class-change-login-url.php — Admin and Site Enhancements (ASE) 7.8.1

admin-site-enhancements / classes / class-change-login-url.php

admin-site-enhancements / classes Last commit date

class-change-login-url.php

350 lines

1	<?php
2
3	namespace ASENHA\Classes;
4
5	/**
6	* Class for Change Login URL module
7	*
8	* @since 6.9.5
9	*/
10	class Change_Login_URL {
11	/**
12	* Redirect to valid login URL when custom login slug is part of the request URL
13	*
14	* @link https://plugins.trac.wordpress.org/browser/admin-login-url-change/trunk/admin-login-url-change.php#L134
15	* @since 1.4.0
16	*/
17	public function redirect_on_custom_login_url() {
18	$options = get_option( ASENHA_SLUG_U );
19	$custom_login_slug = $options['custom_login_slug'];
20	$url_input = sanitize_text_field( $_SERVER['REQUEST_URI'] );
21	// Make sure $url_input ends with /
22	if ( false !== strpos( $url_input, $custom_login_slug ) ) {
23	if ( substr( $url_input, -1 ) != '/' ) {
24	$url_input = $url_input . '/';
25	}
26	}
27	// If URL contains the custom login slug, redirect to the dashboard
28	if ( false !== strpos( $url_input, '/' . $custom_login_slug . '/' ) ) {
29	if ( is_user_logged_in() ) {
30	if ( array_key_exists( 'redirect_after_login', $options ) && $options['redirect_after_login'] ) {
31	$redirect_after_login = new Redirect_After_Login();
32	$redirect_after_login_type = ( isset( $options['redirect_after_login_type'] ) ? $options['redirect_after_login_type'] : 'single_url' );
33	// Does the user have roles data in array form?
34	$user = wp_get_current_user();
35	if ( isset( $user->roles ) && is_array( $user->roles ) ) {
36	$current_user_roles = $user->roles;
37	// sort by value in descending order, so roles with custom redirection enabled comes first
38	}
39	if ( 'single_url' == $redirect_after_login_type && array_key_exists( 'redirect_after_login_for', $options ) && !empty( $options['redirect_after_login_for'] ) ) {
40	$redirect_after_login_to_slug_raw = ( isset( $options['redirect_after_login_to_slug'] ) ? $options['redirect_after_login_to_slug'] : '' );
41	$relative_path = $redirect_after_login->get_redirect_relative_path( $redirect_after_login_to_slug_raw );
42	$redirect_after_login_for = $options['redirect_after_login_for'];
43	if ( isset( $redirect_after_login_for ) && count( $redirect_after_login_for ) > 0 ) {
44	// Assemble single-dimensional array of roles for which custom URL redirection should happen
45	$roles_for_custom_redirect = array();
46	foreach ( $redirect_after_login_for as $role_slug => $custom_redirect ) {
47	if ( $custom_redirect ) {
48	$roles_for_custom_redirect[] = $role_slug;
49	}
50	}
51	// Set custom redirect URL for roles set in the settings. Otherwise, leave redirect URL to the default, i.e. admin dashboard.
52	foreach ( $current_user_roles as $role ) {
53	if ( in_array( $role, $roles_for_custom_redirect ) ) {
54	if ( isset( $_GET['action'] ) ) {
55	// User Switching plugin
56	if ( 'switch_to_user' == $_GET['action'] \|\| 'switch_to_olduser' == $_GET['action'] ) {
57	return;
58	// This ensures user switching proceeds
59	} else {
60	wp_safe_redirect( home_url( $relative_path ) );
61	exit;
62	}
63	} else {
64	// Redirect to custom redirect slug
65	wp_safe_redirect( home_url( $relative_path ) );
66	exit;
67	}
68	} else {
69	if ( isset( $_GET['action'] ) ) {
70	// User Switching plugin
71	if ( 'switch_to_user' == $_GET['action'] \|\| 'switch_to_olduser' == $_GET['action'] ) {
72	return;
73	// This ensures user switching proceeds
74	} else {
75	// Redirect to dashboard
76	wp_safe_redirect( get_admin_url() );
77	exit;
78	}
79	} else {
80	// Redirect to dashboard
81	wp_safe_redirect( get_admin_url() );
82	exit;
83	}
84	}
85	}
86	} else {
87	if ( isset( $_GET['action'] ) && ('switch_to_user' == $_GET['action'] \|\| 'switch_to_olduser' == $_GET['action']) ) {
88	return;
89	// This ensures user switching proceeds
90	}
91	}
92	} else {
93	if ( 'separate_urls' == $redirect_after_login_type && array_key_exists( 'redirect_after_login_for_separate_role', $options ) && !empty( $options['redirect_after_login_for_separate_role'] ) ) {
94	// Redirect to dashboard
95	wp_safe_redirect( get_admin_url() );
96	} else {
97	// Redirect to dashboard
98	wp_safe_redirect( get_admin_url() );
99	exit;
100	}
101	}
102	} else {
103	if ( isset( $_GET['action'] ) ) {
104	// User Switching plugin
105	if ( 'switch_to_user' == $_GET['action'] \|\| 'switch_to_olduser' == $_GET['action'] ) {
106	return;
107	// This ensures user switching proceeds
108	} else {
109	// Redirect to dashboard
110	wp_safe_redirect( get_admin_url() );
111	exit;
112	}
113	} else {
114	// Redirect to dashboard
115	wp_safe_redirect( get_admin_url() );
116	exit;
117	}
118	}
119	} else {
120	// Redirect to the login URL with custom login slug in the query parameters
121	wp_safe_redirect( site_url( '/wp-login.php?' . $custom_login_slug . '&redirect=false' ) );
122	exit;
123	}
124	}
125	}
126
127	/**
128	* Customize login URL returned when calling wp_login_url(). Add the custom login slug.
129	*
130	* @since 5.8.0
131	*/
132	public function customize_login_url( $login_url, $redirect, $force_reauth ) {
133	$options = get_option( ASENHA_SLUG_U );
134	$custom_login_slug = $options['custom_login_slug'];
135	$login_url = home_url( '/' . $custom_login_slug . '/' );
136	if ( !empty( $redirect ) ) {
137	$login_url = add_query_arg( 'redirect_to', urlencode( $redirect ), $login_url );
138	}
139	if ( $force_reauth ) {
140	$login_url = add_query_arg( 'reauth', '1', $login_url );
141	}
142	return $login_url;
143	}
144
145	/**
146	* Customize lost password URL. Add the custom login slug.
147	*
148	* @since 5.8.0
149	*/
150	public function customize_lost_password_url( $lostpassword_url ) {
151	$options = get_option( ASENHA_SLUG_U );
152	$custom_login_slug = $options['custom_login_slug'];
153	// return home_url( '/wp-login.php?backend&action=lostpassword' );
154	return $lostpassword_url . '&' . $custom_login_slug;
155	}
156
157	/**
158	* Customize registration URL. Add the custom login slug.
159	*
160	* @since 6.2.5
161	*/
162	public function customize_register_url( $registration_url ) {
163	$options = get_option( ASENHA_SLUG_U );
164	$custom_login_slug = $options['custom_login_slug'];
165	// return home_url( '/wp-login.php?backend&action=lostpassword' );
166	return $registration_url . '&' . $custom_login_slug;
167	}
168
169	/**
170	* Redirect to /not_found when login URL does not contain the custom login slug
171	* This will redirect /wp-login.php and /wp-admin/ to /not_found/
172	*
173	* @link https://plugins.trac.wordpress.org/browser/admin-login-url-change/trunk/admin-login-url-change.php#L121
174	* @since 1.4.0
175	*/
176	public function redirect_on_default_login_urls() {
177	global $interim_login;
178	if ( defined( 'DOING_AJAX' ) && DOING_AJAX ) {
179	return;
180	}
181	if ( defined( 'DOING_CRON' ) && DOING_CRON ) {
182	return;
183	}
184	$options = get_option( ASENHA_SLUG_U );
185	$custom_login_slug = $options['custom_login_slug'];
186	// e.g. backend
187	$url_input = sanitize_text_field( $_SERVER['REQUEST_URI'] );
188	// e.g. /wp-admin/index.php?page=page-slug
189	$url_input_parts = explode( '/', $url_input );
190	$redirect_slug = 'not_found';
191	// When logging-in
192	if ( isset( $_POST['log'] ) && !empty( $_POST['log'] ) && isset( $_POST['pwd'] ) && !empty( $_POST['pwd'] ) \|\| isset( $_POST['post_password'] ) && !empty( $_POST['post_password'] ) ) {
193	if ( isset( $_SERVER['HTTP_REFERER'] ) ) {
194	$http_referrer = sanitize_url( $_SERVER['HTTP_REFERER'] );
195	} else {
196	$http_referrer = '';
197	}
198	if ( !empty( $http_referrer ) && false === strpos( $http_referrer, get_site_url() ) ) {
199	// // The referer URL does not contain the site's URL. This is an attempt to do a login POST from an external URL / illegitimate method. Let's redirect that.
200	// // Redirect to /not_found/
201	wp_safe_redirect( home_url( $redirect_slug . '/' ), 302 );
202	exit;
203	} else {
204	// Do nothing. i.e. do not redirect to /not_found/ as this contains a login POST request
205	// upon successful login, redirection to logged-in view of /wp-admin/ happens.
206	// Without this condition, login attempt will redirect to /not_found/
207	}
208	} elseif ( is_user_logged_in() ) {
209	// Do nothing user is already logged-in
210	// Redirect to /wp-admin/ (Dashboard) when accessing /wp-login.php without any $_POST data
211	if ( isset( $url_input_parts[1] ) && 'wp-login.php' == $url_input_parts[1] && empty( $_POST ) ) {
212	wp_safe_redirect( admin_url(), 302 );
213	exit;
214	}
215	} elseif ( !is_user_logged_in() ) {
216	// Check if request URL ends in /admin/, /wp-admin/, /login/, /wp-login/ or /wp-login.php
217	if ( isset( $url_input_parts[1] ) && in_array( $url_input_parts[1], array(
218	'admin',
219	'wp-admin',
220	'login',
221	'wp-login',
222	'wp-login.php',
223	'login.php'
224	) ) && (!isset( $url_input_parts[2] ) \|\| isset( $url_input_parts[2] ) && empty( $url_input_parts[2] ) \|\| isset( $url_input_parts[2] ) && false !== strpos( $url_input_parts[2], '.php' )) ) {
225	// Redirect to /not_found/ or custom redirect slug
226	wp_safe_redirect( home_url( $redirect_slug . '/' ), 302 );
227	exit;
228	} elseif ( false !== strpos( $url_input, 'wp-login.php' ) ) {
229	if ( isset( $_GET['action'] ) && ('logout' == $_GET['action'] \|\| 'rp' == $_GET['action'] \|\| 'resetpass' == $_GET['action']) \|\| isset( $_GET['checkemail'] ) && ('confirm' == $_GET['checkemail'] \|\| 'registered' == $_GET['checkemail']) \|\| isset( $_GET['interim-login'] ) && '1' == $_GET['interim-login'] \|\| 'success' == $interim_login \|\| isset( $_GET['redirect_to'] ) && isset( $_GET['reauth'] ) && false !== strpos( $url_input, 'comment' ) ) {
230	// When we're logging out, inside the reset password flow, inside the registration flow or within the interim login flow
231	// e.g. https://www.example.com/wp-login.php?action=logout&_wpnonce=49bb818269
232	// e.g. https://www.example.com/wp-login.php?action=rp --> reset password
233	// e.g. https://www.example.com/wp-login.php?action=resetpass --> reset password
234	// e.g. https://www.example.com/wp-login.php?checkmail=confirm --> reset password
235	// e.g. https://www.example.com/wp-login.php?checkmail=registered --> register account
236	// e.g. https://www.example.com/wp-login.php?interim-login=1&wp_lang=en_US
237	// e.g. https://www.example.com/wp-admin/comment.php?action=approve&c=14#wpbody-content --> https://www.example.com/wp-login.php?redirect_to=https%3A%2F%2Fwww.example.com%2Fwp-admin%2Fcomment.php%3Faction%3Dapprove%26c%3D14&reauth=1#wpbody-content --> comment approve
238	// Do nothing.. proceed...
239	} elseif ( isset( $_GET['action'] ) && ('lostpassword' == $_GET['action'] \|\| 'register' == $_GET['action']) ) {
240	// When resetting password or registering an account
241	if ( isset( $_POST['user_login'] ) ) {
242	// Sending the form to reset password or register an account...
243	// Do nothing.. proceed with password reset or account registration
244	} else {
245	// When landing on the password reset or registration form
246	// ...and custom login slug is not in the URL
247	if ( false === strpos( $url_input, $custom_login_slug ) ) {
248	// Redirect to /not_found/
249	wp_safe_redirect( home_url( $redirect_slug . '/' ), 302 );
250	exit;
251	}
252	// or, custom login slug is in the url
253	// e.g. https://www.example.com/wp-login.php?action=lostpassword&customloginslug
254	// e.g. https://www.example.com/wp-login.php?action=register&customloginslug
255	// Do nothing... allow reset password or registration
256	}
257	} elseif ( false === strpos( $url_input, $custom_login_slug ) ) {
258	// When landing on the login form /wp-login.php
259	// ...and custom login slug is not in the URL
260	// Redirect to /not_found/
261	wp_safe_redirect( home_url( $redirect_slug . '/' ), 302 );
262	exit;
263	} elseif ( false !== strpos( $url_input, $custom_login_slug ) ) {
264	// When landing on the login form /wp-login.php
265	// ...and custom login slug is in the URL
266	// e.g. https://www.example.com/wp-login.php?customloginslug&redirect=false
267	// Do nothing. Do not redirect. Allow login.
268	} else {
269	}
270	} else {
271	}
272	} else {
273	}
274	}
275
276	/**
277	* Redirect to custom login URL on failed login
278	*
279	* @link https://plugins.trac.wordpress.org/browser/admin-login-url-change/trunk/admin-login-url-change.php#L148
280	* @since 1.4.0
281	*/
282	public function redirect_to_custom_login_url_on_login_fail() {
283	global $asenha_limit_login;
284	$options = get_option( ASENHA_SLUG_U );
285	$custom_login_slug = $options['custom_login_slug'];
286	if ( isset( $asenha_limit_login ) && is_array( $asenha_limit_login ) && $asenha_limit_login['within_lockout_period'] ) {
287	// Do nothing. This prevents redirection loop.
288	} else {
289	$should_redirect = true;
290	// Prevent redirection to wp-login.php if the login process is initiated by a custom login form, e.g. WooCommerce, JetFormBuilder
291	// i.e. the POST request will not contain WP login process defaults as follows
292	if ( !isset( $_POST['log'] ) && !isset( $_POST['pwd'] ) && !isset( $_POST['wp-submit'] ) && !isset( $_POST['testcookie'] ) ) {
293	$should_redirect = false;
294	}
295	if ( $should_redirect ) {
296	// Append 'failed_login=true' so we can output custom error message above the login form
297	wp_safe_redirect( home_url( 'wp-login.php?' . $custom_login_slug . '&redirect=false&failed_login=true' ) );
298	exit;
299	}
300	}
301	}
302
303	/**
304	* Add login error message on top of the login form.
305	* Only shown if there's a failed_login URL parameter, and Limit Login Attempts module is not enabled.
306	* If LLA module is enabled, the same custom login error message is handled there.
307	*
308	* @since 6.9.1
309	*/
310	public function add_failed_login_message( $message ) {
311	global $asenha_limit_login;
312	if ( isset( $_REQUEST['failed_login'] ) && $_REQUEST['failed_login'] == 'true' ) {
313	if ( is_null( $asenha_limit_login ) ) {
314	$message = '<div id="login_error" class="notice notice-error"><b>' . __( 'Error:', 'admin-site-enhancements' ) . '</b> ' . __( 'Invalid username/email or incorrect password.', 'admin-site-enhancements' ) . '</div>';
315	}
316	}
317	return $message;
318	}
319
320	/**
321	* Redirect to custom login URL on successful logout
322	*
323	* @link https://plugins.trac.wordpress.org/browser/admin-login-url-change/trunk/admin-login-url-change.php#L148
324	* @since 1.4.0
325	*/
326	public function redirect_to_custom_login_url_on_logout_success() {
327	$options = get_option( ASENHA_SLUG_U );
328	$custom_login_slug = $options['custom_login_slug'];
329	// Redirect to the login URL with custom login slug in it
330	wp_safe_redirect( home_url( 'wp-login.php?' . $custom_login_slug . '&redirect=false' ) );
331	exit;
332	}
333
334	/**
335	* Customize logout URL by adding the custom login slug to it
336	*
337	* @since 7.0.2.3
338	*/
339	public function customize_logout_url( $logout_url, $redirect ) {
340	$options = get_option( ASENHA_SLUG_U );
341	$custom_login_slug = $options['custom_login_slug'];
342	if ( !empty( $redirect ) ) {
343	$logout_url = add_query_arg( 'redirect_to', urlencode( $redirect ), $logout_url );
344	}
345	$logout_url .= '&' . $custom_login_slug;
346	return $logout_url;
347	}
348
349	}
350