<?php

[0] Fix | Delete

[1] Fix | Delete

namespace WordfenceLS;

[2] Fix | Delete

[3] Fix | Delete

use WordfenceLS\Crypto\Model_JWT;

[4] Fix | Delete

use WordfenceLS\Crypto\Model_Symmetric;

[5] Fix | Delete

use RuntimeException;

[6] Fix | Delete

[7] Fix | Delete

class Controller_Users {

[8] Fix | Delete

const RECOVERY_CODE_COUNT = 5;

[9] Fix | Delete

const RECOVERY_CODE_SIZE = 8;

[10] Fix | Delete

const SECONDS_PER_DAY = 86400;

[11] Fix | Delete

const META_KEY_GRACE_PERIOD_RESET = 'wfls-grace-period-reset';

[12] Fix | Delete

const META_KEY_GRACE_PERIOD_OVERRIDE = 'wfls-grace-period-override';

[13] Fix | Delete

const META_KEY_ALLOW_GRACE_PERIOD = 'wfls-allow-grace-period';

[14] Fix | Delete

const META_KEY_VERIFICATION_TOKENS = 'wfls-verification-tokens';

[15] Fix | Delete

const META_KEY_CAPTCHA_SCORES = 'wfls-captcha-scores';

[16] Fix | Delete

const VERIFICATION_TOKEN_BYTES = 64;

[17] Fix | Delete

const VERIFICATION_TOKEN_LIMIT = 5; //Max number of concurrent tokens

[18] Fix | Delete

const VERIFICATION_TOKEN_TRANSIENT_PREFIX = 'wfls_verify_';

[19] Fix | Delete

const CAPTCHA_SCORE_LIMIT = 2; //Max number of captcha scores cached

[20] Fix | Delete

const CAPTCHA_SCORE_TRANSIENT_PREFIX = 'wfls_captcha_';

[21] Fix | Delete

const CAPTCHA_SCORE_CACHE_DURATION = 60; //seconds

[22] Fix | Delete

const LARGE_USER_BASE_THRESHOLD = 1000;

[23] Fix | Delete

const TRUNCATED_ROLE_KEY = 1;

[24] Fix | Delete

[25] Fix | Delete

/**

[26] Fix | Delete

* Returns the singleton Controller_Users.

[27] Fix | Delete

*

[28] Fix | Delete

* @return Controller_Users

[29] Fix | Delete

*/

[30] Fix | Delete

public static function shared() {

[31] Fix | Delete

static $_shared = null;

[32] Fix | Delete

if ($_shared === null) {

[33] Fix | Delete

$_shared = new Controller_Users();

[34] Fix | Delete

}

[35] Fix | Delete

return $_shared;

[36] Fix | Delete

}

[37] Fix | Delete

[38] Fix | Delete

public function init() {

[39] Fix | Delete

$this->_init_actions();

[40] Fix | Delete

}

[41] Fix | Delete

[42] Fix | Delete

/**

[43] Fix | Delete

* Imports the array of 2FA secrets. Users that do not currently exist or are disallowed from enabling 2FA are not imported.

[44] Fix | Delete

*

[45] Fix | Delete

* @param array $secrets An array of secrets in the format array(<user id> => array('secret' => <secret in hex>, 'recovery' => <recovery keys in hex>, 'ctime' => <timestamp>, 'vtime' => <timestamp>, 'type' => <type>), ...)

[46] Fix | Delete

* @return int The number imported.

[47] Fix | Delete

*/

[48] Fix | Delete

public function import_2fa($secrets) {

[49] Fix | Delete

global $wpdb;

[50] Fix | Delete

$table = Controller_DB::shared()->secrets;

[51] Fix | Delete

[52] Fix | Delete

$count = 0;

[53] Fix | Delete

foreach ($secrets as $id => $parameters) {

[54] Fix | Delete

$user = new \WP_User($id);

[55] Fix | Delete

if (!$user->exists() || !$this->can_activate_2fa($user) || $parameters['type'] != 'authenticator' || $this->has_2fa_active($user)) { continue; }

[56] Fix | Delete

$secret = Model_Compat::hex2bin($parameters['secret']);

[57] Fix | Delete

$recovery = Model_Compat::hex2bin($parameters['recovery']);

[58] Fix | Delete

$ctime = (int) $parameters['ctime'];

[59] Fix | Delete

$vtime = min((int) $parameters['vtime'], Controller_Time::time());

[60] Fix | Delete

$type = $parameters['type'];

[61] Fix | Delete

$wpdb->query($wpdb->prepare("INSERT INTO `{$table}` (`user_id`, `secret`, `recovery`, `ctime`, `vtime`, `mode`) VALUES (%d, %s, %s, %d, %d, %s)", $user->ID, $secret, $recovery, $ctime, $vtime, $type));

[62] Fix | Delete

$count++;

[63] Fix | Delete

}

[64] Fix | Delete

return $count;

[65] Fix | Delete

}

[66] Fix | Delete

[67] Fix | Delete

public function admin_users() {

[68] Fix | Delete

//We should eventually allow for any user to be granted the manage capability, but we won't account for that now

[69] Fix | Delete

if (is_multisite()) {

[70] Fix | Delete

$logins = get_super_admins();

[71] Fix | Delete

$users = array();

[72] Fix | Delete

foreach ($logins as $l) {

[73] Fix | Delete

$user = new \WP_User(null, $l);

[74] Fix | Delete

if ($user->ID > 0) {

[75] Fix | Delete

$users[] = $user;

[76] Fix | Delete

}

[77] Fix | Delete

}

[78] Fix | Delete

return $users;

[79] Fix | Delete

}

[80] Fix | Delete

[81] Fix | Delete

$query = new \WP_User_Query(http_build_query(array('role' => 'administrator', 'number' => -1)));

[82] Fix | Delete

return $query->get_results();

[83] Fix | Delete

}

[84] Fix | Delete

[85] Fix | Delete

public function get_users_by_role($role, $limit = -1) {

[86] Fix | Delete

if ($role === 'super-admin') {

[87] Fix | Delete

$superAdmins = array();

[88] Fix | Delete

foreach(get_super_admins() as $username) {

[89] Fix | Delete

$superAdmins[] = new \WP_User($username);

[90] Fix | Delete

}

[91] Fix | Delete

return $superAdmins;

[92] Fix | Delete

}

[93] Fix | Delete

else {

[94] Fix | Delete

$query = new \WP_User_Query(http_build_query(array('role' => $role, 'number' => is_int($limit) ? $limit : -1)));

[95] Fix | Delete

return $query->get_results();

[96] Fix | Delete

}

[97] Fix | Delete

}

[98] Fix | Delete

[99] Fix | Delete

/**

[100] Fix | Delete

* Returns whether or not the user has a valid remembered device.

[101] Fix | Delete

*

[102] Fix | Delete

* @param \WP_User $user

[103] Fix | Delete

* @return bool

[104] Fix | Delete

*/

[105] Fix | Delete

public function has_remembered_2fa($user) {

[106] Fix | Delete

static $_cache = array();

[107] Fix | Delete

if (isset($_cache[$user->ID])) {

[108] Fix | Delete

return $_cache[$user->ID];

[109] Fix | Delete

}

[110] Fix | Delete

[111] Fix | Delete

if (!Controller_Settings::shared()->get_bool(Controller_Settings::OPTION_REMEMBER_DEVICE_ENABLED)) {

[112] Fix | Delete

return false;

[113] Fix | Delete

}

[114] Fix | Delete

[115] Fix | Delete

$maxExpiration = \WordfenceLS\Controller_Time::time() + Controller_Settings::shared()->get_int(Controller_Settings::OPTION_REMEMBER_DEVICE_DURATION);

[116] Fix | Delete

[117] Fix | Delete

$encrypted = Model_Symmetric::encrypt((string) $user->ID);

[118] Fix | Delete

if (!$encrypted) { //Can't generate cookie key due to host failure

[119] Fix | Delete

return false;

[120] Fix | Delete

}

[121] Fix | Delete

[122] Fix | Delete

foreach ($_COOKIE as $name => $value) {

[123] Fix | Delete

if (!preg_match('/^wfls\-remembered\-(.+)$/', $name, $matches)) {

[124] Fix | Delete

continue;

[125] Fix | Delete

}

[126] Fix | Delete

[127] Fix | Delete

$jwt = Model_JWT::decode_jwt($value);

[128] Fix | Delete

if (!$jwt || !isset($jwt->payload['iv'])) {

[129] Fix | Delete

continue;

[130] Fix | Delete

}

[131] Fix | Delete

[132] Fix | Delete

if (\WordfenceLS\Controller_Time::time() > min($jwt->expiration, $maxExpiration)) { //Either JWT is expired or the remember period was shortened since generating it

[133] Fix | Delete

continue;

[134] Fix | Delete

}

[135] Fix | Delete

[136] Fix | Delete

$data = Model_JWT::base64url_convert_from($matches[1]);

[137] Fix | Delete

$iv = $jwt->payload['iv'];

[138] Fix | Delete

$encrypted = array('data' => $data, 'iv' => $iv);

[139] Fix | Delete

$userID = (int) Model_Symmetric::decrypt($encrypted);

[140] Fix | Delete

if ($userID != 0 && $userID == $user->ID) {

[141] Fix | Delete

$_cache[$user->ID] = true;

[142] Fix | Delete

return true;

[143] Fix | Delete

}

[144] Fix | Delete

}

[145] Fix | Delete

[146] Fix | Delete

$_cache[$user->ID] = false;

[147] Fix | Delete

return false;

[148] Fix | Delete

}

[149] Fix | Delete

[150] Fix | Delete

/**

[151] Fix | Delete

* Sets the cookie needed to remember the 2FA status.

[152] Fix | Delete

*

[153] Fix | Delete

* @param \WP_User $user

[154] Fix | Delete

*/

[155] Fix | Delete

public function remember_2fa($user) {

[156] Fix | Delete

if (!Controller_Settings::shared()->get_bool(Controller_Settings::OPTION_REMEMBER_DEVICE_ENABLED)) {

[157] Fix | Delete

return;

[158] Fix | Delete

}

[159] Fix | Delete

[160] Fix | Delete

if ($this->has_remembered_2fa($user)) {

[161] Fix | Delete

return;

[162] Fix | Delete

}

[163] Fix | Delete

[164] Fix | Delete

$encrypted = Model_Symmetric::encrypt((string) $user->ID);

[165] Fix | Delete

if (!$encrypted) { //Can't generate cookie key due to host failure

[166] Fix | Delete

return;

[167] Fix | Delete

}

[168] Fix | Delete

[169] Fix | Delete

//Remove old cookies

[170] Fix | Delete

foreach ($_COOKIE as $name => $value) {

[171] Fix | Delete

if (!preg_match('/^wfls\-remembered\-(.+)$/', $name, $matches)) {

[172] Fix | Delete

continue;

[173] Fix | Delete

}

[174] Fix | Delete

setcookie($name, '', \WordfenceLS\Controller_Time::time() - 86400);

[175] Fix | Delete

}

[176] Fix | Delete

[177] Fix | Delete

//Set the new one

[178] Fix | Delete

$expiration = \WordfenceLS\Controller_Time::time() + Controller_Settings::shared()->get_int(Controller_Settings::OPTION_REMEMBER_DEVICE_DURATION);

[179] Fix | Delete

$jwt = new Model_JWT(array('iv' => $encrypted['iv']), $expiration);

[180] Fix | Delete

$cookieName = 'wfls-remembered-' . Model_JWT::base64url_convert_to($encrypted['data']);

[181] Fix | Delete

$cookieValue = (string) $jwt;

[182] Fix | Delete

setcookie($cookieName, $cookieValue, $expiration, COOKIEPATH, COOKIE_DOMAIN, is_ssl(), true);

[183] Fix | Delete

}

[184] Fix | Delete

[185] Fix | Delete

/**

[186] Fix | Delete

* Returns whether or not 2FA can be activated on the given user.

[187] Fix | Delete

*

[188] Fix | Delete

* @param \WP_User $user

[189] Fix | Delete

* @return bool

[190] Fix | Delete

*/

[191] Fix | Delete

public function can_activate_2fa($user) {

[192] Fix | Delete

if (is_multisite() && !is_super_admin($user->ID)) {

[193] Fix | Delete

return Controller_Permissions::shared()->does_user_have_multisite_capability($user, Controller_Permissions::CAP_ACTIVATE_2FA_SELF);

[194] Fix | Delete

}

[195] Fix | Delete

return user_can($user, Controller_Permissions::CAP_ACTIVATE_2FA_SELF);

[196] Fix | Delete

}

[197] Fix | Delete

[198] Fix | Delete

/**

[199] Fix | Delete

* Returns whether or not any user has 2FA activated.

[200] Fix | Delete

*

[201] Fix | Delete

* @return bool

[202] Fix | Delete

*/

[203] Fix | Delete

public function any_2fa_active() {

[204] Fix | Delete

global $wpdb;

[205] Fix | Delete

$table = Controller_DB::shared()->secrets;

[206] Fix | Delete

return !!intval($wpdb->get_var("SELECT COUNT(*) FROM `{$table}`"));

[207] Fix | Delete

}

[208] Fix | Delete

[209] Fix | Delete

/**

[210] Fix | Delete

* Returns whether or not the user has 2FA activated.

[211] Fix | Delete

*

[212] Fix | Delete

* @param \WP_User $user

[213] Fix | Delete

* @return bool

[214] Fix | Delete

*/

[215] Fix | Delete

public function has_2fa_active($user) {

[216] Fix | Delete

global $wpdb;

[217] Fix | Delete

$table = Controller_DB::shared()->secrets;

[218] Fix | Delete

return $this->can_activate_2fa($user) && !!intval($wpdb->get_var($wpdb->prepare("SELECT COUNT(*) FROM `{$table}` WHERE `user_id` = %d", $user->ID)));

[219] Fix | Delete

}

[220] Fix | Delete

[221] Fix | Delete

/**

[222] Fix | Delete

* Deactivates a user.

[223] Fix | Delete

*

[224] Fix | Delete

* @param \WP_User $user

[225] Fix | Delete

*/

[226] Fix | Delete

public function deactivate_2fa($user) {

[227] Fix | Delete

global $wpdb;

[228] Fix | Delete

$table = Controller_DB::shared()->secrets;

[229] Fix | Delete

$wpdb->query($wpdb->prepare("DELETE FROM `{$table}` WHERE `user_id` = %d", $user->ID));

[230] Fix | Delete

}

[231] Fix | Delete

[232] Fix | Delete

private function has_admin_with_2fa_active() {

[233] Fix | Delete

static $cache = null;

[234] Fix | Delete

if ($cache === null) {

[235] Fix | Delete

$activeIDs = $this->_user_ids_with_2fa_active();

[236] Fix | Delete

foreach ($activeIDs as $id) {

[237] Fix | Delete

if (Controller_Permissions::shared()->can_manage_settings(new \WP_User($id))) {

[238] Fix | Delete

$cache = true;

[239] Fix | Delete

return $cache;

[240] Fix | Delete

}

[241] Fix | Delete

}

[242] Fix | Delete

$cache = false;

[243] Fix | Delete

}

[244] Fix | Delete

return $cache;

[245] Fix | Delete

}

[246] Fix | Delete

[247] Fix | Delete

/**

[248] Fix | Delete

* Returns whether or not 2FA is required for the user regardless of activation status. 2FA is considered required

[249] Fix | Delete

* when the option to require it is enabled and there is at least one administrator with it active.

[250] Fix | Delete

*

[251] Fix | Delete

* @param \WP_User $user

[252] Fix | Delete

* @param bool &$gracePeriod

[253] Fix | Delete

* @param int &$requiredAt

[254] Fix | Delete

* @return bool

[255] Fix | Delete

*/

[256] Fix | Delete

public function requires_2fa($user, &$gracePeriod = false, &$requiredAt = null) {

[257] Fix | Delete

static $cache = array();

[258] Fix | Delete

if (array_key_exists($user->ID, $cache)) {

[259] Fix | Delete

list($required, $gracePeriod, $requiredAt) = $cache[$user->ID];

[260] Fix | Delete

return $required;

[261] Fix | Delete

}

[262] Fix | Delete

else {

[263] Fix | Delete

$gracePeriod = false;

[264] Fix | Delete

$requiredAt = null;

[265] Fix | Delete

$required = $this->does_user_role_require_2fa($user, $gracePeriod, $requiredAt);

[266] Fix | Delete

$cache[$user->ID] = array($required, $gracePeriod, $requiredAt);

[267] Fix | Delete

return $required;

[268] Fix | Delete

}

[269] Fix | Delete

}

[270] Fix | Delete

[271] Fix | Delete

/**

[272] Fix | Delete

* Returns the number of recovery codes remaining for the user or null if the user does not have 2FA active.

[273] Fix | Delete

*

[274] Fix | Delete

* @param \WP_User $user

[275] Fix | Delete

* @return float|null

[276] Fix | Delete

*/

[277] Fix | Delete

public function recovery_code_count($user) {

[278] Fix | Delete

global $wpdb;

[279] Fix | Delete

$table = Controller_DB::shared()->secrets;

[280] Fix | Delete

$record = $wpdb->get_var($wpdb->prepare("SELECT `recovery` FROM `{$table}` WHERE `user_id` = %d", $user->ID));

[281] Fix | Delete

if (!$record) {

[282] Fix | Delete

return null;

[283] Fix | Delete

}

[284] Fix | Delete

[285] Fix | Delete

return floor(Model_Crypto::strlen($record) / self::RECOVERY_CODE_SIZE);

[286] Fix | Delete

}

[287] Fix | Delete

[288] Fix | Delete

/**

[289] Fix | Delete

* Generates a new set of recovery codes and saves them to $user if provided.

[290] Fix | Delete

*

[291] Fix | Delete

* @param \WP_User|bool $user The user to save the codes to or false to just return codes.

[292] Fix | Delete

* @param int $count

[293] Fix | Delete

* @return array

[294] Fix | Delete

*/

[295] Fix | Delete

public function regenerate_recovery_codes($user = false, $count = self::RECOVERY_CODE_COUNT) {

[296] Fix | Delete

$codes = array();

[297] Fix | Delete

for ($i = 0; $i < $count; $i++) {

[298] Fix | Delete

$c = \WordfenceLS\Model_Crypto::random_bytes(self::RECOVERY_CODE_SIZE);

[299] Fix | Delete

$codes[] = $c;

[300] Fix | Delete

}

[301] Fix | Delete

[302] Fix | Delete

if ($user && Controller_Users::shared()->has_2fa_active($user)) {

[303] Fix | Delete

global $wpdb;

[304] Fix | Delete

$table = Controller_DB::shared()->secrets;

[305] Fix | Delete

$wpdb->query($wpdb->prepare("UPDATE `{$table}` SET `recovery` = %s WHERE `user_id` = %d", implode('', $codes), $user->ID));

[306] Fix | Delete

}

[307] Fix | Delete

[308] Fix | Delete

return $codes;

[309] Fix | Delete

}

[310] Fix | Delete

[311] Fix | Delete

/**

[312] Fix | Delete

* Records the reCAPTCHA score for later display.

[313] Fix | Delete

*

[314] Fix | Delete

* This is not atomic, which means this can miscount on hits that overlap, but the overhead of being atomic is not

[315] Fix | Delete

* worth it for our use.

[316] Fix | Delete

*

[317] Fix | Delete

* @param \WP_User $user|null

[318] Fix | Delete

* @param float $score

[319] Fix | Delete

*/

[320] Fix | Delete

public function record_captcha_score($user, $score) {

[321] Fix | Delete

if (!Controller_CAPTCHA::shared()->enabled()) { return; }

[322] Fix | Delete

[323] Fix | Delete

if ($user) { update_user_meta($user->ID, 'wfls-last-captcha-score', $score); }

[324] Fix | Delete

$stats = Controller_Settings::shared()->get_array(Controller_Settings::OPTION_CAPTCHA_STATS);

[325] Fix | Delete

$int_score = min(max((int) ($score * 10), 0), 10);

[326] Fix | Delete

$count = array_sum($stats['counts']);

[327] Fix | Delete

$stats['counts'][$int_score]++;

[328] Fix | Delete

$stats['avg'] = ($stats['avg'] * $count + $int_score) / ($count + 1);

[329] Fix | Delete

Controller_Settings::shared()->set_array(Controller_Settings::OPTION_CAPTCHA_STATS, $stats);

[330] Fix | Delete

}

[331] Fix | Delete

[332] Fix | Delete

/**

[333] Fix | Delete

* Returns the active and inactive user counts.

[334] Fix | Delete

*

[335] Fix | Delete

* @return array

[336] Fix | Delete

*/

[337] Fix | Delete

public function user_counts() {

[338] Fix | Delete

if (is_multisite() && function_exists('get_user_count')) {

[339] Fix | Delete

$total_users = get_user_count();

[340] Fix | Delete

}

[341] Fix | Delete

else {

[342] Fix | Delete

global $wpdb;

[343] Fix | Delete

$total_users = (int) $wpdb->get_var("SELECT COUNT(ID) as c FROM {$wpdb->users}");

[344] Fix | Delete

}

[345] Fix | Delete

$active_users = $this->active_count();

[346] Fix | Delete

return array('active_users' => $active_users, 'inactive_users' => max($total_users - $active_users, 0));

[347] Fix | Delete

}

[348] Fix | Delete

[349] Fix | Delete

public function detailed_user_counts($force = false) {

[350] Fix | Delete

global $wpdb;

[351] Fix | Delete

[352] Fix | Delete

$blog_prefix = $wpdb->get_blog_prefix();

[353] Fix | Delete

$wp_roles = new \WP_Roles();

[354] Fix | Delete

$roles = $wp_roles->get_names();

[355] Fix | Delete

[356] Fix | Delete

$counts = array();

[357] Fix | Delete

$groups = array('avail_roles' => 0, 'active_avail_roles' => 0);

[358] Fix | Delete

[359] Fix | Delete

foreach ($groups as $group => $count) {

[360] Fix | Delete

$counts[$group] = array();

[361] Fix | Delete

foreach ($roles as $role_key => $role_name) {

[362] Fix | Delete

$counts[$group][$role_key] = 0;

[363] Fix | Delete

}

[364] Fix | Delete

$counts[$group][self::TRUNCATED_ROLE_KEY] = 0;

[365] Fix | Delete

}

[366] Fix | Delete

[367] Fix | Delete

$dbController = Controller_DB::shared();

[368] Fix | Delete

[369] Fix | Delete

if ($dbController->create_temporary_role_counts_table()) {

[370] Fix | Delete

$lock = new Utility_NullLock();

[371] Fix | Delete

$role_counts_table = $dbController->role_counts_temporary;

[372] Fix | Delete

}

[373] Fix | Delete

else {

[374] Fix | Delete

$lock = new Utility_DatabaseLock($dbController, 'role-count-calculation');

[375] Fix | Delete

$role_counts_table = $dbController->role_counts;

[376] Fix | Delete

}

[377] Fix | Delete

[378] Fix | Delete

try {

[379] Fix | Delete

$lock->acquire();

[380] Fix | Delete

[381] Fix | Delete

if(!$force && Controller_Settings::shared()->get_bool(Controller_Settings::OPTION_USER_COUNT_QUERY_STATE))

[382] Fix | Delete

throw new RuntimeException('Previous user count query failed to completed successfully. User count queries are currently disabled');

[383] Fix | Delete

Controller_Settings::shared()->set(Controller_Settings::OPTION_USER_COUNT_QUERY_STATE, true);

[384] Fix | Delete

[385] Fix | Delete

$dbController->require_schema_version(2);

[386] Fix | Delete

$secrets_table = $dbController->secrets;

[387] Fix | Delete

[388] Fix | Delete

$dbController->query("TRUNCATE {$role_counts_table}");

[389] Fix | Delete

$dbController->query($wpdb->prepare(<<<SQL

[390] Fix | Delete

INSERT INTO {$role_counts_table}

[391] Fix | Delete

SELECT

[392] Fix | Delete

um.meta_value AS serialized_roles,

[393] Fix | Delete

s.user_id IS NULL AS two_factor_inactive,

[394] Fix | Delete

1 AS user_count

[395] Fix | Delete

FROM

[396] Fix | Delete

{$wpdb->usermeta} um

[397] Fix | Delete

INNER JOIN {$wpdb->users} u ON u.ID = um.user_id

[398] Fix | Delete

LEFT JOIN {$secrets_table} s ON s.user_id = u.ID

[399] Fix | Delete

WHERE

[400] Fix | Delete

meta_key = %s

[401] Fix | Delete

ON DUPLICATE KEY

[402] Fix | Delete

UPDATE user_count = user_count + 1;

[403] Fix | Delete

SQL

[404] Fix | Delete

, "{$blog_prefix}capabilities"));

[405] Fix | Delete

[406] Fix | Delete

$results = $wpdb->get_results(<<<SQL

[407] Fix | Delete

SELECT

[408] Fix | Delete

serialized_roles AS serialized_roles,

[409] Fix | Delete

two_factor_inactive,

[410] Fix | Delete

user_count

[411] Fix | Delete

FROM

[412] Fix | Delete

{$role_counts_table};

[413] Fix | Delete

SQL

[414] Fix | Delete

, OBJECT);

[415] Fix | Delete

[416] Fix | Delete

Controller_Settings::shared()->set(Controller_Settings::OPTION_USER_COUNT_QUERY_STATE, false);

[417] Fix | Delete

}

[418] Fix | Delete

catch (RuntimeException $e) {

[419] Fix | Delete

$lock->release(); //Finally is not supported in older PHP versions, so it is necessary to release the lock in two places

[420] Fix | Delete

return false;

[421] Fix | Delete

}

[422] Fix | Delete

$lock->release();

[423] Fix | Delete

[424] Fix | Delete

foreach ($results as $row) {

[425] Fix | Delete

$truncated_role = false;

[426] Fix | Delete

try {

[427] Fix | Delete

$row_roles = Utility_Serialization::unserialize($row->serialized_roles, array('allowed_classes' => false), 'is_array');

[428] Fix | Delete

}

[429] Fix | Delete

catch (RuntimeException $e) {

[430] Fix | Delete

$row_roles = array(self::TRUNCATED_ROLE_KEY => true);

[431] Fix | Delete

$truncated_role = true;

[432] Fix | Delete

}

[433] Fix | Delete

foreach ($row_roles as $row_role => $state) {

[434] Fix | Delete

if ($state !== true || (!$truncated_role && !is_string($row_role)))

[435] Fix | Delete

continue;

[436] Fix | Delete

if (array_key_exists($row_role, $roles) || $row_role === self::TRUNCATED_ROLE_KEY) {

[437] Fix | Delete

foreach ($groups as $group => &$group_count) {

[438] Fix | Delete

if ($group === 'active_avail_roles' && $row->two_factor_inactive)

[439] Fix | Delete

continue;

[440] Fix | Delete

$counts[$group][$row_role] += $row->user_count;

[441] Fix | Delete

$group_count += $row->user_count;

[442] Fix | Delete

}

[443] Fix | Delete

}

[444] Fix | Delete

}

[445] Fix | Delete

}

[446] Fix | Delete

[447] Fix | Delete

foreach ($roles as $role_key => $role_name) {

[448] Fix | Delete

if ($counts['avail_roles'][$role_key] === 0 && $counts['active_avail_roles'][$role_key] === 0) {

[449] Fix | Delete

unset($counts['avail_roles'][$role_key]);

[450] Fix | Delete

unset($counts['active_avail_roles'][$role_key]);

[451] Fix | Delete

}

[452] Fix | Delete

}

[453] Fix | Delete

[454] Fix | Delete

// Separately add super admins for multisite

[455] Fix | Delete

if (is_multisite()) {

[456] Fix | Delete

$superAdmins = 0;

[457] Fix | Delete

$activeSuperAdmins = 0;

[458] Fix | Delete

foreach(get_super_admins() as $username) {

[459] Fix | Delete

$superAdmins++;

[460] Fix | Delete

$user = new \WP_User($username);

[461] Fix | Delete

if ($this->has_2fa_active($user)) {

[462] Fix | Delete

$activeSuperAdmins++;

[463] Fix | Delete

}

[464] Fix | Delete

}

[465] Fix | Delete

$counts['avail_roles']['super-admin'] = $superAdmins;

[466] Fix | Delete

$counts['active_avail_roles']['super-admin'] = $activeSuperAdmins;

[467] Fix | Delete

}

[468] Fix | Delete

[469] Fix | Delete

$counts['total_users'] = $groups['avail_roles'];

[470] Fix | Delete

$counts['active_total_users'] = $groups['active_avail_roles'];

[471] Fix | Delete

[472] Fix | Delete

return $counts;

[473] Fix | Delete

}

[474] Fix | Delete

[475] Fix | Delete

/**

[476] Fix | Delete

* Returns the number of users with 2FA active.

[477] Fix | Delete

*

[478] Fix | Delete

* @return int

[479] Fix | Delete

*/

[480] Fix | Delete

public function active_count() {

[481] Fix | Delete

global $wpdb;

[482] Fix | Delete

$table = Controller_DB::shared()->secrets;

[483] Fix | Delete

return intval($wpdb->get_var("SELECT COUNT(*) FROM `{$table}`"));

[484] Fix | Delete

}

[485] Fix | Delete

[486] Fix | Delete

/**

[487] Fix | Delete

* WP Filters/Actions

[488] Fix | Delete

*/

[489] Fix | Delete

[490] Fix | Delete

protected function _init_actions() {

[491] Fix | Delete

add_action('deleted_user', array($this, '_deleted_user'));

[492] Fix | Delete

add_filter('manage_users_columns', array($this, '_manage_users_columns'));

[493] Fix | Delete

add_filter('manage_users_custom_column', array($this, '_manage_users_custom_column'), 10, 3);

[494] Fix | Delete

add_filter('manage_users_sortable_columns', array($this, '_manage_users_sortable_columns'), 10, 1);

[495] Fix | Delete

add_filter('users_list_table_query_args', array($this, '_users_list_table_query_args'));

[496] Fix | Delete

add_filter('user_row_actions', array($this, '_user_row_actions'), 10, 2);

[497] Fix | Delete

add_filter('views_users', array($this, '_views_users'));

[498] Fix | Delete

[499] Fix | Delete