Skip to content

Commit 33b6bae

Browse files
rlankhorstrlankhorst
committed
version bump
1 parent eb1ac89 commit 33b6bae

File tree

5 files changed

+64
-57
lines changed

5 files changed

+64
-57
lines changed

‎readme.txt‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ Requires at least: 5.9
66
License: GPL2
77
Tested up to: 6.7
88
Requires PHP: 7.4
9-
Stable tag: 9.1.1.1
9+
Stable tag: 9.1.2
1010

1111
Easily improve site security with WordPress Hardening, Two-Factor Authentication (2FA), Login Protection, Vulnerability Detection and SSL certificate.
1212

@@ -151,6 +151,9 @@ The plugin checks your certificate before enabling, but if, for example, you mig
151151
If you can't deactivate, do not just remove the plugin folder to uninstall! Follow these [instructions](https://really-simple-ssl.com/knowledge-base/uninstall-websitebackend-not-accessible/) instead.
152152

153153
== Changelog ==
154+
= 9.1.2 =
155+
* security: authentication bypass
156+
154157
= 9.1.1.1 =
155158
* November 5th, 2024
156159
*Improvement: updated black friday dates

‎rlrsssl-really-simple-ssl.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
* Plugin Name: Really Simple Security
44
* Plugin URI: https://really-simple-ssl.com
55
* Description: Easily improve site security with WordPress Hardening, Two-Factor Authentication (2FA), Login Protection, Vulnerability Detection and SSL certificate generation.
6-
* Version: 9.1.1.1
6+
* Version: 9.1.2
77
* Requires at least: 5.9
88
* Requires PHP: 7.4
99
* Author: Really Simple Security
@@ -103,7 +103,7 @@ private function setup_constants()
103103
if ( !defined('rsssl_file') ){
104104
define('rsssl_file', __FILE__);
105105
}
106-
define('rsssl_version', '9.1.1.1');
106+
define('rsssl_version', '9.1.2');
107107
define('rsssl_le_cron_generation_renewal_check', 20);
108108
define('rsssl_le_manual_generation_renewal_check', 15);
109109
}

‎security/wordpress/two-fa/class-rsssl-request-parameters.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -95,7 +95,7 @@ public function __construct( WP_REST_Request $request ) {
9595
$this->nonce = $request->get_header( 'X-WP-Nonce' );
9696
$this->user = get_user_by( 'id', $this->user_id );
9797
$this->provider = $request->get_param( 'provider' );
98-
$this->redirect_to = $request->get_param( 'redirect_to' );
98+
$this->redirect_to = $request->get_param( 'redirect_to' )?? admin_url();
9999
if ( 'totp' === $this->provider ) {
100100
$this->code = wp_unslash( $request->get_param( 'two-factor-totp-authcode' ) );
101101
$this->key = wp_unslash( $request->get_param( 'key' ) );

‎security/wordpress/two-fa/class-rsssl-two-factor-on-board-api.php‎

Lines changed: 56 additions & 53 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@
1010

1111
namespace RSSSL\Security\WordPress\Two_Fa;
1212

13+
use Exception;
1314
use WP_REST_Request;
1415
use WP_REST_Response;
1516
use WP_User;
@@ -64,15 +65,19 @@ private function check_custom_validation( WP_REST_Request $request ): bool {
6465
*/
6566
private function check_login_and_get_user( int $user_id, string $login_nonce ) {
6667
if ( ! Rsssl_Two_Fa_Authentication::verify_login_nonce( $user_id, $login_nonce ) ) {
67-
return new WP_REST_Response( array( 'error' => 'Invalid login nonce' ), 403 );
68+
// We throw an error
69+
wp_die();
6870
}
69-
7071
/**
7172
* Get the user by the user ID.
7273
*
7374
* @var WP_User $user
7475
*/
75-
$user = get_user_by( 'id', $user_id );
76+
$user = get_user_by('id', $user_id);
77+
if (!$user) {
78+
throw new Exception('User not found');
79+
}
80+
7681
return $user;
7782
}
7883

@@ -122,15 +127,17 @@ private function start_email_validation(int $user_id, string $redirect_to = '',
122127
* @return WP_REST_Response The REST response object if user is not logged in or provider is invalid.
123128
*/
124129
public function set_as_email( WP_REST_Request $request ): WP_REST_Response {
125-
$parameters = new Rsssl_Request_Parameters( $request );
126-
$user = $this->check_login_and_get_user( $parameters->user_id, $parameters->login_nonce );
127-
// Check if the provider.
128-
if ( 'email' !== $parameters->provider ) {
129-
return new WP_REST_Response( array( 'error' => 'Invalid provider' ), 401 );
130+
$parameters = new Rsssl_Request_Parameters($request);
131+
try {
132+
$this->check_login_and_get_user($parameters->user_id, $parameters->login_nonce);
133+
} catch (Exception $e) {
134+
return new WP_REST_Response(['error' => $e->getMessage()], 403);
135+
}
136+
if ('email' !== $parameters->provider) {
137+
return new WP_REST_Response(['error' => 'Invalid provider'], 401);
130138
}
131139

132-
// Finally redirect the user to the redirect_to page with a response.
133-
return $this->start_email_validation( $parameters->user_id, $parameters->redirect_to , $parameters->profile );
140+
return $this->start_email_validation($parameters->user_id, $parameters->redirect_to, $parameters->profile);
134141
}
135142

136143
/**
@@ -141,15 +148,17 @@ public function set_as_email( WP_REST_Request $request ): WP_REST_Response {
141148
* @return WP_REST_Response The REST response object.
142149
*/
143150
public function set_profile_email(WP_REST_Request $request ): WP_REST_Response {
144-
$parameters = new Rsssl_Request_Parameters( $request );
145-
$user = $this->check_login_and_get_user( $parameters->user_id, $parameters->login_nonce );
146-
// Check if the provider.
147-
if ( 'email' !== $parameters->provider ) {
148-
return new WP_REST_Response( array( 'error' => 'Invalid provider' ), 401 );
149-
}
150-
151-
// Finally redirect the user to the redirect_to page with a response.
152-
return $this->start_email_validation( $parameters->user_id, $parameters->redirect_to, $parameters->profile );
151+
$parameters = new Rsssl_Request_Parameters($request);
152+
try {
153+
$this->check_login_and_get_user($parameters->user_id, $parameters->login_nonce);
154+
} catch (Exception $e) {
155+
return new WP_REST_Response(['error' => $e->getMessage()], 403);
156+
}
157+
if ('email' !== $parameters->provider) {
158+
return new WP_REST_Response(['error' => 'Invalid provider'], 401);
159+
}
160+
161+
return $this->start_email_validation($parameters->user_id, $parameters->redirect_to, $parameters->profile);
153162
}
154163

155164
/**
@@ -160,29 +169,24 @@ public function set_profile_email(WP_REST_Request $request ): WP_REST_Response {
160169
* @return WP_REST_Response The REST response object.
161170
*/
162171
public function validate_email_setup(WP_REST_Request $request ): WP_REST_Response {
163-
$parameters = new Rsssl_Request_Parameters( $request );
164-
$user = $this->check_login_and_get_user( $parameters->user_id, $parameters->login_nonce );
165-
// Check if the provider.
166-
if ( 'email' !== $parameters->provider ) {
167-
return new WP_REST_Response( array( 'error' => 'Invalid provider' ), 401 );
168-
}
169-
if ( !Rsssl_Two_Factor_Email::get_instance()->validate_token( $parameters->user_id, self::sanitize_token($parameters->token) ) ) {
170-
// we reset all the settings.
171-
Rsssl_Two_Factor_Email::set_user_status( $parameters->user_id, 'open' );
172-
Rsssl_Two_Factor_Totp::set_user_status( $parameters->user_id, 'open' );
172+
$parameters = new Rsssl_Request_Parameters($request);
173173

174-
// we logout the user
175-
wp_logout();
174+
if ('email' !== $parameters->provider) {
175+
return new WP_REST_Response(['error' => 'Invalid provider'], 401);
176+
}
176177

177-
return new WP_REST_Response( array( 'error' => __('Code was was invalid, try "Resend Code"', 'really-simple.ssl-pro') ), 401 );
178-
}
178+
if (!Rsssl_Two_Factor_Email::get_instance()->validate_token($parameters->user_id, self::sanitize_token($parameters->token))) {
179+
Rsssl_Two_Factor_Email::set_user_status($parameters->user_id, 'open');
180+
Rsssl_Two_Factor_Totp::set_user_status($parameters->user_id, 'open');
181+
wp_logout();
182+
return new WP_REST_Response(['error' => __('Code was invalid, try "Resend Code"', 'really-simple.ssl-pro')], 401);
183+
}
179184

180-
Rsssl_Two_Factor_Email::set_user_status( $parameters->user_id, 'active' );
181-
Rsssl_Two_Factor_Totp::set_user_status( $parameters->user_id, 'disabled' );
182-
// Mark all other statuses as inactive.
183-
self::set_other_providers_inactive( $parameters->user_id, 'email' );
185+
Rsssl_Two_Factor_Email::set_user_status($parameters->user_id, 'active');
186+
Rsssl_Two_Factor_Totp::set_user_status($parameters->user_id, 'disabled');
187+
self::set_other_providers_inactive($parameters->user_id, 'email');
184188

185-
return $this->authenticate_and_redirect( $parameters->user_id, $parameters->redirect_to );
189+
return $this->authenticate_and_redirect($parameters->user_id, $parameters->redirect_to);
186190
}
187191

188192
/**
@@ -244,24 +248,19 @@ public function verify_2fa_code_totp( WP_REST_Request $request ): WP_REST_Respon
244248
* @return WP_REST_Response The REST response object.
245249
*/
246250
public function disable_two_fa_for_user( WP_REST_Request $request ): WP_REST_Response {
247-
$parameters = new Rsssl_Request_Parameters( $request );
248-
// As a double we check the user_id with the login nonce.
249-
$user = $this->check_login_and_get_user( $parameters->user_id, $parameters->login_nonce );
251+
$parameters = new Rsssl_Request_Parameters($request);
252+
try {
253+
$user = $this->check_login_and_get_user($parameters->user_id, $parameters->login_nonce);
254+
} catch (Exception $e) {
255+
return new WP_REST_Response(['error' => $e->getMessage()], 403);
256+
}
250257

251-
// We get all the available providers for the user.
252258
$user_available_providers = Rsssl_Provider_Loader::get_providers();
253-
254-
foreach ( $user_available_providers as $provider ) {
255-
/**
256-
* Set the user status to disable.
257-
*
258-
* @var Rsssl_Two_Factor_Provider $provider
259-
*/
260-
$provider::set_user_status( $user->ID, 'disabled' );
259+
foreach ($user_available_providers as $provider) {
260+
$provider::set_user_status($user->ID, 'disabled');
261261
}
262262

263-
// Finally we redirect the user to the redirect_to page.
264-
return $this->authenticate_and_redirect( $parameters->user_id, $parameters->redirect_to );
263+
return $this->authenticate_and_redirect($parameters->user_id, $parameters->redirect_to);
265264
}
266265

267266
/**
@@ -274,7 +273,11 @@ public function disable_two_fa_for_user( WP_REST_Request $request ): WP_REST_Res
274273
public function skip_onboarding( WP_REST_Request $request ): WP_REST_Response {
275274
$parameters = new Rsssl_Request_Parameters( $request );
276275
// As a double we check the user_id with the login nonce.
277-
$user = $this->check_login_and_get_user( (int)$parameters->user_id, $parameters->login_nonce );
276+
try {
277+
$this->check_login_and_get_user($parameters->user_id, $parameters->login_nonce);
278+
} catch (Exception $e) {
279+
return new WP_REST_Response(['error' => $e->getMessage()], 403);
280+
}
278281
return $this->authenticate_and_redirect( $parameters->user_id, $parameters->redirect_to );
279282
}
280283

‎security/wordpress/two-fa/class-rsssl-two-factor.php‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -357,6 +357,7 @@ public static function maybe_skip_auth(): void
357357
update_user_meta($user_id, 'rsssl_two_fa_status', 'active');
358358
update_user_meta($user_id, 'rsssl_two_fa_status_email', 'active');
359359
update_user_meta($user_id, 'rsssl_two_fa_status_totp', 'disabled');
360+
delete_user_meta( $user_id, '_rsssl_factor_email_token' );
360361
}
361362

362363
wp_set_auth_cookie($user_id);

0 commit comments

Comments
 (0)