class-password-protection.php — Admin and Site Enhancements (ASE) 8.6.2

admin-site-enhancements / classes / class-password-protection.php

admin-site-enhancements / classes Last commit date

class-password-protection.php

214 lines

1	<?php
2
3	namespace ASENHA\Classes;
4
5	use WP_Error;
6	/**
7	* Class for Password Protection module
8	*
9	* @since 6.9.5
10	*/
11	class Password_Protection {
12	/**
13	* Show Password Protection admin bar status icon
14	*
15	* @since 4.1.0
16	*/
17	public function show_password_protection_admin_bar_icon() {
18	add_action( 'wp_before_admin_bar_render', [$this, 'add_password_protection_admin_bar_item'] );
19	add_action( 'admin_head', [$this, 'add_password_protection_admin_bar_item_styles'] );
20	add_action( 'wp_head', [$this, 'add_password_protection_admin_bar_item_styles'] );
21	}
22
23	/**
24	* Add WP Admin Bar item
25	*
26	* @since 4.1.0
27	*/
28	public function add_password_protection_admin_bar_item() {
29	global $wp_admin_bar;
30	if ( is_user_logged_in() ) {
31	if ( current_user_can( 'manage_options' ) ) {
32	$wp_admin_bar->add_menu( array(
33	'id' => 'password_protection',
34	'title' => '',
35	'href' => admin_url( 'tools.php?page=admin-site-enhancements#utilities' ),
36	'meta' => array(
37	'title' => __( 'Password protection is currently enabled for this site.', 'admin-site-enhancements' ),
38	),
39	) );
40	}
41	}
42	}
43
44	/**
45	* Add icon and CSS for admin bar item
46	*
47	* @since 4.1.0
48	*/
49	public function add_password_protection_admin_bar_item_styles() {
50	if ( is_user_logged_in() ) {
51	if ( current_user_can( 'manage_options' ) ) {
52	?>
53	<style>
54	#wp-admin-bar-password_protection {
55	background-color: #c32121 !important;
56	transition: .25s;
57	}
58	#wp-admin-bar-password_protection > .ab-item {
59	color: #fff !important;
60	}
61	#wp-admin-bar-password_protection > .ab-item:before {
62	content: "\f160";
63	top: 2px;
64	color: #fff !important;
65	margin-right: 0px;
66	}
67	#wp-admin-bar-password_protection:hover > .ab-item {
68	background-color: #af1d1d !important;
69	color: #fff;
70	}
71	</style>
72	<?php
73	}
74	}
75	}
76
77	/**
78	* Disable page caching
79	*
80	* @since 4.1.0
81	*/
82	public function maybe_disable_page_caching() {
83	if ( !defined( 'DONOTCACHEPAGE' ) ) {
84	define( 'DONOTCACHEPAGE', true );
85	}
86	}
87
88	/**
89	* Maybe show login form
90	*
91	* @since 4.1.0
92	*/
93	public function maybe_show_login_form() {
94	// Do not redirect WP-Cron requests; wp-cron.php must return from bootstrap so core can run scheduled hooks.
95	if ( function_exists( 'wp_doing_cron' ) && wp_doing_cron() ) {
96	return;
97	}
98	if ( defined( 'DOING_CRON' ) && DOING_CRON ) {
99	return;
100	}
101	$options = get_option( ASENHA_SLUG_U, array() );
102	$stored_password = $options['password_protection_password'];
103	// When user is logged-in as in an administrator
104	if ( is_user_logged_in() ) {
105	if ( current_user_can( 'manage_options' ) ) {
106	return;
107	// Do not load login form or perform redirection to the login form
108	}
109	}
110	// When site visitor has entered correct password, get the auth cookie
111	$auth_cookie = ( isset( $_COOKIE['asenha_password_protection'] ) ? $_COOKIE['asenha_password_protection'] : '' );
112	// Compared $auth_cookie against hashed string set in maybe_process_login()
113	if ( true === wp_check_password( $_SERVER['HTTP_HOST'] . '__' . $stored_password, $auth_cookie ) ) {
114	return;
115	// Do not load login form or perform redirection to the login form
116	}
117	if ( isset( $_REQUEST['protected-page'] ) && 'view' == $_REQUEST['protected-page'] ) {
118	// Show login form
119	$password_protected_login_page_template = ASENHA_PATH . 'includes/password-protected-login.php';
120	load_template( $password_protected_login_page_template );
121	exit;
122	} else {
123	// Redirect from current URL to login form
124	$current_url = (( is_ssl() ? 'https://' : 'http://' )) . sanitize_text_field( $_SERVER['HTTP_HOST'] ) . sanitize_text_field( $_SERVER['REQUEST_URI'] );
125	$args = array(
126	'protected-page' => 'view',
127	'source' => urlencode( $current_url ),
128	);
129	$pwd_protect_login_url = add_query_arg( $args, home_url( '/' ) );
130	nocache_headers();
131	wp_safe_redirect( $pwd_protect_login_url );
132	exit;
133	}
134	}
135
136	/**
137	* Maybe process login to access protected page content
138	*
139	* @since 4.1.0
140	*/
141	public function maybe_process_login() {
142	global $password_protected_errors;
143	$password_protected_errors = new WP_Error();
144	if ( isset( $_REQUEST['protected_page_pwd'] ) ) {
145	$password_input = sanitize_text_field( $_REQUEST['protected_page_pwd'] );
146	$options = get_option( ASENHA_SLUG_U, array() );
147	$stored_password = $options['password_protection_password'];
148	if ( !empty( $password_input ) ) {
149	if ( $password_input == $stored_password ) {
150	// Password is correct
151	// Set auth cookie
152	// $expiration = time() + DAY_IN_SECONDS; // in 24 hours
153	$expiration = 0;
154	// by the end of browsing session
155	$hashed_cookie_value = wp_hash_password( $_SERVER['HTTP_HOST'] . '__' . $stored_password );
156	setcookie(
157	'asenha_password_protection',
158	$hashed_cookie_value,
159	$expiration,
160	COOKIEPATH,
161	COOKIE_DOMAIN,
162	false,
163	true
164	);
165	// Redirect
166	$redirect_to_url = ( isset( $_REQUEST['source'] ) ? sanitize_url( $_REQUEST['source'] ) : '' );
167	wp_safe_redirect( $redirect_to_url );
168	exit;
169	} else {
170	// Password is incorrect
171	// Add error message
172	$password_protected_errors->add( 'incorrect_password', __( 'Incorrect password.', 'admin-site-enhancements' ) );
173	}
174	} else {
175	// Password input is empty
176	// Add error message
177	$password_protected_errors->add( 'empty_password', __( 'Password can not be empty.', 'admin-site-enhancements' ) );
178	}
179	}
180	}
181
182	/**
183	* Add custom login error messages
184	*
185	* @since 4.1.0
186	*/
187	public function add_login_error_messages() {
188	global $password_protected_errors;
189	if ( $password_protected_errors->get_error_code() ) {
190	$messages = '';
191	$errors = '';
192	// Extract the error message
193	foreach ( $password_protected_errors->get_error_codes() as $code ) {
194	$severity = $password_protected_errors->get_error_data( $code );
195	foreach ( $password_protected_errors->get_error_messages( $code ) as $error ) {
196	if ( 'message' == $severity ) {
197	$messages .= $error . '<br />';
198	} else {
199	$errors .= $error . '<br />';
200	}
201	}
202	}
203	// Output the error message
204	if ( !empty( $messages ) ) {
205	echo '<p class="message">' . wp_kses_post( $messages ) . '</p>';
206	}
207	if ( !empty( $errors ) ) {
208	echo '<div id="login_error">' . wp_kses_post( $errors ) . '</div>';
209	}
210	}
211	}
212
213	}
214