Add/protect blocked send email #8117
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
- adds a better UI on the blocked login page - allows folks to temporarily unblock themselves with a magic link
roccotripaldi
force-pushed
the
add/protect-blocked-send-email
branch
from
dbddbd1 to
7f9582c
Compare
jeherve
added
[Feature] Protect
roccotripaldi
requested review from
samhotchkiss,
dereksmart,
kraftbj and
jeherve
gititon
reviewed
Nov 9, 2017
modules/protect.php
Outdated
| @@ -541,7 +541,7 @@ function block_with_math() { | |||
| * Kill a login attempt | |||
| */ | |||
| function kill_login() { | |||
| $ip = jetpack_protect_get_ip(); | |||
| $ip = jetpack_protect_get_ip(); | |||
gititon
reviewed
Nov 9, 2017
modules/protect.php
Outdated
| array ( 'response' => 403 ) | ||
| ); | ||
| require_once dirname( __FILE__ ) . '/protect/blocked-login-page.php'; | ||
| $blocked_login_page = Jetpack_Protect_Blocked_Login_Page::instance( $ip ); |
gititon
suggested changes
Nov 9, 2017
gititon
reviewed
Nov 10, 2017
|
|
||
| public function add_args_to_lostpassword_redirect_url( $url ) { | ||
| if ( $this->valid_blocked_user_id ) { | ||
| $url = ( empty( $url ) ) ? wp_login_url() : $url; |
There was a problem hiding this comment.
paren around empty unnecessary
gititon
reviewed
Nov 10, 2017
| return false; | ||
| } | ||
|
|
||
| if ( $this->valid_blocked_user_id ) { |
There was a problem hiding this comment.
Maybe put this case first?
gititon
reviewed
Nov 10, 2017
| $user = get_user_by( 'email', trim( $email ) ); | ||
|
|
||
| if ( ! $user ) { | ||
| return new WP_Error( 'invalid_user', __( 'Oops, could not find a user with that email address.', 'jetpack' ) ); |
There was a problem hiding this comment.
Could this somehow be used by a hacker who is already ip blocked to test for valid email addresses/accounts on the site/domain?
gititon
reviewed
Nov 10, 2017
| $code = wp_remote_retrieve_response_code( $response ); | ||
| $result = json_decode( wp_remote_retrieve_body( $response ) ); | ||
|
|
||
| if ( 429 === $code ) { |
There was a problem hiding this comment.
Consider a constant like HTTP_STATUS_TOO_MANY_REQUESTS rather than a "magic number"
gititon
reviewed
Nov 10, 2017
|
|
||
|
|
||
| function get_html_blocked_login_message() { | ||
| // |
There was a problem hiding this comment.
Did you mean to remove this comment?
gititon
reviewed
Nov 10, 2017
| <?php printf( | ||
| __( '<p><span style="float:left; display:block; margin-right:10px;">%1$s</span>Your IP (%2$s) has been flagged for potential security violations. <a href="%3$s">Learn More</a></p>', 'jetpack' ), | ||
| $icon, | ||
| str_replace( 'http://', '', esc_url( 'http://' . $this->ip_address ) ), |
There was a problem hiding this comment.
Why not determine this value before ob_start like you do for $icon?
gititon
approved these changes
Nov 10, 2017
matticbot
removed
the
[Status] Needs Review
jeherve
added
[Status] Needs Changelog
[Status] Needs Testing
jeherve
added
[Status] Has Changelog
and removed
[Status] Needs Changelog
[Status] Needs Testing
oskosk
pushed a commit
that referenced
this pull request
Nov 28, 2017
* Changelog 5.6: create base for changelog. * Update changelog with 5.5.1 info. * Changelog: add #7930 and #8238 * Changelog: add #8076 * Changelog: add #8100 * Changelog: add #8117 * Changelog: add #8141 * Changelog: add #8143 * Changelog: add #8147 * Changelog: add #8149 * Changelog: add #8153 * Changelog: add #8173 * Changelog: add #8184 * Changelog: add #8196 * Changelog: add #8199 * Changelog: add #8093 * Changelog: add #8171 * Changelog: add #8182 * Changelog: add #8202, #8222 * Changelog: add #8228 * Changelog: add #8240 * Changelog: add #8251 * remove AL card change
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Todo:
Jetpack side
.COM side
Testing instructions / p2 post on it's way...