← All changes | authorizer.php +2091 -3881 2.8.3 → 2.6.11 View file →

		@@ -1,31 +1,51 @@
1	1	<?php
2		-/**
3		- * Plugin Name: Authorizer
4		- * Description: Authorizer limits login attempts, restricts access to specified users, and authenticates against external sources (e.g., Google, LDAP, or CAS).
5		- * Author: Paul Ryan <prar@hawaii.edu>
6		- * Plugin URI: https://github.com/uhm-coe/authorizer
7		- * Text Domain: authorizer
8		- * Domain Path: /languages
9		- * License: GPL2
10		- * Version: 2.8.3
11		- *
12		- * @package authorizer
13		- */
	2	+/*
	3	+Plugin Name: Authorizer
	4	+Plugin URI: https://github.com/uhm-coe/authorizer
	5	+Description: Authorizer limits login attempts, restricts access to specified users, and authenticates against external sources (e.g., Google, LDAP, or CAS).
	6	+Version: 2.6.11
	7	+Author: Paul Ryan
	8	+Author URI: http://www.linkedin.com/in/paulrryan/
	9	+Text Domain: authorizer
	10	+Domain Path: /languages
	11	+License: GPL2
	12	+*/
14	13
15		-/**
16		- * Portions forked from Restricted Site Access plugin: http://wordpress.org/plugins/restricted-site-access/
17		- * Portions forked from wpCAS plugin: http://wordpress.org/extend/plugins/cas-authentication/
18		- * Portions forked from Limit Login Attempts: http://wordpress.org/plugins/limit-login-attempts/
19		- */
20	14
21		-/**
22		- * Add phpCAS library if it's not included.
23		- *
24		- * @see https://wiki.jasig.org/display/CASC/phpCAS+installation+guide
25		- */
	15	+/*
	16	+Copyright 2014 Paul Ryan (email: prar@hawaii.edu)
	17	+
	18	+This program is free software; you can redistribute it and/or modify
	19	+it under the terms of the GNU General Public License, version 2, as
	20	+published by the Free Software Foundation.
	21	+
	22	+This program is distributed in the hope that it will be useful,
	23	+but WITHOUT ANY WARRANTY; without even the implied warranty of
	24	+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	25	+GNU General Public License for more details.
	26	+
	27	+You should have received a copy of the GNU General Public License
	28	+along with this program; if not, write to the Free Software
	29	+Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
	30	+*/
	31	+
	32	+
	33	+/*
	34	+Portions forked from Restricted Site Access plugin: http://wordpress.org/plugins/restricted-site-access/
	35	+Portions forked from wpCAS plugin: http://wordpress.org/extend/plugins/cas-authentication/
	36	+Portions forked from Limit Login Attempts: http://wordpress.org/plugins/limit-login-attempts/
	37	+*/
	38	+
	39	+
	40	+define( 'MULTISITE_ADMIN', 'multisite_admin' );
	41	+define( 'SINGLE_ADMIN', 'single_admin' );
	42	+
	43	+
	44	+// Add phpCAS library if it's not included.
	45	+// @see https://wiki.jasig.org/display/CASC/phpCAS+installation+guide
26	46	if ( ! defined( 'PHPCAS_VERSION' ) ) {
27		- require_once dirname( __FILE__ ) . '/vendor/CAS-1.3.5/CAS.php';
	47	+ require_once dirname( __FILE__ ) . '/vendor/CAS-1.3.4/CAS.php';
28	48	}
29	49
30	50
31	51	if ( ! class_exists( 'WP_Plugin_Authorizer' ) ) {
		@@ -39,87 +59,18 @@
39	59	* @link http://hawaii.edu/coe/dcdc/wordpress/authorizer/doc/
40	60	*/
41	61	class WP_Plugin_Authorizer {
42	62
43		- /**
44		- * Constants for determining our admin context (network or individual site).
45		- */
46		- const NETWORK_CONTEXT = 'multisite_admin';
47		- const SINGLE_CONTEXT = 'single_admin';
48	63
49	64	/**
50		- * Current site ID (Multisite).
51		- *
52		- * @var string
53		- */
54		- public $current_site_blog_id = 1;
55		-
56		- /**
57		- * HTML allowed when rendering translatable strings in the Authorizer UI.
58		- * This is passed to wp_kses() when sanitizing HMTL strings.
59		- *
60		- * @var array
61		- */
62		- private $allowed_html = array(
63		- 'a' => array(
64		- 'class' => array(),
65		- 'href' => array(),
66		- 'style' => array(),
67		- 'target' => array(),
68		- 'title' => array(),
69		- ),
70		- 'b' => array(),
71		- 'br' => array(),
72		- 'div' => array(
73		- 'class' => array(),
74		- ),
75		- 'em' => array(),
76		- 'hr' => array(),
77		- 'i' => array(),
78		- 'input' => array(
79		- 'aria-describedby' => array(),
80		- 'class' => array(),
81		- 'id' => array(),
82		- 'name' => array(),
83		- 'size' => array(),
84		- 'type' => array(),
85		- 'value' => array(),
86		- ),
87		- 'label' => array(
88		- 'class' => array(),
89		- 'for' => array(),
90		- ),
91		- 'p' => array(
92		- 'style' => array(),
93		- ),
94		- 'span' => array(
95		- 'aria-hidden' => array(),
96		- 'class' => array(),
97		- 'id' => array(),
98		- 'style' => array(),
99		- ),
100		- 'strong' => array(),
101		- );
102		-
103		- /**
104	65	* Constructor.
105	66	*/
106	67	public function __construct() {
107		- // Save reference to current blog id in the network (support deprecated
108		- // constant BLOGID_CURRENT_SITE).
109		- if ( defined( 'BLOG_ID_CURRENT_SITE' ) ) {
110		- $this->current_site_blog_id = BLOG_ID_CURRENT_SITE;
111		- } elseif ( defined( 'BLOGID_CURRENT_SITE' ) ) { // deprecated.
112		- $this->current_site_blog_id = BLOGID_CURRENT_SITE;
113		- }
114		-
115	68	// Installation and uninstallation hooks.
116	69	register_activation_hook( __FILE__, array( $this, 'activate' ) );
117	70	register_deactivation_hook( __FILE__, array( $this, 'deactivate' ) );
118	71
119		- /**
120		- * Register filters.
121		- */
	72	+ // Register filters.
122	73
123	74	// Custom wp authentication routine using external service.
124	75	add_filter( 'authenticate', array( $this, 'custom_authenticate' ), 1, 3 );
125	76
		@@ -125,9 +76,13 @@
125	76
126	77	// Custom logout action using external service.
127	78	add_action( 'wp_logout', array( $this, 'custom_logout' ) );
128	79
129		- // Create settings link on Plugins page.
	80	+ // Removing this bypasses Wordpress authentication (so if external auth fails,
	81	+ // no one can log in); with it enabled, it will run if external auth fails.
	82	+ //remove_filter('authenticate', 'wp_authenticate_username_password', 20, 3);
	83	+
	84	+ // Create settings link on Plugins page
130	85	add_filter( 'plugin_action_links_' . plugin_basename( __FILE__ ), array( $this, 'plugin_settings_link' ) );
131	86	add_filter( 'network_admin_plugin_action_links_' . plugin_basename( __FILE__ ), array( $this, 'network_admin_plugin_settings_link' ) );
132	87
133	88	// Modify login page with a custom password url (if option is set).
		@@ -138,11 +93,9 @@
138	93	if ( $error && strlen( $error ) > 0 ) {
139	94	add_filter( 'login_errors', array( $this, 'show_advanced_login_error' ) );
140	95	}
141	96
142		- /**
143		- * Register actions.
144		- */
	97	+ // Register actions.
145	98
146	99	// Enable localization. Translation files stored in /languages.
147	100	add_action( 'plugins_loaded', array( $this, 'load_textdomain' ) );
148	101
		@@ -154,20 +107,18 @@
154	107
155	108	// Add users who successfully login to the approved list.
156	109	add_action( 'wp_login', array( $this, 'ensure_wordpress_user_in_approved_list_on_login' ), 10, 2 );
157	110
158		- // Create menu item in Settings.
	111	+ // Create menu item in Settings
159	112	add_action( 'admin_menu', array( $this, 'add_plugin_page' ) );
160	113
161		- // Create options page.
	114	+ // Create options page
162	115	add_action( 'admin_init', array( $this, 'page_init' ) );
163	116
164	117	// Update user role in approved list if it's changed in the WordPress edit user page.
165		- add_action( 'user_profile_update_errors', array( $this, 'edit_user_profile_update_role' ), 10, 3 );
	118	+ add_action( 'edit_user_profile_update', array( $this, 'edit_user_profile_update_role' ) );
	119	+ add_action( 'personal_options_update', array( $this, 'edit_user_profile_update_role' ) );
166	120
167		- // Update user email in approved list if it's changed in the WordPress edit user page.
168		- add_filter( 'send_email_change_email', array( $this, 'edit_user_profile_update_email' ), 10, 3 );
169		-
170	121	// Enqueue javascript and css on the plugin's options page, the
171	122	// dashboard (for the widget), and the network admin.
172	123	add_action( 'load-settings_page_authorizer', array( $this, 'load_options_page' ) );
173	124	add_action( 'admin_head-index.php', array( $this, 'load_options_page' ) );
		@@ -172,16 +123,13 @@
172	123	add_action( 'load-settings_page_authorizer', array( $this, 'load_options_page' ) );
173	124	add_action( 'admin_head-index.php', array( $this, 'load_options_page' ) );
174	125	add_action( 'load-toplevel_page_authorizer', array( $this, 'load_options_page' ) );
175	126
176		- // Add custom css and js to wp-login.php.
	127	+ // Add custom css and js to wp-login.php
177	128	add_action( 'login_enqueue_scripts', array( $this, 'login_enqueue_scripts_and_styles' ) );
178	129	add_action( 'login_footer', array( $this, 'load_login_footer_js' ) );
179	130
180		- // Create google nonce cookie when loading wp-login.php if Google is enabled.
181		- add_action( 'login_init', array( $this, 'login_init__maybe_set_google_nonce_cookie' ) );
182		-
183		- // Modify login page with external auth links (if enabled; e.g., google or cas).
	131	+ // Modify login page with external auth links (if enabled; e.g., google or cas)
184	132	add_action( 'login_form', array( $this, 'login_form_add_external_service_links' ) );
185	133
186	134	// Redirect to CAS login when visiting login page (only if option is
187	135	// enabled, CAS is the only service, and WordPress logins are hidden).
		@@ -190,28 +138,25 @@
190	138	// output is started (so the redirect header doesn't complain about data
191	139	// already being sent).
192	140	add_filter( 'wp_login_errors', array( $this, 'wp_login_errors__maybe_redirect_to_cas' ), 10, 2 );
193	141
194		- // Verify current user has access to page they are visiting.
	142	+ // Verify current user has access to page they are visiting
195	143	add_action( 'parse_request', array( $this, 'restrict_access' ), 9 );
196	144	add_action( 'init', array( $this, 'init__maybe_add_network_approved_user' ) );
197	145
198		- // AJAX: Save options from dashboard widget.
	146	+ // ajax save options from dashboard widget
199	147	add_action( 'wp_ajax_update_auth_user', array( $this, 'ajax_update_auth_user' ) );
200	148
201		- // AJAX: Save options from multisite options page.
	149	+ // ajax save options from multisite options page
202	150	add_action( 'wp_ajax_save_auth_multisite_settings', array( $this, 'ajax_save_auth_multisite_settings' ) );
203	151
204		- // AJAX: Save usermeta from options page.
	152	+ // ajax save usermeta from options page
205	153	add_action( 'wp_ajax_update_auth_usermeta', array( $this, 'ajax_update_auth_usermeta' ) );
206	154
207		- // AJAX: Verify google login.
	155	+ // ajax verify google login
208	156	add_action( 'wp_ajax_process_google_login', array( $this, 'ajax_process_google_login' ) );
209	157	add_action( 'wp_ajax_nopriv_process_google_login', array( $this, 'ajax_process_google_login' ) );
210	158
211		- // AJAX: Refresh approved user list.
212		- add_action( 'wp_ajax_refresh_approved_user_list', array( $this, 'ajax_refresh_approved_user_list' ) );
213		-
214	159	// Add dashboard widget so instructors can add/edit users with access.
215	160	// Hint: For Multisite Network Admin Dashboard use wp_network_dashboard_setup instead of wp_dashboard_setup.
216	161	add_action( 'wp_dashboard_setup', array( $this, 'add_dashboard_widgets' ) );
217	162
		@@ -226,12 +171,17 @@
226	171	add_action( 'wp_enqueue_scripts', array( $this, 'auth_public_scripts' ), 20 );
227	172
228	173	// Multisite-specific actions.
229	174	if ( is_multisite() ) {
230		- // Add network admin options page (global settings for all sites).
	175	+ // Add network admin options page (global settings for all sites)
231	176	add_action( 'network_admin_menu', array( $this, 'network_admin_menu' ) );
232	177	}
233	178
	179	+ // Create login cookie (used by google login)
	180	+ if ( ! isset( $_COOKIE['login_unique'] ) ) {
	181	+ setcookie( 'login_unique', $this->get_cookie_value(), time()+1800, '/', defined( 'COOKIE_DOMAIN' ) ? COOKIE_DOMAIN : '' );
	182	+ }
	183	+
234	184	// Remove user from authorizer lists when that user is deleted in WordPress.
235	185	add_action( 'delete_user', array( $this, 'remove_user_from_authorizer_when_deleted' ) );
236	186	if ( is_multisite() ) {
237	187	// Remove multisite user from authorizer lists when that user is deleted from Network Users.
		@@ -264,20 +214,16 @@
264	214	* Will also activate the plugin for all sites/blogs if this is a "Network enable."
265	215	*
266	216	* @return void
267	217	*/
268		- public function activate( $network_wide ) {
	218	+ public function activate() {
269	219	global $wpdb;
270	220
271		- // If we're in a multisite environment, run the plugin activation for each
272		- // site when network enabling.
273		- // Note: wp-cli does not use nonces, so we skip the nonce check here to
274		- // allow the "wp plugin activate authorizer" command.
275		- // phpcs:ignore WordPress.CSRF.NonceVerification.NoNonceVerification
276		- if ( is_multisite() && $network_wide ) {
	221	+ // If we're in a multisite environment, run the plugin activation for each site when network enabling
	222	+ if ( is_multisite() && isset( $_GET['networkwide'] ) && $_GET['networkwide'] == 1 ) {
277	223
278	224	// Add super admins to the multisite approved list.
279		- $auth_multisite_settings_access_users_approved = get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', array() );
	225	+ $auth_multisite_settings_access_users_approved = get_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', array() );
280	226	$should_update_auth_multisite_settings_access_users_approved = false;
281	227	foreach ( get_super_admins() as $super_admin ) {
282	228	$user = get_user_by( 'login', $super_admin );
283	229	// Add to approved list if not there.
		@@ -282,10 +228,10 @@
282	228	$user = get_user_by( 'login', $super_admin );
283	229	// Add to approved list if not there.
284	230	if ( ! $this->in_multi_array( $user->user_email, $auth_multisite_settings_access_users_approved ) ) {
285	231	$approved_user = array(
286		- 'email' => $this->lowercase( $user->user_email ),
287		- 'role' => count( $user->roles ) > 0 ? $user->roles[0] : 'administrator',
	232	+ 'email' => $user->user_email,
	233	+ 'role' => count( $user->roles ) > 0 ? $user->roles[0] : 'administrator',
288	234	'date_added' => date( 'M Y', strtotime( $user->user_registered ) ),
289	235	'local_user' => true,
290	236	);
291	237	array_push( $auth_multisite_settings_access_users_approved, $approved_user );
		@@ -292,14 +238,13 @@
292	238	$should_update_auth_multisite_settings_access_users_approved = true;
293	239	}
294	240	}
295	241	if ( $should_update_auth_multisite_settings_access_users_approved ) {
296		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
	242	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
297	243	}
298	244
299	245	// Run plugin activation on each site in the network.
300	246	$current_blog_id = $wpdb->blogid;
301		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
302	247	$sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
303	248	foreach ( $sites as $site ) {
304	249	$blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
305	250	switch_to_blog( $blog_id );
		@@ -328,13 +273,13 @@
328	273	* @return void
329	274	*/
330	275	private function add_wp_users_to_approved_list() {
331	276	// Add current WordPress users to the approved list.
332		- $auth_multisite_settings_access_users_approved = is_multisite() ? get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', array() ) : array();
333		- $auth_settings_access_users_pending = $this->get_plugin_option( 'access_users_pending', WP_Plugin_Authorizer::SINGLE_CONTEXT );
334		- $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT );
335		- $auth_settings_access_users_blocked = $this->get_plugin_option( 'access_users_blocked', WP_Plugin_Authorizer::SINGLE_CONTEXT );
336		- $updated = false;
	277	+ $auth_multisite_settings_access_users_approved = is_multisite() ? get_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', array() ) : array();
	278	+ $auth_settings_access_users_pending = $this->get_plugin_option( 'access_users_pending', SINGLE_ADMIN );
	279	+ $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN );
	280	+ $auth_settings_access_users_blocked = $this->get_plugin_option( 'access_users_blocked', SINGLE_ADMIN );
	281	+ $updated = false;
337	282	foreach ( get_users() as $user ) {
338	283	// Skip if user is in blocked list.
339	284	if ( $this->in_multi_array( $user->user_email, $auth_settings_access_users_blocked ) ) {
340	285	continue;
		@@ -340,10 +285,10 @@
340	285	continue;
341	286	}
342	287	// Remove from pending list if there.
343	288	foreach ( $auth_settings_access_users_pending as $key => $pending_user ) {
344		- if ( 0 === strcasecmp( $pending_user['email'], $user->user_email ) ) {
345		- unset( $auth_settings_access_users_pending[ $key ] );
	289	+ if ( $pending_user['email'] == $user->user_email ) {
	290	+ unset( $auth_settings_access_users_pending[$key] );
346	291	$updated = true;
347	292	}
348	293	}
349	294	// Skip if user is in multisite approved list.
		@@ -352,10 +297,10 @@
352	297	}
353	298	// Add to approved list if not there.
354	299	if ( ! $this->in_multi_array( $user->user_email, $auth_settings_access_users_approved ) ) {
355	300	$approved_user = array(
356		- 'email' => $this->lowercase( $user->user_email ),
357		- 'role' => count( $user->roles ) > 0 ? $user->roles[0] : '',
	301	+ 'email' => $user->user_email,
	302	+ 'role' => count( $user->roles ) > 0 ? $user->roles[0] : '',
358	303	'date_added' => date( 'M Y', strtotime( $user->user_registered ) ),
359	304	'local_user' => true,
360	305	);
361	306	array_push( $auth_settings_access_users_approved, $approved_user );
		@@ -390,14 +335,13 @@
390	335
391	336	/**
392	337	* Authenticate against an external service.
393	338	*
394		- * Filter: authenticate
395		- *
396		- * @param WP_User $user user to authenticate.
	339	+ * @param WP_User $user user to authenticate
397	340	* @param string $username optional username to authenticate.
398	341	* @param string $password optional password to authenticate.
399		- * @return WP_User|WP_Error WP_User on success, WP_Error on failure.
	342	+ *
	343	+ * @return WP_User or WP_Error
400	344	*/
401	345	public function custom_authenticate( $user, $username, $password ) {
402	346	// Pass through if already authenticated.
403	347	if ( is_a( $user, 'WP_User' ) ) {
		@@ -405,20 +349,20 @@
405	349	} else {
406	350	$user = null;
407	351	}
408	352
409		- // If username and password are blank, this isn't a log in attempt.
	353	+ // If username and password are blank, this isn't a log in attempt
410	354	$is_login_attempt = strlen( $username ) > 0 && strlen( $password ) > 0;
411	355
412	356	// Check to make sure that $username is not locked out due to too
413	357	// many invalid login attempts. If it is, tell the user how much
414	358	// time remains until they can try again.
415		- $unauthenticated_user = $is_login_attempt ? get_user_by( 'login', $username ) : false;
	359	+ $unauthenticated_user = $is_login_attempt ? get_user_by( 'login', $username ) : false;
416	360	$unauthenticated_user_is_blocked = false;
417		- if ( $is_login_attempt && false !== $unauthenticated_user ) {
	361	+ if ( $is_login_attempt && $unauthenticated_user !== false ) {
418	362	$last_attempt = get_user_meta( $unauthenticated_user->ID, 'auth_settings_advanced_lockouts_time_last_failed', true );
419	363	$num_attempts = get_user_meta( $unauthenticated_user->ID, 'auth_settings_advanced_lockouts_failed_attempts', true );
420		- // Also check the auth_blocked user_meta flag (users in blocked list will get this flag).
	364	+ // Also check the auth_blocked user_meta flag (users in blocked list will get this flag)
421	365	$unauthenticated_user_is_blocked = get_user_meta( $unauthenticated_user->ID, 'auth_blocked', true ) === 'yes';
422	366	} else {
423	367	$last_attempt = get_option( 'auth_settings_advanced_lockouts_time_last_failed' );
424	368	$num_attempts = get_option( 'auth_settings_advanced_lockouts_failed_attempts' );
		@@ -432,9 +376,9 @@
432	376	return new WP_Error( 'empty_password', __( '<strong>ERROR</strong>: Incorrect username or password.', 'authorizer' ) );
433	377	}
434	378
435	379	// Grab plugin settings.
436		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
	380	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' );
437	381
438	382	// Make sure $last_attempt (time) and $num_attempts are positive integers.
439	383	// Note: this addresses resetting them if either is unset from above.
440	384	$last_attempt = abs( intval( $last_attempt ) );
		@@ -440,17 +384,17 @@
440	384	$last_attempt = abs( intval( $last_attempt ) );
441	385	$num_attempts = abs( intval( $num_attempts ) );
442	386
443	387	// Create semantic lockout variables.
444		- $lockouts = $auth_settings['advanced_lockouts'];
445		- $time_since_last_fail = time() - $last_attempt;
446		- $reset_duration = $lockouts['reset_duration'] * 60; // minutes to seconds.
447		- $num_attempts_long_lockout = $lockouts['attempts_1'] + $lockouts['attempts_2'];
448		- $num_attempts_short_lockout = $lockouts['attempts_1'];
449		- $seconds_remaining_long_lockout = $lockouts['duration_2'] * 60 - $time_since_last_fail;
	388	+ $lockouts = $auth_settings['advanced_lockouts'];
	389	+ $time_since_last_fail = time() - $last_attempt;
	390	+ $reset_duration = $lockouts['reset_duration'] * 60; // minutes to seconds
	391	+ $num_attempts_long_lockout = $lockouts['attempts_1'] + $lockouts['attempts_2'];
	392	+ $num_attempts_short_lockout = $lockouts['attempts_1'];
	393	+ $seconds_remaining_long_lockout = $lockouts['duration_2'] * 60 - $time_since_last_fail;
450	394	$seconds_remaining_short_lockout = $lockouts['duration_1'] * 60 - $time_since_last_fail;
451	395
452		- // Check if we need to institute a lockout delay.
	396	+ // Check if we need to institute a lockout delay
453	397	if ( $is_login_attempt && $time_since_last_fail > $reset_duration ) {
454	398	// Enough time has passed since the last invalid attempt and
455	399	// now that we can reset the failed attempt count, and let this
456	400	// login attempt go through.
		@@ -463,9 +407,8 @@
463	407	remove_filter( 'authenticate', 'wp_authenticate_username_password', 20, 3 );
464	408	return new WP_Error(
465	409	'empty_password',
466	410	sprintf(
467		- /* TRANSLATORS: 1: username 2: duration of lockout in seconds 3: duration of lockout as a phrase 4: lost password URL */
468	411	__( '<strong>ERROR</strong>: There have been too many invalid login attempts for the username <strong>%1$s</strong>. Please wait <strong id="seconds_remaining" data-seconds="%2$s">%3$s</strong> before trying again. <a href="%4$s" title="Password Lost and Found">Lost your password</a>?', 'authorizer' ),
469	412	$username,
470	413	$seconds_remaining_long_lockout,
471	414	$this->seconds_as_sentence( $seconds_remaining_long_lockout ),
		@@ -480,9 +423,8 @@
480	423	remove_filter( 'authenticate', 'wp_authenticate_username_password', 20, 3 );
481	424	return new WP_Error(
482	425	'empty_password',
483	426	sprintf(
484		- /* TRANSLATORS: 1: username 2: duration of lockout in seconds 3: duration of lockout as a phrase 4: lost password URL */
485	427	__( '<strong>ERROR</strong>: There have been too many invalid login attempts for the username <strong>%1$s</strong>. Please wait <strong id="seconds_remaining" data-seconds="%2$s">%3$s</strong> before trying again. <a href="%4$s" title="Password Lost and Found">Lost your password</a>?', 'authorizer' ),
486	428	$username,
487	429	$seconds_remaining_short_lockout,
488	430	$this->seconds_as_sentence( $seconds_remaining_short_lockout ),
		@@ -492,16 +434,16 @@
492	434	}
493	435
494	436	// Start external authentication.
495	437	$externally_authenticated_emails = array();
496		- $authenticated_by = '';
497		- $result = null;
	438	+ $authenticated_by = '';
	439	+ $result = null;
498	440
499	441	// Try Google authentication if it's enabled and we don't have a
500	442	// successful login yet.
501	443	if (
502		- '1' === $auth_settings['google'] &&
503		- 0 === count( $externally_authenticated_emails ) &&
	444	+ $auth_settings['google'] === '1' &&
	445	+ count( $externally_authenticated_emails ) === 0 &&
504	446	! is_wp_error( $result )
505	447	) {
506	448	$result = $this->custom_authenticate_google( $auth_settings );
507	449	if ( ! is_null( $result ) && ! is_wp_error( $result ) ) {
		@@ -516,10 +458,10 @@
516	458
517	459	// Try CAS authentication if it's enabled and we don't have a
518	460	// successful login yet.
519	461	if (
520		- '1' === $auth_settings['cas'] &&
521		- 0 === count( $externally_authenticated_emails ) &&
	462	+ $auth_settings['cas'] === '1' &&
	463	+ count( $externally_authenticated_emails ) === 0 &&
522	464	! is_wp_error( $result )
523	465	) {
524	466	$result = $this->custom_authenticate_cas( $auth_settings );
525	467	if ( ! is_null( $result ) && ! is_wp_error( $result ) ) {
		@@ -534,10 +476,10 @@
534	476
535	477	// Try LDAP authentication if it's enabled and we don't have an
536	478	// authenticated user yet.
537	479	if (
538		- '1' === $auth_settings['ldap'] &&
539		- 0 === count( $externally_authenticated_emails ) &&
	480	+ $auth_settings['ldap'] === '1' &&
	481	+ count( $externally_authenticated_emails ) === 0 &&
540	482	! is_wp_error( $result )
541	483	) {
542	484	$result = $this->custom_authenticate_ldap( $auth_settings, $username, $password );
543	485	if ( ! is_null( $result ) && ! is_wp_error( $result ) ) {
		@@ -558,33 +500,31 @@
558	500
559	501	// Remove duplicate and blank emails, if any.
560	502	$externally_authenticated_emails = array_filter( array_unique( $externally_authenticated_emails ) );
561	503
562		- /**
563		- * If we've made it this far, we should have an externally
564		- * authenticated user. The following should be set:
565		- * $externally_authenticated_emails
566		- * $authenticated_by
567		- */
	504	+ // If we've made it this far, we should have an externally
	505	+ // authenticated user. The following should be set:
	506	+ // $externally_authenticated_emails
	507	+ // $authenticated_by
568	508
569	509	// Get the external user's WordPress account by email address.
570	510	foreach ( $externally_authenticated_emails as $externally_authenticated_email ) {
571		- $user = get_user_by( 'email', $this->lowercase( $externally_authenticated_email ) );
	511	+ $user = get_user_by( 'email', $externally_authenticated_email );
572	512
573	513	// If we've already found a WordPress user associated with one
574	514	// of the supplied email addresses, don't keep examining other
575	515	// email addresses associated with the externally authenticated user.
576		- if ( false !== $user ) {
	516	+ if ( $user !== FALSE ) {
577	517	break;
578	518	}
579	519	}
580	520
581	521	// Check this external user's access against the access lists
582		- // (pending, approved, blocked).
	522	+ // (pending, approved, blocked)
583	523	$result = $this->check_user_access( $user, $externally_authenticated_emails, $result );
584	524
585	525	// Fail with message if there was an error creating/adding the user.
586		- if ( is_wp_error( $result ) || 0 === $result ) {
	526	+ if ( is_wp_error( $result ) || $result === 0 ) {
587	527	return $result;
588	528	}
589	529
590	530	// If we created a new user in check_user_access(), log that user in.
		@@ -605,30 +545,27 @@
605	545	/**
606	546	* This function will fail with a wp_die() message to the user if they
607	547	* don't have access.
608	548	*
609		- * @param WP_User $user User to check.
610		- * @param array $user_emails Array of user's plaintext emails (in case current user doesn't have a WP account).
611		- * @param array $user_data Array of keys for email, username, first_name, last_name,
612		- * authenticated_by, google_attributes, cas_attributes, ldap_attributes.
613		- * @return WP_Error|void|null|WP_User
614		- * WP_Error if there was an error on user creation / adding user to blog.
615		- * wp_die() if user does not have access.
616		- * null if user has access (success).
617		- * WP_User if user has access and a new account was created for them.
	549	+ * @param WP_User $user User to check
	550	+ * @param [type] $user_emails Array of user's plaintext emails (in case current user doesn't have a WP account)
	551	+ * @param [type] $user_data Array of keys for email, username, first_name, last_name,
	552	+ * authenticated_by, google_attributes, cas_attributes, ldap_attributes.
	553	+ * @return WP_Error if there was an error on user creation / adding user to blog
	554	+ * wp_die() if user does not have access
	555	+ * null if user has access (success)
	556	+ * WP_User if user has access and a new account was created for them
618	557	*/
619	558	private function check_user_access( $user, $user_emails, $user_data = array() ) {
620	559	// Grab plugin settings.
621		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
622		- $auth_settings_access_users_pending = $this->sanitize_user_list(
623		- $this->get_plugin_option( 'access_users_pending', WP_Plugin_Authorizer::SINGLE_CONTEXT )
	560	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' );
	561	+ $auth_settings_access_users_pending = $this->sanitize_user_list(
	562	+ $this->get_plugin_option( 'access_users_pending', SINGLE_ADMIN )
624	563	);
625		- $auth_settings_access_users_approved_single = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT );
626		- $auth_settings_access_users_approved_multi = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT );
627		- $auth_settings_access_users_approved = $this->sanitize_user_list(
	564	+ $auth_settings_access_users_approved = $this->sanitize_user_list(
628	565	array_merge(
629		- $auth_settings_access_users_approved_single,
630		- $auth_settings_access_users_approved_multi
	566	+ $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN ),
	567	+ $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN )
631	568	)
632	569	);
633	570
634	571	/**
		@@ -637,9 +574,9 @@
637	574	*
638	575	* @param bool $allow_login Whether to block the currently logging in user.
639	576	* @param array $user_data User data returned from external service.
640	577	*/
641		- $allow_login = apply_filters( 'authorizer_allow_login', true, $user_data );
	578	+ $allow_login = apply_filters( 'authorizer_allow_login', true, $user_data );
642	579	$blocked_by_filter = ! $allow_login; // Use this for better readability.
643	580
644	581	// Check our externally authenticated user against the block list.
645	582	// If any of their email addresses are blocked, set the relevant user
		@@ -649,16 +586,14 @@
649	586
650	587	// Add user to blocked list if it was blocked via the filter.
651	588	if ( $blocked_by_filter && ! $this->is_email_in_list( $user_email, 'blocked' ) ) {
652	589	$auth_settings_access_users_blocked = $this->sanitize_user_list(
653		- $this->get_plugin_option( 'access_users_blocked', WP_Plugin_Authorizer::SINGLE_CONTEXT )
	590	+ $this->get_plugin_option( 'access_users_blocked', SINGLE_ADMIN )
654	591	);
655		- array_push(
656		- $auth_settings_access_users_blocked, array(
657		- 'email' => $this->lowercase( $user_email ),
658		- 'date_added' => date( 'M Y' ),
659		- )
660		- );
	592	+ array_push( $auth_settings_access_users_blocked, array(
	593	+ 'email' => $user_email,
	594	+ 'date_added' => date( 'M Y' ),
	595	+ ));
661	596	update_option( 'auth_settings_access_users_blocked', $auth_settings_access_users_blocked );
662	597	}
663	598
664	599	// If the blocked external user has a WordPress account, mark it as
		@@ -667,11 +602,10 @@
667	602	update_user_meta( $user->ID, 'auth_blocked', 'yes' );
668	603	}
669	604
670	605	// Notify user about blocked status and return without authenticating them.
671		- // phpcs:ignore WordPress.CSRF.NonceVerification.NoNonceVerification
672		- $redirect_to = ! empty( $_REQUEST['redirect_to'] ) ? esc_url_raw( wp_unslash( $_REQUEST['redirect_to'] ) ) : home_url();
673		- $page_title = sprintf(
	606	+ $redirect_to = ! empty( $_REQUEST['redirect_to'] ) ? $_REQUEST['redirect_to'] : home_url();
	607	+ $page_title = sprintf(
674	608	/* TRANSLATORS: %s: Name of blog */
675	609	__( '%s - Access Restricted', 'authorizer' ),
676	610	get_bloginfo( 'name' )
677	611	);
		@@ -682,14 +616,13 @@
682	616	'<a class="button" href="' . wp_logout_url( $redirect_to ) . '">' .
683	617	__( 'Back', 'authorizer' ) .
684	618	'</a></p>';
685	619	update_option( 'auth_settings_advanced_login_error', $error_message );
686		- wp_die( wp_kses( $error_message, $this->allowed_html ), esc_html( $page_title ) );
	620	+ wp_die( $error_message, $page_title );
687	621	}
688	622	}
689	623
690		- // Get the default role for this user (or their current role, if they
691		- // already have an account).
	624	+ // Get the default role for this new user.
692	625	$default_role = $user && is_array( $user->roles ) && count( $user->roles ) > 0 ? $user->roles[0] : $auth_settings['access_default_role'];
693	626	/**
694	627	* Filter the role of the user currently logging in. The role will be
695	628	* set to the default (specified in Authorizer options) for new users,
		@@ -694,9 +627,8 @@
694	627	* Filter the role of the user currently logging in. The role will be
695	628	* set to the default (specified in Authorizer options) for new users,
696	629	* or the user's current role for existing users. This filter allows
697	630	* changing user roles based on custom CAS/LDAP attributes.
698		- *
699	631	* @param bool $role Role of the user currently logging in.
700	632	* @param array $user_data User data returned from external service.
701	633	*/
702	634	$approved_role = apply_filters( 'authorizer_custom_role', $default_role, $user_data );
		@@ -729,12 +661,14 @@
729	661	// and login access is set to "All authenticated users," or if they were
730	662	// automatically approved in the "authorizer_approve_login" filter
731	663	// above, then add them to the approved list (they'll get an account
732	664	// created below if they don't have one yet).
733		- if (
	665	+ if ( (
734	666	! $this->is_email_in_list( $user_email, 'approved' ) &&
735		- ( 'external_users' === $auth_settings['access_who_can_login'] || $automatically_approve_login )
736		- ) {
	667	+ $auth_settings['access_who_can_login'] === 'external_users'
	668	+ ) || (
	669	+ $automatically_approve_login
	670	+ ) ) {
737	671	$is_newly_approved_user = true;
738	672
739	673	// If this user happens to be in the pending list (rare),
740	674	// remove them from pending before adding them to approved.
		@@ -739,9 +673,9 @@
739	673	// If this user happens to be in the pending list (rare),
740	674	// remove them from pending before adding them to approved.
741	675	if ( $this->is_email_in_list( $user_email, 'pending' ) ) {
742	676	foreach ( $auth_settings_access_users_pending as $key => $pending_user ) {
743		- if ( 0 === strcasecmp( $pending_user['email'], $user_email ) ) {
	677	+ if ( $pending_user['email'] === $user_email ) {
744	678	unset( $auth_settings_access_users_pending[ $key ] );
745	679	update_option( 'auth_settings_access_users_pending', $auth_settings_access_users_pending );
746	680	break;
747	681	}
		@@ -749,15 +683,14 @@
749	683	}
750	684
751	685	// Add this user to the approved list.
752	686	$approved_user = array(
753		- 'email' => $this->lowercase( $user_email ),
754		- 'role' => $approved_role,
755		- 'date_added' => date( 'Y-m-d H:i:s' ),
	687	+ 'email' => $user_email,
	688	+ 'role' => $approved_role,
	689	+ 'date_added' => date( "Y-m-d H:i:s" ),
756	690	);
757	691	array_push( $auth_settings_access_users_approved, $approved_user );
758		- array_push( $auth_settings_access_users_approved_single, $approved_user );
759		- update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved_single );
	692	+ update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved );
760	693	}
761	694
762	695	// Check our externally authenticated user against the approved
763	696	// list. If they are approved, log them in (and create their account
		@@ -771,9 +704,9 @@
771	704	if ( $default_role !== $approved_role ) {
772	705	$user_info['role'] = $approved_role;
773	706	}
774	707
775		- // If the approved external user does not have a WordPress account, create it.
	708	+ // If the approved external user does not have a WordPress account, create it
776	709	if ( ! $user ) {
777	710	// If there's already a user with this username (e.g.,
778	711	// johndoe/johndoe@gmail.com exists, and we're trying to add
779	712	// johndoe/johndoe@example.com), use the full email address
		@@ -788,47 +721,26 @@
788	721	$username = $user_info['email'];
789	722	}
790	723	$result = wp_insert_user(
791	724	array(
792		- 'user_login' => strtolower( $username ),
793		- 'user_pass' => wp_generate_password(), // random password.
794		- 'first_name' => array_key_exists( 'first_name', $user_data ) ? $user_data['first_name'] : '',
795		- 'last_name' => array_key_exists( 'last_name', $user_data ) ? $user_data['last_name'] : '',
796		- 'user_email' => $this->lowercase( $user_info['email'] ),
	725	+ 'user_login' => strtolower( $username ),
	726	+ 'user_pass' => wp_generate_password(), // random password
	727	+ 'first_name' => array_key_exists( 'first_name', $user_data ) ? $user_data['first_name'] : '',
	728	+ 'last_name' => array_key_exists( 'last_name', $user_data ) ? $user_data['last_name'] : '',
	729	+ 'user_email' => strtolower( $user_info['email'] ),
797	730	'user_registered' => date( 'Y-m-d H:i:s' ),
798		- 'role' => $user_info['role'],
	731	+ 'role' => $user_info['role'],
799	732	)
800	733	);
801	734
802	735	// Fail with message if error.
803		- if ( is_wp_error( $result ) || 0 === $result ) {
	736	+ if ( is_wp_error( $result ) || $result === 0 ) {
804	737	return $result;
805	738	}
806	739
807		- // Authenticate as new user.
	740	+ // Authenticate as new user
808	741	$user = new WP_User( $result );
809	742
810		- /**
811		- * Fires after an external user is authenticated for the first time
812		- * and a new WordPress account is created for them.
813		- *
814		- * @since 2.8.0
815		- *
816		- * @param WP_User $user User object.
817		- * @param array $user_data User data from external service.
818		- *
819		- * Example $user_data:
820		- * array(
821		- * 'email' => 'user@example.edu',
822		- * 'username' => 'user',
823		- * 'first_name' => 'First',
824		- * 'last_name' => 'Last',
825		- * 'authenticated_by' => 'cas',
826		- * 'cas_attributes' => array( ... ),
827		- * );
828		- */
829		- do_action( 'authorizer_user_register', $user, $user_data );
830		-
831	743	// If multisite, iterate through all sites in the network and add the user
832	744	// currently logging in to any of them that have the user on the approved list.
833	745	// Note: this is useful for first-time logins--some users will have access
834	746	// to multiple sites, and this prevents them from having to log into each
		@@ -834,21 +746,18 @@
834	746	// to multiple sites, and this prevents them from having to log into each
835	747	// site individually to get access.
836	748	if ( is_multisite() ) {
837	749	$site_ids_of_user = array_map(
838		- function ( $site_of_user ) {
839		- return intval( $site_of_user->userblog_id );
840		- },
	750	+ function ( $site_of_user ) { return $site_of_user->userblog_id; },
841	751	get_blogs_of_user( $user->ID )
842	752	);
843	753
844		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
845	754	$sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
846	755	foreach ( $sites as $site ) {
847	756	$blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
848	757
849	758	// Skip if user is already added to this site.
850		- if ( in_array( intval( $blog_id ), $site_ids_of_user, true ) ) {
	759	+ if ( in_array( $blog_id, $site_ids_of_user ) ) {
851	760	continue;
852	761	}
853	762
854	763	// Check if user is on the approved list of this site they are not added to.
		@@ -874,9 +783,9 @@
874	783	if ( $meta_key === $user_info['usermeta']['meta_key'] ) {
875	784	// Update user's usermeta value for usermeta key stored in authorizer options.
876	785	if ( strpos( $meta_key, 'acf___' ) === 0 && class_exists( 'acf' ) ) {
877	786	// We have an ACF field value, so use the ACF function to update it.
878		- update_field( str_replace( 'acf___', '', $meta_key ), $user_info['usermeta']['meta_value'], 'user_' . $user->ID );
	787	+ update_field( str_replace('acf___', '', $meta_key ), $user_info['usermeta']['meta_value'], 'user_' . $user->ID );
879	788	} else {
880	789	// We have a normal usermeta value, so just update it via the WordPress function.
881	790	update_user_meta( $user->ID, $meta_key, $user_info['usermeta']['meta_value'] );
882	791	}
		@@ -892,9 +801,9 @@
892	801	switch_to_blog( $blog_id );
893	802	// Update user's usermeta value for usermeta key stored in authorizer options.
894	803	if ( strpos( $meta_key, 'acf___' ) === 0 && class_exists( 'acf' ) ) {
895	804	// We have an ACF field value, so use the ACF function to update it.
896		- update_field( str_replace( 'acf___', '', $meta_key ), $usermeta['meta_value'], 'user_' . $user->ID );
	805	+ update_field( str_replace('acf___', '', $meta_key ), $usermeta['meta_value'], 'user_' . $user->ID );
897	806	} else {
898	807	// We have a normal usermeta value, so just update it via the WordPress function.
899	808	update_user_meta( $user->ID, $meta_key, $usermeta['meta_value'] );
900	809	}
		@@ -905,24 +814,20 @@
905	814	}
906	815	} else {
907	816	// Update first/last names of WordPress user from external
908	817	// service if that option is set.
909		- if ( ( array_key_exists( 'authenticated_by', $user_data ) && 'cas' === $user_data['authenticated_by'] && array_key_exists( 'cas_attr_update_on_login', $auth_settings ) && 1 === intval( $auth_settings['cas_attr_update_on_login'] ) ) || ( array_key_exists( 'authenticated_by', $user_data ) && 'ldap' === $user_data['authenticated_by'] && array_key_exists( 'ldap_attr_update_on_login', $auth_settings ) && 1 === intval( $auth_settings['ldap_attr_update_on_login'] ) ) ) {
910		- if ( array_key_exists( 'first_name', $user_data ) && 0 < strlen( $user_data['first_name'] ) ) {
911		- wp_update_user(
912		- array(
913		- 'ID' => $user->ID,
914		- 'first_name' => $user_data['first_name'],
915		- )
916		- );
	818	+ if ( ( array_key_exists( 'authenticated_by', $user_data ) && $user_data['authenticated_by'] === 'cas' && array_key_exists( 'cas_attr_update_on_login', $auth_settings ) && $auth_settings['cas_attr_update_on_login'] == 1 ) || ( array_key_exists( 'authenticated_by', $user_data ) && $user_data['authenticated_by'] === 'ldap' && array_key_exists( 'ldap_attr_update_on_login', $auth_settings ) && $auth_settings['ldap_attr_update_on_login'] == 1 ) ) {
	819	+ if ( array_key_exists( 'first_name', $user_data ) && strlen( $user_data['first_name'] ) > 0 ) {
	820	+ wp_update_user( array(
	821	+ 'ID' => $user->ID,
	822	+ 'first_name' => $user_data['first_name'],
	823	+ ));
917	824	}
918	825	if ( array_key_exists( 'last_name', $user_data ) && strlen( $user_data['last_name'] ) > 0 ) {
919		- wp_update_user(
920		- array(
921		- 'ID' => $user->ID,
922		- 'last_name' => $user_data['last_name'],
923		- )
924		- );
	826	+ wp_update_user( array(
	827	+ 'ID' => $user->ID,
	828	+ 'last_name' => $user_data['last_name'],
	829	+ ));
925	830	}
926	831	}
927	832
928	833	// Update this user's role if it was modified in the
		@@ -927,19 +832,12 @@
927	832
928	833	// Update this user's role if it was modified in the
929	834	// authorizer_custom_role filter.
930	835	if ( $default_role !== $approved_role ) {
931		- // Update user's role in WordPress.
932		- $user->set_role( $approved_role );
933		-
934		- // Update user's role in this site's approved list and save.
935		- foreach ( $auth_settings_access_users_approved_single as $key => $existing_user ) {
936		- if ( 0 === strcasecmp( $user->user_email, $existing_user['email'] ) ) {
937		- $auth_settings_access_users_approved_single[ $key ]['role'] = $approved_role;
938		- break;
939		- }
940		- }
941		- update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved_single );
	836	+ wp_update_user( array(
	837	+ 'ID' => $user->ID,
	838	+ 'role' => $approved_role,
	839	+ ));
942	840	}
943	841	}
944	842
945	843	// If this is multisite, add new user to current blog.
		@@ -952,34 +850,33 @@
952	850	}
953	851	}
954	852
955	853	// Ensure user has the same role as their entry in the approved list.
956		- if ( $user_info && ! in_array( $user_info['role'], $user->roles, true ) ) {
	854	+ // (This is just a precaution, the role should already be set when
	855	+ // saving admin options in the sanitizing function.)
	856	+ if ( $user_info && ! array_key_exists( $user_info['role'], $user->roles ) ) {
957	857	$user->set_role( $user_info['role'] );
958	858	}
959	859
960	860	return $user;
961	861
962		- } elseif ( 0 === strcasecmp( $user_email, $last_email ) ) {
963		- /**
964		- * Note: only do this for the last email address we are checking (we need
965		- * to iterate through them all to make sure one of them isn't approved).
966		- */
967		-
	862	+ // Note: only do this for the last email address we are checking (we need
	863	+ // to iterate through them all to make sure one of them isn't approved).
	864	+ } elseif ( $user_email === $last_email ) {
968	865	// User isn't an admin, is not blocked, and is not approved.
969	866	// Add them to the pending list and notify them and their instructor.
970	867	if ( strlen( $user_email ) > 0 && ! $this->is_email_in_list( $user_email, 'pending' ) ) {
971		- $pending_user = array();
972		- $pending_user['email'] = $this->lowercase( $user_email );
973		- $pending_user['role'] = $approved_role;
	868	+ $pending_user = array();
	869	+ $pending_user['email'] = $user_email;
	870	+ $pending_user['role'] = $approved_role;
974	871	$pending_user['date_added'] = '';
975	872	array_push( $auth_settings_access_users_pending, $pending_user );
976	873	update_option( 'auth_settings_access_users_pending', $auth_settings_access_users_pending );
977	874
978	875	// Create strings used in the email notification.
979		- $site_name = get_bloginfo( 'name' );
980		- $site_url = get_bloginfo( 'url' );
981		- $authorizer_options_url = 'settings' === $auth_settings['advanced_admin_menu'] ? admin_url( 'options-general.php?page=authorizer' ) : admin_url( '?page=authorizer' );
	876	+ $site_name = get_bloginfo( 'name' );
	877	+ $site_url = get_bloginfo( 'url' );
	878	+ $authorizer_options_url = $auth_settings['advanced_admin_menu'] === 'settings' ? admin_url( 'options-general.php?page=authorizer' ) : admin_url( '?page=authorizer' );
982	879
983	880	// Notify users with the role specified in "Which role should
984	881	// receive email notifications about pending users?".
985	882	if ( strlen( $auth_settings['access_role_receive_pending_emails'] ) > 0 ) {
		@@ -1004,11 +901,10 @@
1004	901	}
1005	902	}
1006	903
1007	904	// Notify user about pending status and return without authenticating them.
1008		- // phpcs:ignore WordPress.CSRF.NonceVerification.NoNonceVerification
1009		- $redirect_to = ! empty( $_REQUEST['redirect_to'] ) ? esc_url_raw( wp_unslash( $_REQUEST['redirect_to'] ) ) : home_url();
1010		- $page_title = get_bloginfo( 'name' ) . ' - Access Pending';
	905	+ $redirect_to = ! empty( $_REQUEST['redirect_to'] ) ? $_REQUEST['redirect_to'] : home_url();
	906	+ $page_title = get_bloginfo( 'name' ) . ' - Access Pending';
1011	907	$error_message =
1012	908	apply_filters( 'the_content', $auth_settings['access_pending_redirect_to_message'] ) .
1013	909	'<hr />' .
1014	910	'<p style="text-align: center;">' .
		@@ -1015,9 +911,9 @@
1015	911	'<a class="button" href="' . wp_logout_url( $redirect_to ) . '">' .
1016	912	__( 'Back', 'authorizer' ) .
1017	913	'</a></p>';
1018	914	update_option( 'auth_settings_advanced_login_error', $error_message );
1019		- wp_die( wp_kses( $error_message, $this->allowed_html ), esc_html( $page_title ) );
	915	+ wp_die( $error_message, $page_title );
1020	916	}
1021	917	}
1022	918
1023	919	// Sanity check: if we made it here without returning, something has gone wrong.
		@@ -1040,34 +936,24 @@
1040	936	* custom_authenticate_google() runs to verify the token; once verified
1041	937	* custom_authenticate proceeds as normal with the google email address
1042	938	* as a successfully authenticated external user.
1043	939	*
1044		- * Action: wp_ajax_process_google_login
1045		- * Action: wp_ajax_nopriv_process_google_login
1046		- *
1047		- * @return void, but die with the value to return to the success() function in AJAX call signInCallback().
	940	+ * @return void, but die with the value to return to the success() function in AJAX call signInCallback()
1048	941	*/
1049		- public function ajax_process_google_login() {
	942	+ function ajax_process_google_login() {
	943	+ $nonce = array_key_exists( 'nonce', $_POST ) ? $_POST['nonce'] : '';
	944	+ $code = array_key_exists( 'code', $_POST ) ? $_POST['code'] : null;
	945	+
1050	946	// Nonce check.
1051		- if (
1052		- ! isset( $_POST['nonce'] ) ||
1053		- ! wp_verify_nonce( sanitize_key( $_POST['nonce'] ), 'google_csrf_nonce' )
1054		- ) {
1055		- die( '' );
	947	+ if ( ! wp_verify_nonce( $nonce, 'google_csrf_nonce' ) ) {
	948	+ return '';
1056	949	}
1057	950
1058		- // Google authentication token.
1059		- // phpcs:ignore WordPress.VIP.ValidatedSanitizedInput.InputNotSanitized
1060		- $code = isset( $_POST['code'] ) ? wp_unslash( $_POST['code'] ) : null;
1061		-
1062	951	// Grab plugin settings.
1063		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
	952	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' );
1064	953
1065		- /**
1066		- * Add Google API PHP Client.
1067		- *
1068		- * @see https://github.com/google/google-api-php-client branch:v1-master
1069		- */
	954	+ // Add Google API PHP Client.
	955	+ // @see https://github.com/google/google-api-php-client branch:v1-master
1070	956	require_once dirname( __FILE__ ) . '/vendor/google-api-php-client/src/Google/autoload.php';
1071	957
1072	958	// Build the Google Client.
1073	959	$client = new Google_Client();
		@@ -1075,26 +961,19 @@
1075	961	$client->setClientId( $auth_settings['google_clientid'] );
1076	962	$client->setClientSecret( $auth_settings['google_clientsecret'] );
1077	963	$client->setRedirectUri( 'postmessage' );
1078	964
1079		- /**
1080		- * If the hosted domain parameter is set, restrict logins to that domain.
1081		- *
1082		- * Note: Will have to upgrade to google-api-php-client v2 or higher for
1083		- * this to function server-side; it's not complete in v1, so this check
1084		- * is performed manually below.
1085		- *
1086		- * if (
1087		- * array_key_exists( 'google_hosteddomain', $auth_settings ) &&
1088		- * strlen( $auth_settings['google_hosteddomain'] ) > 0
1089		- * ) {
1090		- * $google_hosteddomains = explode( "\n", str_replace( "\r", '', $auth_settings['google_hosteddomain'] ) );
1091		- * $google_hosteddomain = trim( $google_hosteddomains[0] );
1092		- * $client->setHostedDomain( $google_hosteddomain );
1093		- * }
1094		- */
	965	+ // If the hosted domain parameter is set, restrict logins to that domain.
	966	+ // Note: Will have to upgrade to google-api-php-client v2 or higher for
	967	+ // this to function server-side; it's not complete in v1, so this check
	968	+ // is performed manually below.
	969	+ // if ( array_key_exists( 'google_hosteddomain', $auth_settings ) && strlen( $auth_settings['google_hosteddomain'] ) > 0 ) {
	970	+ // $google_hosteddomains = explode( "\n", str_replace( "\r", '', $auth_settings['google_hosteddomain'] ) );
	971	+ // $google_hosteddomain = trim( $google_hosteddomains[0] );
	972	+ // $client->setHostedDomain( $google_hosteddomain );
	973	+ // }
1095	974
1096		- // Get one time use token (if it doesn't exist, we'll create one below).
	975	+ // Get one time use token (if it doesn't exist, we'll create one below)
1097	976	session_start();
1098	977	$token = array_key_exists( 'token', $_SESSION ) ? json_decode( $_SESSION['token'] ) : null;
1099	978
1100	979	if ( empty( $token ) ) {
		@@ -1102,18 +981,18 @@
1102	981	$client->authenticate( $code );
1103	982	$token = json_decode( $client->getAccessToken() );
1104	983
1105	984	// Store the token in the session for later use.
1106		- $_SESSION['token'] = wp_json_encode( $token );
	985	+ $_SESSION['token'] = json_encode( $token );
1107	986
1108		- $response = 'Successfully authenticated.';
	987	+ $response = "Successfully authenticated.";
1109	988	} else {
1110		- $client->setAccessToken( wp_json_encode( $token ) );
	989	+ $client->setAccessToken( json_encode( $token ) );
1111	990
1112	991	$response = 'Already authenticated.';
1113	992	}
1114	993
1115		- die( esc_html( $response ) );
	994	+ die( $response );
1116	995	}
1117	996
1118	997
1119	998	/**
		@@ -1118,22 +997,22 @@
1118	997
1119	998	/**
1120	999	* Validate this user's credentials against Google.
1121	1000	*
1122		- * @param array $auth_settings Plugin settings.
1123		- * @return array|WP_Error Array containing email, authenticated_by, first_name,
1124		- * last_name, and username strings for the successfully
1125		- * authenticated user, or WP_Error() object on failure,
1126		- * or null if not attempting a google login.
	1001	+ * @param array $auth_settings Plugin settings
	1002	+ * @return [mixed] Array containing email, authenticated_by,
	1003	+ * first_name, last_name, and username
	1004	+ * strings for the successfully authenticated
	1005	+ * user, or WP_Error() object on failure,
	1006	+ * or null if not attempting a google login.
1127	1007	*/
1128	1008	private function custom_authenticate_google( $auth_settings ) {
1129	1009	// Move on if Google auth hasn't been requested here.
1130		- // phpcs:ignore WordPress.CSRF.NonceVerification.NoNonceVerification
1131		- if ( empty( $_GET['external'] ) || 'google' !== $_GET['external'] ) {
	1010	+ if ( empty( $_GET['external'] ) || $_GET['external'] !== 'google' ) {
1132	1011	return null;
1133	1012	}
1134	1013
1135		- // Get one time use token.
	1014	+ // Get one time use token
1136	1015	session_start();
1137	1016	$token = array_key_exists( 'token', $_SESSION ) ? json_decode( $_SESSION['token'] ) : null;
1138	1017
1139	1018	// No token, so this is not a succesful Google login.
		@@ -1140,13 +1019,10 @@
1140	1019	if ( is_null( $token ) ) {
1141	1020	return null;
1142	1021	}
1143	1022
1144		- /**
1145		- * Add Google API PHP Client.
1146		- *
1147		- * @see https://github.com/google/google-api-php-client branch:v1-master
1148		- */
	1023	+ // Add Google API PHP Client.
	1024	+ // @see https://github.com/google/google-api-php-client branch:v1-master
1149	1025	require_once dirname( __FILE__ ) . '/vendor/google-api-php-client/src/Google/autoload.php';
1150	1026
1151	1027	// Build the Google Client.
1152	1028	$client = new Google_Client();
		@@ -1154,24 +1030,19 @@
1154	1030	$client->setClientId( $auth_settings['google_clientid'] );
1155	1031	$client->setClientSecret( $auth_settings['google_clientsecret'] );
1156	1032	$client->setRedirectUri( 'postmessage' );
1157	1033
1158		- /**
1159		- * If the hosted domain parameter is set, restrict logins to that domain.
1160		- * Note: Will have to upgrade to google-api-php-client v2 or higher for
1161		- * this to function server-side; it's not complete in v1, so this check
1162		- * is performed manually later.
1163		- * if (
1164		- * array_key_exists( 'google_hosteddomain', $auth_settings ) &&
1165		- * strlen( $auth_settings['google_hosteddomain'] ) > 0
1166		- * ) {
1167		- * $google_hosteddomains = explode( "\n", str_replace( "\r", '', $auth_settings['google_hosteddomain'] ) );
1168		- * $google_hosteddomain = trim( $google_hosteddomains[0] );
1169		- * $client->setHostedDomain( $google_hosteddomain );
1170		- * }
1171		- */
	1034	+ // If the hosted domain parameter is set, restrict logins to that domain.
	1035	+ // Note: Will have to upgrade to google-api-php-client v2 or higher for
	1036	+ // this to function server-side; it's not complete in v1, so this check
	1037	+ // is performed manually below.
	1038	+ // if ( array_key_exists( 'google_hosteddomain', $auth_settings ) && strlen( $auth_settings['google_hosteddomain'] ) > 0 ) {
	1039	+ // $google_hosteddomains = explode( "\n", str_replace( "\r", '', $auth_settings['google_hosteddomain'] ) );
	1040	+ // $google_hosteddomain = trim( $google_hosteddomains[0] );
	1041	+ // $client->setHostedDomain( $google_hosteddomain );
	1042	+ // }
1172	1043
1173		- // Verify this is a successful Google authentication.
	1044	+ // Verify this is a successful Google authentication
1174	1045	try {
1175	1046	$ticket = $client->verifyIdToken( $token->id_token, $auth_settings['google_clientid'] );
1176	1047	} catch ( Google_Auth_Exception $e ) {
1177	1048	// Invalid ticket, so this in not a successful Google login.
		@@ -1182,29 +1053,25 @@
1182	1053	if ( ! $ticket ) {
1183	1054	return new WP_Error( 'invalid_google_login', __( 'Invalid Google credentials provided.', 'authorizer' ) );
1184	1055	}
1185	1056
1186		- // Get email address.
1187		- $attributes = $ticket->getAttributes();
1188		- $email = $this->lowercase( $attributes['payload']['email'] );
	1057	+ // Get email address
	1058	+ $attributes = $ticket->getAttributes();
	1059	+ $email = $attributes['payload']['email'];
1189	1060	$email_domain = substr( strrchr( $email, '@' ), 1 );
1190		- $username = current( explode( '@', $email ) );
	1061	+ $username = current( explode( '@', $email ) );
1191	1062
1192		- /**
1193		- * Fail if hd param is set and the logging in user's email address doesn't
1194		- * match the allowed hosted domain.
1195		- *
1196		- * See: https://developers.google.com/identity/protocols/OpenIDConnect#hd-param
1197		- * See: https://github.com/google/google-api-php-client/blob/v1-master/src/Google/Client.php#L407-L416
1198		- *
1199		- * Note: Will have to upgrade to google-api-php-client v2 or higher for
1200		- * this to function server-side; it's not complete in v1, so this check
1201		- * is only performed here.
1202		- */
	1063	+ // Fail if hd param is set and the logging in user's email address doesn't
	1064	+ // match the allowed hosted domain.
	1065	+ // See: https://developers.google.com/identity/protocols/OpenIDConnect#hd-param
	1066	+ // See: https://github.com/google/google-api-php-client/blob/v1-master/src/Google/Client.php#L407-L416
	1067	+ // Note: Will have to upgrade to google-api-php-client v2 or higher for
	1068	+ // this to function server-side; it's not complete in v1, so this check
	1069	+ // is only performed here.
1203	1070	if ( array_key_exists( 'google_hosteddomain', $auth_settings ) && strlen( $auth_settings['google_hosteddomain'] ) > 0 ) {
1204	1071	// Allow multiple whitelisted domains.
1205	1072	$google_hosteddomains = explode( "\n", str_replace( "\r", '', $auth_settings['google_hosteddomain'] ) );
1206		- if ( ! in_array( $email_domain, $google_hosteddomains, true ) ) {
	1073	+ if ( ! in_array( $email_domain, $google_hosteddomains ) ) {
1207	1074	$this->custom_logout();
1208	1075	return new WP_Error( 'invalid_google_login', __( 'Google credentials do not match the allowed hosted domain', 'authorizer' ) );
1209	1076	}
1210	1077	}
		@@ -1209,13 +1076,13 @@
1209	1076	}
1210	1077	}
1211	1078
1212	1079	return array(
1213		- 'email' => $email,
1214		- 'username' => $username,
1215		- 'first_name' => '',
1216		- 'last_name' => '',
1217		- 'authenticated_by' => 'google',
	1080	+ 'email' => $email,
	1081	+ 'username' => $username,
	1082	+ 'first_name' => '',
	1083	+ 'last_name' => '',
	1084	+ 'authenticated_by' => 'google',
1218	1085	'google_attributes' => $attributes,
1219	1086	);
1220	1087	}
1221	1088
		@@ -1222,47 +1089,40 @@
1222	1089
1223	1090	/**
1224	1091	* Validate this user's credentials against CAS.
1225	1092	*
1226		- * @param array $auth_settings Plugin settings.
1227		- * @return array|WP_Error Array containing 'email' and 'authenticated_by' strings
1228		- * for the successfully authenticated user, or WP_Error()
1229		- * object on failure, or null if not attempting a CAS login.
	1093	+ * @param array $auth_settings Plugin settings
	1094	+ * @return [mixed] Array containing 'email' and 'authenticated_by'
	1095	+ * strings for the successfully authenticated
	1096	+ * user, or WP_Error() object on failure,
	1097	+ * or null if not attempting a CAS login.
1230	1098	*/
1231	1099	private function custom_authenticate_cas( $auth_settings ) {
1232	1100	// Move on if CAS hasn't been requested here.
1233		- // phpcs:ignore WordPress.CSRF.NonceVerification.NoNonceVerification
1234		- if ( empty( $_GET['external'] ) || 'cas' !== $_GET['external'] ) {
	1101	+ if ( empty( $_GET['external'] ) || $_GET['external'] !== 'cas' ) {
1235	1102	return null;
1236	1103	}
1237	1104
1238		- /**
1239		- * Get the CAS server version (default to SAML_VERSION_1_1).
1240		- *
1241		- * @see: https://developer.jasig.org/cas-clients/php/1.3.4/docs/api/group__public.html
1242		- */
	1105	+ // Get the CAS server version (default to SAML_VERSION_1_1).
	1106	+ // See: https://developer.jasig.org/cas-clients/php/1.3.4/docs/api/group__public.html
1243	1107	$cas_version = SAML_VERSION_1_1;
1244		- if ( 'CAS_VERSION_3_0' === $auth_settings['cas_version'] ) {
	1108	+ if ( $auth_settings['cas_version'] === 'CAS_VERSION_3_0' ) {
1245	1109	$cas_version = CAS_VERSION_3_0;
1246		- } elseif ( 'CAS_VERSION_2_0' === $auth_settings['cas_version'] ) {
	1110	+ } elseif ( $auth_settings['cas_version'] === 'CAS_VERSION_2_0' ) {
1247	1111	$cas_version = CAS_VERSION_2_0;
1248		- } elseif ( 'CAS_VERSION_1_0' === $auth_settings['cas_version'] ) {
	1112	+ } elseif ( $auth_settings['cas_version'] === 'CAS_VERSION_1_0' ) {
1249	1113	$cas_version = CAS_VERSION_1_0;
1250	1114	}
1251	1115
1252		- // Set the CAS client configuration.
	1116	+ // Set the CAS client configuration
1253	1117	phpCAS::client( $cas_version, $auth_settings['cas_host'], intval( $auth_settings['cas_port'] ), $auth_settings['cas_path'] );
1254	1118
1255		- // Allow redirects at the CAS server endpoint (e.g., allow connections
1256		- // at an old CAS URL that redirects to a newer CAS URL).
1257		- phpCAS::setExtraCurlOption( CURLOPT_FOLLOWLOCATION, true );
1258		-
1259	1119	// Update server certificate bundle if it doesn't exist or is older
1260	1120	// than 6 months, then use it to ensure CAS server is legitimate.
1261	1121	// Note: only try to update if the system has the php_openssl extension.
1262		- $cacert_url = 'https://curl.haxx.se/ca/cacert.pem';
1263		- $cacert_path = plugin_dir_path( __FILE__ ) . 'vendor/cacert.pem';
1264		- $time_180_days = 180 * 24 * 60 * 60; // days * hours * minutes * seconds.
	1122	+ $cacert_url = 'https://curl.haxx.se/ca/cacert.pem';
	1123	+ $cacert_path = plugin_dir_path( __FILE__ ) . 'vendor/cacert.pem';
	1124	+ $time_180_days = 180 * 24 * 60 * 60; // days * hours * minutes * seconds
1265	1125	$time_180_days_ago = time() - $time_180_days;
1266	1126	if (
1267	1127	extension_loaded( 'openssl' ) &&
1268	1128	( ! file_exists( $cacert_path ) || filemtime( $cacert_path ) < $time_180_days_ago )
		@@ -1278,34 +1138,28 @@
1278	1138	}
1279	1139	$cacert_contents = $response['body'];
1280	1140
1281	1141	// Write out the updated certs to the plugin directory.
1282		- // Note: Don't use WP_Filesystem because we are not in an admin context
1283		- // and don't want to potentially prompt the end user for credentials.
1284		- // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_read_file_put_contents
1285	1142	file_put_contents( $cacert_path, $cacert_contents );
1286	1143	}
1287	1144	phpCAS::setCasServerCACert( $cacert_path );
1288	1145
1289	1146	// Set the CAS service URL (including the redirect URL for WordPress when it comes back from CAS).
1290		- $cas_service_url = site_url( '/wp-login.php?external=cas' );
1291		- $login_querystring = array();
1292		- if ( isset( $_SERVER['QUERY_STRING'] ) ) {
1293		- parse_str( $_SERVER['QUERY_STRING'], $login_querystring ); // phpcs:ignore WordPress.VIP.ValidatedSanitizedInput
1294		- }
	1147	+ $cas_service_url = site_url( '/wp-login.php?external=cas' );
	1148	+ $login_querystring = array(); parse_str( $_SERVER['QUERY_STRING'], $login_querystring );
1295	1149	if ( isset( $login_querystring['redirect_to'] ) ) {
1296		- $cas_service_url .= '&redirect_to=' . rawurlencode( $login_querystring['redirect_to'] );
	1150	+ $cas_service_url .= '&redirect_to=' . urlencode( $login_querystring['redirect_to'] );
1297	1151	}
1298	1152	phpCAS::setFixedServiceURL( $cas_service_url );
1299	1153
1300		- // Authenticate against CAS.
	1154	+ // Authenticate against CAS
1301	1155	try {
1302	1156	phpCAS::forceAuthentication();
1303	1157	} catch ( CAS_AuthenticationException $e ) {
1304	1158	// CAS server threw an error in isAuthenticated(), potentially because
1305	1159	// the cached ticket is outdated. Try renewing the authentication.
1306		- error_log( __( 'CAS server returned an Authentication Exception. Details:', 'authorizer' ) ); // phpcs:ignore
1307		- error_log( print_r( $e, true ) ); // phpcs:ignore
	1160	+ error_log( __( 'CAS server returned an Authentication Exception. Details:', 'authorizer' ) );
	1161	+ error_log( print_r( $e, true ) );
1308	1162
1309	1163	// CAS server is throwing errors on this login, so try logging the
1310	1164	// user out of CAS and redirecting them to the login page.
1311	1165	phpCAS::logoutWithRedirectService( wp_login_url() );
		@@ -1320,10 +1174,10 @@
1320	1174	if ( ! filter_var( $externally_authenticated_email, FILTER_VALIDATE_EMAIL ) ) {
1321	1175	// If we can't get the user's email address from a CAS attribute,
1322	1176	// try to guess the domain from the CAS server hostname. This will only
1323	1177	// be used if we can't discover the email address from CAS attributes.
1324		- $domain_guess = preg_match( '/[^.]*\.[^.]*$/', $auth_settings['cas_host'], $matches ) === 1 ? $matches[0] : '';
1325		- $externally_authenticated_email = $this->lowercase( $username ) . '@' . $domain_guess;
	1178	+ $domain_guess = preg_match( '/[^.]*\.[^.]*$/', $auth_settings['cas_host'], $matches ) === 1 ? $matches[0] : '';
	1179	+ $externally_authenticated_email = strtolower( $username ) . '@' . $domain_guess;
1326	1180	}
1327	1181
1328	1182	// Retrieve the user attributes (e.g., email address, first name, last name) from the CAS server.
1329	1183	$cas_attributes = phpCAS::getAttributes();
		@@ -1334,45 +1188,37 @@
1334	1188	// email domain is manually entered there (instead of a reference to a
1335	1189	// CAS attribute), and combine that with the username to create the email.
1336	1190	// Otherwise, look up the CAS attribute for email.
1337	1191	if ( substr( $auth_settings['cas_attr_email'], 0, 1 ) === '@' ) {
1338		- $externally_authenticated_email = $this->lowercase( $username . $auth_settings['cas_attr_email'] );
	1192	+ $externally_authenticated_email = strtolower( $username . $auth_settings['cas_attr_email'] );
1339	1193	} elseif (
1340	1194	// If a CAS attribute has been specified as containing the email address, use that instead.
1341	1195	// Email attribute can be a string or an array of strings.
1342	1196	array_key_exists( $auth_settings['cas_attr_email'], $cas_attributes ) && (
1343	1197	(
1344		- is_array( $cas_attributes[ $auth_settings['cas_attr_email'] ] ) &&
1345		- count( $cas_attributes[ $auth_settings['cas_attr_email'] ] ) > 0
	1198	+ is_array( $cas_attributes[$auth_settings['cas_attr_email']] ) &&
	1199	+ count( $cas_attributes[$auth_settings['cas_attr_email']] ) > 0
1346	1200	) || (
1347		- is_string( $cas_attributes[ $auth_settings['cas_attr_email'] ] ) &&
1348		- strlen( $cas_attributes[ $auth_settings['cas_attr_email'] ] ) > 0
	1201	+ is_string( $cas_attributes[$auth_settings['cas_attr_email']] ) &&
	1202	+ strlen( $cas_attributes[$auth_settings['cas_attr_email']] ) > 0
1349	1203	)
1350	1204	)
1351	1205	) {
1352		- // Each of the emails in the array needs to be set to lowercase.
1353		- if ( is_array( $cas_attributes[ $auth_settings['cas_attr_email'] ] ) ) {
1354		- $externally_authenticated_email = array();
1355		- foreach ( $cas_attributes[ $auth_settings['cas_attr_email'] ] as $external_email ) {
1356		- $externally_authenticated_email[] = $this->lowercase( $external_email );
1357		- }
1358		- } else {
1359		- $externally_authenticated_email = $this->lowercase( $cas_attributes[ $auth_settings['cas_attr_email'] ] );
1360		- }
	1206	+ $externally_authenticated_email = $cas_attributes[$auth_settings['cas_attr_email']];
1361	1207	}
1362	1208	}
1363	1209
1364	1210	// Get user first name and last name.
1365		- $first_name = array_key_exists( 'cas_attr_first_name', $auth_settings ) && strlen( $auth_settings['cas_attr_first_name'] ) > 0 && array_key_exists( $auth_settings['cas_attr_first_name'], $cas_attributes ) && strlen( $cas_attributes[ $auth_settings['cas_attr_first_name'] ] ) > 0 ? $cas_attributes[ $auth_settings['cas_attr_first_name'] ] : '';
1366		- $last_name = array_key_exists( 'cas_attr_last_name', $auth_settings ) && strlen( $auth_settings['cas_attr_last_name'] ) > 0 && array_key_exists( $auth_settings['cas_attr_last_name'], $cas_attributes ) && strlen( $cas_attributes[ $auth_settings['cas_attr_last_name'] ] ) > 0 ? $cas_attributes[ $auth_settings['cas_attr_last_name'] ] : '';
	1211	+ $first_name = array_key_exists( 'cas_attr_first_name', $auth_settings ) && strlen( $auth_settings['cas_attr_first_name'] ) > 0 && array_key_exists( $auth_settings['cas_attr_first_name'], $cas_attributes ) && strlen( $cas_attributes[$auth_settings['cas_attr_first_name']] ) > 0 ? $cas_attributes[$auth_settings['cas_attr_first_name']] : '';
	1212	+ $last_name = array_key_exists( 'cas_attr_last_name', $auth_settings ) && strlen( $auth_settings['cas_attr_last_name'] ) > 0 && array_key_exists( $auth_settings['cas_attr_last_name'], $cas_attributes ) && strlen( $cas_attributes[$auth_settings['cas_attr_last_name']] ) > 0 ? $cas_attributes[$auth_settings['cas_attr_last_name']] : '';
1367	1213
1368	1214	return array(
1369		- 'email' => $externally_authenticated_email,
1370		- 'username' => $username,
1371		- 'first_name' => $first_name,
1372		- 'last_name' => $last_name,
	1215	+ 'email' => $externally_authenticated_email,
	1216	+ 'username' => $username,
	1217	+ 'first_name' => $first_name,
	1218	+ 'last_name' => $last_name,
1373	1219	'authenticated_by' => 'cas',
1374		- 'cas_attributes' => $cas_attributes,
	1220	+ 'cas_attributes' => $cas_attributes,
1375	1221	);
1376	1222	}
1377	1223
1378	1224
		@@ -1378,32 +1224,24 @@
1378	1224
1379	1225	/**
1380	1226	* Validate this user's credentials against LDAP.
1381	1227	*
1382		- * @param array $auth_settings Plugin settings.
1383		- * @param string $username Attempted username from authenticate action.
1384		- * @param string $password Attempted password from authenticate action.
1385		- * @return array|WP_Error Array containing 'email' and 'authenticated_by' strings
1386		- * for the successfully authenticated user, or WP_Error()
1387		- * object on failure, or null if skipping LDAP auth and
1388		- * falling back to WP auth.
	1228	+ * @param array $auth_settings Plugin settings
	1229	+ * @param string $username Attempted username from authenticate action
	1230	+ * @param string $password Attempted password from authenticate action
	1231	+ * @return [mixed] Array containing 'email' and 'authenticated_by'
	1232	+ * strings for the successfully authenticated
	1233	+ * user, or WP_Error() object on failure,
	1234	+ * or null if skipping LDAP auth and falling back to WP auth.
1389	1235	*/
1390	1236	private function custom_authenticate_ldap( $auth_settings, $username, $password ) {
1391		- // Get LDAP search base(s).
1392		- $search_bases = explode( "\n", str_replace( "\r", '', trim( $auth_settings['ldap_search_base'] ) ) );
1393		-
1394		- // Fail silently (fall back to WordPress authentication) if no search base specified.
1395		- if ( count( $search_bases ) < 1 ) {
1396		- return null;
1397		- }
1398		-
1399		- // Get the FQDN from the first LDAP search base domain components (dc). For
1400		- // example, ou=people,dc=example,dc=edu,dc=uk would yield user@example.edu.uk.
1401		- $search_base_components = explode( ',', trim( $search_bases[0] ) );
1402		- $domain = array();
	1237	+ // Get the FQDN from the LDAP search base domain components (dc). For
	1238	+ // example, ou=people,dc=example,dc=edu,dc=uk would yield user@example.edu.uk
	1239	+ $search_base_components = explode( ',', trim( $auth_settings['ldap_search_base'] ) );
	1240	+ $domain = array();
1403	1241	foreach ( $search_base_components as $search_base_component ) {
1404	1242	$component = explode( '=', $search_base_component );
1405		- if ( 2 === count( $component ) && 'dc' === $component[0] ) {
	1243	+ if ( count( $component ) === 2 && $component[0] === 'dc' ) {
1406	1244	$domain[] = $component[1];
1407	1245	}
1408	1246	}
1409	1247	$domain = implode( '.', $domain );
		@@ -1414,9 +1252,9 @@
1414	1252	if ( empty( $domain ) ) {
1415	1253	$domain = preg_match( '/[^.]*\.[^.]*$/', $auth_settings['ldap_host'], $matches ) === 1 ? $matches[0] : '';
1416	1254	}
1417	1255
1418		- // remove @domain if it exists in the username (i.e., if user entered their email).
	1256	+ // remove @domain if it exists in the username (i.e., if user entered their email)
1419	1257	$username = str_replace( '@' . $domain, '', $username );
1420	1258
1421	1259	// Fail silently (fall back to WordPress authentication) if both username
1422	1260	// and password are empty (this will be the case when visiting wp-login.php
		@@ -1439,13 +1277,13 @@
1439	1277	return null;
1440	1278	}
1441	1279
1442	1280	// Authenticate against LDAP using options provided in plugin settings.
1443		- $result = false;
	1281	+ $result = false;
1444	1282	$ldap_user_dn = '';
1445		- $first_name = '';
1446		- $last_name = '';
1447		- $email = '';
	1283	+ $first_name = '';
	1284	+ $last_name = '';
	1285	+ $email = '';
1448	1286
1449	1287	// Construct LDAP connection parameters. ldap_connect() takes either a
1450	1288	// hostname or a full LDAP URI as its first parameter (works with OpenLDAP
1451	1289	// 2.x.x or later). If it's an LDAP URI, the second parameter, $port, is
		@@ -1450,13 +1288,13 @@
1450	1288	// hostname or a full LDAP URI as its first parameter (works with OpenLDAP
1451	1289	// 2.x.x or later). If it's an LDAP URI, the second parameter, $port, is
1452	1290	// ignored, and port must be specified in the full URI. An LDAP URI is of
1453	1291	// the form ldap://hostname:port or ldaps://hostname:port.
1454		- $ldap_host = $auth_settings['ldap_host'];
1455		- $ldap_port = intval( $auth_settings['ldap_port'] );
1456		- $parsed_host = wp_parse_url( $ldap_host );
	1292	+ $ldap_host = $auth_settings['ldap_host'];
	1293	+ $ldap_port = intval( $auth_settings['ldap_port'] );
	1294	+ $parsed_host = parse_url( $ldap_host );
1457	1295	// Fail (fall back to WordPress auth) if invalid host is specified.
1458		- if ( false === $parsed_host ) {
	1296	+ if ( $parsed_host === false ) {
1459	1297	return null;
1460	1298	}
1461	1299	// If a scheme is in the LDAP host, use full LDAP URI instead of just hostname.
1462	1300	if ( array_key_exists( 'scheme', $parsed_host ) ) {
		@@ -1469,24 +1307,24 @@
1469	1307
1470	1308	// Establish LDAP connection.
1471	1309	$ldap = ldap_connect( $ldap_host, $ldap_port );
1472	1310	ldap_set_option( $ldap, LDAP_OPT_PROTOCOL_VERSION, 3 );
1473		- if ( 1 === intval( $auth_settings['ldap_tls'] ) ) {
1474		- if ( ! ldap_start_tls( $ldap ) ) {
	1311	+ if ( $auth_settings['ldap_tls'] == 1 ) {
	1312	+ if( ! ldap_start_tls( $ldap ) ) {
1475	1313	return null;
1476	1314	}
1477	1315	}
1478	1316
1479	1317	// Set bind credentials; attempt an anonymous bind if not provided.
1480		- $bind_rdn = null;
1481		- $bind_password = null;
	1318	+ $bind_rdn = NULL;
	1319	+ $bind_password = NULL;
1482	1320	if ( strlen( $auth_settings['ldap_user'] ) > 0 ) {
1483		- $bind_rdn = $auth_settings['ldap_user'];
	1321	+ $bind_rdn = $auth_settings['ldap_user'];
1484	1322	$bind_password = $this->decrypt( $auth_settings['ldap_password'] );
1485	1323	}
1486	1324
1487	1325	// Attempt LDAP bind.
1488		- $result = @ldap_bind( $ldap, $bind_rdn, stripslashes( $bind_password ) ); // phpcs:ignore
	1326	+ $result = @ldap_bind( $ldap, $bind_rdn, stripslashes( $bind_password ) );
1489	1327	if ( ! $result ) {
1490	1328	// Can't connect to LDAP, so fall back to WordPress authentication.
1491	1329	return null;
1492	1330	}
		@@ -1500,40 +1338,18 @@
1500	1338	if ( array_key_exists( 'ldap_attr_last_name', $auth_settings ) && strlen( $auth_settings['ldap_attr_last_name'] ) > 0 ) {
1501	1339	array_push( $ldap_attributes_to_retrieve, $auth_settings['ldap_attr_last_name'] );
1502	1340	}
1503	1341	if ( array_key_exists( 'ldap_attr_email', $auth_settings ) && strlen( $auth_settings['ldap_attr_email'] ) > 0 && substr( $auth_settings['ldap_attr_email'], 0, 1 ) !== '@' ) {
1504		- array_push( $ldap_attributes_to_retrieve, $this->lowercase( $auth_settings['ldap_attr_email'] ) );
	1342	+ array_push( $ldap_attributes_to_retrieve, $auth_settings['ldap_attr_email'] );
1505	1343	}
	1344	+ $ldap_search = ldap_search(
	1345	+ $ldap,
	1346	+ $auth_settings['ldap_search_base'],
	1347	+ "(" . $auth_settings['ldap_uid'] . "=" . $username . ")",
	1348	+ $ldap_attributes_to_retrieve
	1349	+ );
	1350	+ $ldap_entries = ldap_get_entries( $ldap, $ldap_search );
1506	1351
1507		- // Create default LDAP search filter (uid=$username).
1508		- $search_filter = '(' . $auth_settings['ldap_uid'] . '=' . $username . ')';
1509		-
1510		- /**
1511		- * Filter LDAP search filter.
1512		- *
1513		- * Allows for custom LDAP authentication rules (e.g., restricting login
1514		- * access to users in multiple groups, or having certain attributes).
1515		- *
1516		- * @param string $search_filter The filter to pass to ldap_search().
1517		- * @param string $ldap_uid The attribute to compare username against (from Authorizer Settings).
1518		- * @param string $username The username attempting to log in.
1519		- */
1520		- $search_filter = apply_filters( 'authorizer_ldap_search_filter', $search_filter, $auth_settings['ldap_uid'], $username );
1521		-
1522		- // Multiple search bases can be provided, so iterate through them until a match is found.
1523		- foreach ( $search_bases as $search_base ) {
1524		- $ldap_search = ldap_search(
1525		- $ldap,
1526		- $search_base,
1527		- $search_filter,
1528		- $ldap_attributes_to_retrieve
1529		- );
1530		- $ldap_entries = ldap_get_entries( $ldap, $ldap_search );
1531		- if ( $ldap_entries['count'] > 0 ) {
1532		- break;
1533		- }
1534		- }
1535		-
1536	1352	// If we didn't find any users in ldap, fall back to WordPress authentication.
1537	1353	if ( $ldap_entries['count'] < 1 ) {
1538	1354	return null;
1539	1355	}
		@@ -1539,21 +1355,21 @@
1539	1355	}
1540	1356
1541	1357	// Get the bind dn and first/last names; if there are multiple results returned, just get the last one.
1542	1358	for ( $i = 0; $i < $ldap_entries['count']; $i++ ) {
1543		- $ldap_user_dn = $ldap_entries[ $i ]['dn'];
	1359	+ $ldap_user_dn = $ldap_entries[$i]['dn'];
1544	1360
1545	1361	// Get user first name and last name.
1546		- $ldap_attr_first_name = array_key_exists( 'ldap_attr_first_name', $auth_settings ) ? $this->lowercase( $auth_settings['ldap_attr_first_name'] ) : '';
1547		- if ( strlen( $ldap_attr_first_name ) > 0 && array_key_exists( $ldap_attr_first_name, $ldap_entries[ $i ] ) && $ldap_entries[ $i ][ $ldap_attr_first_name ]['count'] > 0 && strlen( $ldap_entries[ $i ][ $ldap_attr_first_name ][0] ) > 0 ) {
1548		- $first_name = $ldap_entries[ $i ][ $ldap_attr_first_name ][0];
	1362	+ $ldap_attr_first_name = array_key_exists( 'ldap_attr_first_name', $auth_settings ) ? strtolower( $auth_settings['ldap_attr_first_name'] ) : '';
	1363	+ if ( strlen( $ldap_attr_first_name ) > 0 && array_key_exists( $ldap_attr_first_name, $ldap_entries[$i] ) && $ldap_entries[$i][$ldap_attr_first_name]['count'] > 0 && strlen( $ldap_entries[$i][$ldap_attr_first_name][0] ) > 0 ) {
	1364	+ $first_name = $ldap_entries[$i][$ldap_attr_first_name][0];
1549	1365	}
1550		- $ldap_attr_last_name = array_key_exists( 'ldap_attr_last_name', $auth_settings ) ? $this->lowercase( $auth_settings['ldap_attr_last_name'] ) : '';
1551		- if ( strlen( $ldap_attr_last_name ) > 0 && array_key_exists( $ldap_attr_last_name, $ldap_entries[ $i ] ) && $ldap_entries[ $i ][ $ldap_attr_last_name ]['count'] > 0 && strlen( $ldap_entries[ $i ][ $ldap_attr_last_name ][0] ) > 0 ) {
1552		- $last_name = $ldap_entries[ $i ][ $ldap_attr_last_name ][0];
	1366	+ $ldap_attr_last_name = array_key_exists( 'ldap_attr_last_name', $auth_settings ) ? strtolower( $auth_settings['ldap_attr_last_name'] ) : '';
	1367	+ if ( strlen( $ldap_attr_last_name ) > 0 && array_key_exists( $ldap_attr_last_name, $ldap_entries[$i] ) && $ldap_entries[$i][$ldap_attr_last_name]['count'] > 0 && strlen( $ldap_entries[$i][$ldap_attr_last_name][0] ) > 0 ) {
	1368	+ $last_name = $ldap_entries[$i][$ldap_attr_last_name][0];
1553	1369	}
1554	1370	// Get user email if it is specified in another field.
1555		- $ldap_attr_email = array_key_exists( 'ldap_attr_email', $auth_settings ) ? $this->lowercase( $auth_settings['ldap_attr_email'] ) : '';
	1371	+ $ldap_attr_email = array_key_exists( 'ldap_attr_email', $auth_settings ) ? strtolower( $auth_settings['ldap_attr_email'] ) : '';
1556	1372	if ( strlen( $ldap_attr_email ) > 0 ) {
1557	1373	// If the email attribute starts with an at symbol (@), assume that the
1558	1374	// email domain is manually entered there (instead of a reference to an
1559	1375	// LDAP attribute), and combine that with the username to create the email.
		@@ -1558,16 +1374,16 @@
1558	1374	// email domain is manually entered there (instead of a reference to an
1559	1375	// LDAP attribute), and combine that with the username to create the email.
1560	1376	// Otherwise, look up the LDAP attribute for email.
1561	1377	if ( substr( $ldap_attr_email, 0, 1 ) === '@' ) {
1562		- $email = $this->lowercase( $username . $ldap_attr_email );
1563		- } elseif ( array_key_exists( $ldap_attr_email, $ldap_entries[ $i ] ) && $ldap_entries[ $i ][ $ldap_attr_email ]['count'] > 0 && strlen( $ldap_entries[ $i ][ $ldap_attr_email ][0] ) > 0 ) {
1564		- $email = $this->lowercase( $ldap_entries[ $i ][ $ldap_attr_email ][0] );
	1378	+ $email = strtolower( $username . $ldap_attr_email );
	1379	+ } elseif ( array_key_exists( $ldap_attr_email, $ldap_entries[$i] ) && $ldap_entries[$i][$ldap_attr_email]['count'] > 0 && strlen( $ldap_entries[$i][$ldap_attr_email][0] ) > 0 ) {
	1380	+ $email = strtolower( $ldap_entries[$i][$ldap_attr_email][0] );
1565	1381	}
1566	1382	}
1567	1383	}
1568	1384
1569		- $result = @ldap_bind( $ldap, $ldap_user_dn, stripslashes( $password ) ); // phpcs:ignore
	1385	+ $result = @ldap_bind( $ldap, $ldap_user_dn, stripslashes( $password ) );
1570	1386	if ( ! $result ) {
1571	1387	// We have a real ldap user, but an invalid password. Pass
1572	1388	// through to wp authentication after failing LDAP (since
1573	1389	// this could be a local account that happens to be the
		@@ -1575,22 +1391,22 @@
1575	1391	return null;
1576	1392	}
1577	1393
1578	1394	// User successfully authenticated against LDAP, so set the relevant variables.
1579		- $externally_authenticated_email = $this->lowercase( $username . '@' . $domain );
	1395	+ $externally_authenticated_email = $username . '@' . $domain;
1580	1396
1581	1397	// If an LDAP attribute has been specified as containing the email address, use that instead.
1582	1398	if ( strlen( $email ) > 0 ) {
1583		- $externally_authenticated_email = $this->lowercase( $email );
	1399	+ $externally_authenticated_email = $email;
1584	1400	}
1585	1401
1586	1402	return array(
1587		- 'email' => $externally_authenticated_email,
1588		- 'username' => $username,
1589		- 'first_name' => $first_name,
1590		- 'last_name' => $last_name,
	1403	+ 'email' => $externally_authenticated_email,
	1404	+ 'username' => $username,
	1405	+ 'first_name' => $first_name,
	1406	+ 'last_name' => $last_name,
1591	1407	'authenticated_by' => 'ldap',
1592		- 'ldap_attributes' => $ldap_entries,
	1408	+ 'ldap_attributes' => $ldap_entries,
1593	1409	);
1594	1410	}
1595	1411
1596	1412
		@@ -1596,20 +1412,18 @@
1596	1412
1597	1413	/**
1598	1414	* Log out of the attached external service.
1599	1415	*
1600		- * Action: wp_logout
1601		- *
1602	1416	* @return void
1603	1417	*/
1604	1418	public function custom_logout() {
1605	1419	// Grab plugin settings.
1606		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
	1420	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' );
1607	1421
1608	1422	// Reset option containing old error messages.
1609	1423	delete_option( 'auth_settings_advanced_login_error' );
1610	1424
1611		- if ( session_id() === '' ) {
	1425	+ if ( session_id() == '' ) {
1612	1426	session_start();
1613	1427	}
1614	1428
1615	1429	$current_user_authenticated_by = get_user_meta( get_current_user_id(), 'authenticated_by', true );
		@@ -1614,53 +1428,38 @@
1614	1428
1615	1429	$current_user_authenticated_by = get_user_meta( get_current_user_id(), 'authenticated_by', true );
1616	1430
1617	1431	// If logged in to CAS, Log out of CAS.
1618		- if ( 'cas' === $current_user_authenticated_by && '1' === $auth_settings['cas'] ) {
	1432	+ if ( $current_user_authenticated_by === 'cas' && $auth_settings['cas'] === '1' ) {
1619	1433	if ( ! array_key_exists( 'PHPCAS_CLIENT', $GLOBALS ) || ! array_key_exists( 'phpCAS', $_SESSION ) ) {
1620	1434
1621		- /**
1622		- * Get the CAS server version (default to SAML_VERSION_1_1).
1623		- *
1624		- * @see: https://developer.jasig.org/cas-clients/php/1.3.4/docs/api/group__public.html
1625		- */
	1435	+ // Get the CAS server version (default to SAML_VERSION_1_1).
	1436	+ // See: https://developer.jasig.org/cas-clients/php/1.3.4/docs/api/group__public.html
1626	1437	$cas_version = SAML_VERSION_1_1;
1627		- if ( 'CAS_VERSION_3_0' === $auth_settings['cas_version'] ) {
	1438	+ if ( $auth_settings['cas_version'] === 'CAS_VERSION_3_0' ) {
1628	1439	$cas_version = CAS_VERSION_3_0;
1629		- } elseif ( 'CAS_VERSION_2_0' === $auth_settings['cas_version'] ) {
	1440	+ } elseif ( $auth_settings['cas_version'] === 'CAS_VERSION_2_0' ) {
1630	1441	$cas_version = CAS_VERSION_2_0;
1631		- } elseif ( 'CAS_VERSION_1_0' === $auth_settings['cas_version'] ) {
	1442	+ } elseif ( $auth_settings['cas_version'] === 'CAS_VERSION_1_0' ) {
1632	1443	$cas_version = CAS_VERSION_1_0;
1633	1444	}
1634	1445
1635	1446	// Set the CAS client configuration if it hasn't been set already.
1636	1447	phpCAS::client( $cas_version, $auth_settings['cas_host'], intval( $auth_settings['cas_port'] ), $auth_settings['cas_path'] );
1637		- // Allow redirects at the CAS server endpoint (e.g., allow connections
1638		- // at an old CAS URL that redirects to a newer CAS URL).
1639		- phpCAS::setExtraCurlOption( CURLOPT_FOLLOWLOCATION, true );
1640	1448	// Restrict logout request origin to the CAS server only (prevent DDOS).
1641	1449	phpCAS::handleLogoutRequests( true, array( $auth_settings['cas_host'] ) );
1642	1450	}
1643		- if ( phpCAS::isAuthenticated() || phpCAS::isInitialized() ) {
1644		- // Redirect to home page, or specified page if it's been provided.
1645		- $redirect_to = site_url( '/' );
1646		- if ( ! empty( $_REQUEST['redirect_to'] ) && isset( $_REQUEST['_wpnonce'] ) && wp_verify_nonce( sanitize_key( $_REQUEST['_wpnonce'] ), 'log-out' ) ) {
1647		- $redirect_to = esc_url_raw( wp_unslash( $_REQUEST['redirect_to'] ) );
1648		- }
1649		-
1650		- phpCAS::logoutWithRedirectService( $redirect_to );
	1451	+ if ( phpCAS::isAuthenticated() ) {
	1452	+ phpCAS::logoutWithRedirectService( site_url( '/' ) );
1651	1453	}
1652	1454	}
1653	1455
1654	1456	// If session token set, log out of Google.
1655		- if ( 'google' === $current_user_authenticated_by || array_key_exists( 'token', $_SESSION ) ) {
	1457	+ if ( $current_user_authenticated_by === 'google' || array_key_exists( 'token', $_SESSION ) ) {
1656	1458	$token = json_decode( $_SESSION['token'] )->access_token;
1657	1459
1658		- /**
1659		- * Add Google API PHP Client.
1660		- *
1661		- * @see https://github.com/google/google-api-php-client branch:v1-master
1662		- */
	1460	+ // Add Google API PHP Client.
	1461	+ // @see https://github.com/google/google-api-php-client branch:v1-master
1663	1462	require_once dirname( __FILE__ ) . '/vendor/google-api-php-client/src/Google/autoload.php';
1664	1463
1665	1464	// Build the Google Client.
1666	1465	$client = new Google_Client();
		@@ -1668,9 +1467,9 @@
1668	1467	$client->setClientId( $auth_settings['google_clientid'] );
1669	1468	$client->setClientSecret( $auth_settings['google_clientsecret'] );
1670	1469	$client->setRedirectUri( 'postmessage' );
1671	1470
1672		- // Revoke the token.
	1471	+ // Revoke the token
1673	1472	$client->revokeToken( $token );
1674	1473
1675	1474	// Remove the credentials from the user's session.
1676	1475	unset( $_SESSION['token'] );
		@@ -1689,37 +1488,36 @@
1689	1488
1690	1489
1691	1490	/**
1692	1491	* Restrict access to WordPress site based on settings (everyone, logged_in_users).
	1492	+ * Hook: parse_request http://codex.wordpress.org/Plugin_API/Action_Reference/parse_request
1693	1493	*
1694		- * Action: parse_request
	1494	+ * @param array $wp WordPress object.
1695	1495	*
1696		- * @param array $wp WordPress object.
1697		- * @return WP|void WP object when passing through to WordPress authentication, or void.
	1496	+ * @return void
1698	1497	*/
1699	1498	public function restrict_access( $wp ) {
1700	1499	// Grab plugin settings.
1701		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
	1500	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' );
1702	1501
1703	1502	// Grab current user.
1704	1503	$current_user = wp_get_current_user();
1705	1504
1706	1505	$has_access = (
1707		- // Always allow access if WordPress is installing.
1708		- // phpcs:ignore WordPress.CSRF.NonceVerification.NoNonceVerification
	1506	+ // Always allow access if WordPress is installing
1709	1507	( defined( 'WP_INSTALLING' ) && isset( $_GET['key'] ) ) ||
1710		- // Always allow access to admins.
	1508	+ // Always allow access to admins
1711	1509	( current_user_can( 'create_users' ) ) ||
1712		- // Allow access if option is set to 'everyone'.
1713		- ( 'everyone' === $auth_settings['access_who_can_view'] ) ||
1714		- // Allow access to approved external users and logged in users if option is set to 'logged_in_users'.
1715		- ( 'logged_in_users' === $auth_settings['access_who_can_view'] && $this->is_user_logged_in_and_blog_user() && $this->is_email_in_list( $current_user->user_email, 'approved' ) ) ||
1716		- // Allow access for requests to /wp-json/oauth1 so oauth clients can authenticate to use the REST API.
1717		- ( property_exists( $wp, 'matched_query' ) && stripos( $wp->matched_query, 'rest_oauth1=' ) === 0 ) ||
1718		- // Allow access for non-GET requests to /wp-json/*, since REST API authentication already covers them.
1719		- ( property_exists( $wp, 'matched_query' ) && 0 === stripos( $wp->matched_query, 'rest_route=' ) && isset( $_SERVER['REQUEST_METHOD'] ) && 'GET' !== $_SERVER['REQUEST_METHOD'] ) ||
1720		- // Allow access for GET requests to /wp-json/ (root), since REST API discovery calls rely on this.
1721		- ( property_exists( $wp, 'matched_query' ) && 'rest_route=/' === $wp->matched_query )
	1510	+ // Allow access if option is set to 'everyone'
	1511	+ ( $auth_settings['access_who_can_view'] == 'everyone' ) ||
	1512	+ // Allow access to approved external users and logged in users if option is set to 'logged_in_users'
	1513	+ ( $auth_settings['access_who_can_view'] == 'logged_in_users' && $this->is_user_logged_in_and_blog_user() && $this->is_email_in_list( $current_user->user_email, 'approved' ) ) ||
	1514	+ // Allow access for requests to /wp-json/oauth1 so oauth clients can authenticate to use the REST API
	1515	+ ( property_exists( $wp, 'matched_query' ) && stripos( $wp->matched_query, "rest_oauth1=" ) === 0 ) ||
	1516	+ // Allow access for non-GET requests to /wp-json/*, since REST API authentication already covers them
	1517	+ ( property_exists( $wp, 'matched_query' ) && stripos( $wp->matched_query, "rest_route=" ) === 0 && $_SERVER['REQUEST_METHOD'] !== 'GET' ) ||
	1518	+ // Allow access for GET requests to /wp-json/ (root), since REST API discovery calls rely on this
	1519	+ ( property_exists( $wp, 'matched_query' ) && $wp->matched_query === 'rest_route=/' )
1722	1520	// Note that GET requests to a rest endpoint will be restricted by authorizer. In that case, error messages will be returned as JSON.
1723	1521	);
1724	1522
1725	1523	/**
		@@ -1741,9 +1539,9 @@
1741	1539	* }
1742	1540	* add_filter( 'authorizer_has_access', 'my_rsa_feed_access_override' );
1743	1541	*/
1744	1542	if ( apply_filters( 'authorizer_has_access', $has_access, $wp ) === true ) {
1745		- // Turn off the public notice about browsing anonymously.
	1543	+ // Turn off the public notice about browsing anonymously
1746	1544	update_option( 'auth_settings_advanced_public_notice', false );
1747	1545
1748	1546	// We've determined that the current user has access, so simply return to grant access.
1749	1547	return $wp;
		@@ -1749,13 +1547,13 @@
1749	1547	return $wp;
1750	1548	}
1751	1549
1752	1550	// Allow HEAD requests to the root (usually discovery from a REST client).
1753		- if ( 'HEAD' === $_SERVER['REQUEST_METHOD'] && empty( $wp->request ) && empty( $wp->matched_query ) ) {
	1551	+ if ( $_SERVER['REQUEST_METHOD'] === 'HEAD' && empty( $wp->request ) && empty( $wp->matched_query ) ) {
1754	1552	return $wp;
1755	1553	}
1756	1554
1757		- /* We've determined that the current user doesn't have access, so we deal with them now. */
	1555	+ // We've determined that the current user doesn't have access, so we deal with them now.
1758	1556
1759	1557	// Fringe case: In a multisite, a user of a different blog can successfully
1760	1558	// log in, but they aren't on the 'approved' whitelist for this blog.
1761	1559	// If that's the case, add them to the pending list for this blog.
		@@ -1766,19 +1564,21 @@
1766	1564	$result = $this->check_user_access( $current_user, array( $current_user->user_email ) );
1767	1565	}
1768	1566
1769	1567	// Check to see if the requested page is public. If so, show it.
1770		- if ( empty( $wp->request ) ) {
1771		- $current_page_id = 'home';
1772		- } else {
1773		- $request_query = isset( $wp->query_vars ) ? new WP_Query( $wp->query_vars ) : null;
1774		- $current_page_id = isset( $request_query->post_count ) && $request_query->post_count > 0 ? $request_query->post->ID : '';
	1568	+ $current_page_name = property_exists( $wp, 'query_vars' ) && array_key_exists( 'name', $wp->query_vars ) && strlen( $wp->query_vars['name'] ) > 0 ? $wp->query_vars['name'] : '';
	1569	+ if ( ! $current_page_name ) {
	1570	+ // Different WordPress versions store the page slug in different places; look for it elsewhere.
	1571	+ if ( property_exists( $wp, 'query_vars' ) && array_key_exists( 'pagename', $wp->query_vars ) && strlen( $wp->query_vars['pagename'] ) > 0 ) {
	1572	+ $current_page_name = $wp->query_vars['pagename'];
	1573	+ }
1775	1574	}
	1575	+ $current_page_id = empty( $wp->request ) ? 'home' : $this->get_id_from_pagename( $current_page_name );
1776	1576	if ( ! array_key_exists( 'access_public_pages', $auth_settings ) || ! is_array( $auth_settings['access_public_pages'] ) ) {
1777	1577	$auth_settings['access_public_pages'] = array();
1778	1578	}
1779		- if ( in_array( strval( $current_page_id ), $auth_settings['access_public_pages'], true ) ) {
1780		- if ( 'no_warning' === $auth_settings['access_public_warning'] ) {
	1579	+ if ( in_array( $current_page_id, $auth_settings['access_public_pages'] ) ) {
	1580	+ if ( $auth_settings['access_public_warning'] === 'no_warning' ) {
1781	1581	update_option( 'auth_settings_advanced_public_notice', false );
1782	1582	} else {
1783	1583	update_option( 'auth_settings_advanced_public_notice', true );
1784	1584	}
		@@ -1786,11 +1586,11 @@
1786	1586	}
1787	1587
1788	1588	// Check to see if any category assigned to the requested page is public. If so, show it.
1789	1589	$current_page_categories = wp_get_post_categories( $current_page_id, array( 'fields' => 'slugs' ) );
1790		- foreach ( $current_page_categories as $current_page_category ) {
1791		- if ( in_array( 'cat_' . $current_page_category, $auth_settings['access_public_pages'], true ) ) {
1792		- if ( 'no_warning' === $auth_settings['access_public_warning'] ) {
	1590	+ foreach( $current_page_categories as $current_page_category ) {
	1591	+ if ( in_array( 'cat_' . $current_page_category, $auth_settings['access_public_pages'] ) ) {
	1592	+ if ( $auth_settings['access_public_warning'] === 'no_warning' ) {
1793	1593	update_option( 'auth_settings_advanced_public_notice', false );
1794	1594	} else {
1795	1595	update_option( 'auth_settings_advanced_public_notice', true );
1796	1596	}
		@@ -1798,11 +1598,11 @@
1798	1598	}
1799	1599	}
1800	1600
1801	1601	// Check to see if this page can't be found. If so, allow showing the 404 page.
1802		- if ( strlen( $current_page_id ) < 1 ) {
1803		- if ( in_array( 'auth_public_404', $auth_settings['access_public_pages'], true ) ) {
1804		- if ( 'no_warning' === $auth_settings['access_public_warning'] ) {
	1602	+ if ( strlen( $current_page_name ) > 0 && strlen( $current_page_id ) < 1 ) {
	1603	+ if ( in_array( 'auth_public_404', $auth_settings['access_public_pages'] ) ) {
	1604	+ if ( $auth_settings['access_public_warning'] === 'no_warning' ) {
1805	1605	update_option( 'auth_settings_advanced_public_notice', false );
1806	1606	} else {
1807	1607	update_option( 'auth_settings_advanced_public_notice', true );
1808	1608	}
		@@ -1807,8 +1607,9 @@
1807	1607	update_option( 'auth_settings_advanced_public_notice', true );
1808	1608	}
1809	1609	return $wp;
1810	1610	}
	1611	+
1811	1612	}
1812	1613
1813	1614	// Check to see if the requested category is public. If so, show it.
1814	1615	$current_category_name = property_exists( $wp, 'query_vars' ) && array_key_exists( 'category_name', $wp->query_vars ) && strlen( $wp->query_vars['category_name'] ) > 0 ? $wp->query_vars['category_name'] : '';
		@@ -1813,10 +1614,10 @@
1813	1614	// Check to see if the requested category is public. If so, show it.
1814	1615	$current_category_name = property_exists( $wp, 'query_vars' ) && array_key_exists( 'category_name', $wp->query_vars ) && strlen( $wp->query_vars['category_name'] ) > 0 ? $wp->query_vars['category_name'] : '';
1815	1616	if ( $current_category_name ) {
1816	1617	$current_category_name = end( explode( '/', $current_category_name ) );
1817		- if ( in_array( 'cat_' . $current_category_name, $auth_settings['access_public_pages'], true ) ) {
1818		- if ( 'no_warning' === $auth_settings['access_public_warning'] ) {
	1618	+ if ( in_array( 'cat_' . $current_category_name, $auth_settings['access_public_pages'] ) ) {
	1619	+ if ( $auth_settings['access_public_warning'] === 'no_warning' ) {
1819	1620	update_option( 'auth_settings_advanced_public_notice', false );
1820	1621	} else {
1821	1622	update_option( 'auth_settings_advanced_public_notice', true );
1822	1623	}
		@@ -1826,20 +1627,18 @@
1826	1627
1827	1628	// User is denied access, so show them the error message. Render as JSON
1828	1629	// if this is a REST API call; otherwise, show the error message via
1829	1630	// wp_die() (rendered html), or redirect to the login URL.
1830		- $current_path = ! empty( $_SERVER['REQUEST_URI'] ) ? esc_url_raw( wp_unslash( $_SERVER['REQUEST_URI'] ) ) : home_url();
1831		- if ( property_exists( $wp, 'matched_query' ) && stripos( $wp->matched_query, 'rest_route=' ) === 0 && 'GET' === $_SERVER['REQUEST_METHOD'] ) {
1832		- wp_send_json(
1833		- array(
1834		- 'code' => 'rest_cannot_view',
1835		- 'message' => strip_tags( $auth_settings['access_redirect_to_message'] ),
1836		- 'data' => array(
1837		- 'status' => 401,
1838		- ),
1839		- )
1840		- );
1841		- } elseif ( 'message' === $auth_settings['access_redirect'] ) {
	1631	+ $current_path = empty( $_SERVER['REQUEST_URI'] ) ? home_url() : $_SERVER['REQUEST_URI'];
	1632	+ if ( property_exists( $wp, 'matched_query' ) && stripos( $wp->matched_query, "rest_route=" ) === 0 && $_SERVER['REQUEST_METHOD'] === 'GET' ) {
	1633	+ wp_send_json( array(
	1634	+ 'code' => 'rest_cannot_view',
	1635	+ 'message' => strip_tags( $auth_settings['access_redirect_to_message'] ),
	1636	+ 'data' => array(
	1637	+ 'status' => 401,
	1638	+ ),
	1639	+ ));
	1640	+ } elseif ( $auth_settings['access_redirect'] === 'message' ) {
1842	1641	$page_title = sprintf(
1843	1642	/* TRANSLATORS: %s: Name of blog */
1844	1643	__( '%s - Access Restricted', 'authorizer' ),
1845	1644	get_bloginfo( 'name' )
		@@ -1850,15 +1649,15 @@
1850	1649	'<p style="text-align: center;margin-bottom: -15px;">' .
1851	1650	'<a class="button" href="' . wp_login_url( $current_path ) . '">' .
1852	1651	__( 'Log In', 'authorizer' ) .
1853	1652	'</a></p>';
1854		- wp_die( wp_kses( $error_message, $this->allowed_html ), esc_html( $page_title ) );
1855		- } else {
	1653	+ wp_die( $error_message, $page_title );
	1654	+ } else { // if ( $auth_settings['access_redirect'] === 'login' ) {
1856	1655	wp_redirect( wp_login_url( $current_path ), 302 );
1857	1656	exit;
1858	1657	}
1859	1658
1860		- // Sanity check: we should never get here.
	1659	+ // Sanity check: we should never get here
1861	1660	wp_die( '<p>Access denied.</p>', 'Site Access Restricted' );
1862	1661	}
1863	1662
1864	1663
		@@ -1867,11 +1666,9 @@
1867	1666	* not yet been added to this particular blog in a multisite). Note: we do
1868	1667	* this because check_user_access() runs on the parse_request hook, which
1869	1668	* does not fire on wp-admin pages.
1870	1669	*
1871		- * Action: init
1872		- *
1873		- * @return void
	1670	+ * Hook: admin_menu
1874	1671	*/
1875	1672	public function init__maybe_add_network_approved_user() {
1876	1673	global $current_user;
1877	1674
		@@ -1886,10 +1683,10 @@
1886	1683	) {
1887	1684	// Get all approved users.
1888	1685	$auth_settings_access_users_approved = $this->sanitize_user_list(
1889	1686	array_merge(
1890		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT ),
1891		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT )
	1687	+ $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN ),
	1688	+ $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN )
1892	1689	)
1893	1690	);
1894	1691
1895	1692	// Get user info (we need user role).
		@@ -1901,9 +1698,9 @@
1901	1698	// Add user to blog.
1902	1699	add_user_to_blog( get_current_blog_id(), $current_user->ID, $user_info['role'] );
1903	1700
1904	1701	// Refresh user permissions.
1905		- $current_user = new WP_User( $current_user->ID ); // phpcs:ignore WordPress.Variables.GlobalVariables.OverrideProhibited
	1702	+ $current_user = new WP_User( $current_user->ID );
1906	1703	}
1907	1704	}
1908	1705
1909	1706
		@@ -1917,15 +1714,11 @@
1917	1714
1918	1715
1919	1716	/**
1920	1717	* Add custom error message to login screen.
1921		- *
1922	1718	* Filter: login_errors
1923		- *
1924		- * @param string $errors Error description.
1925		- * @return string Error description with Authorizer errors added.
1926	1719	*/
1927		- public function show_advanced_login_error( $errors ) {
	1720	+ function show_advanced_login_error( $errors ) {
1928	1721	$error = get_option( 'auth_settings_advanced_login_error' );
1929	1722	delete_option( 'auth_settings_advanced_login_error' );
1930	1723	$errors = ' ' . $error . "<br />\n";
1931	1724	return $errors;
		@@ -1933,25 +1726,24 @@
1933	1726
1934	1727
1935	1728	/**
1936	1729	* Load external resources for the public-facing site.
1937		- *
1938		- * Action: wp_enqueue_scripts
1939	1730	*/
1940		- public function auth_public_scripts() {
1941		- // Load (and localize) public scripts.
1942		- $current_path = ! empty( $_SERVER['REQUEST_URI'] ) ? esc_url_raw( wp_unslash( $_SERVER['REQUEST_URI'] ) ) : home_url();
1943		- wp_enqueue_script( 'auth_public_scripts', plugins_url( '/js/authorizer-public.js', __FILE__ ), array( 'jquery' ), '2.8.0' );
	1731	+ function auth_public_scripts() {
	1732	+ // Load (and localize) public scripts
	1733	+ $current_path = empty( $_SERVER['REQUEST_URI'] ) ? home_url() : $_SERVER['REQUEST_URI'];
	1734	+ wp_enqueue_script( 'auth_public_scripts', plugins_url( '/js/authorizer-public.js', __FILE__ ), array( 'jquery' ), '2.3.2' );
1944	1735	$auth_localized = array(
1945		- 'wpLoginUrl' => wp_login_url( $current_path ),
1946		- 'publicWarning' => get_option( 'auth_settings_advanced_public_notice' ),
1947		- 'anonymousNotice' => $this->get_plugin_option( 'access_redirect_to_message' ),
1948		- 'logIn' => esc_html__( 'Log In', 'authorizer' ),
	1736	+ 'wp_login_url' => wp_login_url( $current_path ),
	1737	+ 'public_warning' => get_option( 'auth_settings_advanced_public_notice' ),
	1738	+ 'anonymous_notice' => $this->get_plugin_option( 'access_redirect_to_message' ),
	1739	+ 'log_in' => esc_html__( 'Log In', 'authorizer' ),
1949	1740	);
1950	1741	wp_localize_script( 'auth_public_scripts', 'auth', $auth_localized );
	1742	+ //update_option( 'auth_settings_advanced_public_notice', false);
1951	1743
1952		- // Load public css.
1953		- wp_register_style( 'authorizer-public-css', plugins_url( 'css/authorizer-public.css', __FILE__ ), array(), '2.8.0' );
	1744	+ // Load public css
	1745	+ wp_register_style( 'authorizer-public-css', plugins_url( 'css/authorizer-public.css', __FILE__ ), array(), '2.3.2' );
1954	1746	wp_enqueue_style( 'authorizer-public-css' );
1955	1747	}
1956	1748
1957	1749
		@@ -1957,21 +1749,19 @@
1957	1749
1958	1750	/**
1959	1751	* Enqueue JS scripts and CSS styles appearing on wp-login.php.
1960	1752	*
1961		- * Action: login_enqueue_scripts
1962		- *
1963	1753	* @return void
1964	1754	*/
1965		- public function login_enqueue_scripts_and_styles() {
	1755	+ function login_enqueue_scripts_and_styles() {
1966	1756	// Grab plugin settings.
1967		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
	1757	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' );
1968	1758
1969	1759	// Enqueue scripts appearing on wp-login.php.
1970		- wp_enqueue_script( 'auth_login_scripts', plugins_url( '/js/authorizer-login.js', __FILE__ ), array( 'jquery' ), '2.8.0' );
	1760	+ wp_enqueue_script( 'auth_login_scripts', plugins_url( '/js/authorizer-login.js', __FILE__ ), array( 'jquery' ), '2.3.2' );
1971	1761
1972	1762	// Enqueue styles appearing on wp-login.php.
1973		- wp_register_style( 'authorizer-login-css', plugins_url( '/css/authorizer-login.css', __FILE__ ), array(), '2.8.0' );
	1763	+ wp_register_style( 'authorizer-login-css', plugins_url( '/css/authorizer-login.css', __FILE__ ), array(), '2.3.2' );
1974	1764	wp_enqueue_style( 'authorizer-login-css' );
1975	1765
1976	1766	/**
1977	1767	* Developers can use the `authorizer_add_branding_option` filter
		@@ -1976,8 +1766,9 @@
1976	1766	/**
1977	1767	* Developers can use the `authorizer_add_branding_option` filter
1978	1768	* to add a radio button for "Custom WordPress login branding"
1979	1769	* under the "Advanced" tab in Authorizer options. Example:
	1770	+ *
1980	1771	* function my_authorizer_add_branding_option( $branding_options ) {
1981	1772	* $new_branding_option = array(
1982	1773	* 'value' => 'your_brand'
1983	1774	* 'description' => 'Custom Your Brand Login Screen',
		@@ -1991,23 +1782,23 @@
1991	1782	*/
1992	1783	$branding_options = array();
1993	1784	$branding_options = apply_filters( 'authorizer_add_branding_option', $branding_options );
1994	1785	foreach ( $branding_options as $branding_option ) {
1995		- // Make sure the custom brands have the required values.
	1786	+ // Make sure the custom brands have the required values
1996	1787	if ( ! ( is_array( $branding_option ) && array_key_exists( 'value', $branding_option ) && array_key_exists( 'css_url', $branding_option ) && array_key_exists( 'js_url', $branding_option ) ) ) {
1997	1788	continue;
1998	1789	}
1999	1790	if ( $auth_settings['advanced_branding'] === $branding_option['value'] ) {
2000		- wp_enqueue_script( 'auth_login_custom_scripts-' . sanitize_title( $branding_option['value'] ), $branding_option['js_url'], array( 'jquery' ), '2.8.0' );
2001		- wp_register_style( 'authorizer-login-custom-css-' . sanitize_title( $branding_option['value'] ), $branding_option['css_url'], array(), '2.8.0' );
	1791	+ wp_enqueue_script( 'auth_login_custom_scripts-' . sanitize_title( $branding_option['value'] ), $branding_option['js_url'], array( 'jquery' ), '2.3.2' );
	1792	+ wp_register_style( 'authorizer-login-custom-css-' . sanitize_title( $branding_option['value'] ), $branding_option['css_url'], array(), '2.3.2' );
2002	1793	wp_enqueue_style( 'authorizer-login-custom-css-' . sanitize_title( $branding_option['value'] ) );
2003	1794	}
2004	1795	}
2005	1796
2006	1797	// If we're using Google logins, load those resources.
2007		- if ( '1' === $auth_settings['google'] ) {
2008		- wp_enqueue_script( 'authorizer-login-custom-google', plugins_url( '/js/authorizer-login-custom_google.js', __FILE__ ), array( 'jquery' ), '2.8.0' ); ?>
2009		- <meta name="google-signin-clientid" content="<?php echo esc_attr( $auth_settings['google_clientid'] ); ?>" />
	1798	+ if ( $auth_settings['google'] === '1' ) {
	1799	+ wp_enqueue_script( 'authorizer-login-custom-google', plugins_url( '/js/authorizer-login-custom_google.js', __FILE__ ), array( 'jquery' ), '2.3.2' ); ?>
	1800	+ <meta name="google-signin-clientid" content="<?php echo $auth_settings['google_clientid']; ?>" />
2010	1801	<meta name="google-signin-scope" content="email" />
2011	1802	<meta name="google-signin-cookiepolicy" content="single_host_origin" />
2012	1803	<?php
2013	1804	}
		@@ -2015,127 +1806,110 @@
2015	1806
2016	1807
2017	1808	/**
2018	1809	* Load external resources in the footer of the wp-login.php page.
2019		- *
2020		- * Action: login_footer
	1810	+ * Run on action hook: login_footer
2021	1811	*/
2022		- public function load_login_footer_js() {
	1812	+ function load_login_footer_js() {
2023	1813	// Grab plugin settings.
2024		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
2025		- $ajaxurl = admin_url( 'admin-ajax.php' );
2026		- if ( '1' === $auth_settings['google'] ) :
2027		- ?>
2028		-<script type="text/javascript">
2029		-/* global location, window */
2030		-// Reload login page if reauth querystring param exists,
2031		-// since reauth interrupts external logins (e.g., google).
2032		-if ( location.search.indexOf( 'reauth=1' ) >= 0 ) {
2033		- location.href = location.href.replace( 'reauth=1', '' );
2034		-}
	1814	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' ); ?>
	1815	+ <?php if ( $auth_settings['google'] === '1' ): ?>
	1816	+ <script type="text/javascript">
	1817	+ // Reload login page if reauth querystring param exists,
	1818	+ // since reauth interrupts external logins (e.g., google).
	1819	+ if ( location.search.indexOf( 'reauth=1' ) >= 0 ) {
	1820	+ location.href = location.href.replace( 'reauth=1', '' );
	1821	+ }
2035	1822
2036		-// eslint-disable-next-line no-implicit-globals
2037		-function authUpdateQuerystringParam( uri, key, value ) {
2038		- var re = new RegExp( '([?&])' + key + '=.*?(&|$)', 'i' );
2039		- var separator = uri.indexOf( '?' ) !== -1 ? '&' : '?';
2040		- if ( uri.match( re ) ) {
2041		- return uri.replace( re, '$1' + key + '=' + value + '$2' );
2042		- } else {
2043		- return uri + separator + key + '=' + value;
2044		- }
2045		-}
	1823	+ function auth_update_querystring_param( uri, key, value ) {
	1824	+ var re = new RegExp( '([?&])' + key + '=.*?(&|$)', 'i' );
	1825	+ var separator = uri.indexOf( '?' ) !== -1 ? '&' : '?';
	1826	+ if ( uri.match( re ) ) {
	1827	+ return uri.replace( re, '$1' + key + '=' + value + '$2' );
	1828	+ } else {
	1829	+ return uri + separator + key + '=' + value;
	1830	+ }
	1831	+ }
2046	1832
2047		-// eslint-disable-next-line
2048		-function signInCallback( authResult ) { // jshint ignore:line
2049		- var $ = jQuery;
2050		- if ( authResult.status && authResult.status.signed_in ) {
2051		- // Hide the sign-in button now that the user is authorized, for example:
2052		- $( '#googleplus_button' ).attr( 'style', 'display: none' );
	1833	+ function signInCallback( authResult ) {
	1834	+ var $ = jQuery;
	1835	+ if ( authResult['status'] && authResult['status']['signed_in'] ) {
	1836	+ // Hide the sign-in button now that the user is authorized, for example:
	1837	+ $( '#googleplus_button' ).attr( 'style', 'display: none' );
2053	1838
2054		- // Send the code to the server
2055		- var ajaxurl = '<?php echo esc_attr( $ajaxurl ); ?>';
2056		- $.post(ajaxurl, {
2057		- action: 'process_google_login',
2058		- code: authResult.code,
2059		- nonce: $('#nonce_google_auth-<?php echo esc_attr( $this->get_cookie_value() ); ?>' ).val(),
2060		- }, function() {
2061		- // Handle or verify the server response if necessary.
2062		- // console.log( response );
	1839	+ // Send the code to the server
	1840	+ var ajaxurl = '<?php echo admin_url( "admin-ajax.php" ); ?>';
	1841	+ $.post(ajaxurl, {
	1842	+ action: 'process_google_login',
	1843	+ 'code': authResult['code'],
	1844	+ 'nonce': $('#nonce_google_auth-<?php echo $this->get_cookie_value(); ?>' ).val(),
	1845	+ }, function( response ) {
	1846	+ // Handle or verify the server response if necessary.
	1847	+ //console.log( response );
2063	1848
2064		- // Reload wp-login.php to continue the authentication process.
2065		- var newHref = authUpdateQuerystringParam( location.href, 'external', 'google' );
2066		- if ( location.href === newHref ) {
2067		- location.reload();
2068		- } else {
2069		- location.href = newHref;
2070		- }
2071		- });
2072		- } else {
2073		- // Update the app to reflect a signed out user
2074		- // Possible error values:
2075		- // "user_signed_out" - User is signed-out
2076		- // "access_denied" - User denied access to your app
2077		- // "immediate_failed" - Could not automatically log in the user
2078		- // console.log('Sign-in state: ' + authResult['error']);
	1849	+ // Reload wp-login.php to continue the authentication process.
	1850	+ var new_href = auth_update_querystring_param( location.href, 'external', 'google' );
	1851	+ if ( location.href === new_href ) {
	1852	+ location.reload();
	1853	+ } else {
	1854	+ location.href = new_href;
	1855	+ }
	1856	+ });
	1857	+ } else {
	1858	+ // Update the app to reflect a signed out user
	1859	+ // Possible error values:
	1860	+ // "user_signed_out" - User is signed-out
	1861	+ // "access_denied" - User denied access to your app
	1862	+ // "immediate_failed" - Could not automatically log in the user
	1863	+ //console.log('Sign-in state: ' + authResult['error']);
2079	1864
2080		- // If user denies access, reload the login page.
2081		- if ( authResult.error === 'access_denied' || authResult.error === 'user_signed_out' ) {
2082		- window.location.reload();
	1865	+ // If user denies access, reload the login page.
	1866	+ if ( authResult['error'] === 'access_denied' || authResult['error'] === 'user_signed_out' ) {
	1867	+ window.location.reload();
	1868	+ }
	1869	+ }
	1870	+ }
	1871	+ </script>
	1872	+ <?php endif;
2083	1873	}
2084		- }
2085		-}
2086		-</script>
2087		- <?php
2088		- endif;
2089		- }
2090	1874
2091	1875
2092	1876	/**
2093	1877	* Create links for any external authentication services that are enabled.
2094		- *
2095		- * Action: login_form
2096	1878	*/
2097		- public function login_form_add_external_service_links() {
	1879	+ function login_form_add_external_service_links() {
2098	1880	// Grab plugin settings.
2099		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
2100		- ?>
	1881	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' ); ?>
2101	1882	<div id="auth-external-service-login">
2102		- <?php if ( '1' === $auth_settings['google'] ) : ?>
2103		- <p><a id="googleplus_button" class="button button-primary button-external button-google"><span class="dashicons dashicons-googleplus"></span><span class="label"><?php esc_html_e( 'Sign in with Google', 'authorizer' ); ?></span></a></p>
	1883	+ <?php if ( $auth_settings['google'] === '1' ): ?>
	1884	+ <p><a id="googleplus_button" class="button button-primary button-external button-google"><span class="dashicons dashicons-googleplus"></span><span class="label"><?php _e( 'Sign in with Google', 'authorizer' ); ?></span></a></p>
2104	1885	<?php wp_nonce_field( 'google_csrf_nonce', 'nonce_google_auth-' . $this->get_cookie_value() ); ?>
2105	1886	<?php endif; ?>
2106	1887
2107		- <?php if ( '1' === $auth_settings['cas'] ) : ?>
2108		- <p><a class="button button-primary button-external button-cas" href="<?php echo esc_attr( $this->modify_current_url_for_cas_login() ); ?>">
	1888	+ <?php if ( $auth_settings['cas'] === '1' ): ?>
	1889	+ <p><a class="button button-primary button-external button-cas" href="<?php echo $this->modify_current_url_for_cas_login(); ?>">
2109	1890	<span class="dashicons dashicons-lock"></span>
2110		- <span class="label">
2111		- <?php
2112		- echo esc_html(
2113		- sprintf(
2114		- /* TRANSLATORS: %s: Custom CAS label from authorizer options */
2115		- __( 'Sign in with %s', 'authorizer' ),
2116		- $auth_settings['cas_custom_label']
2117		- )
	1891	+ <span class="label"><?php
	1892	+ printf(
	1893	+ /* TRANSLATORS: %s: Custom CAS label from authorizer options */
	1894	+ __( 'Sign in with %s', 'authorizer' ),
	1895	+ $auth_settings['cas_custom_label']
2118	1896	);
2119		- ?>
2120		- </span>
	1897	+ ?></span>
2121	1898	</a></p>
2122	1899	<?php endif; ?>
2123	1900
2124		- <?php if ( '1' === $auth_settings['advanced_hide_wp_login'] && isset( $_SERVER['QUERY_STRING'] ) && false === strpos( $_SERVER['QUERY_STRING'], 'external=wordpress' ) ) : // phpcs:ignore WordPress.VIP.ValidatedSanitizedInput ?>
	1901	+ <?php if ( $auth_settings['advanced_hide_wp_login'] === '1' && strpos( $_SERVER['QUERY_STRING'], 'external=wordpress' ) === false ): ?>
2125	1902	<style type="text/css">
2126		- body.login-action-login form {
2127		- padding-bottom: 8px;
	1903	+ #loginform {
	1904	+ padding-bottom: 8px !important;
2128	1905	}
2129		- body.login-action-login form p > label,
2130		- body.login-action-login form .forgetmenot,
2131		- body.login-action-login form .submit,
2132		- body.login-action-login #nav { /* csslint allow: ids */
2133		- display: none;
	1906	+ #loginform p>label, #loginform p.forgetmenot, #loginform p.submit, p#nav {
	1907	+ display: none !important;
2134	1908	}
2135	1909	</style>
2136		- <?php elseif ( '1' === $auth_settings['cas'] || '1' === $auth_settings['google'] ) : ?>
2137		- <h3> &mdash; <?php esc_html_e( 'or', 'authorizer' ); ?> &mdash; </h3>
	1910	+ <?php elseif ( $auth_settings['cas'] === '1' || $auth_settings['google'] === '1' ): ?>
	1911	+ <h3> &mdash; <?php _e( 'or', 'authorizer' ); ?> &mdash; </h3>
2138	1912	<?php endif; ?>
2139	1913	</div>
2140	1914	<?php
2141	1915
		@@ -2148,28 +1922,21 @@
2148	1922	* Note: hook into wp_login_errors filter so this fires after the
2149	1923	* authenticate hook (where the redirect to CAS happens), but before html
2150	1924	* output is started (so the redirect header doesn't complain about data
2151	1925	* already being sent).
2152		- *
2153		- * Filter: wp_login_errors
2154		- *
2155		- * @param object $errors WP Error object.
2156		- * @param string $redirect_to Where to redirect on error.
2157		- * @return WP_Error|void WP Error object or void on redirect.
2158	1926	*/
2159		- public function wp_login_errors__maybe_redirect_to_cas( $errors, $redirect_to ) {
	1927	+ function wp_login_errors__maybe_redirect_to_cas( $errors, $redirect_to ) {
2160	1928	// Grab plugin settings.
2161		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
	1929	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' );
2162	1930
2163	1931	// Check whether we should redirect to CAS.
2164	1932	if (
2165		- isset( $_SERVER['QUERY_STRING'] ) &&
2166		- strpos( $_SERVER['QUERY_STRING'], 'external=wordpress' ) === false && // phpcs:ignore WordPress.VIP.ValidatedSanitizedInput
2167		- array_key_exists( 'cas_auto_login', $auth_settings ) && '1' === $auth_settings['cas_auto_login'] &&
2168		- array_key_exists( 'cas', $auth_settings ) && '1' === $auth_settings['cas'] &&
2169		- ( ! array_key_exists( 'ldap', $auth_settings ) || '1' !== $auth_settings['ldap'] ) &&
2170		- ( ! array_key_exists( 'google', $auth_settings ) || '1' !== $auth_settings['google'] ) &&
2171		- array_key_exists( 'advanced_hide_wp_login', $auth_settings ) && '1' === $auth_settings['advanced_hide_wp_login']
	1933	+ strpos( $_SERVER['QUERY_STRING'], 'external=wordpress' ) === false &&
	1934	+ array_key_exists( 'cas_auto_login', $auth_settings ) && $auth_settings['cas_auto_login'] === '1' &&
	1935	+ array_key_exists( 'cas', $auth_settings ) && $auth_settings['cas'] === '1' &&
	1936	+ ( ! array_key_exists( 'ldap', $auth_settings ) || $auth_settings['ldap'] !== '1' ) &&
	1937	+ ( ! array_key_exists( 'google', $auth_settings ) || $auth_settings['google'] !== '1' ) &&
	1938	+ array_key_exists( 'advanced_hide_wp_login', $auth_settings ) && $auth_settings['advanced_hide_wp_login'] === '1'
2172	1939	) {
2173	1940	wp_redirect( $this->modify_current_url_for_cas_login() );
2174	1941	exit;
2175	1942	}
		@@ -2178,45 +1945,15 @@
2178	1945	}
2179	1946
2180	1947
2181	1948	/**
2182		- * Set a unique cookie to add to Google auth nonce to avoid CSRF detection.
2183		- * Note: hook into login_init so this fires at the start of the visit to
2184		- * wp-login.php, but before any html output is started (so setting the
2185		- * cookie header doesn't complain about data already being sent).
2186		- *
2187		- * Action: login_init
2188		- *
2189		- * @return void
2190		- */
2191		- public function login_init__maybe_set_google_nonce_cookie() {
2192		- // Grab plugin settings.
2193		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
2194		-
2195		- // If Google logins are enabled, make sure the cookie is set.
2196		- if ( array_key_exists( 'google', $auth_settings ) && '1' === $auth_settings['google'] ) {
2197		- if ( ! isset( $_COOKIE['login_unique'] ) ) {
2198		- $this->cookie_value = md5( rand() );
2199		- setcookie( 'login_unique', $this->cookie_value, time() + 1800, '/', defined( 'COOKIE_DOMAIN' ) ? COOKIE_DOMAIN : '' );
2200		- $_COOKIE['login_unique'] = $this->cookie_value;
2201		- }
2202		- }
2203		- }
2204		-
2205		-
2206		- /**
2207	1949	* Implements hook: do_action( 'wp_login_failed', $username );
2208	1950	* Update the user meta for the user that just failed logging in.
2209	1951	* Keep track of time of last failed attempt and number of failed attempts.
2210		- *
2211		- * Action: wp_login_failed
2212		- *
2213		- * @param string $username Username to update login count for.
2214		- * @return void
2215	1952	*/
2216		- public function update_login_failed_count( $username ) {
	1953	+ function update_login_failed_count( $username ) {
2217	1954	// Grab plugin settings.
2218		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
	1955	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' );
2219	1956
2220	1957	// Get user trying to log in.
2221	1958	// If this isn't a real user, update the global failed attempt
2222	1959	// variables. We'll use these global variables to institute the
		@@ -2224,9 +1961,9 @@
2224	1961	// won't be able to determine which accounts are real by which
2225	1962	// accounts get locked out on multiple invalid attempts.
2226	1963	$user = get_user_by( 'login', $username );
2227	1964
2228		- if ( false !== $user ) {
	1965	+ if ( $user !== FALSE ) {
2229	1966	$last_attempt = get_user_meta( $user->ID, 'auth_settings_advanced_lockouts_time_last_failed', true );
2230	1967	$num_attempts = get_user_meta( $user->ID, 'auth_settings_advanced_lockouts_failed_attempts', true );
2231	1968	} else {
2232	1969	$last_attempt = get_option( 'auth_settings_advanced_lockouts_time_last_failed' );
		@@ -2240,15 +1977,15 @@
2240	1977
2241	1978	// Reset the failed attempt count if the time since the last
2242	1979	// failed attempt is greater than the reset duration.
2243	1980	$time_since_last_fail = time() - $last_attempt;
2244		- $reset_duration = $auth_settings['advanced_lockouts']['reset_duration'] * 60; // minutes to seconds.
	1981	+ $reset_duration = $auth_settings['advanced_lockouts']['reset_duration'] * 60; // minutes to seconds
2245	1982	if ( $time_since_last_fail > $reset_duration ) {
2246	1983	$num_attempts = 0;
2247	1984	}
2248	1985
2249	1986	// Set last failed time to now and increment last failed count.
2250		- if ( false !== $user ) {
	1987	+ if ( $user !== FALSE ) {
2251	1988	update_user_meta( $user->ID, 'auth_settings_advanced_lockouts_time_last_failed', time() );
2252	1989	update_user_meta( $user->ID, 'auth_settings_advanced_lockouts_failed_attempts', $num_attempts + 1 );
2253	1990	} else {
2254	1991	update_option( 'auth_settings_advanced_lockouts_time_last_failed', time() );
		@@ -2259,16 +1996,16 @@
2259	1996
2260	1997	/**
2261	1998	* When they successfully log in, make sure WordPress users are in the approved list.
2262	1999	*
2263		- * Action: wp_login
	2000	+ * @action wp_login
2264	2001	*
2265	2002	* @param string $user_login Username of the user logging in.
2266		- * @param object $user WP_User object of the user logging in.
2267		- * @return void
	2003	+ * @param WP_User $user WP_User object of the user logging in.
	2004	+ * @return null
2268	2005	*/
2269		- public function ensure_wordpress_user_in_approved_list_on_login( $user_login, $user ) {
2270		- $this->add_user_to_authorizer_when_created( $user->user_email, $user->user_registered, $user->roles );
	2006	+ function ensure_wordpress_user_in_approved_list_on_login( $user_login, $user ) {
	2007	+ $this->add_user_to_authorizer_when_created( $user->user_email, $user->user_registered, $user->user_roles );
2271	2008	}
2272	2009
2273	2010
2274	2011	/**
		@@ -2274,17 +2011,12 @@
2274	2011	/**
2275	2012	* Overwrite the URL for the lost password link on the login form.
2276	2013	* If we're authenticating against an external service, standard
2277	2014	* WordPress password resets won't work.
2278		- *
2279		- * Filter: lostpassword_url
2280		- *
2281		- * @param string $lostpassword_url URL to reset password.
2282		- * @return string URL to reset password.
2283	2015	*/
2284		- public function custom_lostpassword_url( $lostpassword_url ) {
	2016	+ function custom_lostpassword_url( $lostpassword_url ) {
2285	2017	// Grab plugin settings.
2286		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
	2018	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' );
2287	2019
2288	2020	if (
2289	2021	array_key_exists( 'ldap_lostpassword_url', $auth_settings ) &&
2290	2022	filter_var( $auth_settings['ldap_lostpassword_url'], FILTER_VALIDATE_URL )
		@@ -2307,16 +2039,15 @@
2307	2039	/**
2308	2040	* Add a link to this plugin's settings page from the WordPress Plugins page.
2309	2041	* Called from "plugin_action_links" filter in __construct() above.
2310	2042	*
2311		- * Filter: plugin_action_links_authorizer.php
	2043	+ * @param array $links array of links in the admin sidebar
2312	2044	*
2313		- * @param array $links Admin sidebar links.
2314		- * @return array Admin sidebar links with Authorizer added.
	2045	+ * @return array of links to show in the admin sidebar.
2315	2046	*/
2316	2047	public function plugin_settings_link( $links ) {
2317		- $admin_menu = $this->get_plugin_option( 'advanced_admin_menu' );
2318		- $settings_url = 'settings' === $admin_menu ? admin_url( 'options-general.php?page=authorizer' ) : admin_url( 'admin.php?page=authorizer' );
	2048	+ $admin_menu = $this->get_plugin_option( 'advanced_admin_menu' );
	2049	+ $settings_url = $admin_menu === 'settings' ? admin_url( 'options-general.php?page=authorizer' ) : admin_url( 'admin.php?page=authorizer' );
2319	2050	array_unshift( $links, '<a href="' . $settings_url . '">' . __( 'Settings', 'authorizer' ) . '</a>' );
2320	2051	return $links;
2321	2052	}
2322	2053
		@@ -2324,12 +2055,11 @@
2324	2055	/**
2325	2056	* Add a link to this plugin's network settings page from the WordPress Plugins page.
2326	2057	* Called from "network_admin_plugin_action_links" filter in __construct() above.
2327	2058	*
2328		- * Filter: network_admin_plugin_action_links_authorizer.php
	2059	+ * @param array $links array of links in the network admin sidebar
2329	2060	*
2330		- * @param array $links Network admin sidebar links.
2331		- * @return array Network admin sidebar links with Authorizer added.
	2061	+ * @return array of links to show in the network admin sidebar.
2332	2062	*/
2333	2063	public function network_admin_plugin_settings_link( $links ) {
2334	2064	$settings_link = '<a href="admin.php?page=authorizer">' . __( 'Network Settings', 'authorizer' ) . '</a>';
2335	2065	array_unshift( $links, $settings_link );
		@@ -2337,33 +2067,32 @@
2337	2067	}
2338	2068
2339	2069
2340	2070	/**
2341		- * Create the options page under Dashboard > Settings.
2342		- *
2343		- * Action: admin_menu
	2071	+ * Create the options page under Dashboard > Settings
	2072	+ * Run on action hook: admin_menu
2344	2073	*/
2345	2074	public function add_plugin_page() {
2346	2075	$admin_menu = $this->get_plugin_option( 'advanced_admin_menu' );
2347		- if ( 'settings' === $admin_menu ) {
	2076	+ if ( $admin_menu === 'settings' ) {
2348	2077	// @see http://codex.wordpress.org/Function_Reference/add_options_page
2349	2078	add_options_page(
2350		- 'Authorizer',
2351		- 'Authorizer',
2352		- 'create_users',
2353		- 'authorizer',
2354		- array( $this, 'create_admin_page' )
	2079	+ 'Authorizer', // Page title
	2080	+ 'Authorizer', // Menu title
	2081	+ 'create_users', // Capability
	2082	+ 'authorizer', // Menu slug
	2083	+ array( $this, 'create_admin_page' ) // function
2355	2084	);
2356	2085	} else {
2357	2086	// @see http://codex.wordpress.org/Function_Reference/add_menu_page
2358	2087	add_menu_page(
2359		- 'Authorizer',
2360		- 'Authorizer',
2361		- 'create_users',
2362		- 'authorizer',
2363		- array( $this, 'create_admin_page' ),
2364		- 'dashicons-groups',
2365		- '99.0018465' // position (decimal is to make overlap with other plugins less likely).
	2088	+ 'Authorizer', // Page title
	2089	+ 'Authorizer', // Menu title
	2090	+ 'create_users', // Capability
	2091	+ 'authorizer', // Menu slug
	2092	+ array( $this, 'create_admin_page' ), // callback
	2093	+ 'dashicons-groups', // icon
	2094	+ '99.0018465' // position (decimal is to make overlap with other plugins less likely)
2366	2095	);
2367	2096	}
2368	2097	}
2369	2098
		@@ -2368,75 +2097,56 @@
2368	2097	}
2369	2098
2370	2099
2371	2100	/**
2372		- * Output the HTML for the options page.
	2101	+ * Output the HTML for the options page
2373	2102	*/
2374		- public function create_admin_page() {
2375		- ?>
	2103	+ public function create_admin_page() { ?>
2376	2104	<div class="wrap">
2377		- <h2><?php esc_html_e( 'Authorizer Settings', 'authorizer' ); ?></h2>
2378		- <form method="post" action="options.php" autocomplete="off">
2379		- <?php
2380		- // This prints out all hidden settings fields.
	2105	+ <h2><?php _e( 'Authorizer Settings', 'authorizer' ); ?></h2>
	2106	+ <form method="post" action="options.php" autocomplete="off"><?php
	2107	+ // This prints out all hidden settings fields
	2108	+ // @see http://codex.wordpress.org/Function_Reference/settings_fields
2381	2109	settings_fields( 'auth_settings_group' );
2382		- // This prints out all the sections.
	2110	+ // This prints out all the sections
	2111	+ // @see http://codex.wordpress.org/Function_Reference/do_settings_sections
2383	2112	do_settings_sections( 'authorizer' );
2384		- submit_button();
2385		- ?>
	2113	+ submit_button(); ?>
2386	2114	</form>
2387		- </div>
2388		- <?php
	2115	+ </div><?php
2389	2116	}
2390	2117
2391	2118
2392	2119	/**
2393	2120	* Load external resources on this plugin's options page.
2394		- *
2395		- * Action: load-settings_page_authorizer
2396		- * Action: load-toplevel_page_authorizer
2397		- * Action: admin_head-index.php
	2121	+ * Run on action hooks: load-settings_page_authorizer, load-toplevel_page_authorizer, admin_head-index.php
2398	2122	*/
2399	2123	public function load_options_page() {
2400	2124	wp_enqueue_script(
2401	2125	'authorizer',
2402	2126	plugins_url( 'js/authorizer.js', __FILE__ ),
2403		- array( 'jquery-effects-shake' ), '2.8.0', true
	2127	+ array( 'jquery-effects-shake' ), '2.3.2', true
2404	2128	);
2405		- wp_localize_script(
2406		- 'authorizer', 'authL10n', array(
2407		- 'baseurl' => get_bloginfo( 'url' ),
2408		- 'saved' => esc_html__( 'Saved', 'authorizer' ),
2409		- 'duplicate' => esc_html__( 'Duplicate', 'authorizer' ),
2410		- 'failed' => esc_html__( 'Failed', 'authorizer' ),
2411		- 'local_wordpress_user' => esc_html__( 'Local WordPress user', 'authorizer' ),
2412		- 'block_ban_user' => esc_html__( 'Block/Ban user', 'authorizer' ),
2413		- 'remove_user' => esc_html__( 'Remove user', 'authorizer' ),
2414		- 'no_users_in' => esc_html__( 'No users in', 'authorizer' ),
2415		- 'save_changes' => esc_html__( 'Save Changes', 'authorizer' ),
2416		- 'private_pages' => esc_html__( 'Private Pages', 'authorizer' ),
2417		- 'public_pages' => esc_html__( 'Public Pages', 'authorizer' ),
2418		- 'first_page' => esc_html__( 'First page' ),
2419		- 'previous_page' => esc_html__( 'Previous page' ),
2420		- 'next_page' => esc_html__( 'Next page' ),
2421		- 'last_page' => esc_html__( 'Last page' ),
2422		- 'is_network_admin' => is_network_admin() ? '1' : '0',
2423		- )
2424		- );
	2129	+ wp_localize_script( 'authorizer', 'auth_L10n', array(
	2130	+ 'baseurl' => get_bloginfo( 'url' ),
	2131	+ 'saved' => esc_html__( 'Saved', 'authorizer' ),
	2132	+ 'failed' => esc_html__( 'Failed', 'authorizer' ),
	2133	+ 'local_wordpress_user' => esc_html__( 'Local WordPress user', 'authorizer' ),
	2134	+ 'block_ban_user' => esc_html__( 'Block/Ban user', 'authorizer' ),
	2135	+ 'remove_user' => esc_html__( 'Remove user', 'authorizer' ),
	2136	+ 'no_users_in' => esc_html__( 'No users in', 'authorizer' ),
	2137	+ 'save_changes' => esc_html__( 'Save Changes', 'authorizer' ),
	2138	+ 'private_pages' => esc_html__( 'Private Pages', 'authorizer' ),
	2139	+ 'public_pages' => esc_html__( 'Public Pages', 'authorizer' ),
	2140	+ ));
2425	2141
2426	2142	wp_enqueue_script(
2427		- 'jquery-autogrow-textarea',
2428		- plugins_url( 'vendor/jquery.autogrow-textarea/jquery.autogrow-textarea.js', __FILE__ ),
2429		- array( 'jquery' ), '2.7.0', true
2430		- );
2431		-
2432		- wp_enqueue_script(
2433	2143	'jquery.multi-select',
2434	2144	plugins_url( 'vendor/jquery.multi-select/js/jquery.multi-select.js', __FILE__ ),
2435	2145	array( 'jquery' ), '1.8', true
2436	2146	);
2437	2147
2438		- wp_register_style( 'authorizer-css', plugins_url( 'css/authorizer.css', __FILE__ ), array(), '2.7.3' );
	2148	+ wp_register_style( 'authorizer-css', plugins_url( 'css/authorizer.css', __FILE__ ), array(), '2.3.2' );
2439	2149	wp_enqueue_style( 'authorizer-css' );
2440	2150
2441	2151	wp_register_style( 'jquery-multi-select-css', plugins_url( 'vendor/jquery.multi-select/css/multi-select.css', __FILE__ ), array(), '1.8' );
2442	2152	wp_enqueue_style( 'jquery-multi-select-css' );
		@@ -2447,26 +2157,18 @@
2447	2157
2448	2158
2449	2159	/**
2450	2160	* Show custom admin notice.
2451		- *
2452		- * Note: currently unused, but if anywhere we:
2453		- * add_option( 'auth_settings_advanced_admin_notice, 'Your message.' );
2454		- * It will display and then delete that message on the admin dashboard.
2455		- *
2456		- * Filter: admin_notices
2457		- * filter: network_admin_notices
	2161	+ * Filter: admin_notice
2458	2162	*/
2459		- public function show_advanced_admin_notice() {
	2163	+ function show_advanced_admin_notice() {
2460	2164	$notice = get_option( 'auth_settings_advanced_admin_notice' );
2461	2165	delete_option( 'auth_settings_advanced_admin_notice' );
2462	2166
2463		- if ( $notice && strlen( $notice ) > 0 ) {
2464		- ?>
	2167	+ if ( $notice && strlen( $notice ) > 0 ) { ?>
2465	2168	<div class="error">
2466		- <p><?php echo wp_kses( $notice, $this->allowed_html ); ?></p>
2467		- </div>
2468		- <?php
	2169	+ <p><?php echo $notice; ?></p>
	2170	+ </div><?php
2469	2171	}
2470	2172	}
2471	2173
2472	2174
		@@ -2471,11 +2173,9 @@
2471	2173
2472	2174
2473	2175	/**
2474	2176	* Add notices to the top of the options page.
2475		- *
2476		- * Action: load-settings_page_authorizer > admin_notices
2477		- *
	2177	+ * Run on action hook chain: load-settings_page_authorizer > admin_notices
2478	2178	* Description: Check for invalid settings combinations and show a warning message, e.g.:
2479	2179	* if ( cas url inaccessible ) : ?>
2480	2180	* <div class='updated settings-error'><p>Can't reach CAS server.</p></div>
2481	2181	* <?php endif;
		@@ -2481,23 +2181,20 @@
2481	2181	* <?php endif;
2482	2182	*/
2483	2183	public function admin_notices() {
2484	2184	// Grab plugin settings.
2485		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
	2185	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' );
2486	2186
2487		- if ( '1' === $auth_settings['cas'] ) :
	2187	+ if ( $auth_settings['cas'] === '1' ) :
2488	2188	// Check if provided CAS URL is accessible.
2489		- $protocol = in_array( strval( $auth_settings['cas_port'] ), array( '80', '8080' ), true ) ? 'http' : 'https';
2490		- $cas_url = $protocol . '://' . $auth_settings['cas_host'] . ':' . $auth_settings['cas_port'] . $auth_settings['cas_path'];
2491		- $legacy_cas_url = trailingslashit( $cas_url ) . 'login'; // Check the specific CAS login endpoint (old; some servers don't register a ./login endpoint, use serviceValidate instead).
2492		- $cas_url = trailingslashit( $cas_url ) . 'serviceValidate'; // Check the specific CAS login endpoint.
2493		- if ( ! $this->url_is_accessible( $cas_url ) && ! $this->url_is_accessible( $legacy_cas_url ) ) :
2494		- $authorizer_options_url = 'settings' === $auth_settings['advanced_admin_menu'] ? admin_url( 'options-general.php?page=authorizer' ) : admin_url( '?page=authorizer' );
2495		- ?>
2496		- <div class='notice notice-warning is-dismissible'>
2497		- <p><?php esc_html_e( "Can't reach CAS server. Please provide", 'authorizer' ); ?> <a href='<?php echo esc_attr( $authorizer_options_url ); ?>&tab=external'><?php esc_html_e( 'accurate CAS settings', 'authorizer' ); ?></a> <?php esc_html_e( 'if you intend to use it.', 'authorizer' ); ?></p>
2498		- </div>
2499		- <?php
	2189	+ $protocol = in_array( $auth_settings['cas_port'], array( '80', '8080' ) ) ? 'http' : 'https';
	2190	+ $cas_url = $protocol . '://' . $auth_settings['cas_host'] . ':' . $auth_settings['cas_port'] . $auth_settings['cas_path'];
	2191	+ $cas_url = trailingslashit( $cas_url ) . 'login'; // Check the specific CAS login endpoint
	2192	+ if ( ! $this->url_is_accessible( $cas_url ) ) :
	2193	+ $authorizer_options_url = $auth_settings['advanced_admin_menu'] === 'settings' ? admin_url( 'options-general.php?page=authorizer' ) : admin_url( '?page=authorizer' );
	2194	+ ?><div class='notice notice-warning is-dismissible'>
	2195	+ <p><?php _e( "Can't reach CAS server. Please provide", 'authorizer' ); ?> <a href='<?php echo $authorizer_options_url; ?>&tab=external'><?php _e( 'accurate CAS settings', 'authorizer' ); ?></a> <?php _e( 'if you intend to use it.', 'authorizer' ); ?></p>
	2196	+ </div><?php
2500	2197	endif;
2501	2198	endif;
2502	2199	}
2503	2200
		@@ -2502,430 +2199,399 @@
2502	2199	}
2503	2200
2504	2201
2505	2202	/**
2506		- * Create sections and options.
2507		- *
2508		- * Action: admin_init
	2203	+ * Create sections and options
	2204	+ * Run on action hook: admin_init
2509	2205	*/
2510	2206	public function page_init() {
2511		- /**
2512		- * Create one setting that holds all the options (array).
2513		- *
2514		- * @see http://codex.wordpress.org/Function_Reference/register_setting
2515		- * @see http://codex.wordpress.org/Function_Reference/add_settings_section
2516		- * @see http://codex.wordpress.org/Function_Reference/add_settings_field
2517		- */
	2207	+ // Create one setting that holds all the options (array)
	2208	+ // @see http://codex.wordpress.org/Function_Reference/register_setting
	2209	+ // @see http://codex.wordpress.org/Function_Reference/add_settings_section
	2210	+ // @see http://codex.wordpress.org/Function_Reference/add_settings_field
2518	2211	register_setting(
2519		- 'auth_settings_group',
2520		- 'auth_settings',
2521		- array( $this, 'sanitize_options' )
	2212	+ 'auth_settings_group', // Option group
	2213	+ 'auth_settings', // Option name
	2214	+ array( $this, 'sanitize_options' ) // Sanitize callback
2522	2215	);
2523	2216
2524	2217	add_settings_section(
2525		- 'auth_settings_tabs',
2526		- '',
2527		- array( $this, 'print_section_info_tabs' ),
2528		- 'authorizer'
	2218	+ 'auth_settings_tabs', // HTML element ID
	2219	+ '', // HTML element Title
	2220	+ array( $this, 'print_section_info_tabs' ), // Callback (echos section content)
	2221	+ 'authorizer' // Page this section is shown on (slug)
2529	2222	);
2530	2223
2531		- // Create Access Lists section.
	2224	+ // Create Access Lists section
2532	2225	add_settings_section(
2533		- 'auth_settings_lists',
2534		- '',
2535		- array( $this, 'print_section_info_access_lists' ),
2536		- 'authorizer'
	2226	+ 'auth_settings_lists', // HTML element ID
	2227	+ '', // HTML element Title
	2228	+ array( $this, 'print_section_info_access_lists' ), // Callback (echos section content)
	2229	+ 'authorizer' // Page this section is shown on (slug)
2537	2230	);
2538	2231
2539		- // Create Login Access section.
	2232	+ // Create Login Access section
2540	2233	add_settings_section(
2541		- 'auth_settings_access_login',
2542		- '',
2543		- array( $this, 'print_section_info_access_login' ),
2544		- 'authorizer'
	2234	+ 'auth_settings_access_login', // HTML element ID
	2235	+ '', // HTML element Title
	2236	+ array( $this, 'print_section_info_access_login' ), // Callback (echos section content)
	2237	+ 'authorizer' // Page this section is shown on (slug)
2545	2238	);
2546	2239	add_settings_field(
2547		- 'auth_settings_access_who_can_login',
2548		- __( 'Who can log into the site?', 'authorizer' ),
2549		- array( $this, 'print_radio_auth_access_who_can_login' ),
2550		- 'authorizer',
2551		- 'auth_settings_access_login'
	2240	+ 'auth_settings_access_who_can_login', // HTML element ID
	2241	+ __( 'Who can log into the site?', 'authorizer' ), // HTML element Title
	2242	+ array( $this, 'print_radio_auth_access_who_can_login' ), // Callback (echos form element)
	2243	+ 'authorizer', // Page this setting is shown on (slug)
	2244	+ 'auth_settings_access_login' // Section this setting is shown on
2552	2245	);
2553	2246	add_settings_field(
2554		- 'auth_settings_access_role_receive_pending_emails',
2555		- __( 'Which role should receive email notifications about pending users?', 'authorizer' ),
2556		- array( $this, 'print_select_auth_access_role_receive_pending_emails' ),
2557		- 'authorizer',
2558		- 'auth_settings_access_login'
	2247	+ 'auth_settings_access_role_receive_pending_emails', // HTML element ID
	2248	+ __( 'Which role should receive email notifications about pending users?', 'authorizer' ), // HTML element Title
	2249	+ array( $this, 'print_select_auth_access_role_receive_pending_emails' ), // Callback (echos form element)
	2250	+ 'authorizer', // Page this setting is shown on (slug)
	2251	+ 'auth_settings_access_login' // Section this setting is shown on
2559	2252	);
2560	2253	add_settings_field(
2561		- 'auth_settings_access_pending_redirect_to_message',
2562		- __( 'What message should pending users see after attempting to log in?', 'authorizer' ),
2563		- array( $this, 'print_wysiwyg_auth_access_pending_redirect_to_message' ),
2564		- 'authorizer',
2565		- 'auth_settings_access_login'
	2254	+ 'auth_settings_access_pending_redirect_to_message', // HTML element ID
	2255	+ __( 'What message should pending users see after attempting to log in?', 'authorizer' ), // HTML element Title
	2256	+ array( $this, 'print_wysiwyg_auth_access_pending_redirect_to_message' ), // Callback (echos form element)
	2257	+ 'authorizer', // Page this setting is shown on (slug)
	2258	+ 'auth_settings_access_login' // Section this setting is shown on
2566	2259	);
2567	2260	add_settings_field(
2568		- 'auth_settings_access_blocked_redirect_to_message',
2569		- __( 'What message should blocked users see after attempting to log in?', 'authorizer' ),
2570		- array( $this, 'print_wysiwyg_auth_access_blocked_redirect_to_message' ),
2571		- 'authorizer',
2572		- 'auth_settings_access_login'
	2261	+ 'auth_settings_access_blocked_redirect_to_message', // HTML element ID
	2262	+ __( 'What message should blocked users see after attempting to log in?', 'authorizer' ), // HTML element Title
	2263	+ array( $this, 'print_wysiwyg_auth_access_blocked_redirect_to_message' ), // Callback (echos form element)
	2264	+ 'authorizer', // Page this setting is shown on (slug)
	2265	+ 'auth_settings_access_login' // Section this setting is shown on
2573	2266	);
2574	2267	add_settings_field(
2575		- 'auth_settings_access_should_email_approved_users',
2576		- __( 'Send welcome email to new approved users?', 'authorizer' ),
2577		- array( $this, 'print_checkbox_auth_access_should_email_approved_users' ),
2578		- 'authorizer',
2579		- 'auth_settings_access_login'
	2268	+ 'auth_settings_access_should_email_approved_users', // HTML element ID
	2269	+ __( 'Send welcome email to new approved users?', 'authorizer' ), // HTML element Title
	2270	+ array( $this, 'print_checkbox_auth_access_should_email_approved_users' ), // Callback (echos form element)
	2271	+ 'authorizer', // Page this setting is shown on (slug)
	2272	+ 'auth_settings_access_login' // Section this setting is shown on
2580	2273	);
2581	2274	add_settings_field(
2582		- 'auth_settings_access_email_approved_users_subject',
2583		- __( 'Welcome email subject', 'authorizer' ),
2584		- array( $this, 'print_text_auth_access_email_approved_users_subject' ),
2585		- 'authorizer',
2586		- 'auth_settings_access_login'
	2275	+ 'auth_settings_access_email_approved_users_subject', // HTML element ID
	2276	+ __( 'Welcome email subject', 'authorizer' ), // HTML element Title
	2277	+ array( $this, 'print_text_auth_access_email_approved_users_subject' ), // Callback (echos form element)
	2278	+ 'authorizer', // Page this setting is shown on (slug)
	2279	+ 'auth_settings_access_login' // Section this setting is shown on
2587	2280	);
2588	2281	add_settings_field(
2589		- 'auth_settings_access_email_approved_users_body',
2590		- __( 'Welcome email body', 'authorizer' ),
2591		- array( $this, 'print_wysiwyg_auth_access_email_approved_users_body' ),
2592		- 'authorizer',
2593		- 'auth_settings_access_login'
	2282	+ 'auth_settings_access_email_approved_users_body', // HTML element ID
	2283	+ __( 'Welcome email body', 'authorizer' ), // HTML element Title
	2284	+ array( $this, 'print_wysiwyg_auth_access_email_approved_users_body' ), // Callback (echos form element)
	2285	+ 'authorizer', // Page this setting is shown on (slug)
	2286	+ 'auth_settings_access_login' // Section this setting is shown on
2594	2287	);
2595	2288
2596		- // Create Public Access section.
	2289	+
	2290	+ // Create Public Access section
2597	2291	add_settings_section(
2598		- 'auth_settings_access_public',
2599		- '',
2600		- array( $this, 'print_section_info_access_public' ),
2601		- 'authorizer'
	2292	+ 'auth_settings_access_public', // HTML element ID
	2293	+ '', // HTML element Title
	2294	+ array( $this, 'print_section_info_access_public' ), // Callback (echos section content)
	2295	+ 'authorizer' // Page this section is shown on (slug)
2602	2296	);
2603	2297	add_settings_field(
2604		- 'auth_settings_access_who_can_view',
2605		- __( 'Who can view the site?', 'authorizer' ),
2606		- array( $this, 'print_radio_auth_access_who_can_view' ),
2607		- 'authorizer',
2608		- 'auth_settings_access_public'
	2298	+ 'auth_settings_access_who_can_view', // HTML element ID
	2299	+ __( 'Who can view the site?', 'authorizer' ), // HTML element Title
	2300	+ array( $this, 'print_radio_auth_access_who_can_view' ), // Callback (echos form element)
	2301	+ 'authorizer', // Page this setting is shown on (slug)
	2302	+ 'auth_settings_access_public' // Section this setting is shown on
2609	2303	);
2610	2304	add_settings_field(
2611		- 'auth_settings_access_public_pages',
2612		- __( 'What pages (if any) should be available to everyone?', 'authorizer' ),
2613		- array( $this, 'print_multiselect_auth_access_public_pages' ),
2614		- 'authorizer',
2615		- 'auth_settings_access_public'
	2305	+ 'auth_settings_access_public_pages', // HTML element ID
	2306	+ __( 'What pages (if any) should be available to everyone?', 'authorizer' ), // HTML element Title
	2307	+ array( $this, 'print_multiselect_auth_access_public_pages' ), // Callback (echos form element)
	2308	+ 'authorizer', // Page this setting is shown on (slug)
	2309	+ 'auth_settings_access_public' // Section this setting is shown on
2616	2310	);
2617	2311	add_settings_field(
2618		- 'auth_settings_access_redirect',
2619		- __( 'What happens to people without access when they visit a private page?', 'authorizer' ),
2620		- array( $this, 'print_radio_auth_access_redirect' ),
2621		- 'authorizer',
2622		- 'auth_settings_access_public'
	2312	+ 'auth_settings_access_redirect', // HTML element ID
	2313	+ __( 'What happens to people without access when they visit a private page?', 'authorizer' ), // HTML element Title
	2314	+ array( $this, 'print_radio_auth_access_redirect' ), // Callback (echos form element)
	2315	+ 'authorizer', // Page this setting is shown on (slug)
	2316	+ 'auth_settings_access_public' // Section this setting is shown on
2623	2317	);
2624	2318	add_settings_field(
2625		- 'auth_settings_access_public_warning',
2626		- __( 'What happens to people without access when they visit a public page?', 'authorizer' ),
2627		- array( $this, 'print_radio_auth_access_public_warning' ),
2628		- 'authorizer',
2629		- 'auth_settings_access_public'
	2319	+ 'auth_settings_access_public_warning', // HTML element ID
	2320	+ __( 'What happens to people without access when they visit a public page?', 'authorizer' ), // HTML element Title
	2321	+ array( $this, 'print_radio_auth_access_public_warning' ), // Callback (echos form element)
	2322	+ 'authorizer', // Page this setting is shown on (slug)
	2323	+ 'auth_settings_access_public' // Section this setting is shown on
2630	2324	);
2631	2325	add_settings_field(
2632		- 'auth_settings_access_redirect_to_message',
2633		- __( 'What message should people without access see?', 'authorizer' ),
2634		- array( $this, 'print_wysiwyg_auth_access_redirect_to_message' ),
2635		- 'authorizer',
2636		- 'auth_settings_access_public'
	2326	+ 'auth_settings_access_redirect_to_message', // HTML element ID
	2327	+ __( 'What message should people without access see?', 'authorizer' ), // HTML element Title
	2328	+ array( $this, 'print_wysiwyg_auth_access_redirect_to_message' ), // Callback (echos form element)
	2329	+ 'authorizer', // Page this setting is shown on (slug)
	2330	+ 'auth_settings_access_public' // Section this setting is shown on
2637	2331	);
2638	2332
2639		- // Create External Service Settings section.
	2333	+ // Create External Service Settings section
2640	2334	add_settings_section(
2641		- 'auth_settings_external',
2642		- '',
2643		- array( $this, 'print_section_info_external' ),
2644		- 'authorizer'
	2335	+ 'auth_settings_external', // HTML element ID
	2336	+ '', // HTML element Title
	2337	+ array( $this, 'print_section_info_external' ), // Callback (echos section content)
	2338	+ 'authorizer' // Page this section is shown on (slug)
2645	2339	);
2646	2340	add_settings_field(
2647		- 'auth_settings_access_default_role',
2648		- __( 'Default role for new users', 'authorizer' ),
2649		- array( $this, 'print_select_auth_access_default_role' ),
2650		- 'authorizer',
2651		- 'auth_settings_external'
	2341	+ 'auth_settings_access_default_role', // HTML element ID
	2342	+ __( 'Default role for new users', 'authorizer' ), // HTML element Title
	2343	+ array( $this, 'print_select_auth_access_default_role' ), // Callback (echos form element)
	2344	+ 'authorizer', // Page this setting is shown on (slug)
	2345	+ 'auth_settings_external' // Section this setting is shown on
2652	2346	);
2653	2347	add_settings_field(
2654		- 'auth_settings_external_google',
2655		- __( 'Google Logins', 'authorizer' ),
2656		- array( $this, 'print_checkbox_auth_external_google' ),
2657		- 'authorizer',
2658		- 'auth_settings_external'
	2348	+ 'auth_settings_external_google', // HTML element ID
	2349	+ __( 'Google Logins', 'authorizer' ), // HTML element Title
	2350	+ array( $this, 'print_checkbox_auth_external_google' ), // Callback (echos form element)
	2351	+ 'authorizer', // Page this setting is shown on (slug)
	2352	+ 'auth_settings_external' // Section this setting is shown on
2659	2353	);
2660	2354	add_settings_field(
2661		- 'auth_settings_google_clientid',
2662		- __( 'Google Client ID', 'authorizer' ),
2663		- array( $this, 'print_text_google_clientid' ),
2664		- 'authorizer',
2665		- 'auth_settings_external'
	2355	+ 'auth_settings_google_clientid', // HTML element ID
	2356	+ __( 'Google Client ID', 'authorizer' ), // HTML element Title
	2357	+ array( $this, 'print_text_google_clientid' ), // Callback (echos form element)
	2358	+ 'authorizer', // Page this setting is shown on (slug)
	2359	+ 'auth_settings_external' // Section this setting is shown on
2666	2360	);
2667	2361	add_settings_field(
2668		- 'auth_settings_google_clientsecret',
2669		- __( 'Google Client Secret', 'authorizer' ),
2670		- array( $this, 'print_text_google_clientsecret' ),
2671		- 'authorizer',
2672		- 'auth_settings_external'
	2362	+ 'auth_settings_google_clientsecret', // HTML element ID
	2363	+ __( 'Google Client Secret', 'authorizer' ), // HTML element Title
	2364	+ array( $this, 'print_text_google_clientsecret' ), // Callback (echos form element)
	2365	+ 'authorizer', // Page this setting is shown on (slug)
	2366	+ 'auth_settings_external' // Section this setting is shown on
2673	2367	);
2674	2368	add_settings_field(
2675		- 'auth_settings_google_hosteddomain',
2676		- __( 'Google Hosted Domain', 'authorizer' ),
2677		- array( $this, 'print_text_google_hosteddomain' ),
2678		- 'authorizer',
2679		- 'auth_settings_external'
	2369	+ 'auth_settings_google_hosteddomain', // HTML element ID
	2370	+ __( 'Google Hosted Domain', 'authorizer' ), // HTML element Title
	2371	+ array( $this, 'print_text_google_hosteddomain' ), // Callback (echos form element)
	2372	+ 'authorizer', // Page this setting is shown on (slug)
	2373	+ 'auth_settings_external' // Section this setting is shown on
2680	2374	);
2681	2375	add_settings_field(
2682		- 'auth_settings_external_cas',
2683		- __( 'CAS Logins', 'authorizer' ),
2684		- array( $this, 'print_checkbox_auth_external_cas' ),
2685		- 'authorizer',
2686		- 'auth_settings_external'
	2376	+ 'auth_settings_external_cas', // HTML element ID
	2377	+ __( 'CAS Logins', 'authorizer' ), // HTML element Title
	2378	+ array( $this, 'print_checkbox_auth_external_cas' ), // Callback (echos form element)
	2379	+ 'authorizer', // Page this setting is shown on (slug)
	2380	+ 'auth_settings_external' // Section this setting is shown on
2687	2381	);
2688	2382	add_settings_field(
2689		- 'auth_settings_cas_custom_label',
2690		- __( 'CAS custom label', 'authorizer' ),
2691		- array( $this, 'print_text_cas_custom_label' ),
2692		- 'authorizer',
2693		- 'auth_settings_external'
	2383	+ 'auth_settings_cas_custom_label', // HTML element ID
	2384	+ __( 'CAS custom label', 'authorizer' ), // HTML element Title
	2385	+ array( $this, 'print_text_cas_custom_label' ), // Callback (echos form element)
	2386	+ 'authorizer', // Page this setting is shown on (slug)
	2387	+ 'auth_settings_external' // Section this setting is shown on
2694	2388	);
2695	2389	add_settings_field(
2696		- 'auth_settings_cas_host',
2697		- __( 'CAS server hostname', 'authorizer' ),
2698		- array( $this, 'print_text_cas_host' ),
2699		- 'authorizer',
2700		- 'auth_settings_external'
	2390	+ 'auth_settings_cas_host', // HTML element ID
	2391	+ __( 'CAS server hostname', 'authorizer' ), // HTML element Title
	2392	+ array( $this, 'print_text_cas_host' ), // Callback (echos form element)
	2393	+ 'authorizer', // Page this setting is shown on (slug)
	2394	+ 'auth_settings_external' // Section this setting is shown on
2701	2395	);
2702	2396	add_settings_field(
2703		- 'auth_settings_cas_port',
2704		- __( 'CAS server port', 'authorizer' ),
2705		- array( $this, 'print_text_cas_port' ),
2706		- 'authorizer',
2707		- 'auth_settings_external'
	2397	+ 'auth_settings_cas_port', // HTML element ID
	2398	+ __( 'CAS server port', 'authorizer' ), // HTML element Title
	2399	+ array( $this, 'print_text_cas_port' ), // Callback (echos form element)
	2400	+ 'authorizer', // Page this setting is shown on (slug)
	2401	+ 'auth_settings_external' // Section this setting is shown on
2708	2402	);
2709	2403	add_settings_field(
2710		- 'auth_settings_cas_path',
2711		- __( 'CAS server path/context', 'authorizer' ),
2712		- array( $this, 'print_text_cas_path' ),
2713		- 'authorizer',
2714		- 'auth_settings_external'
	2404	+ 'auth_settings_cas_path', // HTML element ID
	2405	+ __( 'CAS server path/context', 'authorizer' ), // HTML element Title
	2406	+ array( $this, 'print_text_cas_path' ), // Callback (echos form element)
	2407	+ 'authorizer', // Page this setting is shown on (slug)
	2408	+ 'auth_settings_external' // Section this setting is shown on
2715	2409	);
2716	2410	add_settings_field(
2717		- 'auth_settings_cas_version',
2718		- 'CAS server version',
2719		- array( $this, 'print_select_cas_version' ),
2720		- 'authorizer',
2721		- 'auth_settings_external'
	2411	+ 'auth_settings_cas_version', // HTML element ID
	2412	+ 'CAS server version', // HTML element Title
	2413	+ array( $this, 'print_select_cas_version' ), // Callback (echos form element)
	2414	+ 'authorizer', // Page this setting is shown on (slug)
	2415	+ 'auth_settings_external' // Section this setting is shown on
2722	2416	);
2723	2417	add_settings_field(
2724		- 'auth_settings_cas_attr_email',
2725		- __( 'CAS attribute containing email address', 'authorizer' ),
2726		- array( $this, 'print_text_cas_attr_email' ),
2727		- 'authorizer',
2728		- 'auth_settings_external'
	2418	+ 'auth_settings_cas_attr_email', // HTML element ID
	2419	+ __( 'CAS attribute containing email address', 'authorizer' ), // HTML element Title
	2420	+ array( $this, 'print_text_cas_attr_email' ), // Callback (echos form element)
	2421	+ 'authorizer', // Page this setting is shown on (slug)
	2422	+ 'auth_settings_external' // Section this setting is shown on
2729	2423	);
2730	2424	add_settings_field(
2731		- 'auth_settings_cas_attr_first_name',
2732		- __( 'CAS attribute containing first name', 'authorizer' ),
2733		- array( $this, 'print_text_cas_attr_first_name' ),
2734		- 'authorizer',
2735		- 'auth_settings_external'
	2425	+ 'auth_settings_cas_attr_first_name', // HTML element ID
	2426	+ __( 'CAS attribute containing first name', 'authorizer' ), // HTML element Title
	2427	+ array( $this, 'print_text_cas_attr_first_name' ), // Callback (echos form element)
	2428	+ 'authorizer', // Page this setting is shown on (slug)
	2429	+ 'auth_settings_external' // Section this setting is shown on
2736	2430	);
2737	2431	add_settings_field(
2738		- 'auth_settings_cas_attr_last_name',
2739		- __( 'CAS attribute containing last name', 'authorizer' ),
2740		- array( $this, 'print_text_cas_attr_last_name' ),
2741		- 'authorizer',
2742		- 'auth_settings_external'
	2432	+ 'auth_settings_cas_attr_last_name', // HTML element ID
	2433	+ __( 'CAS attribute containing last name', 'authorizer' ), // HTML element Title
	2434	+ array( $this, 'print_text_cas_attr_last_name' ), // Callback (echos form element)
	2435	+ 'authorizer', // Page this setting is shown on (slug)
	2436	+ 'auth_settings_external' // Section this setting is shown on
2743	2437	);
2744	2438	add_settings_field(
2745		- 'auth_settings_cas_attr_update_on_login',
2746		- __( 'CAS attribute update', 'authorizer' ),
2747		- array( $this, 'print_checkbox_cas_attr_update_on_login' ),
2748		- 'authorizer',
2749		- 'auth_settings_external'
	2439	+ 'auth_settings_cas_attr_update_on_login', // HTML element ID
	2440	+ __( 'CAS attribute update', 'authorizer' ), // HTML element Title
	2441	+ array( $this, 'print_checkbox_cas_attr_update_on_login' ), // Callback (echos form element)
	2442	+ 'authorizer', // Page this setting is shown on (slug)
	2443	+ 'auth_settings_external' // Section this setting is shown on
2750	2444	);
2751	2445	add_settings_field(
2752		- 'auth_settings_cas_auto_login',
2753		- __( 'CAS automatic login', 'authorizer' ),
2754		- array( $this, 'print_checkbox_cas_auto_login' ),
2755		- 'authorizer',
2756		- 'auth_settings_external'
	2446	+ 'auth_settings_cas_auto_login', // HTML element ID
	2447	+ __( 'CAS automatic login', 'authorizer' ), // HTML element Title
	2448	+ array( $this, 'print_checkbox_cas_auto_login' ), // Callback (echos form element)
	2449	+ 'authorizer', // Page this setting is shown on (slug)
	2450	+ 'auth_settings_external' // Section this setting is shown on
2757	2451	);
2758	2452	add_settings_field(
2759		- 'auth_settings_external_ldap',
2760		- __( 'LDAP Logins', 'authorizer' ),
2761		- array( $this, 'print_checkbox_auth_external_ldap' ),
2762		- 'authorizer',
2763		- 'auth_settings_external'
	2453	+ 'auth_settings_external_ldap', // HTML element ID
	2454	+ __( 'LDAP Logins', 'authorizer' ), // HTML element Title
	2455	+ array( $this, 'print_checkbox_auth_external_ldap' ), // Callback (echos form element)
	2456	+ 'authorizer', // Page this setting is shown on (slug)
	2457	+ 'auth_settings_external' // Section this setting is shown on
2764	2458	);
2765	2459	add_settings_field(
2766		- 'auth_settings_ldap_host',
2767		- __( 'LDAP Host', 'authorizer' ),
2768		- array( $this, 'print_text_ldap_host' ),
2769		- 'authorizer',
2770		- 'auth_settings_external'
	2460	+ 'auth_settings_ldap_host', // HTML element ID
	2461	+ __( 'LDAP Host', 'authorizer' ), // HTML element Title
	2462	+ array( $this, 'print_text_ldap_host' ), // Callback (echos form element)
	2463	+ 'authorizer', // Page this setting is shown on (slug)
	2464	+ 'auth_settings_external' // Section this setting is shown on
2771	2465	);
2772	2466	add_settings_field(
2773		- 'auth_settings_ldap_port',
2774		- __( 'LDAP Port', 'authorizer' ),
2775		- array( $this, 'print_text_ldap_port' ),
2776		- 'authorizer',
2777		- 'auth_settings_external'
	2467	+ 'auth_settings_ldap_port', // HTML element ID
	2468	+ __( 'LDAP Port', 'authorizer' ), // HTML element Title
	2469	+ array( $this, 'print_text_ldap_port' ), // Callback (echos form element)
	2470	+ 'authorizer', // Page this setting is shown on (slug)
	2471	+ 'auth_settings_external' // Section this setting is shown on
2778	2472	);
2779	2473	add_settings_field(
2780		- 'auth_settings_ldap_tls',
2781		- __( 'Use TLS', 'authorizer' ),
2782		- array( $this, 'print_checkbox_ldap_tls' ),
2783		- 'authorizer',
2784		- 'auth_settings_external'
	2474	+ 'auth_settings_ldap_tls', // HTML element ID
	2475	+ __( 'Secure Connection (TLS)', 'authorizer' ), // HTML element Title
	2476	+ array( $this, 'print_checkbox_ldap_tls' ), // Callback (echos form element)
	2477	+ 'authorizer', // Page this setting is shown on (slug)
	2478	+ 'auth_settings_external' // Section this setting is shown on
2785	2479	);
2786	2480	add_settings_field(
2787		- 'auth_settings_ldap_search_base',
2788		- __( 'LDAP Search Base', 'authorizer' ),
2789		- array( $this, 'print_text_ldap_search_base' ),
2790		- 'authorizer',
2791		- 'auth_settings_external'
	2481	+ 'auth_settings_ldap_search_base', // HTML element ID
	2482	+ __( 'LDAP Search Base', 'authorizer' ), // HTML element Title
	2483	+ array( $this, 'print_text_ldap_search_base' ), // Callback (echos form element)
	2484	+ 'authorizer', // Page this setting is shown on (slug)
	2485	+ 'auth_settings_external' // Section this setting is shown on
2792	2486	);
2793	2487	add_settings_field(
2794		- 'auth_settings_ldap_uid',
2795		- __( 'LDAP attribute containing username', 'authorizer' ),
2796		- array( $this, 'print_text_ldap_uid' ),
2797		- 'authorizer',
2798		- 'auth_settings_external'
	2488	+ 'auth_settings_ldap_uid', // HTML element ID
	2489	+ __( 'LDAP attribute containing username', 'authorizer' ), // HTML element Title
	2490	+ array( $this, 'print_text_ldap_uid' ), // Callback (echos form element)
	2491	+ 'authorizer', // Page this setting is shown on (slug)
	2492	+ 'auth_settings_external' // Section this setting is shown on
2799	2493	);
2800	2494	add_settings_field(
2801		- 'auth_settings_ldap_attr_email',
2802		- __( 'LDAP attribute containing email address', 'authorizer' ),
2803		- array( $this, 'print_text_ldap_attr_email' ),
2804		- 'authorizer',
2805		- 'auth_settings_external'
	2495	+ 'auth_settings_ldap_attr_email', // HTML element ID
	2496	+ __( 'LDAP attribute containing email address', 'authorizer' ), // HTML element Title
	2497	+ array( $this, 'print_text_ldap_attr_email' ), // Callback (echos form element)
	2498	+ 'authorizer', // Page this setting is shown on (slug)
	2499	+ 'auth_settings_external' // Section this setting is shown on
2806	2500	);
2807	2501	add_settings_field(
2808		- 'auth_settings_ldap_user',
2809		- __( 'LDAP Directory User', 'authorizer' ),
2810		- array( $this, 'print_text_ldap_user' ),
2811		- 'authorizer',
2812		- 'auth_settings_external'
	2502	+ 'auth_settings_ldap_user', // HTML element ID
	2503	+ __( 'LDAP Directory User', 'authorizer' ), // HTML element Title
	2504	+ array( $this, 'print_text_ldap_user' ), // Callback (echos form element)
	2505	+ 'authorizer', // Page this setting is shown on (slug)
	2506	+ 'auth_settings_external' // Section this setting is shown on
2813	2507	);
2814	2508	add_settings_field(
2815		- 'auth_settings_ldap_password',
2816		- __( 'LDAP Directory User Password', 'authorizer' ),
2817		- array( $this, 'print_password_ldap_password' ),
2818		- 'authorizer',
2819		- 'auth_settings_external'
	2509	+ 'auth_settings_ldap_password', // HTML element ID
	2510	+ __( 'LDAP Directory User Password', 'authorizer' ), // HTML element Title
	2511	+ array( $this, 'print_password_ldap_password' ), // Callback (echos form element)
	2512	+ 'authorizer', // Page this setting is shown on (slug)
	2513	+ 'auth_settings_external' // Section this setting is shown on
2820	2514	);
2821	2515	add_settings_field(
2822		- 'auth_settings_ldap_lostpassword_url',
2823		- __( 'Custom lost password URL', 'authorizer' ),
2824		- array( $this, 'print_text_ldap_lostpassword_url' ),
2825		- 'authorizer',
2826		- 'auth_settings_external'
	2516	+ 'auth_settings_ldap_lostpassword_url', // HTML element ID
	2517	+ __( 'Custom lost password URL', 'authorizer' ), // HTML element Title
	2518	+ array( $this, 'print_text_ldap_lostpassword_url' ), // Callback (echos form element)
	2519	+ 'authorizer', // Page this setting is shown on (slug)
	2520	+ 'auth_settings_external' // Section this setting is shown on
2827	2521	);
2828	2522	add_settings_field(
2829		- 'auth_settings_ldap_attr_first_name',
2830		- __( 'LDAP attribute containing first name', 'authorizer' ),
2831		- array( $this, 'print_text_ldap_attr_first_name' ),
2832		- 'authorizer',
2833		- 'auth_settings_external'
	2523	+ 'auth_settings_ldap_attr_first_name', // HTML element ID
	2524	+ __( 'LDAP attribute containing first name', 'authorizer' ), // HTML element Title
	2525	+ array( $this, 'print_text_ldap_attr_first_name' ), // Callback (echos form element)
	2526	+ 'authorizer', // Page this setting is shown on (slug)
	2527	+ 'auth_settings_external' // Section this setting is shown on
2834	2528	);
2835	2529	add_settings_field(
2836		- 'auth_settings_ldap_attr_last_name',
2837		- __( 'LDAP attribute containing last name', 'authorizer' ),
2838		- array( $this, 'print_text_ldap_attr_last_name' ),
2839		- 'authorizer',
2840		- 'auth_settings_external'
	2530	+ 'auth_settings_ldap_attr_last_name', // HTML element ID
	2531	+ __( 'LDAP attribute containing last name', 'authorizer' ), // HTML element Title
	2532	+ array( $this, 'print_text_ldap_attr_last_name' ), // Callback (echos form element)
	2533	+ 'authorizer', // Page this setting is shown on (slug)
	2534	+ 'auth_settings_external' // Section this setting is shown on
2841	2535	);
2842	2536	add_settings_field(
2843		- 'auth_settings_ldap_attr_update_on_login',
2844		- __( 'LDAP attribute update', 'authorizer' ),
2845		- array( $this, 'print_checkbox_ldap_attr_update_on_login' ),
2846		- 'authorizer',
2847		- 'auth_settings_external'
	2537	+ 'auth_settings_ldap_attr_update_on_login', // HTML element ID
	2538	+ __( 'LDAP attribute update', 'authorizer' ), // HTML element Title
	2539	+ array( $this, 'print_checkbox_ldap_attr_update_on_login' ), // Callback (echos form element)
	2540	+ 'authorizer', // Page this setting is shown on (slug)
	2541	+ 'auth_settings_external' // Section this setting is shown on
2848	2542	);
2849	2543
2850		- // Create Advanced Settings section.
	2544	+ // Create Advanced Settings section
2851	2545	add_settings_section(
2852		- 'auth_settings_advanced',
2853		- '',
2854		- array( $this, 'print_section_info_advanced' ),
2855		- 'authorizer'
	2546	+ 'auth_settings_advanced', // HTML element ID
	2547	+ '', // HTML element Title
	2548	+ array( $this, 'print_section_info_advanced' ), // Callback (echos section content)
	2549	+ 'authorizer' // Page this section is shown on (slug)
2856	2550	);
2857	2551	add_settings_field(
2858		- 'auth_settings_advanced_lockouts',
2859		- __( 'Limit invalid login attempts', 'authorizer' ),
2860		- array( $this, 'print_text_auth_advanced_lockouts' ),
2861		- 'authorizer',
2862		- 'auth_settings_advanced'
	2552	+ 'auth_settings_advanced_lockouts', // HTML element ID
	2553	+ __( 'Limit invalid login attempts', 'authorizer' ), // HTML element Title
	2554	+ array( $this, 'print_text_auth_advanced_lockouts' ), // Callback (echos form element)
	2555	+ 'authorizer', // Page this setting is shown on (slug)
	2556	+ 'auth_settings_advanced' // Section this setting is shown on
2863	2557	);
2864	2558	add_settings_field(
2865		- 'auth_settings_advanced_hide_wp_login',
2866		- __( 'Hide WordPress Login', 'authorizer' ),
2867		- array( $this, 'print_checkbox_auth_advanced_hide_wp_login' ),
2868		- 'authorizer',
2869		- 'auth_settings_advanced'
	2559	+ 'auth_settings_advanced_hide_wp_login', // HTML element ID
	2560	+ __( 'Hide WordPress Login', 'authorizer' ), // HTML element Title
	2561	+ array( $this, 'print_checkbox_auth_advanced_hide_wp_login' ), // Callback (echos form element)
	2562	+ 'authorizer', // Page this setting is shown on (slug)
	2563	+ 'auth_settings_advanced' // Section this setting is shown on
2870	2564	);
2871	2565	add_settings_field(
2872		- 'auth_settings_advanced_branding',
2873		- __( 'Custom WordPress login branding', 'authorizer' ),
2874		- array( $this, 'print_radio_auth_advanced_branding' ),
2875		- 'authorizer',
2876		- 'auth_settings_advanced'
	2566	+ 'auth_settings_advanced_branding', // HTML element ID
	2567	+ __( 'Custom WordPress login branding', 'authorizer' ), // HTML element Title
	2568	+ array( $this, 'print_radio_auth_advanced_branding' ), // Callback (echos form element)
	2569	+ 'authorizer', // Page this setting is shown on (slug)
	2570	+ 'auth_settings_advanced' // Section this setting is shown on
2877	2571	);
2878	2572	add_settings_field(
2879		- 'auth_settings_advanced_admin_menu',
2880		- __( 'Authorizer admin menu item location', 'authorizer' ),
2881		- array( $this, 'print_radio_auth_advanced_admin_menu' ),
2882		- 'authorizer',
2883		- 'auth_settings_advanced'
	2573	+ 'auth_settings_advanced_admin_menu', // HTML element ID
	2574	+ __( 'Authorizer admin menu item location', 'authorizer' ), // HTML element Title
	2575	+ array( $this, 'print_radio_auth_advanced_admin_menu' ), // Callback (echos form element)
	2576	+ 'authorizer', // Page this setting is shown on (slug)
	2577	+ 'auth_settings_advanced' // Section this setting is shown on
2884	2578	);
2885	2579	add_settings_field(
2886		- 'auth_settings_advanced_usermeta',
2887		- __( 'Show custom usermeta in user list', 'authorizer' ),
2888		- array( $this, 'print_select_auth_advanced_usermeta' ),
2889		- 'authorizer',
2890		- 'auth_settings_advanced'
	2580	+ 'auth_settings_advanced_usermeta', // HTML element ID
	2581	+ __( 'Show custom usermeta in user list', 'authorizer' ), // HTML element Title
	2582	+ array( $this, 'print_select_auth_advanced_usermeta' ), // Callback (echos form element)
	2583	+ 'authorizer', // Page this setting is shown on (slug)
	2584	+ 'auth_settings_advanced' // Section this setting is shown on
2891	2585	);
2892		- add_settings_field(
2893		- 'auth_settings_advanced_users_per_page',
2894		- __( 'Number of users per page', 'authorizer' ),
2895		- array( $this, 'print_text_auth_advanced_users_per_page' ),
2896		- 'authorizer',
2897		- 'auth_settings_advanced'
2898		- );
2899		- add_settings_field(
2900		- 'auth_settings_advanced_users_sort_by',
2901		- __( 'Approved users sort method', 'authorizer' ),
2902		- array( $this, 'print_select_auth_advanced_users_sort_by' ),
2903		- 'authorizer',
2904		- 'auth_settings_advanced'
2905		- );
2906		- add_settings_field(
2907		- 'auth_settings_advanced_users_sort_order',
2908		- __( 'Approved users sort order', 'authorizer' ),
2909		- array( $this, 'print_select_auth_advanced_users_sort_order' ),
2910		- 'authorizer',
2911		- 'auth_settings_advanced'
2912		- );
2913		- add_settings_field(
2914		- 'auth_settings_advanced_widget_enabled',
2915		- __( 'Show dashboard widget to admin users', 'authorizer' ),
2916		- array( $this, 'print_checkbox_auth_advanced_widget_enabled' ),
2917		- 'authorizer',
2918		- 'auth_settings_advanced'
2919		- );
2920	2586	// On multisite installs, add an option to override all multisite settings on individual sites.
2921	2587	if ( is_multisite() ) {
2922	2588	add_settings_field(
2923		- 'auth_settings_advanced_override_multisite',
2924		- __( 'Override multisite options', 'authorizer' ),
2925		- array( $this, 'print_checkbox_auth_advanced_override_multisite' ),
2926		- 'authorizer',
2927		- 'auth_settings_advanced'
	2589	+ 'auth_settings_advanced_override_multisite', // HTML element ID
	2590	+ __( 'Override multisite options', 'authorizer' ), // HTML element Title
	2591	+ array( $this, 'print_checkbox_auth_advanced_override_multisite' ), // Callback (echos form element)
	2592	+ 'authorizer', // Page this setting is shown on (slug)
	2593	+ 'auth_settings_advanced' // Section this setting is shown on
2928	2594	);
2929	2595	}
2930	2596	}
2931	2597
		@@ -2931,30 +2597,29 @@
2931	2597
2932	2598
2933	2599	/**
2934	2600	* Set meaningful defaults for the plugin options.
2935		- *
2936	2601	* Note: This function is called on plugin activation.
2937	2602	*/
2938		- private function set_default_options() {
	2603	+ function set_default_options() {
2939	2604	global $wp_roles;
2940	2605
2941	2606	$auth_settings = get_option( 'auth_settings' );
2942		- if ( false === $auth_settings ) {
	2607	+ if ( $auth_settings === FALSE ) {
2943	2608	$auth_settings = array();
2944	2609	}
2945	2610
2946	2611	// Access Lists Defaults.
2947	2612	$auth_settings_access_users_pending = get_option( 'auth_settings_access_users_pending' );
2948		- if ( false === $auth_settings_access_users_pending ) {
	2613	+ if ( $auth_settings_access_users_pending === FALSE ) {
2949	2614	$auth_settings_access_users_pending = array();
2950	2615	}
2951	2616	$auth_settings_access_users_approved = get_option( 'auth_settings_access_users_approved' );
2952		- if ( false === $auth_settings_access_users_approved ) {
	2617	+ if ( $auth_settings_access_users_approved === FALSE ) {
2953	2618	$auth_settings_access_users_approved = array();
2954	2619	}
2955	2620	$auth_settings_access_users_blocked = get_option( 'auth_settings_access_users_blocked' );
2956		- if ( false === $auth_settings_access_users_blocked ) {
	2621	+ if ( $auth_settings_access_users_blocked === FALSE ) {
2957	2622	$auth_settings_access_users_blocked = array();
2958	2623	}
2959	2624
2960	2625	// Login Access Defaults.
		@@ -3006,12 +2671,13 @@
3006	2671	if ( ! array_key_exists( 'access_redirect_to_message', $auth_settings ) ) {
3007	2672	$auth_settings['access_redirect_to_message'] = '<p>' . __( 'Notice: You are browsing this site anonymously, and only have access to a portion of its content.', 'authorizer' ) . '</p>';
3008	2673	}
3009	2674
	2675	+
3010	2676	// External Service Defaults.
3011	2677	if ( ! array_key_exists( 'access_default_role', $auth_settings ) ) {
3012	2678	// Set default role to 'student' if that role exists, 'subscriber' otherwise.
3013		- $all_roles = $wp_roles->roles;
	2679	+ $all_roles = $wp_roles->roles;
3014	2680	$editable_roles = apply_filters( 'editable_roles', $all_roles );
3015	2681	if ( array_key_exists( 'student', $editable_roles ) ) {
3016	2682	$auth_settings['access_default_role'] = 'student';
3017	2683	} else {
		@@ -3109,12 +2775,12 @@
3109	2775
3110	2776	// Advanced defaults.
3111	2777	if ( ! array_key_exists( 'advanced_lockouts', $auth_settings ) ) {
3112	2778	$auth_settings['advanced_lockouts'] = array(
3113		- 'attempts_1' => 10,
3114		- 'duration_1' => 1,
3115		- 'attempts_2' => 10,
3116		- 'duration_2' => 10,
	2779	+ 'attempts_1' => 10,
	2780	+ 'duration_1' => 1,
	2781	+ 'attempts_2' => 10,
	2782	+ 'duration_2' => 10,
3117	2783	'reset_duration' => 120,
3118	2784	);
3119	2785	}
3120	2786	if ( ! array_key_exists( 'advanced_hide_wp_login', $auth_settings ) ) {
		@@ -3128,20 +2794,8 @@
3128	2794	}
3129	2795	if ( ! array_key_exists( 'advanced_usermeta', $auth_settings ) ) {
3130	2796	$auth_settings['advanced_usermeta'] = '';
3131	2797	}
3132		- if ( ! array_key_exists( 'advanced_users_per_page', $auth_settings ) ) {
3133		- $auth_settings['advanced_users_per_page'] = 20;
3134		- }
3135		- if ( ! array_key_exists( 'advanced_users_sort_by', $auth_settings ) ) {
3136		- $auth_settings['advanced_users_sort_by'] = 'created';
3137		- }
3138		- if ( ! array_key_exists( 'advanced_users_sort_order', $auth_settings ) ) {
3139		- $auth_settings['advanced_users_sort_order'] = 'asc';
3140		- }
3141		- if ( ! array_key_exists( 'advanced_widget_enabled', $auth_settings ) ) {
3142		- $auth_settings['advanced_widget_enabled'] = '1';
3143		- }
3144	2798	if ( ! array_key_exists( 'advanced_override_multisite', $auth_settings ) ) {
3145	2799	$auth_settings['advanced_override_multisite'] = '';
3146	2800	}
3147	2801
		@@ -3152,11 +2806,11 @@
3152	2806	update_option( 'auth_settings_access_users_blocked', $auth_settings_access_users_blocked );
3153	2807
3154	2808	// Multisite defaults.
3155	2809	if ( is_multisite() ) {
3156		- $auth_multisite_settings = get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings', array() );
	2810	+ $auth_multisite_settings = get_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings', array() );
3157	2811
3158		- if ( false === $auth_multisite_settings ) {
	2812	+ if ( $auth_multisite_settings === FALSE ) {
3159	2813	$auth_multisite_settings = array();
3160	2814	}
3161	2815	// Global switch for enabling multisite options.
3162	2816	if ( ! array_key_exists( 'multisite_override', $auth_multisite_settings ) ) {
		@@ -3162,10 +2816,10 @@
3162	2816	if ( ! array_key_exists( 'multisite_override', $auth_multisite_settings ) ) {
3163	2817	$auth_multisite_settings['multisite_override'] = '';
3164	2818	}
3165	2819	// Access Lists Defaults.
3166		- $auth_multisite_settings_access_users_approved = get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved' );
3167		- if ( false === $auth_multisite_settings_access_users_approved ) {
	2820	+ $auth_multisite_settings_access_users_approved = get_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved' );
	2821	+ if ( $auth_multisite_settings_access_users_approved === FALSE ) {
3168	2822	$auth_multisite_settings_access_users_approved = array();
3169	2823	}
3170	2824	// Login Access Defaults.
3171	2825	if ( ! array_key_exists( 'access_who_can_login', $auth_multisite_settings ) ) {
		@@ -3177,9 +2831,9 @@
3177	2831	}
3178	2832	// External Service Defaults.
3179	2833	if ( ! array_key_exists( 'access_default_role', $auth_multisite_settings ) ) {
3180	2834	// Set default role to 'student' if that role exists, 'subscriber' otherwise.
3181		- $all_roles = $wp_roles->roles;
	2835	+ $all_roles = $wp_roles->roles;
3182	2836	$editable_roles = apply_filters( 'editable_roles', $all_roles );
3183	2837	if ( array_key_exists( 'student', $editable_roles ) ) {
3184	2838	$auth_multisite_settings['access_default_role'] = 'student';
3185	2839	} else {
		@@ -3272,12 +2926,12 @@
3272	2926	}
3273	2927	// Advanced defaults.
3274	2928	if ( ! array_key_exists( 'advanced_lockouts', $auth_multisite_settings ) ) {
3275	2929	$auth_multisite_settings['advanced_lockouts'] = array(
3276		- 'attempts_1' => 10,
3277		- 'duration_1' => 1,
3278		- 'attempts_2' => 10,
3279		- 'duration_2' => 10,
	2930	+ 'attempts_1' => 10,
	2931	+ 'duration_1' => 1,
	2932	+ 'attempts_2' => 10,
	2933	+ 'duration_2' => 10,
3280	2934	'reset_duration' => 120,
3281	2935	);
3282	2936	}
3283	2937	if ( ! array_key_exists( 'advanced_hide_wp_login', $auth_multisite_settings ) ) {
		@@ -3282,23 +2936,11 @@
3282	2936	}
3283	2937	if ( ! array_key_exists( 'advanced_hide_wp_login', $auth_multisite_settings ) ) {
3284	2938	$auth_multisite_settings['advanced_hide_wp_login'] = '';
3285	2939	}
3286		- if ( ! array_key_exists( 'advanced_users_per_page', $auth_multisite_settings ) ) {
3287		- $auth_multisite_settings['advanced_users_per_page'] = 20;
3288		- }
3289		- if ( ! array_key_exists( 'advanced_users_sort_by', $auth_multisite_settings ) ) {
3290		- $auth_multisite_settings['advanced_users_sort_by'] = 'created';
3291		- }
3292		- if ( ! array_key_exists( 'advanced_users_sort_order', $auth_multisite_settings ) ) {
3293		- $auth_multisite_settings['advanced_users_sort_order'] = 'asc';
3294		- }
3295		- if ( ! array_key_exists( 'advanced_widget_enabled', $auth_multisite_settings ) ) {
3296		- $auth_multisite_settings['advanced_widget_enabled'] = '1';
3297		- }
3298	2940	// Save default network options to database.
3299		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings', $auth_multisite_settings );
3300		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
	2941	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings', $auth_multisite_settings );
	2942	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
3301	2943	}
3302	2944
3303	2945	return $auth_settings;
3304	2946	}
		@@ -3305,15 +2947,12 @@
3305	2947
3306	2948
3307	2949	/**
3308	2950	* List sanitizer.
3309		- *
3310		- * @param array $list Array of users to sanitize.
3311		- * @param string $side_effect Set to 'update roles' if role syncing should be performed.
3312		- * @param string $multisite_mode Set to 'multisite' to sync roles on all sites the user belongs to.
3313		- * @return array Array of sanitized users.
	2951	+ * $side_effect = 'none' or 'update roles' to make sure WP user roles match
	2952	+ * $multisite_mode = 'single' or 'multisite' to indicate which user roles to change (this site or all sites)
3314	2953	*/
3315		- private function sanitize_user_list( $list, $side_effect = 'none', $multisite_mode = 'single' ) {
	2954	+ function sanitize_user_list( $list, $side_effect = 'none', $multisite_mode = 'single' ) {
3316	2955	// If it's not a list, make it so.
3317	2956	if ( ! is_array( $list ) ) {
3318	2957	$list = array();
3319	2958	}
		@@ -3318,16 +2957,16 @@
3318	2957	$list = array();
3319	2958	}
3320	2959	foreach ( $list as $key => $user_info ) {
3321	2960	if ( strlen( $user_info['email'] ) < 1 ) {
3322		- // Make sure there are no empty entries in the list.
3323		- unset( $list[ $key ] );
3324		- } elseif ( 'update roles' === $side_effect ) {
	2961	+ // Make sure there are no empty entries in the list
	2962	+ unset( $list[$key] );
	2963	+ } elseif ( $side_effect === 'update roles' ) {
3325	2964	// Make sure the WordPress user accounts have the same role
3326	2965	// as that indicated in the list.
3327	2966	$wp_user = get_user_by( 'email', $user_info['email'] );
3328	2967	if ( $wp_user ) {
3329		- if ( is_multisite() && 'multisite' === $multisite_mode ) {
	2968	+ if ( is_multisite() && $multisite_mode === 'multisite' ) {
3330	2969	foreach ( get_blogs_of_user( $wp_user->ID ) as $blog ) {
3331	2970	add_user_to_blog( $blog->userblog_id, $wp_user->ID, $user_info['role'] );
3332	2971	}
3333	2972	} else {
		@@ -3340,21 +2979,18 @@
3340	2979	}
3341	2980
3342	2981
3343	2982	/**
3344		- * Settings sanitizer callback.
3345		- *
3346		- * @param array $auth_settings Authorizer settings array.
3347		- * @return array Sanitized Authorizer settings array.
	2983	+ * Settings sanitizer callback
3348	2984	*/
3349		- public function sanitize_options( $auth_settings ) {
	2985	+ function sanitize_options( $auth_settings ) {
3350	2986	// Default to "Approved Users" login access restriction.
3351		- if ( ! in_array( $auth_settings['access_who_can_login'], array( 'external_users', 'approved_users' ), true ) ) {
	2987	+ if ( ! in_array( $auth_settings['access_who_can_login'], array( 'external_users', 'approved_users' ) ) ) {
3352	2988	$auth_settings['access_who_can_login'] = 'approved_users';
3353	2989	}
3354	2990
3355	2991	// Default to "Everyone" view access restriction.
3356		- if ( ! in_array( $auth_settings['access_who_can_view'], array( 'everyone', 'logged_in_users' ), true ) ) {
	2992	+ if ( ! in_array( $auth_settings['access_who_can_view'], array( 'everyone', 'logged_in_users' ) ) ) {
3357	2993	$auth_settings['access_who_can_view'] = 'everyone';
3358	2994	}
3359	2995
3360	2996	// Default to WordPress login access redirect.
		@@ -3359,9 +2995,9 @@
3359	2995
3360	2996	// Default to WordPress login access redirect.
3361	2997	// Note: this option doesn't exist in multisite options, so we first
3362	2998	// check to see if it exists.
3363		- if ( array_key_exists( 'access_redirect', $auth_settings ) && ! in_array( $auth_settings['access_redirect'], array( 'login', 'page', 'message' ), true ) ) {
	2999	+ if ( array_key_exists( 'access_redirect', $auth_settings ) && ! in_array( $auth_settings['access_redirect'], array( 'login', 'page', 'message' ) ) ) {
3364	3000	$auth_settings['access_redirect'] = 'login';
3365	3001	}
3366	3002
3367	3003	// Default to warning message for anonymous users on public pages.
		@@ -3366,61 +3002,61 @@
3366	3002
3367	3003	// Default to warning message for anonymous users on public pages.
3368	3004	// Note: this option doesn't exist in multisite options, so we first
3369	3005	// check to see if it exists.
3370		- if ( array_key_exists( 'access_public_warning', $auth_settings ) && ! in_array( $auth_settings['access_public_warning'], array( 'no_warning', 'warning' ), true ) ) {
	3006	+ if ( array_key_exists( 'access_public_warning', $auth_settings ) && ! in_array( $auth_settings['access_public_warning'], array( 'no_warning', 'warning' ) ) ) {
3371	3007	$auth_settings['access_public_warning'] = 'no_warning';
3372	3008	}
3373	3009
3374		- // Sanitize Send welcome email (checkbox: value can only be '1' or empty string).
	3010	+ // Sanitize Send welcome email (checkbox: value can only be '1' or empty string)
3375	3011	$auth_settings['access_should_email_approved_users'] = array_key_exists( 'access_should_email_approved_users', $auth_settings ) && strlen( $auth_settings['access_should_email_approved_users'] ) > 0 ? '1' : '';
3376	3012
3377		- // Sanitize Enable Google Logins (checkbox: value can only be '1' or empty string).
	3013	+ // Sanitize Enable Google Logins (checkbox: value can only be '1' or empty string)
3378	3014	$auth_settings['google'] = array_key_exists( 'google', $auth_settings ) && strlen( $auth_settings['google'] ) > 0 ? '1' : '';
3379	3015
3380		- // Sanitize Enable CAS Logins (checkbox: value can only be '1' or empty string).
	3016	+ // Sanitize Enable CAS Logins (checkbox: value can only be '1' or empty string)
3381	3017	$auth_settings['cas'] = array_key_exists( 'cas', $auth_settings ) && strlen( $auth_settings['cas'] ) > 0 ? '1' : '';
3382	3018
3383		- // Sanitize CAS Host setting.
	3019	+ // Sanitize CAS Host setting
3384	3020	$auth_settings['cas_host'] = filter_var( $auth_settings['cas_host'], FILTER_SANITIZE_URL );
3385	3021
3386		- // Sanitize CAS Port (int).
	3022	+ // Sanitize CAS Port (int)
3387	3023	$auth_settings['cas_port'] = filter_var( $auth_settings['cas_port'], FILTER_SANITIZE_NUMBER_INT );
3388	3024
3389		- // Sanitize CAS attribute update (checkbox: value can only be '1' or empty string).
	3025	+ // Sanitize CAS attribute update (checkbox: value can only be '1' or empty string)
3390	3026	$auth_settings['cas_attr_update_on_login'] = array_key_exists( 'cas_attr_update_on_login', $auth_settings ) && strlen( $auth_settings['cas_attr_update_on_login'] ) > 0 ? '1' : '';
3391	3027
3392		- // Sanitize CAS auto-login (checkbox: value can only be '1' or empty string).
	3028	+ // Sanitize CAS auto-login (checkbox: value can only be '1' or empty string)
3393	3029	$auth_settings['cas_auto_login'] = array_key_exists( 'cas_auto_login', $auth_settings ) && strlen( $auth_settings['cas_auto_login'] ) > 0 ? '1' : '';
3394	3030
3395		- // Sanitize Enable LDAP Logins (checkbox: value can only be '1' or empty string).
	3031	+ // Sanitize Enable LDAP Logins (checkbox: value can only be '1' or empty string)
3396	3032	$auth_settings['ldap'] = array_key_exists( 'ldap', $auth_settings ) && strlen( $auth_settings['ldap'] ) > 0 ? '1' : '';
3397	3033
3398		- // Sanitize LDAP Host setting.
	3034	+ // Sanitize LDAP Host setting
3399	3035	$auth_settings['ldap_host'] = filter_var( $auth_settings['ldap_host'], FILTER_SANITIZE_URL );
3400	3036
3401		- // Sanitize LDAP Port (int).
	3037	+ // Sanitize LDAP Port (int)
3402	3038	$auth_settings['ldap_port'] = filter_var( $auth_settings['ldap_port'], FILTER_SANITIZE_NUMBER_INT );
3403	3039
3404		- // Sanitize LDAP TLS (checkbox: value can only be '1' or empty string).
	3040	+ // Sanitize LDAP TLS (checkbox: value can only be '1' or empty string)
3405	3041	$auth_settings['ldap_tls'] = array_key_exists( 'ldap_tls', $auth_settings ) && strlen( $auth_settings['ldap_tls'] ) > 0 ? '1' : '';
3406	3042
3407		- // Sanitize LDAP attributes (basically make sure they don't have any parentheses).
	3043	+ // Sanitize LDAP attributes (basically make sure they don't have any parentheses)
3408	3044	$auth_settings['ldap_uid'] = filter_var( $auth_settings['ldap_uid'], FILTER_SANITIZE_EMAIL );
3409	3045
3410		- // Sanitize LDAP Lost Password URL.
	3046	+ // Sanitize LDAP Lost Password URL
3411	3047	$auth_settings['ldap_lostpassword_url'] = filter_var( $auth_settings['ldap_lostpassword_url'], FILTER_SANITIZE_URL );
3412	3048
3413		- // Obfuscate LDAP directory user password.
	3049	+ // Obfuscate LDAP directory user password
3414	3050	if ( strlen( $auth_settings['ldap_password'] ) > 0 ) {
3415	3051	// encrypt the directory user password for some minor obfuscation in the database.
3416	3052	$auth_settings['ldap_password'] = $this->encrypt( $auth_settings['ldap_password'] );
3417	3053	}
3418	3054
3419		- // Sanitize LDAP attribute update (checkbox: value can only be '1' or empty string).
	3055	+ // Sanitize LDAP attribute update (checkbox: value can only be '1' or empty string)
3420	3056	$auth_settings['ldap_attr_update_on_login'] = array_key_exists( 'ldap_attr_update_on_login', $auth_settings ) && strlen( $auth_settings['ldap_attr_update_on_login'] ) > 0 ? '1' : '';
3421	3057
3422		- // Make sure public pages is an empty array if it's empty.
	3058	+ // Make sure public pages is an empty array if it's empty
3423	3059	// Note: this option doesn't exist in multisite options, so we first
3424	3060	// check to see if it exists.
3425	3061	if ( array_key_exists( 'access_public_pages', $auth_settings ) && ! is_array( $auth_settings['access_public_pages'] ) ) {
3426	3062	$auth_settings['access_public_pages'] = array();
		@@ -3428,31 +3064,15 @@
3428	3064
3429	3065	// Make sure all lockout options are integers (attempts_1,
3430	3066	// duration_1, attempts_2, duration_2, reset_duration).
3431	3067	foreach ( $auth_settings['advanced_lockouts'] as $key => $value ) {
3432		- $auth_settings['advanced_lockouts'][ $key ] = filter_var( $value, FILTER_SANITIZE_NUMBER_INT );
	3068	+ $auth_settings['advanced_lockouts'][$key] = filter_var( $value, FILTER_SANITIZE_NUMBER_INT );
3433	3069	}
3434	3070
3435		- // Sanitize Hide WordPress logins (checkbox: value can only be '1' or empty string).
	3071	+ // Sanitize Hide WordPress logins (checkbox: value can only be '1' or empty string)
3436	3072	$auth_settings['advanced_hide_wp_login'] = array_key_exists( 'advanced_hide_wp_login', $auth_settings ) && strlen( $auth_settings['advanced_hide_wp_login'] ) > 0 ? '1' : '';
3437	3073
3438		- // Sanitize Users per page (text: value can only int from 1 to MAX_INT).
3439		- $auth_settings['advanced_users_per_page'] = array_key_exists( 'advanced_users_per_page', $auth_settings ) && intval( $auth_settings['advanced_users_per_page'] ) > 0 ? intval( $auth_settings['advanced_users_per_page'] ) : 1;
3440		-
3441		- // Sanitize Sort users by (select: value can be 'email', 'role', 'date_added', 'created').
3442		- if ( ! isset( $auth_settings['advanced_users_sort_by'] ) || ! in_array( $auth_settings['advanced_users_sort_by'], array( 'email', 'role', 'date_added', 'created' ), true ) ) {
3443		- $auth_settings['advanced_users_sort_by'] = 'created';
3444		- }
3445		-
3446		- // Sanitize Sort users order (select: value can be 'asc', 'desc').
3447		- if ( ! isset( $auth_settings['advanced_users_sort_order'] ) || ! in_array( $auth_settings['advanced_users_sort_order'], array( 'asc', 'desc' ), true ) ) {
3448		- $auth_settings['advanced_users_sort_order'] = 'asc';
3449		- }
3450		-
3451		- // Sanitize Show Dashboard Widget (checkbox: value can only be '1' or empty string).
3452		- $auth_settings['advanced_widget_enabled'] = array_key_exists( 'advanced_widget_enabled', $auth_settings ) && strlen( $auth_settings['advanced_widget_enabled'] ) > 0 ? '1' : '';
3453		-
3454		- // Sanitize Override multisite options (checkbox: value can only be '1' or empty string).
	3074	+ // Sanitize Override multisite options (checkbox: value can only be '1' or empty string)
3455	3075	$auth_settings['advanced_override_multisite'] = array_key_exists( 'advanced_override_multisite', $auth_settings ) && strlen( $auth_settings['advanced_override_multisite'] ) > 0 ? '1' : '';
3456	3076
3457	3077	return $auth_settings;
3458	3078	}
		@@ -3459,201 +3079,90 @@
3459	3079
3460	3080
3461	3081	/**
3462	3082	* Keep authorizer approved users' roles in sync with WordPress roles
3463		- * if someone changes the role via the WordPress Edit User page
3464		- * (wp-admin/user-edit.php or wp-admin/profile.php).
	3083	+ * if someone changes the role via the WordPress Edit User options page.
3465	3084	*
3466		- * Action: user_profile_update_errors
3467		- *
3468		- * @param WP_Error $errors Errors object to add any custom errors to (passed by reference).
3469		- * @param bool $update True if updating existing user, false if saving a new one.
3470		- * @param stdClass $user Updated WP_User object for user being edited (passed by reference).
	3085	+ * @action edit_user_profile_update
	3086	+ * @ref https://codex.wordpress.org/Plugin_API/Action_Reference/edit_user_profile_update
	3087	+ * @param int $user_id The user ID of the user being edited
	3088	+
	3089	+ * @action personal_options_update
	3090	+ * @ref https://codex.wordpress.org/Plugin_API/Action_Reference/personal_options_update
	3091	+ * @param int $user_id The user ID of the user being edited
3471	3092	*/
3472		- public function edit_user_profile_update_role( &$errors, $update, &$user ) {
3473		- // Do nothing if we're not updating role.
3474		- if ( ! property_exists( $user, 'role' ) ) {
	3093	+ function edit_user_profile_update_role( $user_id ) {
	3094	+ if ( ! current_user_can( 'edit_user', $user_id ) ) {
3475	3095	return;
3476	3096	}
3477	3097
3478		- // Safety check; will likely not fire if we reach this function.
3479		- if ( ! current_user_can( 'edit_user', $user->ID ) ) {
3480		- return;
3481		- }
3482		-
3483		- // Don't perform Authorizer updates if we have a WordPress error.
3484		- $errors_on_user_update = $errors->get_error_codes();
3485		- if ( ! empty( $errors_on_user_update ) ) {
3486		- return;
3487		- }
3488		-
3489		- // Get original user object (fail if not a real WordPress user).
3490		- $userdata = get_userdata( $user->ID );
3491		- if ( ! $userdata ) {
3492		- return;
3493		- }
3494		-
3495	3098	// If user is in approved list, update his/her associated role.
3496		- if ( $this->is_email_in_list( $userdata->user_email, 'approved' ) ) {
3497		- $auth_settings_access_users_approved = $this->sanitize_user_list( $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT ) );
3498		- foreach ( $auth_settings_access_users_approved as $key => $check_user ) {
3499		- if ( 0 === strcasecmp( $check_user['email'], $userdata->user_email ) ) {
3500		- $auth_settings_access_users_approved[ $key ]['role'] = $user->role;
3501		- }
3502		- }
3503		- update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved );
3504		- }
3505		- }
3506		-
3507		-
3508		- /**
3509		- * Sync any email address changes to WordPress accounts to the corresponding
3510		- * entry in the Authorizer approved list.
3511		- *
3512		- * Note: This filter fires in wp_update_user() if the update includes an
3513		- * email address change, and fires after all security and integrity checks
3514		- * have been performed, so we can simply update the Authorizer approved
3515		- * list, changing the email address on the approved entry, and removing any
3516		- * existing entries that also have the new email address (duplicates).
3517		- *
3518		- * Filter: send_email_change_email
3519		- *
3520		- * @param bool $send Whether to send the email.
3521		- * @param array $user The original user array.
3522		- * @param array $userdata The updated user array.
3523		- */
3524		- public function edit_user_profile_update_email( $send, $user, $userdata ) {
3525		- // If we're in multisite, update the email on all sites in the network
3526		- // (and remove from any subsites if it's a network-approved user).
3527		- if ( is_multisite() ) {
3528		- // If it's a multisite approved user, sync the email there.
3529		- $changed_user_is_multisite_user = false;
3530		- if ( $this->is_email_in_list( $user['user_email'], 'approved', 'multisite' ) ) {
3531		- $changed_user_is_multisite_user = true;
3532		- $auth_multisite_settings_access_users_approved = $this->sanitize_user_list(
3533		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT )
3534		- );
3535		- foreach ( $auth_multisite_settings_access_users_approved as $key => $check_user ) {
3536		- // Update old user email in approved list to the new email.
3537		- if ( 0 === strcasecmp( $check_user['email'], $user['user_email'] ) ) {
3538		- $auth_multisite_settings_access_users_approved[ $key ]['email'] = $this->lowercase( $userdata['user_email'] );
	3099	+ $wp_user = get_user_by( 'id', $user_id );
	3100	+ if ( $this->is_email_in_list( $wp_user->get( 'user_email' ), 'approved' ) ) {
	3101	+ $auth_settings_access_users_approved = $this->sanitize_user_list( $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN ) );
	3102	+ // Find approved user and sync with the corresponding WP_User.
	3103	+ foreach ( $auth_settings_access_users_approved as $key => $user ) {
	3104	+ if ( $user['email'] === $wp_user->user_email ) {
	3105	+ // Sync user role.
	3106	+ if ( array_key_exists( 'role', $_REQUEST ) ) {
	3107	+ $auth_settings_access_users_approved[$key]['role'] = $_REQUEST['role'];
3539	3108	}
3540		- // If new user email is already in approved list, remove that entry.
3541		- if ( 0 === strcasecmp( $check_user['email'], $userdata['user_email'] ) ) {
3542		- unset( $auth_multisite_settings_access_users_approved[ $key ] );
	3109	+ // Sync email address.
	3110	+ if ( array_key_exists( 'email', $_REQUEST ) ) {
	3111	+ $auth_settings_access_users_approved[$key]['email'] = $_REQUEST['email'];
3543	3112	}
3544	3113	}
3545		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
3546	3114	}
3547	3115
3548		- // Go through all approved lists on individual sites and sync this user there.
3549		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
3550		- $sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
3551		- foreach ( $sites as $site ) {
3552		- $updated = false;
3553		- $blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
3554		- $auth_settings_access_users_approved = get_blog_option( $blog_id, 'auth_settings_access_users_approved', array() );
3555		- foreach ( $auth_settings_access_users_approved as $key => $check_user ) {
3556		- // Update old user email in approved list to the new email.
3557		- if ( 0 === strcasecmp( $check_user['email'], $user['user_email'] ) ) {
3558		- // But if the user is already a multisite user, just remove the entry in the subsite.
3559		- if ( $changed_user_is_multisite_user ) {
3560		- unset( $auth_settings_access_users_approved[ $key ] );
3561		- } else {
3562		- $auth_settings_access_users_approved[ $key ]['email'] = $this->lowercase( $userdata['user_email'] );
3563		- }
3564		- $updated = true;
3565		- }
3566		- // If new user email is already in approved list, remove that entry.
3567		- if ( 0 === strcasecmp( $check_user['email'], $userdata['user_email'] ) ) {
3568		- unset( $auth_settings_access_users_approved[ $key ] );
3569		- $updated = true;
3570		- }
3571		- }
3572		- if ( $updated ) {
3573		- update_blog_option( $blog_id, 'auth_settings_access_users_approved', $auth_settings_access_users_approved );
3574		- }
3575		- }
3576		- } else {
3577		- // In a single site environment, just find the old user in the approved list and update the email.
3578		- if ( $this->is_email_in_list( $user['user_email'], 'approved' ) ) {
3579		- $auth_settings_access_users_approved = $this->sanitize_user_list( $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT ) );
3580		- foreach ( $auth_settings_access_users_approved as $key => $check_user ) {
3581		- // Update old user email in approved list to the new email.
3582		- if ( 0 === strcasecmp( $check_user['email'], $user['user_email'] ) ) {
3583		- $auth_settings_access_users_approved[ $key ]['email'] = $this->lowercase( $userdata['user_email'] );
3584		- }
3585		- // If new user email is already in approved list, remove that entry.
3586		- if ( 0 === strcasecmp( $check_user['email'], $userdata['user_email'] ) ) {
3587		- unset( $auth_settings_access_users_approved[ $key ] );
3588		- }
3589		- }
3590		- update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved );
3591		- }
	3116	+ update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved );
3592	3117	}
3593		-
3594		- // We're hooking into this filter merely for its location in the codebase,
3595		- // so make sure to return the filter value unmodified.
3596		- return $send;
3597	3118	}
3598	3119
3599	3120
3600	3121	/**
3601		- * Settings print callback.
3602		- *
3603		- * @param string $args Args (e.g., multisite admin mode).
3604		- * @return void
	3122	+ * Settings print callbacks
3605	3123	*/
3606		- public function print_section_info_tabs( $args = '' ) {
3607		- if ( WP_Plugin_Authorizer::NETWORK_CONTEXT === $this->get_admin_mode( $args ) ) :
3608		- ?>
	3124	+ function print_section_info_tabs( $args = '' ) {
	3125	+ if ( MULTISITE_ADMIN === $this->get_admin_mode( $args )): ?>
3609	3126	<h2 class="nav-tab-wrapper">
3610		- <a class="nav-tab nav-tab-access_lists nav-tab-active" href="javascript:chooseTab('access_lists' );"><?php esc_html_e( 'Access Lists', 'authorizer' ); ?></a>
3611		- <a class="nav-tab nav-tab-external" href="javascript:chooseTab('external' );"><?php esc_html_e( 'External Service', 'authorizer' ); ?></a>
3612		- <a class="nav-tab nav-tab-advanced" href="javascript:chooseTab('advanced' );"><?php esc_html_e( 'Advanced', 'authorizer' ); ?></a>
	3127	+ <a class="nav-tab nav-tab-access_lists nav-tab-active" href="javascript:choose_tab('access_lists' );"><?php _e( 'Access Lists', 'authorizer' ); ?></a>
	3128	+ <a class="nav-tab nav-tab-external" href="javascript:choose_tab('external' );"><?php _e( 'External Service', 'authorizer' ); ?></a>
	3129	+ <a class="nav-tab nav-tab-advanced" href="javascript:choose_tab('advanced' );"><?php _e( 'Advanced', 'authorizer' ); ?></a>
3613	3130	</h2>
3614		- <?php else : ?>
	3131	+ <?php else: ?>
3615	3132	<h2 class="nav-tab-wrapper">
3616		- <a class="nav-tab nav-tab-access_lists nav-tab-active" href="javascript:chooseTab('access_lists' );"><?php esc_html_e( 'Access Lists', 'authorizer' ); ?></a>
3617		- <a class="nav-tab nav-tab-access_login" href="javascript:chooseTab('access_login' );"><?php esc_html_e( 'Login Access', 'authorizer' ); ?></a>
3618		- <a class="nav-tab nav-tab-access_public" href="javascript:chooseTab('access_public' );"><?php esc_html_e( 'Public Access', 'authorizer' ); ?></a>
3619		- <a class="nav-tab nav-tab-external" href="javascript:chooseTab('external' );"><?php esc_html_e( 'External Service', 'authorizer' ); ?></a>
3620		- <a class="nav-tab nav-tab-advanced" href="javascript:chooseTab('advanced' );"><?php esc_html_e( 'Advanced', 'authorizer' ); ?></a>
	3133	+ <a class="nav-tab nav-tab-access_lists nav-tab-active" href="javascript:choose_tab('access_lists' );"><?php _e( 'Access Lists', 'authorizer' ); ?></a>
	3134	+ <a class="nav-tab nav-tab-access_login" href="javascript:choose_tab('access_login' );"><?php _e( 'Login Access', 'authorizer' ); ?></a>
	3135	+ <a class="nav-tab nav-tab-access_public" href="javascript:choose_tab('access_public' );"><?php _e( 'Public Access', 'authorizer' ); ?></a>
	3136	+ <a class="nav-tab nav-tab-external" href="javascript:choose_tab('external' );"><?php _e( 'External Service', 'authorizer' ); ?></a>
	3137	+ <a class="nav-tab nav-tab-advanced" href="javascript:choose_tab('advanced' );"><?php _e( 'Advanced', 'authorizer' ); ?></a>
3621	3138	</h2>
3622		- <?php
3623		- endif;
	3139	+ <?php endif;
3624	3140	}
3625	3141
3626	3142
3627		- /**
3628		- * Settings print callback.
3629		- *
3630		- * @param string $args Args (e.g., multisite admin mode).
3631		- * @return void
3632		- */
3633		- public function print_section_info_access_lists( $args = '' ) {
	3143	+ function print_section_info_access_lists( $args = '' ) {
3634	3144	$admin_mode = $this->get_admin_mode( $args );
3635		- ?>
3636		- <div id="section_info_access_lists" class="section_info">
3637		- <p><?php esc_html_e( 'Manage who has access to this site using these lists.', 'authorizer' ); ?></p>
	3145	+ ?><div id="section_info_access_lists" class="section_info">
	3146	+ <p><?php _e( 'Manage who has access to this site using these lists.', 'authorizer' ); ?></p>
3638	3147	<ol>
3639		- <li><?php echo wp_kses( __( "<strong>Pending</strong> users are users who have successfully logged in to the site, but who haven't yet been approved (or blocked) by you.", 'authorizer' ), $this->allowed_html ); ?></li>
3640		- <li><?php echo wp_kses( __( '<strong>Approved</strong> users have access to the site once they successfully log in.', 'authorizer' ), $this->allowed_html ); ?></li>
3641		- <li><?php echo wp_kses( __( '<strong>Blocked</strong> users will receive an error message when they try to visit the site after authenticating.', 'authorizer' ), $this->allowed_html ); ?></li>
	3148	+ <li><?php _e( "<strong>Pending</strong> users are users who have successfully logged in to the site, but who haven't yet been approved (or blocked) by you.", 'authorizer' ); ?></li>
	3149	+ <li><?php _e( '<strong>Approved</strong> users have access to the site once they successfully log in.', 'authorizer' ); ?></li>
	3150	+ <li><?php _e( '<strong>Blocked</strong> users will receive an error message when they try to visit the site after authenticating.', 'authorizer' ); ?></li>
3642	3151	</ol>
3643	3152	</div>
3644	3153	<table class="form-table">
3645	3154	<tbody>
3646	3155	<tr>
3647		- <th scope="row"><?php esc_html_e( 'Pending Users', 'authorizer' ); ?> <em>(<?php echo esc_html( $this->get_user_count_from_list( 'pending', $admin_mode ) ); ?>)</em></th>
	3156	+ <th scope="row"><?php _e( 'Pending Users', 'authorizer' ); ?> <em>(<?php echo $this->get_user_count_from_list( 'pending', $admin_mode ); ?>)</em></th>
3648	3157	<td><?php $this->print_combo_auth_access_users_pending(); ?></td>
3649	3158	</tr>
3650	3159	<tr>
3651		- <th scope="row"><?php esc_html_e( 'Approved Users', 'authorizer' ); ?> <em>(<?php echo esc_html( $this->get_user_count_from_list( 'approved', $admin_mode ) ); ?>)</em></th>
	3160	+ <th scope="row"><?php _e( 'Approved Users', 'authorizer' ); ?> <em>(<?php echo $this->get_user_count_from_list( 'approved', $admin_mode ); ?>)</em></th>
3652	3161	<td><?php $this->print_combo_auth_access_users_approved(); ?></td>
3653	3162	</tr>
3654	3163	<tr>
3655		- <th scope="row"><?php esc_html_e( 'Blocked Users', 'authorizer' ); ?> <em>(<?php echo esc_html( $this->get_user_count_from_list( 'blocked', $admin_mode ) ); ?>)</em></th>
	3164	+ <th scope="row"><?php _e( 'Blocked Users', 'authorizer' ); ?> <em>(<?php echo $this->get_user_count_from_list( 'blocked', $admin_mode ); ?>)</em></th>
3656	3165	<td><?php $this->print_combo_auth_access_users_blocked(); ?></td>
3657	3166	</tr>
3658	3167	</tbody>
3659	3168	</table>
		@@ -3660,516 +3169,276 @@
3660	3169	<?php
3661	3170	}
3662	3171
3663	3172
3664		- /**
3665		- * Settings print callback.
3666		- *
3667		- * @param string $args Args (e.g., multisite admin mode).
3668		- * @return void
3669		- */
3670		- public function print_combo_auth_access_users_pending( $args = '' ) {
	3173	+ function print_combo_auth_access_users_pending( $args = '' ) {
3671	3174	// Get plugin option.
3672		- $option = 'access_users_pending';
	3175	+ $option = 'access_users_pending';
3673	3176	$auth_settings_option = $this->get_plugin_option( $option );
3674	3177	$auth_settings_option = is_array( $auth_settings_option ) ? $auth_settings_option : array();
3675	3178
3676		- // Render wrapper div (for aligning pager to width of content).
3677		- ?>
3678		- <div class="wrapper_<?php echo esc_attr( $option ); ?>">
3679		- <ul id="list_auth_settings_access_users_pending" style="margin:0;">
3680		- <?php
3681		- if ( count( $auth_settings_option ) > 0 ) :
3682		- foreach ( $auth_settings_option as $key => $pending_user ) :
3683		- if ( empty( $pending_user ) || count( $pending_user ) < 1 ) :
3684		- continue;
3685		- endif;
3686		- $pending_user['is_wp_user'] = false;
3687		- ?>
3688		- <li>
3689		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>_<?php echo esc_attr( $key ); ?>" value="<?php echo esc_attr( $pending_user['email'] ); ?>" readonly="true" class="auth-email" />
3690		- <select id="auth_settings_<?php echo esc_attr( $option ); ?>_<?php echo esc_attr( $key ); ?>_role" class="auth-role">
3691		- <?php $this->wp_dropdown_permitted_roles( $pending_user['role'] ); ?>
3692		- </select>
3693		- <a href="javascript:void(0);" class="button-primary" id="approve_user_<?php echo esc_attr( $key ); ?>" onclick="authAddUser( this, 'approved', false ); authIgnoreUser( this, 'pending' );"><span class="glyphicon glyphicon-ok"></span> <?php esc_html_e( 'Approve', 'authorizer' ); ?></a>
3694		- <a href="javascript:void(0);" class="button-primary" id="block_user_<?php echo esc_attr( $key ); ?>" onclick="authAddUser( this, 'blocked', false ); authIgnoreUser( this, 'pending' );"><span class="glyphicon glyphicon-ban-circle"></span> <?php esc_html_e( 'Block', 'authorizer' ); ?></a>
3695		- <a href="javascript:void(0);" class="button button-secondary" id="ignore_user_<?php echo esc_attr( $key ); ?>" onclick="authIgnoreUser( this, 'pending' );" title="<?php esc_html_e( 'Remove user', 'authorizer' ); ?>"><span class="glyphicon glyphicon-remove"></span> <?php esc_html_e( 'Ignore', 'authorizer' ); ?></a>
3696		- </li>
3697		- <?php endforeach; ?>
3698		- <?php else : ?>
3699		- <li class="auth-empty"><em><?php esc_html_e( 'No pending users', 'authorizer' ); ?></em></li>
3700		- <?php endif; ?>
3701		- </ul>
3702		- </div>
	3179	+ // Print option elements.
	3180	+ ?><ul id="list_auth_settings_access_users_pending" style="margin:0;">
	3181	+ <?php if ( count( $auth_settings_option ) > 0 ) : ?>
	3182	+ <?php foreach ( $auth_settings_option as $key => $pending_user ): ?>
	3183	+ <?php if ( empty( $pending_user ) || count( $pending_user ) < 1 ) continue; ?>
	3184	+ <?php $pending_user['is_wp_user'] = false; ?>
	3185	+ <li>
	3186	+ <input type="text" id="auth_settings_<?php echo $option; ?>_<?php echo $key; ?>" value="<?php echo $pending_user['email']; ?>" readonly="true" class="auth-email" />
	3187	+ <select id="auth_settings_<?php echo $option; ?>_<?php echo $key; ?>_role" class="auth-role">
	3188	+ <?php $this->wp_dropdown_permitted_roles( $pending_user['role'] ); ?>
	3189	+ </select>
	3190	+ <a href="javascript:void(0);" class="button-primary" id="approve_user_<?php echo $key; ?>" onclick="auth_add_user( this, 'approved', false ); auth_ignore_user( this, 'pending' );"><span class="glyphicon glyphicon-ok"></span> <?php _e( 'Approve', 'authorizer' ); ?></a>
	3191	+ <a href="javascript:void(0);" class="button-primary" id="block_user_<?php echo $key; ?>" onclick="auth_add_user( this, 'blocked', false ); auth_ignore_user( this, 'pending' );"><span class="glyphicon glyphicon-ban-circle"></span> <?php _e( 'Block', 'authorizer' ); ?></a>
	3192	+ <a href="javascript:void(0);" class="button button-secondary" id="ignore_user_<?php echo $key; ?>" onclick="auth_ignore_user( this, 'pending' );" title="<?php _e( 'Remove user', 'authorizer' ); ?>"><span class="glyphicon glyphicon-remove"></span> <?php _e( 'Ignore', 'authorizer' ); ?></a>
	3193	+ </li>
	3194	+ <?php endforeach; ?>
	3195	+ <?php else: ?>
	3196	+ <li class="auth-empty"><em><?php _e( 'No pending users', 'authorizer' ); ?></em></li>
	3197	+ <?php endif; ?>
	3198	+ </ul>
3703	3199	<?php
3704	3200	}
3705	3201
3706	3202
3707		- /**
3708		- * Settings print callback.
3709		- *
3710		- * @param string $args Args (e.g., multisite admin mode).
3711		- * @return void
3712		- */
3713		- public function print_combo_auth_access_users_approved( $args = '' ) {
	3203	+ function print_combo_auth_access_users_approved( $args = '' ) {
3714	3204	// Get plugin option.
3715		- $option = 'access_users_approved';
3716		- $admin_mode = $this->get_admin_mode( $args );
	3205	+ $option = 'access_users_approved';
	3206	+ $admin_mode = $this->get_admin_mode( $args );
3717	3207	$auth_settings_option = $this->get_plugin_option( $option, $admin_mode, 'no override' );
3718	3208	$auth_settings_option = is_array( $auth_settings_option ) ? $auth_settings_option : array();
3719	3209
3720		- // Get multisite approved users (will be added to top of list, greyed out).
3721		- $auth_override_multisite = $this->get_plugin_option( 'advanced_override_multisite' );
3722		- $auth_multisite_settings = $this->get_plugin_options( WP_Plugin_Authorizer::NETWORK_CONTEXT );
	3210	+ // Get multisite approved users (add them to top of list, greyed out).
	3211	+ $auth_override_multisite = $this->get_plugin_option( 'advanced_override_multisite' );
	3212	+ $auth_multisite_settings = $this->get_plugin_options( MULTISITE_ADMIN );
3723	3213	$auth_settings_option_multisite = array();
3724	3214	if (
3725	3215	is_multisite() &&
3726		- ! is_network_admin() &&
3727		- '1' !== intval( $auth_override_multisite ) &&
	3216	+ $auth_override_multisite != '1' &&
3728	3217	array_key_exists( 'multisite_override', $auth_multisite_settings ) &&
3729		- '1' === $auth_multisite_settings['multisite_override']
	3218	+ $auth_multisite_settings['multisite_override'] === '1'
3730	3219	) {
3731		- $auth_settings_option_multisite = $this->get_plugin_option( $option, WP_Plugin_Authorizer::NETWORK_CONTEXT, 'allow override' );
	3220	+ $auth_settings_option_multisite = $this->get_plugin_option( $option, MULTISITE_ADMIN, 'allow override' );
3732	3221	$auth_settings_option_multisite = is_array( $auth_settings_option_multisite ) ? $auth_settings_option_multisite : array();
3733		- // Add multisite users to the beginning of the main user array.
3734		- foreach ( array_reverse( $auth_settings_option_multisite ) as $approved_user ) {
3735		- $approved_user['multisite_user'] = true;
3736		- array_unshift( $auth_settings_option, $approved_user );
3737		- }
3738	3222	}
3739	3223
3740	3224	// Get default role for new user dropdown.
3741		- $access_default_role = $this->get_plugin_option( 'access_default_role', WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
	3225	+ $access_default_role = $this->get_plugin_option( 'access_default_role', SINGLE_ADMIN, 'allow override' );
3742	3226
3743	3227	// Get custom usermeta field to show.
3744	3228	$advanced_usermeta = $this->get_plugin_option( 'advanced_usermeta' );
3745	3229
3746	3230	// Adjust javascript function prefixes if multisite.
3747		- $js_function_prefix = WP_Plugin_Authorizer::NETWORK_CONTEXT === $admin_mode ? 'authMultisite' : 'auth';
3748		- $is_multisite_admin_page = WP_Plugin_Authorizer::NETWORK_CONTEXT === $admin_mode;
	3231	+ $js_function_prefix = $admin_mode === MULTISITE_ADMIN ? 'auth_multisite_' : 'auth_';
	3232	+ $multisite_admin_page = $admin_mode === MULTISITE_ADMIN;
3749	3233
3750		- // Filter user list to search terms.
3751		- // phpcs:ignore WordPress.CSRF.NonceVerification.NoNonceVerification
3752		- if ( isset( $_REQUEST['search'] ) && strlen( sanitize_text_field( wp_unslash( $_REQUEST['search'] ) ) ) > 0 ) {
3753		- // phpcs:ignore WordPress.CSRF.NonceVerification.NoNonceVerification
3754		- $search_term = sanitize_text_field( wp_unslash( $_REQUEST['search'] ) );
3755		- $auth_settings_option = array_filter(
3756		- $auth_settings_option, function ( $user ) use ( $search_term ) {
3757		- return stripos( $user['email'], $search_term ) !== false ||
3758		- stripos( $user['role'], $search_term ) !== false ||
3759		- stripos( $user['date_added'], $search_term ) !== false;
3760		- }
3761		- );
3762		- }
3763		-
3764		- // Sort user list.
3765		- $sort_by = $this->get_plugin_option( 'advanced_users_sort_by', WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' ); // email, role, date_added (registered), created (date approved).
3766		- $sort_order = $this->get_plugin_option( 'advanced_users_sort_order', WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' ); // asc or desc.
3767		- $sort_dimension = array();
3768		- if ( in_array( $sort_by, array( 'email', 'role', 'date_added' ), true ) ) {
3769		- foreach ( $auth_settings_option as $key => $user ) {
3770		- if ( 'date_added' === $sort_by ) {
3771		- $sort_dimension[ $key ] = date( 'Ymd', strtotime( $user[ $sort_by ] ) );
3772		- } else {
3773		- $sort_dimension[ $key ] = strtolower( $user[ $sort_by ] );
3774		- }
3775		- }
3776		- $sort_order = 'asc' === $sort_order ? SORT_ASC : SORT_DESC;
3777		- array_multisort( $sort_dimension, $sort_order, $auth_settings_option );
3778		- } elseif ( 'created' === $sort_by && 'asc' !== $sort_order ) {
3779		- // If default sort method and reverse order, just reverse the array.
3780		- $auth_settings_option = array_reverse( $auth_settings_option );
3781		- }
3782		-
3783		- // Ensure array keys run from 0..max (keys in database will be the original,
3784		- // index, and removing users will not reorder the array keys of other users).
3785		- $auth_settings_option = array_values( $auth_settings_option );
3786		-
3787		- // Get pager params.
3788		- $total_users = count( $auth_settings_option );
3789		- $users_per_page = intval( $this->get_plugin_option( 'advanced_users_per_page', WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' ) );
3790		- // phpcs:ignore WordPress.CSRF.NonceVerification.NoNonceVerification
3791		- $current_page = isset( $_REQUEST['paged'] ) ? intval( $_REQUEST['paged'] ) : 1;
3792		- $total_pages = ceil( $total_users / $users_per_page );
3793		- if ( $total_pages < 1 ) {
3794		- $total_pages = 1;
3795		- }
3796		-
3797		- // Make sure current_page is between 1 and max pages.
3798		- if ( $current_page < 1 ) {
3799		- $current_page = 1;
3800		- } elseif ( $current_page > $total_pages ) {
3801		- $current_page = $total_pages;
3802		- }
3803		-
3804		- // Render wrapper div (for aligning pager to width of content).
3805		- ?>
3806		- <div class="wrapper_<?php echo esc_attr( $option ); ?>">
3807		- <?php $this->render_user_pager( $current_page, $users_per_page, $total_users, 'top' ); ?>
3808		- <ul id="list_auth_settings_access_users_approved" class="<?php echo strlen( $advanced_usermeta ) > 0 ? 'has-usermeta' : ''; ?>">
3809		- <?php
3810		- $offset = ( $current_page - 1 ) * $users_per_page;
3811		- $max = min( $offset + $users_per_page, count( $auth_settings_option ) );
3812		- for ( $key = $offset; $key < $max; $key++ ) :
3813		- $approved_user = $auth_settings_option[ $key ];
	3234	+ ?><ul id="list_auth_settings_access_users_approved" style="margin:0;">
	3235	+ <?php if ( ! $multisite_admin_page ) :
	3236	+ foreach ( $auth_settings_option_multisite as $key => $approved_user ) :
3814	3237	if ( empty( $approved_user ) || count( $approved_user ) < 1 ) :
3815	3238	continue;
3816	3239	endif;
3817		- $this->render_user_element( $approved_user, $key, $option, $admin_mode, $advanced_usermeta );
3818		- endfor;
3819		- ?>
3820		- </ul>
	3240	+ $approved_wp_user = get_user_by( 'email', $approved_user['email'] );
	3241	+ if ( $approved_wp_user ) :
	3242	+ $approved_user['email'] = $approved_wp_user->user_email;
	3243	+ $approved_user['role'] = $multisite_admin_page || count( $approved_wp_user->roles ) === 0 ? $approved_user['role'] : array_shift( $approved_wp_user->roles );
	3244	+ $approved_user['date_added'] = $approved_wp_user->user_registered;
	3245	+ // Get usermeta field from the WordPress user's real usermeta.
	3246	+ if ( strlen( $advanced_usermeta ) > 0 ) :
	3247	+ if ( strpos( $advanced_usermeta, 'acf___' ) === 0 && class_exists( 'acf' ) ) :
	3248	+ // Get ACF Field value for the user
	3249	+ $approved_user['usermeta'] = get_field( str_replace('acf___', '', $advanced_usermeta ), 'user_' . $approved_wp_user->ID );
	3250	+ else :
	3251	+ // Get regular usermeta value for the user.
	3252	+ $approved_user['usermeta'] = get_user_meta( $approved_wp_user->ID, $advanced_usermeta, true );
	3253	+ endif;
3821	3254
3822		- <div id="new_auth_settings_<?php echo esc_attr( $option ); ?>">
3823		- <textarea id="new_approved_user_email" placeholder="<?php esc_attr_e( 'email address', 'authorizer' ); ?>" class="auth-email new autogrow-short" rows="1"></textarea>
3824		- <select id="new_approved_user_role" class="auth-role">
3825		- <?php $this->wp_dropdown_permitted_roles( $access_default_role, 'not disabled', $admin_mode ); ?>
3826		- </select>
3827		- <div class="btn-group">
3828		- <a href="javascript:void(0);" class="btn button-primary dropdown-toggle button-add-user" id="approve_user_new" onclick="<?php echo esc_attr( $js_function_prefix ); ?>AddUser(this, 'approved' );"><span class="glyphicon glyphicon-ok"></span> <?php esc_html_e( 'Approve', 'authorizer' ); ?></a>
3829		- <button type="button" class="btn button-primary dropdown-toggle" data-toggle="dropdown">
3830		- <span class="caret"></span>
3831		- <span class="sr-only"><?php esc_html_e( 'Toggle Dropdown', 'authorizer' ); ?></span>
3832		- </button>
3833		- <ul class="dropdown-menu" role="menu">
3834		- <li><a href="javascript:void(0);" onclick="<?php echo esc_attr( $js_function_prefix ); ?>AddUser( document.getElementById( 'approve_user_new' ), 'approved', true);"><?php esc_html_e( 'Create a local WordPress account instead, and email the user their password.', 'authorizer' ); ?></a></li>
3835		- </ul>
3836		- </div>
3837		- </div>
3838		- <?php $this->render_user_pager( $current_page, $users_per_page, $total_users, 'bottom' ); ?>
3839		- </div>
3840		- <?php
3841		- }
	3255	+ if ( is_array( $approved_user['usermeta'] ) || is_object( $approved_user['usermeta'] ) ) :
	3256	+ $approved_user['usermeta'] = serialize( $approved_user['usermeta'] );
	3257	+ endif;
	3258	+ endif;
	3259	+ endif;
	3260	+ if ( ! array_key_exists( 'usermeta', $approved_user ) ) :
	3261	+ $approved_user['usermeta'] = '';
	3262	+ endif; ?>
	3263	+ <li>
	3264	+ <input type="text" id="auth_multisite_settings_<?php echo $option; ?>_<?php echo $key; ?>" value="<?php echo $approved_user['email']; ?>" readonly="true" class="auth-email auth-multisite-email" />
	3265	+ <select id="auth_multisite_settings_<?php echo $option; ?>_<?php echo $key; ?>_role" class="auth-role auth-multisite-role" disabled="disabled">
	3266	+ <?php $this->wp_dropdown_permitted_roles( $approved_user['role'] ); ?>
	3267	+ </select>
	3268	+ <input type="text" id="auth_multisite_settings_<?php echo $option; ?>_<?php echo $key; ?>_date_added" value="<?php echo date( 'M Y', strtotime( $approved_user['date_added'] ) ); ?>" readonly="true" class="auth-date-added auth-multisite-date-added" disabled="disabled" />
	3269	+ <?php if ( strlen( $advanced_usermeta ) > 0 ) :
	3270	+ $should_show_usermeta_in_text_field = true; // Fallback renderer for usermeta; try to use a select first.
	3271	+ if ( strpos( $advanced_usermeta, 'acf___' ) === 0 && class_exists( 'acf' ) ) :
	3272	+ $field_object = get_field_object( str_replace('acf___', '', $advanced_usermeta ) );
	3273	+ if ( is_array( $field_object ) && array_key_exists( 'type', $field_object ) && $field_object['type'] === 'select' ) :
	3274	+ $should_show_usermeta_in_text_field = false; ?>
	3275	+ <select id="auth_settings_<?php echo $option; ?>_<?php echo $key; ?>_usermeta" class="auth-usermeta auth-multisite-usermeta" onchange="<?php echo $js_function_prefix; ?>update_usermeta( this );">
	3276	+ <option value=""<?php if ( empty( $approved_user['usermeta'] ) ) echo ' selected="selected"'; ?>><?php _e( '-- None --', 'authorizer' ); ?></option>
	3277	+ <?php foreach ( $field_object['choices'] as $key => $label ) : ?>
	3278	+ <option value="<?php echo $key; ?>"<?php if ( $key === $approved_user['usermeta'] || ( is_array( $approved_user['usermeta'] ) && array_key_exists( get_current_blog_id(), $approved_user['usermeta'] ) && $key === $approved_user['usermeta'][get_current_blog_id()]['meta_value'] ) ) echo ' selected="selected"'; ?>><?php echo $label; ?></option>
	3279	+ <?php endforeach; ?>
	3280	+ </select>
	3281	+ <?php endif; ?>
	3282	+ <?php endif; ?>
	3283	+ <?php if ( $should_show_usermeta_in_text_field ) : ?>
	3284	+ <input type="text" id="auth_multisite_settings_<?php echo $option; ?>_<?php echo $key; ?>_usermeta" value="<?php echo htmlspecialchars( $approved_user['usermeta'], ENT_COMPAT ); ?>" class="auth-usermeta auth-multisite-usermeta" />
	3285	+ <a class="button button-small button-primary update-usermeta" id="update_usermeta_<?php echo $key; ?>" onclick="<?php echo $js_function_prefix; ?>update_usermeta( this );" title="Update usermeta"><span class="glyphicon glyphicon-floppy-saved"></span></a>
	3286	+ <?php endif; ?>
	3287	+ <?php endif; ?>
	3288	+ &nbsp;&nbsp;<a title="WordPress Multisite user" class="auth-multisite-user"><span class="glyphicon glyphicon-globe"></span></a>
	3289	+ </li>
	3290	+ <?php endforeach;
	3291	+ endif;
	3292	+ foreach ( $auth_settings_option as $key => $approved_user ):
	3293	+ $is_current_user = false;
	3294	+ $local_user_icon = array_key_exists( 'local_user', $approved_user ) && $approved_user['local_user'] === 'true' ? '&nbsp;<a title="Local WordPress user" class="auth-local-user"><span class="glyphicon glyphicon-user"></span></a>' : '';
	3295	+ if ( empty( $approved_user ) || count( $approved_user ) < 1 ) :
	3296	+ continue;
	3297	+ endif;
	3298	+ $approved_wp_user = get_user_by( 'email', $approved_user['email'] );
	3299	+ if ( $approved_wp_user ) :
	3300	+ $approved_user['email'] = $approved_wp_user->user_email;
	3301	+ $approved_user['role'] = $multisite_admin_page || count( $approved_wp_user->roles ) === 0 ? $approved_user['role'] : array_shift( $approved_wp_user->roles );
	3302	+ $approved_user['date_added'] = $approved_wp_user->user_registered;
	3303	+ $approved_user['is_wp_user'] = true;
	3304	+ $is_current_user = $approved_wp_user->ID === get_current_user_id();
	3305	+ // Get usermeta field from the WordPress user's real usermeta.
	3306	+ if ( strlen( $advanced_usermeta ) > 0 ) :
	3307	+ if ( strpos( $advanced_usermeta, 'acf___' ) === 0 && class_exists( 'acf' ) ) :
	3308	+ // Get ACF Field value for the user
	3309	+ $approved_user['usermeta'] = get_field( str_replace('acf___', '', $advanced_usermeta ), 'user_' . $approved_wp_user->ID );
	3310	+ else :
	3311	+ // Get regular usermeta value for the user.
	3312	+ $approved_user['usermeta'] = get_user_meta( $approved_wp_user->ID, $advanced_usermeta, true );
	3313	+ endif;
3842	3314
3843		-
3844		- /**
3845		- * Renders the html elements for the pager above and below the Approved User list.
3846		- *
3847		- * @param integer $current_page Which page we are currently viewing.
3848		- * @param integer $users_per_page How many users to show per page.
3849		- * @param integer $total_users Total count of users in list.
3850		- * @param string $which Where to render the pager ('top' or 'bottom').
3851		- * @return void
3852		- */
3853		- private function render_user_pager( $current_page = 1, $users_per_page = 20, $total_users = 0, $which = 'top' ) {
3854		- $total_pages = ceil( $total_users / $users_per_page );
3855		- if ( $total_pages < 1 ) {
3856		- $total_pages = 1;
3857		- }
3858		-
3859		- /* TRANSLATORS: %s: number of users */
3860		- $output = ' <span class="displaying-num">' . sprintf( _n( '%s user', '%s users', $total_users, 'authorizer' ), number_format_i18n( $total_users ) ) . '</span>';
3861		-
3862		- $disable_first = $current_page <= 1;
3863		- $disable_prev = $current_page <= 1;
3864		- $disable_next = $current_page >= $total_pages;
3865		- $disable_last = $current_page >= $total_pages;
3866		-
3867		- $current_url = '';
3868		- if ( isset( $_SERVER['HTTP_HOST'], $_SERVER['REQUEST_URI'] ) ) {
3869		- $current_url = set_url_scheme( esc_url_raw( wp_unslash( $_SERVER['HTTP_HOST'] ) ) . esc_url_raw( wp_unslash( $_SERVER['REQUEST_URI'] ) ) );
3870		- $current_url = remove_query_arg( wp_removable_query_args(), $current_url );
3871		- }
3872		-
3873		- $page_links = array();
3874		-
3875		- $total_pages_before = '<span class="paging-input">';
3876		- $total_pages_after = '</span></span>';
3877		-
3878		- if ( $disable_first ) {
3879		- $page_links[] = '<span class="first-page tablenav-pages-navspan" aria-hidden="true">&laquo;</span>';
3880		- } else {
3881		- $page_links[] = sprintf(
3882		- "<a class='first-page' href='%s'><span class='screen-reader-text'>%s</span><span aria-hidden='true'>%s</span></a>",
3883		- esc_url( remove_query_arg( 'paged', $current_url ) ),
3884		- __( 'First page' ),
3885		- '&laquo;'
3886		- );
3887		- }
3888		-
3889		- if ( $disable_prev ) {
3890		- $page_links[] = '<span class="prev-page tablenav-pages-navspan" aria-hidden="true">&lsaquo;</span>';
3891		- } else {
3892		- $page_links[] = sprintf(
3893		- "<a class='prev-page' href='%s'><span class='screen-reader-text'>%s</span><span aria-hidden='true'>%s</span></a>",
3894		- esc_url( add_query_arg( 'paged', max( 1, $current_page - 1 ), $current_url ) ),
3895		- __( 'Previous page' ),
3896		- '&lsaquo;'
3897		- );
3898		- }
3899		-
3900		- if ( 'bottom' === $which ) {
3901		- $html_current_page = '<span class="current-page-text">' . $current_page . '</span>';
3902		- $total_pages_before = '<span class="screen-reader-text">' . __( 'Current Page' ) . '</span><span id="table-paging" class="paging-input"><span class="tablenav-paging-text">';
3903		- } else {
3904		- $html_current_page = sprintf(
3905		- "%s<input class='current-page' id='current-page-selector' type='text' name='paged' value='%s' size='%d' aria-describedby='table-paging' /><span class='tablenav-paging-text'>",
3906		- '<label for="current-page-selector" class="screen-reader-text">' . __( 'Current Page' ) . '</label>',
3907		- $current_page,
3908		- strlen( $total_pages )
3909		- );
3910		- }
3911		- /* TRANSLATORS: %s: number of pages */
3912		- $html_total_pages = sprintf( "<span class='total-pages'>%s</span>", number_format_i18n( $total_pages ) );
3913		- /* TRANSLATORS: 1: number of current page 2: number of total pages */
3914		- $page_links[] = $total_pages_before . sprintf( _x( '%1$s of %2$s', 'paging' ), $html_current_page, $html_total_pages ) . $total_pages_after;
3915		-
3916		- if ( $disable_next ) {
3917		- $page_links[] = '<span class="next-page tablenav-pages-navspan" aria-hidden="true">&rsaquo;</span>';
3918		- } else {
3919		- $page_links[] = sprintf(
3920		- "<a class='next-page' href='%s'><span class='screen-reader-text'>%s</span><span aria-hidden='true'>%s</span></a>",
3921		- esc_url( add_query_arg( 'paged', min( $total_pages, $current_page + 1 ), $current_url ) ),
3922		- __( 'Next page' ),
3923		- '&rsaquo;'
3924		- );
3925		- }
3926		-
3927		- if ( $disable_last ) {
3928		- $page_links[] = '<span class="last-page tablenav-pages-navspan" aria-hidden="true">&raquo;</span>';
3929		- } else {
3930		- $page_links[] = sprintf(
3931		- "<a class='last-page' href='%s'><span class='screen-reader-text'>%s</span><span aria-hidden='true'>%s</span></a>",
3932		- esc_url( add_query_arg( 'paged', $total_pages, $current_url ) ),
3933		- __( 'Last page' ),
3934		- '&raquo;'
3935		- );
3936		- }
3937		-
3938		- $pagination_links_class = 'pagination-links';
3939		- $output .= "\n<span class='$pagination_links_class'>" . join( "\n", $page_links ) . '</span>';
3940		-
3941		- $search_form = array();
3942		- if ( 'top' === $which ) {
3943		- // phpcs:ignore WordPress.CSRF.NonceVerification.NoNonceVerification
3944		- $search_term = isset( $_REQUEST['search'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['search'] ) ) : '';
3945		- $search_form[] = '<div class="search-box">';
3946		- $search_form[] = '<label class="screen-reader-text" for="user-search-input">' . __( 'Search Users', 'authorizer' ) . '</label>';
3947		- $search_form[] = '<input type="search" size="14" id="user-search-input" name="search" value="' . $search_term . '">';
3948		- $search_form[] = '<input type="button" id="search-submit" class="button" value="' . __( 'Search', 'authorizer' ) . '">';
3949		- $search_form[] = '</div>';
3950		- }
3951		- $search_form = join( "\n", $search_form );
3952		-
3953		- $output = "<div class='tablenav-pages'>$output</div>";
3954		- ?>
3955		- <div class="tablenav top">
3956		- <?php echo wp_kses( $output, $this->allowed_html ); ?>
3957		- <?php echo wp_kses( $search_form, $this->allowed_html ); ?>
3958		- </div>
3959		- <?php
3960		- }
3961		-
3962		-
3963		- /**
3964		- * Renders the html <li> element for a given user in a list.
3965		- *
3966		- * @param array $approved_user User array to render.
3967		- * @param int $key Index of user in list of users.
3968		- * @param string $option List user is in (e.g., 'access_users_approved').
3969		- * @param string $admin_mode Current admin context.
3970		- * @param string $advanced_usermeta Usermeta field to display.
3971		- * @return void
3972		- */
3973		- private function render_user_element( $approved_user, $key, $option, $admin_mode, $advanced_usermeta ) {
3974		- $is_local_user = array_key_exists( 'local_user', $approved_user ) && 'true' === $approved_user['local_user'];
3975		- $is_multisite_user = array_key_exists( 'multisite_user', $approved_user ) && true === $approved_user['multisite_user'];
3976		- $option_prefix = $is_multisite_user ? 'auth_multisite_settings_' : 'auth_settings_';
3977		- $option_id = $option_prefix . $option . '_' . $key;
3978		- $approved_wp_user = get_user_by( 'email', $approved_user['email'] );
3979		- $is_current_user = $approved_wp_user && get_current_user_id() === $approved_wp_user->ID;
3980		-
3981		- // Adjust javascript function prefixes if multisite.
3982		- $js_function_prefix = WP_Plugin_Authorizer::NETWORK_CONTEXT === $admin_mode ? 'authMultisite' : 'auth';
3983		- $is_multisite_admin_page = WP_Plugin_Authorizer::NETWORK_CONTEXT === $admin_mode;
3984		-
3985		- if ( ! $approved_wp_user ) :
3986		- $approved_user['is_wp_user'] = false;
3987		- else :
3988		- $approved_user['is_wp_user'] = true;
3989		- $approved_user['email'] = $approved_wp_user->user_email;
3990		- $approved_user['role'] = $is_multisite_admin_page || count( $approved_wp_user->roles ) === 0 ? $approved_user['role'] : array_shift( $approved_wp_user->roles );
3991		- $approved_user['date_added'] = $approved_wp_user->user_registered;
3992		-
3993		- // Get usermeta field from the WordPress user's real usermeta.
3994		- if ( strlen( $advanced_usermeta ) > 0 ) :
3995		- if ( strpos( $advanced_usermeta, 'acf___' ) === 0 && class_exists( 'acf' ) ) :
3996		- // Get ACF Field value for the user.
3997		- $approved_user['usermeta'] = get_field( str_replace( 'acf___', '', $advanced_usermeta ), 'user_' . $approved_wp_user->ID );
	3315	+ if ( is_array( $approved_user['usermeta'] ) || is_object( $approved_user['usermeta'] ) ) :
	3316	+ $approved_user['usermeta'] = serialize( $approved_user['usermeta'] );
	3317	+ endif;
	3318	+ endif;
3998	3319	else :
3999		- // Get regular usermeta value for the user.
4000		- $approved_user['usermeta'] = get_user_meta( $approved_wp_user->ID, $advanced_usermeta, true );
	3320	+ $approved_user['is_wp_user'] = false;
4001	3321	endif;
4002		- if ( is_array( $approved_user['usermeta'] ) || is_object( $approved_user['usermeta'] ) ) :
4003		- $approved_user['usermeta'] = serialize( $approved_user['usermeta'] );
4004		- endif;
4005		- endif;
4006		- endif;
4007		- if ( ! array_key_exists( 'usermeta', $approved_user ) ) :
4008		- $approved_user['usermeta'] = '';
4009		- endif;
4010		- ?>
4011		- <li>
4012		- <input
4013		- type="text"
4014		- id="<?php echo esc_attr( $option_id ); ?>"
4015		- value="<?php echo esc_attr( $approved_user['email'] ); ?>"
4016		- readonly="true"
4017		- class="<?php echo esc_attr( $this->create_class_name( 'email', $is_multisite_user ) ); ?>"
4018		- />
4019		- <select
4020		- id="<?php echo esc_attr( $option_id ); ?>_role"
4021		- class="<?php echo esc_attr( $this->create_class_name( 'role', $is_multisite_user ) ); ?>"
4022		- onchange="<?php echo esc_attr( $js_function_prefix ); ?>ChangeRole( this );"
4023		- <?php if ( $is_multisite_user ) : ?>
4024		- disabled="disabled"
4025		- <?php endif; ?>
4026		- >
4027		- <?php $disable_input = $is_current_user ? 'disabled' : null; ?>
4028		- <?php $this->wp_dropdown_permitted_roles( $approved_user['role'], $disable_input, $admin_mode ); ?>
	3322	+ if ( ! array_key_exists( 'usermeta', $approved_user ) ) :
	3323	+ $approved_user['usermeta'] = '';
	3324	+ endif; ?>
	3325	+ <li>
	3326	+ <input type="text" id="auth_settings_<?php echo $option; ?>_<?php echo $key; ?>" value="<?php echo $approved_user['email']; ?>" readonly="true" class="auth-email" />
	3327	+ <select id="auth_settings_<?php echo $option; ?>_<?php echo $key; ?>_role" class="auth-role" onchange="<?php echo $js_function_prefix; ?>change_role( this );">
	3328	+ <?php $disable_input = $is_current_user ? 'disabled' : null; ?>
	3329	+ <?php $this->wp_dropdown_permitted_roles( $approved_user['role'], $disable_input, $admin_mode ); ?>
	3330	+ </select>
	3331	+ <input type="text" id="auth_settings_<?php echo $option; ?>_<?php echo $key; ?>_date_added" value="<?php echo date( 'M Y', strtotime( $approved_user['date_added'] ) ); ?>" readonly="true" class="auth-date-added" />
	3332	+ <?php if ( strlen( $advanced_usermeta ) > 0 ) :
	3333	+ $should_show_usermeta_in_text_field = true; // Fallback renderer for usermeta; try to use a select first.
	3334	+ if ( strpos( $advanced_usermeta, 'acf___' ) === 0 && class_exists( 'acf' ) ) :
	3335	+ $field_object = get_field_object( str_replace('acf___', '', $advanced_usermeta ) );
	3336	+ if ( is_array( $field_object ) && array_key_exists( 'type', $field_object ) && $field_object['type'] === 'select' ) :
	3337	+ $should_show_usermeta_in_text_field = false; ?>
	3338	+ <select id="auth_settings_<?php echo $option; ?>_<?php echo $key; ?>_usermeta" class="auth-usermeta" onchange="<?php echo $js_function_prefix; ?>update_usermeta( this );" >
	3339	+ <option value=""<?php if ( empty( $approved_user['usermeta'] ) ) echo ' selected="selected"'; ?>><?php _e( '-- None --', 'authorizer' ); ?></option>
	3340	+ <?php foreach ( $field_object['choices'] as $key => $label ) : ?>
	3341	+ <option value="<?php echo $key; ?>"<?php if ( $key === $approved_user['usermeta'] || ( is_array( $approved_user['usermeta'] ) && $key === $approved_user['usermeta']['meta_value'] ) ) echo ' selected="selected"'; ?>><?php echo $label; ?></option>
	3342	+ <?php endforeach; ?>
	3343	+ </select>
	3344	+ <?php endif; ?>
	3345	+ <?php endif; ?>
	3346	+ <?php if ( $should_show_usermeta_in_text_field ) : ?>
	3347	+ <input type="text" id="auth_settings_<?php echo $option; ?>_<?php echo $key; ?>_usermeta" value="<?php echo htmlspecialchars( $approved_user['usermeta'], ENT_COMPAT ); ?>" class="auth-usermeta" />
	3348	+ <a class="button button-small button-primary update-usermeta" id="update_usermeta_<?php echo $key; ?>" onclick="<?php echo $js_function_prefix; ?>update_usermeta( this );" title="Update usermeta"><span class="glyphicon glyphicon-floppy-saved"></span></a>
	3349	+ <?php endif; ?>
	3350	+ <?php endif; ?>
	3351	+ <?php if ( ! $is_current_user ): ?>
	3352	+ <?php if ( ! $multisite_admin_page ) : ?>
	3353	+ <a class="button" id="block_user_<?php echo $key; ?>" onclick="<?php echo $js_function_prefix; ?>add_user( this, 'blocked', false ); <?php echo $js_function_prefix; ?>ignore_user( this, 'approved' );" title="<?php _e( 'Block/Ban user', 'authorizer' ); ?>"><span class="glyphicon glyphicon-ban-circle"></span></a>
	3354	+ <?php endif; ?>
	3355	+ <a class="button" id="ignore_user_<?php echo $key; ?>" onclick="<?php echo $js_function_prefix; ?>ignore_user(this, 'approved' );" title="<?php _e( 'Remove user', 'authorizer' ); ?>"><span class="glyphicon glyphicon-remove"></span></a>
	3356	+ <?php endif; ?>
	3357	+ <?php echo $local_user_icon; ?>
	3358	+ </li>
	3359	+ <?php endforeach; ?>
	3360	+ </ul>
	3361	+ <div id="new_auth_settings_<?php echo $option; ?>">
	3362	+ <input type="text" id="new_approved_user_email" placeholder="<?php _e( 'email address', 'authorizer' ); ?>" class="auth-email new" />
	3363	+ <select id="new_approved_user_role" class="auth-role">
	3364	+ <?php $this->wp_dropdown_permitted_roles( $access_default_role, 'not disabled', $admin_mode ); ?>
4029	3365	</select>
4030		- <input
4031		- type="text"
4032		- id="<?php echo esc_attr( $option_id ); ?>_date_added"
4033		- value="<?php echo esc_attr( date( 'M Y', strtotime( $approved_user['date_added'] ) ) ); ?>"
4034		- readonly="true"
4035		- class="<?php echo esc_attr( $this->create_class_name( 'date-added', $is_multisite_user ) ); ?>"
4036		- />
4037		- <?php
4038		- if ( strlen( $advanced_usermeta ) > 0 ) :
4039		- $should_show_usermeta_in_text_field = true; // Fallback renderer for usermeta; try to use a select first.
4040		- if ( strpos( $advanced_usermeta, 'acf___' ) === 0 && class_exists( 'acf' ) ) :
4041		- $field_object = get_field_object( str_replace( 'acf___', '', $advanced_usermeta ) );
4042		- if ( is_array( $field_object ) && array_key_exists( 'type', $field_object ) && 'select' === $field_object['type'] ) :
4043		- $should_show_usermeta_in_text_field = false;
4044		- ?>
4045		- <select
4046		- id="<?php echo esc_attr( $option_id ); ?>_usermeta"
4047		- class="<?php echo esc_attr( $this->create_class_name( 'usermeta', $is_multisite_user ) ); ?>"
4048		- onchange="<?php echo esc_attr( $js_function_prefix ); ?>UpdateUsermeta( this );"
4049		- >
4050		- <option value=""<?php selected( empty( $approved_user['usermeta'] ) ); ?>><?php esc_html_e( '-- None --', 'authorizer' ); ?></option>
4051		- <?php foreach ( $field_object['choices'] as $key => $label ) : ?>
4052		- <option value="<?php echo esc_attr( $key ); ?>"<?php selected( $key === $approved_user['usermeta'] || ( isset( $approved_user['usermeta']['meta_value'] ) && $key === $approved_user['usermeta']['meta_value'] ) ); ?>><?php echo esc_html( $label ); ?></option>
4053		- <?php endforeach; ?>
4054		- </select>
4055		- <?php endif; ?>
4056		- <?php endif; ?>
4057		- <?php if ( $should_show_usermeta_in_text_field ) : ?>
4058		- <input
4059		- type="text"
4060		- id="<?php echo esc_attr( $option_id ); ?>_usermeta"
4061		- value="<?php echo esc_attr( $approved_user['usermeta'], ENT_COMPAT ); ?>"
4062		- class="<?php echo esc_attr( $this->create_class_name( 'usermeta', $is_multisite_user ) ); ?>"
4063		- />
4064		- <a class="button button-small button-primary update-usermeta" id="update_usermeta_<?php echo esc_attr( $key ); ?>" onclick="<?php echo esc_attr( $js_function_prefix ); ?>UpdateUsermeta( this );" title="Update usermeta"><span class="glyphicon glyphicon-floppy-saved"></span></a>
4065		- <?php endif; ?>
4066		- <?php endif; ?>
4067		- <?php if ( ! $is_current_user && ! $is_multisite_user ) : ?>
4068		- <?php if ( ! $is_multisite_admin_page ) : ?>
4069		- <a class="button" id="block_user_<?php echo esc_attr( $key ); ?>" onclick="<?php echo esc_attr( $js_function_prefix ); ?>AddUser( this, 'blocked', false ); <?php echo esc_attr( $js_function_prefix ); ?>IgnoreUser( this, 'approved' );" title="<?php esc_attr_e( 'Block/Ban user', 'authorizer' ); ?>"><span class="glyphicon glyphicon-ban-circle"></span></a>
4070		- <?php endif; ?>
4071		- <a class="button" id="ignore_user_<?php echo esc_attr( $key ); ?>" onclick="<?php echo esc_attr( $js_function_prefix ); ?>IgnoreUser(this, 'approved' );" title="<?php esc_attr_e( 'Remove user', 'authorizer' ); ?>"><span class="glyphicon glyphicon-remove"></span></a>
4072		- <?php endif; ?>
4073		- <?php if ( $is_local_user ) : ?>
4074		- &nbsp;<a title="Local WordPress user" class="auth-local-user"><span class="glyphicon glyphicon-user"></span></a>
4075		- <?php endif; ?>
4076		- <?php if ( $is_multisite_user ) : ?>
4077		- &nbsp;<a title="WordPress Multisite user" class="auth-multisite-user"><span class="glyphicon glyphicon-globe"></span></a>
4078		- <?php endif; ?>
4079		- </li>
	3366	+ <div class="btn-group">
	3367	+ <a href="javascript:void(0);" class="btn button-primary dropdown-toggle" id="approve_user_new" onclick="<?php echo $js_function_prefix; ?>add_user(this, 'approved' );"><span class="glyphicon glyphicon-ok"></span> <?php _e( 'Approve', 'authorizer' ); ?></a>
	3368	+ <button type="button" class="btn button-primary dropdown-toggle" data-toggle="dropdown">
	3369	+ <span class="caret"></span>
	3370	+ <span class="sr-only"><?php _e( 'Toggle Dropdown', 'authorizer' ); ?></span>
	3371	+ </button>
	3372	+ <ul class="dropdown-menu" role="menu">
	3373	+ <li><a href="javascript:void(0);" onclick="<?php echo $js_function_prefix; ?>add_user( document.getElementById('approve_user_new' ), 'approved', true);"><?php _e( 'Create a local WordPress <br />account instead, and email <br />the user their password.', 'authorizer' ); ?></a></li>
	3374	+ </ul>
	3375	+ </div>
	3376	+ </div>
4080	3377	<?php
4081	3378	}
4082	3379
4083	3380
4084		- /**
4085		- * Settings print callback.
4086		- *
4087		- * @param string $args Args (e.g., multisite admin mode).
4088		- * @return void
4089		- */
4090		- public function print_combo_auth_access_users_blocked( $args = '' ) {
	3381	+ function print_combo_auth_access_users_blocked( $args = '' ) {
4091	3382	// Get plugin option.
4092		- $option = 'access_users_blocked';
	3383	+ $option = 'access_users_blocked';
4093	3384	$auth_settings_option = $this->get_plugin_option( $option );
4094	3385	$auth_settings_option = is_array( $auth_settings_option ) ? $auth_settings_option : array();
4095	3386
4096	3387	// Get default role for new blocked user dropdown.
4097		- $access_default_role = $this->get_plugin_option( 'access_default_role', WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
	3388	+ $access_default_role = $this->get_plugin_option( 'access_default_role', SINGLE_ADMIN, 'allow override' );
4098	3389
4099		- // Render wrapper div (for aligning pager to width of content).
4100		- ?>
4101		- <div class="wrapper_<?php echo esc_attr( $option ); ?>">
4102		- <ul id="list_auth_settings_<?php echo esc_attr( $option ); ?>" style="margin:0;">
4103		- <?php
4104		- foreach ( $auth_settings_option as $key => $blocked_user ) :
4105		- if ( empty( $blocked_user ) || count( $blocked_user ) < 1 ) :
4106		- continue;
4107		- endif;
4108		- $blocked_wp_user = get_user_by( 'email', $blocked_user['email'] );
4109		- if ( $blocked_wp_user ) :
4110		- $blocked_user['email'] = $blocked_wp_user->user_email;
4111		- $blocked_user['role'] = array_shift( $blocked_wp_user->roles );
4112		- $blocked_user['date_added'] = $blocked_wp_user->user_registered;
4113		- $blocked_user['is_wp_user'] = true;
4114		- else :
4115		- $blocked_user['is_wp_user'] = false;
4116		- endif;
4117		- ?>
4118		- <li>
4119		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>_<?php echo esc_attr( $key ); ?>" value="<?php echo esc_attr( $blocked_user['email'] ); ?>" readonly="true" class="auth-email" />
4120		- <select id="auth_settings_<?php echo esc_attr( $option ); ?>_<?php echo esc_attr( $key ); ?>_role" class="auth-role">
4121		- <?php $this->wp_dropdown_permitted_roles( $blocked_user['role'] ); ?>
4122		- </select>
4123		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>_<?php echo esc_attr( $key ); ?>_date_added" value="<?php echo esc_attr( date( 'M Y', strtotime( $blocked_user['date_added'] ) ) ); ?>" readonly="true" class="auth-date-added" />
4124		- <a class="button" id="ignore_user_<?php echo esc_attr( $key ); ?>" onclick="authIgnoreUser( this, 'blocked' );" title="<?php esc_attr_e( 'Remove user', 'authorizer' ); ?>"><span class="glyphicon glyphicon-remove"></span></a>
4125		- </li>
4126		- <?php endforeach; ?>
4127		- </ul>
4128		- <div id="new_auth_settings_<?php echo esc_attr( $option ); ?>">
4129		- <input type="text" id="new_blocked_user_email" placeholder="<?php esc_attr_e( 'email address', 'authorizer' ); ?>" class="auth-email new" />
4130		- <select id="new_blocked_user_role" class="auth-role">
4131		- <option value="<?php echo esc_attr( $access_default_role ); ?>"><?php echo esc_html( ucfirst( $access_default_role ) ); ?></option>
4132		- </select>
4133		- <a href="javascript:void(0);" class="button-primary button-add-user" id="block_user_new" onclick="authAddUser( this, 'blocked' );"><span class="glyphicon glyphicon-ban-circle"></span> <?php esc_html_e( 'Block', 'authorizer' ); ?></a>
4134		- </div>
	3390	+ // Print option elements.
	3391	+ ?><ul id="list_auth_settings_<?php echo $option; ?>" style="margin:0;">
	3392	+ <?php foreach ( $auth_settings_option as $key => $blocked_user ): ?>
	3393	+ <?php if ( empty( $blocked_user ) || count( $blocked_user ) < 1 ) continue; ?>
	3394	+ <?php if ( $blocked_wp_user = get_user_by( 'email', $blocked_user['email'] ) ): ?>
	3395	+ <?php $blocked_user['email'] = $blocked_wp_user->user_email; ?>
	3396	+ <?php $blocked_user['role'] = array_shift( $blocked_wp_user->roles ); ?>
	3397	+ <?php $blocked_user['date_added'] = $blocked_wp_user->user_registered; ?>
	3398	+ <?php $blocked_user['is_wp_user'] = true; ?>
	3399	+ <?php else: ?>
	3400	+ <?php $blocked_user['is_wp_user'] = false; ?>
	3401	+ <?php endif; ?>
	3402	+ <li>
	3403	+ <input type="text" id="auth_settings_<?php echo $option; ?>_<?php echo $key; ?>" value="<?php echo $blocked_user['email']; ?>" readonly="true" class="auth-email" />
	3404	+ <select id="auth_settings_<?php echo $option; ?>_<?php echo $key; ?>_role" class="auth-role">
	3405	+ <?php $this->wp_dropdown_permitted_roles( $blocked_user['role'] ); ?>
	3406	+ </select>
	3407	+ <input type="text" id="auth_settings_<?php echo $option; ?>_<?php echo $key; ?>_date_added" value="<?php echo date( 'M Y', strtotime( $blocked_user['date_added'] ) ); ?>" readonly="true" class="auth-date-added" />
	3408	+ <a class="button" id="ignore_user_<?php echo $key; ?>" onclick="auth_ignore_user(this, 'blocked' );" title="<?php _e( 'Remove user', 'authorizer' ); ?>"><span class="glyphicon glyphicon-remove"></span></a>
	3409	+ </li>
	3410	+ <?php endforeach; ?>
	3411	+ </ul>
	3412	+ <div id="new_auth_settings_<?php echo $option; ?>">
	3413	+ <input type="text" id="new_blocked_user_email" placeholder="<?php _e( 'email address', 'authorizer' ); ?>" class="auth-email new" />
	3414	+ <select id="new_blocked_user_role" class="auth-role">
	3415	+ <option value="<?php echo $access_default_role; ?>"><?php echo ucfirst( $access_default_role ); ?></option>
	3416	+ </select>
	3417	+ <a href="javascript:void(0);" class="button-primary" id="block_user_new" onclick="auth_add_user(this, 'blocked' );"><span class="glyphicon glyphicon-ban-circle"></span> <?php _e( 'Block', 'authorizer' ); ?></a>
4135	3418	</div>
4136	3419	<?php
4137	3420	}
4138	3421
4139	3422
4140		- /**
4141		- * Settings print callback.
4142		- *
4143		- * @param string $args Args (e.g., multisite admin mode).
4144		- * @return void
4145		- */
4146		- public function print_section_info_access_login( $args = '' ) {
4147		- ?>
4148		- <div id="section_info_access_login" class="section_info">
	3423	+ function print_section_info_access_login( $args = '' ) {
	3424	+ ?><div id="section_info_access_login" class="section_info">
4149	3425	<?php wp_nonce_field( 'save_auth_settings', 'nonce_save_auth_settings' ); ?>
4150		- <p><?php esc_html_e( 'Choose who is able to log into this site below.', 'authorizer' ); ?></p>
4151		- </div>
4152		- <?php
	3426	+ <p><?php _e( 'Choose who is able to log into this site below.', 'authorizer' ); ?></p>
	3427	+ </div><?php
4153	3428	}
4154	3429
4155	3430
4156		- /**
4157		- * Settings print callback.
4158		- *
4159		- * @param string $args Args (e.g., multisite admin mode).
4160		- * @return void
4161		- */
4162		- public function print_radio_auth_access_who_can_login( $args = '' ) {
	3431	+ function print_radio_auth_access_who_can_login( $args = '' ) {
4163	3432	// Get plugin option.
4164		- $option = 'access_who_can_login';
4165		- $admin_mode = $this->get_admin_mode( $args );
	3433	+ $option = 'access_who_can_login';
	3434	+ $admin_mode = $this->get_admin_mode( $args );
4166	3435	$auth_settings_option = $this->get_plugin_option( $option, $admin_mode, 'allow override', 'print overlay' );
4167	3436
4168	3437	// If this site is configured independently of any multisite overrides, make sure we are not grabbing the multisite value; otherwise, grab the multisite value to show behind the disabled overlay.
4169		- if ( is_multisite() && 1 === intval( $this->get_plugin_option( 'advanced_override_multisite' ) ) ) {
	3438	+ if ( is_multisite() && $this->get_plugin_option( 'advanced_override_multisite' ) == '1' ) {
4170	3439	$auth_settings_option = $this->get_plugin_option( $option );
4171		- } elseif ( is_multisite() && WP_Plugin_Authorizer::SINGLE_CONTEXT === $admin_mode && $this->get_plugin_option( 'multisite_override', WP_Plugin_Authorizer::NETWORK_CONTEXT ) === '1' ) {
	3440	+ } elseif ( is_multisite() && $admin_mode === SINGLE_ADMIN && $this->get_plugin_option( 'multisite_override', MULTISITE_ADMIN ) === '1' ) {
4172	3441	// Workaround: javascript code hides/shows other settings based
4173	3442	// on the selection in this option. If this option is overridden
4174	3443	// by a multisite option, it should show that value in order to
4175	3444	// correctly display the other appropriate options.
		@@ -4175,49 +3444,33 @@
4175	3444	// correctly display the other appropriate options.
4176	3445	// Side effect: this site option will be overwritten by the
4177	3446	// multisite option on save. Since this is a 2-item radio, we
4178	3447	// determined this was acceptable.
4179		- $auth_settings_option = $this->get_plugin_option( $option, WP_Plugin_Authorizer::NETWORK_CONTEXT );
	3448	+ $auth_settings_option = $this->get_plugin_option( $option, MULTISITE_ADMIN );
4180	3449	}
4181	3450
4182	3451	// Print option elements.
4183		- ?>
4184		- <input type="radio" id="radio_auth_settings_<?php echo esc_attr( $option ); ?>_external_users" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="external_users"<?php checked( 'external_users' === $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo esc_attr( $option ); ?>_external_users"><?php esc_html_e( 'All authenticated users (All external service users and all WordPress users)', 'authorizer' ); ?></label><br />
4185		- <input type="radio" id="radio_auth_settings_<?php echo esc_attr( $option ); ?>_approved_users" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="approved_users"<?php checked( 'approved_users' === $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo esc_attr( $option ); ?>_approved_users"><?php esc_html_e( 'Only', 'authorizer' ); ?> <a href="javascript:chooseTab('access_lists' );" id="dashboard_link_approved_users"><?php esc_html_e( 'approved users', 'authorizer' ); ?></a> <?php esc_html_e( '(Approved external users and all WordPress users)', 'authorizer' ); ?></label><br />
4186		- <?php
	3452	+ ?><input type="radio" id="radio_auth_settings_<?php echo $option; ?>_external_users" name="auth_settings[<?php echo $option; ?>]" value="external_users"<?php checked( 'external_users' == $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo $option; ?>_external_users"><?php _e( 'All authenticated users (All external service users and all WordPress users)', 'authorizer' ); ?></label><br />
	3453	+ <input type="radio" id="radio_auth_settings_<?php echo $option; ?>_approved_users" name="auth_settings[<?php echo $option; ?>]" value="approved_users"<?php checked( 'approved_users' == $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo $option; ?>_approved_users"><?php _e( 'Only', 'authorizer' ); ?> <a href="javascript:choose_tab('access_lists' );" id="dashboard_link_approved_users"><?php _e( 'approved users', 'authorizer' ); ?></a> <?php _e( '(Approved external users and all WordPress users)', 'authorizer' ); ?></label><br /><?php
4187	3454	}
4188	3455
4189	3456
4190		- /**
4191		- * Settings print callback.
4192		- *
4193		- * @param string $args Args (e.g., multisite admin mode).
4194		- * @return void
4195		- */
4196		- public function print_select_auth_access_role_receive_pending_emails( $args = '' ) {
	3457	+ function print_select_auth_access_role_receive_pending_emails( $args = '' ) {
4197	3458	// Get plugin option.
4198		- $option = 'access_role_receive_pending_emails';
	3459	+ $option = 'access_role_receive_pending_emails';
4199	3460	$auth_settings_option = $this->get_plugin_option( $option );
4200	3461
4201	3462	// Print option elements.
4202		- ?>
4203		- <select id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]">
4204		- <option value="---" <?php selected( $auth_settings_option, '---' ); ?>><?php esc_html_e( "None (Don't send notification emails)", 'authorizer' ); ?></option>
	3463	+ ?><select id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]">
	3464	+ <option value="---" <?php selected( $auth_settings_option, '---' ); ?>><?php _e( "None (Don't send notification emails)", 'authorizer' ); ?></option>
4205	3465	<?php wp_dropdown_roles( $auth_settings_option ); ?>
4206		- </select>
4207		- <?php
	3466	+ </select><?php
4208	3467	}
4209	3468
4210	3469
4211		- /**
4212		- * Settings print callback.
4213		- *
4214		- * @param string $args Args (e.g., multisite admin mode).
4215		- * @return void
4216		- */
4217		- public function print_wysiwyg_auth_access_pending_redirect_to_message( $args = '' ) {
	3470	+ function print_wysiwyg_auth_access_pending_redirect_to_message( $args = '' ) {
4218	3471	// Get plugin option.
4219		- $option = 'access_pending_redirect_to_message';
	3472	+ $option = 'access_pending_redirect_to_message';
4220	3473	$auth_settings_option = $this->get_plugin_option( $option );
4221	3474
4222	3475	// Print option elements.
4223	3476	wp_editor(
		@@ -4226,25 +3479,19 @@
4226	3479	array(
4227	3480	'media_buttons' => false,
4228	3481	'textarea_name' => "auth_settings[$option]",
4229	3482	'textarea_rows' => 5,
4230		- 'tinymce' => true,
4231		- 'teeny' => true,
4232		- 'quicktags' => false,
	3483	+ 'tinymce' => true,
	3484	+ 'teeny' => true,
	3485	+ 'quicktags' => false,
4233	3486	)
4234	3487	);
4235	3488	}
4236	3489
4237	3490
4238		- /**
4239		- * Settings print callback.
4240		- *
4241		- * @param string $args Args (e.g., multisite admin mode).
4242		- * @return void
4243		- */
4244		- public function print_wysiwyg_auth_access_blocked_redirect_to_message( $args = '' ) {
	3491	+ function print_wysiwyg_auth_access_blocked_redirect_to_message( $args = '' ) {
4245	3492	// Get plugin option.
4246		- $option = 'access_blocked_redirect_to_message';
	3493	+ $option = 'access_blocked_redirect_to_message';
4247	3494	$auth_settings_option = $this->get_plugin_option( $option );
4248	3495
4249	3496	// Print option elements.
4250	3497	wp_editor(
		@@ -4253,61 +3500,39 @@
4253	3500	array(
4254	3501	'media_buttons' => false,
4255	3502	'textarea_name' => "auth_settings[$option]",
4256	3503	'textarea_rows' => 5,
4257		- 'tinymce' => true,
4258		- 'teeny' => true,
4259		- 'quicktags' => false,
	3504	+ 'tinymce' => true,
	3505	+ 'teeny' => true,
	3506	+ 'quicktags' => false,
4260	3507	)
4261	3508	);
4262	3509	}
4263	3510
4264	3511
4265		- /**
4266		- * Settings print callback.
4267		- *
4268		- * @param string $args Args (e.g., multisite admin mode).
4269		- * @return void
4270		- */
4271		- public function print_checkbox_auth_access_should_email_approved_users( $args = '' ) {
	3512	+ function print_checkbox_auth_access_should_email_approved_users( $args = '' ) {
4272	3513	// Get plugin option.
4273		- $option = 'access_should_email_approved_users';
	3514	+ $option = 'access_should_email_approved_users';
4274	3515	$auth_settings_option = $this->get_plugin_option( $option );
4275	3516
4276	3517	// Print option elements.
4277		- ?>
4278		- <input type="checkbox" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="1"<?php checked( 1 === intval( $auth_settings_option ) ); ?> /><label for="auth_settings_<?php echo esc_attr( $option ); ?>"><?php esc_html_e( 'Send a welcome email when approving a new user', 'authorizer' ); ?></label>
4279		- <?php
	3518	+ ?><input type="checkbox" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="1"<?php checked( 1 == $auth_settings_option ); ?> /><label for="auth_settings_<?php echo $option; ?>"><?php _e( 'Send a welcome email when approving a new user', 'authorizer' ); ?></label><?php
4280	3519	}
4281	3520
4282	3521
4283		- /**
4284		- * Settings print callback.
4285		- *
4286		- * @param string $args Args (e.g., multisite admin mode).
4287		- * @return void
4288		- */
4289		- public function print_text_auth_access_email_approved_users_subject( $args = '' ) {
	3522	+ function print_text_auth_access_email_approved_users_subject( $args = '' ) {
4290	3523	// Get plugin option.
4291		- $option = 'access_email_approved_users_subject';
	3524	+ $option = 'access_email_approved_users_subject';
4292	3525	$auth_settings_option = $this->get_plugin_option( $option );
4293	3526
4294	3527	// Print option elements.
4295		- ?>
4296		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="Welcome to [site_name]!" style="width:320px;" /><br /><small><?php echo wp_kses( __( 'You can use the <b>[site_name]</b> shortcode.', 'authorizer' ), $this->allowed_html ); ?></small>
4297		- <?php
	3528	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="Welcome to [site_name]!" style="width:320px;" /><br /><small><?php _e( 'You can use the <b>[site_name]</b> shortcode.', 'authorizer' ); ?></small><?php
4298	3529	}
4299	3530
4300	3531
4301		- /**
4302		- * Settings print callback.
4303		- *
4304		- * @param string $args Args (e.g., multisite admin mode).
4305		- * @return void
4306		- */
4307		- public function print_wysiwyg_auth_access_email_approved_users_body( $args = '' ) {
	3532	+ function print_wysiwyg_auth_access_email_approved_users_body( $args = '' ) {
4308	3533	// Get plugin option.
4309		- $option = 'access_email_approved_users_body';
	3534	+ $option = 'access_email_approved_users_body';
4310	3535	$auth_settings_option = $this->get_plugin_option( $option );
4311	3536
4312	3537	// Print option elements.
4313	3538	wp_editor(
		@@ -4316,60 +3541,42 @@
4316	3541	array(
4317	3542	'media_buttons' => false,
4318	3543	'textarea_name' => "auth_settings[$option]",
4319	3544	'textarea_rows' => 9,
4320		- 'tinymce' => true,
4321		- 'teeny' => true,
4322		- 'quicktags' => false,
	3545	+ 'tinymce' => true,
	3546	+ 'teeny' => true,
	3547	+ 'quicktags' => false,
4323	3548	)
4324	3549	);
4325		- ?>
4326		- <small>
4327		- <?php
4328		- printf(
4329		- /* TRANSLATORS: 1: Shortcode for site name 2: Shortcode for site URL 3: Shortcode for user email */
4330		- wp_kses( __( 'You can use %1$s, %2$s, and %3$s shortcodes.', 'authorizer' ), $this->allowed_html ),
4331		- '<b>[site_name]</b>',
4332		- '<b>[site_url]</b>',
4333		- '<b>[user_email]</b>'
4334		- );
4335		- ?>
4336		- </small>
4337		- <?php
	3550	+
	3551	+ ?><small><?php printf(
	3552	+ /* TRANSLATORS: 1: Shortcode for site name 2: Shortcode for site URL 3: Shortcode for user email */
	3553	+ __( 'You can use %1$s, %2$s, and %3$s shortcodes.', 'authorizer' ),
	3554	+ '<b>[site_name]</b>',
	3555	+ '<b>[site_url]</b>',
	3556	+ '<b>[user_email]</b>'
	3557	+ ); ?></small><?php
	3558	+
4338	3559	}
4339	3560
4340	3561
4341		- /**
4342		- * Settings print callback.
4343		- *
4344		- * @param string $args Args (e.g., multisite admin mode).
4345		- * @return void
4346		- */
4347		- public function print_section_info_access_public( $args = '' ) {
4348		- ?>
4349		- <div id="section_info_access_public" class="section_info">
4350		- <p><?php esc_html_e( 'Choose your public access options here.', 'authorizer' ); ?></p>
4351		- </div>
4352		- <?php
	3562	+ function print_section_info_access_public( $args = '' ) {
	3563	+ ?><div id="section_info_access_public" class="section_info">
	3564	+ <p><?php _e( 'Choose your public access options here.', 'authorizer' ); ?></p>
	3565	+ </div><?php
4353	3566	}
4354	3567
4355	3568
4356		- /**
4357		- * Settings print callback.
4358		- *
4359		- * @param string $args Args (e.g., multisite admin mode).
4360		- * @return void
4361		- */
4362		- public function print_radio_auth_access_who_can_view( $args = '' ) {
	3569	+ function print_radio_auth_access_who_can_view( $args = '' ) {
4363	3570	// Get plugin option.
4364		- $option = 'access_who_can_view';
4365		- $admin_mode = $this->get_admin_mode( $args );
	3571	+ $option = 'access_who_can_view';
	3572	+ $admin_mode = $this->get_admin_mode( $args );
4366	3573	$auth_settings_option = $this->get_plugin_option( $option, $admin_mode, 'allow override', 'print overlay' );
4367	3574
4368	3575	// If this site is configured independently of any multisite overrides, make sure we are not grabbing the multisite value; otherwise, grab the multisite value to show behind the disabled overlay.
4369		- if ( is_multisite() && 1 === intval( $this->get_plugin_option( 'advanced_override_multisite' ) ) ) {
	3576	+ if ( is_multisite() && $this->get_plugin_option( 'advanced_override_multisite' ) == '1' ) {
4370	3577	$auth_settings_option = $this->get_plugin_option( $option );
4371		- } elseif ( is_multisite() && WP_Plugin_Authorizer::SINGLE_CONTEXT === $admin_mode && '1' === $this->get_plugin_option( 'multisite_override', WP_Plugin_Authorizer::NETWORK_CONTEXT ) ) {
	3578	+ } elseif ( is_multisite() && $admin_mode === SINGLE_ADMIN && $this->get_plugin_option( 'multisite_override', MULTISITE_ADMIN ) === '1' ) {
4372	3579	// Workaround: javascript code hides/shows other settings based
4373	3580	// on the selection in this option. If this option is overridden
4374	3581	// by a multisite option, it should show that value in order to
4375	3582	// correctly display the other appropriate options.
		@@ -4375,66 +3582,42 @@
4375	3582	// correctly display the other appropriate options.
4376	3583	// Side effect: this site option will be overwritten by the
4377	3584	// multisite option on save. Since this is a 2-item radio, we
4378	3585	// determined this was acceptable.
4379		- $auth_settings_option = $this->get_plugin_option( $option, WP_Plugin_Authorizer::NETWORK_CONTEXT );
	3586	+ $auth_settings_option = $this->get_plugin_option( $option, MULTISITE_ADMIN );
4380	3587	}
4381	3588
4382	3589	// Print option elements.
4383		- ?>
4384		- <input type="radio" id="radio_auth_settings_<?php echo esc_attr( $option ); ?>_everyone" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="everyone"<?php checked( 'everyone' === $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo esc_attr( $option ); ?>_everyone"><?php esc_html_e( 'Everyone can see the site', 'authorizer' ); ?></label><br />
4385		- <input type="radio" id="radio_auth_settings_<?php echo esc_attr( $option ); ?>_logged_in_users" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="logged_in_users"<?php checked( 'logged_in_users' === $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo esc_attr( $option ); ?>_logged_in_users"><?php esc_html_e( 'Only logged in users can see the site', 'authorizer' ); ?></label><br />
4386		- <?php
	3590	+ ?><input type="radio" id="radio_auth_settings_<?php echo $option; ?>_everyone" name="auth_settings[<?php echo $option; ?>]" value="everyone"<?php checked( 'everyone' == $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo $option; ?>_everyone"><?php _e( 'Everyone can see the site', 'authorizer' ); ?></label><br />
	3591	+ <input type="radio" id="radio_auth_settings_<?php echo $option; ?>_logged_in_users" name="auth_settings[<?php echo $option; ?>]" value="logged_in_users"<?php checked( 'logged_in_users' == $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo $option; ?>_logged_in_users"><?php _e( 'Only logged in users can see the site', 'authorizer' ); ?></label><br /><?php
4387	3592	}
4388	3593
4389	3594
4390		- /**
4391		- * Settings print callback.
4392		- *
4393		- * @param string $args Args (e.g., multisite admin mode).
4394		- * @return void
4395		- */
4396		- public function print_radio_auth_access_redirect( $args = '' ) {
	3595	+ function print_radio_auth_access_redirect( $args = '' ) {
4397	3596	// Get plugin option.
4398		- $option = 'access_redirect';
	3597	+ $option = 'access_redirect';
4399	3598	$auth_settings_option = $this->get_plugin_option( $option );
4400	3599
4401	3600	// Print option elements.
4402		- ?>
4403		- <input type="radio" id="radio_auth_settings_<?php echo esc_attr( $option ); ?>_to_login" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="login"<?php checked( 'login' === $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo esc_attr( $option ); ?>_to_login"><?php esc_html_e( 'Send them to the login screen', 'authorizer' ); ?></label><br />
4404		- <input type="radio" id="radio_auth_settings_<?php echo esc_attr( $option ); ?>_to_message" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="message"<?php checked( 'message' === $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo esc_attr( $option ); ?>_to_message"><?php esc_html_e( 'Show them the anonymous access message (below)', 'authorizer' ); ?></label>
4405		- <?php
	3601	+ ?><input type="radio" id="radio_auth_settings_<?php echo $option; ?>_to_login" name="auth_settings[<?php echo $option; ?>]" value="login"<?php checked( 'login' == $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo $option; ?>_to_login"><?php _e( 'Send them to the login screen', 'authorizer' ); ?></label><br />
	3602	+ <input type="radio" id="radio_auth_settings_<?php echo $option; ?>_to_message" name="auth_settings[<?php echo $option; ?>]" value="message"<?php checked( 'message' == $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo $option; ?>_to_message"><?php _e( 'Show them the anonymous access message (below)', 'authorizer' ); ?></label><?php
4406	3603	}
4407	3604
4408	3605
4409		- /**
4410		- * Settings print callback.
4411		- *
4412		- * @param string $args Args (e.g., multisite admin mode).
4413		- * @return void
4414		- */
4415		- public function print_radio_auth_access_public_warning( $args = '' ) {
	3606	+ function print_radio_auth_access_public_warning( $args = '' ) {
4416	3607	// Get plugin option.
4417		- $option = 'access_public_warning';
	3608	+ $option = 'access_public_warning';
4418	3609	$auth_settings_option = $this->get_plugin_option( $option );
4419	3610
4420	3611	// Print option elements.
4421		- ?>
4422		- <input type="radio" id="radio_auth_settings_<?php echo esc_attr( $option ); ?>_no" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="no_warning"<?php checked( 'no_warning' === $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo esc_attr( $option ); ?>_no"><?php echo wp_kses( __( 'Show them the page <strong>without</strong> the anonymous access message', 'authorizer' ), $this->allowed_html ); ?></label><br />
4423		- <input type="radio" id="radio_auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="warning"<?php checked( 'warning' === $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo esc_attr( $option ); ?>"><?php echo wp_kses( __( 'Show them the page <strong>with</strong> the anonymous access message (marked up as a <a href="http://getbootstrap.com/components/#alerts-dismissible" target="_blank">Bootstrap Dismissible Alert</a>)', 'authorizer' ), $this->allowed_html ); ?></label>
4424		- <?php
	3612	+ ?><input type="radio" id="radio_auth_settings_<?php echo $option; ?>_no" name="auth_settings[<?php echo $option; ?>]" value="no_warning"<?php checked( 'no_warning' == $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo $option; ?>_no"><?php _e( 'Show them the page <strong>without</strong> the anonymous access message', 'authorizer' ); ?></label><br />
	3613	+ <input type="radio" id="radio_auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="warning"<?php checked( 'warning' == $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo $option; ?>"><?php _e( 'Show them the page <strong>with</strong> the anonymous access message (marked up as a <a href="http://getbootstrap.com/components/#alerts-dismissible" target="_blank">Bootstrap Dismissible Alert</a>)', 'authorizer' ); ?></label><?php
4425	3614	}
4426	3615
4427	3616
4428		- /**
4429		- * Settings print callback.
4430		- *
4431		- * @param string $args Args (e.g., multisite admin mode).
4432		- * @return void
4433		- */
4434		- public function print_wysiwyg_auth_access_redirect_to_message( $args = '' ) {
	3617	+ function print_wysiwyg_auth_access_redirect_to_message( $args = '' ) {
4435	3618	// Get plugin option.
4436		- $option = 'access_redirect_to_message';
	3619	+ $option = 'access_redirect_to_message';
4437	3620	$auth_settings_option = $this->get_plugin_option( $option );
4438	3621
4439	3622	// Print option elements.
4440	3623	wp_editor(
		@@ -4443,25 +3626,19 @@
4443	3626	array(
4444	3627	'media_buttons' => false,
4445	3628	'textarea_name' => "auth_settings[$option]",
4446	3629	'textarea_rows' => 5,
4447		- 'tinymce' => true,
4448		- 'teeny' => true,
4449		- 'quicktags' => false,
	3630	+ 'tinymce' => true,
	3631	+ 'teeny' => true,
	3632	+ 'quicktags' => false,
4450	3633	)
4451	3634	);
4452	3635	}
4453	3636
4454	3637
4455		- /**
4456		- * Settings print callback.
4457		- *
4458		- * @param string $args Args (e.g., multisite admin mode).
4459		- * @return void
4460		- */
4461		- public function print_multiselect_auth_access_public_pages( $args = '' ) {
	3638	+ function print_multiselect_auth_access_public_pages( $args = '' ) {
4462	3639	// Get plugin option.
4463		- $option = 'access_public_pages';
	3640	+ $option = 'access_public_pages';
4464	3641	$auth_settings_option = $this->get_plugin_option( $option );
4465	3642	$auth_settings_option = is_array( $auth_settings_option ) ? $auth_settings_option : array();
4466	3643
4467	3644	$post_types = array_merge( array( 'page', 'post' ), get_post_types( array( '_builtin' => false ), 'names' ) );
		@@ -4467,31 +3644,23 @@
4467	3644	$post_types = array_merge( array( 'page', 'post' ), get_post_types( array( '_builtin' => false ), 'names' ) );
4468	3645	$post_types = is_array( $post_types ) ? $post_types : array();
4469	3646
4470	3647	// Print option elements.
4471		- ?>
4472		- <select id="auth_settings_<?php echo esc_attr( $option ); ?>" multiple="multiple" name="auth_settings[<?php echo esc_attr( $option ); ?>][]">
4473		- <optgroup label="<?php esc_attr_e( 'Home', 'authorizer' ); ?>">
4474		- <option value="home" <?php selected( in_array( 'home', $auth_settings_option, true ) ); ?>><?php esc_html_e( 'Home Page', 'authorizer' ); ?></option>
4475		- <option value="auth_public_404" <?php selected( in_array( 'auth_public_404', $auth_settings_option, true ) ); ?>><?php esc_html_e( 'Nonexistent (404) Pages', 'authorizer' ); ?></option>
	3648	+ ?><select id="auth_settings_<?php echo $option; ?>" multiple="multiple" name="auth_settings[<?php echo $option; ?>][]">
	3649	+ <optgroup label="<?php _e( 'Home', 'authorizer' ); ?>">
	3650	+ <option value="home" <?php echo in_array( 'home', $auth_settings_option ) ? 'selected="selected"' : ''; ?>><?php _e( 'Home Page', 'authorizer' ); ?></option>
	3651	+ <option value="auth_public_404" <?php echo in_array( 'auth_public_404', $auth_settings_option ) ? 'selected="selected"' : ''; ?>><?php _e( 'Nonexistent (404) Pages', 'authorizer' ); ?></option>
4476	3652	</optgroup>
4477		- <?php foreach ( $post_types as $post_type ) : ?>
4478		- <optgroup label="<?php echo esc_attr( ucfirst( $post_type ) ); ?>">
4479		- <?php
4480		- $pages = get_posts(
4481		- array(
4482		- 'post_type' => $post_type,
4483		- 'posts_per_page' => 1000, // phpcs:ignore WordPress.VIP.PostsPerPage.posts_per_page_posts_per_page
4484		- )
4485		- );
4486		- $pages = is_array( $pages ) ? $pages : array();
4487		- foreach ( $pages as $page ) :
4488		- ?>
4489		- <option value="<?php echo esc_attr( $page->ID ); ?>" <?php selected( in_array( strval( $page->ID ), $auth_settings_option, true ) ); ?>><?php echo esc_html( $page->post_title ); ?></option>
	3653	+ <?php foreach ( $post_types as $post_type ): ?>
	3654	+ <optgroup label="<?php echo ucfirst( $post_type ); ?>">
	3655	+ <?php $pages = get_posts( array( 'post_type' => $post_type, 'posts_per_page' => -1 ) ); ?>
	3656	+ <?php $pages = is_array( $pages ) ? $pages : array(); ?>
	3657	+ <?php foreach ( $pages as $page ): ?>
	3658	+ <option value="<?php echo $page->ID; ?>" <?php echo in_array( $page->ID, $auth_settings_option ) ? 'selected="selected"' : ''; ?>><?php echo $page->post_title; ?></option>
4490	3659	<?php endforeach; ?>
4491	3660	</optgroup>
4492	3661	<?php endforeach; ?>
4493		- <optgroup label="<?php esc_attr_e( 'Categories', 'authorizer' ); ?>">
	3662	+ <optgroup label="<?php _e( 'Categories', 'authorizer' ); ?>">
4494	3663	<?php
4495	3664	// If sitepress-multilingual-cms plugin is enabled, temporarily disable
4496	3665	// its terms_clauses filter since it conflicts with the category handling.
4497	3666	if ( array_key_exists( 'sitepress', $GLOBALS ) && is_object( $GLOBALS['sitepress'] ) ) {
		@@ -4500,155 +3669,107 @@
4500	3669	add_filter( 'terms_clauses', array( $GLOBALS['sitepress'], 'terms_clauses' ) );
4501	3670	} else {
4502	3671	$categories = get_categories( array( 'hide_empty' => false ) );
4503	3672	}
4504		- foreach ( $categories as $category ) :
4505		- ?>
4506		- <option value="<?php echo esc_attr( 'cat_' . $category->slug ); ?>" <?php selected( in_array( 'cat_' . $category->slug, $auth_settings_option, true ) ); ?>><?php echo esc_html( $category->name ); ?></option>
	3673	+ foreach ( $categories as $category ) : ?>
	3674	+ <option value="<?php echo 'cat_' . $category->slug; ?>" <?php echo in_array( 'cat_' . $category->slug, $auth_settings_option ) ? 'selected="selected"' : ''; ?>><?php echo $category->name; ?></option>
4507	3675	<?php endforeach; ?>
4508	3676	</optgroup>
4509		- </select>
4510		- <?php
	3677	+ </select><?php
4511	3678	}
4512	3679
4513	3680
4514		- /**
4515		- * Settings print callback.
4516		- *
4517		- * @param string $args Args (e.g., multisite admin mode).
4518		- * @return void
4519		- */
4520		- public function print_section_info_external( $args = '' ) {
4521		- ?>
4522		- <div id="section_info_external" class="section_info">
4523		- <p><?php esc_html_e( 'Enter your external server settings below.', 'authorizer' ); ?></p>
4524		- </div>
4525		- <?php
	3681	+ function print_section_info_external( $args = '' ) {
	3682	+ ?><div id="section_info_external" class="section_info">
	3683	+ <p><?php _e( 'Enter your external server settings below.', 'authorizer' ); ?></p>
	3684	+ </div><?php
4526	3685	}
4527	3686
4528	3687
4529		- /**
4530		- * Settings print callback.
4531		- *
4532		- * @param string $args Args (e.g., multisite admin mode).
4533		- * @return void
4534		- */
4535		- public function print_select_auth_access_default_role( $args = '' ) {
	3688	+ function get_admin_mode( $args ) {
	3689	+ if ( is_array( $args ) && array_key_exists( MULTISITE_ADMIN, $args ) && $args[MULTISITE_ADMIN] === true ) {
	3690	+ return MULTISITE_ADMIN;
	3691	+ } else {
	3692	+ return SINGLE_ADMIN;
	3693	+ }
	3694	+ }
	3695	+
	3696	+
	3697	+ function print_select_auth_access_default_role( $args = '' ) {
4536	3698	// Get plugin option.
4537		- $option = 'access_default_role';
	3699	+ $option = 'access_default_role';
4538	3700	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4539	3701
4540	3702	// Print option elements.
4541		- ?>
4542		- <select id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]">
	3703	+ ?><select id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]">
4543	3704	<?php wp_dropdown_roles( $auth_settings_option ); ?>
4544		- <option value=""<?php selected( '' === $auth_settings_option ); ?>><?php esc_html_e( '-- None --', 'authorizer' ); ?></option>
4545		- </select>
4546		- <?php
	3705	+ </select><?php
4547	3706	}
4548	3707
4549	3708
4550		- /**
4551		- * Settings print callback.
4552		- *
4553		- * @param string $args Args (e.g., multisite admin mode).
4554		- * @return void
4555		- */
4556		- public function print_checkbox_auth_external_google( $args = '' ) {
	3709	+ function print_checkbox_auth_external_google( $args = '' ) {
4557	3710	// Get plugin option.
4558		- $option = 'google';
	3711	+ $option = 'google';
4559	3712	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4560	3713
4561	3714	// Print option elements.
4562		- ?>
4563		- <input type="checkbox" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="1"<?php checked( 1 === intval( $auth_settings_option ) ); ?> /><label for="auth_settings_<?php echo esc_attr( $option ); ?>"><?php esc_html_e( 'Enable Google Logins', 'authorizer' ); ?></label>
4564		- <?php
	3715	+ ?><input type="checkbox" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="1"<?php checked( 1 == $auth_settings_option ); ?> /><label for="auth_settings_<?php echo $option; ?>"><?php _e( 'Enable Google Logins', 'authorizer' ); ?></label><?php
4565	3716	}
4566	3717
4567	3718
4568		- /**
4569		- * Settings print callback.
4570		- *
4571		- * @param string $args Args (e.g., multisite admin mode).
4572		- * @return void
4573		- */
4574		- public function print_text_google_clientid( $args = '' ) {
	3719	+ function print_text_google_clientid( $args = '' ) {
4575	3720	// Get plugin option.
4576		- $option = 'google_clientid';
	3721	+ $option = 'google_clientid';
4577	3722	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4578	3723
4579	3724	// Print option elements.
4580		- $site_url_parts = wp_parse_url( get_site_url() );
4581		- $site_url_host = $site_url_parts['scheme'] . '://' . $site_url_parts['host'] . '/';
4582		-
4583		- esc_html_e( "If you don't have a Google Client ID and Secret, generate them by following these instructions:", 'authorizer' );
4584		- ?>
	3725	+ $site_url_parts = parse_url( get_site_url() );
	3726	+ $site_url_host = $site_url_parts['scheme'] . '://' . $site_url_parts['host'] . '/';
	3727	+ ?><?php _e( "If you don't have a Google Client ID and Secret, generate them by following these instructions:", 'authorizer' ); ?>
4585	3728	<ol>
4586		- <li><?php echo wp_kses( __( 'Click <strong>Create a Project</strong> on the <a href="https://cloud.google.com/console" target="_blank">Google Developers Console</a>. You can name it whatever you want.', 'authorizer' ), $this->allowed_html ); ?></li>
4587		- <li><?php echo wp_kses( __( 'Within the project, navigate to <em>APIs and Auth</em> &gt; <em>Credentials</em>, then click <strong>Create New Client ID</strong> under OAuth. Use these settings:', 'authorizer' ), $this->allowed_html ); ?>
	3729	+ <li><?php _e( 'Click <strong>Create a Project</strong> on the <a href="https://cloud.google.com/console" target="_blank">Google Developers Console</a>. You can name it whatever you want.', 'authorizer' ); ?></li>
	3730	+ <li><?php _e( 'Within the project, navigate to <em>APIs and Auth</em> &gt; <em>Credentials</em>, then click <strong>Create New Client ID</strong> under OAuth. Use these settings:', 'authorizer' ); ?>
4588	3731	<ul>
4589		- <li><?php echo wp_kses( __( 'Application Type: <strong>Web application</strong>', 'authorizer' ), $this->allowed_html ); ?></li>
4590		- <li><?php esc_html_e( 'Authorized Javascript Origins:', 'authorizer' ); ?> <strong><?php echo esc_html( rtrim( $site_url_host, '/' ) ); ?></strong></li>
4591		- <li><?php echo wp_kses( __( 'Authorized Redirect URI: <em>none</em>', 'authorizer' ), $this->allowed_html ); ?></li>
	3732	+ <li><?php _e( 'Application Type: <strong>Web application</strong>', 'authorizer' ); ?></li>
	3733	+ <li><?php _e( 'Authorized Javascript Origins:', 'authorizer' ); ?> <strong><?php echo rtrim( $site_url_host, '/' ); ?></strong></li>
	3734	+ <li><?php _e( 'Authorized Redirect URI: <em>none</em>', 'authorizer' ); ?></li>
4592	3735	</ul>
4593	3736	</li>
4594		- <li><?php esc_html_e( 'Copy/paste your new Client ID/Secret pair into the fields below.', 'authorizer' ); ?></li>
4595		- <li><?php echo wp_kses( __( '<strong>Note</strong>: Navigate to <em>APIs and Auth</em> &gt; <em>Consent screen</em> to change the way the Google consent screen appears after a user has successfully entered their password, but before they are redirected back to WordPress.', 'authorizer' ), $this->allowed_html ); ?></li>
4596		- <li><?php echo wp_kses( __( 'Note: Google may have a more recent version of these instructions in their <a href="https://developers.google.com/identity/sign-in/web/devconsole-project" target="_blank">developer documentation</a>.', 'authorizer' ), $this->allowed_html ); ?></li>
	3737	+ <li><?php _e( 'Copy/paste your new Client ID/Secret pair into the fields below.', 'authorizer' ); ?></li>
	3738	+ <li><?php _e( '<strong>Note</strong>: Navigate to <em>APIs and Auth</em> &gt; <em>Consent screen</em> to change the way the Google consent screen appears after a user has successfully entered their password, but before they are redirected back to WordPress.', 'authorizer' ); ?></li>
	3739	+ <li><?php _e( 'Note: Google may have a more recent version of these instructions in their <a href="https://developers.google.com/identity/sign-in/web/devconsole-project" target="_blank">developer documentation</a>.', 'authorizer' ); ?></li>
4597	3740	</ol>
4598		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" style="width:560px;" />
4599		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: 1234567890123-kdjr85yt6vjr6d8g7dhr8g7d6durjf7g.apps.googleusercontent.com', 'authorizer' ); ?></label>
4600		- <?php
	3741	+ <input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" style="width:560px;" />
	3742	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: 1234567890123-kdjr85yt6vjr6d8g7dhr8g7d6durjf7g.apps.googleusercontent.com', 'authorizer'); ?></label><?php
4601	3743	}
4602	3744
4603	3745
4604		- /**
4605		- * Settings print callback.
4606		- *
4607		- * @param string $args Args (e.g., multisite admin mode).
4608		- * @return void
4609		- */
4610		- public function print_text_google_clientsecret( $args = '' ) {
	3746	+ function print_text_google_clientsecret( $args = '' ) {
4611	3747	// Get plugin option.
4612		- $option = 'google_clientsecret';
	3748	+ $option = 'google_clientsecret';
4613	3749	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4614	3750
4615	3751	// Print option elements.
4616		- ?>
4617		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" style="width:220px;" />
4618		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: sDNgX5_pr_5bly-frKmvp8jT', 'authorizer' ); ?></label>
4619		- <?php
	3752	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" style="width:220px;" />
	3753	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: sDNgX5_pr_5bly-frKmvp8jT', 'authorizer'); ?></label><?php
4620	3754	}
4621	3755
4622	3756
4623		- /**
4624		- * Settings print callback.
4625		- *
4626		- * @param string $args Args (e.g., multisite admin mode).
4627		- * @return void
4628		- */
4629		- public function print_text_google_hosteddomain( $args = '' ) {
	3757	+ function print_text_google_hosteddomain( $args = '' ) {
4630	3758	// Get plugin option.
4631		- $option = 'google_hosteddomain';
	3759	+ $option = 'google_hosteddomain';
4632	3760	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4633	3761
4634	3762	// Print option elements.
4635		- ?>
4636		- <textarea id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" placeholder="" style="width:220px;"><?php echo esc_html( $auth_settings_option ); ?></textarea>
4637		- <br /><small><?php esc_html_e( 'Restrict Google logins to a specific Google Apps hosted domain (for example, mycollege.edu). Leave blank to allow all Google sign-ins.', 'authorizer' ); ?><br /><?php esc_html_e( 'If restricting to multiple domains, add one domain per line.', 'authorizer' ); ?></small>
	3763	+ ?><textarea id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" placeholder="" style="width:220px;"><?php echo $auth_settings_option; ?></textarea>
	3764	+ <br /><small><?php _e( 'Restrict Google logins to a specific Google Apps hosted domain (for example, mycollege.edu). Leave blank to allow all Google sign-ins.', 'authorizer' ); ?><br /><?php _e( 'If restricting to multiple domains, add one domain per line.', 'authorizer' ); ?></small>
4638	3765	<?php
4639	3766	}
4640	3767
4641	3768
4642		- /**
4643		- * Settings print callback.
4644		- *
4645		- * @param string $args Args (e.g., multisite admin mode).
4646		- * @return void
4647		- */
4648		- public function print_checkbox_auth_external_cas( $args = '' ) {
	3769	+ function print_checkbox_auth_external_cas( $args = '' ) {
4649	3770	// Get plugin option.
4650		- $option = 'cas';
	3771	+ $option = 'cas';
4651	3772	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4652	3773
4653	3774	// Make sure php5-curl extension is installed on server.
4654	3775	$curl_installed_message = ! function_exists( 'curl_init' ) ? __( '<a href="http://www.php.net//manual/en/curl.installation.php" target="_blank" style="color: red;">PHP CURL extension</a> is not installed', 'authorizer' ) : '';
		@@ -4667,217 +3788,128 @@
4667	3788	')</span>';
4668	3789	}
4669	3790
4670	3791	// Print option elements.
4671		- ?>
4672		- <input type="checkbox" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="1"<?php checked( 1 === intval( $auth_settings_option ) ); ?> /><label for="auth_settings_<?php echo esc_attr( $option ); ?>"><?php esc_html_e( 'Enable CAS Logins', 'authorizer' ); ?></label> <?php echo wp_kses( $error_message, $this->allowed_html ); ?>
4673		- <?php
	3792	+ ?><input type="checkbox" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="1"<?php checked( 1 == $auth_settings_option ); ?> /><label for="auth_settings_<?php echo $option; ?>"><?php _e( 'Enable CAS Logins', 'authorizer' ); ?></label> <?php echo $error_message; ?><?php
4674	3793	}
4675	3794
4676	3795
4677		- /**
4678		- * Settings print callback.
4679		- *
4680		- * @param string $args Args (e.g., multisite admin mode).
4681		- * @return void
4682		- */
4683		- public function print_text_cas_custom_label( $args = '' ) {
	3796	+ function print_text_cas_custom_label( $args = '' ) {
4684	3797	// Get plugin option.
4685		- $option = 'cas_custom_label';
	3798	+ $option = 'cas_custom_label';
4686	3799	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4687	3800
4688	3801	// Print option elements.
4689		- esc_html_e( 'The button on the login page will read:', 'authorizer' );
4690		- ?>
4691		- <p><a class="button-primary button-large" style="padding: 3px 16px; height: 36px;"><span class="dashicons dashicons-lock" style="margin: 4px 4px 0 0;"></span> <strong><?php esc_html_e( 'Sign in with', 'authorizer' ); ?> </strong><input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="CAS" style="width: 100px;" /></a></p>
4692		- <?php
	3802	+ ?><?php _e( 'The button on the login page will read:', 'authorizer' ); ?><p><a class="button-primary button-large" style="padding: 3px 16px; height: 36px;"><span class="dashicons dashicons-lock" style="margin: 4px 4px 0 0;"></span> <strong><?php _e( 'Sign in with', 'authorizer' ); ?> </strong><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="CAS" style="width: 100px;" /></a></p><?php
4693	3803	}
4694	3804
4695	3805
4696		- /**
4697		- * Settings print callback.
4698		- *
4699		- * @param string $args Args (e.g., multisite admin mode).
4700		- * @return void
4701		- */
4702		- public function print_text_cas_host( $args = '' ) {
	3806	+ function print_text_cas_host( $args = '' ) {
4703	3807	// Get plugin option.
4704		- $option = 'cas_host';
	3808	+ $option = 'cas_host';
4705	3809	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4706	3810
4707	3811	// Print option elements.
4708		- ?>
4709		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" />
4710		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: authn.example.edu', 'authorizer' ); ?></label>
4711		- <?php
	3812	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" />
	3813	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: authn.example.edu', 'authorizer'); ?></label><?php
4712	3814	}
4713	3815
4714	3816
4715		- /**
4716		- * Settings print callback.
4717		- *
4718		- * @param string $args Args (e.g., multisite admin mode).
4719		- * @return void
4720		- */
4721		- public function print_text_cas_port( $args = '' ) {
	3817	+ function print_text_cas_port( $args = '' ) {
4722	3818	// Get plugin option.
4723		- $option = 'cas_port';
	3819	+ $option = 'cas_port';
4724	3820	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4725	3821
4726	3822	// Print option elements.
4727		- ?>
4728		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" style="width:50px;" />
4729		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: 443', 'authorizer' ); ?></label>
4730		- <?php
	3823	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" style="width:50px;" />
	3824	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: 443', 'authorizer'); ?></label><?php
4731	3825	}
4732	3826
4733	3827
4734		- /**
4735		- * Settings print callback.
4736		- *
4737		- * @param string $args Args (e.g., multisite admin mode).
4738		- * @return void
4739		- */
4740		- public function print_text_cas_path( $args = '' ) {
	3828	+ function print_text_cas_path( $args = '' ) {
4741	3829	// Get plugin option.
4742		- $option = 'cas_path';
	3830	+ $option = 'cas_path';
4743	3831	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4744	3832
4745	3833	// Print option elements.
4746		- ?>
4747		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" />
4748		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: /cas', 'authorizer' ); ?></label>
4749		- <?php
	3834	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" />
	3835	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: /cas', 'authorizer'); ?></label><?php
4750	3836	}
4751	3837
4752	3838
4753		- /**
4754		- * Settings print callback.
4755		- *
4756		- * @param string $args Args (e.g., multisite admin mode).
4757		- * @return void
4758		- */
4759		- public function print_select_cas_version( $args = '' ) {
	3839	+ function print_select_cas_version( $args = '' ) {
4760	3840	// Get plugin option.
4761		- $option = 'cas_version';
	3841	+ $option = 'cas_version';
4762	3842	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4763	3843
4764	3844	// Print option elements.
4765		- ?>
4766		- <select id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]">
	3845	+ ?><select id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]">
4767	3846	<option value="SAML_VERSION_1_1" <?php selected( $auth_settings_option, 'SAML_VERSION_1_1' ); ?>>SAML_VERSION_1_1</option>
4768	3847	<option value="CAS_VERSION_3_0" <?php selected( $auth_settings_option, 'CAS_VERSION_3_0' ); ?>>CAS_VERSION_3_0</option>
4769	3848	<option value="CAS_VERSION_2_0" <?php selected( $auth_settings_option, 'CAS_VERSION_2_0' ); ?>>CAS_VERSION_2_0</option>
4770	3849	<option value="CAS_VERSION_1_0" <?php selected( $auth_settings_option, 'CAS_VERSION_1_0' ); ?>>CAS_VERSION_1_0</option>
4771		- </select>
4772		- <?php
	3850	+ </select><?php
4773	3851	}
4774	3852
4775	3853
4776		- /**
4777		- * Settings print callback.
4778		- *
4779		- * @param string $args Args (e.g., multisite admin mode).
4780		- * @return void
4781		- */
4782		- public function print_text_cas_attr_email( $args = '' ) {
	3854	+ function print_text_cas_attr_email( $args = '' ) {
4783	3855	// Get plugin option.
4784		- $option = 'cas_attr_email';
	3856	+ $option = 'cas_attr_email';
4785	3857	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4786	3858
4787	3859	// Print option elements.
4788		- ?>
4789		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" />
4790		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: mail', 'authorizer' ); ?></label>
4791		- <br /><small><?php echo wp_kses( __( "Note: If your CAS server doesn't return an attribute containing an email, you can specify the @domain portion of the email address here, and the email address will be constructed from it and the username. For example, if user 'bob' logs in and his email address should be bob@example.edu, then enter <strong>@example.edu</strong> in this field.", 'authorizer' ), $this->allowed_html ); ?></small>
4792		- <?php
	3860	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" />
	3861	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: mail', 'authorizer'); ?></label>
	3862	+ <br /><small><?php _e( "Note: If your CAS server doesn't return an attribute containing an email, you can specify the @domain portion of the email address here, and the email address will be constructed from it and the username. For example, if user 'bob' logs in and his email address should be bob@example.edu, then enter <strong>@example.edu</strong> in this field.", 'authorizer' ); ?></small><?php
4793	3863	}
4794	3864
4795	3865
4796		- /**
4797		- * Settings print callback.
4798		- *
4799		- * @param string $args Args (e.g., multisite admin mode).
4800		- * @return void
4801		- */
4802		- public function print_text_cas_attr_first_name( $args = '' ) {
	3866	+ function print_text_cas_attr_first_name( $args = '' ) {
4803	3867	// Get plugin option.
4804		- $option = 'cas_attr_first_name';
	3868	+ $option = 'cas_attr_first_name';
4805	3869	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4806	3870
4807	3871	// Print option elements.
4808		- ?>
4809		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" />
4810		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: givenName', 'authorizer' ); ?></label>
4811		- <?php
	3872	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" />
	3873	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: givenName', 'authorizer'); ?></label><?php
4812	3874	}
4813	3875
4814	3876
4815		- /**
4816		- * Settings print callback.
4817		- *
4818		- * @param string $args Args (e.g., multisite admin mode).
4819		- * @return void
4820		- */
4821		- public function print_text_cas_attr_last_name( $args = '' ) {
	3877	+ function print_text_cas_attr_last_name( $args = '' ) {
4822	3878	// Get plugin option.
4823		- $option = 'cas_attr_last_name';
	3879	+ $option = 'cas_attr_last_name';
4824	3880	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4825	3881
4826	3882	// Print option elements.
4827		- ?>
4828		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" />
4829		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: sn', 'authorizer' ); ?></label>
4830		- <?php
	3883	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" />
	3884	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: sn', 'authorizer'); ?></label><?php
4831	3885	}
4832	3886
4833	3887
4834		- /**
4835		- * Settings print callback.
4836		- *
4837		- * @param string $args Args (e.g., multisite admin mode).
4838		- * @return void
4839		- */
4840		- public function print_checkbox_cas_attr_update_on_login( $args = '' ) {
	3888	+ function print_checkbox_cas_attr_update_on_login( $args = '' ) {
4841	3889	// Get plugin option.
4842		- $option = 'cas_attr_update_on_login';
	3890	+ $option = 'cas_attr_update_on_login';
4843	3891	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4844	3892
4845	3893	// Print option elements.
4846		- ?>
4847		- <input type="checkbox" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="1"<?php checked( 1 === intval( $auth_settings_option ) ); ?> /><label for="auth_settings_<?php echo esc_attr( $option ); ?>"><?php esc_html_e( 'Update first and last name fields on login (will overwrite any name the user has supplied in their profile)', 'authorizer' ); ?></label>
4848		- <?php
	3894	+ ?><input type="checkbox" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="1"<?php checked( 1 == $auth_settings_option ); ?> /><label for="auth_settings_<?php echo $option; ?>"><?php _e( 'Update first and last name fields on login (will overwrite any name the user has supplied in their profile)', 'authorizer' ); ?></label><?php
4849	3895	}
4850	3896
4851	3897
4852		- /**
4853		- * Settings print callback.
4854		- *
4855		- * @param string $args Args (e.g., multisite admin mode).
4856		- * @return void
4857		- */
4858		- public function print_checkbox_cas_auto_login( $args = '' ) {
	3898	+ function print_checkbox_cas_auto_login( $args = '' ) {
4859	3899	// Get plugin option.
4860		- $option = 'cas_auto_login';
	3900	+ $option = 'cas_auto_login';
4861	3901	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4862	3902
4863	3903	// Print option elements.
4864		- ?>
4865		- <input type="checkbox" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="1"<?php checked( 1 === intval( $auth_settings_option ) ); ?> /><label for="auth_settings_<?php echo esc_attr( $option ); ?>"><?php esc_html_e( "Immediately redirect to CAS login form if it's the only enabled external service and WordPress logins are hidden", 'authorizer' ); ?></label>
4866		- <p><small><?php esc_html_e( 'Note: This feature will only work if you have checked "Hide WordPress Logins" in Advanced settings, and if CAS is the only enabled service (i.e., no Google or LDAP). If you have enabled CAS Single Sign-On (SSO), and a user has already logged into CAS elsewhere, enabling this feature will allow automatic logins without any user interaction.', 'authorizer' ); ?></small></p>
4867		- <?php
	3904	+ ?><input type="checkbox" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="1"<?php checked( 1 == $auth_settings_option ); ?> /><label for="auth_settings_<?php echo $option; ?>"><?php _e( "Immediately redirect to CAS login form if it's the only enabled external service and WordPress logins are hidden", 'authorizer' ); ?></label>
	3905	+ <p><small><?php _e( 'Note: This feature will only work if you have checked "Hide WordPress Logins" in Advanced settings, and if CAS is the only enabled service (i.e., no Google or LDAP). If you have enabled CAS Single Sign-On (SSO), and a user has already logged into CAS elsewhere, enabling this feature will allow automatic logins without any user interaction.', 'authorizer' ); ?></small></p><?php
4868	3906	}
4869	3907
4870	3908
4871		- /**
4872		- * Settings print callback.
4873		- *
4874		- * @param string $args Args (e.g., multisite admin mode).
4875		- * @return void
4876		- */
4877		- public function print_checkbox_auth_external_ldap( $args = '' ) {
	3909	+ function print_checkbox_auth_external_ldap( $args = '' ) {
4878	3910	// Get plugin option.
4879		- $option = 'ldap';
	3911	+ $option = 'ldap';
4880	3912	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4881	3913
4882	3914	// Make sure php5-ldap extension is installed on server.
4883	3915	$ldap_installed_message = ! function_exists( 'ldap_connect' ) ? '<span style="color: red;">(' . __( 'Warning: <a href="http://www.php.net/manual/en/ldap.installation.php" target="_blank" style="color: red;">PHP LDAP extension</a> is <strong>not</strong> installed', 'authorizer' ) . ')</span>' : '';
		@@ -4882,324 +3914,193 @@
4882	3914	// Make sure php5-ldap extension is installed on server.
4883	3915	$ldap_installed_message = ! function_exists( 'ldap_connect' ) ? '<span style="color: red;">(' . __( 'Warning: <a href="http://www.php.net/manual/en/ldap.installation.php" target="_blank" style="color: red;">PHP LDAP extension</a> is <strong>not</strong> installed', 'authorizer' ) . ')</span>' : '';
4884	3916
4885	3917	// Print option elements.
4886		- ?>
4887		- <input type="checkbox" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="1"<?php checked( 1 === intval( $auth_settings_option ) ); ?> /><label for="auth_settings_<?php echo esc_attr( $option ); ?>"><?php esc_html_e( 'Enable LDAP Logins', 'authorizer' ); ?></label> <?php echo wp_kses( $ldap_installed_message, $this->allowed_html ); ?>
4888		- <?php
	3918	+ ?><input type="checkbox" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="1"<?php checked( 1 == $auth_settings_option ); ?> /><label for="auth_settings_<?php echo $option; ?>"><?php _e( 'Enable LDAP Logins', 'authorizer' ); ?></label> <?php echo $ldap_installed_message; ?><?php
4889	3919	}
4890	3920
4891	3921
4892		- /**
4893		- * Settings print callback.
4894		- *
4895		- * @param string $args Args (e.g., multisite admin mode).
4896		- * @return void
4897		- */
4898		- public function print_text_ldap_host( $args = '' ) {
	3922	+ function print_text_ldap_host( $args = '' ) {
4899	3923	// Get plugin option.
4900		- $option = 'ldap_host';
	3924	+ $option = 'ldap_host';
4901	3925	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4902	3926
4903	3927	// Print option elements.
4904		- ?>
4905		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" style="width:330px;" />
4906		- <br /><small><?php esc_html_e( 'Specify either a hostname (for example, ldap.example.edu) or a full LDAP URI (for example, ldaps://ldap.example.edu:636).', 'authorizer' ); ?></small>
4907		- <?php
	3928	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" style="width:330px;" />
	3929	+ <br /><small><?php _e( "Specify either a hostname (for example, ldap.example.edu) or a full LDAP URI (for example, ldaps://ldap.example.edu:636).", 'authorizer' ); ?></small><?php
4908	3930	}
4909	3931
4910	3932
4911		- /**
4912		- * Settings print callback.
4913		- *
4914		- * @param string $args Args (e.g., multisite admin mode).
4915		- * @return void
4916		- */
4917		- public function print_text_ldap_port( $args = '' ) {
	3933	+ function print_text_ldap_port( $args = '' ) {
4918	3934	// Get plugin option.
4919		- $option = 'ldap_port';
	3935	+ $option = 'ldap_port';
4920	3936	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4921	3937
4922	3938	// Print option elements.
4923		- ?>
4924		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" style="width:50px;" />
4925		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: 389', 'authorizer' ); ?></label>
4926		- <br /><small><?php esc_html_e( 'If a full LDAP URI (ldaps://hostname:port) is specified above, this field is ignored.', 'authorizer' ); ?></small>
4927		- <?php
	3939	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" style="width:50px;" />
	3940	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: 389', 'authorizer' ); ?></label>
	3941	+ <br /><small><?php _e( "If a full LDAP URI (ldaps://hostname:port) is specified above, this field is ignored.", 'authorizer' ); ?></small><?php
4928	3942	}
4929	3943
4930	3944
4931		- /**
4932		- * Settings print callback.
4933		- *
4934		- * @param string $args Args (e.g., multisite admin mode).
4935		- * @return void
4936		- */
4937		- public function print_checkbox_ldap_tls( $args = '' ) {
	3945	+ function print_checkbox_ldap_tls( $args = '' ) {
4938	3946	// Get plugin option.
4939		- $option = 'ldap_tls';
	3947	+ $option = 'ldap_tls';
4940	3948	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4941	3949
4942	3950	// Print option elements.
4943		- ?>
4944		- <input type="checkbox" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="1"<?php checked( 1 === intval( $auth_settings_option ) ); ?> /><label for="auth_settings_<?php echo esc_attr( $option ); ?>"><?php esc_html_e( 'Use TLS', 'authorizer' ); ?></label>
4945		- <br /><small><?php esc_html_e( 'If ldaps is used, this should be unchecked', 'authorizer' ); ?></small>
4946		- <?php
	3951	+ ?><input type="checkbox" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="1"<?php checked( 1 == $auth_settings_option ); ?> /><label for="auth_settings_<?php echo $option; ?>"><?php _e( 'Use TLS', 'authorizer' ); ?></label><?php
4947	3952	}
4948	3953
4949	3954
4950		- /**
4951		- * Settings print callback.
4952		- *
4953		- * @param string $args Args (e.g., multisite admin mode).
4954		- * @return void
4955		- */
4956		- public function print_text_ldap_search_base( $args = '' ) {
	3955	+ function print_text_ldap_search_base( $args = '' ) {
4957	3956	// Get plugin option.
4958		- $option = 'ldap_search_base';
	3957	+ $option = 'ldap_search_base';
4959	3958	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4960	3959
4961	3960	// Print option elements.
4962		- ?>
4963		- <textarea id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" placeholder="" style="width:330px;"><?php echo esc_attr( $auth_settings_option ); ?></textarea>
4964		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: ou=people,dc=example,dc=edu', 'authorizer' ); ?></label>
4965		- <br /><small><?php esc_html_e( 'If you have multiple search bases, separate them by newlines (one per line).', 'authorizer' ); ?></small>
4966		- <?php
	3961	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" style="width:330px;" />
	3962	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: ou=people,dc=example,dc=edu', 'authorizer'); ?></label><?php
4967	3963	}
4968	3964
4969	3965
4970		- /**
4971		- * Settings print callback.
4972		- *
4973		- * @param string $args Args (e.g., multisite admin mode).
4974		- * @return void
4975		- */
4976		- public function print_text_ldap_uid( $args = '' ) {
	3966	+ function print_text_ldap_uid( $args = '' ) {
4977	3967	// Get plugin option.
4978		- $option = 'ldap_uid';
	3968	+ $option = 'ldap_uid';
4979	3969	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4980	3970
4981	3971	// Print option elements.
4982		- ?>
4983		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" style="width:80px;" />
4984		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: uid', 'authorizer' ); ?></label>
4985		- <?php
	3972	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" style="width:80px;" />
	3973	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: uid', 'authorizer' ); ?></label><?php
4986	3974	}
4987	3975
4988	3976
4989		- /**
4990		- * Settings print callback.
4991		- *
4992		- * @param string $args Args (e.g., multisite admin mode).
4993		- * @return void
4994		- */
4995		- public function print_text_ldap_attr_email( $args = '' ) {
	3977	+ function print_text_ldap_attr_email( $args = '' ) {
4996	3978	// Get plugin option.
4997		- $option = 'ldap_attr_email';
	3979	+ $option = 'ldap_attr_email';
4998	3980	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4999	3981
5000	3982	// Print option elements.
5001		- ?>
5002		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" />
5003		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: mail', 'authorizer' ); ?></label>
5004		- <br /><small><?php echo wp_kses( __( "Note: If your LDAP server doesn't return an attribute containing an email, you can specify the @domain portion of the email address here, and the email address will be constructed from it and the username. For example, if user 'bob' logs in and his email address should be bob@example.edu, then enter <strong>@example.edu</strong> in this field.", 'authorizer' ), $this->allowed_html ); ?></small>
5005		- <?php
	3983	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" />
	3984	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: mail', 'authorizer' ); ?></label>
	3985	+ <br /><small><?php _e( "Note: If your LDAP server doesn't return an attribute containing an email, you can specify the @domain portion of the email address here, and the email address will be constructed from it and the username. For example, if user 'bob' logs in and his email address should be bob@example.edu, then enter <strong>@example.edu</strong> in this field.", 'authorizer' ); ?></small><?php
5006	3986	}
5007	3987
5008	3988
5009		- /**
5010		- * Settings print callback.
5011		- *
5012		- * @param string $args Args (e.g., multisite admin mode).
5013		- * @return void
5014		- */
5015		- public function print_text_ldap_user( $args = '' ) {
	3989	+ function print_text_ldap_user( $args = '' ) {
5016	3990	// Get plugin option.
5017		- $option = 'ldap_user';
	3991	+ $option = 'ldap_user';
5018	3992	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5019	3993
5020	3994	// Print option elements.
5021		- ?>
5022		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" style="width:330px;" />
5023		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: cn=directory-user,ou=specials,dc=example,dc=edu', 'authorizer' ); ?></label>
5024		- <?php
	3995	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" style="width:330px;" />
	3996	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: cn=directory-user,ou=specials,dc=example,dc=edu', 'authorizer' ); ?></label><?php
5025	3997	}
5026	3998
5027	3999
5028		- /**
5029		- * Settings print callback.
5030		- *
5031		- * @param string $args Args (e.g., multisite admin mode).
5032		- * @return void
5033		- */
5034		- public function print_password_ldap_password( $args = '' ) {
	4000	+ function print_password_ldap_password( $args = '' ) {
5035	4001	// Get plugin option.
5036		- $option = 'ldap_password';
	4002	+ $option = 'ldap_password';
5037	4003	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5038	4004
5039	4005	// Print option elements.
5040		- ?>
5041		- <input type="password" id="garbage_to_stop_autofill" name="garbage" value="" autocomplete="off" style="display:none;" />
5042		- <input type="password" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $this->decrypt( $auth_settings_option ) ); ?>" autocomplete="off" />
5043		- <?php
	4006	+ ?><input type="password" id="garbage_to_stop_autofill" name="garbage" value="" autocomplete="off" style="display:none;" />
	4007	+ <input type="password" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $this->decrypt( $auth_settings_option ); ?>" autocomplete="off" /><?php
5044	4008	}
5045	4009
5046	4010
5047		- /**
5048		- * Settings print callback.
5049		- *
5050		- * @param string $args Args (e.g., multisite admin mode).
5051		- * @return void
5052		- */
5053		- public function print_text_ldap_lostpassword_url( $args = '' ) {
	4011	+ function print_text_ldap_lostpassword_url( $args = '' ) {
5054	4012	// Get plugin option.
5055		- $option = 'ldap_lostpassword_url';
	4013	+ $option = 'ldap_lostpassword_url';
5056	4014	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5057	4015
5058	4016	// Print option elements.
5059		- ?>
5060		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" style="width: 400px;" />
5061		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: https://myschool.example.edu:8888/am-forgot-password', 'authorizer' ); ?></label>
5062		- <?php
	4017	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" style="width: 400px;" />
	4018	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: https://myschool.example.edu:8888/am-forgot-password', 'authorizer' ); ?></label><?php
5063	4019	}
5064	4020
5065	4021
5066		- /**
5067		- * Settings print callback.
5068		- *
5069		- * @param string $args Args (e.g., multisite admin mode).
5070		- * @return void
5071		- */
5072		- public function print_text_ldap_attr_first_name( $args = '' ) {
	4022	+ function print_text_ldap_attr_first_name( $args = '' ) {
5073	4023	// Get plugin option.
5074		- $option = 'ldap_attr_first_name';
	4024	+ $option = 'ldap_attr_first_name';
5075	4025	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5076	4026
5077	4027	// Print option elements.
5078		- ?>
5079		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" />
5080		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: givenname', 'authorizer' ); ?></label>
5081		- <?php
	4028	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" />
	4029	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: givenname', 'authorizer' ); ?></label><?php
5082	4030	}
5083	4031
5084	4032
5085		- /**
5086		- * Settings print callback.
5087		- *
5088		- * @param string $args Args (e.g., multisite admin mode).
5089		- * @return void
5090		- */
5091		- public function print_text_ldap_attr_last_name( $args = '' ) {
	4033	+ function print_text_ldap_attr_last_name( $args = '' ) {
5092	4034	// Get plugin option.
5093		- $option = 'ldap_attr_last_name';
	4035	+ $option = 'ldap_attr_last_name';
5094	4036	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5095	4037
5096	4038	// Print option elements.
5097		- ?>
5098		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" />
5099		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: sn', 'authorizer' ); ?></label>
5100		- <?php
	4039	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" />
	4040	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: sn', 'authorizer' ); ?></label><?php
5101	4041	}
5102	4042
5103	4043
5104		- /**
5105		- * Settings print callback.
5106		- *
5107		- * @param string $args Args (e.g., multisite admin mode).
5108		- * @return void
5109		- */
5110		- public function print_checkbox_ldap_attr_update_on_login( $args = '' ) {
	4044	+ function print_checkbox_ldap_attr_update_on_login( $args = '' ) {
5111	4045	// Get plugin option.
5112		- $option = 'ldap_attr_update_on_login';
	4046	+ $option = 'ldap_attr_update_on_login';
5113	4047	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5114	4048
5115	4049	// Print option elements.
5116		- ?>
5117		- <input type="checkbox" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="1"<?php checked( 1 === intval( $auth_settings_option ) ); ?> /><label for="auth_settings_<?php echo esc_attr( $option ); ?>"><?php esc_html_e( 'Update first and last name fields on login (will overwrite any name the user has supplied in their profile)', 'authorizer' ); ?></label>
5118		- <?php
	4050	+ ?><input type="checkbox" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="1"<?php checked( 1 == $auth_settings_option ); ?> /><label for="auth_settings_<?php echo $option; ?>"><?php _e( 'Update first and last name fields on login (will overwrite any name the user has supplied in their profile)', 'authorizer' ); ?></label><?php
5119	4051	}
5120	4052
5121	4053
5122		- /**
5123		- * Settings print callback.
5124		- *
5125		- * @param string $args Args (e.g., multisite admin mode).
5126		- * @return void
5127		- */
5128		- public function print_section_info_advanced( $args = '' ) {
5129		- ?>
5130		- <div id="section_info_advanced" class="section_info">
5131		- <p><?php esc_html_e( 'You may optionally specify some advanced settings below.', 'authorizer' ); ?></p>
5132		- </div>
5133		- <?php
	4054	+ function print_section_info_advanced( $args = '' ) {
	4055	+ ?><div id="section_info_advanced" class="section_info">
	4056	+ <p><?php _e( 'You may optionally specify some advanced settings below.', 'authorizer' ); ?></p>
	4057	+ </div><?php
5134	4058	}
5135	4059
5136	4060
5137		- /**
5138		- * Settings print callback.
5139		- *
5140		- * @param string $args Args (e.g., multisite admin mode).
5141		- * @return void
5142		- */
5143		- public function print_text_auth_advanced_lockouts( $args = '' ) {
	4061	+ function print_text_auth_advanced_lockouts( $args = '' ) {
5144	4062	// Get plugin option.
5145		- $option = 'advanced_lockouts';
	4063	+ $option = 'advanced_lockouts';
5146	4064	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5147	4065
5148	4066	// Print option elements.
5149		- esc_html_e( 'After', 'authorizer' );
5150		- ?>
5151		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>_attempts_1" name="auth_settings[<?php echo esc_attr( $option ); ?>][attempts_1]" value="<?php echo esc_attr( $auth_settings_option['attempts_1'] ); ?>" placeholder="10" style="width:30px;" />
5152		- <?php esc_html_e( 'invalid password attempts, delay further attempts on that user for', 'authorizer' ); ?>
5153		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>_duration_1" name="auth_settings[<?php echo esc_attr( $option ); ?>][duration_1]" value="<?php echo esc_attr( $auth_settings_option['duration_1'] ); ?>" placeholder="1" style="width:30px;" />
5154		- <?php esc_html_e( 'minute(s).', 'authorizer' ); ?>
	4067	+ ?><?php _e( 'After', 'authorizer' ); ?>
	4068	+ <input type="text" id="auth_settings_<?php echo $option; ?>_attempts_1" name="auth_settings[<?php echo $option; ?>][attempts_1]" value="<?php echo $auth_settings_option['attempts_1']; ?>" placeholder="10" style="width:30px;" />
	4069	+ <?php _e( 'invalid password attempts, delay further attempts on that user for', 'authorizer' ); ?>
	4070	+ <input type="text" id="auth_settings_<?php echo $option; ?>_duration_1" name="auth_settings[<?php echo $option; ?>][duration_1]" value="<?php echo $auth_settings_option['duration_1']; ?>" placeholder="1" style="width:30px;" />
	4071	+ <?php _e( 'minute(s).', 'authorizer' ); ?>
5155	4072	<br />
5156		- <?php esc_html_e( 'After', 'authorizer' ); ?>
5157		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>_attempts_2" name="auth_settings[<?php echo esc_attr( $option ); ?>][attempts_2]" value="<?php echo esc_attr( $auth_settings_option['attempts_2'] ); ?>" placeholder="10" style="width:30px;" />
5158		- <?php esc_html_e( 'more invalid attempts, increase the delay to', 'authorizer' ); ?>
5159		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>_duration_2" name="auth_settings[<?php echo esc_attr( $option ); ?>][duration_2]" value="<?php echo esc_attr( $auth_settings_option['duration_2'] ); ?>" placeholder="10" style="width:30px;" />
5160		- <?php esc_html_e( 'minutes.', 'authorizer' ); ?>
	4073	+ <?php _e( 'After', 'authorizer' ); ?>
	4074	+ <input type="text" id="auth_settings_<?php echo $option; ?>_attempts_2" name="auth_settings[<?php echo $option; ?>][attempts_2]" value="<?php echo $auth_settings_option['attempts_2']; ?>" placeholder="10" style="width:30px;" />
	4075	+ <?php _e( 'more invalid attempts, increase the delay to', 'authorizer' ); ?>
	4076	+ <input type="text" id="auth_settings_<?php echo $option; ?>_duration_2" name="auth_settings[<?php echo $option; ?>][duration_2]" value="<?php echo $auth_settings_option['duration_2']; ?>" placeholder="10" style="width:30px;" />
	4077	+ <?php _e( 'minutes.', 'authorizer' ); ?>
5161	4078	<br />
5162		- <?php esc_html_e( 'Reset the delays after', 'authorizer' ); ?>
5163		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>_reset_duration" name="auth_settings[<?php echo esc_attr( $option ); ?>][reset_duration]" value="<?php echo esc_attr( $auth_settings_option['reset_duration'] ); ?>" placeholder="240" style="width:40px;" />
5164		- <?php esc_html_e( 'minutes with no invalid attempts.', 'authorizer' ); ?>
5165		- <?php
	4079	+ <?php _e( 'Reset the delays after', 'authorizer' ); ?>
	4080	+ <input type="text" id="auth_settings_<?php echo $option; ?>_reset_duration" name="auth_settings[<?php echo $option; ?>][reset_duration]" value="<?php echo $auth_settings_option['reset_duration']; ?>" placeholder="240" style="width:40px;" />
	4081	+ <?php _e( 'minutes with no invalid attempts.', 'authorizer' ); ?><?php
5166	4082	}
5167	4083
5168	4084
5169		- /**
5170		- * Settings print callback.
5171		- *
5172		- * @param string $args Args (e.g., multisite admin mode).
5173		- * @return void
5174		- */
5175		- public function print_checkbox_auth_advanced_hide_wp_login( $args = '' ) {
	4085	+ function print_checkbox_auth_advanced_hide_wp_login( $args = '' ) {
5176	4086	// Get plugin option.
5177		- $option = 'advanced_hide_wp_login';
	4087	+ $option = 'advanced_hide_wp_login';
5178	4088	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5179	4089
5180	4090	// Print option elements.
5181		- ?>
5182		- <input type="checkbox" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="1"<?php checked( 1 === intval( $auth_settings_option ) ); ?> /><label for="auth_settings_<?php echo esc_attr( $option ); ?>"><?php esc_html_e( 'Hide WordPress Logins', 'authorizer' ); ?></label>
5183		- <p><small><?php esc_html_e( 'Note: You can always access the WordPress logins by adding external=wordpress to the wp-login URL, like so:', 'authorizer' ); ?><br /><a href="<?php echo esc_attr( wp_login_url() ); ?>?external=wordpress" target="_blank"><?php echo esc_html( wp_login_url() ); ?>?external=wordpress</a>.</p>
5184		- <?php
	4091	+ ?><input type="checkbox" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="1"<?php checked( 1 == $auth_settings_option ); ?> /><label for="auth_settings_<?php echo $option; ?>"><?php _e( 'Hide WordPress Logins', 'authorizer' ); ?></label>
	4092	+ <p><small><?php _e( 'Note: You can always access the WordPress logins by adding external=wordpress to the wp-login URL, like so:', 'authorizer' ); ?><br /><a href="<?php echo wp_login_url(); ?>?external=wordpress" target="_blank"><?php echo wp_login_url(); ?>?external=wordpress</a>.</p><?php
5185	4093	}
5186	4094
5187	4095
5188		- /**
5189		- * Settings print callback.
5190		- *
5191		- * @param string $args Args (e.g., multisite admin mode).
5192		- * @return void
5193		- */
5194		- public function print_radio_auth_advanced_branding( $args = '' ) {
	4096	+ function print_radio_auth_advanced_branding( $args = '' ) {
5195	4097	// Get plugin option.
5196		- $option = 'advanced_branding';
	4098	+ $option = 'advanced_branding';
5197	4099	$auth_settings_option = $this->get_plugin_option( $option );
5198	4100
5199	4101	// Print option elements.
5200		- ?>
5201		- <input type="radio" id="radio_auth_settings_<?php echo esc_attr( $option ); ?>_default" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="default"<?php checked( 'default' === $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo esc_attr( $option ); ?>_default"><?php esc_html_e( 'Default WordPress login screen', 'authorizer' ); ?></label><br />
	4102	+ ?><input type="radio" id="radio_auth_settings_<?php echo $option; ?>_default" name="auth_settings[<?php echo $option; ?>]" value="default"<?php checked( 'default' == $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo $option; ?>_default"><?php _e( 'Default WordPress login screen', 'authorizer' ); ?></label><br />
5202	4103	<?php
5203	4104
5204	4105	/**
5205	4106	* Developers can use the `authorizer_add_branding_option` filter
		@@ -5204,8 +4105,9 @@
5204	4105	/**
5205	4106	* Developers can use the `authorizer_add_branding_option` filter
5206	4107	* to add a radio button for "Custom WordPress login branding"
5207	4108	* under the "Advanced" tab in Authorizer options. Example:
	4109	+ *
5208	4110	* function my_authorizer_add_branding_option( $branding_options ) {
5209	4111	* $new_branding_option = array(
5210	4112	* 'value' => 'your_brand'
5211	4113	* 'description' => 'Custom Your Brand Login Screen',
		@@ -5219,274 +4121,133 @@
5219	4121	*/
5220	4122	$branding_options = array();
5221	4123	$branding_options = apply_filters( 'authorizer_add_branding_option', $branding_options );
5222	4124	foreach ( $branding_options as $branding_option ) {
5223		- // Make sure the custom brands have the required values.
	4125	+ // Make sure the custom brands have the required values
5224	4126	if ( ! ( is_array( $branding_option ) && array_key_exists( 'value', $branding_option ) && array_key_exists( 'description', $branding_option ) ) ) {
5225	4127	continue;
5226	4128	}
5227		- ?>
5228		- <input type="radio" id="radio_auth_settings_<?php echo esc_attr( $option ); ?>_<?php echo esc_attr( sanitize_title( $branding_option['value'] ) ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $branding_option['value'] ); ?>"<?php checked( $branding_option['value'] === $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo esc_attr( $option ); ?>_<?php echo esc_attr( sanitize_title( $branding_option['value'] ) ); ?>"><?php echo esc_html( $branding_option['description'] ); ?></label><br />
5229		- <?php
	4129	+ ?><input type="radio" id="radio_auth_settings_<?php echo $option; ?>_<?php echo sanitize_title( $branding_option['value'] ); ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $branding_option['value']; ?>"<?php checked( $branding_option['value'] == $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo $option; ?>_<?php echo sanitize_title( $branding_option['value'] ); ?>"><?php echo $branding_option['description']; ?></label><br /><?php
5230	4130	}
5231	4131
5232	4132	// Print message about adding custom brands if there are none.
5233	4133	if ( count( $branding_options ) === 0 ) {
5234		- ?>
5235		- <p><em><?php echo wp_kses( __( '<strong>Note for theme developers</strong>: Add more options here by using the `authorizer_add_branding_option` filter in your theme. You can see an example theme that implements this filter in the plugin directory under sample-theme-add-branding.', 'authorizer' ), $this->allowed_html ); ?></em></p>
5236		- <?php
	4134	+ ?><p><em><?php _e( '<strong>Note for theme developers</strong>: Add more options here by using the `authorizer_add_branding_option` filter in your theme. You can see an example theme that implements this filter in the plugin directory under sample-theme-add-branding.', 'authorizer' ); ?></em></p><?php
5237	4135	}
5238	4136	}
5239	4137
5240	4138
5241		- /**
5242		- * Settings print callback.
5243		- *
5244		- * @param string $args Args (e.g., multisite admin mode).
5245		- * @return void
5246		- */
5247		- public function print_radio_auth_advanced_admin_menu( $args = '' ) {
	4139	+ function print_radio_auth_advanced_admin_menu( $args = '' ) {
5248	4140	// Get plugin option.
5249		- $option = 'advanced_admin_menu';
	4141	+ $option = 'advanced_admin_menu';
5250	4142	$auth_settings_option = $this->get_plugin_option( $option );
5251	4143
5252	4144	// Print option elements.
5253		- ?>
5254		- <input type="radio" id="radio_auth_settings_<?php echo esc_attr( $option ); ?>_settings" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="settings"<?php checked( 'settings' === $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo esc_attr( $option ); ?>_settings"><?php esc_html_e( 'Show in Settings menu', 'authorizer' ); ?></label><br />
5255		- <input type="radio" id="radio_auth_settings_<?php echo esc_attr( $option ); ?>_top" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="top"<?php checked( 'top' === $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo esc_attr( $option ); ?>_top"><?php esc_html_e( 'Show in sidebar (top level)', 'authorizer' ); ?></label><br />
5256		- <?php
	4145	+ ?><input type="radio" id="radio_auth_settings_<?php echo $option; ?>_settings" name="auth_settings[<?php echo $option; ?>]" value="settings"<?php checked( 'settings' == $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo $option; ?>_settings"><?php _e( 'Show in Settings menu', 'authorizer' ); ?></label><br />
	4146	+ <input type="radio" id="radio_auth_settings_<?php echo $option; ?>_top" name="auth_settings[<?php echo $option; ?>]" value="top"<?php checked( 'top' == $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo $option; ?>_top"><?php _e( 'Show in sidebar (top level)', 'authorizer' ); ?></label><br /><?php
5257	4147
5258	4148	}
5259	4149
5260	4150
5261		- /**
5262		- * Settings print callback.
5263		- *
5264		- * @param string $args Args (e.g., multisite admin mode).
5265		- * @return void
5266		- */
5267		- public function print_select_auth_advanced_usermeta( $args = '' ) {
	4151	+ function print_select_auth_advanced_usermeta( $args = '' ) {
5268	4152	// Get plugin option.
5269		- $option = 'advanced_usermeta';
	4153	+ $option = 'advanced_usermeta';
5270	4154	$auth_settings_option = $this->get_plugin_option( $option );
5271	4155
5272	4156	// Print option elements.
5273		- ?>
5274		- <select id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]">
5275		- <option value=""><?php esc_html_e( '-- None --', 'authorizer' ); ?></option>
5276		- <?php
5277		- if ( class_exists( 'acf' ) ) :
	4157	+ ?><select id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]">
	4158	+ <option value=""><?php _e( '-- None --', 'authorizer' ); ?></option>
	4159	+ <?php if ( class_exists( 'acf' ) ) :
5278	4160	// Get ACF 5 fields. Note: it would be much easier to use `get_field_objects()`
5279	4161	// or `get_field_objects( 'user_' . get_current_user_id() )`, but neither will
5280	4162	// list fields that have never been given values for users (i.e., new ACF
5281	4163	// fields). Therefore we fall back on finding any ACF fields applied to users
5282	4164	// (user_role or user_form location rules in the field group definition).
5283		- $fields = array();
	4165	+ $fields = array();
5284	4166	$acf_field_group_ids = array();
5285		- $acf_field_groups = new WP_Query(
5286		- array(
5287		- 'post_type' => 'acf-field-group',
5288		- )
5289		- );
	4167	+ $acf_field_groups = new WP_Query( array(
	4168	+ 'post_type' => 'acf-field-group',
	4169	+ ));
5290	4170	while ( $acf_field_groups->have_posts() ) : $acf_field_groups->the_post();
5291	4171	if ( strpos( get_the_content(), 's:5:"param";s:9:"user_role"' ) !== false || strpos( get_the_content(), 's:5:"param";s:9:"user_form"' ) !== false ) :
5292	4172	array_push( $acf_field_group_ids, get_the_ID() );
5293	4173	endif;
5294		- endwhile;
5295		- wp_reset_postdata();
	4174	+ endwhile; wp_reset_postdata();
5296	4175	foreach ( $acf_field_group_ids as $acf_field_group_id ) :
5297		- $acf_fields = new WP_Query(
5298		- array(
5299		- 'post_type' => 'acf-field',
5300		- 'post_parent' => $acf_field_group_id,
5301		- )
5302		- );
	4176	+ $acf_fields = new WP_Query( array(
	4177	+ 'post_type' => 'acf-field',
	4178	+ 'post_parent' => $acf_field_group_id,
	4179	+ ));
5303	4180	while ( $acf_fields->have_posts() ) : $acf_fields->the_post();
5304	4181	global $post;
5305		- $fields[ $post->post_name ] = get_field_object( $post->post_name );
5306		- endwhile;
5307		- wp_reset_postdata();
	4182	+ $fields[$post->post_name] = get_field_object( $post->post_name );
	4183	+ endwhile; wp_reset_postdata();
5308	4184	endforeach;
5309	4185	// Get ACF 4 fields.
5310		- $acf4_field_groups = new WP_Query(
5311		- array(
5312		- 'post_type' => 'acf',
5313		- )
5314		- );
	4186	+ $acf4_field_groups = new WP_Query( array(
	4187	+ 'post_type' => 'acf',
	4188	+ ));
5315	4189	while ( $acf4_field_groups->have_posts() ) : $acf4_field_groups->the_post();
5316	4190	$field_group_rules = get_post_meta( get_the_ID(), 'rule', true );
5317		- if ( is_array( $field_group_rules ) && array_key_exists( 'param', $field_group_rules ) && 'ef_user' === $field_group_rules['param'] ) :
	4191	+ if ( is_array( $field_group_rules ) && array_key_exists( 'param', $field_group_rules ) && $field_group_rules['param'] === 'ef_user' ) :
5318	4192	$acf4_fields = get_post_custom( get_the_ID() );
5319	4193	foreach ( $acf4_fields as $meta_key => $meta_value ) :
5320	4194	if ( strpos( $meta_key, 'field_' ) === 0 ) :
5321		- $meta_value = unserialize( $meta_value[0] );
5322		- $fields[ $meta_key ] = $meta_value;
	4195	+ $meta_value = unserialize( $meta_value[0] );
	4196	+ $fields[$meta_key] = $meta_value;
5323	4197	endif;
5324	4198	endforeach;
5325	4199	endif;
5326		- endwhile;
5327		- wp_reset_postdata();
5328		- ?>
	4200	+ endwhile; wp_reset_postdata(); ?>
5329	4201	<optgroup label="ACF User Fields:">
5330		- <?php foreach ( (array) $fields as $field => $field_object ) : ?>
5331		- <option value="acf___<?php echo esc_attr( $field_object['key'] ); ?>"<?php selected( "acf___{$field_object['key']}" === $auth_settings_option ); ?>><?php echo esc_html( $field_object['label'] ); ?></option>
	4202	+ <?php foreach ( (array)$fields as $field => $field_object ) : ?>
	4203	+ <option value="acf___<?php echo $field_object['key']; ?>"<?php if ( $auth_settings_option === "acf___{$field_object['key']}" ) echo ' selected="selected"'; ?>><?php echo $field_object['label']; ?></option>
5332	4204	<?php endforeach; ?>
5333	4205	</optgroup>
5334	4206	<?php endif; ?>
5335		- <optgroup label="<?php esc_attr_e( 'All Usermeta:', 'authorizer' ); ?>">
5336		- <?php
5337		- foreach ( $this->get_all_usermeta_keys() as $meta_key ) :
5338		- if ( substr( $meta_key, 0, 3 ) === 'wp_' ) :
5339		- continue;
5340		- endif;
5341		- ?>
5342		- <option value="<?php echo esc_attr( $meta_key ); ?>"<?php selected( $auth_settings_option === $meta_key ); ?>><?php echo esc_html( $meta_key ); ?></option>
	4207	+ <optgroup label="<?php _e( 'All Usermeta:', 'authorizer' ); ?>">
	4208	+ <?php foreach ( $this->get_all_usermeta_keys() as $meta_key ) : if ( substr( $meta_key, 0, 3 ) === 'wp_' ) continue; ?>
	4209	+ <option value="<?php echo $meta_key; ?>"<?php if ( $auth_settings_option === $meta_key ) echo ' selected="selected"'; ?>><?php echo $meta_key; ?></option>
5343	4210	<?php endforeach; ?>
5344	4211	</optgroup>
5345		- </select>
5346		- <?php
	4212	+ </select><?php
5347	4213	}
5348	4214
5349	4215
5350		- /**
5351		- * Settings print callback.
5352		- *
5353		- * @param string $args Args (e.g., multisite admin mode).
5354		- * @return void
5355		- */
5356		- public function print_text_auth_advanced_users_per_page( $args = '' ) {
	4216	+ function print_checkbox_auth_advanced_override_multisite( $args = '' ) {
5357	4217	// Get plugin option.
5358		- $option = 'advanced_users_per_page';
5359		- $auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5360		-
5361		- // Print option elements.
5362		- ?>
5363		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" size="4" />
5364		- <?php
5365		- }
5366		-
5367		-
5368		- /**
5369		- * Settings print callback.
5370		- *
5371		- * @param string $args Args (e.g., multisite admin mode).
5372		- * @return void
5373		- */
5374		- public function print_select_auth_advanced_users_sort_by( $args = '' ) {
5375		- // Get plugin option.
5376		- $option = 'advanced_users_sort_by';
5377		- $auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5378		-
5379		- // Print option elements.
5380		- ?>
5381		- <select id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]">
5382		- <option value="created" <?php selected( $auth_settings_option, 'created' ); ?>><?php esc_html_e( 'Date approved', 'authorizer' ); ?></option>
5383		- <option value="email" <?php selected( $auth_settings_option, 'email' ); ?>><?php esc_html_e( 'Email', 'authorizer' ); ?></option>
5384		- <option value="role" <?php selected( $auth_settings_option, 'role' ); ?>><?php esc_html_e( 'Role', 'authorizer' ); ?></option>
5385		- <option value="date_added" <?php selected( $auth_settings_option, 'date_added' ); ?>><?php esc_html_e( 'Date registered', 'authorizer' ); ?></option>
5386		- </select>
5387		- <?php
5388		- }
5389		-
5390		-
5391		- /**
5392		- * Settings print callback.
5393		- *
5394		- * @param string $args Args (e.g., multisite admin mode).
5395		- * @return void
5396		- */
5397		- public function print_select_auth_advanced_users_sort_order( $args = '' ) {
5398		- // Get plugin option.
5399		- $option = 'advanced_users_sort_order';
5400		- $auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5401		-
5402		- // Print option elements.
5403		- ?>
5404		- <select id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]">
5405		- <option value="asc" <?php selected( $auth_settings_option, 'asc' ); ?>><?php esc_html_e( 'Ascending', 'authorizer' ); ?></option>
5406		- <option value="desc" <?php selected( $auth_settings_option, 'desc' ); ?>><?php esc_html_e( 'Descending', 'authorizer' ); ?></option>
5407		- </select>
5408		- <?php
5409		- }
5410		-
5411		-
5412		- /**
5413		- * Settings print callback.
5414		- *
5415		- * @param string $args Args (e.g., multisite admin mode).
5416		- * @return void
5417		- */
5418		- public function print_checkbox_auth_advanced_widget_enabled( $args = '' ) {
5419		- // Get plugin option.
5420		- $option = 'advanced_widget_enabled';
5421		- $auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5422		-
5423		- // Print option elements.
5424		- ?>
5425		- <input type="checkbox" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="1"<?php checked( 1 === intval( $auth_settings_option ) ); ?> /><label for="auth_settings_<?php echo esc_attr( $option ); ?>"><?php esc_html_e( 'Show Dashboard Widget', 'authorizer' ); ?></label>
5426		- <p><small><?php esc_html_e( 'Note: Only users with the create_users capability will be able to see the dashboard widget.', 'authorizer' ); ?></small></p>
5427		- <?php
5428		- }
5429		-
5430		-
5431		- /**
5432		- * Settings print callback.
5433		- *
5434		- * @param string $args Args (e.g., multisite admin mode).
5435		- * @return void
5436		- */
5437		- public function print_checkbox_auth_advanced_override_multisite( $args = '' ) {
5438		- // Get plugin option.
5439		- $option = 'advanced_override_multisite';
	4218	+ $option = 'advanced_override_multisite';
5440	4219	$auth_settings_option = $this->get_plugin_option( $option );
5441	4220
5442	4221	// Print option elements.
5443		- ?>
5444		- <input type="checkbox" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="1"<?php checked( 1 === intval( $auth_settings_option ) ); ?> /><label for="auth_settings_<?php echo esc_attr( $option ); ?>"><?php esc_html_e( "Configure this site independently (don't inherit any multisite settings)", 'authorizer' ); ?></label>
5445		- <?php
	4222	+ ?><input type="checkbox" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="1"<?php checked( 1 == $auth_settings_option ); ?> /><label for="auth_settings_<?php echo $option; ?>"><?php _e( "Configure this site independently (don't inherit any multisite settings)", 'authorizer' ); ?></label><?php
5446	4223	}
5447	4224
5448	4225
5449	4226
5450	4227	/**
5451		- * Determines whether we are in single site or multisite admin context.
5452		- *
5453		- * @param string $args Args (e.g., multisite admin mode).
5454		- * @return int Current mode.
5455		- */
5456		- private function get_admin_mode( $args ) {
5457		- if ( is_array( $args ) && array_key_exists( WP_Plugin_Authorizer::NETWORK_CONTEXT, $args ) && true === $args[ WP_Plugin_Authorizer::NETWORK_CONTEXT ] ) {
5458		- return WP_Plugin_Authorizer::NETWORK_CONTEXT;
5459		- } else {
5460		- return WP_Plugin_Authorizer::SINGLE_CONTEXT;
5461		- }
5462		- }
5463		-
5464		-
5465		- /**
5466	4228	* Add help documentation to the options page.
5467		- *
5468		- * Action: load-settings_page_authorizer > admin_head
	4229	+ * Run on action hook chain: load-settings_page_authorizer > admin_head
5469	4230	*/
5470	4231	public function admin_head() {
5471	4232	$screen = get_current_screen();
5472	4233
5473		- // Add help tab for Access Lists Settings.
	4234	+ // Add help tab for Access Lists Settings
5474	4235	$help_auth_settings_access_lists_content = '
5475		- <p>' . __( "<strong>Pending Users</strong>: Pending users are users who have successfully logged in to the site, but who haven't yet been approved (or blocked) by you.", 'authorizer' ) . '</p>
5476		- <p>' . __( '<strong>Approved Users</strong>: Approved users have access to the site once they successfully log in.', 'authorizer' ) . '</p>
5477		- <p>' . __( '<strong>Blocked Users</strong>: Blocked users will receive an error message when they try to visit the site after authenticating.', 'authorizer' ) . '</p>
5478		- <p>' . __( 'Users in the <strong>Pending</strong> list appear automatically after a new user tries to log in from the configured external authentication service. You can add users to the <strong>Approved</strong> or <strong>Blocked</strong> lists by typing them in manually, or by clicking the <em>Approve</em> or <em>Block</em> buttons next to a user in the <strong>Pending</strong> list.', 'authorizer' ) . '</p>
	4236	+ <p>' . __( "<strong>Pending Users</strong>: Pending users are users who have successfully logged in to the site, but who haven't yet been approved (or blocked) by you.", 'authorizer' ) .'</p>
	4237	+ <p>' . __( "<strong>Approved Users</strong>: Approved users have access to the site once they successfully log in.", 'authorizer' ) . '</p>
	4238	+ <p>' . __( "<strong>Blocked Users</strong>: Blocked users will receive an error message when they try to visit the site after authenticating.", 'authorizer' ) . '</p>
	4239	+ <p>' . __( "Users in the <strong>Pending</strong> list appear automatically after a new user tries to log in from the configured external authentication service. You can add users to the <strong>Approved</strong> or <strong>Blocked</strong> lists by typing them in manually, or by clicking the <em>Approve</em> or <em>Block</em> buttons next to a user in the <strong>Pending</strong> list.", 'authorizer' ) . '</p>
5479	4240	';
5480	4241	$screen->add_help_tab(
5481	4242	array(
5482		- 'id' => 'help_auth_settings_access_lists_content',
5483		- 'title' => __( 'Access Lists', 'authorizer' ),
	4243	+ 'id' => 'help_auth_settings_access_lists_content',
	4244	+ 'title' => __( 'Access Lists', 'authorizer' ),
5484	4245	'content' => $help_auth_settings_access_lists_content,
5485	4246	)
5486	4247	);
5487	4248
5488		- // Add help tab for Login Access Settings.
	4249	+ // Add help tab for Login Access Settings
5489	4250	$help_auth_settings_access_login_content = '
5490	4251	<p>' . __( "<strong>Who can log in to the site?</strong>: Choose the level of access restriction you'd like to use on your site here. You can leave the site open to anyone with a WordPress account or an account on an external service like Google, CAS, or LDAP, or restrict it to WordPress users and only the external users that you specify via the <em>Access Lists</em>.", 'authorizer' ) . '</p>
5491	4252	<p>' . __( "<strong>Which role should receive email notifications about pending users?</strong>: If you've restricted access to <strong>approved users</strong>, you can determine which WordPress users will receive a notification email everytime a new external user successfully logs in and is added to the pending list. All users of the specified role will receive an email, and the external user will get a message (specified below) telling them their access is pending approval.", 'authorizer' ) . '</p>
5492	4253	<p>' . __( '<strong>What message should pending users see after attempting to log in?</strong>: Here you can specify the exact message a new external user will see once they try to log in to the site for the first time.', 'authorizer' ) . '</p>
		@@ -5492,84 +4253,84 @@
5492	4253	<p>' . __( '<strong>What message should pending users see after attempting to log in?</strong>: Here you can specify the exact message a new external user will see once they try to log in to the site for the first time.', 'authorizer' ) . '</p>
5493	4254	';
5494	4255	$screen->add_help_tab(
5495	4256	array(
5496		- 'id' => 'help_auth_settings_access_login_content',
5497		- 'title' => __( 'Login Access', 'authorizer' ),
	4257	+ 'id' => 'help_auth_settings_access_login_content',
	4258	+ 'title' => __( 'Login Access', 'authorizer' ),
5498	4259	'content' => $help_auth_settings_access_login_content,
5499	4260	)
5500	4261	);
5501	4262
5502		- // Add help tab for Public Access Settings.
	4263	+ // Add help tab for Public Access Settings
5503	4264	$help_auth_settings_access_public_content = '
5504	4265	<p>' . __( "<strong>Who can view the site?</strong>: You can restrict the site's visibility by only allowing logged in users to see pages. If you do so, you can customize the specifics about the site's privacy using the settings below.", 'authorizer' ) . '</p>
5505	4266	<p>' . __( "<strong>What pages (if any) should be available to everyone?</strong>: If you'd like to declare certain pages on your site as always public (such as the course syllabus, introduction, or calendar), specify those pages here. These pages will always be available no matter what access restrictions exist.", 'authorizer' ) . '</p>
5506		- <p>' . __( '<strong>What happens to people without access when they visit a <em>private</em> page?</strong>: Choose the response anonymous users receive when visiting the site. You can choose between immediately taking them to the <strong>login screen</strong>, or simply showing them a <strong>message</strong>.', 'authorizer' ) . '</p>
5507		- <p>' . __( '<strong>What happens to people without access when they visit a <em>public</em> page?</strong>: Choose the response anonymous users receive when visiting a page on the site marked as public. You can choose between showing them the page without any message, or showing them a the page with a message above the content.', 'authorizer' ) . '</p>
5508		- <p>' . __( '<strong>What message should people without access see?</strong>: If you chose to show new users a <strong>message</strong> above, type that message here.', 'authorizer' ) . '</p>
	4267	+ <p>' . __( "<strong>What happens to people without access when they visit a <em>private</em> page?</strong>: Choose the response anonymous users receive when visiting the site. You can choose between immediately taking them to the <strong>login screen</strong>, or simply showing them a <strong>message</strong>.", 'authorizer' ) . '</p>
	4268	+ <p>' . __( "<strong>What happens to people without access when they visit a <em>public</em> page?</strong>: Choose the response anonymous users receive when visiting a page on the site marked as public. You can choose between showing them the page without any message, or showing them a the page with a message above the content.", 'authorizer' ) . '</p>
	4269	+ <p>' . __( "<strong>What message should people without access see?</strong>: If you chose to show new users a <strong>message</strong> above, type that message here.", 'authorizer' ) . '</p>
5509	4270	';
5510	4271	$screen->add_help_tab(
5511	4272	array(
5512		- 'id' => 'help_auth_settings_access_public_content',
5513		- 'title' => __( 'Public Access', 'authorizer' ),
	4273	+ 'id' => 'help_auth_settings_access_public_content',
	4274	+ 'title' => __( 'Public Access', 'authorizer' ),
5514	4275	'content' => $help_auth_settings_access_public_content,
5515	4276	)
5516	4277	);
5517	4278
5518		- // Add help tab for External Service (CAS, LDAP) Settings.
	4279	+ // Add help tab for External Service (CAS, LDAP) Settings
5519	4280	$help_auth_settings_external_content = '
5520	4281	<p>' . __( "<strong>Type of external service to authenticate against</strong>: Choose which authentication service type you will be using. You'll have to fill out different fields below depending on which service you choose.", 'authorizer' ) . '</p>
5521		- <p>' . __( '<strong>Enable Google Logins</strong>: Choose if you want to allow users to log in with their Google Account credentials. You will need to enter your API Client ID and Secret to enable Google Logins.', 'authorizer' ) . '</p>
5522		- <p>' . __( '<strong>Enable CAS Logins</strong>: Choose if you want to allow users to log in with via CAS (Central Authentication Service). You will need to enter details about your CAS server (host, port, and path) to enable CAS Logins.', 'authorizer' ) . '</p>
5523		- <p>' . __( '<strong>Enable LDAP Logins</strong>: Choose if you want to allow users to log in with their LDAP (Lightweight Directory Access Protocol) credentials. You will need to enter details about your LDAP server (host, port, search base, uid attribute, directory user, directory user password, and whether to use TLS) to enable Google Logins.', 'authorizer' ) . '</p>
5524		- <p>' . __( '<strong>Default role for new CAS users</strong>: Specify which role new external users will get by default. Be sure to choose a role with limited permissions!', 'authorizer' ) . '</p>
5525		- <p><strong><em>' . __( 'If you enable Google logins:', 'authorizer' ) . '</em></strong></p>
	4282	+ <p>' . __( "<strong>Enable Google Logins</strong>: Choose if you want to allow users to log in with their Google Account credentials. You will need to enter your API Client ID and Secret to enable Google Logins.", 'authorizer' ) . '</p>
	4283	+ <p>' . __( "<strong>Enable CAS Logins</strong>: Choose if you want to allow users to log in with via CAS (Central Authentication Service). You will need to enter details about your CAS server (host, port, and path) to enable CAS Logins.", 'authorizer' ) . '</p>
	4284	+ <p>' . __( "<strong>Enable LDAP Logins</strong>: Choose if you want to allow users to log in with their LDAP (Lightweight Directory Access Protocol) credentials. You will need to enter details about your LDAP server (host, port, search base, uid attribute, directory user, directory user password, and whether to use TLS) to enable Google Logins.", 'authorizer' ) . '</p>
	4285	+ <p>' . __( "<strong>Default role for new CAS users</strong>: Specify which role new external users will get by default. Be sure to choose a role with limited permissions!", 'authorizer' ) . '</p>
	4286	+ <p><strong><em>' . __( "If you enable Google logins:", 'authorizer' ) . '</em></strong></p>
5526	4287	<ul>
5527	4288	<li>' . __( "<strong>Google Client ID</strong>: You can generate this ID by creating a new Project in the <a href='https://cloud.google.com/console'>Google Developers Console</a>. A Client ID typically looks something like this: 1234567890123-kdjr85yt6vjr6d8g7dhr8g7d6durjf7g.apps.googleusercontent.com", 'authorizer' ) . '</li>
5528	4289	<li>' . __( "<strong>Google Client Secret</strong>: You can generate this secret by creating a new Project in the <a href='https://cloud.google.com/console'>Google Developers Console</a>. A Client Secret typically looks something like this: sDNgX5_pr_5bly-frKmvp8jT", 'authorizer' ) . '</li>
5529	4290	</ul>
5530		- <p><strong><em>' . __( 'If you enable CAS logins:', 'authorizer' ) . '</em></strong></p>
	4291	+ <p><strong><em>' . __( "If you enable CAS logins:", 'authorizer' ) . '</em></strong></p>
5531	4292	<ul>
5532		- <li>' . __( '<strong>CAS server hostname</strong>: Enter the hostname of the CAS server you authenticate against (e.g., authn.example.edu).', 'authorizer' ) . '</li>
5533		- <li>' . __( '<strong>CAS server port</strong>: Enter the port on the CAS server to connect to (e.g., 443).', 'authorizer' ) . '</li>
5534		- <li>' . __( '<strong>CAS server path/context</strong>: Enter the path to the login endpoint on the CAS server (e.g., /cas).', 'authorizer' ) . '</li>
	4293	+ <li>' . __( "<strong>CAS server hostname</strong>: Enter the hostname of the CAS server you authenticate against (e.g., authn.example.edu).", 'authorizer' ) . '</li>
	4294	+ <li>' . __( "<strong>CAS server port</strong>: Enter the port on the CAS server to connect to (e.g., 443).", 'authorizer' ) . '</li>
	4295	+ <li>' . __( "<strong>CAS server path/context</strong>: Enter the path to the login endpoint on the CAS server (e.g., /cas).", 'authorizer' ) . '</li>
5535	4296	<li>' . __( "<strong>CAS attribute containing first name</strong>: Enter the CAS attribute that has the user's first name. When this user first logs in, their WordPress account will have their first name retrieved from CAS and added to their WordPress profile.", 'authorizer' ) . '</li>
5536	4297	<li>' . __( "<strong>CAS attribute containing last name</strong>: Enter the CAS attribute that has the user's last name. When this user first logs in, their WordPress account will have their last name retrieved from CAS and added to their WordPress profile.", 'authorizer' ) . '</li>
5537		- <li>' . __( '<strong>CAS attribute update</strong>: Select whether the first and last names retrieved from CAS should overwrite any value the user has entered in the first and last name fields in their WordPress profile. If this is not set, this only happens the first time they log in.', 'authorizer' ) . '</li>
	4298	+ <li>' . __( "<strong>CAS attribute update</strong>: Select whether the first and last names retrieved from CAS should overwrite any value the user has entered in the first and last name fields in their WordPress profile. If this is not set, this only happens the first time they log in.", 'authorizer' ) . '</li>
5538	4299	</ul>
5539		- <p><strong><em>' . __( 'If you enable LDAP logins:', 'authorizer' ) . '</em></strong></p>
	4300	+ <p><strong><em>' . __( "If you enable LDAP logins:", 'authorizer' ) . '</em></strong></p>
5540	4301	<ul>
5541		- <li>' . __( '<strong>LDAP Host</strong>: Enter the URL of the LDAP server you authenticate against.', 'authorizer' ) . '</li>
5542		- <li>' . __( '<strong>LDAP Port</strong>: Enter the port number that the LDAP server listens on.', 'authorizer' ) . '</li>
5543		- <li>' . __( '<strong>LDAP Search Base</strong>: Enter the LDAP string that represents the search base, e.g., ou=people,dc=example,dc=edu', 'authorizer' ) . '</li>
5544		- <li>' . __( '<strong>LDAP attribute containing username</strong>: Enter the name of the LDAP attribute that contains the usernames used by those attempting to log in. The plugin will search on this attribute to find the cn to bind against for login attempts.', 'authorizer' ) . '</li>
5545		- <li>' . __( '<strong>LDAP Directory User</strong>: Enter the name of the LDAP user that has permissions to browse the directory.', 'authorizer' ) . '</li>
5546		- <li>' . __( '<strong>LDAP Directory User Password</strong>: Enter the password for the LDAP user that has permission to browse the directory.', 'authorizer' ) . '</li>
5547		- <li>' . __( '<strong>Use TLS</strong>: Select whether all communication with the LDAP server should be performed over a TLS-secured connection.', 'authorizer' ) . '</li>
	4302	+ <li>' . __( "<strong>LDAP Host</strong>: Enter the URL of the LDAP server you authenticate against.", 'authorizer' ) . '</li>
	4303	+ <li>' . __( "<strong>LDAP Port</strong>: Enter the port number that the LDAP server listens on.", 'authorizer' ) . '</li>
	4304	+ <li>' . __( "<strong>LDAP Search Base</strong>: Enter the LDAP string that represents the search base, e.g., ou=people,dc=example,dc=edu", 'authorizer' ) . '</li>
	4305	+ <li>' . __( "<strong>LDAP attribute containing username</strong>: Enter the name of the LDAP attribute that contains the usernames used by those attempting to log in. The plugin will search on this attribute to find the cn to bind against for login attempts.", 'authorizer' ) . '</li>
	4306	+ <li>' . __( "<strong>LDAP Directory User</strong>: Enter the name of the LDAP user that has permissions to browse the directory.", 'authorizer' ) . '</li>
	4307	+ <li>' . __( "<strong>LDAP Directory User Password</strong>: Enter the password for the LDAP user that has permission to browse the directory.", 'authorizer' ) . '</li>
	4308	+ <li>' . __( "<strong>Secure Connection (TLS)</strong>: Select whether all communication with the LDAP server should be performed over a TLS-secured connection.", 'authorizer' ) . '</li>
5548	4309	<li>' . __( "<strong>Custom lost password URL</strong>: The WordPress login page contains a link to recover a lost password. If you have external users who shouldn't change the password on their WordPress account, point them to the appropriate location to change the password on their external authentication service here.", 'authorizer' ) . '</li>
5549	4310	<li>' . __( "<strong>LDAP attribute containing first name</strong>: Enter the LDAP attribute that has the user's first name. When this user first logs in, their WordPress account will have their first name retrieved from LDAP and added to their WordPress profile.", 'authorizer' ) . '</li>
5550	4311	<li>' . __( "<strong>LDAP attribute containing last name</strong>: Enter the LDAP attribute that has the user's last name. When this user first logs in, their WordPress account will have their last name retrieved from LDAP and added to their WordPress profile.", 'authorizer' ) . '</li>
5551		- <li>' . __( '<strong>LDAP attribute update</strong>: Select whether the first and last names retrieved from LDAP should overwrite any value the user has entered in the first and last name fields in their WordPress profile. If this is not set, this only happens the first time they log in.', 'authorizer' ) . '</li>
	4312	+ <li>' . __( "<strong>LDAP attribute update</strong>: Select whether the first and last names retrieved from LDAP should overwrite any value the user has entered in the first and last name fields in their WordPress profile. If this is not set, this only happens the first time they log in.", 'authorizer' ) . '</li>
5552	4313	</ul>
5553	4314	';
5554	4315	$screen->add_help_tab(
5555	4316	array(
5556		- 'id' => 'help_auth_settings_external_content',
5557		- 'title' => __( 'External Service', 'authorizer' ),
	4317	+ 'id' => 'help_auth_settings_external_content',
	4318	+ 'title' => __( 'External Service', 'authorizer' ),
5558	4319	'content' => $help_auth_settings_external_content,
5559	4320	)
5560	4321	);
5561	4322
5562		- // Add help tab for Advanced Settings.
	4323	+ // Add help tab for Advanced Settings
5563	4324	$help_auth_settings_advanced_content = '
5564		- <p>' . __( '<strong>Limit invalid login attempts</strong>: Choose how soon (and for how long) to restrict access to individuals (or bots) making repeated invalid login attempts. You may set a shorter delay first, and then a longer delay after repeated invalid attempts; you may also set how much time must pass before the delays will be reset to normal.', 'authorizer' ) . '</p>
5565		- <p>' . __( '<strong>Hide WordPress Logins</strong>: If you want to hide the WordPress username and password fields and the Log In button on the wp-login screen, enable this option. Note: You can always access the WordPress logins by adding external=wordpress to the wp-login URL, like so:', 'authorizer' ) . ' <a href="' . wp_login_url() . '?external=wordpress" target="_blank">' . wp_login_url() . '?external=wordpress</a>.</p>
	4325	+ <p>' . __( "<strong>Limit invalid login attempts</strong>: Choose how soon (and for how long) to restrict access to individuals (or bots) making repeated invalid login attempts. You may set a shorter delay first, and then a longer delay after repeated invalid attempts; you may also set how much time must pass before the delays will be reset to normal.", 'authorizer' ) . '</p>
	4326	+ <p>' . __( "<strong>Hide WordPress Logins</strong>: If you want to hide the WordPress username and password fields and the Log In button on the wp-login screen, enable this option. Note: You can always access the WordPress logins by adding external=wordpress to the wp-login URL, like so:", 'authorizer' ) . ' <a href="' . wp_login_url() . '?external=wordpress" target="_blank">' . wp_login_url() . '?external=wordpress</a>.</p>
5566	4327	<p>' . __( "<strong>Custom WordPress login branding</strong>: If you'd like to use custom branding on the WordPress login page, select that here. You will need to use the `authorizer_add_branding_option` filter in your theme to add it. You can see an example theme that implements this filter in the plugin directory under sample-theme-add-branding.", 'authorizer' ) . '</p>
5567	4328	';
5568	4329	$screen->add_help_tab(
5569	4330	array(
5570		- 'id' => 'help_auth_settings_advanced_content',
5571		- 'title' => __( 'Advanced', 'authorizer' ),
	4331	+ 'id' => 'help_auth_settings_advanced_content',
	4332	+ 'title' => __( 'Advanced', 'authorizer' ),
5572	4333	'content' => $help_auth_settings_advanced_content,
5573	4334	)
5574	4335	);
5575	4336	}
		@@ -5584,66 +4345,65 @@
5584	4345
5585	4346
5586	4347	/**
5587	4348	* Network Admin menu item
	4349	+ * Hook: network_admin_menu
5588	4350	*
5589		- * Action: network_admin_menu
5590		- *
	4351	+ * @param none
5591	4352	* @return void
5592	4353	*/
5593	4354	public function network_admin_menu() {
5594	4355	// @see http://codex.wordpress.org/Function_Reference/add_menu_page
5595	4356	add_menu_page(
5596		- 'Authorizer',
5597		- 'Authorizer',
5598		- 'manage_network_options',
5599		- 'authorizer',
	4357	+ 'Authorizer', // Page title
	4358	+ 'Authorizer', // Menu title
	4359	+ 'manage_network_options', // Capability
	4360	+ 'authorizer', // Menu slug
5600	4361	array( $this, 'create_network_admin_page' ),
5601		- 'dashicons-groups',
5602		- 89 // Position.
	4362	+ 'dashicons-groups', // Icon URL
	4363	+ 89 // Position
5603	4364	);
5604	4365	}
5605	4366
5606	4367
5607	4368	/**
5608		- * Output the HTML for the options page.
	4369	+ * Output the HTML for the options page
5609	4370	*/
5610	4371	public function create_network_admin_page() {
5611	4372	if ( ! current_user_can( 'manage_network_options' ) ) {
5612		- wp_die( wp_kses( __( 'You do not have sufficient permissions to access this page.', 'authorizer' ), $this->allowed_html ) );
	4373	+ wp_die( __( 'You do not have sufficient permissions to access this page.', 'authorizer' ) );
5613	4374	}
5614		- $auth_settings = get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings', array() );
5615		- ?>
	4375	+ $auth_settings = get_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings', array() ); ?>
5616	4376	<div class="wrap">
5617	4377	<form method="post" action="" autocomplete="off">
5618		- <h2><?php esc_html_e( 'Authorizer Settings', 'authorizer' ); ?></h2>
5619		- <p><?php echo wp_kses( __( 'Most <strong>Authorizer</strong> settings are set in the individual sites, but you can specify a few options here that apply to <strong>all sites in the network</strong>. These settings will override settings in the individual sites.', 'authorizer' ), $this->allowed_html ); ?></p>
	4378	+ <h2><?php _e( 'Authorizer Settings', 'authorizer' ); ?></h2>
	4379	+ <p><?php _e( 'Most <strong>Authorizer</strong> settings are set in the individual sites, but you can specify a few options here that apply to <strong>all sites in the network</strong>. These settings will override settings in the individual sites.', 'authorizer' ); ?></p>
5620	4380
5621		- <input type="checkbox" id="auth_settings_multisite_override" name="auth_settings[multisite_override]" value="1"<?php checked( 1 === intval( $auth_settings['multisite_override'] ) ); ?> /><label for="auth_settings_multisite_override"><?php esc_html_e( 'Override individual site settings with the settings below', 'authorizer' ); ?></label>
	4381	+ <input type="checkbox" id="auth_settings_multisite_override" name="auth_settings[multisite_override]" value="1"<?php checked( 1 == $auth_settings['multisite_override'] ); ?> /><label for="auth_settings_multisite_override"><?php _e( 'Override individual site settings with the settings below', 'authorizer' ); ?></label>
5622	4382
5623	4383	<div id="auth_multisite_settings_disabled_overlay" style="display: none;"></div>
5624	4384
5625	4385	<div class="wrap" id="auth_multisite_settings">
5626		- <?php $this->print_section_info_tabs( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?>
	4386	+ <?php $this->print_section_info_tabs( array( MULTISITE_ADMIN => true ) ); ?>
5627	4387
5628	4388	<?php wp_nonce_field( 'save_auth_settings', 'nonce_save_auth_settings' ); ?>
5629	4389
5630		- <?php // Custom access lists (for network, we only really want approved list, not pending or blocked). ?>
	4390	+ <?php // Custom access lists (for network, we only really want approved list, not pending or blocked) ?>
5631	4391	<div id="section_info_access_lists" class="section_info">
5632		- <p><?php esc_html_e( 'Manage who has access to all sites in the network.', 'authorizer' ); ?></p>
	4392	+ <p><?php _e( 'Manage who has access to all sites in the network.', 'authorizer' ); ?></p>
5633	4393	</div>
5634	4394	<table class="form-table"><tbody>
5635	4395	<tr>
5636		- <th scope="row"><?php esc_html_e( 'Who can log in to sites in this network?', 'authorizer' ); ?></th>
5637		- <td><?php $this->print_radio_auth_access_who_can_login( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4396	+ <th scope="row"><?php _e( 'Who can log in to sites in this network?', 'authorizer' ); ?></th>
	4397	+ <td><?php $this->print_radio_auth_access_who_can_login( array( MULTISITE_ADMIN => true ) ); ?></td>
5638	4398	</tr>
5639	4399	<tr>
5640		- <th scope="row"><?php esc_html_e( 'Who can view sites in this network?', 'authorizer' ); ?></th>
5641		- <td><?php $this->print_radio_auth_access_who_can_view( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4400	+ <th scope="row"><?php _e( 'Who can view sites in this network?', 'authorizer' ); ?></th>
	4401	+ <td><?php $this->print_radio_auth_access_who_can_view( array( MULTISITE_ADMIN => true ) ); ?></td>
5642	4402	</tr>
5643	4403	<tr>
5644		- <th scope="row"><?php esc_html_e( 'Approved Users (All Sites)', 'authorizer' ); ?><br /><small><em><?php echo wp_kses( __( 'Note: these users will <strong>not</strong> receive welcome emails when approved. Only users approved from individual sites can receive these messages.', 'authorizer' ), $this->allowed_html ); ?></em></small></th>
5645		- <td><?php $this->print_combo_auth_access_users_approved( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4404	+ <th scope="row"><?php _e( 'Approved Users (All Sites)', 'authorizer' ); ?><br /><small><em><?php _e( 'Note: these users will <strong>not</strong> receive welcome emails when approved. Only users approved from individual sites can receive these messages.', 'authorizer' ); ?></em></small></th>
	4405	+ <td><?php $this->print_combo_auth_access_users_approved( array( MULTISITE_ADMIN => true ) ); ?></td>
5646	4406	</tr>
5647	4407	</tbody></table>
5648	4408
5649	4409	<?php $this->print_section_info_external(); ?>
		@@ -5648,122 +4408,122 @@
5648	4408
5649	4409	<?php $this->print_section_info_external(); ?>
5650	4410	<table class="form-table"><tbody>
5651	4411	<tr>
5652		- <th scope="row"><?php esc_html_e( 'Default role for new users', 'authorizer' ); ?></th>
5653		- <td><?php $this->print_select_auth_access_default_role( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4412	+ <th scope="row"><?php _e( 'Default role for new users', 'authorizer' ); ?></th>
	4413	+ <td><?php $this->print_select_auth_access_default_role( array( MULTISITE_ADMIN => true ) ); ?></td>
5654	4414	</tr>
5655	4415	<tr>
5656		- <th scope="row"><?php esc_html_e( 'Google Logins', 'authorizer' ); ?></th>
5657		- <td><?php $this->print_checkbox_auth_external_google( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4416	+ <th scope="row"><?php _e( 'Google Logins', 'authorizer' ); ?></th>
	4417	+ <td><?php $this->print_checkbox_auth_external_google( array( MULTISITE_ADMIN => true ) ); ?></td>
5658	4418	</tr>
5659	4419	<tr>
5660		- <th scope="row"><?php esc_html_e( 'Google Client ID', 'authorizer' ); ?></th>
5661		- <td><?php $this->print_text_google_clientid( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4420	+ <th scope="row"><?php _e( 'Google Client ID', 'authorizer' ); ?></th>
	4421	+ <td><?php $this->print_text_google_clientid( array( MULTISITE_ADMIN => true ) ); ?></td>
5662	4422	</tr>
5663	4423	<tr>
5664		- <th scope="row"><?php esc_html_e( 'Google Client Secret', 'authorizer' ); ?></th>
5665		- <td><?php $this->print_text_google_clientsecret( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4424	+ <th scope="row"><?php _e( 'Google Client Secret', 'authorizer' ); ?></th>
	4425	+ <td><?php $this->print_text_google_clientsecret( array( MULTISITE_ADMIN => true ) ); ?></td>
5666	4426	</tr>
5667	4427	<tr>
5668		- <th scope="row"><?php esc_html_e( 'Google Hosted Domain', 'authorizer' ); ?></th>
5669		- <td><?php $this->print_text_google_hosteddomain( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4428	+ <th scope="row"><?php _e( 'Google Hosted Domain', 'authorizer' ); ?></th>
	4429	+ <td><?php $this->print_text_google_hosteddomain( array( MULTISITE_ADMIN => true ) ); ?></td>
5670	4430	</tr>
5671	4431	<tr>
5672		- <th scope="row"><?php esc_html_e( 'CAS Logins', 'authorizer' ); ?></th>
5673		- <td><?php $this->print_checkbox_auth_external_cas( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4432	+ <th scope="row"><?php _e( 'CAS Logins', 'authorizer' ); ?></th>
	4433	+ <td><?php $this->print_checkbox_auth_external_cas( array( MULTISITE_ADMIN => true ) ); ?></td>
5674	4434	</tr>
5675	4435	<tr>
5676		- <th scope="row"><?php esc_html_e( 'CAS Custom Label', 'authorizer' ); ?></th>
5677		- <td><?php $this->print_text_cas_custom_label( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4436	+ <th scope="row"><?php _e( 'CAS Custom Label', 'authorizer' ); ?></th>
	4437	+ <td><?php $this->print_text_cas_custom_label( array( MULTISITE_ADMIN => true ) ); ?></td>
5678	4438	</tr>
5679	4439	<tr>
5680		- <th scope="row"><?php esc_html_e( 'CAS server hostname', 'authorizer' ); ?></th>
5681		- <td><?php $this->print_text_cas_host( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4440	+ <th scope="row"><?php _e( 'CAS server hostname', 'authorizer' ); ?></th>
	4441	+ <td><?php $this->print_text_cas_host( array( MULTISITE_ADMIN => true ) ); ?></td>
5682	4442	</tr>
5683	4443	<tr>
5684		- <th scope="row"><?php esc_html_e( 'CAS server port', 'authorizer' ); ?></th>
5685		- <td><?php $this->print_text_cas_port( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4444	+ <th scope="row"><?php _e( 'CAS server port', 'authorizer' ); ?></th>
	4445	+ <td><?php $this->print_text_cas_port( array( MULTISITE_ADMIN => true ) ); ?></td>
5686	4446	</tr>
5687	4447	<tr>
5688		- <th scope="row"><?php esc_html_e( 'CAS server path/context', 'authorizer' ); ?></th>
5689		- <td><?php $this->print_text_cas_path( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4448	+ <th scope="row"><?php _e( 'CAS server path/context', 'authorizer' ); ?></th>
	4449	+ <td><?php $this->print_text_cas_path( array( MULTISITE_ADMIN => true ) ); ?></td>
5690	4450	</tr>
5691	4451	<tr>
5692		- <th scope="row"><?php esc_html_e( 'CAS server version', 'authorizer' ); ?></th>
5693		- <td><?php $this->print_select_cas_version( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4452	+ <th scope="row"><?php _e( 'CAS server version', 'authorizer' ); ?></th>
	4453	+ <td><?php $this->print_select_cas_version( array( MULTISITE_ADMIN => true ) ); ?></td>
5694	4454	</tr>
5695	4455	<tr>
5696		- <th scope="row"><?php esc_html_e( 'CAS attribute containing email', 'authorizer' ); ?></th>
5697		- <td><?php $this->print_text_cas_attr_email( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4456	+ <th scope="row"><?php _e( 'CAS attribute containing email', 'authorizer' ); ?></th>
	4457	+ <td><?php $this->print_text_cas_attr_email( array( MULTISITE_ADMIN => true ) ); ?></td>
5698	4458	</tr>
5699	4459	<tr>
5700		- <th scope="row"><?php esc_html_e( 'CAS attribute containing first name', 'authorizer' ); ?></th>
5701		- <td><?php $this->print_text_cas_attr_first_name( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4460	+ <th scope="row"><?php _e( 'CAS attribute containing first name', 'authorizer' ); ?></th>
	4461	+ <td><?php $this->print_text_cas_attr_first_name( array( MULTISITE_ADMIN => true ) ); ?></td>
5702	4462	</tr>
5703	4463	<tr>
5704		- <th scope="row"><?php esc_html_e( 'CAS attribute containing last name', 'authorizer' ); ?></th>
5705		- <td><?php $this->print_text_cas_attr_last_name( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4464	+ <th scope="row"><?php _e( 'CAS attribute containing last name', 'authorizer' ); ?></th>
	4465	+ <td><?php $this->print_text_cas_attr_last_name( array( MULTISITE_ADMIN => true ) ); ?></td>
5706	4466	</tr>
5707	4467	<tr>
5708		- <th scope="row"><?php esc_html_e( 'CAS attribute update', 'authorizer' ); ?></th>
5709		- <td><?php $this->print_checkbox_cas_attr_update_on_login( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4468	+ <th scope="row"><?php _e( 'CAS attribute update', 'authorizer' ); ?></th>
	4469	+ <td><?php $this->print_checkbox_cas_attr_update_on_login( array( MULTISITE_ADMIN => true ) ); ?></td>
5710	4470	</tr>
5711	4471	<tr>
5712		- <th scope="row"><?php esc_html_e( 'CAS automatic login', 'authorizer' ); ?></th>
5713		- <td><?php $this->print_checkbox_cas_auto_login( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4472	+ <th scope="row"><?php _e( 'CAS automatic login', 'authorizer' ); ?></th>
	4473	+ <td><?php $this->print_checkbox_cas_auto_login( array( MULTISITE_ADMIN => true ) ); ?></td>
5714	4474	</tr>
5715	4475	<tr>
5716		- <th scope="row"><?php esc_html_e( 'LDAP Logins', 'authorizer' ); ?></th>
5717		- <td><?php $this->print_checkbox_auth_external_ldap( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4476	+ <th scope="row"><?php _e( 'LDAP Logins', 'authorizer' ); ?></th>
	4477	+ <td><?php $this->print_checkbox_auth_external_ldap( array( MULTISITE_ADMIN => true ) ); ?></td>
5718	4478	</tr>
5719	4479	<tr>
5720		- <th scope="row"><?php esc_html_e( 'LDAP Host', 'authorizer' ); ?></th>
5721		- <td><?php $this->print_text_ldap_host( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4480	+ <th scope="row"><?php _e( 'LDAP Host', 'authorizer' ); ?></th>
	4481	+ <td><?php $this->print_text_ldap_host( array( MULTISITE_ADMIN => true ) ); ?></td>
5722	4482	</tr>
5723	4483	<tr>
5724		- <th scope="row"><?php esc_html_e( 'LDAP Port', 'authorizer' ); ?></th>
5725		- <td><?php $this->print_text_ldap_port( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4484	+ <th scope="row"><?php _e( 'LDAP Port', 'authorizer' ); ?></th>
	4485	+ <td><?php $this->print_text_ldap_port( array( MULTISITE_ADMIN => true ) ); ?></td>
5726	4486	</tr>
5727	4487	<tr>
5728		- <th scope="row"><?php esc_html_e( 'Use TLS', 'authorizer' ); ?></th>
5729		- <td><?php $this->print_checkbox_ldap_tls( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4488	+ <th scope="row"><?php _e( 'Secure Connection (TLS)', 'authorizer' ); ?></th>
	4489	+ <td><?php $this->print_checkbox_ldap_tls( array( MULTISITE_ADMIN => true ) ); ?></td>
5730	4490	</tr>
5731	4491	<tr>
5732		- <th scope="row"><?php esc_html_e( 'LDAP Search Base', 'authorizer' ); ?></th>
5733		- <td><?php $this->print_text_ldap_search_base( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4492	+ <th scope="row"><?php _e( 'LDAP Search Base', 'authorizer' ); ?></th>
	4493	+ <td><?php $this->print_text_ldap_search_base( array( MULTISITE_ADMIN => true ) ); ?></td>
5734	4494	</tr>
5735	4495	<tr>
5736		- <th scope="row"><?php esc_html_e( 'LDAP attribute containing username', 'authorizer' ); ?></th>
5737		- <td><?php $this->print_text_ldap_uid( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4496	+ <th scope="row"><?php _e( 'LDAP attribute containing username', 'authorizer' ); ?></th>
	4497	+ <td><?php $this->print_text_ldap_uid( array( MULTISITE_ADMIN => true ) ); ?></td>
5738	4498	</tr>
5739	4499	<tr>
5740		- <th scope="row"><?php esc_html_e( 'LDAP attribute containing email', 'authorizer' ); ?></th>
5741		- <td><?php $this->print_text_ldap_attr_email( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4500	+ <th scope="row"><?php _e( 'LDAP attribute containing email', 'authorizer' ); ?></th>
	4501	+ <td><?php $this->print_text_ldap_attr_email( array( MULTISITE_ADMIN => true ) ); ?></td>
5742	4502	</tr>
5743	4503	<tr>
5744		- <th scope="row"><?php esc_html_e( 'LDAP Directory User', 'authorizer' ); ?></th>
5745		- <td><?php $this->print_text_ldap_user( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4504	+ <th scope="row"><?php _e( 'LDAP Directory User', 'authorizer' ); ?></th>
	4505	+ <td><?php $this->print_text_ldap_user( array( MULTISITE_ADMIN => true ) ); ?></td>
5746	4506	</tr>
5747	4507	<tr>
5748		- <th scope="row"><?php esc_html_e( 'LDAP Directory User Password', 'authorizer' ); ?></th>
5749		- <td><?php $this->print_password_ldap_password( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4508	+ <th scope="row"><?php _e( 'LDAP Directory User Password', 'authorizer' ); ?></th>
	4509	+ <td><?php $this->print_password_ldap_password( array( MULTISITE_ADMIN => true ) ); ?></td>
5750	4510	</tr>
5751	4511	<tr>
5752		- <th scope="row"><?php esc_html_e( 'Custom lost password URL', 'authorizer' ); ?></th>
5753		- <td><?php $this->print_text_ldap_lostpassword_url( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4512	+ <th scope="row"><?php _e( 'Custom lost password URL', 'authorizer' ); ?></th>
	4513	+ <td><?php $this->print_text_ldap_lostpassword_url( array( MULTISITE_ADMIN => true ) ); ?></td>
5754	4514	</tr>
5755	4515	<tr>
5756		- <th scope="row"><?php esc_html_e( 'LDAP attribute containing first name', 'authorizer' ); ?></th>
5757		- <td><?php $this->print_text_ldap_attr_first_name( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4516	+ <th scope="row"><?php _e( 'LDAP attribute containing first name', 'authorizer' ); ?></th>
	4517	+ <td><?php $this->print_text_ldap_attr_first_name( array( MULTISITE_ADMIN => true ) ); ?></td>
5758	4518	</tr>
5759	4519	<tr>
5760		- <th scope="row"><?php esc_html_e( 'LDAP attribute containing last name', 'authorizer' ); ?></th>
5761		- <td><?php $this->print_text_ldap_attr_last_name( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4520	+ <th scope="row"><?php _e( 'LDAP attribute containing last name', 'authorizer' ); ?></th>
	4521	+ <td><?php $this->print_text_ldap_attr_last_name( array( MULTISITE_ADMIN => true ) ); ?></td>
5762	4522	</tr>
5763	4523	<tr>
5764		- <th scope="row"><?php esc_html_e( 'LDAP attribute update', 'authorizer' ); ?></th>
5765		- <td><?php $this->print_checkbox_ldap_attr_update_on_login( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4524	+ <th scope="row"><?php _e( 'LDAP attribute update', 'authorizer' ); ?></th>
	4525	+ <td><?php $this->print_checkbox_ldap_attr_update_on_login( array( MULTISITE_ADMIN => true ) ); ?></td>
5766	4526	</tr>
5767	4527	</tbody></table>
5768	4528
5769	4529	<?php $this->print_section_info_advanced(); ?>
		@@ -5768,36 +4528,20 @@
5768	4528
5769	4529	<?php $this->print_section_info_advanced(); ?>
5770	4530	<table class="form-table"><tbody>
5771	4531	<tr>
5772		- <th scope="row"><?php esc_html_e( 'Limit invalid login attempts', 'authorizer' ); ?></th>
5773		- <td><?php $this->print_text_auth_advanced_lockouts( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4532	+ <th scope="row"><?php _e( 'Limit invalid login attempts', 'authorizer' ); ?></th>
	4533	+ <td><?php $this->print_text_auth_advanced_lockouts( array( MULTISITE_ADMIN => true ) ); ?></td>
5774	4534	</tr>
5775	4535	<tr>
5776		- <th scope="row"><?php esc_html_e( 'Hide WordPress Logins', 'authorizer' ); ?></th>
5777		- <td><?php $this->print_checkbox_auth_advanced_hide_wp_login( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4536	+ <th scope="row"><?php _e( 'Hide WordPress Logins', 'authorizer' ); ?></th>
	4537	+ <td><?php $this->print_checkbox_auth_advanced_hide_wp_login( array( MULTISITE_ADMIN => true ) ); ?></td>
5778	4538	</tr>
5779		- <tr>
5780		- <th scope="row"><?php esc_html_e( 'Number of users per page', 'authorizer' ); ?></th>
5781		- <td><?php $this->print_text_auth_advanced_users_per_page( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
5782		- </tr>
5783		- <tr>
5784		- <th scope="row"><?php esc_html_e( 'Approved users sort method', 'authorizer' ); ?></th>
5785		- <td><?php $this->print_select_auth_advanced_users_sort_by( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
5786		- </tr>
5787		- <tr>
5788		- <th scope="row"><?php esc_html_e( 'Approved users sort order', 'authorizer' ); ?></th>
5789		- <td><?php $this->print_select_auth_advanced_users_sort_order( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
5790		- </tr>
5791		- <tr>
5792		- <th scope="row"><?php esc_html_e( 'Show Dashboard Widget', 'authorizer' ); ?></th>
5793		- <td><?php $this->print_checkbox_auth_advanced_widget_enabled( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
5794		- </tr>
5795	4539	</tbody></table>
5796	4540
5797	4541	<br class="clear" />
5798	4542	</div>
5799		- <input type="button" name="submit" id="submit" class="button button-primary" value="<?php esc_attr_e( 'Save Changes', 'authorizer' ); ?>" onclick="saveAuthMultisiteSettings(this);" />
	4543	+ <input type="button" name="submit" id="submit" class="button button-primary" value="<?php _e( 'Save Changes', 'authorizer' ); ?>" onclick="save_auth_multisite_settings(this);" />
5800	4544	</form>
5801	4545	</div>
5802	4546	<?php
5803	4547	}
		@@ -5804,12 +4548,10 @@
5804	4548
5805	4549
5806	4550	/**
5807	4551	* Save multisite settings (ajax call).
5808		- *
5809		- * Action: wp_ajax_save_auth_multisite_settings
5810	4552	*/
5811		- public function ajax_save_auth_multisite_settings() {
	4553	+ function ajax_save_auth_multisite_settings() {
5812	4554	// Fail silently if current user doesn't have permissions.
5813	4555	if ( ! current_user_can( 'manage_network_options' ) ) {
5814	4556	die( '' );
5815	4557	}
		@@ -5814,14 +4556,14 @@
5814	4556	die( '' );
5815	4557	}
5816	4558
5817	4559	// Make sure nonce exists.
5818		- if ( empty( $_POST['nonce'] ) ) {
	4560	+ if ( empty( $_POST['nonce_save_auth_settings'] ) ) {
5819	4561	die( '' );
5820	4562	}
5821	4563
5822	4564	// Nonce check.
5823		- if ( ! wp_verify_nonce( sanitize_key( $_POST['nonce'] ), 'save_auth_settings' ) ) {
	4565	+ if ( ! wp_verify_nonce( $_POST['nonce_save_auth_settings'], 'save_auth_settings' ) ) {
5824	4566	die( '' );
5825	4567	}
5826	4568
5827	4569	// Assert multisite.
		@@ -5829,15 +4571,15 @@
5829	4571	die( '' );
5830	4572	}
5831	4573
5832	4574	// Get multisite settings.
5833		- $auth_multisite_settings = get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings', array() );
	4575	+ $auth_multisite_settings = get_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings', array() );
5834	4576
5835		- // Sanitize settings.
	4577	+ // Sanitize settings
5836	4578	$auth_multisite_settings = $this->sanitize_options( $_POST );
5837	4579
5838		- // Filter options to only the allowed values (multisite options are a subset of all options).
5839		- $allowed = array(
	4580	+ // Filter options to only the allowed values (multisite options are a subset of all options)
	4581	+ $allowed = array(
5840	4582	'multisite_override',
5841	4583	'access_who_can_login',
5842	4584	'access_who_can_view',
5843	4585	'access_default_role',
		@@ -5870,17 +4612,13 @@
5870	4612	'ldap_attr_last_name',
5871	4613	'ldap_attr_update_on_login',
5872	4614	'advanced_lockouts',
5873	4615	'advanced_hide_wp_login',
5874		- 'advanced_users_per_page',
5875		- 'advanced_users_sort_by',
5876		- 'advanced_users_sort_order',
5877		- 'advanced_widget_enabled',
5878	4616	);
5879	4617	$auth_multisite_settings = array_intersect_key( $auth_multisite_settings, array_flip( $allowed ) );
5880	4618
5881	4619	// Update multisite settings in database.
5882		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings', $auth_multisite_settings );
	4620	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings', $auth_multisite_settings );
5883	4621
5884	4622	// Return 'success' value to AJAX call.
5885	4623	die( 'success' );
5886	4624	}
		@@ -5894,67 +4632,42 @@
5894	4632	*/
5895	4633
5896	4634
5897	4635
5898		- /**
5899		- * Load Authorizer dashboard widget if it's enabled.
5900		- *
5901		- * Action: wp_dashboard_setup
5902		- */
5903		- public function add_dashboard_widgets() {
5904		- $widget_enabled = $this->get_plugin_option( 'advanced_widget_enabled', WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' ) === '1';
5905		-
5906		- // Load authorizer dashboard widget if it's enabled and user has permission.
5907		- if ( current_user_can( 'create_users' ) && $widget_enabled ) {
5908		- // Add dashboard widget for adding/editing users with access.
	4636	+ function add_dashboard_widgets() {
	4637	+ // Only users who can edit can see the authorizer dashboard widget
	4638	+ if ( current_user_can( 'create_users' ) ) {
	4639	+ // Add dashboard widget for adding/editing users with access
5909	4640	wp_add_dashboard_widget( 'auth_dashboard_widget', __( 'Authorizer Settings', 'authorizer' ), array( $this, 'add_auth_dashboard_widget' ) );
5910	4641	}
5911	4642	}
5912	4643
5913	4644
5914		- /**
5915		- * Render Authorizer dashboard widget (callback).
5916		- */
5917		- public function add_auth_dashboard_widget() {
5918		- ?>
5919		- <form method="post" id="auth_settings_access_form" action="">
	4645	+ function add_auth_dashboard_widget() {
	4646	+ ?><form method="post" id="auth_settings_access_form" action="">
5920	4647	<?php $this->print_section_info_access_login(); ?>
5921	4648	<div>
5922		- <h2><?php esc_html_e( 'Pending Users', 'authorizer' ); ?></h2>
	4649	+ <h2><?php _e( 'Pending Users', 'authorizer' ); ?></h2>
5923	4650	<?php $this->print_combo_auth_access_users_pending(); ?>
5924	4651	</div>
5925	4652	<div>
5926		- <h2><?php esc_html_e( 'Approved Users', 'authorizer' ); ?></h2>
	4653	+ <h2><?php _e( 'Approved Users', 'authorizer' ); ?></h2>
5927	4654	<?php $this->print_combo_auth_access_users_approved(); ?>
5928	4655	</div>
5929	4656	<div>
5930		- <h2><?php esc_html_e( 'Blocked Users', 'authorizer' ); ?></h2>
	4657	+ <h2><?php _e( 'Blocked Users', 'authorizer' ); ?></h2>
5931	4658	<?php $this->print_combo_auth_access_users_blocked(); ?>
5932	4659	</div>
5933	4660	<br class="clear" />
5934		- </form>
5935		- <?php
	4661	+ </form><?php
5936	4662	}
5937	4663
5938	4664
5939		-
5940		- /**
5941		- * ***************************
5942		- * AJAX Actions
5943		- * ***************************
5944		- */
5945		-
5946		-
5947		-
5948		- /**
5949		- * Re-render the Approved User list (usually triggered if pager params have
5950		- * changed, e.g., current page, search term, sort order).
5951		- *
5952		- * Action: wp_ajax_refresh_approved_user_list
5953		- *
5954		- * @return void
5955		- */
5956		- public function ajax_refresh_approved_user_list() {
	4665	+ // Fired on a change event from the optional usermeta field in the
	4666	+ // approved user list. Updates the selected usermeta value, or saves it
	4667	+ // in the user's approved list entry if the user hasn't logged in yet
	4668	+ // and created a WordPress account.
	4669	+ function ajax_update_auth_usermeta() {
5957	4670	// Fail silently if current user doesn't have permissions.
5958	4671	if ( ! current_user_can( 'create_users' ) ) {
5959	4672	die( '' );
5960	4673	}
		@@ -5959,175 +4672,35 @@
5959	4672	die( '' );
5960	4673	}
5961	4674
5962	4675	// Nonce check.
5963		- if ( empty( $_POST['nonce'] ) || ! wp_verify_nonce( sanitize_key( $_POST['nonce'] ), 'save_auth_settings' ) ) {
	4676	+ if ( empty( $_POST['nonce_save_auth_settings'] ) || ! wp_verify_nonce( $_POST['nonce_save_auth_settings'], 'save_auth_settings' ) ) {
5964	4677	die( '' );
5965	4678	}
5966	4679
5967	4680	// Fail if required post data doesn't exist.
5968		- if ( ! array_key_exists( 'paged', $_REQUEST ) ) {
	4681	+ if ( ! array_key_exists( 'email', $_REQUEST ) || ! array_key_exists( 'usermeta', $_REQUEST ) ) {
5969	4682	die( '' );
5970	4683	}
5971	4684
5972		- // Get defaults.
5973		- $success = true;
5974		- $message = '';
5975		- $is_network_admin = isset( $_REQUEST['is_network_admin'] ) && '1' === $_REQUEST['is_network_admin'];
5976		-
5977		- // Get user list.
5978		- $option = 'access_users_approved';
5979		- $admin_mode = is_multisite() && $is_network_admin ? WP_Plugin_Authorizer::NETWORK_CONTEXT : WP_Plugin_Authorizer::SINGLE_CONTEXT;
5980		- $auth_settings_option = $this->get_plugin_option( $option, $admin_mode, 'no override' );
5981		- $auth_settings_option = is_array( $auth_settings_option ) ? $auth_settings_option : array();
5982		-
5983		- // Get multisite approved users (will be added to top of list, greyed out).
5984		- $auth_override_multisite = $this->get_plugin_option( 'advanced_override_multisite' );
5985		- $auth_multisite_settings = $this->get_plugin_options( WP_Plugin_Authorizer::NETWORK_CONTEXT );
5986		- $auth_settings_option_multisite = array();
5987		- if (
5988		- is_multisite() &&
5989		- ! $is_network_admin &&
5990		- 1 !== intval( $auth_override_multisite ) &&
5991		- array_key_exists( 'multisite_override', $auth_multisite_settings ) &&
5992		- '1' === $auth_multisite_settings['multisite_override']
5993		- ) {
5994		- $auth_settings_option_multisite = $this->get_plugin_option( $option, WP_Plugin_Authorizer::NETWORK_CONTEXT, 'allow override' );
5995		- $auth_settings_option_multisite = is_array( $auth_settings_option_multisite ) ? $auth_settings_option_multisite : array();
5996		- // Add multisite users to the beginning of the main user array.
5997		- foreach ( array_reverse( $auth_settings_option_multisite ) as $approved_user ) {
5998		- $approved_user['multisite_user'] = true;
5999		- array_unshift( $auth_settings_option, $approved_user );
6000		- }
6001		- }
6002		-
6003		- // Get custom usermeta field to show.
6004		- $advanced_usermeta = $this->get_plugin_option( 'advanced_usermeta' );
6005		-
6006		- // Filter user list to search terms.
6007		- if ( ! empty( $_REQUEST['search'] ) ) {
6008		- $search_term = sanitize_text_field( wp_unslash( $_REQUEST['search'] ) );
6009		- $auth_settings_option = array_filter(
6010		- $auth_settings_option, function ( $user ) use ( $search_term ) {
6011		- return stripos( $user['email'], $search_term ) !== false ||
6012		- stripos( $user['role'], $search_term ) !== false ||
6013		- stripos( $user['date_added'], $search_term ) !== false;
6014		- }
6015		- );
6016		- }
6017		-
6018		- // Sort user list.
6019		- $sort_by = $this->get_plugin_option( 'advanced_users_sort_by', WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' ); // email, role, date_added (registered), created (date approved).
6020		- $sort_order = $this->get_plugin_option( 'advanced_users_sort_order', WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' ); // asc or desc.
6021		- $sort_dimension = array();
6022		- if ( in_array( $sort_by, array( 'email', 'role', 'date_added' ), true ) ) {
6023		- foreach ( $auth_settings_option as $key => $user ) {
6024		- if ( 'date_added' === $sort_by ) {
6025		- $sort_dimension[ $key ] = date( 'Ymd', strtotime( $user[ $sort_by ] ) );
6026		- } else {
6027		- $sort_dimension[ $key ] = strtolower( $user[ $sort_by ] );
6028		- }
6029		- }
6030		- $sort_order = 'asc' === $sort_order ? SORT_ASC : SORT_DESC;
6031		- array_multisort( $sort_dimension, $sort_order, $auth_settings_option );
6032		- } elseif ( 'created' === $sort_by && 'asc' !== $sort_order ) {
6033		- // If default sort method and reverse order, just reverse the array.
6034		- $auth_settings_option = array_reverse( $auth_settings_option );
6035		- }
6036		-
6037		- // Ensure array keys run from 0..max (keys in database will be the original,
6038		- // index, and removing users will not reorder the array keys of other users).
6039		- $auth_settings_option = array_values( $auth_settings_option );
6040		-
6041		- // Get pager params.
6042		- $total_users = count( $auth_settings_option );
6043		- $users_per_page = intval( $this->get_plugin_option( 'advanced_users_per_page', WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' ) );
6044		- $current_page = isset( $_REQUEST['paged'] ) ? intval( $_REQUEST['paged'] ) : 1;
6045		- $total_pages = ceil( $total_users / $users_per_page );
6046		- if ( $total_pages < 1 ) {
6047		- $total_pages = 1;
6048		- }
6049		-
6050		- // Make sure current_page is between 1 and max pages.
6051		- if ( $current_page < 1 ) {
6052		- $current_page = 1;
6053		- } elseif ( $current_page > $total_pages ) {
6054		- $current_page = $total_pages;
6055		- }
6056		-
6057		- // Render user list.
6058		- ob_start();
6059		- $offset = ( $current_page - 1 ) * $users_per_page;
6060		- $max = min( $offset + $users_per_page, count( $auth_settings_option ) );
6061		- for ( $key = $offset; $key < $max; $key++ ) :
6062		- $approved_user = $auth_settings_option[ $key ];
6063		- if ( empty( $approved_user ) || count( $approved_user ) < 1 ) :
6064		- continue;
6065		- endif;
6066		- $this->render_user_element( $approved_user, $key, $option, $admin_mode, $advanced_usermeta );
6067		- endfor;
6068		-
6069		- // Send response to client.
6070		- $response = array(
6071		- 'success' => $success,
6072		- 'message' => $message,
6073		- 'html' => ob_get_clean(),
6074		- /* TRANSLATORS: %s: number of users */
6075		- 'total_users_html' => sprintf( _n( '%s user', '%s users', $total_users, 'authorizer' ), number_format_i18n( $total_users ) ),
6076		- 'total_pages_html' => number_format_i18n( $total_pages ),
6077		- 'total_pages' => $total_pages,
6078		- );
6079		- header( 'content-type: application/json' );
6080		- echo wp_json_encode( $response );
6081		- exit;
6082		- }
6083		-
6084		-
6085		- /**
6086		- * Fired on a change event from the optional usermeta field in the approved
6087		- * user list. Updates the selected usermeta value, or saves it in the user's
6088		- * approved list entry if the user hasn't logged in yet and created a
6089		- * WordPress account.
6090		- *
6091		- * Action: wp_ajax_update_auth_usermeta
6092		- *
6093		- * @return void
6094		- */
6095		- public function ajax_update_auth_usermeta() {
6096		- // Fail silently if current user doesn't have permissions.
6097		- if ( ! current_user_can( 'create_users' ) ) {
6098		- die( '' );
6099		- }
6100		-
6101		- // Nonce check.
6102		- if ( empty( $_POST['nonce'] ) || ! wp_verify_nonce( sanitize_key( $_POST['nonce'] ), 'save_auth_settings' ) ) {
6103		- die( '' );
6104		- }
6105		-
6106		- // Fail if required post data doesn't exist.
6107		- if ( ! isset( $_REQUEST['email'], $_REQUEST['usermeta'] ) ) {
6108		- die( '' );
6109		- }
6110		-
6111	4685	// Get values to update from post data.
6112		- $email = sanitize_email( wp_unslash( $_REQUEST['email'] ) );
6113		- $meta_value = sanitize_meta( 'authorizer-usermeta', wp_unslash( $_REQUEST['usermeta'] ), 'user' );
6114		- $meta_key = $this->get_plugin_option( 'advanced_usermeta' );
	4686	+ $email = $_REQUEST['email'];
	4687	+ $meta_value = $_REQUEST['usermeta'];
	4688	+ $meta_key = $this->get_plugin_option( 'advanced_usermeta' );
6115	4689
6116	4690	// If user doesn't exist, save usermeta selection to authorizer
6117	4691	// list. This value will get saved to usermeta when the user first
6118	4692	// logs in (i.e., when their WordPress account is created).
6119		- $wp_user = get_user_by( 'email', $email );
6120		- if ( ! $wp_user ) {
	4693	+ if ( ! ( $wp_user = get_user_by( 'email', $email ) ) ) {
6121	4694	// Look through multisite approved users and add a usermeta
6122	4695	// reference for the current blog if the user is found.
6123		- $auth_multisite_settings_access_users_approved = is_multisite() ? get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', array() ) : array();
	4696	+ $auth_multisite_settings_access_users_approved = is_multisite() ? get_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', array() ) : array();
6124	4697	$should_update_auth_multisite_settings_access_users_approved = false;
6125	4698	foreach ( $auth_multisite_settings_access_users_approved as $index => $approved_user ) {
6126		- if ( 0 === strcasecmp( $email, $approved_user['email'] ) ) {
6127		- if ( ! is_array( $auth_multisite_settings_access_users_approved[ $index ]['usermeta'] ) ) {
	4699	+ if ( $email === $approved_user['email'] ) {
	4700	+ if ( ! is_array( $auth_multisite_settings_access_users_approved[$index]['usermeta'] ) ) {
6128	4701	// Initialize the array of usermeta for each blog this user belongs to.
6129		- $auth_multisite_settings_access_users_approved[ $index ]['usermeta'] = array();
	4702	+ $auth_multisite_settings_access_users_approved[$index]['usermeta'] = array();
6130	4703	} else {
6131	4704	// There is already usermeta associated with this
6132	4705	// preapproved user; iterate through it and make
6133	4706	// sure it's not for old meta_keys (delete it if
		@@ -6133,53 +4706,55 @@
6133	4706	// sure it's not for old meta_keys (delete it if
6134	4707	// so). This can happen if someone changes the
6135	4708	// usermeta key in authorizer options, and we don't
6136	4709	// want to hang on to old data.
6137		- foreach ( $auth_multisite_settings_access_users_approved[ $index ]['usermeta'] as $blog_id => $usermeta ) {
	4710	+ foreach ( $auth_multisite_settings_access_users_approved[$index]['usermeta'] as $blog_id => $usermeta ) {
6138	4711	if ( array_key_exists( 'meta_key', $usermeta ) && $usermeta['meta_key'] === $meta_key ) {
6139	4712	continue;
6140	4713	} else {
6141		- unset( $auth_multisite_settings_access_users_approved[ $index ]['usermeta'][ $blog_id ] );
	4714	+ unset( $auth_multisite_settings_access_users_approved[$index]['usermeta'][$blog_id] );
6142	4715	}
6143	4716	}
6144	4717	}
6145		- $auth_multisite_settings_access_users_approved[ $index ]['usermeta'][ get_current_blog_id() ] = array(
6146		- 'meta_key' => $meta_key,
	4718	+ $auth_multisite_settings_access_users_approved[$index]['usermeta'][get_current_blog_id()] = array(
	4719	+ 'meta_key' => $meta_key,
6147	4720	'meta_value' => $meta_value,
6148	4721	);
6149		- $should_update_auth_multisite_settings_access_users_approved = true;
	4722	+ $should_update_auth_multisite_settings_access_users_approved = true;
6150	4723	}
6151	4724	}
6152	4725	if ( $should_update_auth_multisite_settings_access_users_approved ) {
6153		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
	4726	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
6154	4727	}
6155	4728
6156	4729	// Look through the approved users (of the current blog in a
6157	4730	// multisite install, or just of the single site) and add a
6158	4731	// usermeta reference if the user is found.
6159		- $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT );
	4732	+ $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN );
6160	4733	$should_update_auth_settings_access_users_approved = false;
6161	4734	foreach ( $auth_settings_access_users_approved as $index => $approved_user ) {
6162		- if ( 0 === strcasecmp( $email, $approved_user['email'] ) ) {
6163		- $auth_settings_access_users_approved[ $index ]['usermeta'] = array(
6164		- 'meta_key' => $meta_key,
	4735	+ if ( $email === $approved_user['email'] ) {
	4736	+ $auth_settings_access_users_approved[$index]['usermeta'] = array(
	4737	+ 'meta_key' => $meta_key,
6165	4738	'meta_value' => $meta_value,
6166	4739	);
6167		- $should_update_auth_settings_access_users_approved = true;
	4740	+ $should_update_auth_settings_access_users_approved = true;
6168	4741	}
6169	4742	}
6170	4743	if ( $should_update_auth_settings_access_users_approved ) {
6171	4744	update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved );
6172	4745	}
	4746	+
6173	4747	} else {
6174	4748	// Update user's usermeta value for usermeta key stored in authorizer options.
6175	4749	if ( strpos( $meta_key, 'acf___' ) === 0 && class_exists( 'acf' ) ) {
6176	4750	// We have an ACF field value, so use the ACF function to update it.
6177		- update_field( str_replace( 'acf___', '', $meta_key ), $meta_value, 'user_' . $wp_user->ID );
	4751	+ update_field( str_replace('acf___', '', $meta_key ), $meta_value, 'user_' . $wp_user->ID );
6178	4752	} else {
6179	4753	// We have a normal usermeta value, so just update it via the WordPress function.
6180	4754	update_user_meta( $wp_user->ID, $meta_key, $meta_value );
6181	4755	}
	4756	+
6182	4757	}
6183	4758
6184	4759	// Return 'success' value to AJAX call.
6185	4760	die( 'success' );
		@@ -6185,17 +4760,9 @@
6185	4760	die( 'success' );
6186	4761	}
6187	4762
6188	4763
6189		- /**
6190		- * Fired on a change event from the user fields in the user lists. Updates
6191		- * the selected user value.
6192		- *
6193		- * Action: wp_ajax_update_auth_user
6194		- *
6195		- * @return void
6196		- */
6197		- public function ajax_update_auth_user() {
	4764	+ function ajax_update_auth_user() {
6198	4765	// Fail silently if current user doesn't have permissions.
6199	4766	if ( ! current_user_can( 'create_users' ) ) {
6200	4767	die( '' );
6201	4768	}
		@@ -6200,83 +4767,76 @@
6200	4767	die( '' );
6201	4768	}
6202	4769
6203	4770	// Nonce check.
6204		- if ( empty( $_POST['nonce'] ) || ! wp_verify_nonce( sanitize_key( $_POST['nonce'] ), 'save_auth_settings' ) ) {
	4771	+ if ( empty( $_POST['nonce_save_auth_settings'] ) || ! wp_verify_nonce( $_POST['nonce_save_auth_settings'], 'save_auth_settings' ) ) {
6205	4772	die( '' );
6206	4773	}
6207	4774
6208	4775	// Fail if requesting a change to an invalid setting.
6209		- if ( ! isset( $_POST['setting'] ) || ! in_array( wp_unslash( $_POST['setting'] ), array( 'access_users_pending', 'access_users_approved', 'access_users_blocked' ), true ) ) {
	4776	+ if ( ! in_array( $_POST['setting'], array( 'access_users_pending', 'access_users_approved', 'access_users_blocked' ) ) ) {
6210	4777	die( '' );
6211	4778	}
6212	4779
6213		- // Track any emails that couldn't be added (used when adding users).
6214		- $invalid_emails = array();
6215		-
6216	4780	// Editing a pending list entry.
6217		- if ( 'access_users_pending' === $_POST['setting'] ) {
6218		- // Sanitize posted data.
6219		- $access_users_pending = array();
6220		- if ( isset( $_POST['access_users_pending'] ) && is_array( $_POST['access_users_pending'] ) ) {
6221		- $access_users_pending = $this->sanitize_update_auth_users( wp_unslash( $_POST['access_users_pending'] ) );
	4781	+ if ( $_POST['setting'] === 'access_users_pending' ) {
	4782	+ // Initialize posted data if empty.
	4783	+ if ( ! ( array_key_exists( 'access_users_pending', $_POST ) && is_array( $_POST['access_users_pending'] ) ) ) {
	4784	+ $_POST['access_users_pending'] = array();
6222	4785	}
6223	4786
6224	4787	// Deal with each modified user (add or remove).
6225		- foreach ( $access_users_pending as $pending_user ) {
	4788	+ foreach ( $_POST['access_users_pending'] as $pending_user ) {
6226	4789
6227		- if ( 'add' === $pending_user['edit_action'] ) {
	4790	+ if ( $pending_user['edit_action'] === 'add' ) {
6228	4791
6229	4792	// Add new user to pending list and save (skip if it's
6230	4793	// already there--someone else might have just done it).
6231	4794	if ( ! $this->is_email_in_list( $pending_user['email'], 'pending' ) ) {
6232	4795	$auth_settings_access_users_pending = $this->sanitize_user_list(
6233		- $this->get_plugin_option( 'access_users_pending', WP_Plugin_Authorizer::SINGLE_CONTEXT )
	4796	+ $this->get_plugin_option( 'access_users_pending', SINGLE_ADMIN )
6234	4797	);
6235	4798	array_push( $auth_settings_access_users_pending, $pending_user );
6236	4799	update_option( 'auth_settings_access_users_pending', $auth_settings_access_users_pending );
6237	4800	}
6238		- } elseif ( 'remove' === $pending_user['edit_action'] ) {
6239	4801
6240		- // Remove user from pending list and save.
	4802	+ } elseif ( $pending_user['edit_action'] === 'remove' ) {
	4803	+
	4804	+ // Remove user from pending list and save
6241	4805	if ( $this->is_email_in_list( $pending_user['email'], 'pending' ) ) {
6242	4806	$auth_settings_access_users_pending = $this->sanitize_user_list(
6243		- $this->get_plugin_option( 'access_users_pending', WP_Plugin_Authorizer::SINGLE_CONTEXT )
	4807	+ $this->get_plugin_option( 'access_users_pending', SINGLE_ADMIN )
6244	4808	);
6245	4809	foreach ( $auth_settings_access_users_pending as $key => $existing_user ) {
6246		- if ( 0 === strcasecmp( $pending_user['email'], $existing_user['email'] ) ) {
6247		- unset( $auth_settings_access_users_pending[ $key ] );
	4810	+ if ( $pending_user['email'] == $existing_user['email'] ) {
	4811	+ unset( $auth_settings_access_users_pending[$key] );
6248	4812	break;
6249	4813	}
6250	4814	}
6251	4815	update_option( 'auth_settings_access_users_pending', $auth_settings_access_users_pending );
6252	4816	}
	4817	+
6253	4818	}
6254	4819	}
6255	4820	}
6256	4821
6257	4822	// Editing an approved list entry.
6258		- if ( 'access_users_approved' === $_POST['setting'] ) {
6259		- // Sanitize posted data.
6260		- $access_users_approved = array();
6261		- if ( isset( $_POST['access_users_approved'] ) && is_array( $_POST['access_users_approved'] ) ) {
6262		- $access_users_approved = $this->sanitize_update_auth_users( wp_unslash( $_POST['access_users_approved'] ) );
	4823	+ if ( $_POST['setting'] === 'access_users_approved' ) {
	4824	+ // Initialize posted data if empty.
	4825	+ if ( ! ( array_key_exists( 'access_users_approved', $_POST ) && is_array( $_POST['access_users_approved'] ) ) ) {
	4826	+ $_POST['access_users_approved'] = array();
6263	4827	}
6264	4828
6265	4829	// Deal with each modified user (add, remove, or change_role).
6266		- foreach ( $access_users_approved as $approved_user ) {
6267		- // Skip blank entries.
6268		- if ( strlen( $approved_user['email'] ) < 1 ) {
6269		- continue;
6270		- }
	4830	+ foreach ( $_POST['access_users_approved'] as $approved_user ) {
6271	4831
6272	4832	// New user (create user, or add existing user to current site in multisite).
6273		- if ( 'add' === $approved_user['edit_action'] ) {
	4833	+ if ( $approved_user['edit_action'] === 'add' ) {
6274	4834	$new_user = get_user_by( 'email', $approved_user['email'] );
6275		- if ( false !== $new_user ) {
	4835	+ if ( $new_user !== false ) {
6276	4836	// If we're adding an existing multisite user, make sure their
6277	4837	// newly-assigned role is updated on all sites they are already in.
6278		- if ( is_multisite() && 'false' !== $approved_user['multisite_user'] ) {
	4838	+ if ( is_multisite() && $approved_user['multisite_user'] !== 'false' ) {
6279	4839	foreach ( get_blogs_of_user( $new_user->ID ) as $blog ) {
6280	4840	add_user_to_blog( $blog->userblog_id, $new_user->ID, $approved_user['role'] );
6281	4841	}
6282	4842	}
		@@ -6283,9 +4843,9 @@
6283	4843	// If this user already has an account on another site in the network, add them to this site.
6284	4844	if ( is_multisite() ) {
6285	4845	add_user_to_blog( get_current_blog_id(), $new_user->ID, $approved_user['role'] );
6286	4846	}
6287		- } elseif ( $approved_user['local_user'] && 'false' !== $approved_user['local_user'] ) {
	4847	+ } elseif ( $approved_user['local_user'] === 'true' ) {
6288	4848	// Create a WP account for this new *local* user and email the password.
6289	4849	$plaintext_password = wp_generate_password(); // random password
6290	4850	// If there's already a user with this username (e.g.,
6291	4851	// johndoe/johndoe@gmail.com exists, and we're trying to add
		@@ -6293,26 +4853,26 @@
6293	4853	// as the username.
6294	4854	$username = explode( '@', $approved_user['email'] );
6295	4855	$username = $username[0];
6296	4856	if ( get_user_by( 'login', $username ) !== false ) {
6297		- $username = $this->lowercase( $approved_user['email'] );
	4857	+ $username = $approved_user['email'];
6298	4858	}
6299		- if ( 'false' !== $approved_user['multisite_user'] ) {
	4859	+ if ( $approved_user['multisite_user'] !== 'false' ) {
6300	4860	$result = wpmu_create_user(
6301	4861	strtolower( $username ),
6302	4862	$plaintext_password,
6303		- $this->lowercase( $approved_user['email'] )
	4863	+ strtolower( $approved_user['email'] )
6304	4864	);
6305	4865	} else {
6306	4866	$result = wp_insert_user(
6307	4867	array(
6308		- 'user_login' => strtolower( $username ),
6309		- 'user_pass' => $plaintext_password,
6310		- 'first_name' => '',
6311		- 'last_name' => '',
6312		- 'user_email' => $this->lowercase( $approved_user['email'] ),
	4868	+ 'user_login' => strtolower( $username ),
	4869	+ 'user_pass' => $plaintext_password,
	4870	+ 'first_name' => '',
	4871	+ 'last_name' => '',
	4872	+ 'user_email' => strtolower( $approved_user['email'] ),
6313	4873	'user_registered' => date( 'Y-m-d H:i:s' ),
6314		- 'role' => $approved_user['role'],
	4874	+ 'role' => $approved_user['role'],
6315	4875	)
6316	4876	);
6317	4877	}
6318	4878	if ( ! is_wp_error( $result ) ) {
		@@ -6318,8 +4878,9 @@
6318	4878	if ( ! is_wp_error( $result ) ) {
6319	4879	// Email login credentials to new user.
6320	4880	wp_new_user_notification( $result, null, 'both' );
6321	4881	}
	4882	+
6322	4883	}
6323	4884
6324	4885	// Email new user welcome message if plugin option is set.
6325	4886	$this->maybe_email_welcome_message( $approved_user['email'] );
		@@ -6325,46 +4886,41 @@
6325	4886	$this->maybe_email_welcome_message( $approved_user['email'] );
6326	4887
6327	4888	// Add new user to approved list and save (skip if it's
6328	4889	// already there--someone else might have just done it).
6329		- if ( 'false' !== $approved_user['multisite_user'] ) {
	4890	+ if ( $approved_user['multisite_user'] !== 'false' ) {
6330	4891	if ( ! $this->is_email_in_list( $approved_user['email'], 'approved', 'multisite' ) ) {
6331	4892	$auth_multisite_settings_access_users_approved = $this->sanitize_user_list(
6332		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT )
	4893	+ $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN )
6333	4894	);
6334		- $approved_user['date_added'] = date( 'M Y' );
	4895	+ $approved_user['date_added'] = date( 'M Y' );
6335	4896	array_push( $auth_multisite_settings_access_users_approved, $approved_user );
6336		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
6337		- } else {
6338		- $invalid_emails[] = $approved_user['email'];
	4897	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
6339	4898	}
6340	4899	} else {
6341	4900	if ( ! $this->is_email_in_list( $approved_user['email'], 'approved' ) ) {
6342	4901	$auth_settings_access_users_approved = $this->sanitize_user_list(
6343		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT )
	4902	+ $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN )
6344	4903	);
6345		- $approved_user['date_added'] = date( 'M Y' );
	4904	+ $approved_user['date_added'] = date( 'M Y' );
6346	4905	array_push( $auth_settings_access_users_approved, $approved_user );
6347	4906	update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved );
6348		- } else {
6349		- $invalid_emails[] = $approved_user['email'];
6350	4907	}
6351	4908	}
6352	4909
6353	4910	// If we've added a new multisite user, go through all pending/approved/blocked lists
6354	4911	// on individual sites and remove this user from them (to prevent duplicate entries).
6355		- if ( 'false' !== $approved_user['multisite_user'] && is_multisite() ) {
	4912	+ if ( $approved_user['multisite_user'] !== 'false' && is_multisite() ) {
6356	4913	$list_names = array( 'access_users_pending', 'access_users_approved', 'access_users_blocked' );
6357		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
6358	4914	$sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
6359	4915	foreach ( $sites as $site ) {
6360	4916	$blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
6361	4917	foreach ( $list_names as $list_name ) {
6362		- $user_list = get_blog_option( $blog_id, 'auth_settings_' . $list_name, array() );
	4918	+ $user_list = get_blog_option( $blog_id, 'auth_settings_' . $list_name, array() );
6363	4919	$list_changed = false;
6364	4920	foreach ( $user_list as $key => $user ) {
6365		- if ( 0 === strcasecmp( $user['email'], $approved_user['email'] ) ) {
6366		- unset( $user_list[ $key ] );
	4921	+ if ( $user['email'] == $approved_user['email'] ) {
	4922	+ unset( $user_list[$key] );
6367	4923	$list_changed = true;
6368	4924	}
6369	4925	}
6370	4926	if ( $list_changed ) {
		@@ -6372,45 +4928,32 @@
6372	4928	}
6373	4929	}
6374	4930	}
6375	4931	}
6376		- } elseif ( 'remove' === $approved_user['edit_action'] ) { // Remove user from approved list and save (also remove their role if they have a WordPress account).
6377		- if ( 'false' !== $approved_user['multisite_user'] ) {
	4932	+
	4933	+ // Remove user from approved list and save
	4934	+ } elseif ( $approved_user['edit_action'] === 'remove' ) {
	4935	+ if ( $approved_user['multisite_user'] !== 'false' ) {
6378	4936	if ( $this->is_email_in_list( $approved_user['email'], 'approved', 'multisite' ) ) {
6379	4937	$auth_multisite_settings_access_users_approved = $this->sanitize_user_list(
6380		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT )
	4938	+ $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN )
6381	4939	);
6382	4940	foreach ( $auth_multisite_settings_access_users_approved as $key => $existing_user ) {
6383		- if ( 0 === strcasecmp( $approved_user['email'], $existing_user['email'] ) ) {
6384		- // Remove role of the associated WordPress user from all blogs (but don't delete the user).
6385		- $user = get_user_by( 'email', $approved_user['email'] );
6386		- if ( false !== $user ) {
6387		- // Loop through all of the blogs this user is a member of and remove their capabilities.
6388		- foreach ( get_blogs_of_user( $user->ID ) as $blog ) {
6389		- remove_user_from_blog( $user->ID, $blog->userblog_id, '' );
6390		- }
6391		- }
6392		- // Remove entry from Approved Users list.
6393		- unset( $auth_multisite_settings_access_users_approved[ $key ] );
	4941	+ if ( $approved_user['email'] == $existing_user['email'] ) {
	4942	+ unset( $auth_multisite_settings_access_users_approved[$key] );
6394	4943	break;
6395	4944	}
6396	4945	}
6397		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
	4946	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
6398	4947	}
6399	4948	} else {
6400	4949	if ( $this->is_email_in_list( $approved_user['email'], 'approved' ) ) {
6401	4950	$auth_settings_access_users_approved = $this->sanitize_user_list(
6402		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT )
	4951	+ $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN )
6403	4952	);
6404	4953	foreach ( $auth_settings_access_users_approved as $key => $existing_user ) {
6405		- if ( 0 === strcasecmp( $approved_user['email'], $existing_user['email'] ) ) {
6406		- // Remove role of the associated WordPress user (but don't delete the user).
6407		- $user = get_user_by( 'email', $approved_user['email'] );
6408		- if ( false !== $user ) {
6409		- $user->set_role( '' );
6410		- }
6411		- // Remove entry from Approved Users list.
6412		- unset( $auth_settings_access_users_approved[ $key ] );
	4954	+ if ( $approved_user['email'] == $existing_user['email'] ) {
	4955	+ unset( $auth_settings_access_users_approved[$key] );
6413	4956	break;
6414	4957	}
6415	4958	}
6416	4959	update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved );
		@@ -6415,12 +4958,14 @@
6415	4958	}
6416	4959	update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved );
6417	4960	}
6418	4961	}
6419		- } elseif ( 'change_role' === $approved_user['edit_action'] ) { // Update user's role in WordPress.
	4962	+
	4963	+ // Update user's role in WordPress
	4964	+ } elseif ( $approved_user['edit_action'] === 'change_role' ) {
6420	4965	$changed_user = get_user_by( 'email', $approved_user['email'] );
6421	4966	if ( $changed_user ) {
6422		- if ( is_multisite() && 'false' !== $approved_user['multisite_user'] ) {
	4967	+ if ( is_multisite() && $approved_user['multisite_user'] !== 'false' ) {
6423	4968	foreach ( get_blogs_of_user( $changed_user->ID ) as $blog ) {
6424	4969	add_user_to_blog( $blog->userblog_id, $changed_user->ID, $approved_user['role'] );
6425	4970	}
6426	4971	} else {
		@@ -6427,30 +4972,30 @@
6427	4972	$changed_user->set_role( $approved_user['role'] );
6428	4973	}
6429	4974	}
6430	4975
6431		- if ( 'false' !== $approved_user['multisite_user'] ) {
	4976	+ if ( $approved_user['multisite_user'] !== 'false' ) {
6432	4977	if ( $this->is_email_in_list( $approved_user['email'], 'approved', 'multisite' ) ) {
6433	4978	$auth_multisite_settings_access_users_approved = $this->sanitize_user_list(
6434		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT )
	4979	+ $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN )
6435	4980	);
6436	4981	foreach ( $auth_multisite_settings_access_users_approved as $key => $existing_user ) {
6437		- if ( 0 === strcasecmp( $approved_user['email'], $existing_user['email'] ) ) {
6438		- $auth_multisite_settings_access_users_approved[ $key ]['role'] = $approved_user['role'];
	4982	+ if ( $approved_user['email'] == $existing_user['email'] ) {
	4983	+ $auth_multisite_settings_access_users_approved[$key]['role'] = $approved_user['role'];
6439	4984	break;
6440	4985	}
6441	4986	}
6442		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
	4987	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
6443	4988	}
6444	4989	} else {
6445	4990	// Update user's role in approved list and save.
6446	4991	if ( $this->is_email_in_list( $approved_user['email'], 'approved' ) ) {
6447	4992	$auth_settings_access_users_approved = $this->sanitize_user_list(
6448		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT )
	4993	+ $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN )
6449	4994	);
6450	4995	foreach ( $auth_settings_access_users_approved as $key => $existing_user ) {
6451		- if ( 0 === strcasecmp( $approved_user['email'], $existing_user['email'] ) ) {
6452		- $auth_settings_access_users_approved[ $key ]['role'] = $approved_user['role'];
	4996	+ if ( $approved_user['email'] == $existing_user['email'] ) {
	4997	+ $auth_settings_access_users_approved[$key]['role'] = $approved_user['role'];
6453	4998	break;
6454	4999	}
6455	5000	}
6456	5001	update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved );
		@@ -6455,28 +5000,28 @@
6455	5000	}
6456	5001	update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved );
6457	5002	}
6458	5003	}
	5004	+
6459	5005	}
6460	5006	}
6461	5007	}
6462	5008
6463	5009	// Editing a blocked list entry.
6464		- if ( 'access_users_blocked' === $_POST['setting'] ) {
6465		- // Sanitize post data.
6466		- $access_users_blocked = array();
6467		- if ( isset( $_POST['access_users_blocked'] ) && is_array( $_POST['access_users_blocked'] ) ) {
6468		- $access_users_blocked = $this->sanitize_update_auth_users( wp_unslash( $_POST['access_users_blocked'] ) );
	5010	+ if ( $_POST['setting'] === 'access_users_blocked' ) {
	5011	+ // Initialize posted data if empty.
	5012	+ if ( ! ( array_key_exists( 'access_users_blocked', $_POST ) && is_array( $_POST['access_users_blocked'] ) ) ) {
	5013	+ $_POST['access_users_blocked'] = array();
6469	5014	}
6470	5015
6471	5016	// Deal with each modified user (add or remove).
6472		- foreach ( $access_users_blocked as $blocked_user ) {
	5017	+ foreach ( $_POST['access_users_blocked'] as $blocked_user ) {
6473	5018
6474		- if ( 'add' === $blocked_user['edit_action'] ) {
	5019	+ if ( $blocked_user['edit_action'] === 'add' ) {
6475	5020
6476	5021	// Add auth_blocked usermeta for the user.
6477	5022	$blocked_wp_user = get_user_by( 'email', $blocked_user['email'] );
6478		- if ( false !== $blocked_wp_user ) {
	5023	+ if ( $blocked_wp_user !== false ) {
6479	5024	update_user_meta( $blocked_wp_user->ID, 'auth_blocked', 'yes' );
6480	5025	}
6481	5026
6482	5027	// Add new user to blocked list and save (skip if it's
		@@ -6482,113 +5027,48 @@
6482	5027	// Add new user to blocked list and save (skip if it's
6483	5028	// already there--someone else might have just done it).
6484	5029	if ( ! $this->is_email_in_list( $blocked_user['email'], 'blocked' ) ) {
6485	5030	$auth_settings_access_users_blocked = $this->sanitize_user_list(
6486		- $this->get_plugin_option( 'access_users_blocked', WP_Plugin_Authorizer::SINGLE_CONTEXT )
	5031	+ $this->get_plugin_option( 'access_users_blocked', SINGLE_ADMIN )
6487	5032	);
6488		- $blocked_user['date_added'] = date( 'M Y' );
	5033	+ $blocked_user['date_added'] = date( 'M Y' );
6489	5034	array_push( $auth_settings_access_users_blocked, $blocked_user );
6490	5035	update_option( 'auth_settings_access_users_blocked', $auth_settings_access_users_blocked );
6491		- } else {
6492		- $invalid_emails[] = $blocked_user['email'];
6493	5036	}
6494		- } elseif ( 'remove' === $blocked_user['edit_action'] ) {
6495	5037
	5038	+ } elseif ( $blocked_user['edit_action'] === 'remove' ) {
	5039	+
6496	5040	// Remove auth_blocked usermeta for the user.
6497	5041	$unblocked_user = get_user_by( 'email', $blocked_user['email'] );
6498		- if ( false !== $unblocked_user ) {
	5042	+ if ( $unblocked_user !== false ) {
6499	5043	delete_user_meta( $unblocked_user->ID, 'auth_blocked', 'yes' );
6500	5044	}
6501	5045
6502		- // Remove user from blocked list and save.
	5046	+ // Remove user from blocked list and save
6503	5047	if ( $this->is_email_in_list( $blocked_user['email'], 'blocked' ) ) {
6504	5048	$auth_settings_access_users_blocked = $this->sanitize_user_list(
6505		- $this->get_plugin_option( 'access_users_blocked', WP_Plugin_Authorizer::SINGLE_CONTEXT )
	5049	+ $this->get_plugin_option( 'access_users_blocked', SINGLE_ADMIN )
6506	5050	);
6507	5051	foreach ( $auth_settings_access_users_blocked as $key => $existing_user ) {
6508		- if ( 0 === strcasecmp( $blocked_user['email'], $existing_user['email'] ) ) {
6509		- unset( $auth_settings_access_users_blocked[ $key ] );
	5052	+ if ( $blocked_user['email'] == $existing_user['email'] ) {
	5053	+ unset( $auth_settings_access_users_blocked[$key] );
6510	5054	break;
6511	5055	}
6512	5056	}
6513	5057	update_option( 'auth_settings_access_users_blocked', $auth_settings_access_users_blocked );
6514	5058	}
	5059	+
6515	5060	}
6516	5061	}
6517	5062	}
6518	5063
6519		- // Send response to client.
6520		- $response = array(
6521		- 'success' => true,
6522		- 'invalid_emails' => $invalid_emails,
6523		- );
6524		- header( 'content-type: application/json' );
6525		- echo wp_json_encode( $response );
6526		- exit;
	5064	+ // Return 'success' value to AJAX call.
	5065	+ die( 'success' );
6527	5066	}
6528	5067
6529	5068
6530		- /**
6531		- * Sanitizes an array of user update commands coming from the AJAX handler in Authorizer Settings.
6532		- *
6533		- * Example $users array:
6534		- * array(
6535		- * array(
6536		- * edit_action: 'add' or 'remove' or 'change_role',
6537		- * email: 'johndoe@example.com',
6538		- * role: 'subscriber',
6539		- * date_added: 'Jun 2014',
6540		- * local_user: 'true' or 'false',
6541		- * multisite_user: 'true' or 'false',
6542		- * ),
6543		- * ...
6544		- * )
6545		- *
6546		- * @param array $users Users to edit.
6547		- * @return array Sanitized users to edit.
6548		- */
6549		- private function sanitize_update_auth_users( $users = array() ) {
6550		- if ( ! is_array( $users ) ) {
6551		- $users = array();
6552		- }
6553		- $users = array_map( array( $this, 'sanitize_update_auth_user' ), $users );
6554	5069
6555		- return $users;
6556		- }
6557		-
6558		-
6559	5070	/**
6560		- * Callback for array_map in sanitize_update_auth_users().
6561		- *
6562		- * @param array $user User data to sanitize.
6563		- * @return array Sanitized user data.
6564		- */
6565		- private function sanitize_update_auth_user( $user ) {
6566		- if ( array_key_exists( 'edit_action', $user ) ) {
6567		- $user['edit_action'] = sanitize_text_field( $user['edit_action'] );
6568		- }
6569		- if ( isset( $user['email'] ) ) {
6570		- $user['email'] = sanitize_email( $user['email'] );
6571		- }
6572		- if ( isset( $user['role'] ) ) {
6573		- $user['role'] = sanitize_text_field( $user['role'] );
6574		- }
6575		- if ( isset( $user['date_added'] ) ) {
6576		- $user['date_added'] = sanitize_text_field( $user['date_added'] );
6577		- }
6578		- if ( isset( $user['local_user'] ) ) {
6579		- $user['local_user'] = 'true' === $user['local_user'] ? 'true' : 'false';
6580		- }
6581		- if ( isset( $user['multisite_user'] ) ) {
6582		- $user['multisite_user'] = 'true' === $user['multisite_user'] ? 'true' : 'false';
6583		- }
6584		-
6585		- return $user;
6586		- }
6587		-
6588		-
6589		-
6590		- /**
6591	5071	* ***************************
6592	5072	* Helper functions
6593	5073	* ***************************
6594	5074	*/
		@@ -6596,20 +5076,20 @@
6596	5076
6597	5077	/**
6598	5078	* Retrieves a specific plugin option from db. Multisite enabled.
6599	5079	*
6600		- * @param string $option Option name.
6601		- * @param string $admin_mode WP_Plugin_Authorizer::NETWORK_CONTEXT will retrieve the multisite value.
6602		- * @param string $override_mode 'allow override' will retrieve the multisite value if it exists.
6603		- * @param string $print_mode 'print overlay' will output overlay that hides this option on the settings page.
6604		- * @return mixed Option value, or null on failure.
	5080	+ * @param string $option Option name
	5081	+ * @param string $admin_mode MULTISITE_ADMIN will retrieve the multisite value
	5082	+ * @param string $override_mode 'allow override' will retrieve the multisite value if it exists
	5083	+ * @param string $print_mode 'print overlay' will output overlay that hides this option on the settings page
	5084	+ * @return mixed Option value, or null on failure
6605	5085	*/
6606		- private function get_plugin_option( $option, $admin_mode = WP_Plugin_Authorizer::SINGLE_CONTEXT, $override_mode = 'no override', $print_mode = 'no overlay' ) {
	5086	+ private function get_plugin_option( $option, $admin_mode = SINGLE_ADMIN, $override_mode = 'no override', $print_mode = 'no overlay' ) {
6607	5087	// Special case for user lists (they are saved seperately to prevent concurrency issues).
6608		- if ( in_array( $option, array( 'access_users_pending', 'access_users_approved', 'access_users_blocked' ), true ) ) {
6609		- $list = WP_Plugin_Authorizer::NETWORK_CONTEXT === $admin_mode ? array() : get_option( 'auth_settings_' . $option );
6610		- if ( is_multisite() && WP_Plugin_Authorizer::NETWORK_CONTEXT === $admin_mode ) {
6611		- $list = get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_' . $option, array() );
	5088	+ if ( in_array( $option, array( 'access_users_pending', 'access_users_approved', 'access_users_blocked' ) ) ) {
	5089	+ $list = $admin_mode === MULTISITE_ADMIN ? array() : get_option( 'auth_settings_' . $option );
	5090	+ if ( is_multisite() && $admin_mode === MULTISITE_ADMIN ) {
	5091	+ $list = get_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_' . $option, array() );
6612	5092	}
6613	5093	return $list;
6614	5094	}
6615	5095
		@@ -6623,26 +5103,24 @@
6623	5103
6624	5104	// If requested and appropriate, print the overlay hiding the
6625	5105	// single site option that is overridden by a multisite option.
6626	5106	if (
6627		- WP_Plugin_Authorizer::NETWORK_CONTEXT !== $admin_mode &&
6628		- 'allow override' === $override_mode &&
6629		- 'print overlay' === $print_mode &&
	5107	+ $admin_mode !== MULTISITE_ADMIN &&
	5108	+ $override_mode === 'allow override' &&
	5109	+ $print_mode === 'print overlay' &&
6630	5110	array_key_exists( 'multisite_override', $auth_settings ) &&
6631		- '1' === $auth_settings['multisite_override'] &&
6632		- ( ! array_key_exists( 'advanced_override_multisite', $auth_settings ) || 1 !== intval( $auth_settings['advanced_override_multisite'] ) )
	5111	+ $auth_settings['multisite_override'] === '1' &&
	5112	+ ( ! array_key_exists( 'advanced_override_multisite', $auth_settings ) || $auth_settings['advanced_override_multisite'] != '1' )
6633	5113	) {
6634	5114	// Get original plugin options (not overridden value). We'll
6635	5115	// show this old value behind the disabled overlay.
6636		- // $auth_settings = $this->get_plugin_options( $admin_mode, 'no override' );
6637		- // (This feature is disabled).
6638		- //
	5116	+ $auth_settings = $this->get_plugin_options( $admin_mode, 'no override' );
	5117	+
6639	5118	$name = "auth_settings[$option]";
6640		- $id = "auth_settings_$option";
6641		- ?>
6642		- <div id="overlay-hide-auth_settings_<?php echo esc_attr( $option ); ?>" class="auth_multisite_override_overlay">
	5119	+ $id = "auth_settings_$option"; ?>
	5120	+ <div id="overlay-hide-auth_settings_<?php echo $option; ?>" class="auth_multisite_override_overlay">
6643	5121	<span class="overlay-note">
6644		- <?php esc_html_e( 'This setting is overridden by a', 'authorizer' ); ?> <a href="<?php echo esc_attr( network_admin_url( 'admin.php?page=authorizer' ) ); ?>"><?php esc_html_e( 'multisite option', 'authorizer' ); ?></a>.
	5122	+ <?php _e( 'This setting is overridden by a', 'authorizer' ); ?> <a href="<?php echo network_admin_url( 'admin.php?page=authorizer&tab=external' ); ?>"><?php _e( 'multisite option', 'authorizer' ); ?></a>.
6645	5123	</span>
6646	5124	</div>
6647	5125	<?php
6648	5126	}
		@@ -6648,9 +5126,9 @@
6648	5126	}
6649	5127
6650	5128	// If we're getting an option in a site that has overridden the multisite override, make
6651	5129	// sure we are returning the option value from that site (not the multisite value).
6652		- if ( array_key_exists( 'advanced_override_multisite', $auth_settings ) && 1 === intval( $auth_settings['advanced_override_multisite'] ) ) {
	5130	+ if ( array_key_exists( 'advanced_override_multisite', $auth_settings ) && $auth_settings['advanced_override_multisite'] == '1' ) {
6653	5131	$auth_settings = $this->get_plugin_options( $admin_mode, 'no override' );
6654	5132	}
6655	5133
6656	5134	// Set option to null if it wasn't found.
		@@ -6657,115 +5135,98 @@
6657	5135	if ( ! array_key_exists( $option, $auth_settings ) ) {
6658	5136	return null;
6659	5137	}
6660	5138
6661		- return $auth_settings[ $option ];
	5139	+ return $auth_settings[$option];
6662	5140	}
6663	5141
6664	5142	/**
6665	5143	* Retrieves all plugin options from db. Multisite enabled.
6666	5144	*
6667		- * @param string $admin_mode WP_Plugin_Authorizer::NETWORK_CONTEXT will retrieve the multisite value.
6668		- * @param string $override_mode 'allow override' will retrieve the multisite value if it exists.
6669		- * @return mixed Option value, or null on failure.
	5145	+ * @param string $admin_mode MULTISITE_ADMIN will retrieve the multisite value
	5146	+ * @param string $override_mode 'allow override' will retrieve the multisite value if it exists
	5147	+ * @return mixed Option value, or null on failure
6670	5148	*/
6671		- private function get_plugin_options( $admin_mode = WP_Plugin_Authorizer::SINGLE_CONTEXT, $override_mode = 'no override' ) {
6672		- // Grab plugin settings (skip if in WP_Plugin_Authorizer::NETWORK_CONTEXT mode).
6673		- $auth_settings = WP_Plugin_Authorizer::NETWORK_CONTEXT === $admin_mode ? array() : get_option( 'auth_settings' );
	5149	+ private function get_plugin_options( $admin_mode = SINGLE_ADMIN, $override_mode = 'no override' ) {
	5150	+ // Grab plugin settings (skip if in MULTISITE_ADMIN mode).
	5151	+ $auth_settings = $admin_mode === MULTISITE_ADMIN ? array() : get_option( 'auth_settings' );
6674	5152
6675	5153	// Initialize to default values if the plugin option doesn't exist.
6676		- if ( false === $auth_settings ) {
	5154	+ if ( $auth_settings === FALSE ) {
6677	5155	$auth_settings = $this->set_default_options();
6678	5156	}
6679	5157
6680	5158	// Merge multisite options if we're in a network and the current site hasn't overridden multisite settings.
6681		- if ( is_multisite() && ( ! array_key_exists( 'advanced_override_multisite', $auth_settings ) || 1 !== intval( $auth_settings['advanced_override_multisite'] ) ) ) {
	5159	+ if ( is_multisite() && ( ! array_key_exists( 'advanced_override_multisite', $auth_settings ) || $auth_settings['advanced_override_multisite'] != '1' ) ) {
6682	5160	// Get multisite options.
6683		- $auth_multisite_settings = get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings', array() );
	5161	+ $auth_multisite_settings = get_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings', array() );
6684	5162
6685	5163	// Return the multisite options if we're viewing the network admin options page.
6686	5164	// Otherwise override options with their multisite equivalents.
6687		- if ( WP_Plugin_Authorizer::NETWORK_CONTEXT === $admin_mode ) {
	5165	+ if ( $admin_mode === MULTISITE_ADMIN ) {
6688	5166	$auth_settings = $auth_multisite_settings;
6689	5167	} elseif (
6690		- 'allow override' === $override_mode &&
	5168	+ $override_mode === 'allow override' &&
6691	5169	array_key_exists( 'multisite_override', $auth_multisite_settings ) &&
6692		- '1' === $auth_multisite_settings['multisite_override']
	5170	+ $auth_multisite_settings['multisite_override'] === '1'
6693	5171	) {
6694	5172	// Keep track of the multisite override selection.
6695	5173	$auth_settings['multisite_override'] = $auth_multisite_settings['multisite_override'];
6696	5174
6697		- /**
6698		- * Note: the options below should be the complete list of overridden
6699		- * options. It is *not* the complete list of all options (some options
6700		- * don't have a multisite equivalent).
6701		- */
	5175	+ // Note: the options below should be the complete list of
	5176	+ // overridden options. It is *not* the complete list of all
	5177	+ // options (some options don't have a multisite equivalent)
6702	5178
6703		- /**
6704		- * Note: access_users_approved, access_users_pending, and
6705		- * access_users_blocked do not get overridden. However, since
6706		- * access_users_approved has a multisite equivalent, you must retrieve
6707		- * them both seperately. This is done because the two lists should be
6708		- * treated differently.
6709		- *
6710		- * $approved_users = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT );
6711		- * $ms_approved_users = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT );
6712		- */
	5179	+ // Note: access_users_approved, access_users_pending, and
	5180	+ // access_users_blocked do not get overridden. However,
	5181	+ // since access_users_approved has a multisite equivalent,
	5182	+ // you must retrieve them both seperately. This is done
	5183	+ // because the two lists should be treated differently.
	5184	+ // $approved_users = $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN );
	5185	+ // $ms_approved_users = $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN );
6713	5186
6714		- // Override external services (google, cas, or ldap) and associated options.
6715		- $auth_settings['google'] = $auth_multisite_settings['google'];
6716		- $auth_settings['google_clientid'] = $auth_multisite_settings['google_clientid'];
6717		- $auth_settings['google_clientsecret'] = $auth_multisite_settings['google_clientsecret'];
6718		- $auth_settings['google_hosteddomain'] = $auth_multisite_settings['google_hosteddomain'];
6719		- $auth_settings['cas'] = $auth_multisite_settings['cas'];
6720		- $auth_settings['cas_custom_label'] = $auth_multisite_settings['cas_custom_label'];
6721		- $auth_settings['cas_host'] = $auth_multisite_settings['cas_host'];
6722		- $auth_settings['cas_port'] = $auth_multisite_settings['cas_port'];
6723		- $auth_settings['cas_path'] = $auth_multisite_settings['cas_path'];
6724		- $auth_settings['cas_version'] = $auth_multisite_settings['cas_version'];
6725		- $auth_settings['cas_attr_email'] = $auth_multisite_settings['cas_attr_email'];
6726		- $auth_settings['cas_attr_first_name'] = $auth_multisite_settings['cas_attr_first_name'];
6727		- $auth_settings['cas_attr_last_name'] = $auth_multisite_settings['cas_attr_last_name'];
6728		- $auth_settings['cas_attr_update_on_login'] = $auth_multisite_settings['cas_attr_update_on_login'];
6729		- $auth_settings['cas_auto_login'] = $auth_multisite_settings['cas_auto_login'];
6730		- $auth_settings['ldap'] = $auth_multisite_settings['ldap'];
6731		- $auth_settings['ldap_host'] = $auth_multisite_settings['ldap_host'];
6732		- $auth_settings['ldap_port'] = $auth_multisite_settings['ldap_port'];
6733		- $auth_settings['ldap_tls'] = $auth_multisite_settings['ldap_tls'];
6734		- $auth_settings['ldap_search_base'] = $auth_multisite_settings['ldap_search_base'];
6735		- $auth_settings['ldap_uid'] = $auth_multisite_settings['ldap_uid'];
6736		- $auth_settings['ldap_attr_email'] = $auth_multisite_settings['ldap_attr_email'];
6737		- $auth_settings['ldap_user'] = $auth_multisite_settings['ldap_user'];
6738		- $auth_settings['ldap_password'] = $auth_multisite_settings['ldap_password'];
6739		- $auth_settings['ldap_lostpassword_url'] = $auth_multisite_settings['ldap_lostpassword_url'];
6740		- $auth_settings['ldap_attr_first_name'] = $auth_multisite_settings['ldap_attr_first_name'];
6741		- $auth_settings['ldap_attr_last_name'] = $auth_multisite_settings['ldap_attr_last_name'];
	5187	+ // Override external services (google, cas, or ldap) and associated options
	5188	+ $auth_settings['google'] = $auth_multisite_settings['google'];
	5189	+ $auth_settings['google_clientid'] = $auth_multisite_settings['google_clientid'];
	5190	+ $auth_settings['google_clientsecret'] = $auth_multisite_settings['google_clientsecret'];
	5191	+ $auth_settings['google_hosteddomain'] = $auth_multisite_settings['google_hosteddomain'];
	5192	+ $auth_settings['cas'] = $auth_multisite_settings['cas'];
	5193	+ $auth_settings['cas_custom_label'] = $auth_multisite_settings['cas_custom_label'];
	5194	+ $auth_settings['cas_host'] = $auth_multisite_settings['cas_host'];
	5195	+ $auth_settings['cas_port'] = $auth_multisite_settings['cas_port'];
	5196	+ $auth_settings['cas_path'] = $auth_multisite_settings['cas_path'];
	5197	+ $auth_settings['cas_version'] = $auth_multisite_settings['cas_version'];
	5198	+ $auth_settings['cas_attr_email'] = $auth_multisite_settings['cas_attr_email'];
	5199	+ $auth_settings['cas_attr_first_name'] = $auth_multisite_settings['cas_attr_first_name'];
	5200	+ $auth_settings['cas_attr_last_name'] = $auth_multisite_settings['cas_attr_last_name'];
	5201	+ $auth_settings['cas_attr_update_on_login'] = $auth_multisite_settings['cas_attr_update_on_login'];
	5202	+ $auth_settings['cas_auto_login'] = $auth_multisite_settings['cas_auto_login'];
	5203	+ $auth_settings['ldap'] = $auth_multisite_settings['ldap'];
	5204	+ $auth_settings['ldap_host'] = $auth_multisite_settings['ldap_host'];
	5205	+ $auth_settings['ldap_port'] = $auth_multisite_settings['ldap_port'];
	5206	+ $auth_settings['ldap_tls'] = $auth_multisite_settings['ldap_tls'];
	5207	+ $auth_settings['ldap_search_base'] = $auth_multisite_settings['ldap_search_base'];
	5208	+ $auth_settings['ldap_uid'] = $auth_multisite_settings['ldap_uid'];
	5209	+ $auth_settings['ldap_attr_email'] = $auth_multisite_settings['ldap_attr_email'];
	5210	+ $auth_settings['ldap_user'] = $auth_multisite_settings['ldap_user'];
	5211	+ $auth_settings['ldap_password'] = $auth_multisite_settings['ldap_password'];
	5212	+ $auth_settings['ldap_lostpassword_url'] = $auth_multisite_settings['ldap_lostpassword_url'];
	5213	+ $auth_settings['ldap_attr_first_name'] = $auth_multisite_settings['ldap_attr_first_name'];
	5214	+ $auth_settings['ldap_attr_last_name'] = $auth_multisite_settings['ldap_attr_last_name'];
6742	5215	$auth_settings['ldap_attr_update_on_login'] = $auth_multisite_settings['ldap_attr_update_on_login'];
6743	5216
6744		- // Override access_who_can_login and access_who_can_view.
	5217	+ // Override access_who_can_login and access_who_can_view
6745	5218	$auth_settings['access_who_can_login'] = $auth_multisite_settings['access_who_can_login'];
6746		- $auth_settings['access_who_can_view'] = $auth_multisite_settings['access_who_can_view'];
	5219	+ $auth_settings['access_who_can_view'] = $auth_multisite_settings['access_who_can_view'];
6747	5220
6748		- // Override access_default_role.
	5221	+ // Override access_default_role
6749	5222	$auth_settings['access_default_role'] = $auth_multisite_settings['access_default_role'];
6750	5223
6751		- // Override lockouts.
	5224	+ // Override lockouts
6752	5225	$auth_settings['advanced_lockouts'] = $auth_multisite_settings['advanced_lockouts'];
6753	5226
6754		- // Override Hide WordPress login.
	5227	+ // Override Hide WordPress login
6755	5228	$auth_settings['advanced_hide_wp_login'] = $auth_multisite_settings['advanced_hide_wp_login'];
6756		-
6757		- // Override Users per page.
6758		- $auth_settings['advanced_users_per_page'] = $auth_multisite_settings['advanced_users_per_page'];
6759		-
6760		- // Override Sort users by.
6761		- $auth_settings['advanced_users_sort_by'] = $auth_multisite_settings['advanced_users_sort_by'];
6762		-
6763		- // Override Sort users order.
6764		- $auth_settings['advanced_users_sort_order'] = $auth_multisite_settings['advanced_users_sort_order'];
6765		-
6766		- // Override Show Dashboard Widget.
6767		- $auth_settings['advanced_widget_enabled'] = $auth_multisite_settings['advanced_widget_enabled'];
6768	5229	}
6769	5230	}
6770	5231	return $auth_settings;
6771	5232	}
		@@ -6772,27 +5233,23 @@
6772	5233
6773	5234
6774	5235	/**
6775	5236	* Remove user from authorizer lists when that user is deleted in WordPress.
6776		- *
6777		- * Action: delete_user
6778		- *
6779		- * @param int $user_id User ID to remove.
6780		- * @return void
	5237	+ * Run on action hook: delete_user
6781	5238	*/
6782		- public function remove_user_from_authorizer_when_deleted( $user_id ) {
6783		- $user = get_user_by( 'id', $user_id );
	5239	+ function remove_user_from_authorizer_when_deleted( $user_id ) {
	5240	+ $user = get_user_by( 'id', $user_id );
6784	5241	$deleted_email = $user->user_email;
6785	5242
6786	5243	// Remove user from pending/approved lists and save.
6787	5244	$list_names = array( 'access_users_pending', 'access_users_approved' );
6788	5245	foreach ( $list_names as $list_name ) {
6789		- $user_list = $this->sanitize_user_list( $this->get_plugin_option( $list_name, WP_Plugin_Authorizer::SINGLE_CONTEXT ) );
	5246	+ $user_list = $this->sanitize_user_list( $this->get_plugin_option( $list_name, SINGLE_ADMIN ) );
6790	5247	$list_changed = false;
6791	5248	foreach ( $user_list as $key => $existing_user ) {
6792		- if ( 0 === strcasecmp( $deleted_email, $existing_user['email'] ) ) {
	5249	+ if ( $deleted_email === $existing_user['email'] ) {
6793	5250	$list_changed = true;
6794		- unset( $user_list[ $key ] );
	5251	+ unset( $user_list[$key] );
6795	5252	}
6796	5253	}
6797	5254	if ( $list_changed ) {
6798	5255	update_option( 'auth_settings_' . $list_name, $user_list );
		@@ -6802,35 +5259,30 @@
6802	5259
6803	5260
6804	5261	/**
6805	5262	* Remove multisite user from authorizer lists when that user is deleted from Network Users.
6806		- *
6807		- * Action: wpmu_delete_user
6808		- *
6809		- * @param int $user_id User ID to remove.
6810		- * @return void
	5263	+ * Run on action hook: wpmu_delete_user
6811	5264	*/
6812		- public function remove_network_user_from_authorizer_when_deleted( $user_id ) {
6813		- $user = get_user_by( 'id', $user_id );
	5265	+ function remove_network_user_from_authorizer_when_deleted( $user_id ) {
	5266	+ $user = get_user_by( 'id', $user_id );
6814	5267	$deleted_email = $user->user_email;
6815	5268
6816	5269	// Go through multisite approved user list and remove this user.
6817	5270	$auth_multisite_settings_access_users_approved = $this->sanitize_user_list(
6818		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT )
	5271	+ $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN )
6819	5272	);
6820		- $list_changed = false;
	5273	+ $list_changed = false;
6821	5274	foreach ( $auth_multisite_settings_access_users_approved as $key => $existing_user ) {
6822		- if ( 0 === strcasecmp( $deleted_email, $existing_user['email'] ) ) {
	5275	+ if ( $deleted_email === $existing_user['email'] ) {
6823	5276	$list_changed = true;
6824		- unset( $auth_multisite_settings_access_users_approved[ $key ] );
	5277	+ unset( $auth_multisite_settings_access_users_approved[$key] );
6825	5278	}
6826	5279	}
6827	5280	if ( $list_changed ) {
6828		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
	5281	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
6829	5282	}
6830	5283
6831	5284	// Go through all pending/approved lists on individual sites and remove this user from them.
6832		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
6833	5285	$sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
6834	5286	foreach ( $sites as $site ) {
6835	5287	$blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
6836	5288	$this->remove_network_user_from_site_when_removed( $user_id, $blog_id );
		@@ -6840,27 +5292,22 @@
6840	5292
6841	5293
6842	5294	/**
6843	5295	* Remove multisite user from a specific site's lists when that user is removed from the site.
6844		- *
6845		- * Action: remove_user_from_blog
6846		- *
6847		- * @param int $user_id User ID to remove.
6848		- * @param int $blog_id Blog ID to remove from.
6849		- * @return void
	5296	+ * Run on action hook: remove_user_from_blog
6850	5297	*/
6851		- public function remove_network_user_from_site_when_removed( $user_id, $blog_id ) {
6852		- $user = get_user_by( 'id', $user_id );
	5298	+ function remove_network_user_from_site_when_removed( $user_id, $blog_id ) {
	5299	+ $user = get_user_by( 'id', $user_id );
6853	5300	$deleted_email = $user->user_email;
6854	5301
6855	5302	$list_names = array( 'access_users_pending', 'access_users_approved' );
6856	5303	foreach ( $list_names as $list_name ) {
6857		- $user_list = get_blog_option( $blog_id, 'auth_settings_' . $list_name, array() );
	5304	+ $user_list = get_blog_option( $blog_id, 'auth_settings_' . $list_name, array() );
6858	5305	$list_changed = false;
6859	5306	foreach ( $user_list as $key => $existing_user ) {
6860		- if ( 0 === strcasecmp( $deleted_email, $existing_user['email'] ) ) {
	5307	+ if ( $deleted_email === $existing_user['email'] ) {
6861	5308	$list_changed = true;
6862		- unset( $user_list[ $key ] );
	5309	+ unset( $user_list[$key] );
6863	5310	}
6864	5311	}
6865	5312	if ( $list_changed ) {
6866	5313	update_blog_option( $blog_id, 'auth_settings_' . $list_name, $user_list );
		@@ -6870,30 +5317,26 @@
6870	5317
6871	5318
6872	5319	/**
6873	5320	* Helper: Add multisite user to a specific site's approved list.
6874		- *
6875		- * @param int $user_id User ID to add.
6876		- * @param int $blog_id Blog ID to add to.
6877		- * @return void
6878	5321	*/
6879		- private function add_network_user_to_site( $user_id, $blog_id ) {
	5322	+ function add_network_user_to_site( $user_id, $blog_id ) {
6880	5323	// Switch to blog.
6881	5324	switch_to_blog( $blog_id );
6882	5325
6883	5326	// Get user details and role.
6884		- $access_default_role = $this->get_plugin_option( 'access_default_role', WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
6885		- $user = get_user_by( 'id', $user_id );
6886		- $user_email = $user->user_email;
6887		- $user_role = $user && is_array( $user->roles ) && count( $user->roles ) > 0 ? $user->roles[0] : $access_default_role;
	5327	+ $access_default_role = $this->get_plugin_option( 'access_default_role', SINGLE_ADMIN, 'allow override' );
	5328	+ $user = get_user_by( 'id', $user_id );
	5329	+ $user_email = $user->user_email;
	5330	+ $user_role = $user && is_array( $user->roles ) && count( $user->roles ) > 0 ? $user->roles[0] : $access_default_role;
6888	5331
6889	5332	// Add user to approved list if not already there and not in blocked list.
6890		- $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT );
6891		- $auth_settings_access_users_blocked = $this->get_plugin_option( 'access_users_blocked', WP_Plugin_Authorizer::SINGLE_CONTEXT );
	5333	+ $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN );
	5334	+ $auth_settings_access_users_blocked = $this->get_plugin_option( 'access_users_blocked', SINGLE_ADMIN );
6892	5335	if ( ! $this->in_multi_array( $user_email, $auth_settings_access_users_approved ) && ! $this->in_multi_array( $user_email, $auth_settings_access_users_blocked ) ) {
6893	5336	$approved_user = array(
6894		- 'email' => $this->lowercase( $user_email ),
6895		- 'role' => $user_role,
	5337	+ 'email' => $user_email,
	5338	+ 'role' => $user_role,
6896	5339	'date_added' => date( 'M Y', strtotime( $user->user_registered ) ),
6897	5340	'local_user' => true,
6898	5341	);
6899	5342	array_push( $auth_settings_access_users_approved, $approved_user );
		@@ -6910,17 +5353,17 @@
6910	5353	* When an existing user is invited to the current site (or a new user is created),
6911	5354	* add them to the authorizer approved list. This action fires when the admin
6912	5355	* doesn't select the "Skip Confirmation Email" option.
6913	5356	*
6914		- * Action: invite_user
	5357	+ * @action invite_user
6915	5358	*
6916		- * @param int $user_id The invited user's ID.
6917		- * @param array $role The role of the invited user (or none if a new user creation).
	5359	+ * @param int $user_id The invited user's ID.
	5360	+ * @param array $role The role of the invited user (or none if a new user creation).
6918	5361	* @param string $newuser_key The key of the invitation.
6919	5362	*/
6920		- public function add_existing_user_to_authorizer_when_created( $user_id, $role = array(), $newuser_key = '' ) {
	5363	+ function add_existing_user_to_authorizer_when_created( $user_id, $role = array(), $newuser_key = '' ) {
6921	5364	$user = get_user_by( 'id', $user_id );
6922		- $this->add_user_to_authorizer_when_created( $user->user_email, $user->user_registered, $user->roles, $role );
	5365	+ $this->add_user_to_authorizer_when_created( $user->user_email, $user->user_registered, $user->user_roles, $role );
6923	5366	}
6924	5367
6925	5368
6926	5369	/**
		@@ -6928,16 +5371,16 @@
6928	5371	* When an existing user is invited to the current site (or a new user is created),
6929	5372	* add them to the authorizer approved list. This action fires when the admin
6930	5373	* selects the "Skip Confirmation Email" option.
6931	5374	*
6932		- * Action: added_existing_user
	5375	+ * @action added_existing_user
6933	5376	*
6934		- * @param int $user_id The invited user's ID.
6935		- * @param mixed $result True on success or a WP_Error object if the user doesn't exist.
	5377	+ * @param int $user_id The invited user's ID.
	5378	+ * @param mixed $result True on success or a WP_Error object if the user doesn't exist.
6936	5379	*/
6937		- public function add_existing_user_to_authorizer_when_created_noconfirmation( $user_id, $result ) {
	5380	+ function add_existing_user_to_authorizer_when_created_noconfirmation( $user_id, $result ) {
6938	5381	$user = get_user_by( 'id', $user_id );
6939		- $this->add_user_to_authorizer_when_created( $user->user_email, $user->user_registered, $user->roles );
	5382	+ $this->add_user_to_authorizer_when_created( $user->user_email, $user->user_registered, $user->user_roles );
6940	5383	}
6941	5384
6942	5385
6943	5386	/**
		@@ -6944,18 +5387,17 @@
6944	5387	* Multisite:
6945	5388	* When a new user is invited to the current site (or a new user is created),
6946	5389	* add them to the authorizer approved list.
6947	5390	*
6948		- * Action: after_signup_user
	5391	+ * @action after_signup_user
6949	5392	*
6950		- * @param string $user User's requested login name.
	5393	+ * @param string $user User's requested login name.
6951	5394	* @param string $user_email User's email address.
6952		- * @param string $key User's activation key.
6953		- * @param array $meta Additional signup meta, including initially set roles.
	5395	+ * @param string $key User's activation key.
	5396	+ * @param array $meta Additional signup meta.
6954	5397	*/
6955		- public function add_new_user_to_authorizer_when_created( $user, $user_email, $key, $meta ) {
6956		- $user_roles = isset( $meta['new_role'] ) ? array( $meta['new_role'] ) : array();
6957		- $this->add_user_to_authorizer_when_created( $user_email, time(), $user_roles );
	5398	+ function add_new_user_to_authorizer_when_created( $user, $user_email, $key, $meta ) {
	5399	+ $this->add_user_to_authorizer_when_created( $user_email, time() );
6958	5400	}
6959	5401
6960	5402
6961	5403	/**
		@@ -6962,18 +5404,17 @@
6962	5404	* Single site:
6963	5405	* When a new user is added in single site mode, add them to the authorizer
6964	5406	* approved list.
6965	5407	*
6966		- * Action: edit_user_created_user
	5408	+ * @action edit_user_created_user
6967	5409	*
6968		- * @param int $user_id ID of the newly created user.
6969		- * @param string $notify Type of notification that should happen. See
6970		- * wp_send_new_user_notifications() for more
6971		- * information on possible values.
	5410	+ * @param int $user_id ID of the newly created user.
	5411	+ * @param string $notify Type of notification that should happen. See wp_send_new_user_notifications()
	5412	+ * for more information on possible values.
6972	5413	*/
6973		- public function add_new_user_to_authorizer_when_created_single_site( $user_id, $notify ) {
	5414	+ function add_new_user_to_authorizer_when_created_single_site( $user_id, $notify ) {
6974	5415	$user = get_user_by( 'id', $user_id );
6975		- $this->add_user_to_authorizer_when_created( $user->user_email, $user->user_registered, $user->roles );
	5416	+ $this->add_user_to_authorizer_when_created( $user->user_email, $user->user_registered, $user->user_roles );
6976	5417	}
6977	5418
6978	5419
6979	5420	/**
		@@ -6978,19 +5419,14 @@
6978	5419
6979	5420	/**
6980	5421	* Helper: When a new user is added/invited to the current site (or a new
6981	5422	* user is created), add them to the authorizer approved list.
6982		- *
6983		- * @param string $user_email Email address of user to add.
6984		- * @param string $date_registered Date user registered.
6985		- * @param array $user_roles Role to add for user.
6986		- * @param array $default_role Default role, if no role specified.
6987	5423	*/
6988	5424	private function add_user_to_authorizer_when_created( $user_email, $date_registered, $user_roles = array(), $default_role = array() ) {
6989		- $auth_multisite_settings_access_users_approved = is_multisite() ? get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', array() ) : array();
6990		- $auth_settings_access_users_pending = $this->get_plugin_option( 'access_users_pending', WP_Plugin_Authorizer::SINGLE_CONTEXT );
6991		- $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT );
6992		- $auth_settings_access_users_blocked = $this->get_plugin_option( 'access_users_blocked', WP_Plugin_Authorizer::SINGLE_CONTEXT );
	5425	+ $auth_multisite_settings_access_users_approved = is_multisite() ? get_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', array() ) : array();
	5426	+ $auth_settings_access_users_pending = $this->get_plugin_option( 'access_users_pending', SINGLE_ADMIN );
	5427	+ $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN );
	5428	+ $auth_settings_access_users_blocked = $this->get_plugin_option( 'access_users_blocked', SINGLE_ADMIN );
6993	5429
6994	5430	// Get default role if one isn't specified.
6995	5431	if ( count( $default_role ) < 1 ) {
6996	5432	$default_role = '';
		@@ -7005,10 +5441,10 @@
7005	5441	return;
7006	5442	}
7007	5443	// Remove from pending list if there.
7008	5444	foreach ( $auth_settings_access_users_pending as $key => $pending_user ) {
7009		- if ( 0 === strcasecmp( $pending_user['email'], $user_email ) ) {
7010		- unset( $auth_settings_access_users_pending[ $key ] );
	5445	+ if ( $pending_user['email'] == $user_email ) {
	5446	+ unset( $auth_settings_access_users_pending[$key] );
7011	5447	$updated = true;
7012	5448	}
7013	5449	}
7014	5450	// Skip if user is in multisite approved list.
		@@ -7017,10 +5453,10 @@
7017	5453	}
7018	5454	// Add to approved list if not there.
7019	5455	if ( ! $this->in_multi_array( $user_email, $auth_settings_access_users_approved ) ) {
7020	5456	$approved_user = array(
7021		- 'email' => $this->lowercase( $user_email ),
7022		- 'role' => is_array( $user_roles ) && count( $user_roles ) > 0 ? $user_roles[0] : $default_role,
	5457	+ 'email' => $user_email,
	5458	+ 'role' => is_array( $user_roles ) && count( $user_roles ) > 0 ? $user_roles[0] : $default_role,
7023	5459	'date_added' => date( 'M Y', strtotime( $date_registered ) ),
7024	5460	'local_user' => true,
7025	5461	);
7026	5462	array_push( $auth_settings_access_users_approved, $approved_user );
		@@ -7039,33 +5475,32 @@
7039	5475	* When a user is granted super admin status (checkbox on network user edit
7040	5476	* screen), add them to the authorizer network approved list. Also remove
7041	5477	* them from pending/approved list on any individual sites.
7042	5478	*
7043		- * Action: grant_super_admin
	5479	+ * @action grant_super_admin
7044	5480	*
7045	5481	* @param int $user_id The user's ID.
7046	5482	*/
7047		- public function grant_super_admin__add_to_network_approved( $user_id ) {
7048		- $user = get_user_by( 'id', $user_id );
	5483	+ function grant_super_admin__add_to_network_approved( $user_id ) {
	5484	+ $user = get_user_by( 'id', $user_id );
7049	5485	$user_email = $user->user_email;
7050	5486
7051	5487	// Add user to multisite approved user list (if not already there).
7052	5488	$auth_multisite_settings_access_users_approved = $this->sanitize_user_list(
7053		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT )
	5489	+ $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN )
7054	5490	);
7055	5491	if ( ! $this->in_multi_array( $user_email, $auth_multisite_settings_access_users_approved ) ) {
7056	5492	$multisite_approved_user = array(
7057		- 'email' => $this->lowercase( $user_email ),
7058		- 'role' => count( $user->roles ) > 0 ? $user->roles[0] : 'administrator',
	5493	+ 'email' => $user_email,
	5494	+ 'role' => count( $user->roles ) > 0 ? $user->roles[0] : 'administrator',
7059	5495	'date_added' => date( 'M Y', strtotime( $user->user_registered ) ),
7060	5496	'local_user' => true,
7061	5497	);
7062	5498	array_push( $auth_multisite_settings_access_users_approved, $multisite_approved_user );
7063		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
	5499	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
7064	5500	}
7065	5501
7066	5502	// Go through all pending/approved lists on individual sites and remove this user from them.
7067		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
7068	5503	$sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
7069	5504	foreach ( $sites as $site ) {
7070	5505	$blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
7071	5506	$this->remove_network_user_from_site_when_removed( $user_id, $blog_id );
		@@ -7078,29 +5513,29 @@
7078	5513	* When a user's super admin status is revoked (checkbox on network user edit
7079	5514	* screen), remove them from the authorizer network approved list. Also add
7080	5515	* them to approved list on any individual sites they are already a part of.
7081	5516	*
7082		- * Action: revoke_super_admin
	5517	+ * @action revoke_super_admin
7083	5518	*
7084	5519	* @param int $user_id The user's ID.
7085	5520	*/
7086		- public function revoke_super_admin__remove_from_network_approved( $user_id ) {
7087		- $user = get_user_by( 'id', $user_id );
	5521	+ function revoke_super_admin__remove_from_network_approved( $user_id ) {
	5522	+ $user = get_user_by( 'id', $user_id );
7088	5523	$revoked_email = $user->user_email;
7089	5524
7090	5525	// Go through multisite approved user list and remove this user.
7091	5526	$auth_multisite_settings_access_users_approved = $this->sanitize_user_list(
7092		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT )
	5527	+ $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN )
7093	5528	);
7094		- $list_changed = false;
	5529	+ $list_changed = false;
7095	5530	foreach ( $auth_multisite_settings_access_users_approved as $key => $existing_user ) {
7096		- if ( 0 === strcasecmp( $revoked_email, $existing_user['email'] ) ) {
	5531	+ if ( $revoked_email === $existing_user['email'] ) {
7097	5532	$list_changed = true;
7098		- unset( $auth_multisite_settings_access_users_approved[ $key ] );
	5533	+ unset( $auth_multisite_settings_access_users_approved[$key] );
7099	5534	}
7100	5535	}
7101	5536	if ( $list_changed ) {
7102		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
	5537	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
7103	5538	}
7104	5539
7105	5540	// Go through this user's current sites and add them to the approved list
7106	5541	// (since they are no longer on the network approved list).
		@@ -7111,21 +5546,14 @@
7111	5546	}
7112	5547
7113	5548	}
7114	5549
7115		- /**
7116		- * Send a welcome email message to a newly approved user (if the "Should
7117		- * email approved users" setting is enabled).
7118		- *
7119		- * @param string $email Email address to send welcome email to.
7120		- * @return bool Whether the email was sent.
7121		- */
7122	5550	private function maybe_email_welcome_message( $email ) {
7123	5551	// Get option for whether to email welcome messages.
7124	5552	$should_email_new_approved_users = $this->get_plugin_option( 'access_should_email_approved_users' );
7125	5553
7126	5554	// Do not send welcome email if option not enabled.
7127		- if ( '1' !== $should_email_new_approved_users ) {
	5555	+ if ( $should_email_new_approved_users !== '1' ) {
7128	5556	return false;
7129	5557	}
7130	5558
7131	5559	// Make sure we didn't just email this user (can happen with
		@@ -7131,15 +5559,15 @@
7131	5559	// Make sure we didn't just email this user (can happen with
7132	5560	// multiple admins saving at the same time, or by clicking
7133	5561	// Approve button too rapidly).
7134	5562	$recently_sent_emails = get_option( 'auth_settings_recently_sent_emails' );
7135		- if ( false === $recently_sent_emails ) {
	5563	+ if ( $recently_sent_emails === FALSE ) {
7136	5564	$recently_sent_emails = array();
7137	5565	}
7138	5566	foreach ( $recently_sent_emails as $key => $recently_sent_email ) {
7139	5567	if ( $recently_sent_email['time'] < strtotime( 'now -1 minutes' ) ) {
7140	5568	// Remove emails sent more than 1 minute ago.
7141		- unset( $recently_sent_emails[ $key ] );
	5569	+ unset( $recently_sent_emails[$key] );
7142	5570	} elseif ( $recently_sent_email['email'] === $email ) {
7143	5571	// Sent an email to this user within the last 1 minute, so
7144	5572	// quit without sending.
7145	5573	return false;
		@@ -7147,15 +5575,15 @@
7147	5575	}
7148	5576	// Add the email we're about to send to the list.
7149	5577	$recently_sent_emails[] = array(
7150	5578	'email' => $email,
7151		- 'time' => time(),
	5579	+ 'time' => time(),
7152	5580	);
7153	5581	update_option( 'auth_settings_recently_sent_emails', $recently_sent_emails );
7154	5582
7155		- // Get welcome email subject and body text.
	5583	+ // Get welcome email subject and body text
7156	5584	$subject = $this->get_plugin_option( 'access_email_approved_users_subject' );
7157		- $body = apply_filters( 'the_content', $this->get_plugin_option( 'access_email_approved_users_body' ) );
	5585	+ $body = apply_filters( 'the_content', $this->get_plugin_option( 'access_email_approved_users_body' ) );
7158	5586
7159	5587	// Fail if the subject/body options don't exist or are empty.
7160	5588	if ( is_null( $subject ) || is_null( $body ) || strlen( $subject ) === 0 || strlen( $body ) === 0 ) {
7161	5589	return false;
		@@ -7162,14 +5590,14 @@
7162	5590	}
7163	5591
7164	5592	// Replace approved shortcode patterns in subject and body.
7165	5593	$site_name = get_bloginfo( 'name' );
7166		- $site_url = get_site_url();
7167		- $subject = str_replace( '[site_name]', $site_name, $subject );
7168		- $body = str_replace( '[site_name]', $site_name, $body );
7169		- $body = str_replace( '[site_url]', $site_url, $body );
7170		- $body = str_replace( '[user_email]', $email, $body );
7171		- $headers = 'Content-type: text/html' . "\r\n";
	5594	+ $site_url = get_site_url();
	5595	+ $subject = str_replace( '[site_name]', $site_name, $subject );
	5596	+ $body = str_replace( '[site_name]', $site_name, $body );
	5597	+ $body = str_replace( '[site_url]', $site_url, $body );
	5598	+ $body = str_replace( '[user_email]', $email, $body );
	5599	+ $headers = 'Content-type: text/html' . "\r\n";
7172	5600
7173	5601	// Send email.
7174	5602	wp_mail( $email, $subject, $body, $headers );
7175	5603
		@@ -7179,22 +5607,14 @@
7179	5607
7180	5608
7181	5609	/**
7182	5610	* Generate a unique cookie to add to nonces to prevent CSRF.
7183		- *
7184		- * @var string
7185	5611	*/
7186		- private $cookie_value = null;
7187		-
7188		- /**
7189		- * Retrieve the unique login cookie.
7190		- *
7191		- * @return string Login cookie value.
7192		- */
7193		- private function get_cookie_value() {
	5612	+ protected $cookie_value = null;
	5613	+ function get_cookie_value() {
7194	5614	if ( ! $this->cookie_value ) {
7195	5615	if ( isset( $_COOKIE['login_unique'] ) ) {
7196		- $this->cookie_value = sanitize_key( wp_unslash( $_COOKIE['login_unique'] ) );
	5616	+ $this->cookie_value = $_COOKIE['login_unique'];
7197	5617	} else {
7198	5618	$this->cookie_value = md5( rand() );
7199	5619	}
7200	5620	}
		@@ -7202,51 +5622,37 @@
7202	5622	}
7203	5623
7204	5624
7205	5625	/**
7206		- * Encryption key (not secret!).
7207		- *
7208		- * @var string
7209		- */
7210		- private static $key = "8QxnrvjdtweisvCBKEY!+0\0\0";
7211		-
7212		- /**
7213		- * Encryption salt (not secret!).
7214		- *
7215		- * @var string
7216		- */
7217		- private static $iv = 'R_O2D]jPn]1[fhJl!-P1.oe';
7218		-
7219		- /**
7220	5626	* Basic encryption using a public (not secret!) key. Used for general
7221	5627	* database obfuscation of passwords.
7222		- *
7223		- * @param string $text String to encrypt.
7224		- * @param string $library Encryption library to use (openssl).
7225		- * @return string Encrypted string.
	5628	+ * @param $text String to encrypt.
	5629	+ * @param $library Encryption lib to use (openssl).
	5630	+ * @return Encrypted string
7226	5631	*/
7227		- private function encrypt( $text, $library = 'openssl' ) {
	5632	+ private static $key = "8QxnrvjdtweisvCBKEY!+0\0\0";
	5633	+ private static $iv = "R_O2D]jPn]1[fhJl!-P1.oe";
	5634	+ function encrypt( $text, $library = 'openssl' ) {
7228	5635	$result = '';
7229	5636
7230	5637	// Use openssl library (better) if it is enabled.
7231		- if ( function_exists( 'openssl_encrypt' ) && 'openssl' === $library ) {
7232		- $result = base64_encode(
7233		- openssl_encrypt(
7234		- $text,
7235		- 'AES-256-CBC',
7236		- hash( 'sha256', self::$key ),
7237		- 0,
7238		- substr( hash( 'sha256', self::$iv ), 0, 16 )
7239		- )
7240		- );
7241		- } elseif ( function_exists( 'mcrypt_encrypt' ) ) { // Use mcrypt library (deprecated in PHP 7.1) if php5-mcrypt extension is enabled.
	5638	+ if ( function_exists( 'openssl_encrypt' ) && $library === 'openssl' ) {
	5639	+ $result = base64_encode( openssl_encrypt(
	5640	+ $text,
	5641	+ 'AES-256-CBC',
	5642	+ hash( 'sha256', self::$key ),
	5643	+ 0,
	5644	+ substr( hash( 'sha256', self::$iv ), 0, 16 )
	5645	+ ) );
	5646	+ // Use mcrypt library (deprecated in PHP 7.1) if php5-mcrypt extension is enabled.
	5647	+ } else if ( function_exists( 'mcrypt_encrypt' ) ) {
7242	5648	$result = base64_encode( mcrypt_encrypt( MCRYPT_RIJNDAEL_256, self::$key, $text, MCRYPT_MODE_ECB, 'abcdefghijklmnopqrstuvwxyz012345' ) );
7243		- } else { // Fall back to basic obfuscation.
7244		- $length = strlen( $text );
7245		- for ( $i = 0; $i < $length; $i++ ) {
7246		- $char = substr( $text, $i, 1 );
	5649	+ // Fall back to basic obfuscation.
	5650	+ } else {
	5651	+ for ( $i = 0; $i < strlen( $text ); $i++ ) {
	5652	+ $char = substr( $text, $i, 1 );
7247	5653	$keychar = substr( self::$key, ( $i % strlen( self::$key ) ) - 1, 1 );
7248		- $char = chr( ord( $char ) + ord( $keychar ) );
	5654	+ $char = chr( ord( $char ) + ord( $keychar ) );
7249	5655	$result .= $char;
7250	5656	}
7251	5657	$result = base64_encode( $result );
7252	5658	}
		@@ -7257,18 +5663,17 @@
7257	5663
7258	5664	/**
7259	5665	* Basic decryption using a public (not secret!) key. Used for general
7260	5666	* database obfuscation of passwords.
7261		- *
7262		- * @param string $secret String to encrypt.
7263		- * @param string $library Encryption lib to use (openssl).
7264		- * @return string Decrypted string
	5667	+ * @param $text String to encrypt.
	5668	+ * @param $library Encryption lib to use (openssl).
	5669	+ * @return Decrypted string
7265	5670	*/
7266		- private function decrypt( $secret, $library = 'openssl' ) {
	5671	+ function decrypt( $secret, $library = 'openssl' ) {
7267	5672	$result = '';
7268	5673
7269	5674	// Use openssl library (better) if it is enabled.
7270		- if ( function_exists( 'openssl_decrypt' ) && 'openssl' === $library ) {
	5675	+ if ( function_exists( 'openssl_decrypt' ) && $library === 'openssl' ) {
7271	5676	$result = openssl_decrypt(
7272	5677	base64_decode( $secret ),
7273	5678	'AES-256-CBC',
7274	5679	hash( 'sha256', self::$key ),
		@@ -7274,18 +5679,19 @@
7274	5679	hash( 'sha256', self::$key ),
7275	5680	0,
7276	5681	substr( hash( 'sha256', self::$iv ), 0, 16 )
7277	5682	);
7278		- } elseif ( function_exists( 'mcrypt_decrypt' ) ) { // Use mcrypt library (deprecated in PHP 7.1) if php5-mcrypt extension is enabled.
	5683	+ // Use mcrypt library (deprecated in PHP 7.1) if php5-mcrypt extension is enabled.
	5684	+ } else if ( function_exists( 'mcrypt_decrypt' ) ) {
7279	5685	$secret = base64_decode( $secret );
7280	5686	$result = rtrim( mcrypt_decrypt( MCRYPT_RIJNDAEL_256, self::$key, $secret, MCRYPT_MODE_ECB, 'abcdefghijklmnopqrstuvwxyz012345' ), "\0$result" );
7281		- } else { // Fall back to basic obfuscation.
	5687	+ // Fall back to basic obfuscation.
	5688	+ } else {
7282	5689	$secret = base64_decode( $secret );
7283		- $length = strlen( $secret );
7284		- for ( $i = 0; $i < $length; $i++ ) {
7285		- $char = substr( $secret, $i, 1 );
	5690	+ for ( $i = 0; $i < strlen( $secret ); $i++ ) {
	5691	+ $char = substr( $secret, $i, 1 );
7286	5692	$keychar = substr( self::$key, ( $i % strlen( self::$key ) ) - 1, 1 );
7287		- $char = chr( ord( $char ) - ord( $keychar ) );
	5693	+ $char = chr( ord( $char ) - ord( $keychar ) );
7288	5694	$result .= $char;
7289	5695	}
7290	5696	}
7291	5697
		@@ -7296,12 +5702,10 @@
7296	5702	/**
7297	5703	* In a multisite environment, returns true if the current user is logged
7298	5704	* in and a user of the current blog. In single site mode, simply returns
7299	5705	* true if the current user is logged in.
7300		- *
7301		- * @return bool Whether current user is logged in and a user of the current blog.
7302	5706	*/
7303		- protected function is_user_logged_in_and_blog_user() {
	5707	+ function is_user_logged_in_and_blog_user() {
7304	5708	$is_user_logged_in_and_blog_user = false;
7305	5709	if ( is_multisite() ) {
7306	5710	$is_user_logged_in_and_blog_user = is_user_logged_in() && is_user_member_of_blog( get_current_user_id() );
7307	5711	} else {
		@@ -7314,42 +5718,39 @@
7314	5718	/**
7315	5719	* Helper function to determine whether a given email is in one of
7316	5720	* the lists (pending, approved, blocked). Defaults to the list of
7317	5721	* approved users.
7318		- *
7319		- * @param string $email Email to check existent of.
7320		- * @param string $list List to look for email in.
7321		- * @param string $multisite_mode Admin context.
7322		- * @return boolean Whether email was found.
7323	5722	*/
7324		- protected function is_email_in_list( $email = '', $list = 'approved', $multisite_mode = 'single' ) {
7325		- if ( empty( $email ) ) {
	5723	+ function is_email_in_list( $email = '', $list = 'approved', $multisite_mode = 'single' ) {
	5724	+ if ( empty( $email ) )
7326	5725	return false;
7327		- }
7328	5726
7329	5727	switch ( $list ) {
7330		- case 'pending':
7331		- $auth_settings_access_users_pending = $this->get_plugin_option( 'access_users_pending', WP_Plugin_Authorizer::SINGLE_CONTEXT );
7332		- return $this->in_multi_array( $email, $auth_settings_access_users_pending );
7333		- case 'blocked':
7334		- $auth_settings_access_users_blocked = $this->get_plugin_option( 'access_users_blocked', WP_Plugin_Authorizer::SINGLE_CONTEXT );
7335		- return $this->in_multi_array( $email, $auth_settings_access_users_blocked );
7336		- case 'approved':
7337		- default:
7338		- if ( 'single' !== $multisite_mode ) {
7339		- // Get multisite users only.
7340		- $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT );
7341		- } elseif ( is_multisite() && 1 === intval( $this->get_plugin_option( 'advanced_override_multisite' ) ) ) {
7342		- // This site has overridden any multisite settings, so only get its users.
7343		- $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT );
7344		- } else {
7345		- // Get all site users and all multisite users.
7346		- $auth_settings_access_users_approved = array_merge(
7347		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT ),
7348		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT )
7349		- );
7350		- }
7351		- return $this->in_multi_array( $email, $auth_settings_access_users_approved );
	5728	+ case 'pending':
	5729	+ $auth_settings_access_users_pending = $this->get_plugin_option( 'access_users_pending', SINGLE_ADMIN );
	5730	+ return $this->in_multi_array( $email, $auth_settings_access_users_pending );
	5731	+ break;
	5732	+ case 'blocked':
	5733	+ $auth_settings_access_users_blocked = $this->get_plugin_option( 'access_users_blocked', SINGLE_ADMIN );
	5734	+ return $this->in_multi_array( $email, $auth_settings_access_users_blocked );
	5735	+ break;
	5736	+ case 'approved':
	5737	+ default:
	5738	+ if ( $multisite_mode !== 'single' ) {
	5739	+ // Get multisite users only.
	5740	+ $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN );
	5741	+ } elseif ( is_multisite() && $this->get_plugin_option( 'advanced_override_multisite' ) == '1' ) {
	5742	+ // This site has overridden any multisite settings, so only get its users.
	5743	+ $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN );
	5744	+ } else {
	5745	+ // Get all site users and all multisite users.
	5746	+ $auth_settings_access_users_approved = array_merge(
	5747	+ $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN ),
	5748	+ $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN )
	5749	+ );
	5750	+ }
	5751	+ return $this->in_multi_array( $email, $auth_settings_access_users_approved );
	5752	+ break;
7352	5753	}
7353	5754	}
7354	5755
7355	5756
		@@ -7355,37 +5756,36 @@
7355	5756
7356	5757	/**
7357	5758	* Helper function to get number of users (including multisite users)
7358	5759	* in a given list (pending, approved, or blocked).
7359		- *
7360		- * @param string $list List to get count of.
7361		- * @param string $admin_mode WP_Plugin_Authorizer::SINGLE_CONTEXT or WP_Plugin_Authorizer::NETWORK_CONTEXT determines whether to include multisite users.
7362		- * @return int Number of users in list.
	5760	+ * @param string $list
	5761	+ * @param string $admin_mode SINGLE_ADMIN or MULTISITE_ADMIN determines whether to include multisite users
	5762	+ * @return int number of users in list
7363	5763	*/
7364		- protected function get_user_count_from_list( $list, $admin_mode = WP_Plugin_Authorizer::SINGLE_CONTEXT ) {
	5764	+ function get_user_count_from_list( $list, $admin_mode = SINGLE_ADMIN ) {
7365	5765	$auth_settings_access_users = array();
7366	5766
7367	5767	switch ( $list ) {
7368		- case 'pending':
7369		- $auth_settings_access_users = $this->get_plugin_option( 'access_users_pending', WP_Plugin_Authorizer::SINGLE_CONTEXT );
7370		- break;
7371		- case 'blocked':
7372		- $auth_settings_access_users = $this->get_plugin_option( 'access_users_blocked', WP_Plugin_Authorizer::SINGLE_CONTEXT );
7373		- break;
7374		- case 'approved':
7375		- if ( WP_Plugin_Authorizer::SINGLE_CONTEXT !== $admin_mode ) {
7376		- // Get multisite users only.
7377		- $auth_settings_access_users = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT );
7378		- } elseif ( is_multisite() && 1 === intval( $this->get_plugin_option( 'advanced_override_multisite' ) ) ) {
7379		- // This site has overridden any multisite settings, so only get its users.
7380		- $auth_settings_access_users = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT );
7381		- } else {
7382		- // Get all site users and all multisite users.
7383		- $auth_settings_access_users = array_merge(
7384		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT ),
7385		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT )
7386		- );
7387		- }
	5768	+ case 'pending':
	5769	+ $auth_settings_access_users = $this->get_plugin_option( 'access_users_pending', SINGLE_ADMIN );
	5770	+ break;
	5771	+ case 'blocked':
	5772	+ $auth_settings_access_users = $this->get_plugin_option( 'access_users_blocked', SINGLE_ADMIN );
	5773	+ break;
	5774	+ case 'approved':
	5775	+ if ( $admin_mode !== SINGLE_ADMIN ) {
	5776	+ // Get multisite users only.
	5777	+ $auth_settings_access_users = $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN );
	5778	+ } elseif ( is_multisite() && $this->get_plugin_option( 'advanced_override_multisite' ) == '1' ) {
	5779	+ // This site has overridden any multisite settings, so only get its users.
	5780	+ $auth_settings_access_users = $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN );
	5781	+ } else {
	5782	+ // Get all site users and all multisite users.
	5783	+ $auth_settings_access_users = array_merge(
	5784	+ $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN ),
	5785	+ $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN )
	5786	+ );
	5787	+ }
7388	5788	}
7389	5789
7390	5790	return count( $auth_settings_access_users );
7391	5791	}
		@@ -7392,27 +5792,21 @@
7392	5792
7393	5793
7394	5794	/**
7395	5795	* Helper function to search a multidimensional array for a value.
7396		- *
7397		- * @param string $needle Value to search for.
7398		- * @param array $haystack Multidimensional array to search.
7399		- * @param string $strict_mode 'strict' if strict comparisons should be used.
7400		- * @param string $case_sensitivity 'case sensitive' if comparisons should respect case.
7401		- * @return bool Whether needle was found.
7402	5796	*/
7403		- protected function in_multi_array( $needle = '', $haystack = array(), $strict_mode = 'not strict', $case_sensitivity = 'case insensitive' ) {
	5797	+ function in_multi_array( $needle = '', $haystack = array(), $strict_mode = 'not strict', $case_sensitivity = 'case insensitive' ) {
7404	5798	if ( ! is_array( $haystack ) ) {
7405	5799	return false;
7406	5800	}
7407		- if ( 'case insensitive' === $case_sensitivity ) {
	5801	+ if ( $case_sensitivity === 'case insensitive' ) {
7408	5802	$needle = strtolower( $needle );
7409	5803	}
7410	5804	foreach ( $haystack as $item ) {
7411		- if ( 'case insensitive' === $case_sensitivity && ! is_array( $item ) ) {
	5805	+ if ( $case_sensitivity === 'case insensitive' && ! is_array( $item ) ) {
7412	5806	$item = strtolower( $item );
7413	5807	}
7414		- if ( ( 'strict' === $strict_mode ? $item === $needle : $item == $needle ) || ( is_array( $item ) && $this->in_multi_array( $needle, $item, $strict_mode, $case_sensitivity ) ) ) { // phpcs:ignore WordPress.PHP.StrictComparisons.LooseComparison
	5808	+ if ( ( $strict_mode === 'strict' ? $item === $needle : $item == $needle ) || ( is_array( $item ) && $this->in_multi_array( $needle, $item, $strict_mode, $case_sensitivity ) ) ) {
7415	5809	return true;
7416	5810	}
7417	5811	}
7418	5812	return false;
		@@ -7419,31 +5813,43 @@
7419	5813	}
7420	5814
7421	5815
7422	5816	/**
	5817	+ * Helper function to get a WordPress page ID from the pagename.
	5818	+ *
	5819	+ * @param string $pagename Page Slug
	5820	+ * @return int Page/Post ID
	5821	+ */
	5822	+ function get_id_from_pagename( $pagename = '' ) {
	5823	+ global $wpdb;
	5824	+ $page_id = $wpdb->get_var( "SELECT ID FROM $wpdb->posts WHERE post_name = '" . sanitize_title_for_query( $pagename ) . "'" );
	5825	+ return $page_id;
	5826	+ }
	5827	+
	5828	+
	5829	+ /**
7423	5830	* Helper function to determine if an URL is accessible.
7424	5831	*
7425		- * @param string $url URL that should be publicly reachable.
7426		- * @return boolean Whether the URL is publicly reachable.
	5832	+ * @param string $url URL that should be publicly reachable
	5833	+ * @return boolean Whether the URL is publicly reachable
7427	5834	*/
7428		- protected function url_is_accessible( $url ) {
	5835	+ function url_is_accessible( $url ) {
7429	5836	// Use wp_remote_retrieve_response_code() to retrieve the URL.
7430		- $response = wp_remote_get( $url );
	5837	+ $response = wp_remote_get( $url );
7431	5838	$response_code = wp_remote_retrieve_response_code( $response );
7432	5839
7433		- // Return true if the document has loaded successfully without any redirection or error.
7434		- return $response_code >= 200 && $response_code < 400;
	5840	+ // Return true if the document has loaded successfully without any redirection or error
	5841	+ return $response_code >= 200 && $response_code < 300;
7435	5842	}
7436	5843
7437	5844
7438	5845	/**
7439	5846	* Helper function to reconstruct a URL split using parse_url().
7440		- *
7441		- * @param array $parts Array returned from parse_url().
7442		- * @return string URL.
	5847	+ * @param array $parts Array returned from parse_url().
	5848	+ * @return string URL.
7443	5849	*/
7444		- protected function build_url( $parts = array() ) {
7445		- return (
	5850	+ function build_url( $parts = array() ) {
	5851	+ return
7446	5852	( isset( $parts['scheme'] ) ? "{$parts['scheme']}:" : '' ) .
7447	5853	( ( isset( $parts['user'] ) || isset( $parts['host'] ) ) ? '//' : '' ) .
7448	5854	( isset( $parts['user'] ) ? "{$parts['user']}" : '' ) .
7449	5855	( isset( $parts['pass'] ) ? ":{$parts['pass']}" : '' ) .
		@@ -7451,30 +5857,21 @@
7451	5857	( isset( $parts['host'] ) ? "{$parts['host']}" : '' ) .
7452	5858	( isset( $parts['port'] ) ? ":{$parts['port']}" : '' ) .
7453	5859	( isset( $parts['path'] ) ? "{$parts['path']}" : '' ) .
7454	5860	( isset( $parts['query'] ) ? "?{$parts['query']}" : '' ) .
7455		- ( isset( $parts['fragment'] ) ? "#{$parts['fragment']}" : '' )
7456		- );
	5861	+ ( isset( $parts['fragment'] ) ? "#{$parts['fragment']}" : '' );
7457	5862	}
7458	5863
7459	5864
7460		- /**
7461		- * Helper function that prints option tags for a select element for all
7462		- * roles the current user has permission to assign.
7463		- *
7464		- * @param string $selected_role Which role should be selected in the dropdown.
7465		- * @param string $disable_input 'disabled' if select element should be disabled.
7466		- * @param int $admin_mode WP_Plugin_Authorizer::NETWORK_CONTEXT if we are in that context.
7467		- * @return void
7468		- */
7469		- protected function wp_dropdown_permitted_roles( $selected_role = 'subscriber', $disable_input = 'not disabled', $admin_mode = WP_Plugin_Authorizer::SINGLE_CONTEXT ) {
7470		- $roles = get_editable_roles();
	5865	+ // Helper function that builds option tags for a select element for all
	5866	+ // roles the current user has permission to assign.
	5867	+ function wp_dropdown_permitted_roles( $selected_role = 'subscriber', $disable_input = 'not disabled', $admin_mode = SINGLE_ADMIN ) {
	5868	+ $roles = get_editable_roles();
7471	5869	$current_user = wp_get_current_user();
7472	5870
7473	5871	// If we're in network admin, also show any roles that might exist only on
7474	5872	// specific sites in the network (themes can add their own roles).
7475		- if ( WP_Plugin_Authorizer::NETWORK_CONTEXT === $admin_mode ) {
7476		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
	5873	+ if ( $admin_mode === MULTISITE_ADMIN ) {
7477	5874	$sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
7478	5875	foreach ( $sites as $site ) {
7479	5876	$blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
7480	5877	switch_to_blog( $blog_id );
		@@ -7483,11 +5880,11 @@
7483	5880	}
7484	5881	$unique_role_names = array();
7485	5882	foreach ( $roles as $role_name => $role_info ) {
7486	5883	if ( array_key_exists( $role_name, $unique_role_names ) ) {
7487		- unset( $roles[ $role_name ] );
	5884	+ unset( $roles[$role_name] );
7488	5885	} else {
7489		- $unique_role_names[ $role_name ] = true;
	5886	+ $unique_role_names[$role_name] = true;
7490	5887	}
7491	5888	}
7492	5889	}
7493	5890
		@@ -7499,43 +5896,39 @@
7499	5896	}
7500	5897
7501	5898	// Print an option element for each permitted role.
7502	5899	foreach ( $roles as $name => $role ) {
7503		- $is_selected = $selected_role === $name;
	5900	+ $selected = $selected_role === $name ? ' selected="selected"' : '';
7504	5901
7505		- // Don't let a user change their own role (but network admins always can).
7506		- $is_disabled = $selected_role !== $name && 'disabled' === $disable_input && ! ( is_multisite() && current_user_can( 'manage_network' ) );
7507		- ?>
7508		- <option value="<?php echo esc_attr( $name ); ?>"<?php selected( $is_selected ); ?><?php disabled( $is_disabled ); ?>><?php echo esc_html( $role['name'] ); ?></option>
7509		- <?php
	5902	+ // Don't let a user change their own role
	5903	+ $disabled = $selected_role !== $name && $disable_input === 'disabled' ? ' disabled="disabled"' : '';
	5904	+
	5905	+ // But network admins can always change their role.
	5906	+ if ( is_multisite() && current_user_can( 'manage_network' ) ) {
	5907	+ $disabled = '';
	5908	+ }
	5909	+
	5910	+ ?><option value="<?php echo $name; ?>"<?php echo $selected . $disabled; ?>><?php echo $role['name']; ?></option><?php
7510	5911	}
7511	5912
7512	5913	// Print default role (no role).
7513		- $is_selected = strlen( $selected_role ) === 0 || ! array_key_exists( $selected_role, $roles );
7514		- $is_disabled = strlen( $selected_role ) > 0 && 'disabled' === $disable_input && ! ( is_multisite() && current_user_can( 'manage_network' ) );
7515		- ?>
7516		- <option value=""<?php selected( $is_selected ); ?><?php disabled( $is_disabled ); ?>><?php esc_html_e( '&mdash; No role for this site &mdash;', 'authorizer' ); ?></option>
7517		- <?php
	5914	+ $selected = strlen( $selected_role ) == 0 || ! array_key_exists( $selected_role, $roles ) ? ' selected="selected"' : '';
	5915	+ $disabled = strlen( $selected_role ) > 0 && $disable_input === 'disabled' ? ' disabled="disabled"' : '';
	5916	+ if ( is_multisite() && current_user_can( 'manage_network' ) ) {
	5917	+ $disabled = '';
	5918	+ }
	5919	+ ?><option value=""<?php echo $selected . $disabled; ?>><?php _e( '&mdash; No role for this site &mdash;', 'authorizer' ); ?></option><?php
7518	5920
7519	5921	}
7520	5922
7521	5923
7522		- /**
7523		- * Helper function to get a single user info array from one of the access
7524		- * control lists (pending, approved, or blocked).
7525		- *
7526		- * @param string $email Email address to retrieve info for.
7527		- * @param string $list List to get info from.
7528		- * @return mixed false if not found, otherwise: array(
7529		- * 'email' => '',
7530		- * 'role' => '',
7531		- * 'date_added' => '',
7532		- * ['usermeta' => [''|array()]]
7533		- * );
7534		- */
7535		- protected function get_user_info_from_list( $email, $list ) {
	5924	+ // Helper function to get a single user info array from one of the
	5925	+ // access control lists (pending, approved, or blocked).
	5926	+ // Returns: false if not found; otherwise
	5927	+ // array( 'email' => '', 'role' => '', 'date_added' => '', ['usermeta' => [''|array()]] );
	5928	+ function get_user_info_from_list( $email, $list ) {
7536	5929	foreach ( $list as $user_info ) {
7537		- if ( 0 === strcasecmp( $user_info['email'], $email ) ) {
	5930	+ if ( $user_info['email'] === $email ) {
7538	5931	return $user_info;
7539	5932	}
7540	5933	}
7541	5934	return false;
		@@ -7540,49 +5933,29 @@
7540	5933	}
7541	5934	return false;
7542	5935	}
7543	5936
7544		- /**
7545		- * Helper function to convert a string to lowercase. Prefers to use mb_strtolower,
7546		- * but will fall back to strtolower if the former is not available.
7547		- *
7548		- * @param string $string String to convert to lowercase.
7549		- * @return string Input in lowercase.
7550		- */
7551		- protected function lowercase( $string ) {
7552		- return function_exists( 'mb_strtolower' ) ? mb_strtolower( $string ) : strtolower( $string );
7553		- }
7554	5937
7555		-
7556		- /**
7557		- * Helper function to convert seconds to human readable text.
7558		- *
7559		- * @see: http://csl.name/php-secs-to-human-text/
7560		- *
7561		- * @param int $secs Seconds to display as readable text.
7562		- * @return string Readable version of number of seconds.
7563		- */
7564		- protected function seconds_as_sentence( $secs ) {
	5938	+ // Helper function to convert seconds to human readable text.
	5939	+ // Source: http://csl.name/php-secs-to-human-text/
	5940	+ function seconds_as_sentence( $secs ) {
7565	5941	$units = array(
7566		- 'week' => 3600 * 24 * 7,
7567		- 'day' => 3600 * 24,
7568		- 'hour' => 3600,
7569		- 'minute' => 60,
7570		- 'second' => 1,
	5942	+ "week" => 7 * 24 * 3600,
	5943	+ "day" => 24 * 3600,
	5944	+ "hour" => 3600,
	5945	+ "minute" => 60,
	5946	+ "second" => 1,
7571	5947	);
7572	5948
7573		- // Specifically handle zero.
7574		- if ( 0 === intval( $secs ) ) {
7575		- return '0 seconds';
7576		- }
	5949	+ // specifically handle zero
	5950	+ if ( $secs == 0 ) return "0 seconds";
7577	5951
7578		- $s = '';
	5952	+ $s = "";
7579	5953
7580	5954	foreach ( $units as $name => $divisor ) {
7581		- $quot = intval( $secs / $divisor );
7582		- if ( $quot ) {
7583		- $s .= "$quot $name";
7584		- $s .= ( abs( $quot ) > 1 ? 's' : '' ) . ', ';
	5955	+ if ( $quot = intval( $secs / $divisor ) ) {
	5956	+ $s .= "$quot $name";
	5957	+ $s .= ( abs( $quot ) > 1 ? "s" : "" ) . ", ";
7585	5958	$secs -= $quot * $divisor;
7586	5959	}
7587	5960	}
7588	5961
		@@ -7588,14 +5961,10 @@
7588	5961
7589	5962	return substr( $s, 0, -2 );
7590	5963	}
7591	5964
7592		- /**
7593		- * Helper function to get all available usermeta keys as an array.
7594		- *
7595		- * @return array All usermeta keys for user.
7596		- */
7597		- protected function get_all_usermeta_keys() {
	5965	+ // Helper function to get all available usermeta keys as an array.
	5966	+ function get_all_usermeta_keys() {
7598	5967	global $wpdb;
7599	5968	$usermeta_keys = $wpdb->get_col( "SELECT DISTINCT $wpdb->usermeta.meta_key FROM $wpdb->usermeta" );
7600	5969	return $usermeta_keys;
7601	5970	}
		@@ -7602,12 +5971,10 @@
7602	5971
7603	5972
7604	5973	/**
7605	5974	* Load translated strings from *.mo files in /languages.
7606		- *
7607		- * Action: plugins_loaded
7608	5975	*/
7609		- public function load_textdomain() {
	5976	+ function load_textdomain() {
7610	5977	load_plugin_textdomain(
7611	5978	'authorizer',
7612	5979	false,
7613	5980	plugin_basename( dirname( __FILE__ ) ) . '/languages'
		@@ -7618,17 +5985,14 @@
7618	5985	/**
7619	5986	* Generate CAS authentication URL (wp-login.php URL with reauth=1 removed
7620	5987	* and external=cas added).
7621	5988	*/
7622		- private function modify_current_url_for_cas_login() {
	5989	+ function modify_current_url_for_cas_login() {
7623	5990	// Construct the URL of the current page (wp-login.php).
7624		- $url = '';
7625		- if ( isset( $_SERVER['HTTP_HOST'], $_SERVER['REQUEST_URI'] ) ) {
7626		- $url = set_url_scheme( esc_url_raw( wp_unslash( $_SERVER['HTTP_HOST'] ) ) . esc_url_raw( wp_unslash( $_SERVER['REQUEST_URI'] ) ) );
7627		- }
	5991	+ $url = 'http' . ( isset( $_SERVER['HTTPS'] ) ? 's' : '' ) . '://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
7628	5992
7629	5993	// Parse the URL into its components.
7630		- $parsed_url = wp_parse_url( $url );
	5994	+ $parsed_url = parse_url( $url );
7631	5995
7632	5996	// Fix up the querystring values (remove reauth, make sure external=cas).
7633	5997	$querystring = array();
7634	5998	if ( array_key_exists( 'query', $parsed_url ) ) {
		@@ -7635,9 +5999,9 @@
7635	5999	parse_str( $parsed_url['query'], $querystring );
7636	6000	}
7637	6001	unset( $querystring['reauth'] );
7638	6002	$querystring['external'] = 'cas';
7639		- $parsed_url['query'] = http_build_query( $querystring );
	6003	+ $parsed_url['query'] = http_build_query( $querystring );
7640	6004
7641	6005	// Return the URL as a string.
7642	6006	return $this->unparse_url( $parsed_url );
7643	6007	}
		@@ -7644,21 +6008,20 @@
7644	6008
7645	6009
7646	6010	/**
7647	6011	* Reconstruct a URL after it has been deconstructed with parse_url().
7648		- *
7649		- * @param array $parsed_url Keys from parse_url().
7650		- * @return string URL constructed from the components in $parsed_url.
	6012	+ * @param $parsed_url array() with keys from parse_url().
	6013	+ * @return string URL constructed from the components in $parsed_url.
7651	6014	*/
7652		- protected function unparse_url( $parsed_url = array() ) {
7653		- $scheme = isset( $parsed_url['scheme'] ) ? $parsed_url['scheme'] . '://' : '';
7654		- $host = isset( $parsed_url['host'] ) ? $parsed_url['host'] : '';
7655		- $port = isset( $parsed_url['port'] ) ? ':' . $parsed_url['port'] : '';
7656		- $user = isset( $parsed_url['user'] ) ? $parsed_url['user'] : '';
7657		- $pass = isset( $parsed_url['pass'] ) ? ':' . $parsed_url['pass'] : '';
7658		- $pass = $user || $pass ? "$pass@" : '';
7659		- $path = isset( $parsed_url['path'] ) ? $parsed_url['path'] : '';
7660		- $query = isset( $parsed_url['query'] ) ? '?' . $parsed_url['query'] : '';
	6015	+ function unparse_url( $parsed_url = array() ) {
	6016	+ $scheme = isset( $parsed_url['scheme'] ) ? $parsed_url['scheme'] . '://' : '';
	6017	+ $host = isset( $parsed_url['host'] ) ? $parsed_url['host'] : '';
	6018	+ $port = isset( $parsed_url['port'] ) ? ':' . $parsed_url['port'] : '';
	6019	+ $user = isset( $parsed_url['user'] ) ? $parsed_url['user'] : '';
	6020	+ $pass = isset( $parsed_url['pass'] ) ? ':' . $parsed_url['pass'] : '';
	6021	+ $pass = $user || $pass ? "$pass@" : '';
	6022	+ $path = isset( $parsed_url['path'] ) ? $parsed_url['path'] : '';
	6023	+ $query = isset( $parsed_url['query'] ) ? '?' . $parsed_url['query'] : '';
7661	6024	$fragment = isset( $parsed_url['fragment'] ) ? '#' . $parsed_url['fragment'] : '';
7662	6025	return "$scheme$user$pass$host$port$path$query$fragment";
7663	6026	}
7664	6027
		@@ -7663,30 +6026,15 @@
7663	6026	}
7664	6027
7665	6028
7666	6029	/**
7667		- * Helper function to generate an HTML class name for an option (used in
7668		- * Authorizer Settings in the Approved User list).
7669		- *
7670		- * @param string $suffix Unique part of class name.
7671		- * @param boolean $is_multisite_user Whether the class name should indicate it's a multisite user.
7672		- * @return string Class name, e.g., "auth-email auth-multisite-email".
7673		- */
7674		- private function create_class_name( $suffix = '', $is_multisite_user = false ) {
7675		- return $is_multisite_user ? "auth-$suffix auth-multisite-$suffix" : "auth-$suffix";
7676		- }
7677		-
7678		-
7679		- /**
7680	6030	* Plugin Update Routines.
7681		- *
7682		- * Action: plugins_loaded
7683	6031	*/
7684		- public function auth_update_check() {
	6032	+ function auth_update_check() {
7685	6033	// Get current version.
7686	6034	$needs_updating = false;
7687	6035	if ( is_multisite() ) {
7688		- $auth_version = get_blog_option( $this->current_site_blog_id, 'auth_version' );
	6036	+ $auth_version = get_blog_option( BLOG_ID_CURRENT_SITE, 'auth_version' );
7689	6037	} else {
7690	6038	$auth_version = get_option( 'auth_version' );
7691	6039	}
7692	6040
		@@ -7698,9 +6046,9 @@
7698	6046	// log in; approved and blocked lists are changed whenever an admin
7699	6047	// changes them from the multisite panel, the dashboard widget, or
7700	6048	// the plugin options page.
7701	6049	$update_if_older_than = 20140709;
7702		- if ( false === $auth_version || intval( $auth_version ) < $update_if_older_than ) {
	6050	+ if ( $auth_version === false || intval( $auth_version ) < $update_if_older_than ) {
7703	6051	// Copy single site user lists to new options (if they exist).
7704	6052	$auth_settings = get_option( 'auth_settings' );
7705	6053	if ( is_array( $auth_settings ) && array_key_exists( 'access_users_pending', $auth_settings ) ) {
7706	6054	update_option( 'auth_settings_access_users_pending', $auth_settings['access_users_pending'] );
		@@ -7718,27 +6066,27 @@
7718	6066	update_option( 'auth_settings', $auth_settings );
7719	6067	}
7720	6068	// Copy multisite user lists to new options (if they exist).
7721	6069	if ( is_multisite() ) {
7722		- $auth_multisite_settings = get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings', array() );
	6070	+ $auth_multisite_settings = get_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings', array() );
7723	6071	if ( is_array( $auth_multisite_settings ) && array_key_exists( 'access_users_pending', $auth_multisite_settings ) ) {
7724		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_pending', $auth_multisite_settings['access_users_pending'] );
	6072	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_pending', $auth_multisite_settings['access_users_pending'] );
7725	6073	unset( $auth_multisite_settings['access_users_pending'] );
7726		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings', $auth_multisite_settings );
	6074	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings', $auth_multisite_settings );
7727	6075	}
7728	6076	if ( is_array( $auth_multisite_settings ) && array_key_exists( 'access_users_approved', $auth_multisite_settings ) ) {
7729		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings['access_users_approved'] );
	6077	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings['access_users_approved'] );
7730	6078	unset( $auth_multisite_settings['access_users_approved'] );
7731		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings', $auth_multisite_settings );
	6079	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings', $auth_multisite_settings );
7732	6080	}
7733	6081	if ( is_array( $auth_multisite_settings ) && array_key_exists( 'access_users_blocked', $auth_multisite_settings ) ) {
7734		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_blocked', $auth_multisite_settings['access_users_blocked'] );
	6082	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_blocked', $auth_multisite_settings['access_users_blocked'] );
7735	6083	unset( $auth_multisite_settings['access_users_blocked'] );
7736		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings', $auth_multisite_settings );
	6084	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings', $auth_multisite_settings );
7737	6085	}
7738	6086	}
7739	6087	// Update version to reflect this change has been made.
7740		- $auth_version = $update_if_older_than;
	6088	+ $auth_version = $update_if_older_than;
7741	6089	$needs_updating = true;
7742	6090	}
7743	6091
7744	6092	// Update: Set default values for newly added options (forgot to do
		@@ -7744,13 +6092,12 @@
7744	6092	// Update: Set default values for newly added options (forgot to do
7745	6093	// this, so some users are getting debug log notices about undefined
7746	6094	// indexes in $auth_settings).
7747	6095	$update_if_older_than = 20160831;
7748		- if ( false === $auth_version || intval( $auth_version ) < $update_if_older_than ) {
	6096	+ if ( $auth_version === false || intval( $auth_version ) < $update_if_older_than ) {
7749	6097	// Provide default values for any $auth_settings options that don't exist.
7750	6098	if ( is_multisite() ) {
7751		- // Get all blog ids.
7752		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
	6099	+ // Get all blog ids
7753	6100	$sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
7754	6101	foreach ( $sites as $site ) {
7755	6102	$blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
7756	6103	switch_to_blog( $blog_id );
		@@ -7755,9 +6102,9 @@
7755	6102	$blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
7756	6103	switch_to_blog( $blog_id );
7757	6104	// Set meaningful defaults for other sites in the network.
7758	6105	$this->set_default_options();
7759		- // Switch back to original blog.
	6106	+ // Switch back to original blog. See: https://codex.wordpress.org/Function_Reference/restore_current_blog
7760	6107	restore_current_blog();
7761	6108	}
7762	6109	} else {
7763	6110	// Set meaningful defaults for this site.
		@@ -7763,9 +6110,9 @@
7763	6110	// Set meaningful defaults for this site.
7764	6111	$this->set_default_options();
7765	6112	}
7766	6113	// Update version to reflect this change has been made.
7767		- $auth_version = $update_if_older_than;
	6114	+ $auth_version = $update_if_older_than;
7768	6115	$needs_updating = true;
7769	6116	}
7770	6117
7771	6118	// Update: Migrate LDAP passwords encrypted with mcrypt since mcrypt is
		@@ -7770,18 +6117,17 @@
7770	6117
7771	6118	// Update: Migrate LDAP passwords encrypted with mcrypt since mcrypt is
7772	6119	// deprecated as of PHP 7.1. Use openssl library instead.
7773	6120	$update_if_older_than = 20170510;
7774		- if ( false === $auth_version || intval( $auth_version ) < $update_if_older_than ) {
	6121	+ if ( $auth_version === false || intval( $auth_version ) < $update_if_older_than ) {
7775	6122	if ( is_multisite() ) {
7776	6123	// Reencrypt LDAP passwords in each site in the network.
7777		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
7778	6124	$sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
7779	6125	foreach ( $sites as $site ) {
7780		- $blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
	6126	+ $blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
7781	6127	$auth_settings = get_blog_option( $blog_id, 'auth_settings', array() );
7782	6128	if ( array_key_exists( 'ldap_password', $auth_settings ) && strlen( $auth_settings['ldap_password'] ) > 0 ) {
7783		- $plaintext_ldap_password = $this->decrypt( $auth_settings['ldap_password'], 'mcrypt' );
	6129	+ $plaintext_ldap_password = $this->decrypt( $auth_settings['ldap_password'], 'mcrypt' );
7784	6130	$auth_settings['ldap_password'] = $this->encrypt( $plaintext_ldap_password );
7785	6131	update_blog_option( $blog_id, 'auth_settings', $auth_settings );
7786	6132	}
7787	6133	}
		@@ -7788,15 +6134,15 @@
7788	6134	} else {
7789	6135	// Reencrypt LDAP password on this single-site install.
7790	6136	$auth_settings = get_option( 'auth_settings', array() );
7791	6137	if ( array_key_exists( 'ldap_password', $auth_settings ) && strlen( $auth_settings['ldap_password'] ) > 0 ) {
7792		- $plaintext_ldap_password = $this->decrypt( $auth_settings['ldap_password'], 'mcrypt' );
	6138	+ $plaintext_ldap_password = $this->decrypt( $auth_settings['ldap_password'], 'mcrypt' );
7793	6139	$auth_settings['ldap_password'] = $this->encrypt( $plaintext_ldap_password );
7794	6140	update_option( 'auth_settings', $auth_settings );
7795	6141	}
7796	6142	}
7797	6143	// Update version to reflect this change has been made.
7798		- $auth_version = $update_if_older_than;
	6144	+ $auth_version = $update_if_older_than;
7799	6145	$needs_updating = true;
7800	6146	}
7801	6147
7802	6148	// Update: Migrate LDAP passwords encrypted with mcrypt since mcrypt is
		@@ -7802,171 +6148,35 @@
7802	6148	// Update: Migrate LDAP passwords encrypted with mcrypt since mcrypt is
7803	6149	// deprecated as of PHP 7.1. Use openssl library instead.
7804	6150	// Note: Forgot to update the auth_multisite_settings ldap password! Do it here.
7805	6151	$update_if_older_than = 20170511;
7806		- if ( false === $auth_version || intval( $auth_version ) < $update_if_older_than ) {
	6152	+ if ( $auth_version === false || intval( $auth_version ) < $update_if_older_than ) {
7807	6153	if ( is_multisite() ) {
7808	6154	// Reencrypt LDAP password in network (multisite) options.
7809		- $auth_multisite_settings = get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings', array() );
	6155	+ $auth_multisite_settings = get_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings', array() );
7810	6156	if ( array_key_exists( 'ldap_password', $auth_multisite_settings ) && strlen( $auth_multisite_settings['ldap_password'] ) > 0 ) {
7811		- $plaintext_ldap_password = $this->decrypt( $auth_multisite_settings['ldap_password'], 'mcrypt' );
	6157	+ $plaintext_ldap_password = $this->decrypt( $auth_multisite_settings['ldap_password'], 'mcrypt' );
7812	6158	$auth_multisite_settings['ldap_password'] = $this->encrypt( $plaintext_ldap_password );
7813		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings', $auth_multisite_settings );
	6159	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings', $auth_multisite_settings );
7814	6160	}
7815	6161	}
7816	6162	// Update version to reflect this change has been made.
7817		- $auth_version = $update_if_older_than;
	6163	+ $auth_version = $update_if_older_than;
7818	6164	$needs_updating = true;
7819	6165	}
7820	6166
7821		- // Update: Remove duplicates from approved list caused by authorizer_automatically_approve_login
7822		- // filter not respecting users who are already in the approved list
7823		- // (causing them to get re-added each time they logged in).
7824		- $update_if_older_than = 20170711;
7825		- if ( false === $auth_version || intval( $auth_version ) < $update_if_older_than ) {
7826		- // Remove duplicates from approved user lists.
7827		- if ( is_multisite() ) {
7828		- // Remove duplicates from each site in the multisite.
7829		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
7830		- $sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
7831		- foreach ( $sites as $site ) {
7832		- $blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
7833		- $auth_settings_access_users_approved = get_blog_option( $blog_id, 'auth_settings_access_users_approved', array() );
7834		- if ( is_array( $auth_settings_access_users_approved ) ) {
7835		- $should_update = false;
7836		- $distinct_emails = array();
7837		- foreach ( $auth_settings_access_users_approved as $key => $user ) {
7838		- if ( in_array( $user['email'], $distinct_emails, true ) ) {
7839		- $should_update = true;
7840		- unset( $auth_settings_access_users_approved[ $key ] );
7841		- } else {
7842		- $distinct_emails[] = $user['email'];
7843		- }
7844		- }
7845		- if ( $should_update ) {
7846		- update_blog_option( $blog_id, 'auth_settings_access_users_approved', $auth_settings_access_users_approved );
7847		- }
7848		- }
7849		- }
7850		- // Remove duplicates from multisite approved user list.
7851		- $auth_multisite_settings_access_users_approved = get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', array() );
7852		- if ( is_array( $auth_multisite_settings_access_users_approved ) ) {
7853		- $should_update = false;
7854		- $distinct_emails = array();
7855		- foreach ( $auth_multisite_settings_access_users_approved as $key => $user ) {
7856		- if ( in_array( $user['email'], $distinct_emails, true ) ) {
7857		- $should_update = true;
7858		- unset( $auth_multisite_settings_access_users_approved[ $key ] );
7859		- } else {
7860		- $distinct_emails[] = $user['email'];
7861		- }
7862		- }
7863		- if ( $should_update ) {
7864		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
7865		- }
7866		- }
7867		- } else {
7868		- // Remove duplicates from single site approved user list.
7869		- $auth_settings_access_users_approved = get_option( 'auth_settings_access_users_approved' );
7870		- if ( is_array( $auth_settings_access_users_approved ) ) {
7871		- $should_update = false;
7872		- $distinct_emails = array();
7873		- foreach ( $auth_settings_access_users_approved as $key => $user ) {
7874		- if ( in_array( $user['email'], $distinct_emails, true ) ) {
7875		- $should_update = true;
7876		- unset( $auth_settings_access_users_approved[ $key ] );
7877		- } else {
7878		- $distinct_emails[] = $user['email'];
7879		- }
7880		- }
7881		- if ( $should_update ) {
7882		- update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved );
7883		- }
7884		- }
7885		- }
7886		- // Update version to reflect this change has been made.
7887		- $auth_version = $update_if_older_than;
7888		- $needs_updating = true;
7889		- }
	6167	+ // // Update: TEMPLATE
	6168	+ // $update_if_older_than = YYYYMMDD;
	6169	+ // if ( $auth_version === false || intval( $auth_version ) < $update_if_older_than ) {
	6170	+ // UPDATE CODE HERE
	6171	+ // // Update version to reflect this change has been made.
	6172	+ // $auth_version = $update_if_older_than;
	6173	+ // $needs_updating = true;
	6174	+ // }
7890	6175
7891		- // Update: Set default value for newly added option advanced_widget_enabled.
7892		- $update_if_older_than = 20171023;
7893		- if ( false === $auth_version || intval( $auth_version ) < $update_if_older_than ) {
7894		- // Provide default values for any $auth_settings options that don't exist.
7895		- if ( is_multisite() ) {
7896		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
7897		- $sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
7898		- foreach ( $sites as $site ) {
7899		- $blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
7900		- switch_to_blog( $blog_id );
7901		- $this->set_default_options();
7902		- restore_current_blog();
7903		- }
7904		- } else {
7905		- $this->set_default_options();
7906		- }
7907		- // Update version to reflect this change has been made.
7908		- $auth_version = $update_if_older_than;
7909		- $needs_updating = true;
7910		- }
7911		-
7912		- // Update: Set default value for newly added option advanced_users_per_page.
7913		- $update_if_older_than = 20171215;
7914		- if ( false === $auth_version || intval( $auth_version ) < $update_if_older_than ) {
7915		- // Provide default values for any $auth_settings options that don't exist.
7916		- if ( is_multisite() ) {
7917		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
7918		- $sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
7919		- foreach ( $sites as $site ) {
7920		- $blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
7921		- switch_to_blog( $blog_id );
7922		- $this->set_default_options();
7923		- restore_current_blog();
7924		- }
7925		- } else {
7926		- $this->set_default_options();
7927		- }
7928		- // Update version to reflect this change has been made.
7929		- $auth_version = $update_if_older_than;
7930		- $needs_updating = true;
7931		- }
7932		-
7933		- // Update: Set default value for newly added options advanced_users_sort_by and advanced_users_sort_order.
7934		- $update_if_older_than = 20171219;
7935		- if ( false === $auth_version || intval( $auth_version ) < $update_if_older_than ) {
7936		- // Provide default values for any $auth_settings options that don't exist.
7937		- if ( is_multisite() ) {
7938		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
7939		- $sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
7940		- foreach ( $sites as $site ) {
7941		- $blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
7942		- switch_to_blog( $blog_id );
7943		- $this->set_default_options();
7944		- restore_current_blog();
7945		- }
7946		- } else {
7947		- $this->set_default_options();
7948		- }
7949		- // Update version to reflect this change has been made.
7950		- $auth_version = $update_if_older_than;
7951		- $needs_updating = true;
7952		- }
7953		-
7954		- /*
7955		- // Update: TEMPLATE
7956		- $update_if_older_than = YYYYMMDD;
7957		- if ( $auth_version === false || intval( $auth_version ) < $update_if_older_than ) {
7958		- UPDATE CODE HERE
7959		- // Update version to reflect this change has been made.
7960		- $auth_version = $update_if_older_than;
7961		- $needs_updating = true;
7962		- }
7963		- */
7964		-
7965	6176	// Save new version number if we performed any updates.
7966	6177	if ( $needs_updating ) {
7967	6178	if ( is_multisite() ) {
7968		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
7969	6179	$sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
7970	6180	foreach ( $sites as $site ) {
7971	6181	$blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
7972	6182	update_blog_option( $blog_id, 'auth_version', $auth_version );