Fix #300: support for application passwords #697
Conversation
Suggested fix for issue WordPress#300
|
My PR may be too crude. An alternative way is to add a new filter for the |
|
Thanks for the pull request! The goal of #300 is to make the two-factor plugin more vocal about Application Password and XML-RPC logins being blocked by default. I believe we don't want to enable API logins by default. Primarily because XML-RPC logins allow standard user passwords for auth. So the solution could be adding a notice to the user profiles near the Application Passwords section. Something like:
In addition, we could also add a checkbox to the two-factor settings that allows enabling application passwords for that particular user. The option would be hidden if the |
There was a problem hiding this comment.
I've been thinking about this some more and I believe this plugin should match the behaviour of most other application (including Gmail and GitHub) where application passwords are allowed to bypass the second factor.
This will also enable XML-RPC logins as long as an application password was used.
| @@ -776,7 +776,7 @@ public static function filter_authenticate_block_cookies( $user ) { | |||
| * @return boolean | |||
| */ | |||
| public static function is_user_api_login_enabled( $user_id ) { | |||
| return (bool) apply_filters( 'two_factor_user_api_login_enable', false, $user_id ); | |||
| return (bool) apply_filters( 'two_factor_user_api_login_enable', (bool) did_action( 'application_password_did_authenticate' ), $user_id ); | |||
There was a problem hiding this comment.
This is a good action to use, I believe. It fires right after a successful application passwords login.
There was a problem hiding this comment.
Yes, as said it does not check the user, but I in the flow of things that should not be an issue.
Suggested fix for issue #300
What?
Proposed fix for #300: when a user is authenticated using an application password no 2factor is needed.
Why?
Re #300
How?
Depending of if the
application_password_did_authenticateaction has run the plugin now passesTRUE(did run) orFALSE(did not run) through thetwo_factor_user_api_login_enablefilter in theis_user_api_login_enabledfunction.Testing Instructions
If you succeed my PR works, if you can't login my PR does not work.
Screenshots or screencast
Changelog Entry
Fixed #300
Added application passwords support.