← All changes | authorizer.php +2086 -3799 2.8.2 → 2.6.17 View file →

		@@ -1,29 +1,49 @@
1	1	<?php
2		-/**
3		- * Plugin Name: Authorizer
4		- * Description: Authorizer limits login attempts, restricts access to specified users, and authenticates against external sources (e.g., Google, LDAP, or CAS).
5		- * Author: Paul Ryan <prar@hawaii.edu>
6		- * Plugin URI: https://github.com/uhm-coe/authorizer
7		- * Text Domain: authorizer
8		- * Domain Path: /languages
9		- * License: GPL2
10		- * Version: 2.8.2
11		- *
12		- * @package authorizer
13		- */
	2	+/*
	3	+Plugin Name: Authorizer
	4	+Plugin URI: https://github.com/uhm-coe/authorizer
	5	+Description: Authorizer limits login attempts, restricts access to specified users, and authenticates against external sources (e.g., Google, LDAP, or CAS).
	6	+Version: 2.6.17
	7	+Author: Paul Ryan
	8	+Author URI: http://www.linkedin.com/in/paulrryan/
	9	+Text Domain: authorizer
	10	+Domain Path: /languages
	11	+License: GPL2
	12	+*/
14	13
15		-/**
16		- * Portions forked from Restricted Site Access plugin: http://wordpress.org/plugins/restricted-site-access/
17		- * Portions forked from wpCAS plugin: http://wordpress.org/extend/plugins/cas-authentication/
18		- * Portions forked from Limit Login Attempts: http://wordpress.org/plugins/limit-login-attempts/
19		- */
20	14
21		-/**
22		- * Add phpCAS library if it's not included.
23		- *
24		- * @see https://wiki.jasig.org/display/CASC/phpCAS+installation+guide
25		- */
	15	+/*
	16	+Copyright 2014 Paul Ryan (email: prar@hawaii.edu)
	17	+
	18	+This program is free software; you can redistribute it and/or modify
	19	+it under the terms of the GNU General Public License, version 2, as
	20	+published by the Free Software Foundation.
	21	+
	22	+This program is distributed in the hope that it will be useful,
	23	+but WITHOUT ANY WARRANTY; without even the implied warranty of
	24	+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	25	+GNU General Public License for more details.
	26	+
	27	+You should have received a copy of the GNU General Public License
	28	+along with this program; if not, write to the Free Software
	29	+Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
	30	+*/
	31	+
	32	+
	33	+/*
	34	+Portions forked from Restricted Site Access plugin: http://wordpress.org/plugins/restricted-site-access/
	35	+Portions forked from wpCAS plugin: http://wordpress.org/extend/plugins/cas-authentication/
	36	+Portions forked from Limit Login Attempts: http://wordpress.org/plugins/limit-login-attempts/
	37	+*/
	38	+
	39	+
	40	+define( 'MULTISITE_ADMIN', 'multisite_admin' );
	41	+define( 'SINGLE_ADMIN', 'single_admin' );
	42	+
	43	+
	44	+// Add phpCAS library if it's not included.
	45	+// @see https://wiki.jasig.org/display/CASC/phpCAS+installation+guide
26	46	if ( ! defined( 'PHPCAS_VERSION' ) ) {
27	47	require_once dirname( __FILE__ ) . '/vendor/CAS-1.3.5/CAS.php';
28	48	}
29	49
		@@ -39,87 +59,18 @@
39	59	* @link http://hawaii.edu/coe/dcdc/wordpress/authorizer/doc/
40	60	*/
41	61	class WP_Plugin_Authorizer {
42	62
43		- /**
44		- * Constants for determining our admin context (network or individual site).
45		- */
46		- const NETWORK_CONTEXT = 'multisite_admin';
47		- const SINGLE_CONTEXT = 'single_admin';
48	63
49	64	/**
50		- * Current site ID (Multisite).
51		- *
52		- * @var string
53		- */
54		- public $current_site_blog_id = 1;
55		-
56		- /**
57		- * HTML allowed when rendering translatable strings in the Authorizer UI.
58		- * This is passed to wp_kses() when sanitizing HMTL strings.
59		- *
60		- * @var array
61		- */
62		- private $allowed_html = array(
63		- 'a' => array(
64		- 'class' => array(),
65		- 'href' => array(),
66		- 'style' => array(),
67		- 'target' => array(),
68		- 'title' => array(),
69		- ),
70		- 'b' => array(),
71		- 'br' => array(),
72		- 'div' => array(
73		- 'class' => array(),
74		- ),
75		- 'em' => array(),
76		- 'hr' => array(),
77		- 'i' => array(),
78		- 'input' => array(
79		- 'aria-describedby' => array(),
80		- 'class' => array(),
81		- 'id' => array(),
82		- 'name' => array(),
83		- 'size' => array(),
84		- 'type' => array(),
85		- 'value' => array(),
86		- ),
87		- 'label' => array(
88		- 'class' => array(),
89		- 'for' => array(),
90		- ),
91		- 'p' => array(
92		- 'style' => array(),
93		- ),
94		- 'span' => array(
95		- 'aria-hidden' => array(),
96		- 'class' => array(),
97		- 'id' => array(),
98		- 'style' => array(),
99		- ),
100		- 'strong' => array(),
101		- );
102		-
103		- /**
104	65	* Constructor.
105	66	*/
106	67	public function __construct() {
107		- // Save reference to current blog id in the network (support deprecated
108		- // constant BLOGID_CURRENT_SITE).
109		- if ( defined( 'BLOG_ID_CURRENT_SITE' ) ) {
110		- $this->current_site_blog_id = BLOG_ID_CURRENT_SITE;
111		- } elseif ( defined( 'BLOGID_CURRENT_SITE' ) ) { // deprecated.
112		- $this->current_site_blog_id = BLOGID_CURRENT_SITE;
113		- }
114		-
115	68	// Installation and uninstallation hooks.
116	69	register_activation_hook( __FILE__, array( $this, 'activate' ) );
117	70	register_deactivation_hook( __FILE__, array( $this, 'deactivate' ) );
118	71
119		- /**
120		- * Register filters.
121		- */
	72	+ // Register filters.
122	73
123	74	// Custom wp authentication routine using external service.
124	75	add_filter( 'authenticate', array( $this, 'custom_authenticate' ), 1, 3 );
125	76
		@@ -125,9 +76,13 @@
125	76
126	77	// Custom logout action using external service.
127	78	add_action( 'wp_logout', array( $this, 'custom_logout' ) );
128	79
129		- // Create settings link on Plugins page.
	80	+ // Removing this bypasses Wordpress authentication (so if external auth fails,
	81	+ // no one can log in); with it enabled, it will run if external auth fails.
	82	+ //remove_filter('authenticate', 'wp_authenticate_username_password', 20, 3);
	83	+
	84	+ // Create settings link on Plugins page
130	85	add_filter( 'plugin_action_links_' . plugin_basename( __FILE__ ), array( $this, 'plugin_settings_link' ) );
131	86	add_filter( 'network_admin_plugin_action_links_' . plugin_basename( __FILE__ ), array( $this, 'network_admin_plugin_settings_link' ) );
132	87
133	88	// Modify login page with a custom password url (if option is set).
		@@ -138,11 +93,9 @@
138	93	if ( $error && strlen( $error ) > 0 ) {
139	94	add_filter( 'login_errors', array( $this, 'show_advanced_login_error' ) );
140	95	}
141	96
142		- /**
143		- * Register actions.
144		- */
	97	+ // Register actions.
145	98
146	99	// Enable localization. Translation files stored in /languages.
147	100	add_action( 'plugins_loaded', array( $this, 'load_textdomain' ) );
148	101
		@@ -154,20 +107,18 @@
154	107
155	108	// Add users who successfully login to the approved list.
156	109	add_action( 'wp_login', array( $this, 'ensure_wordpress_user_in_approved_list_on_login' ), 10, 2 );
157	110
158		- // Create menu item in Settings.
	111	+ // Create menu item in Settings
159	112	add_action( 'admin_menu', array( $this, 'add_plugin_page' ) );
160	113
161		- // Create options page.
	114	+ // Create options page
162	115	add_action( 'admin_init', array( $this, 'page_init' ) );
163	116
164	117	// Update user role in approved list if it's changed in the WordPress edit user page.
165		- add_action( 'user_profile_update_errors', array( $this, 'edit_user_profile_update_role' ), 10, 3 );
	118	+ add_action( 'edit_user_profile_update', array( $this, 'edit_user_profile_update_role' ) );
	119	+ add_action( 'personal_options_update', array( $this, 'edit_user_profile_update_role' ) );
166	120
167		- // Update user email in approved list if it's changed in the WordPress edit user page.
168		- add_filter( 'send_email_change_email', array( $this, 'edit_user_profile_update_email' ), 10, 3 );
169		-
170	121	// Enqueue javascript and css on the plugin's options page, the
171	122	// dashboard (for the widget), and the network admin.
172	123	add_action( 'load-settings_page_authorizer', array( $this, 'load_options_page' ) );
173	124	add_action( 'admin_head-index.php', array( $this, 'load_options_page' ) );
		@@ -172,16 +123,13 @@
172	123	add_action( 'load-settings_page_authorizer', array( $this, 'load_options_page' ) );
173	124	add_action( 'admin_head-index.php', array( $this, 'load_options_page' ) );
174	125	add_action( 'load-toplevel_page_authorizer', array( $this, 'load_options_page' ) );
175	126
176		- // Add custom css and js to wp-login.php.
	127	+ // Add custom css and js to wp-login.php
177	128	add_action( 'login_enqueue_scripts', array( $this, 'login_enqueue_scripts_and_styles' ) );
178	129	add_action( 'login_footer', array( $this, 'load_login_footer_js' ) );
179	130
180		- // Create google nonce cookie when loading wp-login.php if Google is enabled.
181		- add_action( 'login_init', array( $this, 'login_init__maybe_set_google_nonce_cookie' ) );
182		-
183		- // Modify login page with external auth links (if enabled; e.g., google or cas).
	131	+ // Modify login page with external auth links (if enabled; e.g., google or cas)
184	132	add_action( 'login_form', array( $this, 'login_form_add_external_service_links' ) );
185	133
186	134	// Redirect to CAS login when visiting login page (only if option is
187	135	// enabled, CAS is the only service, and WordPress logins are hidden).
		@@ -190,28 +138,25 @@
190	138	// output is started (so the redirect header doesn't complain about data
191	139	// already being sent).
192	140	add_filter( 'wp_login_errors', array( $this, 'wp_login_errors__maybe_redirect_to_cas' ), 10, 2 );
193	141
194		- // Verify current user has access to page they are visiting.
	142	+ // Verify current user has access to page they are visiting
195	143	add_action( 'parse_request', array( $this, 'restrict_access' ), 9 );
196	144	add_action( 'init', array( $this, 'init__maybe_add_network_approved_user' ) );
197	145
198		- // AJAX: Save options from dashboard widget.
	146	+ // ajax save options from dashboard widget
199	147	add_action( 'wp_ajax_update_auth_user', array( $this, 'ajax_update_auth_user' ) );
200	148
201		- // AJAX: Save options from multisite options page.
	149	+ // ajax save options from multisite options page
202	150	add_action( 'wp_ajax_save_auth_multisite_settings', array( $this, 'ajax_save_auth_multisite_settings' ) );
203	151
204		- // AJAX: Save usermeta from options page.
	152	+ // ajax save usermeta from options page
205	153	add_action( 'wp_ajax_update_auth_usermeta', array( $this, 'ajax_update_auth_usermeta' ) );
206	154
207		- // AJAX: Verify google login.
	155	+ // ajax verify google login
208	156	add_action( 'wp_ajax_process_google_login', array( $this, 'ajax_process_google_login' ) );
209	157	add_action( 'wp_ajax_nopriv_process_google_login', array( $this, 'ajax_process_google_login' ) );
210	158
211		- // AJAX: Refresh approved user list.
212		- add_action( 'wp_ajax_refresh_approved_user_list', array( $this, 'ajax_refresh_approved_user_list' ) );
213		-
214	159	// Add dashboard widget so instructors can add/edit users with access.
215	160	// Hint: For Multisite Network Admin Dashboard use wp_network_dashboard_setup instead of wp_dashboard_setup.
216	161	add_action( 'wp_dashboard_setup', array( $this, 'add_dashboard_widgets' ) );
217	162
		@@ -226,9 +171,9 @@
226	171	add_action( 'wp_enqueue_scripts', array( $this, 'auth_public_scripts' ), 20 );
227	172
228	173	// Multisite-specific actions.
229	174	if ( is_multisite() ) {
230		- // Add network admin options page (global settings for all sites).
	175	+ // Add network admin options page (global settings for all sites)
231	176	add_action( 'network_admin_menu', array( $this, 'network_admin_menu' ) );
232	177	}
233	178
234	179	// Remove user from authorizer lists when that user is deleted in WordPress.
		@@ -267,21 +212,13 @@
267	212	*/
268	213	public function activate() {
269	214	global $wpdb;
270	215
271		- // Nonce check.
272		- if (
273		- ! isset( $_REQUEST['_wpnonce'], $_REQUEST['plugin'] ) ||
274		- ! wp_verify_nonce( sanitize_key( $_REQUEST['_wpnonce'] ), 'activate-plugin_' . sanitize_text_field( wp_unslash( $_REQUEST['plugin'] ) ) )
275		- ) {
276		- die( '' );
277		- }
	216	+ // If we're in a multisite environment, run the plugin activation for each site when network enabling
	217	+ if ( is_multisite() && isset( $_GET['networkwide'] ) && $_GET['networkwide'] == 1 ) {
278	218
279		- // If we're in a multisite environment, run the plugin activation for each site when network enabling.
280		- if ( is_multisite() && isset( $_GET['networkwide'] ) && 1 === intval( $_GET['networkwide'] ) ) {
281		-
282	219	// Add super admins to the multisite approved list.
283		- $auth_multisite_settings_access_users_approved = get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', array() );
	220	+ $auth_multisite_settings_access_users_approved = get_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', array() );
284	221	$should_update_auth_multisite_settings_access_users_approved = false;
285	222	foreach ( get_super_admins() as $super_admin ) {
286	223	$user = get_user_by( 'login', $super_admin );
287	224	// Add to approved list if not there.
		@@ -286,10 +223,10 @@
286	223	$user = get_user_by( 'login', $super_admin );
287	224	// Add to approved list if not there.
288	225	if ( ! $this->in_multi_array( $user->user_email, $auth_multisite_settings_access_users_approved ) ) {
289	226	$approved_user = array(
290		- 'email' => $this->lowercase( $user->user_email ),
291		- 'role' => count( $user->roles ) > 0 ? $user->roles[0] : 'administrator',
	227	+ 'email' => $user->user_email,
	228	+ 'role' => count( $user->roles ) > 0 ? $user->roles[0] : 'administrator',
292	229	'date_added' => date( 'M Y', strtotime( $user->user_registered ) ),
293	230	'local_user' => true,
294	231	);
295	232	array_push( $auth_multisite_settings_access_users_approved, $approved_user );
		@@ -296,14 +233,13 @@
296	233	$should_update_auth_multisite_settings_access_users_approved = true;
297	234	}
298	235	}
299	236	if ( $should_update_auth_multisite_settings_access_users_approved ) {
300		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
	237	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
301	238	}
302	239
303	240	// Run plugin activation on each site in the network.
304	241	$current_blog_id = $wpdb->blogid;
305		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
306	242	$sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
307	243	foreach ( $sites as $site ) {
308	244	$blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
309	245	switch_to_blog( $blog_id );
		@@ -332,13 +268,13 @@
332	268	* @return void
333	269	*/
334	270	private function add_wp_users_to_approved_list() {
335	271	// Add current WordPress users to the approved list.
336		- $auth_multisite_settings_access_users_approved = is_multisite() ? get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', array() ) : array();
337		- $auth_settings_access_users_pending = $this->get_plugin_option( 'access_users_pending', WP_Plugin_Authorizer::SINGLE_CONTEXT );
338		- $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT );
339		- $auth_settings_access_users_blocked = $this->get_plugin_option( 'access_users_blocked', WP_Plugin_Authorizer::SINGLE_CONTEXT );
340		- $updated = false;
	272	+ $auth_multisite_settings_access_users_approved = is_multisite() ? get_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', array() ) : array();
	273	+ $auth_settings_access_users_pending = $this->get_plugin_option( 'access_users_pending', SINGLE_ADMIN );
	274	+ $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN );
	275	+ $auth_settings_access_users_blocked = $this->get_plugin_option( 'access_users_blocked', SINGLE_ADMIN );
	276	+ $updated = false;
341	277	foreach ( get_users() as $user ) {
342	278	// Skip if user is in blocked list.
343	279	if ( $this->in_multi_array( $user->user_email, $auth_settings_access_users_blocked ) ) {
344	280	continue;
		@@ -344,10 +280,10 @@
344	280	continue;
345	281	}
346	282	// Remove from pending list if there.
347	283	foreach ( $auth_settings_access_users_pending as $key => $pending_user ) {
348		- if ( 0 === strcasecmp( $pending_user['email'], $user->user_email ) ) {
349		- unset( $auth_settings_access_users_pending[ $key ] );
	284	+ if ( $pending_user['email'] == $user->user_email ) {
	285	+ unset( $auth_settings_access_users_pending[$key] );
350	286	$updated = true;
351	287	}
352	288	}
353	289	// Skip if user is in multisite approved list.
		@@ -356,10 +292,10 @@
356	292	}
357	293	// Add to approved list if not there.
358	294	if ( ! $this->in_multi_array( $user->user_email, $auth_settings_access_users_approved ) ) {
359	295	$approved_user = array(
360		- 'email' => $this->lowercase( $user->user_email ),
361		- 'role' => count( $user->roles ) > 0 ? $user->roles[0] : '',
	296	+ 'email' => $user->user_email,
	297	+ 'role' => count( $user->roles ) > 0 ? $user->roles[0] : '',
362	298	'date_added' => date( 'M Y', strtotime( $user->user_registered ) ),
363	299	'local_user' => true,
364	300	);
365	301	array_push( $auth_settings_access_users_approved, $approved_user );
		@@ -394,14 +330,13 @@
394	330
395	331	/**
396	332	* Authenticate against an external service.
397	333	*
398		- * Filter: authenticate
399		- *
400		- * @param WP_User $user user to authenticate.
	334	+ * @param WP_User $user user to authenticate
401	335	* @param string $username optional username to authenticate.
402	336	* @param string $password optional password to authenticate.
403		- * @return WP_User|WP_Error WP_User on success, WP_Error on failure.
	337	+ *
	338	+ * @return WP_User or WP_Error
404	339	*/
405	340	public function custom_authenticate( $user, $username, $password ) {
406	341	// Pass through if already authenticated.
407	342	if ( is_a( $user, 'WP_User' ) ) {
		@@ -409,20 +344,20 @@
409	344	} else {
410	345	$user = null;
411	346	}
412	347
413		- // If username and password are blank, this isn't a log in attempt.
	348	+ // If username and password are blank, this isn't a log in attempt
414	349	$is_login_attempt = strlen( $username ) > 0 && strlen( $password ) > 0;
415	350
416	351	// Check to make sure that $username is not locked out due to too
417	352	// many invalid login attempts. If it is, tell the user how much
418	353	// time remains until they can try again.
419		- $unauthenticated_user = $is_login_attempt ? get_user_by( 'login', $username ) : false;
	354	+ $unauthenticated_user = $is_login_attempt ? get_user_by( 'login', $username ) : false;
420	355	$unauthenticated_user_is_blocked = false;
421		- if ( $is_login_attempt && false !== $unauthenticated_user ) {
	356	+ if ( $is_login_attempt && $unauthenticated_user !== false ) {
422	357	$last_attempt = get_user_meta( $unauthenticated_user->ID, 'auth_settings_advanced_lockouts_time_last_failed', true );
423	358	$num_attempts = get_user_meta( $unauthenticated_user->ID, 'auth_settings_advanced_lockouts_failed_attempts', true );
424		- // Also check the auth_blocked user_meta flag (users in blocked list will get this flag).
	359	+ // Also check the auth_blocked user_meta flag (users in blocked list will get this flag)
425	360	$unauthenticated_user_is_blocked = get_user_meta( $unauthenticated_user->ID, 'auth_blocked', true ) === 'yes';
426	361	} else {
427	362	$last_attempt = get_option( 'auth_settings_advanced_lockouts_time_last_failed' );
428	363	$num_attempts = get_option( 'auth_settings_advanced_lockouts_failed_attempts' );
		@@ -436,9 +371,9 @@
436	371	return new WP_Error( 'empty_password', __( '<strong>ERROR</strong>: Incorrect username or password.', 'authorizer' ) );
437	372	}
438	373
439	374	// Grab plugin settings.
440		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
	375	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' );
441	376
442	377	// Make sure $last_attempt (time) and $num_attempts are positive integers.
443	378	// Note: this addresses resetting them if either is unset from above.
444	379	$last_attempt = abs( intval( $last_attempt ) );
		@@ -444,17 +379,17 @@
444	379	$last_attempt = abs( intval( $last_attempt ) );
445	380	$num_attempts = abs( intval( $num_attempts ) );
446	381
447	382	// Create semantic lockout variables.
448		- $lockouts = $auth_settings['advanced_lockouts'];
449		- $time_since_last_fail = time() - $last_attempt;
450		- $reset_duration = $lockouts['reset_duration'] * 60; // minutes to seconds.
451		- $num_attempts_long_lockout = $lockouts['attempts_1'] + $lockouts['attempts_2'];
452		- $num_attempts_short_lockout = $lockouts['attempts_1'];
453		- $seconds_remaining_long_lockout = $lockouts['duration_2'] * 60 - $time_since_last_fail;
	383	+ $lockouts = $auth_settings['advanced_lockouts'];
	384	+ $time_since_last_fail = time() - $last_attempt;
	385	+ $reset_duration = $lockouts['reset_duration'] * 60; // minutes to seconds
	386	+ $num_attempts_long_lockout = $lockouts['attempts_1'] + $lockouts['attempts_2'];
	387	+ $num_attempts_short_lockout = $lockouts['attempts_1'];
	388	+ $seconds_remaining_long_lockout = $lockouts['duration_2'] * 60 - $time_since_last_fail;
454	389	$seconds_remaining_short_lockout = $lockouts['duration_1'] * 60 - $time_since_last_fail;
455	390
456		- // Check if we need to institute a lockout delay.
	391	+ // Check if we need to institute a lockout delay
457	392	if ( $is_login_attempt && $time_since_last_fail > $reset_duration ) {
458	393	// Enough time has passed since the last invalid attempt and
459	394	// now that we can reset the failed attempt count, and let this
460	395	// login attempt go through.
		@@ -467,9 +402,8 @@
467	402	remove_filter( 'authenticate', 'wp_authenticate_username_password', 20, 3 );
468	403	return new WP_Error(
469	404	'empty_password',
470	405	sprintf(
471		- /* TRANSLATORS: 1: username 2: duration of lockout in seconds 3: duration of lockout as a phrase 4: lost password URL */
472	406	__( '<strong>ERROR</strong>: There have been too many invalid login attempts for the username <strong>%1$s</strong>. Please wait <strong id="seconds_remaining" data-seconds="%2$s">%3$s</strong> before trying again. <a href="%4$s" title="Password Lost and Found">Lost your password</a>?', 'authorizer' ),
473	407	$username,
474	408	$seconds_remaining_long_lockout,
475	409	$this->seconds_as_sentence( $seconds_remaining_long_lockout ),
		@@ -484,9 +418,8 @@
484	418	remove_filter( 'authenticate', 'wp_authenticate_username_password', 20, 3 );
485	419	return new WP_Error(
486	420	'empty_password',
487	421	sprintf(
488		- /* TRANSLATORS: 1: username 2: duration of lockout in seconds 3: duration of lockout as a phrase 4: lost password URL */
489	422	__( '<strong>ERROR</strong>: There have been too many invalid login attempts for the username <strong>%1$s</strong>. Please wait <strong id="seconds_remaining" data-seconds="%2$s">%3$s</strong> before trying again. <a href="%4$s" title="Password Lost and Found">Lost your password</a>?', 'authorizer' ),
490	423	$username,
491	424	$seconds_remaining_short_lockout,
492	425	$this->seconds_as_sentence( $seconds_remaining_short_lockout ),
		@@ -496,16 +429,16 @@
496	429	}
497	430
498	431	// Start external authentication.
499	432	$externally_authenticated_emails = array();
500		- $authenticated_by = '';
501		- $result = null;
	433	+ $authenticated_by = '';
	434	+ $result = null;
502	435
503	436	// Try Google authentication if it's enabled and we don't have a
504	437	// successful login yet.
505	438	if (
506		- '1' === $auth_settings['google'] &&
507		- 0 === count( $externally_authenticated_emails ) &&
	439	+ $auth_settings['google'] === '1' &&
	440	+ count( $externally_authenticated_emails ) === 0 &&
508	441	! is_wp_error( $result )
509	442	) {
510	443	$result = $this->custom_authenticate_google( $auth_settings );
511	444	if ( ! is_null( $result ) && ! is_wp_error( $result ) ) {
		@@ -520,10 +453,10 @@
520	453
521	454	// Try CAS authentication if it's enabled and we don't have a
522	455	// successful login yet.
523	456	if (
524		- '1' === $auth_settings['cas'] &&
525		- 0 === count( $externally_authenticated_emails ) &&
	457	+ $auth_settings['cas'] === '1' &&
	458	+ count( $externally_authenticated_emails ) === 0 &&
526	459	! is_wp_error( $result )
527	460	) {
528	461	$result = $this->custom_authenticate_cas( $auth_settings );
529	462	if ( ! is_null( $result ) && ! is_wp_error( $result ) ) {
		@@ -538,10 +471,10 @@
538	471
539	472	// Try LDAP authentication if it's enabled and we don't have an
540	473	// authenticated user yet.
541	474	if (
542		- '1' === $auth_settings['ldap'] &&
543		- 0 === count( $externally_authenticated_emails ) &&
	475	+ $auth_settings['ldap'] === '1' &&
	476	+ count( $externally_authenticated_emails ) === 0 &&
544	477	! is_wp_error( $result )
545	478	) {
546	479	$result = $this->custom_authenticate_ldap( $auth_settings, $username, $password );
547	480	if ( ! is_null( $result ) && ! is_wp_error( $result ) ) {
		@@ -562,33 +495,31 @@
562	495
563	496	// Remove duplicate and blank emails, if any.
564	497	$externally_authenticated_emails = array_filter( array_unique( $externally_authenticated_emails ) );
565	498
566		- /**
567		- * If we've made it this far, we should have an externally
568		- * authenticated user. The following should be set:
569		- * $externally_authenticated_emails
570		- * $authenticated_by
571		- */
	499	+ // If we've made it this far, we should have an externally
	500	+ // authenticated user. The following should be set:
	501	+ // $externally_authenticated_emails
	502	+ // $authenticated_by
572	503
573	504	// Get the external user's WordPress account by email address.
574	505	foreach ( $externally_authenticated_emails as $externally_authenticated_email ) {
575		- $user = get_user_by( 'email', $this->lowercase( $externally_authenticated_email ) );
	506	+ $user = get_user_by( 'email', $externally_authenticated_email );
576	507
577	508	// If we've already found a WordPress user associated with one
578	509	// of the supplied email addresses, don't keep examining other
579	510	// email addresses associated with the externally authenticated user.
580		- if ( false !== $user ) {
	511	+ if ( $user !== FALSE ) {
581	512	break;
582	513	}
583	514	}
584	515
585	516	// Check this external user's access against the access lists
586		- // (pending, approved, blocked).
	517	+ // (pending, approved, blocked)
587	518	$result = $this->check_user_access( $user, $externally_authenticated_emails, $result );
588	519
589	520	// Fail with message if there was an error creating/adding the user.
590		- if ( is_wp_error( $result ) || 0 === $result ) {
	521	+ if ( is_wp_error( $result ) || $result === 0 ) {
591	522	return $result;
592	523	}
593	524
594	525	// If we created a new user in check_user_access(), log that user in.
		@@ -609,27 +540,26 @@
609	540	/**
610	541	* This function will fail with a wp_die() message to the user if they
611	542	* don't have access.
612	543	*
613		- * @param WP_User $user User to check.
614		- * @param array $user_emails Array of user's plaintext emails (in case current user doesn't have a WP account).
615		- * @param array $user_data Array of keys for email, username, first_name, last_name,
616		- * authenticated_by, google_attributes, cas_attributes, ldap_attributes.
617		- * @return WP_Error|void|null|WP_User
618		- * WP_Error if there was an error on user creation / adding user to blog.
619		- * wp_die() if user does not have access.
620		- * null if user has access (success).
621		- * WP_User if user has access and a new account was created for them.
	544	+ * @param WP_User $user User to check
	545	+ * @param [type] $user_emails Array of user's plaintext emails (in case current user doesn't have a WP account)
	546	+ * @param [type] $user_data Array of keys for email, username, first_name, last_name,
	547	+ * authenticated_by, google_attributes, cas_attributes, ldap_attributes.
	548	+ * @return WP_Error if there was an error on user creation / adding user to blog
	549	+ * wp_die() if user does not have access
	550	+ * null if user has access (success)
	551	+ * WP_User if user has access and a new account was created for them
622	552	*/
623	553	private function check_user_access( $user, $user_emails, $user_data = array() ) {
624	554	// Grab plugin settings.
625		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
626		- $auth_settings_access_users_pending = $this->sanitize_user_list(
627		- $this->get_plugin_option( 'access_users_pending', WP_Plugin_Authorizer::SINGLE_CONTEXT )
	555	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' );
	556	+ $auth_settings_access_users_pending = $this->sanitize_user_list(
	557	+ $this->get_plugin_option( 'access_users_pending', SINGLE_ADMIN )
628	558	);
629		- $auth_settings_access_users_approved_single = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT );
630		- $auth_settings_access_users_approved_multi = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT );
631		- $auth_settings_access_users_approved = $this->sanitize_user_list(
	559	+ $auth_settings_access_users_approved_single = $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN );
	560	+ $auth_settings_access_users_approved_multi = $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN );
	561	+ $auth_settings_access_users_approved = $this->sanitize_user_list(
632	562	array_merge(
633	563	$auth_settings_access_users_approved_single,
634	564	$auth_settings_access_users_approved_multi
635	565	)
		@@ -641,9 +571,9 @@
641	571	*
642	572	* @param bool $allow_login Whether to block the currently logging in user.
643	573	* @param array $user_data User data returned from external service.
644	574	*/
645		- $allow_login = apply_filters( 'authorizer_allow_login', true, $user_data );
	575	+ $allow_login = apply_filters( 'authorizer_allow_login', true, $user_data );
646	576	$blocked_by_filter = ! $allow_login; // Use this for better readability.
647	577
648	578	// Check our externally authenticated user against the block list.
649	579	// If any of their email addresses are blocked, set the relevant user
		@@ -653,16 +583,14 @@
653	583
654	584	// Add user to blocked list if it was blocked via the filter.
655	585	if ( $blocked_by_filter && ! $this->is_email_in_list( $user_email, 'blocked' ) ) {
656	586	$auth_settings_access_users_blocked = $this->sanitize_user_list(
657		- $this->get_plugin_option( 'access_users_blocked', WP_Plugin_Authorizer::SINGLE_CONTEXT )
	587	+ $this->get_plugin_option( 'access_users_blocked', SINGLE_ADMIN )
658	588	);
659		- array_push(
660		- $auth_settings_access_users_blocked, array(
661		- 'email' => $this->lowercase( $user_email ),
662		- 'date_added' => date( 'M Y' ),
663		- )
664		- );
	589	+ array_push( $auth_settings_access_users_blocked, array(
	590	+ 'email' => $user_email,
	591	+ 'date_added' => date( 'M Y' ),
	592	+ ));
665	593	update_option( 'auth_settings_access_users_blocked', $auth_settings_access_users_blocked );
666	594	}
667	595
668	596	// If the blocked external user has a WordPress account, mark it as
		@@ -671,11 +599,10 @@
671	599	update_user_meta( $user->ID, 'auth_blocked', 'yes' );
672	600	}
673	601
674	602	// Notify user about blocked status and return without authenticating them.
675		- // phpcs:ignore WordPress.CSRF.NonceVerification.NoNonceVerification
676		- $redirect_to = ! empty( $_REQUEST['redirect_to'] ) ? esc_url_raw( wp_unslash( $_REQUEST['redirect_to'] ) ) : home_url();
677		- $page_title = sprintf(
	603	+ $redirect_to = ! empty( $_REQUEST['redirect_to'] ) ? $_REQUEST['redirect_to'] : home_url();
	604	+ $page_title = sprintf(
678	605	/* TRANSLATORS: %s: Name of blog */
679	606	__( '%s - Access Restricted', 'authorizer' ),
680	607	get_bloginfo( 'name' )
681	608	);
		@@ -686,9 +613,9 @@
686	613	'<a class="button" href="' . wp_logout_url( $redirect_to ) . '">' .
687	614	__( 'Back', 'authorizer' ) .
688	615	'</a></p>';
689	616	update_option( 'auth_settings_advanced_login_error', $error_message );
690		- wp_die( wp_kses( $error_message, $this->allowed_html ), esc_html( $page_title ) );
	617	+ wp_die( $error_message, $page_title );
691	618	}
692	619	}
693	620
694	621	// Get the default role for this user (or their current role, if they
		@@ -698,9 +625,8 @@
698	625	* Filter the role of the user currently logging in. The role will be
699	626	* set to the default (specified in Authorizer options) for new users,
700	627	* or the user's current role for existing users. This filter allows
701	628	* changing user roles based on custom CAS/LDAP attributes.
702		- *
703	629	* @param bool $role Role of the user currently logging in.
704	630	* @param array $user_data User data returned from external service.
705	631	*/
706	632	$approved_role = apply_filters( 'authorizer_custom_role', $default_role, $user_data );
		@@ -735,9 +661,9 @@
735	661	// above, then add them to the approved list (they'll get an account
736	662	// created below if they don't have one yet).
737	663	if (
738	664	! $this->is_email_in_list( $user_email, 'approved' ) &&
739		- ( 'external_users' === $auth_settings['access_who_can_login'] || $automatically_approve_login )
	665	+ ( $auth_settings['access_who_can_login'] === 'external_users' || $automatically_approve_login )
740	666	) {
741	667	$is_newly_approved_user = true;
742	668
743	669	// If this user happens to be in the pending list (rare),
		@@ -743,9 +669,9 @@
743	669	// If this user happens to be in the pending list (rare),
744	670	// remove them from pending before adding them to approved.
745	671	if ( $this->is_email_in_list( $user_email, 'pending' ) ) {
746	672	foreach ( $auth_settings_access_users_pending as $key => $pending_user ) {
747		- if ( 0 === strcasecmp( $pending_user['email'], $user_email ) ) {
	673	+ if ( $pending_user['email'] === $user_email ) {
748	674	unset( $auth_settings_access_users_pending[ $key ] );
749	675	update_option( 'auth_settings_access_users_pending', $auth_settings_access_users_pending );
750	676	break;
751	677	}
		@@ -753,11 +679,11 @@
753	679	}
754	680
755	681	// Add this user to the approved list.
756	682	$approved_user = array(
757		- 'email' => $this->lowercase( $user_email ),
758		- 'role' => $approved_role,
759		- 'date_added' => date( 'Y-m-d H:i:s' ),
	683	+ 'email' => $user_email,
	684	+ 'role' => $approved_role,
	685	+ 'date_added' => date( "Y-m-d H:i:s" ),
760	686	);
761	687	array_push( $auth_settings_access_users_approved, $approved_user );
762	688	array_push( $auth_settings_access_users_approved_single, $approved_user );
763	689	update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved_single );
		@@ -775,9 +701,9 @@
775	701	if ( $default_role !== $approved_role ) {
776	702	$user_info['role'] = $approved_role;
777	703	}
778	704
779		- // If the approved external user does not have a WordPress account, create it.
	705	+ // If the approved external user does not have a WordPress account, create it
780	706	if ( ! $user ) {
781	707	// If there's already a user with this username (e.g.,
782	708	// johndoe/johndoe@gmail.com exists, and we're trying to add
783	709	// johndoe/johndoe@example.com), use the full email address
		@@ -792,47 +718,26 @@
792	718	$username = $user_info['email'];
793	719	}
794	720	$result = wp_insert_user(
795	721	array(
796		- 'user_login' => strtolower( $username ),
797		- 'user_pass' => wp_generate_password(), // random password.
798		- 'first_name' => array_key_exists( 'first_name', $user_data ) ? $user_data['first_name'] : '',
799		- 'last_name' => array_key_exists( 'last_name', $user_data ) ? $user_data['last_name'] : '',
800		- 'user_email' => $this->lowercase( $user_info['email'] ),
	722	+ 'user_login' => strtolower( $username ),
	723	+ 'user_pass' => wp_generate_password(), // random password
	724	+ 'first_name' => array_key_exists( 'first_name', $user_data ) ? $user_data['first_name'] : '',
	725	+ 'last_name' => array_key_exists( 'last_name', $user_data ) ? $user_data['last_name'] : '',
	726	+ 'user_email' => strtolower( $user_info['email'] ),
801	727	'user_registered' => date( 'Y-m-d H:i:s' ),
802		- 'role' => $user_info['role'],
	728	+ 'role' => $user_info['role'],
803	729	)
804	730	);
805	731
806	732	// Fail with message if error.
807		- if ( is_wp_error( $result ) || 0 === $result ) {
	733	+ if ( is_wp_error( $result ) || $result === 0 ) {
808	734	return $result;
809	735	}
810	736
811		- // Authenticate as new user.
	737	+ // Authenticate as new user
812	738	$user = new WP_User( $result );
813	739
814		- /**
815		- * Fires after an external user is authenticated for the first time
816		- * and a new WordPress account is created for them.
817		- *
818		- * @since 2.8.0
819		- *
820		- * @param WP_User $user User object.
821		- * @param array $user_data User data from external service.
822		- *
823		- * Example $user_data:
824		- * array(
825		- * 'email' => 'user@example.edu',
826		- * 'username' => 'user',
827		- * 'first_name' => 'First',
828		- * 'last_name' => 'Last',
829		- * 'authenticated_by' => 'cas',
830		- * 'cas_attributes' => array( ... ),
831		- * );
832		- */
833		- do_action( 'authorizer_user_register', $user, $user_data );
834		-
835	740	// If multisite, iterate through all sites in the network and add the user
836	741	// currently logging in to any of them that have the user on the approved list.
837	742	// Note: this is useful for first-time logins--some users will have access
838	743	// to multiple sites, and this prevents them from having to log into each
		@@ -838,21 +743,18 @@
838	743	// to multiple sites, and this prevents them from having to log into each
839	744	// site individually to get access.
840	745	if ( is_multisite() ) {
841	746	$site_ids_of_user = array_map(
842		- function ( $site_of_user ) {
843		- return intval( $site_of_user->userblog_id );
844		- },
	747	+ function ( $site_of_user ) { return $site_of_user->userblog_id; },
845	748	get_blogs_of_user( $user->ID )
846	749	);
847	750
848		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
849	751	$sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
850	752	foreach ( $sites as $site ) {
851	753	$blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
852	754
853	755	// Skip if user is already added to this site.
854		- if ( in_array( intval( $blog_id ), $site_ids_of_user, true ) ) {
	756	+ if ( in_array( $blog_id, $site_ids_of_user ) ) {
855	757	continue;
856	758	}
857	759
858	760	// Check if user is on the approved list of this site they are not added to.
		@@ -878,9 +780,9 @@
878	780	if ( $meta_key === $user_info['usermeta']['meta_key'] ) {
879	781	// Update user's usermeta value for usermeta key stored in authorizer options.
880	782	if ( strpos( $meta_key, 'acf___' ) === 0 && class_exists( 'acf' ) ) {
881	783	// We have an ACF field value, so use the ACF function to update it.
882		- update_field( str_replace( 'acf___', '', $meta_key ), $user_info['usermeta']['meta_value'], 'user_' . $user->ID );
	784	+ update_field( str_replace('acf___', '', $meta_key ), $user_info['usermeta']['meta_value'], 'user_' . $user->ID );
883	785	} else {
884	786	// We have a normal usermeta value, so just update it via the WordPress function.
885	787	update_user_meta( $user->ID, $meta_key, $user_info['usermeta']['meta_value'] );
886	788	}
		@@ -896,9 +798,9 @@
896	798	switch_to_blog( $blog_id );
897	799	// Update user's usermeta value for usermeta key stored in authorizer options.
898	800	if ( strpos( $meta_key, 'acf___' ) === 0 && class_exists( 'acf' ) ) {
899	801	// We have an ACF field value, so use the ACF function to update it.
900		- update_field( str_replace( 'acf___', '', $meta_key ), $usermeta['meta_value'], 'user_' . $user->ID );
	802	+ update_field( str_replace('acf___', '', $meta_key ), $usermeta['meta_value'], 'user_' . $user->ID );
901	803	} else {
902	804	// We have a normal usermeta value, so just update it via the WordPress function.
903	805	update_user_meta( $user->ID, $meta_key, $usermeta['meta_value'] );
904	806	}
		@@ -909,24 +811,20 @@
909	811	}
910	812	} else {
911	813	// Update first/last names of WordPress user from external
912	814	// service if that option is set.
913		- if ( ( array_key_exists( 'authenticated_by', $user_data ) && 'cas' === $user_data['authenticated_by'] && array_key_exists( 'cas_attr_update_on_login', $auth_settings ) && 1 === intval( $auth_settings['cas_attr_update_on_login'] ) ) || ( array_key_exists( 'authenticated_by', $user_data ) && 'ldap' === $user_data['authenticated_by'] && array_key_exists( 'ldap_attr_update_on_login', $auth_settings ) && 1 === intval( $auth_settings['ldap_attr_update_on_login'] ) ) ) {
914		- if ( array_key_exists( 'first_name', $user_data ) && 0 < strlen( $user_data['first_name'] ) ) {
915		- wp_update_user(
916		- array(
917		- 'ID' => $user->ID,
918		- 'first_name' => $user_data['first_name'],
919		- )
920		- );
	815	+ if ( ( array_key_exists( 'authenticated_by', $user_data ) && $user_data['authenticated_by'] === 'cas' && array_key_exists( 'cas_attr_update_on_login', $auth_settings ) && $auth_settings['cas_attr_update_on_login'] == 1 ) || ( array_key_exists( 'authenticated_by', $user_data ) && $user_data['authenticated_by'] === 'ldap' && array_key_exists( 'ldap_attr_update_on_login', $auth_settings ) && $auth_settings['ldap_attr_update_on_login'] == 1 ) ) {
	816	+ if ( array_key_exists( 'first_name', $user_data ) && strlen( $user_data['first_name'] ) > 0 ) {
	817	+ wp_update_user( array(
	818	+ 'ID' => $user->ID,
	819	+ 'first_name' => $user_data['first_name'],
	820	+ ));
921	821	}
922	822	if ( array_key_exists( 'last_name', $user_data ) && strlen( $user_data['last_name'] ) > 0 ) {
923		- wp_update_user(
924		- array(
925		- 'ID' => $user->ID,
926		- 'last_name' => $user_data['last_name'],
927		- )
928		- );
	823	+ wp_update_user( array(
	824	+ 'ID' => $user->ID,
	825	+ 'last_name' => $user_data['last_name'],
	826	+ ));
929	827	}
930	828	}
931	829
932	830	// Update this user's role if it was modified in the
		@@ -936,10 +834,10 @@
936	834	$user->set_role( $approved_role );
937	835
938	836	// Update user's role in this site's approved list and save.
939	837	foreach ( $auth_settings_access_users_approved_single as $key => $existing_user ) {
940		- if ( 0 === strcasecmp( $user->user_email, $existing_user['email'] ) ) {
941		- $auth_settings_access_users_approved_single[ $key ]['role'] = $approved_role;
	838	+ if ( $user->user_email == $existing_user['email'] ) {
	839	+ $auth_settings_access_users_approved[$key]['role'] = $approved_role;
942	840	break;
943	841	}
944	842	}
945	843	update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved_single );
		@@ -956,34 +854,33 @@
956	854	}
957	855	}
958	856
959	857	// Ensure user has the same role as their entry in the approved list.
960		- if ( $user_info && ! in_array( $user_info['role'], $user->roles, true ) ) {
	858	+ // (This is just a precaution, the role should already be set when
	859	+ // saving admin options in the sanitizing function.)
	860	+ if ( $user_info && ! array_key_exists( $user_info['role'], $user->roles ) ) {
961	861	$user->set_role( $user_info['role'] );
962	862	}
963	863
964	864	return $user;
965	865
966		- } elseif ( 0 === strcasecmp( $user_email, $last_email ) ) {
967		- /**
968		- * Note: only do this for the last email address we are checking (we need
969		- * to iterate through them all to make sure one of them isn't approved).
970		- */
971		-
	866	+ // Note: only do this for the last email address we are checking (we need
	867	+ // to iterate through them all to make sure one of them isn't approved).
	868	+ } elseif ( $user_email === $last_email ) {
972	869	// User isn't an admin, is not blocked, and is not approved.
973	870	// Add them to the pending list and notify them and their instructor.
974	871	if ( strlen( $user_email ) > 0 && ! $this->is_email_in_list( $user_email, 'pending' ) ) {
975		- $pending_user = array();
976		- $pending_user['email'] = $this->lowercase( $user_email );
977		- $pending_user['role'] = $approved_role;
	872	+ $pending_user = array();
	873	+ $pending_user['email'] = $user_email;
	874	+ $pending_user['role'] = $approved_role;
978	875	$pending_user['date_added'] = '';
979	876	array_push( $auth_settings_access_users_pending, $pending_user );
980	877	update_option( 'auth_settings_access_users_pending', $auth_settings_access_users_pending );
981	878
982	879	// Create strings used in the email notification.
983		- $site_name = get_bloginfo( 'name' );
984		- $site_url = get_bloginfo( 'url' );
985		- $authorizer_options_url = 'settings' === $auth_settings['advanced_admin_menu'] ? admin_url( 'options-general.php?page=authorizer' ) : admin_url( '?page=authorizer' );
	880	+ $site_name = get_bloginfo( 'name' );
	881	+ $site_url = get_bloginfo( 'url' );
	882	+ $authorizer_options_url = $auth_settings['advanced_admin_menu'] === 'settings' ? admin_url( 'options-general.php?page=authorizer' ) : admin_url( '?page=authorizer' );
986	883
987	884	// Notify users with the role specified in "Which role should
988	885	// receive email notifications about pending users?".
989	886	if ( strlen( $auth_settings['access_role_receive_pending_emails'] ) > 0 ) {
		@@ -1008,11 +905,10 @@
1008	905	}
1009	906	}
1010	907
1011	908	// Notify user about pending status and return without authenticating them.
1012		- // phpcs:ignore WordPress.CSRF.NonceVerification.NoNonceVerification
1013		- $redirect_to = ! empty( $_REQUEST['redirect_to'] ) ? esc_url_raw( wp_unslash( $_REQUEST['redirect_to'] ) ) : home_url();
1014		- $page_title = get_bloginfo( 'name' ) . ' - Access Pending';
	909	+ $redirect_to = ! empty( $_REQUEST['redirect_to'] ) ? $_REQUEST['redirect_to'] : home_url();
	910	+ $page_title = get_bloginfo( 'name' ) . ' - Access Pending';
1015	911	$error_message =
1016	912	apply_filters( 'the_content', $auth_settings['access_pending_redirect_to_message'] ) .
1017	913	'<hr />' .
1018	914	'<p style="text-align: center;">' .
		@@ -1019,9 +915,9 @@
1019	915	'<a class="button" href="' . wp_logout_url( $redirect_to ) . '">' .
1020	916	__( 'Back', 'authorizer' ) .
1021	917	'</a></p>';
1022	918	update_option( 'auth_settings_advanced_login_error', $error_message );
1023		- wp_die( wp_kses( $error_message, $this->allowed_html ), esc_html( $page_title ) );
	919	+ wp_die( $error_message, $page_title );
1024	920	}
1025	921	}
1026	922
1027	923	// Sanity check: if we made it here without returning, something has gone wrong.
		@@ -1044,34 +940,24 @@
1044	940	* custom_authenticate_google() runs to verify the token; once verified
1045	941	* custom_authenticate proceeds as normal with the google email address
1046	942	* as a successfully authenticated external user.
1047	943	*
1048		- * Action: wp_ajax_process_google_login
1049		- * Action: wp_ajax_nopriv_process_google_login
1050		- *
1051		- * @return void, but die with the value to return to the success() function in AJAX call signInCallback().
	944	+ * @return void, but die with the value to return to the success() function in AJAX call signInCallback()
1052	945	*/
1053		- public function ajax_process_google_login() {
	946	+ function ajax_process_google_login() {
	947	+ $nonce = array_key_exists( 'nonce', $_POST ) ? $_POST['nonce'] : '';
	948	+ $code = array_key_exists( 'code', $_POST ) ? $_POST['code'] : null;
	949	+
1054	950	// Nonce check.
1055		- if (
1056		- ! isset( $_POST['nonce'] ) ||
1057		- ! wp_verify_nonce( sanitize_key( $_POST['nonce'] ), 'google_csrf_nonce' )
1058		- ) {
1059		- die( '' );
	951	+ if ( ! wp_verify_nonce( $nonce, 'google_csrf_nonce' ) ) {
	952	+ return '';
1060	953	}
1061	954
1062		- // Google authentication token.
1063		- // phpcs:ignore WordPress.VIP.ValidatedSanitizedInput.InputNotSanitized
1064		- $code = isset( $_POST['code'] ) ? wp_unslash( $_POST['code'] ) : null;
1065		-
1066	955	// Grab plugin settings.
1067		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
	956	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' );
1068	957
1069		- /**
1070		- * Add Google API PHP Client.
1071		- *
1072		- * @see https://github.com/google/google-api-php-client branch:v1-master
1073		- */
	958	+ // Add Google API PHP Client.
	959	+ // @see https://github.com/google/google-api-php-client branch:v1-master
1074	960	require_once dirname( __FILE__ ) . '/vendor/google-api-php-client/src/Google/autoload.php';
1075	961
1076	962	// Build the Google Client.
1077	963	$client = new Google_Client();
		@@ -1079,26 +965,19 @@
1079	965	$client->setClientId( $auth_settings['google_clientid'] );
1080	966	$client->setClientSecret( $auth_settings['google_clientsecret'] );
1081	967	$client->setRedirectUri( 'postmessage' );
1082	968
1083		- /**
1084		- * If the hosted domain parameter is set, restrict logins to that domain.
1085		- *
1086		- * Note: Will have to upgrade to google-api-php-client v2 or higher for
1087		- * this to function server-side; it's not complete in v1, so this check
1088		- * is performed manually below.
1089		- *
1090		- * if (
1091		- * array_key_exists( 'google_hosteddomain', $auth_settings ) &&
1092		- * strlen( $auth_settings['google_hosteddomain'] ) > 0
1093		- * ) {
1094		- * $google_hosteddomains = explode( "\n", str_replace( "\r", '', $auth_settings['google_hosteddomain'] ) );
1095		- * $google_hosteddomain = trim( $google_hosteddomains[0] );
1096		- * $client->setHostedDomain( $google_hosteddomain );
1097		- * }
1098		- */
	969	+ // If the hosted domain parameter is set, restrict logins to that domain.
	970	+ // Note: Will have to upgrade to google-api-php-client v2 or higher for
	971	+ // this to function server-side; it's not complete in v1, so this check
	972	+ // is performed manually below.
	973	+ // if ( array_key_exists( 'google_hosteddomain', $auth_settings ) && strlen( $auth_settings['google_hosteddomain'] ) > 0 ) {
	974	+ // $google_hosteddomains = explode( "\n", str_replace( "\r", '', $auth_settings['google_hosteddomain'] ) );
	975	+ // $google_hosteddomain = trim( $google_hosteddomains[0] );
	976	+ // $client->setHostedDomain( $google_hosteddomain );
	977	+ // }
1099	978
1100		- // Get one time use token (if it doesn't exist, we'll create one below).
	979	+ // Get one time use token (if it doesn't exist, we'll create one below)
1101	980	session_start();
1102	981	$token = array_key_exists( 'token', $_SESSION ) ? json_decode( $_SESSION['token'] ) : null;
1103	982
1104	983	if ( empty( $token ) ) {
		@@ -1106,18 +985,18 @@
1106	985	$client->authenticate( $code );
1107	986	$token = json_decode( $client->getAccessToken() );
1108	987
1109	988	// Store the token in the session for later use.
1110		- $_SESSION['token'] = wp_json_encode( $token );
	989	+ $_SESSION['token'] = json_encode( $token );
1111	990
1112		- $response = 'Successfully authenticated.';
	991	+ $response = "Successfully authenticated.";
1113	992	} else {
1114		- $client->setAccessToken( wp_json_encode( $token ) );
	993	+ $client->setAccessToken( json_encode( $token ) );
1115	994
1116	995	$response = 'Already authenticated.';
1117	996	}
1118	997
1119		- die( esc_html( $response ) );
	998	+ die( $response );
1120	999	}
1121	1000
1122	1001
1123	1002	/**
		@@ -1122,22 +1001,22 @@
1122	1001
1123	1002	/**
1124	1003	* Validate this user's credentials against Google.
1125	1004	*
1126		- * @param array $auth_settings Plugin settings.
1127		- * @return array|WP_Error Array containing email, authenticated_by, first_name,
1128		- * last_name, and username strings for the successfully
1129		- * authenticated user, or WP_Error() object on failure,
1130		- * or null if not attempting a google login.
	1005	+ * @param array $auth_settings Plugin settings
	1006	+ * @return [mixed] Array containing email, authenticated_by,
	1007	+ * first_name, last_name, and username
	1008	+ * strings for the successfully authenticated
	1009	+ * user, or WP_Error() object on failure,
	1010	+ * or null if not attempting a google login.
1131	1011	*/
1132	1012	private function custom_authenticate_google( $auth_settings ) {
1133	1013	// Move on if Google auth hasn't been requested here.
1134		- // phpcs:ignore WordPress.CSRF.NonceVerification.NoNonceVerification
1135		- if ( empty( $_GET['external'] ) || 'google' !== $_GET['external'] ) {
	1014	+ if ( empty( $_GET['external'] ) || $_GET['external'] !== 'google' ) {
1136	1015	return null;
1137	1016	}
1138	1017
1139		- // Get one time use token.
	1018	+ // Get one time use token
1140	1019	session_start();
1141	1020	$token = array_key_exists( 'token', $_SESSION ) ? json_decode( $_SESSION['token'] ) : null;
1142	1021
1143	1022	// No token, so this is not a succesful Google login.
		@@ -1144,13 +1023,10 @@
1144	1023	if ( is_null( $token ) ) {
1145	1024	return null;
1146	1025	}
1147	1026
1148		- /**
1149		- * Add Google API PHP Client.
1150		- *
1151		- * @see https://github.com/google/google-api-php-client branch:v1-master
1152		- */
	1027	+ // Add Google API PHP Client.
	1028	+ // @see https://github.com/google/google-api-php-client branch:v1-master
1153	1029	require_once dirname( __FILE__ ) . '/vendor/google-api-php-client/src/Google/autoload.php';
1154	1030
1155	1031	// Build the Google Client.
1156	1032	$client = new Google_Client();
		@@ -1158,24 +1034,19 @@
1158	1034	$client->setClientId( $auth_settings['google_clientid'] );
1159	1035	$client->setClientSecret( $auth_settings['google_clientsecret'] );
1160	1036	$client->setRedirectUri( 'postmessage' );
1161	1037
1162		- /**
1163		- * If the hosted domain parameter is set, restrict logins to that domain.
1164		- * Note: Will have to upgrade to google-api-php-client v2 or higher for
1165		- * this to function server-side; it's not complete in v1, so this check
1166		- * is performed manually later.
1167		- * if (
1168		- * array_key_exists( 'google_hosteddomain', $auth_settings ) &&
1169		- * strlen( $auth_settings['google_hosteddomain'] ) > 0
1170		- * ) {
1171		- * $google_hosteddomains = explode( "\n", str_replace( "\r", '', $auth_settings['google_hosteddomain'] ) );
1172		- * $google_hosteddomain = trim( $google_hosteddomains[0] );
1173		- * $client->setHostedDomain( $google_hosteddomain );
1174		- * }
1175		- */
	1038	+ // If the hosted domain parameter is set, restrict logins to that domain.
	1039	+ // Note: Will have to upgrade to google-api-php-client v2 or higher for
	1040	+ // this to function server-side; it's not complete in v1, so this check
	1041	+ // is performed manually below.
	1042	+ // if ( array_key_exists( 'google_hosteddomain', $auth_settings ) && strlen( $auth_settings['google_hosteddomain'] ) > 0 ) {
	1043	+ // $google_hosteddomains = explode( "\n", str_replace( "\r", '', $auth_settings['google_hosteddomain'] ) );
	1044	+ // $google_hosteddomain = trim( $google_hosteddomains[0] );
	1045	+ // $client->setHostedDomain( $google_hosteddomain );
	1046	+ // }
1176	1047
1177		- // Verify this is a successful Google authentication.
	1048	+ // Verify this is a successful Google authentication
1178	1049	try {
1179	1050	$ticket = $client->verifyIdToken( $token->id_token, $auth_settings['google_clientid'] );
1180	1051	} catch ( Google_Auth_Exception $e ) {
1181	1052	// Invalid ticket, so this in not a successful Google login.
		@@ -1186,29 +1057,25 @@
1186	1057	if ( ! $ticket ) {
1187	1058	return new WP_Error( 'invalid_google_login', __( 'Invalid Google credentials provided.', 'authorizer' ) );
1188	1059	}
1189	1060
1190		- // Get email address.
1191		- $attributes = $ticket->getAttributes();
1192		- $email = $this->lowercase( $attributes['payload']['email'] );
	1061	+ // Get email address
	1062	+ $attributes = $ticket->getAttributes();
	1063	+ $email = $attributes['payload']['email'];
1193	1064	$email_domain = substr( strrchr( $email, '@' ), 1 );
1194		- $username = current( explode( '@', $email ) );
	1065	+ $username = current( explode( '@', $email ) );
1195	1066
1196		- /**
1197		- * Fail if hd param is set and the logging in user's email address doesn't
1198		- * match the allowed hosted domain.
1199		- *
1200		- * See: https://developers.google.com/identity/protocols/OpenIDConnect#hd-param
1201		- * See: https://github.com/google/google-api-php-client/blob/v1-master/src/Google/Client.php#L407-L416
1202		- *
1203		- * Note: Will have to upgrade to google-api-php-client v2 or higher for
1204		- * this to function server-side; it's not complete in v1, so this check
1205		- * is only performed here.
1206		- */
	1067	+ // Fail if hd param is set and the logging in user's email address doesn't
	1068	+ // match the allowed hosted domain.
	1069	+ // See: https://developers.google.com/identity/protocols/OpenIDConnect#hd-param
	1070	+ // See: https://github.com/google/google-api-php-client/blob/v1-master/src/Google/Client.php#L407-L416
	1071	+ // Note: Will have to upgrade to google-api-php-client v2 or higher for
	1072	+ // this to function server-side; it's not complete in v1, so this check
	1073	+ // is only performed here.
1207	1074	if ( array_key_exists( 'google_hosteddomain', $auth_settings ) && strlen( $auth_settings['google_hosteddomain'] ) > 0 ) {
1208	1075	// Allow multiple whitelisted domains.
1209	1076	$google_hosteddomains = explode( "\n", str_replace( "\r", '', $auth_settings['google_hosteddomain'] ) );
1210		- if ( ! in_array( $email_domain, $google_hosteddomains, true ) ) {
	1077	+ if ( ! in_array( $email_domain, $google_hosteddomains ) ) {
1211	1078	$this->custom_logout();
1212	1079	return new WP_Error( 'invalid_google_login', __( 'Google credentials do not match the allowed hosted domain', 'authorizer' ) );
1213	1080	}
1214	1081	}
		@@ -1213,13 +1080,13 @@
1213	1080	}
1214	1081	}
1215	1082
1216	1083	return array(
1217		- 'email' => $email,
1218		- 'username' => $username,
1219		- 'first_name' => '',
1220		- 'last_name' => '',
1221		- 'authenticated_by' => 'google',
	1084	+ 'email' => $email,
	1085	+ 'username' => $username,
	1086	+ 'first_name' => '',
	1087	+ 'last_name' => '',
	1088	+ 'authenticated_by' => 'google',
1222	1089	'google_attributes' => $attributes,
1223	1090	);
1224	1091	}
1225	1092
		@@ -1226,47 +1093,40 @@
1226	1093
1227	1094	/**
1228	1095	* Validate this user's credentials against CAS.
1229	1096	*
1230		- * @param array $auth_settings Plugin settings.
1231		- * @return array|WP_Error Array containing 'email' and 'authenticated_by' strings
1232		- * for the successfully authenticated user, or WP_Error()
1233		- * object on failure, or null if not attempting a CAS login.
	1097	+ * @param array $auth_settings Plugin settings
	1098	+ * @return [mixed] Array containing 'email' and 'authenticated_by'
	1099	+ * strings for the successfully authenticated
	1100	+ * user, or WP_Error() object on failure,
	1101	+ * or null if not attempting a CAS login.
1234	1102	*/
1235	1103	private function custom_authenticate_cas( $auth_settings ) {
1236	1104	// Move on if CAS hasn't been requested here.
1237		- // phpcs:ignore WordPress.CSRF.NonceVerification.NoNonceVerification
1238		- if ( empty( $_GET['external'] ) || 'cas' !== $_GET['external'] ) {
	1105	+ if ( empty( $_GET['external'] ) || $_GET['external'] !== 'cas' ) {
1239	1106	return null;
1240	1107	}
1241	1108
1242		- /**
1243		- * Get the CAS server version (default to SAML_VERSION_1_1).
1244		- *
1245		- * @see: https://developer.jasig.org/cas-clients/php/1.3.4/docs/api/group__public.html
1246		- */
	1109	+ // Get the CAS server version (default to SAML_VERSION_1_1).
	1110	+ // See: https://developer.jasig.org/cas-clients/php/1.3.4/docs/api/group__public.html
1247	1111	$cas_version = SAML_VERSION_1_1;
1248		- if ( 'CAS_VERSION_3_0' === $auth_settings['cas_version'] ) {
	1112	+ if ( $auth_settings['cas_version'] === 'CAS_VERSION_3_0' ) {
1249	1113	$cas_version = CAS_VERSION_3_0;
1250		- } elseif ( 'CAS_VERSION_2_0' === $auth_settings['cas_version'] ) {
	1114	+ } elseif ( $auth_settings['cas_version'] === 'CAS_VERSION_2_0' ) {
1251	1115	$cas_version = CAS_VERSION_2_0;
1252		- } elseif ( 'CAS_VERSION_1_0' === $auth_settings['cas_version'] ) {
	1116	+ } elseif ( $auth_settings['cas_version'] === 'CAS_VERSION_1_0' ) {
1253	1117	$cas_version = CAS_VERSION_1_0;
1254	1118	}
1255	1119
1256		- // Set the CAS client configuration.
	1120	+ // Set the CAS client configuration
1257	1121	phpCAS::client( $cas_version, $auth_settings['cas_host'], intval( $auth_settings['cas_port'] ), $auth_settings['cas_path'] );
1258	1122
1259		- // Allow redirects at the CAS server endpoint (e.g., allow connections
1260		- // at an old CAS URL that redirects to a newer CAS URL).
1261		- phpCAS::setExtraCurlOption( CURLOPT_FOLLOWLOCATION, true );
1262		-
1263	1123	// Update server certificate bundle if it doesn't exist or is older
1264	1124	// than 6 months, then use it to ensure CAS server is legitimate.
1265	1125	// Note: only try to update if the system has the php_openssl extension.
1266		- $cacert_url = 'https://curl.haxx.se/ca/cacert.pem';
1267		- $cacert_path = plugin_dir_path( __FILE__ ) . 'vendor/cacert.pem';
1268		- $time_180_days = 180 * 24 * 60 * 60; // days * hours * minutes * seconds.
	1126	+ $cacert_url = 'https://curl.haxx.se/ca/cacert.pem';
	1127	+ $cacert_path = plugin_dir_path( __FILE__ ) . 'vendor/cacert.pem';
	1128	+ $time_180_days = 180 * 24 * 60 * 60; // days * hours * minutes * seconds
1269	1129	$time_180_days_ago = time() - $time_180_days;
1270	1130	if (
1271	1131	extension_loaded( 'openssl' ) &&
1272	1132	( ! file_exists( $cacert_path ) || filemtime( $cacert_path ) < $time_180_days_ago )
		@@ -1282,34 +1142,28 @@
1282	1142	}
1283	1143	$cacert_contents = $response['body'];
1284	1144
1285	1145	// Write out the updated certs to the plugin directory.
1286		- // Note: Don't use WP_Filesystem because we are not in an admin context
1287		- // and don't want to potentially prompt the end user for credentials.
1288		- // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_read_file_put_contents
1289	1146	file_put_contents( $cacert_path, $cacert_contents );
1290	1147	}
1291	1148	phpCAS::setCasServerCACert( $cacert_path );
1292	1149
1293	1150	// Set the CAS service URL (including the redirect URL for WordPress when it comes back from CAS).
1294		- $cas_service_url = site_url( '/wp-login.php?external=cas' );
1295		- $login_querystring = array();
1296		- if ( isset( $_SERVER['QUERY_STRING'] ) ) {
1297		- parse_str( $_SERVER['QUERY_STRING'], $login_querystring ); // phpcs:ignore WordPress.VIP.ValidatedSanitizedInput
1298		- }
	1151	+ $cas_service_url = site_url( '/wp-login.php?external=cas' );
	1152	+ $login_querystring = array(); parse_str( $_SERVER['QUERY_STRING'], $login_querystring );
1299	1153	if ( isset( $login_querystring['redirect_to'] ) ) {
1300		- $cas_service_url .= '&redirect_to=' . rawurlencode( $login_querystring['redirect_to'] );
	1154	+ $cas_service_url .= '&redirect_to=' . urlencode( $login_querystring['redirect_to'] );
1301	1155	}
1302	1156	phpCAS::setFixedServiceURL( $cas_service_url );
1303	1157
1304		- // Authenticate against CAS.
	1158	+ // Authenticate against CAS
1305	1159	try {
1306	1160	phpCAS::forceAuthentication();
1307	1161	} catch ( CAS_AuthenticationException $e ) {
1308	1162	// CAS server threw an error in isAuthenticated(), potentially because
1309	1163	// the cached ticket is outdated. Try renewing the authentication.
1310		- error_log( __( 'CAS server returned an Authentication Exception. Details:', 'authorizer' ) ); // phpcs:ignore
1311		- error_log( print_r( $e, true ) ); // phpcs:ignore
	1164	+ error_log( __( 'CAS server returned an Authentication Exception. Details:', 'authorizer' ) );
	1165	+ error_log( print_r( $e, true ) );
1312	1166
1313	1167	// CAS server is throwing errors on this login, so try logging the
1314	1168	// user out of CAS and redirecting them to the login page.
1315	1169	phpCAS::logoutWithRedirectService( wp_login_url() );
		@@ -1324,10 +1178,10 @@
1324	1178	if ( ! filter_var( $externally_authenticated_email, FILTER_VALIDATE_EMAIL ) ) {
1325	1179	// If we can't get the user's email address from a CAS attribute,
1326	1180	// try to guess the domain from the CAS server hostname. This will only
1327	1181	// be used if we can't discover the email address from CAS attributes.
1328		- $domain_guess = preg_match( '/[^.]*\.[^.]*$/', $auth_settings['cas_host'], $matches ) === 1 ? $matches[0] : '';
1329		- $externally_authenticated_email = $this->lowercase( $username ) . '@' . $domain_guess;
	1182	+ $domain_guess = preg_match( '/[^.]*\.[^.]*$/', $auth_settings['cas_host'], $matches ) === 1 ? $matches[0] : '';
	1183	+ $externally_authenticated_email = strtolower( $username ) . '@' . $domain_guess;
1330	1184	}
1331	1185
1332	1186	// Retrieve the user attributes (e.g., email address, first name, last name) from the CAS server.
1333	1187	$cas_attributes = phpCAS::getAttributes();
		@@ -1338,45 +1192,37 @@
1338	1192	// email domain is manually entered there (instead of a reference to a
1339	1193	// CAS attribute), and combine that with the username to create the email.
1340	1194	// Otherwise, look up the CAS attribute for email.
1341	1195	if ( substr( $auth_settings['cas_attr_email'], 0, 1 ) === '@' ) {
1342		- $externally_authenticated_email = $this->lowercase( $username . $auth_settings['cas_attr_email'] );
	1196	+ $externally_authenticated_email = strtolower( $username . $auth_settings['cas_attr_email'] );
1343	1197	} elseif (
1344	1198	// If a CAS attribute has been specified as containing the email address, use that instead.
1345	1199	// Email attribute can be a string or an array of strings.
1346	1200	array_key_exists( $auth_settings['cas_attr_email'], $cas_attributes ) && (
1347	1201	(
1348		- is_array( $cas_attributes[ $auth_settings['cas_attr_email'] ] ) &&
1349		- count( $cas_attributes[ $auth_settings['cas_attr_email'] ] ) > 0
	1202	+ is_array( $cas_attributes[$auth_settings['cas_attr_email']] ) &&
	1203	+ count( $cas_attributes[$auth_settings['cas_attr_email']] ) > 0
1350	1204	) || (
1351		- is_string( $cas_attributes[ $auth_settings['cas_attr_email'] ] ) &&
1352		- strlen( $cas_attributes[ $auth_settings['cas_attr_email'] ] ) > 0
	1205	+ is_string( $cas_attributes[$auth_settings['cas_attr_email']] ) &&
	1206	+ strlen( $cas_attributes[$auth_settings['cas_attr_email']] ) > 0
1353	1207	)
1354	1208	)
1355	1209	) {
1356		- // Each of the emails in the array needs to be set to lowercase.
1357		- if ( is_array( $cas_attributes[ $auth_settings['cas_attr_email'] ] ) ) {
1358		- $externally_authenticated_email = array();
1359		- foreach ( $cas_attributes[ $auth_settings['cas_attr_email'] ] as $external_email ) {
1360		- $externally_authenticated_email[] = $this->lowercase( $external_email );
1361		- }
1362		- } else {
1363		- $externally_authenticated_email = $this->lowercase( $cas_attributes[ $auth_settings['cas_attr_email'] ] );
1364		- }
	1210	+ $externally_authenticated_email = $cas_attributes[$auth_settings['cas_attr_email']];
1365	1211	}
1366	1212	}
1367	1213
1368	1214	// Get user first name and last name.
1369		- $first_name = array_key_exists( 'cas_attr_first_name', $auth_settings ) && strlen( $auth_settings['cas_attr_first_name'] ) > 0 && array_key_exists( $auth_settings['cas_attr_first_name'], $cas_attributes ) && strlen( $cas_attributes[ $auth_settings['cas_attr_first_name'] ] ) > 0 ? $cas_attributes[ $auth_settings['cas_attr_first_name'] ] : '';
1370		- $last_name = array_key_exists( 'cas_attr_last_name', $auth_settings ) && strlen( $auth_settings['cas_attr_last_name'] ) > 0 && array_key_exists( $auth_settings['cas_attr_last_name'], $cas_attributes ) && strlen( $cas_attributes[ $auth_settings['cas_attr_last_name'] ] ) > 0 ? $cas_attributes[ $auth_settings['cas_attr_last_name'] ] : '';
	1215	+ $first_name = array_key_exists( 'cas_attr_first_name', $auth_settings ) && strlen( $auth_settings['cas_attr_first_name'] ) > 0 && array_key_exists( $auth_settings['cas_attr_first_name'], $cas_attributes ) && strlen( $cas_attributes[$auth_settings['cas_attr_first_name']] ) > 0 ? $cas_attributes[$auth_settings['cas_attr_first_name']] : '';
	1216	+ $last_name = array_key_exists( 'cas_attr_last_name', $auth_settings ) && strlen( $auth_settings['cas_attr_last_name'] ) > 0 && array_key_exists( $auth_settings['cas_attr_last_name'], $cas_attributes ) && strlen( $cas_attributes[$auth_settings['cas_attr_last_name']] ) > 0 ? $cas_attributes[$auth_settings['cas_attr_last_name']] : '';
1371	1217
1372	1218	return array(
1373		- 'email' => $externally_authenticated_email,
1374		- 'username' => $username,
1375		- 'first_name' => $first_name,
1376		- 'last_name' => $last_name,
	1219	+ 'email' => $externally_authenticated_email,
	1220	+ 'username' => $username,
	1221	+ 'first_name' => $first_name,
	1222	+ 'last_name' => $last_name,
1377	1223	'authenticated_by' => 'cas',
1378		- 'cas_attributes' => $cas_attributes,
	1224	+ 'cas_attributes' => $cas_attributes,
1379	1225	);
1380	1226	}
1381	1227
1382	1228
		@@ -1382,32 +1228,24 @@
1382	1228
1383	1229	/**
1384	1230	* Validate this user's credentials against LDAP.
1385	1231	*
1386		- * @param array $auth_settings Plugin settings.
1387		- * @param string $username Attempted username from authenticate action.
1388		- * @param string $password Attempted password from authenticate action.
1389		- * @return array|WP_Error Array containing 'email' and 'authenticated_by' strings
1390		- * for the successfully authenticated user, or WP_Error()
1391		- * object on failure, or null if skipping LDAP auth and
1392		- * falling back to WP auth.
	1232	+ * @param array $auth_settings Plugin settings
	1233	+ * @param string $username Attempted username from authenticate action
	1234	+ * @param string $password Attempted password from authenticate action
	1235	+ * @return [mixed] Array containing 'email' and 'authenticated_by'
	1236	+ * strings for the successfully authenticated
	1237	+ * user, or WP_Error() object on failure,
	1238	+ * or null if skipping LDAP auth and falling back to WP auth.
1393	1239	*/
1394	1240	private function custom_authenticate_ldap( $auth_settings, $username, $password ) {
1395		- // Get LDAP search base(s).
1396		- $search_bases = explode( "\n", str_replace( "\r", '', trim( $auth_settings['ldap_search_base'] ) ) );
1397		-
1398		- // Fail silently (fall back to WordPress authentication) if no search base specified.
1399		- if ( count( $search_bases ) < 1 ) {
1400		- return null;
1401		- }
1402		-
1403		- // Get the FQDN from the first LDAP search base domain components (dc). For
1404		- // example, ou=people,dc=example,dc=edu,dc=uk would yield user@example.edu.uk.
1405		- $search_base_components = explode( ',', trim( $search_bases[0] ) );
1406		- $domain = array();
	1241	+ // Get the FQDN from the LDAP search base domain components (dc). For
	1242	+ // example, ou=people,dc=example,dc=edu,dc=uk would yield user@example.edu.uk
	1243	+ $search_base_components = explode( ',', trim( $auth_settings['ldap_search_base'] ) );
	1244	+ $domain = array();
1407	1245	foreach ( $search_base_components as $search_base_component ) {
1408	1246	$component = explode( '=', $search_base_component );
1409		- if ( 2 === count( $component ) && 'dc' === $component[0] ) {
	1247	+ if ( count( $component ) === 2 && $component[0] === 'dc' ) {
1410	1248	$domain[] = $component[1];
1411	1249	}
1412	1250	}
1413	1251	$domain = implode( '.', $domain );
		@@ -1418,9 +1256,9 @@
1418	1256	if ( empty( $domain ) ) {
1419	1257	$domain = preg_match( '/[^.]*\.[^.]*$/', $auth_settings['ldap_host'], $matches ) === 1 ? $matches[0] : '';
1420	1258	}
1421	1259
1422		- // remove @domain if it exists in the username (i.e., if user entered their email).
	1260	+ // remove @domain if it exists in the username (i.e., if user entered their email)
1423	1261	$username = str_replace( '@' . $domain, '', $username );
1424	1262
1425	1263	// Fail silently (fall back to WordPress authentication) if both username
1426	1264	// and password are empty (this will be the case when visiting wp-login.php
		@@ -1443,13 +1281,13 @@
1443	1281	return null;
1444	1282	}
1445	1283
1446	1284	// Authenticate against LDAP using options provided in plugin settings.
1447		- $result = false;
	1285	+ $result = false;
1448	1286	$ldap_user_dn = '';
1449		- $first_name = '';
1450		- $last_name = '';
1451		- $email = '';
	1287	+ $first_name = '';
	1288	+ $last_name = '';
	1289	+ $email = '';
1452	1290
1453	1291	// Construct LDAP connection parameters. ldap_connect() takes either a
1454	1292	// hostname or a full LDAP URI as its first parameter (works with OpenLDAP
1455	1293	// 2.x.x or later). If it's an LDAP URI, the second parameter, $port, is
		@@ -1454,13 +1292,13 @@
1454	1292	// hostname or a full LDAP URI as its first parameter (works with OpenLDAP
1455	1293	// 2.x.x or later). If it's an LDAP URI, the second parameter, $port, is
1456	1294	// ignored, and port must be specified in the full URI. An LDAP URI is of
1457	1295	// the form ldap://hostname:port or ldaps://hostname:port.
1458		- $ldap_host = $auth_settings['ldap_host'];
1459		- $ldap_port = intval( $auth_settings['ldap_port'] );
1460		- $parsed_host = wp_parse_url( $ldap_host );
	1296	+ $ldap_host = $auth_settings['ldap_host'];
	1297	+ $ldap_port = intval( $auth_settings['ldap_port'] );
	1298	+ $parsed_host = parse_url( $ldap_host );
1461	1299	// Fail (fall back to WordPress auth) if invalid host is specified.
1462		- if ( false === $parsed_host ) {
	1300	+ if ( $parsed_host === false ) {
1463	1301	return null;
1464	1302	}
1465	1303	// If a scheme is in the LDAP host, use full LDAP URI instead of just hostname.
1466	1304	if ( array_key_exists( 'scheme', $parsed_host ) ) {
		@@ -1473,24 +1311,24 @@
1473	1311
1474	1312	// Establish LDAP connection.
1475	1313	$ldap = ldap_connect( $ldap_host, $ldap_port );
1476	1314	ldap_set_option( $ldap, LDAP_OPT_PROTOCOL_VERSION, 3 );
1477		- if ( 1 === intval( $auth_settings['ldap_tls'] ) ) {
1478		- if ( ! ldap_start_tls( $ldap ) ) {
	1315	+ if ( $auth_settings['ldap_tls'] == 1 ) {
	1316	+ if( ! ldap_start_tls( $ldap ) ) {
1479	1317	return null;
1480	1318	}
1481	1319	}
1482	1320
1483	1321	// Set bind credentials; attempt an anonymous bind if not provided.
1484		- $bind_rdn = null;
1485		- $bind_password = null;
	1322	+ $bind_rdn = NULL;
	1323	+ $bind_password = NULL;
1486	1324	if ( strlen( $auth_settings['ldap_user'] ) > 0 ) {
1487		- $bind_rdn = $auth_settings['ldap_user'];
	1325	+ $bind_rdn = $auth_settings['ldap_user'];
1488	1326	$bind_password = $this->decrypt( $auth_settings['ldap_password'] );
1489	1327	}
1490	1328
1491	1329	// Attempt LDAP bind.
1492		- $result = @ldap_bind( $ldap, $bind_rdn, stripslashes( $bind_password ) ); // phpcs:ignore
	1330	+ $result = @ldap_bind( $ldap, $bind_rdn, stripslashes( $bind_password ) );
1493	1331	if ( ! $result ) {
1494	1332	// Can't connect to LDAP, so fall back to WordPress authentication.
1495	1333	return null;
1496	1334	}
		@@ -1504,40 +1342,18 @@
1504	1342	if ( array_key_exists( 'ldap_attr_last_name', $auth_settings ) && strlen( $auth_settings['ldap_attr_last_name'] ) > 0 ) {
1505	1343	array_push( $ldap_attributes_to_retrieve, $auth_settings['ldap_attr_last_name'] );
1506	1344	}
1507	1345	if ( array_key_exists( 'ldap_attr_email', $auth_settings ) && strlen( $auth_settings['ldap_attr_email'] ) > 0 && substr( $auth_settings['ldap_attr_email'], 0, 1 ) !== '@' ) {
1508		- array_push( $ldap_attributes_to_retrieve, $this->lowercase( $auth_settings['ldap_attr_email'] ) );
	1346	+ array_push( $ldap_attributes_to_retrieve, $auth_settings['ldap_attr_email'] );
1509	1347	}
	1348	+ $ldap_search = ldap_search(
	1349	+ $ldap,
	1350	+ $auth_settings['ldap_search_base'],
	1351	+ "(" . $auth_settings['ldap_uid'] . "=" . $username . ")",
	1352	+ $ldap_attributes_to_retrieve
	1353	+ );
	1354	+ $ldap_entries = ldap_get_entries( $ldap, $ldap_search );
1510	1355
1511		- // Create default LDAP search filter (uid=$username).
1512		- $search_filter = '(' . $auth_settings['ldap_uid'] . '=' . $username . ')';
1513		-
1514		- /**
1515		- * Filter LDAP search filter.
1516		- *
1517		- * Allows for custom LDAP authentication rules (e.g., restricting login
1518		- * access to users in multiple groups, or having certain attributes).
1519		- *
1520		- * @param string $search_filter The filter to pass to ldap_search().
1521		- * @param string $ldap_uid The attribute to compare username against (from Authorizer Settings).
1522		- * @param string $username The username attempting to log in.
1523		- */
1524		- $search_filter = apply_filters( 'authorizer_ldap_search_filter', $search_filter, $auth_settings['ldap_uid'], $username );
1525		-
1526		- // Multiple search bases can be provided, so iterate through them until a match is found.
1527		- foreach ( $search_bases as $search_base ) {
1528		- $ldap_search = ldap_search(
1529		- $ldap,
1530		- $search_base,
1531		- $search_filter,
1532		- $ldap_attributes_to_retrieve
1533		- );
1534		- $ldap_entries = ldap_get_entries( $ldap, $ldap_search );
1535		- if ( $ldap_entries['count'] > 0 ) {
1536		- break;
1537		- }
1538		- }
1539		-
1540	1356	// If we didn't find any users in ldap, fall back to WordPress authentication.
1541	1357	if ( $ldap_entries['count'] < 1 ) {
1542	1358	return null;
1543	1359	}
		@@ -1543,21 +1359,21 @@
1543	1359	}
1544	1360
1545	1361	// Get the bind dn and first/last names; if there are multiple results returned, just get the last one.
1546	1362	for ( $i = 0; $i < $ldap_entries['count']; $i++ ) {
1547		- $ldap_user_dn = $ldap_entries[ $i ]['dn'];
	1363	+ $ldap_user_dn = $ldap_entries[$i]['dn'];
1548	1364
1549	1365	// Get user first name and last name.
1550		- $ldap_attr_first_name = array_key_exists( 'ldap_attr_first_name', $auth_settings ) ? $this->lowercase( $auth_settings['ldap_attr_first_name'] ) : '';
1551		- if ( strlen( $ldap_attr_first_name ) > 0 && array_key_exists( $ldap_attr_first_name, $ldap_entries[ $i ] ) && $ldap_entries[ $i ][ $ldap_attr_first_name ]['count'] > 0 && strlen( $ldap_entries[ $i ][ $ldap_attr_first_name ][0] ) > 0 ) {
1552		- $first_name = $ldap_entries[ $i ][ $ldap_attr_first_name ][0];
	1366	+ $ldap_attr_first_name = array_key_exists( 'ldap_attr_first_name', $auth_settings ) ? strtolower( $auth_settings['ldap_attr_first_name'] ) : '';
	1367	+ if ( strlen( $ldap_attr_first_name ) > 0 && array_key_exists( $ldap_attr_first_name, $ldap_entries[$i] ) && $ldap_entries[$i][$ldap_attr_first_name]['count'] > 0 && strlen( $ldap_entries[$i][$ldap_attr_first_name][0] ) > 0 ) {
	1368	+ $first_name = $ldap_entries[$i][$ldap_attr_first_name][0];
1553	1369	}
1554		- $ldap_attr_last_name = array_key_exists( 'ldap_attr_last_name', $auth_settings ) ? $this->lowercase( $auth_settings['ldap_attr_last_name'] ) : '';
1555		- if ( strlen( $ldap_attr_last_name ) > 0 && array_key_exists( $ldap_attr_last_name, $ldap_entries[ $i ] ) && $ldap_entries[ $i ][ $ldap_attr_last_name ]['count'] > 0 && strlen( $ldap_entries[ $i ][ $ldap_attr_last_name ][0] ) > 0 ) {
1556		- $last_name = $ldap_entries[ $i ][ $ldap_attr_last_name ][0];
	1370	+ $ldap_attr_last_name = array_key_exists( 'ldap_attr_last_name', $auth_settings ) ? strtolower( $auth_settings['ldap_attr_last_name'] ) : '';
	1371	+ if ( strlen( $ldap_attr_last_name ) > 0 && array_key_exists( $ldap_attr_last_name, $ldap_entries[$i] ) && $ldap_entries[$i][$ldap_attr_last_name]['count'] > 0 && strlen( $ldap_entries[$i][$ldap_attr_last_name][0] ) > 0 ) {
	1372	+ $last_name = $ldap_entries[$i][$ldap_attr_last_name][0];
1557	1373	}
1558	1374	// Get user email if it is specified in another field.
1559		- $ldap_attr_email = array_key_exists( 'ldap_attr_email', $auth_settings ) ? $this->lowercase( $auth_settings['ldap_attr_email'] ) : '';
	1375	+ $ldap_attr_email = array_key_exists( 'ldap_attr_email', $auth_settings ) ? strtolower( $auth_settings['ldap_attr_email'] ) : '';
1560	1376	if ( strlen( $ldap_attr_email ) > 0 ) {
1561	1377	// If the email attribute starts with an at symbol (@), assume that the
1562	1378	// email domain is manually entered there (instead of a reference to an
1563	1379	// LDAP attribute), and combine that with the username to create the email.
		@@ -1562,16 +1378,16 @@
1562	1378	// email domain is manually entered there (instead of a reference to an
1563	1379	// LDAP attribute), and combine that with the username to create the email.
1564	1380	// Otherwise, look up the LDAP attribute for email.
1565	1381	if ( substr( $ldap_attr_email, 0, 1 ) === '@' ) {
1566		- $email = $this->lowercase( $username . $ldap_attr_email );
1567		- } elseif ( array_key_exists( $ldap_attr_email, $ldap_entries[ $i ] ) && $ldap_entries[ $i ][ $ldap_attr_email ]['count'] > 0 && strlen( $ldap_entries[ $i ][ $ldap_attr_email ][0] ) > 0 ) {
1568		- $email = $this->lowercase( $ldap_entries[ $i ][ $ldap_attr_email ][0] );
	1382	+ $email = strtolower( $username . $ldap_attr_email );
	1383	+ } elseif ( array_key_exists( $ldap_attr_email, $ldap_entries[$i] ) && $ldap_entries[$i][$ldap_attr_email]['count'] > 0 && strlen( $ldap_entries[$i][$ldap_attr_email][0] ) > 0 ) {
	1384	+ $email = strtolower( $ldap_entries[$i][$ldap_attr_email][0] );
1569	1385	}
1570	1386	}
1571	1387	}
1572	1388
1573		- $result = @ldap_bind( $ldap, $ldap_user_dn, stripslashes( $password ) ); // phpcs:ignore
	1389	+ $result = @ldap_bind( $ldap, $ldap_user_dn, stripslashes( $password ) );
1574	1390	if ( ! $result ) {
1575	1391	// We have a real ldap user, but an invalid password. Pass
1576	1392	// through to wp authentication after failing LDAP (since
1577	1393	// this could be a local account that happens to be the
		@@ -1579,22 +1395,22 @@
1579	1395	return null;
1580	1396	}
1581	1397
1582	1398	// User successfully authenticated against LDAP, so set the relevant variables.
1583		- $externally_authenticated_email = $this->lowercase( $username . '@' . $domain );
	1399	+ $externally_authenticated_email = $username . '@' . $domain;
1584	1400
1585	1401	// If an LDAP attribute has been specified as containing the email address, use that instead.
1586	1402	if ( strlen( $email ) > 0 ) {
1587		- $externally_authenticated_email = $this->lowercase( $email );
	1403	+ $externally_authenticated_email = $email;
1588	1404	}
1589	1405
1590	1406	return array(
1591		- 'email' => $externally_authenticated_email,
1592		- 'username' => $username,
1593		- 'first_name' => $first_name,
1594		- 'last_name' => $last_name,
	1407	+ 'email' => $externally_authenticated_email,
	1408	+ 'username' => $username,
	1409	+ 'first_name' => $first_name,
	1410	+ 'last_name' => $last_name,
1595	1411	'authenticated_by' => 'ldap',
1596		- 'ldap_attributes' => $ldap_entries,
	1412	+ 'ldap_attributes' => $ldap_entries,
1597	1413	);
1598	1414	}
1599	1415
1600	1416
		@@ -1600,20 +1416,18 @@
1600	1416
1601	1417	/**
1602	1418	* Log out of the attached external service.
1603	1419	*
1604		- * Action: wp_logout
1605		- *
1606	1420	* @return void
1607	1421	*/
1608	1422	public function custom_logout() {
1609	1423	// Grab plugin settings.
1610		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
	1424	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' );
1611	1425
1612	1426	// Reset option containing old error messages.
1613	1427	delete_option( 'auth_settings_advanced_login_error' );
1614	1428
1615		- if ( session_id() === '' ) {
	1429	+ if ( session_id() == '' ) {
1616	1430	session_start();
1617	1431	}
1618	1432
1619	1433	$current_user_authenticated_by = get_user_meta( get_current_user_id(), 'authenticated_by', true );
		@@ -1618,38 +1432,32 @@
1618	1432
1619	1433	$current_user_authenticated_by = get_user_meta( get_current_user_id(), 'authenticated_by', true );
1620	1434
1621	1435	// If logged in to CAS, Log out of CAS.
1622		- if ( 'cas' === $current_user_authenticated_by && '1' === $auth_settings['cas'] ) {
	1436	+ if ( $current_user_authenticated_by === 'cas' && $auth_settings['cas'] === '1' ) {
1623	1437	if ( ! array_key_exists( 'PHPCAS_CLIENT', $GLOBALS ) || ! array_key_exists( 'phpCAS', $_SESSION ) ) {
1624	1438
1625		- /**
1626		- * Get the CAS server version (default to SAML_VERSION_1_1).
1627		- *
1628		- * @see: https://developer.jasig.org/cas-clients/php/1.3.4/docs/api/group__public.html
1629		- */
	1439	+ // Get the CAS server version (default to SAML_VERSION_1_1).
	1440	+ // See: https://developer.jasig.org/cas-clients/php/1.3.4/docs/api/group__public.html
1630	1441	$cas_version = SAML_VERSION_1_1;
1631		- if ( 'CAS_VERSION_3_0' === $auth_settings['cas_version'] ) {
	1442	+ if ( $auth_settings['cas_version'] === 'CAS_VERSION_3_0' ) {
1632	1443	$cas_version = CAS_VERSION_3_0;
1633		- } elseif ( 'CAS_VERSION_2_0' === $auth_settings['cas_version'] ) {
	1444	+ } elseif ( $auth_settings['cas_version'] === 'CAS_VERSION_2_0' ) {
1634	1445	$cas_version = CAS_VERSION_2_0;
1635		- } elseif ( 'CAS_VERSION_1_0' === $auth_settings['cas_version'] ) {
	1446	+ } elseif ( $auth_settings['cas_version'] === 'CAS_VERSION_1_0' ) {
1636	1447	$cas_version = CAS_VERSION_1_0;
1637	1448	}
1638	1449
1639	1450	// Set the CAS client configuration if it hasn't been set already.
1640	1451	phpCAS::client( $cas_version, $auth_settings['cas_host'], intval( $auth_settings['cas_port'] ), $auth_settings['cas_path'] );
1641		- // Allow redirects at the CAS server endpoint (e.g., allow connections
1642		- // at an old CAS URL that redirects to a newer CAS URL).
1643		- phpCAS::setExtraCurlOption( CURLOPT_FOLLOWLOCATION, true );
1644	1452	// Restrict logout request origin to the CAS server only (prevent DDOS).
1645	1453	phpCAS::handleLogoutRequests( true, array( $auth_settings['cas_host'] ) );
1646	1454	}
1647		- if ( phpCAS::isAuthenticated() || phpCAS::isInitialized() ) {
	1455	+ if ( phpCAS::isAuthenticated() ) {
1648	1456	// Redirect to home page, or specified page if it's been provided.
1649	1457	$redirect_to = site_url( '/' );
1650		- if ( ! empty( $_REQUEST['redirect_to'] ) && isset( $_REQUEST['_wpnonce'] ) && wp_verify_nonce( sanitize_key( $_REQUEST['_wpnonce'] ), 'log-out' ) ) {
1651		- $redirect_to = esc_url_raw( wp_unslash( $_REQUEST['redirect_to'] ) );
	1458	+ if ( array_key_exists( 'redirect_to', $_REQUEST ) && filter_var( $_REQUEST['redirect_to'], FILTER_VALIDATE_URL ) !== false ) {
	1459	+ $redirect_to = $_REQUEST['redirect_to'];
1652	1460	}
1653	1461
1654	1462	phpCAS::logoutWithRedirectService( $redirect_to );
1655	1463	}
		@@ -1655,16 +1463,13 @@
1655	1463	}
1656	1464	}
1657	1465
1658	1466	// If session token set, log out of Google.
1659		- if ( 'google' === $current_user_authenticated_by || array_key_exists( 'token', $_SESSION ) ) {
	1467	+ if ( $current_user_authenticated_by === 'google' || array_key_exists( 'token', $_SESSION ) ) {
1660	1468	$token = json_decode( $_SESSION['token'] )->access_token;
1661	1469
1662		- /**
1663		- * Add Google API PHP Client.
1664		- *
1665		- * @see https://github.com/google/google-api-php-client branch:v1-master
1666		- */
	1470	+ // Add Google API PHP Client.
	1471	+ // @see https://github.com/google/google-api-php-client branch:v1-master
1667	1472	require_once dirname( __FILE__ ) . '/vendor/google-api-php-client/src/Google/autoload.php';
1668	1473
1669	1474	// Build the Google Client.
1670	1475	$client = new Google_Client();
		@@ -1672,9 +1477,9 @@
1672	1477	$client->setClientId( $auth_settings['google_clientid'] );
1673	1478	$client->setClientSecret( $auth_settings['google_clientsecret'] );
1674	1479	$client->setRedirectUri( 'postmessage' );
1675	1480
1676		- // Revoke the token.
	1481	+ // Revoke the token
1677	1482	$client->revokeToken( $token );
1678	1483
1679	1484	// Remove the credentials from the user's session.
1680	1485	unset( $_SESSION['token'] );
		@@ -1693,37 +1498,36 @@
1693	1498
1694	1499
1695	1500	/**
1696	1501	* Restrict access to WordPress site based on settings (everyone, logged_in_users).
	1502	+ * Hook: parse_request http://codex.wordpress.org/Plugin_API/Action_Reference/parse_request
1697	1503	*
1698		- * Action: parse_request
	1504	+ * @param array $wp WordPress object.
1699	1505	*
1700		- * @param array $wp WordPress object.
1701		- * @return WP|void WP object when passing through to WordPress authentication, or void.
	1506	+ * @return void
1702	1507	*/
1703	1508	public function restrict_access( $wp ) {
1704	1509	// Grab plugin settings.
1705		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
	1510	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' );
1706	1511
1707	1512	// Grab current user.
1708	1513	$current_user = wp_get_current_user();
1709	1514
1710	1515	$has_access = (
1711		- // Always allow access if WordPress is installing.
1712		- // phpcs:ignore WordPress.CSRF.NonceVerification.NoNonceVerification
	1516	+ // Always allow access if WordPress is installing
1713	1517	( defined( 'WP_INSTALLING' ) && isset( $_GET['key'] ) ) ||
1714		- // Always allow access to admins.
	1518	+ // Always allow access to admins
1715	1519	( current_user_can( 'create_users' ) ) ||
1716		- // Allow access if option is set to 'everyone'.
1717		- ( 'everyone' === $auth_settings['access_who_can_view'] ) ||
1718		- // Allow access to approved external users and logged in users if option is set to 'logged_in_users'.
1719		- ( 'logged_in_users' === $auth_settings['access_who_can_view'] && $this->is_user_logged_in_and_blog_user() && $this->is_email_in_list( $current_user->user_email, 'approved' ) ) ||
1720		- // Allow access for requests to /wp-json/oauth1 so oauth clients can authenticate to use the REST API.
1721		- ( property_exists( $wp, 'matched_query' ) && stripos( $wp->matched_query, 'rest_oauth1=' ) === 0 ) ||
1722		- // Allow access for non-GET requests to /wp-json/*, since REST API authentication already covers them.
1723		- ( property_exists( $wp, 'matched_query' ) && 0 === stripos( $wp->matched_query, 'rest_route=' ) && isset( $_SERVER['REQUEST_METHOD'] ) && 'GET' !== $_SERVER['REQUEST_METHOD'] ) ||
1724		- // Allow access for GET requests to /wp-json/ (root), since REST API discovery calls rely on this.
1725		- ( property_exists( $wp, 'matched_query' ) && 'rest_route=/' === $wp->matched_query )
	1520	+ // Allow access if option is set to 'everyone'
	1521	+ ( $auth_settings['access_who_can_view'] == 'everyone' ) ||
	1522	+ // Allow access to approved external users and logged in users if option is set to 'logged_in_users'
	1523	+ ( $auth_settings['access_who_can_view'] == 'logged_in_users' && $this->is_user_logged_in_and_blog_user() && $this->is_email_in_list( $current_user->user_email, 'approved' ) ) ||
	1524	+ // Allow access for requests to /wp-json/oauth1 so oauth clients can authenticate to use the REST API
	1525	+ ( property_exists( $wp, 'matched_query' ) && stripos( $wp->matched_query, "rest_oauth1=" ) === 0 ) ||
	1526	+ // Allow access for non-GET requests to /wp-json/*, since REST API authentication already covers them
	1527	+ ( property_exists( $wp, 'matched_query' ) && stripos( $wp->matched_query, "rest_route=" ) === 0 && $_SERVER['REQUEST_METHOD'] !== 'GET' ) ||
	1528	+ // Allow access for GET requests to /wp-json/ (root), since REST API discovery calls rely on this
	1529	+ ( property_exists( $wp, 'matched_query' ) && $wp->matched_query === 'rest_route=/' )
1726	1530	// Note that GET requests to a rest endpoint will be restricted by authorizer. In that case, error messages will be returned as JSON.
1727	1531	);
1728	1532
1729	1533	/**
		@@ -1745,9 +1549,9 @@
1745	1549	* }
1746	1550	* add_filter( 'authorizer_has_access', 'my_rsa_feed_access_override' );
1747	1551	*/
1748	1552	if ( apply_filters( 'authorizer_has_access', $has_access, $wp ) === true ) {
1749		- // Turn off the public notice about browsing anonymously.
	1553	+ // Turn off the public notice about browsing anonymously
1750	1554	update_option( 'auth_settings_advanced_public_notice', false );
1751	1555
1752	1556	// We've determined that the current user has access, so simply return to grant access.
1753	1557	return $wp;
		@@ -1753,13 +1557,13 @@
1753	1557	return $wp;
1754	1558	}
1755	1559
1756	1560	// Allow HEAD requests to the root (usually discovery from a REST client).
1757		- if ( 'HEAD' === $_SERVER['REQUEST_METHOD'] && empty( $wp->request ) && empty( $wp->matched_query ) ) {
	1561	+ if ( $_SERVER['REQUEST_METHOD'] === 'HEAD' && empty( $wp->request ) && empty( $wp->matched_query ) ) {
1758	1562	return $wp;
1759	1563	}
1760	1564
1761		- /* We've determined that the current user doesn't have access, so we deal with them now. */
	1565	+ // We've determined that the current user doesn't have access, so we deal with them now.
1762	1566
1763	1567	// Fringe case: In a multisite, a user of a different blog can successfully
1764	1568	// log in, but they aren't on the 'approved' whitelist for this blog.
1765	1569	// If that's the case, add them to the pending list for this blog.
		@@ -1770,19 +1574,29 @@
1770	1574	$result = $this->check_user_access( $current_user, array( $current_user->user_email ) );
1771	1575	}
1772	1576
1773	1577	// Check to see if the requested page is public. If so, show it.
	1578	+ $current_page_name = property_exists( $wp, 'query_vars' ) && array_key_exists( 'name', $wp->query_vars ) && strlen( $wp->query_vars['name'] ) > 0 ? $wp->query_vars['name'] : '';
	1579	+ if ( ! $current_page_name ) {
	1580	+ // Different WordPress versions store the page slug in different places; look for it elsewhere.
	1581	+ if ( property_exists( $wp, 'query_vars' ) && array_key_exists( 'pagename', $wp->query_vars ) && strlen( $wp->query_vars['pagename'] ) > 0 ) {
	1582	+ $current_page_name = $wp->query_vars['pagename'];
	1583	+ }
	1584	+ }
	1585	+ $current_page_id = '';
1774	1586	if ( empty( $wp->request ) ) {
1775	1587	$current_page_id = 'home';
1776	1588	} else {
1777		- $request_query = isset( $wp->query_vars ) ? new WP_Query( $wp->query_vars ) : null;
1778		- $current_page_id = isset( $request_query->post_count ) && $request_query->post_count > 0 ? $request_query->post->ID : '';
	1589	+ $current_page = get_page_by_path( $current_page_name );
	1590	+ if ( is_object( $current_page ) && isset( $current_page->ID ) ) {
	1591	+ $current_page_id = $current_page->ID;
	1592	+ }
1779	1593	}
1780	1594	if ( ! array_key_exists( 'access_public_pages', $auth_settings ) || ! is_array( $auth_settings['access_public_pages'] ) ) {
1781	1595	$auth_settings['access_public_pages'] = array();
1782	1596	}
1783		- if ( in_array( strval( $current_page_id ), $auth_settings['access_public_pages'], true ) ) {
1784		- if ( 'no_warning' === $auth_settings['access_public_warning'] ) {
	1597	+ if ( in_array( $current_page_id, $auth_settings['access_public_pages'] ) ) {
	1598	+ if ( $auth_settings['access_public_warning'] === 'no_warning' ) {
1785	1599	update_option( 'auth_settings_advanced_public_notice', false );
1786	1600	} else {
1787	1601	update_option( 'auth_settings_advanced_public_notice', true );
1788	1602	}
		@@ -1790,11 +1604,11 @@
1790	1604	}
1791	1605
1792	1606	// Check to see if any category assigned to the requested page is public. If so, show it.
1793	1607	$current_page_categories = wp_get_post_categories( $current_page_id, array( 'fields' => 'slugs' ) );
1794		- foreach ( $current_page_categories as $current_page_category ) {
1795		- if ( in_array( 'cat_' . $current_page_category, $auth_settings['access_public_pages'], true ) ) {
1796		- if ( 'no_warning' === $auth_settings['access_public_warning'] ) {
	1608	+ foreach( $current_page_categories as $current_page_category ) {
	1609	+ if ( in_array( 'cat_' . $current_page_category, $auth_settings['access_public_pages'] ) ) {
	1610	+ if ( $auth_settings['access_public_warning'] === 'no_warning' ) {
1797	1611	update_option( 'auth_settings_advanced_public_notice', false );
1798	1612	} else {
1799	1613	update_option( 'auth_settings_advanced_public_notice', true );
1800	1614	}
		@@ -1802,11 +1616,11 @@
1802	1616	}
1803	1617	}
1804	1618
1805	1619	// Check to see if this page can't be found. If so, allow showing the 404 page.
1806		- if ( strlen( $current_page_id ) < 1 ) {
1807		- if ( in_array( 'auth_public_404', $auth_settings['access_public_pages'], true ) ) {
1808		- if ( 'no_warning' === $auth_settings['access_public_warning'] ) {
	1620	+ if ( strlen( $current_page_name ) > 0 && strlen( $current_page_id ) < 1 ) {
	1621	+ if ( in_array( 'auth_public_404', $auth_settings['access_public_pages'] ) ) {
	1622	+ if ( $auth_settings['access_public_warning'] === 'no_warning' ) {
1809	1623	update_option( 'auth_settings_advanced_public_notice', false );
1810	1624	} else {
1811	1625	update_option( 'auth_settings_advanced_public_notice', true );
1812	1626	}
		@@ -1811,8 +1625,9 @@
1811	1625	update_option( 'auth_settings_advanced_public_notice', true );
1812	1626	}
1813	1627	return $wp;
1814	1628	}
	1629	+
1815	1630	}
1816	1631
1817	1632	// Check to see if the requested category is public. If so, show it.
1818	1633	$current_category_name = property_exists( $wp, 'query_vars' ) && array_key_exists( 'category_name', $wp->query_vars ) && strlen( $wp->query_vars['category_name'] ) > 0 ? $wp->query_vars['category_name'] : '';
		@@ -1817,10 +1632,10 @@
1817	1632	// Check to see if the requested category is public. If so, show it.
1818	1633	$current_category_name = property_exists( $wp, 'query_vars' ) && array_key_exists( 'category_name', $wp->query_vars ) && strlen( $wp->query_vars['category_name'] ) > 0 ? $wp->query_vars['category_name'] : '';
1819	1634	if ( $current_category_name ) {
1820	1635	$current_category_name = end( explode( '/', $current_category_name ) );
1821		- if ( in_array( 'cat_' . $current_category_name, $auth_settings['access_public_pages'], true ) ) {
1822		- if ( 'no_warning' === $auth_settings['access_public_warning'] ) {
	1636	+ if ( in_array( 'cat_' . $current_category_name, $auth_settings['access_public_pages'] ) ) {
	1637	+ if ( $auth_settings['access_public_warning'] === 'no_warning' ) {
1823	1638	update_option( 'auth_settings_advanced_public_notice', false );
1824	1639	} else {
1825	1640	update_option( 'auth_settings_advanced_public_notice', true );
1826	1641	}
		@@ -1830,20 +1645,18 @@
1830	1645
1831	1646	// User is denied access, so show them the error message. Render as JSON
1832	1647	// if this is a REST API call; otherwise, show the error message via
1833	1648	// wp_die() (rendered html), or redirect to the login URL.
1834		- $current_path = ! empty( $_SERVER['REQUEST_URI'] ) ? esc_url_raw( wp_unslash( $_SERVER['REQUEST_URI'] ) ) : home_url();
1835		- if ( property_exists( $wp, 'matched_query' ) && stripos( $wp->matched_query, 'rest_route=' ) === 0 && 'GET' === $_SERVER['REQUEST_METHOD'] ) {
1836		- wp_send_json(
1837		- array(
1838		- 'code' => 'rest_cannot_view',
1839		- 'message' => strip_tags( $auth_settings['access_redirect_to_message'] ),
1840		- 'data' => array(
1841		- 'status' => 401,
1842		- ),
1843		- )
1844		- );
1845		- } elseif ( 'message' === $auth_settings['access_redirect'] ) {
	1649	+ $current_path = empty( $_SERVER['REQUEST_URI'] ) ? home_url() : $_SERVER['REQUEST_URI'];
	1650	+ if ( property_exists( $wp, 'matched_query' ) && stripos( $wp->matched_query, "rest_route=" ) === 0 && $_SERVER['REQUEST_METHOD'] === 'GET' ) {
	1651	+ wp_send_json( array(
	1652	+ 'code' => 'rest_cannot_view',
	1653	+ 'message' => strip_tags( $auth_settings['access_redirect_to_message'] ),
	1654	+ 'data' => array(
	1655	+ 'status' => 401,
	1656	+ ),
	1657	+ ));
	1658	+ } elseif ( $auth_settings['access_redirect'] === 'message' ) {
1846	1659	$page_title = sprintf(
1847	1660	/* TRANSLATORS: %s: Name of blog */
1848	1661	__( '%s - Access Restricted', 'authorizer' ),
1849	1662	get_bloginfo( 'name' )
		@@ -1854,15 +1667,15 @@
1854	1667	'<p style="text-align: center;margin-bottom: -15px;">' .
1855	1668	'<a class="button" href="' . wp_login_url( $current_path ) . '">' .
1856	1669	__( 'Log In', 'authorizer' ) .
1857	1670	'</a></p>';
1858		- wp_die( wp_kses( $error_message, $this->allowed_html ), esc_html( $page_title ) );
1859		- } else {
	1671	+ wp_die( $error_message, $page_title );
	1672	+ } else { // if ( $auth_settings['access_redirect'] === 'login' ) {
1860	1673	wp_redirect( wp_login_url( $current_path ), 302 );
1861	1674	exit;
1862	1675	}
1863	1676
1864		- // Sanity check: we should never get here.
	1677	+ // Sanity check: we should never get here
1865	1678	wp_die( '<p>Access denied.</p>', 'Site Access Restricted' );
1866	1679	}
1867	1680
1868	1681
		@@ -1871,11 +1684,9 @@
1871	1684	* not yet been added to this particular blog in a multisite). Note: we do
1872	1685	* this because check_user_access() runs on the parse_request hook, which
1873	1686	* does not fire on wp-admin pages.
1874	1687	*
1875		- * Action: init
1876		- *
1877		- * @return void
	1688	+ * Hook: admin_menu
1878	1689	*/
1879	1690	public function init__maybe_add_network_approved_user() {
1880	1691	global $current_user;
1881	1692
		@@ -1890,10 +1701,10 @@
1890	1701	) {
1891	1702	// Get all approved users.
1892	1703	$auth_settings_access_users_approved = $this->sanitize_user_list(
1893	1704	array_merge(
1894		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT ),
1895		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT )
	1705	+ $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN ),
	1706	+ $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN )
1896	1707	)
1897	1708	);
1898	1709
1899	1710	// Get user info (we need user role).
		@@ -1905,9 +1716,9 @@
1905	1716	// Add user to blog.
1906	1717	add_user_to_blog( get_current_blog_id(), $current_user->ID, $user_info['role'] );
1907	1718
1908	1719	// Refresh user permissions.
1909		- $current_user = new WP_User( $current_user->ID ); // phpcs:ignore WordPress.Variables.GlobalVariables.OverrideProhibited
	1720	+ $current_user = new WP_User( $current_user->ID );
1910	1721	}
1911	1722	}
1912	1723
1913	1724
		@@ -1921,15 +1732,11 @@
1921	1732
1922	1733
1923	1734	/**
1924	1735	* Add custom error message to login screen.
1925		- *
1926	1736	* Filter: login_errors
1927		- *
1928		- * @param string $errors Error description.
1929		- * @return string Error description with Authorizer errors added.
1930	1737	*/
1931		- public function show_advanced_login_error( $errors ) {
	1738	+ function show_advanced_login_error( $errors ) {
1932	1739	$error = get_option( 'auth_settings_advanced_login_error' );
1933	1740	delete_option( 'auth_settings_advanced_login_error' );
1934	1741	$errors = ' ' . $error . "<br />\n";
1935	1742	return $errors;
		@@ -1937,25 +1744,24 @@
1937	1744
1938	1745
1939	1746	/**
1940	1747	* Load external resources for the public-facing site.
1941		- *
1942		- * Action: wp_enqueue_scripts
1943	1748	*/
1944		- public function auth_public_scripts() {
1945		- // Load (and localize) public scripts.
1946		- $current_path = ! empty( $_SERVER['REQUEST_URI'] ) ? esc_url_raw( wp_unslash( $_SERVER['REQUEST_URI'] ) ) : home_url();
1947		- wp_enqueue_script( 'auth_public_scripts', plugins_url( '/js/authorizer-public.js', __FILE__ ), array( 'jquery' ), '2.8.0' );
	1749	+ function auth_public_scripts() {
	1750	+ // Load (and localize) public scripts
	1751	+ $current_path = empty( $_SERVER['REQUEST_URI'] ) ? home_url() : $_SERVER['REQUEST_URI'];
	1752	+ wp_enqueue_script( 'auth_public_scripts', plugins_url( '/js/authorizer-public.js', __FILE__ ), array( 'jquery' ), '2.3.2' );
1948	1753	$auth_localized = array(
1949		- 'wpLoginUrl' => wp_login_url( $current_path ),
1950		- 'publicWarning' => get_option( 'auth_settings_advanced_public_notice' ),
1951		- 'anonymousNotice' => $this->get_plugin_option( 'access_redirect_to_message' ),
1952		- 'logIn' => esc_html__( 'Log In', 'authorizer' ),
	1754	+ 'wp_login_url' => wp_login_url( $current_path ),
	1755	+ 'public_warning' => get_option( 'auth_settings_advanced_public_notice' ),
	1756	+ 'anonymous_notice' => $this->get_plugin_option( 'access_redirect_to_message' ),
	1757	+ 'log_in' => esc_html__( 'Log In', 'authorizer' ),
1953	1758	);
1954	1759	wp_localize_script( 'auth_public_scripts', 'auth', $auth_localized );
	1760	+ //update_option( 'auth_settings_advanced_public_notice', false);
1955	1761
1956		- // Load public css.
1957		- wp_register_style( 'authorizer-public-css', plugins_url( 'css/authorizer-public.css', __FILE__ ), array(), '2.8.0' );
	1762	+ // Load public css
	1763	+ wp_register_style( 'authorizer-public-css', plugins_url( 'css/authorizer-public.css', __FILE__ ), array(), '2.3.2' );
1958	1764	wp_enqueue_style( 'authorizer-public-css' );
1959	1765	}
1960	1766
1961	1767
		@@ -1961,21 +1767,19 @@
1961	1767
1962	1768	/**
1963	1769	* Enqueue JS scripts and CSS styles appearing on wp-login.php.
1964	1770	*
1965		- * Action: login_enqueue_scripts
1966		- *
1967	1771	* @return void
1968	1772	*/
1969		- public function login_enqueue_scripts_and_styles() {
	1773	+ function login_enqueue_scripts_and_styles() {
1970	1774	// Grab plugin settings.
1971		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
	1775	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' );
1972	1776
1973	1777	// Enqueue scripts appearing on wp-login.php.
1974		- wp_enqueue_script( 'auth_login_scripts', plugins_url( '/js/authorizer-login.js', __FILE__ ), array( 'jquery' ), '2.8.0' );
	1778	+ wp_enqueue_script( 'auth_login_scripts', plugins_url( '/js/authorizer-login.js', __FILE__ ), array( 'jquery' ), '2.3.2' );
1975	1779
1976	1780	// Enqueue styles appearing on wp-login.php.
1977		- wp_register_style( 'authorizer-login-css', plugins_url( '/css/authorizer-login.css', __FILE__ ), array(), '2.8.0' );
	1781	+ wp_register_style( 'authorizer-login-css', plugins_url( '/css/authorizer-login.css', __FILE__ ), array(), '2.3.2' );
1978	1782	wp_enqueue_style( 'authorizer-login-css' );
1979	1783
1980	1784	/**
1981	1785	* Developers can use the `authorizer_add_branding_option` filter
		@@ -1980,8 +1784,9 @@
1980	1784	/**
1981	1785	* Developers can use the `authorizer_add_branding_option` filter
1982	1786	* to add a radio button for "Custom WordPress login branding"
1983	1787	* under the "Advanced" tab in Authorizer options. Example:
	1788	+ *
1984	1789	* function my_authorizer_add_branding_option( $branding_options ) {
1985	1790	* $new_branding_option = array(
1986	1791	* 'value' => 'your_brand'
1987	1792	* 'description' => 'Custom Your Brand Login Screen',
		@@ -1995,23 +1800,23 @@
1995	1800	*/
1996	1801	$branding_options = array();
1997	1802	$branding_options = apply_filters( 'authorizer_add_branding_option', $branding_options );
1998	1803	foreach ( $branding_options as $branding_option ) {
1999		- // Make sure the custom brands have the required values.
	1804	+ // Make sure the custom brands have the required values
2000	1805	if ( ! ( is_array( $branding_option ) && array_key_exists( 'value', $branding_option ) && array_key_exists( 'css_url', $branding_option ) && array_key_exists( 'js_url', $branding_option ) ) ) {
2001	1806	continue;
2002	1807	}
2003	1808	if ( $auth_settings['advanced_branding'] === $branding_option['value'] ) {
2004		- wp_enqueue_script( 'auth_login_custom_scripts-' . sanitize_title( $branding_option['value'] ), $branding_option['js_url'], array( 'jquery' ), '2.8.0' );
2005		- wp_register_style( 'authorizer-login-custom-css-' . sanitize_title( $branding_option['value'] ), $branding_option['css_url'], array(), '2.8.0' );
	1809	+ wp_enqueue_script( 'auth_login_custom_scripts-' . sanitize_title( $branding_option['value'] ), $branding_option['js_url'], array( 'jquery' ), '2.3.2' );
	1810	+ wp_register_style( 'authorizer-login-custom-css-' . sanitize_title( $branding_option['value'] ), $branding_option['css_url'], array(), '2.3.2' );
2006	1811	wp_enqueue_style( 'authorizer-login-custom-css-' . sanitize_title( $branding_option['value'] ) );
2007	1812	}
2008	1813	}
2009	1814
2010	1815	// If we're using Google logins, load those resources.
2011		- if ( '1' === $auth_settings['google'] ) {
2012		- wp_enqueue_script( 'authorizer-login-custom-google', plugins_url( '/js/authorizer-login-custom_google.js', __FILE__ ), array( 'jquery' ), '2.8.0' ); ?>
2013		- <meta name="google-signin-clientid" content="<?php echo esc_attr( $auth_settings['google_clientid'] ); ?>" />
	1816	+ if ( $auth_settings['google'] === '1' ) {
	1817	+ wp_enqueue_script( 'authorizer-login-custom-google', plugins_url( '/js/authorizer-login-custom_google.js', __FILE__ ), array( 'jquery' ), '2.3.2' ); ?>
	1818	+ <meta name="google-signin-clientid" content="<?php echo $auth_settings['google_clientid']; ?>" />
2014	1819	<meta name="google-signin-scope" content="email" />
2015	1820	<meta name="google-signin-cookiepolicy" content="single_host_origin" />
2016	1821	<?php
2017	1822	}
		@@ -2019,127 +1824,110 @@
2019	1824
2020	1825
2021	1826	/**
2022	1827	* Load external resources in the footer of the wp-login.php page.
2023		- *
2024		- * Action: login_footer
	1828	+ * Run on action hook: login_footer
2025	1829	*/
2026		- public function load_login_footer_js() {
	1830	+ function load_login_footer_js() {
2027	1831	// Grab plugin settings.
2028		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
2029		- $ajaxurl = admin_url( 'admin-ajax.php' );
2030		- if ( '1' === $auth_settings['google'] ) :
2031		- ?>
2032		-<script type="text/javascript">
2033		-/* global location, window */
2034		-// Reload login page if reauth querystring param exists,
2035		-// since reauth interrupts external logins (e.g., google).
2036		-if ( location.search.indexOf( 'reauth=1' ) >= 0 ) {
2037		- location.href = location.href.replace( 'reauth=1', '' );
2038		-}
	1832	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' ); ?>
	1833	+ <?php if ( $auth_settings['google'] === '1' ): ?>
	1834	+ <script type="text/javascript">
	1835	+ // Reload login page if reauth querystring param exists,
	1836	+ // since reauth interrupts external logins (e.g., google).
	1837	+ if ( location.search.indexOf( 'reauth=1' ) >= 0 ) {
	1838	+ location.href = location.href.replace( 'reauth=1', '' );
	1839	+ }
2039	1840
2040		-// eslint-disable-next-line no-implicit-globals
2041		-function authUpdateQuerystringParam( uri, key, value ) {
2042		- var re = new RegExp( '([?&])' + key + '=.*?(&|$)', 'i' );
2043		- var separator = uri.indexOf( '?' ) !== -1 ? '&' : '?';
2044		- if ( uri.match( re ) ) {
2045		- return uri.replace( re, '$1' + key + '=' + value + '$2' );
2046		- } else {
2047		- return uri + separator + key + '=' + value;
2048		- }
2049		-}
	1841	+ function auth_update_querystring_param( uri, key, value ) {
	1842	+ var re = new RegExp( '([?&])' + key + '=.*?(&|$)', 'i' );
	1843	+ var separator = uri.indexOf( '?' ) !== -1 ? '&' : '?';
	1844	+ if ( uri.match( re ) ) {
	1845	+ return uri.replace( re, '$1' + key + '=' + value + '$2' );
	1846	+ } else {
	1847	+ return uri + separator + key + '=' + value;
	1848	+ }
	1849	+ }
2050	1850
2051		-// eslint-disable-next-line
2052		-function signInCallback( authResult ) { // jshint ignore:line
2053		- var $ = jQuery;
2054		- if ( authResult.status && authResult.status.signed_in ) {
2055		- // Hide the sign-in button now that the user is authorized, for example:
2056		- $( '#googleplus_button' ).attr( 'style', 'display: none' );
	1851	+ function signInCallback( authResult ) {
	1852	+ var $ = jQuery;
	1853	+ if ( authResult['status'] && authResult['status']['signed_in'] ) {
	1854	+ // Hide the sign-in button now that the user is authorized, for example:
	1855	+ $( '#googleplus_button' ).attr( 'style', 'display: none' );
2057	1856
2058		- // Send the code to the server
2059		- var ajaxurl = '<?php echo esc_attr( $ajaxurl ); ?>';
2060		- $.post(ajaxurl, {
2061		- action: 'process_google_login',
2062		- code: authResult.code,
2063		- nonce: $('#nonce_google_auth-<?php echo esc_attr( $this->get_cookie_value() ); ?>' ).val(),
2064		- }, function() {
2065		- // Handle or verify the server response if necessary.
2066		- // console.log( response );
	1857	+ // Send the code to the server
	1858	+ var ajaxurl = '<?php echo admin_url( "admin-ajax.php" ); ?>';
	1859	+ $.post(ajaxurl, {
	1860	+ action: 'process_google_login',
	1861	+ 'code': authResult['code'],
	1862	+ 'nonce': $('#nonce_google_auth-<?php echo $this->get_cookie_value(); ?>' ).val(),
	1863	+ }, function( response ) {
	1864	+ // Handle or verify the server response if necessary.
	1865	+ //console.log( response );
2067	1866
2068		- // Reload wp-login.php to continue the authentication process.
2069		- var newHref = authUpdateQuerystringParam( location.href, 'external', 'google' );
2070		- if ( location.href === newHref ) {
2071		- location.reload();
2072		- } else {
2073		- location.href = newHref;
2074		- }
2075		- });
2076		- } else {
2077		- // Update the app to reflect a signed out user
2078		- // Possible error values:
2079		- // "user_signed_out" - User is signed-out
2080		- // "access_denied" - User denied access to your app
2081		- // "immediate_failed" - Could not automatically log in the user
2082		- // console.log('Sign-in state: ' + authResult['error']);
	1867	+ // Reload wp-login.php to continue the authentication process.
	1868	+ var new_href = auth_update_querystring_param( location.href, 'external', 'google' );
	1869	+ if ( location.href === new_href ) {
	1870	+ location.reload();
	1871	+ } else {
	1872	+ location.href = new_href;
	1873	+ }
	1874	+ });
	1875	+ } else {
	1876	+ // Update the app to reflect a signed out user
	1877	+ // Possible error values:
	1878	+ // "user_signed_out" - User is signed-out
	1879	+ // "access_denied" - User denied access to your app
	1880	+ // "immediate_failed" - Could not automatically log in the user
	1881	+ //console.log('Sign-in state: ' + authResult['error']);
2083	1882
2084		- // If user denies access, reload the login page.
2085		- if ( authResult.error === 'access_denied' || authResult.error === 'user_signed_out' ) {
2086		- window.location.reload();
	1883	+ // If user denies access, reload the login page.
	1884	+ if ( authResult['error'] === 'access_denied' || authResult['error'] === 'user_signed_out' ) {
	1885	+ window.location.reload();
	1886	+ }
	1887	+ }
	1888	+ }
	1889	+ </script>
	1890	+ <?php endif;
2087	1891	}
2088		- }
2089		-}
2090		-</script>
2091		- <?php
2092		- endif;
2093		- }
2094	1892
2095	1893
2096	1894	/**
2097	1895	* Create links for any external authentication services that are enabled.
2098		- *
2099		- * Action: login_form
2100	1896	*/
2101		- public function login_form_add_external_service_links() {
	1897	+ function login_form_add_external_service_links() {
2102	1898	// Grab plugin settings.
2103		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
2104		- ?>
	1899	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' ); ?>
2105	1900	<div id="auth-external-service-login">
2106		- <?php if ( '1' === $auth_settings['google'] ) : ?>
2107		- <p><a id="googleplus_button" class="button button-primary button-external button-google"><span class="dashicons dashicons-googleplus"></span><span class="label"><?php esc_html_e( 'Sign in with Google', 'authorizer' ); ?></span></a></p>
	1901	+ <?php if ( $auth_settings['google'] === '1' ): ?>
	1902	+ <p><a id="googleplus_button" class="button button-primary button-external button-google"><span class="dashicons dashicons-googleplus"></span><span class="label"><?php _e( 'Sign in with Google', 'authorizer' ); ?></span></a></p>
2108	1903	<?php wp_nonce_field( 'google_csrf_nonce', 'nonce_google_auth-' . $this->get_cookie_value() ); ?>
2109	1904	<?php endif; ?>
2110	1905
2111		- <?php if ( '1' === $auth_settings['cas'] ) : ?>
2112		- <p><a class="button button-primary button-external button-cas" href="<?php echo esc_attr( $this->modify_current_url_for_cas_login() ); ?>">
	1906	+ <?php if ( $auth_settings['cas'] === '1' ): ?>
	1907	+ <p><a class="button button-primary button-external button-cas" href="<?php echo $this->modify_current_url_for_cas_login(); ?>">
2113	1908	<span class="dashicons dashicons-lock"></span>
2114		- <span class="label">
2115		- <?php
2116		- echo esc_html(
2117		- sprintf(
2118		- /* TRANSLATORS: %s: Custom CAS label from authorizer options */
2119		- __( 'Sign in with %s', 'authorizer' ),
2120		- $auth_settings['cas_custom_label']
2121		- )
	1909	+ <span class="label"><?php
	1910	+ printf(
	1911	+ /* TRANSLATORS: %s: Custom CAS label from authorizer options */
	1912	+ __( 'Sign in with %s', 'authorizer' ),
	1913	+ $auth_settings['cas_custom_label']
2122	1914	);
2123		- ?>
2124		- </span>
	1915	+ ?></span>
2125	1916	</a></p>
2126	1917	<?php endif; ?>
2127	1918
2128		- <?php if ( '1' === $auth_settings['advanced_hide_wp_login'] && isset( $_SERVER['QUERY_STRING'] ) && false === strpos( $_SERVER['QUERY_STRING'], 'external=wordpress' ) ) : // phpcs:ignore WordPress.VIP.ValidatedSanitizedInput ?>
	1919	+ <?php if ( $auth_settings['advanced_hide_wp_login'] === '1' && strpos( $_SERVER['QUERY_STRING'], 'external=wordpress' ) === false ): ?>
2129	1920	<style type="text/css">
2130		- body.login-action-login form {
2131		- padding-bottom: 8px;
	1921	+ #loginform {
	1922	+ padding-bottom: 8px !important;
2132	1923	}
2133		- body.login-action-login form p > label,
2134		- body.login-action-login form .forgetmenot,
2135		- body.login-action-login form .submit,
2136		- body.login-action-login #nav { /* csslint allow: ids */
2137		- display: none;
	1924	+ #loginform p>label, #loginform p.forgetmenot, #loginform p.submit, p#nav {
	1925	+ display: none !important;
2138	1926	}
2139	1927	</style>
2140		- <?php elseif ( '1' === $auth_settings['cas'] || '1' === $auth_settings['google'] ) : ?>
2141		- <h3> &mdash; <?php esc_html_e( 'or', 'authorizer' ); ?> &mdash; </h3>
	1928	+ <?php elseif ( $auth_settings['cas'] === '1' || $auth_settings['google'] === '1' ): ?>
	1929	+ <h3> &mdash; <?php _e( 'or', 'authorizer' ); ?> &mdash; </h3>
2142	1930	<?php endif; ?>
2143	1931	</div>
2144	1932	<?php
2145	1933
		@@ -2152,28 +1940,21 @@
2152	1940	* Note: hook into wp_login_errors filter so this fires after the
2153	1941	* authenticate hook (where the redirect to CAS happens), but before html
2154	1942	* output is started (so the redirect header doesn't complain about data
2155	1943	* already being sent).
2156		- *
2157		- * Filter: wp_login_errors
2158		- *
2159		- * @param object $errors WP Error object.
2160		- * @param string $redirect_to Where to redirect on error.
2161		- * @return WP_Error|void WP Error object or void on redirect.
2162	1944	*/
2163		- public function wp_login_errors__maybe_redirect_to_cas( $errors, $redirect_to ) {
	1945	+ function wp_login_errors__maybe_redirect_to_cas( $errors, $redirect_to ) {
2164	1946	// Grab plugin settings.
2165		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
	1947	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' );
2166	1948
2167	1949	// Check whether we should redirect to CAS.
2168	1950	if (
2169		- isset( $_SERVER['QUERY_STRING'] ) &&
2170		- strpos( $_SERVER['QUERY_STRING'], 'external=wordpress' ) === false && // phpcs:ignore WordPress.VIP.ValidatedSanitizedInput
2171		- array_key_exists( 'cas_auto_login', $auth_settings ) && '1' === $auth_settings['cas_auto_login'] &&
2172		- array_key_exists( 'cas', $auth_settings ) && '1' === $auth_settings['cas'] &&
2173		- ( ! array_key_exists( 'ldap', $auth_settings ) || '1' !== $auth_settings['ldap'] ) &&
2174		- ( ! array_key_exists( 'google', $auth_settings ) || '1' !== $auth_settings['google'] ) &&
2175		- array_key_exists( 'advanced_hide_wp_login', $auth_settings ) && '1' === $auth_settings['advanced_hide_wp_login']
	1951	+ strpos( $_SERVER['QUERY_STRING'], 'external=wordpress' ) === false &&
	1952	+ array_key_exists( 'cas_auto_login', $auth_settings ) && $auth_settings['cas_auto_login'] === '1' &&
	1953	+ array_key_exists( 'cas', $auth_settings ) && $auth_settings['cas'] === '1' &&
	1954	+ ( ! array_key_exists( 'ldap', $auth_settings ) || $auth_settings['ldap'] !== '1' ) &&
	1955	+ ( ! array_key_exists( 'google', $auth_settings ) || $auth_settings['google'] !== '1' ) &&
	1956	+ array_key_exists( 'advanced_hide_wp_login', $auth_settings ) && $auth_settings['advanced_hide_wp_login'] === '1'
2176	1957	) {
2177	1958	wp_redirect( $this->modify_current_url_for_cas_login() );
2178	1959	exit;
2179	1960	}
		@@ -2182,45 +1963,15 @@
2182	1963	}
2183	1964
2184	1965
2185	1966	/**
2186		- * Set a unique cookie to add to Google auth nonce to avoid CSRF detection.
2187		- * Note: hook into login_init so this fires at the start of the visit to
2188		- * wp-login.php, but before any html output is started (so setting the
2189		- * cookie header doesn't complain about data already being sent).
2190		- *
2191		- * Action: login_init
2192		- *
2193		- * @return void
2194		- */
2195		- public function login_init__maybe_set_google_nonce_cookie() {
2196		- // Grab plugin settings.
2197		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
2198		-
2199		- // If Google logins are enabled, make sure the cookie is set.
2200		- if ( array_key_exists( 'google', $auth_settings ) && '1' === $auth_settings['google'] ) {
2201		- if ( ! isset( $_COOKIE['login_unique'] ) ) {
2202		- $this->cookie_value = md5( rand() );
2203		- setcookie( 'login_unique', $this->cookie_value, time() + 1800, '/', defined( 'COOKIE_DOMAIN' ) ? COOKIE_DOMAIN : '' );
2204		- $_COOKIE['login_unique'] = $this->cookie_value;
2205		- }
2206		- }
2207		- }
2208		-
2209		-
2210		- /**
2211	1967	* Implements hook: do_action( 'wp_login_failed', $username );
2212	1968	* Update the user meta for the user that just failed logging in.
2213	1969	* Keep track of time of last failed attempt and number of failed attempts.
2214		- *
2215		- * Action: wp_login_failed
2216		- *
2217		- * @param string $username Username to update login count for.
2218		- * @return void
2219	1970	*/
2220		- public function update_login_failed_count( $username ) {
	1971	+ function update_login_failed_count( $username ) {
2221	1972	// Grab plugin settings.
2222		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
	1973	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' );
2223	1974
2224	1975	// Get user trying to log in.
2225	1976	// If this isn't a real user, update the global failed attempt
2226	1977	// variables. We'll use these global variables to institute the
		@@ -2228,9 +1979,9 @@
2228	1979	// won't be able to determine which accounts are real by which
2229	1980	// accounts get locked out on multiple invalid attempts.
2230	1981	$user = get_user_by( 'login', $username );
2231	1982
2232		- if ( false !== $user ) {
	1983	+ if ( $user !== FALSE ) {
2233	1984	$last_attempt = get_user_meta( $user->ID, 'auth_settings_advanced_lockouts_time_last_failed', true );
2234	1985	$num_attempts = get_user_meta( $user->ID, 'auth_settings_advanced_lockouts_failed_attempts', true );
2235	1986	} else {
2236	1987	$last_attempt = get_option( 'auth_settings_advanced_lockouts_time_last_failed' );
		@@ -2244,15 +1995,15 @@
2244	1995
2245	1996	// Reset the failed attempt count if the time since the last
2246	1997	// failed attempt is greater than the reset duration.
2247	1998	$time_since_last_fail = time() - $last_attempt;
2248		- $reset_duration = $auth_settings['advanced_lockouts']['reset_duration'] * 60; // minutes to seconds.
	1999	+ $reset_duration = $auth_settings['advanced_lockouts']['reset_duration'] * 60; // minutes to seconds
2249	2000	if ( $time_since_last_fail > $reset_duration ) {
2250	2001	$num_attempts = 0;
2251	2002	}
2252	2003
2253	2004	// Set last failed time to now and increment last failed count.
2254		- if ( false !== $user ) {
	2005	+ if ( $user !== FALSE ) {
2255	2006	update_user_meta( $user->ID, 'auth_settings_advanced_lockouts_time_last_failed', time() );
2256	2007	update_user_meta( $user->ID, 'auth_settings_advanced_lockouts_failed_attempts', $num_attempts + 1 );
2257	2008	} else {
2258	2009	update_option( 'auth_settings_advanced_lockouts_time_last_failed', time() );
		@@ -2263,16 +2014,16 @@
2263	2014
2264	2015	/**
2265	2016	* When they successfully log in, make sure WordPress users are in the approved list.
2266	2017	*
2267		- * Action: wp_login
	2018	+ * @action wp_login
2268	2019	*
2269	2020	* @param string $user_login Username of the user logging in.
2270		- * @param object $user WP_User object of the user logging in.
2271		- * @return void
	2021	+ * @param WP_User $user WP_User object of the user logging in.
	2022	+ * @return null
2272	2023	*/
2273		- public function ensure_wordpress_user_in_approved_list_on_login( $user_login, $user ) {
2274		- $this->add_user_to_authorizer_when_created( $user->user_email, $user->user_registered, $user->roles );
	2024	+ function ensure_wordpress_user_in_approved_list_on_login( $user_login, $user ) {
	2025	+ $this->add_user_to_authorizer_when_created( $user->user_email, $user->user_registered, $user->user_roles );
2275	2026	}
2276	2027
2277	2028
2278	2029	/**
		@@ -2278,17 +2029,12 @@
2278	2029	/**
2279	2030	* Overwrite the URL for the lost password link on the login form.
2280	2031	* If we're authenticating against an external service, standard
2281	2032	* WordPress password resets won't work.
2282		- *
2283		- * Filter: lostpassword_url
2284		- *
2285		- * @param string $lostpassword_url URL to reset password.
2286		- * @return string URL to reset password.
2287	2033	*/
2288		- public function custom_lostpassword_url( $lostpassword_url ) {
	2034	+ function custom_lostpassword_url( $lostpassword_url ) {
2289	2035	// Grab plugin settings.
2290		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
	2036	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' );
2291	2037
2292	2038	if (
2293	2039	array_key_exists( 'ldap_lostpassword_url', $auth_settings ) &&
2294	2040	filter_var( $auth_settings['ldap_lostpassword_url'], FILTER_VALIDATE_URL )
		@@ -2311,16 +2057,15 @@
2311	2057	/**
2312	2058	* Add a link to this plugin's settings page from the WordPress Plugins page.
2313	2059	* Called from "plugin_action_links" filter in __construct() above.
2314	2060	*
2315		- * Filter: plugin_action_links_authorizer.php
	2061	+ * @param array $links array of links in the admin sidebar
2316	2062	*
2317		- * @param array $links Admin sidebar links.
2318		- * @return array Admin sidebar links with Authorizer added.
	2063	+ * @return array of links to show in the admin sidebar.
2319	2064	*/
2320	2065	public function plugin_settings_link( $links ) {
2321		- $admin_menu = $this->get_plugin_option( 'advanced_admin_menu' );
2322		- $settings_url = 'settings' === $admin_menu ? admin_url( 'options-general.php?page=authorizer' ) : admin_url( 'admin.php?page=authorizer' );
	2066	+ $admin_menu = $this->get_plugin_option( 'advanced_admin_menu' );
	2067	+ $settings_url = $admin_menu === 'settings' ? admin_url( 'options-general.php?page=authorizer' ) : admin_url( 'admin.php?page=authorizer' );
2323	2068	array_unshift( $links, '<a href="' . $settings_url . '">' . __( 'Settings', 'authorizer' ) . '</a>' );
2324	2069	return $links;
2325	2070	}
2326	2071
		@@ -2328,12 +2073,11 @@
2328	2073	/**
2329	2074	* Add a link to this plugin's network settings page from the WordPress Plugins page.
2330	2075	* Called from "network_admin_plugin_action_links" filter in __construct() above.
2331	2076	*
2332		- * Filter: network_admin_plugin_action_links_authorizer.php
	2077	+ * @param array $links array of links in the network admin sidebar
2333	2078	*
2334		- * @param array $links Network admin sidebar links.
2335		- * @return array Network admin sidebar links with Authorizer added.
	2079	+ * @return array of links to show in the network admin sidebar.
2336	2080	*/
2337	2081	public function network_admin_plugin_settings_link( $links ) {
2338	2082	$settings_link = '<a href="admin.php?page=authorizer">' . __( 'Network Settings', 'authorizer' ) . '</a>';
2339	2083	array_unshift( $links, $settings_link );
		@@ -2341,33 +2085,32 @@
2341	2085	}
2342	2086
2343	2087
2344	2088	/**
2345		- * Create the options page under Dashboard > Settings.
2346		- *
2347		- * Action: admin_menu
	2089	+ * Create the options page under Dashboard > Settings
	2090	+ * Run on action hook: admin_menu
2348	2091	*/
2349	2092	public function add_plugin_page() {
2350	2093	$admin_menu = $this->get_plugin_option( 'advanced_admin_menu' );
2351		- if ( 'settings' === $admin_menu ) {
	2094	+ if ( $admin_menu === 'settings' ) {
2352	2095	// @see http://codex.wordpress.org/Function_Reference/add_options_page
2353	2096	add_options_page(
2354		- 'Authorizer',
2355		- 'Authorizer',
2356		- 'create_users',
2357		- 'authorizer',
2358		- array( $this, 'create_admin_page' )
	2097	+ 'Authorizer', // Page title
	2098	+ 'Authorizer', // Menu title
	2099	+ 'create_users', // Capability
	2100	+ 'authorizer', // Menu slug
	2101	+ array( $this, 'create_admin_page' ) // function
2359	2102	);
2360	2103	} else {
2361	2104	// @see http://codex.wordpress.org/Function_Reference/add_menu_page
2362	2105	add_menu_page(
2363		- 'Authorizer',
2364		- 'Authorizer',
2365		- 'create_users',
2366		- 'authorizer',
2367		- array( $this, 'create_admin_page' ),
2368		- 'dashicons-groups',
2369		- '99.0018465' // position (decimal is to make overlap with other plugins less likely).
	2106	+ 'Authorizer', // Page title
	2107	+ 'Authorizer', // Menu title
	2108	+ 'create_users', // Capability
	2109	+ 'authorizer', // Menu slug
	2110	+ array( $this, 'create_admin_page' ), // callback
	2111	+ 'dashicons-groups', // icon
	2112	+ '99.0018465' // position (decimal is to make overlap with other plugins less likely)
2370	2113	);
2371	2114	}
2372	2115	}
2373	2116
		@@ -2372,75 +2115,56 @@
2372	2115	}
2373	2116
2374	2117
2375	2118	/**
2376		- * Output the HTML for the options page.
	2119	+ * Output the HTML for the options page
2377	2120	*/
2378		- public function create_admin_page() {
2379		- ?>
	2121	+ public function create_admin_page() { ?>
2380	2122	<div class="wrap">
2381		- <h2><?php esc_html_e( 'Authorizer Settings', 'authorizer' ); ?></h2>
2382		- <form method="post" action="options.php" autocomplete="off">
2383		- <?php
2384		- // This prints out all hidden settings fields.
	2123	+ <h2><?php _e( 'Authorizer Settings', 'authorizer' ); ?></h2>
	2124	+ <form method="post" action="options.php" autocomplete="off"><?php
	2125	+ // This prints out all hidden settings fields
	2126	+ // @see http://codex.wordpress.org/Function_Reference/settings_fields
2385	2127	settings_fields( 'auth_settings_group' );
2386		- // This prints out all the sections.
	2128	+ // This prints out all the sections
	2129	+ // @see http://codex.wordpress.org/Function_Reference/do_settings_sections
2387	2130	do_settings_sections( 'authorizer' );
2388		- submit_button();
2389		- ?>
	2131	+ submit_button(); ?>
2390	2132	</form>
2391		- </div>
2392		- <?php
	2133	+ </div><?php
2393	2134	}
2394	2135
2395	2136
2396	2137	/**
2397	2138	* Load external resources on this plugin's options page.
2398		- *
2399		- * Action: load-settings_page_authorizer
2400		- * Action: load-toplevel_page_authorizer
2401		- * Action: admin_head-index.php
	2139	+ * Run on action hooks: load-settings_page_authorizer, load-toplevel_page_authorizer, admin_head-index.php
2402	2140	*/
2403	2141	public function load_options_page() {
2404	2142	wp_enqueue_script(
2405	2143	'authorizer',
2406	2144	plugins_url( 'js/authorizer.js', __FILE__ ),
2407		- array( 'jquery-effects-shake' ), '2.8.0', true
	2145	+ array( 'jquery-effects-shake' ), '2.3.2', true
2408	2146	);
2409		- wp_localize_script(
2410		- 'authorizer', 'authL10n', array(
2411		- 'baseurl' => get_bloginfo( 'url' ),
2412		- 'saved' => esc_html__( 'Saved', 'authorizer' ),
2413		- 'duplicate' => esc_html__( 'Duplicate', 'authorizer' ),
2414		- 'failed' => esc_html__( 'Failed', 'authorizer' ),
2415		- 'local_wordpress_user' => esc_html__( 'Local WordPress user', 'authorizer' ),
2416		- 'block_ban_user' => esc_html__( 'Block/Ban user', 'authorizer' ),
2417		- 'remove_user' => esc_html__( 'Remove user', 'authorizer' ),
2418		- 'no_users_in' => esc_html__( 'No users in', 'authorizer' ),
2419		- 'save_changes' => esc_html__( 'Save Changes', 'authorizer' ),
2420		- 'private_pages' => esc_html__( 'Private Pages', 'authorizer' ),
2421		- 'public_pages' => esc_html__( 'Public Pages', 'authorizer' ),
2422		- 'first_page' => esc_html__( 'First page' ),
2423		- 'previous_page' => esc_html__( 'Previous page' ),
2424		- 'next_page' => esc_html__( 'Next page' ),
2425		- 'last_page' => esc_html__( 'Last page' ),
2426		- 'is_network_admin' => is_network_admin() ? '1' : '0',
2427		- )
2428		- );
	2147	+ wp_localize_script( 'authorizer', 'auth_L10n', array(
	2148	+ 'baseurl' => get_bloginfo( 'url' ),
	2149	+ 'saved' => esc_html__( 'Saved', 'authorizer' ),
	2150	+ 'failed' => esc_html__( 'Failed', 'authorizer' ),
	2151	+ 'local_wordpress_user' => esc_html__( 'Local WordPress user', 'authorizer' ),
	2152	+ 'block_ban_user' => esc_html__( 'Block/Ban user', 'authorizer' ),
	2153	+ 'remove_user' => esc_html__( 'Remove user', 'authorizer' ),
	2154	+ 'no_users_in' => esc_html__( 'No users in', 'authorizer' ),
	2155	+ 'save_changes' => esc_html__( 'Save Changes', 'authorizer' ),
	2156	+ 'private_pages' => esc_html__( 'Private Pages', 'authorizer' ),
	2157	+ 'public_pages' => esc_html__( 'Public Pages', 'authorizer' ),
	2158	+ ));
2429	2159
2430	2160	wp_enqueue_script(
2431		- 'jquery-autogrow-textarea',
2432		- plugins_url( 'vendor/jquery.autogrow-textarea/jquery.autogrow-textarea.js', __FILE__ ),
2433		- array( 'jquery' ), '2.7.0', true
2434		- );
2435		-
2436		- wp_enqueue_script(
2437	2161	'jquery.multi-select',
2438	2162	plugins_url( 'vendor/jquery.multi-select/js/jquery.multi-select.js', __FILE__ ),
2439	2163	array( 'jquery' ), '1.8', true
2440	2164	);
2441	2165
2442		- wp_register_style( 'authorizer-css', plugins_url( 'css/authorizer.css', __FILE__ ), array(), '2.7.3' );
	2166	+ wp_register_style( 'authorizer-css', plugins_url( 'css/authorizer.css', __FILE__ ), array(), '2.3.2' );
2443	2167	wp_enqueue_style( 'authorizer-css' );
2444	2168
2445	2169	wp_register_style( 'jquery-multi-select-css', plugins_url( 'vendor/jquery.multi-select/css/multi-select.css', __FILE__ ), array(), '1.8' );
2446	2170	wp_enqueue_style( 'jquery-multi-select-css' );
		@@ -2451,26 +2175,18 @@
2451	2175
2452	2176
2453	2177	/**
2454	2178	* Show custom admin notice.
2455		- *
2456		- * Note: currently unused, but if anywhere we:
2457		- * add_option( 'auth_settings_advanced_admin_notice, 'Your message.' );
2458		- * It will display and then delete that message on the admin dashboard.
2459		- *
2460		- * Filter: admin_notices
2461		- * filter: network_admin_notices
	2179	+ * Filter: admin_notice
2462	2180	*/
2463		- public function show_advanced_admin_notice() {
	2181	+ function show_advanced_admin_notice() {
2464	2182	$notice = get_option( 'auth_settings_advanced_admin_notice' );
2465	2183	delete_option( 'auth_settings_advanced_admin_notice' );
2466	2184
2467		- if ( $notice && strlen( $notice ) > 0 ) {
2468		- ?>
	2185	+ if ( $notice && strlen( $notice ) > 0 ) { ?>
2469	2186	<div class="error">
2470		- <p><?php echo wp_kses( $notice, $this->allowed_html ); ?></p>
2471		- </div>
2472		- <?php
	2187	+ <p><?php echo $notice; ?></p>
	2188	+ </div><?php
2473	2189	}
2474	2190	}
2475	2191
2476	2192
		@@ -2475,11 +2191,9 @@
2475	2191
2476	2192
2477	2193	/**
2478	2194	* Add notices to the top of the options page.
2479		- *
2480		- * Action: load-settings_page_authorizer > admin_notices
2481		- *
	2195	+ * Run on action hook chain: load-settings_page_authorizer > admin_notices
2482	2196	* Description: Check for invalid settings combinations and show a warning message, e.g.:
2483	2197	* if ( cas url inaccessible ) : ?>
2484	2198	* <div class='updated settings-error'><p>Can't reach CAS server.</p></div>
2485	2199	* <?php endif;
		@@ -2485,23 +2199,20 @@
2485	2199	* <?php endif;
2486	2200	*/
2487	2201	public function admin_notices() {
2488	2202	// Grab plugin settings.
2489		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
	2203	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' );
2490	2204
2491		- if ( '1' === $auth_settings['cas'] ) :
	2205	+ if ( $auth_settings['cas'] === '1' ) :
2492	2206	// Check if provided CAS URL is accessible.
2493		- $protocol = in_array( strval( $auth_settings['cas_port'] ), array( '80', '8080' ), true ) ? 'http' : 'https';
2494		- $cas_url = $protocol . '://' . $auth_settings['cas_host'] . ':' . $auth_settings['cas_port'] . $auth_settings['cas_path'];
2495		- $legacy_cas_url = trailingslashit( $cas_url ) . 'login'; // Check the specific CAS login endpoint (old; some servers don't register a ./login endpoint, use serviceValidate instead).
2496		- $cas_url = trailingslashit( $cas_url ) . 'serviceValidate'; // Check the specific CAS login endpoint.
2497		- if ( ! $this->url_is_accessible( $cas_url ) && ! $this->url_is_accessible( $legacy_cas_url ) ) :
2498		- $authorizer_options_url = 'settings' === $auth_settings['advanced_admin_menu'] ? admin_url( 'options-general.php?page=authorizer' ) : admin_url( '?page=authorizer' );
2499		- ?>
2500		- <div class='notice notice-warning is-dismissible'>
2501		- <p><?php esc_html_e( "Can't reach CAS server. Please provide", 'authorizer' ); ?> <a href='<?php echo esc_attr( $authorizer_options_url ); ?>&tab=external'><?php esc_html_e( 'accurate CAS settings', 'authorizer' ); ?></a> <?php esc_html_e( 'if you intend to use it.', 'authorizer' ); ?></p>
2502		- </div>
2503		- <?php
	2207	+ $protocol = in_array( $auth_settings['cas_port'], array( '80', '8080' ) ) ? 'http' : 'https';
	2208	+ $cas_url = $protocol . '://' . $auth_settings['cas_host'] . ':' . $auth_settings['cas_port'] . $auth_settings['cas_path'];
	2209	+ $cas_url = trailingslashit( $cas_url ) . 'login'; // Check the specific CAS login endpoint
	2210	+ if ( ! $this->url_is_accessible( $cas_url ) ) :
	2211	+ $authorizer_options_url = $auth_settings['advanced_admin_menu'] === 'settings' ? admin_url( 'options-general.php?page=authorizer' ) : admin_url( '?page=authorizer' );
	2212	+ ?><div class='notice notice-warning is-dismissible'>
	2213	+ <p><?php _e( "Can't reach CAS server. Please provide", 'authorizer' ); ?> <a href='<?php echo $authorizer_options_url; ?>&tab=external'><?php _e( 'accurate CAS settings', 'authorizer' ); ?></a> <?php _e( 'if you intend to use it.', 'authorizer' ); ?></p>
	2214	+ </div><?php
2504	2215	endif;
2505	2216	endif;
2506	2217	}
2507	2218
		@@ -2506,430 +2217,399 @@
2506	2217	}
2507	2218
2508	2219
2509	2220	/**
2510		- * Create sections and options.
2511		- *
2512		- * Action: admin_init
	2221	+ * Create sections and options
	2222	+ * Run on action hook: admin_init
2513	2223	*/
2514	2224	public function page_init() {
2515		- /**
2516		- * Create one setting that holds all the options (array).
2517		- *
2518		- * @see http://codex.wordpress.org/Function_Reference/register_setting
2519		- * @see http://codex.wordpress.org/Function_Reference/add_settings_section
2520		- * @see http://codex.wordpress.org/Function_Reference/add_settings_field
2521		- */
	2225	+ // Create one setting that holds all the options (array)
	2226	+ // @see http://codex.wordpress.org/Function_Reference/register_setting
	2227	+ // @see http://codex.wordpress.org/Function_Reference/add_settings_section
	2228	+ // @see http://codex.wordpress.org/Function_Reference/add_settings_field
2522	2229	register_setting(
2523		- 'auth_settings_group',
2524		- 'auth_settings',
2525		- array( $this, 'sanitize_options' )
	2230	+ 'auth_settings_group', // Option group
	2231	+ 'auth_settings', // Option name
	2232	+ array( $this, 'sanitize_options' ) // Sanitize callback
2526	2233	);
2527	2234
2528	2235	add_settings_section(
2529		- 'auth_settings_tabs',
2530		- '',
2531		- array( $this, 'print_section_info_tabs' ),
2532		- 'authorizer'
	2236	+ 'auth_settings_tabs', // HTML element ID
	2237	+ '', // HTML element Title
	2238	+ array( $this, 'print_section_info_tabs' ), // Callback (echos section content)
	2239	+ 'authorizer' // Page this section is shown on (slug)
2533	2240	);
2534	2241
2535		- // Create Access Lists section.
	2242	+ // Create Access Lists section
2536	2243	add_settings_section(
2537		- 'auth_settings_lists',
2538		- '',
2539		- array( $this, 'print_section_info_access_lists' ),
2540		- 'authorizer'
	2244	+ 'auth_settings_lists', // HTML element ID
	2245	+ '', // HTML element Title
	2246	+ array( $this, 'print_section_info_access_lists' ), // Callback (echos section content)
	2247	+ 'authorizer' // Page this section is shown on (slug)
2541	2248	);
2542	2249
2543		- // Create Login Access section.
	2250	+ // Create Login Access section
2544	2251	add_settings_section(
2545		- 'auth_settings_access_login',
2546		- '',
2547		- array( $this, 'print_section_info_access_login' ),
2548		- 'authorizer'
	2252	+ 'auth_settings_access_login', // HTML element ID
	2253	+ '', // HTML element Title
	2254	+ array( $this, 'print_section_info_access_login' ), // Callback (echos section content)
	2255	+ 'authorizer' // Page this section is shown on (slug)
2549	2256	);
2550	2257	add_settings_field(
2551		- 'auth_settings_access_who_can_login',
2552		- __( 'Who can log into the site?', 'authorizer' ),
2553		- array( $this, 'print_radio_auth_access_who_can_login' ),
2554		- 'authorizer',
2555		- 'auth_settings_access_login'
	2258	+ 'auth_settings_access_who_can_login', // HTML element ID
	2259	+ __( 'Who can log into the site?', 'authorizer' ), // HTML element Title
	2260	+ array( $this, 'print_radio_auth_access_who_can_login' ), // Callback (echos form element)
	2261	+ 'authorizer', // Page this setting is shown on (slug)
	2262	+ 'auth_settings_access_login' // Section this setting is shown on
2556	2263	);
2557	2264	add_settings_field(
2558		- 'auth_settings_access_role_receive_pending_emails',
2559		- __( 'Which role should receive email notifications about pending users?', 'authorizer' ),
2560		- array( $this, 'print_select_auth_access_role_receive_pending_emails' ),
2561		- 'authorizer',
2562		- 'auth_settings_access_login'
	2265	+ 'auth_settings_access_role_receive_pending_emails', // HTML element ID
	2266	+ __( 'Which role should receive email notifications about pending users?', 'authorizer' ), // HTML element Title
	2267	+ array( $this, 'print_select_auth_access_role_receive_pending_emails' ), // Callback (echos form element)
	2268	+ 'authorizer', // Page this setting is shown on (slug)
	2269	+ 'auth_settings_access_login' // Section this setting is shown on
2563	2270	);
2564	2271	add_settings_field(
2565		- 'auth_settings_access_pending_redirect_to_message',
2566		- __( 'What message should pending users see after attempting to log in?', 'authorizer' ),
2567		- array( $this, 'print_wysiwyg_auth_access_pending_redirect_to_message' ),
2568		- 'authorizer',
2569		- 'auth_settings_access_login'
	2272	+ 'auth_settings_access_pending_redirect_to_message', // HTML element ID
	2273	+ __( 'What message should pending users see after attempting to log in?', 'authorizer' ), // HTML element Title
	2274	+ array( $this, 'print_wysiwyg_auth_access_pending_redirect_to_message' ), // Callback (echos form element)
	2275	+ 'authorizer', // Page this setting is shown on (slug)
	2276	+ 'auth_settings_access_login' // Section this setting is shown on
2570	2277	);
2571	2278	add_settings_field(
2572		- 'auth_settings_access_blocked_redirect_to_message',
2573		- __( 'What message should blocked users see after attempting to log in?', 'authorizer' ),
2574		- array( $this, 'print_wysiwyg_auth_access_blocked_redirect_to_message' ),
2575		- 'authorizer',
2576		- 'auth_settings_access_login'
	2279	+ 'auth_settings_access_blocked_redirect_to_message', // HTML element ID
	2280	+ __( 'What message should blocked users see after attempting to log in?', 'authorizer' ), // HTML element Title
	2281	+ array( $this, 'print_wysiwyg_auth_access_blocked_redirect_to_message' ), // Callback (echos form element)
	2282	+ 'authorizer', // Page this setting is shown on (slug)
	2283	+ 'auth_settings_access_login' // Section this setting is shown on
2577	2284	);
2578	2285	add_settings_field(
2579		- 'auth_settings_access_should_email_approved_users',
2580		- __( 'Send welcome email to new approved users?', 'authorizer' ),
2581		- array( $this, 'print_checkbox_auth_access_should_email_approved_users' ),
2582		- 'authorizer',
2583		- 'auth_settings_access_login'
	2286	+ 'auth_settings_access_should_email_approved_users', // HTML element ID
	2287	+ __( 'Send welcome email to new approved users?', 'authorizer' ), // HTML element Title
	2288	+ array( $this, 'print_checkbox_auth_access_should_email_approved_users' ), // Callback (echos form element)
	2289	+ 'authorizer', // Page this setting is shown on (slug)
	2290	+ 'auth_settings_access_login' // Section this setting is shown on
2584	2291	);
2585	2292	add_settings_field(
2586		- 'auth_settings_access_email_approved_users_subject',
2587		- __( 'Welcome email subject', 'authorizer' ),
2588		- array( $this, 'print_text_auth_access_email_approved_users_subject' ),
2589		- 'authorizer',
2590		- 'auth_settings_access_login'
	2293	+ 'auth_settings_access_email_approved_users_subject', // HTML element ID
	2294	+ __( 'Welcome email subject', 'authorizer' ), // HTML element Title
	2295	+ array( $this, 'print_text_auth_access_email_approved_users_subject' ), // Callback (echos form element)
	2296	+ 'authorizer', // Page this setting is shown on (slug)
	2297	+ 'auth_settings_access_login' // Section this setting is shown on
2591	2298	);
2592	2299	add_settings_field(
2593		- 'auth_settings_access_email_approved_users_body',
2594		- __( 'Welcome email body', 'authorizer' ),
2595		- array( $this, 'print_wysiwyg_auth_access_email_approved_users_body' ),
2596		- 'authorizer',
2597		- 'auth_settings_access_login'
	2300	+ 'auth_settings_access_email_approved_users_body', // HTML element ID
	2301	+ __( 'Welcome email body', 'authorizer' ), // HTML element Title
	2302	+ array( $this, 'print_wysiwyg_auth_access_email_approved_users_body' ), // Callback (echos form element)
	2303	+ 'authorizer', // Page this setting is shown on (slug)
	2304	+ 'auth_settings_access_login' // Section this setting is shown on
2598	2305	);
2599	2306
2600		- // Create Public Access section.
	2307	+
	2308	+ // Create Public Access section
2601	2309	add_settings_section(
2602		- 'auth_settings_access_public',
2603		- '',
2604		- array( $this, 'print_section_info_access_public' ),
2605		- 'authorizer'
	2310	+ 'auth_settings_access_public', // HTML element ID
	2311	+ '', // HTML element Title
	2312	+ array( $this, 'print_section_info_access_public' ), // Callback (echos section content)
	2313	+ 'authorizer' // Page this section is shown on (slug)
2606	2314	);
2607	2315	add_settings_field(
2608		- 'auth_settings_access_who_can_view',
2609		- __( 'Who can view the site?', 'authorizer' ),
2610		- array( $this, 'print_radio_auth_access_who_can_view' ),
2611		- 'authorizer',
2612		- 'auth_settings_access_public'
	2316	+ 'auth_settings_access_who_can_view', // HTML element ID
	2317	+ __( 'Who can view the site?', 'authorizer' ), // HTML element Title
	2318	+ array( $this, 'print_radio_auth_access_who_can_view' ), // Callback (echos form element)
	2319	+ 'authorizer', // Page this setting is shown on (slug)
	2320	+ 'auth_settings_access_public' // Section this setting is shown on
2613	2321	);
2614	2322	add_settings_field(
2615		- 'auth_settings_access_public_pages',
2616		- __( 'What pages (if any) should be available to everyone?', 'authorizer' ),
2617		- array( $this, 'print_multiselect_auth_access_public_pages' ),
2618		- 'authorizer',
2619		- 'auth_settings_access_public'
	2323	+ 'auth_settings_access_public_pages', // HTML element ID
	2324	+ __( 'What pages (if any) should be available to everyone?', 'authorizer' ), // HTML element Title
	2325	+ array( $this, 'print_multiselect_auth_access_public_pages' ), // Callback (echos form element)
	2326	+ 'authorizer', // Page this setting is shown on (slug)
	2327	+ 'auth_settings_access_public' // Section this setting is shown on
2620	2328	);
2621	2329	add_settings_field(
2622		- 'auth_settings_access_redirect',
2623		- __( 'What happens to people without access when they visit a private page?', 'authorizer' ),
2624		- array( $this, 'print_radio_auth_access_redirect' ),
2625		- 'authorizer',
2626		- 'auth_settings_access_public'
	2330	+ 'auth_settings_access_redirect', // HTML element ID
	2331	+ __( 'What happens to people without access when they visit a private page?', 'authorizer' ), // HTML element Title
	2332	+ array( $this, 'print_radio_auth_access_redirect' ), // Callback (echos form element)
	2333	+ 'authorizer', // Page this setting is shown on (slug)
	2334	+ 'auth_settings_access_public' // Section this setting is shown on
2627	2335	);
2628	2336	add_settings_field(
2629		- 'auth_settings_access_public_warning',
2630		- __( 'What happens to people without access when they visit a public page?', 'authorizer' ),
2631		- array( $this, 'print_radio_auth_access_public_warning' ),
2632		- 'authorizer',
2633		- 'auth_settings_access_public'
	2337	+ 'auth_settings_access_public_warning', // HTML element ID
	2338	+ __( 'What happens to people without access when they visit a public page?', 'authorizer' ), // HTML element Title
	2339	+ array( $this, 'print_radio_auth_access_public_warning' ), // Callback (echos form element)
	2340	+ 'authorizer', // Page this setting is shown on (slug)
	2341	+ 'auth_settings_access_public' // Section this setting is shown on
2634	2342	);
2635	2343	add_settings_field(
2636		- 'auth_settings_access_redirect_to_message',
2637		- __( 'What message should people without access see?', 'authorizer' ),
2638		- array( $this, 'print_wysiwyg_auth_access_redirect_to_message' ),
2639		- 'authorizer',
2640		- 'auth_settings_access_public'
	2344	+ 'auth_settings_access_redirect_to_message', // HTML element ID
	2345	+ __( 'What message should people without access see?', 'authorizer' ), // HTML element Title
	2346	+ array( $this, 'print_wysiwyg_auth_access_redirect_to_message' ), // Callback (echos form element)
	2347	+ 'authorizer', // Page this setting is shown on (slug)
	2348	+ 'auth_settings_access_public' // Section this setting is shown on
2641	2349	);
2642	2350
2643		- // Create External Service Settings section.
	2351	+ // Create External Service Settings section
2644	2352	add_settings_section(
2645		- 'auth_settings_external',
2646		- '',
2647		- array( $this, 'print_section_info_external' ),
2648		- 'authorizer'
	2353	+ 'auth_settings_external', // HTML element ID
	2354	+ '', // HTML element Title
	2355	+ array( $this, 'print_section_info_external' ), // Callback (echos section content)
	2356	+ 'authorizer' // Page this section is shown on (slug)
2649	2357	);
2650	2358	add_settings_field(
2651		- 'auth_settings_access_default_role',
2652		- __( 'Default role for new users', 'authorizer' ),
2653		- array( $this, 'print_select_auth_access_default_role' ),
2654		- 'authorizer',
2655		- 'auth_settings_external'
	2359	+ 'auth_settings_access_default_role', // HTML element ID
	2360	+ __( 'Default role for new users', 'authorizer' ), // HTML element Title
	2361	+ array( $this, 'print_select_auth_access_default_role' ), // Callback (echos form element)
	2362	+ 'authorizer', // Page this setting is shown on (slug)
	2363	+ 'auth_settings_external' // Section this setting is shown on
2656	2364	);
2657	2365	add_settings_field(
2658		- 'auth_settings_external_google',
2659		- __( 'Google Logins', 'authorizer' ),
2660		- array( $this, 'print_checkbox_auth_external_google' ),
2661		- 'authorizer',
2662		- 'auth_settings_external'
	2366	+ 'auth_settings_external_google', // HTML element ID
	2367	+ __( 'Google Logins', 'authorizer' ), // HTML element Title
	2368	+ array( $this, 'print_checkbox_auth_external_google' ), // Callback (echos form element)
	2369	+ 'authorizer', // Page this setting is shown on (slug)
	2370	+ 'auth_settings_external' // Section this setting is shown on
2663	2371	);
2664	2372	add_settings_field(
2665		- 'auth_settings_google_clientid',
2666		- __( 'Google Client ID', 'authorizer' ),
2667		- array( $this, 'print_text_google_clientid' ),
2668		- 'authorizer',
2669		- 'auth_settings_external'
	2373	+ 'auth_settings_google_clientid', // HTML element ID
	2374	+ __( 'Google Client ID', 'authorizer' ), // HTML element Title
	2375	+ array( $this, 'print_text_google_clientid' ), // Callback (echos form element)
	2376	+ 'authorizer', // Page this setting is shown on (slug)
	2377	+ 'auth_settings_external' // Section this setting is shown on
2670	2378	);
2671	2379	add_settings_field(
2672		- 'auth_settings_google_clientsecret',
2673		- __( 'Google Client Secret', 'authorizer' ),
2674		- array( $this, 'print_text_google_clientsecret' ),
2675		- 'authorizer',
2676		- 'auth_settings_external'
	2380	+ 'auth_settings_google_clientsecret', // HTML element ID
	2381	+ __( 'Google Client Secret', 'authorizer' ), // HTML element Title
	2382	+ array( $this, 'print_text_google_clientsecret' ), // Callback (echos form element)
	2383	+ 'authorizer', // Page this setting is shown on (slug)
	2384	+ 'auth_settings_external' // Section this setting is shown on
2677	2385	);
2678	2386	add_settings_field(
2679		- 'auth_settings_google_hosteddomain',
2680		- __( 'Google Hosted Domain', 'authorizer' ),
2681		- array( $this, 'print_text_google_hosteddomain' ),
2682		- 'authorizer',
2683		- 'auth_settings_external'
	2387	+ 'auth_settings_google_hosteddomain', // HTML element ID
	2388	+ __( 'Google Hosted Domain', 'authorizer' ), // HTML element Title
	2389	+ array( $this, 'print_text_google_hosteddomain' ), // Callback (echos form element)
	2390	+ 'authorizer', // Page this setting is shown on (slug)
	2391	+ 'auth_settings_external' // Section this setting is shown on
2684	2392	);
2685	2393	add_settings_field(
2686		- 'auth_settings_external_cas',
2687		- __( 'CAS Logins', 'authorizer' ),
2688		- array( $this, 'print_checkbox_auth_external_cas' ),
2689		- 'authorizer',
2690		- 'auth_settings_external'
	2394	+ 'auth_settings_external_cas', // HTML element ID
	2395	+ __( 'CAS Logins', 'authorizer' ), // HTML element Title
	2396	+ array( $this, 'print_checkbox_auth_external_cas' ), // Callback (echos form element)
	2397	+ 'authorizer', // Page this setting is shown on (slug)
	2398	+ 'auth_settings_external' // Section this setting is shown on
2691	2399	);
2692	2400	add_settings_field(
2693		- 'auth_settings_cas_custom_label',
2694		- __( 'CAS custom label', 'authorizer' ),
2695		- array( $this, 'print_text_cas_custom_label' ),
2696		- 'authorizer',
2697		- 'auth_settings_external'
	2401	+ 'auth_settings_cas_custom_label', // HTML element ID
	2402	+ __( 'CAS custom label', 'authorizer' ), // HTML element Title
	2403	+ array( $this, 'print_text_cas_custom_label' ), // Callback (echos form element)
	2404	+ 'authorizer', // Page this setting is shown on (slug)
	2405	+ 'auth_settings_external' // Section this setting is shown on
2698	2406	);
2699	2407	add_settings_field(
2700		- 'auth_settings_cas_host',
2701		- __( 'CAS server hostname', 'authorizer' ),
2702		- array( $this, 'print_text_cas_host' ),
2703		- 'authorizer',
2704		- 'auth_settings_external'
	2408	+ 'auth_settings_cas_host', // HTML element ID
	2409	+ __( 'CAS server hostname', 'authorizer' ), // HTML element Title
	2410	+ array( $this, 'print_text_cas_host' ), // Callback (echos form element)
	2411	+ 'authorizer', // Page this setting is shown on (slug)
	2412	+ 'auth_settings_external' // Section this setting is shown on
2705	2413	);
2706	2414	add_settings_field(
2707		- 'auth_settings_cas_port',
2708		- __( 'CAS server port', 'authorizer' ),
2709		- array( $this, 'print_text_cas_port' ),
2710		- 'authorizer',
2711		- 'auth_settings_external'
	2415	+ 'auth_settings_cas_port', // HTML element ID
	2416	+ __( 'CAS server port', 'authorizer' ), // HTML element Title
	2417	+ array( $this, 'print_text_cas_port' ), // Callback (echos form element)
	2418	+ 'authorizer', // Page this setting is shown on (slug)
	2419	+ 'auth_settings_external' // Section this setting is shown on
2712	2420	);
2713	2421	add_settings_field(
2714		- 'auth_settings_cas_path',
2715		- __( 'CAS server path/context', 'authorizer' ),
2716		- array( $this, 'print_text_cas_path' ),
2717		- 'authorizer',
2718		- 'auth_settings_external'
	2422	+ 'auth_settings_cas_path', // HTML element ID
	2423	+ __( 'CAS server path/context', 'authorizer' ), // HTML element Title
	2424	+ array( $this, 'print_text_cas_path' ), // Callback (echos form element)
	2425	+ 'authorizer', // Page this setting is shown on (slug)
	2426	+ 'auth_settings_external' // Section this setting is shown on
2719	2427	);
2720	2428	add_settings_field(
2721		- 'auth_settings_cas_version',
2722		- 'CAS server version',
2723		- array( $this, 'print_select_cas_version' ),
2724		- 'authorizer',
2725		- 'auth_settings_external'
	2429	+ 'auth_settings_cas_version', // HTML element ID
	2430	+ 'CAS server version', // HTML element Title
	2431	+ array( $this, 'print_select_cas_version' ), // Callback (echos form element)
	2432	+ 'authorizer', // Page this setting is shown on (slug)
	2433	+ 'auth_settings_external' // Section this setting is shown on
2726	2434	);
2727	2435	add_settings_field(
2728		- 'auth_settings_cas_attr_email',
2729		- __( 'CAS attribute containing email address', 'authorizer' ),
2730		- array( $this, 'print_text_cas_attr_email' ),
2731		- 'authorizer',
2732		- 'auth_settings_external'
	2436	+ 'auth_settings_cas_attr_email', // HTML element ID
	2437	+ __( 'CAS attribute containing email address', 'authorizer' ), // HTML element Title
	2438	+ array( $this, 'print_text_cas_attr_email' ), // Callback (echos form element)
	2439	+ 'authorizer', // Page this setting is shown on (slug)
	2440	+ 'auth_settings_external' // Section this setting is shown on
2733	2441	);
2734	2442	add_settings_field(
2735		- 'auth_settings_cas_attr_first_name',
2736		- __( 'CAS attribute containing first name', 'authorizer' ),
2737		- array( $this, 'print_text_cas_attr_first_name' ),
2738		- 'authorizer',
2739		- 'auth_settings_external'
	2443	+ 'auth_settings_cas_attr_first_name', // HTML element ID
	2444	+ __( 'CAS attribute containing first name', 'authorizer' ), // HTML element Title
	2445	+ array( $this, 'print_text_cas_attr_first_name' ), // Callback (echos form element)
	2446	+ 'authorizer', // Page this setting is shown on (slug)
	2447	+ 'auth_settings_external' // Section this setting is shown on
2740	2448	);
2741	2449	add_settings_field(
2742		- 'auth_settings_cas_attr_last_name',
2743		- __( 'CAS attribute containing last name', 'authorizer' ),
2744		- array( $this, 'print_text_cas_attr_last_name' ),
2745		- 'authorizer',
2746		- 'auth_settings_external'
	2450	+ 'auth_settings_cas_attr_last_name', // HTML element ID
	2451	+ __( 'CAS attribute containing last name', 'authorizer' ), // HTML element Title
	2452	+ array( $this, 'print_text_cas_attr_last_name' ), // Callback (echos form element)
	2453	+ 'authorizer', // Page this setting is shown on (slug)
	2454	+ 'auth_settings_external' // Section this setting is shown on
2747	2455	);
2748	2456	add_settings_field(
2749		- 'auth_settings_cas_attr_update_on_login',
2750		- __( 'CAS attribute update', 'authorizer' ),
2751		- array( $this, 'print_checkbox_cas_attr_update_on_login' ),
2752		- 'authorizer',
2753		- 'auth_settings_external'
	2457	+ 'auth_settings_cas_attr_update_on_login', // HTML element ID
	2458	+ __( 'CAS attribute update', 'authorizer' ), // HTML element Title
	2459	+ array( $this, 'print_checkbox_cas_attr_update_on_login' ), // Callback (echos form element)
	2460	+ 'authorizer', // Page this setting is shown on (slug)
	2461	+ 'auth_settings_external' // Section this setting is shown on
2754	2462	);
2755	2463	add_settings_field(
2756		- 'auth_settings_cas_auto_login',
2757		- __( 'CAS automatic login', 'authorizer' ),
2758		- array( $this, 'print_checkbox_cas_auto_login' ),
2759		- 'authorizer',
2760		- 'auth_settings_external'
	2464	+ 'auth_settings_cas_auto_login', // HTML element ID
	2465	+ __( 'CAS automatic login', 'authorizer' ), // HTML element Title
	2466	+ array( $this, 'print_checkbox_cas_auto_login' ), // Callback (echos form element)
	2467	+ 'authorizer', // Page this setting is shown on (slug)
	2468	+ 'auth_settings_external' // Section this setting is shown on
2761	2469	);
2762	2470	add_settings_field(
2763		- 'auth_settings_external_ldap',
2764		- __( 'LDAP Logins', 'authorizer' ),
2765		- array( $this, 'print_checkbox_auth_external_ldap' ),
2766		- 'authorizer',
2767		- 'auth_settings_external'
	2471	+ 'auth_settings_external_ldap', // HTML element ID
	2472	+ __( 'LDAP Logins', 'authorizer' ), // HTML element Title
	2473	+ array( $this, 'print_checkbox_auth_external_ldap' ), // Callback (echos form element)
	2474	+ 'authorizer', // Page this setting is shown on (slug)
	2475	+ 'auth_settings_external' // Section this setting is shown on
2768	2476	);
2769	2477	add_settings_field(
2770		- 'auth_settings_ldap_host',
2771		- __( 'LDAP Host', 'authorizer' ),
2772		- array( $this, 'print_text_ldap_host' ),
2773		- 'authorizer',
2774		- 'auth_settings_external'
	2478	+ 'auth_settings_ldap_host', // HTML element ID
	2479	+ __( 'LDAP Host', 'authorizer' ), // HTML element Title
	2480	+ array( $this, 'print_text_ldap_host' ), // Callback (echos form element)
	2481	+ 'authorizer', // Page this setting is shown on (slug)
	2482	+ 'auth_settings_external' // Section this setting is shown on
2775	2483	);
2776	2484	add_settings_field(
2777		- 'auth_settings_ldap_port',
2778		- __( 'LDAP Port', 'authorizer' ),
2779		- array( $this, 'print_text_ldap_port' ),
2780		- 'authorizer',
2781		- 'auth_settings_external'
	2485	+ 'auth_settings_ldap_port', // HTML element ID
	2486	+ __( 'LDAP Port', 'authorizer' ), // HTML element Title
	2487	+ array( $this, 'print_text_ldap_port' ), // Callback (echos form element)
	2488	+ 'authorizer', // Page this setting is shown on (slug)
	2489	+ 'auth_settings_external' // Section this setting is shown on
2782	2490	);
2783	2491	add_settings_field(
2784		- 'auth_settings_ldap_tls',
2785		- __( 'Use TLS', 'authorizer' ),
2786		- array( $this, 'print_checkbox_ldap_tls' ),
2787		- 'authorizer',
2788		- 'auth_settings_external'
	2492	+ 'auth_settings_ldap_tls', // HTML element ID
	2493	+ __( 'Secure Connection (TLS)', 'authorizer' ), // HTML element Title
	2494	+ array( $this, 'print_checkbox_ldap_tls' ), // Callback (echos form element)
	2495	+ 'authorizer', // Page this setting is shown on (slug)
	2496	+ 'auth_settings_external' // Section this setting is shown on
2789	2497	);
2790	2498	add_settings_field(
2791		- 'auth_settings_ldap_search_base',
2792		- __( 'LDAP Search Base', 'authorizer' ),
2793		- array( $this, 'print_text_ldap_search_base' ),
2794		- 'authorizer',
2795		- 'auth_settings_external'
	2499	+ 'auth_settings_ldap_search_base', // HTML element ID
	2500	+ __( 'LDAP Search Base', 'authorizer' ), // HTML element Title
	2501	+ array( $this, 'print_text_ldap_search_base' ), // Callback (echos form element)
	2502	+ 'authorizer', // Page this setting is shown on (slug)
	2503	+ 'auth_settings_external' // Section this setting is shown on
2796	2504	);
2797	2505	add_settings_field(
2798		- 'auth_settings_ldap_uid',
2799		- __( 'LDAP attribute containing username', 'authorizer' ),
2800		- array( $this, 'print_text_ldap_uid' ),
2801		- 'authorizer',
2802		- 'auth_settings_external'
	2506	+ 'auth_settings_ldap_uid', // HTML element ID
	2507	+ __( 'LDAP attribute containing username', 'authorizer' ), // HTML element Title
	2508	+ array( $this, 'print_text_ldap_uid' ), // Callback (echos form element)
	2509	+ 'authorizer', // Page this setting is shown on (slug)
	2510	+ 'auth_settings_external' // Section this setting is shown on
2803	2511	);
2804	2512	add_settings_field(
2805		- 'auth_settings_ldap_attr_email',
2806		- __( 'LDAP attribute containing email address', 'authorizer' ),
2807		- array( $this, 'print_text_ldap_attr_email' ),
2808		- 'authorizer',
2809		- 'auth_settings_external'
	2513	+ 'auth_settings_ldap_attr_email', // HTML element ID
	2514	+ __( 'LDAP attribute containing email address', 'authorizer' ), // HTML element Title
	2515	+ array( $this, 'print_text_ldap_attr_email' ), // Callback (echos form element)
	2516	+ 'authorizer', // Page this setting is shown on (slug)
	2517	+ 'auth_settings_external' // Section this setting is shown on
2810	2518	);
2811	2519	add_settings_field(
2812		- 'auth_settings_ldap_user',
2813		- __( 'LDAP Directory User', 'authorizer' ),
2814		- array( $this, 'print_text_ldap_user' ),
2815		- 'authorizer',
2816		- 'auth_settings_external'
	2520	+ 'auth_settings_ldap_user', // HTML element ID
	2521	+ __( 'LDAP Directory User', 'authorizer' ), // HTML element Title
	2522	+ array( $this, 'print_text_ldap_user' ), // Callback (echos form element)
	2523	+ 'authorizer', // Page this setting is shown on (slug)
	2524	+ 'auth_settings_external' // Section this setting is shown on
2817	2525	);
2818	2526	add_settings_field(
2819		- 'auth_settings_ldap_password',
2820		- __( 'LDAP Directory User Password', 'authorizer' ),
2821		- array( $this, 'print_password_ldap_password' ),
2822		- 'authorizer',
2823		- 'auth_settings_external'
	2527	+ 'auth_settings_ldap_password', // HTML element ID
	2528	+ __( 'LDAP Directory User Password', 'authorizer' ), // HTML element Title
	2529	+ array( $this, 'print_password_ldap_password' ), // Callback (echos form element)
	2530	+ 'authorizer', // Page this setting is shown on (slug)
	2531	+ 'auth_settings_external' // Section this setting is shown on
2824	2532	);
2825	2533	add_settings_field(
2826		- 'auth_settings_ldap_lostpassword_url',
2827		- __( 'Custom lost password URL', 'authorizer' ),
2828		- array( $this, 'print_text_ldap_lostpassword_url' ),
2829		- 'authorizer',
2830		- 'auth_settings_external'
	2534	+ 'auth_settings_ldap_lostpassword_url', // HTML element ID
	2535	+ __( 'Custom lost password URL', 'authorizer' ), // HTML element Title
	2536	+ array( $this, 'print_text_ldap_lostpassword_url' ), // Callback (echos form element)
	2537	+ 'authorizer', // Page this setting is shown on (slug)
	2538	+ 'auth_settings_external' // Section this setting is shown on
2831	2539	);
2832	2540	add_settings_field(
2833		- 'auth_settings_ldap_attr_first_name',
2834		- __( 'LDAP attribute containing first name', 'authorizer' ),
2835		- array( $this, 'print_text_ldap_attr_first_name' ),
2836		- 'authorizer',
2837		- 'auth_settings_external'
	2541	+ 'auth_settings_ldap_attr_first_name', // HTML element ID
	2542	+ __( 'LDAP attribute containing first name', 'authorizer' ), // HTML element Title
	2543	+ array( $this, 'print_text_ldap_attr_first_name' ), // Callback (echos form element)
	2544	+ 'authorizer', // Page this setting is shown on (slug)
	2545	+ 'auth_settings_external' // Section this setting is shown on
2838	2546	);
2839	2547	add_settings_field(
2840		- 'auth_settings_ldap_attr_last_name',
2841		- __( 'LDAP attribute containing last name', 'authorizer' ),
2842		- array( $this, 'print_text_ldap_attr_last_name' ),
2843		- 'authorizer',
2844		- 'auth_settings_external'
	2548	+ 'auth_settings_ldap_attr_last_name', // HTML element ID
	2549	+ __( 'LDAP attribute containing last name', 'authorizer' ), // HTML element Title
	2550	+ array( $this, 'print_text_ldap_attr_last_name' ), // Callback (echos form element)
	2551	+ 'authorizer', // Page this setting is shown on (slug)
	2552	+ 'auth_settings_external' // Section this setting is shown on
2845	2553	);
2846	2554	add_settings_field(
2847		- 'auth_settings_ldap_attr_update_on_login',
2848		- __( 'LDAP attribute update', 'authorizer' ),
2849		- array( $this, 'print_checkbox_ldap_attr_update_on_login' ),
2850		- 'authorizer',
2851		- 'auth_settings_external'
	2555	+ 'auth_settings_ldap_attr_update_on_login', // HTML element ID
	2556	+ __( 'LDAP attribute update', 'authorizer' ), // HTML element Title
	2557	+ array( $this, 'print_checkbox_ldap_attr_update_on_login' ), // Callback (echos form element)
	2558	+ 'authorizer', // Page this setting is shown on (slug)
	2559	+ 'auth_settings_external' // Section this setting is shown on
2852	2560	);
2853	2561
2854		- // Create Advanced Settings section.
	2562	+ // Create Advanced Settings section
2855	2563	add_settings_section(
2856		- 'auth_settings_advanced',
2857		- '',
2858		- array( $this, 'print_section_info_advanced' ),
2859		- 'authorizer'
	2564	+ 'auth_settings_advanced', // HTML element ID
	2565	+ '', // HTML element Title
	2566	+ array( $this, 'print_section_info_advanced' ), // Callback (echos section content)
	2567	+ 'authorizer' // Page this section is shown on (slug)
2860	2568	);
2861	2569	add_settings_field(
2862		- 'auth_settings_advanced_lockouts',
2863		- __( 'Limit invalid login attempts', 'authorizer' ),
2864		- array( $this, 'print_text_auth_advanced_lockouts' ),
2865		- 'authorizer',
2866		- 'auth_settings_advanced'
	2570	+ 'auth_settings_advanced_lockouts', // HTML element ID
	2571	+ __( 'Limit invalid login attempts', 'authorizer' ), // HTML element Title
	2572	+ array( $this, 'print_text_auth_advanced_lockouts' ), // Callback (echos form element)
	2573	+ 'authorizer', // Page this setting is shown on (slug)
	2574	+ 'auth_settings_advanced' // Section this setting is shown on
2867	2575	);
2868	2576	add_settings_field(
2869		- 'auth_settings_advanced_hide_wp_login',
2870		- __( 'Hide WordPress Login', 'authorizer' ),
2871		- array( $this, 'print_checkbox_auth_advanced_hide_wp_login' ),
2872		- 'authorizer',
2873		- 'auth_settings_advanced'
	2577	+ 'auth_settings_advanced_hide_wp_login', // HTML element ID
	2578	+ __( 'Hide WordPress Login', 'authorizer' ), // HTML element Title
	2579	+ array( $this, 'print_checkbox_auth_advanced_hide_wp_login' ), // Callback (echos form element)
	2580	+ 'authorizer', // Page this setting is shown on (slug)
	2581	+ 'auth_settings_advanced' // Section this setting is shown on
2874	2582	);
2875	2583	add_settings_field(
2876		- 'auth_settings_advanced_branding',
2877		- __( 'Custom WordPress login branding', 'authorizer' ),
2878		- array( $this, 'print_radio_auth_advanced_branding' ),
2879		- 'authorizer',
2880		- 'auth_settings_advanced'
	2584	+ 'auth_settings_advanced_branding', // HTML element ID
	2585	+ __( 'Custom WordPress login branding', 'authorizer' ), // HTML element Title
	2586	+ array( $this, 'print_radio_auth_advanced_branding' ), // Callback (echos form element)
	2587	+ 'authorizer', // Page this setting is shown on (slug)
	2588	+ 'auth_settings_advanced' // Section this setting is shown on
2881	2589	);
2882	2590	add_settings_field(
2883		- 'auth_settings_advanced_admin_menu',
2884		- __( 'Authorizer admin menu item location', 'authorizer' ),
2885		- array( $this, 'print_radio_auth_advanced_admin_menu' ),
2886		- 'authorizer',
2887		- 'auth_settings_advanced'
	2591	+ 'auth_settings_advanced_admin_menu', // HTML element ID
	2592	+ __( 'Authorizer admin menu item location', 'authorizer' ), // HTML element Title
	2593	+ array( $this, 'print_radio_auth_advanced_admin_menu' ), // Callback (echos form element)
	2594	+ 'authorizer', // Page this setting is shown on (slug)
	2595	+ 'auth_settings_advanced' // Section this setting is shown on
2888	2596	);
2889	2597	add_settings_field(
2890		- 'auth_settings_advanced_usermeta',
2891		- __( 'Show custom usermeta in user list', 'authorizer' ),
2892		- array( $this, 'print_select_auth_advanced_usermeta' ),
2893		- 'authorizer',
2894		- 'auth_settings_advanced'
	2598	+ 'auth_settings_advanced_usermeta', // HTML element ID
	2599	+ __( 'Show custom usermeta in user list', 'authorizer' ), // HTML element Title
	2600	+ array( $this, 'print_select_auth_advanced_usermeta' ), // Callback (echos form element)
	2601	+ 'authorizer', // Page this setting is shown on (slug)
	2602	+ 'auth_settings_advanced' // Section this setting is shown on
2895	2603	);
2896		- add_settings_field(
2897		- 'auth_settings_advanced_users_per_page',
2898		- __( 'Number of users per page', 'authorizer' ),
2899		- array( $this, 'print_text_auth_advanced_users_per_page' ),
2900		- 'authorizer',
2901		- 'auth_settings_advanced'
2902		- );
2903		- add_settings_field(
2904		- 'auth_settings_advanced_users_sort_by',
2905		- __( 'Approved users sort method', 'authorizer' ),
2906		- array( $this, 'print_select_auth_advanced_users_sort_by' ),
2907		- 'authorizer',
2908		- 'auth_settings_advanced'
2909		- );
2910		- add_settings_field(
2911		- 'auth_settings_advanced_users_sort_order',
2912		- __( 'Approved users sort order', 'authorizer' ),
2913		- array( $this, 'print_select_auth_advanced_users_sort_order' ),
2914		- 'authorizer',
2915		- 'auth_settings_advanced'
2916		- );
2917		- add_settings_field(
2918		- 'auth_settings_advanced_widget_enabled',
2919		- __( 'Show dashboard widget to admin users', 'authorizer' ),
2920		- array( $this, 'print_checkbox_auth_advanced_widget_enabled' ),
2921		- 'authorizer',
2922		- 'auth_settings_advanced'
2923		- );
2924	2604	// On multisite installs, add an option to override all multisite settings on individual sites.
2925	2605	if ( is_multisite() ) {
2926	2606	add_settings_field(
2927		- 'auth_settings_advanced_override_multisite',
2928		- __( 'Override multisite options', 'authorizer' ),
2929		- array( $this, 'print_checkbox_auth_advanced_override_multisite' ),
2930		- 'authorizer',
2931		- 'auth_settings_advanced'
	2607	+ 'auth_settings_advanced_override_multisite', // HTML element ID
	2608	+ __( 'Override multisite options', 'authorizer' ), // HTML element Title
	2609	+ array( $this, 'print_checkbox_auth_advanced_override_multisite' ), // Callback (echos form element)
	2610	+ 'authorizer', // Page this setting is shown on (slug)
	2611	+ 'auth_settings_advanced' // Section this setting is shown on
2932	2612	);
2933	2613	}
2934	2614	}
2935	2615
		@@ -2935,30 +2615,29 @@
2935	2615
2936	2616
2937	2617	/**
2938	2618	* Set meaningful defaults for the plugin options.
2939		- *
2940	2619	* Note: This function is called on plugin activation.
2941	2620	*/
2942		- private function set_default_options() {
	2621	+ function set_default_options() {
2943	2622	global $wp_roles;
2944	2623
2945	2624	$auth_settings = get_option( 'auth_settings' );
2946		- if ( false === $auth_settings ) {
	2625	+ if ( $auth_settings === FALSE ) {
2947	2626	$auth_settings = array();
2948	2627	}
2949	2628
2950	2629	// Access Lists Defaults.
2951	2630	$auth_settings_access_users_pending = get_option( 'auth_settings_access_users_pending' );
2952		- if ( false === $auth_settings_access_users_pending ) {
	2631	+ if ( $auth_settings_access_users_pending === FALSE ) {
2953	2632	$auth_settings_access_users_pending = array();
2954	2633	}
2955	2634	$auth_settings_access_users_approved = get_option( 'auth_settings_access_users_approved' );
2956		- if ( false === $auth_settings_access_users_approved ) {
	2635	+ if ( $auth_settings_access_users_approved === FALSE ) {
2957	2636	$auth_settings_access_users_approved = array();
2958	2637	}
2959	2638	$auth_settings_access_users_blocked = get_option( 'auth_settings_access_users_blocked' );
2960		- if ( false === $auth_settings_access_users_blocked ) {
	2639	+ if ( $auth_settings_access_users_blocked === FALSE ) {
2961	2640	$auth_settings_access_users_blocked = array();
2962	2641	}
2963	2642
2964	2643	// Login Access Defaults.
		@@ -3010,12 +2689,13 @@
3010	2689	if ( ! array_key_exists( 'access_redirect_to_message', $auth_settings ) ) {
3011	2690	$auth_settings['access_redirect_to_message'] = '<p>' . __( 'Notice: You are browsing this site anonymously, and only have access to a portion of its content.', 'authorizer' ) . '</p>';
3012	2691	}
3013	2692
	2693	+
3014	2694	// External Service Defaults.
3015	2695	if ( ! array_key_exists( 'access_default_role', $auth_settings ) ) {
3016	2696	// Set default role to 'student' if that role exists, 'subscriber' otherwise.
3017		- $all_roles = $wp_roles->roles;
	2697	+ $all_roles = $wp_roles->roles;
3018	2698	$editable_roles = apply_filters( 'editable_roles', $all_roles );
3019	2699	if ( array_key_exists( 'student', $editable_roles ) ) {
3020	2700	$auth_settings['access_default_role'] = 'student';
3021	2701	} else {
		@@ -3113,12 +2793,12 @@
3113	2793
3114	2794	// Advanced defaults.
3115	2795	if ( ! array_key_exists( 'advanced_lockouts', $auth_settings ) ) {
3116	2796	$auth_settings['advanced_lockouts'] = array(
3117		- 'attempts_1' => 10,
3118		- 'duration_1' => 1,
3119		- 'attempts_2' => 10,
3120		- 'duration_2' => 10,
	2797	+ 'attempts_1' => 10,
	2798	+ 'duration_1' => 1,
	2799	+ 'attempts_2' => 10,
	2800	+ 'duration_2' => 10,
3121	2801	'reset_duration' => 120,
3122	2802	);
3123	2803	}
3124	2804	if ( ! array_key_exists( 'advanced_hide_wp_login', $auth_settings ) ) {
		@@ -3132,20 +2812,8 @@
3132	2812	}
3133	2813	if ( ! array_key_exists( 'advanced_usermeta', $auth_settings ) ) {
3134	2814	$auth_settings['advanced_usermeta'] = '';
3135	2815	}
3136		- if ( ! array_key_exists( 'advanced_users_per_page', $auth_settings ) ) {
3137		- $auth_settings['advanced_users_per_page'] = 20;
3138		- }
3139		- if ( ! array_key_exists( 'advanced_users_sort_by', $auth_settings ) ) {
3140		- $auth_settings['advanced_users_sort_by'] = 'created';
3141		- }
3142		- if ( ! array_key_exists( 'advanced_users_sort_order', $auth_settings ) ) {
3143		- $auth_settings['advanced_users_sort_order'] = 'asc';
3144		- }
3145		- if ( ! array_key_exists( 'advanced_widget_enabled', $auth_settings ) ) {
3146		- $auth_settings['advanced_widget_enabled'] = '1';
3147		- }
3148	2816	if ( ! array_key_exists( 'advanced_override_multisite', $auth_settings ) ) {
3149	2817	$auth_settings['advanced_override_multisite'] = '';
3150	2818	}
3151	2819
		@@ -3156,11 +2824,11 @@
3156	2824	update_option( 'auth_settings_access_users_blocked', $auth_settings_access_users_blocked );
3157	2825
3158	2826	// Multisite defaults.
3159	2827	if ( is_multisite() ) {
3160		- $auth_multisite_settings = get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings', array() );
	2828	+ $auth_multisite_settings = get_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings', array() );
3161	2829
3162		- if ( false === $auth_multisite_settings ) {
	2830	+ if ( $auth_multisite_settings === FALSE ) {
3163	2831	$auth_multisite_settings = array();
3164	2832	}
3165	2833	// Global switch for enabling multisite options.
3166	2834	if ( ! array_key_exists( 'multisite_override', $auth_multisite_settings ) ) {
		@@ -3166,10 +2834,10 @@
3166	2834	if ( ! array_key_exists( 'multisite_override', $auth_multisite_settings ) ) {
3167	2835	$auth_multisite_settings['multisite_override'] = '';
3168	2836	}
3169	2837	// Access Lists Defaults.
3170		- $auth_multisite_settings_access_users_approved = get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved' );
3171		- if ( false === $auth_multisite_settings_access_users_approved ) {
	2838	+ $auth_multisite_settings_access_users_approved = get_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved' );
	2839	+ if ( $auth_multisite_settings_access_users_approved === FALSE ) {
3172	2840	$auth_multisite_settings_access_users_approved = array();
3173	2841	}
3174	2842	// Login Access Defaults.
3175	2843	if ( ! array_key_exists( 'access_who_can_login', $auth_multisite_settings ) ) {
		@@ -3181,9 +2849,9 @@
3181	2849	}
3182	2850	// External Service Defaults.
3183	2851	if ( ! array_key_exists( 'access_default_role', $auth_multisite_settings ) ) {
3184	2852	// Set default role to 'student' if that role exists, 'subscriber' otherwise.
3185		- $all_roles = $wp_roles->roles;
	2853	+ $all_roles = $wp_roles->roles;
3186	2854	$editable_roles = apply_filters( 'editable_roles', $all_roles );
3187	2855	if ( array_key_exists( 'student', $editable_roles ) ) {
3188	2856	$auth_multisite_settings['access_default_role'] = 'student';
3189	2857	} else {
		@@ -3276,12 +2944,12 @@
3276	2944	}
3277	2945	// Advanced defaults.
3278	2946	if ( ! array_key_exists( 'advanced_lockouts', $auth_multisite_settings ) ) {
3279	2947	$auth_multisite_settings['advanced_lockouts'] = array(
3280		- 'attempts_1' => 10,
3281		- 'duration_1' => 1,
3282		- 'attempts_2' => 10,
3283		- 'duration_2' => 10,
	2948	+ 'attempts_1' => 10,
	2949	+ 'duration_1' => 1,
	2950	+ 'attempts_2' => 10,
	2951	+ 'duration_2' => 10,
3284	2952	'reset_duration' => 120,
3285	2953	);
3286	2954	}
3287	2955	if ( ! array_key_exists( 'advanced_hide_wp_login', $auth_multisite_settings ) ) {
		@@ -3286,23 +2954,11 @@
3286	2954	}
3287	2955	if ( ! array_key_exists( 'advanced_hide_wp_login', $auth_multisite_settings ) ) {
3288	2956	$auth_multisite_settings['advanced_hide_wp_login'] = '';
3289	2957	}
3290		- if ( ! array_key_exists( 'advanced_users_per_page', $auth_multisite_settings ) ) {
3291		- $auth_multisite_settings['advanced_users_per_page'] = 20;
3292		- }
3293		- if ( ! array_key_exists( 'advanced_users_sort_by', $auth_multisite_settings ) ) {
3294		- $auth_multisite_settings['advanced_users_sort_by'] = 'created';
3295		- }
3296		- if ( ! array_key_exists( 'advanced_users_sort_order', $auth_multisite_settings ) ) {
3297		- $auth_multisite_settings['advanced_users_sort_order'] = 'asc';
3298		- }
3299		- if ( ! array_key_exists( 'advanced_widget_enabled', $auth_multisite_settings ) ) {
3300		- $auth_multisite_settings['advanced_widget_enabled'] = '1';
3301		- }
3302	2958	// Save default network options to database.
3303		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings', $auth_multisite_settings );
3304		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
	2959	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings', $auth_multisite_settings );
	2960	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
3305	2961	}
3306	2962
3307	2963	return $auth_settings;
3308	2964	}
		@@ -3309,15 +2965,12 @@
3309	2965
3310	2966
3311	2967	/**
3312	2968	* List sanitizer.
3313		- *
3314		- * @param array $list Array of users to sanitize.
3315		- * @param string $side_effect Set to 'update roles' if role syncing should be performed.
3316		- * @param string $multisite_mode Set to 'multisite' to sync roles on all sites the user belongs to.
3317		- * @return array Array of sanitized users.
	2969	+ * $side_effect = 'none' or 'update roles' to make sure WP user roles match
	2970	+ * $multisite_mode = 'single' or 'multisite' to indicate which user roles to change (this site or all sites)
3318	2971	*/
3319		- private function sanitize_user_list( $list, $side_effect = 'none', $multisite_mode = 'single' ) {
	2972	+ function sanitize_user_list( $list, $side_effect = 'none', $multisite_mode = 'single' ) {
3320	2973	// If it's not a list, make it so.
3321	2974	if ( ! is_array( $list ) ) {
3322	2975	$list = array();
3323	2976	}
		@@ -3322,16 +2975,16 @@
3322	2975	$list = array();
3323	2976	}
3324	2977	foreach ( $list as $key => $user_info ) {
3325	2978	if ( strlen( $user_info['email'] ) < 1 ) {
3326		- // Make sure there are no empty entries in the list.
3327		- unset( $list[ $key ] );
3328		- } elseif ( 'update roles' === $side_effect ) {
	2979	+ // Make sure there are no empty entries in the list
	2980	+ unset( $list[$key] );
	2981	+ } elseif ( $side_effect === 'update roles' ) {
3329	2982	// Make sure the WordPress user accounts have the same role
3330	2983	// as that indicated in the list.
3331	2984	$wp_user = get_user_by( 'email', $user_info['email'] );
3332	2985	if ( $wp_user ) {
3333		- if ( is_multisite() && 'multisite' === $multisite_mode ) {
	2986	+ if ( is_multisite() && $multisite_mode === 'multisite' ) {
3334	2987	foreach ( get_blogs_of_user( $wp_user->ID ) as $blog ) {
3335	2988	add_user_to_blog( $blog->userblog_id, $wp_user->ID, $user_info['role'] );
3336	2989	}
3337	2990	} else {
		@@ -3344,21 +2997,18 @@
3344	2997	}
3345	2998
3346	2999
3347	3000	/**
3348		- * Settings sanitizer callback.
3349		- *
3350		- * @param array $auth_settings Authorizer settings array.
3351		- * @return array Sanitized Authorizer settings array.
	3001	+ * Settings sanitizer callback
3352	3002	*/
3353		- public function sanitize_options( $auth_settings ) {
	3003	+ function sanitize_options( $auth_settings ) {
3354	3004	// Default to "Approved Users" login access restriction.
3355		- if ( ! in_array( $auth_settings['access_who_can_login'], array( 'external_users', 'approved_users' ), true ) ) {
	3005	+ if ( ! in_array( $auth_settings['access_who_can_login'], array( 'external_users', 'approved_users' ) ) ) {
3356	3006	$auth_settings['access_who_can_login'] = 'approved_users';
3357	3007	}
3358	3008
3359	3009	// Default to "Everyone" view access restriction.
3360		- if ( ! in_array( $auth_settings['access_who_can_view'], array( 'everyone', 'logged_in_users' ), true ) ) {
	3010	+ if ( ! in_array( $auth_settings['access_who_can_view'], array( 'everyone', 'logged_in_users' ) ) ) {
3361	3011	$auth_settings['access_who_can_view'] = 'everyone';
3362	3012	}
3363	3013
3364	3014	// Default to WordPress login access redirect.
		@@ -3363,9 +3013,9 @@
3363	3013
3364	3014	// Default to WordPress login access redirect.
3365	3015	// Note: this option doesn't exist in multisite options, so we first
3366	3016	// check to see if it exists.
3367		- if ( array_key_exists( 'access_redirect', $auth_settings ) && ! in_array( $auth_settings['access_redirect'], array( 'login', 'page', 'message' ), true ) ) {
	3017	+ if ( array_key_exists( 'access_redirect', $auth_settings ) && ! in_array( $auth_settings['access_redirect'], array( 'login', 'page', 'message' ) ) ) {
3368	3018	$auth_settings['access_redirect'] = 'login';
3369	3019	}
3370	3020
3371	3021	// Default to warning message for anonymous users on public pages.
		@@ -3370,61 +3020,61 @@
3370	3020
3371	3021	// Default to warning message for anonymous users on public pages.
3372	3022	// Note: this option doesn't exist in multisite options, so we first
3373	3023	// check to see if it exists.
3374		- if ( array_key_exists( 'access_public_warning', $auth_settings ) && ! in_array( $auth_settings['access_public_warning'], array( 'no_warning', 'warning' ), true ) ) {
	3024	+ if ( array_key_exists( 'access_public_warning', $auth_settings ) && ! in_array( $auth_settings['access_public_warning'], array( 'no_warning', 'warning' ) ) ) {
3375	3025	$auth_settings['access_public_warning'] = 'no_warning';
3376	3026	}
3377	3027
3378		- // Sanitize Send welcome email (checkbox: value can only be '1' or empty string).
	3028	+ // Sanitize Send welcome email (checkbox: value can only be '1' or empty string)
3379	3029	$auth_settings['access_should_email_approved_users'] = array_key_exists( 'access_should_email_approved_users', $auth_settings ) && strlen( $auth_settings['access_should_email_approved_users'] ) > 0 ? '1' : '';
3380	3030
3381		- // Sanitize Enable Google Logins (checkbox: value can only be '1' or empty string).
	3031	+ // Sanitize Enable Google Logins (checkbox: value can only be '1' or empty string)
3382	3032	$auth_settings['google'] = array_key_exists( 'google', $auth_settings ) && strlen( $auth_settings['google'] ) > 0 ? '1' : '';
3383	3033
3384		- // Sanitize Enable CAS Logins (checkbox: value can only be '1' or empty string).
	3034	+ // Sanitize Enable CAS Logins (checkbox: value can only be '1' or empty string)
3385	3035	$auth_settings['cas'] = array_key_exists( 'cas', $auth_settings ) && strlen( $auth_settings['cas'] ) > 0 ? '1' : '';
3386	3036
3387		- // Sanitize CAS Host setting.
	3037	+ // Sanitize CAS Host setting
3388	3038	$auth_settings['cas_host'] = filter_var( $auth_settings['cas_host'], FILTER_SANITIZE_URL );
3389	3039
3390		- // Sanitize CAS Port (int).
	3040	+ // Sanitize CAS Port (int)
3391	3041	$auth_settings['cas_port'] = filter_var( $auth_settings['cas_port'], FILTER_SANITIZE_NUMBER_INT );
3392	3042
3393		- // Sanitize CAS attribute update (checkbox: value can only be '1' or empty string).
	3043	+ // Sanitize CAS attribute update (checkbox: value can only be '1' or empty string)
3394	3044	$auth_settings['cas_attr_update_on_login'] = array_key_exists( 'cas_attr_update_on_login', $auth_settings ) && strlen( $auth_settings['cas_attr_update_on_login'] ) > 0 ? '1' : '';
3395	3045
3396		- // Sanitize CAS auto-login (checkbox: value can only be '1' or empty string).
	3046	+ // Sanitize CAS auto-login (checkbox: value can only be '1' or empty string)
3397	3047	$auth_settings['cas_auto_login'] = array_key_exists( 'cas_auto_login', $auth_settings ) && strlen( $auth_settings['cas_auto_login'] ) > 0 ? '1' : '';
3398	3048
3399		- // Sanitize Enable LDAP Logins (checkbox: value can only be '1' or empty string).
	3049	+ // Sanitize Enable LDAP Logins (checkbox: value can only be '1' or empty string)
3400	3050	$auth_settings['ldap'] = array_key_exists( 'ldap', $auth_settings ) && strlen( $auth_settings['ldap'] ) > 0 ? '1' : '';
3401	3051
3402		- // Sanitize LDAP Host setting.
	3052	+ // Sanitize LDAP Host setting
3403	3053	$auth_settings['ldap_host'] = filter_var( $auth_settings['ldap_host'], FILTER_SANITIZE_URL );
3404	3054
3405		- // Sanitize LDAP Port (int).
	3055	+ // Sanitize LDAP Port (int)
3406	3056	$auth_settings['ldap_port'] = filter_var( $auth_settings['ldap_port'], FILTER_SANITIZE_NUMBER_INT );
3407	3057
3408		- // Sanitize LDAP TLS (checkbox: value can only be '1' or empty string).
	3058	+ // Sanitize LDAP TLS (checkbox: value can only be '1' or empty string)
3409	3059	$auth_settings['ldap_tls'] = array_key_exists( 'ldap_tls', $auth_settings ) && strlen( $auth_settings['ldap_tls'] ) > 0 ? '1' : '';
3410	3060
3411		- // Sanitize LDAP attributes (basically make sure they don't have any parentheses).
	3061	+ // Sanitize LDAP attributes (basically make sure they don't have any parentheses)
3412	3062	$auth_settings['ldap_uid'] = filter_var( $auth_settings['ldap_uid'], FILTER_SANITIZE_EMAIL );
3413	3063
3414		- // Sanitize LDAP Lost Password URL.
	3064	+ // Sanitize LDAP Lost Password URL
3415	3065	$auth_settings['ldap_lostpassword_url'] = filter_var( $auth_settings['ldap_lostpassword_url'], FILTER_SANITIZE_URL );
3416	3066
3417		- // Obfuscate LDAP directory user password.
	3067	+ // Obfuscate LDAP directory user password
3418	3068	if ( strlen( $auth_settings['ldap_password'] ) > 0 ) {
3419	3069	// encrypt the directory user password for some minor obfuscation in the database.
3420	3070	$auth_settings['ldap_password'] = $this->encrypt( $auth_settings['ldap_password'] );
3421	3071	}
3422	3072
3423		- // Sanitize LDAP attribute update (checkbox: value can only be '1' or empty string).
	3073	+ // Sanitize LDAP attribute update (checkbox: value can only be '1' or empty string)
3424	3074	$auth_settings['ldap_attr_update_on_login'] = array_key_exists( 'ldap_attr_update_on_login', $auth_settings ) && strlen( $auth_settings['ldap_attr_update_on_login'] ) > 0 ? '1' : '';
3425	3075
3426		- // Make sure public pages is an empty array if it's empty.
	3076	+ // Make sure public pages is an empty array if it's empty
3427	3077	// Note: this option doesn't exist in multisite options, so we first
3428	3078	// check to see if it exists.
3429	3079	if ( array_key_exists( 'access_public_pages', $auth_settings ) && ! is_array( $auth_settings['access_public_pages'] ) ) {
3430	3080	$auth_settings['access_public_pages'] = array();
		@@ -3432,31 +3082,15 @@
3432	3082
3433	3083	// Make sure all lockout options are integers (attempts_1,
3434	3084	// duration_1, attempts_2, duration_2, reset_duration).
3435	3085	foreach ( $auth_settings['advanced_lockouts'] as $key => $value ) {
3436		- $auth_settings['advanced_lockouts'][ $key ] = filter_var( $value, FILTER_SANITIZE_NUMBER_INT );
	3086	+ $auth_settings['advanced_lockouts'][$key] = filter_var( $value, FILTER_SANITIZE_NUMBER_INT );
3437	3087	}
3438	3088
3439		- // Sanitize Hide WordPress logins (checkbox: value can only be '1' or empty string).
	3089	+ // Sanitize Hide WordPress logins (checkbox: value can only be '1' or empty string)
3440	3090	$auth_settings['advanced_hide_wp_login'] = array_key_exists( 'advanced_hide_wp_login', $auth_settings ) && strlen( $auth_settings['advanced_hide_wp_login'] ) > 0 ? '1' : '';
3441	3091
3442		- // Sanitize Users per page (text: value can only int from 1 to MAX_INT).
3443		- $auth_settings['advanced_users_per_page'] = array_key_exists( 'advanced_users_per_page', $auth_settings ) && intval( $auth_settings['advanced_users_per_page'] ) > 0 ? intval( $auth_settings['advanced_users_per_page'] ) : 1;
3444		-
3445		- // Sanitize Sort users by (select: value can be 'email', 'role', 'date_added', 'created').
3446		- if ( ! isset( $auth_settings['advanced_users_sort_by'] ) || ! in_array( $auth_settings['advanced_users_sort_by'], array( 'email', 'role', 'date_added', 'created' ), true ) ) {
3447		- $auth_settings['advanced_users_sort_by'] = 'created';
3448		- }
3449		-
3450		- // Sanitize Sort users order (select: value can be 'asc', 'desc').
3451		- if ( ! isset( $auth_settings['advanced_users_sort_order'] ) || ! in_array( $auth_settings['advanced_users_sort_order'], array( 'asc', 'desc' ), true ) ) {
3452		- $auth_settings['advanced_users_sort_order'] = 'asc';
3453		- }
3454		-
3455		- // Sanitize Show Dashboard Widget (checkbox: value can only be '1' or empty string).
3456		- $auth_settings['advanced_widget_enabled'] = array_key_exists( 'advanced_widget_enabled', $auth_settings ) && strlen( $auth_settings['advanced_widget_enabled'] ) > 0 ? '1' : '';
3457		-
3458		- // Sanitize Override multisite options (checkbox: value can only be '1' or empty string).
	3092	+ // Sanitize Override multisite options (checkbox: value can only be '1' or empty string)
3459	3093	$auth_settings['advanced_override_multisite'] = array_key_exists( 'advanced_override_multisite', $auth_settings ) && strlen( $auth_settings['advanced_override_multisite'] ) > 0 ? '1' : '';
3460	3094
3461	3095	return $auth_settings;
3462	3096	}
		@@ -3463,201 +3097,90 @@
3463	3097
3464	3098
3465	3099	/**
3466	3100	* Keep authorizer approved users' roles in sync with WordPress roles
3467		- * if someone changes the role via the WordPress Edit User page
3468		- * (wp-admin/user-edit.php or wp-admin/profile.php).
	3101	+ * if someone changes the role via the WordPress Edit User options page.
3469	3102	*
3470		- * Action: user_profile_update_errors
3471		- *
3472		- * @param WP_Error $errors Errors object to add any custom errors to (passed by reference).
3473		- * @param bool $update True if updating existing user, false if saving a new one.
3474		- * @param stdClass $user Updated WP_User object for user being edited (passed by reference).
	3103	+ * @action edit_user_profile_update
	3104	+ * @ref https://codex.wordpress.org/Plugin_API/Action_Reference/edit_user_profile_update
	3105	+ * @param int $user_id The user ID of the user being edited
	3106	+
	3107	+ * @action personal_options_update
	3108	+ * @ref https://codex.wordpress.org/Plugin_API/Action_Reference/personal_options_update
	3109	+ * @param int $user_id The user ID of the user being edited
3475	3110	*/
3476		- public function edit_user_profile_update_role( &$errors, $update, &$user ) {
3477		- // Do nothing if we're not updating role.
3478		- if ( ! property_exists( $user, 'role' ) ) {
	3111	+ function edit_user_profile_update_role( $user_id ) {
	3112	+ if ( ! current_user_can( 'edit_user', $user_id ) ) {
3479	3113	return;
3480	3114	}
3481	3115
3482		- // Safety check; will likely not fire if we reach this function.
3483		- if ( ! current_user_can( 'edit_user', $user->ID ) ) {
3484		- return;
3485		- }
3486		-
3487		- // Don't perform Authorizer updates if we have a WordPress error.
3488		- $errors_on_user_update = $errors->get_error_codes();
3489		- if ( ! empty( $errors_on_user_update ) ) {
3490		- return;
3491		- }
3492		-
3493		- // Get original user object (fail if not a real WordPress user).
3494		- $userdata = get_userdata( $user->ID );
3495		- if ( ! $userdata ) {
3496		- return;
3497		- }
3498		-
3499	3116	// If user is in approved list, update his/her associated role.
3500		- if ( $this->is_email_in_list( $userdata->user_email, 'approved' ) ) {
3501		- $auth_settings_access_users_approved = $this->sanitize_user_list( $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT ) );
3502		- foreach ( $auth_settings_access_users_approved as $key => $check_user ) {
3503		- if ( 0 === strcasecmp( $check_user['email'], $userdata->user_email ) ) {
3504		- $auth_settings_access_users_approved[ $key ]['role'] = $user->role;
3505		- }
3506		- }
3507		- update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved );
3508		- }
3509		- }
3510		-
3511		-
3512		- /**
3513		- * Sync any email address changes to WordPress accounts to the corresponding
3514		- * entry in the Authorizer approved list.
3515		- *
3516		- * Note: This filter fires in wp_update_user() if the update includes an
3517		- * email address change, and fires after all security and integrity checks
3518		- * have been performed, so we can simply update the Authorizer approved
3519		- * list, changing the email address on the approved entry, and removing any
3520		- * existing entries that also have the new email address (duplicates).
3521		- *
3522		- * Filter: send_email_change_email
3523		- *
3524		- * @param bool $send Whether to send the email.
3525		- * @param array $user The original user array.
3526		- * @param array $userdata The updated user array.
3527		- */
3528		- public function edit_user_profile_update_email( $send, $user, $userdata ) {
3529		- // If we're in multisite, update the email on all sites in the network
3530		- // (and remove from any subsites if it's a network-approved user).
3531		- if ( is_multisite() ) {
3532		- // If it's a multisite approved user, sync the email there.
3533		- $changed_user_is_multisite_user = false;
3534		- if ( $this->is_email_in_list( $user['user_email'], 'approved', 'multisite' ) ) {
3535		- $changed_user_is_multisite_user = true;
3536		- $auth_multisite_settings_access_users_approved = $this->sanitize_user_list(
3537		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT )
3538		- );
3539		- foreach ( $auth_multisite_settings_access_users_approved as $key => $check_user ) {
3540		- // Update old user email in approved list to the new email.
3541		- if ( 0 === strcasecmp( $check_user['email'], $user['user_email'] ) ) {
3542		- $auth_multisite_settings_access_users_approved[ $key ]['email'] = $this->lowercase( $userdata['user_email'] );
	3117	+ $wp_user = get_user_by( 'id', $user_id );
	3118	+ if ( $this->is_email_in_list( $wp_user->get( 'user_email' ), 'approved' ) ) {
	3119	+ $auth_settings_access_users_approved = $this->sanitize_user_list( $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN ) );
	3120	+ // Find approved user and sync with the corresponding WP_User.
	3121	+ foreach ( $auth_settings_access_users_approved as $key => $user ) {
	3122	+ if ( $user['email'] === $wp_user->user_email ) {
	3123	+ // Sync user role.
	3124	+ if ( array_key_exists( 'role', $_REQUEST ) ) {
	3125	+ $auth_settings_access_users_approved[$key]['role'] = $_REQUEST['role'];
3543	3126	}
3544		- // If new user email is already in approved list, remove that entry.
3545		- if ( 0 === strcasecmp( $check_user['email'], $userdata['user_email'] ) ) {
3546		- unset( $auth_multisite_settings_access_users_approved[ $key ] );
	3127	+ // Sync email address.
	3128	+ if ( array_key_exists( 'email', $_REQUEST ) ) {
	3129	+ $auth_settings_access_users_approved[$key]['email'] = $_REQUEST['email'];
3547	3130	}
3548	3131	}
3549		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
3550	3132	}
3551	3133
3552		- // Go through all approved lists on individual sites and sync this user there.
3553		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
3554		- $sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
3555		- foreach ( $sites as $site ) {
3556		- $updated = false;
3557		- $blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
3558		- $auth_settings_access_users_approved = get_blog_option( $blog_id, 'auth_settings_access_users_approved', array() );
3559		- foreach ( $auth_settings_access_users_approved as $key => $check_user ) {
3560		- // Update old user email in approved list to the new email.
3561		- if ( 0 === strcasecmp( $check_user['email'], $user['user_email'] ) ) {
3562		- // But if the user is already a multisite user, just remove the entry in the subsite.
3563		- if ( $changed_user_is_multisite_user ) {
3564		- unset( $auth_settings_access_users_approved[ $key ] );
3565		- } else {
3566		- $auth_settings_access_users_approved[ $key ]['email'] = $this->lowercase( $userdata['user_email'] );
3567		- }
3568		- $updated = true;
3569		- }
3570		- // If new user email is already in approved list, remove that entry.
3571		- if ( 0 === strcasecmp( $check_user['email'], $userdata['user_email'] ) ) {
3572		- unset( $auth_settings_access_users_approved[ $key ] );
3573		- $updated = true;
3574		- }
3575		- }
3576		- if ( $updated ) {
3577		- update_blog_option( $blog_id, 'auth_settings_access_users_approved', $auth_settings_access_users_approved );
3578		- }
3579		- }
3580		- } else {
3581		- // In a single site environment, just find the old user in the approved list and update the email.
3582		- if ( $this->is_email_in_list( $user['user_email'], 'approved' ) ) {
3583		- $auth_settings_access_users_approved = $this->sanitize_user_list( $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT ) );
3584		- foreach ( $auth_settings_access_users_approved as $key => $check_user ) {
3585		- // Update old user email in approved list to the new email.
3586		- if ( 0 === strcasecmp( $check_user['email'], $user['user_email'] ) ) {
3587		- $auth_settings_access_users_approved[ $key ]['email'] = $this->lowercase( $userdata['user_email'] );
3588		- }
3589		- // If new user email is already in approved list, remove that entry.
3590		- if ( 0 === strcasecmp( $check_user['email'], $userdata['user_email'] ) ) {
3591		- unset( $auth_settings_access_users_approved[ $key ] );
3592		- }
3593		- }
3594		- update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved );
3595		- }
	3134	+ update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved );
3596	3135	}
3597		-
3598		- // We're hooking into this filter merely for its location in the codebase,
3599		- // so make sure to return the filter value unmodified.
3600		- return $send;
3601	3136	}
3602	3137
3603	3138
3604	3139	/**
3605		- * Settings print callback.
3606		- *
3607		- * @param string $args Args (e.g., multisite admin mode).
3608		- * @return void
	3140	+ * Settings print callbacks
3609	3141	*/
3610		- public function print_section_info_tabs( $args = '' ) {
3611		- if ( WP_Plugin_Authorizer::NETWORK_CONTEXT === $this->get_admin_mode( $args ) ) :
3612		- ?>
	3142	+ function print_section_info_tabs( $args = '' ) {
	3143	+ if ( MULTISITE_ADMIN === $this->get_admin_mode( $args )): ?>
3613	3144	<h2 class="nav-tab-wrapper">
3614		- <a class="nav-tab nav-tab-access_lists nav-tab-active" href="javascript:chooseTab('access_lists' );"><?php esc_html_e( 'Access Lists', 'authorizer' ); ?></a>
3615		- <a class="nav-tab nav-tab-external" href="javascript:chooseTab('external' );"><?php esc_html_e( 'External Service', 'authorizer' ); ?></a>
3616		- <a class="nav-tab nav-tab-advanced" href="javascript:chooseTab('advanced' );"><?php esc_html_e( 'Advanced', 'authorizer' ); ?></a>
	3145	+ <a class="nav-tab nav-tab-access_lists nav-tab-active" href="javascript:choose_tab('access_lists' );"><?php _e( 'Access Lists', 'authorizer' ); ?></a>
	3146	+ <a class="nav-tab nav-tab-external" href="javascript:choose_tab('external' );"><?php _e( 'External Service', 'authorizer' ); ?></a>
	3147	+ <a class="nav-tab nav-tab-advanced" href="javascript:choose_tab('advanced' );"><?php _e( 'Advanced', 'authorizer' ); ?></a>
3617	3148	</h2>
3618		- <?php else : ?>
	3149	+ <?php else: ?>
3619	3150	<h2 class="nav-tab-wrapper">
3620		- <a class="nav-tab nav-tab-access_lists nav-tab-active" href="javascript:chooseTab('access_lists' );"><?php esc_html_e( 'Access Lists', 'authorizer' ); ?></a>
3621		- <a class="nav-tab nav-tab-access_login" href="javascript:chooseTab('access_login' );"><?php esc_html_e( 'Login Access', 'authorizer' ); ?></a>
3622		- <a class="nav-tab nav-tab-access_public" href="javascript:chooseTab('access_public' );"><?php esc_html_e( 'Public Access', 'authorizer' ); ?></a>
3623		- <a class="nav-tab nav-tab-external" href="javascript:chooseTab('external' );"><?php esc_html_e( 'External Service', 'authorizer' ); ?></a>
3624		- <a class="nav-tab nav-tab-advanced" href="javascript:chooseTab('advanced' );"><?php esc_html_e( 'Advanced', 'authorizer' ); ?></a>
	3151	+ <a class="nav-tab nav-tab-access_lists nav-tab-active" href="javascript:choose_tab('access_lists' );"><?php _e( 'Access Lists', 'authorizer' ); ?></a>
	3152	+ <a class="nav-tab nav-tab-access_login" href="javascript:choose_tab('access_login' );"><?php _e( 'Login Access', 'authorizer' ); ?></a>
	3153	+ <a class="nav-tab nav-tab-access_public" href="javascript:choose_tab('access_public' );"><?php _e( 'Public Access', 'authorizer' ); ?></a>
	3154	+ <a class="nav-tab nav-tab-external" href="javascript:choose_tab('external' );"><?php _e( 'External Service', 'authorizer' ); ?></a>
	3155	+ <a class="nav-tab nav-tab-advanced" href="javascript:choose_tab('advanced' );"><?php _e( 'Advanced', 'authorizer' ); ?></a>
3625	3156	</h2>
3626		- <?php
3627		- endif;
	3157	+ <?php endif;
3628	3158	}
3629	3159
3630	3160
3631		- /**
3632		- * Settings print callback.
3633		- *
3634		- * @param string $args Args (e.g., multisite admin mode).
3635		- * @return void
3636		- */
3637		- public function print_section_info_access_lists( $args = '' ) {
	3161	+ function print_section_info_access_lists( $args = '' ) {
3638	3162	$admin_mode = $this->get_admin_mode( $args );
3639		- ?>
3640		- <div id="section_info_access_lists" class="section_info">
3641		- <p><?php esc_html_e( 'Manage who has access to this site using these lists.', 'authorizer' ); ?></p>
	3163	+ ?><div id="section_info_access_lists" class="section_info">
	3164	+ <p><?php _e( 'Manage who has access to this site using these lists.', 'authorizer' ); ?></p>
3642	3165	<ol>
3643		- <li><?php echo wp_kses( __( "<strong>Pending</strong> users are users who have successfully logged in to the site, but who haven't yet been approved (or blocked) by you.", 'authorizer' ), $this->allowed_html ); ?></li>
3644		- <li><?php echo wp_kses( __( '<strong>Approved</strong> users have access to the site once they successfully log in.', 'authorizer' ), $this->allowed_html ); ?></li>
3645		- <li><?php echo wp_kses( __( '<strong>Blocked</strong> users will receive an error message when they try to visit the site after authenticating.', 'authorizer' ), $this->allowed_html ); ?></li>
	3166	+ <li><?php _e( "<strong>Pending</strong> users are users who have successfully logged in to the site, but who haven't yet been approved (or blocked) by you.", 'authorizer' ); ?></li>
	3167	+ <li><?php _e( '<strong>Approved</strong> users have access to the site once they successfully log in.', 'authorizer' ); ?></li>
	3168	+ <li><?php _e( '<strong>Blocked</strong> users will receive an error message when they try to visit the site after authenticating.', 'authorizer' ); ?></li>
3646	3169	</ol>
3647	3170	</div>
3648	3171	<table class="form-table">
3649	3172	<tbody>
3650	3173	<tr>
3651		- <th scope="row"><?php esc_html_e( 'Pending Users', 'authorizer' ); ?> <em>(<?php echo esc_html( $this->get_user_count_from_list( 'pending', $admin_mode ) ); ?>)</em></th>
	3174	+ <th scope="row"><?php _e( 'Pending Users', 'authorizer' ); ?> <em>(<?php echo $this->get_user_count_from_list( 'pending', $admin_mode ); ?>)</em></th>
3652	3175	<td><?php $this->print_combo_auth_access_users_pending(); ?></td>
3653	3176	</tr>
3654	3177	<tr>
3655		- <th scope="row"><?php esc_html_e( 'Approved Users', 'authorizer' ); ?> <em>(<?php echo esc_html( $this->get_user_count_from_list( 'approved', $admin_mode ) ); ?>)</em></th>
	3178	+ <th scope="row"><?php _e( 'Approved Users', 'authorizer' ); ?> <em>(<?php echo $this->get_user_count_from_list( 'approved', $admin_mode ); ?>)</em></th>
3656	3179	<td><?php $this->print_combo_auth_access_users_approved(); ?></td>
3657	3180	</tr>
3658	3181	<tr>
3659		- <th scope="row"><?php esc_html_e( 'Blocked Users', 'authorizer' ); ?> <em>(<?php echo esc_html( $this->get_user_count_from_list( 'blocked', $admin_mode ) ); ?>)</em></th>
	3182	+ <th scope="row"><?php _e( 'Blocked Users', 'authorizer' ); ?> <em>(<?php echo $this->get_user_count_from_list( 'blocked', $admin_mode ); ?>)</em></th>
3660	3183	<td><?php $this->print_combo_auth_access_users_blocked(); ?></td>
3661	3184	</tr>
3662	3185	</tbody>
3663	3186	</table>
		@@ -3664,516 +3187,276 @@
3664	3187	<?php
3665	3188	}
3666	3189
3667	3190
3668		- /**
3669		- * Settings print callback.
3670		- *
3671		- * @param string $args Args (e.g., multisite admin mode).
3672		- * @return void
3673		- */
3674		- public function print_combo_auth_access_users_pending( $args = '' ) {
	3191	+ function print_combo_auth_access_users_pending( $args = '' ) {
3675	3192	// Get plugin option.
3676		- $option = 'access_users_pending';
	3193	+ $option = 'access_users_pending';
3677	3194	$auth_settings_option = $this->get_plugin_option( $option );
3678	3195	$auth_settings_option = is_array( $auth_settings_option ) ? $auth_settings_option : array();
3679	3196
3680		- // Render wrapper div (for aligning pager to width of content).
3681		- ?>
3682		- <div class="wrapper_<?php echo esc_attr( $option ); ?>">
3683		- <ul id="list_auth_settings_access_users_pending" style="margin:0;">
3684		- <?php
3685		- if ( count( $auth_settings_option ) > 0 ) :
3686		- foreach ( $auth_settings_option as $key => $pending_user ) :
3687		- if ( empty( $pending_user ) || count( $pending_user ) < 1 ) :
3688		- continue;
3689		- endif;
3690		- $pending_user['is_wp_user'] = false;
3691		- ?>
3692		- <li>
3693		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>_<?php echo esc_attr( $key ); ?>" value="<?php echo esc_attr( $pending_user['email'] ); ?>" readonly="true" class="auth-email" />
3694		- <select id="auth_settings_<?php echo esc_attr( $option ); ?>_<?php echo esc_attr( $key ); ?>_role" class="auth-role">
3695		- <?php $this->wp_dropdown_permitted_roles( $pending_user['role'] ); ?>
3696		- </select>
3697		- <a href="javascript:void(0);" class="button-primary" id="approve_user_<?php echo esc_attr( $key ); ?>" onclick="authAddUser( this, 'approved', false ); authIgnoreUser( this, 'pending' );"><span class="glyphicon glyphicon-ok"></span> <?php esc_html_e( 'Approve', 'authorizer' ); ?></a>
3698		- <a href="javascript:void(0);" class="button-primary" id="block_user_<?php echo esc_attr( $key ); ?>" onclick="authAddUser( this, 'blocked', false ); authIgnoreUser( this, 'pending' );"><span class="glyphicon glyphicon-ban-circle"></span> <?php esc_html_e( 'Block', 'authorizer' ); ?></a>
3699		- <a href="javascript:void(0);" class="button button-secondary" id="ignore_user_<?php echo esc_attr( $key ); ?>" onclick="authIgnoreUser( this, 'pending' );" title="<?php esc_html_e( 'Remove user', 'authorizer' ); ?>"><span class="glyphicon glyphicon-remove"></span> <?php esc_html_e( 'Ignore', 'authorizer' ); ?></a>
3700		- </li>
3701		- <?php endforeach; ?>
3702		- <?php else : ?>
3703		- <li class="auth-empty"><em><?php esc_html_e( 'No pending users', 'authorizer' ); ?></em></li>
3704		- <?php endif; ?>
3705		- </ul>
3706		- </div>
	3197	+ // Print option elements.
	3198	+ ?><ul id="list_auth_settings_access_users_pending" style="margin:0;">
	3199	+ <?php if ( count( $auth_settings_option ) > 0 ) : ?>
	3200	+ <?php foreach ( $auth_settings_option as $key => $pending_user ): ?>
	3201	+ <?php if ( empty( $pending_user ) || count( $pending_user ) < 1 ) continue; ?>
	3202	+ <?php $pending_user['is_wp_user'] = false; ?>
	3203	+ <li>
	3204	+ <input type="text" id="auth_settings_<?php echo $option; ?>_<?php echo $key; ?>" value="<?php echo $pending_user['email']; ?>" readonly="true" class="auth-email" />
	3205	+ <select id="auth_settings_<?php echo $option; ?>_<?php echo $key; ?>_role" class="auth-role">
	3206	+ <?php $this->wp_dropdown_permitted_roles( $pending_user['role'] ); ?>
	3207	+ </select>
	3208	+ <a href="javascript:void(0);" class="button-primary" id="approve_user_<?php echo $key; ?>" onclick="auth_add_user( this, 'approved', false ); auth_ignore_user( this, 'pending' );"><span class="glyphicon glyphicon-ok"></span> <?php _e( 'Approve', 'authorizer' ); ?></a>
	3209	+ <a href="javascript:void(0);" class="button-primary" id="block_user_<?php echo $key; ?>" onclick="auth_add_user( this, 'blocked', false ); auth_ignore_user( this, 'pending' );"><span class="glyphicon glyphicon-ban-circle"></span> <?php _e( 'Block', 'authorizer' ); ?></a>
	3210	+ <a href="javascript:void(0);" class="button button-secondary" id="ignore_user_<?php echo $key; ?>" onclick="auth_ignore_user( this, 'pending' );" title="<?php _e( 'Remove user', 'authorizer' ); ?>"><span class="glyphicon glyphicon-remove"></span> <?php _e( 'Ignore', 'authorizer' ); ?></a>
	3211	+ </li>
	3212	+ <?php endforeach; ?>
	3213	+ <?php else: ?>
	3214	+ <li class="auth-empty"><em><?php _e( 'No pending users', 'authorizer' ); ?></em></li>
	3215	+ <?php endif; ?>
	3216	+ </ul>
3707	3217	<?php
3708	3218	}
3709	3219
3710	3220
3711		- /**
3712		- * Settings print callback.
3713		- *
3714		- * @param string $args Args (e.g., multisite admin mode).
3715		- * @return void
3716		- */
3717		- public function print_combo_auth_access_users_approved( $args = '' ) {
	3221	+ function print_combo_auth_access_users_approved( $args = '' ) {
3718	3222	// Get plugin option.
3719		- $option = 'access_users_approved';
3720		- $admin_mode = $this->get_admin_mode( $args );
	3223	+ $option = 'access_users_approved';
	3224	+ $admin_mode = $this->get_admin_mode( $args );
3721	3225	$auth_settings_option = $this->get_plugin_option( $option, $admin_mode, 'no override' );
3722	3226	$auth_settings_option = is_array( $auth_settings_option ) ? $auth_settings_option : array();
3723	3227
3724		- // Get multisite approved users (will be added to top of list, greyed out).
3725		- $auth_override_multisite = $this->get_plugin_option( 'advanced_override_multisite' );
3726		- $auth_multisite_settings = $this->get_plugin_options( WP_Plugin_Authorizer::NETWORK_CONTEXT );
	3228	+ // Get multisite approved users (add them to top of list, greyed out).
	3229	+ $auth_override_multisite = $this->get_plugin_option( 'advanced_override_multisite' );
	3230	+ $auth_multisite_settings = $this->get_plugin_options( MULTISITE_ADMIN );
3727	3231	$auth_settings_option_multisite = array();
3728	3232	if (
3729	3233	is_multisite() &&
3730		- ! is_network_admin() &&
3731		- '1' !== intval( $auth_override_multisite ) &&
	3234	+ $auth_override_multisite != '1' &&
3732	3235	array_key_exists( 'multisite_override', $auth_multisite_settings ) &&
3733		- '1' === $auth_multisite_settings['multisite_override']
	3236	+ $auth_multisite_settings['multisite_override'] === '1'
3734	3237	) {
3735		- $auth_settings_option_multisite = $this->get_plugin_option( $option, WP_Plugin_Authorizer::NETWORK_CONTEXT, 'allow override' );
	3238	+ $auth_settings_option_multisite = $this->get_plugin_option( $option, MULTISITE_ADMIN, 'allow override' );
3736	3239	$auth_settings_option_multisite = is_array( $auth_settings_option_multisite ) ? $auth_settings_option_multisite : array();
3737		- // Add multisite users to the beginning of the main user array.
3738		- foreach ( array_reverse( $auth_settings_option_multisite ) as $approved_user ) {
3739		- $approved_user['multisite_user'] = true;
3740		- array_unshift( $auth_settings_option, $approved_user );
3741		- }
3742	3240	}
3743	3241
3744	3242	// Get default role for new user dropdown.
3745		- $access_default_role = $this->get_plugin_option( 'access_default_role', WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
	3243	+ $access_default_role = $this->get_plugin_option( 'access_default_role', SINGLE_ADMIN, 'allow override' );
3746	3244
3747	3245	// Get custom usermeta field to show.
3748	3246	$advanced_usermeta = $this->get_plugin_option( 'advanced_usermeta' );
3749	3247
3750	3248	// Adjust javascript function prefixes if multisite.
3751		- $js_function_prefix = WP_Plugin_Authorizer::NETWORK_CONTEXT === $admin_mode ? 'authMultisite' : 'auth';
3752		- $is_multisite_admin_page = WP_Plugin_Authorizer::NETWORK_CONTEXT === $admin_mode;
	3249	+ $js_function_prefix = $admin_mode === MULTISITE_ADMIN ? 'auth_multisite_' : 'auth_';
	3250	+ $multisite_admin_page = $admin_mode === MULTISITE_ADMIN;
3753	3251
3754		- // Filter user list to search terms.
3755		- // phpcs:ignore WordPress.CSRF.NonceVerification.NoNonceVerification
3756		- if ( isset( $_REQUEST['search'] ) && strlen( sanitize_text_field( wp_unslash( $_REQUEST['search'] ) ) ) > 0 ) {
3757		- // phpcs:ignore WordPress.CSRF.NonceVerification.NoNonceVerification
3758		- $search_term = sanitize_text_field( wp_unslash( $_REQUEST['search'] ) );
3759		- $auth_settings_option = array_filter(
3760		- $auth_settings_option, function ( $user ) use ( $search_term ) {
3761		- return stripos( $user['email'], $search_term ) !== false ||
3762		- stripos( $user['role'], $search_term ) !== false ||
3763		- stripos( $user['date_added'], $search_term ) !== false;
3764		- }
3765		- );
3766		- }
3767		-
3768		- // Sort user list.
3769		- $sort_by = $this->get_plugin_option( 'advanced_users_sort_by', WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' ); // email, role, date_added (registered), created (date approved).
3770		- $sort_order = $this->get_plugin_option( 'advanced_users_sort_order', WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' ); // asc or desc.
3771		- $sort_dimension = array();
3772		- if ( in_array( $sort_by, array( 'email', 'role', 'date_added' ), true ) ) {
3773		- foreach ( $auth_settings_option as $key => $user ) {
3774		- if ( 'date_added' === $sort_by ) {
3775		- $sort_dimension[ $key ] = date( 'Ymd', strtotime( $user[ $sort_by ] ) );
3776		- } else {
3777		- $sort_dimension[ $key ] = strtolower( $user[ $sort_by ] );
3778		- }
3779		- }
3780		- $sort_order = 'asc' === $sort_order ? SORT_ASC : SORT_DESC;
3781		- array_multisort( $sort_dimension, $sort_order, $auth_settings_option );
3782		- } elseif ( 'created' === $sort_by && 'asc' !== $sort_order ) {
3783		- // If default sort method and reverse order, just reverse the array.
3784		- $auth_settings_option = array_reverse( $auth_settings_option );
3785		- }
3786		-
3787		- // Ensure array keys run from 0..max (keys in database will be the original,
3788		- // index, and removing users will not reorder the array keys of other users).
3789		- $auth_settings_option = array_values( $auth_settings_option );
3790		-
3791		- // Get pager params.
3792		- $total_users = count( $auth_settings_option );
3793		- $users_per_page = intval( $this->get_plugin_option( 'advanced_users_per_page', WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' ) );
3794		- // phpcs:ignore WordPress.CSRF.NonceVerification.NoNonceVerification
3795		- $current_page = isset( $_REQUEST['paged'] ) ? intval( $_REQUEST['paged'] ) : 1;
3796		- $total_pages = ceil( $total_users / $users_per_page );
3797		- if ( $total_pages < 1 ) {
3798		- $total_pages = 1;
3799		- }
3800		-
3801		- // Make sure current_page is between 1 and max pages.
3802		- if ( $current_page < 1 ) {
3803		- $current_page = 1;
3804		- } elseif ( $current_page > $total_pages ) {
3805		- $current_page = $total_pages;
3806		- }
3807		-
3808		- // Render wrapper div (for aligning pager to width of content).
3809		- ?>
3810		- <div class="wrapper_<?php echo esc_attr( $option ); ?>">
3811		- <?php $this->render_user_pager( $current_page, $users_per_page, $total_users, 'top' ); ?>
3812		- <ul id="list_auth_settings_access_users_approved" class="<?php echo strlen( $advanced_usermeta ) > 0 ? 'has-usermeta' : ''; ?>">
3813		- <?php
3814		- $offset = ( $current_page - 1 ) * $users_per_page;
3815		- $max = min( $offset + $users_per_page, count( $auth_settings_option ) );
3816		- for ( $key = $offset; $key < $max; $key++ ) :
3817		- $approved_user = $auth_settings_option[ $key ];
	3252	+ ?><ul id="list_auth_settings_access_users_approved" style="margin:0;">
	3253	+ <?php if ( ! $multisite_admin_page ) :
	3254	+ foreach ( $auth_settings_option_multisite as $key => $approved_user ) :
3818	3255	if ( empty( $approved_user ) || count( $approved_user ) < 1 ) :
3819	3256	continue;
3820	3257	endif;
3821		- $this->render_user_element( $approved_user, $key, $option, $admin_mode, $advanced_usermeta );
3822		- endfor;
3823		- ?>
3824		- </ul>
	3258	+ $approved_wp_user = get_user_by( 'email', $approved_user['email'] );
	3259	+ if ( $approved_wp_user ) :
	3260	+ $approved_user['email'] = $approved_wp_user->user_email;
	3261	+ $approved_user['role'] = $multisite_admin_page || count( $approved_wp_user->roles ) === 0 ? $approved_user['role'] : array_shift( $approved_wp_user->roles );
	3262	+ $approved_user['date_added'] = $approved_wp_user->user_registered;
	3263	+ // Get usermeta field from the WordPress user's real usermeta.
	3264	+ if ( strlen( $advanced_usermeta ) > 0 ) :
	3265	+ if ( strpos( $advanced_usermeta, 'acf___' ) === 0 && class_exists( 'acf' ) ) :
	3266	+ // Get ACF Field value for the user
	3267	+ $approved_user['usermeta'] = get_field( str_replace('acf___', '', $advanced_usermeta ), 'user_' . $approved_wp_user->ID );
	3268	+ else :
	3269	+ // Get regular usermeta value for the user.
	3270	+ $approved_user['usermeta'] = get_user_meta( $approved_wp_user->ID, $advanced_usermeta, true );
	3271	+ endif;
3825	3272
3826		- <div id="new_auth_settings_<?php echo esc_attr( $option ); ?>">
3827		- <textarea id="new_approved_user_email" placeholder="<?php esc_attr_e( 'email address', 'authorizer' ); ?>" class="auth-email new autogrow-short" rows="1"></textarea>
3828		- <select id="new_approved_user_role" class="auth-role">
3829		- <?php $this->wp_dropdown_permitted_roles( $access_default_role, 'not disabled', $admin_mode ); ?>
3830		- </select>
3831		- <div class="btn-group">
3832		- <a href="javascript:void(0);" class="btn button-primary dropdown-toggle button-add-user" id="approve_user_new" onclick="<?php echo esc_attr( $js_function_prefix ); ?>AddUser(this, 'approved' );"><span class="glyphicon glyphicon-ok"></span> <?php esc_html_e( 'Approve', 'authorizer' ); ?></a>
3833		- <button type="button" class="btn button-primary dropdown-toggle" data-toggle="dropdown">
3834		- <span class="caret"></span>
3835		- <span class="sr-only"><?php esc_html_e( 'Toggle Dropdown', 'authorizer' ); ?></span>
3836		- </button>
3837		- <ul class="dropdown-menu" role="menu">
3838		- <li><a href="javascript:void(0);" onclick="<?php echo esc_attr( $js_function_prefix ); ?>AddUser( document.getElementById( 'approve_user_new' ), 'approved', true);"><?php esc_html_e( 'Create a local WordPress account instead, and email the user their password.', 'authorizer' ); ?></a></li>
3839		- </ul>
3840		- </div>
3841		- </div>
3842		- <?php $this->render_user_pager( $current_page, $users_per_page, $total_users, 'bottom' ); ?>
3843		- </div>
3844		- <?php
3845		- }
	3273	+ if ( is_array( $approved_user['usermeta'] ) || is_object( $approved_user['usermeta'] ) ) :
	3274	+ $approved_user['usermeta'] = serialize( $approved_user['usermeta'] );
	3275	+ endif;
	3276	+ endif;
	3277	+ endif;
	3278	+ if ( ! array_key_exists( 'usermeta', $approved_user ) ) :
	3279	+ $approved_user['usermeta'] = '';
	3280	+ endif; ?>
	3281	+ <li>
	3282	+ <input type="text" id="auth_multisite_settings_<?php echo $option; ?>_<?php echo $key; ?>" value="<?php echo $approved_user['email']; ?>" readonly="true" class="auth-email auth-multisite-email" />
	3283	+ <select id="auth_multisite_settings_<?php echo $option; ?>_<?php echo $key; ?>_role" class="auth-role auth-multisite-role" disabled="disabled">
	3284	+ <?php $this->wp_dropdown_permitted_roles( $approved_user['role'] ); ?>
	3285	+ </select>
	3286	+ <input type="text" id="auth_multisite_settings_<?php echo $option; ?>_<?php echo $key; ?>_date_added" value="<?php echo date( 'M Y', strtotime( $approved_user['date_added'] ) ); ?>" readonly="true" class="auth-date-added auth-multisite-date-added" disabled="disabled" />
	3287	+ <?php if ( strlen( $advanced_usermeta ) > 0 ) :
	3288	+ $should_show_usermeta_in_text_field = true; // Fallback renderer for usermeta; try to use a select first.
	3289	+ if ( strpos( $advanced_usermeta, 'acf___' ) === 0 && class_exists( 'acf' ) ) :
	3290	+ $field_object = get_field_object( str_replace('acf___', '', $advanced_usermeta ) );
	3291	+ if ( is_array( $field_object ) && array_key_exists( 'type', $field_object ) && $field_object['type'] === 'select' ) :
	3292	+ $should_show_usermeta_in_text_field = false; ?>
	3293	+ <select id="auth_settings_<?php echo $option; ?>_<?php echo $key; ?>_usermeta" class="auth-usermeta auth-multisite-usermeta" onchange="<?php echo $js_function_prefix; ?>update_usermeta( this );">
	3294	+ <option value=""<?php if ( empty( $approved_user['usermeta'] ) ) echo ' selected="selected"'; ?>><?php _e( '-- None --', 'authorizer' ); ?></option>
	3295	+ <?php foreach ( $field_object['choices'] as $key => $label ) : ?>
	3296	+ <option value="<?php echo $key; ?>"<?php if ( $key === $approved_user['usermeta'] || ( is_array( $approved_user['usermeta'] ) && array_key_exists( get_current_blog_id(), $approved_user['usermeta'] ) && $key === $approved_user['usermeta'][get_current_blog_id()]['meta_value'] ) ) echo ' selected="selected"'; ?>><?php echo $label; ?></option>
	3297	+ <?php endforeach; ?>
	3298	+ </select>
	3299	+ <?php endif; ?>
	3300	+ <?php endif; ?>
	3301	+ <?php if ( $should_show_usermeta_in_text_field ) : ?>
	3302	+ <input type="text" id="auth_multisite_settings_<?php echo $option; ?>_<?php echo $key; ?>_usermeta" value="<?php echo htmlspecialchars( $approved_user['usermeta'], ENT_COMPAT ); ?>" class="auth-usermeta auth-multisite-usermeta" />
	3303	+ <a class="button button-small button-primary update-usermeta" id="update_usermeta_<?php echo $key; ?>" onclick="<?php echo $js_function_prefix; ?>update_usermeta( this );" title="Update usermeta"><span class="glyphicon glyphicon-floppy-saved"></span></a>
	3304	+ <?php endif; ?>
	3305	+ <?php endif; ?>
	3306	+ &nbsp;&nbsp;<a title="WordPress Multisite user" class="auth-multisite-user"><span class="glyphicon glyphicon-globe"></span></a>
	3307	+ </li>
	3308	+ <?php endforeach;
	3309	+ endif;
	3310	+ foreach ( $auth_settings_option as $key => $approved_user ):
	3311	+ $is_current_user = false;
	3312	+ $local_user_icon = array_key_exists( 'local_user', $approved_user ) && $approved_user['local_user'] === 'true' ? '&nbsp;<a title="Local WordPress user" class="auth-local-user"><span class="glyphicon glyphicon-user"></span></a>' : '';
	3313	+ if ( empty( $approved_user ) || count( $approved_user ) < 1 ) :
	3314	+ continue;
	3315	+ endif;
	3316	+ $approved_wp_user = get_user_by( 'email', $approved_user['email'] );
	3317	+ if ( $approved_wp_user ) :
	3318	+ $approved_user['email'] = $approved_wp_user->user_email;
	3319	+ $approved_user['role'] = $multisite_admin_page || count( $approved_wp_user->roles ) === 0 ? $approved_user['role'] : array_shift( $approved_wp_user->roles );
	3320	+ $approved_user['date_added'] = $approved_wp_user->user_registered;
	3321	+ $approved_user['is_wp_user'] = true;
	3322	+ $is_current_user = $approved_wp_user->ID === get_current_user_id();
	3323	+ // Get usermeta field from the WordPress user's real usermeta.
	3324	+ if ( strlen( $advanced_usermeta ) > 0 ) :
	3325	+ if ( strpos( $advanced_usermeta, 'acf___' ) === 0 && class_exists( 'acf' ) ) :
	3326	+ // Get ACF Field value for the user
	3327	+ $approved_user['usermeta'] = get_field( str_replace('acf___', '', $advanced_usermeta ), 'user_' . $approved_wp_user->ID );
	3328	+ else :
	3329	+ // Get regular usermeta value for the user.
	3330	+ $approved_user['usermeta'] = get_user_meta( $approved_wp_user->ID, $advanced_usermeta, true );
	3331	+ endif;
3846	3332
3847		-
3848		- /**
3849		- * Renders the html elements for the pager above and below the Approved User list.
3850		- *
3851		- * @param integer $current_page Which page we are currently viewing.
3852		- * @param integer $users_per_page How many users to show per page.
3853		- * @param integer $total_users Total count of users in list.
3854		- * @param string $which Where to render the pager ('top' or 'bottom').
3855		- * @return void
3856		- */
3857		- private function render_user_pager( $current_page = 1, $users_per_page = 20, $total_users = 0, $which = 'top' ) {
3858		- $total_pages = ceil( $total_users / $users_per_page );
3859		- if ( $total_pages < 1 ) {
3860		- $total_pages = 1;
3861		- }
3862		-
3863		- /* TRANSLATORS: %s: number of users */
3864		- $output = ' <span class="displaying-num">' . sprintf( _n( '%s user', '%s users', $total_users, 'authorizer' ), number_format_i18n( $total_users ) ) . '</span>';
3865		-
3866		- $disable_first = $current_page <= 1;
3867		- $disable_prev = $current_page <= 1;
3868		- $disable_next = $current_page >= $total_pages;
3869		- $disable_last = $current_page >= $total_pages;
3870		-
3871		- $current_url = '';
3872		- if ( isset( $_SERVER['HTTP_HOST'], $_SERVER['REQUEST_URI'] ) ) {
3873		- $current_url = set_url_scheme( esc_url_raw( wp_unslash( $_SERVER['HTTP_HOST'] ) ) . esc_url_raw( wp_unslash( $_SERVER['REQUEST_URI'] ) ) );
3874		- $current_url = remove_query_arg( wp_removable_query_args(), $current_url );
3875		- }
3876		-
3877		- $page_links = array();
3878		-
3879		- $total_pages_before = '<span class="paging-input">';
3880		- $total_pages_after = '</span></span>';
3881		-
3882		- if ( $disable_first ) {
3883		- $page_links[] = '<span class="first-page tablenav-pages-navspan" aria-hidden="true">&laquo;</span>';
3884		- } else {
3885		- $page_links[] = sprintf(
3886		- "<a class='first-page' href='%s'><span class='screen-reader-text'>%s</span><span aria-hidden='true'>%s</span></a>",
3887		- esc_url( remove_query_arg( 'paged', $current_url ) ),
3888		- __( 'First page' ),
3889		- '&laquo;'
3890		- );
3891		- }
3892		-
3893		- if ( $disable_prev ) {
3894		- $page_links[] = '<span class="prev-page tablenav-pages-navspan" aria-hidden="true">&lsaquo;</span>';
3895		- } else {
3896		- $page_links[] = sprintf(
3897		- "<a class='prev-page' href='%s'><span class='screen-reader-text'>%s</span><span aria-hidden='true'>%s</span></a>",
3898		- esc_url( add_query_arg( 'paged', max( 1, $current_page - 1 ), $current_url ) ),
3899		- __( 'Previous page' ),
3900		- '&lsaquo;'
3901		- );
3902		- }
3903		-
3904		- if ( 'bottom' === $which ) {
3905		- $html_current_page = '<span class="current-page-text">' . $current_page . '</span>';
3906		- $total_pages_before = '<span class="screen-reader-text">' . __( 'Current Page' ) . '</span><span id="table-paging" class="paging-input"><span class="tablenav-paging-text">';
3907		- } else {
3908		- $html_current_page = sprintf(
3909		- "%s<input class='current-page' id='current-page-selector' type='text' name='paged' value='%s' size='%d' aria-describedby='table-paging' /><span class='tablenav-paging-text'>",
3910		- '<label for="current-page-selector" class="screen-reader-text">' . __( 'Current Page' ) . '</label>',
3911		- $current_page,
3912		- strlen( $total_pages )
3913		- );
3914		- }
3915		- /* TRANSLATORS: %s: number of pages */
3916		- $html_total_pages = sprintf( "<span class='total-pages'>%s</span>", number_format_i18n( $total_pages ) );
3917		- /* TRANSLATORS: 1: number of current page 2: number of total pages */
3918		- $page_links[] = $total_pages_before . sprintf( _x( '%1$s of %2$s', 'paging' ), $html_current_page, $html_total_pages ) . $total_pages_after;
3919		-
3920		- if ( $disable_next ) {
3921		- $page_links[] = '<span class="next-page tablenav-pages-navspan" aria-hidden="true">&rsaquo;</span>';
3922		- } else {
3923		- $page_links[] = sprintf(
3924		- "<a class='next-page' href='%s'><span class='screen-reader-text'>%s</span><span aria-hidden='true'>%s</span></a>",
3925		- esc_url( add_query_arg( 'paged', min( $total_pages, $current_page + 1 ), $current_url ) ),
3926		- __( 'Next page' ),
3927		- '&rsaquo;'
3928		- );
3929		- }
3930		-
3931		- if ( $disable_last ) {
3932		- $page_links[] = '<span class="last-page tablenav-pages-navspan" aria-hidden="true">&raquo;</span>';
3933		- } else {
3934		- $page_links[] = sprintf(
3935		- "<a class='last-page' href='%s'><span class='screen-reader-text'>%s</span><span aria-hidden='true'>%s</span></a>",
3936		- esc_url( add_query_arg( 'paged', $total_pages, $current_url ) ),
3937		- __( 'Last page' ),
3938		- '&raquo;'
3939		- );
3940		- }
3941		-
3942		- $pagination_links_class = 'pagination-links';
3943		- $output .= "\n<span class='$pagination_links_class'>" . join( "\n", $page_links ) . '</span>';
3944		-
3945		- $search_form = array();
3946		- if ( 'top' === $which ) {
3947		- // phpcs:ignore WordPress.CSRF.NonceVerification.NoNonceVerification
3948		- $search_term = isset( $_REQUEST['search'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['search'] ) ) : '';
3949		- $search_form[] = '<div class="search-box">';
3950		- $search_form[] = '<label class="screen-reader-text" for="user-search-input">' . __( 'Search Users', 'authorizer' ) . '</label>';
3951		- $search_form[] = '<input type="search" size="14" id="user-search-input" name="search" value="' . $search_term . '">';
3952		- $search_form[] = '<input type="button" id="search-submit" class="button" value="' . __( 'Search', 'authorizer' ) . '">';
3953		- $search_form[] = '</div>';
3954		- }
3955		- $search_form = join( "\n", $search_form );
3956		-
3957		- $output = "<div class='tablenav-pages'>$output</div>";
3958		- ?>
3959		- <div class="tablenav top">
3960		- <?php echo wp_kses( $output, $this->allowed_html ); ?>
3961		- <?php echo wp_kses( $search_form, $this->allowed_html ); ?>
3962		- </div>
3963		- <?php
3964		- }
3965		-
3966		-
3967		- /**
3968		- * Renders the html <li> element for a given user in a list.
3969		- *
3970		- * @param array $approved_user User array to render.
3971		- * @param int $key Index of user in list of users.
3972		- * @param string $option List user is in (e.g., 'access_users_approved').
3973		- * @param string $admin_mode Current admin context.
3974		- * @param string $advanced_usermeta Usermeta field to display.
3975		- * @return void
3976		- */
3977		- private function render_user_element( $approved_user, $key, $option, $admin_mode, $advanced_usermeta ) {
3978		- $is_local_user = array_key_exists( 'local_user', $approved_user ) && 'true' === $approved_user['local_user'];
3979		- $is_multisite_user = array_key_exists( 'multisite_user', $approved_user ) && true === $approved_user['multisite_user'];
3980		- $option_prefix = $is_multisite_user ? 'auth_multisite_settings_' : 'auth_settings_';
3981		- $option_id = $option_prefix . $option . '_' . $key;
3982		- $approved_wp_user = get_user_by( 'email', $approved_user['email'] );
3983		- $is_current_user = $approved_wp_user && get_current_user_id() === $approved_wp_user->ID;
3984		-
3985		- // Adjust javascript function prefixes if multisite.
3986		- $js_function_prefix = WP_Plugin_Authorizer::NETWORK_CONTEXT === $admin_mode ? 'authMultisite' : 'auth';
3987		- $is_multisite_admin_page = WP_Plugin_Authorizer::NETWORK_CONTEXT === $admin_mode;
3988		-
3989		- if ( ! $approved_wp_user ) :
3990		- $approved_user['is_wp_user'] = false;
3991		- else :
3992		- $approved_user['is_wp_user'] = true;
3993		- $approved_user['email'] = $approved_wp_user->user_email;
3994		- $approved_user['role'] = $is_multisite_admin_page || count( $approved_wp_user->roles ) === 0 ? $approved_user['role'] : array_shift( $approved_wp_user->roles );
3995		- $approved_user['date_added'] = $approved_wp_user->user_registered;
3996		-
3997		- // Get usermeta field from the WordPress user's real usermeta.
3998		- if ( strlen( $advanced_usermeta ) > 0 ) :
3999		- if ( strpos( $advanced_usermeta, 'acf___' ) === 0 && class_exists( 'acf' ) ) :
4000		- // Get ACF Field value for the user.
4001		- $approved_user['usermeta'] = get_field( str_replace( 'acf___', '', $advanced_usermeta ), 'user_' . $approved_wp_user->ID );
	3333	+ if ( is_array( $approved_user['usermeta'] ) || is_object( $approved_user['usermeta'] ) ) :
	3334	+ $approved_user['usermeta'] = serialize( $approved_user['usermeta'] );
	3335	+ endif;
	3336	+ endif;
4002	3337	else :
4003		- // Get regular usermeta value for the user.
4004		- $approved_user['usermeta'] = get_user_meta( $approved_wp_user->ID, $advanced_usermeta, true );
	3338	+ $approved_user['is_wp_user'] = false;
4005	3339	endif;
4006		- if ( is_array( $approved_user['usermeta'] ) || is_object( $approved_user['usermeta'] ) ) :
4007		- $approved_user['usermeta'] = serialize( $approved_user['usermeta'] );
4008		- endif;
4009		- endif;
4010		- endif;
4011		- if ( ! array_key_exists( 'usermeta', $approved_user ) ) :
4012		- $approved_user['usermeta'] = '';
4013		- endif;
4014		- ?>
4015		- <li>
4016		- <input
4017		- type="text"
4018		- id="<?php echo esc_attr( $option_id ); ?>"
4019		- value="<?php echo esc_attr( $approved_user['email'] ); ?>"
4020		- readonly="true"
4021		- class="<?php echo esc_attr( $this->create_class_name( 'email', $is_multisite_user ) ); ?>"
4022		- />
4023		- <select
4024		- id="<?php echo esc_attr( $option_id ); ?>_role"
4025		- class="<?php echo esc_attr( $this->create_class_name( 'role', $is_multisite_user ) ); ?>"
4026		- onchange="<?php echo esc_attr( $js_function_prefix ); ?>ChangeRole( this );"
4027		- <?php if ( $is_multisite_user ) : ?>
4028		- disabled="disabled"
4029		- <?php endif; ?>
4030		- >
4031		- <?php $disable_input = $is_current_user ? 'disabled' : null; ?>
4032		- <?php $this->wp_dropdown_permitted_roles( $approved_user['role'], $disable_input, $admin_mode ); ?>
	3340	+ if ( ! array_key_exists( 'usermeta', $approved_user ) ) :
	3341	+ $approved_user['usermeta'] = '';
	3342	+ endif; ?>
	3343	+ <li>
	3344	+ <input type="text" id="auth_settings_<?php echo $option; ?>_<?php echo $key; ?>" value="<?php echo $approved_user['email']; ?>" readonly="true" class="auth-email" />
	3345	+ <select id="auth_settings_<?php echo $option; ?>_<?php echo $key; ?>_role" class="auth-role" onchange="<?php echo $js_function_prefix; ?>change_role( this );">
	3346	+ <?php $disable_input = $is_current_user ? 'disabled' : null; ?>
	3347	+ <?php $this->wp_dropdown_permitted_roles( $approved_user['role'], $disable_input, $admin_mode ); ?>
	3348	+ </select>
	3349	+ <input type="text" id="auth_settings_<?php echo $option; ?>_<?php echo $key; ?>_date_added" value="<?php echo date( 'M Y', strtotime( $approved_user['date_added'] ) ); ?>" readonly="true" class="auth-date-added" />
	3350	+ <?php if ( strlen( $advanced_usermeta ) > 0 ) :
	3351	+ $should_show_usermeta_in_text_field = true; // Fallback renderer for usermeta; try to use a select first.
	3352	+ if ( strpos( $advanced_usermeta, 'acf___' ) === 0 && class_exists( 'acf' ) ) :
	3353	+ $field_object = get_field_object( str_replace('acf___', '', $advanced_usermeta ) );
	3354	+ if ( is_array( $field_object ) && array_key_exists( 'type', $field_object ) && $field_object['type'] === 'select' ) :
	3355	+ $should_show_usermeta_in_text_field = false; ?>
	3356	+ <select id="auth_settings_<?php echo $option; ?>_<?php echo $key; ?>_usermeta" class="auth-usermeta" onchange="<?php echo $js_function_prefix; ?>update_usermeta( this );" >
	3357	+ <option value=""<?php if ( empty( $approved_user['usermeta'] ) ) echo ' selected="selected"'; ?>><?php _e( '-- None --', 'authorizer' ); ?></option>
	3358	+ <?php foreach ( $field_object['choices'] as $key => $label ) : ?>
	3359	+ <option value="<?php echo $key; ?>"<?php if ( $key === $approved_user['usermeta'] || ( is_array( $approved_user['usermeta'] ) && $key === $approved_user['usermeta']['meta_value'] ) ) echo ' selected="selected"'; ?>><?php echo $label; ?></option>
	3360	+ <?php endforeach; ?>
	3361	+ </select>
	3362	+ <?php endif; ?>
	3363	+ <?php endif; ?>
	3364	+ <?php if ( $should_show_usermeta_in_text_field ) : ?>
	3365	+ <input type="text" id="auth_settings_<?php echo $option; ?>_<?php echo $key; ?>_usermeta" value="<?php echo htmlspecialchars( $approved_user['usermeta'], ENT_COMPAT ); ?>" class="auth-usermeta" />
	3366	+ <a class="button button-small button-primary update-usermeta" id="update_usermeta_<?php echo $key; ?>" onclick="<?php echo $js_function_prefix; ?>update_usermeta( this );" title="Update usermeta"><span class="glyphicon glyphicon-floppy-saved"></span></a>
	3367	+ <?php endif; ?>
	3368	+ <?php endif; ?>
	3369	+ <?php if ( ! $is_current_user ): ?>
	3370	+ <?php if ( ! $multisite_admin_page ) : ?>
	3371	+ <a class="button" id="block_user_<?php echo $key; ?>" onclick="<?php echo $js_function_prefix; ?>add_user( this, 'blocked', false ); <?php echo $js_function_prefix; ?>ignore_user( this, 'approved' );" title="<?php _e( 'Block/Ban user', 'authorizer' ); ?>"><span class="glyphicon glyphicon-ban-circle"></span></a>
	3372	+ <?php endif; ?>
	3373	+ <a class="button" id="ignore_user_<?php echo $key; ?>" onclick="<?php echo $js_function_prefix; ?>ignore_user(this, 'approved' );" title="<?php _e( 'Remove user', 'authorizer' ); ?>"><span class="glyphicon glyphicon-remove"></span></a>
	3374	+ <?php endif; ?>
	3375	+ <?php echo $local_user_icon; ?>
	3376	+ </li>
	3377	+ <?php endforeach; ?>
	3378	+ </ul>
	3379	+ <div id="new_auth_settings_<?php echo $option; ?>">
	3380	+ <input type="text" id="new_approved_user_email" placeholder="<?php _e( 'email address', 'authorizer' ); ?>" class="auth-email new" />
	3381	+ <select id="new_approved_user_role" class="auth-role">
	3382	+ <?php $this->wp_dropdown_permitted_roles( $access_default_role, 'not disabled', $admin_mode ); ?>
4033	3383	</select>
4034		- <input
4035		- type="text"
4036		- id="<?php echo esc_attr( $option_id ); ?>_date_added"
4037		- value="<?php echo esc_attr( date( 'M Y', strtotime( $approved_user['date_added'] ) ) ); ?>"
4038		- readonly="true"
4039		- class="<?php echo esc_attr( $this->create_class_name( 'date-added', $is_multisite_user ) ); ?>"
4040		- />
4041		- <?php
4042		- if ( strlen( $advanced_usermeta ) > 0 ) :
4043		- $should_show_usermeta_in_text_field = true; // Fallback renderer for usermeta; try to use a select first.
4044		- if ( strpos( $advanced_usermeta, 'acf___' ) === 0 && class_exists( 'acf' ) ) :
4045		- $field_object = get_field_object( str_replace( 'acf___', '', $advanced_usermeta ) );
4046		- if ( is_array( $field_object ) && array_key_exists( 'type', $field_object ) && 'select' === $field_object['type'] ) :
4047		- $should_show_usermeta_in_text_field = false;
4048		- ?>
4049		- <select
4050		- id="<?php echo esc_attr( $option_id ); ?>_usermeta"
4051		- class="<?php echo esc_attr( $this->create_class_name( 'usermeta', $is_multisite_user ) ); ?>"
4052		- onchange="<?php echo esc_attr( $js_function_prefix ); ?>UpdateUsermeta( this );"
4053		- >
4054		- <option value=""<?php selected( empty( $approved_user['usermeta'] ) ); ?>><?php esc_html_e( '-- None --', 'authorizer' ); ?></option>
4055		- <?php foreach ( $field_object['choices'] as $key => $label ) : ?>
4056		- <option value="<?php echo esc_attr( $key ); ?>"<?php selected( $key === $approved_user['usermeta'] || ( isset( $approved_user['usermeta']['meta_value'] ) && $key === $approved_user['usermeta']['meta_value'] ) ); ?>><?php echo esc_html( $label ); ?></option>
4057		- <?php endforeach; ?>
4058		- </select>
4059		- <?php endif; ?>
4060		- <?php endif; ?>
4061		- <?php if ( $should_show_usermeta_in_text_field ) : ?>
4062		- <input
4063		- type="text"
4064		- id="<?php echo esc_attr( $option_id ); ?>_usermeta"
4065		- value="<?php echo esc_attr( $approved_user['usermeta'], ENT_COMPAT ); ?>"
4066		- class="<?php echo esc_attr( $this->create_class_name( 'usermeta', $is_multisite_user ) ); ?>"
4067		- />
4068		- <a class="button button-small button-primary update-usermeta" id="update_usermeta_<?php echo esc_attr( $key ); ?>" onclick="<?php echo esc_attr( $js_function_prefix ); ?>UpdateUsermeta( this );" title="Update usermeta"><span class="glyphicon glyphicon-floppy-saved"></span></a>
4069		- <?php endif; ?>
4070		- <?php endif; ?>
4071		- <?php if ( ! $is_current_user && ! $is_multisite_user ) : ?>
4072		- <?php if ( ! $is_multisite_admin_page ) : ?>
4073		- <a class="button" id="block_user_<?php echo esc_attr( $key ); ?>" onclick="<?php echo esc_attr( $js_function_prefix ); ?>AddUser( this, 'blocked', false ); <?php echo esc_attr( $js_function_prefix ); ?>IgnoreUser( this, 'approved' );" title="<?php esc_attr_e( 'Block/Ban user', 'authorizer' ); ?>"><span class="glyphicon glyphicon-ban-circle"></span></a>
4074		- <?php endif; ?>
4075		- <a class="button" id="ignore_user_<?php echo esc_attr( $key ); ?>" onclick="<?php echo esc_attr( $js_function_prefix ); ?>IgnoreUser(this, 'approved' );" title="<?php esc_attr_e( 'Remove user', 'authorizer' ); ?>"><span class="glyphicon glyphicon-remove"></span></a>
4076		- <?php endif; ?>
4077		- <?php if ( $is_local_user ) : ?>
4078		- &nbsp;<a title="Local WordPress user" class="auth-local-user"><span class="glyphicon glyphicon-user"></span></a>
4079		- <?php endif; ?>
4080		- <?php if ( $is_multisite_user ) : ?>
4081		- &nbsp;<a title="WordPress Multisite user" class="auth-multisite-user"><span class="glyphicon glyphicon-globe"></span></a>
4082		- <?php endif; ?>
4083		- </li>
	3384	+ <div class="btn-group">
	3385	+ <a href="javascript:void(0);" class="btn button-primary dropdown-toggle" id="approve_user_new" onclick="<?php echo $js_function_prefix; ?>add_user(this, 'approved' );"><span class="glyphicon glyphicon-ok"></span> <?php _e( 'Approve', 'authorizer' ); ?></a>
	3386	+ <button type="button" class="btn button-primary dropdown-toggle" data-toggle="dropdown">
	3387	+ <span class="caret"></span>
	3388	+ <span class="sr-only"><?php _e( 'Toggle Dropdown', 'authorizer' ); ?></span>
	3389	+ </button>
	3390	+ <ul class="dropdown-menu" role="menu">
	3391	+ <li><a href="javascript:void(0);" onclick="<?php echo $js_function_prefix; ?>add_user( document.getElementById('approve_user_new' ), 'approved', true);"><?php _e( 'Create a local WordPress <br />account instead, and email <br />the user their password.', 'authorizer' ); ?></a></li>
	3392	+ </ul>
	3393	+ </div>
	3394	+ </div>
4084	3395	<?php
4085	3396	}
4086	3397
4087	3398
4088		- /**
4089		- * Settings print callback.
4090		- *
4091		- * @param string $args Args (e.g., multisite admin mode).
4092		- * @return void
4093		- */
4094		- public function print_combo_auth_access_users_blocked( $args = '' ) {
	3399	+ function print_combo_auth_access_users_blocked( $args = '' ) {
4095	3400	// Get plugin option.
4096		- $option = 'access_users_blocked';
	3401	+ $option = 'access_users_blocked';
4097	3402	$auth_settings_option = $this->get_plugin_option( $option );
4098	3403	$auth_settings_option = is_array( $auth_settings_option ) ? $auth_settings_option : array();
4099	3404
4100	3405	// Get default role for new blocked user dropdown.
4101		- $access_default_role = $this->get_plugin_option( 'access_default_role', WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
	3406	+ $access_default_role = $this->get_plugin_option( 'access_default_role', SINGLE_ADMIN, 'allow override' );
4102	3407
4103		- // Render wrapper div (for aligning pager to width of content).
4104		- ?>
4105		- <div class="wrapper_<?php echo esc_attr( $option ); ?>">
4106		- <ul id="list_auth_settings_<?php echo esc_attr( $option ); ?>" style="margin:0;">
4107		- <?php
4108		- foreach ( $auth_settings_option as $key => $blocked_user ) :
4109		- if ( empty( $blocked_user ) || count( $blocked_user ) < 1 ) :
4110		- continue;
4111		- endif;
4112		- $blocked_wp_user = get_user_by( 'email', $blocked_user['email'] );
4113		- if ( $blocked_wp_user ) :
4114		- $blocked_user['email'] = $blocked_wp_user->user_email;
4115		- $blocked_user['role'] = array_shift( $blocked_wp_user->roles );
4116		- $blocked_user['date_added'] = $blocked_wp_user->user_registered;
4117		- $blocked_user['is_wp_user'] = true;
4118		- else :
4119		- $blocked_user['is_wp_user'] = false;
4120		- endif;
4121		- ?>
4122		- <li>
4123		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>_<?php echo esc_attr( $key ); ?>" value="<?php echo esc_attr( $blocked_user['email'] ); ?>" readonly="true" class="auth-email" />
4124		- <select id="auth_settings_<?php echo esc_attr( $option ); ?>_<?php echo esc_attr( $key ); ?>_role" class="auth-role">
4125		- <?php $this->wp_dropdown_permitted_roles( $blocked_user['role'] ); ?>
4126		- </select>
4127		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>_<?php echo esc_attr( $key ); ?>_date_added" value="<?php echo esc_attr( date( 'M Y', strtotime( $blocked_user['date_added'] ) ) ); ?>" readonly="true" class="auth-date-added" />
4128		- <a class="button" id="ignore_user_<?php echo esc_attr( $key ); ?>" onclick="authIgnoreUser( this, 'blocked' );" title="<?php esc_attr_e( 'Remove user', 'authorizer' ); ?>"><span class="glyphicon glyphicon-remove"></span></a>
4129		- </li>
4130		- <?php endforeach; ?>
4131		- </ul>
4132		- <div id="new_auth_settings_<?php echo esc_attr( $option ); ?>">
4133		- <input type="text" id="new_blocked_user_email" placeholder="<?php esc_attr_e( 'email address', 'authorizer' ); ?>" class="auth-email new" />
4134		- <select id="new_blocked_user_role" class="auth-role">
4135		- <option value="<?php echo esc_attr( $access_default_role ); ?>"><?php echo esc_html( ucfirst( $access_default_role ) ); ?></option>
4136		- </select>
4137		- <a href="javascript:void(0);" class="button-primary button-add-user" id="block_user_new" onclick="authAddUser( this, 'blocked' );"><span class="glyphicon glyphicon-ban-circle"></span> <?php esc_html_e( 'Block', 'authorizer' ); ?></a>
4138		- </div>
	3408	+ // Print option elements.
	3409	+ ?><ul id="list_auth_settings_<?php echo $option; ?>" style="margin:0;">
	3410	+ <?php foreach ( $auth_settings_option as $key => $blocked_user ): ?>
	3411	+ <?php if ( empty( $blocked_user ) || count( $blocked_user ) < 1 ) continue; ?>
	3412	+ <?php if ( $blocked_wp_user = get_user_by( 'email', $blocked_user['email'] ) ): ?>
	3413	+ <?php $blocked_user['email'] = $blocked_wp_user->user_email; ?>
	3414	+ <?php $blocked_user['role'] = array_shift( $blocked_wp_user->roles ); ?>
	3415	+ <?php $blocked_user['date_added'] = $blocked_wp_user->user_registered; ?>
	3416	+ <?php $blocked_user['is_wp_user'] = true; ?>
	3417	+ <?php else: ?>
	3418	+ <?php $blocked_user['is_wp_user'] = false; ?>
	3419	+ <?php endif; ?>
	3420	+ <li>
	3421	+ <input type="text" id="auth_settings_<?php echo $option; ?>_<?php echo $key; ?>" value="<?php echo $blocked_user['email']; ?>" readonly="true" class="auth-email" />
	3422	+ <select id="auth_settings_<?php echo $option; ?>_<?php echo $key; ?>_role" class="auth-role">
	3423	+ <?php $this->wp_dropdown_permitted_roles( $blocked_user['role'] ); ?>
	3424	+ </select>
	3425	+ <input type="text" id="auth_settings_<?php echo $option; ?>_<?php echo $key; ?>_date_added" value="<?php echo date( 'M Y', strtotime( $blocked_user['date_added'] ) ); ?>" readonly="true" class="auth-date-added" />
	3426	+ <a class="button" id="ignore_user_<?php echo $key; ?>" onclick="auth_ignore_user(this, 'blocked' );" title="<?php _e( 'Remove user', 'authorizer' ); ?>"><span class="glyphicon glyphicon-remove"></span></a>
	3427	+ </li>
	3428	+ <?php endforeach; ?>
	3429	+ </ul>
	3430	+ <div id="new_auth_settings_<?php echo $option; ?>">
	3431	+ <input type="text" id="new_blocked_user_email" placeholder="<?php _e( 'email address', 'authorizer' ); ?>" class="auth-email new" />
	3432	+ <select id="new_blocked_user_role" class="auth-role">
	3433	+ <option value="<?php echo $access_default_role; ?>"><?php echo ucfirst( $access_default_role ); ?></option>
	3434	+ </select>
	3435	+ <a href="javascript:void(0);" class="button-primary" id="block_user_new" onclick="auth_add_user(this, 'blocked' );"><span class="glyphicon glyphicon-ban-circle"></span> <?php _e( 'Block', 'authorizer' ); ?></a>
4139	3436	</div>
4140	3437	<?php
4141	3438	}
4142	3439
4143	3440
4144		- /**
4145		- * Settings print callback.
4146		- *
4147		- * @param string $args Args (e.g., multisite admin mode).
4148		- * @return void
4149		- */
4150		- public function print_section_info_access_login( $args = '' ) {
4151		- ?>
4152		- <div id="section_info_access_login" class="section_info">
	3441	+ function print_section_info_access_login( $args = '' ) {
	3442	+ ?><div id="section_info_access_login" class="section_info">
4153	3443	<?php wp_nonce_field( 'save_auth_settings', 'nonce_save_auth_settings' ); ?>
4154		- <p><?php esc_html_e( 'Choose who is able to log into this site below.', 'authorizer' ); ?></p>
4155		- </div>
4156		- <?php
	3444	+ <p><?php _e( 'Choose who is able to log into this site below.', 'authorizer' ); ?></p>
	3445	+ </div><?php
4157	3446	}
4158	3447
4159	3448
4160		- /**
4161		- * Settings print callback.
4162		- *
4163		- * @param string $args Args (e.g., multisite admin mode).
4164		- * @return void
4165		- */
4166		- public function print_radio_auth_access_who_can_login( $args = '' ) {
	3449	+ function print_radio_auth_access_who_can_login( $args = '' ) {
4167	3450	// Get plugin option.
4168		- $option = 'access_who_can_login';
4169		- $admin_mode = $this->get_admin_mode( $args );
	3451	+ $option = 'access_who_can_login';
	3452	+ $admin_mode = $this->get_admin_mode( $args );
4170	3453	$auth_settings_option = $this->get_plugin_option( $option, $admin_mode, 'allow override', 'print overlay' );
4171	3454
4172	3455	// If this site is configured independently of any multisite overrides, make sure we are not grabbing the multisite value; otherwise, grab the multisite value to show behind the disabled overlay.
4173		- if ( is_multisite() && 1 === intval( $this->get_plugin_option( 'advanced_override_multisite' ) ) ) {
	3456	+ if ( is_multisite() && $this->get_plugin_option( 'advanced_override_multisite' ) == '1' ) {
4174	3457	$auth_settings_option = $this->get_plugin_option( $option );
4175		- } elseif ( is_multisite() && WP_Plugin_Authorizer::SINGLE_CONTEXT === $admin_mode && $this->get_plugin_option( 'multisite_override', WP_Plugin_Authorizer::NETWORK_CONTEXT ) === '1' ) {
	3458	+ } elseif ( is_multisite() && $admin_mode === SINGLE_ADMIN && $this->get_plugin_option( 'multisite_override', MULTISITE_ADMIN ) === '1' ) {
4176	3459	// Workaround: javascript code hides/shows other settings based
4177	3460	// on the selection in this option. If this option is overridden
4178	3461	// by a multisite option, it should show that value in order to
4179	3462	// correctly display the other appropriate options.
		@@ -4179,49 +3462,33 @@
4179	3462	// correctly display the other appropriate options.
4180	3463	// Side effect: this site option will be overwritten by the
4181	3464	// multisite option on save. Since this is a 2-item radio, we
4182	3465	// determined this was acceptable.
4183		- $auth_settings_option = $this->get_plugin_option( $option, WP_Plugin_Authorizer::NETWORK_CONTEXT );
	3466	+ $auth_settings_option = $this->get_plugin_option( $option, MULTISITE_ADMIN );
4184	3467	}
4185	3468
4186	3469	// Print option elements.
4187		- ?>
4188		- <input type="radio" id="radio_auth_settings_<?php echo esc_attr( $option ); ?>_external_users" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="external_users"<?php checked( 'external_users' === $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo esc_attr( $option ); ?>_external_users"><?php esc_html_e( 'All authenticated users (All external service users and all WordPress users)', 'authorizer' ); ?></label><br />
4189		- <input type="radio" id="radio_auth_settings_<?php echo esc_attr( $option ); ?>_approved_users" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="approved_users"<?php checked( 'approved_users' === $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo esc_attr( $option ); ?>_approved_users"><?php esc_html_e( 'Only', 'authorizer' ); ?> <a href="javascript:chooseTab('access_lists' );" id="dashboard_link_approved_users"><?php esc_html_e( 'approved users', 'authorizer' ); ?></a> <?php esc_html_e( '(Approved external users and all WordPress users)', 'authorizer' ); ?></label><br />
4190		- <?php
	3470	+ ?><input type="radio" id="radio_auth_settings_<?php echo $option; ?>_external_users" name="auth_settings[<?php echo $option; ?>]" value="external_users"<?php checked( 'external_users' == $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo $option; ?>_external_users"><?php _e( 'All authenticated users (All external service users and all WordPress users)', 'authorizer' ); ?></label><br />
	3471	+ <input type="radio" id="radio_auth_settings_<?php echo $option; ?>_approved_users" name="auth_settings[<?php echo $option; ?>]" value="approved_users"<?php checked( 'approved_users' == $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo $option; ?>_approved_users"><?php _e( 'Only', 'authorizer' ); ?> <a href="javascript:choose_tab('access_lists' );" id="dashboard_link_approved_users"><?php _e( 'approved users', 'authorizer' ); ?></a> <?php _e( '(Approved external users and all WordPress users)', 'authorizer' ); ?></label><br /><?php
4191	3472	}
4192	3473
4193	3474
4194		- /**
4195		- * Settings print callback.
4196		- *
4197		- * @param string $args Args (e.g., multisite admin mode).
4198		- * @return void
4199		- */
4200		- public function print_select_auth_access_role_receive_pending_emails( $args = '' ) {
	3475	+ function print_select_auth_access_role_receive_pending_emails( $args = '' ) {
4201	3476	// Get plugin option.
4202		- $option = 'access_role_receive_pending_emails';
	3477	+ $option = 'access_role_receive_pending_emails';
4203	3478	$auth_settings_option = $this->get_plugin_option( $option );
4204	3479
4205	3480	// Print option elements.
4206		- ?>
4207		- <select id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]">
4208		- <option value="---" <?php selected( $auth_settings_option, '---' ); ?>><?php esc_html_e( "None (Don't send notification emails)", 'authorizer' ); ?></option>
	3481	+ ?><select id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]">
	3482	+ <option value="---" <?php selected( $auth_settings_option, '---' ); ?>><?php _e( "None (Don't send notification emails)", 'authorizer' ); ?></option>
4209	3483	<?php wp_dropdown_roles( $auth_settings_option ); ?>
4210		- </select>
4211		- <?php
	3484	+ </select><?php
4212	3485	}
4213	3486
4214	3487
4215		- /**
4216		- * Settings print callback.
4217		- *
4218		- * @param string $args Args (e.g., multisite admin mode).
4219		- * @return void
4220		- */
4221		- public function print_wysiwyg_auth_access_pending_redirect_to_message( $args = '' ) {
	3488	+ function print_wysiwyg_auth_access_pending_redirect_to_message( $args = '' ) {
4222	3489	// Get plugin option.
4223		- $option = 'access_pending_redirect_to_message';
	3490	+ $option = 'access_pending_redirect_to_message';
4224	3491	$auth_settings_option = $this->get_plugin_option( $option );
4225	3492
4226	3493	// Print option elements.
4227	3494	wp_editor(
		@@ -4230,25 +3497,19 @@
4230	3497	array(
4231	3498	'media_buttons' => false,
4232	3499	'textarea_name' => "auth_settings[$option]",
4233	3500	'textarea_rows' => 5,
4234		- 'tinymce' => true,
4235		- 'teeny' => true,
4236		- 'quicktags' => false,
	3501	+ 'tinymce' => true,
	3502	+ 'teeny' => true,
	3503	+ 'quicktags' => false,
4237	3504	)
4238	3505	);
4239	3506	}
4240	3507
4241	3508
4242		- /**
4243		- * Settings print callback.
4244		- *
4245		- * @param string $args Args (e.g., multisite admin mode).
4246		- * @return void
4247		- */
4248		- public function print_wysiwyg_auth_access_blocked_redirect_to_message( $args = '' ) {
	3509	+ function print_wysiwyg_auth_access_blocked_redirect_to_message( $args = '' ) {
4249	3510	// Get plugin option.
4250		- $option = 'access_blocked_redirect_to_message';
	3511	+ $option = 'access_blocked_redirect_to_message';
4251	3512	$auth_settings_option = $this->get_plugin_option( $option );
4252	3513
4253	3514	// Print option elements.
4254	3515	wp_editor(
		@@ -4257,61 +3518,39 @@
4257	3518	array(
4258	3519	'media_buttons' => false,
4259	3520	'textarea_name' => "auth_settings[$option]",
4260	3521	'textarea_rows' => 5,
4261		- 'tinymce' => true,
4262		- 'teeny' => true,
4263		- 'quicktags' => false,
	3522	+ 'tinymce' => true,
	3523	+ 'teeny' => true,
	3524	+ 'quicktags' => false,
4264	3525	)
4265	3526	);
4266	3527	}
4267	3528
4268	3529
4269		- /**
4270		- * Settings print callback.
4271		- *
4272		- * @param string $args Args (e.g., multisite admin mode).
4273		- * @return void
4274		- */
4275		- public function print_checkbox_auth_access_should_email_approved_users( $args = '' ) {
	3530	+ function print_checkbox_auth_access_should_email_approved_users( $args = '' ) {
4276	3531	// Get plugin option.
4277		- $option = 'access_should_email_approved_users';
	3532	+ $option = 'access_should_email_approved_users';
4278	3533	$auth_settings_option = $this->get_plugin_option( $option );
4279	3534
4280	3535	// Print option elements.
4281		- ?>
4282		- <input type="checkbox" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="1"<?php checked( 1 === intval( $auth_settings_option ) ); ?> /><label for="auth_settings_<?php echo esc_attr( $option ); ?>"><?php esc_html_e( 'Send a welcome email when approving a new user', 'authorizer' ); ?></label>
4283		- <?php
	3536	+ ?><input type="checkbox" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="1"<?php checked( 1 == $auth_settings_option ); ?> /><label for="auth_settings_<?php echo $option; ?>"><?php _e( 'Send a welcome email when approving a new user', 'authorizer' ); ?></label><?php
4284	3537	}
4285	3538
4286	3539
4287		- /**
4288		- * Settings print callback.
4289		- *
4290		- * @param string $args Args (e.g., multisite admin mode).
4291		- * @return void
4292		- */
4293		- public function print_text_auth_access_email_approved_users_subject( $args = '' ) {
	3540	+ function print_text_auth_access_email_approved_users_subject( $args = '' ) {
4294	3541	// Get plugin option.
4295		- $option = 'access_email_approved_users_subject';
	3542	+ $option = 'access_email_approved_users_subject';
4296	3543	$auth_settings_option = $this->get_plugin_option( $option );
4297	3544
4298	3545	// Print option elements.
4299		- ?>
4300		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="Welcome to [site_name]!" style="width:320px;" /><br /><small><?php echo wp_kses( __( 'You can use the <b>[site_name]</b> shortcode.', 'authorizer' ), $this->allowed_html ); ?></small>
4301		- <?php
	3546	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="Welcome to [site_name]!" style="width:320px;" /><br /><small><?php _e( 'You can use the <b>[site_name]</b> shortcode.', 'authorizer' ); ?></small><?php
4302	3547	}
4303	3548
4304	3549
4305		- /**
4306		- * Settings print callback.
4307		- *
4308		- * @param string $args Args (e.g., multisite admin mode).
4309		- * @return void
4310		- */
4311		- public function print_wysiwyg_auth_access_email_approved_users_body( $args = '' ) {
	3550	+ function print_wysiwyg_auth_access_email_approved_users_body( $args = '' ) {
4312	3551	// Get plugin option.
4313		- $option = 'access_email_approved_users_body';
	3552	+ $option = 'access_email_approved_users_body';
4314	3553	$auth_settings_option = $this->get_plugin_option( $option );
4315	3554
4316	3555	// Print option elements.
4317	3556	wp_editor(
		@@ -4320,60 +3559,42 @@
4320	3559	array(
4321	3560	'media_buttons' => false,
4322	3561	'textarea_name' => "auth_settings[$option]",
4323	3562	'textarea_rows' => 9,
4324		- 'tinymce' => true,
4325		- 'teeny' => true,
4326		- 'quicktags' => false,
	3563	+ 'tinymce' => true,
	3564	+ 'teeny' => true,
	3565	+ 'quicktags' => false,
4327	3566	)
4328	3567	);
4329		- ?>
4330		- <small>
4331		- <?php
4332		- printf(
4333		- /* TRANSLATORS: 1: Shortcode for site name 2: Shortcode for site URL 3: Shortcode for user email */
4334		- wp_kses( __( 'You can use %1$s, %2$s, and %3$s shortcodes.', 'authorizer' ), $this->allowed_html ),
4335		- '<b>[site_name]</b>',
4336		- '<b>[site_url]</b>',
4337		- '<b>[user_email]</b>'
4338		- );
4339		- ?>
4340		- </small>
4341		- <?php
	3568	+
	3569	+ ?><small><?php printf(
	3570	+ /* TRANSLATORS: 1: Shortcode for site name 2: Shortcode for site URL 3: Shortcode for user email */
	3571	+ __( 'You can use %1$s, %2$s, and %3$s shortcodes.', 'authorizer' ),
	3572	+ '<b>[site_name]</b>',
	3573	+ '<b>[site_url]</b>',
	3574	+ '<b>[user_email]</b>'
	3575	+ ); ?></small><?php
	3576	+
4342	3577	}
4343	3578
4344	3579
4345		- /**
4346		- * Settings print callback.
4347		- *
4348		- * @param string $args Args (e.g., multisite admin mode).
4349		- * @return void
4350		- */
4351		- public function print_section_info_access_public( $args = '' ) {
4352		- ?>
4353		- <div id="section_info_access_public" class="section_info">
4354		- <p><?php esc_html_e( 'Choose your public access options here.', 'authorizer' ); ?></p>
4355		- </div>
4356		- <?php
	3580	+ function print_section_info_access_public( $args = '' ) {
	3581	+ ?><div id="section_info_access_public" class="section_info">
	3582	+ <p><?php _e( 'Choose your public access options here.', 'authorizer' ); ?></p>
	3583	+ </div><?php
4357	3584	}
4358	3585
4359	3586
4360		- /**
4361		- * Settings print callback.
4362		- *
4363		- * @param string $args Args (e.g., multisite admin mode).
4364		- * @return void
4365		- */
4366		- public function print_radio_auth_access_who_can_view( $args = '' ) {
	3587	+ function print_radio_auth_access_who_can_view( $args = '' ) {
4367	3588	// Get plugin option.
4368		- $option = 'access_who_can_view';
4369		- $admin_mode = $this->get_admin_mode( $args );
	3589	+ $option = 'access_who_can_view';
	3590	+ $admin_mode = $this->get_admin_mode( $args );
4370	3591	$auth_settings_option = $this->get_plugin_option( $option, $admin_mode, 'allow override', 'print overlay' );
4371	3592
4372	3593	// If this site is configured independently of any multisite overrides, make sure we are not grabbing the multisite value; otherwise, grab the multisite value to show behind the disabled overlay.
4373		- if ( is_multisite() && 1 === intval( $this->get_plugin_option( 'advanced_override_multisite' ) ) ) {
	3594	+ if ( is_multisite() && $this->get_plugin_option( 'advanced_override_multisite' ) == '1' ) {
4374	3595	$auth_settings_option = $this->get_plugin_option( $option );
4375		- } elseif ( is_multisite() && WP_Plugin_Authorizer::SINGLE_CONTEXT === $admin_mode && '1' === $this->get_plugin_option( 'multisite_override', WP_Plugin_Authorizer::NETWORK_CONTEXT ) ) {
	3596	+ } elseif ( is_multisite() && $admin_mode === SINGLE_ADMIN && $this->get_plugin_option( 'multisite_override', MULTISITE_ADMIN ) === '1' ) {
4376	3597	// Workaround: javascript code hides/shows other settings based
4377	3598	// on the selection in this option. If this option is overridden
4378	3599	// by a multisite option, it should show that value in order to
4379	3600	// correctly display the other appropriate options.
		@@ -4379,66 +3600,42 @@
4379	3600	// correctly display the other appropriate options.
4380	3601	// Side effect: this site option will be overwritten by the
4381	3602	// multisite option on save. Since this is a 2-item radio, we
4382	3603	// determined this was acceptable.
4383		- $auth_settings_option = $this->get_plugin_option( $option, WP_Plugin_Authorizer::NETWORK_CONTEXT );
	3604	+ $auth_settings_option = $this->get_plugin_option( $option, MULTISITE_ADMIN );
4384	3605	}
4385	3606
4386	3607	// Print option elements.
4387		- ?>
4388		- <input type="radio" id="radio_auth_settings_<?php echo esc_attr( $option ); ?>_everyone" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="everyone"<?php checked( 'everyone' === $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo esc_attr( $option ); ?>_everyone"><?php esc_html_e( 'Everyone can see the site', 'authorizer' ); ?></label><br />
4389		- <input type="radio" id="radio_auth_settings_<?php echo esc_attr( $option ); ?>_logged_in_users" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="logged_in_users"<?php checked( 'logged_in_users' === $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo esc_attr( $option ); ?>_logged_in_users"><?php esc_html_e( 'Only logged in users can see the site', 'authorizer' ); ?></label><br />
4390		- <?php
	3608	+ ?><input type="radio" id="radio_auth_settings_<?php echo $option; ?>_everyone" name="auth_settings[<?php echo $option; ?>]" value="everyone"<?php checked( 'everyone' == $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo $option; ?>_everyone"><?php _e( 'Everyone can see the site', 'authorizer' ); ?></label><br />
	3609	+ <input type="radio" id="radio_auth_settings_<?php echo $option; ?>_logged_in_users" name="auth_settings[<?php echo $option; ?>]" value="logged_in_users"<?php checked( 'logged_in_users' == $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo $option; ?>_logged_in_users"><?php _e( 'Only logged in users can see the site', 'authorizer' ); ?></label><br /><?php
4391	3610	}
4392	3611
4393	3612
4394		- /**
4395		- * Settings print callback.
4396		- *
4397		- * @param string $args Args (e.g., multisite admin mode).
4398		- * @return void
4399		- */
4400		- public function print_radio_auth_access_redirect( $args = '' ) {
	3613	+ function print_radio_auth_access_redirect( $args = '' ) {
4401	3614	// Get plugin option.
4402		- $option = 'access_redirect';
	3615	+ $option = 'access_redirect';
4403	3616	$auth_settings_option = $this->get_plugin_option( $option );
4404	3617
4405	3618	// Print option elements.
4406		- ?>
4407		- <input type="radio" id="radio_auth_settings_<?php echo esc_attr( $option ); ?>_to_login" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="login"<?php checked( 'login' === $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo esc_attr( $option ); ?>_to_login"><?php esc_html_e( 'Send them to the login screen', 'authorizer' ); ?></label><br />
4408		- <input type="radio" id="radio_auth_settings_<?php echo esc_attr( $option ); ?>_to_message" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="message"<?php checked( 'message' === $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo esc_attr( $option ); ?>_to_message"><?php esc_html_e( 'Show them the anonymous access message (below)', 'authorizer' ); ?></label>
4409		- <?php
	3619	+ ?><input type="radio" id="radio_auth_settings_<?php echo $option; ?>_to_login" name="auth_settings[<?php echo $option; ?>]" value="login"<?php checked( 'login' == $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo $option; ?>_to_login"><?php _e( 'Send them to the login screen', 'authorizer' ); ?></label><br />
	3620	+ <input type="radio" id="radio_auth_settings_<?php echo $option; ?>_to_message" name="auth_settings[<?php echo $option; ?>]" value="message"<?php checked( 'message' == $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo $option; ?>_to_message"><?php _e( 'Show them the anonymous access message (below)', 'authorizer' ); ?></label><?php
4410	3621	}
4411	3622
4412	3623
4413		- /**
4414		- * Settings print callback.
4415		- *
4416		- * @param string $args Args (e.g., multisite admin mode).
4417		- * @return void
4418		- */
4419		- public function print_radio_auth_access_public_warning( $args = '' ) {
	3624	+ function print_radio_auth_access_public_warning( $args = '' ) {
4420	3625	// Get plugin option.
4421		- $option = 'access_public_warning';
	3626	+ $option = 'access_public_warning';
4422	3627	$auth_settings_option = $this->get_plugin_option( $option );
4423	3628
4424	3629	// Print option elements.
4425		- ?>
4426		- <input type="radio" id="radio_auth_settings_<?php echo esc_attr( $option ); ?>_no" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="no_warning"<?php checked( 'no_warning' === $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo esc_attr( $option ); ?>_no"><?php echo wp_kses( __( 'Show them the page <strong>without</strong> the anonymous access message', 'authorizer' ), $this->allowed_html ); ?></label><br />
4427		- <input type="radio" id="radio_auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="warning"<?php checked( 'warning' === $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo esc_attr( $option ); ?>"><?php echo wp_kses( __( 'Show them the page <strong>with</strong> the anonymous access message (marked up as a <a href="http://getbootstrap.com/components/#alerts-dismissible" target="_blank">Bootstrap Dismissible Alert</a>)', 'authorizer' ), $this->allowed_html ); ?></label>
4428		- <?php
	3630	+ ?><input type="radio" id="radio_auth_settings_<?php echo $option; ?>_no" name="auth_settings[<?php echo $option; ?>]" value="no_warning"<?php checked( 'no_warning' == $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo $option; ?>_no"><?php _e( 'Show them the page <strong>without</strong> the anonymous access message', 'authorizer' ); ?></label><br />
	3631	+ <input type="radio" id="radio_auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="warning"<?php checked( 'warning' == $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo $option; ?>"><?php _e( 'Show them the page <strong>with</strong> the anonymous access message (marked up as a <a href="http://getbootstrap.com/components/#alerts-dismissible" target="_blank">Bootstrap Dismissible Alert</a>)', 'authorizer' ); ?></label><?php
4429	3632	}
4430	3633
4431	3634
4432		- /**
4433		- * Settings print callback.
4434		- *
4435		- * @param string $args Args (e.g., multisite admin mode).
4436		- * @return void
4437		- */
4438		- public function print_wysiwyg_auth_access_redirect_to_message( $args = '' ) {
	3635	+ function print_wysiwyg_auth_access_redirect_to_message( $args = '' ) {
4439	3636	// Get plugin option.
4440		- $option = 'access_redirect_to_message';
	3637	+ $option = 'access_redirect_to_message';
4441	3638	$auth_settings_option = $this->get_plugin_option( $option );
4442	3639
4443	3640	// Print option elements.
4444	3641	wp_editor(
		@@ -4447,25 +3644,19 @@
4447	3644	array(
4448	3645	'media_buttons' => false,
4449	3646	'textarea_name' => "auth_settings[$option]",
4450	3647	'textarea_rows' => 5,
4451		- 'tinymce' => true,
4452		- 'teeny' => true,
4453		- 'quicktags' => false,
	3648	+ 'tinymce' => true,
	3649	+ 'teeny' => true,
	3650	+ 'quicktags' => false,
4454	3651	)
4455	3652	);
4456	3653	}
4457	3654
4458	3655
4459		- /**
4460		- * Settings print callback.
4461		- *
4462		- * @param string $args Args (e.g., multisite admin mode).
4463		- * @return void
4464		- */
4465		- public function print_multiselect_auth_access_public_pages( $args = '' ) {
	3656	+ function print_multiselect_auth_access_public_pages( $args = '' ) {
4466	3657	// Get plugin option.
4467		- $option = 'access_public_pages';
	3658	+ $option = 'access_public_pages';
4468	3659	$auth_settings_option = $this->get_plugin_option( $option );
4469	3660	$auth_settings_option = is_array( $auth_settings_option ) ? $auth_settings_option : array();
4470	3661
4471	3662	$post_types = array_merge( array( 'page', 'post' ), get_post_types( array( '_builtin' => false ), 'names' ) );
		@@ -4471,31 +3662,23 @@
4471	3662	$post_types = array_merge( array( 'page', 'post' ), get_post_types( array( '_builtin' => false ), 'names' ) );
4472	3663	$post_types = is_array( $post_types ) ? $post_types : array();
4473	3664
4474	3665	// Print option elements.
4475		- ?>
4476		- <select id="auth_settings_<?php echo esc_attr( $option ); ?>" multiple="multiple" name="auth_settings[<?php echo esc_attr( $option ); ?>][]">
4477		- <optgroup label="<?php esc_attr_e( 'Home', 'authorizer' ); ?>">
4478		- <option value="home" <?php selected( in_array( 'home', $auth_settings_option, true ) ); ?>><?php esc_html_e( 'Home Page', 'authorizer' ); ?></option>
4479		- <option value="auth_public_404" <?php selected( in_array( 'auth_public_404', $auth_settings_option, true ) ); ?>><?php esc_html_e( 'Nonexistent (404) Pages', 'authorizer' ); ?></option>
	3666	+ ?><select id="auth_settings_<?php echo $option; ?>" multiple="multiple" name="auth_settings[<?php echo $option; ?>][]">
	3667	+ <optgroup label="<?php _e( 'Home', 'authorizer' ); ?>">
	3668	+ <option value="home" <?php echo in_array( 'home', $auth_settings_option ) ? 'selected="selected"' : ''; ?>><?php _e( 'Home Page', 'authorizer' ); ?></option>
	3669	+ <option value="auth_public_404" <?php echo in_array( 'auth_public_404', $auth_settings_option ) ? 'selected="selected"' : ''; ?>><?php _e( 'Nonexistent (404) Pages', 'authorizer' ); ?></option>
4480	3670	</optgroup>
4481		- <?php foreach ( $post_types as $post_type ) : ?>
4482		- <optgroup label="<?php echo esc_attr( ucfirst( $post_type ) ); ?>">
4483		- <?php
4484		- $pages = get_posts(
4485		- array(
4486		- 'post_type' => $post_type,
4487		- 'posts_per_page' => 1000, // phpcs:ignore WordPress.VIP.PostsPerPage.posts_per_page_posts_per_page
4488		- )
4489		- );
4490		- $pages = is_array( $pages ) ? $pages : array();
4491		- foreach ( $pages as $page ) :
4492		- ?>
4493		- <option value="<?php echo esc_attr( $page->ID ); ?>" <?php selected( in_array( strval( $page->ID ), $auth_settings_option, true ) ); ?>><?php echo esc_html( $page->post_title ); ?></option>
	3671	+ <?php foreach ( $post_types as $post_type ): ?>
	3672	+ <optgroup label="<?php echo ucfirst( $post_type ); ?>">
	3673	+ <?php $pages = get_posts( array( 'post_type' => $post_type, 'posts_per_page' => -1 ) ); ?>
	3674	+ <?php $pages = is_array( $pages ) ? $pages : array(); ?>
	3675	+ <?php foreach ( $pages as $page ): ?>
	3676	+ <option value="<?php echo $page->ID; ?>" <?php echo in_array( $page->ID, $auth_settings_option ) ? 'selected="selected"' : ''; ?>><?php echo $page->post_title; ?></option>
4494	3677	<?php endforeach; ?>
4495	3678	</optgroup>
4496	3679	<?php endforeach; ?>
4497		- <optgroup label="<?php esc_attr_e( 'Categories', 'authorizer' ); ?>">
	3680	+ <optgroup label="<?php _e( 'Categories', 'authorizer' ); ?>">
4498	3681	<?php
4499	3682	// If sitepress-multilingual-cms plugin is enabled, temporarily disable
4500	3683	// its terms_clauses filter since it conflicts with the category handling.
4501	3684	if ( array_key_exists( 'sitepress', $GLOBALS ) && is_object( $GLOBALS['sitepress'] ) ) {
		@@ -4504,155 +3687,107 @@
4504	3687	add_filter( 'terms_clauses', array( $GLOBALS['sitepress'], 'terms_clauses' ) );
4505	3688	} else {
4506	3689	$categories = get_categories( array( 'hide_empty' => false ) );
4507	3690	}
4508		- foreach ( $categories as $category ) :
4509		- ?>
4510		- <option value="<?php echo esc_attr( 'cat_' . $category->slug ); ?>" <?php selected( in_array( 'cat_' . $category->slug, $auth_settings_option, true ) ); ?>><?php echo esc_html( $category->name ); ?></option>
	3691	+ foreach ( $categories as $category ) : ?>
	3692	+ <option value="<?php echo 'cat_' . $category->slug; ?>" <?php echo in_array( 'cat_' . $category->slug, $auth_settings_option ) ? 'selected="selected"' : ''; ?>><?php echo $category->name; ?></option>
4511	3693	<?php endforeach; ?>
4512	3694	</optgroup>
4513		- </select>
4514		- <?php
	3695	+ </select><?php
4515	3696	}
4516	3697
4517	3698
4518		- /**
4519		- * Settings print callback.
4520		- *
4521		- * @param string $args Args (e.g., multisite admin mode).
4522		- * @return void
4523		- */
4524		- public function print_section_info_external( $args = '' ) {
4525		- ?>
4526		- <div id="section_info_external" class="section_info">
4527		- <p><?php esc_html_e( 'Enter your external server settings below.', 'authorizer' ); ?></p>
4528		- </div>
4529		- <?php
	3699	+ function print_section_info_external( $args = '' ) {
	3700	+ ?><div id="section_info_external" class="section_info">
	3701	+ <p><?php _e( 'Enter your external server settings below.', 'authorizer' ); ?></p>
	3702	+ </div><?php
4530	3703	}
4531	3704
4532	3705
4533		- /**
4534		- * Settings print callback.
4535		- *
4536		- * @param string $args Args (e.g., multisite admin mode).
4537		- * @return void
4538		- */
4539		- public function print_select_auth_access_default_role( $args = '' ) {
	3706	+ function get_admin_mode( $args ) {
	3707	+ if ( is_array( $args ) && array_key_exists( MULTISITE_ADMIN, $args ) && $args[MULTISITE_ADMIN] === true ) {
	3708	+ return MULTISITE_ADMIN;
	3709	+ } else {
	3710	+ return SINGLE_ADMIN;
	3711	+ }
	3712	+ }
	3713	+
	3714	+
	3715	+ function print_select_auth_access_default_role( $args = '' ) {
4540	3716	// Get plugin option.
4541		- $option = 'access_default_role';
	3717	+ $option = 'access_default_role';
4542	3718	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4543	3719
4544	3720	// Print option elements.
4545		- ?>
4546		- <select id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]">
	3721	+ ?><select id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]">
4547	3722	<?php wp_dropdown_roles( $auth_settings_option ); ?>
4548		- <option value=""<?php selected( '' === $auth_settings_option ); ?>><?php esc_html_e( '-- None --', 'authorizer' ); ?></option>
4549		- </select>
4550		- <?php
	3723	+ </select><?php
4551	3724	}
4552	3725
4553	3726
4554		- /**
4555		- * Settings print callback.
4556		- *
4557		- * @param string $args Args (e.g., multisite admin mode).
4558		- * @return void
4559		- */
4560		- public function print_checkbox_auth_external_google( $args = '' ) {
	3727	+ function print_checkbox_auth_external_google( $args = '' ) {
4561	3728	// Get plugin option.
4562		- $option = 'google';
	3729	+ $option = 'google';
4563	3730	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4564	3731
4565	3732	// Print option elements.
4566		- ?>
4567		- <input type="checkbox" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="1"<?php checked( 1 === intval( $auth_settings_option ) ); ?> /><label for="auth_settings_<?php echo esc_attr( $option ); ?>"><?php esc_html_e( 'Enable Google Logins', 'authorizer' ); ?></label>
4568		- <?php
	3733	+ ?><input type="checkbox" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="1"<?php checked( 1 == $auth_settings_option ); ?> /><label for="auth_settings_<?php echo $option; ?>"><?php _e( 'Enable Google Logins', 'authorizer' ); ?></label><?php
4569	3734	}
4570	3735
4571	3736
4572		- /**
4573		- * Settings print callback.
4574		- *
4575		- * @param string $args Args (e.g., multisite admin mode).
4576		- * @return void
4577		- */
4578		- public function print_text_google_clientid( $args = '' ) {
	3737	+ function print_text_google_clientid( $args = '' ) {
4579	3738	// Get plugin option.
4580		- $option = 'google_clientid';
	3739	+ $option = 'google_clientid';
4581	3740	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4582	3741
4583	3742	// Print option elements.
4584		- $site_url_parts = wp_parse_url( get_site_url() );
4585		- $site_url_host = $site_url_parts['scheme'] . '://' . $site_url_parts['host'] . '/';
4586		-
4587		- esc_html_e( "If you don't have a Google Client ID and Secret, generate them by following these instructions:", 'authorizer' );
4588		- ?>
	3743	+ $site_url_parts = parse_url( get_site_url() );
	3744	+ $site_url_host = $site_url_parts['scheme'] . '://' . $site_url_parts['host'] . '/';
	3745	+ ?><?php _e( "If you don't have a Google Client ID and Secret, generate them by following these instructions:", 'authorizer' ); ?>
4589	3746	<ol>
4590		- <li><?php echo wp_kses( __( 'Click <strong>Create a Project</strong> on the <a href="https://cloud.google.com/console" target="_blank">Google Developers Console</a>. You can name it whatever you want.', 'authorizer' ), $this->allowed_html ); ?></li>
4591		- <li><?php echo wp_kses( __( 'Within the project, navigate to <em>APIs and Auth</em> &gt; <em>Credentials</em>, then click <strong>Create New Client ID</strong> under OAuth. Use these settings:', 'authorizer' ), $this->allowed_html ); ?>
	3747	+ <li><?php _e( 'Click <strong>Create a Project</strong> on the <a href="https://cloud.google.com/console" target="_blank">Google Developers Console</a>. You can name it whatever you want.', 'authorizer' ); ?></li>
	3748	+ <li><?php _e( 'Within the project, navigate to <em>APIs and Auth</em> &gt; <em>Credentials</em>, then click <strong>Create New Client ID</strong> under OAuth. Use these settings:', 'authorizer' ); ?>
4592	3749	<ul>
4593		- <li><?php echo wp_kses( __( 'Application Type: <strong>Web application</strong>', 'authorizer' ), $this->allowed_html ); ?></li>
4594		- <li><?php esc_html_e( 'Authorized Javascript Origins:', 'authorizer' ); ?> <strong><?php echo esc_html( rtrim( $site_url_host, '/' ) ); ?></strong></li>
4595		- <li><?php echo wp_kses( __( 'Authorized Redirect URI: <em>none</em>', 'authorizer' ), $this->allowed_html ); ?></li>
	3750	+ <li><?php _e( 'Application Type: <strong>Web application</strong>', 'authorizer' ); ?></li>
	3751	+ <li><?php _e( 'Authorized Javascript Origins:', 'authorizer' ); ?> <strong><?php echo rtrim( $site_url_host, '/' ); ?></strong></li>
	3752	+ <li><?php _e( 'Authorized Redirect URI: <em>none</em>', 'authorizer' ); ?></li>
4596	3753	</ul>
4597	3754	</li>
4598		- <li><?php esc_html_e( 'Copy/paste your new Client ID/Secret pair into the fields below.', 'authorizer' ); ?></li>
4599		- <li><?php echo wp_kses( __( '<strong>Note</strong>: Navigate to <em>APIs and Auth</em> &gt; <em>Consent screen</em> to change the way the Google consent screen appears after a user has successfully entered their password, but before they are redirected back to WordPress.', 'authorizer' ), $this->allowed_html ); ?></li>
4600		- <li><?php echo wp_kses( __( 'Note: Google may have a more recent version of these instructions in their <a href="https://developers.google.com/identity/sign-in/web/devconsole-project" target="_blank">developer documentation</a>.', 'authorizer' ), $this->allowed_html ); ?></li>
	3755	+ <li><?php _e( 'Copy/paste your new Client ID/Secret pair into the fields below.', 'authorizer' ); ?></li>
	3756	+ <li><?php _e( '<strong>Note</strong>: Navigate to <em>APIs and Auth</em> &gt; <em>Consent screen</em> to change the way the Google consent screen appears after a user has successfully entered their password, but before they are redirected back to WordPress.', 'authorizer' ); ?></li>
	3757	+ <li><?php _e( 'Note: Google may have a more recent version of these instructions in their <a href="https://developers.google.com/identity/sign-in/web/devconsole-project" target="_blank">developer documentation</a>.', 'authorizer' ); ?></li>
4601	3758	</ol>
4602		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" style="width:560px;" />
4603		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: 1234567890123-kdjr85yt6vjr6d8g7dhr8g7d6durjf7g.apps.googleusercontent.com', 'authorizer' ); ?></label>
4604		- <?php
	3759	+ <input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" style="width:560px;" />
	3760	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: 1234567890123-kdjr85yt6vjr6d8g7dhr8g7d6durjf7g.apps.googleusercontent.com', 'authorizer'); ?></label><?php
4605	3761	}
4606	3762
4607	3763
4608		- /**
4609		- * Settings print callback.
4610		- *
4611		- * @param string $args Args (e.g., multisite admin mode).
4612		- * @return void
4613		- */
4614		- public function print_text_google_clientsecret( $args = '' ) {
	3764	+ function print_text_google_clientsecret( $args = '' ) {
4615	3765	// Get plugin option.
4616		- $option = 'google_clientsecret';
	3766	+ $option = 'google_clientsecret';
4617	3767	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4618	3768
4619	3769	// Print option elements.
4620		- ?>
4621		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" style="width:220px;" />
4622		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: sDNgX5_pr_5bly-frKmvp8jT', 'authorizer' ); ?></label>
4623		- <?php
	3770	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" style="width:220px;" />
	3771	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: sDNgX5_pr_5bly-frKmvp8jT', 'authorizer'); ?></label><?php
4624	3772	}
4625	3773
4626	3774
4627		- /**
4628		- * Settings print callback.
4629		- *
4630		- * @param string $args Args (e.g., multisite admin mode).
4631		- * @return void
4632		- */
4633		- public function print_text_google_hosteddomain( $args = '' ) {
	3775	+ function print_text_google_hosteddomain( $args = '' ) {
4634	3776	// Get plugin option.
4635		- $option = 'google_hosteddomain';
	3777	+ $option = 'google_hosteddomain';
4636	3778	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4637	3779
4638	3780	// Print option elements.
4639		- ?>
4640		- <textarea id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" placeholder="" style="width:220px;"><?php echo esc_html( $auth_settings_option ); ?></textarea>
4641		- <br /><small><?php esc_html_e( 'Restrict Google logins to a specific Google Apps hosted domain (for example, mycollege.edu). Leave blank to allow all Google sign-ins.', 'authorizer' ); ?><br /><?php esc_html_e( 'If restricting to multiple domains, add one domain per line.', 'authorizer' ); ?></small>
	3781	+ ?><textarea id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" placeholder="" style="width:220px;"><?php echo $auth_settings_option; ?></textarea>
	3782	+ <br /><small><?php _e( 'Restrict Google logins to a specific Google Apps hosted domain (for example, mycollege.edu). Leave blank to allow all Google sign-ins.', 'authorizer' ); ?><br /><?php _e( 'If restricting to multiple domains, add one domain per line.', 'authorizer' ); ?></small>
4642	3783	<?php
4643	3784	}
4644	3785
4645	3786
4646		- /**
4647		- * Settings print callback.
4648		- *
4649		- * @param string $args Args (e.g., multisite admin mode).
4650		- * @return void
4651		- */
4652		- public function print_checkbox_auth_external_cas( $args = '' ) {
	3787	+ function print_checkbox_auth_external_cas( $args = '' ) {
4653	3788	// Get plugin option.
4654		- $option = 'cas';
	3789	+ $option = 'cas';
4655	3790	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4656	3791
4657	3792	// Make sure php5-curl extension is installed on server.
4658	3793	$curl_installed_message = ! function_exists( 'curl_init' ) ? __( '<a href="http://www.php.net//manual/en/curl.installation.php" target="_blank" style="color: red;">PHP CURL extension</a> is not installed', 'authorizer' ) : '';
		@@ -4671,217 +3806,128 @@
4671	3806	')</span>';
4672	3807	}
4673	3808
4674	3809	// Print option elements.
4675		- ?>
4676		- <input type="checkbox" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="1"<?php checked( 1 === intval( $auth_settings_option ) ); ?> /><label for="auth_settings_<?php echo esc_attr( $option ); ?>"><?php esc_html_e( 'Enable CAS Logins', 'authorizer' ); ?></label> <?php echo wp_kses( $error_message, $this->allowed_html ); ?>
4677		- <?php
	3810	+ ?><input type="checkbox" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="1"<?php checked( 1 == $auth_settings_option ); ?> /><label for="auth_settings_<?php echo $option; ?>"><?php _e( 'Enable CAS Logins', 'authorizer' ); ?></label> <?php echo $error_message; ?><?php
4678	3811	}
4679	3812
4680	3813
4681		- /**
4682		- * Settings print callback.
4683		- *
4684		- * @param string $args Args (e.g., multisite admin mode).
4685		- * @return void
4686		- */
4687		- public function print_text_cas_custom_label( $args = '' ) {
	3814	+ function print_text_cas_custom_label( $args = '' ) {
4688	3815	// Get plugin option.
4689		- $option = 'cas_custom_label';
	3816	+ $option = 'cas_custom_label';
4690	3817	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4691	3818
4692	3819	// Print option elements.
4693		- esc_html_e( 'The button on the login page will read:', 'authorizer' );
4694		- ?>
4695		- <p><a class="button-primary button-large" style="padding: 3px 16px; height: 36px;"><span class="dashicons dashicons-lock" style="margin: 4px 4px 0 0;"></span> <strong><?php esc_html_e( 'Sign in with', 'authorizer' ); ?> </strong><input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="CAS" style="width: 100px;" /></a></p>
4696		- <?php
	3820	+ ?><?php _e( 'The button on the login page will read:', 'authorizer' ); ?><p><a class="button-primary button-large" style="padding: 3px 16px; height: 36px;"><span class="dashicons dashicons-lock" style="margin: 4px 4px 0 0;"></span> <strong><?php _e( 'Sign in with', 'authorizer' ); ?> </strong><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="CAS" style="width: 100px;" /></a></p><?php
4697	3821	}
4698	3822
4699	3823
4700		- /**
4701		- * Settings print callback.
4702		- *
4703		- * @param string $args Args (e.g., multisite admin mode).
4704		- * @return void
4705		- */
4706		- public function print_text_cas_host( $args = '' ) {
	3824	+ function print_text_cas_host( $args = '' ) {
4707	3825	// Get plugin option.
4708		- $option = 'cas_host';
	3826	+ $option = 'cas_host';
4709	3827	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4710	3828
4711	3829	// Print option elements.
4712		- ?>
4713		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" />
4714		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: authn.example.edu', 'authorizer' ); ?></label>
4715		- <?php
	3830	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" />
	3831	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: authn.example.edu', 'authorizer'); ?></label><?php
4716	3832	}
4717	3833
4718	3834
4719		- /**
4720		- * Settings print callback.
4721		- *
4722		- * @param string $args Args (e.g., multisite admin mode).
4723		- * @return void
4724		- */
4725		- public function print_text_cas_port( $args = '' ) {
	3835	+ function print_text_cas_port( $args = '' ) {
4726	3836	// Get plugin option.
4727		- $option = 'cas_port';
	3837	+ $option = 'cas_port';
4728	3838	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4729	3839
4730	3840	// Print option elements.
4731		- ?>
4732		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" style="width:50px;" />
4733		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: 443', 'authorizer' ); ?></label>
4734		- <?php
	3841	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" style="width:50px;" />
	3842	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: 443', 'authorizer'); ?></label><?php
4735	3843	}
4736	3844
4737	3845
4738		- /**
4739		- * Settings print callback.
4740		- *
4741		- * @param string $args Args (e.g., multisite admin mode).
4742		- * @return void
4743		- */
4744		- public function print_text_cas_path( $args = '' ) {
	3846	+ function print_text_cas_path( $args = '' ) {
4745	3847	// Get plugin option.
4746		- $option = 'cas_path';
	3848	+ $option = 'cas_path';
4747	3849	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4748	3850
4749	3851	// Print option elements.
4750		- ?>
4751		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" />
4752		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: /cas', 'authorizer' ); ?></label>
4753		- <?php
	3852	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" />
	3853	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: /cas', 'authorizer'); ?></label><?php
4754	3854	}
4755	3855
4756	3856
4757		- /**
4758		- * Settings print callback.
4759		- *
4760		- * @param string $args Args (e.g., multisite admin mode).
4761		- * @return void
4762		- */
4763		- public function print_select_cas_version( $args = '' ) {
	3857	+ function print_select_cas_version( $args = '' ) {
4764	3858	// Get plugin option.
4765		- $option = 'cas_version';
	3859	+ $option = 'cas_version';
4766	3860	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4767	3861
4768	3862	// Print option elements.
4769		- ?>
4770		- <select id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]">
	3863	+ ?><select id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]">
4771	3864	<option value="SAML_VERSION_1_1" <?php selected( $auth_settings_option, 'SAML_VERSION_1_1' ); ?>>SAML_VERSION_1_1</option>
4772	3865	<option value="CAS_VERSION_3_0" <?php selected( $auth_settings_option, 'CAS_VERSION_3_0' ); ?>>CAS_VERSION_3_0</option>
4773	3866	<option value="CAS_VERSION_2_0" <?php selected( $auth_settings_option, 'CAS_VERSION_2_0' ); ?>>CAS_VERSION_2_0</option>
4774	3867	<option value="CAS_VERSION_1_0" <?php selected( $auth_settings_option, 'CAS_VERSION_1_0' ); ?>>CAS_VERSION_1_0</option>
4775		- </select>
4776		- <?php
	3868	+ </select><?php
4777	3869	}
4778	3870
4779	3871
4780		- /**
4781		- * Settings print callback.
4782		- *
4783		- * @param string $args Args (e.g., multisite admin mode).
4784		- * @return void
4785		- */
4786		- public function print_text_cas_attr_email( $args = '' ) {
	3872	+ function print_text_cas_attr_email( $args = '' ) {
4787	3873	// Get plugin option.
4788		- $option = 'cas_attr_email';
	3874	+ $option = 'cas_attr_email';
4789	3875	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4790	3876
4791	3877	// Print option elements.
4792		- ?>
4793		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" />
4794		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: mail', 'authorizer' ); ?></label>
4795		- <br /><small><?php echo wp_kses( __( "Note: If your CAS server doesn't return an attribute containing an email, you can specify the @domain portion of the email address here, and the email address will be constructed from it and the username. For example, if user 'bob' logs in and his email address should be bob@example.edu, then enter <strong>@example.edu</strong> in this field.", 'authorizer' ), $this->allowed_html ); ?></small>
4796		- <?php
	3878	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" />
	3879	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: mail', 'authorizer'); ?></label>
	3880	+ <br /><small><?php _e( "Note: If your CAS server doesn't return an attribute containing an email, you can specify the @domain portion of the email address here, and the email address will be constructed from it and the username. For example, if user 'bob' logs in and his email address should be bob@example.edu, then enter <strong>@example.edu</strong> in this field.", 'authorizer' ); ?></small><?php
4797	3881	}
4798	3882
4799	3883
4800		- /**
4801		- * Settings print callback.
4802		- *
4803		- * @param string $args Args (e.g., multisite admin mode).
4804		- * @return void
4805		- */
4806		- public function print_text_cas_attr_first_name( $args = '' ) {
	3884	+ function print_text_cas_attr_first_name( $args = '' ) {
4807	3885	// Get plugin option.
4808		- $option = 'cas_attr_first_name';
	3886	+ $option = 'cas_attr_first_name';
4809	3887	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4810	3888
4811	3889	// Print option elements.
4812		- ?>
4813		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" />
4814		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: givenName', 'authorizer' ); ?></label>
4815		- <?php
	3890	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" />
	3891	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: givenName', 'authorizer'); ?></label><?php
4816	3892	}
4817	3893
4818	3894
4819		- /**
4820		- * Settings print callback.
4821		- *
4822		- * @param string $args Args (e.g., multisite admin mode).
4823		- * @return void
4824		- */
4825		- public function print_text_cas_attr_last_name( $args = '' ) {
	3895	+ function print_text_cas_attr_last_name( $args = '' ) {
4826	3896	// Get plugin option.
4827		- $option = 'cas_attr_last_name';
	3897	+ $option = 'cas_attr_last_name';
4828	3898	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4829	3899
4830	3900	// Print option elements.
4831		- ?>
4832		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" />
4833		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: sn', 'authorizer' ); ?></label>
4834		- <?php
	3901	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" />
	3902	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: sn', 'authorizer'); ?></label><?php
4835	3903	}
4836	3904
4837	3905
4838		- /**
4839		- * Settings print callback.
4840		- *
4841		- * @param string $args Args (e.g., multisite admin mode).
4842		- * @return void
4843		- */
4844		- public function print_checkbox_cas_attr_update_on_login( $args = '' ) {
	3906	+ function print_checkbox_cas_attr_update_on_login( $args = '' ) {
4845	3907	// Get plugin option.
4846		- $option = 'cas_attr_update_on_login';
	3908	+ $option = 'cas_attr_update_on_login';
4847	3909	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4848	3910
4849	3911	// Print option elements.
4850		- ?>
4851		- <input type="checkbox" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="1"<?php checked( 1 === intval( $auth_settings_option ) ); ?> /><label for="auth_settings_<?php echo esc_attr( $option ); ?>"><?php esc_html_e( 'Update first and last name fields on login (will overwrite any name the user has supplied in their profile)', 'authorizer' ); ?></label>
4852		- <?php
	3912	+ ?><input type="checkbox" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="1"<?php checked( 1 == $auth_settings_option ); ?> /><label for="auth_settings_<?php echo $option; ?>"><?php _e( 'Update first and last name fields on login (will overwrite any name the user has supplied in their profile)', 'authorizer' ); ?></label><?php
4853	3913	}
4854	3914
4855	3915
4856		- /**
4857		- * Settings print callback.
4858		- *
4859		- * @param string $args Args (e.g., multisite admin mode).
4860		- * @return void
4861		- */
4862		- public function print_checkbox_cas_auto_login( $args = '' ) {
	3916	+ function print_checkbox_cas_auto_login( $args = '' ) {
4863	3917	// Get plugin option.
4864		- $option = 'cas_auto_login';
	3918	+ $option = 'cas_auto_login';
4865	3919	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4866	3920
4867	3921	// Print option elements.
4868		- ?>
4869		- <input type="checkbox" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="1"<?php checked( 1 === intval( $auth_settings_option ) ); ?> /><label for="auth_settings_<?php echo esc_attr( $option ); ?>"><?php esc_html_e( "Immediately redirect to CAS login form if it's the only enabled external service and WordPress logins are hidden", 'authorizer' ); ?></label>
4870		- <p><small><?php esc_html_e( 'Note: This feature will only work if you have checked "Hide WordPress Logins" in Advanced settings, and if CAS is the only enabled service (i.e., no Google or LDAP). If you have enabled CAS Single Sign-On (SSO), and a user has already logged into CAS elsewhere, enabling this feature will allow automatic logins without any user interaction.', 'authorizer' ); ?></small></p>
4871		- <?php
	3922	+ ?><input type="checkbox" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="1"<?php checked( 1 == $auth_settings_option ); ?> /><label for="auth_settings_<?php echo $option; ?>"><?php _e( "Immediately redirect to CAS login form if it's the only enabled external service and WordPress logins are hidden", 'authorizer' ); ?></label>
	3923	+ <p><small><?php _e( 'Note: This feature will only work if you have checked "Hide WordPress Logins" in Advanced settings, and if CAS is the only enabled service (i.e., no Google or LDAP). If you have enabled CAS Single Sign-On (SSO), and a user has already logged into CAS elsewhere, enabling this feature will allow automatic logins without any user interaction.', 'authorizer' ); ?></small></p><?php
4872	3924	}
4873	3925
4874	3926
4875		- /**
4876		- * Settings print callback.
4877		- *
4878		- * @param string $args Args (e.g., multisite admin mode).
4879		- * @return void
4880		- */
4881		- public function print_checkbox_auth_external_ldap( $args = '' ) {
	3927	+ function print_checkbox_auth_external_ldap( $args = '' ) {
4882	3928	// Get plugin option.
4883		- $option = 'ldap';
	3929	+ $option = 'ldap';
4884	3930	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4885	3931
4886	3932	// Make sure php5-ldap extension is installed on server.
4887	3933	$ldap_installed_message = ! function_exists( 'ldap_connect' ) ? '<span style="color: red;">(' . __( 'Warning: <a href="http://www.php.net/manual/en/ldap.installation.php" target="_blank" style="color: red;">PHP LDAP extension</a> is <strong>not</strong> installed', 'authorizer' ) . ')</span>' : '';
		@@ -4886,324 +3932,193 @@
4886	3932	// Make sure php5-ldap extension is installed on server.
4887	3933	$ldap_installed_message = ! function_exists( 'ldap_connect' ) ? '<span style="color: red;">(' . __( 'Warning: <a href="http://www.php.net/manual/en/ldap.installation.php" target="_blank" style="color: red;">PHP LDAP extension</a> is <strong>not</strong> installed', 'authorizer' ) . ')</span>' : '';
4888	3934
4889	3935	// Print option elements.
4890		- ?>
4891		- <input type="checkbox" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="1"<?php checked( 1 === intval( $auth_settings_option ) ); ?> /><label for="auth_settings_<?php echo esc_attr( $option ); ?>"><?php esc_html_e( 'Enable LDAP Logins', 'authorizer' ); ?></label> <?php echo wp_kses( $ldap_installed_message, $this->allowed_html ); ?>
4892		- <?php
	3936	+ ?><input type="checkbox" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="1"<?php checked( 1 == $auth_settings_option ); ?> /><label for="auth_settings_<?php echo $option; ?>"><?php _e( 'Enable LDAP Logins', 'authorizer' ); ?></label> <?php echo $ldap_installed_message; ?><?php
4893	3937	}
4894	3938
4895	3939
4896		- /**
4897		- * Settings print callback.
4898		- *
4899		- * @param string $args Args (e.g., multisite admin mode).
4900		- * @return void
4901		- */
4902		- public function print_text_ldap_host( $args = '' ) {
	3940	+ function print_text_ldap_host( $args = '' ) {
4903	3941	// Get plugin option.
4904		- $option = 'ldap_host';
	3942	+ $option = 'ldap_host';
4905	3943	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4906	3944
4907	3945	// Print option elements.
4908		- ?>
4909		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" style="width:330px;" />
4910		- <br /><small><?php esc_html_e( 'Specify either a hostname (for example, ldap.example.edu) or a full LDAP URI (for example, ldaps://ldap.example.edu:636).', 'authorizer' ); ?></small>
4911		- <?php
	3946	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" style="width:330px;" />
	3947	+ <br /><small><?php _e( "Specify either a hostname (for example, ldap.example.edu) or a full LDAP URI (for example, ldaps://ldap.example.edu:636).", 'authorizer' ); ?></small><?php
4912	3948	}
4913	3949
4914	3950
4915		- /**
4916		- * Settings print callback.
4917		- *
4918		- * @param string $args Args (e.g., multisite admin mode).
4919		- * @return void
4920		- */
4921		- public function print_text_ldap_port( $args = '' ) {
	3951	+ function print_text_ldap_port( $args = '' ) {
4922	3952	// Get plugin option.
4923		- $option = 'ldap_port';
	3953	+ $option = 'ldap_port';
4924	3954	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4925	3955
4926	3956	// Print option elements.
4927		- ?>
4928		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" style="width:50px;" />
4929		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: 389', 'authorizer' ); ?></label>
4930		- <br /><small><?php esc_html_e( 'If a full LDAP URI (ldaps://hostname:port) is specified above, this field is ignored.', 'authorizer' ); ?></small>
4931		- <?php
	3957	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" style="width:50px;" />
	3958	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: 389', 'authorizer' ); ?></label>
	3959	+ <br /><small><?php _e( "If a full LDAP URI (ldaps://hostname:port) is specified above, this field is ignored.", 'authorizer' ); ?></small><?php
4932	3960	}
4933	3961
4934	3962
4935		- /**
4936		- * Settings print callback.
4937		- *
4938		- * @param string $args Args (e.g., multisite admin mode).
4939		- * @return void
4940		- */
4941		- public function print_checkbox_ldap_tls( $args = '' ) {
	3963	+ function print_checkbox_ldap_tls( $args = '' ) {
4942	3964	// Get plugin option.
4943		- $option = 'ldap_tls';
	3965	+ $option = 'ldap_tls';
4944	3966	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4945	3967
4946	3968	// Print option elements.
4947		- ?>
4948		- <input type="checkbox" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="1"<?php checked( 1 === intval( $auth_settings_option ) ); ?> /><label for="auth_settings_<?php echo esc_attr( $option ); ?>"><?php esc_html_e( 'Use TLS', 'authorizer' ); ?></label>
4949		- <br /><small><?php esc_html_e( 'If ldaps is used, this should be unchecked', 'authorizer' ); ?></small>
4950		- <?php
	3969	+ ?><input type="checkbox" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="1"<?php checked( 1 == $auth_settings_option ); ?> /><label for="auth_settings_<?php echo $option; ?>"><?php _e( 'Use TLS', 'authorizer' ); ?></label><?php
4951	3970	}
4952	3971
4953	3972
4954		- /**
4955		- * Settings print callback.
4956		- *
4957		- * @param string $args Args (e.g., multisite admin mode).
4958		- * @return void
4959		- */
4960		- public function print_text_ldap_search_base( $args = '' ) {
	3973	+ function print_text_ldap_search_base( $args = '' ) {
4961	3974	// Get plugin option.
4962		- $option = 'ldap_search_base';
	3975	+ $option = 'ldap_search_base';
4963	3976	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4964	3977
4965	3978	// Print option elements.
4966		- ?>
4967		- <textarea id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" placeholder="" style="width:330px;"><?php echo esc_attr( $auth_settings_option ); ?></textarea>
4968		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: ou=people,dc=example,dc=edu', 'authorizer' ); ?></label>
4969		- <br /><small><?php esc_html_e( 'If you have multiple search bases, separate them by newlines (one per line).', 'authorizer' ); ?></small>
4970		- <?php
	3979	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" style="width:330px;" />
	3980	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: ou=people,dc=example,dc=edu', 'authorizer'); ?></label><?php
4971	3981	}
4972	3982
4973	3983
4974		- /**
4975		- * Settings print callback.
4976		- *
4977		- * @param string $args Args (e.g., multisite admin mode).
4978		- * @return void
4979		- */
4980		- public function print_text_ldap_uid( $args = '' ) {
	3984	+ function print_text_ldap_uid( $args = '' ) {
4981	3985	// Get plugin option.
4982		- $option = 'ldap_uid';
	3986	+ $option = 'ldap_uid';
4983	3987	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4984	3988
4985	3989	// Print option elements.
4986		- ?>
4987		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" style="width:80px;" />
4988		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: uid', 'authorizer' ); ?></label>
4989		- <?php
	3990	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" style="width:80px;" />
	3991	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: uid', 'authorizer' ); ?></label><?php
4990	3992	}
4991	3993
4992	3994
4993		- /**
4994		- * Settings print callback.
4995		- *
4996		- * @param string $args Args (e.g., multisite admin mode).
4997		- * @return void
4998		- */
4999		- public function print_text_ldap_attr_email( $args = '' ) {
	3995	+ function print_text_ldap_attr_email( $args = '' ) {
5000	3996	// Get plugin option.
5001		- $option = 'ldap_attr_email';
	3997	+ $option = 'ldap_attr_email';
5002	3998	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5003	3999
5004	4000	// Print option elements.
5005		- ?>
5006		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" />
5007		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: mail', 'authorizer' ); ?></label>
5008		- <br /><small><?php echo wp_kses( __( "Note: If your LDAP server doesn't return an attribute containing an email, you can specify the @domain portion of the email address here, and the email address will be constructed from it and the username. For example, if user 'bob' logs in and his email address should be bob@example.edu, then enter <strong>@example.edu</strong> in this field.", 'authorizer' ), $this->allowed_html ); ?></small>
5009		- <?php
	4001	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" />
	4002	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: mail', 'authorizer' ); ?></label>
	4003	+ <br /><small><?php _e( "Note: If your LDAP server doesn't return an attribute containing an email, you can specify the @domain portion of the email address here, and the email address will be constructed from it and the username. For example, if user 'bob' logs in and his email address should be bob@example.edu, then enter <strong>@example.edu</strong> in this field.", 'authorizer' ); ?></small><?php
5010	4004	}
5011	4005
5012	4006
5013		- /**
5014		- * Settings print callback.
5015		- *
5016		- * @param string $args Args (e.g., multisite admin mode).
5017		- * @return void
5018		- */
5019		- public function print_text_ldap_user( $args = '' ) {
	4007	+ function print_text_ldap_user( $args = '' ) {
5020	4008	// Get plugin option.
5021		- $option = 'ldap_user';
	4009	+ $option = 'ldap_user';
5022	4010	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5023	4011
5024	4012	// Print option elements.
5025		- ?>
5026		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" style="width:330px;" />
5027		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: cn=directory-user,ou=specials,dc=example,dc=edu', 'authorizer' ); ?></label>
5028		- <?php
	4013	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" style="width:330px;" />
	4014	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: cn=directory-user,ou=specials,dc=example,dc=edu', 'authorizer' ); ?></label><?php
5029	4015	}
5030	4016
5031	4017
5032		- /**
5033		- * Settings print callback.
5034		- *
5035		- * @param string $args Args (e.g., multisite admin mode).
5036		- * @return void
5037		- */
5038		- public function print_password_ldap_password( $args = '' ) {
	4018	+ function print_password_ldap_password( $args = '' ) {
5039	4019	// Get plugin option.
5040		- $option = 'ldap_password';
	4020	+ $option = 'ldap_password';
5041	4021	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5042	4022
5043	4023	// Print option elements.
5044		- ?>
5045		- <input type="password" id="garbage_to_stop_autofill" name="garbage" value="" autocomplete="off" style="display:none;" />
5046		- <input type="password" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $this->decrypt( $auth_settings_option ) ); ?>" autocomplete="off" />
5047		- <?php
	4024	+ ?><input type="password" id="garbage_to_stop_autofill" name="garbage" value="" autocomplete="off" style="display:none;" />
	4025	+ <input type="password" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $this->decrypt( $auth_settings_option ); ?>" autocomplete="off" /><?php
5048	4026	}
5049	4027
5050	4028
5051		- /**
5052		- * Settings print callback.
5053		- *
5054		- * @param string $args Args (e.g., multisite admin mode).
5055		- * @return void
5056		- */
5057		- public function print_text_ldap_lostpassword_url( $args = '' ) {
	4029	+ function print_text_ldap_lostpassword_url( $args = '' ) {
5058	4030	// Get plugin option.
5059		- $option = 'ldap_lostpassword_url';
	4031	+ $option = 'ldap_lostpassword_url';
5060	4032	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5061	4033
5062	4034	// Print option elements.
5063		- ?>
5064		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" style="width: 400px;" />
5065		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: https://myschool.example.edu:8888/am-forgot-password', 'authorizer' ); ?></label>
5066		- <?php
	4035	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" style="width: 400px;" />
	4036	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: https://myschool.example.edu:8888/am-forgot-password', 'authorizer' ); ?></label><?php
5067	4037	}
5068	4038
5069	4039
5070		- /**
5071		- * Settings print callback.
5072		- *
5073		- * @param string $args Args (e.g., multisite admin mode).
5074		- * @return void
5075		- */
5076		- public function print_text_ldap_attr_first_name( $args = '' ) {
	4040	+ function print_text_ldap_attr_first_name( $args = '' ) {
5077	4041	// Get plugin option.
5078		- $option = 'ldap_attr_first_name';
	4042	+ $option = 'ldap_attr_first_name';
5079	4043	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5080	4044
5081	4045	// Print option elements.
5082		- ?>
5083		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" />
5084		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: givenname', 'authorizer' ); ?></label>
5085		- <?php
	4046	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" />
	4047	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: givenname', 'authorizer' ); ?></label><?php
5086	4048	}
5087	4049
5088	4050
5089		- /**
5090		- * Settings print callback.
5091		- *
5092		- * @param string $args Args (e.g., multisite admin mode).
5093		- * @return void
5094		- */
5095		- public function print_text_ldap_attr_last_name( $args = '' ) {
	4051	+ function print_text_ldap_attr_last_name( $args = '' ) {
5096	4052	// Get plugin option.
5097		- $option = 'ldap_attr_last_name';
	4053	+ $option = 'ldap_attr_last_name';
5098	4054	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5099	4055
5100	4056	// Print option elements.
5101		- ?>
5102		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" />
5103		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: sn', 'authorizer' ); ?></label>
5104		- <?php
	4057	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" />
	4058	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: sn', 'authorizer' ); ?></label><?php
5105	4059	}
5106	4060
5107	4061
5108		- /**
5109		- * Settings print callback.
5110		- *
5111		- * @param string $args Args (e.g., multisite admin mode).
5112		- * @return void
5113		- */
5114		- public function print_checkbox_ldap_attr_update_on_login( $args = '' ) {
	4062	+ function print_checkbox_ldap_attr_update_on_login( $args = '' ) {
5115	4063	// Get plugin option.
5116		- $option = 'ldap_attr_update_on_login';
	4064	+ $option = 'ldap_attr_update_on_login';
5117	4065	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5118	4066
5119	4067	// Print option elements.
5120		- ?>
5121		- <input type="checkbox" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="1"<?php checked( 1 === intval( $auth_settings_option ) ); ?> /><label for="auth_settings_<?php echo esc_attr( $option ); ?>"><?php esc_html_e( 'Update first and last name fields on login (will overwrite any name the user has supplied in their profile)', 'authorizer' ); ?></label>
5122		- <?php
	4068	+ ?><input type="checkbox" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="1"<?php checked( 1 == $auth_settings_option ); ?> /><label for="auth_settings_<?php echo $option; ?>"><?php _e( 'Update first and last name fields on login (will overwrite any name the user has supplied in their profile)', 'authorizer' ); ?></label><?php
5123	4069	}
5124	4070
5125	4071
5126		- /**
5127		- * Settings print callback.
5128		- *
5129		- * @param string $args Args (e.g., multisite admin mode).
5130		- * @return void
5131		- */
5132		- public function print_section_info_advanced( $args = '' ) {
5133		- ?>
5134		- <div id="section_info_advanced" class="section_info">
5135		- <p><?php esc_html_e( 'You may optionally specify some advanced settings below.', 'authorizer' ); ?></p>
5136		- </div>
5137		- <?php
	4072	+ function print_section_info_advanced( $args = '' ) {
	4073	+ ?><div id="section_info_advanced" class="section_info">
	4074	+ <p><?php _e( 'You may optionally specify some advanced settings below.', 'authorizer' ); ?></p>
	4075	+ </div><?php
5138	4076	}
5139	4077
5140	4078
5141		- /**
5142		- * Settings print callback.
5143		- *
5144		- * @param string $args Args (e.g., multisite admin mode).
5145		- * @return void
5146		- */
5147		- public function print_text_auth_advanced_lockouts( $args = '' ) {
	4079	+ function print_text_auth_advanced_lockouts( $args = '' ) {
5148	4080	// Get plugin option.
5149		- $option = 'advanced_lockouts';
	4081	+ $option = 'advanced_lockouts';
5150	4082	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5151	4083
5152	4084	// Print option elements.
5153		- esc_html_e( 'After', 'authorizer' );
5154		- ?>
5155		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>_attempts_1" name="auth_settings[<?php echo esc_attr( $option ); ?>][attempts_1]" value="<?php echo esc_attr( $auth_settings_option['attempts_1'] ); ?>" placeholder="10" style="width:30px;" />
5156		- <?php esc_html_e( 'invalid password attempts, delay further attempts on that user for', 'authorizer' ); ?>
5157		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>_duration_1" name="auth_settings[<?php echo esc_attr( $option ); ?>][duration_1]" value="<?php echo esc_attr( $auth_settings_option['duration_1'] ); ?>" placeholder="1" style="width:30px;" />
5158		- <?php esc_html_e( 'minute(s).', 'authorizer' ); ?>
	4085	+ ?><?php _e( 'After', 'authorizer' ); ?>
	4086	+ <input type="text" id="auth_settings_<?php echo $option; ?>_attempts_1" name="auth_settings[<?php echo $option; ?>][attempts_1]" value="<?php echo $auth_settings_option['attempts_1']; ?>" placeholder="10" style="width:30px;" />
	4087	+ <?php _e( 'invalid password attempts, delay further attempts on that user for', 'authorizer' ); ?>
	4088	+ <input type="text" id="auth_settings_<?php echo $option; ?>_duration_1" name="auth_settings[<?php echo $option; ?>][duration_1]" value="<?php echo $auth_settings_option['duration_1']; ?>" placeholder="1" style="width:30px;" />
	4089	+ <?php _e( 'minute(s).', 'authorizer' ); ?>
5159	4090	<br />
5160		- <?php esc_html_e( 'After', 'authorizer' ); ?>
5161		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>_attempts_2" name="auth_settings[<?php echo esc_attr( $option ); ?>][attempts_2]" value="<?php echo esc_attr( $auth_settings_option['attempts_2'] ); ?>" placeholder="10" style="width:30px;" />
5162		- <?php esc_html_e( 'more invalid attempts, increase the delay to', 'authorizer' ); ?>
5163		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>_duration_2" name="auth_settings[<?php echo esc_attr( $option ); ?>][duration_2]" value="<?php echo esc_attr( $auth_settings_option['duration_2'] ); ?>" placeholder="10" style="width:30px;" />
5164		- <?php esc_html_e( 'minutes.', 'authorizer' ); ?>
	4091	+ <?php _e( 'After', 'authorizer' ); ?>
	4092	+ <input type="text" id="auth_settings_<?php echo $option; ?>_attempts_2" name="auth_settings[<?php echo $option; ?>][attempts_2]" value="<?php echo $auth_settings_option['attempts_2']; ?>" placeholder="10" style="width:30px;" />
	4093	+ <?php _e( 'more invalid attempts, increase the delay to', 'authorizer' ); ?>
	4094	+ <input type="text" id="auth_settings_<?php echo $option; ?>_duration_2" name="auth_settings[<?php echo $option; ?>][duration_2]" value="<?php echo $auth_settings_option['duration_2']; ?>" placeholder="10" style="width:30px;" />
	4095	+ <?php _e( 'minutes.', 'authorizer' ); ?>
5165	4096	<br />
5166		- <?php esc_html_e( 'Reset the delays after', 'authorizer' ); ?>
5167		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>_reset_duration" name="auth_settings[<?php echo esc_attr( $option ); ?>][reset_duration]" value="<?php echo esc_attr( $auth_settings_option['reset_duration'] ); ?>" placeholder="240" style="width:40px;" />
5168		- <?php esc_html_e( 'minutes with no invalid attempts.', 'authorizer' ); ?>
5169		- <?php
	4097	+ <?php _e( 'Reset the delays after', 'authorizer' ); ?>
	4098	+ <input type="text" id="auth_settings_<?php echo $option; ?>_reset_duration" name="auth_settings[<?php echo $option; ?>][reset_duration]" value="<?php echo $auth_settings_option['reset_duration']; ?>" placeholder="240" style="width:40px;" />
	4099	+ <?php _e( 'minutes with no invalid attempts.', 'authorizer' ); ?><?php
5170	4100	}
5171	4101
5172	4102
5173		- /**
5174		- * Settings print callback.
5175		- *
5176		- * @param string $args Args (e.g., multisite admin mode).
5177		- * @return void
5178		- */
5179		- public function print_checkbox_auth_advanced_hide_wp_login( $args = '' ) {
	4103	+ function print_checkbox_auth_advanced_hide_wp_login( $args = '' ) {
5180	4104	// Get plugin option.
5181		- $option = 'advanced_hide_wp_login';
	4105	+ $option = 'advanced_hide_wp_login';
5182	4106	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5183	4107
5184	4108	// Print option elements.
5185		- ?>
5186		- <input type="checkbox" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="1"<?php checked( 1 === intval( $auth_settings_option ) ); ?> /><label for="auth_settings_<?php echo esc_attr( $option ); ?>"><?php esc_html_e( 'Hide WordPress Logins', 'authorizer' ); ?></label>
5187		- <p><small><?php esc_html_e( 'Note: You can always access the WordPress logins by adding external=wordpress to the wp-login URL, like so:', 'authorizer' ); ?><br /><a href="<?php echo esc_attr( wp_login_url() ); ?>?external=wordpress" target="_blank"><?php echo esc_html( wp_login_url() ); ?>?external=wordpress</a>.</p>
5188		- <?php
	4109	+ ?><input type="checkbox" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="1"<?php checked( 1 == $auth_settings_option ); ?> /><label for="auth_settings_<?php echo $option; ?>"><?php _e( 'Hide WordPress Logins', 'authorizer' ); ?></label>
	4110	+ <p><small><?php _e( 'Note: You can always access the WordPress logins by adding external=wordpress to the wp-login URL, like so:', 'authorizer' ); ?><br /><a href="<?php echo wp_login_url(); ?>?external=wordpress" target="_blank"><?php echo wp_login_url(); ?>?external=wordpress</a>.</p><?php
5189	4111	}
5190	4112
5191	4113
5192		- /**
5193		- * Settings print callback.
5194		- *
5195		- * @param string $args Args (e.g., multisite admin mode).
5196		- * @return void
5197		- */
5198		- public function print_radio_auth_advanced_branding( $args = '' ) {
	4114	+ function print_radio_auth_advanced_branding( $args = '' ) {
5199	4115	// Get plugin option.
5200		- $option = 'advanced_branding';
	4116	+ $option = 'advanced_branding';
5201	4117	$auth_settings_option = $this->get_plugin_option( $option );
5202	4118
5203	4119	// Print option elements.
5204		- ?>
5205		- <input type="radio" id="radio_auth_settings_<?php echo esc_attr( $option ); ?>_default" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="default"<?php checked( 'default' === $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo esc_attr( $option ); ?>_default"><?php esc_html_e( 'Default WordPress login screen', 'authorizer' ); ?></label><br />
	4120	+ ?><input type="radio" id="radio_auth_settings_<?php echo $option; ?>_default" name="auth_settings[<?php echo $option; ?>]" value="default"<?php checked( 'default' == $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo $option; ?>_default"><?php _e( 'Default WordPress login screen', 'authorizer' ); ?></label><br />
5206	4121	<?php
5207	4122
5208	4123	/**
5209	4124	* Developers can use the `authorizer_add_branding_option` filter
		@@ -5208,8 +4123,9 @@
5208	4123	/**
5209	4124	* Developers can use the `authorizer_add_branding_option` filter
5210	4125	* to add a radio button for "Custom WordPress login branding"
5211	4126	* under the "Advanced" tab in Authorizer options. Example:
	4127	+ *
5212	4128	* function my_authorizer_add_branding_option( $branding_options ) {
5213	4129	* $new_branding_option = array(
5214	4130	* 'value' => 'your_brand'
5215	4131	* 'description' => 'Custom Your Brand Login Screen',
		@@ -5223,274 +4139,133 @@
5223	4139	*/
5224	4140	$branding_options = array();
5225	4141	$branding_options = apply_filters( 'authorizer_add_branding_option', $branding_options );
5226	4142	foreach ( $branding_options as $branding_option ) {
5227		- // Make sure the custom brands have the required values.
	4143	+ // Make sure the custom brands have the required values
5228	4144	if ( ! ( is_array( $branding_option ) && array_key_exists( 'value', $branding_option ) && array_key_exists( 'description', $branding_option ) ) ) {
5229	4145	continue;
5230	4146	}
5231		- ?>
5232		- <input type="radio" id="radio_auth_settings_<?php echo esc_attr( $option ); ?>_<?php echo esc_attr( sanitize_title( $branding_option['value'] ) ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $branding_option['value'] ); ?>"<?php checked( $branding_option['value'] === $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo esc_attr( $option ); ?>_<?php echo esc_attr( sanitize_title( $branding_option['value'] ) ); ?>"><?php echo esc_html( $branding_option['description'] ); ?></label><br />
5233		- <?php
	4147	+ ?><input type="radio" id="radio_auth_settings_<?php echo $option; ?>_<?php echo sanitize_title( $branding_option['value'] ); ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $branding_option['value']; ?>"<?php checked( $branding_option['value'] == $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo $option; ?>_<?php echo sanitize_title( $branding_option['value'] ); ?>"><?php echo $branding_option['description']; ?></label><br /><?php
5234	4148	}
5235	4149
5236	4150	// Print message about adding custom brands if there are none.
5237	4151	if ( count( $branding_options ) === 0 ) {
5238		- ?>
5239		- <p><em><?php echo wp_kses( __( '<strong>Note for theme developers</strong>: Add more options here by using the `authorizer_add_branding_option` filter in your theme. You can see an example theme that implements this filter in the plugin directory under sample-theme-add-branding.', 'authorizer' ), $this->allowed_html ); ?></em></p>
5240		- <?php
	4152	+ ?><p><em><?php _e( '<strong>Note for theme developers</strong>: Add more options here by using the `authorizer_add_branding_option` filter in your theme. You can see an example theme that implements this filter in the plugin directory under sample-theme-add-branding.', 'authorizer' ); ?></em></p><?php
5241	4153	}
5242	4154	}
5243	4155
5244	4156
5245		- /**
5246		- * Settings print callback.
5247		- *
5248		- * @param string $args Args (e.g., multisite admin mode).
5249		- * @return void
5250		- */
5251		- public function print_radio_auth_advanced_admin_menu( $args = '' ) {
	4157	+ function print_radio_auth_advanced_admin_menu( $args = '' ) {
5252	4158	// Get plugin option.
5253		- $option = 'advanced_admin_menu';
	4159	+ $option = 'advanced_admin_menu';
5254	4160	$auth_settings_option = $this->get_plugin_option( $option );
5255	4161
5256	4162	// Print option elements.
5257		- ?>
5258		- <input type="radio" id="radio_auth_settings_<?php echo esc_attr( $option ); ?>_settings" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="settings"<?php checked( 'settings' === $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo esc_attr( $option ); ?>_settings"><?php esc_html_e( 'Show in Settings menu', 'authorizer' ); ?></label><br />
5259		- <input type="radio" id="radio_auth_settings_<?php echo esc_attr( $option ); ?>_top" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="top"<?php checked( 'top' === $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo esc_attr( $option ); ?>_top"><?php esc_html_e( 'Show in sidebar (top level)', 'authorizer' ); ?></label><br />
5260		- <?php
	4163	+ ?><input type="radio" id="radio_auth_settings_<?php echo $option; ?>_settings" name="auth_settings[<?php echo $option; ?>]" value="settings"<?php checked( 'settings' == $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo $option; ?>_settings"><?php _e( 'Show in Settings menu', 'authorizer' ); ?></label><br />
	4164	+ <input type="radio" id="radio_auth_settings_<?php echo $option; ?>_top" name="auth_settings[<?php echo $option; ?>]" value="top"<?php checked( 'top' == $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo $option; ?>_top"><?php _e( 'Show in sidebar (top level)', 'authorizer' ); ?></label><br /><?php
5261	4165
5262	4166	}
5263	4167
5264	4168
5265		- /**
5266		- * Settings print callback.
5267		- *
5268		- * @param string $args Args (e.g., multisite admin mode).
5269		- * @return void
5270		- */
5271		- public function print_select_auth_advanced_usermeta( $args = '' ) {
	4169	+ function print_select_auth_advanced_usermeta( $args = '' ) {
5272	4170	// Get plugin option.
5273		- $option = 'advanced_usermeta';
	4171	+ $option = 'advanced_usermeta';
5274	4172	$auth_settings_option = $this->get_plugin_option( $option );
5275	4173
5276	4174	// Print option elements.
5277		- ?>
5278		- <select id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]">
5279		- <option value=""><?php esc_html_e( '-- None --', 'authorizer' ); ?></option>
5280		- <?php
5281		- if ( class_exists( 'acf' ) ) :
	4175	+ ?><select id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]">
	4176	+ <option value=""><?php _e( '-- None --', 'authorizer' ); ?></option>
	4177	+ <?php if ( class_exists( 'acf' ) ) :
5282	4178	// Get ACF 5 fields. Note: it would be much easier to use `get_field_objects()`
5283	4179	// or `get_field_objects( 'user_' . get_current_user_id() )`, but neither will
5284	4180	// list fields that have never been given values for users (i.e., new ACF
5285	4181	// fields). Therefore we fall back on finding any ACF fields applied to users
5286	4182	// (user_role or user_form location rules in the field group definition).
5287		- $fields = array();
	4183	+ $fields = array();
5288	4184	$acf_field_group_ids = array();
5289		- $acf_field_groups = new WP_Query(
5290		- array(
5291		- 'post_type' => 'acf-field-group',
5292		- )
5293		- );
	4185	+ $acf_field_groups = new WP_Query( array(
	4186	+ 'post_type' => 'acf-field-group',
	4187	+ ));
5294	4188	while ( $acf_field_groups->have_posts() ) : $acf_field_groups->the_post();
5295	4189	if ( strpos( get_the_content(), 's:5:"param";s:9:"user_role"' ) !== false || strpos( get_the_content(), 's:5:"param";s:9:"user_form"' ) !== false ) :
5296	4190	array_push( $acf_field_group_ids, get_the_ID() );
5297	4191	endif;
5298		- endwhile;
5299		- wp_reset_postdata();
	4192	+ endwhile; wp_reset_postdata();
5300	4193	foreach ( $acf_field_group_ids as $acf_field_group_id ) :
5301		- $acf_fields = new WP_Query(
5302		- array(
5303		- 'post_type' => 'acf-field',
5304		- 'post_parent' => $acf_field_group_id,
5305		- )
5306		- );
	4194	+ $acf_fields = new WP_Query( array(
	4195	+ 'post_type' => 'acf-field',
	4196	+ 'post_parent' => $acf_field_group_id,
	4197	+ ));
5307	4198	while ( $acf_fields->have_posts() ) : $acf_fields->the_post();
5308	4199	global $post;
5309		- $fields[ $post->post_name ] = get_field_object( $post->post_name );
5310		- endwhile;
5311		- wp_reset_postdata();
	4200	+ $fields[$post->post_name] = get_field_object( $post->post_name );
	4201	+ endwhile; wp_reset_postdata();
5312	4202	endforeach;
5313	4203	// Get ACF 4 fields.
5314		- $acf4_field_groups = new WP_Query(
5315		- array(
5316		- 'post_type' => 'acf',
5317		- )
5318		- );
	4204	+ $acf4_field_groups = new WP_Query( array(
	4205	+ 'post_type' => 'acf',
	4206	+ ));
5319	4207	while ( $acf4_field_groups->have_posts() ) : $acf4_field_groups->the_post();
5320	4208	$field_group_rules = get_post_meta( get_the_ID(), 'rule', true );
5321		- if ( is_array( $field_group_rules ) && array_key_exists( 'param', $field_group_rules ) && 'ef_user' === $field_group_rules['param'] ) :
	4209	+ if ( is_array( $field_group_rules ) && array_key_exists( 'param', $field_group_rules ) && $field_group_rules['param'] === 'ef_user' ) :
5322	4210	$acf4_fields = get_post_custom( get_the_ID() );
5323	4211	foreach ( $acf4_fields as $meta_key => $meta_value ) :
5324	4212	if ( strpos( $meta_key, 'field_' ) === 0 ) :
5325		- $meta_value = unserialize( $meta_value[0] );
5326		- $fields[ $meta_key ] = $meta_value;
	4213	+ $meta_value = unserialize( $meta_value[0] );
	4214	+ $fields[$meta_key] = $meta_value;
5327	4215	endif;
5328	4216	endforeach;
5329	4217	endif;
5330		- endwhile;
5331		- wp_reset_postdata();
5332		- ?>
	4218	+ endwhile; wp_reset_postdata(); ?>
5333	4219	<optgroup label="ACF User Fields:">
5334		- <?php foreach ( (array) $fields as $field => $field_object ) : ?>
5335		- <option value="acf___<?php echo esc_attr( $field_object['key'] ); ?>"<?php selected( "acf___{$field_object['key']}" === $auth_settings_option ); ?>><?php echo esc_html( $field_object['label'] ); ?></option>
	4220	+ <?php foreach ( (array)$fields as $field => $field_object ) : ?>
	4221	+ <option value="acf___<?php echo $field_object['key']; ?>"<?php if ( $auth_settings_option === "acf___{$field_object['key']}" ) echo ' selected="selected"'; ?>><?php echo $field_object['label']; ?></option>
5336	4222	<?php endforeach; ?>
5337	4223	</optgroup>
5338	4224	<?php endif; ?>
5339		- <optgroup label="<?php esc_attr_e( 'All Usermeta:', 'authorizer' ); ?>">
5340		- <?php
5341		- foreach ( $this->get_all_usermeta_keys() as $meta_key ) :
5342		- if ( substr( $meta_key, 0, 3 ) === 'wp_' ) :
5343		- continue;
5344		- endif;
5345		- ?>
5346		- <option value="<?php echo esc_attr( $meta_key ); ?>"<?php selected( $auth_settings_option === $meta_key ); ?>><?php echo esc_html( $meta_key ); ?></option>
	4225	+ <optgroup label="<?php _e( 'All Usermeta:', 'authorizer' ); ?>">
	4226	+ <?php foreach ( $this->get_all_usermeta_keys() as $meta_key ) : if ( substr( $meta_key, 0, 3 ) === 'wp_' ) continue; ?>
	4227	+ <option value="<?php echo $meta_key; ?>"<?php if ( $auth_settings_option === $meta_key ) echo ' selected="selected"'; ?>><?php echo $meta_key; ?></option>
5347	4228	<?php endforeach; ?>
5348	4229	</optgroup>
5349		- </select>
5350		- <?php
	4230	+ </select><?php
5351	4231	}
5352	4232
5353	4233
5354		- /**
5355		- * Settings print callback.
5356		- *
5357		- * @param string $args Args (e.g., multisite admin mode).
5358		- * @return void
5359		- */
5360		- public function print_text_auth_advanced_users_per_page( $args = '' ) {
	4234	+ function print_checkbox_auth_advanced_override_multisite( $args = '' ) {
5361	4235	// Get plugin option.
5362		- $option = 'advanced_users_per_page';
5363		- $auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5364		-
5365		- // Print option elements.
5366		- ?>
5367		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" size="4" />
5368		- <?php
5369		- }
5370		-
5371		-
5372		- /**
5373		- * Settings print callback.
5374		- *
5375		- * @param string $args Args (e.g., multisite admin mode).
5376		- * @return void
5377		- */
5378		- public function print_select_auth_advanced_users_sort_by( $args = '' ) {
5379		- // Get plugin option.
5380		- $option = 'advanced_users_sort_by';
5381		- $auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5382		-
5383		- // Print option elements.
5384		- ?>
5385		- <select id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]">
5386		- <option value="created" <?php selected( $auth_settings_option, 'created' ); ?>><?php esc_html_e( 'Date approved', 'authorizer' ); ?></option>
5387		- <option value="email" <?php selected( $auth_settings_option, 'email' ); ?>><?php esc_html_e( 'Email', 'authorizer' ); ?></option>
5388		- <option value="role" <?php selected( $auth_settings_option, 'role' ); ?>><?php esc_html_e( 'Role', 'authorizer' ); ?></option>
5389		- <option value="date_added" <?php selected( $auth_settings_option, 'date_added' ); ?>><?php esc_html_e( 'Date registered', 'authorizer' ); ?></option>
5390		- </select>
5391		- <?php
5392		- }
5393		-
5394		-
5395		- /**
5396		- * Settings print callback.
5397		- *
5398		- * @param string $args Args (e.g., multisite admin mode).
5399		- * @return void
5400		- */
5401		- public function print_select_auth_advanced_users_sort_order( $args = '' ) {
5402		- // Get plugin option.
5403		- $option = 'advanced_users_sort_order';
5404		- $auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5405		-
5406		- // Print option elements.
5407		- ?>
5408		- <select id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]">
5409		- <option value="asc" <?php selected( $auth_settings_option, 'asc' ); ?>><?php esc_html_e( 'Ascending', 'authorizer' ); ?></option>
5410		- <option value="desc" <?php selected( $auth_settings_option, 'desc' ); ?>><?php esc_html_e( 'Descending', 'authorizer' ); ?></option>
5411		- </select>
5412		- <?php
5413		- }
5414		-
5415		-
5416		- /**
5417		- * Settings print callback.
5418		- *
5419		- * @param string $args Args (e.g., multisite admin mode).
5420		- * @return void
5421		- */
5422		- public function print_checkbox_auth_advanced_widget_enabled( $args = '' ) {
5423		- // Get plugin option.
5424		- $option = 'advanced_widget_enabled';
5425		- $auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5426		-
5427		- // Print option elements.
5428		- ?>
5429		- <input type="checkbox" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="1"<?php checked( 1 === intval( $auth_settings_option ) ); ?> /><label for="auth_settings_<?php echo esc_attr( $option ); ?>"><?php esc_html_e( 'Show Dashboard Widget', 'authorizer' ); ?></label>
5430		- <p><small><?php esc_html_e( 'Note: Only users with the create_users capability will be able to see the dashboard widget.', 'authorizer' ); ?></small></p>
5431		- <?php
5432		- }
5433		-
5434		-
5435		- /**
5436		- * Settings print callback.
5437		- *
5438		- * @param string $args Args (e.g., multisite admin mode).
5439		- * @return void
5440		- */
5441		- public function print_checkbox_auth_advanced_override_multisite( $args = '' ) {
5442		- // Get plugin option.
5443		- $option = 'advanced_override_multisite';
	4236	+ $option = 'advanced_override_multisite';
5444	4237	$auth_settings_option = $this->get_plugin_option( $option );
5445	4238
5446	4239	// Print option elements.
5447		- ?>
5448		- <input type="checkbox" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="1"<?php checked( 1 === intval( $auth_settings_option ) ); ?> /><label for="auth_settings_<?php echo esc_attr( $option ); ?>"><?php esc_html_e( "Configure this site independently (don't inherit any multisite settings)", 'authorizer' ); ?></label>
5449		- <?php
	4240	+ ?><input type="checkbox" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="1"<?php checked( 1 == $auth_settings_option ); ?> /><label for="auth_settings_<?php echo $option; ?>"><?php _e( "Configure this site independently (don't inherit any multisite settings)", 'authorizer' ); ?></label><?php
5450	4241	}
5451	4242
5452	4243
5453	4244
5454	4245	/**
5455		- * Determines whether we are in single site or multisite admin context.
5456		- *
5457		- * @param string $args Args (e.g., multisite admin mode).
5458		- * @return int Current mode.
5459		- */
5460		- private function get_admin_mode( $args ) {
5461		- if ( is_array( $args ) && array_key_exists( WP_Plugin_Authorizer::NETWORK_CONTEXT, $args ) && true === $args[ WP_Plugin_Authorizer::NETWORK_CONTEXT ] ) {
5462		- return WP_Plugin_Authorizer::NETWORK_CONTEXT;
5463		- } else {
5464		- return WP_Plugin_Authorizer::SINGLE_CONTEXT;
5465		- }
5466		- }
5467		-
5468		-
5469		- /**
5470	4246	* Add help documentation to the options page.
5471		- *
5472		- * Action: load-settings_page_authorizer > admin_head
	4247	+ * Run on action hook chain: load-settings_page_authorizer > admin_head
5473	4248	*/
5474	4249	public function admin_head() {
5475	4250	$screen = get_current_screen();
5476	4251
5477		- // Add help tab for Access Lists Settings.
	4252	+ // Add help tab for Access Lists Settings
5478	4253	$help_auth_settings_access_lists_content = '
5479		- <p>' . __( "<strong>Pending Users</strong>: Pending users are users who have successfully logged in to the site, but who haven't yet been approved (or blocked) by you.", 'authorizer' ) . '</p>
5480		- <p>' . __( '<strong>Approved Users</strong>: Approved users have access to the site once they successfully log in.', 'authorizer' ) . '</p>
5481		- <p>' . __( '<strong>Blocked Users</strong>: Blocked users will receive an error message when they try to visit the site after authenticating.', 'authorizer' ) . '</p>
5482		- <p>' . __( 'Users in the <strong>Pending</strong> list appear automatically after a new user tries to log in from the configured external authentication service. You can add users to the <strong>Approved</strong> or <strong>Blocked</strong> lists by typing them in manually, or by clicking the <em>Approve</em> or <em>Block</em> buttons next to a user in the <strong>Pending</strong> list.', 'authorizer' ) . '</p>
	4254	+ <p>' . __( "<strong>Pending Users</strong>: Pending users are users who have successfully logged in to the site, but who haven't yet been approved (or blocked) by you.", 'authorizer' ) .'</p>
	4255	+ <p>' . __( "<strong>Approved Users</strong>: Approved users have access to the site once they successfully log in.", 'authorizer' ) . '</p>
	4256	+ <p>' . __( "<strong>Blocked Users</strong>: Blocked users will receive an error message when they try to visit the site after authenticating.", 'authorizer' ) . '</p>
	4257	+ <p>' . __( "Users in the <strong>Pending</strong> list appear automatically after a new user tries to log in from the configured external authentication service. You can add users to the <strong>Approved</strong> or <strong>Blocked</strong> lists by typing them in manually, or by clicking the <em>Approve</em> or <em>Block</em> buttons next to a user in the <strong>Pending</strong> list.", 'authorizer' ) . '</p>
5483	4258	';
5484	4259	$screen->add_help_tab(
5485	4260	array(
5486		- 'id' => 'help_auth_settings_access_lists_content',
5487		- 'title' => __( 'Access Lists', 'authorizer' ),
	4261	+ 'id' => 'help_auth_settings_access_lists_content',
	4262	+ 'title' => __( 'Access Lists', 'authorizer' ),
5488	4263	'content' => $help_auth_settings_access_lists_content,
5489	4264	)
5490	4265	);
5491	4266
5492		- // Add help tab for Login Access Settings.
	4267	+ // Add help tab for Login Access Settings
5493	4268	$help_auth_settings_access_login_content = '
5494	4269	<p>' . __( "<strong>Who can log in to the site?</strong>: Choose the level of access restriction you'd like to use on your site here. You can leave the site open to anyone with a WordPress account or an account on an external service like Google, CAS, or LDAP, or restrict it to WordPress users and only the external users that you specify via the <em>Access Lists</em>.", 'authorizer' ) . '</p>
5495	4270	<p>' . __( "<strong>Which role should receive email notifications about pending users?</strong>: If you've restricted access to <strong>approved users</strong>, you can determine which WordPress users will receive a notification email everytime a new external user successfully logs in and is added to the pending list. All users of the specified role will receive an email, and the external user will get a message (specified below) telling them their access is pending approval.", 'authorizer' ) . '</p>
5496	4271	<p>' . __( '<strong>What message should pending users see after attempting to log in?</strong>: Here you can specify the exact message a new external user will see once they try to log in to the site for the first time.', 'authorizer' ) . '</p>
		@@ -5496,84 +4271,84 @@
5496	4271	<p>' . __( '<strong>What message should pending users see after attempting to log in?</strong>: Here you can specify the exact message a new external user will see once they try to log in to the site for the first time.', 'authorizer' ) . '</p>
5497	4272	';
5498	4273	$screen->add_help_tab(
5499	4274	array(
5500		- 'id' => 'help_auth_settings_access_login_content',
5501		- 'title' => __( 'Login Access', 'authorizer' ),
	4275	+ 'id' => 'help_auth_settings_access_login_content',
	4276	+ 'title' => __( 'Login Access', 'authorizer' ),
5502	4277	'content' => $help_auth_settings_access_login_content,
5503	4278	)
5504	4279	);
5505	4280
5506		- // Add help tab for Public Access Settings.
	4281	+ // Add help tab for Public Access Settings
5507	4282	$help_auth_settings_access_public_content = '
5508	4283	<p>' . __( "<strong>Who can view the site?</strong>: You can restrict the site's visibility by only allowing logged in users to see pages. If you do so, you can customize the specifics about the site's privacy using the settings below.", 'authorizer' ) . '</p>
5509	4284	<p>' . __( "<strong>What pages (if any) should be available to everyone?</strong>: If you'd like to declare certain pages on your site as always public (such as the course syllabus, introduction, or calendar), specify those pages here. These pages will always be available no matter what access restrictions exist.", 'authorizer' ) . '</p>
5510		- <p>' . __( '<strong>What happens to people without access when they visit a <em>private</em> page?</strong>: Choose the response anonymous users receive when visiting the site. You can choose between immediately taking them to the <strong>login screen</strong>, or simply showing them a <strong>message</strong>.', 'authorizer' ) . '</p>
5511		- <p>' . __( '<strong>What happens to people without access when they visit a <em>public</em> page?</strong>: Choose the response anonymous users receive when visiting a page on the site marked as public. You can choose between showing them the page without any message, or showing them a the page with a message above the content.', 'authorizer' ) . '</p>
5512		- <p>' . __( '<strong>What message should people without access see?</strong>: If you chose to show new users a <strong>message</strong> above, type that message here.', 'authorizer' ) . '</p>
	4285	+ <p>' . __( "<strong>What happens to people without access when they visit a <em>private</em> page?</strong>: Choose the response anonymous users receive when visiting the site. You can choose between immediately taking them to the <strong>login screen</strong>, or simply showing them a <strong>message</strong>.", 'authorizer' ) . '</p>
	4286	+ <p>' . __( "<strong>What happens to people without access when they visit a <em>public</em> page?</strong>: Choose the response anonymous users receive when visiting a page on the site marked as public. You can choose between showing them the page without any message, or showing them a the page with a message above the content.", 'authorizer' ) . '</p>
	4287	+ <p>' . __( "<strong>What message should people without access see?</strong>: If you chose to show new users a <strong>message</strong> above, type that message here.", 'authorizer' ) . '</p>
5513	4288	';
5514	4289	$screen->add_help_tab(
5515	4290	array(
5516		- 'id' => 'help_auth_settings_access_public_content',
5517		- 'title' => __( 'Public Access', 'authorizer' ),
	4291	+ 'id' => 'help_auth_settings_access_public_content',
	4292	+ 'title' => __( 'Public Access', 'authorizer' ),
5518	4293	'content' => $help_auth_settings_access_public_content,
5519	4294	)
5520	4295	);
5521	4296
5522		- // Add help tab for External Service (CAS, LDAP) Settings.
	4297	+ // Add help tab for External Service (CAS, LDAP) Settings
5523	4298	$help_auth_settings_external_content = '
5524	4299	<p>' . __( "<strong>Type of external service to authenticate against</strong>: Choose which authentication service type you will be using. You'll have to fill out different fields below depending on which service you choose.", 'authorizer' ) . '</p>
5525		- <p>' . __( '<strong>Enable Google Logins</strong>: Choose if you want to allow users to log in with their Google Account credentials. You will need to enter your API Client ID and Secret to enable Google Logins.', 'authorizer' ) . '</p>
5526		- <p>' . __( '<strong>Enable CAS Logins</strong>: Choose if you want to allow users to log in with via CAS (Central Authentication Service). You will need to enter details about your CAS server (host, port, and path) to enable CAS Logins.', 'authorizer' ) . '</p>
5527		- <p>' . __( '<strong>Enable LDAP Logins</strong>: Choose if you want to allow users to log in with their LDAP (Lightweight Directory Access Protocol) credentials. You will need to enter details about your LDAP server (host, port, search base, uid attribute, directory user, directory user password, and whether to use TLS) to enable Google Logins.', 'authorizer' ) . '</p>
5528		- <p>' . __( '<strong>Default role for new CAS users</strong>: Specify which role new external users will get by default. Be sure to choose a role with limited permissions!', 'authorizer' ) . '</p>
5529		- <p><strong><em>' . __( 'If you enable Google logins:', 'authorizer' ) . '</em></strong></p>
	4300	+ <p>' . __( "<strong>Enable Google Logins</strong>: Choose if you want to allow users to log in with their Google Account credentials. You will need to enter your API Client ID and Secret to enable Google Logins.", 'authorizer' ) . '</p>
	4301	+ <p>' . __( "<strong>Enable CAS Logins</strong>: Choose if you want to allow users to log in with via CAS (Central Authentication Service). You will need to enter details about your CAS server (host, port, and path) to enable CAS Logins.", 'authorizer' ) . '</p>
	4302	+ <p>' . __( "<strong>Enable LDAP Logins</strong>: Choose if you want to allow users to log in with their LDAP (Lightweight Directory Access Protocol) credentials. You will need to enter details about your LDAP server (host, port, search base, uid attribute, directory user, directory user password, and whether to use TLS) to enable Google Logins.", 'authorizer' ) . '</p>
	4303	+ <p>' . __( "<strong>Default role for new CAS users</strong>: Specify which role new external users will get by default. Be sure to choose a role with limited permissions!", 'authorizer' ) . '</p>
	4304	+ <p><strong><em>' . __( "If you enable Google logins:", 'authorizer' ) . '</em></strong></p>
5530	4305	<ul>
5531	4306	<li>' . __( "<strong>Google Client ID</strong>: You can generate this ID by creating a new Project in the <a href='https://cloud.google.com/console'>Google Developers Console</a>. A Client ID typically looks something like this: 1234567890123-kdjr85yt6vjr6d8g7dhr8g7d6durjf7g.apps.googleusercontent.com", 'authorizer' ) . '</li>
5532	4307	<li>' . __( "<strong>Google Client Secret</strong>: You can generate this secret by creating a new Project in the <a href='https://cloud.google.com/console'>Google Developers Console</a>. A Client Secret typically looks something like this: sDNgX5_pr_5bly-frKmvp8jT", 'authorizer' ) . '</li>
5533	4308	</ul>
5534		- <p><strong><em>' . __( 'If you enable CAS logins:', 'authorizer' ) . '</em></strong></p>
	4309	+ <p><strong><em>' . __( "If you enable CAS logins:", 'authorizer' ) . '</em></strong></p>
5535	4310	<ul>
5536		- <li>' . __( '<strong>CAS server hostname</strong>: Enter the hostname of the CAS server you authenticate against (e.g., authn.example.edu).', 'authorizer' ) . '</li>
5537		- <li>' . __( '<strong>CAS server port</strong>: Enter the port on the CAS server to connect to (e.g., 443).', 'authorizer' ) . '</li>
5538		- <li>' . __( '<strong>CAS server path/context</strong>: Enter the path to the login endpoint on the CAS server (e.g., /cas).', 'authorizer' ) . '</li>
	4311	+ <li>' . __( "<strong>CAS server hostname</strong>: Enter the hostname of the CAS server you authenticate against (e.g., authn.example.edu).", 'authorizer' ) . '</li>
	4312	+ <li>' . __( "<strong>CAS server port</strong>: Enter the port on the CAS server to connect to (e.g., 443).", 'authorizer' ) . '</li>
	4313	+ <li>' . __( "<strong>CAS server path/context</strong>: Enter the path to the login endpoint on the CAS server (e.g., /cas).", 'authorizer' ) . '</li>
5539	4314	<li>' . __( "<strong>CAS attribute containing first name</strong>: Enter the CAS attribute that has the user's first name. When this user first logs in, their WordPress account will have their first name retrieved from CAS and added to their WordPress profile.", 'authorizer' ) . '</li>
5540	4315	<li>' . __( "<strong>CAS attribute containing last name</strong>: Enter the CAS attribute that has the user's last name. When this user first logs in, their WordPress account will have their last name retrieved from CAS and added to their WordPress profile.", 'authorizer' ) . '</li>
5541		- <li>' . __( '<strong>CAS attribute update</strong>: Select whether the first and last names retrieved from CAS should overwrite any value the user has entered in the first and last name fields in their WordPress profile. If this is not set, this only happens the first time they log in.', 'authorizer' ) . '</li>
	4316	+ <li>' . __( "<strong>CAS attribute update</strong>: Select whether the first and last names retrieved from CAS should overwrite any value the user has entered in the first and last name fields in their WordPress profile. If this is not set, this only happens the first time they log in.", 'authorizer' ) . '</li>
5542	4317	</ul>
5543		- <p><strong><em>' . __( 'If you enable LDAP logins:', 'authorizer' ) . '</em></strong></p>
	4318	+ <p><strong><em>' . __( "If you enable LDAP logins:", 'authorizer' ) . '</em></strong></p>
5544	4319	<ul>
5545		- <li>' . __( '<strong>LDAP Host</strong>: Enter the URL of the LDAP server you authenticate against.', 'authorizer' ) . '</li>
5546		- <li>' . __( '<strong>LDAP Port</strong>: Enter the port number that the LDAP server listens on.', 'authorizer' ) . '</li>
5547		- <li>' . __( '<strong>LDAP Search Base</strong>: Enter the LDAP string that represents the search base, e.g., ou=people,dc=example,dc=edu', 'authorizer' ) . '</li>
5548		- <li>' . __( '<strong>LDAP attribute containing username</strong>: Enter the name of the LDAP attribute that contains the usernames used by those attempting to log in. The plugin will search on this attribute to find the cn to bind against for login attempts.', 'authorizer' ) . '</li>
5549		- <li>' . __( '<strong>LDAP Directory User</strong>: Enter the name of the LDAP user that has permissions to browse the directory.', 'authorizer' ) . '</li>
5550		- <li>' . __( '<strong>LDAP Directory User Password</strong>: Enter the password for the LDAP user that has permission to browse the directory.', 'authorizer' ) . '</li>
5551		- <li>' . __( '<strong>Use TLS</strong>: Select whether all communication with the LDAP server should be performed over a TLS-secured connection.', 'authorizer' ) . '</li>
	4320	+ <li>' . __( "<strong>LDAP Host</strong>: Enter the URL of the LDAP server you authenticate against.", 'authorizer' ) . '</li>
	4321	+ <li>' . __( "<strong>LDAP Port</strong>: Enter the port number that the LDAP server listens on.", 'authorizer' ) . '</li>
	4322	+ <li>' . __( "<strong>LDAP Search Base</strong>: Enter the LDAP string that represents the search base, e.g., ou=people,dc=example,dc=edu", 'authorizer' ) . '</li>
	4323	+ <li>' . __( "<strong>LDAP attribute containing username</strong>: Enter the name of the LDAP attribute that contains the usernames used by those attempting to log in. The plugin will search on this attribute to find the cn to bind against for login attempts.", 'authorizer' ) . '</li>
	4324	+ <li>' . __( "<strong>LDAP Directory User</strong>: Enter the name of the LDAP user that has permissions to browse the directory.", 'authorizer' ) . '</li>
	4325	+ <li>' . __( "<strong>LDAP Directory User Password</strong>: Enter the password for the LDAP user that has permission to browse the directory.", 'authorizer' ) . '</li>
	4326	+ <li>' . __( "<strong>Secure Connection (TLS)</strong>: Select whether all communication with the LDAP server should be performed over a TLS-secured connection.", 'authorizer' ) . '</li>
5552	4327	<li>' . __( "<strong>Custom lost password URL</strong>: The WordPress login page contains a link to recover a lost password. If you have external users who shouldn't change the password on their WordPress account, point them to the appropriate location to change the password on their external authentication service here.", 'authorizer' ) . '</li>
5553	4328	<li>' . __( "<strong>LDAP attribute containing first name</strong>: Enter the LDAP attribute that has the user's first name. When this user first logs in, their WordPress account will have their first name retrieved from LDAP and added to their WordPress profile.", 'authorizer' ) . '</li>
5554	4329	<li>' . __( "<strong>LDAP attribute containing last name</strong>: Enter the LDAP attribute that has the user's last name. When this user first logs in, their WordPress account will have their last name retrieved from LDAP and added to their WordPress profile.", 'authorizer' ) . '</li>
5555		- <li>' . __( '<strong>LDAP attribute update</strong>: Select whether the first and last names retrieved from LDAP should overwrite any value the user has entered in the first and last name fields in their WordPress profile. If this is not set, this only happens the first time they log in.', 'authorizer' ) . '</li>
	4330	+ <li>' . __( "<strong>LDAP attribute update</strong>: Select whether the first and last names retrieved from LDAP should overwrite any value the user has entered in the first and last name fields in their WordPress profile. If this is not set, this only happens the first time they log in.", 'authorizer' ) . '</li>
5556	4331	</ul>
5557	4332	';
5558	4333	$screen->add_help_tab(
5559	4334	array(
5560		- 'id' => 'help_auth_settings_external_content',
5561		- 'title' => __( 'External Service', 'authorizer' ),
	4335	+ 'id' => 'help_auth_settings_external_content',
	4336	+ 'title' => __( 'External Service', 'authorizer' ),
5562	4337	'content' => $help_auth_settings_external_content,
5563	4338	)
5564	4339	);
5565	4340
5566		- // Add help tab for Advanced Settings.
	4341	+ // Add help tab for Advanced Settings
5567	4342	$help_auth_settings_advanced_content = '
5568		- <p>' . __( '<strong>Limit invalid login attempts</strong>: Choose how soon (and for how long) to restrict access to individuals (or bots) making repeated invalid login attempts. You may set a shorter delay first, and then a longer delay after repeated invalid attempts; you may also set how much time must pass before the delays will be reset to normal.', 'authorizer' ) . '</p>
5569		- <p>' . __( '<strong>Hide WordPress Logins</strong>: If you want to hide the WordPress username and password fields and the Log In button on the wp-login screen, enable this option. Note: You can always access the WordPress logins by adding external=wordpress to the wp-login URL, like so:', 'authorizer' ) . ' <a href="' . wp_login_url() . '?external=wordpress" target="_blank">' . wp_login_url() . '?external=wordpress</a>.</p>
	4343	+ <p>' . __( "<strong>Limit invalid login attempts</strong>: Choose how soon (and for how long) to restrict access to individuals (or bots) making repeated invalid login attempts. You may set a shorter delay first, and then a longer delay after repeated invalid attempts; you may also set how much time must pass before the delays will be reset to normal.", 'authorizer' ) . '</p>
	4344	+ <p>' . __( "<strong>Hide WordPress Logins</strong>: If you want to hide the WordPress username and password fields and the Log In button on the wp-login screen, enable this option. Note: You can always access the WordPress logins by adding external=wordpress to the wp-login URL, like so:", 'authorizer' ) . ' <a href="' . wp_login_url() . '?external=wordpress" target="_blank">' . wp_login_url() . '?external=wordpress</a>.</p>
5570	4345	<p>' . __( "<strong>Custom WordPress login branding</strong>: If you'd like to use custom branding on the WordPress login page, select that here. You will need to use the `authorizer_add_branding_option` filter in your theme to add it. You can see an example theme that implements this filter in the plugin directory under sample-theme-add-branding.", 'authorizer' ) . '</p>
5571	4346	';
5572	4347	$screen->add_help_tab(
5573	4348	array(
5574		- 'id' => 'help_auth_settings_advanced_content',
5575		- 'title' => __( 'Advanced', 'authorizer' ),
	4349	+ 'id' => 'help_auth_settings_advanced_content',
	4350	+ 'title' => __( 'Advanced', 'authorizer' ),
5576	4351	'content' => $help_auth_settings_advanced_content,
5577	4352	)
5578	4353	);
5579	4354	}
		@@ -5588,66 +4363,65 @@
5588	4363
5589	4364
5590	4365	/**
5591	4366	* Network Admin menu item
	4367	+ * Hook: network_admin_menu
5592	4368	*
5593		- * Action: network_admin_menu
5594		- *
	4369	+ * @param none
5595	4370	* @return void
5596	4371	*/
5597	4372	public function network_admin_menu() {
5598	4373	// @see http://codex.wordpress.org/Function_Reference/add_menu_page
5599	4374	add_menu_page(
5600		- 'Authorizer',
5601		- 'Authorizer',
5602		- 'manage_network_options',
5603		- 'authorizer',
	4375	+ 'Authorizer', // Page title
	4376	+ 'Authorizer', // Menu title
	4377	+ 'manage_network_options', // Capability
	4378	+ 'authorizer', // Menu slug
5604	4379	array( $this, 'create_network_admin_page' ),
5605		- 'dashicons-groups',
5606		- 89 // Position.
	4380	+ 'dashicons-groups', // Icon URL
	4381	+ 89 // Position
5607	4382	);
5608	4383	}
5609	4384
5610	4385
5611	4386	/**
5612		- * Output the HTML for the options page.
	4387	+ * Output the HTML for the options page
5613	4388	*/
5614	4389	public function create_network_admin_page() {
5615	4390	if ( ! current_user_can( 'manage_network_options' ) ) {
5616		- wp_die( wp_kses( __( 'You do not have sufficient permissions to access this page.', 'authorizer' ), $this->allowed_html ) );
	4391	+ wp_die( __( 'You do not have sufficient permissions to access this page.', 'authorizer' ) );
5617	4392	}
5618		- $auth_settings = get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings', array() );
5619		- ?>
	4393	+ $auth_settings = get_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings', array() ); ?>
5620	4394	<div class="wrap">
5621	4395	<form method="post" action="" autocomplete="off">
5622		- <h2><?php esc_html_e( 'Authorizer Settings', 'authorizer' ); ?></h2>
5623		- <p><?php echo wp_kses( __( 'Most <strong>Authorizer</strong> settings are set in the individual sites, but you can specify a few options here that apply to <strong>all sites in the network</strong>. These settings will override settings in the individual sites.', 'authorizer' ), $this->allowed_html ); ?></p>
	4396	+ <h2><?php _e( 'Authorizer Settings', 'authorizer' ); ?></h2>
	4397	+ <p><?php _e( 'Most <strong>Authorizer</strong> settings are set in the individual sites, but you can specify a few options here that apply to <strong>all sites in the network</strong>. These settings will override settings in the individual sites.', 'authorizer' ); ?></p>
5624	4398
5625		- <input type="checkbox" id="auth_settings_multisite_override" name="auth_settings[multisite_override]" value="1"<?php checked( 1 === intval( $auth_settings['multisite_override'] ) ); ?> /><label for="auth_settings_multisite_override"><?php esc_html_e( 'Override individual site settings with the settings below', 'authorizer' ); ?></label>
	4399	+ <input type="checkbox" id="auth_settings_multisite_override" name="auth_settings[multisite_override]" value="1"<?php checked( 1 == $auth_settings['multisite_override'] ); ?> /><label for="auth_settings_multisite_override"><?php _e( 'Override individual site settings with the settings below', 'authorizer' ); ?></label>
5626	4400
5627	4401	<div id="auth_multisite_settings_disabled_overlay" style="display: none;"></div>
5628	4402
5629	4403	<div class="wrap" id="auth_multisite_settings">
5630		- <?php $this->print_section_info_tabs( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?>
	4404	+ <?php $this->print_section_info_tabs( array( MULTISITE_ADMIN => true ) ); ?>
5631	4405
5632	4406	<?php wp_nonce_field( 'save_auth_settings', 'nonce_save_auth_settings' ); ?>
5633	4407
5634		- <?php // Custom access lists (for network, we only really want approved list, not pending or blocked). ?>
	4408	+ <?php // Custom access lists (for network, we only really want approved list, not pending or blocked) ?>
5635	4409	<div id="section_info_access_lists" class="section_info">
5636		- <p><?php esc_html_e( 'Manage who has access to all sites in the network.', 'authorizer' ); ?></p>
	4410	+ <p><?php _e( 'Manage who has access to all sites in the network.', 'authorizer' ); ?></p>
5637	4411	</div>
5638	4412	<table class="form-table"><tbody>
5639	4413	<tr>
5640		- <th scope="row"><?php esc_html_e( 'Who can log in to sites in this network?', 'authorizer' ); ?></th>
5641		- <td><?php $this->print_radio_auth_access_who_can_login( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4414	+ <th scope="row"><?php _e( 'Who can log in to sites in this network?', 'authorizer' ); ?></th>
	4415	+ <td><?php $this->print_radio_auth_access_who_can_login( array( MULTISITE_ADMIN => true ) ); ?></td>
5642	4416	</tr>
5643	4417	<tr>
5644		- <th scope="row"><?php esc_html_e( 'Who can view sites in this network?', 'authorizer' ); ?></th>
5645		- <td><?php $this->print_radio_auth_access_who_can_view( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4418	+ <th scope="row"><?php _e( 'Who can view sites in this network?', 'authorizer' ); ?></th>
	4419	+ <td><?php $this->print_radio_auth_access_who_can_view( array( MULTISITE_ADMIN => true ) ); ?></td>
5646	4420	</tr>
5647	4421	<tr>
5648		- <th scope="row"><?php esc_html_e( 'Approved Users (All Sites)', 'authorizer' ); ?><br /><small><em><?php echo wp_kses( __( 'Note: these users will <strong>not</strong> receive welcome emails when approved. Only users approved from individual sites can receive these messages.', 'authorizer' ), $this->allowed_html ); ?></em></small></th>
5649		- <td><?php $this->print_combo_auth_access_users_approved( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4422	+ <th scope="row"><?php _e( 'Approved Users (All Sites)', 'authorizer' ); ?><br /><small><em><?php _e( 'Note: these users will <strong>not</strong> receive welcome emails when approved. Only users approved from individual sites can receive these messages.', 'authorizer' ); ?></em></small></th>
	4423	+ <td><?php $this->print_combo_auth_access_users_approved( array( MULTISITE_ADMIN => true ) ); ?></td>
5650	4424	</tr>
5651	4425	</tbody></table>
5652	4426
5653	4427	<?php $this->print_section_info_external(); ?>
		@@ -5652,122 +4426,122 @@
5652	4426
5653	4427	<?php $this->print_section_info_external(); ?>
5654	4428	<table class="form-table"><tbody>
5655	4429	<tr>
5656		- <th scope="row"><?php esc_html_e( 'Default role for new users', 'authorizer' ); ?></th>
5657		- <td><?php $this->print_select_auth_access_default_role( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4430	+ <th scope="row"><?php _e( 'Default role for new users', 'authorizer' ); ?></th>
	4431	+ <td><?php $this->print_select_auth_access_default_role( array( MULTISITE_ADMIN => true ) ); ?></td>
5658	4432	</tr>
5659	4433	<tr>
5660		- <th scope="row"><?php esc_html_e( 'Google Logins', 'authorizer' ); ?></th>
5661		- <td><?php $this->print_checkbox_auth_external_google( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4434	+ <th scope="row"><?php _e( 'Google Logins', 'authorizer' ); ?></th>
	4435	+ <td><?php $this->print_checkbox_auth_external_google( array( MULTISITE_ADMIN => true ) ); ?></td>
5662	4436	</tr>
5663	4437	<tr>
5664		- <th scope="row"><?php esc_html_e( 'Google Client ID', 'authorizer' ); ?></th>
5665		- <td><?php $this->print_text_google_clientid( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4438	+ <th scope="row"><?php _e( 'Google Client ID', 'authorizer' ); ?></th>
	4439	+ <td><?php $this->print_text_google_clientid( array( MULTISITE_ADMIN => true ) ); ?></td>
5666	4440	</tr>
5667	4441	<tr>
5668		- <th scope="row"><?php esc_html_e( 'Google Client Secret', 'authorizer' ); ?></th>
5669		- <td><?php $this->print_text_google_clientsecret( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4442	+ <th scope="row"><?php _e( 'Google Client Secret', 'authorizer' ); ?></th>
	4443	+ <td><?php $this->print_text_google_clientsecret( array( MULTISITE_ADMIN => true ) ); ?></td>
5670	4444	</tr>
5671	4445	<tr>
5672		- <th scope="row"><?php esc_html_e( 'Google Hosted Domain', 'authorizer' ); ?></th>
5673		- <td><?php $this->print_text_google_hosteddomain( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4446	+ <th scope="row"><?php _e( 'Google Hosted Domain', 'authorizer' ); ?></th>
	4447	+ <td><?php $this->print_text_google_hosteddomain( array( MULTISITE_ADMIN => true ) ); ?></td>
5674	4448	</tr>
5675	4449	<tr>
5676		- <th scope="row"><?php esc_html_e( 'CAS Logins', 'authorizer' ); ?></th>
5677		- <td><?php $this->print_checkbox_auth_external_cas( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4450	+ <th scope="row"><?php _e( 'CAS Logins', 'authorizer' ); ?></th>
	4451	+ <td><?php $this->print_checkbox_auth_external_cas( array( MULTISITE_ADMIN => true ) ); ?></td>
5678	4452	</tr>
5679	4453	<tr>
5680		- <th scope="row"><?php esc_html_e( 'CAS Custom Label', 'authorizer' ); ?></th>
5681		- <td><?php $this->print_text_cas_custom_label( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4454	+ <th scope="row"><?php _e( 'CAS Custom Label', 'authorizer' ); ?></th>
	4455	+ <td><?php $this->print_text_cas_custom_label( array( MULTISITE_ADMIN => true ) ); ?></td>
5682	4456	</tr>
5683	4457	<tr>
5684		- <th scope="row"><?php esc_html_e( 'CAS server hostname', 'authorizer' ); ?></th>
5685		- <td><?php $this->print_text_cas_host( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4458	+ <th scope="row"><?php _e( 'CAS server hostname', 'authorizer' ); ?></th>
	4459	+ <td><?php $this->print_text_cas_host( array( MULTISITE_ADMIN => true ) ); ?></td>
5686	4460	</tr>
5687	4461	<tr>
5688		- <th scope="row"><?php esc_html_e( 'CAS server port', 'authorizer' ); ?></th>
5689		- <td><?php $this->print_text_cas_port( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4462	+ <th scope="row"><?php _e( 'CAS server port', 'authorizer' ); ?></th>
	4463	+ <td><?php $this->print_text_cas_port( array( MULTISITE_ADMIN => true ) ); ?></td>
5690	4464	</tr>
5691	4465	<tr>
5692		- <th scope="row"><?php esc_html_e( 'CAS server path/context', 'authorizer' ); ?></th>
5693		- <td><?php $this->print_text_cas_path( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4466	+ <th scope="row"><?php _e( 'CAS server path/context', 'authorizer' ); ?></th>
	4467	+ <td><?php $this->print_text_cas_path( array( MULTISITE_ADMIN => true ) ); ?></td>
5694	4468	</tr>
5695	4469	<tr>
5696		- <th scope="row"><?php esc_html_e( 'CAS server version', 'authorizer' ); ?></th>
5697		- <td><?php $this->print_select_cas_version( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4470	+ <th scope="row"><?php _e( 'CAS server version', 'authorizer' ); ?></th>
	4471	+ <td><?php $this->print_select_cas_version( array( MULTISITE_ADMIN => true ) ); ?></td>
5698	4472	</tr>
5699	4473	<tr>
5700		- <th scope="row"><?php esc_html_e( 'CAS attribute containing email', 'authorizer' ); ?></th>
5701		- <td><?php $this->print_text_cas_attr_email( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4474	+ <th scope="row"><?php _e( 'CAS attribute containing email', 'authorizer' ); ?></th>
	4475	+ <td><?php $this->print_text_cas_attr_email( array( MULTISITE_ADMIN => true ) ); ?></td>
5702	4476	</tr>
5703	4477	<tr>
5704		- <th scope="row"><?php esc_html_e( 'CAS attribute containing first name', 'authorizer' ); ?></th>
5705		- <td><?php $this->print_text_cas_attr_first_name( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4478	+ <th scope="row"><?php _e( 'CAS attribute containing first name', 'authorizer' ); ?></th>
	4479	+ <td><?php $this->print_text_cas_attr_first_name( array( MULTISITE_ADMIN => true ) ); ?></td>
5706	4480	</tr>
5707	4481	<tr>
5708		- <th scope="row"><?php esc_html_e( 'CAS attribute containing last name', 'authorizer' ); ?></th>
5709		- <td><?php $this->print_text_cas_attr_last_name( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4482	+ <th scope="row"><?php _e( 'CAS attribute containing last name', 'authorizer' ); ?></th>
	4483	+ <td><?php $this->print_text_cas_attr_last_name( array( MULTISITE_ADMIN => true ) ); ?></td>
5710	4484	</tr>
5711	4485	<tr>
5712		- <th scope="row"><?php esc_html_e( 'CAS attribute update', 'authorizer' ); ?></th>
5713		- <td><?php $this->print_checkbox_cas_attr_update_on_login( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4486	+ <th scope="row"><?php _e( 'CAS attribute update', 'authorizer' ); ?></th>
	4487	+ <td><?php $this->print_checkbox_cas_attr_update_on_login( array( MULTISITE_ADMIN => true ) ); ?></td>
5714	4488	</tr>
5715	4489	<tr>
5716		- <th scope="row"><?php esc_html_e( 'CAS automatic login', 'authorizer' ); ?></th>
5717		- <td><?php $this->print_checkbox_cas_auto_login( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4490	+ <th scope="row"><?php _e( 'CAS automatic login', 'authorizer' ); ?></th>
	4491	+ <td><?php $this->print_checkbox_cas_auto_login( array( MULTISITE_ADMIN => true ) ); ?></td>
5718	4492	</tr>
5719	4493	<tr>
5720		- <th scope="row"><?php esc_html_e( 'LDAP Logins', 'authorizer' ); ?></th>
5721		- <td><?php $this->print_checkbox_auth_external_ldap( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4494	+ <th scope="row"><?php _e( 'LDAP Logins', 'authorizer' ); ?></th>
	4495	+ <td><?php $this->print_checkbox_auth_external_ldap( array( MULTISITE_ADMIN => true ) ); ?></td>
5722	4496	</tr>
5723	4497	<tr>
5724		- <th scope="row"><?php esc_html_e( 'LDAP Host', 'authorizer' ); ?></th>
5725		- <td><?php $this->print_text_ldap_host( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4498	+ <th scope="row"><?php _e( 'LDAP Host', 'authorizer' ); ?></th>
	4499	+ <td><?php $this->print_text_ldap_host( array( MULTISITE_ADMIN => true ) ); ?></td>
5726	4500	</tr>
5727	4501	<tr>
5728		- <th scope="row"><?php esc_html_e( 'LDAP Port', 'authorizer' ); ?></th>
5729		- <td><?php $this->print_text_ldap_port( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4502	+ <th scope="row"><?php _e( 'LDAP Port', 'authorizer' ); ?></th>
	4503	+ <td><?php $this->print_text_ldap_port( array( MULTISITE_ADMIN => true ) ); ?></td>
5730	4504	</tr>
5731	4505	<tr>
5732		- <th scope="row"><?php esc_html_e( 'Use TLS', 'authorizer' ); ?></th>
5733		- <td><?php $this->print_checkbox_ldap_tls( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4506	+ <th scope="row"><?php _e( 'Secure Connection (TLS)', 'authorizer' ); ?></th>
	4507	+ <td><?php $this->print_checkbox_ldap_tls( array( MULTISITE_ADMIN => true ) ); ?></td>
5734	4508	</tr>
5735	4509	<tr>
5736		- <th scope="row"><?php esc_html_e( 'LDAP Search Base', 'authorizer' ); ?></th>
5737		- <td><?php $this->print_text_ldap_search_base( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4510	+ <th scope="row"><?php _e( 'LDAP Search Base', 'authorizer' ); ?></th>
	4511	+ <td><?php $this->print_text_ldap_search_base( array( MULTISITE_ADMIN => true ) ); ?></td>
5738	4512	</tr>
5739	4513	<tr>
5740		- <th scope="row"><?php esc_html_e( 'LDAP attribute containing username', 'authorizer' ); ?></th>
5741		- <td><?php $this->print_text_ldap_uid( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4514	+ <th scope="row"><?php _e( 'LDAP attribute containing username', 'authorizer' ); ?></th>
	4515	+ <td><?php $this->print_text_ldap_uid( array( MULTISITE_ADMIN => true ) ); ?></td>
5742	4516	</tr>
5743	4517	<tr>
5744		- <th scope="row"><?php esc_html_e( 'LDAP attribute containing email', 'authorizer' ); ?></th>
5745		- <td><?php $this->print_text_ldap_attr_email( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4518	+ <th scope="row"><?php _e( 'LDAP attribute containing email', 'authorizer' ); ?></th>
	4519	+ <td><?php $this->print_text_ldap_attr_email( array( MULTISITE_ADMIN => true ) ); ?></td>
5746	4520	</tr>
5747	4521	<tr>
5748		- <th scope="row"><?php esc_html_e( 'LDAP Directory User', 'authorizer' ); ?></th>
5749		- <td><?php $this->print_text_ldap_user( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4522	+ <th scope="row"><?php _e( 'LDAP Directory User', 'authorizer' ); ?></th>
	4523	+ <td><?php $this->print_text_ldap_user( array( MULTISITE_ADMIN => true ) ); ?></td>
5750	4524	</tr>
5751	4525	<tr>
5752		- <th scope="row"><?php esc_html_e( 'LDAP Directory User Password', 'authorizer' ); ?></th>
5753		- <td><?php $this->print_password_ldap_password( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4526	+ <th scope="row"><?php _e( 'LDAP Directory User Password', 'authorizer' ); ?></th>
	4527	+ <td><?php $this->print_password_ldap_password( array( MULTISITE_ADMIN => true ) ); ?></td>
5754	4528	</tr>
5755	4529	<tr>
5756		- <th scope="row"><?php esc_html_e( 'Custom lost password URL', 'authorizer' ); ?></th>
5757		- <td><?php $this->print_text_ldap_lostpassword_url( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4530	+ <th scope="row"><?php _e( 'Custom lost password URL', 'authorizer' ); ?></th>
	4531	+ <td><?php $this->print_text_ldap_lostpassword_url( array( MULTISITE_ADMIN => true ) ); ?></td>
5758	4532	</tr>
5759	4533	<tr>
5760		- <th scope="row"><?php esc_html_e( 'LDAP attribute containing first name', 'authorizer' ); ?></th>
5761		- <td><?php $this->print_text_ldap_attr_first_name( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4534	+ <th scope="row"><?php _e( 'LDAP attribute containing first name', 'authorizer' ); ?></th>
	4535	+ <td><?php $this->print_text_ldap_attr_first_name( array( MULTISITE_ADMIN => true ) ); ?></td>
5762	4536	</tr>
5763	4537	<tr>
5764		- <th scope="row"><?php esc_html_e( 'LDAP attribute containing last name', 'authorizer' ); ?></th>
5765		- <td><?php $this->print_text_ldap_attr_last_name( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4538	+ <th scope="row"><?php _e( 'LDAP attribute containing last name', 'authorizer' ); ?></th>
	4539	+ <td><?php $this->print_text_ldap_attr_last_name( array( MULTISITE_ADMIN => true ) ); ?></td>
5766	4540	</tr>
5767	4541	<tr>
5768		- <th scope="row"><?php esc_html_e( 'LDAP attribute update', 'authorizer' ); ?></th>
5769		- <td><?php $this->print_checkbox_ldap_attr_update_on_login( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4542	+ <th scope="row"><?php _e( 'LDAP attribute update', 'authorizer' ); ?></th>
	4543	+ <td><?php $this->print_checkbox_ldap_attr_update_on_login( array( MULTISITE_ADMIN => true ) ); ?></td>
5770	4544	</tr>
5771	4545	</tbody></table>
5772	4546
5773	4547	<?php $this->print_section_info_advanced(); ?>
		@@ -5772,36 +4546,20 @@
5772	4546
5773	4547	<?php $this->print_section_info_advanced(); ?>
5774	4548	<table class="form-table"><tbody>
5775	4549	<tr>
5776		- <th scope="row"><?php esc_html_e( 'Limit invalid login attempts', 'authorizer' ); ?></th>
5777		- <td><?php $this->print_text_auth_advanced_lockouts( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4550	+ <th scope="row"><?php _e( 'Limit invalid login attempts', 'authorizer' ); ?></th>
	4551	+ <td><?php $this->print_text_auth_advanced_lockouts( array( MULTISITE_ADMIN => true ) ); ?></td>
5778	4552	</tr>
5779	4553	<tr>
5780		- <th scope="row"><?php esc_html_e( 'Hide WordPress Logins', 'authorizer' ); ?></th>
5781		- <td><?php $this->print_checkbox_auth_advanced_hide_wp_login( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4554	+ <th scope="row"><?php _e( 'Hide WordPress Logins', 'authorizer' ); ?></th>
	4555	+ <td><?php $this->print_checkbox_auth_advanced_hide_wp_login( array( MULTISITE_ADMIN => true ) ); ?></td>
5782	4556	</tr>
5783		- <tr>
5784		- <th scope="row"><?php esc_html_e( 'Number of users per page', 'authorizer' ); ?></th>
5785		- <td><?php $this->print_text_auth_advanced_users_per_page( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
5786		- </tr>
5787		- <tr>
5788		- <th scope="row"><?php esc_html_e( 'Approved users sort method', 'authorizer' ); ?></th>
5789		- <td><?php $this->print_select_auth_advanced_users_sort_by( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
5790		- </tr>
5791		- <tr>
5792		- <th scope="row"><?php esc_html_e( 'Approved users sort order', 'authorizer' ); ?></th>
5793		- <td><?php $this->print_select_auth_advanced_users_sort_order( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
5794		- </tr>
5795		- <tr>
5796		- <th scope="row"><?php esc_html_e( 'Show Dashboard Widget', 'authorizer' ); ?></th>
5797		- <td><?php $this->print_checkbox_auth_advanced_widget_enabled( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
5798		- </tr>
5799	4557	</tbody></table>
5800	4558
5801	4559	<br class="clear" />
5802	4560	</div>
5803		- <input type="button" name="submit" id="submit" class="button button-primary" value="<?php esc_attr_e( 'Save Changes', 'authorizer' ); ?>" onclick="saveAuthMultisiteSettings(this);" />
	4561	+ <input type="button" name="submit" id="submit" class="button button-primary" value="<?php _e( 'Save Changes', 'authorizer' ); ?>" onclick="save_auth_multisite_settings(this);" />
5804	4562	</form>
5805	4563	</div>
5806	4564	<?php
5807	4565	}
		@@ -5808,12 +4566,10 @@
5808	4566
5809	4567
5810	4568	/**
5811	4569	* Save multisite settings (ajax call).
5812		- *
5813		- * Action: wp_ajax_save_auth_multisite_settings
5814	4570	*/
5815		- public function ajax_save_auth_multisite_settings() {
	4571	+ function ajax_save_auth_multisite_settings() {
5816	4572	// Fail silently if current user doesn't have permissions.
5817	4573	if ( ! current_user_can( 'manage_network_options' ) ) {
5818	4574	die( '' );
5819	4575	}
		@@ -5818,14 +4574,14 @@
5818	4574	die( '' );
5819	4575	}
5820	4576
5821	4577	// Make sure nonce exists.
5822		- if ( empty( $_POST['nonce'] ) ) {
	4578	+ if ( empty( $_POST['nonce_save_auth_settings'] ) ) {
5823	4579	die( '' );
5824	4580	}
5825	4581
5826	4582	// Nonce check.
5827		- if ( ! wp_verify_nonce( sanitize_key( $_POST['nonce'] ), 'save_auth_settings' ) ) {
	4583	+ if ( ! wp_verify_nonce( $_POST['nonce_save_auth_settings'], 'save_auth_settings' ) ) {
5828	4584	die( '' );
5829	4585	}
5830	4586
5831	4587	// Assert multisite.
		@@ -5833,15 +4589,15 @@
5833	4589	die( '' );
5834	4590	}
5835	4591
5836	4592	// Get multisite settings.
5837		- $auth_multisite_settings = get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings', array() );
	4593	+ $auth_multisite_settings = get_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings', array() );
5838	4594
5839		- // Sanitize settings.
	4595	+ // Sanitize settings
5840	4596	$auth_multisite_settings = $this->sanitize_options( $_POST );
5841	4597
5842		- // Filter options to only the allowed values (multisite options are a subset of all options).
5843		- $allowed = array(
	4598	+ // Filter options to only the allowed values (multisite options are a subset of all options)
	4599	+ $allowed = array(
5844	4600	'multisite_override',
5845	4601	'access_who_can_login',
5846	4602	'access_who_can_view',
5847	4603	'access_default_role',
		@@ -5874,17 +4630,13 @@
5874	4630	'ldap_attr_last_name',
5875	4631	'ldap_attr_update_on_login',
5876	4632	'advanced_lockouts',
5877	4633	'advanced_hide_wp_login',
5878		- 'advanced_users_per_page',
5879		- 'advanced_users_sort_by',
5880		- 'advanced_users_sort_order',
5881		- 'advanced_widget_enabled',
5882	4634	);
5883	4635	$auth_multisite_settings = array_intersect_key( $auth_multisite_settings, array_flip( $allowed ) );
5884	4636
5885	4637	// Update multisite settings in database.
5886		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings', $auth_multisite_settings );
	4638	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings', $auth_multisite_settings );
5887	4639
5888	4640	// Return 'success' value to AJAX call.
5889	4641	die( 'success' );
5890	4642	}
		@@ -5898,67 +4650,42 @@
5898	4650	*/
5899	4651
5900	4652
5901	4653
5902		- /**
5903		- * Load Authorizer dashboard widget if it's enabled.
5904		- *
5905		- * Action: wp_dashboard_setup
5906		- */
5907		- public function add_dashboard_widgets() {
5908		- $widget_enabled = $this->get_plugin_option( 'advanced_widget_enabled', WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' ) === '1';
5909		-
5910		- // Load authorizer dashboard widget if it's enabled and user has permission.
5911		- if ( current_user_can( 'create_users' ) && $widget_enabled ) {
5912		- // Add dashboard widget for adding/editing users with access.
	4654	+ function add_dashboard_widgets() {
	4655	+ // Only users who can edit can see the authorizer dashboard widget
	4656	+ if ( current_user_can( 'create_users' ) ) {
	4657	+ // Add dashboard widget for adding/editing users with access
5913	4658	wp_add_dashboard_widget( 'auth_dashboard_widget', __( 'Authorizer Settings', 'authorizer' ), array( $this, 'add_auth_dashboard_widget' ) );
5914	4659	}
5915	4660	}
5916	4661
5917	4662
5918		- /**
5919		- * Render Authorizer dashboard widget (callback).
5920		- */
5921		- public function add_auth_dashboard_widget() {
5922		- ?>
5923		- <form method="post" id="auth_settings_access_form" action="">
	4663	+ function add_auth_dashboard_widget() {
	4664	+ ?><form method="post" id="auth_settings_access_form" action="">
5924	4665	<?php $this->print_section_info_access_login(); ?>
5925	4666	<div>
5926		- <h2><?php esc_html_e( 'Pending Users', 'authorizer' ); ?></h2>
	4667	+ <h2><?php _e( 'Pending Users', 'authorizer' ); ?></h2>
5927	4668	<?php $this->print_combo_auth_access_users_pending(); ?>
5928	4669	</div>
5929	4670	<div>
5930		- <h2><?php esc_html_e( 'Approved Users', 'authorizer' ); ?></h2>
	4671	+ <h2><?php _e( 'Approved Users', 'authorizer' ); ?></h2>
5931	4672	<?php $this->print_combo_auth_access_users_approved(); ?>
5932	4673	</div>
5933	4674	<div>
5934		- <h2><?php esc_html_e( 'Blocked Users', 'authorizer' ); ?></h2>
	4675	+ <h2><?php _e( 'Blocked Users', 'authorizer' ); ?></h2>
5935	4676	<?php $this->print_combo_auth_access_users_blocked(); ?>
5936	4677	</div>
5937	4678	<br class="clear" />
5938		- </form>
5939		- <?php
	4679	+ </form><?php
5940	4680	}
5941	4681
5942	4682
5943		-
5944		- /**
5945		- * ***************************
5946		- * AJAX Actions
5947		- * ***************************
5948		- */
5949		-
5950		-
5951		-
5952		- /**
5953		- * Re-render the Approved User list (usually triggered if pager params have
5954		- * changed, e.g., current page, search term, sort order).
5955		- *
5956		- * Action: wp_ajax_refresh_approved_user_list
5957		- *
5958		- * @return void
5959		- */
5960		- public function ajax_refresh_approved_user_list() {
	4683	+ // Fired on a change event from the optional usermeta field in the
	4684	+ // approved user list. Updates the selected usermeta value, or saves it
	4685	+ // in the user's approved list entry if the user hasn't logged in yet
	4686	+ // and created a WordPress account.
	4687	+ function ajax_update_auth_usermeta() {
5961	4688	// Fail silently if current user doesn't have permissions.
5962	4689	if ( ! current_user_can( 'create_users' ) ) {
5963	4690	die( '' );
5964	4691	}
		@@ -5963,175 +4690,35 @@
5963	4690	die( '' );
5964	4691	}
5965	4692
5966	4693	// Nonce check.
5967		- if ( empty( $_POST['nonce'] ) || ! wp_verify_nonce( sanitize_key( $_POST['nonce'] ), 'save_auth_settings' ) ) {
	4694	+ if ( empty( $_POST['nonce_save_auth_settings'] ) || ! wp_verify_nonce( $_POST['nonce_save_auth_settings'], 'save_auth_settings' ) ) {
5968	4695	die( '' );
5969	4696	}
5970	4697
5971	4698	// Fail if required post data doesn't exist.
5972		- if ( ! array_key_exists( 'paged', $_REQUEST ) ) {
	4699	+ if ( ! array_key_exists( 'email', $_REQUEST ) || ! array_key_exists( 'usermeta', $_REQUEST ) ) {
5973	4700	die( '' );
5974	4701	}
5975	4702
5976		- // Get defaults.
5977		- $success = true;
5978		- $message = '';
5979		- $is_network_admin = isset( $_REQUEST['is_network_admin'] ) && '1' === $_REQUEST['is_network_admin'];
5980		-
5981		- // Get user list.
5982		- $option = 'access_users_approved';
5983		- $admin_mode = is_multisite() && $is_network_admin ? WP_Plugin_Authorizer::NETWORK_CONTEXT : WP_Plugin_Authorizer::SINGLE_CONTEXT;
5984		- $auth_settings_option = $this->get_plugin_option( $option, $admin_mode, 'no override' );
5985		- $auth_settings_option = is_array( $auth_settings_option ) ? $auth_settings_option : array();
5986		-
5987		- // Get multisite approved users (will be added to top of list, greyed out).
5988		- $auth_override_multisite = $this->get_plugin_option( 'advanced_override_multisite' );
5989		- $auth_multisite_settings = $this->get_plugin_options( WP_Plugin_Authorizer::NETWORK_CONTEXT );
5990		- $auth_settings_option_multisite = array();
5991		- if (
5992		- is_multisite() &&
5993		- ! $is_network_admin &&
5994		- 1 !== intval( $auth_override_multisite ) &&
5995		- array_key_exists( 'multisite_override', $auth_multisite_settings ) &&
5996		- '1' === $auth_multisite_settings['multisite_override']
5997		- ) {
5998		- $auth_settings_option_multisite = $this->get_plugin_option( $option, WP_Plugin_Authorizer::NETWORK_CONTEXT, 'allow override' );
5999		- $auth_settings_option_multisite = is_array( $auth_settings_option_multisite ) ? $auth_settings_option_multisite : array();
6000		- // Add multisite users to the beginning of the main user array.
6001		- foreach ( array_reverse( $auth_settings_option_multisite ) as $approved_user ) {
6002		- $approved_user['multisite_user'] = true;
6003		- array_unshift( $auth_settings_option, $approved_user );
6004		- }
6005		- }
6006		-
6007		- // Get custom usermeta field to show.
6008		- $advanced_usermeta = $this->get_plugin_option( 'advanced_usermeta' );
6009		-
6010		- // Filter user list to search terms.
6011		- if ( ! empty( $_REQUEST['search'] ) ) {
6012		- $search_term = sanitize_text_field( wp_unslash( $_REQUEST['search'] ) );
6013		- $auth_settings_option = array_filter(
6014		- $auth_settings_option, function ( $user ) use ( $search_term ) {
6015		- return stripos( $user['email'], $search_term ) !== false ||
6016		- stripos( $user['role'], $search_term ) !== false ||
6017		- stripos( $user['date_added'], $search_term ) !== false;
6018		- }
6019		- );
6020		- }
6021		-
6022		- // Sort user list.
6023		- $sort_by = $this->get_plugin_option( 'advanced_users_sort_by', WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' ); // email, role, date_added (registered), created (date approved).
6024		- $sort_order = $this->get_plugin_option( 'advanced_users_sort_order', WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' ); // asc or desc.
6025		- $sort_dimension = array();
6026		- if ( in_array( $sort_by, array( 'email', 'role', 'date_added' ), true ) ) {
6027		- foreach ( $auth_settings_option as $key => $user ) {
6028		- if ( 'date_added' === $sort_by ) {
6029		- $sort_dimension[ $key ] = date( 'Ymd', strtotime( $user[ $sort_by ] ) );
6030		- } else {
6031		- $sort_dimension[ $key ] = strtolower( $user[ $sort_by ] );
6032		- }
6033		- }
6034		- $sort_order = 'asc' === $sort_order ? SORT_ASC : SORT_DESC;
6035		- array_multisort( $sort_dimension, $sort_order, $auth_settings_option );
6036		- } elseif ( 'created' === $sort_by && 'asc' !== $sort_order ) {
6037		- // If default sort method and reverse order, just reverse the array.
6038		- $auth_settings_option = array_reverse( $auth_settings_option );
6039		- }
6040		-
6041		- // Ensure array keys run from 0..max (keys in database will be the original,
6042		- // index, and removing users will not reorder the array keys of other users).
6043		- $auth_settings_option = array_values( $auth_settings_option );
6044		-
6045		- // Get pager params.
6046		- $total_users = count( $auth_settings_option );
6047		- $users_per_page = intval( $this->get_plugin_option( 'advanced_users_per_page', WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' ) );
6048		- $current_page = isset( $_REQUEST['paged'] ) ? intval( $_REQUEST['paged'] ) : 1;
6049		- $total_pages = ceil( $total_users / $users_per_page );
6050		- if ( $total_pages < 1 ) {
6051		- $total_pages = 1;
6052		- }
6053		-
6054		- // Make sure current_page is between 1 and max pages.
6055		- if ( $current_page < 1 ) {
6056		- $current_page = 1;
6057		- } elseif ( $current_page > $total_pages ) {
6058		- $current_page = $total_pages;
6059		- }
6060		-
6061		- // Render user list.
6062		- ob_start();
6063		- $offset = ( $current_page - 1 ) * $users_per_page;
6064		- $max = min( $offset + $users_per_page, count( $auth_settings_option ) );
6065		- for ( $key = $offset; $key < $max; $key++ ) :
6066		- $approved_user = $auth_settings_option[ $key ];
6067		- if ( empty( $approved_user ) || count( $approved_user ) < 1 ) :
6068		- continue;
6069		- endif;
6070		- $this->render_user_element( $approved_user, $key, $option, $admin_mode, $advanced_usermeta );
6071		- endfor;
6072		-
6073		- // Send response to client.
6074		- $response = array(
6075		- 'success' => $success,
6076		- 'message' => $message,
6077		- 'html' => ob_get_clean(),
6078		- /* TRANSLATORS: %s: number of users */
6079		- 'total_users_html' => sprintf( _n( '%s user', '%s users', $total_users, 'authorizer' ), number_format_i18n( $total_users ) ),
6080		- 'total_pages_html' => number_format_i18n( $total_pages ),
6081		- 'total_pages' => $total_pages,
6082		- );
6083		- header( 'content-type: application/json' );
6084		- echo wp_json_encode( $response );
6085		- exit;
6086		- }
6087		-
6088		-
6089		- /**
6090		- * Fired on a change event from the optional usermeta field in the approved
6091		- * user list. Updates the selected usermeta value, or saves it in the user's
6092		- * approved list entry if the user hasn't logged in yet and created a
6093		- * WordPress account.
6094		- *
6095		- * Action: wp_ajax_update_auth_usermeta
6096		- *
6097		- * @return void
6098		- */
6099		- public function ajax_update_auth_usermeta() {
6100		- // Fail silently if current user doesn't have permissions.
6101		- if ( ! current_user_can( 'create_users' ) ) {
6102		- die( '' );
6103		- }
6104		-
6105		- // Nonce check.
6106		- if ( empty( $_POST['nonce'] ) || ! wp_verify_nonce( sanitize_key( $_POST['nonce'] ), 'save_auth_settings' ) ) {
6107		- die( '' );
6108		- }
6109		-
6110		- // Fail if required post data doesn't exist.
6111		- if ( ! isset( $_REQUEST['email'], $_REQUEST['usermeta'] ) ) {
6112		- die( '' );
6113		- }
6114		-
6115	4703	// Get values to update from post data.
6116		- $email = sanitize_email( wp_unslash( $_REQUEST['email'] ) );
6117		- $meta_value = sanitize_meta( 'authorizer-usermeta', wp_unslash( $_REQUEST['usermeta'] ), 'user' );
6118		- $meta_key = $this->get_plugin_option( 'advanced_usermeta' );
	4704	+ $email = $_REQUEST['email'];
	4705	+ $meta_value = $_REQUEST['usermeta'];
	4706	+ $meta_key = $this->get_plugin_option( 'advanced_usermeta' );
6119	4707
6120	4708	// If user doesn't exist, save usermeta selection to authorizer
6121	4709	// list. This value will get saved to usermeta when the user first
6122	4710	// logs in (i.e., when their WordPress account is created).
6123		- $wp_user = get_user_by( 'email', $email );
6124		- if ( ! $wp_user ) {
	4711	+ if ( ! ( $wp_user = get_user_by( 'email', $email ) ) ) {
6125	4712	// Look through multisite approved users and add a usermeta
6126	4713	// reference for the current blog if the user is found.
6127		- $auth_multisite_settings_access_users_approved = is_multisite() ? get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', array() ) : array();
	4714	+ $auth_multisite_settings_access_users_approved = is_multisite() ? get_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', array() ) : array();
6128	4715	$should_update_auth_multisite_settings_access_users_approved = false;
6129	4716	foreach ( $auth_multisite_settings_access_users_approved as $index => $approved_user ) {
6130		- if ( 0 === strcasecmp( $email, $approved_user['email'] ) ) {
6131		- if ( ! is_array( $auth_multisite_settings_access_users_approved[ $index ]['usermeta'] ) ) {
	4717	+ if ( $email === $approved_user['email'] ) {
	4718	+ if ( ! is_array( $auth_multisite_settings_access_users_approved[$index]['usermeta'] ) ) {
6132	4719	// Initialize the array of usermeta for each blog this user belongs to.
6133		- $auth_multisite_settings_access_users_approved[ $index ]['usermeta'] = array();
	4720	+ $auth_multisite_settings_access_users_approved[$index]['usermeta'] = array();
6134	4721	} else {
6135	4722	// There is already usermeta associated with this
6136	4723	// preapproved user; iterate through it and make
6137	4724	// sure it's not for old meta_keys (delete it if
		@@ -6137,53 +4724,55 @@
6137	4724	// sure it's not for old meta_keys (delete it if
6138	4725	// so). This can happen if someone changes the
6139	4726	// usermeta key in authorizer options, and we don't
6140	4727	// want to hang on to old data.
6141		- foreach ( $auth_multisite_settings_access_users_approved[ $index ]['usermeta'] as $blog_id => $usermeta ) {
	4728	+ foreach ( $auth_multisite_settings_access_users_approved[$index]['usermeta'] as $blog_id => $usermeta ) {
6142	4729	if ( array_key_exists( 'meta_key', $usermeta ) && $usermeta['meta_key'] === $meta_key ) {
6143	4730	continue;
6144	4731	} else {
6145		- unset( $auth_multisite_settings_access_users_approved[ $index ]['usermeta'][ $blog_id ] );
	4732	+ unset( $auth_multisite_settings_access_users_approved[$index]['usermeta'][$blog_id] );
6146	4733	}
6147	4734	}
6148	4735	}
6149		- $auth_multisite_settings_access_users_approved[ $index ]['usermeta'][ get_current_blog_id() ] = array(
6150		- 'meta_key' => $meta_key,
	4736	+ $auth_multisite_settings_access_users_approved[$index]['usermeta'][get_current_blog_id()] = array(
	4737	+ 'meta_key' => $meta_key,
6151	4738	'meta_value' => $meta_value,
6152	4739	);
6153		- $should_update_auth_multisite_settings_access_users_approved = true;
	4740	+ $should_update_auth_multisite_settings_access_users_approved = true;
6154	4741	}
6155	4742	}
6156	4743	if ( $should_update_auth_multisite_settings_access_users_approved ) {
6157		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
	4744	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
6158	4745	}
6159	4746
6160	4747	// Look through the approved users (of the current blog in a
6161	4748	// multisite install, or just of the single site) and add a
6162	4749	// usermeta reference if the user is found.
6163		- $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT );
	4750	+ $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN );
6164	4751	$should_update_auth_settings_access_users_approved = false;
6165	4752	foreach ( $auth_settings_access_users_approved as $index => $approved_user ) {
6166		- if ( 0 === strcasecmp( $email, $approved_user['email'] ) ) {
6167		- $auth_settings_access_users_approved[ $index ]['usermeta'] = array(
6168		- 'meta_key' => $meta_key,
	4753	+ if ( $email === $approved_user['email'] ) {
	4754	+ $auth_settings_access_users_approved[$index]['usermeta'] = array(
	4755	+ 'meta_key' => $meta_key,
6169	4756	'meta_value' => $meta_value,
6170	4757	);
6171		- $should_update_auth_settings_access_users_approved = true;
	4758	+ $should_update_auth_settings_access_users_approved = true;
6172	4759	}
6173	4760	}
6174	4761	if ( $should_update_auth_settings_access_users_approved ) {
6175	4762	update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved );
6176	4763	}
	4764	+
6177	4765	} else {
6178	4766	// Update user's usermeta value for usermeta key stored in authorizer options.
6179	4767	if ( strpos( $meta_key, 'acf___' ) === 0 && class_exists( 'acf' ) ) {
6180	4768	// We have an ACF field value, so use the ACF function to update it.
6181		- update_field( str_replace( 'acf___', '', $meta_key ), $meta_value, 'user_' . $wp_user->ID );
	4769	+ update_field( str_replace('acf___', '', $meta_key ), $meta_value, 'user_' . $wp_user->ID );
6182	4770	} else {
6183	4771	// We have a normal usermeta value, so just update it via the WordPress function.
6184	4772	update_user_meta( $wp_user->ID, $meta_key, $meta_value );
6185	4773	}
	4774	+
6186	4775	}
6187	4776
6188	4777	// Return 'success' value to AJAX call.
6189	4778	die( 'success' );
		@@ -6189,17 +4778,9 @@
6189	4778	die( 'success' );
6190	4779	}
6191	4780
6192	4781
6193		- /**
6194		- * Fired on a change event from the user fields in the user lists. Updates
6195		- * the selected user value.
6196		- *
6197		- * Action: wp_ajax_update_auth_user
6198		- *
6199		- * @return void
6200		- */
6201		- public function ajax_update_auth_user() {
	4782	+ function ajax_update_auth_user() {
6202	4783	// Fail silently if current user doesn't have permissions.
6203	4784	if ( ! current_user_can( 'create_users' ) ) {
6204	4785	die( '' );
6205	4786	}
		@@ -6204,83 +4785,76 @@
6204	4785	die( '' );
6205	4786	}
6206	4787
6207	4788	// Nonce check.
6208		- if ( empty( $_POST['nonce'] ) || ! wp_verify_nonce( sanitize_key( $_POST['nonce'] ), 'save_auth_settings' ) ) {
	4789	+ if ( empty( $_POST['nonce_save_auth_settings'] ) || ! wp_verify_nonce( $_POST['nonce_save_auth_settings'], 'save_auth_settings' ) ) {
6209	4790	die( '' );
6210	4791	}
6211	4792
6212	4793	// Fail if requesting a change to an invalid setting.
6213		- if ( ! isset( $_POST['setting'] ) || ! in_array( wp_unslash( $_POST['setting'] ), array( 'access_users_pending', 'access_users_approved', 'access_users_blocked' ), true ) ) {
	4794	+ if ( ! in_array( $_POST['setting'], array( 'access_users_pending', 'access_users_approved', 'access_users_blocked' ) ) ) {
6214	4795	die( '' );
6215	4796	}
6216	4797
6217		- // Track any emails that couldn't be added (used when adding users).
6218		- $invalid_emails = array();
6219		-
6220	4798	// Editing a pending list entry.
6221		- if ( 'access_users_pending' === $_POST['setting'] ) {
6222		- // Sanitize posted data.
6223		- $access_users_pending = array();
6224		- if ( isset( $_POST['access_users_pending'] ) && is_array( $_POST['access_users_pending'] ) ) {
6225		- $access_users_pending = $this->sanitize_update_auth_users( wp_unslash( $_POST['access_users_pending'] ) );
	4799	+ if ( $_POST['setting'] === 'access_users_pending' ) {
	4800	+ // Initialize posted data if empty.
	4801	+ if ( ! ( array_key_exists( 'access_users_pending', $_POST ) && is_array( $_POST['access_users_pending'] ) ) ) {
	4802	+ $_POST['access_users_pending'] = array();
6226	4803	}
6227	4804
6228	4805	// Deal with each modified user (add or remove).
6229		- foreach ( $access_users_pending as $pending_user ) {
	4806	+ foreach ( $_POST['access_users_pending'] as $pending_user ) {
6230	4807
6231		- if ( 'add' === $pending_user['edit_action'] ) {
	4808	+ if ( $pending_user['edit_action'] === 'add' ) {
6232	4809
6233	4810	// Add new user to pending list and save (skip if it's
6234	4811	// already there--someone else might have just done it).
6235	4812	if ( ! $this->is_email_in_list( $pending_user['email'], 'pending' ) ) {
6236	4813	$auth_settings_access_users_pending = $this->sanitize_user_list(
6237		- $this->get_plugin_option( 'access_users_pending', WP_Plugin_Authorizer::SINGLE_CONTEXT )
	4814	+ $this->get_plugin_option( 'access_users_pending', SINGLE_ADMIN )
6238	4815	);
6239	4816	array_push( $auth_settings_access_users_pending, $pending_user );
6240	4817	update_option( 'auth_settings_access_users_pending', $auth_settings_access_users_pending );
6241	4818	}
6242		- } elseif ( 'remove' === $pending_user['edit_action'] ) {
6243	4819
6244		- // Remove user from pending list and save.
	4820	+ } elseif ( $pending_user['edit_action'] === 'remove' ) {
	4821	+
	4822	+ // Remove user from pending list and save
6245	4823	if ( $this->is_email_in_list( $pending_user['email'], 'pending' ) ) {
6246	4824	$auth_settings_access_users_pending = $this->sanitize_user_list(
6247		- $this->get_plugin_option( 'access_users_pending', WP_Plugin_Authorizer::SINGLE_CONTEXT )
	4825	+ $this->get_plugin_option( 'access_users_pending', SINGLE_ADMIN )
6248	4826	);
6249	4827	foreach ( $auth_settings_access_users_pending as $key => $existing_user ) {
6250		- if ( 0 === strcasecmp( $pending_user['email'], $existing_user['email'] ) ) {
6251		- unset( $auth_settings_access_users_pending[ $key ] );
	4828	+ if ( $pending_user['email'] == $existing_user['email'] ) {
	4829	+ unset( $auth_settings_access_users_pending[$key] );
6252	4830	break;
6253	4831	}
6254	4832	}
6255	4833	update_option( 'auth_settings_access_users_pending', $auth_settings_access_users_pending );
6256	4834	}
	4835	+
6257	4836	}
6258	4837	}
6259	4838	}
6260	4839
6261	4840	// Editing an approved list entry.
6262		- if ( 'access_users_approved' === $_POST['setting'] ) {
6263		- // Sanitize posted data.
6264		- $access_users_approved = array();
6265		- if ( isset( $_POST['access_users_approved'] ) && is_array( $_POST['access_users_approved'] ) ) {
6266		- $access_users_approved = $this->sanitize_update_auth_users( wp_unslash( $_POST['access_users_approved'] ) );
	4841	+ if ( $_POST['setting'] === 'access_users_approved' ) {
	4842	+ // Initialize posted data if empty.
	4843	+ if ( ! ( array_key_exists( 'access_users_approved', $_POST ) && is_array( $_POST['access_users_approved'] ) ) ) {
	4844	+ $_POST['access_users_approved'] = array();
6267	4845	}
6268	4846
6269	4847	// Deal with each modified user (add, remove, or change_role).
6270		- foreach ( $access_users_approved as $approved_user ) {
6271		- // Skip blank entries.
6272		- if ( strlen( $approved_user['email'] ) < 1 ) {
6273		- continue;
6274		- }
	4848	+ foreach ( $_POST['access_users_approved'] as $approved_user ) {
6275	4849
6276	4850	// New user (create user, or add existing user to current site in multisite).
6277		- if ( 'add' === $approved_user['edit_action'] ) {
	4851	+ if ( $approved_user['edit_action'] === 'add' ) {
6278	4852	$new_user = get_user_by( 'email', $approved_user['email'] );
6279		- if ( false !== $new_user ) {
	4853	+ if ( $new_user !== false ) {
6280	4854	// If we're adding an existing multisite user, make sure their
6281	4855	// newly-assigned role is updated on all sites they are already in.
6282		- if ( is_multisite() && 'false' !== $approved_user['multisite_user'] ) {
	4856	+ if ( is_multisite() && $approved_user['multisite_user'] !== 'false' ) {
6283	4857	foreach ( get_blogs_of_user( $new_user->ID ) as $blog ) {
6284	4858	add_user_to_blog( $blog->userblog_id, $new_user->ID, $approved_user['role'] );
6285	4859	}
6286	4860	}
		@@ -6287,9 +4861,9 @@
6287	4861	// If this user already has an account on another site in the network, add them to this site.
6288	4862	if ( is_multisite() ) {
6289	4863	add_user_to_blog( get_current_blog_id(), $new_user->ID, $approved_user['role'] );
6290	4864	}
6291		- } elseif ( $approved_user['local_user'] && 'false' !== $approved_user['local_user'] ) {
	4865	+ } elseif ( $approved_user['local_user'] === 'true' ) {
6292	4866	// Create a WP account for this new *local* user and email the password.
6293	4867	$plaintext_password = wp_generate_password(); // random password
6294	4868	// If there's already a user with this username (e.g.,
6295	4869	// johndoe/johndoe@gmail.com exists, and we're trying to add
		@@ -6297,26 +4871,26 @@
6297	4871	// as the username.
6298	4872	$username = explode( '@', $approved_user['email'] );
6299	4873	$username = $username[0];
6300	4874	if ( get_user_by( 'login', $username ) !== false ) {
6301		- $username = $this->lowercase( $approved_user['email'] );
	4875	+ $username = $approved_user['email'];
6302	4876	}
6303		- if ( 'false' !== $approved_user['multisite_user'] ) {
	4877	+ if ( $approved_user['multisite_user'] !== 'false' ) {
6304	4878	$result = wpmu_create_user(
6305	4879	strtolower( $username ),
6306	4880	$plaintext_password,
6307		- $this->lowercase( $approved_user['email'] )
	4881	+ strtolower( $approved_user['email'] )
6308	4882	);
6309	4883	} else {
6310	4884	$result = wp_insert_user(
6311	4885	array(
6312		- 'user_login' => strtolower( $username ),
6313		- 'user_pass' => $plaintext_password,
6314		- 'first_name' => '',
6315		- 'last_name' => '',
6316		- 'user_email' => $this->lowercase( $approved_user['email'] ),
	4886	+ 'user_login' => strtolower( $username ),
	4887	+ 'user_pass' => $plaintext_password,
	4888	+ 'first_name' => '',
	4889	+ 'last_name' => '',
	4890	+ 'user_email' => strtolower( $approved_user['email'] ),
6317	4891	'user_registered' => date( 'Y-m-d H:i:s' ),
6318		- 'role' => $approved_user['role'],
	4892	+ 'role' => $approved_user['role'],
6319	4893	)
6320	4894	);
6321	4895	}
6322	4896	if ( ! is_wp_error( $result ) ) {
		@@ -6322,8 +4896,9 @@
6322	4896	if ( ! is_wp_error( $result ) ) {
6323	4897	// Email login credentials to new user.
6324	4898	wp_new_user_notification( $result, null, 'both' );
6325	4899	}
	4900	+
6326	4901	}
6327	4902
6328	4903	// Email new user welcome message if plugin option is set.
6329	4904	$this->maybe_email_welcome_message( $approved_user['email'] );
		@@ -6329,46 +4904,41 @@
6329	4904	$this->maybe_email_welcome_message( $approved_user['email'] );
6330	4905
6331	4906	// Add new user to approved list and save (skip if it's
6332	4907	// already there--someone else might have just done it).
6333		- if ( 'false' !== $approved_user['multisite_user'] ) {
	4908	+ if ( $approved_user['multisite_user'] !== 'false' ) {
6334	4909	if ( ! $this->is_email_in_list( $approved_user['email'], 'approved', 'multisite' ) ) {
6335	4910	$auth_multisite_settings_access_users_approved = $this->sanitize_user_list(
6336		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT )
	4911	+ $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN )
6337	4912	);
6338		- $approved_user['date_added'] = date( 'M Y' );
	4913	+ $approved_user['date_added'] = date( 'M Y' );
6339	4914	array_push( $auth_multisite_settings_access_users_approved, $approved_user );
6340		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
6341		- } else {
6342		- $invalid_emails[] = $approved_user['email'];
	4915	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
6343	4916	}
6344	4917	} else {
6345	4918	if ( ! $this->is_email_in_list( $approved_user['email'], 'approved' ) ) {
6346	4919	$auth_settings_access_users_approved = $this->sanitize_user_list(
6347		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT )
	4920	+ $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN )
6348	4921	);
6349		- $approved_user['date_added'] = date( 'M Y' );
	4922	+ $approved_user['date_added'] = date( 'M Y' );
6350	4923	array_push( $auth_settings_access_users_approved, $approved_user );
6351	4924	update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved );
6352		- } else {
6353		- $invalid_emails[] = $approved_user['email'];
6354	4925	}
6355	4926	}
6356	4927
6357	4928	// If we've added a new multisite user, go through all pending/approved/blocked lists
6358	4929	// on individual sites and remove this user from them (to prevent duplicate entries).
6359		- if ( 'false' !== $approved_user['multisite_user'] && is_multisite() ) {
	4930	+ if ( $approved_user['multisite_user'] !== 'false' && is_multisite() ) {
6360	4931	$list_names = array( 'access_users_pending', 'access_users_approved', 'access_users_blocked' );
6361		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
6362	4932	$sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
6363	4933	foreach ( $sites as $site ) {
6364	4934	$blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
6365	4935	foreach ( $list_names as $list_name ) {
6366		- $user_list = get_blog_option( $blog_id, 'auth_settings_' . $list_name, array() );
	4936	+ $user_list = get_blog_option( $blog_id, 'auth_settings_' . $list_name, array() );
6367	4937	$list_changed = false;
6368	4938	foreach ( $user_list as $key => $user ) {
6369		- if ( 0 === strcasecmp( $user['email'], $approved_user['email'] ) ) {
6370		- unset( $user_list[ $key ] );
	4939	+ if ( $user['email'] == $approved_user['email'] ) {
	4940	+ unset( $user_list[$key] );
6371	4941	$list_changed = true;
6372	4942	}
6373	4943	}
6374	4944	if ( $list_changed ) {
		@@ -6376,45 +4946,38 @@
6376	4946	}
6377	4947	}
6378	4948	}
6379	4949	}
6380		- } elseif ( 'remove' === $approved_user['edit_action'] ) { // Remove user from approved list and save (also remove their role if they have a WordPress account).
6381		- if ( 'false' !== $approved_user['multisite_user'] ) {
	4950	+
	4951	+ // Remove user from approved list and save (also remove their role if they have a WordPress account)
	4952	+ } elseif ( $approved_user['edit_action'] === 'remove' ) {
	4953	+ if ( $approved_user['multisite_user'] !== 'false' ) {
6382	4954	if ( $this->is_email_in_list( $approved_user['email'], 'approved', 'multisite' ) ) {
6383	4955	$auth_multisite_settings_access_users_approved = $this->sanitize_user_list(
6384		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT )
	4956	+ $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN )
6385	4957	);
6386	4958	foreach ( $auth_multisite_settings_access_users_approved as $key => $existing_user ) {
6387		- if ( 0 === strcasecmp( $approved_user['email'], $existing_user['email'] ) ) {
6388		- // Remove role of the associated WordPress user from all blogs (but don't delete the user).
6389		- $user = get_user_by( 'email', $approved_user['email'] );
6390		- if ( false !== $user ) {
6391		- // Loop through all of the blogs this user is a member of and remove their capabilities.
6392		- foreach ( get_blogs_of_user( $user->ID ) as $blog ) {
6393		- remove_user_from_blog( $user->ID, $blog->userblog_id, '' );
6394		- }
6395		- }
6396		- // Remove entry from Approved Users list.
6397		- unset( $auth_multisite_settings_access_users_approved[ $key ] );
	4959	+ if ( $approved_user['email'] == $existing_user['email'] ) {
	4960	+ unset( $auth_multisite_settings_access_users_approved[$key] );
6398	4961	break;
6399	4962	}
6400	4963	}
6401		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
	4964	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
6402	4965	}
6403	4966	} else {
6404	4967	if ( $this->is_email_in_list( $approved_user['email'], 'approved' ) ) {
6405	4968	$auth_settings_access_users_approved = $this->sanitize_user_list(
6406		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT )
	4969	+ $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN )
6407	4970	);
6408	4971	foreach ( $auth_settings_access_users_approved as $key => $existing_user ) {
6409		- if ( 0 === strcasecmp( $approved_user['email'], $existing_user['email'] ) ) {
	4972	+ if ( $approved_user['email'] == $existing_user['email'] ) {
6410	4973	// Remove role of the associated WordPress user (but don't delete the user).
6411	4974	$user = get_user_by( 'email', $approved_user['email'] );
6412		- if ( false !== $user ) {
	4975	+ if ( $user !== false ) {
6413	4976	$user->set_role( '' );
6414	4977	}
6415	4978	// Remove entry from Approved Users list.
6416		- unset( $auth_settings_access_users_approved[ $key ] );
	4979	+ unset( $auth_settings_access_users_approved[$key] );
6417	4980	break;
6418	4981	}
6419	4982	}
6420	4983	update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved );
		@@ -6419,12 +4982,14 @@
6419	4982	}
6420	4983	update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved );
6421	4984	}
6422	4985	}
6423		- } elseif ( 'change_role' === $approved_user['edit_action'] ) { // Update user's role in WordPress.
	4986	+
	4987	+ // Update user's role in WordPress
	4988	+ } elseif ( $approved_user['edit_action'] === 'change_role' ) {
6424	4989	$changed_user = get_user_by( 'email', $approved_user['email'] );
6425	4990	if ( $changed_user ) {
6426		- if ( is_multisite() && 'false' !== $approved_user['multisite_user'] ) {
	4991	+ if ( is_multisite() && $approved_user['multisite_user'] !== 'false' ) {
6427	4992	foreach ( get_blogs_of_user( $changed_user->ID ) as $blog ) {
6428	4993	add_user_to_blog( $blog->userblog_id, $changed_user->ID, $approved_user['role'] );
6429	4994	}
6430	4995	} else {
		@@ -6431,30 +4996,30 @@
6431	4996	$changed_user->set_role( $approved_user['role'] );
6432	4997	}
6433	4998	}
6434	4999
6435		- if ( 'false' !== $approved_user['multisite_user'] ) {
	5000	+ if ( $approved_user['multisite_user'] !== 'false' ) {
6436	5001	if ( $this->is_email_in_list( $approved_user['email'], 'approved', 'multisite' ) ) {
6437	5002	$auth_multisite_settings_access_users_approved = $this->sanitize_user_list(
6438		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT )
	5003	+ $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN )
6439	5004	);
6440	5005	foreach ( $auth_multisite_settings_access_users_approved as $key => $existing_user ) {
6441		- if ( 0 === strcasecmp( $approved_user['email'], $existing_user['email'] ) ) {
6442		- $auth_multisite_settings_access_users_approved[ $key ]['role'] = $approved_user['role'];
	5006	+ if ( $approved_user['email'] == $existing_user['email'] ) {
	5007	+ $auth_multisite_settings_access_users_approved[$key]['role'] = $approved_user['role'];
6443	5008	break;
6444	5009	}
6445	5010	}
6446		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
	5011	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
6447	5012	}
6448	5013	} else {
6449	5014	// Update user's role in approved list and save.
6450	5015	if ( $this->is_email_in_list( $approved_user['email'], 'approved' ) ) {
6451	5016	$auth_settings_access_users_approved = $this->sanitize_user_list(
6452		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT )
	5017	+ $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN )
6453	5018	);
6454	5019	foreach ( $auth_settings_access_users_approved as $key => $existing_user ) {
6455		- if ( 0 === strcasecmp( $approved_user['email'], $existing_user['email'] ) ) {
6456		- $auth_settings_access_users_approved[ $key ]['role'] = $approved_user['role'];
	5020	+ if ( $approved_user['email'] == $existing_user['email'] ) {
	5021	+ $auth_settings_access_users_approved[$key]['role'] = $approved_user['role'];
6457	5022	break;
6458	5023	}
6459	5024	}
6460	5025	update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved );
		@@ -6459,28 +5024,28 @@
6459	5024	}
6460	5025	update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved );
6461	5026	}
6462	5027	}
	5028	+
6463	5029	}
6464	5030	}
6465	5031	}
6466	5032
6467	5033	// Editing a blocked list entry.
6468		- if ( 'access_users_blocked' === $_POST['setting'] ) {
6469		- // Sanitize post data.
6470		- $access_users_blocked = array();
6471		- if ( isset( $_POST['access_users_blocked'] ) && is_array( $_POST['access_users_blocked'] ) ) {
6472		- $access_users_blocked = $this->sanitize_update_auth_users( wp_unslash( $_POST['access_users_blocked'] ) );
	5034	+ if ( $_POST['setting'] === 'access_users_blocked' ) {
	5035	+ // Initialize posted data if empty.
	5036	+ if ( ! ( array_key_exists( 'access_users_blocked', $_POST ) && is_array( $_POST['access_users_blocked'] ) ) ) {
	5037	+ $_POST['access_users_blocked'] = array();
6473	5038	}
6474	5039
6475	5040	// Deal with each modified user (add or remove).
6476		- foreach ( $access_users_blocked as $blocked_user ) {
	5041	+ foreach ( $_POST['access_users_blocked'] as $blocked_user ) {
6477	5042
6478		- if ( 'add' === $blocked_user['edit_action'] ) {
	5043	+ if ( $blocked_user['edit_action'] === 'add' ) {
6479	5044
6480	5045	// Add auth_blocked usermeta for the user.
6481	5046	$blocked_wp_user = get_user_by( 'email', $blocked_user['email'] );
6482		- if ( false !== $blocked_wp_user ) {
	5047	+ if ( $blocked_wp_user !== false ) {
6483	5048	update_user_meta( $blocked_wp_user->ID, 'auth_blocked', 'yes' );
6484	5049	}
6485	5050
6486	5051	// Add new user to blocked list and save (skip if it's
		@@ -6486,113 +5051,48 @@
6486	5051	// Add new user to blocked list and save (skip if it's
6487	5052	// already there--someone else might have just done it).
6488	5053	if ( ! $this->is_email_in_list( $blocked_user['email'], 'blocked' ) ) {
6489	5054	$auth_settings_access_users_blocked = $this->sanitize_user_list(
6490		- $this->get_plugin_option( 'access_users_blocked', WP_Plugin_Authorizer::SINGLE_CONTEXT )
	5055	+ $this->get_plugin_option( 'access_users_blocked', SINGLE_ADMIN )
6491	5056	);
6492		- $blocked_user['date_added'] = date( 'M Y' );
	5057	+ $blocked_user['date_added'] = date( 'M Y' );
6493	5058	array_push( $auth_settings_access_users_blocked, $blocked_user );
6494	5059	update_option( 'auth_settings_access_users_blocked', $auth_settings_access_users_blocked );
6495		- } else {
6496		- $invalid_emails[] = $blocked_user['email'];
6497	5060	}
6498		- } elseif ( 'remove' === $blocked_user['edit_action'] ) {
6499	5061
	5062	+ } elseif ( $blocked_user['edit_action'] === 'remove' ) {
	5063	+
6500	5064	// Remove auth_blocked usermeta for the user.
6501	5065	$unblocked_user = get_user_by( 'email', $blocked_user['email'] );
6502		- if ( false !== $unblocked_user ) {
	5066	+ if ( $unblocked_user !== false ) {
6503	5067	delete_user_meta( $unblocked_user->ID, 'auth_blocked', 'yes' );
6504	5068	}
6505	5069
6506		- // Remove user from blocked list and save.
	5070	+ // Remove user from blocked list and save
6507	5071	if ( $this->is_email_in_list( $blocked_user['email'], 'blocked' ) ) {
6508	5072	$auth_settings_access_users_blocked = $this->sanitize_user_list(
6509		- $this->get_plugin_option( 'access_users_blocked', WP_Plugin_Authorizer::SINGLE_CONTEXT )
	5073	+ $this->get_plugin_option( 'access_users_blocked', SINGLE_ADMIN )
6510	5074	);
6511	5075	foreach ( $auth_settings_access_users_blocked as $key => $existing_user ) {
6512		- if ( 0 === strcasecmp( $blocked_user['email'], $existing_user['email'] ) ) {
6513		- unset( $auth_settings_access_users_blocked[ $key ] );
	5076	+ if ( $blocked_user['email'] == $existing_user['email'] ) {
	5077	+ unset( $auth_settings_access_users_blocked[$key] );
6514	5078	break;
6515	5079	}
6516	5080	}
6517	5081	update_option( 'auth_settings_access_users_blocked', $auth_settings_access_users_blocked );
6518	5082	}
	5083	+
6519	5084	}
6520	5085	}
6521	5086	}
6522	5087
6523		- // Send response to client.
6524		- $response = array(
6525		- 'success' => true,
6526		- 'invalid_emails' => $invalid_emails,
6527		- );
6528		- header( 'content-type: application/json' );
6529		- echo wp_json_encode( $response );
6530		- exit;
	5088	+ // Return 'success' value to AJAX call.
	5089	+ die( 'success' );
6531	5090	}
6532	5091
6533	5092
6534		- /**
6535		- * Sanitizes an array of user update commands coming from the AJAX handler in Authorizer Settings.
6536		- *
6537		- * Example $users array:
6538		- * array(
6539		- * array(
6540		- * edit_action: 'add' or 'remove' or 'change_role',
6541		- * email: 'johndoe@example.com',
6542		- * role: 'subscriber',
6543		- * date_added: 'Jun 2014',
6544		- * local_user: 'true' or 'false',
6545		- * multisite_user: 'true' or 'false',
6546		- * ),
6547		- * ...
6548		- * )
6549		- *
6550		- * @param array $users Users to edit.
6551		- * @return array Sanitized users to edit.
6552		- */
6553		- private function sanitize_update_auth_users( $users = array() ) {
6554		- if ( ! is_array( $users ) ) {
6555		- $users = array();
6556		- }
6557		- $users = array_map( array( $this, 'sanitize_update_auth_user' ), $users );
6558	5093
6559		- return $users;
6560		- }
6561		-
6562		-
6563	5094	/**
6564		- * Callback for array_map in sanitize_update_auth_users().
6565		- *
6566		- * @param array $user User data to sanitize.
6567		- * @return array Sanitized user data.
6568		- */
6569		- private function sanitize_update_auth_user( $user ) {
6570		- if ( array_key_exists( 'edit_action', $user ) ) {
6571		- $user['edit_action'] = sanitize_text_field( $user['edit_action'] );
6572		- }
6573		- if ( isset( $user['email'] ) ) {
6574		- $user['email'] = sanitize_email( $user['email'] );
6575		- }
6576		- if ( isset( $user['role'] ) ) {
6577		- $user['role'] = sanitize_text_field( $user['role'] );
6578		- }
6579		- if ( isset( $user['date_added'] ) ) {
6580		- $user['date_added'] = sanitize_text_field( $user['date_added'] );
6581		- }
6582		- if ( isset( $user['local_user'] ) ) {
6583		- $user['local_user'] = 'true' === $user['local_user'] ? 'true' : 'false';
6584		- }
6585		- if ( isset( $user['multisite_user'] ) ) {
6586		- $user['multisite_user'] = 'true' === $user['multisite_user'] ? 'true' : 'false';
6587		- }
6588		-
6589		- return $user;
6590		- }
6591		-
6592		-
6593		-
6594		- /**
6595	5095	* ***************************
6596	5096	* Helper functions
6597	5097	* ***************************
6598	5098	*/
		@@ -6600,20 +5100,20 @@
6600	5100
6601	5101	/**
6602	5102	* Retrieves a specific plugin option from db. Multisite enabled.
6603	5103	*
6604		- * @param string $option Option name.
6605		- * @param string $admin_mode WP_Plugin_Authorizer::NETWORK_CONTEXT will retrieve the multisite value.
6606		- * @param string $override_mode 'allow override' will retrieve the multisite value if it exists.
6607		- * @param string $print_mode 'print overlay' will output overlay that hides this option on the settings page.
6608		- * @return mixed Option value, or null on failure.
	5104	+ * @param string $option Option name
	5105	+ * @param string $admin_mode MULTISITE_ADMIN will retrieve the multisite value
	5106	+ * @param string $override_mode 'allow override' will retrieve the multisite value if it exists
	5107	+ * @param string $print_mode 'print overlay' will output overlay that hides this option on the settings page
	5108	+ * @return mixed Option value, or null on failure
6609	5109	*/
6610		- private function get_plugin_option( $option, $admin_mode = WP_Plugin_Authorizer::SINGLE_CONTEXT, $override_mode = 'no override', $print_mode = 'no overlay' ) {
	5110	+ private function get_plugin_option( $option, $admin_mode = SINGLE_ADMIN, $override_mode = 'no override', $print_mode = 'no overlay' ) {
6611	5111	// Special case for user lists (they are saved seperately to prevent concurrency issues).
6612		- if ( in_array( $option, array( 'access_users_pending', 'access_users_approved', 'access_users_blocked' ), true ) ) {
6613		- $list = WP_Plugin_Authorizer::NETWORK_CONTEXT === $admin_mode ? array() : get_option( 'auth_settings_' . $option );
6614		- if ( is_multisite() && WP_Plugin_Authorizer::NETWORK_CONTEXT === $admin_mode ) {
6615		- $list = get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_' . $option, array() );
	5112	+ if ( in_array( $option, array( 'access_users_pending', 'access_users_approved', 'access_users_blocked' ) ) ) {
	5113	+ $list = $admin_mode === MULTISITE_ADMIN ? array() : get_option( 'auth_settings_' . $option );
	5114	+ if ( is_multisite() && $admin_mode === MULTISITE_ADMIN ) {
	5115	+ $list = get_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_' . $option, array() );
6616	5116	}
6617	5117	return $list;
6618	5118	}
6619	5119
		@@ -6627,26 +5127,24 @@
6627	5127
6628	5128	// If requested and appropriate, print the overlay hiding the
6629	5129	// single site option that is overridden by a multisite option.
6630	5130	if (
6631		- WP_Plugin_Authorizer::NETWORK_CONTEXT !== $admin_mode &&
6632		- 'allow override' === $override_mode &&
6633		- 'print overlay' === $print_mode &&
	5131	+ $admin_mode !== MULTISITE_ADMIN &&
	5132	+ $override_mode === 'allow override' &&
	5133	+ $print_mode === 'print overlay' &&
6634	5134	array_key_exists( 'multisite_override', $auth_settings ) &&
6635		- '1' === $auth_settings['multisite_override'] &&
6636		- ( ! array_key_exists( 'advanced_override_multisite', $auth_settings ) || 1 !== intval( $auth_settings['advanced_override_multisite'] ) )
	5135	+ $auth_settings['multisite_override'] === '1' &&
	5136	+ ( ! array_key_exists( 'advanced_override_multisite', $auth_settings ) || $auth_settings['advanced_override_multisite'] != '1' )
6637	5137	) {
6638	5138	// Get original plugin options (not overridden value). We'll
6639	5139	// show this old value behind the disabled overlay.
6640		- // $auth_settings = $this->get_plugin_options( $admin_mode, 'no override' );
6641		- // (This feature is disabled).
6642		- //
	5140	+ $auth_settings = $this->get_plugin_options( $admin_mode, 'no override' );
	5141	+
6643	5142	$name = "auth_settings[$option]";
6644		- $id = "auth_settings_$option";
6645		- ?>
6646		- <div id="overlay-hide-auth_settings_<?php echo esc_attr( $option ); ?>" class="auth_multisite_override_overlay">
	5143	+ $id = "auth_settings_$option"; ?>
	5144	+ <div id="overlay-hide-auth_settings_<?php echo $option; ?>" class="auth_multisite_override_overlay">
6647	5145	<span class="overlay-note">
6648		- <?php esc_html_e( 'This setting is overridden by a', 'authorizer' ); ?> <a href="<?php echo esc_attr( network_admin_url( 'admin.php?page=authorizer' ) ); ?>"><?php esc_html_e( 'multisite option', 'authorizer' ); ?></a>.
	5146	+ <?php _e( 'This setting is overridden by a', 'authorizer' ); ?> <a href="<?php echo network_admin_url( 'admin.php?page=authorizer&tab=external' ); ?>"><?php _e( 'multisite option', 'authorizer' ); ?></a>.
6649	5147	</span>
6650	5148	</div>
6651	5149	<?php
6652	5150	}
		@@ -6652,9 +5150,9 @@
6652	5150	}
6653	5151
6654	5152	// If we're getting an option in a site that has overridden the multisite override, make
6655	5153	// sure we are returning the option value from that site (not the multisite value).
6656		- if ( array_key_exists( 'advanced_override_multisite', $auth_settings ) && 1 === intval( $auth_settings['advanced_override_multisite'] ) ) {
	5154	+ if ( array_key_exists( 'advanced_override_multisite', $auth_settings ) && $auth_settings['advanced_override_multisite'] == '1' ) {
6657	5155	$auth_settings = $this->get_plugin_options( $admin_mode, 'no override' );
6658	5156	}
6659	5157
6660	5158	// Set option to null if it wasn't found.
		@@ -6661,115 +5159,98 @@
6661	5159	if ( ! array_key_exists( $option, $auth_settings ) ) {
6662	5160	return null;
6663	5161	}
6664	5162
6665		- return $auth_settings[ $option ];
	5163	+ return $auth_settings[$option];
6666	5164	}
6667	5165
6668	5166	/**
6669	5167	* Retrieves all plugin options from db. Multisite enabled.
6670	5168	*
6671		- * @param string $admin_mode WP_Plugin_Authorizer::NETWORK_CONTEXT will retrieve the multisite value.
6672		- * @param string $override_mode 'allow override' will retrieve the multisite value if it exists.
6673		- * @return mixed Option value, or null on failure.
	5169	+ * @param string $admin_mode MULTISITE_ADMIN will retrieve the multisite value
	5170	+ * @param string $override_mode 'allow override' will retrieve the multisite value if it exists
	5171	+ * @return mixed Option value, or null on failure
6674	5172	*/
6675		- private function get_plugin_options( $admin_mode = WP_Plugin_Authorizer::SINGLE_CONTEXT, $override_mode = 'no override' ) {
6676		- // Grab plugin settings (skip if in WP_Plugin_Authorizer::NETWORK_CONTEXT mode).
6677		- $auth_settings = WP_Plugin_Authorizer::NETWORK_CONTEXT === $admin_mode ? array() : get_option( 'auth_settings' );
	5173	+ private function get_plugin_options( $admin_mode = SINGLE_ADMIN, $override_mode = 'no override' ) {
	5174	+ // Grab plugin settings (skip if in MULTISITE_ADMIN mode).
	5175	+ $auth_settings = $admin_mode === MULTISITE_ADMIN ? array() : get_option( 'auth_settings' );
6678	5176
6679	5177	// Initialize to default values if the plugin option doesn't exist.
6680		- if ( false === $auth_settings ) {
	5178	+ if ( $auth_settings === FALSE ) {
6681	5179	$auth_settings = $this->set_default_options();
6682	5180	}
6683	5181
6684	5182	// Merge multisite options if we're in a network and the current site hasn't overridden multisite settings.
6685		- if ( is_multisite() && ( ! array_key_exists( 'advanced_override_multisite', $auth_settings ) || 1 !== intval( $auth_settings['advanced_override_multisite'] ) ) ) {
	5183	+ if ( is_multisite() && ( ! array_key_exists( 'advanced_override_multisite', $auth_settings ) || $auth_settings['advanced_override_multisite'] != '1' ) ) {
6686	5184	// Get multisite options.
6687		- $auth_multisite_settings = get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings', array() );
	5185	+ $auth_multisite_settings = get_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings', array() );
6688	5186
6689	5187	// Return the multisite options if we're viewing the network admin options page.
6690	5188	// Otherwise override options with their multisite equivalents.
6691		- if ( WP_Plugin_Authorizer::NETWORK_CONTEXT === $admin_mode ) {
	5189	+ if ( $admin_mode === MULTISITE_ADMIN ) {
6692	5190	$auth_settings = $auth_multisite_settings;
6693	5191	} elseif (
6694		- 'allow override' === $override_mode &&
	5192	+ $override_mode === 'allow override' &&
6695	5193	array_key_exists( 'multisite_override', $auth_multisite_settings ) &&
6696		- '1' === $auth_multisite_settings['multisite_override']
	5194	+ $auth_multisite_settings['multisite_override'] === '1'
6697	5195	) {
6698	5196	// Keep track of the multisite override selection.
6699	5197	$auth_settings['multisite_override'] = $auth_multisite_settings['multisite_override'];
6700	5198
6701		- /**
6702		- * Note: the options below should be the complete list of overridden
6703		- * options. It is *not* the complete list of all options (some options
6704		- * don't have a multisite equivalent).
6705		- */
	5199	+ // Note: the options below should be the complete list of
	5200	+ // overridden options. It is *not* the complete list of all
	5201	+ // options (some options don't have a multisite equivalent)
6706	5202
6707		- /**
6708		- * Note: access_users_approved, access_users_pending, and
6709		- * access_users_blocked do not get overridden. However, since
6710		- * access_users_approved has a multisite equivalent, you must retrieve
6711		- * them both seperately. This is done because the two lists should be
6712		- * treated differently.
6713		- *
6714		- * $approved_users = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT );
6715		- * $ms_approved_users = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT );
6716		- */
	5203	+ // Note: access_users_approved, access_users_pending, and
	5204	+ // access_users_blocked do not get overridden. However,
	5205	+ // since access_users_approved has a multisite equivalent,
	5206	+ // you must retrieve them both seperately. This is done
	5207	+ // because the two lists should be treated differently.
	5208	+ // $approved_users = $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN );
	5209	+ // $ms_approved_users = $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN );
6717	5210
6718		- // Override external services (google, cas, or ldap) and associated options.
6719		- $auth_settings['google'] = $auth_multisite_settings['google'];
6720		- $auth_settings['google_clientid'] = $auth_multisite_settings['google_clientid'];
6721		- $auth_settings['google_clientsecret'] = $auth_multisite_settings['google_clientsecret'];
6722		- $auth_settings['google_hosteddomain'] = $auth_multisite_settings['google_hosteddomain'];
6723		- $auth_settings['cas'] = $auth_multisite_settings['cas'];
6724		- $auth_settings['cas_custom_label'] = $auth_multisite_settings['cas_custom_label'];
6725		- $auth_settings['cas_host'] = $auth_multisite_settings['cas_host'];
6726		- $auth_settings['cas_port'] = $auth_multisite_settings['cas_port'];
6727		- $auth_settings['cas_path'] = $auth_multisite_settings['cas_path'];
6728		- $auth_settings['cas_version'] = $auth_multisite_settings['cas_version'];
6729		- $auth_settings['cas_attr_email'] = $auth_multisite_settings['cas_attr_email'];
6730		- $auth_settings['cas_attr_first_name'] = $auth_multisite_settings['cas_attr_first_name'];
6731		- $auth_settings['cas_attr_last_name'] = $auth_multisite_settings['cas_attr_last_name'];
6732		- $auth_settings['cas_attr_update_on_login'] = $auth_multisite_settings['cas_attr_update_on_login'];
6733		- $auth_settings['cas_auto_login'] = $auth_multisite_settings['cas_auto_login'];
6734		- $auth_settings['ldap'] = $auth_multisite_settings['ldap'];
6735		- $auth_settings['ldap_host'] = $auth_multisite_settings['ldap_host'];
6736		- $auth_settings['ldap_port'] = $auth_multisite_settings['ldap_port'];
6737		- $auth_settings['ldap_tls'] = $auth_multisite_settings['ldap_tls'];
6738		- $auth_settings['ldap_search_base'] = $auth_multisite_settings['ldap_search_base'];
6739		- $auth_settings['ldap_uid'] = $auth_multisite_settings['ldap_uid'];
6740		- $auth_settings['ldap_attr_email'] = $auth_multisite_settings['ldap_attr_email'];
6741		- $auth_settings['ldap_user'] = $auth_multisite_settings['ldap_user'];
6742		- $auth_settings['ldap_password'] = $auth_multisite_settings['ldap_password'];
6743		- $auth_settings['ldap_lostpassword_url'] = $auth_multisite_settings['ldap_lostpassword_url'];
6744		- $auth_settings['ldap_attr_first_name'] = $auth_multisite_settings['ldap_attr_first_name'];
6745		- $auth_settings['ldap_attr_last_name'] = $auth_multisite_settings['ldap_attr_last_name'];
	5211	+ // Override external services (google, cas, or ldap) and associated options
	5212	+ $auth_settings['google'] = $auth_multisite_settings['google'];
	5213	+ $auth_settings['google_clientid'] = $auth_multisite_settings['google_clientid'];
	5214	+ $auth_settings['google_clientsecret'] = $auth_multisite_settings['google_clientsecret'];
	5215	+ $auth_settings['google_hosteddomain'] = $auth_multisite_settings['google_hosteddomain'];
	5216	+ $auth_settings['cas'] = $auth_multisite_settings['cas'];
	5217	+ $auth_settings['cas_custom_label'] = $auth_multisite_settings['cas_custom_label'];
	5218	+ $auth_settings['cas_host'] = $auth_multisite_settings['cas_host'];
	5219	+ $auth_settings['cas_port'] = $auth_multisite_settings['cas_port'];
	5220	+ $auth_settings['cas_path'] = $auth_multisite_settings['cas_path'];
	5221	+ $auth_settings['cas_version'] = $auth_multisite_settings['cas_version'];
	5222	+ $auth_settings['cas_attr_email'] = $auth_multisite_settings['cas_attr_email'];
	5223	+ $auth_settings['cas_attr_first_name'] = $auth_multisite_settings['cas_attr_first_name'];
	5224	+ $auth_settings['cas_attr_last_name'] = $auth_multisite_settings['cas_attr_last_name'];
	5225	+ $auth_settings['cas_attr_update_on_login'] = $auth_multisite_settings['cas_attr_update_on_login'];
	5226	+ $auth_settings['cas_auto_login'] = $auth_multisite_settings['cas_auto_login'];
	5227	+ $auth_settings['ldap'] = $auth_multisite_settings['ldap'];
	5228	+ $auth_settings['ldap_host'] = $auth_multisite_settings['ldap_host'];
	5229	+ $auth_settings['ldap_port'] = $auth_multisite_settings['ldap_port'];
	5230	+ $auth_settings['ldap_tls'] = $auth_multisite_settings['ldap_tls'];
	5231	+ $auth_settings['ldap_search_base'] = $auth_multisite_settings['ldap_search_base'];
	5232	+ $auth_settings['ldap_uid'] = $auth_multisite_settings['ldap_uid'];
	5233	+ $auth_settings['ldap_attr_email'] = $auth_multisite_settings['ldap_attr_email'];
	5234	+ $auth_settings['ldap_user'] = $auth_multisite_settings['ldap_user'];
	5235	+ $auth_settings['ldap_password'] = $auth_multisite_settings['ldap_password'];
	5236	+ $auth_settings['ldap_lostpassword_url'] = $auth_multisite_settings['ldap_lostpassword_url'];
	5237	+ $auth_settings['ldap_attr_first_name'] = $auth_multisite_settings['ldap_attr_first_name'];
	5238	+ $auth_settings['ldap_attr_last_name'] = $auth_multisite_settings['ldap_attr_last_name'];
6746	5239	$auth_settings['ldap_attr_update_on_login'] = $auth_multisite_settings['ldap_attr_update_on_login'];
6747	5240
6748		- // Override access_who_can_login and access_who_can_view.
	5241	+ // Override access_who_can_login and access_who_can_view
6749	5242	$auth_settings['access_who_can_login'] = $auth_multisite_settings['access_who_can_login'];
6750		- $auth_settings['access_who_can_view'] = $auth_multisite_settings['access_who_can_view'];
	5243	+ $auth_settings['access_who_can_view'] = $auth_multisite_settings['access_who_can_view'];
6751	5244
6752		- // Override access_default_role.
	5245	+ // Override access_default_role
6753	5246	$auth_settings['access_default_role'] = $auth_multisite_settings['access_default_role'];
6754	5247
6755		- // Override lockouts.
	5248	+ // Override lockouts
6756	5249	$auth_settings['advanced_lockouts'] = $auth_multisite_settings['advanced_lockouts'];
6757	5250
6758		- // Override Hide WordPress login.
	5251	+ // Override Hide WordPress login
6759	5252	$auth_settings['advanced_hide_wp_login'] = $auth_multisite_settings['advanced_hide_wp_login'];
6760		-
6761		- // Override Users per page.
6762		- $auth_settings['advanced_users_per_page'] = $auth_multisite_settings['advanced_users_per_page'];
6763		-
6764		- // Override Sort users by.
6765		- $auth_settings['advanced_users_sort_by'] = $auth_multisite_settings['advanced_users_sort_by'];
6766		-
6767		- // Override Sort users order.
6768		- $auth_settings['advanced_users_sort_order'] = $auth_multisite_settings['advanced_users_sort_order'];
6769		-
6770		- // Override Show Dashboard Widget.
6771		- $auth_settings['advanced_widget_enabled'] = $auth_multisite_settings['advanced_widget_enabled'];
6772	5253	}
6773	5254	}
6774	5255	return $auth_settings;
6775	5256	}
		@@ -6776,27 +5257,23 @@
6776	5257
6777	5258
6778	5259	/**
6779	5260	* Remove user from authorizer lists when that user is deleted in WordPress.
6780		- *
6781		- * Action: delete_user
6782		- *
6783		- * @param int $user_id User ID to remove.
6784		- * @return void
	5261	+ * Run on action hook: delete_user
6785	5262	*/
6786		- public function remove_user_from_authorizer_when_deleted( $user_id ) {
6787		- $user = get_user_by( 'id', $user_id );
	5263	+ function remove_user_from_authorizer_when_deleted( $user_id ) {
	5264	+ $user = get_user_by( 'id', $user_id );
6788	5265	$deleted_email = $user->user_email;
6789	5266
6790	5267	// Remove user from pending/approved lists and save.
6791	5268	$list_names = array( 'access_users_pending', 'access_users_approved' );
6792	5269	foreach ( $list_names as $list_name ) {
6793		- $user_list = $this->sanitize_user_list( $this->get_plugin_option( $list_name, WP_Plugin_Authorizer::SINGLE_CONTEXT ) );
	5270	+ $user_list = $this->sanitize_user_list( $this->get_plugin_option( $list_name, SINGLE_ADMIN ) );
6794	5271	$list_changed = false;
6795	5272	foreach ( $user_list as $key => $existing_user ) {
6796		- if ( 0 === strcasecmp( $deleted_email, $existing_user['email'] ) ) {
	5273	+ if ( $deleted_email === $existing_user['email'] ) {
6797	5274	$list_changed = true;
6798		- unset( $user_list[ $key ] );
	5275	+ unset( $user_list[$key] );
6799	5276	}
6800	5277	}
6801	5278	if ( $list_changed ) {
6802	5279	update_option( 'auth_settings_' . $list_name, $user_list );
		@@ -6806,35 +5283,30 @@
6806	5283
6807	5284
6808	5285	/**
6809	5286	* Remove multisite user from authorizer lists when that user is deleted from Network Users.
6810		- *
6811		- * Action: wpmu_delete_user
6812		- *
6813		- * @param int $user_id User ID to remove.
6814		- * @return void
	5287	+ * Run on action hook: wpmu_delete_user
6815	5288	*/
6816		- public function remove_network_user_from_authorizer_when_deleted( $user_id ) {
6817		- $user = get_user_by( 'id', $user_id );
	5289	+ function remove_network_user_from_authorizer_when_deleted( $user_id ) {
	5290	+ $user = get_user_by( 'id', $user_id );
6818	5291	$deleted_email = $user->user_email;
6819	5292
6820	5293	// Go through multisite approved user list and remove this user.
6821	5294	$auth_multisite_settings_access_users_approved = $this->sanitize_user_list(
6822		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT )
	5295	+ $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN )
6823	5296	);
6824		- $list_changed = false;
	5297	+ $list_changed = false;
6825	5298	foreach ( $auth_multisite_settings_access_users_approved as $key => $existing_user ) {
6826		- if ( 0 === strcasecmp( $deleted_email, $existing_user['email'] ) ) {
	5299	+ if ( $deleted_email === $existing_user['email'] ) {
6827	5300	$list_changed = true;
6828		- unset( $auth_multisite_settings_access_users_approved[ $key ] );
	5301	+ unset( $auth_multisite_settings_access_users_approved[$key] );
6829	5302	}
6830	5303	}
6831	5304	if ( $list_changed ) {
6832		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
	5305	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
6833	5306	}
6834	5307
6835	5308	// Go through all pending/approved lists on individual sites and remove this user from them.
6836		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
6837	5309	$sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
6838	5310	foreach ( $sites as $site ) {
6839	5311	$blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
6840	5312	$this->remove_network_user_from_site_when_removed( $user_id, $blog_id );
		@@ -6844,27 +5316,22 @@
6844	5316
6845	5317
6846	5318	/**
6847	5319	* Remove multisite user from a specific site's lists when that user is removed from the site.
6848		- *
6849		- * Action: remove_user_from_blog
6850		- *
6851		- * @param int $user_id User ID to remove.
6852		- * @param int $blog_id Blog ID to remove from.
6853		- * @return void
	5320	+ * Run on action hook: remove_user_from_blog
6854	5321	*/
6855		- public function remove_network_user_from_site_when_removed( $user_id, $blog_id ) {
6856		- $user = get_user_by( 'id', $user_id );
	5322	+ function remove_network_user_from_site_when_removed( $user_id, $blog_id ) {
	5323	+ $user = get_user_by( 'id', $user_id );
6857	5324	$deleted_email = $user->user_email;
6858	5325
6859	5326	$list_names = array( 'access_users_pending', 'access_users_approved' );
6860	5327	foreach ( $list_names as $list_name ) {
6861		- $user_list = get_blog_option( $blog_id, 'auth_settings_' . $list_name, array() );
	5328	+ $user_list = get_blog_option( $blog_id, 'auth_settings_' . $list_name, array() );
6862	5329	$list_changed = false;
6863	5330	foreach ( $user_list as $key => $existing_user ) {
6864		- if ( 0 === strcasecmp( $deleted_email, $existing_user['email'] ) ) {
	5331	+ if ( $deleted_email === $existing_user['email'] ) {
6865	5332	$list_changed = true;
6866		- unset( $user_list[ $key ] );
	5333	+ unset( $user_list[$key] );
6867	5334	}
6868	5335	}
6869	5336	if ( $list_changed ) {
6870	5337	update_blog_option( $blog_id, 'auth_settings_' . $list_name, $user_list );
		@@ -6874,30 +5341,26 @@
6874	5341
6875	5342
6876	5343	/**
6877	5344	* Helper: Add multisite user to a specific site's approved list.
6878		- *
6879		- * @param int $user_id User ID to add.
6880		- * @param int $blog_id Blog ID to add to.
6881		- * @return void
6882	5345	*/
6883		- private function add_network_user_to_site( $user_id, $blog_id ) {
	5346	+ function add_network_user_to_site( $user_id, $blog_id ) {
6884	5347	// Switch to blog.
6885	5348	switch_to_blog( $blog_id );
6886	5349
6887	5350	// Get user details and role.
6888		- $access_default_role = $this->get_plugin_option( 'access_default_role', WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
6889		- $user = get_user_by( 'id', $user_id );
6890		- $user_email = $user->user_email;
6891		- $user_role = $user && is_array( $user->roles ) && count( $user->roles ) > 0 ? $user->roles[0] : $access_default_role;
	5351	+ $access_default_role = $this->get_plugin_option( 'access_default_role', SINGLE_ADMIN, 'allow override' );
	5352	+ $user = get_user_by( 'id', $user_id );
	5353	+ $user_email = $user->user_email;
	5354	+ $user_role = $user && is_array( $user->roles ) && count( $user->roles ) > 0 ? $user->roles[0] : $access_default_role;
6892	5355
6893	5356	// Add user to approved list if not already there and not in blocked list.
6894		- $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT );
6895		- $auth_settings_access_users_blocked = $this->get_plugin_option( 'access_users_blocked', WP_Plugin_Authorizer::SINGLE_CONTEXT );
	5357	+ $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN );
	5358	+ $auth_settings_access_users_blocked = $this->get_plugin_option( 'access_users_blocked', SINGLE_ADMIN );
6896	5359	if ( ! $this->in_multi_array( $user_email, $auth_settings_access_users_approved ) && ! $this->in_multi_array( $user_email, $auth_settings_access_users_blocked ) ) {
6897	5360	$approved_user = array(
6898		- 'email' => $this->lowercase( $user_email ),
6899		- 'role' => $user_role,
	5361	+ 'email' => $user_email,
	5362	+ 'role' => $user_role,
6900	5363	'date_added' => date( 'M Y', strtotime( $user->user_registered ) ),
6901	5364	'local_user' => true,
6902	5365	);
6903	5366	array_push( $auth_settings_access_users_approved, $approved_user );
		@@ -6914,17 +5377,17 @@
6914	5377	* When an existing user is invited to the current site (or a new user is created),
6915	5378	* add them to the authorizer approved list. This action fires when the admin
6916	5379	* doesn't select the "Skip Confirmation Email" option.
6917	5380	*
6918		- * Action: invite_user
	5381	+ * @action invite_user
6919	5382	*
6920		- * @param int $user_id The invited user's ID.
6921		- * @param array $role The role of the invited user (or none if a new user creation).
	5383	+ * @param int $user_id The invited user's ID.
	5384	+ * @param array $role The role of the invited user (or none if a new user creation).
6922	5385	* @param string $newuser_key The key of the invitation.
6923	5386	*/
6924		- public function add_existing_user_to_authorizer_when_created( $user_id, $role = array(), $newuser_key = '' ) {
	5387	+ function add_existing_user_to_authorizer_when_created( $user_id, $role = array(), $newuser_key = '' ) {
6925	5388	$user = get_user_by( 'id', $user_id );
6926		- $this->add_user_to_authorizer_when_created( $user->user_email, $user->user_registered, $user->roles, $role );
	5389	+ $this->add_user_to_authorizer_when_created( $user->user_email, $user->user_registered, $user->user_roles, $role );
6927	5390	}
6928	5391
6929	5392
6930	5393	/**
		@@ -6932,16 +5395,16 @@
6932	5395	* When an existing user is invited to the current site (or a new user is created),
6933	5396	* add them to the authorizer approved list. This action fires when the admin
6934	5397	* selects the "Skip Confirmation Email" option.
6935	5398	*
6936		- * Action: added_existing_user
	5399	+ * @action added_existing_user
6937	5400	*
6938		- * @param int $user_id The invited user's ID.
6939		- * @param mixed $result True on success or a WP_Error object if the user doesn't exist.
	5401	+ * @param int $user_id The invited user's ID.
	5402	+ * @param mixed $result True on success or a WP_Error object if the user doesn't exist.
6940	5403	*/
6941		- public function add_existing_user_to_authorizer_when_created_noconfirmation( $user_id, $result ) {
	5404	+ function add_existing_user_to_authorizer_when_created_noconfirmation( $user_id, $result ) {
6942	5405	$user = get_user_by( 'id', $user_id );
6943		- $this->add_user_to_authorizer_when_created( $user->user_email, $user->user_registered, $user->roles );
	5406	+ $this->add_user_to_authorizer_when_created( $user->user_email, $user->user_registered, $user->user_roles );
6944	5407	}
6945	5408
6946	5409
6947	5410	/**
		@@ -6948,18 +5411,17 @@
6948	5411	* Multisite:
6949	5412	* When a new user is invited to the current site (or a new user is created),
6950	5413	* add them to the authorizer approved list.
6951	5414	*
6952		- * Action: after_signup_user
	5415	+ * @action after_signup_user
6953	5416	*
6954		- * @param string $user User's requested login name.
	5417	+ * @param string $user User's requested login name.
6955	5418	* @param string $user_email User's email address.
6956		- * @param string $key User's activation key.
6957		- * @param array $meta Additional signup meta, including initially set roles.
	5419	+ * @param string $key User's activation key.
	5420	+ * @param array $meta Additional signup meta.
6958	5421	*/
6959		- public function add_new_user_to_authorizer_when_created( $user, $user_email, $key, $meta ) {
6960		- $user_roles = isset( $meta['new_role'] ) ? array( $meta['new_role'] ) : array();
6961		- $this->add_user_to_authorizer_when_created( $user_email, time(), $user_roles );
	5422	+ function add_new_user_to_authorizer_when_created( $user, $user_email, $key, $meta ) {
	5423	+ $this->add_user_to_authorizer_when_created( $user_email, time() );
6962	5424	}
6963	5425
6964	5426
6965	5427	/**
		@@ -6966,18 +5428,17 @@
6966	5428	* Single site:
6967	5429	* When a new user is added in single site mode, add them to the authorizer
6968	5430	* approved list.
6969	5431	*
6970		- * Action: edit_user_created_user
	5432	+ * @action edit_user_created_user
6971	5433	*
6972		- * @param int $user_id ID of the newly created user.
6973		- * @param string $notify Type of notification that should happen. See
6974		- * wp_send_new_user_notifications() for more
6975		- * information on possible values.
	5434	+ * @param int $user_id ID of the newly created user.
	5435	+ * @param string $notify Type of notification that should happen. See wp_send_new_user_notifications()
	5436	+ * for more information on possible values.
6976	5437	*/
6977		- public function add_new_user_to_authorizer_when_created_single_site( $user_id, $notify ) {
	5438	+ function add_new_user_to_authorizer_when_created_single_site( $user_id, $notify ) {
6978	5439	$user = get_user_by( 'id', $user_id );
6979		- $this->add_user_to_authorizer_when_created( $user->user_email, $user->user_registered, $user->roles );
	5440	+ $this->add_user_to_authorizer_when_created( $user->user_email, $user->user_registered, $user->user_roles );
6980	5441	}
6981	5442
6982	5443
6983	5444	/**
		@@ -6982,19 +5443,14 @@
6982	5443
6983	5444	/**
6984	5445	* Helper: When a new user is added/invited to the current site (or a new
6985	5446	* user is created), add them to the authorizer approved list.
6986		- *
6987		- * @param string $user_email Email address of user to add.
6988		- * @param string $date_registered Date user registered.
6989		- * @param array $user_roles Role to add for user.
6990		- * @param array $default_role Default role, if no role specified.
6991	5447	*/
6992	5448	private function add_user_to_authorizer_when_created( $user_email, $date_registered, $user_roles = array(), $default_role = array() ) {
6993		- $auth_multisite_settings_access_users_approved = is_multisite() ? get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', array() ) : array();
6994		- $auth_settings_access_users_pending = $this->get_plugin_option( 'access_users_pending', WP_Plugin_Authorizer::SINGLE_CONTEXT );
6995		- $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT );
6996		- $auth_settings_access_users_blocked = $this->get_plugin_option( 'access_users_blocked', WP_Plugin_Authorizer::SINGLE_CONTEXT );
	5449	+ $auth_multisite_settings_access_users_approved = is_multisite() ? get_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', array() ) : array();
	5450	+ $auth_settings_access_users_pending = $this->get_plugin_option( 'access_users_pending', SINGLE_ADMIN );
	5451	+ $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN );
	5452	+ $auth_settings_access_users_blocked = $this->get_plugin_option( 'access_users_blocked', SINGLE_ADMIN );
6997	5453
6998	5454	// Get default role if one isn't specified.
6999	5455	if ( count( $default_role ) < 1 ) {
7000	5456	$default_role = '';
		@@ -7009,10 +5465,10 @@
7009	5465	return;
7010	5466	}
7011	5467	// Remove from pending list if there.
7012	5468	foreach ( $auth_settings_access_users_pending as $key => $pending_user ) {
7013		- if ( 0 === strcasecmp( $pending_user['email'], $user_email ) ) {
7014		- unset( $auth_settings_access_users_pending[ $key ] );
	5469	+ if ( $pending_user['email'] == $user_email ) {
	5470	+ unset( $auth_settings_access_users_pending[$key] );
7015	5471	$updated = true;
7016	5472	}
7017	5473	}
7018	5474	// Skip if user is in multisite approved list.
		@@ -7021,10 +5477,10 @@
7021	5477	}
7022	5478	// Add to approved list if not there.
7023	5479	if ( ! $this->in_multi_array( $user_email, $auth_settings_access_users_approved ) ) {
7024	5480	$approved_user = array(
7025		- 'email' => $this->lowercase( $user_email ),
7026		- 'role' => is_array( $user_roles ) && count( $user_roles ) > 0 ? $user_roles[0] : $default_role,
	5481	+ 'email' => $user_email,
	5482	+ 'role' => is_array( $user_roles ) && count( $user_roles ) > 0 ? $user_roles[0] : $default_role,
7027	5483	'date_added' => date( 'M Y', strtotime( $date_registered ) ),
7028	5484	'local_user' => true,
7029	5485	);
7030	5486	array_push( $auth_settings_access_users_approved, $approved_user );
		@@ -7043,33 +5499,32 @@
7043	5499	* When a user is granted super admin status (checkbox on network user edit
7044	5500	* screen), add them to the authorizer network approved list. Also remove
7045	5501	* them from pending/approved list on any individual sites.
7046	5502	*
7047		- * Action: grant_super_admin
	5503	+ * @action grant_super_admin
7048	5504	*
7049	5505	* @param int $user_id The user's ID.
7050	5506	*/
7051		- public function grant_super_admin__add_to_network_approved( $user_id ) {
7052		- $user = get_user_by( 'id', $user_id );
	5507	+ function grant_super_admin__add_to_network_approved( $user_id ) {
	5508	+ $user = get_user_by( 'id', $user_id );
7053	5509	$user_email = $user->user_email;
7054	5510
7055	5511	// Add user to multisite approved user list (if not already there).
7056	5512	$auth_multisite_settings_access_users_approved = $this->sanitize_user_list(
7057		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT )
	5513	+ $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN )
7058	5514	);
7059	5515	if ( ! $this->in_multi_array( $user_email, $auth_multisite_settings_access_users_approved ) ) {
7060	5516	$multisite_approved_user = array(
7061		- 'email' => $this->lowercase( $user_email ),
7062		- 'role' => count( $user->roles ) > 0 ? $user->roles[0] : 'administrator',
	5517	+ 'email' => $user_email,
	5518	+ 'role' => count( $user->roles ) > 0 ? $user->roles[0] : 'administrator',
7063	5519	'date_added' => date( 'M Y', strtotime( $user->user_registered ) ),
7064	5520	'local_user' => true,
7065	5521	);
7066	5522	array_push( $auth_multisite_settings_access_users_approved, $multisite_approved_user );
7067		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
	5523	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
7068	5524	}
7069	5525
7070	5526	// Go through all pending/approved lists on individual sites and remove this user from them.
7071		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
7072	5527	$sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
7073	5528	foreach ( $sites as $site ) {
7074	5529	$blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
7075	5530	$this->remove_network_user_from_site_when_removed( $user_id, $blog_id );
		@@ -7082,29 +5537,29 @@
7082	5537	* When a user's super admin status is revoked (checkbox on network user edit
7083	5538	* screen), remove them from the authorizer network approved list. Also add
7084	5539	* them to approved list on any individual sites they are already a part of.
7085	5540	*
7086		- * Action: revoke_super_admin
	5541	+ * @action revoke_super_admin
7087	5542	*
7088	5543	* @param int $user_id The user's ID.
7089	5544	*/
7090		- public function revoke_super_admin__remove_from_network_approved( $user_id ) {
7091		- $user = get_user_by( 'id', $user_id );
	5545	+ function revoke_super_admin__remove_from_network_approved( $user_id ) {
	5546	+ $user = get_user_by( 'id', $user_id );
7092	5547	$revoked_email = $user->user_email;
7093	5548
7094	5549	// Go through multisite approved user list and remove this user.
7095	5550	$auth_multisite_settings_access_users_approved = $this->sanitize_user_list(
7096		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT )
	5551	+ $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN )
7097	5552	);
7098		- $list_changed = false;
	5553	+ $list_changed = false;
7099	5554	foreach ( $auth_multisite_settings_access_users_approved as $key => $existing_user ) {
7100		- if ( 0 === strcasecmp( $revoked_email, $existing_user['email'] ) ) {
	5555	+ if ( $revoked_email === $existing_user['email'] ) {
7101	5556	$list_changed = true;
7102		- unset( $auth_multisite_settings_access_users_approved[ $key ] );
	5557	+ unset( $auth_multisite_settings_access_users_approved[$key] );
7103	5558	}
7104	5559	}
7105	5560	if ( $list_changed ) {
7106		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
	5561	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
7107	5562	}
7108	5563
7109	5564	// Go through this user's current sites and add them to the approved list
7110	5565	// (since they are no longer on the network approved list).
		@@ -7115,21 +5570,14 @@
7115	5570	}
7116	5571
7117	5572	}
7118	5573
7119		- /**
7120		- * Send a welcome email message to a newly approved user (if the "Should
7121		- * email approved users" setting is enabled).
7122		- *
7123		- * @param string $email Email address to send welcome email to.
7124		- * @return bool Whether the email was sent.
7125		- */
7126	5574	private function maybe_email_welcome_message( $email ) {
7127	5575	// Get option for whether to email welcome messages.
7128	5576	$should_email_new_approved_users = $this->get_plugin_option( 'access_should_email_approved_users' );
7129	5577
7130	5578	// Do not send welcome email if option not enabled.
7131		- if ( '1' !== $should_email_new_approved_users ) {
	5579	+ if ( $should_email_new_approved_users !== '1' ) {
7132	5580	return false;
7133	5581	}
7134	5582
7135	5583	// Make sure we didn't just email this user (can happen with
		@@ -7135,15 +5583,15 @@
7135	5583	// Make sure we didn't just email this user (can happen with
7136	5584	// multiple admins saving at the same time, or by clicking
7137	5585	// Approve button too rapidly).
7138	5586	$recently_sent_emails = get_option( 'auth_settings_recently_sent_emails' );
7139		- if ( false === $recently_sent_emails ) {
	5587	+ if ( $recently_sent_emails === FALSE ) {
7140	5588	$recently_sent_emails = array();
7141	5589	}
7142	5590	foreach ( $recently_sent_emails as $key => $recently_sent_email ) {
7143	5591	if ( $recently_sent_email['time'] < strtotime( 'now -1 minutes' ) ) {
7144	5592	// Remove emails sent more than 1 minute ago.
7145		- unset( $recently_sent_emails[ $key ] );
	5593	+ unset( $recently_sent_emails[$key] );
7146	5594	} elseif ( $recently_sent_email['email'] === $email ) {
7147	5595	// Sent an email to this user within the last 1 minute, so
7148	5596	// quit without sending.
7149	5597	return false;
		@@ -7151,15 +5599,15 @@
7151	5599	}
7152	5600	// Add the email we're about to send to the list.
7153	5601	$recently_sent_emails[] = array(
7154	5602	'email' => $email,
7155		- 'time' => time(),
	5603	+ 'time' => time(),
7156	5604	);
7157	5605	update_option( 'auth_settings_recently_sent_emails', $recently_sent_emails );
7158	5606
7159		- // Get welcome email subject and body text.
	5607	+ // Get welcome email subject and body text
7160	5608	$subject = $this->get_plugin_option( 'access_email_approved_users_subject' );
7161		- $body = apply_filters( 'the_content', $this->get_plugin_option( 'access_email_approved_users_body' ) );
	5609	+ $body = apply_filters( 'the_content', $this->get_plugin_option( 'access_email_approved_users_body' ) );
7162	5610
7163	5611	// Fail if the subject/body options don't exist or are empty.
7164	5612	if ( is_null( $subject ) || is_null( $body ) || strlen( $subject ) === 0 || strlen( $body ) === 0 ) {
7165	5613	return false;
		@@ -7166,14 +5614,14 @@
7166	5614	}
7167	5615
7168	5616	// Replace approved shortcode patterns in subject and body.
7169	5617	$site_name = get_bloginfo( 'name' );
7170		- $site_url = get_site_url();
7171		- $subject = str_replace( '[site_name]', $site_name, $subject );
7172		- $body = str_replace( '[site_name]', $site_name, $body );
7173		- $body = str_replace( '[site_url]', $site_url, $body );
7174		- $body = str_replace( '[user_email]', $email, $body );
7175		- $headers = 'Content-type: text/html' . "\r\n";
	5618	+ $site_url = get_site_url();
	5619	+ $subject = str_replace( '[site_name]', $site_name, $subject );
	5620	+ $body = str_replace( '[site_name]', $site_name, $body );
	5621	+ $body = str_replace( '[site_url]', $site_url, $body );
	5622	+ $body = str_replace( '[user_email]', $email, $body );
	5623	+ $headers = 'Content-type: text/html' . "\r\n";
7176	5624
7177	5625	// Send email.
7178	5626	wp_mail( $email, $subject, $body, $headers );
7179	5627
		@@ -7183,24 +5631,17 @@
7183	5631
7184	5632
7185	5633	/**
7186	5634	* Generate a unique cookie to add to nonces to prevent CSRF.
7187		- *
7188		- * @var string
7189	5635	*/
7190		- private $cookie_value = null;
7191		-
7192		- /**
7193		- * Retrieve the unique login cookie.
7194		- *
7195		- * @return string Login cookie value.
7196		- */
7197		- private function get_cookie_value() {
	5636	+ protected $cookie_value = null;
	5637	+ function get_cookie_value() {
7198	5638	if ( ! $this->cookie_value ) {
7199	5639	if ( isset( $_COOKIE['login_unique'] ) ) {
7200		- $this->cookie_value = sanitize_key( wp_unslash( $_COOKIE['login_unique'] ) );
	5640	+ $this->cookie_value = $_COOKIE['login_unique'];
7201	5641	} else {
7202	5642	$this->cookie_value = md5( rand() );
	5643	+ setcookie( 'login_unique', $this->cookie_value, time()+1800, '/', defined( 'COOKIE_DOMAIN' ) ? COOKIE_DOMAIN : '' );
7203	5644	}
7204	5645	}
7205	5646	return $this->cookie_value;
7206	5647	}
		@@ -7206,51 +5647,37 @@
7206	5647	}
7207	5648
7208	5649
7209	5650	/**
7210		- * Encryption key (not secret!).
7211		- *
7212		- * @var string
7213		- */
7214		- private static $key = "8QxnrvjdtweisvCBKEY!+0\0\0";
7215		-
7216		- /**
7217		- * Encryption salt (not secret!).
7218		- *
7219		- * @var string
7220		- */
7221		- private static $iv = 'R_O2D]jPn]1[fhJl!-P1.oe';
7222		-
7223		- /**
7224	5651	* Basic encryption using a public (not secret!) key. Used for general
7225	5652	* database obfuscation of passwords.
7226		- *
7227		- * @param string $text String to encrypt.
7228		- * @param string $library Encryption library to use (openssl).
7229		- * @return string Encrypted string.
	5653	+ * @param $text String to encrypt.
	5654	+ * @param $library Encryption lib to use (openssl).
	5655	+ * @return Encrypted string
7230	5656	*/
7231		- private function encrypt( $text, $library = 'openssl' ) {
	5657	+ private static $key = "8QxnrvjdtweisvCBKEY!+0\0\0";
	5658	+ private static $iv = "R_O2D]jPn]1[fhJl!-P1.oe";
	5659	+ function encrypt( $text, $library = 'openssl' ) {
7232	5660	$result = '';
7233	5661
7234	5662	// Use openssl library (better) if it is enabled.
7235		- if ( function_exists( 'openssl_encrypt' ) && 'openssl' === $library ) {
7236		- $result = base64_encode(
7237		- openssl_encrypt(
7238		- $text,
7239		- 'AES-256-CBC',
7240		- hash( 'sha256', self::$key ),
7241		- 0,
7242		- substr( hash( 'sha256', self::$iv ), 0, 16 )
7243		- )
7244		- );
7245		- } elseif ( function_exists( 'mcrypt_encrypt' ) ) { // Use mcrypt library (deprecated in PHP 7.1) if php5-mcrypt extension is enabled.
	5663	+ if ( function_exists( 'openssl_encrypt' ) && $library === 'openssl' ) {
	5664	+ $result = base64_encode( openssl_encrypt(
	5665	+ $text,
	5666	+ 'AES-256-CBC',
	5667	+ hash( 'sha256', self::$key ),
	5668	+ 0,
	5669	+ substr( hash( 'sha256', self::$iv ), 0, 16 )
	5670	+ ) );
	5671	+ // Use mcrypt library (deprecated in PHP 7.1) if php5-mcrypt extension is enabled.
	5672	+ } else if ( function_exists( 'mcrypt_encrypt' ) ) {
7246	5673	$result = base64_encode( mcrypt_encrypt( MCRYPT_RIJNDAEL_256, self::$key, $text, MCRYPT_MODE_ECB, 'abcdefghijklmnopqrstuvwxyz012345' ) );
7247		- } else { // Fall back to basic obfuscation.
7248		- $length = strlen( $text );
7249		- for ( $i = 0; $i < $length; $i++ ) {
7250		- $char = substr( $text, $i, 1 );
	5674	+ // Fall back to basic obfuscation.
	5675	+ } else {
	5676	+ for ( $i = 0; $i < strlen( $text ); $i++ ) {
	5677	+ $char = substr( $text, $i, 1 );
7251	5678	$keychar = substr( self::$key, ( $i % strlen( self::$key ) ) - 1, 1 );
7252		- $char = chr( ord( $char ) + ord( $keychar ) );
	5679	+ $char = chr( ord( $char ) + ord( $keychar ) );
7253	5680	$result .= $char;
7254	5681	}
7255	5682	$result = base64_encode( $result );
7256	5683	}
		@@ -7261,18 +5688,17 @@
7261	5688
7262	5689	/**
7263	5690	* Basic decryption using a public (not secret!) key. Used for general
7264	5691	* database obfuscation of passwords.
7265		- *
7266		- * @param string $secret String to encrypt.
7267		- * @param string $library Encryption lib to use (openssl).
7268		- * @return string Decrypted string
	5692	+ * @param $text String to encrypt.
	5693	+ * @param $library Encryption lib to use (openssl).
	5694	+ * @return Decrypted string
7269	5695	*/
7270		- private function decrypt( $secret, $library = 'openssl' ) {
	5696	+ function decrypt( $secret, $library = 'openssl' ) {
7271	5697	$result = '';
7272	5698
7273	5699	// Use openssl library (better) if it is enabled.
7274		- if ( function_exists( 'openssl_decrypt' ) && 'openssl' === $library ) {
	5700	+ if ( function_exists( 'openssl_decrypt' ) && $library === 'openssl' ) {
7275	5701	$result = openssl_decrypt(
7276	5702	base64_decode( $secret ),
7277	5703	'AES-256-CBC',
7278	5704	hash( 'sha256', self::$key ),
		@@ -7278,18 +5704,19 @@
7278	5704	hash( 'sha256', self::$key ),
7279	5705	0,
7280	5706	substr( hash( 'sha256', self::$iv ), 0, 16 )
7281	5707	);
7282		- } elseif ( function_exists( 'mcrypt_decrypt' ) ) { // Use mcrypt library (deprecated in PHP 7.1) if php5-mcrypt extension is enabled.
	5708	+ // Use mcrypt library (deprecated in PHP 7.1) if php5-mcrypt extension is enabled.
	5709	+ } else if ( function_exists( 'mcrypt_decrypt' ) ) {
7283	5710	$secret = base64_decode( $secret );
7284	5711	$result = rtrim( mcrypt_decrypt( MCRYPT_RIJNDAEL_256, self::$key, $secret, MCRYPT_MODE_ECB, 'abcdefghijklmnopqrstuvwxyz012345' ), "\0$result" );
7285		- } else { // Fall back to basic obfuscation.
	5712	+ // Fall back to basic obfuscation.
	5713	+ } else {
7286	5714	$secret = base64_decode( $secret );
7287		- $length = strlen( $secret );
7288		- for ( $i = 0; $i < $length; $i++ ) {
7289		- $char = substr( $secret, $i, 1 );
	5715	+ for ( $i = 0; $i < strlen( $secret ); $i++ ) {
	5716	+ $char = substr( $secret, $i, 1 );
7290	5717	$keychar = substr( self::$key, ( $i % strlen( self::$key ) ) - 1, 1 );
7291		- $char = chr( ord( $char ) - ord( $keychar ) );
	5718	+ $char = chr( ord( $char ) - ord( $keychar ) );
7292	5719	$result .= $char;
7293	5720	}
7294	5721	}
7295	5722
		@@ -7300,12 +5727,10 @@
7300	5727	/**
7301	5728	* In a multisite environment, returns true if the current user is logged
7302	5729	* in and a user of the current blog. In single site mode, simply returns
7303	5730	* true if the current user is logged in.
7304		- *
7305		- * @return bool Whether current user is logged in and a user of the current blog.
7306	5731	*/
7307		- protected function is_user_logged_in_and_blog_user() {
	5732	+ function is_user_logged_in_and_blog_user() {
7308	5733	$is_user_logged_in_and_blog_user = false;
7309	5734	if ( is_multisite() ) {
7310	5735	$is_user_logged_in_and_blog_user = is_user_logged_in() && is_user_member_of_blog( get_current_user_id() );
7311	5736	} else {
		@@ -7318,42 +5743,39 @@
7318	5743	/**
7319	5744	* Helper function to determine whether a given email is in one of
7320	5745	* the lists (pending, approved, blocked). Defaults to the list of
7321	5746	* approved users.
7322		- *
7323		- * @param string $email Email to check existent of.
7324		- * @param string $list List to look for email in.
7325		- * @param string $multisite_mode Admin context.
7326		- * @return boolean Whether email was found.
7327	5747	*/
7328		- protected function is_email_in_list( $email = '', $list = 'approved', $multisite_mode = 'single' ) {
7329		- if ( empty( $email ) ) {
	5748	+ function is_email_in_list( $email = '', $list = 'approved', $multisite_mode = 'single' ) {
	5749	+ if ( empty( $email ) )
7330	5750	return false;
7331		- }
7332	5751
7333	5752	switch ( $list ) {
7334		- case 'pending':
7335		- $auth_settings_access_users_pending = $this->get_plugin_option( 'access_users_pending', WP_Plugin_Authorizer::SINGLE_CONTEXT );
7336		- return $this->in_multi_array( $email, $auth_settings_access_users_pending );
7337		- case 'blocked':
7338		- $auth_settings_access_users_blocked = $this->get_plugin_option( 'access_users_blocked', WP_Plugin_Authorizer::SINGLE_CONTEXT );
7339		- return $this->in_multi_array( $email, $auth_settings_access_users_blocked );
7340		- case 'approved':
7341		- default:
7342		- if ( 'single' !== $multisite_mode ) {
7343		- // Get multisite users only.
7344		- $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT );
7345		- } elseif ( is_multisite() && 1 === intval( $this->get_plugin_option( 'advanced_override_multisite' ) ) ) {
7346		- // This site has overridden any multisite settings, so only get its users.
7347		- $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT );
7348		- } else {
7349		- // Get all site users and all multisite users.
7350		- $auth_settings_access_users_approved = array_merge(
7351		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT ),
7352		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT )
7353		- );
7354		- }
7355		- return $this->in_multi_array( $email, $auth_settings_access_users_approved );
	5753	+ case 'pending':
	5754	+ $auth_settings_access_users_pending = $this->get_plugin_option( 'access_users_pending', SINGLE_ADMIN );
	5755	+ return $this->in_multi_array( $email, $auth_settings_access_users_pending );
	5756	+ break;
	5757	+ case 'blocked':
	5758	+ $auth_settings_access_users_blocked = $this->get_plugin_option( 'access_users_blocked', SINGLE_ADMIN );
	5759	+ return $this->in_multi_array( $email, $auth_settings_access_users_blocked );
	5760	+ break;
	5761	+ case 'approved':
	5762	+ default:
	5763	+ if ( $multisite_mode !== 'single' ) {
	5764	+ // Get multisite users only.
	5765	+ $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN );
	5766	+ } elseif ( is_multisite() && $this->get_plugin_option( 'advanced_override_multisite' ) == '1' ) {
	5767	+ // This site has overridden any multisite settings, so only get its users.
	5768	+ $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN );
	5769	+ } else {
	5770	+ // Get all site users and all multisite users.
	5771	+ $auth_settings_access_users_approved = array_merge(
	5772	+ $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN ),
	5773	+ $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN )
	5774	+ );
	5775	+ }
	5776	+ return $this->in_multi_array( $email, $auth_settings_access_users_approved );
	5777	+ break;
7356	5778	}
7357	5779	}
7358	5780
7359	5781
		@@ -7359,37 +5781,36 @@
7359	5781
7360	5782	/**
7361	5783	* Helper function to get number of users (including multisite users)
7362	5784	* in a given list (pending, approved, or blocked).
7363		- *
7364		- * @param string $list List to get count of.
7365		- * @param string $admin_mode WP_Plugin_Authorizer::SINGLE_CONTEXT or WP_Plugin_Authorizer::NETWORK_CONTEXT determines whether to include multisite users.
7366		- * @return int Number of users in list.
	5785	+ * @param string $list
	5786	+ * @param string $admin_mode SINGLE_ADMIN or MULTISITE_ADMIN determines whether to include multisite users
	5787	+ * @return int number of users in list
7367	5788	*/
7368		- protected function get_user_count_from_list( $list, $admin_mode = WP_Plugin_Authorizer::SINGLE_CONTEXT ) {
	5789	+ function get_user_count_from_list( $list, $admin_mode = SINGLE_ADMIN ) {
7369	5790	$auth_settings_access_users = array();
7370	5791
7371	5792	switch ( $list ) {
7372		- case 'pending':
7373		- $auth_settings_access_users = $this->get_plugin_option( 'access_users_pending', WP_Plugin_Authorizer::SINGLE_CONTEXT );
7374		- break;
7375		- case 'blocked':
7376		- $auth_settings_access_users = $this->get_plugin_option( 'access_users_blocked', WP_Plugin_Authorizer::SINGLE_CONTEXT );
7377		- break;
7378		- case 'approved':
7379		- if ( WP_Plugin_Authorizer::SINGLE_CONTEXT !== $admin_mode ) {
7380		- // Get multisite users only.
7381		- $auth_settings_access_users = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT );
7382		- } elseif ( is_multisite() && 1 === intval( $this->get_plugin_option( 'advanced_override_multisite' ) ) ) {
7383		- // This site has overridden any multisite settings, so only get its users.
7384		- $auth_settings_access_users = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT );
7385		- } else {
7386		- // Get all site users and all multisite users.
7387		- $auth_settings_access_users = array_merge(
7388		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT ),
7389		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT )
7390		- );
7391		- }
	5793	+ case 'pending':
	5794	+ $auth_settings_access_users = $this->get_plugin_option( 'access_users_pending', SINGLE_ADMIN );
	5795	+ break;
	5796	+ case 'blocked':
	5797	+ $auth_settings_access_users = $this->get_plugin_option( 'access_users_blocked', SINGLE_ADMIN );
	5798	+ break;
	5799	+ case 'approved':
	5800	+ if ( $admin_mode !== SINGLE_ADMIN ) {
	5801	+ // Get multisite users only.
	5802	+ $auth_settings_access_users = $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN );
	5803	+ } elseif ( is_multisite() && $this->get_plugin_option( 'advanced_override_multisite' ) == '1' ) {
	5804	+ // This site has overridden any multisite settings, so only get its users.
	5805	+ $auth_settings_access_users = $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN );
	5806	+ } else {
	5807	+ // Get all site users and all multisite users.
	5808	+ $auth_settings_access_users = array_merge(
	5809	+ $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN ),
	5810	+ $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN )
	5811	+ );
	5812	+ }
7392	5813	}
7393	5814
7394	5815	return count( $auth_settings_access_users );
7395	5816	}
		@@ -7396,27 +5817,21 @@
7396	5817
7397	5818
7398	5819	/**
7399	5820	* Helper function to search a multidimensional array for a value.
7400		- *
7401		- * @param string $needle Value to search for.
7402		- * @param array $haystack Multidimensional array to search.
7403		- * @param string $strict_mode 'strict' if strict comparisons should be used.
7404		- * @param string $case_sensitivity 'case sensitive' if comparisons should respect case.
7405		- * @return bool Whether needle was found.
7406	5821	*/
7407		- protected function in_multi_array( $needle = '', $haystack = array(), $strict_mode = 'not strict', $case_sensitivity = 'case insensitive' ) {
	5822	+ function in_multi_array( $needle = '', $haystack = array(), $strict_mode = 'not strict', $case_sensitivity = 'case insensitive' ) {
7408	5823	if ( ! is_array( $haystack ) ) {
7409	5824	return false;
7410	5825	}
7411		- if ( 'case insensitive' === $case_sensitivity ) {
	5826	+ if ( $case_sensitivity === 'case insensitive' ) {
7412	5827	$needle = strtolower( $needle );
7413	5828	}
7414	5829	foreach ( $haystack as $item ) {
7415		- if ( 'case insensitive' === $case_sensitivity && ! is_array( $item ) ) {
	5830	+ if ( $case_sensitivity === 'case insensitive' && ! is_array( $item ) ) {
7416	5831	$item = strtolower( $item );
7417	5832	}
7418		- if ( ( 'strict' === $strict_mode ? $item === $needle : $item == $needle ) || ( is_array( $item ) && $this->in_multi_array( $needle, $item, $strict_mode, $case_sensitivity ) ) ) { // phpcs:ignore WordPress.PHP.StrictComparisons.LooseComparison
	5833	+ if ( ( $strict_mode === 'strict' ? $item === $needle : $item == $needle ) || ( is_array( $item ) && $this->in_multi_array( $needle, $item, $strict_mode, $case_sensitivity ) ) ) {
7419	5834	return true;
7420	5835	}
7421	5836	}
7422	5837	return false;
		@@ -7425,29 +5840,28 @@
7425	5840
7426	5841	/**
7427	5842	* Helper function to determine if an URL is accessible.
7428	5843	*
7429		- * @param string $url URL that should be publicly reachable.
7430		- * @return boolean Whether the URL is publicly reachable.
	5844	+ * @param string $url URL that should be publicly reachable
	5845	+ * @return boolean Whether the URL is publicly reachable
7431	5846	*/
7432		- protected function url_is_accessible( $url ) {
	5847	+ function url_is_accessible( $url ) {
7433	5848	// Use wp_remote_retrieve_response_code() to retrieve the URL.
7434		- $response = wp_remote_get( $url );
	5849	+ $response = wp_remote_get( $url );
7435	5850	$response_code = wp_remote_retrieve_response_code( $response );
7436	5851
7437		- // Return true if the document has loaded successfully without any redirection or error.
7438		- return $response_code >= 200 && $response_code < 400;
	5852	+ // Return true if the document has loaded successfully without any redirection or error
	5853	+ return $response_code >= 200 && $response_code < 300;
7439	5854	}
7440	5855
7441	5856
7442	5857	/**
7443	5858	* Helper function to reconstruct a URL split using parse_url().
7444		- *
7445		- * @param array $parts Array returned from parse_url().
7446		- * @return string URL.
	5859	+ * @param array $parts Array returned from parse_url().
	5860	+ * @return string URL.
7447	5861	*/
7448		- protected function build_url( $parts = array() ) {
7449		- return (
	5862	+ function build_url( $parts = array() ) {
	5863	+ return
7450	5864	( isset( $parts['scheme'] ) ? "{$parts['scheme']}:" : '' ) .
7451	5865	( ( isset( $parts['user'] ) || isset( $parts['host'] ) ) ? '//' : '' ) .
7452	5866	( isset( $parts['user'] ) ? "{$parts['user']}" : '' ) .
7453	5867	( isset( $parts['pass'] ) ? ":{$parts['pass']}" : '' ) .
		@@ -7455,30 +5869,21 @@
7455	5869	( isset( $parts['host'] ) ? "{$parts['host']}" : '' ) .
7456	5870	( isset( $parts['port'] ) ? ":{$parts['port']}" : '' ) .
7457	5871	( isset( $parts['path'] ) ? "{$parts['path']}" : '' ) .
7458	5872	( isset( $parts['query'] ) ? "?{$parts['query']}" : '' ) .
7459		- ( isset( $parts['fragment'] ) ? "#{$parts['fragment']}" : '' )
7460		- );
	5873	+ ( isset( $parts['fragment'] ) ? "#{$parts['fragment']}" : '' );
7461	5874	}
7462	5875
7463	5876
7464		- /**
7465		- * Helper function that prints option tags for a select element for all
7466		- * roles the current user has permission to assign.
7467		- *
7468		- * @param string $selected_role Which role should be selected in the dropdown.
7469		- * @param string $disable_input 'disabled' if select element should be disabled.
7470		- * @param int $admin_mode WP_Plugin_Authorizer::NETWORK_CONTEXT if we are in that context.
7471		- * @return void
7472		- */
7473		- protected function wp_dropdown_permitted_roles( $selected_role = 'subscriber', $disable_input = 'not disabled', $admin_mode = WP_Plugin_Authorizer::SINGLE_CONTEXT ) {
7474		- $roles = get_editable_roles();
	5877	+ // Helper function that builds option tags for a select element for all
	5878	+ // roles the current user has permission to assign.
	5879	+ function wp_dropdown_permitted_roles( $selected_role = 'subscriber', $disable_input = 'not disabled', $admin_mode = SINGLE_ADMIN ) {
	5880	+ $roles = get_editable_roles();
7475	5881	$current_user = wp_get_current_user();
7476	5882
7477	5883	// If we're in network admin, also show any roles that might exist only on
7478	5884	// specific sites in the network (themes can add their own roles).
7479		- if ( WP_Plugin_Authorizer::NETWORK_CONTEXT === $admin_mode ) {
7480		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
	5885	+ if ( $admin_mode === MULTISITE_ADMIN ) {
7481	5886	$sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
7482	5887	foreach ( $sites as $site ) {
7483	5888	$blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
7484	5889	switch_to_blog( $blog_id );
		@@ -7487,11 +5892,11 @@
7487	5892	}
7488	5893	$unique_role_names = array();
7489	5894	foreach ( $roles as $role_name => $role_info ) {
7490	5895	if ( array_key_exists( $role_name, $unique_role_names ) ) {
7491		- unset( $roles[ $role_name ] );
	5896	+ unset( $roles[$role_name] );
7492	5897	} else {
7493		- $unique_role_names[ $role_name ] = true;
	5898	+ $unique_role_names[$role_name] = true;
7494	5899	}
7495	5900	}
7496	5901	}
7497	5902
		@@ -7503,43 +5908,39 @@
7503	5908	}
7504	5909
7505	5910	// Print an option element for each permitted role.
7506	5911	foreach ( $roles as $name => $role ) {
7507		- $is_selected = $selected_role === $name;
	5912	+ $selected = $selected_role === $name ? ' selected="selected"' : '';
7508	5913
7509		- // Don't let a user change their own role (but network admins always can).
7510		- $is_disabled = $selected_role !== $name && 'disabled' === $disable_input && ! ( is_multisite() && current_user_can( 'manage_network' ) );
7511		- ?>
7512		- <option value="<?php echo esc_attr( $name ); ?>"<?php selected( $is_selected ); ?><?php disabled( $is_disabled ); ?>><?php echo esc_html( $role['name'] ); ?></option>
7513		- <?php
	5914	+ // Don't let a user change their own role
	5915	+ $disabled = $selected_role !== $name && $disable_input === 'disabled' ? ' disabled="disabled"' : '';
	5916	+
	5917	+ // But network admins can always change their role.
	5918	+ if ( is_multisite() && current_user_can( 'manage_network' ) ) {
	5919	+ $disabled = '';
	5920	+ }
	5921	+
	5922	+ ?><option value="<?php echo $name; ?>"<?php echo $selected . $disabled; ?>><?php echo $role['name']; ?></option><?php
7514	5923	}
7515	5924
7516	5925	// Print default role (no role).
7517		- $is_selected = strlen( $selected_role ) === 0 || ! array_key_exists( $selected_role, $roles );
7518		- $is_disabled = strlen( $selected_role ) > 0 && 'disabled' === $disable_input && ! ( is_multisite() && current_user_can( 'manage_network' ) );
7519		- ?>
7520		- <option value=""<?php selected( $is_selected ); ?><?php disabled( $is_disabled ); ?>><?php esc_html_e( '&mdash; No role for this site &mdash;', 'authorizer' ); ?></option>
7521		- <?php
	5926	+ $selected = strlen( $selected_role ) == 0 || ! array_key_exists( $selected_role, $roles ) ? ' selected="selected"' : '';
	5927	+ $disabled = strlen( $selected_role ) > 0 && $disable_input === 'disabled' ? ' disabled="disabled"' : '';
	5928	+ if ( is_multisite() && current_user_can( 'manage_network' ) ) {
	5929	+ $disabled = '';
	5930	+ }
	5931	+ ?><option value=""<?php echo $selected . $disabled; ?>><?php _e( '&mdash; No role for this site &mdash;', 'authorizer' ); ?></option><?php
7522	5932
7523	5933	}
7524	5934
7525	5935
7526		- /**
7527		- * Helper function to get a single user info array from one of the access
7528		- * control lists (pending, approved, or blocked).
7529		- *
7530		- * @param string $email Email address to retrieve info for.
7531		- * @param string $list List to get info from.
7532		- * @return mixed false if not found, otherwise: array(
7533		- * 'email' => '',
7534		- * 'role' => '',
7535		- * 'date_added' => '',
7536		- * ['usermeta' => [''|array()]]
7537		- * );
7538		- */
7539		- protected function get_user_info_from_list( $email, $list ) {
	5936	+ // Helper function to get a single user info array from one of the
	5937	+ // access control lists (pending, approved, or blocked).
	5938	+ // Returns: false if not found; otherwise
	5939	+ // array( 'email' => '', 'role' => '', 'date_added' => '', ['usermeta' => [''|array()]] );
	5940	+ function get_user_info_from_list( $email, $list ) {
7540	5941	foreach ( $list as $user_info ) {
7541		- if ( 0 === strcasecmp( $user_info['email'], $email ) ) {
	5942	+ if ( $user_info['email'] === $email ) {
7542	5943	return $user_info;
7543	5944	}
7544	5945	}
7545	5946	return false;
		@@ -7544,49 +5945,29 @@
7544	5945	}
7545	5946	return false;
7546	5947	}
7547	5948
7548		- /**
7549		- * Helper function to convert a string to lowercase. Prefers to use mb_strtolower,
7550		- * but will fall back to strtolower if the former is not available.
7551		- *
7552		- * @param string $string String to convert to lowercase.
7553		- * @return string Input in lowercase.
7554		- */
7555		- protected function lowercase( $string ) {
7556		- return function_exists( 'mb_strtolower' ) ? mb_strtolower( $string ) : strtolower( $string );
7557		- }
7558	5949
7559		-
7560		- /**
7561		- * Helper function to convert seconds to human readable text.
7562		- *
7563		- * @see: http://csl.name/php-secs-to-human-text/
7564		- *
7565		- * @param int $secs Seconds to display as readable text.
7566		- * @return string Readable version of number of seconds.
7567		- */
7568		- protected function seconds_as_sentence( $secs ) {
	5950	+ // Helper function to convert seconds to human readable text.
	5951	+ // Source: http://csl.name/php-secs-to-human-text/
	5952	+ function seconds_as_sentence( $secs ) {
7569	5953	$units = array(
7570		- 'week' => 3600 * 24 * 7,
7571		- 'day' => 3600 * 24,
7572		- 'hour' => 3600,
7573		- 'minute' => 60,
7574		- 'second' => 1,
	5954	+ "week" => 7 * 24 * 3600,
	5955	+ "day" => 24 * 3600,
	5956	+ "hour" => 3600,
	5957	+ "minute" => 60,
	5958	+ "second" => 1,
7575	5959	);
7576	5960
7577		- // Specifically handle zero.
7578		- if ( 0 === intval( $secs ) ) {
7579		- return '0 seconds';
7580		- }
	5961	+ // specifically handle zero
	5962	+ if ( $secs == 0 ) return "0 seconds";
7581	5963
7582		- $s = '';
	5964	+ $s = "";
7583	5965
7584	5966	foreach ( $units as $name => $divisor ) {
7585		- $quot = intval( $secs / $divisor );
7586		- if ( $quot ) {
7587		- $s .= "$quot $name";
7588		- $s .= ( abs( $quot ) > 1 ? 's' : '' ) . ', ';
	5967	+ if ( $quot = intval( $secs / $divisor ) ) {
	5968	+ $s .= "$quot $name";
	5969	+ $s .= ( abs( $quot ) > 1 ? "s" : "" ) . ", ";
7589	5970	$secs -= $quot * $divisor;
7590	5971	}
7591	5972	}
7592	5973
		@@ -7592,14 +5973,10 @@
7592	5973
7593	5974	return substr( $s, 0, -2 );
7594	5975	}
7595	5976
7596		- /**
7597		- * Helper function to get all available usermeta keys as an array.
7598		- *
7599		- * @return array All usermeta keys for user.
7600		- */
7601		- protected function get_all_usermeta_keys() {
	5977	+ // Helper function to get all available usermeta keys as an array.
	5978	+ function get_all_usermeta_keys() {
7602	5979	global $wpdb;
7603	5980	$usermeta_keys = $wpdb->get_col( "SELECT DISTINCT $wpdb->usermeta.meta_key FROM $wpdb->usermeta" );
7604	5981	return $usermeta_keys;
7605	5982	}
		@@ -7606,12 +5983,10 @@
7606	5983
7607	5984
7608	5985	/**
7609	5986	* Load translated strings from *.mo files in /languages.
7610		- *
7611		- * Action: plugins_loaded
7612	5987	*/
7613		- public function load_textdomain() {
	5988	+ function load_textdomain() {
7614	5989	load_plugin_textdomain(
7615	5990	'authorizer',
7616	5991	false,
7617	5992	plugin_basename( dirname( __FILE__ ) ) . '/languages'
		@@ -7622,17 +5997,14 @@
7622	5997	/**
7623	5998	* Generate CAS authentication URL (wp-login.php URL with reauth=1 removed
7624	5999	* and external=cas added).
7625	6000	*/
7626		- private function modify_current_url_for_cas_login() {
	6001	+ function modify_current_url_for_cas_login() {
7627	6002	// Construct the URL of the current page (wp-login.php).
7628		- $url = '';
7629		- if ( isset( $_SERVER['HTTP_HOST'], $_SERVER['REQUEST_URI'] ) ) {
7630		- $url = set_url_scheme( esc_url_raw( wp_unslash( $_SERVER['HTTP_HOST'] ) ) . esc_url_raw( wp_unslash( $_SERVER['REQUEST_URI'] ) ) );
7631		- }
	6003	+ $url = 'http' . ( isset( $_SERVER['HTTPS'] ) ? 's' : '' ) . '://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
7632	6004
7633	6005	// Parse the URL into its components.
7634		- $parsed_url = wp_parse_url( $url );
	6006	+ $parsed_url = parse_url( $url );
7635	6007
7636	6008	// Fix up the querystring values (remove reauth, make sure external=cas).
7637	6009	$querystring = array();
7638	6010	if ( array_key_exists( 'query', $parsed_url ) ) {
		@@ -7639,9 +6011,9 @@
7639	6011	parse_str( $parsed_url['query'], $querystring );
7640	6012	}
7641	6013	unset( $querystring['reauth'] );
7642	6014	$querystring['external'] = 'cas';
7643		- $parsed_url['query'] = http_build_query( $querystring );
	6015	+ $parsed_url['query'] = http_build_query( $querystring );
7644	6016
7645	6017	// Return the URL as a string.
7646	6018	return $this->unparse_url( $parsed_url );
7647	6019	}
		@@ -7648,21 +6020,20 @@
7648	6020
7649	6021
7650	6022	/**
7651	6023	* Reconstruct a URL after it has been deconstructed with parse_url().
7652		- *
7653		- * @param array $parsed_url Keys from parse_url().
7654		- * @return string URL constructed from the components in $parsed_url.
	6024	+ * @param $parsed_url array() with keys from parse_url().
	6025	+ * @return string URL constructed from the components in $parsed_url.
7655	6026	*/
7656		- protected function unparse_url( $parsed_url = array() ) {
7657		- $scheme = isset( $parsed_url['scheme'] ) ? $parsed_url['scheme'] . '://' : '';
7658		- $host = isset( $parsed_url['host'] ) ? $parsed_url['host'] : '';
7659		- $port = isset( $parsed_url['port'] ) ? ':' . $parsed_url['port'] : '';
7660		- $user = isset( $parsed_url['user'] ) ? $parsed_url['user'] : '';
7661		- $pass = isset( $parsed_url['pass'] ) ? ':' . $parsed_url['pass'] : '';
7662		- $pass = $user || $pass ? "$pass@" : '';
7663		- $path = isset( $parsed_url['path'] ) ? $parsed_url['path'] : '';
7664		- $query = isset( $parsed_url['query'] ) ? '?' . $parsed_url['query'] : '';
	6027	+ function unparse_url( $parsed_url = array() ) {
	6028	+ $scheme = isset( $parsed_url['scheme'] ) ? $parsed_url['scheme'] . '://' : '';
	6029	+ $host = isset( $parsed_url['host'] ) ? $parsed_url['host'] : '';
	6030	+ $port = isset( $parsed_url['port'] ) ? ':' . $parsed_url['port'] : '';
	6031	+ $user = isset( $parsed_url['user'] ) ? $parsed_url['user'] : '';
	6032	+ $pass = isset( $parsed_url['pass'] ) ? ':' . $parsed_url['pass'] : '';
	6033	+ $pass = $user || $pass ? "$pass@" : '';
	6034	+ $path = isset( $parsed_url['path'] ) ? $parsed_url['path'] : '';
	6035	+ $query = isset( $parsed_url['query'] ) ? '?' . $parsed_url['query'] : '';
7665	6036	$fragment = isset( $parsed_url['fragment'] ) ? '#' . $parsed_url['fragment'] : '';
7666	6037	return "$scheme$user$pass$host$port$path$query$fragment";
7667	6038	}
7668	6039
		@@ -7667,30 +6038,15 @@
7667	6038	}
7668	6039
7669	6040
7670	6041	/**
7671		- * Helper function to generate an HTML class name for an option (used in
7672		- * Authorizer Settings in the Approved User list).
7673		- *
7674		- * @param string $suffix Unique part of class name.
7675		- * @param boolean $is_multisite_user Whether the class name should indicate it's a multisite user.
7676		- * @return string Class name, e.g., "auth-email auth-multisite-email".
7677		- */
7678		- private function create_class_name( $suffix = '', $is_multisite_user = false ) {
7679		- return $is_multisite_user ? "auth-$suffix auth-multisite-$suffix" : "auth-$suffix";
7680		- }
7681		-
7682		-
7683		- /**
7684	6042	* Plugin Update Routines.
7685		- *
7686		- * Action: plugins_loaded
7687	6043	*/
7688		- public function auth_update_check() {
	6044	+ function auth_update_check() {
7689	6045	// Get current version.
7690	6046	$needs_updating = false;
7691	6047	if ( is_multisite() ) {
7692		- $auth_version = get_blog_option( $this->current_site_blog_id, 'auth_version' );
	6048	+ $auth_version = get_blog_option( BLOG_ID_CURRENT_SITE, 'auth_version' );
7693	6049	} else {
7694	6050	$auth_version = get_option( 'auth_version' );
7695	6051	}
7696	6052
		@@ -7702,9 +6058,9 @@
7702	6058	// log in; approved and blocked lists are changed whenever an admin
7703	6059	// changes them from the multisite panel, the dashboard widget, or
7704	6060	// the plugin options page.
7705	6061	$update_if_older_than = 20140709;
7706		- if ( false === $auth_version || intval( $auth_version ) < $update_if_older_than ) {
	6062	+ if ( $auth_version === false || intval( $auth_version ) < $update_if_older_than ) {
7707	6063	// Copy single site user lists to new options (if they exist).
7708	6064	$auth_settings = get_option( 'auth_settings' );
7709	6065	if ( is_array( $auth_settings ) && array_key_exists( 'access_users_pending', $auth_settings ) ) {
7710	6066	update_option( 'auth_settings_access_users_pending', $auth_settings['access_users_pending'] );
		@@ -7722,27 +6078,27 @@
7722	6078	update_option( 'auth_settings', $auth_settings );
7723	6079	}
7724	6080	// Copy multisite user lists to new options (if they exist).
7725	6081	if ( is_multisite() ) {
7726		- $auth_multisite_settings = get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings', array() );
	6082	+ $auth_multisite_settings = get_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings', array() );
7727	6083	if ( is_array( $auth_multisite_settings ) && array_key_exists( 'access_users_pending', $auth_multisite_settings ) ) {
7728		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_pending', $auth_multisite_settings['access_users_pending'] );
	6084	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_pending', $auth_multisite_settings['access_users_pending'] );
7729	6085	unset( $auth_multisite_settings['access_users_pending'] );
7730		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings', $auth_multisite_settings );
	6086	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings', $auth_multisite_settings );
7731	6087	}
7732	6088	if ( is_array( $auth_multisite_settings ) && array_key_exists( 'access_users_approved', $auth_multisite_settings ) ) {
7733		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings['access_users_approved'] );
	6089	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings['access_users_approved'] );
7734	6090	unset( $auth_multisite_settings['access_users_approved'] );
7735		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings', $auth_multisite_settings );
	6091	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings', $auth_multisite_settings );
7736	6092	}
7737	6093	if ( is_array( $auth_multisite_settings ) && array_key_exists( 'access_users_blocked', $auth_multisite_settings ) ) {
7738		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_blocked', $auth_multisite_settings['access_users_blocked'] );
	6094	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_blocked', $auth_multisite_settings['access_users_blocked'] );
7739	6095	unset( $auth_multisite_settings['access_users_blocked'] );
7740		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings', $auth_multisite_settings );
	6096	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings', $auth_multisite_settings );
7741	6097	}
7742	6098	}
7743	6099	// Update version to reflect this change has been made.
7744		- $auth_version = $update_if_older_than;
	6100	+ $auth_version = $update_if_older_than;
7745	6101	$needs_updating = true;
7746	6102	}
7747	6103
7748	6104	// Update: Set default values for newly added options (forgot to do
		@@ -7748,13 +6104,12 @@
7748	6104	// Update: Set default values for newly added options (forgot to do
7749	6105	// this, so some users are getting debug log notices about undefined
7750	6106	// indexes in $auth_settings).
7751	6107	$update_if_older_than = 20160831;
7752		- if ( false === $auth_version || intval( $auth_version ) < $update_if_older_than ) {
	6108	+ if ( $auth_version === false || intval( $auth_version ) < $update_if_older_than ) {
7753	6109	// Provide default values for any $auth_settings options that don't exist.
7754	6110	if ( is_multisite() ) {
7755		- // Get all blog ids.
7756		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
	6111	+ // Get all blog ids
7757	6112	$sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
7758	6113	foreach ( $sites as $site ) {
7759	6114	$blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
7760	6115	switch_to_blog( $blog_id );
		@@ -7759,9 +6114,9 @@
7759	6114	$blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
7760	6115	switch_to_blog( $blog_id );
7761	6116	// Set meaningful defaults for other sites in the network.
7762	6117	$this->set_default_options();
7763		- // Switch back to original blog.
	6118	+ // Switch back to original blog. See: https://codex.wordpress.org/Function_Reference/restore_current_blog
7764	6119	restore_current_blog();
7765	6120	}
7766	6121	} else {
7767	6122	// Set meaningful defaults for this site.
		@@ -7767,9 +6122,9 @@
7767	6122	// Set meaningful defaults for this site.
7768	6123	$this->set_default_options();
7769	6124	}
7770	6125	// Update version to reflect this change has been made.
7771		- $auth_version = $update_if_older_than;
	6126	+ $auth_version = $update_if_older_than;
7772	6127	$needs_updating = true;
7773	6128	}
7774	6129
7775	6130	// Update: Migrate LDAP passwords encrypted with mcrypt since mcrypt is
		@@ -7774,18 +6129,17 @@
7774	6129
7775	6130	// Update: Migrate LDAP passwords encrypted with mcrypt since mcrypt is
7776	6131	// deprecated as of PHP 7.1. Use openssl library instead.
7777	6132	$update_if_older_than = 20170510;
7778		- if ( false === $auth_version || intval( $auth_version ) < $update_if_older_than ) {
	6133	+ if ( $auth_version === false || intval( $auth_version ) < $update_if_older_than ) {
7779	6134	if ( is_multisite() ) {
7780	6135	// Reencrypt LDAP passwords in each site in the network.
7781		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
7782	6136	$sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
7783	6137	foreach ( $sites as $site ) {
7784		- $blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
	6138	+ $blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
7785	6139	$auth_settings = get_blog_option( $blog_id, 'auth_settings', array() );
7786	6140	if ( array_key_exists( 'ldap_password', $auth_settings ) && strlen( $auth_settings['ldap_password'] ) > 0 ) {
7787		- $plaintext_ldap_password = $this->decrypt( $auth_settings['ldap_password'], 'mcrypt' );
	6141	+ $plaintext_ldap_password = $this->decrypt( $auth_settings['ldap_password'], 'mcrypt' );
7788	6142	$auth_settings['ldap_password'] = $this->encrypt( $plaintext_ldap_password );
7789	6143	update_blog_option( $blog_id, 'auth_settings', $auth_settings );
7790	6144	}
7791	6145	}
		@@ -7792,15 +6146,15 @@
7792	6146	} else {
7793	6147	// Reencrypt LDAP password on this single-site install.
7794	6148	$auth_settings = get_option( 'auth_settings', array() );
7795	6149	if ( array_key_exists( 'ldap_password', $auth_settings ) && strlen( $auth_settings['ldap_password'] ) > 0 ) {
7796		- $plaintext_ldap_password = $this->decrypt( $auth_settings['ldap_password'], 'mcrypt' );
	6150	+ $plaintext_ldap_password = $this->decrypt( $auth_settings['ldap_password'], 'mcrypt' );
7797	6151	$auth_settings['ldap_password'] = $this->encrypt( $plaintext_ldap_password );
7798	6152	update_option( 'auth_settings', $auth_settings );
7799	6153	}
7800	6154	}
7801	6155	// Update version to reflect this change has been made.
7802		- $auth_version = $update_if_older_than;
	6156	+ $auth_version = $update_if_older_than;
7803	6157	$needs_updating = true;
7804	6158	}
7805	6159
7806	6160	// Update: Migrate LDAP passwords encrypted with mcrypt since mcrypt is
		@@ -7806,20 +6160,20 @@
7806	6160	// Update: Migrate LDAP passwords encrypted with mcrypt since mcrypt is
7807	6161	// deprecated as of PHP 7.1. Use openssl library instead.
7808	6162	// Note: Forgot to update the auth_multisite_settings ldap password! Do it here.
7809	6163	$update_if_older_than = 20170511;
7810		- if ( false === $auth_version || intval( $auth_version ) < $update_if_older_than ) {
	6164	+ if ( $auth_version === false || intval( $auth_version ) < $update_if_older_than ) {
7811	6165	if ( is_multisite() ) {
7812	6166	// Reencrypt LDAP password in network (multisite) options.
7813		- $auth_multisite_settings = get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings', array() );
	6167	+ $auth_multisite_settings = get_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings', array() );
7814	6168	if ( array_key_exists( 'ldap_password', $auth_multisite_settings ) && strlen( $auth_multisite_settings['ldap_password'] ) > 0 ) {
7815		- $plaintext_ldap_password = $this->decrypt( $auth_multisite_settings['ldap_password'], 'mcrypt' );
	6169	+ $plaintext_ldap_password = $this->decrypt( $auth_multisite_settings['ldap_password'], 'mcrypt' );
7816	6170	$auth_multisite_settings['ldap_password'] = $this->encrypt( $plaintext_ldap_password );
7817		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings', $auth_multisite_settings );
	6171	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings', $auth_multisite_settings );
7818	6172	}
7819	6173	}
7820	6174	// Update version to reflect this change has been made.
7821		- $auth_version = $update_if_older_than;
	6175	+ $auth_version = $update_if_older_than;
7822	6176	$needs_updating = true;
7823	6177	}
7824	6178
7825	6179	// Update: Remove duplicates from approved list caused by authorizer_automatically_approve_login
		@@ -7825,24 +6179,23 @@
7825	6179	// Update: Remove duplicates from approved list caused by authorizer_automatically_approve_login
7826	6180	// filter not respecting users who are already in the approved list
7827	6181	// (causing them to get re-added each time they logged in).
7828	6182	$update_if_older_than = 20170711;
7829		- if ( false === $auth_version || intval( $auth_version ) < $update_if_older_than ) {
	6183	+ if ( $auth_version === false || intval( $auth_version ) < $update_if_older_than ) {
7830	6184	// Remove duplicates from approved user lists.
7831	6185	if ( is_multisite() ) {
7832		- // Remove duplicates from each site in the multisite.
7833		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
	6186	+ // Remove duplicates from each site in the multisite
7834	6187	$sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
7835	6188	foreach ( $sites as $site ) {
7836		- $blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
	6189	+ $blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
7837	6190	$auth_settings_access_users_approved = get_blog_option( $blog_id, 'auth_settings_access_users_approved', array() );
7838	6191	if ( is_array( $auth_settings_access_users_approved ) ) {
7839		- $should_update = false;
	6192	+ $should_update = false;
7840	6193	$distinct_emails = array();
7841	6194	foreach ( $auth_settings_access_users_approved as $key => $user ) {
7842		- if ( in_array( $user['email'], $distinct_emails, true ) ) {
	6195	+ if ( in_array( $user['email'], $distinct_emails ) ) {
7843	6196	$should_update = true;
7844		- unset( $auth_settings_access_users_approved[ $key ] );
	6197	+ unset( $auth_settings_access_users_approved[$key] );
7845	6198	} else {
7846	6199	$distinct_emails[] = $user['email'];
7847	6200	}
7848	6201	}
		@@ -7851,22 +6204,22 @@
7851	6204	}
7852	6205	}
7853	6206	}
7854	6207	// Remove duplicates from multisite approved user list.
7855		- $auth_multisite_settings_access_users_approved = get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', array() );
	6208	+ $auth_multisite_settings_access_users_approved = get_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', array() );
7856	6209	if ( is_array( $auth_multisite_settings_access_users_approved ) ) {
7857		- $should_update = false;
	6210	+ $should_update = false;
7858	6211	$distinct_emails = array();
7859	6212	foreach ( $auth_multisite_settings_access_users_approved as $key => $user ) {
7860		- if ( in_array( $user['email'], $distinct_emails, true ) ) {
	6213	+ if ( in_array( $user['email'], $distinct_emails ) ) {
7861	6214	$should_update = true;
7862		- unset( $auth_multisite_settings_access_users_approved[ $key ] );
	6215	+ unset( $auth_multisite_settings_access_users_approved[$key] );
7863	6216	} else {
7864	6217	$distinct_emails[] = $user['email'];
7865	6218	}
7866	6219	}
7867	6220	if ( $should_update ) {
7868		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
	6221	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
7869	6222	}
7870	6223	}
7871	6224	} else {
7872	6225	// Remove duplicates from single site approved user list.
		@@ -7871,14 +6224,14 @@
7871	6224	} else {
7872	6225	// Remove duplicates from single site approved user list.
7873	6226	$auth_settings_access_users_approved = get_option( 'auth_settings_access_users_approved' );
7874	6227	if ( is_array( $auth_settings_access_users_approved ) ) {
7875		- $should_update = false;
	6228	+ $should_update = false;
7876	6229	$distinct_emails = array();
7877	6230	foreach ( $auth_settings_access_users_approved as $key => $user ) {
7878		- if ( in_array( $user['email'], $distinct_emails, true ) ) {
	6231	+ if ( in_array( $user['email'], $distinct_emails ) ) {
7879	6232	$should_update = true;
7880		- unset( $auth_settings_access_users_approved[ $key ] );
	6233	+ unset( $auth_settings_access_users_approved[$key] );
7881	6234	} else {
7882	6235	$distinct_emails[] = $user['email'];
7883	6236	}
7884	6237	}
		@@ -7887,90 +6240,24 @@
7887	6240	}
7888	6241	}
7889	6242	}
7890	6243	// Update version to reflect this change has been made.
7891		- $auth_version = $update_if_older_than;
	6244	+ $auth_version = $update_if_older_than;
7892	6245	$needs_updating = true;
7893	6246	}
7894	6247
7895		- // Update: Set default value for newly added option advanced_widget_enabled.
7896		- $update_if_older_than = 20171023;
7897		- if ( false === $auth_version || intval( $auth_version ) < $update_if_older_than ) {
7898		- // Provide default values for any $auth_settings options that don't exist.
7899		- if ( is_multisite() ) {
7900		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
7901		- $sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
7902		- foreach ( $sites as $site ) {
7903		- $blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
7904		- switch_to_blog( $blog_id );
7905		- $this->set_default_options();
7906		- restore_current_blog();
7907		- }
7908		- } else {
7909		- $this->set_default_options();
7910		- }
7911		- // Update version to reflect this change has been made.
7912		- $auth_version = $update_if_older_than;
7913		- $needs_updating = true;
7914		- }
	6248	+ // // Update: TEMPLATE
	6249	+ // $update_if_older_than = YYYYMMDD;
	6250	+ // if ( $auth_version === false || intval( $auth_version ) < $update_if_older_than ) {
	6251	+ // UPDATE CODE HERE
	6252	+ // // Update version to reflect this change has been made.
	6253	+ // $auth_version = $update_if_older_than;
	6254	+ // $needs_updating = true;
	6255	+ // }
7915	6256
7916		- // Update: Set default value for newly added option advanced_users_per_page.
7917		- $update_if_older_than = 20171215;
7918		- if ( false === $auth_version || intval( $auth_version ) < $update_if_older_than ) {
7919		- // Provide default values for any $auth_settings options that don't exist.
7920		- if ( is_multisite() ) {
7921		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
7922		- $sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
7923		- foreach ( $sites as $site ) {
7924		- $blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
7925		- switch_to_blog( $blog_id );
7926		- $this->set_default_options();
7927		- restore_current_blog();
7928		- }
7929		- } else {
7930		- $this->set_default_options();
7931		- }
7932		- // Update version to reflect this change has been made.
7933		- $auth_version = $update_if_older_than;
7934		- $needs_updating = true;
7935		- }
7936		-
7937		- // Update: Set default value for newly added options advanced_users_sort_by and advanced_users_sort_order.
7938		- $update_if_older_than = 20171219;
7939		- if ( false === $auth_version || intval( $auth_version ) < $update_if_older_than ) {
7940		- // Provide default values for any $auth_settings options that don't exist.
7941		- if ( is_multisite() ) {
7942		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
7943		- $sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
7944		- foreach ( $sites as $site ) {
7945		- $blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
7946		- switch_to_blog( $blog_id );
7947		- $this->set_default_options();
7948		- restore_current_blog();
7949		- }
7950		- } else {
7951		- $this->set_default_options();
7952		- }
7953		- // Update version to reflect this change has been made.
7954		- $auth_version = $update_if_older_than;
7955		- $needs_updating = true;
7956		- }
7957		-
7958		- /*
7959		- // Update: TEMPLATE
7960		- $update_if_older_than = YYYYMMDD;
7961		- if ( $auth_version === false || intval( $auth_version ) < $update_if_older_than ) {
7962		- UPDATE CODE HERE
7963		- // Update version to reflect this change has been made.
7964		- $auth_version = $update_if_older_than;
7965		- $needs_updating = true;
7966		- }
7967		- */
7968		-
7969	6257	// Save new version number if we performed any updates.
7970	6258	if ( $needs_updating ) {
7971	6259	if ( is_multisite() ) {
7972		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
7973	6260	$sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
7974	6261	foreach ( $sites as $site ) {
7975	6262	$blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
7976	6263	update_blog_option( $blog_id, 'auth_version', $auth_version );