Edit File by line

<?php

[0] Fix | Delete

[1] Fix | Delete

class wfRESTAuthenticationController {

[2] Fix | Delete

[3] Fix | Delete

const NONCE_AGE = 600;

[4] Fix | Delete

[5] Fix | Delete

public static function generateNonce($tickOffset = 0) {

[6] Fix | Delete

add_filter('nonce_life', 'wfRESTAuthenticationController::nonceAge');

[7] Fix | Delete

[8] Fix | Delete

$i = wp_nonce_tick();

[9] Fix | Delete

$salt = wp_salt('nonce');

[10] Fix | Delete

$nonce = hash_hmac('sha256', ($i + $tickOffset) . '|wordfence-rest-api-auth', $salt);

[11] Fix | Delete

[12] Fix | Delete

remove_filter('nonce_life', 'wfRESTAuthenticationController::nonceAge');

[13] Fix | Delete

[14] Fix | Delete

return $nonce;

[15] Fix | Delete

}

[16] Fix | Delete

[17] Fix | Delete

public static function generateToken() {

[18] Fix | Delete

return new wfJWT(wfConfig::get('wordfenceCentralSiteID'));

[19] Fix | Delete

}

[20] Fix | Delete

[21] Fix | Delete

public static function nonceAge() {

[22] Fix | Delete

return self::NONCE_AGE;

[23] Fix | Delete

}

[24] Fix | Delete

[25] Fix | Delete

public function registerRoutes() {

[26] Fix | Delete

register_rest_route('wordfence/v1', '/authenticate', array(

[27] Fix | Delete

'methods' => WP_REST_Server::READABLE,

[28] Fix | Delete

'callback' => array($this, 'nonce'),

[29] Fix | Delete

'permission_callback' => '__return_true',

[30] Fix | Delete

));

[31] Fix | Delete

register_rest_route('wordfence/v1', '/authenticate', array(

[32] Fix | Delete

'methods' => WP_REST_Server::CREATABLE,

[33] Fix | Delete

'callback' => array($this, 'authenticate'),

[34] Fix | Delete

'permission_callback' => '__return_true',

[35] Fix | Delete

));

[36] Fix | Delete

register_rest_route('wordfence/v1', '/authenticate-premium', array(

[37] Fix | Delete

'methods' => WP_REST_Server::CREATABLE,

[38] Fix | Delete

'callback' => array($this, 'authenticatePremium'),

[39] Fix | Delete

'permission_callback' => '__return_true',

[40] Fix | Delete

));

[41] Fix | Delete

}

[42] Fix | Delete

[43] Fix | Delete

/**

[44] Fix | Delete

* @param WP_REST_Request $request

[45] Fix | Delete

* @return mixed|WP_REST_Response

[46] Fix | Delete

[47] Fix | Delete

public function nonce($request) {

[48] Fix | Delete

$response = rest_ensure_response(array(

[49] Fix | Delete

'nonce' => self::generateNonce(),

[50] Fix | Delete

'admin_url' => network_admin_url(),

[51] Fix | Delete

));

[52] Fix | Delete

return $response;

[53] Fix | Delete

}

[54] Fix | Delete

[55] Fix | Delete

/**

[56] Fix | Delete

* @param WP_REST_Request $request

[57] Fix | Delete

* @return mixed|WP_REST_Response

[58] Fix | Delete

[59] Fix | Delete

public function authenticate($request) {

[60] Fix | Delete

require_once(WORDFENCE_PATH . '/lib/sodium_compat_fast.php');

[61] Fix | Delete

[62] Fix | Delete

$siteID = wfConfig::get('wordfenceCentralSiteID');

[63] Fix | Delete

if (!$siteID) {

[64] Fix | Delete

return new WP_Error('rest_forbidden_context',

[65] Fix | Delete

__('Site is not connected to Wordfence Central.', 'wordfence'),

[66] Fix | Delete

array('status' => rest_authorization_required_code()));

[67] Fix | Delete

}

[68] Fix | Delete

[69] Fix | Delete

// verify signature.

[70] Fix | Delete

$data = $request->get_param('data');

[71] Fix | Delete

$dataChunks = explode('|', $data, 2);

[72] Fix | Delete

if (count($dataChunks) !== 2) {

[73] Fix | Delete

return new WP_Error('rest_forbidden_context',

[74] Fix | Delete

__('Data is invalid.', 'wordfence'),

[75] Fix | Delete

array('status' => rest_authorization_required_code()));

[76] Fix | Delete

}

[77] Fix | Delete

if (!preg_match('/[0-9a-f]{64}/i', $dataChunks[0])) {

[78] Fix | Delete

return new WP_Error('rest_forbidden_context',

[79] Fix | Delete

__('Nonce format is invalid.', 'wordfence'),

[80] Fix | Delete

array('status' => rest_authorization_required_code()));

[81] Fix | Delete

}

[82] Fix | Delete

if (!preg_match('/[0-9a-f\-]{36}/i', $dataChunks[1])) {

[83] Fix | Delete

return new WP_Error('rest_forbidden_context',

[84] Fix | Delete

__('Site ID is invalid.', 'wordfence'),

[85] Fix | Delete

array('status' => rest_authorization_required_code()));

[86] Fix | Delete

}

[87] Fix | Delete

if (!hash_equals($siteID, $dataChunks[1])) {

[88] Fix | Delete

return new WP_Error('rest_forbidden_context',

[89] Fix | Delete

__('Site ID is invalid.', 'wordfence'),

[90] Fix | Delete

array('status' => rest_authorization_required_code()));

[91] Fix | Delete

}

[92] Fix | Delete

[93] Fix | Delete

$signature = $request->get_param('signature');

[94] Fix | Delete

$nonce1 = self::generateNonce();

[95] Fix | Delete

$nonce2 = self::generateNonce(-1);

[96] Fix | Delete

$verfiedNonce = hash_equals($nonce1, $dataChunks[0]) || hash_equals($nonce2, $dataChunks[0]);

[97] Fix | Delete

[98] Fix | Delete

if (!$verfiedNonce) {

[99] Fix | Delete

return new WP_Error('rest_forbidden_context',

[100] Fix | Delete

__('Nonce is invalid.', 'wordfence'),

[101] Fix | Delete

array('status' => rest_authorization_required_code()));

[102] Fix | Delete

}

[103] Fix | Delete

$signature = pack('H*', $signature);

[104] Fix | Delete

if (!ParagonIE_Sodium_Compat::crypto_sign_verify_detached($signature, $data, wfConfig::get('wordfenceCentralPK'))) {

[105] Fix | Delete

return new WP_Error('rest_forbidden_context',

[106] Fix | Delete

__('Signature is invalid.', 'wordfence'),

[107] Fix | Delete

array('status' => rest_authorization_required_code()));

[108] Fix | Delete

}

[109] Fix | Delete

[110] Fix | Delete

$response = rest_ensure_response(array(

[111] Fix | Delete

'token' => (string) self::generateToken(),

[112] Fix | Delete

));

[113] Fix | Delete

return $response;

[114] Fix | Delete

}

[115] Fix | Delete

[116] Fix | Delete

/**

[117] Fix | Delete

* @param WP_REST_Request $request

[118] Fix | Delete

* @return mixed|WP_REST_Response

[119] Fix | Delete

[120] Fix | Delete

public function authenticatePremium($request) {

[121] Fix | Delete

require_once(WORDFENCE_PATH . '/lib/sodium_compat_fast.php');

[122] Fix | Delete

[123] Fix | Delete

// verify signature.

[124] Fix | Delete

$data = $request->get_param('data');

[125] Fix | Delete

$dataChunks = explode('|', $data, 2);

[126] Fix | Delete

if (count($dataChunks) !== 2) {

[127] Fix | Delete

return new WP_Error('rest_forbidden_context',

[128] Fix | Delete

__('Data is invalid.', 'wordfence'),

[129] Fix | Delete

array('status' => rest_authorization_required_code()));

[130] Fix | Delete

}

[131] Fix | Delete

if (!preg_match('/[0-9a-f]{64}/i', $dataChunks[0])) {

[132] Fix | Delete

return new WP_Error('rest_forbidden_context',

[133] Fix | Delete

__('Nonce format is invalid.', 'wordfence'),

[134] Fix | Delete

array('status' => rest_authorization_required_code()));

[135] Fix | Delete

}

[136] Fix | Delete

if (!is_email($dataChunks[1])) {

[137] Fix | Delete

return new WP_Error('rest_forbidden_context',

[138] Fix | Delete

__('Email address is invalid.', 'wordfence'),

[139] Fix | Delete

array('status' => rest_authorization_required_code()));

[140] Fix | Delete

}

[141] Fix | Delete

[142] Fix | Delete

$adminEmail = $dataChunks[1];

[143] Fix | Delete

[144] Fix | Delete

$signature = $request->get_param('signature');

[145] Fix | Delete

$nonce1 = self::generateNonce();

[146] Fix | Delete

$nonce2 = self::generateNonce(-1);

[147] Fix | Delete

$verfiedNonce = hash_equals($nonce1, $dataChunks[0]) || hash_equals($nonce2, $dataChunks[0]);

[148] Fix | Delete

[149] Fix | Delete

if (!$verfiedNonce) {

[150] Fix | Delete

return new WP_Error('rest_forbidden_context',

[151] Fix | Delete

__('Nonce is invalid.', 'wordfence'),

[152] Fix | Delete

array('status' => rest_authorization_required_code()));

[153] Fix | Delete

}

[154] Fix | Delete

$signature = pack('H*', $signature);

[155] Fix | Delete

if (!ParagonIE_Sodium_Compat::crypto_sign_verify_detached($signature, $data, WORDFENCE_CENTRAL_PUBLIC_KEY)) {

[156] Fix | Delete

return new WP_Error('rest_forbidden_context',

[157] Fix | Delete

__('Signature is invalid.', 'wordfence'),

[158] Fix | Delete

array('status' => rest_authorization_required_code()));

[159] Fix | Delete

}

[160] Fix | Delete

[161] Fix | Delete

$user_query = new WP_User_Query(array(

[162] Fix | Delete

'role' => 'administrator',

[163] Fix | Delete

'search' => $adminEmail,

[164] Fix | Delete

'search_columns' => array('user_email')

[165] Fix | Delete

));

[166] Fix | Delete

$users = $user_query->get_results();

[167] Fix | Delete

if (is_array($users) && count($users) === 1) {

[168] Fix | Delete

$jwt = new wfJWT('wordfence-central-premium');

[169] Fix | Delete

$jwt->addClaims(array('email' => $adminEmail));

[170] Fix | Delete

$response = rest_ensure_response(array(

[171] Fix | Delete

'token' => (string) $jwt,

[172] Fix | Delete

));

[173] Fix | Delete

return $response;

[174] Fix | Delete

}

[175] Fix | Delete

[176] Fix | Delete

return new WP_Error('rest_forbidden_context',

[177] Fix | Delete

__('Admin user with this email address not found.', 'wordfence'),

[178] Fix | Delete

array('status' => rest_authorization_required_code()));

[179] Fix | Delete

}

[180] Fix | Delete

[181] Fix | Delete

}

[182] Fix | Delete