diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md new file mode 100644 index 0000000..7397668 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/bug_report.md @@ -0,0 +1,29 @@ +--- +name: Bug report +about: Technical issue with the Wagento HIBP module. + +--- + +### Preconditions (*) + +1. +2. + +### Steps to reproduce (*) + +1. +2. + +### Expected result (*) + +1. [Screenshots, logs or description] +2. + +### Actual result (*) + +1. [Screenshots, logs or description] +2. diff --git a/.github/ISSUE_TEMPLATE/feature_request.md b/.github/ISSUE_TEMPLATE/feature_request.md new file mode 100644 index 0000000..ab5ad85 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/feature_request.md @@ -0,0 +1,17 @@ +--- +name: Feature request +about: Any feature or improvements you would like to see in this module. + +--- + +### Description (*) + + +### Expected behavior (*) + + +### Benefits + + +### Additional information + diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md new file mode 100644 index 0000000..06db822 --- /dev/null +++ b/.github/PULL_REQUEST_TEMPLATE.md @@ -0,0 +1,45 @@ + + + + +### Description (*) + + +### Related Pull Requests + + +### Fixed Issues (if relevant) + + +1. Fixes wagento/module-hibp# + +### Manual testing scenarios (*) + +1. ... +2. ... + +### Questions or comments + + +### Contribution checklist (*) + - [ ] Pull request has a meaningful description of its purpose + - [ ] All commits are accompanied by meaningful commit messages diff --git a/Block/Adminhtml/User.php b/Block/Adminhtml/User.php new file mode 100644 index 0000000..839f1aa --- /dev/null +++ b/Block/Adminhtml/User.php @@ -0,0 +1,29 @@ +, Chirag Dodia + * @copyright Copyright (c) Wagento Creative LLC. (https://www.wagento.com/) + * @license https://opensource.org/licenses/OSL-3.0.php Open Software License 3.0 + */ + +namespace Wagento\HIBP\Block\Adminhtml; + +use Magento\Backend\Block\Template; + +class User extends Template +{ + public function getConfig($path) + { + return $this->_scopeConfig->getValue($path, \Magento\Store\Model\ScopeInterface::SCOPE_STORE); + } + + public function getBaseUrl() + { + return parent::getBaseUrl(); + } +} diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md new file mode 100644 index 0000000..b084c71 --- /dev/null +++ b/CONTRIBUTING.md @@ -0,0 +1,47 @@ +# Contributing to Wagento HIBP Module +Thank you for your interest in helping Wagento improve this extension. We +welcome any enhancements or bug fixes that you might wish to contribute. + +**Note**: If you have a security concern or an issue that you cannot resolve +yourself, please send an e-mail to [support@wagento.com] instead of opening a +GitHub ticket. +## Things to Know + +* At Wagento, we follow the [Git Flow] methodology when adding new features. +* We follow the [PSR-1], [PSR-2], and [PSR-12] coding standards. +* Please be civil and do not harass or abuse any members of the Wagento staff +or other contributors. +* Wagento reserves the right to decline any contributions which do not fit +our guidelines or vision for the extension. +* All code submitted becomes the sole property of Wagento and is subject to our +copyright with or without attribution. + +## Important Steps to Follow + +1. [Open a GitHub issue][issue] describing the enhancement or fix that you are +contributing. +2. Create a fork of [our GitHub repository][repository] in your GitHub account. +3. Create a feature branch to contain your contribution. +4. Develop your contribution and test it thoroughly under the Magento versions +supported by the extension (see the [README] for a list). +5. Add unit tests, integration tests, and functional tests to prove that your +contribution functions properly and does not break anything. +6. [Submit a Pull Request][pr] referencing the ticket you created in Step 1. + +## Follow-up + +After you submit your contribution, we will review it when time permits. Once we +do so, we will add a comment to the Pull Request letting you know what needs to +be added, corrected, or otherwise changed. When we are satisfied, we will merge +your changes and add your name to the Credits section of the [README] if +merited. + +[support@wagento.com]: mailto:support@wagento.com?subject=[HIBP%20Module]%20 +[Git Flow]: http://nvie.com/posts/a-successful-git-branching-model/ +[PSR-1]: https://www.php-fig.org/psr/psr-1/ +[PSR-2]: https://www.php-fig.org/psr/psr-2/ +[PSR-12]: https://github.com/php-fig/fig-standards/blob/master/proposed/extended-coding-style-guide.md +[repository]: https://github.com/wagento/module-hibp +[issue]: https://github.com/wagento/module-hibp/issues +[pr]: https://github.com/wagento/module-hibp/compare +[README]: ./README.md diff --git a/Console/Command/HIBP.php b/Console/Command/HIBP.php new file mode 100644 index 0000000..44d763a --- /dev/null +++ b/Console/Command/HIBP.php @@ -0,0 +1,69 @@ +, Chirag Dodia , Thanh Nguyen + * @copyright Copyright (c) Wagento Creative LLC. (https://www.wagento.com/) + * @license https://opensource.org/licenses/OSL-3.0.php Open Software License 3.0 + */ +declare(strict_types=1); + +namespace Wagento\HIBP\Console\Command; + +use Symfony\Component\Console\Command\Command; +use Symfony\Component\Console\Input\InputInterface; +use Symfony\Component\Console\Output\OutputInterface; +use Symfony\Component\Console\Input\InputArgument; +use Wagento\HIBP\Model\Hibp as HibpModel; + +class HIBP extends Command +{ + const PASSWORD = 'password'; + + /** + * Command Line class HIBP constructor. + * @param Hibp $hibp + */ + public function __construct( + HibpModel $hibp + ) { + $this->hibp = $hibp; + parent::__construct(); + } + + protected function configure() + { + $this->setName('hibp:check-password') + ->setDescription('Wagento Have I Been Pwned - Check Password') + ->addArgument( + self::PASSWORD, + InputArgument::REQUIRED, + 'Password To Check' + ); + + parent::configure(); + } + + /** + * check input password from command line + * @param InputInterface + * @param OutputInterface + */ + protected function execute(InputInterface $input, OutputInterface $output) + { + $password = $input->getArgument(self::PASSWORD); + + $isPwnedPassword = $this->hibp->isPwnedPassword($password); + $count = $this->hibp->count(); + if ($isPwnedPassword && $count) { + $output->writeln("Your Password has been Pwned {$count} times !"); + } + else { + $output->writeln("Your Password hasn't been Pwned !"); + } + } +} diff --git a/Controller/Index/AjaxPost.php b/Controller/Index/AjaxPost.php index 8b499b5..6a5532a 100644 --- a/Controller/Index/AjaxPost.php +++ b/Controller/Index/AjaxPost.php @@ -6,7 +6,7 @@ * been used on other sites. * * @package Wagento\HIBP\Controller\Index - * @author Joseph Leedy + * @author Joseph Leedy , Chirag Dodia * @copyright Copyright (c) Wagento Creative LLC. (https://www.wagento.com/) * @license https://opensource.org/licenses/OSL-3.0.php Open Software License 3.0 */ @@ -14,11 +14,11 @@ namespace Wagento\HIBP\Controller\Index; -use Dragonbe\Hibp\HibpFactory; -use Magento\Framework\App\Action\Action; -use Magento\Framework\App\Action\Context; +use Magento\Framework\App\Action\HttpPostActionInterface; +use Magento\Framework\App\RequestInterface; use Magento\Framework\Controller\ResultFactory; use Magento\Framework\Exception\NotFoundException; +use Wagento\HIBP\Model\Hibp; /** * Ajax POST Controller @@ -26,20 +26,35 @@ * @package Wagento\HIBP\Controller\Index * @author Joseph Leedy */ -class AjaxPost extends Action +class AjaxPost implements HttpPostActionInterface { /** - * @var \Dragonbe\Hibp\HibpFactory + * @var RequestInterface + */ + protected $request; + /** + * @var ResultFactory + */ + protected $resultFactory; + /** + * @var Hibp */ - private $hibpFactory; + protected $hibp; + /** + * AjaxPost constructor. + * @param Hibp $hibp + * @param RequestInterface $request + * @param ResultFactory $resultFactory + */ public function __construct( - Context $context, - HibpFactory $hibpFactory + Hibp $hibp, + RequestInterface $request, + ResultFactory $resultFactory ) { - parent::__construct($context); - - $this->hibpFactory = $hibpFactory; + $this->hibp = $hibp; + $this->request = $request; + $this->resultFactory = $resultFactory; } /** @@ -47,17 +62,17 @@ public function __construct( */ public function execute() { - if (!$this->getRequest()->isAjax() || !$this->getRequest()->isPost()) { + if (!$this->request->isAjax() || !$this->request->isPost()) { throw new NotFoundException(__('Action is not available.')); } - $hibp = $this->hibpFactory::create(); - $password = $this->getRequest()->getPost('password'); + $hibp = $this->hibp; + $password = $this->request->getPost('password'); $resultJson = $this->resultFactory->create(ResultFactory::TYPE_JSON); $resultJson->setData([ 'pwned' => $hibp->isPwnedPassword($password), - 'count' => count($hibp) + 'count' => $hibp->count() ]); return $resultJson; diff --git a/LICENSE.txt b/LICENSE.txt new file mode 100644 index 0000000..eb8baf3 --- /dev/null +++ b/LICENSE.txt @@ -0,0 +1,27 @@ +Open Software License ("OSL") v. 3.0 + +This Open Software License (the "License") applies to any original work of authorship (the "Original Work") whose owner (the "Licensor") has placed the following licensing notice adjacent to the copyright notice for the Original Work: + +Licensed under the Open Software License version 3.0 + +1. Grant of Copyright License. Licensor grants You a worldwide, royalty-free, non-exclusive, sublicensable license, for the duration of the copyright, to do the following: + a. to reproduce the Original Work in copies, either alone or as part of a collective work; + b. to translate, adapt, alter, transform, modify, or arrange the Original Work, thereby creating derivative works ("Derivative Works") based upon the Original Work; + c. to distribute or communicate copies of the Original Work and Derivative Works to the public, with the proviso that copies of Original Work or Derivative Works that You distribute or communicate shall be licensed under this Open Software License; + d. to perform the Original Work publicly; and + e. to display the Original Work publicly. +2. Grant of Patent License. Licensor grants You a worldwide, royalty-free, non-exclusive, sublicensable license, under patent claims owned or controlled by the Licensor that are embodied in the Original Work as furnished by the Licensor, for the duration of the patents, to make, use, sell, offer for sale, have made, and import the Original Work and Derivative Works. +3. Grant of Source Code License. The term "Source Code" means the preferred form of the Original Work for making modifications to it and all available documentation describing how to modify the Original Work. Licensor agrees to provide a machine-readable copy of the Source Code of the Original Work along with each copy of the Original Work that Licensor distributes. Licensor reserves the right to satisfy this obligation by placing a machine-readable copy of the Source Code in an information repository reasonably calculated to permit inexpensive and convenient access by You for as long as Licensor continues to distribute the Original Work. +4. Exclusions From License Grant. Neither the names of Licensor, nor the names of any contributors to the Original Work, nor any of their trademarks or service marks, may be used to endorse or promote products derived from this Original Work without express prior permission of the Licensor. Except as expressly stated herein, nothing in this License grants any license to Licensor's trademarks, copyrights, patents, trade secrets or any other intellectual property. No patent license is granted to make, use, sell, offer for sale, have made, or import embodiments of any patent claims other than the licensed claims defined in Section 2. No license is granted to the trademarks of Licensor even if such marks are included in the Original Work. Nothing in this License shall be interpreted to prohibit Licensor from licensing under terms different from this License any Original Work that Licensor otherwise would have a right to license. +5. External Deployment. The term "External Deployment" means the use, distribution, or communication of the Original Work or Derivative Works in any way such that the Original Work or Derivative Works may be used by anyone other than You, whether those works are distributed or communicated to those persons or made available as an application intended for use over a network. As an express condition for the grants of license hereunder, You must treat any External Deployment by You of the Original Work or a Derivative Work as a distribution under section 1(c). +6. Attribution Rights. You must retain, in the Source Code of any Derivative Works that You create, all copyright, patent, or trademark notices from the Source Code of the Original Work, as well as any notices of licensing and any descriptive text identified therein as an "Attribution Notice." You must cause the Source Code for any Derivative Works that You create to carry a prominent Attribution Notice reasonably calculated to inform recipients that You have modified the Original Work. +7. Warranty of Provenance and Disclaimer of Warranty. Licensor warrants that the copyright in and to the Original Work and the patent rights granted herein by Licensor are owned by the Licensor or are sublicensed to You under the terms of this License with the permission of the contributor(s) of those copyrights and patent rights. Except as expressly stated in the immediately preceding sentence, the Original Work is provided under this License on an "AS IS" BASIS and WITHOUT WARRANTY, either express or implied, including, without limitation, the warranties of non-infringement, merchantability or fitness for a particular purpose. THE ENTIRE RISK AS TO THE QUALITY OF THE ORIGINAL WORK IS WITH YOU. This DISCLAIMER OF WARRANTY constitutes an essential part of this License. No license to the Original Work is granted by this License except under this disclaimer. +8. Limitation of Liability. Under no circumstances and under no legal theory, whether in tort (including negligence), contract, or otherwise, shall the Licensor be liable to anyone for any indirect, special, incidental, or consequential damages of any character arising as a result of this License or the use of the Original Work including, without limitation, damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses. This limitation of liability shall not apply to the extent applicable law prohibits such limitation. +9. Acceptance and Termination. If, at any time, You expressly assented to this License, that assent indicates your clear and irrevocable acceptance of this License and all of its terms and conditions. If You distribute or communicate copies of the Original Work or a Derivative Work, You must make a reasonable effort under the circumstances to obtain the express assent of recipients to the terms of this License. This License conditions your rights to undertake the activities listed in Section 1, including your right to create Derivative Works based upon the Original Work, and doing so without honoring these terms and conditions is prohibited by copyright law and international treaty. Nothing in this License is intended to affect copyright exceptions and limitations (including 'fair use' or 'fair dealing'). This License shall terminate immediately and You may no longer exercise any of the rights granted to You by this License upon your failure to honor the conditions in Section 1(c). +10. Termination for Patent Action. This License shall terminate automatically and You may no longer exercise any of the rights granted to You by this License as of the date You commence an action, including a cross-claim or counterclaim, against Licensor or any licensee alleging that the Original Work infringes a patent. This termination provision shall not apply for an action alleging patent infringement by combinations of the Original Work with other software or hardware. +11. Jurisdiction, Venue and Governing Law. Any action or suit relating to this License may be brought only in the courts of a jurisdiction wherein the Licensor resides or in which Licensor conducts its primary business, and under the laws of that jurisdiction excluding its conflict-of-law provisions. The application of the United Nations Convention on Contracts for the International Sale of Goods is expressly excluded. Any use of the Original Work outside the scope of this License or after its termination shall be subject to the requirements and penalties of copyright or patent law in the appropriate jurisdiction. This section shall survive the termination of this License. +12. Attorneys' Fees. In any action to enforce the terms of this License or seeking damages relating thereto, the prevailing party shall be entitled to recover its costs and expenses, including, without limitation, reasonable attorneys' fees and costs incurred in connection with such action, including any appeal of such action. This section shall survive the termination of this License. +13. Miscellaneous. If any provision of this License is held to be unenforceable, such provision shall be reformed only to the extent necessary to make it enforceable. +14. Definition of "You" in This License. "You" throughout this License, whether in upper or lower case, means an individual or a legal entity exercising rights under, and complying with all of the terms of, this License. For legal entities, "You" includes any entity that controls, is controlled by, or is under common control with you. For purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity. +15. Right to Use. You may use the Original Work in all ways not otherwise restricted or conditioned by this License or by law, and Licensor promises not to interfere with or be responsible for such uses by You. +16. Modification of This License. This License is Copyright (C) 2005 Lawrence Rosen. Permission is granted to copy, distribute, or communicate this License without modification. Nothing in this License permits You to modify this License as applied to the Original Work or to Derivative Works. However, You may modify the text of this License and copy, distribute or communicate your modified version (the "Modified License") and apply it to other original works of authorship subject to the following conditions: (i) You may not indicate in any way that your Modified License is the "Open Software License" or "OSL" and you may not use those names in the name of your Modified License; (ii) You must replace the notice specified in the first paragraph above with the notice "Licensed under " or with a notice of your own that is not confusingly similar to the notice in this License; and (iii) You may not claim that your original works are open source software unless your Modified License has been approved by Open Source Initiative (OSI) and You comply with its license review and certification process. diff --git a/Model/Config/Source/Mode.php b/Model/Config/Source/Mode.php new file mode 100644 index 0000000..29d0bfb --- /dev/null +++ b/Model/Config/Source/Mode.php @@ -0,0 +1,35 @@ +, Chirag Dodia + * @copyright Copyright (c) Wagento Creative LLC. (https://www.wagento.com/) + * @license https://opensource.org/licenses/OSL-3.0.php Open Software License 3.0 + */ + +declare(strict_types=1); + +namespace Wagento\HIBP\Model\Config\Source; + +use Magento\Framework\Data\OptionSourceInterface; + +class Mode implements OptionSourceInterface +{ + public function toOptionArray() + { + return [ + [ + 'value' => 'report', + 'label' => __('Report Only') + ], + [ + 'value' => 'restrict', + 'label' => __('Restrict') + ] + ]; + } +} diff --git a/Model/Hibp.php b/Model/Hibp.php new file mode 100644 index 0000000..12cf5b1 --- /dev/null +++ b/Model/Hibp.php @@ -0,0 +1,104 @@ +, Chirag Dodia + * @copyright Copyright (c) Wagento Creative LLC. (https://www.wagento.com/) + * @license https://opensource.org/licenses/OSL-3.0.php Open Software License 3.0 + */ + +namespace Wagento\HIBP\Model; + +use GuzzleHttp\ClientFactory; +use GuzzleHttp\Exception\GuzzleException; +use GuzzleHttp\Psr7\ResponseFactory; +use Magento\Framework\Webapi\Rest\Request; + +class Hibp +{ + /** + * API request URL + */ + const API_REQUEST_URI = 'https://api.pwnedpasswords.com/range/'; + + /** + * @var ClientFactory + */ + protected ClientFactory $clientFactory; + /** + * @var ResponseFactory + */ + protected ResponseFactory $responseFactory; + + /** + * @var int + */ + protected $count = 0; + /** + * Hibp constructor. + * @param ClientFactory $clientFactory + * @param ResponseFactory $responseFactory + */ + public function __construct( + ClientFactory $clientFactory, + ResponseFactory $responseFactory + ) { + $this->clientFactory = $clientFactory; + $this->responseFactory = $responseFactory; + } + + /** + * @param $password + * @param string $requestMethod + * @return bool|\GuzzleHttp\Psr7\Response + */ + public function isPwnedPassword($password, $requestMethod = Request::HTTP_METHOD_GET) + { + $password = sha1($password); + $password = strtoupper($password); + $range = substr($password, 0, 5); + $endpoint = self::API_REQUEST_URI . $range; + + /** @var Client $client */ + $client = $this->clientFactory->create(); + + try { + $totalCount = 0; + $data = []; + $response = $client->request($requestMethod, $endpoint); + if ($response->getStatusCode() == 200) { + $body = (string) $response->getBody(); + $data = explode("\r\n", $body); + foreach ($data as $value) { + list($hash, $count) = explode(':', $value); + if (strcmp($hash, substr($password, 5)) === 0) { + $totalCount = +(int)$count; + } + } + } + if ($data === []) { + return false; + } + $this->count = $totalCount; + return true; + } catch (GuzzleException $exception) { + $response = $this->responseFactory->create([ + 'status' => $exception->getCode(), + 'reason' => $exception->getMessage() + ]); + } + return $response; + } + + /** + * @return int + */ + public function count() + { + return $this->count; + } +} diff --git a/README.md b/README.md new file mode 100644 index 0000000..a8e5f10 --- /dev/null +++ b/README.md @@ -0,0 +1,78 @@ +Wagento HIBP Module +====================== +This Wagento module leverages Have I Been Pwned? to check ensure your password has not been compromised. It will return your email and password and whether it has been used and/or pasted. This is accomplished by utilizing the HIBP database for passwords that exist and are the same. There is no risk since the two are not connected, but it does tell you if your password is out there. + +Requirements +------------------------- +* PHP 7.4 +* Magento Open Source/Commerce 2.4 + +Installation Instructions +------------------------- +Download the file, extract +its contents to the project root directory. The module sources should then be +available in the following sub-directory: + + app + └── code + └── Wagento + └── HIBP +### Enable Module ### +Once the source files are available, make them known to the application: + + ./bin/magento module:enable Wagento_HIBP + ./bin/magento setup:upgrade + +Last but not least, flush cache and compile. + + ./bin/magento cache:flush + ./bin/magento setup:di:compile + +Uninstallation +-------------- +To uninstall the module manually, run the following commands in your project +root directory: + + ./bin/magento module:disable Wagento_HIBP + rm -rf app/code/Wagento/HIBP + +Features +-------------- + Module will check, whether your password is compromise or not by utilizing the HIBP database in following Magento 2 forms + 1. Customer Registration Form + 2. Customer Reset Password Form + 3. Admin User Creation and edit Form + + Module is also providing system configuration under Wagento Modules > HIBP Checker > Mode: Report Only/Restrict + + In the Report Only mode, module will only indicate the notice but allow customer to use the compromise password. While in Restrict mode, module will restrict customer to use compromise password. + + Support + --------- + If you experience any issues or errors while using the extension, please open a + ticket by sending an e-mail to [support@wagento.com][Support]. Be sure to + include your domain, PHP version, Magento version, a detailed description of the + problem including steps to reproduce it and any other relevant information. We + do our best to respond to all legitimate inquires within 48 business hours. + + License + -------- + The source code contained in this extension is licensed under [version 3.0 of + the Open Software License (OSL-3.0)][OSL]. A full copy of the license can be + found in the [LICENSE.txt] file. + + + How to Contribute? + -------------- +We welcome any and all feedback, suggestions and improvements submitted via +issues and pull requests on [GitHub]. For guidelines, please see the +[CONTRIBUTING.md] document. + + [Support]: mailto:support@wagento.com?subject=[HIBP%20Module]%20 + [GitHub]: https://github.com/wagento/module-hibp + [README]: ./README.md + [LICENSE.txt]: ./LICENSE.txt + [CONTRIBUTING.md]: ./CONTRIBUTING.md + [CHANGELOG.md]: ./CHANGELOG.md + [OSL]: https://opensource.org/licenses/OSL-3.0.php + diff --git a/Rewrite/Magento/Customer/Block/Account/Resetpassword.php b/Rewrite/Magento/Customer/Block/Account/Resetpassword.php new file mode 100644 index 0000000..79b589c --- /dev/null +++ b/Rewrite/Magento/Customer/Block/Account/Resetpassword.php @@ -0,0 +1,23 @@ +, Chirag Dodia + * @copyright Copyright (c) Wagento Creative LLC. (https://www.wagento.com/) + * @license https://opensource.org/licenses/OSL-3.0.php Open Software License 3.0 + */ +declare(strict_types=1); + +namespace Wagento\HIBP\Rewrite\Magento\Customer\Block\Account; + +class Resetpassword extends \Magento\Customer\Block\Account\Resetpassword +{ + public function getConfig($path) + { + return $this->_scopeConfig->getValue($path, \Magento\Store\Model\ScopeInterface::SCOPE_STORE); + } +} diff --git a/composer.json b/composer.json index 145b277..605121e 100644 --- a/composer.json +++ b/composer.json @@ -12,8 +12,7 @@ "require": { "php": "~7.2.0", "magento/framework": "102.0.*", - "magento/module-customer": "102.0.*", - "dragonbe/hibp": "^0.0.5" + "magento/module-customer": "102.0.*" }, "autoload": { "files": [ @@ -23,4 +22,4 @@ "Wagento\\HIBP\\": "" } } -} \ No newline at end of file +} diff --git a/etc/acl.xml b/etc/acl.xml new file mode 100644 index 0000000..80d3b6c --- /dev/null +++ b/etc/acl.xml @@ -0,0 +1,28 @@ + + + + + + + + + + + + + + + + + diff --git a/etc/adminhtml/system.xml b/etc/adminhtml/system.xml new file mode 100644 index 0000000..86d860b --- /dev/null +++ b/etc/adminhtml/system.xml @@ -0,0 +1,33 @@ + + + + + + + +
+ + wagento + Wagento_HIBP::config_wagento_hibp + + + + + In the restrict mode system will restrict users from using pwned password + Wagento\HIBP\Model\Config\Source\Mode + + +
+ + diff --git a/etc/config.xml b/etc/config.xml new file mode 100644 index 0000000..a65106e --- /dev/null +++ b/etc/config.xml @@ -0,0 +1,22 @@ + + + + + + + report + + + + diff --git a/etc/di.xml b/etc/di.xml new file mode 100644 index 0000000..3b8bbc6 --- /dev/null +++ b/etc/di.xml @@ -0,0 +1,23 @@ + + + + + + + + Wagento\HIBP\Console\Command\HIBP + + + + diff --git a/etc/frontend/routes.xml b/etc/frontend/routes.xml index 85aa453..5de1cd1 100644 --- a/etc/frontend/routes.xml +++ b/etc/frontend/routes.xml @@ -6,7 +6,7 @@ * Adds test to built-in password strength indicator to check if password has * been used on other sites. * - * @author Joseph Leedy + * @author Joseph Leedy , Chirag Dodia * @copyright Copyright (c) Wagento Creative LLC. (https://www.wagento.com/) * @license https://opensource.org/licenses/OSL-3.0.php Open Software License 3.0 */ @@ -17,4 +17,4 @@ - \ No newline at end of file + diff --git a/etc/module.xml b/etc/module.xml index f71f030..85cc78f 100644 --- a/etc/module.xml +++ b/etc/module.xml @@ -6,15 +6,15 @@ * Adds test to built-in password strength indicator to check if password has * been used on other sites. * - * @author Joseph Leedy + * @author Joseph Leedy , Chirag Dodia * @copyright Copyright (c) Wagento Creative LLC. (https://www.wagento.com/) * @license https://opensource.org/licenses/OSL-3.0.php Open Software License 3.0 */ --> - + - \ No newline at end of file + diff --git a/registration.php b/registration.php index 69d7b85..ed9e548 100644 --- a/registration.php +++ b/registration.php @@ -9,8 +9,11 @@ * @copyright Copyright (c) Wagento Creative LLC. (https://www.wagento.com/) * @license https://opensource.org/licenses/OSL-3.0.php Open Software License 3.0 */ -\Magento\Framework\Component\ComponentRegistrar::register( - \Magento\Framework\Component\ComponentRegistrar::MODULE, + +use Magento\Framework\Component\ComponentRegistrar; + +ComponentRegistrar::register( + ComponentRegistrar::MODULE, 'Wagento_HIBP', __DIR__ ); diff --git a/view/adminhtml/layout/adminhtml_user_edit.xml b/view/adminhtml/layout/adminhtml_user_edit.xml new file mode 100644 index 0000000..04fe592 --- /dev/null +++ b/view/adminhtml/layout/adminhtml_user_edit.xml @@ -0,0 +1,20 @@ + + + + + + + + + diff --git a/view/adminhtml/templates/hibp_js.phtml b/view/adminhtml/templates/hibp_js.phtml new file mode 100644 index 0000000..9c700f2 --- /dev/null +++ b/view/adminhtml/templates/hibp_js.phtml @@ -0,0 +1,62 @@ +, Chirag Dodia + * @copyright Copyright (c) Wagento Creative LLC. (https://www.wagento.com/) + * @license https://opensource.org/licenses/OSL-3.0.php Open Software License 3.0 + */ + +/** @var \Magento\Framework\View\Helper\SecureHtmlRenderer $secureRenderer */ +/** @var \Wagento\HIBP\Block\Adminhtml\User $block */ +?> +getConfig('hibp/general/mode'); +?> +'; + var validText = ''; + if (result.count > 0) { + if (mode === 'restrict') { + validText +='Please choose another password.'; + $('#save').prop('disabled', true); + } else { + $('#save').prop('disabled', false); + } + $(validText).insertAfter($("#user_password")); + } + }); + }); + }); + }); + +script; +?> +renderTag('script', [], $scriptString, false) ?> + + diff --git a/view/adminhtml/web/js/hibp.js b/view/adminhtml/web/js/hibp.js new file mode 100644 index 0000000..550308e --- /dev/null +++ b/view/adminhtml/web/js/hibp.js @@ -0,0 +1,27 @@ +/** + * Wagento Have I Been Pwned? + * + * Adds test to built-in password strength indicator to check if password has + * been used on other sites. + * + * @author Joseph Leedy , Chirag Dodia + * @copyright Copyright (c) Wagento Creative LLC. (https://www.wagento.com/) + * @license https://opensource.org/licenses/OSL-3.0.php Open Software License 3.0 + */ + +define([ + 'jquery', + 'mage/url' +], function ($, urlBuilder) { + 'use strict'; + + return function hibp(password, doneCallback) { + const ajaxPostUrl = urlBuilder.build('hibp/index/ajaxPost'); + + $.ajax({ + url: ajaxPostUrl, + data: {password: password}, + type: 'POST' + }).done(doneCallback); + }; +}); diff --git a/view/frontend/layout/customer_account_create.xml b/view/frontend/layout/customer_account_create.xml index c178c30..37fa11b 100644 --- a/view/frontend/layout/customer_account_create.xml +++ b/view/frontend/layout/customer_account_create.xml @@ -1,4 +1,16 @@ + @@ -7,4 +19,4 @@ - \ No newline at end of file + diff --git a/view/frontend/layout/customer_account_createpassword.xml b/view/frontend/layout/customer_account_createpassword.xml new file mode 100644 index 0000000..02e6033 --- /dev/null +++ b/view/frontend/layout/customer_account_createpassword.xml @@ -0,0 +1,22 @@ + + + + + + + Wagento_HIBP::form/resetforgottenpassword.phtml + + + + diff --git a/view/frontend/requirejs-config.js b/view/frontend/requirejs-config.js index 36b71df..6a8ae54 100644 --- a/view/frontend/requirejs-config.js +++ b/view/frontend/requirejs-config.js @@ -4,15 +4,17 @@ * Adds test to built-in password strength indicator to check if password has * been used on other sites. * - * @author Joseph Leedy + * @author Joseph Leedy , Chirag Dodia * @copyright Copyright (c) Wagento Creative LLC. (https://www.wagento.com/) * @license https://opensource.org/licenses/OSL-3.0.php Open Software License 3.0 */ var config = { - map: { - '*': { - passwordStrengthIndicator: 'Wagento_HIBP/js/password-strength-indicator' + config: { + mixins: { + 'Magento_Customer/js/password-strength-indicator': { + 'Wagento_HIBP/js/password-strength-indicator-mixin': true + } } } -}; \ No newline at end of file +}; diff --git a/view/frontend/templates/form/register.phtml b/view/frontend/templates/form/register.phtml index 39627d2..15a02fe 100644 --- a/view/frontend/templates/form/register.phtml +++ b/view/frontend/templates/form/register.phtml @@ -7,21 +7,22 @@ // @codingStandardsIgnoreFile /** @var \Magento\Customer\Block\Form\Register $block */ +/** @var \Magento\Framework\Escaper $escaper */ ?> getChildHtml('form_fields_before') ?> getChildHtml('customer.form.register.extra') ?> -