Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

2FA: Add pattern to validate phone number format as per E.164 #5538

Open
wants to merge 6 commits into
base: develop
Choose a base branch
from

Conversation

saroshaga
Copy link
Contributor

Description

The SMS provider that the two-factor authentication plugin uses rejects any phone number that isn't in E.164 standards.

Here we're applying some client-side validation using HTML to ensure that incorrect phone numbers aren't configured.

Changelog Description

Changed

  • WPCOM VIP 2FA: Add pattern to validate phone number format as per E.164

Pre-review checklist

  • This change works and has been tested locally or in Codespaces (or has an appropriate fallback).
  • This change works and has been tested on a sandbox.
  • This change has relevant unit tests (if applicable).
  • This change uses a rollout method to ease with deployment (if applicable - especially for large scale actions that require writes).
  • This change has relevant documentation additions / updates (if applicable).
  • I've created a changelog description that aligns with the provided examples.

Pre-deploy checklist

  • VIP staff: Ensure any alerts added/updated conform to internal standards (see internal documentation).

Steps to Test

  1. Check out PR.
  2. Go to wp-admin > Tools > Bakery
  3. Click on "Bake Cookies" button.
  4. Verify cookies are delicious.

Copy link

codecov bot commented May 3, 2024

Codecov Report

Attention: Patch coverage is 0% with 1 line in your changes missing coverage. Please review.

Project coverage is 29.42%. Comparing base (68e33d5) to head (e92c5d8).
Report is 125 commits behind head on develop.

Files Patch % Lines
wpcom-vip-two-factor/sms-provider.php 0.00% 1 Missing ⚠️
Additional details and impacted files
@@              Coverage Diff              @@
##             develop    #5538      +/-   ##
=============================================
+ Coverage      29.40%   29.42%   +0.01%     
  Complexity      4759     4759              
=============================================
  Files            282      282              
  Lines          20580    20569      -11     
=============================================
  Hits            6052     6052              
+ Misses         14528    14517      -11     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

Addressing the SonarCloud check that failed, although target="_blank" should handle it
…ic/vip-go-mu-plugins into add/2fa-phone-number-validation
@saroshaga saroshaga marked this pull request as ready for review May 6, 2024 07:13
@saroshaga saroshaga requested a review from a team as a code owner May 6, 2024 07:13
Copy link

sonarcloud bot commented May 6, 2024

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarCloud

Copy link
Contributor

@brunobasto brunobasto left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me! Thank you for handling this!

Copy link
Contributor

@rebeccahum rebeccahum left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hmm, I just tested this and it's still accepting phone numbers such as 780-123-4567. I think it might be missing the <form> tags around it for the validation?

Copy link
Contributor

github-actions bot commented Jul 8, 2024

This pull request has been marked stale because it has been open for 60 days with no activity. If there is no activity within 7 days, it will be closed.

This is an automation to keep pull requests manageable and actionable and is not a comment on the quality of this pull request nor on the work done so far. Closed PRs are still valuable to the project and their branches are preserved.

@@ -201,12 +201,15 @@ public function user_options( $user ) {
<?php else : ?>
<label>Phone Number
<input name="vip-two-factor-phone" type="tel"
pattern="^\+[1-9]\d{1,14}$"
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ITU-T specifies that a phone number cannot be longer than fifteen digits, with one to three digits reserved for the country calling code, but valid numbers in Germany have been assigned that are longer than this.

-- https://github.com/google/libphonenumber/blob/master/FALSEHOODS.md

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants