Update jetpack 5.6

Signed-off-by: Anthony G. Basile <blueness@gentoo.org>

2 files changed, 337 insertions, 0 deletions

diff --git a/plugins/jetpack/modules/protect/blocked-login-page.php b/plugins/jetpack/modules/protect/blocked-login-page.php
new file mode 100644
index 00000000..ec1e8835
--- /dev/null
+++ b/plugins/jetpack/modules/protect/blocked-login-page.php
@@ -0,0 +1,337 @@
+<?php
+
+
+/**
+ * Class Jetpack_Protect_Blocked_Login_Page
+ *
+ * Instanciated on the wp-login page when Jetpack modules are loaded and $pagenow
+ * is available, or during the login_head hook.
+ *
+ * Class will only be instanciated if Protect has detected a hard blocked IP address.
+ *
+ *
+ */
+class Jetpack_Protect_Blocked_Login_Page {
+
+	private static $__instance = null;
+	public $can_send_recovery_emails;
+	public $ip_address;
+	public $valid_blocked_user_id;
+	public $page_title;
+	public $email_address;
+	const HELP_URL = 'https://jetpack.com/support/security-features/#unblock';
+	const HTTP_STATUS_CODE_TOO_MANY_REQUESTS = 429;
+
+	/**
+	 * Singleton implementation
+	 *
+	 * @return object
+	 */
+	public static function instance( $ip_address ) {
+		if ( ! is_a( self::$__instance, 'Jetpack_Protect_Blocked_Login_Page' ) ) {
+			self::$__instance = new Jetpack_Protect_Blocked_Login_Page( $ip_address );
+		}
+
+		return self::$__instance;
+	}
+
+
+	function __construct( $ip_address ) {
+		/**
+		 * Filter controls if an email recovery form is shown to blocked IPs.
+		 *
+		 * A recovery form allows folks to re-gain access to the login form
+		 * via an email link if their IP was mistakenly blocked.
+		 *
+		 * @module protect
+		 *
+		 * @since 5.6
+		 *
+		 * @param bool $can_send_recovery_emails Defaults to true.
+		 */
+		$this->can_send_recovery_emails = apply_filters( 'jetpack_protect_can_send_recovery_emails', true );
+		$this->ip_address               = $ip_address;
+
+		add_filter( 'wp_authenticate_user', array( $this, 'check_valid_blocked_user' ), 10, 1 );
+		add_filter( 'site_url', array( $this, 'add_args_to_login_post_url' ), 10, 3 );
+		add_filter( 'network_site_url', array( $this, 'add_args_to_login_post_url' ), 10, 3 );
+		add_filter( 'lostpassword_url', array( $this, 'add_args_to_lostpassword_url' ), 10, 2 );
+		add_filter( 'login_url', array( $this, 'add_args_to_login_url' ), 10, 3 );
+		add_filter( 'lostpassword_redirect', array( $this, 'add_args_to_lostpassword_redirect_url' ), 10, 1 );
+	}
+
+	public function add_args_to_lostpassword_redirect_url( $url ) {
+		if ( $this->valid_blocked_user_id ) {
+			$url = empty( $url ) ? wp_login_url() : $url;
+			$url = add_query_arg(
+				array(
+					'validate_jetpack_protect_recovery' => $_GET['validate_jetpack_protect_recovery'],
+					'user_id'                           => $_GET['user_id'],
+					'checkemail'                        => 'confirm',
+				),
+				$url
+			);
+		}
+
+		return $url;
+	}
+
+	public function add_args_to_lostpassword_url( $url, $redirect ) {
+		if ( $this->valid_blocked_user_id ) {
+			$args = array(
+				'validate_jetpack_protect_recovery' => $_GET['validate_jetpack_protect_recovery'],
+				'user_id'                           => $_GET['user_id'],
+				'action'                            => 'lostpassword',
+			);
+			if ( ! empty( $redirect ) ) {
+				$args['redirect_to'] = $redirect;
+			}
+			$url = add_query_arg( $args, $url );
+		}
+
+		return $url;
+	}
+
+	public function add_args_to_login_post_url( $url, $path, $scheme ) {
+		if ( $this->valid_blocked_user_id && ( 'login_post' === $scheme || 'login' === $scheme ) ) {
+			$url = add_query_arg(
+				array(
+					'validate_jetpack_protect_recovery' => $_GET['validate_jetpack_protect_recovery'],
+					'user_id'                           => $_GET['user_id'],
+				),
+				$url
+			);
+
+		}
+
+		return $url;
+	}
+
+	public function add_args_to_login_url( $url, $redirect, $force_reauth ) {
+		if ( $this->valid_blocked_user_id ) {
+			$args = array(
+				'validate_jetpack_protect_recovery' => $_GET['validate_jetpack_protect_recovery'],
+				'user_id'                           => $_GET['user_id'],
+			);
+
+			if ( ! empty( $redirect ) ) {
+				$args['redirect_to'] = $redirect;
+			}
+
+			if ( ! empty( $force_reauth ) ) {
+				$args['reauth'] = '1';
+			}
+			$url = add_query_arg( $args, $url );
+		}
+
+		return $url;
+	}
+
+	public function check_valid_blocked_user( $user ) {
+		if ( $this->valid_blocked_user_id && $this->valid_blocked_user_id != $user->ID ) {
+			return new WP_Error( 'invalid_recovery_token', __( 'The recovery token is not valid for this user.', 'jetpack' ) );
+		}
+
+		return $user;
+	}
+
+	public function is_blocked_user_valid() {
+		if ( ! $this->can_send_recovery_emails ) {
+			return false;
+		}
+
+		if ( $this->valid_blocked_user_id ) {
+			return true;
+		}
+
+		if ( ! isset( $_GET['validate_jetpack_protect_recovery'], $_GET['user_id'] ) ) {
+			return false;
+		}
+
+		if ( ! $this->is_valid_protect_recovery_key( $_GET['validate_jetpack_protect_recovery'], $_GET['user_id'] ) ) {
+			return false;
+		}
+
+		$this->valid_blocked_user_id = (int) $_GET['user_id'];
+
+		return true;
+	}
+
+	public function is_valid_protect_recovery_key( $key, $user_id ) {
+
+		$path     = sprintf( '/sites/%d/protect/recovery/confirm', Jetpack::get_option( 'id' ) );
+		$response = Jetpack_Client::wpcom_json_api_request_as_blog(
+			$path,
+			'1.1',
+			array(
+				'method' => 'post'
+			),
+			array(
+				'token'   => $key,
+				'user_id' => $user_id,
+				'ip'      => $this->ip_address,
+			)
+		);
+
+		$result = json_decode( wp_remote_retrieve_body( $response ) );
+
+		if ( is_wp_error( $result ) || empty( $result ) || isset( $result->error ) ) {
+			return false;
+		}
+
+		return true;
+	}
+
+	public function render_and_die() {
+		$this->page_title = __( 'Login Blocked by Jetpack', 'jetpack' );
+
+		if ( ! $this->can_send_recovery_emails ) {
+			$this->render_blocked_login_message();
+
+			return;
+		}
+
+		if ( isset( $_GET['validate_jetpack_protect_recovery'] ) && $_GET['user_id'] ) {
+			$this->protect_die( __( 'Could not validate recovery token.', 'jetpack' ) );
+
+			return;
+		}
+
+		if (
+			isset( $_GET['jetpack-protect-recovery'] ) &&
+			isset( $_POST['_wpnonce'] ) &&
+			wp_verify_nonce( $_POST['_wpnonce'], 'bypass-protect' )
+		) {
+			$this->process_recovery_email();
+
+			return;
+		}
+
+		if ( isset( $_GET['loggedout'] ) && 'true' === $_GET['loggedout'] ) {
+			$this->protect_die( __( 'You successfully logged out.', 'jetpack' ) );
+		}
+
+		$this->render_recovery_form();
+	}
+
+	public function render_blocked_login_message() {
+		$this->protect_die( $this->get_html_blocked_login_message() );
+	}
+
+	function process_recovery_email() {
+		$sent = $this->send_recovery_email();
+
+		if ( is_wp_error( $sent ) ) {
+			$this->protect_die( $sent, true );
+		} else {
+			$this->render_recovery_success();
+		}
+	}
+
+	function send_recovery_email() {
+		$email = isset( $_POST['email'] ) ? $_POST['email'] : '';
+		if ( sanitize_email( $email ) !== $email || ! is_email( $email ) ) {
+			return new WP_Error( 'invalid_email', __( "Oops, looks like that's not the right email address. Please try again!", 'jetpack' ) );
+		}
+		$user = get_user_by( 'email', trim( $email ) );
+
+		if ( ! $user ) {
+			return new WP_Error( 'invalid_user', __( 'Oops, could not find a user with that email address.', 'jetpack' ) );
+		}
+		$this->email_address = $email;
+		$path                = sprintf( '/sites/%d/protect/recovery/request', Jetpack::get_option( 'id' ) );
+
+
+		$response = Jetpack_Client::wpcom_json_api_request_as_blog(
+			$path,
+			'1.1',
+			array(
+				'method' => 'post'
+			),
+			array(
+				'user_id' => $user->ID,
+				'ip'      => $this->ip_address
+			)
+		);
+
+		$code   = wp_remote_retrieve_response_code( $response );
+		$result = json_decode( wp_remote_retrieve_body( $response ) );
+
+		if ( self::HTTP_STATUS_CODE_TOO_MANY_REQUESTS === $code ) {
+			return new WP_Error( 'email_already_sent', __( 'An email was already sent to this address.', 'jetpack' ) );
+		} else if ( is_wp_error( $result ) || empty( $result ) || isset( $result->error ) ) {
+			return new WP_Error( 'email_send_error', __( 'There was an error sending your email.', 'jetpack' ) );
+		}
+
+		return true;
+	}
+
+	function protect_die( $content, $back_link = false ) {
+		$image = sprintf(
+			'<img src="%s" width="180" style="display: block; margin: 0 auto;" />',
+			plugins_url( 'modules/protect/jetpack-security.png', JETPACK__PLUGIN_FILE )
+		);
+
+		if ( is_wp_error( $content ) ) {
+			$content = $content->get_error_message();
+		}
+		// hack to get around default wp_die_handler. https://core.trac.wordpress.org/browser/tags/4.8.1/src/wp-includes/functions.php#L2698
+		$content = $image . '</p> ' . $content . '<p>';
+
+		if ( isset( $_GET['interim-login'] ) ) {
+			$content = "<style>html{ background-color: #fff; } #error-page { margin:0 auto; padding: 1em; box-shadow: none; } </style>" . $content;
+		}
+
+		wp_die( $content, $this->page_title, array( 'back_link' => $back_link, 'response' => 200 ) );
+	}
+
+	function render_recovery_form() {
+		$content = $this->get_html_blocked_login_message() . $this->get_html_recovery_form();
+		$this->protect_die( $content );
+	}
+
+	function render_recovery_success() {
+		$this->protect_die( sprintf( __( 'An email with recovery instructions was sent to %s.', 'jetpack' ), $this->email_address ) );
+	}
+
+
+	function get_html_blocked_login_message() {
+		$icon = '<svg class="gridicon gridicons-spam" style="fill:#d94f4f" height="24" width="24" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><g><path d="M17 2H7L2 7v10l5 5h10l5-5V7l-5-5zm-4 15h-2v-2h2v2zm0-4h-2l-.5-6h3l-.5 6z"/></g></svg>';
+		$ip = str_replace( 'http://', '', esc_url( 'http://' . $this->ip_address ) );
+		ob_start(); ?>
+        <h3><?php printf( __( 'Jetpack Protect has locked your site\'s login page.', 'jetpack' ) ); ?></h3>
+		<?php printf(
+			__( '<p><span style="float:left; display:block; margin-right:10px;">%1$s</span>Your IP (%2$s) has been flagged for potential security violations. <a href="%3$s">Learn More</a></p>', 'jetpack' ),
+			$icon,
+			$ip,
+			esc_url( self::HELP_URL )
+		);
+
+		$contents = ob_get_contents();
+		ob_end_clean();
+
+		return $contents;
+	}
+
+	function get_html_recovery_form() {
+		ob_start(); ?>
+        <div style="margin-top:100px;">
+            <p><?php _e( 'Email yourself a special link to regain access the login form.', 'jetpack' ); ?></p>
+            <form method="post" action="?jetpack-protect-recovery=true">
+				<?php echo wp_nonce_field( 'bypass-protect' ); ?>
+                <p><label for="email" style="font-size:12px;">Email Address<br/></label>
+                    <input type="email" name="email" style="font-size:24px; padding:3px; margin: 2px 6px 16px 0; width:100%; border: 1px solid #ddd;
+    box-shadow: inset 0 1px 2px rgba(0,0,0,.07);"/>
+                    <input type="submit" class="button button-primary button-large"
+                           value="<?php echo esc_attr( __( 'Send', 'jetpack' ) ); ?>"/>
+                </p>
+            </form>
+        </div>
+
+		<?php
+		$contents = ob_get_contents();
+		ob_end_clean();
+
+		return $contents;
+	}
+}
diff --git a/plugins/jetpack/modules/protect/jetpack-security.png b/plugins/jetpack/modules/protect/jetpack-security.png
new file mode 100644
index 00000000..189ae6b3
--- /dev/null
+++ b/plugins/jetpack/modules/protect/jetpack-security.png