sirius-press/plugins/sirius-press-auth/includes/class-spa-register.php

<?php
/**
 * Creating an account without an email address.
 *
 * Stock WordPress registration is a two-step dance around a mailbox: you hand
 * over an address, it sends you a link, you click it, and the click is the
 * proof. The proof here is a signature, which arrives in the same request —
 * so registration is one step, and there is no pending state, no confirmation
 * link to expire, and no way for a typo'd address to strand an account.
 *
 * This lives at `wp-login.php?action=sirius_register` rather than replacing
 * core's `action=register`, so the plugins work unmodified on a stock
 * WordPress too. The core patch in `patches/` is then a two-line redirect
 * instead of a rewritten form — which is the whole reason the fork's diff
 * against upstream stays small enough to merge security releases into.
 *
 * @package SiriusPress
 */

defined( 'ABSPATH' ) || exit;

final class SPA_Register {

	const ACTION = 'sirius_register';

	public static function hooks() {
		add_action( 'login_form_' . self::ACTION, array( __CLASS__, 'handle' ) );
		add_filter( 'register_url', array( __CLASS__, 'filter_register_url' ) );
		// Core's own registration form cannot work here — it requires an email
		// address — so send anyone who reaches it to the wallet flow.
		add_action( 'login_form_register', array( __CLASS__, 'redirect_core_register' ) );
	}

	public static function url() {
		return add_query_arg( 'action', self::ACTION, wp_login_url() );
	}

	public static function filter_register_url( $url ) {
		return self::url();
	}

	public static function redirect_core_register() {
		wp_safe_redirect( self::url() );
		exit;
	}

	/** Render and process the registration screen. */
	public static function handle() {
		if ( is_user_logged_in() ) {
			wp_safe_redirect( admin_url() );
			exit;
		}

		$errors = new WP_Error();

		if ( 'POST' === strtoupper( isset( $_SERVER['REQUEST_METHOD'] ) ? sanitize_text_field( wp_unslash( $_SERVER['REQUEST_METHOD'] ) ) : 'GET' ) ) {
			$result = self::process();
			if ( is_wp_error( $result ) ) {
				$errors = $result;
			} else {
				// Straight in. There is nothing left to confirm, so making
				// someone sign a second time to start their session would be
				// ceremony, not security.
				wp_set_current_user( $result );
				wp_set_auth_cookie( $result, false );
				do_action( 'wp_login', get_userdata( $result )->user_login, get_userdata( $result ) );
				wp_safe_redirect( apply_filters( 'sirius_press_after_register_redirect', admin_url(), $result ) );
				exit;
			}
		}

		self::render( $errors );
		exit;
	}

	/**
	 * @return int|WP_Error User ID.
	 */
	private static function process() {
		if ( ! SP_Settings::open_registration() ) {
			return new WP_Error( 'sirius_closed', __( 'This site is not accepting new accounts.', 'sirius-press' ) );
		}

		$limited = SPA_Challenge::check_rate_limit( 'register', 10, 900 );
		if ( is_wp_error( $limited ) ) {
			return $limited;
		}

		// phpcs:disable WordPress.Security.NonceVerification.Missing -- the signed challenge is the anti-forgery proof.
		$nonce     = isset( $_POST['sirius_nonce'] ) ? sanitize_text_field( wp_unslash( $_POST['sirius_nonce'] ) ) : '';
		$signature = isset( $_POST['sirius_signature'] ) ? sanitize_text_field( wp_unslash( $_POST['sirius_signature'] ) ) : '';
		$login     = isset( $_POST['user_login'] ) ? sanitize_user( wp_unslash( $_POST['user_login'] ), true ) : '';
		$claimed   = isset( $_POST['sirius_address'] ) ? sanitize_text_field( wp_unslash( $_POST['sirius_address'] ) ) : '';
		// phpcs:enable WordPress.Security.NonceVerification.Missing

		if ( '' === $signature || '' === $nonce ) {
			return new WP_Error( 'sirius_missing', __( 'Sign the text above before submitting.', 'sirius-press' ) );
		}

		/*
		 * The claimed address is required here, unlike at sign-in. Recovering
		 * a key from a signature always succeeds, so without something to
		 * compare against, a signature over the wrong text would create an
		 * account bound to an address the registrant cannot sign for — and
		 * they would only find out the next time they tried to get in.
		 */
		if ( '' === $claimed ) {
			return new WP_Error(
				'sirius_missing_address',
				__( 'Tell us which address you signed with, so the signature can be checked against it.', 'sirius-press' )
			);
		}

		$address = SPA_Challenge::verify( $nonce, $signature, SPA_Challenge::PURPOSE_REGISTER, $claimed );
		if ( is_wp_error( $address ) ) {
			return $address;
		}

		$existing = SP_Identity::user_by_address( $address );
		if ( $existing ) {
			return new WP_Error(
				'sirius_exists',
				sprintf(
					/* translators: %s: login URL. */
					__( 'That wallet already has an account here. <a href="%s">Sign in</a> instead.', 'sirius-press' ),
					esc_url( wp_login_url() )
				)
			);
		}

		if ( '' !== $login && username_exists( $login ) ) {
			return new WP_Error( 'sirius_username_taken', __( 'That username is taken. Pick another.', 'sirius-press' ) );
		}

		return SP_Identity::create_user( $address, $login );
	}

	private static function render( WP_Error $errors ) {
		$nonce   = SPA_Challenge::issue();
		$message = SPA_Challenge::message( $nonce, SPA_Challenge::PURPOSE_REGISTER );
		$open    = SP_Settings::open_registration();

		login_header(
			__( 'Create an account', 'sirius-press' ),
			'',
			$errors
		);
		SPA_Login::print_config();
		?>
		<form name="siriusregisterform" id="siriusregisterform" action="<?php echo esc_url( self::url() ); ?>" method="post">
			<?php if ( ! $open ) : ?>
				<p><?php esc_html_e( 'This site is not accepting new accounts right now.', 'sirius-press' ); ?></p>
			<?php else : ?>
				<p>
					<label for="user_login"><?php esc_html_e( 'Username (optional)', 'sirius-press' ); ?></label>
					<input type="text" name="user_login" id="user_login" class="input" value="" size="20"
						autocapitalize="off" autocomplete="username" />
				</p>
				<p class="description sirius-hint">
					<?php esc_html_e( 'Leave blank and one is made from your address. There is no email field, and there will not be a confirmation link — the signature below is the confirmation.', 'sirius-press' ); ?>
				</p>

				<?php SPA_Login::render_signing_block( $nonce, $message, SPA_Challenge::PURPOSE_REGISTER, __( 'Create account', 'sirius-press' ) ); ?>

				<p class="submit">
					<input type="submit" name="wp-submit" id="wp-submit" class="button button-primary button-large"
						value="<?php esc_attr_e( 'Create account', 'sirius-press' ); ?>" />
				</p>
			<?php endif; ?>
		</form>

		<p id="nav">
			<a href="<?php echo esc_url( wp_login_url() ); ?>"><?php esc_html_e( '← Sign in', 'sirius-press' ); ?></a>
		</p>
		<?php
		login_footer();
	}
}