Merge pull request #382 from WordPress/fix/phpcs-followup

Ensure there are no blank spaces or line breaks around the token
WordPress · Aug 26, 2020 · 736473e · 736473e
2 parents feb4708 + e200e0e
commit 736473e
Show file tree

Hide file tree

Showing 2 changed files with 21 additions and 2 deletions.
diff --git a/providers/class-two-factor-email.php b/providers/class-two-factor-email.php
@@ -269,7 +269,7 @@ public function authentication_page( $user ) {
 		<p><?php esc_html_e( 'A verification code has been sent to the email address associated with your account.', 'two-factor' ); ?></p>
 		<p>
 			<label for="authcode"><?php esc_html_e( 'Verification Code:', 'two-factor' ); ?></label>
-			<input type="tel" name="two-factor-email-code" id="authcode" class="input" value="" size="20" pattern="[0-9]*" />
+			<input type="tel" name="two-factor-email-code" id="authcode" class="input" value="" size="20" />
 			<?php submit_button( __( 'Log In', 'two-factor' ) ); ?>
 		</p>
 		<p class="two-factor-email-resend">
@@ -317,7 +317,10 @@ public function validate_authentication( $user ) {
 			return false;
 		}
 
-		return $this->validate_token( $user->ID, $_REQUEST['two-factor-email-code'] );
+		// Ensure there are no spaces or line breaks around the code.
+		$code = trim( sanitize_text_field( $_REQUEST['two-factor-email-code'] ) ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended, handled by the core method already.
+
+		return $this->validate_token( $user->ID, $code );
 	}
 
 	/**

diff --git a/tests/providers/class-two-factor-email.php b/tests/providers/class-two-factor-email.php
@@ -206,6 +206,22 @@ public function test_validate_authentication() {
 		unset( $_REQUEST['two-factor-email-code'] );
 	}
 
+	/**
+	 * Can strip away blank spaces and new line characters in code input.
+	 *
+	 * @covers Two_Factor_Email::validate_authentication
+	 */
+	public function test_validate_authentication_code_with_spaces() {
+		$user = new WP_User( $this->factory->user->create() );
+
+		$token                             = $this->provider->generate_token( $user->ID );
+		$_REQUEST['two-factor-email-code'] = sprintf( ' %s ', $token );
+
+		$this->assertTrue( $this->provider->validate_authentication( $user ) );
+
+		unset( $_REQUEST['two-factor-email-code'] );
+	}
+
 	/**
 	 * Verify that availability returns true.
 	 *