class-change-login-url.php — Admin and Site Enhancements (ASE) 7.5.2

admin-site-enhancements / classes / class-change-login-url.php

admin-site-enhancements / classes Last commit date

class-change-login-url.php

338 lines

1	<?php
2
3	namespace ASENHA\Classes;
4
5	/**
6	* Class for Change Login URL module
7	*
8	* @since 6.9.5
9	*/
10	class Change_Login_URL {
11	/**
12	* Redirect to valid login URL when custom login slug is part of the request URL
13	*
14	* @link https://plugins.trac.wordpress.org/browser/admin-login-url-change/trunk/admin-login-url-change.php#L134
15	* @since 1.4.0
16	*/
17	public function redirect_on_custom_login_url() {
18	$options = get_option( ASENHA_SLUG_U );
19	$custom_login_slug = $options['custom_login_slug'];
20	$url_input = sanitize_text_field( $_SERVER['REQUEST_URI'] );
21	// Make sure $url_input ends with /
22	if ( false !== strpos( $url_input, $custom_login_slug ) ) {
23	if ( substr( $url_input, -1 ) != '/' ) {
24	$url_input = $url_input . '/';
25	}
26	}
27	// If URL contains the custom login slug, redirect to the dashboard
28	if ( false !== strpos( $url_input, '/' . $custom_login_slug . '/' ) ) {
29	if ( is_user_logged_in() ) {
30	if ( array_key_exists( 'redirect_after_login', $options ) && $options['redirect_after_login'] ) {
31	$redirect_after_login = new Redirect_After_Login();
32	$redirect_after_login_type = ( isset( $options['redirect_after_login_type'] ) ? $options['redirect_after_login_type'] : 'single_url' );
33	// Does the user have roles data in array form?
34	$user = wp_get_current_user();
35	if ( isset( $user->roles ) && is_array( $user->roles ) ) {
36	$current_user_roles = $user->roles;
37	// sort by value in descending order, so roles with custom redirection enabled comes first
38	}
39	if ( 'single_url' == $redirect_after_login_type && array_key_exists( 'redirect_after_login_for', $options ) && !empty( $options['redirect_after_login_for'] ) ) {
40	$redirect_after_login_to_slug_raw = ( isset( $options['redirect_after_login_to_slug'] ) ? $options['redirect_after_login_to_slug'] : '' );
41	$relative_path = $redirect_after_login->get_redirect_relative_path( $redirect_after_login_to_slug_raw );
42	$redirect_after_login_for = $options['redirect_after_login_for'];
43	if ( isset( $redirect_after_login_for ) && count( $redirect_after_login_for ) > 0 ) {
44	// Assemble single-dimensional array of roles for which custom URL redirection should happen
45	$roles_for_custom_redirect = array();
46	foreach ( $redirect_after_login_for as $role_slug => $custom_redirect ) {
47	if ( $custom_redirect ) {
48	$roles_for_custom_redirect[] = $role_slug;
49	}
50	}
51	// Set custom redirect URL for roles set in the settings. Otherwise, leave redirect URL to the default, i.e. admin dashboard.
52	foreach ( $current_user_roles as $role ) {
53	if ( in_array( $role, $roles_for_custom_redirect ) ) {
54	if ( isset( $_GET['action'] ) ) {
55	// User Switching plugin
56	if ( 'switch_to_user' == $_GET['action'] \|\| 'switch_to_olduser' == $_GET['action'] ) {
57	return;
58	// This ensures user switching proceeds
59	} else {
60	wp_safe_redirect( home_url( $relative_path ) );
61	exit;
62	}
63	} else {
64	// Redirect to custom redirect slug
65	wp_safe_redirect( home_url( $relative_path ) );
66	exit;
67	}
68	} else {
69	if ( isset( $_GET['action'] ) ) {
70	// User Switching plugin
71	if ( 'switch_to_user' == $_GET['action'] \|\| 'switch_to_olduser' == $_GET['action'] ) {
72	return;
73	// This ensures user switching proceeds
74	} else {
75	// Redirect to dashboard
76	wp_safe_redirect( get_admin_url() );
77	exit;
78	}
79	} else {
80	// Redirect to dashboard
81	wp_safe_redirect( get_admin_url() );
82	exit;
83	}
84	}
85	}
86	} else {
87	if ( isset( $_GET['action'] ) && ('switch_to_user' == $_GET['action'] \|\| 'switch_to_olduser' == $_GET['action']) ) {
88	return;
89	// This ensures user switching proceeds
90	}
91	}
92	} else {
93	if ( 'separate_urls' == $redirect_after_login_type && array_key_exists( 'redirect_after_login_for_separate_role', $options ) && !empty( $options['redirect_after_login_for_separate_role'] ) ) {
94	// Redirect to dashboard
95	wp_safe_redirect( get_admin_url() );
96	} else {
97	// Redirect to dashboard
98	wp_safe_redirect( get_admin_url() );
99	exit;
100	}
101	}
102	} else {
103	if ( isset( $_GET['action'] ) ) {
104	// User Switching plugin
105	if ( 'switch_to_user' == $_GET['action'] \|\| 'switch_to_olduser' == $_GET['action'] ) {
106	return;
107	// This ensures user switching proceeds
108	} else {
109	// Redirect to dashboard
110	wp_safe_redirect( get_admin_url() );
111	exit;
112	}
113	} else {
114	// Redirect to dashboard
115	wp_safe_redirect( get_admin_url() );
116	exit;
117	}
118	}
119	} else {
120	// Redirect to the login URL with custom login slug in the query parameters
121	wp_safe_redirect( site_url( '/wp-login.php?' . $custom_login_slug . '&redirect=false' ) );
122	exit;
123	}
124	}
125	}
126
127	/**
128	* Customize login URL returned when calling wp_login_url(). Add the custom login slug.
129	*
130	* @since 5.8.0
131	*/
132	public function customize_login_url( $login_url, $redirect, $force_reauth ) {
133	$options = get_option( ASENHA_SLUG_U );
134	$custom_login_slug = $options['custom_login_slug'];
135	$login_url = home_url( '/' . $custom_login_slug . '/' );
136	if ( !empty( $redirect ) ) {
137	$login_url = add_query_arg( 'redirect_to', urlencode( $redirect ), $login_url );
138	}
139	if ( $force_reauth ) {
140	$login_url = add_query_arg( 'reauth', '1', $login_url );
141	}
142	return $login_url;
143	}
144
145	/**
146	* Customize lost password URL. Add the custom login slug.
147	*
148	* @since 5.8.0
149	*/
150	public function customize_lost_password_url( $lostpassword_url ) {
151	$options = get_option( ASENHA_SLUG_U );
152	$custom_login_slug = $options['custom_login_slug'];
153	// return home_url( '/wp-login.php?manage&action=lostpassword' );
154	return $lostpassword_url . '&' . $custom_login_slug;
155	}
156
157	/**
158	* Customize registration URL. Add the custom login slug.
159	*
160	* @since 6.2.5
161	*/
162	public function customize_register_url( $registration_url ) {
163	$options = get_option( ASENHA_SLUG_U );
164	$custom_login_slug = $options['custom_login_slug'];
165	// return home_url( '/wp-login.php?manage&action=lostpassword' );
166	return $registration_url . '&' . $custom_login_slug;
167	}
168
169	/**
170	* Redirect to /not_found when login URL does not contain the custom login slug
171	* This will redirect /wp-login.php and /wp-admin/ to /not_found/
172	*
173	* @link https://plugins.trac.wordpress.org/browser/admin-login-url-change/trunk/admin-login-url-change.php#L121
174	* @since 1.4.0
175	*/
176	public function redirect_on_default_login_urls() {
177	global $interim_login;
178	if ( defined( 'DOING_AJAX' ) && DOING_AJAX ) {
179	return;
180	}
181	if ( defined( 'DOING_CRON' ) && DOING_CRON ) {
182	return;
183	}
184	$options = get_option( ASENHA_SLUG_U );
185	$custom_login_slug = $options['custom_login_slug'];
186	// e.g. manage
187	$url_input = sanitize_text_field( $_SERVER['REQUEST_URI'] );
188	// e.g. /wp-admin/index.php?page=page-slug
189	$url_input_parts = explode( '/', $url_input );
190	$redirect_slug = 'not_found';
191	// When logging-in
192	if ( isset( $_POST['log'] ) && isset( $_POST['pwd'] ) \|\| isset( $_POST['post_password'] ) ) {
193	// Do nothing. i.e. do not redirect to /not_found/ as this contains a login POST request
194	// upon successful login, redirection to logged-in view of /wp-admin/ happens.
195	// Without this condition, login attempt will redirect to /not_found/
196	} elseif ( is_user_logged_in() ) {
197	// Do nothing user is already logged-in
198	// Redirect to /wp-admin/ (Dashboard) when accessing /wp-login.php without any $_POST data
199	if ( isset( $url_input_parts[1] ) && 'wp-login.php' == $url_input_parts[1] && empty( $_POST ) ) {
200	wp_safe_redirect( admin_url(), 302 );
201	exit;
202	}
203	} elseif ( !is_user_logged_in() ) {
204	// Check if request URL ends in /admin/, /wp-admin/, /login/, /wp-login/ or /wp-login.php
205	if ( isset( $url_input_parts[1] ) && in_array( $url_input_parts[1], array(
206	'admin',
207	'wp-admin',
208	'login',
209	'wp-login',
210	'wp-login.php',
211	'login.php'
212	) ) && (!isset( $url_input_parts[2] ) \|\| isset( $url_input_parts[2] ) && empty( $url_input_parts[2] ) \|\| isset( $url_input_parts[2] ) && false !== strpos( $url_input_parts[2], '.php' )) ) {
213	// Redirect to /not_found/ or custom redirect slug
214	wp_safe_redirect( home_url( $redirect_slug . '/' ), 302 );
215	exit;
216	} elseif ( false !== strpos( $url_input, 'wp-login.php' ) ) {
217	if ( isset( $_GET['action'] ) && ('logout' == $_GET['action'] \|\| 'rp' == $_GET['action'] \|\| 'resetpass' == $_GET['action']) \|\| isset( $_GET['checkemail'] ) && ('confirm' == $_GET['checkemail'] \|\| 'registered' == $_GET['checkemail']) \|\| isset( $_GET['interim-login'] ) && '1' == $_GET['interim-login'] \|\| 'success' == $interim_login \|\| isset( $_GET['redirect_to'] ) && isset( $_GET['reauth'] ) && false !== strpos( $url_input, 'comment' ) ) {
218	// When we're logging out, inside the reset password flow, inside the registration flow or within the interim login flow
219	// e.g. https://www.example.com/wp-login.php?action=logout&_wpnonce=49bb818269
220	// e.g. https://www.example.com/wp-login.php?action=rp --> reset password
221	// e.g. https://www.example.com/wp-login.php?action=resetpass --> reset password
222	// e.g. https://www.example.com/wp-login.php?checkmail=confirm --> reset password
223	// e.g. https://www.example.com/wp-login.php?checkmail=registered --> register account
224	// e.g. https://www.example.com/wp-login.php?interim-login=1&wp_lang=en_US
225	// e.g. https://www.example.com/wp-admin/comment.php?action=approve&c=14#wpbody-content --> https://www.example.com/wp-login.php?redirect_to=https%3A%2F%2Fwww.example.com%2Fwp-admin%2Fcomment.php%3Faction%3Dapprove%26c%3D14&reauth=1#wpbody-content --> comment approve
226	// Do nothing.. proceed...
227	} elseif ( isset( $_GET['action'] ) && ('lostpassword' == $_GET['action'] \|\| 'register' == $_GET['action']) ) {
228	// When resetting password or registering an account
229	if ( isset( $_POST['user_login'] ) ) {
230	// Sending the form to reset password or register an account...
231	// Do nothing.. proceed with password reset or account registration
232	} else {
233	// When landing on the password reset or registration form
234	// ...and custom login slug is not in the URL
235	if ( false === strpos( $url_input, $custom_login_slug ) ) {
236	// Redirect to /not_found/
237	wp_safe_redirect( home_url( $redirect_slug . '/' ), 302 );
238	exit;
239	}
240	// or, custom login slug is in the url
241	// e.g. https://www.example.com/wp-login.php?action=lostpassword&customloginslug
242	// e.g. https://www.example.com/wp-login.php?action=register&customloginslug
243	// Do nothing... allow reset password or registration
244	}
245	} elseif ( false === strpos( $url_input, $custom_login_slug ) ) {
246	// When landing on the login form /wp-login.php
247	// ...and custom login slug is not in the URL
248	// Redirect to /not_found/
249	wp_safe_redirect( home_url( $redirect_slug . '/' ), 302 );
250	exit;
251	} elseif ( false !== strpos( $url_input, $custom_login_slug ) ) {
252	// When landing on the login form /wp-login.php
253	// ...and custom login slug is in the URL
254	// e.g. https://www.example.com/wp-login.php?customloginslug&redirect=false
255	// Do nothing. Do not redirect. Allow login.
256	} else {
257	}
258	} else {
259	}
260	} else {
261	}
262	}
263
264	/**
265	* Redirect to custom login URL on failed login
266	*
267	* @link https://plugins.trac.wordpress.org/browser/admin-login-url-change/trunk/admin-login-url-change.php#L148
268	* @since 1.4.0
269	*/
270	public function redirect_to_custom_login_url_on_login_fail() {
271	global $asenha_limit_login;
272	$options = get_option( ASENHA_SLUG_U );
273	$custom_login_slug = $options['custom_login_slug'];
274	if ( isset( $asenha_limit_login ) && is_array( $asenha_limit_login ) && $asenha_limit_login['within_lockout_period'] ) {
275	// Do nothing. This prevents redirection loop.
276	} else {
277	$should_redirect = true;
278	// Prevent redirection to wp-login.php if the login process is initiated by a custom login form, e.g. WooCommerce, JetFormBuilder
279	// i.e. the POST request will not contain WP login process defaults as follows
280	if ( !isset( $_POST['log'] ) && !isset( $_POST['pwd'] ) && !isset( $_POST['wp-submit'] ) && !isset( $_POST['testcookie'] ) ) {
281	$should_redirect = false;
282	}
283	if ( $should_redirect ) {
284	// Append 'failed_login=true' so we can output custom error message above the login form
285	wp_safe_redirect( home_url( 'wp-login.php?' . $custom_login_slug . '&redirect=false&failed_login=true' ) );
286	exit;
287	}
288	}
289	}
290
291	/**
292	* Add login error message on top of the login form.
293	* Only shown if there's a failed_login URL parameter, and Limit Login Attempts module is not enabled.
294	* If LLA module is enabled, the same custom login error message is handled there.
295	*
296	* @since 6.9.1
297	*/
298	public function add_failed_login_message( $message ) {
299	global $asenha_limit_login;
300	if ( isset( $_REQUEST['failed_login'] ) && $_REQUEST['failed_login'] == 'true' ) {
301	if ( is_null( $asenha_limit_login ) ) {
302	$message = '<div id="login_error" class="notice notice-error"><b>' . __( 'Error:', 'admin-site-enhancements' ) . '</b> ' . __( 'Invalid username/email or incorrect password.', 'admin-site-enhancements' ) . '</div>';
303	}
304	}
305	return $message;
306	}
307
308	/**
309	* Redirect to custom login URL on successful logout
310	*
311	* @link https://plugins.trac.wordpress.org/browser/admin-login-url-change/trunk/admin-login-url-change.php#L148
312	* @since 1.4.0
313	*/
314	public function redirect_to_custom_login_url_on_logout_success() {
315	$options = get_option( ASENHA_SLUG_U );
316	$custom_login_slug = $options['custom_login_slug'];
317	// Redirect to the login URL with custom login slug in it
318	wp_safe_redirect( home_url( 'wp-login.php?' . $custom_login_slug . '&redirect=false' ) );
319	exit;
320	}
321
322	/**
323	* Customize logout URL by adding the custom login slug to it
324	*
325	* @since 7.0.2.3
326	*/
327	public function customize_logout_url( $logout_url, $redirect ) {
328	$options = get_option( ASENHA_SLUG_U );
329	$custom_login_slug = $options['custom_login_slug'];
330	if ( !empty( $redirect ) ) {
331	$logout_url = add_query_arg( 'redirect_to', urlencode( $redirect ), $logout_url );
332	}
333	$logout_url .= '&' . $custom_login_slug;
334	return $logout_url;
335	}
336
337	}
338