Changeset 13189

Timestamp:

12/16/2021 06:16:38 PM (3 years ago)

Author:

imath

Message:

Introduce a new constant/filter to enforce strong password in BP areas

You can now use the BP_MEMBERS_REQUIRED_PASSWORD_STRENGTH constant or alternatively the 'bp_members_user_pass_required_strength' filter to force members to use password satisfying a strength score from 4 (strong) to 1 (weak). For instance use define ( 'BP_MEMBERS_REQUIRED_PASSWORD_STRENGTH', 4 ); to enforce strong passwords.

This setting will only be applied to these 2 BuddyPress specific areas:

• the registration form,
• the General User's front-end profile settings tab.

PS: this commit also removes completely the password-verify script from the BP Nouveau Template Pack which was deprecated since BuddyPress 5.0.

Props niftythree, dcavins

Fixes #8589

Location:

trunk/src

Files:

• bp-members/bp-members-functions.php (modified) (1 diff)
• bp-members/screens/register.php (modified) (2 diffs)
• bp-settings/actions/general.php (modified) (2 diffs)
• bp-templates/bp-legacy/buddypress-functions.php (modified) (2 diffs)
• bp-templates/bp-legacy/js/password-verify.js (modified) (2 diffs)
• bp-templates/bp-nouveau/buddypress-functions.php (modified) (2 diffs)
• bp-templates/bp-nouveau/includes/template-tags.php (modified) (1 diff)
• bp-templates/bp-nouveau/js/buddypress-nouveau.js (modified) (3 diffs)
• bp-templates/bp-nouveau/js/password-verify.js (deleted)

trunk/src/bp-members/bp-members-functions.php

@@ -3764 +3764 @@
     return is_multisite() && in_array( bp_core_get_root_option( 'registration' ), $matches, true );
 }
+
+/**
+ * Returns the strength score a password needs to have to be used by a member.
+ *
+ * Score => Allowed Strength.
+ * 0     => any passwords.
+ * 1     => at least short passwords.
+ * 2     => at least weak passwords.
+ * 3     => at least good passwords.
+ * 4     => at least strong passwords.
+ *
+ * @since 10.0.0
+ *
+ * @return int the strength score a password needs to have to be used by a member.
+ */
+function bp_members_user_pass_required_strength() {
+    $default_strength = 0;
+    if ( defined( 'BP_MEMBERS_REQUIRED_PASSWORD_STRENGTH' ) && BP_MEMBERS_REQUIRED_PASSWORD_STRENGTH ) {
+        $default_strength = (int) BP_MEMBERS_REQUIRED_PASSWORD_STRENGTH;
+    }
+
+    /**
+     * Filter here to raise the strength score user passwords need to reach to be allowed.
+     *
+     * @since 10.0.0
+     *
+     * @param int $default_strength The strength score user passwords need to reach to be allowed.
+     */
+    return (int) apply_filters( 'bp_members_user_pass_required_strength', $default_strength );
+}

trunk/src/bp-members/screens/register.php

@@ -16 +16 @@
     $bp = buddypress();
 
-    if ( ! bp_is_current_component( 'register' ) || bp_current_action() )
+    if ( ! bp_is_current_component( 'register' ) || bp_current_action() ) {
         return;
+    }
 
     // Not a directory.
@@ -88 +89 @@
         }
 
-        $signup_pass = '';
-        if ( isset( $_POST['signup_password'] ) ) {
-            $signup_pass = wp_unslash( $_POST['signup_password'] );
-        }
-
-        $signup_pass_confirm = '';
-        if ( isset( $_POST['signup_password_confirm'] ) ) {
-            $signup_pass_confirm = wp_unslash( $_POST['signup_password_confirm'] );
-        }
-
-        // Check the account password for problems.
-        $account_password = bp_members_validate_user_password( $signup_pass, $signup_pass_confirm );
-        $password_error   = $account_password->get_error_message();
+        // Password strength check.
+        $required_password_strength = bp_members_user_pass_required_strength();
+        $current_password_strength  = null;
+        if ( isset( $_POST['_password_strength_score'] ) ) {
+            $current_password_strength = (int) $_POST['_password_strength_score'];
+        }
+
+        if ( $required_password_strength && ! is_null( $current_password_strength ) && $required_password_strength > $current_password_strength ) {
+            $account_password = new WP_Error(
+                'not_strong_enough_password',
+                __( 'Your password is not strong enougth to be allowed on this site. Please use a stronger password.', 'buddypress' )
+            );
+        } else {
+            $signup_pass = '';
+            if ( isset( $_POST['signup_password'] ) ) {
+                $signup_pass = wp_unslash( $_POST['signup_password'] );
+            }
+
+            $signup_pass_confirm = '';
+            if ( isset( $_POST['signup_password_confirm'] ) ) {
+                $signup_pass_confirm = wp_unslash( $_POST['signup_password_confirm'] );
+            }
+
+            // Check the account password for problems.
+            $account_password = bp_members_validate_user_password( $signup_pass, $signup_pass_confirm );
+        }
+
+        $password_error = $account_password->get_error_message();
 
         if ( $password_error ) {

trunk/src/bp-settings/actions/general.php

@@ -74 +74 @@
             // User is changing email address.
             if ( $old_user_email !== $user_email ) {
-
                 // Run some tests on the email address.
                 $email_checks = bp_core_validate_email_address( $user_email );
@@ -135 +134 @@
             $pass         = wp_unslash( $_POST['pass1'] );
             $pass_confirm = wp_unslash( $_POST['pass2'] );
-            $pass_error   = bp_members_validate_user_password( $pass, $pass_confirm, $update_user );
-
-            if ( ! $pass_error->get_error_message() ) {
-                // Password change attempt is successful.
-                if ( ( ! empty( $_POST['pwd'] ) && wp_unslash( $_POST['pwd'] ) !== $pass ) || is_super_admin() )  {
-                    $update_user['user_pass'] = $_POST['pass1'];
-                    $pass_error               = false;
-                    $pass_changed             = true;
-
-                // The new password is the same as the current password.
-                } else {
-                    $pass_error->add( 'same_user_password', __( 'The new password must be different from the current password.', 'buddypress' ) );
+
+            // Password strength check.
+            $required_password_strength = bp_members_user_pass_required_strength();
+            $current_password_strength  = null;
+            if ( isset( $_POST['_password_strength_score'] ) ) {
+                $current_password_strength = (int) $_POST['_password_strength_score'];
+            }
+
+            if ( $required_password_strength && ! is_null( $current_password_strength ) && $required_password_strength > $current_password_strength ) {
+                $pass_error = new WP_Error(
+                    'not_strong_enough_password',
+                    __( 'Your password is not strong enougth to be allowed on this site. Please use a stronger password.', 'buddypress' )
+                );
+            } else {
+                $pass_error = bp_members_validate_user_password( $pass, $pass_confirm, $update_user );
+
+                if ( ! $pass_error->get_error_message() ) {
+                    // Password change attempt is successful.
+                    if ( ( ! empty( $_POST['pwd'] ) && wp_unslash( $_POST['pwd'] ) !== $pass ) || is_super_admin() )  {
+                        $update_user['user_pass'] = $_POST['pass1'];
+                        $pass_error               = false;
+                        $pass_changed             = true;
+
+                    // The new password is the same as the current password.
+                    } else {
+                        $pass_error->add( 'same_user_password', __( 'The new password must be different from the current password.', 'buddypress' ) );
+                    }
                 }
             }

trunk/src/bp-templates/bp-legacy/buddypress-functions.php

@@ -7 +7 @@
  * @package BuddyPress
  * @subpackage BP_Theme_Compat
- * @version 3.1.0
+ * @version 10.0.0
  */
 
@@ -338 +338 @@
 
             // Enqueue script.
-            wp_enqueue_script( $asset['handle'] . '-password-verify', $asset['location'], $dependencies, $this->version);
+            wp_enqueue_script( $asset['handle'] . '-password-verify', $asset['location'], $dependencies, $this->version );
+            wp_localize_script(
+                $asset['handle'] . '-password-verify',
+                'bpPasswordVerify',
+                array(
+                    'tooWeakPasswordWarning' => __( 'Your password is too weak, please use a stronger password.', 'buddypress' ),
+                    'requiredPassStrength'   => bp_members_user_pass_required_strength(),
+                )
+            );
         }
 

trunk/src/bp-templates/bp-legacy/js/password-verify.js

@@ -1 +1 @@
 /* jshint undef: false */
 /* @since 1.7.0 */
-/* @version 8.0.0 */
+/* @version 10.0.0 */
 /* Password Verify */
 ( function( $ ){
-    function check_pass_strength() {
+    function check_pass_strength( event ) {
         var pass1 = $( '.password-entry' ).val(),
             pass2 = $( '.password-entry-confirm' ).val(),
-            strength;
+            currentForm = $( '.password-entry' ).closest( 'form' ),
+            strength, requiredStrength;
+
+        if ( 'undefined' !== typeof window.bpPasswordVerify && window.bpPasswordVerify.requiredPassStrength ) {
+            requiredStrength = parseInt( window.bpPasswordVerify.requiredPassStrength, 10 );
+        }
 
         // Reset classes and result text
@@ -40 +45 @@
                 break;
         }
+
+        if ( requiredStrength && 4 >= requiredStrength ) {
+            var passwordWarningContainer = $( currentForm ).find( '#password-warning' );
+
+                if ( strength < requiredStrength ) {
+                    if ( ! $( passwordWarningContainer ).length ) {
+                        $( event.currentTarget ).before(
+                            $( '<p></p>' ).prop( 'id', 'password-warning' )
+                                          .addClass( 'description' )
+                        );
+                    }
+
+                    $( passwordWarningContainer ).html( bpPasswordVerify.tooWeakPasswordWarning );
+                } else if ( $( passwordWarningContainer ).length ) {
+                    $( passwordWarningContainer ).remove();
+                }
+
+            if ( ! $( currentForm ).find( '#password-strength-score' ).length ) {
+                $( currentForm ).prepend(
+                    $('<input></input>').prop( {
+                        id: 'password-strength-score',
+                        type: 'hidden',
+                        'name': '_password_strength_score'
+                    } )
+                );
+            }
+
+            $( '#password-strength-score' ).val( strength );
+        }
     }
 

trunk/src/bp-templates/bp-nouveau/buddypress-functions.php

@@ -385 +385 @@
         }
 
-        // Add The password verify if needed.
-        if ( bp_is_active( 'settings' ) || bp_get_signup_allowed() ) {
-            /**
-             * BP Nouveau is now directly using the `wp-admin/js/user-profile.js` script.
-             *
-             * Setting the user password is now more consistent with how WordPress handles it.
-             *
-             * @deprecated 5.0.0
-             */
-            $scripts['bp-nouveau-password-verify'] = array(
-                'file'         => 'js/password-verify%s.js',
-                'dependencies' => array( 'bp-nouveau', 'password-strength-meter' ),
-                'footer'       => true,
-            );
-        }
-
         foreach ( $scripts as $handle => $script ) {
             if ( ! isset( $script['file'] ) ) {
@@ -531 +515 @@
         if ( is_customize_preview() ) {
             $params['customizer_settings'] = bp_nouveau_get_temporary_setting( 'any' );
+        }
+
+        $required_password_strength = bp_members_user_pass_required_strength();
+        if ( $required_password_strength ) {
+            $params['bpPasswordVerify'] = array(
+                'tooWeakPasswordWarning' => __( 'Your password is too weak, please use a stronger password.', 'buddypress' ),
+                'requiredPassStrength'   => bp_members_user_pass_required_strength(),
+            );
         }
 

trunk/src/bp-templates/bp-nouveau/includes/template-tags.php

@@ -2371 +2371 @@
             ?>
             <label for="pass1"><?php esc_html_e( 'Choose a Password (required)', 'buddypress' ); ?></label>
+            <?php if ( isset( buddypress()->signup->errors['signup_password'] ) ) :
+                nouveau_error_template( buddypress()->signup->errors['signup_password'] );
+            endif; ?>
+
             <div class="user-pass1-wrap">
                 <div class="wp-pwd">

trunk/src/bp-templates/bp-nouveau/js/buddypress-nouveau.js

@@ -3 +3 @@
 /* jshint browser: true */
 /* @since 3.0.0 */
-/* @version 8.0.0 */
+/* @version 10.0.0 */
 window.wp = window.wp || {};
 window.bp = window.bp || {};
@@ -469 +469 @@
             // Pagination.
             $( '#buddypress [data-bp-list]' ).on( 'click', '[data-bp-pagination] a', this, this.paginateAction );
+
+            // Password updates.
+            if ( BP_Nouveau.bpPasswordVerify && BP_Nouveau.bpPasswordVerify.requiredPassStrength ) {
+                $( '#pass1' ).on( 'input pwupdate', this.checkPassStrength );
+            }
         },
 
@@ -824 +829 @@
             // Request the page.
             self.objectRequest( queryData );
+        },
+
+        checkPassStrength: function( event ) {
+            var bpPasswordVerify = BP_Nouveau.bpPasswordVerify, strength,
+                requiredStrength = parseInt( bpPasswordVerify.requiredPassStrength, 10 ),
+                pass1 = $( event.currentTarget ).val(), pass2 = $( '#pass2' ).val(),
+                currentForm = $( event.currentTarget ).closest( 'form' );
+
+
+            // wp.passwordStrength.userInputBlacklist() has been deprecated in WP 5.5.0.
+            if ( 'function' === typeof wp.passwordStrength.userInputDisallowedList ) {
+                strength = wp.passwordStrength.meter( pass1, wp.passwordStrength.userInputDisallowedList(), pass2 );
+            } else {
+                strength = wp.passwordStrength.meter( pass1, wp.passwordStrength.userInputBlacklist(), pass2 );
+            }
+
+            if ( requiredStrength && 4 >= requiredStrength ) {
+                var passwordWarningContainer = $( currentForm ).find( '#password-warning' );
+
+                if ( strength < requiredStrength ) {
+                    if ( ! $( passwordWarningContainer ).length ) {
+                        $( event.currentTarget ).before(
+                            $( '<p></p>' ).prop( 'id', 'password-warning' )
+                                          .addClass( 'description' )
+                        );
+                    }
+
+                    $( passwordWarningContainer ).html( bpPasswordVerify.tooWeakPasswordWarning );
+                } else if ( $( passwordWarningContainer ).length ) {
+                    $( passwordWarningContainer ).remove();
+                }
+
+                if ( ! $( currentForm ).find( '#password-strength-score' ).length ) {
+                    $( currentForm ).prepend(
+                        $('<input></input>').prop( {
+                            id: 'password-strength-score',
+                            type: 'hidden',
+                            'name': '_password_strength_score'
+                        } )
+                    );
+                }
+
+                $( '#password-strength-score' ).val( strength );
+
+                if ( requiredStrength > strength ) {
+                    $( '.pw-weak' ).remove();
+                }
+            }
         }
     };