-settings/actions/general.php (modified) (4 diffs)
• tests/phpunit/testcases/members/functions.php (modified) (1 diff)

trunk/src/bp-members/bp-members-functions.php

@@ -1770 +1770 @@
 
 /**
+ * Validate a user password.
+ *
+ * @since 7.0.0
+ *
+ * @param string       $pass         The password.
+ * @param string       $confirm_pass The confirmed password.
+ * @param null|WP_User $userdata     Null or the userdata object when a member updates their password from front-end.
+ * @return WP_Error A WP error object possibly containing error messages.
+ */
+function bp_members_validate_user_password( $pass, $confirm_pass, $userdata = null ) {
+    $errors = new WP_Error();
+
+    if ( ! $pass || ! $confirm_pass ) {
+        $errors->add( 'missing_user_password', __( 'Please make sure you enter your password twice', 'buddypress' ) );
+    }
+
+    if ( $pass && $confirm_pass && $pass !== $confirm_pass ) {
+        $errors->add( 'mismatching_user_password', __( 'The passwords you entered do not match.', 'buddypress' ) );
+    }
+
+    /**
+     * Filter here to add password validation errors.
+     *
+     * @since 7.0.0
+     *
+     * @param WP_Error     $errors       Password validation errors.
+     * @param string       $pass         The password.
+     * @param string       $confirm_pass The confirmed password.
+     * @param null|WP_User $userdata     Null or the userdata object when a member updates their password from front-end.
+     */
+    return apply_filters( 'bp_members_validate_user_password', $errors, $pass, $confirm_pass, $userdata );
+}
+
+/**
  * Validate blog URL and title provided at signup.
  *

trunk/src/bp-members/screens/register.php

@@ -60 +60 @@
 
         // If there are errors with account details, set them for display.
-        if ( !empty( $account_details['errors']->errors['user_name'] ) )
+        if ( ! empty( $account_details['errors']->errors['user_name'] ) ) {
             $bp->signup->errors['signup_username'] = $account_details['errors']->errors['user_name'][0];
-
-        if ( !empty( $account_details['errors']->errors['user_email'] ) )
+        }
+
+        if ( ! empty( $account_details['errors']->errors['user_email'] ) ) {
             $bp->signup->errors['signup_email'] = $account_details['errors']->errors['user_email'][0];
-
-        // Check that both password fields are filled in.
-        if ( empty( $_POST['signup_password'] ) || empty( $_POST['signup_password_confirm'] ) )
-            $bp->signup->errors['signup_password'] = __( 'Please make sure you enter your password twice', 'buddypress' );
-
-        // Check that the passwords match.
-        if ( ( !empty( $_POST['signup_password'] ) && !empty( $_POST['signup_password_confirm'] ) ) && $_POST['signup_password'] != $_POST['signup_password_confirm'] )
-            $bp->signup->errors['signup_password'] = __( 'The passwords you entered do not match.', 'buddypress' );
+        }
+
+        $signup_pass = '';
+        if ( isset( $_POST['signup_password'] ) ) {
+            $signup_pass = wp_unslash( $_POST['signup_password'] );
+        }
+
+        $signup_pass_confirm = '';
+        if ( isset( $_POST['signup_password_confirm'] ) ) {
+            $signup_pass_confirm = wp_unslash( $_POST['signup_password_confirm'] );
+        }
+
+        // Check the account password for problems.
+        $account_password = bp_members_validate_user_password( $signup_pass, $signup_pass_confirm );
+        $password_error   = $account_password->get_error_message();
+
+        if ( $password_error ) {
+            $bp->signup->errors['signup_password'] = $password_error;
+        }
 
         if ( bp_signup_requires_privacy_policy_acceptance() && ! empty( $_POST['signup-privacy-policy-check'] ) && empty( $_POST['signup-privacy-policy-accept'] ) ) {

trunk/src/bp-settings/actions/general.php

@@ -131 +131 @@
         /* Password Change Attempt ***************************************/
 
-        if ( !empty( $_POST['pass1'] ) && !empty( $_POST['pass2'] ) ) {
-
-            if ( ( $_POST['pass1'] == $_POST['pass2'] ) && !strpos( " " . wp_unslash( $_POST['pass1'] ), "\\" ) ) {
-
+        if ( ! empty( $_POST['pass1'] ) && ! empty( $_POST['pass2'] ) ) {
+            $pass         = wp_unslash( $_POST['pass1'] );
+            $pass_confirm = wp_unslash( $_POST['pass2'] );
+            $pass_error   = bp_members_validate_user_password( $pass, $pass_confirm, $update_user );
+
+            if ( ! $pass_error->get_error_message() ) {
                 // Password change attempt is successful.
-                if ( ( ! empty( $_POST['pwd'] ) && $_POST['pwd'] != $_POST['pass1'] ) || is_super_admin() )  {
+                if ( ( ! empty( $_POST['pwd'] ) && wp_unslash( $_POST['pwd'] ) !== $pass ) || is_super_admin() )  {
                     $update_user->user_pass = $_POST['pass1'];
-                    $pass_changed = true;
+                    $pass_error             = false;
+                    $pass_changed           = true;
 
                 // The new password is the same as the current password.
                 } else {
-                    $pass_error = 'same';
+                    $pass_error->add( 'same_user_password', __( 'The new password must be different from the current password.', 'buddypress' ) );
                 }
-
-            // Password change attempt was unsuccessful.
-            } else {
-                $pass_error = 'mismatch';
             }
 
@@ -155 +154 @@
 
         // One of the password boxes was left empty.
-        } elseif ( ( empty( $_POST['pass1'] ) && !empty( $_POST['pass2'] ) ) || ( !empty( $_POST['pass1'] ) && empty( $_POST['pass2'] ) ) ) {
-            $pass_error = 'empty';
+        } elseif ( ( empty( $_POST['pass1'] ) && ! empty( $_POST['pass2'] ) ) || ( ! empty( $_POST['pass1'] ) && empty( $_POST['pass2'] ) ) ) {
+            $pass_error = new WP_Error( 'empty_user_password', __( 'One of the password fields was empty.', 'buddypress' ) );
         }
 
@@ -181 +180 @@
     // Password Error.
     } else {
-        $pass_error = 'invalid';
+        $pass_error = new WP_Error( 'invalid_user_password', __( 'Your current password is invalid.', 'buddypress' ) );
     }
 
@@ -203 +202 @@
     }
 
-    // Password feedback.
-    switch ( $pass_error ) {
-        case 'invalid' :
-            $feedback['pass_error']    = __( 'Your current password is invalid.', 'buddypress' );
-            break;
-        case 'mismatch' :
-            $feedback['pass_mismatch'] = __( 'The new password fields did not match.', 'buddypress' );
-            break;
-        case 'empty' :
-            $feedback['pass_empty']    = __( 'One of the password fields was empty.', 'buddypress' );
-            break;
-        case 'same' :
-            $feedback['pass_same']     = __( 'The new password must be different from the current password.', 'buddypress' );
-            break;
-        case false :
-            // No change.
-            break;
+    if ( is_wp_error( $pass_error ) && $pass_error->get_error_message() ) {
+        $feedback[ $pass_error->get_error_code() ] = $pass_error->get_error_message();
     }
 

trunk/tests/phpunit/testcases/members/functions.php

@@ -579 +579 @@
     public function test_wp_registration_url_should_return_bp_register_page_when_register_page_is_configured_properly() {
         $this->assertSame( bp_get_signup_page(), wp_registration_url() );
+    }
+
+    /**
+     * @group bp_members_validate_user_password
+     */
+    public function test_bp_members_validate_user_password() {
+        $validate = bp_members_validate_user_password( 'foobar', 'foobar' );
+
+        $this->assertEmpty( $validate->get_error_message() );
+    }
+
+    /**
+     * @group bp_members_validate_user_password
+     */
+    public function test_bp_members_validate_user_password_missing() {
+        $validate = bp_members_validate_user_password( '', '' );
+
+        $this->assertEquals( 'missing_user_password', $validate->get_error_code() );
+
+        $validate = bp_members_validate_user_password( 'foobar', '' );
+
+        $this->assertEquals( 'missing_user_password', $validate->get_error_code() );
+
+        $validate = bp_members_validate_user_password( '', 'foobar' );
+
+        $this->assertEquals( 'missing_user_password', $validate->get_error_code() );
+    }
+
+    /**
+     * @group bp_members_validate_user_password
+     */
+    public function test_bp_members_validate_user_password_mismatching() {
+        $validate = bp_members_validate_user_password( 'foobar', 'barfoo' );
+
+        $this->assertEquals( 'mismatching_user_password', $validate->get_error_code() );
+    }
+
+    /**
+     * @group bp_members_validate_user_password
+     */
+    public function test_bp_members_validate_user_password_too_short() {
+        add_filter( 'bp_members_validate_user_password', array( $this, 'filter_bp_members_validate_user_password' ), 10, 2 );
+
+        $validate = bp_members_validate_user_password( 'one', 'one' );
+
+        remove_filter( 'bp_members_validate_user_password', array( $this, 'filter_bp_members_validate_user_password' ), 10, 2 );
+
+        $this->assertEquals( 'too_short_user_password', $validate->get_error_code() );
+    }
+
+    function filter_bp_members_validate_user_password( $errors, $pass ) {
+        if ( 4 > strlen( $pass ) ) {
+            $errors->add( 'too_short_user_password', __( 'Your password is too short.', 'buddypress' ) );
+        }
+
+        return $errors;
     }