class-change-login-url.php — Admin and Site Enhancements (ASE) 8.2.2

admin-site-enhancements / classes / class-change-login-url.php

admin-site-enhancements / classes Last commit date

class-change-login-url.php

405 lines

1	<?php
2
3	namespace ASENHA\Classes;
4
5	/**
6	* Class for Change Login URL module
7	*
8	* @since 6.9.5
9	*/
10	class Change_Login_URL {
11	/**
12	* Redirect to valid login URL when custom login slug is part of the request URL
13	*
14	* @link https://plugins.trac.wordpress.org/browser/admin-login-url-change/trunk/admin-login-url-change.php#L134
15	* @since 1.4.0
16	*/
17	public function redirect_on_custom_login_url() {
18	$options = get_option( ASENHA_SLUG_U );
19	$custom_login_slug = $options['custom_login_slug'];
20	$url_input = sanitize_text_field( $_SERVER['REQUEST_URI'] );
21	// Make sure $url_input ends with /
22	if ( false !== strpos( $url_input, $custom_login_slug ) ) {
23	if ( substr( $url_input, -1 ) != '/' ) {
24	$url_input = $url_input . '/';
25	}
26	}
27	// If URL contains the custom login slug, redirect to the dashboard
28	if ( false !== strpos( $url_input, '/' . $custom_login_slug . '/' ) ) {
29	if ( is_user_logged_in() ) {
30	if ( array_key_exists( 'redirect_after_login', $options ) && $options['redirect_after_login'] ) {
31	$redirect_after_login = new Redirect_After_Login();
32	$redirect_after_login_type = ( isset( $options['redirect_after_login_type'] ) ? $options['redirect_after_login_type'] : 'single_url' );
33	// Does the user have roles data in array form?
34	$user = wp_get_current_user();
35	if ( isset( $user->roles ) && is_array( $user->roles ) ) {
36	$current_user_roles = $user->roles;
37	// sort by value in descending order, so roles with custom redirection enabled comes first
38	}
39	if ( 'single_url' == $redirect_after_login_type && array_key_exists( 'redirect_after_login_for', $options ) && !empty( $options['redirect_after_login_for'] ) ) {
40	$redirect_after_login_to_slug_raw = ( isset( $options['redirect_after_login_to_slug'] ) ? $options['redirect_after_login_to_slug'] : '' );
41	$relative_path = $redirect_after_login->get_redirect_relative_path( $redirect_after_login_to_slug_raw );
42	$redirect_after_login_for = $options['redirect_after_login_for'];
43	if ( isset( $redirect_after_login_for ) && count( $redirect_after_login_for ) > 0 ) {
44	// Assemble single-dimensional array of roles for which custom URL redirection should happen
45	$roles_for_custom_redirect = array();
46	foreach ( $redirect_after_login_for as $role_slug => $custom_redirect ) {
47	if ( $custom_redirect ) {
48	$roles_for_custom_redirect[] = $role_slug;
49	}
50	}
51	// Set custom redirect URL for roles set in the settings. Otherwise, leave redirect URL to the default, i.e. admin dashboard.
52	foreach ( $current_user_roles as $role ) {
53	if ( in_array( $role, $roles_for_custom_redirect ) ) {
54	if ( isset( $_GET['action'] ) ) {
55	// User Switching plugin
56	if ( 'switch_to_user' == $_GET['action'] \|\| 'switch_to_olduser' == $_GET['action'] ) {
57	return;
58	// This ensures user switching proceeds
59	} else {
60	wp_safe_redirect( home_url( $relative_path ) );
61	exit;
62	}
63	} else {
64	// Redirect to custom redirect slug
65	wp_safe_redirect( home_url( $relative_path ) );
66	exit;
67	}
68	} else {
69	if ( isset( $_GET['action'] ) ) {
70	// User Switching plugin
71	if ( 'switch_to_user' == $_GET['action'] \|\| 'switch_to_olduser' == $_GET['action'] ) {
72	return;
73	// This ensures user switching proceeds
74	} else {
75	// Redirect to dashboard
76	wp_safe_redirect( get_admin_url() );
77	exit;
78	}
79	} else {
80	// Redirect to dashboard
81	wp_safe_redirect( get_admin_url() );
82	exit;
83	}
84	}
85	}
86	} else {
87	if ( isset( $_GET['action'] ) && ('switch_to_user' == $_GET['action'] \|\| 'switch_to_olduser' == $_GET['action']) ) {
88	return;
89	// This ensures user switching proceeds
90	}
91	}
92	} else {
93	if ( 'separate_urls' == $redirect_after_login_type && array_key_exists( 'redirect_after_login_for_separate_role', $options ) && !empty( $options['redirect_after_login_for_separate_role'] ) ) {
94	// Redirect to dashboard
95	wp_safe_redirect( get_admin_url() );
96	} else {
97	// Redirect to dashboard
98	wp_safe_redirect( get_admin_url() );
99	exit;
100	}
101	}
102	} else {
103	if ( isset( $_GET['action'] ) ) {
104	// User Switching plugin
105	if ( 'switch_to_user' == $_GET['action'] \|\| 'switch_to_olduser' == $_GET['action'] ) {
106	return;
107	// This ensures user switching proceeds
108	} else {
109	// Redirect to dashboard
110	wp_safe_redirect( get_admin_url() );
111	exit;
112	}
113	} else {
114	// Redirect to dashboard
115	wp_safe_redirect( get_admin_url() );
116	exit;
117	}
118	}
119	} else {
120	// Redirect to the login URL with custom login slug in the query parameters
121	wp_safe_redirect( site_url( '/wp-login.php?' . $custom_login_slug . '&redirect=false' ) );
122	exit;
123	}
124	}
125	}
126
127	/**
128	* Prevent redirect to custom login URL when Gravity Forms is active, and non-logged-in user opens a page with ?gf_page URL string
129	*
130	* @since 7.8.5
131	*/
132	public function prevent_redirect_to_custom_login_url() {
133	$url_input = sanitize_text_field( $_SERVER['REQUEST_URI'] );
134	$options = get_option( ASENHA_SLUG_U );
135	$custom_login_slug = $options['custom_login_slug'];
136	// Make sure $url_input ends with /
137	if ( false !== strpos( $url_input, $custom_login_slug ) ) {
138	if ( substr( $url_input, -1 ) != '/' ) {
139	$url_input = $url_input . '/';
140	}
141	}
142	if ( false === strpos( $url_input, '/' . $custom_login_slug . '/' ) && 'GET' === $_SERVER['REQUEST_METHOD'] && isset( $_GET['gf_page'] ) && !is_user_logged_in() && !wp_doing_ajax() ) {
143	wp_safe_redirect( site_url() );
144	exit;
145	}
146	}
147
148	/**
149	* Customize login URL returned when calling wp_login_url(). Add the custom login slug.
150	*
151	* @since 5.8.0
152	*/
153	public function customize_login_url( $login_url, $redirect, $force_reauth ) {
154	$options = get_option( ASENHA_SLUG_U );
155	$custom_login_slug = $options['custom_login_slug'];
156	$login_url = home_url( '/' . $custom_login_slug . '/' );
157	if ( !empty( $redirect ) ) {
158	$login_url = add_query_arg( 'redirect_to', urlencode( $redirect ), $login_url );
159	}
160	if ( $force_reauth ) {
161	$login_url = add_query_arg( 'reauth', '1', $login_url );
162	}
163	return $login_url;
164	}
165
166	/**
167	* Customize lost password URL. Add the custom login slug.
168	*
169	* @since 5.8.0
170	*/
171	public function customize_lost_password_url( $lostpassword_url ) {
172	$options = get_option( ASENHA_SLUG_U );
173	$custom_login_slug = $options['custom_login_slug'];
174	// return home_url( '/wp-login.php?backend&action=lostpassword' );
175	return $lostpassword_url . '&' . $custom_login_slug;
176	}
177
178	/**
179	* Customize registration URL. Add the custom login slug.
180	*
181	* @since 6.2.5
182	*/
183	public function customize_register_url( $registration_url ) {
184	$options = get_option( ASENHA_SLUG_U );
185	$custom_login_slug = $options['custom_login_slug'];
186	// return home_url( '/wp-login.php?action=register&custom_login_slug' );
187	return $registration_url . '&' . $custom_login_slug;
188	}
189
190	/**
191	* Redirect to /not_found when login URL does not contain the custom login slug
192	* This will redirect /wp-login.php and /wp-admin/ to /not_found/
193	*
194	* @link https://plugins.trac.wordpress.org/browser/admin-login-url-change/trunk/admin-login-url-change.php#L121
195	* @since 1.4.0
196	*/
197	public function redirect_on_default_login_urls() {
198	global $interim_login;
199	if ( defined( 'DOING_AJAX' ) && DOING_AJAX ) {
200	return;
201	}
202	if ( defined( 'DOING_CRON' ) && DOING_CRON ) {
203	return;
204	}
205	$options = get_option( ASENHA_SLUG_U );
206	$custom_login_slug = $options['custom_login_slug'];
207	// e.g. backend
208	$custom_login_whitelist_raw = ( isset( $options['custom_login_whitelist'] ) ? explode( PHP_EOL, $options['custom_login_whitelist'] ) : array() );
209	$custom_login_whitelist = array();
210	if ( !empty( $custom_login_whitelist_raw ) ) {
211	foreach ( $custom_login_whitelist_raw as $path ) {
212	$custom_login_whitelist[] = trim( $path );
213	}
214	}
215	$url_input = sanitize_text_field( $_SERVER['REQUEST_URI'] );
216	// e.g. /wp-admin/index.php?page=page-slug
217	$url_input_parts = explode( '/', $url_input );
218	$redirect_slug = 'not_found';
219	if ( isset( $_POST['log'] ) && !empty( $_POST['log'] ) && isset( $_POST['pwd'] ) && !empty( $_POST['pwd'] ) ) {
220	// When logging-in
221	$http_referrer = ( isset( $_SERVER['HTTP_REFERER'] ) ? sanitize_url( $_SERVER['HTTP_REFERER'] ) : '' );
222	$http_referrer_no_protocol = str_replace( array('https://', 'http://'), '', $http_referrer );
223	$http_referrer_parts = explode( '/', $http_referrer_no_protocol );
224	$http_user_agent = ( isset( $_SERVER['HTTP_USER_AGENT'] ) ? $_SERVER['HTTP_USER_AGENT'] : '' );
225	if ( in_array( 'paid-memberships-pro/paid-memberships-pro.php', get_option( 'active_plugins', array() ) ) && isset( $_POST['pmpro_login_form_used'] ) && '1' == $_POST['pmpro_login_form_used'] ) {
226	// Do nothing. i.e. do not redirect to /not_found/
227	// This is a login attempt from Paid Membership Pro login form, which may include a modal/pop-up form.
228	} elseif ( !empty( $http_referrer ) && false === strpos( $http_referrer, get_site_url() ) ) {
229	// The referer URL does not contain the site's URL. This is an attempt to do a login POST from an external URL / illegitimate method. Let's redirect that.
230	wp_safe_redirect( home_url( $redirect_slug . '/' ), 302 );
231	exit;
232	} elseif ( !empty( $http_user_agent ) && preg_match( '/^(curl\|wget)/i', $http_user_agent ) ) {
233	// The post request is coming from a cURL or Wget request, let's redirect that.
234	wp_safe_redirect( home_url( $redirect_slug . '/' ), 302 );
235	exit;
236	} elseif ( empty( $http_referrer ) ) {
237	// The login request does not have HTTP_REFERER info. e.g. coming from cURL but with a user agent set to a browser's.
238	// Let's redirect that
239	wp_safe_redirect( home_url( $redirect_slug . '/' ), 302 );
240	exit;
241	} elseif ( !empty( $http_referrer ) && false === strpos( $http_referrer, $custom_login_slug ) ) {
242	// The referrer URL does not contain the custom login slug. Could be an attempt to login via cURL POST.
243	if ( isset( $http_referrer_parts[1] ) && in_array( $http_referrer_parts[1], $custom_login_whitelist ) ) {
244	// Do nothing. i.e. do not redirect to /not_found/ as this contains a URL keyword that's been exlucded from redirection
245	} else {
246	wp_safe_redirect( home_url( $redirect_slug . '/' ), 302 );
247	exit;
248	}
249	} else {
250	// Do nothing. i.e. do not redirect to /not_found/ as this contains a valin login POST request
251	// upon successful login, redirection to logged-in view of /wp-admin/ happens.
252	// Without this condition, login attempt will redirect to /not_found/
253	}
254	} elseif ( isset( $_POST['post_password'] ) && !empty( $_POST['post_password'] ) ) {
255	// When entering password for a password-protected post/page
256	// Do nothing. i.e. do not redirect to /not_found/
257	} elseif ( is_user_logged_in() ) {
258	// Do nothing user is already logged-in
259	// Redirect to /wp-admin/ (Dashboard) when accessing /wp-login.php without any $_POST data
260	if ( isset( $url_input_parts[1] ) && 'wp-login.php' == $url_input_parts[1] && empty( $_POST ) ) {
261	wp_safe_redirect( admin_url(), 302 );
262	exit;
263	}
264	} elseif ( !is_user_logged_in() ) {
265	// WHen trying to access /wp-signup.php without the ?custom_login_slug, redirect to the redriect_slug
266	if ( isset( $url_input_parts[1] ) && 'wp-signup.php' == $url_input_parts[1] && false === strpos( $url_input, $custom_login_slug ) ) {
267	// Redirect to /not_found/
268	wp_safe_redirect( home_url( $redirect_slug . '/' ), 302 );
269	exit;
270	} elseif ( false !== strpos( $url_input, 'wp-admin/admin-post.php' ) ) {
271	// Do nothing. i.e. do not redirect to /not_found/
272	} elseif ( isset( $url_input_parts[1] ) && in_array( $url_input_parts[1], array(
273	'admin',
274	'wp-admin',
275	'login',
276	'wp-login',
277	'wp-login.php',
278	'login.php'
279	) ) && (!isset( $url_input_parts[2] ) \|\| isset( $url_input_parts[2] ) && empty( $url_input_parts[2] ) \|\| isset( $url_input_parts[2] ) && false !== strpos( $url_input_parts[2], '.php' )) ) {
280	// Redirect to /not_found/ or custom redirect slug
281	wp_safe_redirect( home_url( $redirect_slug . '/' ), 302 );
282	exit;
283	} elseif ( false !== strpos( $url_input, 'wp-login.php' ) ) {
284	if ( isset( $_GET['action'] ) && ('logout' == $_GET['action'] \|\| 'rp' == $_GET['action'] \|\| 'resetpass' == $_GET['action']) \|\| isset( $_GET['checkemail'] ) && ('confirm' == $_GET['checkemail'] \|\| 'registered' == $_GET['checkemail']) \|\| isset( $_GET['interim-login'] ) && '1' == $_GET['interim-login'] \|\| 'success' == $interim_login \|\| isset( $_GET['redirect_to'] ) && isset( $_GET['reauth'] ) && false !== strpos( $url_input, 'comment' ) ) {
285	// When we're logging out, inside the reset password flow, inside the registration flow or within the interim login flow
286	// e.g. https://www.example.com/wp-login.php?action=logout&_wpnonce=49bb818269
287	// e.g. https://www.example.com/wp-login.php?action=rp --> reset password
288	// e.g. https://www.example.com/wp-login.php?action=resetpass --> reset password
289	// e.g. https://www.example.com/wp-login.php?checkmail=confirm --> reset password
290	// e.g. https://www.example.com/wp-login.php?checkmail=registered --> register account
291	// e.g. https://www.example.com/wp-login.php?interim-login=1&wp_lang=en_US
292	// e.g. https://www.example.com/wp-admin/comment.php?action=approve&c=14#wpbody-content --> https://www.example.com/wp-login.php?redirect_to=https%3A%2F%2Fwww.example.com%2Fwp-admin%2Fcomment.php%3Faction%3Dapprove%26c%3D14&reauth=1#wpbody-content --> comment approve
293	// Do nothing.. proceed...
294	} elseif ( isset( $_GET['action'] ) && ('lostpassword' == $_GET['action'] \|\| 'register' == $_GET['action']) ) {
295	// When resetting password or registering an account
296	if ( isset( $_POST['user_login'] ) ) {
297	// Sending the form to reset password or register an account...
298	// Do nothing.. proceed with password reset or account registration
299	} else {
300	// When landing on the password reset or registration form
301	// ...and custom login slug is not in the URL
302	if ( false === strpos( $url_input, $custom_login_slug ) ) {
303	// Redirect to /not_found/
304	wp_safe_redirect( home_url( $redirect_slug . '/' ), 302 );
305	exit;
306	}
307	// or, custom login slug is in the url
308	// e.g. https://www.example.com/wp-login.php?action=lostpassword&customloginslug
309	// e.g. https://www.example.com/wp-login.php?action=register&customloginslug
310	// Do nothing... allow reset password or registration
311	}
312	} elseif ( false === strpos( $url_input, $custom_login_slug ) ) {
313	// When landing on the login form /wp-login.php
314	// ...and custom login slug is not in the URL
315	// Redirect to /not_found/
316	wp_safe_redirect( home_url( $redirect_slug . '/' ), 302 );
317	exit;
318	} elseif ( false !== strpos( $url_input, $custom_login_slug ) ) {
319	// When landing on the login form /wp-login.php
320	// ...and custom login slug is in the URL
321	// e.g. https://www.example.com/wp-login.php?customloginslug&redirect=false
322	// Do nothing. Do not redirect. Allow login.
323	} else {
324	}
325	} else {
326	}
327	} else {
328	}
329	}
330
331	/**
332	* Redirect to custom login URL on failed login
333	*
334	* @link https://plugins.trac.wordpress.org/browser/admin-login-url-change/trunk/admin-login-url-change.php#L148
335	* @since 1.4.0
336	*/
337	public function redirect_to_custom_login_url_on_login_fail() {
338	global $asenha_limit_login;
339	$options = get_option( ASENHA_SLUG_U );
340	$custom_login_slug = $options['custom_login_slug'];
341	if ( isset( $asenha_limit_login ) && is_array( $asenha_limit_login ) && $asenha_limit_login['within_lockout_period'] ) {
342	// Do nothing. This prevents redirection loop.
343	} else {
344	$should_redirect = true;
345	// Prevent redirection to wp-login.php if the login process is initiated by a custom login form, e.g. WooCommerce, JetFormBuilder
346	// i.e. the POST request will not contain WP login process defaults as follows
347	if ( !isset( $_POST['log'] ) && !isset( $_POST['pwd'] ) && !isset( $_POST['wp-submit'] ) && !isset( $_POST['testcookie'] ) ) {
348	$should_redirect = false;
349	}
350	if ( $should_redirect ) {
351	// Append 'failed_login=true' so we can output custom error message above the login form
352	wp_safe_redirect( site_url( 'wp-login.php?' . $custom_login_slug . '&redirect=false&failed_login=true' ) );
353	exit;
354	}
355	}
356	}
357
358	/**
359	* Add login error message on top of the login form.
360	* Only shown if there's a failed_login URL parameter, and Limit Login Attempts module is not enabled.
361	* If LLA module is enabled, the same custom login error message is handled there.
362	*
363	* @since 6.9.1
364	*/
365	public function add_failed_login_message( $message ) {
366	global $asenha_limit_login;
367	if ( isset( $_REQUEST['failed_login'] ) && $_REQUEST['failed_login'] == 'true' ) {
368	if ( is_null( $asenha_limit_login ) ) {
369	$message = '<div id="login_error" class="notice notice-error"><b>' . __( 'Error:', 'admin-site-enhancements' ) . '</b> ' . __( 'Invalid username/email or incorrect password.', 'admin-site-enhancements' ) . '</div>';
370	}
371	}
372	return $message;
373	}
374
375	/**
376	* Redirect to custom login URL on successful logout
377	*
378	* @link https://plugins.trac.wordpress.org/browser/admin-login-url-change/trunk/admin-login-url-change.php#L148
379	* @since 1.4.0
380	*/
381	public function redirect_to_custom_login_url_on_logout_success() {
382	$options = get_option( ASENHA_SLUG_U );
383	$custom_login_slug = $options['custom_login_slug'];
384	// Redirect to the login URL with custom login slug in it
385	wp_safe_redirect( home_url( 'wp-login.php?' . $custom_login_slug . '&redirect=false' ) );
386	exit;
387	}
388
389	/**
390	* Customize logout URL by adding the custom login slug to it
391	*
392	* @since 7.0.2.3
393	*/
394	public function customize_logout_url( $logout_url, $redirect ) {
395	$options = get_option( ASENHA_SLUG_U );
396	$custom_login_slug = $options['custom_login_slug'];
397	if ( !empty( $redirect ) ) {
398	$logout_url = add_query_arg( 'redirect_to', urlencode( $redirect ), $logout_url );
399	}
400	$logout_url .= '&' . $custom_login_slug;
401	return $logout_url;
402	}
403
404	}
405