2FA: Add pattern to validate phone number format as per E.164

[saroshaga]

Description

The SMS provider that the two-factor authentication plugin uses rejects any phone number that isn't in E.164 standards.

Here we're applying some client-side validation using HTML to ensure that incorrect phone numbers aren't configured.

Changelog Description

Changed

• WPCOM VIP 2FA: Add pattern to validate phone number format as per E.164

Pre-review checklist

• This change works and has been tested locally or in Codespaces (or has an appropriate fallback).
• This change works and has been tested on a sandbox.
• This change has relevant unit tests (if applicable).
• This change uses a rollout method to ease with deployment (if applicable - especially for large scale actions that require writes).
• This change has relevant documentation additions / updates (if applicable).
• I've created a changelog description that aligns with the provided examples.

Pre-deploy checklist

• VIP staff: Ensure any alerts added/updated conform to internal standards (see internal documentation).

Steps to Test

1. Check out PR.
2. Go to wp-admin > Tools > Bakery
3. Click on "Bake Cookies" button.
4. Verify cookies are delicious.

[codecov]

Codecov Report

Attention: Patch coverage is 0% with 1 line in your changes missing coverage. Please review.

Project coverage is 31.36%. Comparing base (b20b2de) to head (b8ec894).

Files with missing lines	Patch %	Lines
wpcom-vip-two-factor/sms-provider.php	0.00%	1 Missing ⚠️

Additional details and impacted files

@@              Coverage Diff              @@
##             develop    #5538      +/-   ##
=============================================
- Coverage      31.36%   31.36%   -0.01%     
  Complexity      5028     5028              
=============================================
  Files            298      298              
  Lines          22047    22048       +1     
=============================================
  Hits            6916     6916              
- Misses         15131    15132       +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarCloud

[brunobasto]

Looks good to me! Thank you for handling this!

[rebeccahum]

Hmm, I just tested this and it's still accepting phone numbers such as 780-123-4567. I think it might be missing the <form> tags around it for the validation?

[github-actions]

This pull request has been marked stale because it has been open for 60 days with no activity. If there is no activity within 7 days, it will be closed.

This is an automation to keep pull requests manageable and actionable and is not a comment on the quality of this pull request nor on the work done so far. Closed PRs are still valuable to the project and their branches are preserved.

[sjinks]

ITU-T specifies that a phone number cannot be longer than fifteen digits, with one to three digits reserved for the country calling code, but valid numbers in Germany have been assigned that are longer than this.

-- https://github.com/google/libphonenumber/blob/master/FALSEHOODS.md

[github-actions]

This pull request has been marked stale because it has been open for 60 days with no activity. If there is no activity within 7 days, it will be closed.

This is an automation to keep pull requests manageable and actionable and is not a comment on the quality of this pull request nor on the work done so far. Closed PRs are still valuable to the project and their branches are preserved.

[github-actions]

This pull request has been marked stale because it has been open for 60 days with no activity. If there is no activity within 7 days, it will be closed.

This is an automation to keep pull requests manageable and actionable and is not a comment on the quality of this pull request nor on the work done so far. Closed PRs are still valuable to the project and their branches are preserved.

[github-actions]

This pull request has been marked stale because it has been open for 60 days with no activity. If there is no activity within 7 days, it will be closed.

This is an automation to keep pull requests manageable and actionable and is not a comment on the quality of this pull request nor on the work done so far. Closed PRs are still valuable to the project and their branches are preserved.

[mjangda]

@andrea-sdl how did we solve this for VIP Auth? Can we implement similar validation here?

[andrea-sdl]

@mjangda for VIP Auth we used https://github.com/jackocnr/intl-tel-input on the frontend, and then validated the phone number via the Twilio API https://github.com/Automattic/vip-auth/blob/d414a80f657954c84026d7fe9dd4799d423ee6be/client-mu-plugins/vip-auth/src/mfa/providers/class-sms.php#L75

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud