← All changes | authorizer.php +2077 -3760 2.8.4 → 2.6.20 View file →

		@@ -1,29 +1,49 @@
1	1	<?php
2		-/**
3		- * Plugin Name: Authorizer
4		- * Description: Authorizer limits login attempts, restricts access to specified users, and authenticates against external sources (e.g., Google, LDAP, or CAS).
5		- * Author: Paul Ryan <prar@hawaii.edu>
6		- * Plugin URI: https://github.com/uhm-coe/authorizer
7		- * Text Domain: authorizer
8		- * Domain Path: /languages
9		- * License: GPL2
10		- * Version: 2.8.4
11		- *
12		- * @package authorizer
13		- */
	2	+/*
	3	+Plugin Name: Authorizer
	4	+Plugin URI: https://github.com/uhm-coe/authorizer
	5	+Description: Authorizer limits login attempts, restricts access to specified users, and authenticates against external sources (e.g., Google, LDAP, or CAS).
	6	+Version: 2.6.20
	7	+Author: Paul Ryan
	8	+Author URI: http://www.linkedin.com/in/paulrryan/
	9	+Text Domain: authorizer
	10	+Domain Path: /languages
	11	+License: GPL2
	12	+*/
14	13
15		-/**
16		- * Portions forked from Restricted Site Access plugin: http://wordpress.org/plugins/restricted-site-access/
17		- * Portions forked from wpCAS plugin: http://wordpress.org/extend/plugins/cas-authentication/
18		- * Portions forked from Limit Login Attempts: http://wordpress.org/plugins/limit-login-attempts/
19		- */
20	14
21		-/**
22		- * Add phpCAS library if it's not included.
23		- *
24		- * @see https://wiki.jasig.org/display/CASC/phpCAS+installation+guide
25		- */
	15	+/*
	16	+Copyright 2014 Paul Ryan (email: prar@hawaii.edu)
	17	+
	18	+This program is free software; you can redistribute it and/or modify
	19	+it under the terms of the GNU General Public License, version 2, as
	20	+published by the Free Software Foundation.
	21	+
	22	+This program is distributed in the hope that it will be useful,
	23	+but WITHOUT ANY WARRANTY; without even the implied warranty of
	24	+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	25	+GNU General Public License for more details.
	26	+
	27	+You should have received a copy of the GNU General Public License
	28	+along with this program; if not, write to the Free Software
	29	+Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
	30	+*/
	31	+
	32	+
	33	+/*
	34	+Portions forked from Restricted Site Access plugin: http://wordpress.org/plugins/restricted-site-access/
	35	+Portions forked from wpCAS plugin: http://wordpress.org/extend/plugins/cas-authentication/
	36	+Portions forked from Limit Login Attempts: http://wordpress.org/plugins/limit-login-attempts/
	37	+*/
	38	+
	39	+
	40	+define( 'MULTISITE_ADMIN', 'multisite_admin' );
	41	+define( 'SINGLE_ADMIN', 'single_admin' );
	42	+
	43	+
	44	+// Add phpCAS library if it's not included.
	45	+// @see https://wiki.jasig.org/display/CASC/phpCAS+installation+guide
26	46	if ( ! defined( 'PHPCAS_VERSION' ) ) {
27	47	require_once dirname( __FILE__ ) . '/vendor/CAS-1.3.5/CAS.php';
28	48	}
29	49
		@@ -39,87 +59,18 @@
39	59	* @link http://hawaii.edu/coe/dcdc/wordpress/authorizer/doc/
40	60	*/
41	61	class WP_Plugin_Authorizer {
42	62
43		- /**
44		- * Constants for determining our admin context (network or individual site).
45		- */
46		- const NETWORK_CONTEXT = 'multisite_admin';
47		- const SINGLE_CONTEXT = 'single_admin';
48	63
49	64	/**
50		- * Current site ID (Multisite).
51		- *
52		- * @var string
53		- */
54		- public $current_site_blog_id = 1;
55		-
56		- /**
57		- * HTML allowed when rendering translatable strings in the Authorizer UI.
58		- * This is passed to wp_kses() when sanitizing HMTL strings.
59		- *
60		- * @var array
61		- */
62		- private $allowed_html = array(
63		- 'a' => array(
64		- 'class' => array(),
65		- 'href' => array(),
66		- 'style' => array(),
67		- 'target' => array(),
68		- 'title' => array(),
69		- ),
70		- 'b' => array(),
71		- 'br' => array(),
72		- 'div' => array(
73		- 'class' => array(),
74		- ),
75		- 'em' => array(),
76		- 'hr' => array(),
77		- 'i' => array(),
78		- 'input' => array(
79		- 'aria-describedby' => array(),
80		- 'class' => array(),
81		- 'id' => array(),
82		- 'name' => array(),
83		- 'size' => array(),
84		- 'type' => array(),
85		- 'value' => array(),
86		- ),
87		- 'label' => array(
88		- 'class' => array(),
89		- 'for' => array(),
90		- ),
91		- 'p' => array(
92		- 'style' => array(),
93		- ),
94		- 'span' => array(
95		- 'aria-hidden' => array(),
96		- 'class' => array(),
97		- 'id' => array(),
98		- 'style' => array(),
99		- ),
100		- 'strong' => array(),
101		- );
102		-
103		- /**
104	65	* Constructor.
105	66	*/
106	67	public function __construct() {
107		- // Save reference to current blog id in the network (support deprecated
108		- // constant BLOGID_CURRENT_SITE).
109		- if ( defined( 'BLOG_ID_CURRENT_SITE' ) ) {
110		- $this->current_site_blog_id = BLOG_ID_CURRENT_SITE;
111		- } elseif ( defined( 'BLOGID_CURRENT_SITE' ) ) { // deprecated.
112		- $this->current_site_blog_id = BLOGID_CURRENT_SITE;
113		- }
114		-
115	68	// Installation and uninstallation hooks.
116	69	register_activation_hook( __FILE__, array( $this, 'activate' ) );
117	70	register_deactivation_hook( __FILE__, array( $this, 'deactivate' ) );
118	71
119		- /**
120		- * Register filters.
121		- */
	72	+ // Register filters.
122	73
123	74	// Custom wp authentication routine using external service.
124	75	add_filter( 'authenticate', array( $this, 'custom_authenticate' ), 1, 3 );
125	76
		@@ -125,9 +76,13 @@
125	76
126	77	// Custom logout action using external service.
127	78	add_action( 'wp_logout', array( $this, 'custom_logout' ) );
128	79
129		- // Create settings link on Plugins page.
	80	+ // Removing this bypasses Wordpress authentication (so if external auth fails,
	81	+ // no one can log in); with it enabled, it will run if external auth fails.
	82	+ //remove_filter('authenticate', 'wp_authenticate_username_password', 20, 3);
	83	+
	84	+ // Create settings link on Plugins page
130	85	add_filter( 'plugin_action_links_' . plugin_basename( __FILE__ ), array( $this, 'plugin_settings_link' ) );
131	86	add_filter( 'network_admin_plugin_action_links_' . plugin_basename( __FILE__ ), array( $this, 'network_admin_plugin_settings_link' ) );
132	87
133	88	// Modify login page with a custom password url (if option is set).
		@@ -138,11 +93,9 @@
138	93	if ( $error && strlen( $error ) > 0 ) {
139	94	add_filter( 'login_errors', array( $this, 'show_advanced_login_error' ) );
140	95	}
141	96
142		- /**
143		- * Register actions.
144		- */
	97	+ // Register actions.
145	98
146	99	// Enable localization. Translation files stored in /languages.
147	100	add_action( 'plugins_loaded', array( $this, 'load_textdomain' ) );
148	101
		@@ -154,20 +107,18 @@
154	107
155	108	// Add users who successfully login to the approved list.
156	109	add_action( 'wp_login', array( $this, 'ensure_wordpress_user_in_approved_list_on_login' ), 10, 2 );
157	110
158		- // Create menu item in Settings.
	111	+ // Create menu item in Settings
159	112	add_action( 'admin_menu', array( $this, 'add_plugin_page' ) );
160	113
161		- // Create options page.
	114	+ // Create options page
162	115	add_action( 'admin_init', array( $this, 'page_init' ) );
163	116
164	117	// Update user role in approved list if it's changed in the WordPress edit user page.
165		- add_action( 'user_profile_update_errors', array( $this, 'edit_user_profile_update_role' ), 10, 3 );
	118	+ add_action( 'edit_user_profile_update', array( $this, 'edit_user_profile_update_role' ) );
	119	+ add_action( 'personal_options_update', array( $this, 'edit_user_profile_update_role' ) );
166	120
167		- // Update user email in approved list if it's changed in the WordPress edit user page.
168		- add_filter( 'send_email_change_email', array( $this, 'edit_user_profile_update_email' ), 10, 3 );
169		-
170	121	// Enqueue javascript and css on the plugin's options page, the
171	122	// dashboard (for the widget), and the network admin.
172	123	add_action( 'load-settings_page_authorizer', array( $this, 'load_options_page' ) );
173	124	add_action( 'admin_head-index.php', array( $this, 'load_options_page' ) );
		@@ -172,9 +123,9 @@
172	123	add_action( 'load-settings_page_authorizer', array( $this, 'load_options_page' ) );
173	124	add_action( 'admin_head-index.php', array( $this, 'load_options_page' ) );
174	125	add_action( 'load-toplevel_page_authorizer', array( $this, 'load_options_page' ) );
175	126
176		- // Add custom css and js to wp-login.php.
	127	+ // Add custom css and js to wp-login.php
177	128	add_action( 'login_enqueue_scripts', array( $this, 'login_enqueue_scripts_and_styles' ) );
178	129	add_action( 'login_footer', array( $this, 'load_login_footer_js' ) );
179	130
180	131	// Create google nonce cookie when loading wp-login.php if Google is enabled.
		@@ -179,9 +130,9 @@
179	130
180	131	// Create google nonce cookie when loading wp-login.php if Google is enabled.
181	132	add_action( 'login_init', array( $this, 'login_init__maybe_set_google_nonce_cookie' ) );
182	133
183		- // Modify login page with external auth links (if enabled; e.g., google or cas).
	134	+ // Modify login page with external auth links (if enabled; e.g., google or cas)
184	135	add_action( 'login_form', array( $this, 'login_form_add_external_service_links' ) );
185	136
186	137	// Redirect to CAS login when visiting login page (only if option is
187	138	// enabled, CAS is the only service, and WordPress logins are hidden).
		@@ -190,28 +141,25 @@
190	141	// output is started (so the redirect header doesn't complain about data
191	142	// already being sent).
192	143	add_filter( 'wp_login_errors', array( $this, 'wp_login_errors__maybe_redirect_to_cas' ), 10, 2 );
193	144
194		- // Verify current user has access to page they are visiting.
	145	+ // Verify current user has access to page they are visiting
195	146	add_action( 'parse_request', array( $this, 'restrict_access' ), 9 );
196	147	add_action( 'init', array( $this, 'init__maybe_add_network_approved_user' ) );
197	148
198		- // AJAX: Save options from dashboard widget.
	149	+ // ajax save options from dashboard widget
199	150	add_action( 'wp_ajax_update_auth_user', array( $this, 'ajax_update_auth_user' ) );
200	151
201		- // AJAX: Save options from multisite options page.
	152	+ // ajax save options from multisite options page
202	153	add_action( 'wp_ajax_save_auth_multisite_settings', array( $this, 'ajax_save_auth_multisite_settings' ) );
203	154
204		- // AJAX: Save usermeta from options page.
	155	+ // ajax save usermeta from options page
205	156	add_action( 'wp_ajax_update_auth_usermeta', array( $this, 'ajax_update_auth_usermeta' ) );
206	157
207		- // AJAX: Verify google login.
	158	+ // ajax verify google login
208	159	add_action( 'wp_ajax_process_google_login', array( $this, 'ajax_process_google_login' ) );
209	160	add_action( 'wp_ajax_nopriv_process_google_login', array( $this, 'ajax_process_google_login' ) );
210	161
211		- // AJAX: Refresh approved user list.
212		- add_action( 'wp_ajax_refresh_approved_user_list', array( $this, 'ajax_refresh_approved_user_list' ) );
213		-
214	162	// Add dashboard widget so instructors can add/edit users with access.
215	163	// Hint: For Multisite Network Admin Dashboard use wp_network_dashboard_setup instead of wp_dashboard_setup.
216	164	add_action( 'wp_dashboard_setup', array( $this, 'add_dashboard_widgets' ) );
217	165
		@@ -226,9 +174,9 @@
226	174	add_action( 'wp_enqueue_scripts', array( $this, 'auth_public_scripts' ), 20 );
227	175
228	176	// Multisite-specific actions.
229	177	if ( is_multisite() ) {
230		- // Add network admin options page (global settings for all sites).
	178	+ // Add network admin options page (global settings for all sites)
231	179	add_action( 'network_admin_menu', array( $this, 'network_admin_menu' ) );
232	180	}
233	181
234	182	// Remove user from authorizer lists when that user is deleted in WordPress.
		@@ -264,20 +212,16 @@
264	212	* Will also activate the plugin for all sites/blogs if this is a "Network enable."
265	213	*
266	214	* @return void
267	215	*/
268		- public function activate( $network_wide ) {
	216	+ public function activate() {
269	217	global $wpdb;
270	218
271		- // If we're in a multisite environment, run the plugin activation for each
272		- // site when network enabling.
273		- // Note: wp-cli does not use nonces, so we skip the nonce check here to
274		- // allow the "wp plugin activate authorizer" command.
275		- // phpcs:ignore WordPress.CSRF.NonceVerification.NoNonceVerification
276		- if ( is_multisite() && $network_wide ) {
	219	+ // If we're in a multisite environment, run the plugin activation for each site when network enabling
	220	+ if ( is_multisite() && isset( $_GET['networkwide'] ) && $_GET['networkwide'] == 1 ) {
277	221
278	222	// Add super admins to the multisite approved list.
279		- $auth_multisite_settings_access_users_approved = get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', array() );
	223	+ $auth_multisite_settings_access_users_approved = get_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', array() );
280	224	$should_update_auth_multisite_settings_access_users_approved = false;
281	225	foreach ( get_super_admins() as $super_admin ) {
282	226	$user = get_user_by( 'login', $super_admin );
283	227	// Add to approved list if not there.
		@@ -282,10 +226,10 @@
282	226	$user = get_user_by( 'login', $super_admin );
283	227	// Add to approved list if not there.
284	228	if ( ! $this->in_multi_array( $user->user_email, $auth_multisite_settings_access_users_approved ) ) {
285	229	$approved_user = array(
286		- 'email' => $this->lowercase( $user->user_email ),
287		- 'role' => count( $user->roles ) > 0 ? $user->roles[0] : 'administrator',
	230	+ 'email' => mb_strtolower( $user->user_email ),
	231	+ 'role' => count( $user->roles ) > 0 ? $user->roles[0] : 'administrator',
288	232	'date_added' => date( 'M Y', strtotime( $user->user_registered ) ),
289	233	'local_user' => true,
290	234	);
291	235	array_push( $auth_multisite_settings_access_users_approved, $approved_user );
		@@ -292,14 +236,13 @@
292	236	$should_update_auth_multisite_settings_access_users_approved = true;
293	237	}
294	238	}
295	239	if ( $should_update_auth_multisite_settings_access_users_approved ) {
296		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
	240	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
297	241	}
298	242
299	243	// Run plugin activation on each site in the network.
300	244	$current_blog_id = $wpdb->blogid;
301		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
302	245	$sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
303	246	foreach ( $sites as $site ) {
304	247	$blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
305	248	switch_to_blog( $blog_id );
		@@ -328,13 +271,13 @@
328	271	* @return void
329	272	*/
330	273	private function add_wp_users_to_approved_list() {
331	274	// Add current WordPress users to the approved list.
332		- $auth_multisite_settings_access_users_approved = is_multisite() ? get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', array() ) : array();
333		- $auth_settings_access_users_pending = $this->get_plugin_option( 'access_users_pending', WP_Plugin_Authorizer::SINGLE_CONTEXT );
334		- $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT );
335		- $auth_settings_access_users_blocked = $this->get_plugin_option( 'access_users_blocked', WP_Plugin_Authorizer::SINGLE_CONTEXT );
336		- $updated = false;
	275	+ $auth_multisite_settings_access_users_approved = is_multisite() ? get_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', array() ) : array();
	276	+ $auth_settings_access_users_pending = $this->get_plugin_option( 'access_users_pending', SINGLE_ADMIN );
	277	+ $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN );
	278	+ $auth_settings_access_users_blocked = $this->get_plugin_option( 'access_users_blocked', SINGLE_ADMIN );
	279	+ $updated = false;
337	280	foreach ( get_users() as $user ) {
338	281	// Skip if user is in blocked list.
339	282	if ( $this->in_multi_array( $user->user_email, $auth_settings_access_users_blocked ) ) {
340	283	continue;
		@@ -341,9 +284,9 @@
341	284	}
342	285	// Remove from pending list if there.
343	286	foreach ( $auth_settings_access_users_pending as $key => $pending_user ) {
344	287	if ( 0 === strcasecmp( $pending_user['email'], $user->user_email ) ) {
345		- unset( $auth_settings_access_users_pending[ $key ] );
	288	+ unset( $auth_settings_access_users_pending[$key] );
346	289	$updated = true;
347	290	}
348	291	}
349	292	// Skip if user is in multisite approved list.
		@@ -352,10 +295,10 @@
352	295	}
353	296	// Add to approved list if not there.
354	297	if ( ! $this->in_multi_array( $user->user_email, $auth_settings_access_users_approved ) ) {
355	298	$approved_user = array(
356		- 'email' => $this->lowercase( $user->user_email ),
357		- 'role' => count( $user->roles ) > 0 ? $user->roles[0] : '',
	299	+ 'email' => mb_strtolower( $user->user_email ),
	300	+ 'role' => count( $user->roles ) > 0 ? $user->roles[0] : '',
358	301	'date_added' => date( 'M Y', strtotime( $user->user_registered ) ),
359	302	'local_user' => true,
360	303	);
361	304	array_push( $auth_settings_access_users_approved, $approved_user );
		@@ -390,14 +333,13 @@
390	333
391	334	/**
392	335	* Authenticate against an external service.
393	336	*
394		- * Filter: authenticate
395		- *
396		- * @param WP_User $user user to authenticate.
	337	+ * @param WP_User $user user to authenticate
397	338	* @param string $username optional username to authenticate.
398	339	* @param string $password optional password to authenticate.
399		- * @return WP_User|WP_Error WP_User on success, WP_Error on failure.
	340	+ *
	341	+ * @return WP_User or WP_Error
400	342	*/
401	343	public function custom_authenticate( $user, $username, $password ) {
402	344	// Pass through if already authenticated.
403	345	if ( is_a( $user, 'WP_User' ) ) {
		@@ -405,20 +347,20 @@
405	347	} else {
406	348	$user = null;
407	349	}
408	350
409		- // If username and password are blank, this isn't a log in attempt.
	351	+ // If username and password are blank, this isn't a log in attempt
410	352	$is_login_attempt = strlen( $username ) > 0 && strlen( $password ) > 0;
411	353
412	354	// Check to make sure that $username is not locked out due to too
413	355	// many invalid login attempts. If it is, tell the user how much
414	356	// time remains until they can try again.
415		- $unauthenticated_user = $is_login_attempt ? get_user_by( 'login', $username ) : false;
	357	+ $unauthenticated_user = $is_login_attempt ? get_user_by( 'login', $username ) : false;
416	358	$unauthenticated_user_is_blocked = false;
417		- if ( $is_login_attempt && false !== $unauthenticated_user ) {
	359	+ if ( $is_login_attempt && $unauthenticated_user !== false ) {
418	360	$last_attempt = get_user_meta( $unauthenticated_user->ID, 'auth_settings_advanced_lockouts_time_last_failed', true );
419	361	$num_attempts = get_user_meta( $unauthenticated_user->ID, 'auth_settings_advanced_lockouts_failed_attempts', true );
420		- // Also check the auth_blocked user_meta flag (users in blocked list will get this flag).
	362	+ // Also check the auth_blocked user_meta flag (users in blocked list will get this flag)
421	363	$unauthenticated_user_is_blocked = get_user_meta( $unauthenticated_user->ID, 'auth_blocked', true ) === 'yes';
422	364	} else {
423	365	$last_attempt = get_option( 'auth_settings_advanced_lockouts_time_last_failed' );
424	366	$num_attempts = get_option( 'auth_settings_advanced_lockouts_failed_attempts' );
		@@ -432,9 +374,9 @@
432	374	return new WP_Error( 'empty_password', __( '<strong>ERROR</strong>: Incorrect username or password.', 'authorizer' ) );
433	375	}
434	376
435	377	// Grab plugin settings.
436		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
	378	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' );
437	379
438	380	// Make sure $last_attempt (time) and $num_attempts are positive integers.
439	381	// Note: this addresses resetting them if either is unset from above.
440	382	$last_attempt = abs( intval( $last_attempt ) );
		@@ -440,17 +382,17 @@
440	382	$last_attempt = abs( intval( $last_attempt ) );
441	383	$num_attempts = abs( intval( $num_attempts ) );
442	384
443	385	// Create semantic lockout variables.
444		- $lockouts = $auth_settings['advanced_lockouts'];
445		- $time_since_last_fail = time() - $last_attempt;
446		- $reset_duration = $lockouts['reset_duration'] * 60; // minutes to seconds.
447		- $num_attempts_long_lockout = $lockouts['attempts_1'] + $lockouts['attempts_2'];
448		- $num_attempts_short_lockout = $lockouts['attempts_1'];
449		- $seconds_remaining_long_lockout = $lockouts['duration_2'] * 60 - $time_since_last_fail;
	386	+ $lockouts = $auth_settings['advanced_lockouts'];
	387	+ $time_since_last_fail = time() - $last_attempt;
	388	+ $reset_duration = $lockouts['reset_duration'] * 60; // minutes to seconds
	389	+ $num_attempts_long_lockout = $lockouts['attempts_1'] + $lockouts['attempts_2'];
	390	+ $num_attempts_short_lockout = $lockouts['attempts_1'];
	391	+ $seconds_remaining_long_lockout = $lockouts['duration_2'] * 60 - $time_since_last_fail;
450	392	$seconds_remaining_short_lockout = $lockouts['duration_1'] * 60 - $time_since_last_fail;
451	393
452		- // Check if we need to institute a lockout delay.
	394	+ // Check if we need to institute a lockout delay
453	395	if ( $is_login_attempt && $time_since_last_fail > $reset_duration ) {
454	396	// Enough time has passed since the last invalid attempt and
455	397	// now that we can reset the failed attempt count, and let this
456	398	// login attempt go through.
		@@ -463,9 +405,8 @@
463	405	remove_filter( 'authenticate', 'wp_authenticate_username_password', 20, 3 );
464	406	return new WP_Error(
465	407	'empty_password',
466	408	sprintf(
467		- /* TRANSLATORS: 1: username 2: duration of lockout in seconds 3: duration of lockout as a phrase 4: lost password URL */
468	409	__( '<strong>ERROR</strong>: There have been too many invalid login attempts for the username <strong>%1$s</strong>. Please wait <strong id="seconds_remaining" data-seconds="%2$s">%3$s</strong> before trying again. <a href="%4$s" title="Password Lost and Found">Lost your password</a>?', 'authorizer' ),
469	410	$username,
470	411	$seconds_remaining_long_lockout,
471	412	$this->seconds_as_sentence( $seconds_remaining_long_lockout ),
		@@ -480,9 +421,8 @@
480	421	remove_filter( 'authenticate', 'wp_authenticate_username_password', 20, 3 );
481	422	return new WP_Error(
482	423	'empty_password',
483	424	sprintf(
484		- /* TRANSLATORS: 1: username 2: duration of lockout in seconds 3: duration of lockout as a phrase 4: lost password URL */
485	425	__( '<strong>ERROR</strong>: There have been too many invalid login attempts for the username <strong>%1$s</strong>. Please wait <strong id="seconds_remaining" data-seconds="%2$s">%3$s</strong> before trying again. <a href="%4$s" title="Password Lost and Found">Lost your password</a>?', 'authorizer' ),
486	426	$username,
487	427	$seconds_remaining_short_lockout,
488	428	$this->seconds_as_sentence( $seconds_remaining_short_lockout ),
		@@ -492,16 +432,16 @@
492	432	}
493	433
494	434	// Start external authentication.
495	435	$externally_authenticated_emails = array();
496		- $authenticated_by = '';
497		- $result = null;
	436	+ $authenticated_by = '';
	437	+ $result = null;
498	438
499	439	// Try Google authentication if it's enabled and we don't have a
500	440	// successful login yet.
501	441	if (
502		- '1' === $auth_settings['google'] &&
503		- 0 === count( $externally_authenticated_emails ) &&
	442	+ $auth_settings['google'] === '1' &&
	443	+ count( $externally_authenticated_emails ) === 0 &&
504	444	! is_wp_error( $result )
505	445	) {
506	446	$result = $this->custom_authenticate_google( $auth_settings );
507	447	if ( ! is_null( $result ) && ! is_wp_error( $result ) ) {
		@@ -516,10 +456,10 @@
516	456
517	457	// Try CAS authentication if it's enabled and we don't have a
518	458	// successful login yet.
519	459	if (
520		- '1' === $auth_settings['cas'] &&
521		- 0 === count( $externally_authenticated_emails ) &&
	460	+ $auth_settings['cas'] === '1' &&
	461	+ count( $externally_authenticated_emails ) === 0 &&
522	462	! is_wp_error( $result )
523	463	) {
524	464	$result = $this->custom_authenticate_cas( $auth_settings );
525	465	if ( ! is_null( $result ) && ! is_wp_error( $result ) ) {
		@@ -534,10 +474,10 @@
534	474
535	475	// Try LDAP authentication if it's enabled and we don't have an
536	476	// authenticated user yet.
537	477	if (
538		- '1' === $auth_settings['ldap'] &&
539		- 0 === count( $externally_authenticated_emails ) &&
	478	+ $auth_settings['ldap'] === '1' &&
	479	+ count( $externally_authenticated_emails ) === 0 &&
540	480	! is_wp_error( $result )
541	481	) {
542	482	$result = $this->custom_authenticate_ldap( $auth_settings, $username, $password );
543	483	if ( ! is_null( $result ) && ! is_wp_error( $result ) ) {
		@@ -558,37 +498,35 @@
558	498
559	499	// Remove duplicate and blank emails, if any.
560	500	$externally_authenticated_emails = array_filter( array_unique( $externally_authenticated_emails ) );
561	501
562		- /**
563		- * If we've made it this far, we should have an externally
564		- * authenticated user. The following should be set:
565		- * $externally_authenticated_emails
566		- * $authenticated_by
567		- */
	502	+ // If we've made it this far, we should have an externally
	503	+ // authenticated user. The following should be set:
	504	+ // $externally_authenticated_emails
	505	+ // $authenticated_by
568	506
569	507	// Get the external user's WordPress account by email address.
570	508	foreach ( $externally_authenticated_emails as $externally_authenticated_email ) {
571		- $user = get_user_by( 'email', $this->lowercase( $externally_authenticated_email ) );
	509	+ $user = get_user_by( 'email', mb_strtolower( $externally_authenticated_email ) );
572	510
573	511	// If we've already found a WordPress user associated with one
574	512	// of the supplied email addresses, don't keep examining other
575	513	// email addresses associated with the externally authenticated user.
576		- if ( false !== $user ) {
	514	+ if ( $user !== FALSE ) {
577	515	break;
578	516	}
579	517	}
580	518
581	519	// Check this external user's access against the access lists
582		- // (pending, approved, blocked).
	520	+ // (pending, approved, blocked)
583	521	$result = $this->check_user_access( $user, $externally_authenticated_emails, $result );
584	522
585	523	// Fail with message if there was an error creating/adding the user.
586		- if ( is_wp_error( $result ) || 0 === $result ) {
	524	+ if ( is_wp_error( $result ) || $result === 0 ) {
587	525	return $result;
588	526	}
589	527
590		- // If we have a valid user from check_user_access(), log that user in.
	528	+ // If we created a new user in check_user_access(), log that user in.
591	529	if ( get_class( $result ) === 'WP_User' ) {
592	530	$user = $result;
593	531	}
594	532
		@@ -605,26 +543,26 @@
605	543	/**
606	544	* This function will fail with a wp_die() message to the user if they
607	545	* don't have access.
608	546	*
609		- * @param WP_User $user User to check.
610		- * @param array $user_emails Array of user's plaintext emails (in case current user doesn't have a WP account).
611		- * @param array $user_data Array of keys for email, username, first_name, last_name,
612		- * authenticated_by, google_attributes, cas_attributes, ldap_attributes.
613		- * @return WP_Error|void|WP_User
614		- * WP_Error if there was an error on user creation / adding user to blog.
615		- * wp_die() if user does not have access.
616		- * WP_User if user has access.
	547	+ * @param WP_User $user User to check
	548	+ * @param [type] $user_emails Array of user's plaintext emails (in case current user doesn't have a WP account)
	549	+ * @param [type] $user_data Array of keys for email, username, first_name, last_name,
	550	+ * authenticated_by, google_attributes, cas_attributes, ldap_attributes.
	551	+ * @return WP_Error if there was an error on user creation / adding user to blog
	552	+ * wp_die() if user does not have access
	553	+ * null if user has access (success)
	554	+ * WP_User if user has access and a new account was created for them
617	555	*/
618	556	private function check_user_access( $user, $user_emails, $user_data = array() ) {
619	557	// Grab plugin settings.
620		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
621		- $auth_settings_access_users_pending = $this->sanitize_user_list(
622		- $this->get_plugin_option( 'access_users_pending', WP_Plugin_Authorizer::SINGLE_CONTEXT )
	558	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' );
	559	+ $auth_settings_access_users_pending = $this->sanitize_user_list(
	560	+ $this->get_plugin_option( 'access_users_pending', SINGLE_ADMIN )
623	561	);
624		- $auth_settings_access_users_approved_single = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT );
625		- $auth_settings_access_users_approved_multi = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT );
626		- $auth_settings_access_users_approved = $this->sanitize_user_list(
	562	+ $auth_settings_access_users_approved_single = $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN );
	563	+ $auth_settings_access_users_approved_multi = $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN );
	564	+ $auth_settings_access_users_approved = $this->sanitize_user_list(
627	565	array_merge(
628	566	$auth_settings_access_users_approved_single,
629	567	$auth_settings_access_users_approved_multi
630	568	)
		@@ -636,9 +574,9 @@
636	574	*
637	575	* @param bool $allow_login Whether to block the currently logging in user.
638	576	* @param array $user_data User data returned from external service.
639	577	*/
640		- $allow_login = apply_filters( 'authorizer_allow_login', true, $user_data );
	578	+ $allow_login = apply_filters( 'authorizer_allow_login', true, $user_data );
641	579	$blocked_by_filter = ! $allow_login; // Use this for better readability.
642	580
643	581	// Check our externally authenticated user against the block list.
644	582	// If any of their email addresses are blocked, set the relevant user
		@@ -648,16 +586,14 @@
648	586
649	587	// Add user to blocked list if it was blocked via the filter.
650	588	if ( $blocked_by_filter && ! $this->is_email_in_list( $user_email, 'blocked' ) ) {
651	589	$auth_settings_access_users_blocked = $this->sanitize_user_list(
652		- $this->get_plugin_option( 'access_users_blocked', WP_Plugin_Authorizer::SINGLE_CONTEXT )
	590	+ $this->get_plugin_option( 'access_users_blocked', SINGLE_ADMIN )
653	591	);
654		- array_push(
655		- $auth_settings_access_users_blocked, array(
656		- 'email' => $this->lowercase( $user_email ),
657		- 'date_added' => date( 'M Y' ),
658		- )
659		- );
	592	+ array_push( $auth_settings_access_users_blocked, array(
	593	+ 'email' => mb_strtolower( $user_email ),
	594	+ 'date_added' => date( 'M Y' ),
	595	+ ));
660	596	update_option( 'auth_settings_access_users_blocked', $auth_settings_access_users_blocked );
661	597	}
662	598
663	599	// If the blocked external user has a WordPress account, mark it as
		@@ -666,11 +602,10 @@
666	602	update_user_meta( $user->ID, 'auth_blocked', 'yes' );
667	603	}
668	604
669	605	// Notify user about blocked status and return without authenticating them.
670		- // phpcs:ignore WordPress.CSRF.NonceVerification.NoNonceVerification
671		- $redirect_to = ! empty( $_REQUEST['redirect_to'] ) ? esc_url_raw( wp_unslash( $_REQUEST['redirect_to'] ) ) : home_url();
672		- $page_title = sprintf(
	606	+ $redirect_to = ! empty( $_REQUEST['redirect_to'] ) ? $_REQUEST['redirect_to'] : home_url();
	607	+ $page_title = sprintf(
673	608	/* TRANSLATORS: %s: Name of blog */
674	609	__( '%s - Access Restricted', 'authorizer' ),
675	610	get_bloginfo( 'name' )
676	611	);
		@@ -681,9 +616,9 @@
681	616	'<a class="button" href="' . wp_logout_url( $redirect_to ) . '">' .
682	617	__( 'Back', 'authorizer' ) .
683	618	'</a></p>';
684	619	update_option( 'auth_settings_advanced_login_error', $error_message );
685		- wp_die( wp_kses( $error_message, $this->allowed_html ), esc_html( $page_title ) );
	620	+ wp_die( $error_message, $page_title );
686	621	}
687	622	}
688	623
689	624	// Get the default role for this user (or their current role, if they
		@@ -693,9 +628,8 @@
693	628	* Filter the role of the user currently logging in. The role will be
694	629	* set to the default (specified in Authorizer options) for new users,
695	630	* or the user's current role for existing users. This filter allows
696	631	* changing user roles based on custom CAS/LDAP attributes.
697		- *
698	632	* @param bool $role Role of the user currently logging in.
699	633	* @param array $user_data User data returned from external service.
700	634	*/
701	635	$approved_role = apply_filters( 'authorizer_custom_role', $default_role, $user_data );
		@@ -720,9 +654,9 @@
720	654	// If this externally authenticated user is an existing administrator
721	655	// (administrator in single site mode, or super admin in network mode),
722	656	// and is not in the blocked list, let them in.
723	657	if ( $user && is_super_admin( $user->ID ) ) {
724		- return $user;
	658	+ return;
725	659	}
726	660
727	661	// If this externally authenticated user isn't in the approved list
728	662	// and login access is set to "All authenticated users," or if they were
		@@ -730,9 +664,9 @@
730	664	// above, then add them to the approved list (they'll get an account
731	665	// created below if they don't have one yet).
732	666	if (
733	667	! $this->is_email_in_list( $user_email, 'approved' ) &&
734		- ( 'external_users' === $auth_settings['access_who_can_login'] || $automatically_approve_login )
	668	+ ( $auth_settings['access_who_can_login'] === 'external_users' || $automatically_approve_login )
735	669	) {
736	670	$is_newly_approved_user = true;
737	671
738	672	// If this user happens to be in the pending list (rare),
		@@ -748,11 +682,11 @@
748	682	}
749	683
750	684	// Add this user to the approved list.
751	685	$approved_user = array(
752		- 'email' => $this->lowercase( $user_email ),
753		- 'role' => $approved_role,
754		- 'date_added' => date( 'Y-m-d H:i:s' ),
	686	+ 'email' => mb_strtolower( $user_email ),
	687	+ 'role' => $approved_role,
	688	+ 'date_added' => date( "Y-m-d H:i:s" ),
755	689	);
756	690	array_push( $auth_settings_access_users_approved, $approved_user );
757	691	array_push( $auth_settings_access_users_approved_single, $approved_user );
758	692	update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved_single );
		@@ -770,9 +704,9 @@
770	704	if ( $default_role !== $approved_role ) {
771	705	$user_info['role'] = $approved_role;
772	706	}
773	707
774		- // If the approved external user does not have a WordPress account, create it.
	708	+ // If the approved external user does not have a WordPress account, create it
775	709	if ( ! $user ) {
776	710	// If there's already a user with this username (e.g.,
777	711	// johndoe/johndoe@gmail.com exists, and we're trying to add
778	712	// johndoe/johndoe@example.com), use the full email address
		@@ -787,47 +721,26 @@
787	721	$username = $user_info['email'];
788	722	}
789	723	$result = wp_insert_user(
790	724	array(
791		- 'user_login' => strtolower( $username ),
792		- 'user_pass' => wp_generate_password(), // random password.
793		- 'first_name' => array_key_exists( 'first_name', $user_data ) ? $user_data['first_name'] : '',
794		- 'last_name' => array_key_exists( 'last_name', $user_data ) ? $user_data['last_name'] : '',
795		- 'user_email' => $this->lowercase( $user_info['email'] ),
	725	+ 'user_login' => strtolower( $username ),
	726	+ 'user_pass' => wp_generate_password(), // random password
	727	+ 'first_name' => array_key_exists( 'first_name', $user_data ) ? $user_data['first_name'] : '',
	728	+ 'last_name' => array_key_exists( 'last_name', $user_data ) ? $user_data['last_name'] : '',
	729	+ 'user_email' => mb_strtolower( $user_info['email'] ),
796	730	'user_registered' => date( 'Y-m-d H:i:s' ),
797		- 'role' => $user_info['role'],
	731	+ 'role' => $user_info['role'],
798	732	)
799	733	);
800	734
801	735	// Fail with message if error.
802		- if ( is_wp_error( $result ) || 0 === $result ) {
	736	+ if ( is_wp_error( $result ) || $result === 0 ) {
803	737	return $result;
804	738	}
805	739
806		- // Authenticate as new user.
	740	+ // Authenticate as new user
807	741	$user = new WP_User( $result );
808	742
809		- /**
810		- * Fires after an external user is authenticated for the first time
811		- * and a new WordPress account is created for them.
812		- *
813		- * @since 2.8.0
814		- *
815		- * @param WP_User $user User object.
816		- * @param array $user_data User data from external service.
817		- *
818		- * Example $user_data:
819		- * array(
820		- * 'email' => 'user@example.edu',
821		- * 'username' => 'user',
822		- * 'first_name' => 'First',
823		- * 'last_name' => 'Last',
824		- * 'authenticated_by' => 'cas',
825		- * 'cas_attributes' => array( ... ),
826		- * );
827		- */
828		- do_action( 'authorizer_user_register', $user, $user_data );
829		-
830	743	// If multisite, iterate through all sites in the network and add the user
831	744	// currently logging in to any of them that have the user on the approved list.
832	745	// Note: this is useful for first-time logins--some users will have access
833	746	// to multiple sites, and this prevents them from having to log into each
		@@ -833,21 +746,18 @@
833	746	// to multiple sites, and this prevents them from having to log into each
834	747	// site individually to get access.
835	748	if ( is_multisite() ) {
836	749	$site_ids_of_user = array_map(
837		- function ( $site_of_user ) {
838		- return intval( $site_of_user->userblog_id );
839		- },
	750	+ function ( $site_of_user ) { return $site_of_user->userblog_id; },
840	751	get_blogs_of_user( $user->ID )
841	752	);
842	753
843		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
844	754	$sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
845	755	foreach ( $sites as $site ) {
846	756	$blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
847	757
848	758	// Skip if user is already added to this site.
849		- if ( in_array( intval( $blog_id ), $site_ids_of_user, true ) ) {
	759	+ if ( in_array( $blog_id, $site_ids_of_user ) ) {
850	760	continue;
851	761	}
852	762
853	763	// Check if user is on the approved list of this site they are not added to.
		@@ -873,9 +783,9 @@
873	783	if ( $meta_key === $user_info['usermeta']['meta_key'] ) {
874	784	// Update user's usermeta value for usermeta key stored in authorizer options.
875	785	if ( strpos( $meta_key, 'acf___' ) === 0 && class_exists( 'acf' ) ) {
876	786	// We have an ACF field value, so use the ACF function to update it.
877		- update_field( str_replace( 'acf___', '', $meta_key ), $user_info['usermeta']['meta_value'], 'user_' . $user->ID );
	787	+ update_field( str_replace('acf___', '', $meta_key ), $user_info['usermeta']['meta_value'], 'user_' . $user->ID );
878	788	} else {
879	789	// We have a normal usermeta value, so just update it via the WordPress function.
880	790	update_user_meta( $user->ID, $meta_key, $user_info['usermeta']['meta_value'] );
881	791	}
		@@ -891,9 +801,9 @@
891	801	switch_to_blog( $blog_id );
892	802	// Update user's usermeta value for usermeta key stored in authorizer options.
893	803	if ( strpos( $meta_key, 'acf___' ) === 0 && class_exists( 'acf' ) ) {
894	804	// We have an ACF field value, so use the ACF function to update it.
895		- update_field( str_replace( 'acf___', '', $meta_key ), $usermeta['meta_value'], 'user_' . $user->ID );
	805	+ update_field( str_replace('acf___', '', $meta_key ), $usermeta['meta_value'], 'user_' . $user->ID );
896	806	} else {
897	807	// We have a normal usermeta value, so just update it via the WordPress function.
898	808	update_user_meta( $user->ID, $meta_key, $usermeta['meta_value'] );
899	809	}
		@@ -904,24 +814,20 @@
904	814	}
905	815	} else {
906	816	// Update first/last names of WordPress user from external
907	817	// service if that option is set.
908		- if ( ( array_key_exists( 'authenticated_by', $user_data ) && 'cas' === $user_data['authenticated_by'] && array_key_exists( 'cas_attr_update_on_login', $auth_settings ) && 1 === intval( $auth_settings['cas_attr_update_on_login'] ) ) || ( array_key_exists( 'authenticated_by', $user_data ) && 'ldap' === $user_data['authenticated_by'] && array_key_exists( 'ldap_attr_update_on_login', $auth_settings ) && 1 === intval( $auth_settings['ldap_attr_update_on_login'] ) ) ) {
909		- if ( array_key_exists( 'first_name', $user_data ) && 0 < strlen( $user_data['first_name'] ) ) {
910		- wp_update_user(
911		- array(
912		- 'ID' => $user->ID,
913		- 'first_name' => $user_data['first_name'],
914		- )
915		- );
	818	+ if ( ( array_key_exists( 'authenticated_by', $user_data ) && $user_data['authenticated_by'] === 'cas' && array_key_exists( 'cas_attr_update_on_login', $auth_settings ) && $auth_settings['cas_attr_update_on_login'] == 1 ) || ( array_key_exists( 'authenticated_by', $user_data ) && $user_data['authenticated_by'] === 'ldap' && array_key_exists( 'ldap_attr_update_on_login', $auth_settings ) && $auth_settings['ldap_attr_update_on_login'] == 1 ) ) {
	819	+ if ( array_key_exists( 'first_name', $user_data ) && strlen( $user_data['first_name'] ) > 0 ) {
	820	+ wp_update_user( array(
	821	+ 'ID' => $user->ID,
	822	+ 'first_name' => $user_data['first_name'],
	823	+ ));
916	824	}
917	825	if ( array_key_exists( 'last_name', $user_data ) && strlen( $user_data['last_name'] ) > 0 ) {
918		- wp_update_user(
919		- array(
920		- 'ID' => $user->ID,
921		- 'last_name' => $user_data['last_name'],
922		- )
923		- );
	826	+ wp_update_user( array(
	827	+ 'ID' => $user->ID,
	828	+ 'last_name' => $user_data['last_name'],
	829	+ ));
924	830	}
925	831	}
926	832
927	833	// Update this user's role if it was modified in the
		@@ -932,9 +838,9 @@
932	838
933	839	// Update user's role in this site's approved list and save.
934	840	foreach ( $auth_settings_access_users_approved_single as $key => $existing_user ) {
935	841	if ( 0 === strcasecmp( $user->user_email, $existing_user['email'] ) ) {
936		- $auth_settings_access_users_approved_single[ $key ]['role'] = $approved_role;
	842	+ $auth_settings_access_users_approved_single[$key]['role'] = $approved_role;
937	843	break;
938	844	}
939	845	}
940	846	update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved_single );
		@@ -951,34 +857,33 @@
951	857	}
952	858	}
953	859
954	860	// Ensure user has the same role as their entry in the approved list.
955		- if ( $user_info && ! in_array( $user_info['role'], $user->roles, true ) ) {
	861	+ // (This is just a precaution, the role should already be set when
	862	+ // saving admin options in the sanitizing function.)
	863	+ if ( $user_info && ! array_key_exists( $user_info['role'], $user->roles ) ) {
956	864	$user->set_role( $user_info['role'] );
957	865	}
958	866
959	867	return $user;
960	868
	869	+ // Note: only do this for the last email address we are checking (we need
	870	+ // to iterate through them all to make sure one of them isn't approved).
961	871	} elseif ( 0 === strcasecmp( $user_email, $last_email ) ) {
962		- /**
963		- * Note: only do this for the last email address we are checking (we need
964		- * to iterate through them all to make sure one of them isn't approved).
965		- */
966		-
967	872	// User isn't an admin, is not blocked, and is not approved.
968	873	// Add them to the pending list and notify them and their instructor.
969	874	if ( strlen( $user_email ) > 0 && ! $this->is_email_in_list( $user_email, 'pending' ) ) {
970		- $pending_user = array();
971		- $pending_user['email'] = $this->lowercase( $user_email );
972		- $pending_user['role'] = $approved_role;
	875	+ $pending_user = array();
	876	+ $pending_user['email'] = mb_strtolower( $user_email );
	877	+ $pending_user['role'] = $approved_role;
973	878	$pending_user['date_added'] = '';
974	879	array_push( $auth_settings_access_users_pending, $pending_user );
975	880	update_option( 'auth_settings_access_users_pending', $auth_settings_access_users_pending );
976	881
977	882	// Create strings used in the email notification.
978		- $site_name = get_bloginfo( 'name' );
979		- $site_url = get_bloginfo( 'url' );
980		- $authorizer_options_url = 'settings' === $auth_settings['advanced_admin_menu'] ? admin_url( 'options-general.php?page=authorizer' ) : admin_url( '?page=authorizer' );
	883	+ $site_name = get_bloginfo( 'name' );
	884	+ $site_url = get_bloginfo( 'url' );
	885	+ $authorizer_options_url = $auth_settings['advanced_admin_menu'] === 'settings' ? admin_url( 'options-general.php?page=authorizer' ) : admin_url( '?page=authorizer' );
981	886
982	887	// Notify users with the role specified in "Which role should
983	888	// receive email notifications about pending users?".
984	889	if ( strlen( $auth_settings['access_role_receive_pending_emails'] ) > 0 ) {
		@@ -1003,11 +908,10 @@
1003	908	}
1004	909	}
1005	910
1006	911	// Notify user about pending status and return without authenticating them.
1007		- // phpcs:ignore WordPress.CSRF.NonceVerification.NoNonceVerification
1008		- $redirect_to = ! empty( $_REQUEST['redirect_to'] ) ? esc_url_raw( wp_unslash( $_REQUEST['redirect_to'] ) ) : home_url();
1009		- $page_title = get_bloginfo( 'name' ) . ' - Access Pending';
	912	+ $redirect_to = ! empty( $_REQUEST['redirect_to'] ) ? $_REQUEST['redirect_to'] : home_url();
	913	+ $page_title = get_bloginfo( 'name' ) . ' - Access Pending';
1010	914	$error_message =
1011	915	apply_filters( 'the_content', $auth_settings['access_pending_redirect_to_message'] ) .
1012	916	'<hr />' .
1013	917	'<p style="text-align: center;">' .
		@@ -1014,9 +918,9 @@
1014	918	'<a class="button" href="' . wp_logout_url( $redirect_to ) . '">' .
1015	919	__( 'Back', 'authorizer' ) .
1016	920	'</a></p>';
1017	921	update_option( 'auth_settings_advanced_login_error', $error_message );
1018		- wp_die( wp_kses( $error_message, $this->allowed_html ), esc_html( $page_title ) );
	922	+ wp_die( $error_message, $page_title );
1019	923	}
1020	924	}
1021	925
1022	926	// Sanity check: if we made it here without returning, something has gone wrong.
		@@ -1039,34 +943,24 @@
1039	943	* custom_authenticate_google() runs to verify the token; once verified
1040	944	* custom_authenticate proceeds as normal with the google email address
1041	945	* as a successfully authenticated external user.
1042	946	*
1043		- * Action: wp_ajax_process_google_login
1044		- * Action: wp_ajax_nopriv_process_google_login
1045		- *
1046		- * @return void, but die with the value to return to the success() function in AJAX call signInCallback().
	947	+ * @return void, but die with the value to return to the success() function in AJAX call signInCallback()
1047	948	*/
1048		- public function ajax_process_google_login() {
	949	+ function ajax_process_google_login() {
	950	+ $nonce = array_key_exists( 'nonce', $_POST ) ? $_POST['nonce'] : '';
	951	+ $code = array_key_exists( 'code', $_POST ) ? $_POST['code'] : null;
	952	+
1049	953	// Nonce check.
1050		- if (
1051		- ! isset( $_POST['nonce'] ) ||
1052		- ! wp_verify_nonce( sanitize_key( $_POST['nonce'] ), 'google_csrf_nonce' )
1053		- ) {
1054		- die( '' );
	954	+ if ( ! wp_verify_nonce( $nonce, 'google_csrf_nonce' ) ) {
	955	+ return '';
1055	956	}
1056	957
1057		- // Google authentication token.
1058		- // phpcs:ignore WordPress.VIP.ValidatedSanitizedInput.InputNotSanitized
1059		- $code = isset( $_POST['code'] ) ? wp_unslash( $_POST['code'] ) : null;
1060		-
1061	958	// Grab plugin settings.
1062		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
	959	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' );
1063	960
1064		- /**
1065		- * Add Google API PHP Client.
1066		- *
1067		- * @see https://github.com/google/google-api-php-client branch:v1-master
1068		- */
	961	+ // Add Google API PHP Client.
	962	+ // @see https://github.com/google/google-api-php-client branch:v1-master
1069	963	require_once dirname( __FILE__ ) . '/vendor/google-api-php-client/src/Google/autoload.php';
1070	964
1071	965	// Build the Google Client.
1072	966	$client = new Google_Client();
		@@ -1074,26 +968,19 @@
1074	968	$client->setClientId( $auth_settings['google_clientid'] );
1075	969	$client->setClientSecret( $auth_settings['google_clientsecret'] );
1076	970	$client->setRedirectUri( 'postmessage' );
1077	971
1078		- /**
1079		- * If the hosted domain parameter is set, restrict logins to that domain.
1080		- *
1081		- * Note: Will have to upgrade to google-api-php-client v2 or higher for
1082		- * this to function server-side; it's not complete in v1, so this check
1083		- * is performed manually below.
1084		- *
1085		- * if (
1086		- * array_key_exists( 'google_hosteddomain', $auth_settings ) &&
1087		- * strlen( $auth_settings['google_hosteddomain'] ) > 0
1088		- * ) {
1089		- * $google_hosteddomains = explode( "\n", str_replace( "\r", '', $auth_settings['google_hosteddomain'] ) );
1090		- * $google_hosteddomain = trim( $google_hosteddomains[0] );
1091		- * $client->setHostedDomain( $google_hosteddomain );
1092		- * }
1093		- */
	972	+ // If the hosted domain parameter is set, restrict logins to that domain.
	973	+ // Note: Will have to upgrade to google-api-php-client v2 or higher for
	974	+ // this to function server-side; it's not complete in v1, so this check
	975	+ // is performed manually below.
	976	+ // if ( array_key_exists( 'google_hosteddomain', $auth_settings ) && strlen( $auth_settings['google_hosteddomain'] ) > 0 ) {
	977	+ // $google_hosteddomains = explode( "\n", str_replace( "\r", '', $auth_settings['google_hosteddomain'] ) );
	978	+ // $google_hosteddomain = trim( $google_hosteddomains[0] );
	979	+ // $client->setHostedDomain( $google_hosteddomain );
	980	+ // }
1094	981
1095		- // Get one time use token (if it doesn't exist, we'll create one below).
	982	+ // Get one time use token (if it doesn't exist, we'll create one below)
1096	983	session_start();
1097	984	$token = array_key_exists( 'token', $_SESSION ) ? json_decode( $_SESSION['token'] ) : null;
1098	985
1099	986	if ( empty( $token ) ) {
		@@ -1101,18 +988,18 @@
1101	988	$client->authenticate( $code );
1102	989	$token = json_decode( $client->getAccessToken() );
1103	990
1104	991	// Store the token in the session for later use.
1105		- $_SESSION['token'] = wp_json_encode( $token );
	992	+ $_SESSION['token'] = json_encode( $token );
1106	993
1107		- $response = 'Successfully authenticated.';
	994	+ $response = "Successfully authenticated.";
1108	995	} else {
1109		- $client->setAccessToken( wp_json_encode( $token ) );
	996	+ $client->setAccessToken( json_encode( $token ) );
1110	997
1111	998	$response = 'Already authenticated.';
1112	999	}
1113	1000
1114		- die( esc_html( $response ) );
	1001	+ die( $response );
1115	1002	}
1116	1003
1117	1004
1118	1005	/**
		@@ -1117,22 +1004,22 @@
1117	1004
1118	1005	/**
1119	1006	* Validate this user's credentials against Google.
1120	1007	*
1121		- * @param array $auth_settings Plugin settings.
1122		- * @return array|WP_Error Array containing email, authenticated_by, first_name,
1123		- * last_name, and username strings for the successfully
1124		- * authenticated user, or WP_Error() object on failure,
1125		- * or null if not attempting a google login.
	1008	+ * @param array $auth_settings Plugin settings
	1009	+ * @return [mixed] Array containing email, authenticated_by,
	1010	+ * first_name, last_name, and username
	1011	+ * strings for the successfully authenticated
	1012	+ * user, or WP_Error() object on failure,
	1013	+ * or null if not attempting a google login.
1126	1014	*/
1127	1015	private function custom_authenticate_google( $auth_settings ) {
1128	1016	// Move on if Google auth hasn't been requested here.
1129		- // phpcs:ignore WordPress.CSRF.NonceVerification.NoNonceVerification
1130		- if ( empty( $_GET['external'] ) || 'google' !== $_GET['external'] ) {
	1017	+ if ( empty( $_GET['external'] ) || $_GET['external'] !== 'google' ) {
1131	1018	return null;
1132	1019	}
1133	1020
1134		- // Get one time use token.
	1021	+ // Get one time use token
1135	1022	session_start();
1136	1023	$token = array_key_exists( 'token', $_SESSION ) ? json_decode( $_SESSION['token'] ) : null;
1137	1024
1138	1025	// No token, so this is not a succesful Google login.
		@@ -1139,13 +1026,10 @@
1139	1026	if ( is_null( $token ) ) {
1140	1027	return null;
1141	1028	}
1142	1029
1143		- /**
1144		- * Add Google API PHP Client.
1145		- *
1146		- * @see https://github.com/google/google-api-php-client branch:v1-master
1147		- */
	1030	+ // Add Google API PHP Client.
	1031	+ // @see https://github.com/google/google-api-php-client branch:v1-master
1148	1032	require_once dirname( __FILE__ ) . '/vendor/google-api-php-client/src/Google/autoload.php';
1149	1033
1150	1034	// Build the Google Client.
1151	1035	$client = new Google_Client();
		@@ -1153,24 +1037,19 @@
1153	1037	$client->setClientId( $auth_settings['google_clientid'] );
1154	1038	$client->setClientSecret( $auth_settings['google_clientsecret'] );
1155	1039	$client->setRedirectUri( 'postmessage' );
1156	1040
1157		- /**
1158		- * If the hosted domain parameter is set, restrict logins to that domain.
1159		- * Note: Will have to upgrade to google-api-php-client v2 or higher for
1160		- * this to function server-side; it's not complete in v1, so this check
1161		- * is performed manually later.
1162		- * if (
1163		- * array_key_exists( 'google_hosteddomain', $auth_settings ) &&
1164		- * strlen( $auth_settings['google_hosteddomain'] ) > 0
1165		- * ) {
1166		- * $google_hosteddomains = explode( "\n", str_replace( "\r", '', $auth_settings['google_hosteddomain'] ) );
1167		- * $google_hosteddomain = trim( $google_hosteddomains[0] );
1168		- * $client->setHostedDomain( $google_hosteddomain );
1169		- * }
1170		- */
	1041	+ // If the hosted domain parameter is set, restrict logins to that domain.
	1042	+ // Note: Will have to upgrade to google-api-php-client v2 or higher for
	1043	+ // this to function server-side; it's not complete in v1, so this check
	1044	+ // is performed manually below.
	1045	+ // if ( array_key_exists( 'google_hosteddomain', $auth_settings ) && strlen( $auth_settings['google_hosteddomain'] ) > 0 ) {
	1046	+ // $google_hosteddomains = explode( "\n", str_replace( "\r", '', $auth_settings['google_hosteddomain'] ) );
	1047	+ // $google_hosteddomain = trim( $google_hosteddomains[0] );
	1048	+ // $client->setHostedDomain( $google_hosteddomain );
	1049	+ // }
1171	1050
1172		- // Verify this is a successful Google authentication.
	1051	+ // Verify this is a successful Google authentication
1173	1052	try {
1174	1053	$ticket = $client->verifyIdToken( $token->id_token, $auth_settings['google_clientid'] );
1175	1054	} catch ( Google_Auth_Exception $e ) {
1176	1055	// Invalid ticket, so this in not a successful Google login.
		@@ -1181,29 +1060,25 @@
1181	1060	if ( ! $ticket ) {
1182	1061	return new WP_Error( 'invalid_google_login', __( 'Invalid Google credentials provided.', 'authorizer' ) );
1183	1062	}
1184	1063
1185		- // Get email address.
1186		- $attributes = $ticket->getAttributes();
1187		- $email = $this->lowercase( $attributes['payload']['email'] );
	1064	+ // Get email address
	1065	+ $attributes = $ticket->getAttributes();
	1066	+ $email = mb_strtolower( $attributes['payload']['email'] );
1188	1067	$email_domain = substr( strrchr( $email, '@' ), 1 );
1189		- $username = current( explode( '@', $email ) );
	1068	+ $username = current( explode( '@', $email ) );
1190	1069
1191		- /**
1192		- * Fail if hd param is set and the logging in user's email address doesn't
1193		- * match the allowed hosted domain.
1194		- *
1195		- * See: https://developers.google.com/identity/protocols/OpenIDConnect#hd-param
1196		- * See: https://github.com/google/google-api-php-client/blob/v1-master/src/Google/Client.php#L407-L416
1197		- *
1198		- * Note: Will have to upgrade to google-api-php-client v2 or higher for
1199		- * this to function server-side; it's not complete in v1, so this check
1200		- * is only performed here.
1201		- */
	1070	+ // Fail if hd param is set and the logging in user's email address doesn't
	1071	+ // match the allowed hosted domain.
	1072	+ // See: https://developers.google.com/identity/protocols/OpenIDConnect#hd-param
	1073	+ // See: https://github.com/google/google-api-php-client/blob/v1-master/src/Google/Client.php#L407-L416
	1074	+ // Note: Will have to upgrade to google-api-php-client v2 or higher for
	1075	+ // this to function server-side; it's not complete in v1, so this check
	1076	+ // is only performed here.
1202	1077	if ( array_key_exists( 'google_hosteddomain', $auth_settings ) && strlen( $auth_settings['google_hosteddomain'] ) > 0 ) {
1203	1078	// Allow multiple whitelisted domains.
1204	1079	$google_hosteddomains = explode( "\n", str_replace( "\r", '', $auth_settings['google_hosteddomain'] ) );
1205		- if ( ! in_array( $email_domain, $google_hosteddomains, true ) ) {
	1080	+ if ( ! in_array( $email_domain, $google_hosteddomains ) ) {
1206	1081	$this->custom_logout();
1207	1082	return new WP_Error( 'invalid_google_login', __( 'Google credentials do not match the allowed hosted domain', 'authorizer' ) );
1208	1083	}
1209	1084	}
		@@ -1208,13 +1083,13 @@
1208	1083	}
1209	1084	}
1210	1085
1211	1086	return array(
1212		- 'email' => $email,
1213		- 'username' => $username,
1214		- 'first_name' => '',
1215		- 'last_name' => '',
1216		- 'authenticated_by' => 'google',
	1087	+ 'email' => $email,
	1088	+ 'username' => $username,
	1089	+ 'first_name' => '',
	1090	+ 'last_name' => '',
	1091	+ 'authenticated_by' => 'google',
1217	1092	'google_attributes' => $attributes,
1218	1093	);
1219	1094	}
1220	1095
		@@ -1221,47 +1096,40 @@
1221	1096
1222	1097	/**
1223	1098	* Validate this user's credentials against CAS.
1224	1099	*
1225		- * @param array $auth_settings Plugin settings.
1226		- * @return array|WP_Error Array containing 'email' and 'authenticated_by' strings
1227		- * for the successfully authenticated user, or WP_Error()
1228		- * object on failure, or null if not attempting a CAS login.
	1100	+ * @param array $auth_settings Plugin settings
	1101	+ * @return [mixed] Array containing 'email' and 'authenticated_by'
	1102	+ * strings for the successfully authenticated
	1103	+ * user, or WP_Error() object on failure,
	1104	+ * or null if not attempting a CAS login.
1229	1105	*/
1230	1106	private function custom_authenticate_cas( $auth_settings ) {
1231	1107	// Move on if CAS hasn't been requested here.
1232		- // phpcs:ignore WordPress.CSRF.NonceVerification.NoNonceVerification
1233		- if ( empty( $_GET['external'] ) || 'cas' !== $_GET['external'] ) {
	1108	+ if ( empty( $_GET['external'] ) || $_GET['external'] !== 'cas' ) {
1234	1109	return null;
1235	1110	}
1236	1111
1237		- /**
1238		- * Get the CAS server version (default to SAML_VERSION_1_1).
1239		- *
1240		- * @see: https://developer.jasig.org/cas-clients/php/1.3.4/docs/api/group__public.html
1241		- */
	1112	+ // Get the CAS server version (default to SAML_VERSION_1_1).
	1113	+ // See: https://developer.jasig.org/cas-clients/php/1.3.4/docs/api/group__public.html
1242	1114	$cas_version = SAML_VERSION_1_1;
1243		- if ( 'CAS_VERSION_3_0' === $auth_settings['cas_version'] ) {
	1115	+ if ( $auth_settings['cas_version'] === 'CAS_VERSION_3_0' ) {
1244	1116	$cas_version = CAS_VERSION_3_0;
1245		- } elseif ( 'CAS_VERSION_2_0' === $auth_settings['cas_version'] ) {
	1117	+ } elseif ( $auth_settings['cas_version'] === 'CAS_VERSION_2_0' ) {
1246	1118	$cas_version = CAS_VERSION_2_0;
1247		- } elseif ( 'CAS_VERSION_1_0' === $auth_settings['cas_version'] ) {
	1119	+ } elseif ( $auth_settings['cas_version'] === 'CAS_VERSION_1_0' ) {
1248	1120	$cas_version = CAS_VERSION_1_0;
1249	1121	}
1250	1122
1251		- // Set the CAS client configuration.
	1123	+ // Set the CAS client configuration
1252	1124	phpCAS::client( $cas_version, $auth_settings['cas_host'], intval( $auth_settings['cas_port'] ), $auth_settings['cas_path'] );
1253	1125
1254		- // Allow redirects at the CAS server endpoint (e.g., allow connections
1255		- // at an old CAS URL that redirects to a newer CAS URL).
1256		- phpCAS::setExtraCurlOption( CURLOPT_FOLLOWLOCATION, true );
1257		-
1258	1126	// Update server certificate bundle if it doesn't exist or is older
1259	1127	// than 6 months, then use it to ensure CAS server is legitimate.
1260	1128	// Note: only try to update if the system has the php_openssl extension.
1261		- $cacert_url = 'https://curl.haxx.se/ca/cacert.pem';
1262		- $cacert_path = plugin_dir_path( __FILE__ ) . 'vendor/cacert.pem';
1263		- $time_180_days = 180 * 24 * 60 * 60; // days * hours * minutes * seconds.
	1129	+ $cacert_url = 'https://curl.haxx.se/ca/cacert.pem';
	1130	+ $cacert_path = plugin_dir_path( __FILE__ ) . 'vendor/cacert.pem';
	1131	+ $time_180_days = 180 * 24 * 60 * 60; // days * hours * minutes * seconds
1264	1132	$time_180_days_ago = time() - $time_180_days;
1265	1133	if (
1266	1134	extension_loaded( 'openssl' ) &&
1267	1135	( ! file_exists( $cacert_path ) || filemtime( $cacert_path ) < $time_180_days_ago )
		@@ -1277,34 +1145,28 @@
1277	1145	}
1278	1146	$cacert_contents = $response['body'];
1279	1147
1280	1148	// Write out the updated certs to the plugin directory.
1281		- // Note: Don't use WP_Filesystem because we are not in an admin context
1282		- // and don't want to potentially prompt the end user for credentials.
1283		- // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_read_file_put_contents
1284	1149	file_put_contents( $cacert_path, $cacert_contents );
1285	1150	}
1286	1151	phpCAS::setCasServerCACert( $cacert_path );
1287	1152
1288	1153	// Set the CAS service URL (including the redirect URL for WordPress when it comes back from CAS).
1289		- $cas_service_url = site_url( '/wp-login.php?external=cas' );
1290		- $login_querystring = array();
1291		- if ( isset( $_SERVER['QUERY_STRING'] ) ) {
1292		- parse_str( $_SERVER['QUERY_STRING'], $login_querystring ); // phpcs:ignore WordPress.VIP.ValidatedSanitizedInput
1293		- }
	1154	+ $cas_service_url = site_url( '/wp-login.php?external=cas' );
	1155	+ $login_querystring = array(); parse_str( $_SERVER['QUERY_STRING'], $login_querystring );
1294	1156	if ( isset( $login_querystring['redirect_to'] ) ) {
1295		- $cas_service_url .= '&redirect_to=' . rawurlencode( $login_querystring['redirect_to'] );
	1157	+ $cas_service_url .= '&redirect_to=' . urlencode( $login_querystring['redirect_to'] );
1296	1158	}
1297	1159	phpCAS::setFixedServiceURL( $cas_service_url );
1298	1160
1299		- // Authenticate against CAS.
	1161	+ // Authenticate against CAS
1300	1162	try {
1301	1163	phpCAS::forceAuthentication();
1302	1164	} catch ( CAS_AuthenticationException $e ) {
1303	1165	// CAS server threw an error in isAuthenticated(), potentially because
1304	1166	// the cached ticket is outdated. Try renewing the authentication.
1305		- error_log( __( 'CAS server returned an Authentication Exception. Details:', 'authorizer' ) ); // phpcs:ignore
1306		- error_log( print_r( $e, true ) ); // phpcs:ignore
	1167	+ error_log( __( 'CAS server returned an Authentication Exception. Details:', 'authorizer' ) );
	1168	+ error_log( print_r( $e, true ) );
1307	1169
1308	1170	// CAS server is throwing errors on this login, so try logging the
1309	1171	// user out of CAS and redirecting them to the login page.
1310	1172	phpCAS::logoutWithRedirectService( wp_login_url() );
		@@ -1319,10 +1181,10 @@
1319	1181	if ( ! filter_var( $externally_authenticated_email, FILTER_VALIDATE_EMAIL ) ) {
1320	1182	// If we can't get the user's email address from a CAS attribute,
1321	1183	// try to guess the domain from the CAS server hostname. This will only
1322	1184	// be used if we can't discover the email address from CAS attributes.
1323		- $domain_guess = preg_match( '/[^.]*\.[^.]*$/', $auth_settings['cas_host'], $matches ) === 1 ? $matches[0] : '';
1324		- $externally_authenticated_email = $this->lowercase( $username ) . '@' . $domain_guess;
	1185	+ $domain_guess = preg_match( '/[^.]*\.[^.]*$/', $auth_settings['cas_host'], $matches ) === 1 ? $matches[0] : '';
	1186	+ $externally_authenticated_email = mb_strtolower( $username ) . '@' . $domain_guess;
1325	1187	}
1326	1188
1327	1189	// Retrieve the user attributes (e.g., email address, first name, last name) from the CAS server.
1328	1190	$cas_attributes = phpCAS::getAttributes();
		@@ -1333,45 +1195,41 @@
1333	1195	// email domain is manually entered there (instead of a reference to a
1334	1196	// CAS attribute), and combine that with the username to create the email.
1335	1197	// Otherwise, look up the CAS attribute for email.
1336	1198	if ( substr( $auth_settings['cas_attr_email'], 0, 1 ) === '@' ) {
1337		- $externally_authenticated_email = $this->lowercase( $username . $auth_settings['cas_attr_email'] );
	1199	+ $externally_authenticated_email = mb_strtolower( $username . $auth_settings['cas_attr_email'] );
1338	1200	} elseif (
1339	1201	// If a CAS attribute has been specified as containing the email address, use that instead.
1340	1202	// Email attribute can be a string or an array of strings.
1341	1203	array_key_exists( $auth_settings['cas_attr_email'], $cas_attributes ) && (
1342	1204	(
1343		- is_array( $cas_attributes[ $auth_settings['cas_attr_email'] ] ) &&
1344		- count( $cas_attributes[ $auth_settings['cas_attr_email'] ] ) > 0
	1205	+ is_array( $cas_attributes[$auth_settings['cas_attr_email']] ) &&
	1206	+ count( $cas_attributes[$auth_settings['cas_attr_email']] ) > 0
1345	1207	) || (
1346		- is_string( $cas_attributes[ $auth_settings['cas_attr_email'] ] ) &&
1347		- strlen( $cas_attributes[ $auth_settings['cas_attr_email'] ] ) > 0
	1208	+ is_string( $cas_attributes[$auth_settings['cas_attr_email']] ) &&
	1209	+ strlen( $cas_attributes[$auth_settings['cas_attr_email']] ) > 0
1348	1210	)
1349	1211	)
1350	1212	) {
1351	1213	// Each of the emails in the array needs to be set to lowercase.
1352		- if ( is_array( $cas_attributes[ $auth_settings['cas_attr_email'] ] ) ) {
1353		- $externally_authenticated_email = array();
1354		- foreach ( $cas_attributes[ $auth_settings['cas_attr_email'] ] as $external_email ) {
1355		- $externally_authenticated_email[] = $this->lowercase( $external_email );
1356		- }
1357		- } else {
1358		- $externally_authenticated_email = $this->lowercase( $cas_attributes[ $auth_settings['cas_attr_email'] ] );
	1214	+ $externally_authenticated_email = array();
	1215	+ foreach ( $cas_attributes[$auth_settings['cas_attr_email']] as $external_email ) {
	1216	+ $externally_authenticated_email[] = mb_strtolower( $external_email );
1359	1217	}
1360	1218	}
1361	1219	}
1362	1220
1363	1221	// Get user first name and last name.
1364		- $first_name = array_key_exists( 'cas_attr_first_name', $auth_settings ) && strlen( $auth_settings['cas_attr_first_name'] ) > 0 && array_key_exists( $auth_settings['cas_attr_first_name'], $cas_attributes ) && strlen( $cas_attributes[ $auth_settings['cas_attr_first_name'] ] ) > 0 ? $cas_attributes[ $auth_settings['cas_attr_first_name'] ] : '';
1365		- $last_name = array_key_exists( 'cas_attr_last_name', $auth_settings ) && strlen( $auth_settings['cas_attr_last_name'] ) > 0 && array_key_exists( $auth_settings['cas_attr_last_name'], $cas_attributes ) && strlen( $cas_attributes[ $auth_settings['cas_attr_last_name'] ] ) > 0 ? $cas_attributes[ $auth_settings['cas_attr_last_name'] ] : '';
	1222	+ $first_name = array_key_exists( 'cas_attr_first_name', $auth_settings ) && strlen( $auth_settings['cas_attr_first_name'] ) > 0 && array_key_exists( $auth_settings['cas_attr_first_name'], $cas_attributes ) && strlen( $cas_attributes[$auth_settings['cas_attr_first_name']] ) > 0 ? $cas_attributes[$auth_settings['cas_attr_first_name']] : '';
	1223	+ $last_name = array_key_exists( 'cas_attr_last_name', $auth_settings ) && strlen( $auth_settings['cas_attr_last_name'] ) > 0 && array_key_exists( $auth_settings['cas_attr_last_name'], $cas_attributes ) && strlen( $cas_attributes[$auth_settings['cas_attr_last_name']] ) > 0 ? $cas_attributes[$auth_settings['cas_attr_last_name']] : '';
1366	1224
1367	1225	return array(
1368		- 'email' => $externally_authenticated_email,
1369		- 'username' => $username,
1370		- 'first_name' => $first_name,
1371		- 'last_name' => $last_name,
	1226	+ 'email' => $externally_authenticated_email,
	1227	+ 'username' => $username,
	1228	+ 'first_name' => $first_name,
	1229	+ 'last_name' => $last_name,
1372	1230	'authenticated_by' => 'cas',
1373		- 'cas_attributes' => $cas_attributes,
	1231	+ 'cas_attributes' => $cas_attributes,
1374	1232	);
1375	1233	}
1376	1234
1377	1235
		@@ -1377,32 +1235,24 @@
1377	1235
1378	1236	/**
1379	1237	* Validate this user's credentials against LDAP.
1380	1238	*
1381		- * @param array $auth_settings Plugin settings.
1382		- * @param string $username Attempted username from authenticate action.
1383		- * @param string $password Attempted password from authenticate action.
1384		- * @return array|WP_Error Array containing 'email' and 'authenticated_by' strings
1385		- * for the successfully authenticated user, or WP_Error()
1386		- * object on failure, or null if skipping LDAP auth and
1387		- * falling back to WP auth.
	1239	+ * @param array $auth_settings Plugin settings
	1240	+ * @param string $username Attempted username from authenticate action
	1241	+ * @param string $password Attempted password from authenticate action
	1242	+ * @return [mixed] Array containing 'email' and 'authenticated_by'
	1243	+ * strings for the successfully authenticated
	1244	+ * user, or WP_Error() object on failure,
	1245	+ * or null if skipping LDAP auth and falling back to WP auth.
1388	1246	*/
1389	1247	private function custom_authenticate_ldap( $auth_settings, $username, $password ) {
1390		- // Get LDAP search base(s).
1391		- $search_bases = explode( "\n", str_replace( "\r", '', trim( $auth_settings['ldap_search_base'] ) ) );
1392		-
1393		- // Fail silently (fall back to WordPress authentication) if no search base specified.
1394		- if ( count( $search_bases ) < 1 ) {
1395		- return null;
1396		- }
1397		-
1398		- // Get the FQDN from the first LDAP search base domain components (dc). For
1399		- // example, ou=people,dc=example,dc=edu,dc=uk would yield user@example.edu.uk.
1400		- $search_base_components = explode( ',', trim( $search_bases[0] ) );
1401		- $domain = array();
	1248	+ // Get the FQDN from the LDAP search base domain components (dc). For
	1249	+ // example, ou=people,dc=example,dc=edu,dc=uk would yield user@example.edu.uk
	1250	+ $search_base_components = explode( ',', trim( $auth_settings['ldap_search_base'] ) );
	1251	+ $domain = array();
1402	1252	foreach ( $search_base_components as $search_base_component ) {
1403	1253	$component = explode( '=', $search_base_component );
1404		- if ( 2 === count( $component ) && 'dc' === $component[0] ) {
	1254	+ if ( count( $component ) === 2 && $component[0] === 'dc' ) {
1405	1255	$domain[] = $component[1];
1406	1256	}
1407	1257	}
1408	1258	$domain = implode( '.', $domain );
		@@ -1413,9 +1263,9 @@
1413	1263	if ( empty( $domain ) ) {
1414	1264	$domain = preg_match( '/[^.]*\.[^.]*$/', $auth_settings['ldap_host'], $matches ) === 1 ? $matches[0] : '';
1415	1265	}
1416	1266
1417		- // remove @domain if it exists in the username (i.e., if user entered their email).
	1267	+ // remove @domain if it exists in the username (i.e., if user entered their email)
1418	1268	$username = str_replace( '@' . $domain, '', $username );
1419	1269
1420	1270	// Fail silently (fall back to WordPress authentication) if both username
1421	1271	// and password are empty (this will be the case when visiting wp-login.php
		@@ -1438,13 +1288,13 @@
1438	1288	return null;
1439	1289	}
1440	1290
1441	1291	// Authenticate against LDAP using options provided in plugin settings.
1442		- $result = false;
	1292	+ $result = false;
1443	1293	$ldap_user_dn = '';
1444		- $first_name = '';
1445		- $last_name = '';
1446		- $email = '';
	1294	+ $first_name = '';
	1295	+ $last_name = '';
	1296	+ $email = '';
1447	1297
1448	1298	// Construct LDAP connection parameters. ldap_connect() takes either a
1449	1299	// hostname or a full LDAP URI as its first parameter (works with OpenLDAP
1450	1300	// 2.x.x or later). If it's an LDAP URI, the second parameter, $port, is
		@@ -1449,13 +1299,13 @@
1449	1299	// hostname or a full LDAP URI as its first parameter (works with OpenLDAP
1450	1300	// 2.x.x or later). If it's an LDAP URI, the second parameter, $port, is
1451	1301	// ignored, and port must be specified in the full URI. An LDAP URI is of
1452	1302	// the form ldap://hostname:port or ldaps://hostname:port.
1453		- $ldap_host = $auth_settings['ldap_host'];
1454		- $ldap_port = intval( $auth_settings['ldap_port'] );
1455		- $parsed_host = wp_parse_url( $ldap_host );
	1303	+ $ldap_host = $auth_settings['ldap_host'];
	1304	+ $ldap_port = intval( $auth_settings['ldap_port'] );
	1305	+ $parsed_host = parse_url( $ldap_host );
1456	1306	// Fail (fall back to WordPress auth) if invalid host is specified.
1457		- if ( false === $parsed_host ) {
	1307	+ if ( $parsed_host === false ) {
1458	1308	return null;
1459	1309	}
1460	1310	// If a scheme is in the LDAP host, use full LDAP URI instead of just hostname.
1461	1311	if ( array_key_exists( 'scheme', $parsed_host ) ) {
		@@ -1468,24 +1318,24 @@
1468	1318
1469	1319	// Establish LDAP connection.
1470	1320	$ldap = ldap_connect( $ldap_host, $ldap_port );
1471	1321	ldap_set_option( $ldap, LDAP_OPT_PROTOCOL_VERSION, 3 );
1472		- if ( 1 === intval( $auth_settings['ldap_tls'] ) ) {
1473		- if ( ! ldap_start_tls( $ldap ) ) {
	1322	+ if ( $auth_settings['ldap_tls'] == 1 ) {
	1323	+ if( ! ldap_start_tls( $ldap ) ) {
1474	1324	return null;
1475	1325	}
1476	1326	}
1477	1327
1478	1328	// Set bind credentials; attempt an anonymous bind if not provided.
1479		- $bind_rdn = null;
1480		- $bind_password = null;
	1329	+ $bind_rdn = NULL;
	1330	+ $bind_password = NULL;
1481	1331	if ( strlen( $auth_settings['ldap_user'] ) > 0 ) {
1482		- $bind_rdn = $auth_settings['ldap_user'];
	1332	+ $bind_rdn = $auth_settings['ldap_user'];
1483	1333	$bind_password = $this->decrypt( $auth_settings['ldap_password'] );
1484	1334	}
1485	1335
1486	1336	// Attempt LDAP bind.
1487		- $result = @ldap_bind( $ldap, $bind_rdn, stripslashes( $bind_password ) ); // phpcs:ignore
	1337	+ $result = @ldap_bind( $ldap, $bind_rdn, stripslashes( $bind_password ) );
1488	1338	if ( ! $result ) {
1489	1339	// Can't connect to LDAP, so fall back to WordPress authentication.
1490	1340	return null;
1491	1341	}
		@@ -1499,40 +1349,18 @@
1499	1349	if ( array_key_exists( 'ldap_attr_last_name', $auth_settings ) && strlen( $auth_settings['ldap_attr_last_name'] ) > 0 ) {
1500	1350	array_push( $ldap_attributes_to_retrieve, $auth_settings['ldap_attr_last_name'] );
1501	1351	}
1502	1352	if ( array_key_exists( 'ldap_attr_email', $auth_settings ) && strlen( $auth_settings['ldap_attr_email'] ) > 0 && substr( $auth_settings['ldap_attr_email'], 0, 1 ) !== '@' ) {
1503		- array_push( $ldap_attributes_to_retrieve, $this->lowercase( $auth_settings['ldap_attr_email'] ) );
	1353	+ array_push( $ldap_attributes_to_retrieve, mb_strtolower( $auth_settings['ldap_attr_email'] ) );
1504	1354	}
	1355	+ $ldap_search = ldap_search(
	1356	+ $ldap,
	1357	+ $auth_settings['ldap_search_base'],
	1358	+ "(" . $auth_settings['ldap_uid'] . "=" . $username . ")",
	1359	+ $ldap_attributes_to_retrieve
	1360	+ );
	1361	+ $ldap_entries = ldap_get_entries( $ldap, $ldap_search );
1505	1362
1506		- // Create default LDAP search filter (uid=$username).
1507		- $search_filter = '(' . $auth_settings['ldap_uid'] . '=' . $username . ')';
1508		-
1509		- /**
1510		- * Filter LDAP search filter.
1511		- *
1512		- * Allows for custom LDAP authentication rules (e.g., restricting login
1513		- * access to users in multiple groups, or having certain attributes).
1514		- *
1515		- * @param string $search_filter The filter to pass to ldap_search().
1516		- * @param string $ldap_uid The attribute to compare username against (from Authorizer Settings).
1517		- * @param string $username The username attempting to log in.
1518		- */
1519		- $search_filter = apply_filters( 'authorizer_ldap_search_filter', $search_filter, $auth_settings['ldap_uid'], $username );
1520		-
1521		- // Multiple search bases can be provided, so iterate through them until a match is found.
1522		- foreach ( $search_bases as $search_base ) {
1523		- $ldap_search = ldap_search(
1524		- $ldap,
1525		- $search_base,
1526		- $search_filter,
1527		- $ldap_attributes_to_retrieve
1528		- );
1529		- $ldap_entries = ldap_get_entries( $ldap, $ldap_search );
1530		- if ( $ldap_entries['count'] > 0 ) {
1531		- break;
1532		- }
1533		- }
1534		-
1535	1363	// If we didn't find any users in ldap, fall back to WordPress authentication.
1536	1364	if ( $ldap_entries['count'] < 1 ) {
1537	1365	return null;
1538	1366	}
		@@ -1538,21 +1366,21 @@
1538	1366	}
1539	1367
1540	1368	// Get the bind dn and first/last names; if there are multiple results returned, just get the last one.
1541	1369	for ( $i = 0; $i < $ldap_entries['count']; $i++ ) {
1542		- $ldap_user_dn = $ldap_entries[ $i ]['dn'];
	1370	+ $ldap_user_dn = $ldap_entries[$i]['dn'];
1543	1371
1544	1372	// Get user first name and last name.
1545		- $ldap_attr_first_name = array_key_exists( 'ldap_attr_first_name', $auth_settings ) ? $this->lowercase( $auth_settings['ldap_attr_first_name'] ) : '';
1546		- if ( strlen( $ldap_attr_first_name ) > 0 && array_key_exists( $ldap_attr_first_name, $ldap_entries[ $i ] ) && $ldap_entries[ $i ][ $ldap_attr_first_name ]['count'] > 0 && strlen( $ldap_entries[ $i ][ $ldap_attr_first_name ][0] ) > 0 ) {
1547		- $first_name = $ldap_entries[ $i ][ $ldap_attr_first_name ][0];
	1373	+ $ldap_attr_first_name = array_key_exists( 'ldap_attr_first_name', $auth_settings ) ? mb_strtolower( $auth_settings['ldap_attr_first_name'] ) : '';
	1374	+ if ( strlen( $ldap_attr_first_name ) > 0 && array_key_exists( $ldap_attr_first_name, $ldap_entries[$i] ) && $ldap_entries[$i][$ldap_attr_first_name]['count'] > 0 && strlen( $ldap_entries[$i][$ldap_attr_first_name][0] ) > 0 ) {
	1375	+ $first_name = $ldap_entries[$i][$ldap_attr_first_name][0];
1548	1376	}
1549		- $ldap_attr_last_name = array_key_exists( 'ldap_attr_last_name', $auth_settings ) ? $this->lowercase( $auth_settings['ldap_attr_last_name'] ) : '';
1550		- if ( strlen( $ldap_attr_last_name ) > 0 && array_key_exists( $ldap_attr_last_name, $ldap_entries[ $i ] ) && $ldap_entries[ $i ][ $ldap_attr_last_name ]['count'] > 0 && strlen( $ldap_entries[ $i ][ $ldap_attr_last_name ][0] ) > 0 ) {
1551		- $last_name = $ldap_entries[ $i ][ $ldap_attr_last_name ][0];
	1377	+ $ldap_attr_last_name = array_key_exists( 'ldap_attr_last_name', $auth_settings ) ? mb_strtolower( $auth_settings['ldap_attr_last_name'] ) : '';
	1378	+ if ( strlen( $ldap_attr_last_name ) > 0 && array_key_exists( $ldap_attr_last_name, $ldap_entries[$i] ) && $ldap_entries[$i][$ldap_attr_last_name]['count'] > 0 && strlen( $ldap_entries[$i][$ldap_attr_last_name][0] ) > 0 ) {
	1379	+ $last_name = $ldap_entries[$i][$ldap_attr_last_name][0];
1552	1380	}
1553	1381	// Get user email if it is specified in another field.
1554		- $ldap_attr_email = array_key_exists( 'ldap_attr_email', $auth_settings ) ? $this->lowercase( $auth_settings['ldap_attr_email'] ) : '';
	1382	+ $ldap_attr_email = array_key_exists( 'ldap_attr_email', $auth_settings ) ? mb_strtolower( $auth_settings['ldap_attr_email'] ) : '';
1555	1383	if ( strlen( $ldap_attr_email ) > 0 ) {
1556	1384	// If the email attribute starts with an at symbol (@), assume that the
1557	1385	// email domain is manually entered there (instead of a reference to an
1558	1386	// LDAP attribute), and combine that with the username to create the email.
		@@ -1557,16 +1385,16 @@
1557	1385	// email domain is manually entered there (instead of a reference to an
1558	1386	// LDAP attribute), and combine that with the username to create the email.
1559	1387	// Otherwise, look up the LDAP attribute for email.
1560	1388	if ( substr( $ldap_attr_email, 0, 1 ) === '@' ) {
1561		- $email = $this->lowercase( $username . $ldap_attr_email );
1562		- } elseif ( array_key_exists( $ldap_attr_email, $ldap_entries[ $i ] ) && $ldap_entries[ $i ][ $ldap_attr_email ]['count'] > 0 && strlen( $ldap_entries[ $i ][ $ldap_attr_email ][0] ) > 0 ) {
1563		- $email = $this->lowercase( $ldap_entries[ $i ][ $ldap_attr_email ][0] );
	1389	+ $email = mb_strtolower( $username . $ldap_attr_email );
	1390	+ } elseif ( array_key_exists( $ldap_attr_email, $ldap_entries[$i] ) && $ldap_entries[$i][$ldap_attr_email]['count'] > 0 && strlen( $ldap_entries[$i][$ldap_attr_email][0] ) > 0 ) {
	1391	+ $email = mb_strtolower( $ldap_entries[$i][$ldap_attr_email][0] );
1564	1392	}
1565	1393	}
1566	1394	}
1567	1395
1568		- $result = @ldap_bind( $ldap, $ldap_user_dn, stripslashes( $password ) ); // phpcs:ignore
	1396	+ $result = @ldap_bind( $ldap, $ldap_user_dn, stripslashes( $password ) );
1569	1397	if ( ! $result ) {
1570	1398	// We have a real ldap user, but an invalid password. Pass
1571	1399	// through to wp authentication after failing LDAP (since
1572	1400	// this could be a local account that happens to be the
		@@ -1574,22 +1402,22 @@
1574	1402	return null;
1575	1403	}
1576	1404
1577	1405	// User successfully authenticated against LDAP, so set the relevant variables.
1578		- $externally_authenticated_email = $this->lowercase( $username . '@' . $domain );
	1406	+ $externally_authenticated_email = mb_strtolower( $username . '@' . $domain );
1579	1407
1580	1408	// If an LDAP attribute has been specified as containing the email address, use that instead.
1581	1409	if ( strlen( $email ) > 0 ) {
1582		- $externally_authenticated_email = $this->lowercase( $email );
	1410	+ $externally_authenticated_email = mb_strtolower( $email );
1583	1411	}
1584	1412
1585	1413	return array(
1586		- 'email' => $externally_authenticated_email,
1587		- 'username' => $username,
1588		- 'first_name' => $first_name,
1589		- 'last_name' => $last_name,
	1414	+ 'email' => $externally_authenticated_email,
	1415	+ 'username' => $username,
	1416	+ 'first_name' => $first_name,
	1417	+ 'last_name' => $last_name,
1590	1418	'authenticated_by' => 'ldap',
1591		- 'ldap_attributes' => $ldap_entries,
	1419	+ 'ldap_attributes' => $ldap_entries,
1592	1420	);
1593	1421	}
1594	1422
1595	1423
		@@ -1595,20 +1423,18 @@
1595	1423
1596	1424	/**
1597	1425	* Log out of the attached external service.
1598	1426	*
1599		- * Action: wp_logout
1600		- *
1601	1427	* @return void
1602	1428	*/
1603	1429	public function custom_logout() {
1604	1430	// Grab plugin settings.
1605		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
	1431	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' );
1606	1432
1607	1433	// Reset option containing old error messages.
1608	1434	delete_option( 'auth_settings_advanced_login_error' );
1609	1435
1610		- if ( session_id() === '' ) {
	1436	+ if ( session_id() == '' ) {
1611	1437	session_start();
1612	1438	}
1613	1439
1614	1440	$current_user_authenticated_by = get_user_meta( get_current_user_id(), 'authenticated_by', true );
		@@ -1613,38 +1439,32 @@
1613	1439
1614	1440	$current_user_authenticated_by = get_user_meta( get_current_user_id(), 'authenticated_by', true );
1615	1441
1616	1442	// If logged in to CAS, Log out of CAS.
1617		- if ( 'cas' === $current_user_authenticated_by && '1' === $auth_settings['cas'] ) {
	1443	+ if ( $current_user_authenticated_by === 'cas' && $auth_settings['cas'] === '1' ) {
1618	1444	if ( ! array_key_exists( 'PHPCAS_CLIENT', $GLOBALS ) || ! array_key_exists( 'phpCAS', $_SESSION ) ) {
1619	1445
1620		- /**
1621		- * Get the CAS server version (default to SAML_VERSION_1_1).
1622		- *
1623		- * @see: https://developer.jasig.org/cas-clients/php/1.3.4/docs/api/group__public.html
1624		- */
	1446	+ // Get the CAS server version (default to SAML_VERSION_1_1).
	1447	+ // See: https://developer.jasig.org/cas-clients/php/1.3.4/docs/api/group__public.html
1625	1448	$cas_version = SAML_VERSION_1_1;
1626		- if ( 'CAS_VERSION_3_0' === $auth_settings['cas_version'] ) {
	1449	+ if ( $auth_settings['cas_version'] === 'CAS_VERSION_3_0' ) {
1627	1450	$cas_version = CAS_VERSION_3_0;
1628		- } elseif ( 'CAS_VERSION_2_0' === $auth_settings['cas_version'] ) {
	1451	+ } elseif ( $auth_settings['cas_version'] === 'CAS_VERSION_2_0' ) {
1629	1452	$cas_version = CAS_VERSION_2_0;
1630		- } elseif ( 'CAS_VERSION_1_0' === $auth_settings['cas_version'] ) {
	1453	+ } elseif ( $auth_settings['cas_version'] === 'CAS_VERSION_1_0' ) {
1631	1454	$cas_version = CAS_VERSION_1_0;
1632	1455	}
1633	1456
1634	1457	// Set the CAS client configuration if it hasn't been set already.
1635	1458	phpCAS::client( $cas_version, $auth_settings['cas_host'], intval( $auth_settings['cas_port'] ), $auth_settings['cas_path'] );
1636		- // Allow redirects at the CAS server endpoint (e.g., allow connections
1637		- // at an old CAS URL that redirects to a newer CAS URL).
1638		- phpCAS::setExtraCurlOption( CURLOPT_FOLLOWLOCATION, true );
1639	1459	// Restrict logout request origin to the CAS server only (prevent DDOS).
1640	1460	phpCAS::handleLogoutRequests( true, array( $auth_settings['cas_host'] ) );
1641	1461	}
1642		- if ( phpCAS::isAuthenticated() || phpCAS::isInitialized() ) {
	1462	+ if ( phpCAS::isAuthenticated() ) {
1643	1463	// Redirect to home page, or specified page if it's been provided.
1644	1464	$redirect_to = site_url( '/' );
1645		- if ( ! empty( $_REQUEST['redirect_to'] ) && isset( $_REQUEST['_wpnonce'] ) && wp_verify_nonce( sanitize_key( $_REQUEST['_wpnonce'] ), 'log-out' ) ) {
1646		- $redirect_to = esc_url_raw( wp_unslash( $_REQUEST['redirect_to'] ) );
	1465	+ if ( array_key_exists( 'redirect_to', $_REQUEST ) && filter_var( $_REQUEST['redirect_to'], FILTER_VALIDATE_URL ) !== false ) {
	1466	+ $redirect_to = $_REQUEST['redirect_to'];
1647	1467	}
1648	1468
1649	1469	phpCAS::logoutWithRedirectService( $redirect_to );
1650	1470	}
		@@ -1650,16 +1470,13 @@
1650	1470	}
1651	1471	}
1652	1472
1653	1473	// If session token set, log out of Google.
1654		- if ( 'google' === $current_user_authenticated_by || array_key_exists( 'token', $_SESSION ) ) {
	1474	+ if ( $current_user_authenticated_by === 'google' || array_key_exists( 'token', $_SESSION ) ) {
1655	1475	$token = json_decode( $_SESSION['token'] )->access_token;
1656	1476
1657		- /**
1658		- * Add Google API PHP Client.
1659		- *
1660		- * @see https://github.com/google/google-api-php-client branch:v1-master
1661		- */
	1477	+ // Add Google API PHP Client.
	1478	+ // @see https://github.com/google/google-api-php-client branch:v1-master
1662	1479	require_once dirname( __FILE__ ) . '/vendor/google-api-php-client/src/Google/autoload.php';
1663	1480
1664	1481	// Build the Google Client.
1665	1482	$client = new Google_Client();
		@@ -1667,9 +1484,9 @@
1667	1484	$client->setClientId( $auth_settings['google_clientid'] );
1668	1485	$client->setClientSecret( $auth_settings['google_clientsecret'] );
1669	1486	$client->setRedirectUri( 'postmessage' );
1670	1487
1671		- // Revoke the token.
	1488	+ // Revoke the token
1672	1489	$client->revokeToken( $token );
1673	1490
1674	1491	// Remove the credentials from the user's session.
1675	1492	unset( $_SESSION['token'] );
		@@ -1688,37 +1505,36 @@
1688	1505
1689	1506
1690	1507	/**
1691	1508	* Restrict access to WordPress site based on settings (everyone, logged_in_users).
	1509	+ * Hook: parse_request http://codex.wordpress.org/Plugin_API/Action_Reference/parse_request
1692	1510	*
1693		- * Action: parse_request
	1511	+ * @param array $wp WordPress object.
1694	1512	*
1695		- * @param array $wp WordPress object.
1696		- * @return WP|void WP object when passing through to WordPress authentication, or void.
	1513	+ * @return void
1697	1514	*/
1698	1515	public function restrict_access( $wp ) {
1699	1516	// Grab plugin settings.
1700		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
	1517	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' );
1701	1518
1702	1519	// Grab current user.
1703	1520	$current_user = wp_get_current_user();
1704	1521
1705	1522	$has_access = (
1706		- // Always allow access if WordPress is installing.
1707		- // phpcs:ignore WordPress.CSRF.NonceVerification.NoNonceVerification
	1523	+ // Always allow access if WordPress is installing
1708	1524	( defined( 'WP_INSTALLING' ) && isset( $_GET['key'] ) ) ||
1709		- // Always allow access to admins.
	1525	+ // Always allow access to admins
1710	1526	( current_user_can( 'create_users' ) ) ||
1711		- // Allow access if option is set to 'everyone'.
1712		- ( 'everyone' === $auth_settings['access_who_can_view'] ) ||
1713		- // Allow access to approved external users and logged in users if option is set to 'logged_in_users'.
1714		- ( 'logged_in_users' === $auth_settings['access_who_can_view'] && $this->is_user_logged_in_and_blog_user() && $this->is_email_in_list( $current_user->user_email, 'approved' ) ) ||
1715		- // Allow access for requests to /wp-json/oauth1 so oauth clients can authenticate to use the REST API.
1716		- ( property_exists( $wp, 'matched_query' ) && stripos( $wp->matched_query, 'rest_oauth1=' ) === 0 ) ||
1717		- // Allow access for non-GET requests to /wp-json/*, since REST API authentication already covers them.
1718		- ( property_exists( $wp, 'matched_query' ) && 0 === stripos( $wp->matched_query, 'rest_route=' ) && isset( $_SERVER['REQUEST_METHOD'] ) && 'GET' !== $_SERVER['REQUEST_METHOD'] ) ||
1719		- // Allow access for GET requests to /wp-json/ (root), since REST API discovery calls rely on this.
1720		- ( property_exists( $wp, 'matched_query' ) && 'rest_route=/' === $wp->matched_query )
	1527	+ // Allow access if option is set to 'everyone'
	1528	+ ( $auth_settings['access_who_can_view'] == 'everyone' ) ||
	1529	+ // Allow access to approved external users and logged in users if option is set to 'logged_in_users'
	1530	+ ( $auth_settings['access_who_can_view'] == 'logged_in_users' && $this->is_user_logged_in_and_blog_user() && $this->is_email_in_list( $current_user->user_email, 'approved' ) ) ||
	1531	+ // Allow access for requests to /wp-json/oauth1 so oauth clients can authenticate to use the REST API
	1532	+ ( property_exists( $wp, 'matched_query' ) && stripos( $wp->matched_query, "rest_oauth1=" ) === 0 ) ||
	1533	+ // Allow access for non-GET requests to /wp-json/*, since REST API authentication already covers them
	1534	+ ( property_exists( $wp, 'matched_query' ) && stripos( $wp->matched_query, "rest_route=" ) === 0 && $_SERVER['REQUEST_METHOD'] !== 'GET' ) ||
	1535	+ // Allow access for GET requests to /wp-json/ (root), since REST API discovery calls rely on this
	1536	+ ( property_exists( $wp, 'matched_query' ) && $wp->matched_query === 'rest_route=/' )
1721	1537	// Note that GET requests to a rest endpoint will be restricted by authorizer. In that case, error messages will be returned as JSON.
1722	1538	);
1723	1539
1724	1540	/**
		@@ -1740,9 +1556,9 @@
1740	1556	* }
1741	1557	* add_filter( 'authorizer_has_access', 'my_rsa_feed_access_override' );
1742	1558	*/
1743	1559	if ( apply_filters( 'authorizer_has_access', $has_access, $wp ) === true ) {
1744		- // Turn off the public notice about browsing anonymously.
	1560	+ // Turn off the public notice about browsing anonymously
1745	1561	update_option( 'auth_settings_advanced_public_notice', false );
1746	1562
1747	1563	// We've determined that the current user has access, so simply return to grant access.
1748	1564	return $wp;
		@@ -1748,13 +1564,13 @@
1748	1564	return $wp;
1749	1565	}
1750	1566
1751	1567	// Allow HEAD requests to the root (usually discovery from a REST client).
1752		- if ( 'HEAD' === $_SERVER['REQUEST_METHOD'] && empty( $wp->request ) && empty( $wp->matched_query ) ) {
	1568	+ if ( $_SERVER['REQUEST_METHOD'] === 'HEAD' && empty( $wp->request ) && empty( $wp->matched_query ) ) {
1753	1569	return $wp;
1754	1570	}
1755	1571
1756		- /* We've determined that the current user doesn't have access, so we deal with them now. */
	1572	+ // We've determined that the current user doesn't have access, so we deal with them now.
1757	1573
1758	1574	// Fringe case: In a multisite, a user of a different blog can successfully
1759	1575	// log in, but they aren't on the 'approved' whitelist for this blog.
1760	1576	// If that's the case, add them to the pending list for this blog.
		@@ -1765,19 +1581,29 @@
1765	1581	$result = $this->check_user_access( $current_user, array( $current_user->user_email ) );
1766	1582	}
1767	1583
1768	1584	// Check to see if the requested page is public. If so, show it.
	1585	+ $current_page_name = property_exists( $wp, 'query_vars' ) && array_key_exists( 'name', $wp->query_vars ) && strlen( $wp->query_vars['name'] ) > 0 ? $wp->query_vars['name'] : '';
	1586	+ if ( ! $current_page_name ) {
	1587	+ // Different WordPress versions store the page slug in different places; look for it elsewhere.
	1588	+ if ( property_exists( $wp, 'query_vars' ) && array_key_exists( 'pagename', $wp->query_vars ) && strlen( $wp->query_vars['pagename'] ) > 0 ) {
	1589	+ $current_page_name = $wp->query_vars['pagename'];
	1590	+ }
	1591	+ }
	1592	+ $current_page_id = '';
1769	1593	if ( empty( $wp->request ) ) {
1770	1594	$current_page_id = 'home';
1771	1595	} else {
1772		- $request_query = isset( $wp->query_vars ) ? new WP_Query( $wp->query_vars ) : null;
1773		- $current_page_id = isset( $request_query->post_count ) && $request_query->post_count > 0 ? $request_query->post->ID : '';
	1596	+ $current_page = get_page_by_path( $current_page_name );
	1597	+ if ( is_object( $current_page ) && isset( $current_page->ID ) ) {
	1598	+ $current_page_id = $current_page->ID;
	1599	+ }
1774	1600	}
1775	1601	if ( ! array_key_exists( 'access_public_pages', $auth_settings ) || ! is_array( $auth_settings['access_public_pages'] ) ) {
1776	1602	$auth_settings['access_public_pages'] = array();
1777	1603	}
1778		- if ( in_array( strval( $current_page_id ), $auth_settings['access_public_pages'], true ) ) {
1779		- if ( 'no_warning' === $auth_settings['access_public_warning'] ) {
	1604	+ if ( in_array( $current_page_id, $auth_settings['access_public_pages'] ) ) {
	1605	+ if ( $auth_settings['access_public_warning'] === 'no_warning' ) {
1780	1606	update_option( 'auth_settings_advanced_public_notice', false );
1781	1607	} else {
1782	1608	update_option( 'auth_settings_advanced_public_notice', true );
1783	1609	}
		@@ -1785,11 +1611,11 @@
1785	1611	}
1786	1612
1787	1613	// Check to see if any category assigned to the requested page is public. If so, show it.
1788	1614	$current_page_categories = wp_get_post_categories( $current_page_id, array( 'fields' => 'slugs' ) );
1789		- foreach ( $current_page_categories as $current_page_category ) {
1790		- if ( in_array( 'cat_' . $current_page_category, $auth_settings['access_public_pages'], true ) ) {
1791		- if ( 'no_warning' === $auth_settings['access_public_warning'] ) {
	1615	+ foreach( $current_page_categories as $current_page_category ) {
	1616	+ if ( in_array( 'cat_' . $current_page_category, $auth_settings['access_public_pages'] ) ) {
	1617	+ if ( $auth_settings['access_public_warning'] === 'no_warning' ) {
1792	1618	update_option( 'auth_settings_advanced_public_notice', false );
1793	1619	} else {
1794	1620	update_option( 'auth_settings_advanced_public_notice', true );
1795	1621	}
		@@ -1797,11 +1623,11 @@
1797	1623	}
1798	1624	}
1799	1625
1800	1626	// Check to see if this page can't be found. If so, allow showing the 404 page.
1801		- if ( strlen( $current_page_id ) < 1 ) {
1802		- if ( in_array( 'auth_public_404', $auth_settings['access_public_pages'], true ) ) {
1803		- if ( 'no_warning' === $auth_settings['access_public_warning'] ) {
	1627	+ if ( strlen( $current_page_name ) > 0 && strlen( $current_page_id ) < 1 ) {
	1628	+ if ( in_array( 'auth_public_404', $auth_settings['access_public_pages'] ) ) {
	1629	+ if ( $auth_settings['access_public_warning'] === 'no_warning' ) {
1804	1630	update_option( 'auth_settings_advanced_public_notice', false );
1805	1631	} else {
1806	1632	update_option( 'auth_settings_advanced_public_notice', true );
1807	1633	}
		@@ -1806,8 +1632,9 @@
1806	1632	update_option( 'auth_settings_advanced_public_notice', true );
1807	1633	}
1808	1634	return $wp;
1809	1635	}
	1636	+
1810	1637	}
1811	1638
1812	1639	// Check to see if the requested category is public. If so, show it.
1813	1640	$current_category_name = property_exists( $wp, 'query_vars' ) && array_key_exists( 'category_name', $wp->query_vars ) && strlen( $wp->query_vars['category_name'] ) > 0 ? $wp->query_vars['category_name'] : '';
		@@ -1812,10 +1639,10 @@
1812	1639	// Check to see if the requested category is public. If so, show it.
1813	1640	$current_category_name = property_exists( $wp, 'query_vars' ) && array_key_exists( 'category_name', $wp->query_vars ) && strlen( $wp->query_vars['category_name'] ) > 0 ? $wp->query_vars['category_name'] : '';
1814	1641	if ( $current_category_name ) {
1815	1642	$current_category_name = end( explode( '/', $current_category_name ) );
1816		- if ( in_array( 'cat_' . $current_category_name, $auth_settings['access_public_pages'], true ) ) {
1817		- if ( 'no_warning' === $auth_settings['access_public_warning'] ) {
	1643	+ if ( in_array( 'cat_' . $current_category_name, $auth_settings['access_public_pages'] ) ) {
	1644	+ if ( $auth_settings['access_public_warning'] === 'no_warning' ) {
1818	1645	update_option( 'auth_settings_advanced_public_notice', false );
1819	1646	} else {
1820	1647	update_option( 'auth_settings_advanced_public_notice', true );
1821	1648	}
		@@ -1825,20 +1652,18 @@
1825	1652
1826	1653	// User is denied access, so show them the error message. Render as JSON
1827	1654	// if this is a REST API call; otherwise, show the error message via
1828	1655	// wp_die() (rendered html), or redirect to the login URL.
1829		- $current_path = ! empty( $_SERVER['REQUEST_URI'] ) ? esc_url_raw( wp_unslash( $_SERVER['REQUEST_URI'] ) ) : home_url();
1830		- if ( property_exists( $wp, 'matched_query' ) && stripos( $wp->matched_query, 'rest_route=' ) === 0 && 'GET' === $_SERVER['REQUEST_METHOD'] ) {
1831		- wp_send_json(
1832		- array(
1833		- 'code' => 'rest_cannot_view',
1834		- 'message' => strip_tags( $auth_settings['access_redirect_to_message'] ),
1835		- 'data' => array(
1836		- 'status' => 401,
1837		- ),
1838		- )
1839		- );
1840		- } elseif ( 'message' === $auth_settings['access_redirect'] ) {
	1656	+ $current_path = empty( $_SERVER['REQUEST_URI'] ) ? home_url() : $_SERVER['REQUEST_URI'];
	1657	+ if ( property_exists( $wp, 'matched_query' ) && stripos( $wp->matched_query, "rest_route=" ) === 0 && $_SERVER['REQUEST_METHOD'] === 'GET' ) {
	1658	+ wp_send_json( array(
	1659	+ 'code' => 'rest_cannot_view',
	1660	+ 'message' => strip_tags( $auth_settings['access_redirect_to_message'] ),
	1661	+ 'data' => array(
	1662	+ 'status' => 401,
	1663	+ ),
	1664	+ ));
	1665	+ } elseif ( $auth_settings['access_redirect'] === 'message' ) {
1841	1666	$page_title = sprintf(
1842	1667	/* TRANSLATORS: %s: Name of blog */
1843	1668	__( '%s - Access Restricted', 'authorizer' ),
1844	1669	get_bloginfo( 'name' )
		@@ -1849,15 +1674,15 @@
1849	1674	'<p style="text-align: center;margin-bottom: -15px;">' .
1850	1675	'<a class="button" href="' . wp_login_url( $current_path ) . '">' .
1851	1676	__( 'Log In', 'authorizer' ) .
1852	1677	'</a></p>';
1853		- wp_die( wp_kses( $error_message, $this->allowed_html ), esc_html( $page_title ) );
1854		- } else {
	1678	+ wp_die( $error_message, $page_title );
	1679	+ } else { // if ( $auth_settings['access_redirect'] === 'login' ) {
1855	1680	wp_redirect( wp_login_url( $current_path ), 302 );
1856	1681	exit;
1857	1682	}
1858	1683
1859		- // Sanity check: we should never get here.
	1684	+ // Sanity check: we should never get here
1860	1685	wp_die( '<p>Access denied.</p>', 'Site Access Restricted' );
1861	1686	}
1862	1687
1863	1688
		@@ -1866,11 +1691,9 @@
1866	1691	* not yet been added to this particular blog in a multisite). Note: we do
1867	1692	* this because check_user_access() runs on the parse_request hook, which
1868	1693	* does not fire on wp-admin pages.
1869	1694	*
1870		- * Action: init
1871		- *
1872		- * @return void
	1695	+ * Hook: admin_menu
1873	1696	*/
1874	1697	public function init__maybe_add_network_approved_user() {
1875	1698	global $current_user;
1876	1699
		@@ -1885,10 +1708,10 @@
1885	1708	) {
1886	1709	// Get all approved users.
1887	1710	$auth_settings_access_users_approved = $this->sanitize_user_list(
1888	1711	array_merge(
1889		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT ),
1890		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT )
	1712	+ $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN ),
	1713	+ $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN )
1891	1714	)
1892	1715	);
1893	1716
1894	1717	// Get user info (we need user role).
		@@ -1900,9 +1723,9 @@
1900	1723	// Add user to blog.
1901	1724	add_user_to_blog( get_current_blog_id(), $current_user->ID, $user_info['role'] );
1902	1725
1903	1726	// Refresh user permissions.
1904		- $current_user = new WP_User( $current_user->ID ); // phpcs:ignore WordPress.Variables.GlobalVariables.OverrideProhibited
	1727	+ $current_user = new WP_User( $current_user->ID );
1905	1728	}
1906	1729	}
1907	1730
1908	1731
		@@ -1916,15 +1739,11 @@
1916	1739
1917	1740
1918	1741	/**
1919	1742	* Add custom error message to login screen.
1920		- *
1921	1743	* Filter: login_errors
1922		- *
1923		- * @param string $errors Error description.
1924		- * @return string Error description with Authorizer errors added.
1925	1744	*/
1926		- public function show_advanced_login_error( $errors ) {
	1745	+ function show_advanced_login_error( $errors ) {
1927	1746	$error = get_option( 'auth_settings_advanced_login_error' );
1928	1747	delete_option( 'auth_settings_advanced_login_error' );
1929	1748	$errors = ' ' . $error . "<br />\n";
1930	1749	return $errors;
		@@ -1932,25 +1751,24 @@
1932	1751
1933	1752
1934	1753	/**
1935	1754	* Load external resources for the public-facing site.
1936		- *
1937		- * Action: wp_enqueue_scripts
1938	1755	*/
1939		- public function auth_public_scripts() {
1940		- // Load (and localize) public scripts.
1941		- $current_path = ! empty( $_SERVER['REQUEST_URI'] ) ? esc_url_raw( wp_unslash( $_SERVER['REQUEST_URI'] ) ) : home_url();
1942		- wp_enqueue_script( 'auth_public_scripts', plugins_url( '/js/authorizer-public.js', __FILE__ ), array( 'jquery' ), '2.8.0' );
	1756	+ function auth_public_scripts() {
	1757	+ // Load (and localize) public scripts
	1758	+ $current_path = empty( $_SERVER['REQUEST_URI'] ) ? home_url() : $_SERVER['REQUEST_URI'];
	1759	+ wp_enqueue_script( 'auth_public_scripts', plugins_url( '/js/authorizer-public.js', __FILE__ ), array( 'jquery' ), '2.3.2' );
1943	1760	$auth_localized = array(
1944		- 'wpLoginUrl' => wp_login_url( $current_path ),
1945		- 'publicWarning' => get_option( 'auth_settings_advanced_public_notice' ),
1946		- 'anonymousNotice' => $this->get_plugin_option( 'access_redirect_to_message' ),
1947		- 'logIn' => esc_html__( 'Log In', 'authorizer' ),
	1761	+ 'wp_login_url' => wp_login_url( $current_path ),
	1762	+ 'public_warning' => get_option( 'auth_settings_advanced_public_notice' ),
	1763	+ 'anonymous_notice' => $this->get_plugin_option( 'access_redirect_to_message' ),
	1764	+ 'log_in' => esc_html__( 'Log In', 'authorizer' ),
1948	1765	);
1949	1766	wp_localize_script( 'auth_public_scripts', 'auth', $auth_localized );
	1767	+ //update_option( 'auth_settings_advanced_public_notice', false);
1950	1768
1951		- // Load public css.
1952		- wp_register_style( 'authorizer-public-css', plugins_url( 'css/authorizer-public.css', __FILE__ ), array(), '2.8.0' );
	1769	+ // Load public css
	1770	+ wp_register_style( 'authorizer-public-css', plugins_url( 'css/authorizer-public.css', __FILE__ ), array(), '2.3.2' );
1953	1771	wp_enqueue_style( 'authorizer-public-css' );
1954	1772	}
1955	1773
1956	1774
		@@ -1956,21 +1774,19 @@
1956	1774
1957	1775	/**
1958	1776	* Enqueue JS scripts and CSS styles appearing on wp-login.php.
1959	1777	*
1960		- * Action: login_enqueue_scripts
1961		- *
1962	1778	* @return void
1963	1779	*/
1964		- public function login_enqueue_scripts_and_styles() {
	1780	+ function login_enqueue_scripts_and_styles() {
1965	1781	// Grab plugin settings.
1966		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
	1782	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' );
1967	1783
1968	1784	// Enqueue scripts appearing on wp-login.php.
1969		- wp_enqueue_script( 'auth_login_scripts', plugins_url( '/js/authorizer-login.js', __FILE__ ), array( 'jquery' ), '2.8.0' );
	1785	+ wp_enqueue_script( 'auth_login_scripts', plugins_url( '/js/authorizer-login.js', __FILE__ ), array( 'jquery' ), '2.3.2' );
1970	1786
1971	1787	// Enqueue styles appearing on wp-login.php.
1972		- wp_register_style( 'authorizer-login-css', plugins_url( '/css/authorizer-login.css', __FILE__ ), array(), '2.8.0' );
	1788	+ wp_register_style( 'authorizer-login-css', plugins_url( '/css/authorizer-login.css', __FILE__ ), array(), '2.3.2' );
1973	1789	wp_enqueue_style( 'authorizer-login-css' );
1974	1790
1975	1791	/**
1976	1792	* Developers can use the `authorizer_add_branding_option` filter
		@@ -1975,8 +1791,9 @@
1975	1791	/**
1976	1792	* Developers can use the `authorizer_add_branding_option` filter
1977	1793	* to add a radio button for "Custom WordPress login branding"
1978	1794	* under the "Advanced" tab in Authorizer options. Example:
	1795	+ *
1979	1796	* function my_authorizer_add_branding_option( $branding_options ) {
1980	1797	* $new_branding_option = array(
1981	1798	* 'value' => 'your_brand'
1982	1799	* 'description' => 'Custom Your Brand Login Screen',
		@@ -1990,23 +1807,23 @@
1990	1807	*/
1991	1808	$branding_options = array();
1992	1809	$branding_options = apply_filters( 'authorizer_add_branding_option', $branding_options );
1993	1810	foreach ( $branding_options as $branding_option ) {
1994		- // Make sure the custom brands have the required values.
	1811	+ // Make sure the custom brands have the required values
1995	1812	if ( ! ( is_array( $branding_option ) && array_key_exists( 'value', $branding_option ) && array_key_exists( 'css_url', $branding_option ) && array_key_exists( 'js_url', $branding_option ) ) ) {
1996	1813	continue;
1997	1814	}
1998	1815	if ( $auth_settings['advanced_branding'] === $branding_option['value'] ) {
1999		- wp_enqueue_script( 'auth_login_custom_scripts-' . sanitize_title( $branding_option['value'] ), $branding_option['js_url'], array( 'jquery' ), '2.8.0' );
2000		- wp_register_style( 'authorizer-login-custom-css-' . sanitize_title( $branding_option['value'] ), $branding_option['css_url'], array(), '2.8.0' );
	1816	+ wp_enqueue_script( 'auth_login_custom_scripts-' . sanitize_title( $branding_option['value'] ), $branding_option['js_url'], array( 'jquery' ), '2.3.2' );
	1817	+ wp_register_style( 'authorizer-login-custom-css-' . sanitize_title( $branding_option['value'] ), $branding_option['css_url'], array(), '2.3.2' );
2001	1818	wp_enqueue_style( 'authorizer-login-custom-css-' . sanitize_title( $branding_option['value'] ) );
2002	1819	}
2003	1820	}
2004	1821
2005	1822	// If we're using Google logins, load those resources.
2006		- if ( '1' === $auth_settings['google'] ) {
2007		- wp_enqueue_script( 'authorizer-login-custom-google', plugins_url( '/js/authorizer-login-custom_google.js', __FILE__ ), array( 'jquery' ), '2.8.0' ); ?>
2008		- <meta name="google-signin-clientid" content="<?php echo esc_attr( $auth_settings['google_clientid'] ); ?>" />
	1823	+ if ( $auth_settings['google'] === '1' ) {
	1824	+ wp_enqueue_script( 'authorizer-login-custom-google', plugins_url( '/js/authorizer-login-custom_google.js', __FILE__ ), array( 'jquery' ), '2.3.2' ); ?>
	1825	+ <meta name="google-signin-clientid" content="<?php echo $auth_settings['google_clientid']; ?>" />
2009	1826	<meta name="google-signin-scope" content="email" />
2010	1827	<meta name="google-signin-cookiepolicy" content="single_host_origin" />
2011	1828	<?php
2012	1829	}
		@@ -2014,127 +1831,110 @@
2014	1831
2015	1832
2016	1833	/**
2017	1834	* Load external resources in the footer of the wp-login.php page.
2018		- *
2019		- * Action: login_footer
	1835	+ * Run on action hook: login_footer
2020	1836	*/
2021		- public function load_login_footer_js() {
	1837	+ function load_login_footer_js() {
2022	1838	// Grab plugin settings.
2023		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
2024		- $ajaxurl = admin_url( 'admin-ajax.php' );
2025		- if ( '1' === $auth_settings['google'] ) :
2026		- ?>
2027		-<script type="text/javascript">
2028		-/* global location, window */
2029		-// Reload login page if reauth querystring param exists,
2030		-// since reauth interrupts external logins (e.g., google).
2031		-if ( location.search.indexOf( 'reauth=1' ) >= 0 ) {
2032		- location.href = location.href.replace( 'reauth=1', '' );
2033		-}
	1839	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' ); ?>
	1840	+ <?php if ( $auth_settings['google'] === '1' ): ?>
	1841	+ <script type="text/javascript">
	1842	+ // Reload login page if reauth querystring param exists,
	1843	+ // since reauth interrupts external logins (e.g., google).
	1844	+ if ( location.search.indexOf( 'reauth=1' ) >= 0 ) {
	1845	+ location.href = location.href.replace( 'reauth=1', '' );
	1846	+ }
2034	1847
2035		-// eslint-disable-next-line no-implicit-globals
2036		-function authUpdateQuerystringParam( uri, key, value ) {
2037		- var re = new RegExp( '([?&])' + key + '=.*?(&|$)', 'i' );
2038		- var separator = uri.indexOf( '?' ) !== -1 ? '&' : '?';
2039		- if ( uri.match( re ) ) {
2040		- return uri.replace( re, '$1' + key + '=' + value + '$2' );
2041		- } else {
2042		- return uri + separator + key + '=' + value;
2043		- }
2044		-}
	1848	+ function auth_update_querystring_param( uri, key, value ) {
	1849	+ var re = new RegExp( '([?&])' + key + '=.*?(&|$)', 'i' );
	1850	+ var separator = uri.indexOf( '?' ) !== -1 ? '&' : '?';
	1851	+ if ( uri.match( re ) ) {
	1852	+ return uri.replace( re, '$1' + key + '=' + value + '$2' );
	1853	+ } else {
	1854	+ return uri + separator + key + '=' + value;
	1855	+ }
	1856	+ }
2045	1857
2046		-// eslint-disable-next-line
2047		-function signInCallback( authResult ) { // jshint ignore:line
2048		- var $ = jQuery;
2049		- if ( authResult.status && authResult.status.signed_in ) {
2050		- // Hide the sign-in button now that the user is authorized, for example:
2051		- $( '#googleplus_button' ).attr( 'style', 'display: none' );
	1858	+ function signInCallback( authResult ) {
	1859	+ var $ = jQuery;
	1860	+ if ( authResult['status'] && authResult['status']['signed_in'] ) {
	1861	+ // Hide the sign-in button now that the user is authorized, for example:
	1862	+ $( '#googleplus_button' ).attr( 'style', 'display: none' );
2052	1863
2053		- // Send the code to the server
2054		- var ajaxurl = '<?php echo esc_attr( $ajaxurl ); ?>';
2055		- $.post(ajaxurl, {
2056		- action: 'process_google_login',
2057		- code: authResult.code,
2058		- nonce: $('#nonce_google_auth-<?php echo esc_attr( $this->get_cookie_value() ); ?>' ).val(),
2059		- }, function() {
2060		- // Handle or verify the server response if necessary.
2061		- // console.log( response );
	1864	+ // Send the code to the server
	1865	+ var ajaxurl = '<?php echo admin_url( "admin-ajax.php" ); ?>';
	1866	+ $.post(ajaxurl, {
	1867	+ action: 'process_google_login',
	1868	+ 'code': authResult['code'],
	1869	+ 'nonce': $('#nonce_google_auth-<?php echo $this->get_cookie_value(); ?>' ).val(),
	1870	+ }, function( response ) {
	1871	+ // Handle or verify the server response if necessary.
	1872	+ //console.log( response );
2062	1873
2063		- // Reload wp-login.php to continue the authentication process.
2064		- var newHref = authUpdateQuerystringParam( location.href, 'external', 'google' );
2065		- if ( location.href === newHref ) {
2066		- location.reload();
2067		- } else {
2068		- location.href = newHref;
2069		- }
2070		- });
2071		- } else {
2072		- // Update the app to reflect a signed out user
2073		- // Possible error values:
2074		- // "user_signed_out" - User is signed-out
2075		- // "access_denied" - User denied access to your app
2076		- // "immediate_failed" - Could not automatically log in the user
2077		- // console.log('Sign-in state: ' + authResult['error']);
	1874	+ // Reload wp-login.php to continue the authentication process.
	1875	+ var new_href = auth_update_querystring_param( location.href, 'external', 'google' );
	1876	+ if ( location.href === new_href ) {
	1877	+ location.reload();
	1878	+ } else {
	1879	+ location.href = new_href;
	1880	+ }
	1881	+ });
	1882	+ } else {
	1883	+ // Update the app to reflect a signed out user
	1884	+ // Possible error values:
	1885	+ // "user_signed_out" - User is signed-out
	1886	+ // "access_denied" - User denied access to your app
	1887	+ // "immediate_failed" - Could not automatically log in the user
	1888	+ //console.log('Sign-in state: ' + authResult['error']);
2078	1889
2079		- // If user denies access, reload the login page.
2080		- if ( authResult.error === 'access_denied' || authResult.error === 'user_signed_out' ) {
2081		- window.location.reload();
	1890	+ // If user denies access, reload the login page.
	1891	+ if ( authResult['error'] === 'access_denied' || authResult['error'] === 'user_signed_out' ) {
	1892	+ window.location.reload();
	1893	+ }
	1894	+ }
	1895	+ }
	1896	+ </script>
	1897	+ <?php endif;
2082	1898	}
2083		- }
2084		-}
2085		-</script>
2086		- <?php
2087		- endif;
2088		- }
2089	1899
2090	1900
2091	1901	/**
2092	1902	* Create links for any external authentication services that are enabled.
2093		- *
2094		- * Action: login_form
2095	1903	*/
2096		- public function login_form_add_external_service_links() {
	1904	+ function login_form_add_external_service_links() {
2097	1905	// Grab plugin settings.
2098		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
2099		- ?>
	1906	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' ); ?>
2100	1907	<div id="auth-external-service-login">
2101		- <?php if ( '1' === $auth_settings['google'] ) : ?>
2102		- <p><a id="googleplus_button" class="button button-primary button-external button-google"><span class="dashicons dashicons-googleplus"></span><span class="label"><?php esc_html_e( 'Sign in with Google', 'authorizer' ); ?></span></a></p>
	1908	+ <?php if ( $auth_settings['google'] === '1' ): ?>
	1909	+ <p><a id="googleplus_button" class="button button-primary button-external button-google"><span class="dashicons dashicons-googleplus"></span><span class="label"><?php _e( 'Sign in with Google', 'authorizer' ); ?></span></a></p>
2103	1910	<?php wp_nonce_field( 'google_csrf_nonce', 'nonce_google_auth-' . $this->get_cookie_value() ); ?>
2104	1911	<?php endif; ?>
2105	1912
2106		- <?php if ( '1' === $auth_settings['cas'] ) : ?>
2107		- <p><a class="button button-primary button-external button-cas" href="<?php echo esc_attr( $this->modify_current_url_for_cas_login() ); ?>">
	1913	+ <?php if ( $auth_settings['cas'] === '1' ): ?>
	1914	+ <p><a class="button button-primary button-external button-cas" href="<?php echo $this->modify_current_url_for_cas_login(); ?>">
2108	1915	<span class="dashicons dashicons-lock"></span>
2109		- <span class="label">
2110		- <?php
2111		- echo esc_html(
2112		- sprintf(
2113		- /* TRANSLATORS: %s: Custom CAS label from authorizer options */
2114		- __( 'Sign in with %s', 'authorizer' ),
2115		- $auth_settings['cas_custom_label']
2116		- )
	1916	+ <span class="label"><?php
	1917	+ printf(
	1918	+ /* TRANSLATORS: %s: Custom CAS label from authorizer options */
	1919	+ __( 'Sign in with %s', 'authorizer' ),
	1920	+ $auth_settings['cas_custom_label']
2117	1921	);
2118		- ?>
2119		- </span>
	1922	+ ?></span>
2120	1923	</a></p>
2121	1924	<?php endif; ?>
2122	1925
2123		- <?php if ( '1' === $auth_settings['advanced_hide_wp_login'] && isset( $_SERVER['QUERY_STRING'] ) && false === strpos( $_SERVER['QUERY_STRING'], 'external=wordpress' ) ) : // phpcs:ignore WordPress.VIP.ValidatedSanitizedInput ?>
	1926	+ <?php if ( $auth_settings['advanced_hide_wp_login'] === '1' && strpos( $_SERVER['QUERY_STRING'], 'external=wordpress' ) === false ): ?>
2124	1927	<style type="text/css">
2125		- body.login-action-login form {
2126		- padding-bottom: 8px;
	1928	+ #loginform {
	1929	+ padding-bottom: 8px !important;
2127	1930	}
2128		- body.login-action-login form p > label,
2129		- body.login-action-login form .forgetmenot,
2130		- body.login-action-login form .submit,
2131		- body.login-action-login #nav { /* csslint allow: ids */
2132		- display: none;
	1931	+ #loginform p>label, #loginform p.forgetmenot, #loginform p.submit, p#nav {
	1932	+ display: none !important;
2133	1933	}
2134	1934	</style>
2135		- <?php elseif ( '1' === $auth_settings['cas'] || '1' === $auth_settings['google'] ) : ?>
2136		- <h3> &mdash; <?php esc_html_e( 'or', 'authorizer' ); ?> &mdash; </h3>
	1935	+ <?php elseif ( $auth_settings['cas'] === '1' || $auth_settings['google'] === '1' ): ?>
	1936	+ <h3> &mdash; <?php _e( 'or', 'authorizer' ); ?> &mdash; </h3>
2137	1937	<?php endif; ?>
2138	1938	</div>
2139	1939	<?php
2140	1940
		@@ -2147,28 +1947,21 @@
2147	1947	* Note: hook into wp_login_errors filter so this fires after the
2148	1948	* authenticate hook (where the redirect to CAS happens), but before html
2149	1949	* output is started (so the redirect header doesn't complain about data
2150	1950	* already being sent).
2151		- *
2152		- * Filter: wp_login_errors
2153		- *
2154		- * @param object $errors WP Error object.
2155		- * @param string $redirect_to Where to redirect on error.
2156		- * @return WP_Error|void WP Error object or void on redirect.
2157	1951	*/
2158		- public function wp_login_errors__maybe_redirect_to_cas( $errors, $redirect_to ) {
	1952	+ function wp_login_errors__maybe_redirect_to_cas( $errors, $redirect_to ) {
2159	1953	// Grab plugin settings.
2160		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
	1954	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' );
2161	1955
2162	1956	// Check whether we should redirect to CAS.
2163	1957	if (
2164		- isset( $_SERVER['QUERY_STRING'] ) &&
2165		- strpos( $_SERVER['QUERY_STRING'], 'external=wordpress' ) === false && // phpcs:ignore WordPress.VIP.ValidatedSanitizedInput
2166		- array_key_exists( 'cas_auto_login', $auth_settings ) && '1' === $auth_settings['cas_auto_login'] &&
2167		- array_key_exists( 'cas', $auth_settings ) && '1' === $auth_settings['cas'] &&
2168		- ( ! array_key_exists( 'ldap', $auth_settings ) || '1' !== $auth_settings['ldap'] ) &&
2169		- ( ! array_key_exists( 'google', $auth_settings ) || '1' !== $auth_settings['google'] ) &&
2170		- array_key_exists( 'advanced_hide_wp_login', $auth_settings ) && '1' === $auth_settings['advanced_hide_wp_login']
	1958	+ strpos( $_SERVER['QUERY_STRING'], 'external=wordpress' ) === false &&
	1959	+ array_key_exists( 'cas_auto_login', $auth_settings ) && $auth_settings['cas_auto_login'] === '1' &&
	1960	+ array_key_exists( 'cas', $auth_settings ) && $auth_settings['cas'] === '1' &&
	1961	+ ( ! array_key_exists( 'ldap', $auth_settings ) || $auth_settings['ldap'] !== '1' ) &&
	1962	+ ( ! array_key_exists( 'google', $auth_settings ) || $auth_settings['google'] !== '1' ) &&
	1963	+ array_key_exists( 'advanced_hide_wp_login', $auth_settings ) && $auth_settings['advanced_hide_wp_login'] === '1'
2171	1964	) {
2172	1965	wp_redirect( $this->modify_current_url_for_cas_login() );
2173	1966	exit;
2174	1967	}
		@@ -2181,22 +1974,18 @@
2181	1974	* Set a unique cookie to add to Google auth nonce to avoid CSRF detection.
2182	1975	* Note: hook into login_init so this fires at the start of the visit to
2183	1976	* wp-login.php, but before any html output is started (so setting the
2184	1977	* cookie header doesn't complain about data already being sent).
2185		- *
2186		- * Action: login_init
2187		- *
2188		- * @return void
2189	1978	*/
2190		- public function login_init__maybe_set_google_nonce_cookie() {
	1979	+ function login_init__maybe_set_google_nonce_cookie() {
2191	1980	// Grab plugin settings.
2192		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
	1981	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' );
2193	1982
2194	1983	// If Google logins are enabled, make sure the cookie is set.
2195		- if ( array_key_exists( 'google', $auth_settings ) && '1' === $auth_settings['google'] ) {
	1984	+ if ( array_key_exists( 'google', $auth_settings ) && $auth_settings['google'] === '1' ) {
2196	1985	if ( ! isset( $_COOKIE['login_unique'] ) ) {
2197	1986	$this->cookie_value = md5( rand() );
2198		- setcookie( 'login_unique', $this->cookie_value, time() + 1800, '/', defined( 'COOKIE_DOMAIN' ) ? COOKIE_DOMAIN : '' );
	1987	+ setcookie( 'login_unique', $this->cookie_value, time()+1800, '/', defined( 'COOKIE_DOMAIN' ) ? COOKIE_DOMAIN : '' );
2199	1988	$_COOKIE['login_unique'] = $this->cookie_value;
2200	1989	}
2201	1990	}
2202	1991	}
		@@ -2205,17 +1994,12 @@
2205	1994	/**
2206	1995	* Implements hook: do_action( 'wp_login_failed', $username );
2207	1996	* Update the user meta for the user that just failed logging in.
2208	1997	* Keep track of time of last failed attempt and number of failed attempts.
2209		- *
2210		- * Action: wp_login_failed
2211		- *
2212		- * @param string $username Username to update login count for.
2213		- * @return void
2214	1998	*/
2215		- public function update_login_failed_count( $username ) {
	1999	+ function update_login_failed_count( $username ) {
2216	2000	// Grab plugin settings.
2217		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
	2001	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' );
2218	2002
2219	2003	// Get user trying to log in.
2220	2004	// If this isn't a real user, update the global failed attempt
2221	2005	// variables. We'll use these global variables to institute the
		@@ -2223,9 +2007,9 @@
2223	2007	// won't be able to determine which accounts are real by which
2224	2008	// accounts get locked out on multiple invalid attempts.
2225	2009	$user = get_user_by( 'login', $username );
2226	2010
2227		- if ( false !== $user ) {
	2011	+ if ( $user !== FALSE ) {
2228	2012	$last_attempt = get_user_meta( $user->ID, 'auth_settings_advanced_lockouts_time_last_failed', true );
2229	2013	$num_attempts = get_user_meta( $user->ID, 'auth_settings_advanced_lockouts_failed_attempts', true );
2230	2014	} else {
2231	2015	$last_attempt = get_option( 'auth_settings_advanced_lockouts_time_last_failed' );
		@@ -2239,15 +2023,15 @@
2239	2023
2240	2024	// Reset the failed attempt count if the time since the last
2241	2025	// failed attempt is greater than the reset duration.
2242	2026	$time_since_last_fail = time() - $last_attempt;
2243		- $reset_duration = $auth_settings['advanced_lockouts']['reset_duration'] * 60; // minutes to seconds.
	2027	+ $reset_duration = $auth_settings['advanced_lockouts']['reset_duration'] * 60; // minutes to seconds
2244	2028	if ( $time_since_last_fail > $reset_duration ) {
2245	2029	$num_attempts = 0;
2246	2030	}
2247	2031
2248	2032	// Set last failed time to now and increment last failed count.
2249		- if ( false !== $user ) {
	2033	+ if ( $user !== FALSE ) {
2250	2034	update_user_meta( $user->ID, 'auth_settings_advanced_lockouts_time_last_failed', time() );
2251	2035	update_user_meta( $user->ID, 'auth_settings_advanced_lockouts_failed_attempts', $num_attempts + 1 );
2252	2036	} else {
2253	2037	update_option( 'auth_settings_advanced_lockouts_time_last_failed', time() );
		@@ -2258,16 +2042,16 @@
2258	2042
2259	2043	/**
2260	2044	* When they successfully log in, make sure WordPress users are in the approved list.
2261	2045	*
2262		- * Action: wp_login
	2046	+ * @action wp_login
2263	2047	*
2264	2048	* @param string $user_login Username of the user logging in.
2265		- * @param object $user WP_User object of the user logging in.
2266		- * @return void
	2049	+ * @param WP_User $user WP_User object of the user logging in.
	2050	+ * @return null
2267	2051	*/
2268		- public function ensure_wordpress_user_in_approved_list_on_login( $user_login, $user ) {
2269		- $this->add_user_to_authorizer_when_created( $user->user_email, $user->user_registered, $user->roles );
	2052	+ function ensure_wordpress_user_in_approved_list_on_login( $user_login, $user ) {
	2053	+ $this->add_user_to_authorizer_when_created( $user->user_email, $user->user_registered, $user->user_roles );
2270	2054	}
2271	2055
2272	2056
2273	2057	/**
		@@ -2273,17 +2057,12 @@
2273	2057	/**
2274	2058	* Overwrite the URL for the lost password link on the login form.
2275	2059	* If we're authenticating against an external service, standard
2276	2060	* WordPress password resets won't work.
2277		- *
2278		- * Filter: lostpassword_url
2279		- *
2280		- * @param string $lostpassword_url URL to reset password.
2281		- * @return string URL to reset password.
2282	2061	*/
2283		- public function custom_lostpassword_url( $lostpassword_url ) {
	2062	+ function custom_lostpassword_url( $lostpassword_url ) {
2284	2063	// Grab plugin settings.
2285		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
	2064	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' );
2286	2065
2287	2066	if (
2288	2067	array_key_exists( 'ldap_lostpassword_url', $auth_settings ) &&
2289	2068	filter_var( $auth_settings['ldap_lostpassword_url'], FILTER_VALIDATE_URL )
		@@ -2306,16 +2085,15 @@
2306	2085	/**
2307	2086	* Add a link to this plugin's settings page from the WordPress Plugins page.
2308	2087	* Called from "plugin_action_links" filter in __construct() above.
2309	2088	*
2310		- * Filter: plugin_action_links_authorizer.php
	2089	+ * @param array $links array of links in the admin sidebar
2311	2090	*
2312		- * @param array $links Admin sidebar links.
2313		- * @return array Admin sidebar links with Authorizer added.
	2091	+ * @return array of links to show in the admin sidebar.
2314	2092	*/
2315	2093	public function plugin_settings_link( $links ) {
2316		- $admin_menu = $this->get_plugin_option( 'advanced_admin_menu' );
2317		- $settings_url = 'settings' === $admin_menu ? admin_url( 'options-general.php?page=authorizer' ) : admin_url( 'admin.php?page=authorizer' );
	2094	+ $admin_menu = $this->get_plugin_option( 'advanced_admin_menu' );
	2095	+ $settings_url = $admin_menu === 'settings' ? admin_url( 'options-general.php?page=authorizer' ) : admin_url( 'admin.php?page=authorizer' );
2318	2096	array_unshift( $links, '<a href="' . $settings_url . '">' . __( 'Settings', 'authorizer' ) . '</a>' );
2319	2097	return $links;
2320	2098	}
2321	2099
		@@ -2323,12 +2101,11 @@
2323	2101	/**
2324	2102	* Add a link to this plugin's network settings page from the WordPress Plugins page.
2325	2103	* Called from "network_admin_plugin_action_links" filter in __construct() above.
2326	2104	*
2327		- * Filter: network_admin_plugin_action_links_authorizer.php
	2105	+ * @param array $links array of links in the network admin sidebar
2328	2106	*
2329		- * @param array $links Network admin sidebar links.
2330		- * @return array Network admin sidebar links with Authorizer added.
	2107	+ * @return array of links to show in the network admin sidebar.
2331	2108	*/
2332	2109	public function network_admin_plugin_settings_link( $links ) {
2333	2110	$settings_link = '<a href="admin.php?page=authorizer">' . __( 'Network Settings', 'authorizer' ) . '</a>';
2334	2111	array_unshift( $links, $settings_link );
		@@ -2336,33 +2113,32 @@
2336	2113	}
2337	2114
2338	2115
2339	2116	/**
2340		- * Create the options page under Dashboard > Settings.
2341		- *
2342		- * Action: admin_menu
	2117	+ * Create the options page under Dashboard > Settings
	2118	+ * Run on action hook: admin_menu
2343	2119	*/
2344	2120	public function add_plugin_page() {
2345	2121	$admin_menu = $this->get_plugin_option( 'advanced_admin_menu' );
2346		- if ( 'settings' === $admin_menu ) {
	2122	+ if ( $admin_menu === 'settings' ) {
2347	2123	// @see http://codex.wordpress.org/Function_Reference/add_options_page
2348	2124	add_options_page(
2349		- 'Authorizer',
2350		- 'Authorizer',
2351		- 'create_users',
2352		- 'authorizer',
2353		- array( $this, 'create_admin_page' )
	2125	+ 'Authorizer', // Page title
	2126	+ 'Authorizer', // Menu title
	2127	+ 'create_users', // Capability
	2128	+ 'authorizer', // Menu slug
	2129	+ array( $this, 'create_admin_page' ) // function
2354	2130	);
2355	2131	} else {
2356	2132	// @see http://codex.wordpress.org/Function_Reference/add_menu_page
2357	2133	add_menu_page(
2358		- 'Authorizer',
2359		- 'Authorizer',
2360		- 'create_users',
2361		- 'authorizer',
2362		- array( $this, 'create_admin_page' ),
2363		- 'dashicons-groups',
2364		- '99.0018465' // position (decimal is to make overlap with other plugins less likely).
	2134	+ 'Authorizer', // Page title
	2135	+ 'Authorizer', // Menu title
	2136	+ 'create_users', // Capability
	2137	+ 'authorizer', // Menu slug
	2138	+ array( $this, 'create_admin_page' ), // callback
	2139	+ 'dashicons-groups', // icon
	2140	+ '99.0018465' // position (decimal is to make overlap with other plugins less likely)
2365	2141	);
2366	2142	}
2367	2143	}
2368	2144
		@@ -2367,75 +2143,56 @@
2367	2143	}
2368	2144
2369	2145
2370	2146	/**
2371		- * Output the HTML for the options page.
	2147	+ * Output the HTML for the options page
2372	2148	*/
2373		- public function create_admin_page() {
2374		- ?>
	2149	+ public function create_admin_page() { ?>
2375	2150	<div class="wrap">
2376		- <h2><?php esc_html_e( 'Authorizer Settings', 'authorizer' ); ?></h2>
2377		- <form method="post" action="options.php" autocomplete="off">
2378		- <?php
2379		- // This prints out all hidden settings fields.
	2151	+ <h2><?php _e( 'Authorizer Settings', 'authorizer' ); ?></h2>
	2152	+ <form method="post" action="options.php" autocomplete="off"><?php
	2153	+ // This prints out all hidden settings fields
	2154	+ // @see http://codex.wordpress.org/Function_Reference/settings_fields
2380	2155	settings_fields( 'auth_settings_group' );
2381		- // This prints out all the sections.
	2156	+ // This prints out all the sections
	2157	+ // @see http://codex.wordpress.org/Function_Reference/do_settings_sections
2382	2158	do_settings_sections( 'authorizer' );
2383		- submit_button();
2384		- ?>
	2159	+ submit_button(); ?>
2385	2160	</form>
2386		- </div>
2387		- <?php
	2161	+ </div><?php
2388	2162	}
2389	2163
2390	2164
2391	2165	/**
2392	2166	* Load external resources on this plugin's options page.
2393		- *
2394		- * Action: load-settings_page_authorizer
2395		- * Action: load-toplevel_page_authorizer
2396		- * Action: admin_head-index.php
	2167	+ * Run on action hooks: load-settings_page_authorizer, load-toplevel_page_authorizer, admin_head-index.php
2397	2168	*/
2398	2169	public function load_options_page() {
2399	2170	wp_enqueue_script(
2400	2171	'authorizer',
2401	2172	plugins_url( 'js/authorizer.js', __FILE__ ),
2402		- array( 'jquery-effects-shake' ), '2.8.0', true
	2173	+ array( 'jquery-effects-shake' ), '2.3.2', true
2403	2174	);
2404		- wp_localize_script(
2405		- 'authorizer', 'authL10n', array(
2406		- 'baseurl' => get_bloginfo( 'url' ),
2407		- 'saved' => esc_html__( 'Saved', 'authorizer' ),
2408		- 'duplicate' => esc_html__( 'Duplicate', 'authorizer' ),
2409		- 'failed' => esc_html__( 'Failed', 'authorizer' ),
2410		- 'local_wordpress_user' => esc_html__( 'Local WordPress user', 'authorizer' ),
2411		- 'block_ban_user' => esc_html__( 'Block/Ban user', 'authorizer' ),
2412		- 'remove_user' => esc_html__( 'Remove user', 'authorizer' ),
2413		- 'no_users_in' => esc_html__( 'No users in', 'authorizer' ),
2414		- 'save_changes' => esc_html__( 'Save Changes', 'authorizer' ),
2415		- 'private_pages' => esc_html__( 'Private Pages', 'authorizer' ),
2416		- 'public_pages' => esc_html__( 'Public Pages', 'authorizer' ),
2417		- 'first_page' => esc_html__( 'First page' ),
2418		- 'previous_page' => esc_html__( 'Previous page' ),
2419		- 'next_page' => esc_html__( 'Next page' ),
2420		- 'last_page' => esc_html__( 'Last page' ),
2421		- 'is_network_admin' => is_network_admin() ? '1' : '0',
2422		- )
2423		- );
	2175	+ wp_localize_script( 'authorizer', 'auth_L10n', array(
	2176	+ 'baseurl' => get_bloginfo( 'url' ),
	2177	+ 'saved' => esc_html__( 'Saved', 'authorizer' ),
	2178	+ 'failed' => esc_html__( 'Failed', 'authorizer' ),
	2179	+ 'local_wordpress_user' => esc_html__( 'Local WordPress user', 'authorizer' ),
	2180	+ 'block_ban_user' => esc_html__( 'Block/Ban user', 'authorizer' ),
	2181	+ 'remove_user' => esc_html__( 'Remove user', 'authorizer' ),
	2182	+ 'no_users_in' => esc_html__( 'No users in', 'authorizer' ),
	2183	+ 'save_changes' => esc_html__( 'Save Changes', 'authorizer' ),
	2184	+ 'private_pages' => esc_html__( 'Private Pages', 'authorizer' ),
	2185	+ 'public_pages' => esc_html__( 'Public Pages', 'authorizer' ),
	2186	+ ));
2424	2187
2425	2188	wp_enqueue_script(
2426		- 'jquery-autogrow-textarea',
2427		- plugins_url( 'vendor/jquery.autogrow-textarea/jquery.autogrow-textarea.js', __FILE__ ),
2428		- array( 'jquery' ), '2.7.0', true
2429		- );
2430		-
2431		- wp_enqueue_script(
2432	2189	'jquery.multi-select',
2433	2190	plugins_url( 'vendor/jquery.multi-select/js/jquery.multi-select.js', __FILE__ ),
2434	2191	array( 'jquery' ), '1.8', true
2435	2192	);
2436	2193
2437		- wp_register_style( 'authorizer-css', plugins_url( 'css/authorizer.css', __FILE__ ), array(), '2.7.3' );
	2194	+ wp_register_style( 'authorizer-css', plugins_url( 'css/authorizer.css', __FILE__ ), array(), '2.3.2' );
2438	2195	wp_enqueue_style( 'authorizer-css' );
2439	2196
2440	2197	wp_register_style( 'jquery-multi-select-css', plugins_url( 'vendor/jquery.multi-select/css/multi-select.css', __FILE__ ), array(), '1.8' );
2441	2198	wp_enqueue_style( 'jquery-multi-select-css' );
		@@ -2446,26 +2203,18 @@
2446	2203
2447	2204
2448	2205	/**
2449	2206	* Show custom admin notice.
2450		- *
2451		- * Note: currently unused, but if anywhere we:
2452		- * add_option( 'auth_settings_advanced_admin_notice, 'Your message.' );
2453		- * It will display and then delete that message on the admin dashboard.
2454		- *
2455		- * Filter: admin_notices
2456		- * filter: network_admin_notices
	2207	+ * Filter: admin_notice
2457	2208	*/
2458		- public function show_advanced_admin_notice() {
	2209	+ function show_advanced_admin_notice() {
2459	2210	$notice = get_option( 'auth_settings_advanced_admin_notice' );
2460	2211	delete_option( 'auth_settings_advanced_admin_notice' );
2461	2212
2462		- if ( $notice && strlen( $notice ) > 0 ) {
2463		- ?>
	2213	+ if ( $notice && strlen( $notice ) > 0 ) { ?>
2464	2214	<div class="error">
2465		- <p><?php echo wp_kses( $notice, $this->allowed_html ); ?></p>
2466		- </div>
2467		- <?php
	2215	+ <p><?php echo $notice; ?></p>
	2216	+ </div><?php
2468	2217	}
2469	2218	}
2470	2219
2471	2220
		@@ -2470,11 +2219,9 @@
2470	2219
2471	2220
2472	2221	/**
2473	2222	* Add notices to the top of the options page.
2474		- *
2475		- * Action: load-settings_page_authorizer > admin_notices
2476		- *
	2223	+ * Run on action hook chain: load-settings_page_authorizer > admin_notices
2477	2224	* Description: Check for invalid settings combinations and show a warning message, e.g.:
2478	2225	* if ( cas url inaccessible ) : ?>
2479	2226	* <div class='updated settings-error'><p>Can't reach CAS server.</p></div>
2480	2227	* <?php endif;
		@@ -2480,23 +2227,20 @@
2480	2227	* <?php endif;
2481	2228	*/
2482	2229	public function admin_notices() {
2483	2230	// Grab plugin settings.
2484		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
	2231	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' );
2485	2232
2486		- if ( '1' === $auth_settings['cas'] ) :
	2233	+ if ( $auth_settings['cas'] === '1' ) :
2487	2234	// Check if provided CAS URL is accessible.
2488		- $protocol = in_array( strval( $auth_settings['cas_port'] ), array( '80', '8080' ), true ) ? 'http' : 'https';
2489		- $cas_url = $protocol . '://' . $auth_settings['cas_host'] . ':' . $auth_settings['cas_port'] . $auth_settings['cas_path'];
2490		- $legacy_cas_url = trailingslashit( $cas_url ) . 'login'; // Check the specific CAS login endpoint (old; some servers don't register a ./login endpoint, use serviceValidate instead).
2491		- $cas_url = trailingslashit( $cas_url ) . 'serviceValidate'; // Check the specific CAS login endpoint.
2492		- if ( ! $this->url_is_accessible( $cas_url ) && ! $this->url_is_accessible( $legacy_cas_url ) ) :
2493		- $authorizer_options_url = 'settings' === $auth_settings['advanced_admin_menu'] ? admin_url( 'options-general.php?page=authorizer' ) : admin_url( '?page=authorizer' );
2494		- ?>
2495		- <div class='notice notice-warning is-dismissible'>
2496		- <p><?php esc_html_e( "Can't reach CAS server. Please provide", 'authorizer' ); ?> <a href='<?php echo esc_attr( $authorizer_options_url ); ?>&tab=external'><?php esc_html_e( 'accurate CAS settings', 'authorizer' ); ?></a> <?php esc_html_e( 'if you intend to use it.', 'authorizer' ); ?></p>
2497		- </div>
2498		- <?php
	2235	+ $protocol = in_array( $auth_settings['cas_port'], array( '80', '8080' ) ) ? 'http' : 'https';
	2236	+ $cas_url = $protocol . '://' . $auth_settings['cas_host'] . ':' . $auth_settings['cas_port'] . $auth_settings['cas_path'];
	2237	+ $cas_url = trailingslashit( $cas_url ) . 'login'; // Check the specific CAS login endpoint
	2238	+ if ( ! $this->url_is_accessible( $cas_url ) ) :
	2239	+ $authorizer_options_url = $auth_settings['advanced_admin_menu'] === 'settings' ? admin_url( 'options-general.php?page=authorizer' ) : admin_url( '?page=authorizer' );
	2240	+ ?><div class='notice notice-warning is-dismissible'>
	2241	+ <p><?php _e( "Can't reach CAS server. Please provide", 'authorizer' ); ?> <a href='<?php echo $authorizer_options_url; ?>&tab=external'><?php _e( 'accurate CAS settings', 'authorizer' ); ?></a> <?php _e( 'if you intend to use it.', 'authorizer' ); ?></p>
	2242	+ </div><?php
2499	2243	endif;
2500	2244	endif;
2501	2245	}
2502	2246
		@@ -2501,430 +2245,399 @@
2501	2245	}
2502	2246
2503	2247
2504	2248	/**
2505		- * Create sections and options.
2506		- *
2507		- * Action: admin_init
	2249	+ * Create sections and options
	2250	+ * Run on action hook: admin_init
2508	2251	*/
2509	2252	public function page_init() {
2510		- /**
2511		- * Create one setting that holds all the options (array).
2512		- *
2513		- * @see http://codex.wordpress.org/Function_Reference/register_setting
2514		- * @see http://codex.wordpress.org/Function_Reference/add_settings_section
2515		- * @see http://codex.wordpress.org/Function_Reference/add_settings_field
2516		- */
	2253	+ // Create one setting that holds all the options (array)
	2254	+ // @see http://codex.wordpress.org/Function_Reference/register_setting
	2255	+ // @see http://codex.wordpress.org/Function_Reference/add_settings_section
	2256	+ // @see http://codex.wordpress.org/Function_Reference/add_settings_field
2517	2257	register_setting(
2518		- 'auth_settings_group',
2519		- 'auth_settings',
2520		- array( $this, 'sanitize_options' )
	2258	+ 'auth_settings_group', // Option group
	2259	+ 'auth_settings', // Option name
	2260	+ array( $this, 'sanitize_options' ) // Sanitize callback
2521	2261	);
2522	2262
2523	2263	add_settings_section(
2524		- 'auth_settings_tabs',
2525		- '',
2526		- array( $this, 'print_section_info_tabs' ),
2527		- 'authorizer'
	2264	+ 'auth_settings_tabs', // HTML element ID
	2265	+ '', // HTML element Title
	2266	+ array( $this, 'print_section_info_tabs' ), // Callback (echos section content)
	2267	+ 'authorizer' // Page this section is shown on (slug)
2528	2268	);
2529	2269
2530		- // Create Access Lists section.
	2270	+ // Create Access Lists section
2531	2271	add_settings_section(
2532		- 'auth_settings_lists',
2533		- '',
2534		- array( $this, 'print_section_info_access_lists' ),
2535		- 'authorizer'
	2272	+ 'auth_settings_lists', // HTML element ID
	2273	+ '', // HTML element Title
	2274	+ array( $this, 'print_section_info_access_lists' ), // Callback (echos section content)
	2275	+ 'authorizer' // Page this section is shown on (slug)
2536	2276	);
2537	2277
2538		- // Create Login Access section.
	2278	+ // Create Login Access section
2539	2279	add_settings_section(
2540		- 'auth_settings_access_login',
2541		- '',
2542		- array( $this, 'print_section_info_access_login' ),
2543		- 'authorizer'
	2280	+ 'auth_settings_access_login', // HTML element ID
	2281	+ '', // HTML element Title
	2282	+ array( $this, 'print_section_info_access_login' ), // Callback (echos section content)
	2283	+ 'authorizer' // Page this section is shown on (slug)
2544	2284	);
2545	2285	add_settings_field(
2546		- 'auth_settings_access_who_can_login',
2547		- __( 'Who can log into the site?', 'authorizer' ),
2548		- array( $this, 'print_radio_auth_access_who_can_login' ),
2549		- 'authorizer',
2550		- 'auth_settings_access_login'
	2286	+ 'auth_settings_access_who_can_login', // HTML element ID
	2287	+ __( 'Who can log into the site?', 'authorizer' ), // HTML element Title
	2288	+ array( $this, 'print_radio_auth_access_who_can_login' ), // Callback (echos form element)
	2289	+ 'authorizer', // Page this setting is shown on (slug)
	2290	+ 'auth_settings_access_login' // Section this setting is shown on
2551	2291	);
2552	2292	add_settings_field(
2553		- 'auth_settings_access_role_receive_pending_emails',
2554		- __( 'Which role should receive email notifications about pending users?', 'authorizer' ),
2555		- array( $this, 'print_select_auth_access_role_receive_pending_emails' ),
2556		- 'authorizer',
2557		- 'auth_settings_access_login'
	2293	+ 'auth_settings_access_role_receive_pending_emails', // HTML element ID
	2294	+ __( 'Which role should receive email notifications about pending users?', 'authorizer' ), // HTML element Title
	2295	+ array( $this, 'print_select_auth_access_role_receive_pending_emails' ), // Callback (echos form element)
	2296	+ 'authorizer', // Page this setting is shown on (slug)
	2297	+ 'auth_settings_access_login' // Section this setting is shown on
2558	2298	);
2559	2299	add_settings_field(
2560		- 'auth_settings_access_pending_redirect_to_message',
2561		- __( 'What message should pending users see after attempting to log in?', 'authorizer' ),
2562		- array( $this, 'print_wysiwyg_auth_access_pending_redirect_to_message' ),
2563		- 'authorizer',
2564		- 'auth_settings_access_login'
	2300	+ 'auth_settings_access_pending_redirect_to_message', // HTML element ID
	2301	+ __( 'What message should pending users see after attempting to log in?', 'authorizer' ), // HTML element Title
	2302	+ array( $this, 'print_wysiwyg_auth_access_pending_redirect_to_message' ), // Callback (echos form element)
	2303	+ 'authorizer', // Page this setting is shown on (slug)
	2304	+ 'auth_settings_access_login' // Section this setting is shown on
2565	2305	);
2566	2306	add_settings_field(
2567		- 'auth_settings_access_blocked_redirect_to_message',
2568		- __( 'What message should blocked users see after attempting to log in?', 'authorizer' ),
2569		- array( $this, 'print_wysiwyg_auth_access_blocked_redirect_to_message' ),
2570		- 'authorizer',
2571		- 'auth_settings_access_login'
	2307	+ 'auth_settings_access_blocked_redirect_to_message', // HTML element ID
	2308	+ __( 'What message should blocked users see after attempting to log in?', 'authorizer' ), // HTML element Title
	2309	+ array( $this, 'print_wysiwyg_auth_access_blocked_redirect_to_message' ), // Callback (echos form element)
	2310	+ 'authorizer', // Page this setting is shown on (slug)
	2311	+ 'auth_settings_access_login' // Section this setting is shown on
2572	2312	);
2573	2313	add_settings_field(
2574		- 'auth_settings_access_should_email_approved_users',
2575		- __( 'Send welcome email to new approved users?', 'authorizer' ),
2576		- array( $this, 'print_checkbox_auth_access_should_email_approved_users' ),
2577		- 'authorizer',
2578		- 'auth_settings_access_login'
	2314	+ 'auth_settings_access_should_email_approved_users', // HTML element ID
	2315	+ __( 'Send welcome email to new approved users?', 'authorizer' ), // HTML element Title
	2316	+ array( $this, 'print_checkbox_auth_access_should_email_approved_users' ), // Callback (echos form element)
	2317	+ 'authorizer', // Page this setting is shown on (slug)
	2318	+ 'auth_settings_access_login' // Section this setting is shown on
2579	2319	);
2580	2320	add_settings_field(
2581		- 'auth_settings_access_email_approved_users_subject',
2582		- __( 'Welcome email subject', 'authorizer' ),
2583		- array( $this, 'print_text_auth_access_email_approved_users_subject' ),
2584		- 'authorizer',
2585		- 'auth_settings_access_login'
	2321	+ 'auth_settings_access_email_approved_users_subject', // HTML element ID
	2322	+ __( 'Welcome email subject', 'authorizer' ), // HTML element Title
	2323	+ array( $this, 'print_text_auth_access_email_approved_users_subject' ), // Callback (echos form element)
	2324	+ 'authorizer', // Page this setting is shown on (slug)
	2325	+ 'auth_settings_access_login' // Section this setting is shown on
2586	2326	);
2587	2327	add_settings_field(
2588		- 'auth_settings_access_email_approved_users_body',
2589		- __( 'Welcome email body', 'authorizer' ),
2590		- array( $this, 'print_wysiwyg_auth_access_email_approved_users_body' ),
2591		- 'authorizer',
2592		- 'auth_settings_access_login'
	2328	+ 'auth_settings_access_email_approved_users_body', // HTML element ID
	2329	+ __( 'Welcome email body', 'authorizer' ), // HTML element Title
	2330	+ array( $this, 'print_wysiwyg_auth_access_email_approved_users_body' ), // Callback (echos form element)
	2331	+ 'authorizer', // Page this setting is shown on (slug)
	2332	+ 'auth_settings_access_login' // Section this setting is shown on
2593	2333	);
2594	2334
2595		- // Create Public Access section.
	2335	+
	2336	+ // Create Public Access section
2596	2337	add_settings_section(
2597		- 'auth_settings_access_public',
2598		- '',
2599		- array( $this, 'print_section_info_access_public' ),
2600		- 'authorizer'
	2338	+ 'auth_settings_access_public', // HTML element ID
	2339	+ '', // HTML element Title
	2340	+ array( $this, 'print_section_info_access_public' ), // Callback (echos section content)
	2341	+ 'authorizer' // Page this section is shown on (slug)
2601	2342	);
2602	2343	add_settings_field(
2603		- 'auth_settings_access_who_can_view',
2604		- __( 'Who can view the site?', 'authorizer' ),
2605		- array( $this, 'print_radio_auth_access_who_can_view' ),
2606		- 'authorizer',
2607		- 'auth_settings_access_public'
	2344	+ 'auth_settings_access_who_can_view', // HTML element ID
	2345	+ __( 'Who can view the site?', 'authorizer' ), // HTML element Title
	2346	+ array( $this, 'print_radio_auth_access_who_can_view' ), // Callback (echos form element)
	2347	+ 'authorizer', // Page this setting is shown on (slug)
	2348	+ 'auth_settings_access_public' // Section this setting is shown on
2608	2349	);
2609	2350	add_settings_field(
2610		- 'auth_settings_access_public_pages',
2611		- __( 'What pages (if any) should be available to everyone?', 'authorizer' ),
2612		- array( $this, 'print_multiselect_auth_access_public_pages' ),
2613		- 'authorizer',
2614		- 'auth_settings_access_public'
	2351	+ 'auth_settings_access_public_pages', // HTML element ID
	2352	+ __( 'What pages (if any) should be available to everyone?', 'authorizer' ), // HTML element Title
	2353	+ array( $this, 'print_multiselect_auth_access_public_pages' ), // Callback (echos form element)
	2354	+ 'authorizer', // Page this setting is shown on (slug)
	2355	+ 'auth_settings_access_public' // Section this setting is shown on
2615	2356	);
2616	2357	add_settings_field(
2617		- 'auth_settings_access_redirect',
2618		- __( 'What happens to people without access when they visit a private page?', 'authorizer' ),
2619		- array( $this, 'print_radio_auth_access_redirect' ),
2620		- 'authorizer',
2621		- 'auth_settings_access_public'
	2358	+ 'auth_settings_access_redirect', // HTML element ID
	2359	+ __( 'What happens to people without access when they visit a private page?', 'authorizer' ), // HTML element Title
	2360	+ array( $this, 'print_radio_auth_access_redirect' ), // Callback (echos form element)
	2361	+ 'authorizer', // Page this setting is shown on (slug)
	2362	+ 'auth_settings_access_public' // Section this setting is shown on
2622	2363	);
2623	2364	add_settings_field(
2624		- 'auth_settings_access_public_warning',
2625		- __( 'What happens to people without access when they visit a public page?', 'authorizer' ),
2626		- array( $this, 'print_radio_auth_access_public_warning' ),
2627		- 'authorizer',
2628		- 'auth_settings_access_public'
	2365	+ 'auth_settings_access_public_warning', // HTML element ID
	2366	+ __( 'What happens to people without access when they visit a public page?', 'authorizer' ), // HTML element Title
	2367	+ array( $this, 'print_radio_auth_access_public_warning' ), // Callback (echos form element)
	2368	+ 'authorizer', // Page this setting is shown on (slug)
	2369	+ 'auth_settings_access_public' // Section this setting is shown on
2629	2370	);
2630	2371	add_settings_field(
2631		- 'auth_settings_access_redirect_to_message',
2632		- __( 'What message should people without access see?', 'authorizer' ),
2633		- array( $this, 'print_wysiwyg_auth_access_redirect_to_message' ),
2634		- 'authorizer',
2635		- 'auth_settings_access_public'
	2372	+ 'auth_settings_access_redirect_to_message', // HTML element ID
	2373	+ __( 'What message should people without access see?', 'authorizer' ), // HTML element Title
	2374	+ array( $this, 'print_wysiwyg_auth_access_redirect_to_message' ), // Callback (echos form element)
	2375	+ 'authorizer', // Page this setting is shown on (slug)
	2376	+ 'auth_settings_access_public' // Section this setting is shown on
2636	2377	);
2637	2378
2638		- // Create External Service Settings section.
	2379	+ // Create External Service Settings section
2639	2380	add_settings_section(
2640		- 'auth_settings_external',
2641		- '',
2642		- array( $this, 'print_section_info_external' ),
2643		- 'authorizer'
	2381	+ 'auth_settings_external', // HTML element ID
	2382	+ '', // HTML element Title
	2383	+ array( $this, 'print_section_info_external' ), // Callback (echos section content)
	2384	+ 'authorizer' // Page this section is shown on (slug)
2644	2385	);
2645	2386	add_settings_field(
2646		- 'auth_settings_access_default_role',
2647		- __( 'Default role for new users', 'authorizer' ),
2648		- array( $this, 'print_select_auth_access_default_role' ),
2649		- 'authorizer',
2650		- 'auth_settings_external'
	2387	+ 'auth_settings_access_default_role', // HTML element ID
	2388	+ __( 'Default role for new users', 'authorizer' ), // HTML element Title
	2389	+ array( $this, 'print_select_auth_access_default_role' ), // Callback (echos form element)
	2390	+ 'authorizer', // Page this setting is shown on (slug)
	2391	+ 'auth_settings_external' // Section this setting is shown on
2651	2392	);
2652	2393	add_settings_field(
2653		- 'auth_settings_external_google',
2654		- __( 'Google Logins', 'authorizer' ),
2655		- array( $this, 'print_checkbox_auth_external_google' ),
2656		- 'authorizer',
2657		- 'auth_settings_external'
	2394	+ 'auth_settings_external_google', // HTML element ID
	2395	+ __( 'Google Logins', 'authorizer' ), // HTML element Title
	2396	+ array( $this, 'print_checkbox_auth_external_google' ), // Callback (echos form element)
	2397	+ 'authorizer', // Page this setting is shown on (slug)
	2398	+ 'auth_settings_external' // Section this setting is shown on
2658	2399	);
2659	2400	add_settings_field(
2660		- 'auth_settings_google_clientid',
2661		- __( 'Google Client ID', 'authorizer' ),
2662		- array( $this, 'print_text_google_clientid' ),
2663		- 'authorizer',
2664		- 'auth_settings_external'
	2401	+ 'auth_settings_google_clientid', // HTML element ID
	2402	+ __( 'Google Client ID', 'authorizer' ), // HTML element Title
	2403	+ array( $this, 'print_text_google_clientid' ), // Callback (echos form element)
	2404	+ 'authorizer', // Page this setting is shown on (slug)
	2405	+ 'auth_settings_external' // Section this setting is shown on
2665	2406	);
2666	2407	add_settings_field(
2667		- 'auth_settings_google_clientsecret',
2668		- __( 'Google Client Secret', 'authorizer' ),
2669		- array( $this, 'print_text_google_clientsecret' ),
2670		- 'authorizer',
2671		- 'auth_settings_external'
	2408	+ 'auth_settings_google_clientsecret', // HTML element ID
	2409	+ __( 'Google Client Secret', 'authorizer' ), // HTML element Title
	2410	+ array( $this, 'print_text_google_clientsecret' ), // Callback (echos form element)
	2411	+ 'authorizer', // Page this setting is shown on (slug)
	2412	+ 'auth_settings_external' // Section this setting is shown on
2672	2413	);
2673	2414	add_settings_field(
2674		- 'auth_settings_google_hosteddomain',
2675		- __( 'Google Hosted Domain', 'authorizer' ),
2676		- array( $this, 'print_text_google_hosteddomain' ),
2677		- 'authorizer',
2678		- 'auth_settings_external'
	2415	+ 'auth_settings_google_hosteddomain', // HTML element ID
	2416	+ __( 'Google Hosted Domain', 'authorizer' ), // HTML element Title
	2417	+ array( $this, 'print_text_google_hosteddomain' ), // Callback (echos form element)
	2418	+ 'authorizer', // Page this setting is shown on (slug)
	2419	+ 'auth_settings_external' // Section this setting is shown on
2679	2420	);
2680	2421	add_settings_field(
2681		- 'auth_settings_external_cas',
2682		- __( 'CAS Logins', 'authorizer' ),
2683		- array( $this, 'print_checkbox_auth_external_cas' ),
2684		- 'authorizer',
2685		- 'auth_settings_external'
	2422	+ 'auth_settings_external_cas', // HTML element ID
	2423	+ __( 'CAS Logins', 'authorizer' ), // HTML element Title
	2424	+ array( $this, 'print_checkbox_auth_external_cas' ), // Callback (echos form element)
	2425	+ 'authorizer', // Page this setting is shown on (slug)
	2426	+ 'auth_settings_external' // Section this setting is shown on
2686	2427	);
2687	2428	add_settings_field(
2688		- 'auth_settings_cas_custom_label',
2689		- __( 'CAS custom label', 'authorizer' ),
2690		- array( $this, 'print_text_cas_custom_label' ),
2691		- 'authorizer',
2692		- 'auth_settings_external'
	2429	+ 'auth_settings_cas_custom_label', // HTML element ID
	2430	+ __( 'CAS custom label', 'authorizer' ), // HTML element Title
	2431	+ array( $this, 'print_text_cas_custom_label' ), // Callback (echos form element)
	2432	+ 'authorizer', // Page this setting is shown on (slug)
	2433	+ 'auth_settings_external' // Section this setting is shown on
2693	2434	);
2694	2435	add_settings_field(
2695		- 'auth_settings_cas_host',
2696		- __( 'CAS server hostname', 'authorizer' ),
2697		- array( $this, 'print_text_cas_host' ),
2698		- 'authorizer',
2699		- 'auth_settings_external'
	2436	+ 'auth_settings_cas_host', // HTML element ID
	2437	+ __( 'CAS server hostname', 'authorizer' ), // HTML element Title
	2438	+ array( $this, 'print_text_cas_host' ), // Callback (echos form element)
	2439	+ 'authorizer', // Page this setting is shown on (slug)
	2440	+ 'auth_settings_external' // Section this setting is shown on
2700	2441	);
2701	2442	add_settings_field(
2702		- 'auth_settings_cas_port',
2703		- __( 'CAS server port', 'authorizer' ),
2704		- array( $this, 'print_text_cas_port' ),
2705		- 'authorizer',
2706		- 'auth_settings_external'
	2443	+ 'auth_settings_cas_port', // HTML element ID
	2444	+ __( 'CAS server port', 'authorizer' ), // HTML element Title
	2445	+ array( $this, 'print_text_cas_port' ), // Callback (echos form element)
	2446	+ 'authorizer', // Page this setting is shown on (slug)
	2447	+ 'auth_settings_external' // Section this setting is shown on
2707	2448	);
2708	2449	add_settings_field(
2709		- 'auth_settings_cas_path',
2710		- __( 'CAS server path/context', 'authorizer' ),
2711		- array( $this, 'print_text_cas_path' ),
2712		- 'authorizer',
2713		- 'auth_settings_external'
	2450	+ 'auth_settings_cas_path', // HTML element ID
	2451	+ __( 'CAS server path/context', 'authorizer' ), // HTML element Title
	2452	+ array( $this, 'print_text_cas_path' ), // Callback (echos form element)
	2453	+ 'authorizer', // Page this setting is shown on (slug)
	2454	+ 'auth_settings_external' // Section this setting is shown on
2714	2455	);
2715	2456	add_settings_field(
2716		- 'auth_settings_cas_version',
2717		- 'CAS server version',
2718		- array( $this, 'print_select_cas_version' ),
2719		- 'authorizer',
2720		- 'auth_settings_external'
	2457	+ 'auth_settings_cas_version', // HTML element ID
	2458	+ 'CAS server version', // HTML element Title
	2459	+ array( $this, 'print_select_cas_version' ), // Callback (echos form element)
	2460	+ 'authorizer', // Page this setting is shown on (slug)
	2461	+ 'auth_settings_external' // Section this setting is shown on
2721	2462	);
2722	2463	add_settings_field(
2723		- 'auth_settings_cas_attr_email',
2724		- __( 'CAS attribute containing email address', 'authorizer' ),
2725		- array( $this, 'print_text_cas_attr_email' ),
2726		- 'authorizer',
2727		- 'auth_settings_external'
	2464	+ 'auth_settings_cas_attr_email', // HTML element ID
	2465	+ __( 'CAS attribute containing email address', 'authorizer' ), // HTML element Title
	2466	+ array( $this, 'print_text_cas_attr_email' ), // Callback (echos form element)
	2467	+ 'authorizer', // Page this setting is shown on (slug)
	2468	+ 'auth_settings_external' // Section this setting is shown on
2728	2469	);
2729	2470	add_settings_field(
2730		- 'auth_settings_cas_attr_first_name',
2731		- __( 'CAS attribute containing first name', 'authorizer' ),
2732		- array( $this, 'print_text_cas_attr_first_name' ),
2733		- 'authorizer',
2734		- 'auth_settings_external'
	2471	+ 'auth_settings_cas_attr_first_name', // HTML element ID
	2472	+ __( 'CAS attribute containing first name', 'authorizer' ), // HTML element Title
	2473	+ array( $this, 'print_text_cas_attr_first_name' ), // Callback (echos form element)
	2474	+ 'authorizer', // Page this setting is shown on (slug)
	2475	+ 'auth_settings_external' // Section this setting is shown on
2735	2476	);
2736	2477	add_settings_field(
2737		- 'auth_settings_cas_attr_last_name',
2738		- __( 'CAS attribute containing last name', 'authorizer' ),
2739		- array( $this, 'print_text_cas_attr_last_name' ),
2740		- 'authorizer',
2741		- 'auth_settings_external'
	2478	+ 'auth_settings_cas_attr_last_name', // HTML element ID
	2479	+ __( 'CAS attribute containing last name', 'authorizer' ), // HTML element Title
	2480	+ array( $this, 'print_text_cas_attr_last_name' ), // Callback (echos form element)
	2481	+ 'authorizer', // Page this setting is shown on (slug)
	2482	+ 'auth_settings_external' // Section this setting is shown on
2742	2483	);
2743	2484	add_settings_field(
2744		- 'auth_settings_cas_attr_update_on_login',
2745		- __( 'CAS attribute update', 'authorizer' ),
2746		- array( $this, 'print_checkbox_cas_attr_update_on_login' ),
2747		- 'authorizer',
2748		- 'auth_settings_external'
	2485	+ 'auth_settings_cas_attr_update_on_login', // HTML element ID
	2486	+ __( 'CAS attribute update', 'authorizer' ), // HTML element Title
	2487	+ array( $this, 'print_checkbox_cas_attr_update_on_login' ), // Callback (echos form element)
	2488	+ 'authorizer', // Page this setting is shown on (slug)
	2489	+ 'auth_settings_external' // Section this setting is shown on
2749	2490	);
2750	2491	add_settings_field(
2751		- 'auth_settings_cas_auto_login',
2752		- __( 'CAS automatic login', 'authorizer' ),
2753		- array( $this, 'print_checkbox_cas_auto_login' ),
2754		- 'authorizer',
2755		- 'auth_settings_external'
	2492	+ 'auth_settings_cas_auto_login', // HTML element ID
	2493	+ __( 'CAS automatic login', 'authorizer' ), // HTML element Title
	2494	+ array( $this, 'print_checkbox_cas_auto_login' ), // Callback (echos form element)
	2495	+ 'authorizer', // Page this setting is shown on (slug)
	2496	+ 'auth_settings_external' // Section this setting is shown on
2756	2497	);
2757	2498	add_settings_field(
2758		- 'auth_settings_external_ldap',
2759		- __( 'LDAP Logins', 'authorizer' ),
2760		- array( $this, 'print_checkbox_auth_external_ldap' ),
2761		- 'authorizer',
2762		- 'auth_settings_external'
	2499	+ 'auth_settings_external_ldap', // HTML element ID
	2500	+ __( 'LDAP Logins', 'authorizer' ), // HTML element Title
	2501	+ array( $this, 'print_checkbox_auth_external_ldap' ), // Callback (echos form element)
	2502	+ 'authorizer', // Page this setting is shown on (slug)
	2503	+ 'auth_settings_external' // Section this setting is shown on
2763	2504	);
2764	2505	add_settings_field(
2765		- 'auth_settings_ldap_host',
2766		- __( 'LDAP Host', 'authorizer' ),
2767		- array( $this, 'print_text_ldap_host' ),
2768		- 'authorizer',
2769		- 'auth_settings_external'
	2506	+ 'auth_settings_ldap_host', // HTML element ID
	2507	+ __( 'LDAP Host', 'authorizer' ), // HTML element Title
	2508	+ array( $this, 'print_text_ldap_host' ), // Callback (echos form element)
	2509	+ 'authorizer', // Page this setting is shown on (slug)
	2510	+ 'auth_settings_external' // Section this setting is shown on
2770	2511	);
2771	2512	add_settings_field(
2772		- 'auth_settings_ldap_port',
2773		- __( 'LDAP Port', 'authorizer' ),
2774		- array( $this, 'print_text_ldap_port' ),
2775		- 'authorizer',
2776		- 'auth_settings_external'
	2513	+ 'auth_settings_ldap_port', // HTML element ID
	2514	+ __( 'LDAP Port', 'authorizer' ), // HTML element Title
	2515	+ array( $this, 'print_text_ldap_port' ), // Callback (echos form element)
	2516	+ 'authorizer', // Page this setting is shown on (slug)
	2517	+ 'auth_settings_external' // Section this setting is shown on
2777	2518	);
2778	2519	add_settings_field(
2779		- 'auth_settings_ldap_tls',
2780		- __( 'Use TLS', 'authorizer' ),
2781		- array( $this, 'print_checkbox_ldap_tls' ),
2782		- 'authorizer',
2783		- 'auth_settings_external'
	2520	+ 'auth_settings_ldap_tls', // HTML element ID
	2521	+ __( 'Secure Connection (TLS)', 'authorizer' ), // HTML element Title
	2522	+ array( $this, 'print_checkbox_ldap_tls' ), // Callback (echos form element)
	2523	+ 'authorizer', // Page this setting is shown on (slug)
	2524	+ 'auth_settings_external' // Section this setting is shown on
2784	2525	);
2785	2526	add_settings_field(
2786		- 'auth_settings_ldap_search_base',
2787		- __( 'LDAP Search Base', 'authorizer' ),
2788		- array( $this, 'print_text_ldap_search_base' ),
2789		- 'authorizer',
2790		- 'auth_settings_external'
	2527	+ 'auth_settings_ldap_search_base', // HTML element ID
	2528	+ __( 'LDAP Search Base', 'authorizer' ), // HTML element Title
	2529	+ array( $this, 'print_text_ldap_search_base' ), // Callback (echos form element)
	2530	+ 'authorizer', // Page this setting is shown on (slug)
	2531	+ 'auth_settings_external' // Section this setting is shown on
2791	2532	);
2792	2533	add_settings_field(
2793		- 'auth_settings_ldap_uid',
2794		- __( 'LDAP attribute containing username', 'authorizer' ),
2795		- array( $this, 'print_text_ldap_uid' ),
2796		- 'authorizer',
2797		- 'auth_settings_external'
	2534	+ 'auth_settings_ldap_uid', // HTML element ID
	2535	+ __( 'LDAP attribute containing username', 'authorizer' ), // HTML element Title
	2536	+ array( $this, 'print_text_ldap_uid' ), // Callback (echos form element)
	2537	+ 'authorizer', // Page this setting is shown on (slug)
	2538	+ 'auth_settings_external' // Section this setting is shown on
2798	2539	);
2799	2540	add_settings_field(
2800		- 'auth_settings_ldap_attr_email',
2801		- __( 'LDAP attribute containing email address', 'authorizer' ),
2802		- array( $this, 'print_text_ldap_attr_email' ),
2803		- 'authorizer',
2804		- 'auth_settings_external'
	2541	+ 'auth_settings_ldap_attr_email', // HTML element ID
	2542	+ __( 'LDAP attribute containing email address', 'authorizer' ), // HTML element Title
	2543	+ array( $this, 'print_text_ldap_attr_email' ), // Callback (echos form element)
	2544	+ 'authorizer', // Page this setting is shown on (slug)
	2545	+ 'auth_settings_external' // Section this setting is shown on
2805	2546	);
2806	2547	add_settings_field(
2807		- 'auth_settings_ldap_user',
2808		- __( 'LDAP Directory User', 'authorizer' ),
2809		- array( $this, 'print_text_ldap_user' ),
2810		- 'authorizer',
2811		- 'auth_settings_external'
	2548	+ 'auth_settings_ldap_user', // HTML element ID
	2549	+ __( 'LDAP Directory User', 'authorizer' ), // HTML element Title
	2550	+ array( $this, 'print_text_ldap_user' ), // Callback (echos form element)
	2551	+ 'authorizer', // Page this setting is shown on (slug)
	2552	+ 'auth_settings_external' // Section this setting is shown on
2812	2553	);
2813	2554	add_settings_field(
2814		- 'auth_settings_ldap_password',
2815		- __( 'LDAP Directory User Password', 'authorizer' ),
2816		- array( $this, 'print_password_ldap_password' ),
2817		- 'authorizer',
2818		- 'auth_settings_external'
	2555	+ 'auth_settings_ldap_password', // HTML element ID
	2556	+ __( 'LDAP Directory User Password', 'authorizer' ), // HTML element Title
	2557	+ array( $this, 'print_password_ldap_password' ), // Callback (echos form element)
	2558	+ 'authorizer', // Page this setting is shown on (slug)
	2559	+ 'auth_settings_external' // Section this setting is shown on
2819	2560	);
2820	2561	add_settings_field(
2821		- 'auth_settings_ldap_lostpassword_url',
2822		- __( 'Custom lost password URL', 'authorizer' ),
2823		- array( $this, 'print_text_ldap_lostpassword_url' ),
2824		- 'authorizer',
2825		- 'auth_settings_external'
	2562	+ 'auth_settings_ldap_lostpassword_url', // HTML element ID
	2563	+ __( 'Custom lost password URL', 'authorizer' ), // HTML element Title
	2564	+ array( $this, 'print_text_ldap_lostpassword_url' ), // Callback (echos form element)
	2565	+ 'authorizer', // Page this setting is shown on (slug)
	2566	+ 'auth_settings_external' // Section this setting is shown on
2826	2567	);
2827	2568	add_settings_field(
2828		- 'auth_settings_ldap_attr_first_name',
2829		- __( 'LDAP attribute containing first name', 'authorizer' ),
2830		- array( $this, 'print_text_ldap_attr_first_name' ),
2831		- 'authorizer',
2832		- 'auth_settings_external'
	2569	+ 'auth_settings_ldap_attr_first_name', // HTML element ID
	2570	+ __( 'LDAP attribute containing first name', 'authorizer' ), // HTML element Title
	2571	+ array( $this, 'print_text_ldap_attr_first_name' ), // Callback (echos form element)
	2572	+ 'authorizer', // Page this setting is shown on (slug)
	2573	+ 'auth_settings_external' // Section this setting is shown on
2833	2574	);
2834	2575	add_settings_field(
2835		- 'auth_settings_ldap_attr_last_name',
2836		- __( 'LDAP attribute containing last name', 'authorizer' ),
2837		- array( $this, 'print_text_ldap_attr_last_name' ),
2838		- 'authorizer',
2839		- 'auth_settings_external'
	2576	+ 'auth_settings_ldap_attr_last_name', // HTML element ID
	2577	+ __( 'LDAP attribute containing last name', 'authorizer' ), // HTML element Title
	2578	+ array( $this, 'print_text_ldap_attr_last_name' ), // Callback (echos form element)
	2579	+ 'authorizer', // Page this setting is shown on (slug)
	2580	+ 'auth_settings_external' // Section this setting is shown on
2840	2581	);
2841	2582	add_settings_field(
2842		- 'auth_settings_ldap_attr_update_on_login',
2843		- __( 'LDAP attribute update', 'authorizer' ),
2844		- array( $this, 'print_checkbox_ldap_attr_update_on_login' ),
2845		- 'authorizer',
2846		- 'auth_settings_external'
	2583	+ 'auth_settings_ldap_attr_update_on_login', // HTML element ID
	2584	+ __( 'LDAP attribute update', 'authorizer' ), // HTML element Title
	2585	+ array( $this, 'print_checkbox_ldap_attr_update_on_login' ), // Callback (echos form element)
	2586	+ 'authorizer', // Page this setting is shown on (slug)
	2587	+ 'auth_settings_external' // Section this setting is shown on
2847	2588	);
2848	2589
2849		- // Create Advanced Settings section.
	2590	+ // Create Advanced Settings section
2850	2591	add_settings_section(
2851		- 'auth_settings_advanced',
2852		- '',
2853		- array( $this, 'print_section_info_advanced' ),
2854		- 'authorizer'
	2592	+ 'auth_settings_advanced', // HTML element ID
	2593	+ '', // HTML element Title
	2594	+ array( $this, 'print_section_info_advanced' ), // Callback (echos section content)
	2595	+ 'authorizer' // Page this section is shown on (slug)
2855	2596	);
2856	2597	add_settings_field(
2857		- 'auth_settings_advanced_lockouts',
2858		- __( 'Limit invalid login attempts', 'authorizer' ),
2859		- array( $this, 'print_text_auth_advanced_lockouts' ),
2860		- 'authorizer',
2861		- 'auth_settings_advanced'
	2598	+ 'auth_settings_advanced_lockouts', // HTML element ID
	2599	+ __( 'Limit invalid login attempts', 'authorizer' ), // HTML element Title
	2600	+ array( $this, 'print_text_auth_advanced_lockouts' ), // Callback (echos form element)
	2601	+ 'authorizer', // Page this setting is shown on (slug)
	2602	+ 'auth_settings_advanced' // Section this setting is shown on
2862	2603	);
2863	2604	add_settings_field(
2864		- 'auth_settings_advanced_hide_wp_login',
2865		- __( 'Hide WordPress Login', 'authorizer' ),
2866		- array( $this, 'print_checkbox_auth_advanced_hide_wp_login' ),
2867		- 'authorizer',
2868		- 'auth_settings_advanced'
	2605	+ 'auth_settings_advanced_hide_wp_login', // HTML element ID
	2606	+ __( 'Hide WordPress Login', 'authorizer' ), // HTML element Title
	2607	+ array( $this, 'print_checkbox_auth_advanced_hide_wp_login' ), // Callback (echos form element)
	2608	+ 'authorizer', // Page this setting is shown on (slug)
	2609	+ 'auth_settings_advanced' // Section this setting is shown on
2869	2610	);
2870	2611	add_settings_field(
2871		- 'auth_settings_advanced_branding',
2872		- __( 'Custom WordPress login branding', 'authorizer' ),
2873		- array( $this, 'print_radio_auth_advanced_branding' ),
2874		- 'authorizer',
2875		- 'auth_settings_advanced'
	2612	+ 'auth_settings_advanced_branding', // HTML element ID
	2613	+ __( 'Custom WordPress login branding', 'authorizer' ), // HTML element Title
	2614	+ array( $this, 'print_radio_auth_advanced_branding' ), // Callback (echos form element)
	2615	+ 'authorizer', // Page this setting is shown on (slug)
	2616	+ 'auth_settings_advanced' // Section this setting is shown on
2876	2617	);
2877	2618	add_settings_field(
2878		- 'auth_settings_advanced_admin_menu',
2879		- __( 'Authorizer admin menu item location', 'authorizer' ),
2880		- array( $this, 'print_radio_auth_advanced_admin_menu' ),
2881		- 'authorizer',
2882		- 'auth_settings_advanced'
	2619	+ 'auth_settings_advanced_admin_menu', // HTML element ID
	2620	+ __( 'Authorizer admin menu item location', 'authorizer' ), // HTML element Title
	2621	+ array( $this, 'print_radio_auth_advanced_admin_menu' ), // Callback (echos form element)
	2622	+ 'authorizer', // Page this setting is shown on (slug)
	2623	+ 'auth_settings_advanced' // Section this setting is shown on
2883	2624	);
2884	2625	add_settings_field(
2885		- 'auth_settings_advanced_usermeta',
2886		- __( 'Show custom usermeta in user list', 'authorizer' ),
2887		- array( $this, 'print_select_auth_advanced_usermeta' ),
2888		- 'authorizer',
2889		- 'auth_settings_advanced'
	2626	+ 'auth_settings_advanced_usermeta', // HTML element ID
	2627	+ __( 'Show custom usermeta in user list', 'authorizer' ), // HTML element Title
	2628	+ array( $this, 'print_select_auth_advanced_usermeta' ), // Callback (echos form element)
	2629	+ 'authorizer', // Page this setting is shown on (slug)
	2630	+ 'auth_settings_advanced' // Section this setting is shown on
2890	2631	);
2891		- add_settings_field(
2892		- 'auth_settings_advanced_users_per_page',
2893		- __( 'Number of users per page', 'authorizer' ),
2894		- array( $this, 'print_text_auth_advanced_users_per_page' ),
2895		- 'authorizer',
2896		- 'auth_settings_advanced'
2897		- );
2898		- add_settings_field(
2899		- 'auth_settings_advanced_users_sort_by',
2900		- __( 'Approved users sort method', 'authorizer' ),
2901		- array( $this, 'print_select_auth_advanced_users_sort_by' ),
2902		- 'authorizer',
2903		- 'auth_settings_advanced'
2904		- );
2905		- add_settings_field(
2906		- 'auth_settings_advanced_users_sort_order',
2907		- __( 'Approved users sort order', 'authorizer' ),
2908		- array( $this, 'print_select_auth_advanced_users_sort_order' ),
2909		- 'authorizer',
2910		- 'auth_settings_advanced'
2911		- );
2912		- add_settings_field(
2913		- 'auth_settings_advanced_widget_enabled',
2914		- __( 'Show dashboard widget to admin users', 'authorizer' ),
2915		- array( $this, 'print_checkbox_auth_advanced_widget_enabled' ),
2916		- 'authorizer',
2917		- 'auth_settings_advanced'
2918		- );
2919	2632	// On multisite installs, add an option to override all multisite settings on individual sites.
2920	2633	if ( is_multisite() ) {
2921	2634	add_settings_field(
2922		- 'auth_settings_advanced_override_multisite',
2923		- __( 'Override multisite options', 'authorizer' ),
2924		- array( $this, 'print_checkbox_auth_advanced_override_multisite' ),
2925		- 'authorizer',
2926		- 'auth_settings_advanced'
	2635	+ 'auth_settings_advanced_override_multisite', // HTML element ID
	2636	+ __( 'Override multisite options', 'authorizer' ), // HTML element Title
	2637	+ array( $this, 'print_checkbox_auth_advanced_override_multisite' ), // Callback (echos form element)
	2638	+ 'authorizer', // Page this setting is shown on (slug)
	2639	+ 'auth_settings_advanced' // Section this setting is shown on
2927	2640	);
2928	2641	}
2929	2642	}
2930	2643
		@@ -2930,30 +2643,29 @@
2930	2643
2931	2644
2932	2645	/**
2933	2646	* Set meaningful defaults for the plugin options.
2934		- *
2935	2647	* Note: This function is called on plugin activation.
2936	2648	*/
2937		- private function set_default_options() {
	2649	+ function set_default_options() {
2938	2650	global $wp_roles;
2939	2651
2940	2652	$auth_settings = get_option( 'auth_settings' );
2941		- if ( false === $auth_settings ) {
	2653	+ if ( $auth_settings === FALSE ) {
2942	2654	$auth_settings = array();
2943	2655	}
2944	2656
2945	2657	// Access Lists Defaults.
2946	2658	$auth_settings_access_users_pending = get_option( 'auth_settings_access_users_pending' );
2947		- if ( false === $auth_settings_access_users_pending ) {
	2659	+ if ( $auth_settings_access_users_pending === FALSE ) {
2948	2660	$auth_settings_access_users_pending = array();
2949	2661	}
2950	2662	$auth_settings_access_users_approved = get_option( 'auth_settings_access_users_approved' );
2951		- if ( false === $auth_settings_access_users_approved ) {
	2663	+ if ( $auth_settings_access_users_approved === FALSE ) {
2952	2664	$auth_settings_access_users_approved = array();
2953	2665	}
2954	2666	$auth_settings_access_users_blocked = get_option( 'auth_settings_access_users_blocked' );
2955		- if ( false === $auth_settings_access_users_blocked ) {
	2667	+ if ( $auth_settings_access_users_blocked === FALSE ) {
2956	2668	$auth_settings_access_users_blocked = array();
2957	2669	}
2958	2670
2959	2671	// Login Access Defaults.
		@@ -3005,12 +2717,13 @@
3005	2717	if ( ! array_key_exists( 'access_redirect_to_message', $auth_settings ) ) {
3006	2718	$auth_settings['access_redirect_to_message'] = '<p>' . __( 'Notice: You are browsing this site anonymously, and only have access to a portion of its content.', 'authorizer' ) . '</p>';
3007	2719	}
3008	2720
	2721	+
3009	2722	// External Service Defaults.
3010	2723	if ( ! array_key_exists( 'access_default_role', $auth_settings ) ) {
3011	2724	// Set default role to 'student' if that role exists, 'subscriber' otherwise.
3012		- $all_roles = $wp_roles->roles;
	2725	+ $all_roles = $wp_roles->roles;
3013	2726	$editable_roles = apply_filters( 'editable_roles', $all_roles );
3014	2727	if ( array_key_exists( 'student', $editable_roles ) ) {
3015	2728	$auth_settings['access_default_role'] = 'student';
3016	2729	} else {
		@@ -3108,12 +2821,12 @@
3108	2821
3109	2822	// Advanced defaults.
3110	2823	if ( ! array_key_exists( 'advanced_lockouts', $auth_settings ) ) {
3111	2824	$auth_settings['advanced_lockouts'] = array(
3112		- 'attempts_1' => 10,
3113		- 'duration_1' => 1,
3114		- 'attempts_2' => 10,
3115		- 'duration_2' => 10,
	2825	+ 'attempts_1' => 10,
	2826	+ 'duration_1' => 1,
	2827	+ 'attempts_2' => 10,
	2828	+ 'duration_2' => 10,
3116	2829	'reset_duration' => 120,
3117	2830	);
3118	2831	}
3119	2832	if ( ! array_key_exists( 'advanced_hide_wp_login', $auth_settings ) ) {
		@@ -3127,20 +2840,8 @@
3127	2840	}
3128	2841	if ( ! array_key_exists( 'advanced_usermeta', $auth_settings ) ) {
3129	2842	$auth_settings['advanced_usermeta'] = '';
3130	2843	}
3131		- if ( ! array_key_exists( 'advanced_users_per_page', $auth_settings ) ) {
3132		- $auth_settings['advanced_users_per_page'] = 20;
3133		- }
3134		- if ( ! array_key_exists( 'advanced_users_sort_by', $auth_settings ) ) {
3135		- $auth_settings['advanced_users_sort_by'] = 'created';
3136		- }
3137		- if ( ! array_key_exists( 'advanced_users_sort_order', $auth_settings ) ) {
3138		- $auth_settings['advanced_users_sort_order'] = 'asc';
3139		- }
3140		- if ( ! array_key_exists( 'advanced_widget_enabled', $auth_settings ) ) {
3141		- $auth_settings['advanced_widget_enabled'] = '1';
3142		- }
3143	2844	if ( ! array_key_exists( 'advanced_override_multisite', $auth_settings ) ) {
3144	2845	$auth_settings['advanced_override_multisite'] = '';
3145	2846	}
3146	2847
		@@ -3151,11 +2852,11 @@
3151	2852	update_option( 'auth_settings_access_users_blocked', $auth_settings_access_users_blocked );
3152	2853
3153	2854	// Multisite defaults.
3154	2855	if ( is_multisite() ) {
3155		- $auth_multisite_settings = get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings', array() );
	2856	+ $auth_multisite_settings = get_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings', array() );
3156	2857
3157		- if ( false === $auth_multisite_settings ) {
	2858	+ if ( $auth_multisite_settings === FALSE ) {
3158	2859	$auth_multisite_settings = array();
3159	2860	}
3160	2861	// Global switch for enabling multisite options.
3161	2862	if ( ! array_key_exists( 'multisite_override', $auth_multisite_settings ) ) {
		@@ -3161,10 +2862,10 @@
3161	2862	if ( ! array_key_exists( 'multisite_override', $auth_multisite_settings ) ) {
3162	2863	$auth_multisite_settings['multisite_override'] = '';
3163	2864	}
3164	2865	// Access Lists Defaults.
3165		- $auth_multisite_settings_access_users_approved = get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved' );
3166		- if ( false === $auth_multisite_settings_access_users_approved ) {
	2866	+ $auth_multisite_settings_access_users_approved = get_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved' );
	2867	+ if ( $auth_multisite_settings_access_users_approved === FALSE ) {
3167	2868	$auth_multisite_settings_access_users_approved = array();
3168	2869	}
3169	2870	// Login Access Defaults.
3170	2871	if ( ! array_key_exists( 'access_who_can_login', $auth_multisite_settings ) ) {
		@@ -3176,9 +2877,9 @@
3176	2877	}
3177	2878	// External Service Defaults.
3178	2879	if ( ! array_key_exists( 'access_default_role', $auth_multisite_settings ) ) {
3179	2880	// Set default role to 'student' if that role exists, 'subscriber' otherwise.
3180		- $all_roles = $wp_roles->roles;
	2881	+ $all_roles = $wp_roles->roles;
3181	2882	$editable_roles = apply_filters( 'editable_roles', $all_roles );
3182	2883	if ( array_key_exists( 'student', $editable_roles ) ) {
3183	2884	$auth_multisite_settings['access_default_role'] = 'student';
3184	2885	} else {
		@@ -3271,12 +2972,12 @@
3271	2972	}
3272	2973	// Advanced defaults.
3273	2974	if ( ! array_key_exists( 'advanced_lockouts', $auth_multisite_settings ) ) {
3274	2975	$auth_multisite_settings['advanced_lockouts'] = array(
3275		- 'attempts_1' => 10,
3276		- 'duration_1' => 1,
3277		- 'attempts_2' => 10,
3278		- 'duration_2' => 10,
	2976	+ 'attempts_1' => 10,
	2977	+ 'duration_1' => 1,
	2978	+ 'attempts_2' => 10,
	2979	+ 'duration_2' => 10,
3279	2980	'reset_duration' => 120,
3280	2981	);
3281	2982	}
3282	2983	if ( ! array_key_exists( 'advanced_hide_wp_login', $auth_multisite_settings ) ) {
		@@ -3281,23 +2982,11 @@
3281	2982	}
3282	2983	if ( ! array_key_exists( 'advanced_hide_wp_login', $auth_multisite_settings ) ) {
3283	2984	$auth_multisite_settings['advanced_hide_wp_login'] = '';
3284	2985	}
3285		- if ( ! array_key_exists( 'advanced_users_per_page', $auth_multisite_settings ) ) {
3286		- $auth_multisite_settings['advanced_users_per_page'] = 20;
3287		- }
3288		- if ( ! array_key_exists( 'advanced_users_sort_by', $auth_multisite_settings ) ) {
3289		- $auth_multisite_settings['advanced_users_sort_by'] = 'created';
3290		- }
3291		- if ( ! array_key_exists( 'advanced_users_sort_order', $auth_multisite_settings ) ) {
3292		- $auth_multisite_settings['advanced_users_sort_order'] = 'asc';
3293		- }
3294		- if ( ! array_key_exists( 'advanced_widget_enabled', $auth_multisite_settings ) ) {
3295		- $auth_multisite_settings['advanced_widget_enabled'] = '1';
3296		- }
3297	2986	// Save default network options to database.
3298		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings', $auth_multisite_settings );
3299		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
	2987	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings', $auth_multisite_settings );
	2988	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
3300	2989	}
3301	2990
3302	2991	return $auth_settings;
3303	2992	}
		@@ -3304,15 +2993,12 @@
3304	2993
3305	2994
3306	2995	/**
3307	2996	* List sanitizer.
3308		- *
3309		- * @param array $list Array of users to sanitize.
3310		- * @param string $side_effect Set to 'update roles' if role syncing should be performed.
3311		- * @param string $multisite_mode Set to 'multisite' to sync roles on all sites the user belongs to.
3312		- * @return array Array of sanitized users.
	2997	+ * $side_effect = 'none' or 'update roles' to make sure WP user roles match
	2998	+ * $multisite_mode = 'single' or 'multisite' to indicate which user roles to change (this site or all sites)
3313	2999	*/
3314		- private function sanitize_user_list( $list, $side_effect = 'none', $multisite_mode = 'single' ) {
	3000	+ function sanitize_user_list( $list, $side_effect = 'none', $multisite_mode = 'single' ) {
3315	3001	// If it's not a list, make it so.
3316	3002	if ( ! is_array( $list ) ) {
3317	3003	$list = array();
3318	3004	}
		@@ -3317,16 +3003,16 @@
3317	3003	$list = array();
3318	3004	}
3319	3005	foreach ( $list as $key => $user_info ) {
3320	3006	if ( strlen( $user_info['email'] ) < 1 ) {
3321		- // Make sure there are no empty entries in the list.
3322		- unset( $list[ $key ] );
3323		- } elseif ( 'update roles' === $side_effect ) {
	3007	+ // Make sure there are no empty entries in the list
	3008	+ unset( $list[$key] );
	3009	+ } elseif ( $side_effect === 'update roles' ) {
3324	3010	// Make sure the WordPress user accounts have the same role
3325	3011	// as that indicated in the list.
3326	3012	$wp_user = get_user_by( 'email', $user_info['email'] );
3327	3013	if ( $wp_user ) {
3328		- if ( is_multisite() && 'multisite' === $multisite_mode ) {
	3014	+ if ( is_multisite() && $multisite_mode === 'multisite' ) {
3329	3015	foreach ( get_blogs_of_user( $wp_user->ID ) as $blog ) {
3330	3016	add_user_to_blog( $blog->userblog_id, $wp_user->ID, $user_info['role'] );
3331	3017	}
3332	3018	} else {
		@@ -3339,21 +3025,18 @@
3339	3025	}
3340	3026
3341	3027
3342	3028	/**
3343		- * Settings sanitizer callback.
3344		- *
3345		- * @param array $auth_settings Authorizer settings array.
3346		- * @return array Sanitized Authorizer settings array.
	3029	+ * Settings sanitizer callback
3347	3030	*/
3348		- public function sanitize_options( $auth_settings ) {
	3031	+ function sanitize_options( $auth_settings ) {
3349	3032	// Default to "Approved Users" login access restriction.
3350		- if ( ! in_array( $auth_settings['access_who_can_login'], array( 'external_users', 'approved_users' ), true ) ) {
	3033	+ if ( ! in_array( $auth_settings['access_who_can_login'], array( 'external_users', 'approved_users' ) ) ) {
3351	3034	$auth_settings['access_who_can_login'] = 'approved_users';
3352	3035	}
3353	3036
3354	3037	// Default to "Everyone" view access restriction.
3355		- if ( ! in_array( $auth_settings['access_who_can_view'], array( 'everyone', 'logged_in_users' ), true ) ) {
	3038	+ if ( ! in_array( $auth_settings['access_who_can_view'], array( 'everyone', 'logged_in_users' ) ) ) {
3356	3039	$auth_settings['access_who_can_view'] = 'everyone';
3357	3040	}
3358	3041
3359	3042	// Default to WordPress login access redirect.
		@@ -3358,9 +3041,9 @@
3358	3041
3359	3042	// Default to WordPress login access redirect.
3360	3043	// Note: this option doesn't exist in multisite options, so we first
3361	3044	// check to see if it exists.
3362		- if ( array_key_exists( 'access_redirect', $auth_settings ) && ! in_array( $auth_settings['access_redirect'], array( 'login', 'page', 'message' ), true ) ) {
	3045	+ if ( array_key_exists( 'access_redirect', $auth_settings ) && ! in_array( $auth_settings['access_redirect'], array( 'login', 'page', 'message' ) ) ) {
3363	3046	$auth_settings['access_redirect'] = 'login';
3364	3047	}
3365	3048
3366	3049	// Default to warning message for anonymous users on public pages.
		@@ -3365,61 +3048,61 @@
3365	3048
3366	3049	// Default to warning message for anonymous users on public pages.
3367	3050	// Note: this option doesn't exist in multisite options, so we first
3368	3051	// check to see if it exists.
3369		- if ( array_key_exists( 'access_public_warning', $auth_settings ) && ! in_array( $auth_settings['access_public_warning'], array( 'no_warning', 'warning' ), true ) ) {
	3052	+ if ( array_key_exists( 'access_public_warning', $auth_settings ) && ! in_array( $auth_settings['access_public_warning'], array( 'no_warning', 'warning' ) ) ) {
3370	3053	$auth_settings['access_public_warning'] = 'no_warning';
3371	3054	}
3372	3055
3373		- // Sanitize Send welcome email (checkbox: value can only be '1' or empty string).
	3056	+ // Sanitize Send welcome email (checkbox: value can only be '1' or empty string)
3374	3057	$auth_settings['access_should_email_approved_users'] = array_key_exists( 'access_should_email_approved_users', $auth_settings ) && strlen( $auth_settings['access_should_email_approved_users'] ) > 0 ? '1' : '';
3375	3058
3376		- // Sanitize Enable Google Logins (checkbox: value can only be '1' or empty string).
	3059	+ // Sanitize Enable Google Logins (checkbox: value can only be '1' or empty string)
3377	3060	$auth_settings['google'] = array_key_exists( 'google', $auth_settings ) && strlen( $auth_settings['google'] ) > 0 ? '1' : '';
3378	3061
3379		- // Sanitize Enable CAS Logins (checkbox: value can only be '1' or empty string).
	3062	+ // Sanitize Enable CAS Logins (checkbox: value can only be '1' or empty string)
3380	3063	$auth_settings['cas'] = array_key_exists( 'cas', $auth_settings ) && strlen( $auth_settings['cas'] ) > 0 ? '1' : '';
3381	3064
3382		- // Sanitize CAS Host setting.
	3065	+ // Sanitize CAS Host setting
3383	3066	$auth_settings['cas_host'] = filter_var( $auth_settings['cas_host'], FILTER_SANITIZE_URL );
3384	3067
3385		- // Sanitize CAS Port (int).
	3068	+ // Sanitize CAS Port (int)
3386	3069	$auth_settings['cas_port'] = filter_var( $auth_settings['cas_port'], FILTER_SANITIZE_NUMBER_INT );
3387	3070
3388		- // Sanitize CAS attribute update (checkbox: value can only be '1' or empty string).
	3071	+ // Sanitize CAS attribute update (checkbox: value can only be '1' or empty string)
3389	3072	$auth_settings['cas_attr_update_on_login'] = array_key_exists( 'cas_attr_update_on_login', $auth_settings ) && strlen( $auth_settings['cas_attr_update_on_login'] ) > 0 ? '1' : '';
3390	3073
3391		- // Sanitize CAS auto-login (checkbox: value can only be '1' or empty string).
	3074	+ // Sanitize CAS auto-login (checkbox: value can only be '1' or empty string)
3392	3075	$auth_settings['cas_auto_login'] = array_key_exists( 'cas_auto_login', $auth_settings ) && strlen( $auth_settings['cas_auto_login'] ) > 0 ? '1' : '';
3393	3076
3394		- // Sanitize Enable LDAP Logins (checkbox: value can only be '1' or empty string).
	3077	+ // Sanitize Enable LDAP Logins (checkbox: value can only be '1' or empty string)
3395	3078	$auth_settings['ldap'] = array_key_exists( 'ldap', $auth_settings ) && strlen( $auth_settings['ldap'] ) > 0 ? '1' : '';
3396	3079
3397		- // Sanitize LDAP Host setting.
	3080	+ // Sanitize LDAP Host setting
3398	3081	$auth_settings['ldap_host'] = filter_var( $auth_settings['ldap_host'], FILTER_SANITIZE_URL );
3399	3082
3400		- // Sanitize LDAP Port (int).
	3083	+ // Sanitize LDAP Port (int)
3401	3084	$auth_settings['ldap_port'] = filter_var( $auth_settings['ldap_port'], FILTER_SANITIZE_NUMBER_INT );
3402	3085
3403		- // Sanitize LDAP TLS (checkbox: value can only be '1' or empty string).
	3086	+ // Sanitize LDAP TLS (checkbox: value can only be '1' or empty string)
3404	3087	$auth_settings['ldap_tls'] = array_key_exists( 'ldap_tls', $auth_settings ) && strlen( $auth_settings['ldap_tls'] ) > 0 ? '1' : '';
3405	3088
3406		- // Sanitize LDAP attributes (basically make sure they don't have any parentheses).
	3089	+ // Sanitize LDAP attributes (basically make sure they don't have any parentheses)
3407	3090	$auth_settings['ldap_uid'] = filter_var( $auth_settings['ldap_uid'], FILTER_SANITIZE_EMAIL );
3408	3091
3409		- // Sanitize LDAP Lost Password URL.
	3092	+ // Sanitize LDAP Lost Password URL
3410	3093	$auth_settings['ldap_lostpassword_url'] = filter_var( $auth_settings['ldap_lostpassword_url'], FILTER_SANITIZE_URL );
3411	3094
3412		- // Obfuscate LDAP directory user password.
	3095	+ // Obfuscate LDAP directory user password
3413	3096	if ( strlen( $auth_settings['ldap_password'] ) > 0 ) {
3414	3097	// encrypt the directory user password for some minor obfuscation in the database.
3415	3098	$auth_settings['ldap_password'] = $this->encrypt( $auth_settings['ldap_password'] );
3416	3099	}
3417	3100
3418		- // Sanitize LDAP attribute update (checkbox: value can only be '1' or empty string).
	3101	+ // Sanitize LDAP attribute update (checkbox: value can only be '1' or empty string)
3419	3102	$auth_settings['ldap_attr_update_on_login'] = array_key_exists( 'ldap_attr_update_on_login', $auth_settings ) && strlen( $auth_settings['ldap_attr_update_on_login'] ) > 0 ? '1' : '';
3420	3103
3421		- // Make sure public pages is an empty array if it's empty.
	3104	+ // Make sure public pages is an empty array if it's empty
3422	3105	// Note: this option doesn't exist in multisite options, so we first
3423	3106	// check to see if it exists.
3424	3107	if ( array_key_exists( 'access_public_pages', $auth_settings ) && ! is_array( $auth_settings['access_public_pages'] ) ) {
3425	3108	$auth_settings['access_public_pages'] = array();
		@@ -3427,31 +3110,15 @@
3427	3110
3428	3111	// Make sure all lockout options are integers (attempts_1,
3429	3112	// duration_1, attempts_2, duration_2, reset_duration).
3430	3113	foreach ( $auth_settings['advanced_lockouts'] as $key => $value ) {
3431		- $auth_settings['advanced_lockouts'][ $key ] = filter_var( $value, FILTER_SANITIZE_NUMBER_INT );
	3114	+ $auth_settings['advanced_lockouts'][$key] = filter_var( $value, FILTER_SANITIZE_NUMBER_INT );
3432	3115	}
3433	3116
3434		- // Sanitize Hide WordPress logins (checkbox: value can only be '1' or empty string).
	3117	+ // Sanitize Hide WordPress logins (checkbox: value can only be '1' or empty string)
3435	3118	$auth_settings['advanced_hide_wp_login'] = array_key_exists( 'advanced_hide_wp_login', $auth_settings ) && strlen( $auth_settings['advanced_hide_wp_login'] ) > 0 ? '1' : '';
3436	3119
3437		- // Sanitize Users per page (text: value can only int from 1 to MAX_INT).
3438		- $auth_settings['advanced_users_per_page'] = array_key_exists( 'advanced_users_per_page', $auth_settings ) && intval( $auth_settings['advanced_users_per_page'] ) > 0 ? intval( $auth_settings['advanced_users_per_page'] ) : 1;
3439		-
3440		- // Sanitize Sort users by (select: value can be 'email', 'role', 'date_added', 'created').
3441		- if ( ! isset( $auth_settings['advanced_users_sort_by'] ) || ! in_array( $auth_settings['advanced_users_sort_by'], array( 'email', 'role', 'date_added', 'created' ), true ) ) {
3442		- $auth_settings['advanced_users_sort_by'] = 'created';
3443		- }
3444		-
3445		- // Sanitize Sort users order (select: value can be 'asc', 'desc').
3446		- if ( ! isset( $auth_settings['advanced_users_sort_order'] ) || ! in_array( $auth_settings['advanced_users_sort_order'], array( 'asc', 'desc' ), true ) ) {
3447		- $auth_settings['advanced_users_sort_order'] = 'asc';
3448		- }
3449		-
3450		- // Sanitize Show Dashboard Widget (checkbox: value can only be '1' or empty string).
3451		- $auth_settings['advanced_widget_enabled'] = array_key_exists( 'advanced_widget_enabled', $auth_settings ) && strlen( $auth_settings['advanced_widget_enabled'] ) > 0 ? '1' : '';
3452		-
3453		- // Sanitize Override multisite options (checkbox: value can only be '1' or empty string).
	3120	+ // Sanitize Override multisite options (checkbox: value can only be '1' or empty string)
3454	3121	$auth_settings['advanced_override_multisite'] = array_key_exists( 'advanced_override_multisite', $auth_settings ) && strlen( $auth_settings['advanced_override_multisite'] ) > 0 ? '1' : '';
3455	3122
3456	3123	return $auth_settings;
3457	3124	}
		@@ -3458,201 +3125,90 @@
3458	3125
3459	3126
3460	3127	/**
3461	3128	* Keep authorizer approved users' roles in sync with WordPress roles
3462		- * if someone changes the role via the WordPress Edit User page
3463		- * (wp-admin/user-edit.php or wp-admin/profile.php).
	3129	+ * if someone changes the role via the WordPress Edit User options page.
3464	3130	*
3465		- * Action: user_profile_update_errors
3466		- *
3467		- * @param WP_Error $errors Errors object to add any custom errors to (passed by reference).
3468		- * @param bool $update True if updating existing user, false if saving a new one.
3469		- * @param stdClass $user Updated WP_User object for user being edited (passed by reference).
	3131	+ * @action edit_user_profile_update
	3132	+ * @ref https://codex.wordpress.org/Plugin_API/Action_Reference/edit_user_profile_update
	3133	+ * @param int $user_id The user ID of the user being edited
	3134	+
	3135	+ * @action personal_options_update
	3136	+ * @ref https://codex.wordpress.org/Plugin_API/Action_Reference/personal_options_update
	3137	+ * @param int $user_id The user ID of the user being edited
3470	3138	*/
3471		- public function edit_user_profile_update_role( &$errors, $update, &$user ) {
3472		- // Do nothing if we're not updating role.
3473		- if ( ! property_exists( $user, 'role' ) ) {
	3139	+ function edit_user_profile_update_role( $user_id ) {
	3140	+ if ( ! current_user_can( 'edit_user', $user_id ) ) {
3474	3141	return;
3475	3142	}
3476	3143
3477		- // Safety check; will likely not fire if we reach this function.
3478		- if ( ! current_user_can( 'edit_user', $user->ID ) ) {
3479		- return;
3480		- }
3481		-
3482		- // Don't perform Authorizer updates if we have a WordPress error.
3483		- $errors_on_user_update = $errors->get_error_codes();
3484		- if ( ! empty( $errors_on_user_update ) ) {
3485		- return;
3486		- }
3487		-
3488		- // Get original user object (fail if not a real WordPress user).
3489		- $userdata = get_userdata( $user->ID );
3490		- if ( ! $userdata ) {
3491		- return;
3492		- }
3493		-
3494	3144	// If user is in approved list, update his/her associated role.
3495		- if ( $this->is_email_in_list( $userdata->user_email, 'approved' ) ) {
3496		- $auth_settings_access_users_approved = $this->sanitize_user_list( $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT ) );
3497		- foreach ( $auth_settings_access_users_approved as $key => $check_user ) {
3498		- if ( 0 === strcasecmp( $check_user['email'], $userdata->user_email ) ) {
3499		- $auth_settings_access_users_approved[ $key ]['role'] = $user->role;
3500		- }
3501		- }
3502		- update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved );
3503		- }
3504		- }
3505		-
3506		-
3507		- /**
3508		- * Sync any email address changes to WordPress accounts to the corresponding
3509		- * entry in the Authorizer approved list.
3510		- *
3511		- * Note: This filter fires in wp_update_user() if the update includes an
3512		- * email address change, and fires after all security and integrity checks
3513		- * have been performed, so we can simply update the Authorizer approved
3514		- * list, changing the email address on the approved entry, and removing any
3515		- * existing entries that also have the new email address (duplicates).
3516		- *
3517		- * Filter: send_email_change_email
3518		- *
3519		- * @param bool $send Whether to send the email.
3520		- * @param array $user The original user array.
3521		- * @param array $userdata The updated user array.
3522		- */
3523		- public function edit_user_profile_update_email( $send, $user, $userdata ) {
3524		- // If we're in multisite, update the email on all sites in the network
3525		- // (and remove from any subsites if it's a network-approved user).
3526		- if ( is_multisite() ) {
3527		- // If it's a multisite approved user, sync the email there.
3528		- $changed_user_is_multisite_user = false;
3529		- if ( $this->is_email_in_list( $user['user_email'], 'approved', 'multisite' ) ) {
3530		- $changed_user_is_multisite_user = true;
3531		- $auth_multisite_settings_access_users_approved = $this->sanitize_user_list(
3532		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT )
3533		- );
3534		- foreach ( $auth_multisite_settings_access_users_approved as $key => $check_user ) {
3535		- // Update old user email in approved list to the new email.
3536		- if ( 0 === strcasecmp( $check_user['email'], $user['user_email'] ) ) {
3537		- $auth_multisite_settings_access_users_approved[ $key ]['email'] = $this->lowercase( $userdata['user_email'] );
	3145	+ $wp_user = get_user_by( 'id', $user_id );
	3146	+ if ( $this->is_email_in_list( $wp_user->get( 'user_email' ), 'approved' ) ) {
	3147	+ $auth_settings_access_users_approved = $this->sanitize_user_list( $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN ) );
	3148	+ // Find approved user and sync with the corresponding WP_User.
	3149	+ foreach ( $auth_settings_access_users_approved as $key => $user ) {
	3150	+ if ( 0 === strcasecmp( $user['email'], $wp_user->user_email ) ) {
	3151	+ // Sync user role.
	3152	+ if ( array_key_exists( 'role', $_REQUEST ) ) {
	3153	+ $auth_settings_access_users_approved[$key]['role'] = $_REQUEST['role'];
3538	3154	}
3539		- // If new user email is already in approved list, remove that entry.
3540		- if ( 0 === strcasecmp( $check_user['email'], $userdata['user_email'] ) ) {
3541		- unset( $auth_multisite_settings_access_users_approved[ $key ] );
	3155	+ // Sync email address.
	3156	+ if ( array_key_exists( 'email', $_REQUEST ) ) {
	3157	+ $auth_settings_access_users_approved[$key]['email'] = mb_strtolower( $_REQUEST['email'] );
3542	3158	}
3543	3159	}
3544		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
3545	3160	}
3546	3161
3547		- // Go through all approved lists on individual sites and sync this user there.
3548		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
3549		- $sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
3550		- foreach ( $sites as $site ) {
3551		- $updated = false;
3552		- $blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
3553		- $auth_settings_access_users_approved = get_blog_option( $blog_id, 'auth_settings_access_users_approved', array() );
3554		- foreach ( $auth_settings_access_users_approved as $key => $check_user ) {
3555		- // Update old user email in approved list to the new email.
3556		- if ( 0 === strcasecmp( $check_user['email'], $user['user_email'] ) ) {
3557		- // But if the user is already a multisite user, just remove the entry in the subsite.
3558		- if ( $changed_user_is_multisite_user ) {
3559		- unset( $auth_settings_access_users_approved[ $key ] );
3560		- } else {
3561		- $auth_settings_access_users_approved[ $key ]['email'] = $this->lowercase( $userdata['user_email'] );
3562		- }
3563		- $updated = true;
3564		- }
3565		- // If new user email is already in approved list, remove that entry.
3566		- if ( 0 === strcasecmp( $check_user['email'], $userdata['user_email'] ) ) {
3567		- unset( $auth_settings_access_users_approved[ $key ] );
3568		- $updated = true;
3569		- }
3570		- }
3571		- if ( $updated ) {
3572		- update_blog_option( $blog_id, 'auth_settings_access_users_approved', $auth_settings_access_users_approved );
3573		- }
3574		- }
3575		- } else {
3576		- // In a single site environment, just find the old user in the approved list and update the email.
3577		- if ( $this->is_email_in_list( $user['user_email'], 'approved' ) ) {
3578		- $auth_settings_access_users_approved = $this->sanitize_user_list( $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT ) );
3579		- foreach ( $auth_settings_access_users_approved as $key => $check_user ) {
3580		- // Update old user email in approved list to the new email.
3581		- if ( 0 === strcasecmp( $check_user['email'], $user['user_email'] ) ) {
3582		- $auth_settings_access_users_approved[ $key ]['email'] = $this->lowercase( $userdata['user_email'] );
3583		- }
3584		- // If new user email is already in approved list, remove that entry.
3585		- if ( 0 === strcasecmp( $check_user['email'], $userdata['user_email'] ) ) {
3586		- unset( $auth_settings_access_users_approved[ $key ] );
3587		- }
3588		- }
3589		- update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved );
3590		- }
	3162	+ update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved );
3591	3163	}
3592		-
3593		- // We're hooking into this filter merely for its location in the codebase,
3594		- // so make sure to return the filter value unmodified.
3595		- return $send;
3596	3164	}
3597	3165
3598	3166
3599	3167	/**
3600		- * Settings print callback.
3601		- *
3602		- * @param string $args Args (e.g., multisite admin mode).
3603		- * @return void
	3168	+ * Settings print callbacks
3604	3169	*/
3605		- public function print_section_info_tabs( $args = '' ) {
3606		- if ( WP_Plugin_Authorizer::NETWORK_CONTEXT === $this->get_admin_mode( $args ) ) :
3607		- ?>
	3170	+ function print_section_info_tabs( $args = '' ) {
	3171	+ if ( MULTISITE_ADMIN === $this->get_admin_mode( $args )): ?>
3608	3172	<h2 class="nav-tab-wrapper">
3609		- <a class="nav-tab nav-tab-access_lists nav-tab-active" href="javascript:chooseTab('access_lists' );"><?php esc_html_e( 'Access Lists', 'authorizer' ); ?></a>
3610		- <a class="nav-tab nav-tab-external" href="javascript:chooseTab('external' );"><?php esc_html_e( 'External Service', 'authorizer' ); ?></a>
3611		- <a class="nav-tab nav-tab-advanced" href="javascript:chooseTab('advanced' );"><?php esc_html_e( 'Advanced', 'authorizer' ); ?></a>
	3173	+ <a class="nav-tab nav-tab-access_lists nav-tab-active" href="javascript:choose_tab('access_lists' );"><?php _e( 'Access Lists', 'authorizer' ); ?></a>
	3174	+ <a class="nav-tab nav-tab-external" href="javascript:choose_tab('external' );"><?php _e( 'External Service', 'authorizer' ); ?></a>
	3175	+ <a class="nav-tab nav-tab-advanced" href="javascript:choose_tab('advanced' );"><?php _e( 'Advanced', 'authorizer' ); ?></a>
3612	3176	</h2>
3613		- <?php else : ?>
	3177	+ <?php else: ?>
3614	3178	<h2 class="nav-tab-wrapper">
3615		- <a class="nav-tab nav-tab-access_lists nav-tab-active" href="javascript:chooseTab('access_lists' );"><?php esc_html_e( 'Access Lists', 'authorizer' ); ?></a>
3616		- <a class="nav-tab nav-tab-access_login" href="javascript:chooseTab('access_login' );"><?php esc_html_e( 'Login Access', 'authorizer' ); ?></a>
3617		- <a class="nav-tab nav-tab-access_public" href="javascript:chooseTab('access_public' );"><?php esc_html_e( 'Public Access', 'authorizer' ); ?></a>
3618		- <a class="nav-tab nav-tab-external" href="javascript:chooseTab('external' );"><?php esc_html_e( 'External Service', 'authorizer' ); ?></a>
3619		- <a class="nav-tab nav-tab-advanced" href="javascript:chooseTab('advanced' );"><?php esc_html_e( 'Advanced', 'authorizer' ); ?></a>
	3179	+ <a class="nav-tab nav-tab-access_lists nav-tab-active" href="javascript:choose_tab('access_lists' );"><?php _e( 'Access Lists', 'authorizer' ); ?></a>
	3180	+ <a class="nav-tab nav-tab-access_login" href="javascript:choose_tab('access_login' );"><?php _e( 'Login Access', 'authorizer' ); ?></a>
	3181	+ <a class="nav-tab nav-tab-access_public" href="javascript:choose_tab('access_public' );"><?php _e( 'Public Access', 'authorizer' ); ?></a>
	3182	+ <a class="nav-tab nav-tab-external" href="javascript:choose_tab('external' );"><?php _e( 'External Service', 'authorizer' ); ?></a>
	3183	+ <a class="nav-tab nav-tab-advanced" href="javascript:choose_tab('advanced' );"><?php _e( 'Advanced', 'authorizer' ); ?></a>
3620	3184	</h2>
3621		- <?php
3622		- endif;
	3185	+ <?php endif;
3623	3186	}
3624	3187
3625	3188
3626		- /**
3627		- * Settings print callback.
3628		- *
3629		- * @param string $args Args (e.g., multisite admin mode).
3630		- * @return void
3631		- */
3632		- public function print_section_info_access_lists( $args = '' ) {
	3189	+ function print_section_info_access_lists( $args = '' ) {
3633	3190	$admin_mode = $this->get_admin_mode( $args );
3634		- ?>
3635		- <div id="section_info_access_lists" class="section_info">
3636		- <p><?php esc_html_e( 'Manage who has access to this site using these lists.', 'authorizer' ); ?></p>
	3191	+ ?><div id="section_info_access_lists" class="section_info">
	3192	+ <p><?php _e( 'Manage who has access to this site using these lists.', 'authorizer' ); ?></p>
3637	3193	<ol>
3638		- <li><?php echo wp_kses( __( "<strong>Pending</strong> users are users who have successfully logged in to the site, but who haven't yet been approved (or blocked) by you.", 'authorizer' ), $this->allowed_html ); ?></li>
3639		- <li><?php echo wp_kses( __( '<strong>Approved</strong> users have access to the site once they successfully log in.', 'authorizer' ), $this->allowed_html ); ?></li>
3640		- <li><?php echo wp_kses( __( '<strong>Blocked</strong> users will receive an error message when they try to visit the site after authenticating.', 'authorizer' ), $this->allowed_html ); ?></li>
	3194	+ <li><?php _e( "<strong>Pending</strong> users are users who have successfully logged in to the site, but who haven't yet been approved (or blocked) by you.", 'authorizer' ); ?></li>
	3195	+ <li><?php _e( '<strong>Approved</strong> users have access to the site once they successfully log in.', 'authorizer' ); ?></li>
	3196	+ <li><?php _e( '<strong>Blocked</strong> users will receive an error message when they try to visit the site after authenticating.', 'authorizer' ); ?></li>
3641	3197	</ol>
3642	3198	</div>
3643	3199	<table class="form-table">
3644	3200	<tbody>
3645	3201	<tr>
3646		- <th scope="row"><?php esc_html_e( 'Pending Users', 'authorizer' ); ?> <em>(<?php echo esc_html( $this->get_user_count_from_list( 'pending', $admin_mode ) ); ?>)</em></th>
	3202	+ <th scope="row"><?php _e( 'Pending Users', 'authorizer' ); ?> <em>(<?php echo $this->get_user_count_from_list( 'pending', $admin_mode ); ?>)</em></th>
3647	3203	<td><?php $this->print_combo_auth_access_users_pending(); ?></td>
3648	3204	</tr>
3649	3205	<tr>
3650		- <th scope="row"><?php esc_html_e( 'Approved Users', 'authorizer' ); ?> <em>(<?php echo esc_html( $this->get_user_count_from_list( 'approved', $admin_mode ) ); ?>)</em></th>
	3206	+ <th scope="row"><?php _e( 'Approved Users', 'authorizer' ); ?> <em>(<?php echo $this->get_user_count_from_list( 'approved', $admin_mode ); ?>)</em></th>
3651	3207	<td><?php $this->print_combo_auth_access_users_approved(); ?></td>
3652	3208	</tr>
3653	3209	<tr>
3654		- <th scope="row"><?php esc_html_e( 'Blocked Users', 'authorizer' ); ?> <em>(<?php echo esc_html( $this->get_user_count_from_list( 'blocked', $admin_mode ) ); ?>)</em></th>
	3210	+ <th scope="row"><?php _e( 'Blocked Users', 'authorizer' ); ?> <em>(<?php echo $this->get_user_count_from_list( 'blocked', $admin_mode ); ?>)</em></th>
3655	3211	<td><?php $this->print_combo_auth_access_users_blocked(); ?></td>
3656	3212	</tr>
3657	3213	</tbody>
3658	3214	</table>
		@@ -3659,516 +3215,276 @@
3659	3215	<?php
3660	3216	}
3661	3217
3662	3218
3663		- /**
3664		- * Settings print callback.
3665		- *
3666		- * @param string $args Args (e.g., multisite admin mode).
3667		- * @return void
3668		- */
3669		- public function print_combo_auth_access_users_pending( $args = '' ) {
	3219	+ function print_combo_auth_access_users_pending( $args = '' ) {
3670	3220	// Get plugin option.
3671		- $option = 'access_users_pending';
	3221	+ $option = 'access_users_pending';
3672	3222	$auth_settings_option = $this->get_plugin_option( $option );
3673	3223	$auth_settings_option = is_array( $auth_settings_option ) ? $auth_settings_option : array();
3674	3224
3675		- // Render wrapper div (for aligning pager to width of content).
3676		- ?>
3677		- <div class="wrapper_<?php echo esc_attr( $option ); ?>">
3678		- <ul id="list_auth_settings_access_users_pending" style="margin:0;">
3679		- <?php
3680		- if ( count( $auth_settings_option ) > 0 ) :
3681		- foreach ( $auth_settings_option as $key => $pending_user ) :
3682		- if ( empty( $pending_user ) || count( $pending_user ) < 1 ) :
3683		- continue;
3684		- endif;
3685		- $pending_user['is_wp_user'] = false;
3686		- ?>
3687		- <li>
3688		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>_<?php echo esc_attr( $key ); ?>" value="<?php echo esc_attr( $pending_user['email'] ); ?>" readonly="true" class="auth-email" />
3689		- <select id="auth_settings_<?php echo esc_attr( $option ); ?>_<?php echo esc_attr( $key ); ?>_role" class="auth-role">
3690		- <?php $this->wp_dropdown_permitted_roles( $pending_user['role'] ); ?>
3691		- </select>
3692		- <a href="javascript:void(0);" class="button-primary" id="approve_user_<?php echo esc_attr( $key ); ?>" onclick="authAddUser( this, 'approved', false ); authIgnoreUser( this, 'pending' );"><span class="glyphicon glyphicon-ok"></span> <?php esc_html_e( 'Approve', 'authorizer' ); ?></a>
3693		- <a href="javascript:void(0);" class="button-primary" id="block_user_<?php echo esc_attr( $key ); ?>" onclick="authAddUser( this, 'blocked', false ); authIgnoreUser( this, 'pending' );"><span class="glyphicon glyphicon-ban-circle"></span> <?php esc_html_e( 'Block', 'authorizer' ); ?></a>
3694		- <a href="javascript:void(0);" class="button button-secondary" id="ignore_user_<?php echo esc_attr( $key ); ?>" onclick="authIgnoreUser( this, 'pending' );" title="<?php esc_html_e( 'Remove user', 'authorizer' ); ?>"><span class="glyphicon glyphicon-remove"></span> <?php esc_html_e( 'Ignore', 'authorizer' ); ?></a>
3695		- </li>
3696		- <?php endforeach; ?>
3697		- <?php else : ?>
3698		- <li class="auth-empty"><em><?php esc_html_e( 'No pending users', 'authorizer' ); ?></em></li>
3699		- <?php endif; ?>
3700		- </ul>
3701		- </div>
	3225	+ // Print option elements.
	3226	+ ?><ul id="list_auth_settings_access_users_pending" style="margin:0;">
	3227	+ <?php if ( count( $auth_settings_option ) > 0 ) : ?>
	3228	+ <?php foreach ( $auth_settings_option as $key => $pending_user ): ?>
	3229	+ <?php if ( empty( $pending_user ) || count( $pending_user ) < 1 ) continue; ?>
	3230	+ <?php $pending_user['is_wp_user'] = false; ?>
	3231	+ <li>
	3232	+ <input type="text" id="auth_settings_<?php echo $option; ?>_<?php echo $key; ?>" value="<?php echo $pending_user['email']; ?>" readonly="true" class="auth-email" />
	3233	+ <select id="auth_settings_<?php echo $option; ?>_<?php echo $key; ?>_role" class="auth-role">
	3234	+ <?php $this->wp_dropdown_permitted_roles( $pending_user['role'] ); ?>
	3235	+ </select>
	3236	+ <a href="javascript:void(0);" class="button-primary" id="approve_user_<?php echo $key; ?>" onclick="auth_add_user( this, 'approved', false ); auth_ignore_user( this, 'pending' );"><span class="glyphicon glyphicon-ok"></span> <?php _e( 'Approve', 'authorizer' ); ?></a>
	3237	+ <a href="javascript:void(0);" class="button-primary" id="block_user_<?php echo $key; ?>" onclick="auth_add_user( this, 'blocked', false ); auth_ignore_user( this, 'pending' );"><span class="glyphicon glyphicon-ban-circle"></span> <?php _e( 'Block', 'authorizer' ); ?></a>
	3238	+ <a href="javascript:void(0);" class="button button-secondary" id="ignore_user_<?php echo $key; ?>" onclick="auth_ignore_user( this, 'pending' );" title="<?php _e( 'Remove user', 'authorizer' ); ?>"><span class="glyphicon glyphicon-remove"></span> <?php _e( 'Ignore', 'authorizer' ); ?></a>
	3239	+ </li>
	3240	+ <?php endforeach; ?>
	3241	+ <?php else: ?>
	3242	+ <li class="auth-empty"><em><?php _e( 'No pending users', 'authorizer' ); ?></em></li>
	3243	+ <?php endif; ?>
	3244	+ </ul>
3702	3245	<?php
3703	3246	}
3704	3247
3705	3248
3706		- /**
3707		- * Settings print callback.
3708		- *
3709		- * @param string $args Args (e.g., multisite admin mode).
3710		- * @return void
3711		- */
3712		- public function print_combo_auth_access_users_approved( $args = '' ) {
	3249	+ function print_combo_auth_access_users_approved( $args = '' ) {
3713	3250	// Get plugin option.
3714		- $option = 'access_users_approved';
3715		- $admin_mode = $this->get_admin_mode( $args );
	3251	+ $option = 'access_users_approved';
	3252	+ $admin_mode = $this->get_admin_mode( $args );
3716	3253	$auth_settings_option = $this->get_plugin_option( $option, $admin_mode, 'no override' );
3717	3254	$auth_settings_option = is_array( $auth_settings_option ) ? $auth_settings_option : array();
3718	3255
3719		- // Get multisite approved users (will be added to top of list, greyed out).
3720		- $auth_override_multisite = $this->get_plugin_option( 'advanced_override_multisite' );
3721		- $auth_multisite_settings = $this->get_plugin_options( WP_Plugin_Authorizer::NETWORK_CONTEXT );
	3256	+ // Get multisite approved users (add them to top of list, greyed out).
	3257	+ $auth_override_multisite = $this->get_plugin_option( 'advanced_override_multisite' );
	3258	+ $auth_multisite_settings = $this->get_plugin_options( MULTISITE_ADMIN );
3722	3259	$auth_settings_option_multisite = array();
3723	3260	if (
3724	3261	is_multisite() &&
3725		- ! is_network_admin() &&
3726		- '1' !== intval( $auth_override_multisite ) &&
	3262	+ $auth_override_multisite != '1' &&
3727	3263	array_key_exists( 'multisite_override', $auth_multisite_settings ) &&
3728		- '1' === $auth_multisite_settings['multisite_override']
	3264	+ $auth_multisite_settings['multisite_override'] === '1'
3729	3265	) {
3730		- $auth_settings_option_multisite = $this->get_plugin_option( $option, WP_Plugin_Authorizer::NETWORK_CONTEXT, 'allow override' );
	3266	+ $auth_settings_option_multisite = $this->get_plugin_option( $option, MULTISITE_ADMIN, 'allow override' );
3731	3267	$auth_settings_option_multisite = is_array( $auth_settings_option_multisite ) ? $auth_settings_option_multisite : array();
3732		- // Add multisite users to the beginning of the main user array.
3733		- foreach ( array_reverse( $auth_settings_option_multisite ) as $approved_user ) {
3734		- $approved_user['multisite_user'] = true;
3735		- array_unshift( $auth_settings_option, $approved_user );
3736		- }
3737	3268	}
3738	3269
3739	3270	// Get default role for new user dropdown.
3740		- $access_default_role = $this->get_plugin_option( 'access_default_role', WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
	3271	+ $access_default_role = $this->get_plugin_option( 'access_default_role', SINGLE_ADMIN, 'allow override' );
3741	3272
3742	3273	// Get custom usermeta field to show.
3743	3274	$advanced_usermeta = $this->get_plugin_option( 'advanced_usermeta' );
3744	3275
3745	3276	// Adjust javascript function prefixes if multisite.
3746		- $js_function_prefix = WP_Plugin_Authorizer::NETWORK_CONTEXT === $admin_mode ? 'authMultisite' : 'auth';
3747		- $is_multisite_admin_page = WP_Plugin_Authorizer::NETWORK_CONTEXT === $admin_mode;
	3277	+ $js_function_prefix = $admin_mode === MULTISITE_ADMIN ? 'auth_multisite_' : 'auth_';
	3278	+ $multisite_admin_page = $admin_mode === MULTISITE_ADMIN;
3748	3279
3749		- // Filter user list to search terms.
3750		- // phpcs:ignore WordPress.CSRF.NonceVerification.NoNonceVerification
3751		- if ( isset( $_REQUEST['search'] ) && strlen( sanitize_text_field( wp_unslash( $_REQUEST['search'] ) ) ) > 0 ) {
3752		- // phpcs:ignore WordPress.CSRF.NonceVerification.NoNonceVerification
3753		- $search_term = sanitize_text_field( wp_unslash( $_REQUEST['search'] ) );
3754		- $auth_settings_option = array_filter(
3755		- $auth_settings_option, function ( $user ) use ( $search_term ) {
3756		- return stripos( $user['email'], $search_term ) !== false ||
3757		- stripos( $user['role'], $search_term ) !== false ||
3758		- stripos( $user['date_added'], $search_term ) !== false;
3759		- }
3760		- );
3761		- }
3762		-
3763		- // Sort user list.
3764		- $sort_by = $this->get_plugin_option( 'advanced_users_sort_by', WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' ); // email, role, date_added (registered), created (date approved).
3765		- $sort_order = $this->get_plugin_option( 'advanced_users_sort_order', WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' ); // asc or desc.
3766		- $sort_dimension = array();
3767		- if ( in_array( $sort_by, array( 'email', 'role', 'date_added' ), true ) ) {
3768		- foreach ( $auth_settings_option as $key => $user ) {
3769		- if ( 'date_added' === $sort_by ) {
3770		- $sort_dimension[ $key ] = date( 'Ymd', strtotime( $user[ $sort_by ] ) );
3771		- } else {
3772		- $sort_dimension[ $key ] = strtolower( $user[ $sort_by ] );
3773		- }
3774		- }
3775		- $sort_order = 'asc' === $sort_order ? SORT_ASC : SORT_DESC;
3776		- array_multisort( $sort_dimension, $sort_order, $auth_settings_option );
3777		- } elseif ( 'created' === $sort_by && 'asc' !== $sort_order ) {
3778		- // If default sort method and reverse order, just reverse the array.
3779		- $auth_settings_option = array_reverse( $auth_settings_option );
3780		- }
3781		-
3782		- // Ensure array keys run from 0..max (keys in database will be the original,
3783		- // index, and removing users will not reorder the array keys of other users).
3784		- $auth_settings_option = array_values( $auth_settings_option );
3785		-
3786		- // Get pager params.
3787		- $total_users = count( $auth_settings_option );
3788		- $users_per_page = intval( $this->get_plugin_option( 'advanced_users_per_page', WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' ) );
3789		- // phpcs:ignore WordPress.CSRF.NonceVerification.NoNonceVerification
3790		- $current_page = isset( $_REQUEST['paged'] ) ? intval( $_REQUEST['paged'] ) : 1;
3791		- $total_pages = ceil( $total_users / $users_per_page );
3792		- if ( $total_pages < 1 ) {
3793		- $total_pages = 1;
3794		- }
3795		-
3796		- // Make sure current_page is between 1 and max pages.
3797		- if ( $current_page < 1 ) {
3798		- $current_page = 1;
3799		- } elseif ( $current_page > $total_pages ) {
3800		- $current_page = $total_pages;
3801		- }
3802		-
3803		- // Render wrapper div (for aligning pager to width of content).
3804		- ?>
3805		- <div class="wrapper_<?php echo esc_attr( $option ); ?>">
3806		- <?php $this->render_user_pager( $current_page, $users_per_page, $total_users, 'top' ); ?>
3807		- <ul id="list_auth_settings_access_users_approved" class="<?php echo strlen( $advanced_usermeta ) > 0 ? 'has-usermeta' : ''; ?>">
3808		- <?php
3809		- $offset = ( $current_page - 1 ) * $users_per_page;
3810		- $max = min( $offset + $users_per_page, count( $auth_settings_option ) );
3811		- for ( $key = $offset; $key < $max; $key++ ) :
3812		- $approved_user = $auth_settings_option[ $key ];
	3280	+ ?><ul id="list_auth_settings_access_users_approved" style="margin:0;">
	3281	+ <?php if ( ! $multisite_admin_page ) :
	3282	+ foreach ( $auth_settings_option_multisite as $key => $approved_user ) :
3813	3283	if ( empty( $approved_user ) || count( $approved_user ) < 1 ) :
3814	3284	continue;
3815	3285	endif;
3816		- $this->render_user_element( $approved_user, $key, $option, $admin_mode, $advanced_usermeta );
3817		- endfor;
3818		- ?>
3819		- </ul>
	3286	+ $approved_wp_user = get_user_by( 'email', $approved_user['email'] );
	3287	+ if ( $approved_wp_user ) :
	3288	+ $approved_user['email'] = $approved_wp_user->user_email;
	3289	+ $approved_user['role'] = $multisite_admin_page || count( $approved_wp_user->roles ) === 0 ? $approved_user['role'] : array_shift( $approved_wp_user->roles );
	3290	+ $approved_user['date_added'] = $approved_wp_user->user_registered;
	3291	+ // Get usermeta field from the WordPress user's real usermeta.
	3292	+ if ( strlen( $advanced_usermeta ) > 0 ) :
	3293	+ if ( strpos( $advanced_usermeta, 'acf___' ) === 0 && class_exists( 'acf' ) ) :
	3294	+ // Get ACF Field value for the user
	3295	+ $approved_user['usermeta'] = get_field( str_replace('acf___', '', $advanced_usermeta ), 'user_' . $approved_wp_user->ID );
	3296	+ else :
	3297	+ // Get regular usermeta value for the user.
	3298	+ $approved_user['usermeta'] = get_user_meta( $approved_wp_user->ID, $advanced_usermeta, true );
	3299	+ endif;
3820	3300
3821		- <div id="new_auth_settings_<?php echo esc_attr( $option ); ?>">
3822		- <textarea id="new_approved_user_email" placeholder="<?php esc_attr_e( 'email address', 'authorizer' ); ?>" class="auth-email new autogrow-short" rows="1"></textarea>
3823		- <select id="new_approved_user_role" class="auth-role">
3824		- <?php $this->wp_dropdown_permitted_roles( $access_default_role, 'not disabled', $admin_mode ); ?>
3825		- </select>
3826		- <div class="btn-group">
3827		- <a href="javascript:void(0);" class="btn button-primary dropdown-toggle button-add-user" id="approve_user_new" onclick="<?php echo esc_attr( $js_function_prefix ); ?>AddUser(this, 'approved' );"><span class="glyphicon glyphicon-ok"></span> <?php esc_html_e( 'Approve', 'authorizer' ); ?></a>
3828		- <button type="button" class="btn button-primary dropdown-toggle" data-toggle="dropdown">
3829		- <span class="caret"></span>
3830		- <span class="sr-only"><?php esc_html_e( 'Toggle Dropdown', 'authorizer' ); ?></span>
3831		- </button>
3832		- <ul class="dropdown-menu" role="menu">
3833		- <li><a href="javascript:void(0);" onclick="<?php echo esc_attr( $js_function_prefix ); ?>AddUser( document.getElementById( 'approve_user_new' ), 'approved', true);"><?php esc_html_e( 'Create a local WordPress account instead, and email the user their password.', 'authorizer' ); ?></a></li>
3834		- </ul>
3835		- </div>
3836		- </div>
3837		- <?php $this->render_user_pager( $current_page, $users_per_page, $total_users, 'bottom' ); ?>
3838		- </div>
3839		- <?php
3840		- }
	3301	+ if ( is_array( $approved_user['usermeta'] ) || is_object( $approved_user['usermeta'] ) ) :
	3302	+ $approved_user['usermeta'] = serialize( $approved_user['usermeta'] );
	3303	+ endif;
	3304	+ endif;
	3305	+ endif;
	3306	+ if ( ! array_key_exists( 'usermeta', $approved_user ) ) :
	3307	+ $approved_user['usermeta'] = '';
	3308	+ endif; ?>
	3309	+ <li>
	3310	+ <input type="text" id="auth_multisite_settings_<?php echo $option; ?>_<?php echo $key; ?>" value="<?php echo $approved_user['email']; ?>" readonly="true" class="auth-email auth-multisite-email" />
	3311	+ <select id="auth_multisite_settings_<?php echo $option; ?>_<?php echo $key; ?>_role" class="auth-role auth-multisite-role" disabled="disabled">
	3312	+ <?php $this->wp_dropdown_permitted_roles( $approved_user['role'] ); ?>
	3313	+ </select>
	3314	+ <input type="text" id="auth_multisite_settings_<?php echo $option; ?>_<?php echo $key; ?>_date_added" value="<?php echo date( 'M Y', strtotime( $approved_user['date_added'] ) ); ?>" readonly="true" class="auth-date-added auth-multisite-date-added" disabled="disabled" />
	3315	+ <?php if ( strlen( $advanced_usermeta ) > 0 ) :
	3316	+ $should_show_usermeta_in_text_field = true; // Fallback renderer for usermeta; try to use a select first.
	3317	+ if ( strpos( $advanced_usermeta, 'acf___' ) === 0 && class_exists( 'acf' ) ) :
	3318	+ $field_object = get_field_object( str_replace('acf___', '', $advanced_usermeta ) );
	3319	+ if ( is_array( $field_object ) && array_key_exists( 'type', $field_object ) && $field_object['type'] === 'select' ) :
	3320	+ $should_show_usermeta_in_text_field = false; ?>
	3321	+ <select id="auth_settings_<?php echo $option; ?>_<?php echo $key; ?>_usermeta" class="auth-usermeta auth-multisite-usermeta" onchange="<?php echo $js_function_prefix; ?>update_usermeta( this );">
	3322	+ <option value=""<?php if ( empty( $approved_user['usermeta'] ) ) echo ' selected="selected"'; ?>><?php _e( '-- None --', 'authorizer' ); ?></option>
	3323	+ <?php foreach ( $field_object['choices'] as $key => $label ) : ?>
	3324	+ <option value="<?php echo $key; ?>"<?php if ( $key === $approved_user['usermeta'] || ( is_array( $approved_user['usermeta'] ) && array_key_exists( get_current_blog_id(), $approved_user['usermeta'] ) && $key === $approved_user['usermeta'][get_current_blog_id()]['meta_value'] ) ) echo ' selected="selected"'; ?>><?php echo $label; ?></option>
	3325	+ <?php endforeach; ?>
	3326	+ </select>
	3327	+ <?php endif; ?>
	3328	+ <?php endif; ?>
	3329	+ <?php if ( $should_show_usermeta_in_text_field ) : ?>
	3330	+ <input type="text" id="auth_multisite_settings_<?php echo $option; ?>_<?php echo $key; ?>_usermeta" value="<?php echo htmlspecialchars( $approved_user['usermeta'], ENT_COMPAT ); ?>" class="auth-usermeta auth-multisite-usermeta" />
	3331	+ <a class="button button-small button-primary update-usermeta" id="update_usermeta_<?php echo $key; ?>" onclick="<?php echo $js_function_prefix; ?>update_usermeta( this );" title="Update usermeta"><span class="glyphicon glyphicon-floppy-saved"></span></a>
	3332	+ <?php endif; ?>
	3333	+ <?php endif; ?>
	3334	+ &nbsp;&nbsp;<a title="WordPress Multisite user" class="auth-multisite-user"><span class="glyphicon glyphicon-globe"></span></a>
	3335	+ </li>
	3336	+ <?php endforeach;
	3337	+ endif;
	3338	+ foreach ( $auth_settings_option as $key => $approved_user ):
	3339	+ $is_current_user = false;
	3340	+ $local_user_icon = array_key_exists( 'local_user', $approved_user ) && $approved_user['local_user'] === 'true' ? '&nbsp;<a title="Local WordPress user" class="auth-local-user"><span class="glyphicon glyphicon-user"></span></a>' : '';
	3341	+ if ( empty( $approved_user ) || count( $approved_user ) < 1 ) :
	3342	+ continue;
	3343	+ endif;
	3344	+ $approved_wp_user = get_user_by( 'email', $approved_user['email'] );
	3345	+ if ( $approved_wp_user ) :
	3346	+ $approved_user['email'] = $approved_wp_user->user_email;
	3347	+ $approved_user['role'] = $multisite_admin_page || count( $approved_wp_user->roles ) === 0 ? $approved_user['role'] : array_shift( $approved_wp_user->roles );
	3348	+ $approved_user['date_added'] = $approved_wp_user->user_registered;
	3349	+ $approved_user['is_wp_user'] = true;
	3350	+ $is_current_user = $approved_wp_user->ID === get_current_user_id();
	3351	+ // Get usermeta field from the WordPress user's real usermeta.
	3352	+ if ( strlen( $advanced_usermeta ) > 0 ) :
	3353	+ if ( strpos( $advanced_usermeta, 'acf___' ) === 0 && class_exists( 'acf' ) ) :
	3354	+ // Get ACF Field value for the user
	3355	+ $approved_user['usermeta'] = get_field( str_replace('acf___', '', $advanced_usermeta ), 'user_' . $approved_wp_user->ID );
	3356	+ else :
	3357	+ // Get regular usermeta value for the user.
	3358	+ $approved_user['usermeta'] = get_user_meta( $approved_wp_user->ID, $advanced_usermeta, true );
	3359	+ endif;
3841	3360
3842		-
3843		- /**
3844		- * Renders the html elements for the pager above and below the Approved User list.
3845		- *
3846		- * @param integer $current_page Which page we are currently viewing.
3847		- * @param integer $users_per_page How many users to show per page.
3848		- * @param integer $total_users Total count of users in list.
3849		- * @param string $which Where to render the pager ('top' or 'bottom').
3850		- * @return void
3851		- */
3852		- private function render_user_pager( $current_page = 1, $users_per_page = 20, $total_users = 0, $which = 'top' ) {
3853		- $total_pages = ceil( $total_users / $users_per_page );
3854		- if ( $total_pages < 1 ) {
3855		- $total_pages = 1;
3856		- }
3857		-
3858		- /* TRANSLATORS: %s: number of users */
3859		- $output = ' <span class="displaying-num">' . sprintf( _n( '%s user', '%s users', $total_users, 'authorizer' ), number_format_i18n( $total_users ) ) . '</span>';
3860		-
3861		- $disable_first = $current_page <= 1;
3862		- $disable_prev = $current_page <= 1;
3863		- $disable_next = $current_page >= $total_pages;
3864		- $disable_last = $current_page >= $total_pages;
3865		-
3866		- $current_url = '';
3867		- if ( isset( $_SERVER['HTTP_HOST'], $_SERVER['REQUEST_URI'] ) ) {
3868		- $current_url = set_url_scheme( esc_url_raw( wp_unslash( $_SERVER['HTTP_HOST'] ) ) . esc_url_raw( wp_unslash( $_SERVER['REQUEST_URI'] ) ) );
3869		- $current_url = remove_query_arg( wp_removable_query_args(), $current_url );
3870		- }
3871		-
3872		- $page_links = array();
3873		-
3874		- $total_pages_before = '<span class="paging-input">';
3875		- $total_pages_after = '</span></span>';
3876		-
3877		- if ( $disable_first ) {
3878		- $page_links[] = '<span class="first-page tablenav-pages-navspan" aria-hidden="true">&laquo;</span>';
3879		- } else {
3880		- $page_links[] = sprintf(
3881		- "<a class='first-page' href='%s'><span class='screen-reader-text'>%s</span><span aria-hidden='true'>%s</span></a>",
3882		- esc_url( remove_query_arg( 'paged', $current_url ) ),
3883		- __( 'First page' ),
3884		- '&laquo;'
3885		- );
3886		- }
3887		-
3888		- if ( $disable_prev ) {
3889		- $page_links[] = '<span class="prev-page tablenav-pages-navspan" aria-hidden="true">&lsaquo;</span>';
3890		- } else {
3891		- $page_links[] = sprintf(
3892		- "<a class='prev-page' href='%s'><span class='screen-reader-text'>%s</span><span aria-hidden='true'>%s</span></a>",
3893		- esc_url( add_query_arg( 'paged', max( 1, $current_page - 1 ), $current_url ) ),
3894		- __( 'Previous page' ),
3895		- '&lsaquo;'
3896		- );
3897		- }
3898		-
3899		- if ( 'bottom' === $which ) {
3900		- $html_current_page = '<span class="current-page-text">' . $current_page . '</span>';
3901		- $total_pages_before = '<span class="screen-reader-text">' . __( 'Current Page' ) . '</span><span id="table-paging" class="paging-input"><span class="tablenav-paging-text">';
3902		- } else {
3903		- $html_current_page = sprintf(
3904		- "%s<input class='current-page' id='current-page-selector' type='text' name='paged' value='%s' size='%d' aria-describedby='table-paging' /><span class='tablenav-paging-text'>",
3905		- '<label for="current-page-selector" class="screen-reader-text">' . __( 'Current Page' ) . '</label>',
3906		- $current_page,
3907		- strlen( $total_pages )
3908		- );
3909		- }
3910		- /* TRANSLATORS: %s: number of pages */
3911		- $html_total_pages = sprintf( "<span class='total-pages'>%s</span>", number_format_i18n( $total_pages ) );
3912		- /* TRANSLATORS: 1: number of current page 2: number of total pages */
3913		- $page_links[] = $total_pages_before . sprintf( _x( '%1$s of %2$s', 'paging' ), $html_current_page, $html_total_pages ) . $total_pages_after;
3914		-
3915		- if ( $disable_next ) {
3916		- $page_links[] = '<span class="next-page tablenav-pages-navspan" aria-hidden="true">&rsaquo;</span>';
3917		- } else {
3918		- $page_links[] = sprintf(
3919		- "<a class='next-page' href='%s'><span class='screen-reader-text'>%s</span><span aria-hidden='true'>%s</span></a>",
3920		- esc_url( add_query_arg( 'paged', min( $total_pages, $current_page + 1 ), $current_url ) ),
3921		- __( 'Next page' ),
3922		- '&rsaquo;'
3923		- );
3924		- }
3925		-
3926		- if ( $disable_last ) {
3927		- $page_links[] = '<span class="last-page tablenav-pages-navspan" aria-hidden="true">&raquo;</span>';
3928		- } else {
3929		- $page_links[] = sprintf(
3930		- "<a class='last-page' href='%s'><span class='screen-reader-text'>%s</span><span aria-hidden='true'>%s</span></a>",
3931		- esc_url( add_query_arg( 'paged', $total_pages, $current_url ) ),
3932		- __( 'Last page' ),
3933		- '&raquo;'
3934		- );
3935		- }
3936		-
3937		- $pagination_links_class = 'pagination-links';
3938		- $output .= "\n<span class='$pagination_links_class'>" . join( "\n", $page_links ) . '</span>';
3939		-
3940		- $search_form = array();
3941		- if ( 'top' === $which ) {
3942		- // phpcs:ignore WordPress.CSRF.NonceVerification.NoNonceVerification
3943		- $search_term = isset( $_REQUEST['search'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['search'] ) ) : '';
3944		- $search_form[] = '<div class="search-box">';
3945		- $search_form[] = '<label class="screen-reader-text" for="user-search-input">' . __( 'Search Users', 'authorizer' ) . '</label>';
3946		- $search_form[] = '<input type="search" size="14" id="user-search-input" name="search" value="' . $search_term . '">';
3947		- $search_form[] = '<input type="button" id="search-submit" class="button" value="' . __( 'Search', 'authorizer' ) . '">';
3948		- $search_form[] = '</div>';
3949		- }
3950		- $search_form = join( "\n", $search_form );
3951		-
3952		- $output = "<div class='tablenav-pages'>$output</div>";
3953		- ?>
3954		- <div class="tablenav top">
3955		- <?php echo wp_kses( $output, $this->allowed_html ); ?>
3956		- <?php echo wp_kses( $search_form, $this->allowed_html ); ?>
3957		- </div>
3958		- <?php
3959		- }
3960		-
3961		-
3962		- /**
3963		- * Renders the html <li> element for a given user in a list.
3964		- *
3965		- * @param array $approved_user User array to render.
3966		- * @param int $key Index of user in list of users.
3967		- * @param string $option List user is in (e.g., 'access_users_approved').
3968		- * @param string $admin_mode Current admin context.
3969		- * @param string $advanced_usermeta Usermeta field to display.
3970		- * @return void
3971		- */
3972		- private function render_user_element( $approved_user, $key, $option, $admin_mode, $advanced_usermeta ) {
3973		- $is_local_user = array_key_exists( 'local_user', $approved_user ) && 'true' === $approved_user['local_user'];
3974		- $is_multisite_user = array_key_exists( 'multisite_user', $approved_user ) && true === $approved_user['multisite_user'];
3975		- $option_prefix = $is_multisite_user ? 'auth_multisite_settings_' : 'auth_settings_';
3976		- $option_id = $option_prefix . $option . '_' . $key;
3977		- $approved_wp_user = get_user_by( 'email', $approved_user['email'] );
3978		- $is_current_user = $approved_wp_user && get_current_user_id() === $approved_wp_user->ID;
3979		-
3980		- // Adjust javascript function prefixes if multisite.
3981		- $js_function_prefix = WP_Plugin_Authorizer::NETWORK_CONTEXT === $admin_mode ? 'authMultisite' : 'auth';
3982		- $is_multisite_admin_page = WP_Plugin_Authorizer::NETWORK_CONTEXT === $admin_mode;
3983		-
3984		- if ( ! $approved_wp_user ) :
3985		- $approved_user['is_wp_user'] = false;
3986		- else :
3987		- $approved_user['is_wp_user'] = true;
3988		- $approved_user['email'] = $approved_wp_user->user_email;
3989		- $approved_user['role'] = $is_multisite_admin_page || count( $approved_wp_user->roles ) === 0 ? $approved_user['role'] : array_shift( $approved_wp_user->roles );
3990		- $approved_user['date_added'] = $approved_wp_user->user_registered;
3991		-
3992		- // Get usermeta field from the WordPress user's real usermeta.
3993		- if ( strlen( $advanced_usermeta ) > 0 ) :
3994		- if ( strpos( $advanced_usermeta, 'acf___' ) === 0 && class_exists( 'acf' ) ) :
3995		- // Get ACF Field value for the user.
3996		- $approved_user['usermeta'] = get_field( str_replace( 'acf___', '', $advanced_usermeta ), 'user_' . $approved_wp_user->ID );
	3361	+ if ( is_array( $approved_user['usermeta'] ) || is_object( $approved_user['usermeta'] ) ) :
	3362	+ $approved_user['usermeta'] = serialize( $approved_user['usermeta'] );
	3363	+ endif;
	3364	+ endif;
3997	3365	else :
3998		- // Get regular usermeta value for the user.
3999		- $approved_user['usermeta'] = get_user_meta( $approved_wp_user->ID, $advanced_usermeta, true );
	3366	+ $approved_user['is_wp_user'] = false;
4000	3367	endif;
4001		- if ( is_array( $approved_user['usermeta'] ) || is_object( $approved_user['usermeta'] ) ) :
4002		- $approved_user['usermeta'] = serialize( $approved_user['usermeta'] );
4003		- endif;
4004		- endif;
4005		- endif;
4006		- if ( ! array_key_exists( 'usermeta', $approved_user ) ) :
4007		- $approved_user['usermeta'] = '';
4008		- endif;
4009		- ?>
4010		- <li>
4011		- <input
4012		- type="text"
4013		- id="<?php echo esc_attr( $option_id ); ?>"
4014		- value="<?php echo esc_attr( $approved_user['email'] ); ?>"
4015		- readonly="true"
4016		- class="<?php echo esc_attr( $this->create_class_name( 'email', $is_multisite_user ) ); ?>"
4017		- />
4018		- <select
4019		- id="<?php echo esc_attr( $option_id ); ?>_role"
4020		- class="<?php echo esc_attr( $this->create_class_name( 'role', $is_multisite_user ) ); ?>"
4021		- onchange="<?php echo esc_attr( $js_function_prefix ); ?>ChangeRole( this );"
4022		- <?php if ( $is_multisite_user ) : ?>
4023		- disabled="disabled"
4024		- <?php endif; ?>
4025		- >
4026		- <?php $disable_input = $is_current_user ? 'disabled' : null; ?>
4027		- <?php $this->wp_dropdown_permitted_roles( $approved_user['role'], $disable_input, $admin_mode ); ?>
	3368	+ if ( ! array_key_exists( 'usermeta', $approved_user ) ) :
	3369	+ $approved_user['usermeta'] = '';
	3370	+ endif; ?>
	3371	+ <li>
	3372	+ <input type="text" id="auth_settings_<?php echo $option; ?>_<?php echo $key; ?>" value="<?php echo $approved_user['email']; ?>" readonly="true" class="auth-email" />
	3373	+ <select id="auth_settings_<?php echo $option; ?>_<?php echo $key; ?>_role" class="auth-role" onchange="<?php echo $js_function_prefix; ?>change_role( this );">
	3374	+ <?php $disable_input = $is_current_user ? 'disabled' : null; ?>
	3375	+ <?php $this->wp_dropdown_permitted_roles( $approved_user['role'], $disable_input, $admin_mode ); ?>
	3376	+ </select>
	3377	+ <input type="text" id="auth_settings_<?php echo $option; ?>_<?php echo $key; ?>_date_added" value="<?php echo date( 'M Y', strtotime( $approved_user['date_added'] ) ); ?>" readonly="true" class="auth-date-added" />
	3378	+ <?php if ( strlen( $advanced_usermeta ) > 0 ) :
	3379	+ $should_show_usermeta_in_text_field = true; // Fallback renderer for usermeta; try to use a select first.
	3380	+ if ( strpos( $advanced_usermeta, 'acf___' ) === 0 && class_exists( 'acf' ) ) :
	3381	+ $field_object = get_field_object( str_replace('acf___', '', $advanced_usermeta ) );
	3382	+ if ( is_array( $field_object ) && array_key_exists( 'type', $field_object ) && $field_object['type'] === 'select' ) :
	3383	+ $should_show_usermeta_in_text_field = false; ?>
	3384	+ <select id="auth_settings_<?php echo $option; ?>_<?php echo $key; ?>_usermeta" class="auth-usermeta" onchange="<?php echo $js_function_prefix; ?>update_usermeta( this );" >
	3385	+ <option value=""<?php if ( empty( $approved_user['usermeta'] ) ) echo ' selected="selected"'; ?>><?php _e( '-- None --', 'authorizer' ); ?></option>
	3386	+ <?php foreach ( $field_object['choices'] as $key => $label ) : ?>
	3387	+ <option value="<?php echo $key; ?>"<?php if ( $key === $approved_user['usermeta'] || ( is_array( $approved_user['usermeta'] ) && $key === $approved_user['usermeta']['meta_value'] ) ) echo ' selected="selected"'; ?>><?php echo $label; ?></option>
	3388	+ <?php endforeach; ?>
	3389	+ </select>
	3390	+ <?php endif; ?>
	3391	+ <?php endif; ?>
	3392	+ <?php if ( $should_show_usermeta_in_text_field ) : ?>
	3393	+ <input type="text" id="auth_settings_<?php echo $option; ?>_<?php echo $key; ?>_usermeta" value="<?php echo htmlspecialchars( $approved_user['usermeta'], ENT_COMPAT ); ?>" class="auth-usermeta" />
	3394	+ <a class="button button-small button-primary update-usermeta" id="update_usermeta_<?php echo $key; ?>" onclick="<?php echo $js_function_prefix; ?>update_usermeta( this );" title="Update usermeta"><span class="glyphicon glyphicon-floppy-saved"></span></a>
	3395	+ <?php endif; ?>
	3396	+ <?php endif; ?>
	3397	+ <?php if ( ! $is_current_user ): ?>
	3398	+ <?php if ( ! $multisite_admin_page ) : ?>
	3399	+ <a class="button" id="block_user_<?php echo $key; ?>" onclick="<?php echo $js_function_prefix; ?>add_user( this, 'blocked', false ); <?php echo $js_function_prefix; ?>ignore_user( this, 'approved' );" title="<?php _e( 'Block/Ban user', 'authorizer' ); ?>"><span class="glyphicon glyphicon-ban-circle"></span></a>
	3400	+ <?php endif; ?>
	3401	+ <a class="button" id="ignore_user_<?php echo $key; ?>" onclick="<?php echo $js_function_prefix; ?>ignore_user(this, 'approved' );" title="<?php _e( 'Remove user', 'authorizer' ); ?>"><span class="glyphicon glyphicon-remove"></span></a>
	3402	+ <?php endif; ?>
	3403	+ <?php echo $local_user_icon; ?>
	3404	+ </li>
	3405	+ <?php endforeach; ?>
	3406	+ </ul>
	3407	+ <div id="new_auth_settings_<?php echo $option; ?>">
	3408	+ <input type="text" id="new_approved_user_email" placeholder="<?php _e( 'email address', 'authorizer' ); ?>" class="auth-email new" />
	3409	+ <select id="new_approved_user_role" class="auth-role">
	3410	+ <?php $this->wp_dropdown_permitted_roles( $access_default_role, 'not disabled', $admin_mode ); ?>
4028	3411	</select>
4029		- <input
4030		- type="text"
4031		- id="<?php echo esc_attr( $option_id ); ?>_date_added"
4032		- value="<?php echo esc_attr( date( 'M Y', strtotime( $approved_user['date_added'] ) ) ); ?>"
4033		- readonly="true"
4034		- class="<?php echo esc_attr( $this->create_class_name( 'date-added', $is_multisite_user ) ); ?>"
4035		- />
4036		- <?php
4037		- if ( strlen( $advanced_usermeta ) > 0 ) :
4038		- $should_show_usermeta_in_text_field = true; // Fallback renderer for usermeta; try to use a select first.
4039		- if ( strpos( $advanced_usermeta, 'acf___' ) === 0 && class_exists( 'acf' ) ) :
4040		- $field_object = get_field_object( str_replace( 'acf___', '', $advanced_usermeta ) );
4041		- if ( is_array( $field_object ) && array_key_exists( 'type', $field_object ) && 'select' === $field_object['type'] ) :
4042		- $should_show_usermeta_in_text_field = false;
4043		- ?>
4044		- <select
4045		- id="<?php echo esc_attr( $option_id ); ?>_usermeta"
4046		- class="<?php echo esc_attr( $this->create_class_name( 'usermeta', $is_multisite_user ) ); ?>"
4047		- onchange="<?php echo esc_attr( $js_function_prefix ); ?>UpdateUsermeta( this );"
4048		- >
4049		- <option value=""<?php selected( empty( $approved_user['usermeta'] ) ); ?>><?php esc_html_e( '-- None --', 'authorizer' ); ?></option>
4050		- <?php foreach ( $field_object['choices'] as $key => $label ) : ?>
4051		- <option value="<?php echo esc_attr( $key ); ?>"<?php selected( $key === $approved_user['usermeta'] || ( isset( $approved_user['usermeta']['meta_value'] ) && $key === $approved_user['usermeta']['meta_value'] ) ); ?>><?php echo esc_html( $label ); ?></option>
4052		- <?php endforeach; ?>
4053		- </select>
4054		- <?php endif; ?>
4055		- <?php endif; ?>
4056		- <?php if ( $should_show_usermeta_in_text_field ) : ?>
4057		- <input
4058		- type="text"
4059		- id="<?php echo esc_attr( $option_id ); ?>_usermeta"
4060		- value="<?php echo esc_attr( $approved_user['usermeta'], ENT_COMPAT ); ?>"
4061		- class="<?php echo esc_attr( $this->create_class_name( 'usermeta', $is_multisite_user ) ); ?>"
4062		- />
4063		- <a class="button button-small button-primary update-usermeta" id="update_usermeta_<?php echo esc_attr( $key ); ?>" onclick="<?php echo esc_attr( $js_function_prefix ); ?>UpdateUsermeta( this );" title="Update usermeta"><span class="glyphicon glyphicon-floppy-saved"></span></a>
4064		- <?php endif; ?>
4065		- <?php endif; ?>
4066		- <?php if ( ! $is_current_user && ! $is_multisite_user ) : ?>
4067		- <?php if ( ! $is_multisite_admin_page ) : ?>
4068		- <a class="button" id="block_user_<?php echo esc_attr( $key ); ?>" onclick="<?php echo esc_attr( $js_function_prefix ); ?>AddUser( this, 'blocked', false ); <?php echo esc_attr( $js_function_prefix ); ?>IgnoreUser( this, 'approved' );" title="<?php esc_attr_e( 'Block/Ban user', 'authorizer' ); ?>"><span class="glyphicon glyphicon-ban-circle"></span></a>
4069		- <?php endif; ?>
4070		- <a class="button" id="ignore_user_<?php echo esc_attr( $key ); ?>" onclick="<?php echo esc_attr( $js_function_prefix ); ?>IgnoreUser(this, 'approved' );" title="<?php esc_attr_e( 'Remove user', 'authorizer' ); ?>"><span class="glyphicon glyphicon-remove"></span></a>
4071		- <?php endif; ?>
4072		- <?php if ( $is_local_user ) : ?>
4073		- &nbsp;<a title="Local WordPress user" class="auth-local-user"><span class="glyphicon glyphicon-user"></span></a>
4074		- <?php endif; ?>
4075		- <?php if ( $is_multisite_user ) : ?>
4076		- &nbsp;<a title="WordPress Multisite user" class="auth-multisite-user"><span class="glyphicon glyphicon-globe"></span></a>
4077		- <?php endif; ?>
4078		- </li>
	3412	+ <div class="btn-group">
	3413	+ <a href="javascript:void(0);" class="btn button-primary dropdown-toggle" id="approve_user_new" onclick="<?php echo $js_function_prefix; ?>add_user(this, 'approved' );"><span class="glyphicon glyphicon-ok"></span> <?php _e( 'Approve', 'authorizer' ); ?></a>
	3414	+ <button type="button" class="btn button-primary dropdown-toggle" data-toggle="dropdown">
	3415	+ <span class="caret"></span>
	3416	+ <span class="sr-only"><?php _e( 'Toggle Dropdown', 'authorizer' ); ?></span>
	3417	+ </button>
	3418	+ <ul class="dropdown-menu" role="menu">
	3419	+ <li><a href="javascript:void(0);" onclick="<?php echo $js_function_prefix; ?>add_user( document.getElementById('approve_user_new' ), 'approved', true);"><?php _e( 'Create a local WordPress <br />account instead, and email <br />the user their password.', 'authorizer' ); ?></a></li>
	3420	+ </ul>
	3421	+ </div>
	3422	+ </div>
4079	3423	<?php
4080	3424	}
4081	3425
4082	3426
4083		- /**
4084		- * Settings print callback.
4085		- *
4086		- * @param string $args Args (e.g., multisite admin mode).
4087		- * @return void
4088		- */
4089		- public function print_combo_auth_access_users_blocked( $args = '' ) {
	3427	+ function print_combo_auth_access_users_blocked( $args = '' ) {
4090	3428	// Get plugin option.
4091		- $option = 'access_users_blocked';
	3429	+ $option = 'access_users_blocked';
4092	3430	$auth_settings_option = $this->get_plugin_option( $option );
4093	3431	$auth_settings_option = is_array( $auth_settings_option ) ? $auth_settings_option : array();
4094	3432
4095	3433	// Get default role for new blocked user dropdown.
4096		- $access_default_role = $this->get_plugin_option( 'access_default_role', WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
	3434	+ $access_default_role = $this->get_plugin_option( 'access_default_role', SINGLE_ADMIN, 'allow override' );
4097	3435
4098		- // Render wrapper div (for aligning pager to width of content).
4099		- ?>
4100		- <div class="wrapper_<?php echo esc_attr( $option ); ?>">
4101		- <ul id="list_auth_settings_<?php echo esc_attr( $option ); ?>" style="margin:0;">
4102		- <?php
4103		- foreach ( $auth_settings_option as $key => $blocked_user ) :
4104		- if ( empty( $blocked_user ) || count( $blocked_user ) < 1 ) :
4105		- continue;
4106		- endif;
4107		- $blocked_wp_user = get_user_by( 'email', $blocked_user['email'] );
4108		- if ( $blocked_wp_user ) :
4109		- $blocked_user['email'] = $blocked_wp_user->user_email;
4110		- $blocked_user['role'] = array_shift( $blocked_wp_user->roles );
4111		- $blocked_user['date_added'] = $blocked_wp_user->user_registered;
4112		- $blocked_user['is_wp_user'] = true;
4113		- else :
4114		- $blocked_user['is_wp_user'] = false;
4115		- endif;
4116		- ?>
4117		- <li>
4118		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>_<?php echo esc_attr( $key ); ?>" value="<?php echo esc_attr( $blocked_user['email'] ); ?>" readonly="true" class="auth-email" />
4119		- <select id="auth_settings_<?php echo esc_attr( $option ); ?>_<?php echo esc_attr( $key ); ?>_role" class="auth-role">
4120		- <?php $this->wp_dropdown_permitted_roles( $blocked_user['role'] ); ?>
4121		- </select>
4122		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>_<?php echo esc_attr( $key ); ?>_date_added" value="<?php echo esc_attr( date( 'M Y', strtotime( $blocked_user['date_added'] ) ) ); ?>" readonly="true" class="auth-date-added" />
4123		- <a class="button" id="ignore_user_<?php echo esc_attr( $key ); ?>" onclick="authIgnoreUser( this, 'blocked' );" title="<?php esc_attr_e( 'Remove user', 'authorizer' ); ?>"><span class="glyphicon glyphicon-remove"></span></a>
4124		- </li>
4125		- <?php endforeach; ?>
4126		- </ul>
4127		- <div id="new_auth_settings_<?php echo esc_attr( $option ); ?>">
4128		- <input type="text" id="new_blocked_user_email" placeholder="<?php esc_attr_e( 'email address', 'authorizer' ); ?>" class="auth-email new" />
4129		- <select id="new_blocked_user_role" class="auth-role">
4130		- <option value="<?php echo esc_attr( $access_default_role ); ?>"><?php echo esc_html( ucfirst( $access_default_role ) ); ?></option>
4131		- </select>
4132		- <a href="javascript:void(0);" class="button-primary button-add-user" id="block_user_new" onclick="authAddUser( this, 'blocked' );"><span class="glyphicon glyphicon-ban-circle"></span> <?php esc_html_e( 'Block', 'authorizer' ); ?></a>
4133		- </div>
	3436	+ // Print option elements.
	3437	+ ?><ul id="list_auth_settings_<?php echo $option; ?>" style="margin:0;">
	3438	+ <?php foreach ( $auth_settings_option as $key => $blocked_user ): ?>
	3439	+ <?php if ( empty( $blocked_user ) || count( $blocked_user ) < 1 ) continue; ?>
	3440	+ <?php if ( $blocked_wp_user = get_user_by( 'email', $blocked_user['email'] ) ): ?>
	3441	+ <?php $blocked_user['email'] = $blocked_wp_user->user_email; ?>
	3442	+ <?php $blocked_user['role'] = array_shift( $blocked_wp_user->roles ); ?>
	3443	+ <?php $blocked_user['date_added'] = $blocked_wp_user->user_registered; ?>
	3444	+ <?php $blocked_user['is_wp_user'] = true; ?>
	3445	+ <?php else: ?>
	3446	+ <?php $blocked_user['is_wp_user'] = false; ?>
	3447	+ <?php endif; ?>
	3448	+ <li>
	3449	+ <input type="text" id="auth_settings_<?php echo $option; ?>_<?php echo $key; ?>" value="<?php echo $blocked_user['email']; ?>" readonly="true" class="auth-email" />
	3450	+ <select id="auth_settings_<?php echo $option; ?>_<?php echo $key; ?>_role" class="auth-role">
	3451	+ <?php $this->wp_dropdown_permitted_roles( $blocked_user['role'] ); ?>
	3452	+ </select>
	3453	+ <input type="text" id="auth_settings_<?php echo $option; ?>_<?php echo $key; ?>_date_added" value="<?php echo date( 'M Y', strtotime( $blocked_user['date_added'] ) ); ?>" readonly="true" class="auth-date-added" />
	3454	+ <a class="button" id="ignore_user_<?php echo $key; ?>" onclick="auth_ignore_user(this, 'blocked' );" title="<?php _e( 'Remove user', 'authorizer' ); ?>"><span class="glyphicon glyphicon-remove"></span></a>
	3455	+ </li>
	3456	+ <?php endforeach; ?>
	3457	+ </ul>
	3458	+ <div id="new_auth_settings_<?php echo $option; ?>">
	3459	+ <input type="text" id="new_blocked_user_email" placeholder="<?php _e( 'email address', 'authorizer' ); ?>" class="auth-email new" />
	3460	+ <select id="new_blocked_user_role" class="auth-role">
	3461	+ <option value="<?php echo $access_default_role; ?>"><?php echo ucfirst( $access_default_role ); ?></option>
	3462	+ </select>
	3463	+ <a href="javascript:void(0);" class="button-primary" id="block_user_new" onclick="auth_add_user(this, 'blocked' );"><span class="glyphicon glyphicon-ban-circle"></span> <?php _e( 'Block', 'authorizer' ); ?></a>
4134	3464	</div>
4135	3465	<?php
4136	3466	}
4137	3467
4138	3468
4139		- /**
4140		- * Settings print callback.
4141		- *
4142		- * @param string $args Args (e.g., multisite admin mode).
4143		- * @return void
4144		- */
4145		- public function print_section_info_access_login( $args = '' ) {
4146		- ?>
4147		- <div id="section_info_access_login" class="section_info">
	3469	+ function print_section_info_access_login( $args = '' ) {
	3470	+ ?><div id="section_info_access_login" class="section_info">
4148	3471	<?php wp_nonce_field( 'save_auth_settings', 'nonce_save_auth_settings' ); ?>
4149		- <p><?php esc_html_e( 'Choose who is able to log into this site below.', 'authorizer' ); ?></p>
4150		- </div>
4151		- <?php
	3472	+ <p><?php _e( 'Choose who is able to log into this site below.', 'authorizer' ); ?></p>
	3473	+ </div><?php
4152	3474	}
4153	3475
4154	3476
4155		- /**
4156		- * Settings print callback.
4157		- *
4158		- * @param string $args Args (e.g., multisite admin mode).
4159		- * @return void
4160		- */
4161		- public function print_radio_auth_access_who_can_login( $args = '' ) {
	3477	+ function print_radio_auth_access_who_can_login( $args = '' ) {
4162	3478	// Get plugin option.
4163		- $option = 'access_who_can_login';
4164		- $admin_mode = $this->get_admin_mode( $args );
	3479	+ $option = 'access_who_can_login';
	3480	+ $admin_mode = $this->get_admin_mode( $args );
4165	3481	$auth_settings_option = $this->get_plugin_option( $option, $admin_mode, 'allow override', 'print overlay' );
4166	3482
4167	3483	// If this site is configured independently of any multisite overrides, make sure we are not grabbing the multisite value; otherwise, grab the multisite value to show behind the disabled overlay.
4168		- if ( is_multisite() && 1 === intval( $this->get_plugin_option( 'advanced_override_multisite' ) ) ) {
	3484	+ if ( is_multisite() && $this->get_plugin_option( 'advanced_override_multisite' ) == '1' ) {
4169	3485	$auth_settings_option = $this->get_plugin_option( $option );
4170		- } elseif ( is_multisite() && WP_Plugin_Authorizer::SINGLE_CONTEXT === $admin_mode && $this->get_plugin_option( 'multisite_override', WP_Plugin_Authorizer::NETWORK_CONTEXT ) === '1' ) {
	3486	+ } elseif ( is_multisite() && $admin_mode === SINGLE_ADMIN && $this->get_plugin_option( 'multisite_override', MULTISITE_ADMIN ) === '1' ) {
4171	3487	// Workaround: javascript code hides/shows other settings based
4172	3488	// on the selection in this option. If this option is overridden
4173	3489	// by a multisite option, it should show that value in order to
4174	3490	// correctly display the other appropriate options.
		@@ -4174,49 +3490,33 @@
4174	3490	// correctly display the other appropriate options.
4175	3491	// Side effect: this site option will be overwritten by the
4176	3492	// multisite option on save. Since this is a 2-item radio, we
4177	3493	// determined this was acceptable.
4178		- $auth_settings_option = $this->get_plugin_option( $option, WP_Plugin_Authorizer::NETWORK_CONTEXT );
	3494	+ $auth_settings_option = $this->get_plugin_option( $option, MULTISITE_ADMIN );
4179	3495	}
4180	3496
4181	3497	// Print option elements.
4182		- ?>
4183		- <input type="radio" id="radio_auth_settings_<?php echo esc_attr( $option ); ?>_external_users" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="external_users"<?php checked( 'external_users' === $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo esc_attr( $option ); ?>_external_users"><?php esc_html_e( 'All authenticated users (All external service users and all WordPress users)', 'authorizer' ); ?></label><br />
4184		- <input type="radio" id="radio_auth_settings_<?php echo esc_attr( $option ); ?>_approved_users" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="approved_users"<?php checked( 'approved_users' === $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo esc_attr( $option ); ?>_approved_users"><?php esc_html_e( 'Only', 'authorizer' ); ?> <a href="javascript:chooseTab('access_lists' );" id="dashboard_link_approved_users"><?php esc_html_e( 'approved users', 'authorizer' ); ?></a> <?php esc_html_e( '(Approved external users and all WordPress users)', 'authorizer' ); ?></label><br />
4185		- <?php
	3498	+ ?><input type="radio" id="radio_auth_settings_<?php echo $option; ?>_external_users" name="auth_settings[<?php echo $option; ?>]" value="external_users"<?php checked( 'external_users' == $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo $option; ?>_external_users"><?php _e( 'All authenticated users (All external service users and all WordPress users)', 'authorizer' ); ?></label><br />
	3499	+ <input type="radio" id="radio_auth_settings_<?php echo $option; ?>_approved_users" name="auth_settings[<?php echo $option; ?>]" value="approved_users"<?php checked( 'approved_users' == $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo $option; ?>_approved_users"><?php _e( 'Only', 'authorizer' ); ?> <a href="javascript:choose_tab('access_lists' );" id="dashboard_link_approved_users"><?php _e( 'approved users', 'authorizer' ); ?></a> <?php _e( '(Approved external users and all WordPress users)', 'authorizer' ); ?></label><br /><?php
4186	3500	}
4187	3501
4188	3502
4189		- /**
4190		- * Settings print callback.
4191		- *
4192		- * @param string $args Args (e.g., multisite admin mode).
4193		- * @return void
4194		- */
4195		- public function print_select_auth_access_role_receive_pending_emails( $args = '' ) {
	3503	+ function print_select_auth_access_role_receive_pending_emails( $args = '' ) {
4196	3504	// Get plugin option.
4197		- $option = 'access_role_receive_pending_emails';
	3505	+ $option = 'access_role_receive_pending_emails';
4198	3506	$auth_settings_option = $this->get_plugin_option( $option );
4199	3507
4200	3508	// Print option elements.
4201		- ?>
4202		- <select id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]">
4203		- <option value="---" <?php selected( $auth_settings_option, '---' ); ?>><?php esc_html_e( "None (Don't send notification emails)", 'authorizer' ); ?></option>
	3509	+ ?><select id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]">
	3510	+ <option value="---" <?php selected( $auth_settings_option, '---' ); ?>><?php _e( "None (Don't send notification emails)", 'authorizer' ); ?></option>
4204	3511	<?php wp_dropdown_roles( $auth_settings_option ); ?>
4205		- </select>
4206		- <?php
	3512	+ </select><?php
4207	3513	}
4208	3514
4209	3515
4210		- /**
4211		- * Settings print callback.
4212		- *
4213		- * @param string $args Args (e.g., multisite admin mode).
4214		- * @return void
4215		- */
4216		- public function print_wysiwyg_auth_access_pending_redirect_to_message( $args = '' ) {
	3516	+ function print_wysiwyg_auth_access_pending_redirect_to_message( $args = '' ) {
4217	3517	// Get plugin option.
4218		- $option = 'access_pending_redirect_to_message';
	3518	+ $option = 'access_pending_redirect_to_message';
4219	3519	$auth_settings_option = $this->get_plugin_option( $option );
4220	3520
4221	3521	// Print option elements.
4222	3522	wp_editor(
		@@ -4225,25 +3525,19 @@
4225	3525	array(
4226	3526	'media_buttons' => false,
4227	3527	'textarea_name' => "auth_settings[$option]",
4228	3528	'textarea_rows' => 5,
4229		- 'tinymce' => true,
4230		- 'teeny' => true,
4231		- 'quicktags' => false,
	3529	+ 'tinymce' => true,
	3530	+ 'teeny' => true,
	3531	+ 'quicktags' => false,
4232	3532	)
4233	3533	);
4234	3534	}
4235	3535
4236	3536
4237		- /**
4238		- * Settings print callback.
4239		- *
4240		- * @param string $args Args (e.g., multisite admin mode).
4241		- * @return void
4242		- */
4243		- public function print_wysiwyg_auth_access_blocked_redirect_to_message( $args = '' ) {
	3537	+ function print_wysiwyg_auth_access_blocked_redirect_to_message( $args = '' ) {
4244	3538	// Get plugin option.
4245		- $option = 'access_blocked_redirect_to_message';
	3539	+ $option = 'access_blocked_redirect_to_message';
4246	3540	$auth_settings_option = $this->get_plugin_option( $option );
4247	3541
4248	3542	// Print option elements.
4249	3543	wp_editor(
		@@ -4252,61 +3546,39 @@
4252	3546	array(
4253	3547	'media_buttons' => false,
4254	3548	'textarea_name' => "auth_settings[$option]",
4255	3549	'textarea_rows' => 5,
4256		- 'tinymce' => true,
4257		- 'teeny' => true,
4258		- 'quicktags' => false,
	3550	+ 'tinymce' => true,
	3551	+ 'teeny' => true,
	3552	+ 'quicktags' => false,
4259	3553	)
4260	3554	);
4261	3555	}
4262	3556
4263	3557
4264		- /**
4265		- * Settings print callback.
4266		- *
4267		- * @param string $args Args (e.g., multisite admin mode).
4268		- * @return void
4269		- */
4270		- public function print_checkbox_auth_access_should_email_approved_users( $args = '' ) {
	3558	+ function print_checkbox_auth_access_should_email_approved_users( $args = '' ) {
4271	3559	// Get plugin option.
4272		- $option = 'access_should_email_approved_users';
	3560	+ $option = 'access_should_email_approved_users';
4273	3561	$auth_settings_option = $this->get_plugin_option( $option );
4274	3562
4275	3563	// Print option elements.
4276		- ?>
4277		- <input type="checkbox" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="1"<?php checked( 1 === intval( $auth_settings_option ) ); ?> /><label for="auth_settings_<?php echo esc_attr( $option ); ?>"><?php esc_html_e( 'Send a welcome email when approving a new user', 'authorizer' ); ?></label>
4278		- <?php
	3564	+ ?><input type="checkbox" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="1"<?php checked( 1 == $auth_settings_option ); ?> /><label for="auth_settings_<?php echo $option; ?>"><?php _e( 'Send a welcome email when approving a new user', 'authorizer' ); ?></label><?php
4279	3565	}
4280	3566
4281	3567
4282		- /**
4283		- * Settings print callback.
4284		- *
4285		- * @param string $args Args (e.g., multisite admin mode).
4286		- * @return void
4287		- */
4288		- public function print_text_auth_access_email_approved_users_subject( $args = '' ) {
	3568	+ function print_text_auth_access_email_approved_users_subject( $args = '' ) {
4289	3569	// Get plugin option.
4290		- $option = 'access_email_approved_users_subject';
	3570	+ $option = 'access_email_approved_users_subject';
4291	3571	$auth_settings_option = $this->get_plugin_option( $option );
4292	3572
4293	3573	// Print option elements.
4294		- ?>
4295		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="Welcome to [site_name]!" style="width:320px;" /><br /><small><?php echo wp_kses( __( 'You can use the <b>[site_name]</b> shortcode.', 'authorizer' ), $this->allowed_html ); ?></small>
4296		- <?php
	3574	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="Welcome to [site_name]!" style="width:320px;" /><br /><small><?php _e( 'You can use the <b>[site_name]</b> shortcode.', 'authorizer' ); ?></small><?php
4297	3575	}
4298	3576
4299	3577
4300		- /**
4301		- * Settings print callback.
4302		- *
4303		- * @param string $args Args (e.g., multisite admin mode).
4304		- * @return void
4305		- */
4306		- public function print_wysiwyg_auth_access_email_approved_users_body( $args = '' ) {
	3578	+ function print_wysiwyg_auth_access_email_approved_users_body( $args = '' ) {
4307	3579	// Get plugin option.
4308		- $option = 'access_email_approved_users_body';
	3580	+ $option = 'access_email_approved_users_body';
4309	3581	$auth_settings_option = $this->get_plugin_option( $option );
4310	3582
4311	3583	// Print option elements.
4312	3584	wp_editor(
		@@ -4315,60 +3587,42 @@
4315	3587	array(
4316	3588	'media_buttons' => false,
4317	3589	'textarea_name' => "auth_settings[$option]",
4318	3590	'textarea_rows' => 9,
4319		- 'tinymce' => true,
4320		- 'teeny' => true,
4321		- 'quicktags' => false,
	3591	+ 'tinymce' => true,
	3592	+ 'teeny' => true,
	3593	+ 'quicktags' => false,
4322	3594	)
4323	3595	);
4324		- ?>
4325		- <small>
4326		- <?php
4327		- printf(
4328		- /* TRANSLATORS: 1: Shortcode for site name 2: Shortcode for site URL 3: Shortcode for user email */
4329		- wp_kses( __( 'You can use %1$s, %2$s, and %3$s shortcodes.', 'authorizer' ), $this->allowed_html ),
4330		- '<b>[site_name]</b>',
4331		- '<b>[site_url]</b>',
4332		- '<b>[user_email]</b>'
4333		- );
4334		- ?>
4335		- </small>
4336		- <?php
	3596	+
	3597	+ ?><small><?php printf(
	3598	+ /* TRANSLATORS: 1: Shortcode for site name 2: Shortcode for site URL 3: Shortcode for user email */
	3599	+ __( 'You can use %1$s, %2$s, and %3$s shortcodes.', 'authorizer' ),
	3600	+ '<b>[site_name]</b>',
	3601	+ '<b>[site_url]</b>',
	3602	+ '<b>[user_email]</b>'
	3603	+ ); ?></small><?php
	3604	+
4337	3605	}
4338	3606
4339	3607
4340		- /**
4341		- * Settings print callback.
4342		- *
4343		- * @param string $args Args (e.g., multisite admin mode).
4344		- * @return void
4345		- */
4346		- public function print_section_info_access_public( $args = '' ) {
4347		- ?>
4348		- <div id="section_info_access_public" class="section_info">
4349		- <p><?php esc_html_e( 'Choose your public access options here.', 'authorizer' ); ?></p>
4350		- </div>
4351		- <?php
	3608	+ function print_section_info_access_public( $args = '' ) {
	3609	+ ?><div id="section_info_access_public" class="section_info">
	3610	+ <p><?php _e( 'Choose your public access options here.', 'authorizer' ); ?></p>
	3611	+ </div><?php
4352	3612	}
4353	3613
4354	3614
4355		- /**
4356		- * Settings print callback.
4357		- *
4358		- * @param string $args Args (e.g., multisite admin mode).
4359		- * @return void
4360		- */
4361		- public function print_radio_auth_access_who_can_view( $args = '' ) {
	3615	+ function print_radio_auth_access_who_can_view( $args = '' ) {
4362	3616	// Get plugin option.
4363		- $option = 'access_who_can_view';
4364		- $admin_mode = $this->get_admin_mode( $args );
	3617	+ $option = 'access_who_can_view';
	3618	+ $admin_mode = $this->get_admin_mode( $args );
4365	3619	$auth_settings_option = $this->get_plugin_option( $option, $admin_mode, 'allow override', 'print overlay' );
4366	3620
4367	3621	// If this site is configured independently of any multisite overrides, make sure we are not grabbing the multisite value; otherwise, grab the multisite value to show behind the disabled overlay.
4368		- if ( is_multisite() && 1 === intval( $this->get_plugin_option( 'advanced_override_multisite' ) ) ) {
	3622	+ if ( is_multisite() && $this->get_plugin_option( 'advanced_override_multisite' ) == '1' ) {
4369	3623	$auth_settings_option = $this->get_plugin_option( $option );
4370		- } elseif ( is_multisite() && WP_Plugin_Authorizer::SINGLE_CONTEXT === $admin_mode && '1' === $this->get_plugin_option( 'multisite_override', WP_Plugin_Authorizer::NETWORK_CONTEXT ) ) {
	3624	+ } elseif ( is_multisite() && $admin_mode === SINGLE_ADMIN && $this->get_plugin_option( 'multisite_override', MULTISITE_ADMIN ) === '1' ) {
4371	3625	// Workaround: javascript code hides/shows other settings based
4372	3626	// on the selection in this option. If this option is overridden
4373	3627	// by a multisite option, it should show that value in order to
4374	3628	// correctly display the other appropriate options.
		@@ -4374,66 +3628,42 @@
4374	3628	// correctly display the other appropriate options.
4375	3629	// Side effect: this site option will be overwritten by the
4376	3630	// multisite option on save. Since this is a 2-item radio, we
4377	3631	// determined this was acceptable.
4378		- $auth_settings_option = $this->get_plugin_option( $option, WP_Plugin_Authorizer::NETWORK_CONTEXT );
	3632	+ $auth_settings_option = $this->get_plugin_option( $option, MULTISITE_ADMIN );
4379	3633	}
4380	3634
4381	3635	// Print option elements.
4382		- ?>
4383		- <input type="radio" id="radio_auth_settings_<?php echo esc_attr( $option ); ?>_everyone" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="everyone"<?php checked( 'everyone' === $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo esc_attr( $option ); ?>_everyone"><?php esc_html_e( 'Everyone can see the site', 'authorizer' ); ?></label><br />
4384		- <input type="radio" id="radio_auth_settings_<?php echo esc_attr( $option ); ?>_logged_in_users" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="logged_in_users"<?php checked( 'logged_in_users' === $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo esc_attr( $option ); ?>_logged_in_users"><?php esc_html_e( 'Only logged in users can see the site', 'authorizer' ); ?></label><br />
4385		- <?php
	3636	+ ?><input type="radio" id="radio_auth_settings_<?php echo $option; ?>_everyone" name="auth_settings[<?php echo $option; ?>]" value="everyone"<?php checked( 'everyone' == $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo $option; ?>_everyone"><?php _e( 'Everyone can see the site', 'authorizer' ); ?></label><br />
	3637	+ <input type="radio" id="radio_auth_settings_<?php echo $option; ?>_logged_in_users" name="auth_settings[<?php echo $option; ?>]" value="logged_in_users"<?php checked( 'logged_in_users' == $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo $option; ?>_logged_in_users"><?php _e( 'Only logged in users can see the site', 'authorizer' ); ?></label><br /><?php
4386	3638	}
4387	3639
4388	3640
4389		- /**
4390		- * Settings print callback.
4391		- *
4392		- * @param string $args Args (e.g., multisite admin mode).
4393		- * @return void
4394		- */
4395		- public function print_radio_auth_access_redirect( $args = '' ) {
	3641	+ function print_radio_auth_access_redirect( $args = '' ) {
4396	3642	// Get plugin option.
4397		- $option = 'access_redirect';
	3643	+ $option = 'access_redirect';
4398	3644	$auth_settings_option = $this->get_plugin_option( $option );
4399	3645
4400	3646	// Print option elements.
4401		- ?>
4402		- <input type="radio" id="radio_auth_settings_<?php echo esc_attr( $option ); ?>_to_login" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="login"<?php checked( 'login' === $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo esc_attr( $option ); ?>_to_login"><?php esc_html_e( 'Send them to the login screen', 'authorizer' ); ?></label><br />
4403		- <input type="radio" id="radio_auth_settings_<?php echo esc_attr( $option ); ?>_to_message" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="message"<?php checked( 'message' === $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo esc_attr( $option ); ?>_to_message"><?php esc_html_e( 'Show them the anonymous access message (below)', 'authorizer' ); ?></label>
4404		- <?php
	3647	+ ?><input type="radio" id="radio_auth_settings_<?php echo $option; ?>_to_login" name="auth_settings[<?php echo $option; ?>]" value="login"<?php checked( 'login' == $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo $option; ?>_to_login"><?php _e( 'Send them to the login screen', 'authorizer' ); ?></label><br />
	3648	+ <input type="radio" id="radio_auth_settings_<?php echo $option; ?>_to_message" name="auth_settings[<?php echo $option; ?>]" value="message"<?php checked( 'message' == $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo $option; ?>_to_message"><?php _e( 'Show them the anonymous access message (below)', 'authorizer' ); ?></label><?php
4405	3649	}
4406	3650
4407	3651
4408		- /**
4409		- * Settings print callback.
4410		- *
4411		- * @param string $args Args (e.g., multisite admin mode).
4412		- * @return void
4413		- */
4414		- public function print_radio_auth_access_public_warning( $args = '' ) {
	3652	+ function print_radio_auth_access_public_warning( $args = '' ) {
4415	3653	// Get plugin option.
4416		- $option = 'access_public_warning';
	3654	+ $option = 'access_public_warning';
4417	3655	$auth_settings_option = $this->get_plugin_option( $option );
4418	3656
4419	3657	// Print option elements.
4420		- ?>
4421		- <input type="radio" id="radio_auth_settings_<?php echo esc_attr( $option ); ?>_no" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="no_warning"<?php checked( 'no_warning' === $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo esc_attr( $option ); ?>_no"><?php echo wp_kses( __( 'Show them the page <strong>without</strong> the anonymous access message', 'authorizer' ), $this->allowed_html ); ?></label><br />
4422		- <input type="radio" id="radio_auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="warning"<?php checked( 'warning' === $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo esc_attr( $option ); ?>"><?php echo wp_kses( __( 'Show them the page <strong>with</strong> the anonymous access message (marked up as a <a href="http://getbootstrap.com/components/#alerts-dismissible" target="_blank">Bootstrap Dismissible Alert</a>)', 'authorizer' ), $this->allowed_html ); ?></label>
4423		- <?php
	3658	+ ?><input type="radio" id="radio_auth_settings_<?php echo $option; ?>_no" name="auth_settings[<?php echo $option; ?>]" value="no_warning"<?php checked( 'no_warning' == $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo $option; ?>_no"><?php _e( 'Show them the page <strong>without</strong> the anonymous access message', 'authorizer' ); ?></label><br />
	3659	+ <input type="radio" id="radio_auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="warning"<?php checked( 'warning' == $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo $option; ?>"><?php _e( 'Show them the page <strong>with</strong> the anonymous access message (marked up as a <a href="http://getbootstrap.com/components/#alerts-dismissible" target="_blank">Bootstrap Dismissible Alert</a>)', 'authorizer' ); ?></label><?php
4424	3660	}
4425	3661
4426	3662
4427		- /**
4428		- * Settings print callback.
4429		- *
4430		- * @param string $args Args (e.g., multisite admin mode).
4431		- * @return void
4432		- */
4433		- public function print_wysiwyg_auth_access_redirect_to_message( $args = '' ) {
	3663	+ function print_wysiwyg_auth_access_redirect_to_message( $args = '' ) {
4434	3664	// Get plugin option.
4435		- $option = 'access_redirect_to_message';
	3665	+ $option = 'access_redirect_to_message';
4436	3666	$auth_settings_option = $this->get_plugin_option( $option );
4437	3667
4438	3668	// Print option elements.
4439	3669	wp_editor(
		@@ -4442,25 +3672,19 @@
4442	3672	array(
4443	3673	'media_buttons' => false,
4444	3674	'textarea_name' => "auth_settings[$option]",
4445	3675	'textarea_rows' => 5,
4446		- 'tinymce' => true,
4447		- 'teeny' => true,
4448		- 'quicktags' => false,
	3676	+ 'tinymce' => true,
	3677	+ 'teeny' => true,
	3678	+ 'quicktags' => false,
4449	3679	)
4450	3680	);
4451	3681	}
4452	3682
4453	3683
4454		- /**
4455		- * Settings print callback.
4456		- *
4457		- * @param string $args Args (e.g., multisite admin mode).
4458		- * @return void
4459		- */
4460		- public function print_multiselect_auth_access_public_pages( $args = '' ) {
	3684	+ function print_multiselect_auth_access_public_pages( $args = '' ) {
4461	3685	// Get plugin option.
4462		- $option = 'access_public_pages';
	3686	+ $option = 'access_public_pages';
4463	3687	$auth_settings_option = $this->get_plugin_option( $option );
4464	3688	$auth_settings_option = is_array( $auth_settings_option ) ? $auth_settings_option : array();
4465	3689
4466	3690	$post_types = array_merge( array( 'page', 'post' ), get_post_types( array( '_builtin' => false ), 'names' ) );
		@@ -4466,31 +3690,23 @@
4466	3690	$post_types = array_merge( array( 'page', 'post' ), get_post_types( array( '_builtin' => false ), 'names' ) );
4467	3691	$post_types = is_array( $post_types ) ? $post_types : array();
4468	3692
4469	3693	// Print option elements.
4470		- ?>
4471		- <select id="auth_settings_<?php echo esc_attr( $option ); ?>" multiple="multiple" name="auth_settings[<?php echo esc_attr( $option ); ?>][]">
4472		- <optgroup label="<?php esc_attr_e( 'Home', 'authorizer' ); ?>">
4473		- <option value="home" <?php selected( in_array( 'home', $auth_settings_option, true ) ); ?>><?php esc_html_e( 'Home Page', 'authorizer' ); ?></option>
4474		- <option value="auth_public_404" <?php selected( in_array( 'auth_public_404', $auth_settings_option, true ) ); ?>><?php esc_html_e( 'Nonexistent (404) Pages', 'authorizer' ); ?></option>
	3694	+ ?><select id="auth_settings_<?php echo $option; ?>" multiple="multiple" name="auth_settings[<?php echo $option; ?>][]">
	3695	+ <optgroup label="<?php _e( 'Home', 'authorizer' ); ?>">
	3696	+ <option value="home" <?php echo in_array( 'home', $auth_settings_option ) ? 'selected="selected"' : ''; ?>><?php _e( 'Home Page', 'authorizer' ); ?></option>
	3697	+ <option value="auth_public_404" <?php echo in_array( 'auth_public_404', $auth_settings_option ) ? 'selected="selected"' : ''; ?>><?php _e( 'Nonexistent (404) Pages', 'authorizer' ); ?></option>
4475	3698	</optgroup>
4476		- <?php foreach ( $post_types as $post_type ) : ?>
4477		- <optgroup label="<?php echo esc_attr( ucfirst( $post_type ) ); ?>">
4478		- <?php
4479		- $pages = get_posts(
4480		- array(
4481		- 'post_type' => $post_type,
4482		- 'posts_per_page' => 1000, // phpcs:ignore WordPress.VIP.PostsPerPage.posts_per_page_posts_per_page
4483		- )
4484		- );
4485		- $pages = is_array( $pages ) ? $pages : array();
4486		- foreach ( $pages as $page ) :
4487		- ?>
4488		- <option value="<?php echo esc_attr( $page->ID ); ?>" <?php selected( in_array( strval( $page->ID ), $auth_settings_option, true ) ); ?>><?php echo esc_html( $page->post_title ); ?></option>
	3699	+ <?php foreach ( $post_types as $post_type ): ?>
	3700	+ <optgroup label="<?php echo ucfirst( $post_type ); ?>">
	3701	+ <?php $pages = get_posts( array( 'post_type' => $post_type, 'posts_per_page' => -1 ) ); ?>
	3702	+ <?php $pages = is_array( $pages ) ? $pages : array(); ?>
	3703	+ <?php foreach ( $pages as $page ): ?>
	3704	+ <option value="<?php echo $page->ID; ?>" <?php echo in_array( $page->ID, $auth_settings_option ) ? 'selected="selected"' : ''; ?>><?php echo $page->post_title; ?></option>
4489	3705	<?php endforeach; ?>
4490	3706	</optgroup>
4491	3707	<?php endforeach; ?>
4492		- <optgroup label="<?php esc_attr_e( 'Categories', 'authorizer' ); ?>">
	3708	+ <optgroup label="<?php _e( 'Categories', 'authorizer' ); ?>">
4493	3709	<?php
4494	3710	// If sitepress-multilingual-cms plugin is enabled, temporarily disable
4495	3711	// its terms_clauses filter since it conflicts with the category handling.
4496	3712	if ( array_key_exists( 'sitepress', $GLOBALS ) && is_object( $GLOBALS['sitepress'] ) ) {
		@@ -4499,155 +3715,107 @@
4499	3715	add_filter( 'terms_clauses', array( $GLOBALS['sitepress'], 'terms_clauses' ) );
4500	3716	} else {
4501	3717	$categories = get_categories( array( 'hide_empty' => false ) );
4502	3718	}
4503		- foreach ( $categories as $category ) :
4504		- ?>
4505		- <option value="<?php echo esc_attr( 'cat_' . $category->slug ); ?>" <?php selected( in_array( 'cat_' . $category->slug, $auth_settings_option, true ) ); ?>><?php echo esc_html( $category->name ); ?></option>
	3719	+ foreach ( $categories as $category ) : ?>
	3720	+ <option value="<?php echo 'cat_' . $category->slug; ?>" <?php echo in_array( 'cat_' . $category->slug, $auth_settings_option ) ? 'selected="selected"' : ''; ?>><?php echo $category->name; ?></option>
4506	3721	<?php endforeach; ?>
4507	3722	</optgroup>
4508		- </select>
4509		- <?php
	3723	+ </select><?php
4510	3724	}
4511	3725
4512	3726
4513		- /**
4514		- * Settings print callback.
4515		- *
4516		- * @param string $args Args (e.g., multisite admin mode).
4517		- * @return void
4518		- */
4519		- public function print_section_info_external( $args = '' ) {
4520		- ?>
4521		- <div id="section_info_external" class="section_info">
4522		- <p><?php esc_html_e( 'Enter your external server settings below.', 'authorizer' ); ?></p>
4523		- </div>
4524		- <?php
	3727	+ function print_section_info_external( $args = '' ) {
	3728	+ ?><div id="section_info_external" class="section_info">
	3729	+ <p><?php _e( 'Enter your external server settings below.', 'authorizer' ); ?></p>
	3730	+ </div><?php
4525	3731	}
4526	3732
4527	3733
4528		- /**
4529		- * Settings print callback.
4530		- *
4531		- * @param string $args Args (e.g., multisite admin mode).
4532		- * @return void
4533		- */
4534		- public function print_select_auth_access_default_role( $args = '' ) {
	3734	+ function get_admin_mode( $args ) {
	3735	+ if ( is_array( $args ) && array_key_exists( MULTISITE_ADMIN, $args ) && $args[MULTISITE_ADMIN] === true ) {
	3736	+ return MULTISITE_ADMIN;
	3737	+ } else {
	3738	+ return SINGLE_ADMIN;
	3739	+ }
	3740	+ }
	3741	+
	3742	+
	3743	+ function print_select_auth_access_default_role( $args = '' ) {
4535	3744	// Get plugin option.
4536		- $option = 'access_default_role';
	3745	+ $option = 'access_default_role';
4537	3746	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4538	3747
4539	3748	// Print option elements.
4540		- ?>
4541		- <select id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]">
	3749	+ ?><select id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]">
4542	3750	<?php wp_dropdown_roles( $auth_settings_option ); ?>
4543		- <option value=""<?php selected( '' === $auth_settings_option ); ?>><?php esc_html_e( '-- None --', 'authorizer' ); ?></option>
4544		- </select>
4545		- <?php
	3751	+ </select><?php
4546	3752	}
4547	3753
4548	3754
4549		- /**
4550		- * Settings print callback.
4551		- *
4552		- * @param string $args Args (e.g., multisite admin mode).
4553		- * @return void
4554		- */
4555		- public function print_checkbox_auth_external_google( $args = '' ) {
	3755	+ function print_checkbox_auth_external_google( $args = '' ) {
4556	3756	// Get plugin option.
4557		- $option = 'google';
	3757	+ $option = 'google';
4558	3758	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4559	3759
4560	3760	// Print option elements.
4561		- ?>
4562		- <input type="checkbox" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="1"<?php checked( 1 === intval( $auth_settings_option ) ); ?> /><label for="auth_settings_<?php echo esc_attr( $option ); ?>"><?php esc_html_e( 'Enable Google Logins', 'authorizer' ); ?></label>
4563		- <?php
	3761	+ ?><input type="checkbox" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="1"<?php checked( 1 == $auth_settings_option ); ?> /><label for="auth_settings_<?php echo $option; ?>"><?php _e( 'Enable Google Logins', 'authorizer' ); ?></label><?php
4564	3762	}
4565	3763
4566	3764
4567		- /**
4568		- * Settings print callback.
4569		- *
4570		- * @param string $args Args (e.g., multisite admin mode).
4571		- * @return void
4572		- */
4573		- public function print_text_google_clientid( $args = '' ) {
	3765	+ function print_text_google_clientid( $args = '' ) {
4574	3766	// Get plugin option.
4575		- $option = 'google_clientid';
	3767	+ $option = 'google_clientid';
4576	3768	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4577	3769
4578	3770	// Print option elements.
4579		- $site_url_parts = wp_parse_url( get_site_url() );
4580		- $site_url_host = $site_url_parts['scheme'] . '://' . $site_url_parts['host'] . '/';
4581		-
4582		- esc_html_e( "If you don't have a Google Client ID and Secret, generate them by following these instructions:", 'authorizer' );
4583		- ?>
	3771	+ $site_url_parts = parse_url( get_site_url() );
	3772	+ $site_url_host = $site_url_parts['scheme'] . '://' . $site_url_parts['host'] . '/';
	3773	+ ?><?php _e( "If you don't have a Google Client ID and Secret, generate them by following these instructions:", 'authorizer' ); ?>
4584	3774	<ol>
4585		- <li><?php echo wp_kses( __( 'Click <strong>Create a Project</strong> on the <a href="https://cloud.google.com/console" target="_blank">Google Developers Console</a>. You can name it whatever you want.', 'authorizer' ), $this->allowed_html ); ?></li>
4586		- <li><?php echo wp_kses( __( 'Within the project, navigate to <em>APIs and Auth</em> &gt; <em>Credentials</em>, then click <strong>Create New Client ID</strong> under OAuth. Use these settings:', 'authorizer' ), $this->allowed_html ); ?>
	3775	+ <li><?php _e( 'Click <strong>Create a Project</strong> on the <a href="https://cloud.google.com/console" target="_blank">Google Developers Console</a>. You can name it whatever you want.', 'authorizer' ); ?></li>
	3776	+ <li><?php _e( 'Within the project, navigate to <em>APIs and Auth</em> &gt; <em>Credentials</em>, then click <strong>Create New Client ID</strong> under OAuth. Use these settings:', 'authorizer' ); ?>
4587	3777	<ul>
4588		- <li><?php echo wp_kses( __( 'Application Type: <strong>Web application</strong>', 'authorizer' ), $this->allowed_html ); ?></li>
4589		- <li><?php esc_html_e( 'Authorized Javascript Origins:', 'authorizer' ); ?> <strong><?php echo esc_html( rtrim( $site_url_host, '/' ) ); ?></strong></li>
4590		- <li><?php echo wp_kses( __( 'Authorized Redirect URI: <em>none</em>', 'authorizer' ), $this->allowed_html ); ?></li>
	3778	+ <li><?php _e( 'Application Type: <strong>Web application</strong>', 'authorizer' ); ?></li>
	3779	+ <li><?php _e( 'Authorized Javascript Origins:', 'authorizer' ); ?> <strong><?php echo rtrim( $site_url_host, '/' ); ?></strong></li>
	3780	+ <li><?php _e( 'Authorized Redirect URI: <em>none</em>', 'authorizer' ); ?></li>
4591	3781	</ul>
4592	3782	</li>
4593		- <li><?php esc_html_e( 'Copy/paste your new Client ID/Secret pair into the fields below.', 'authorizer' ); ?></li>
4594		- <li><?php echo wp_kses( __( '<strong>Note</strong>: Navigate to <em>APIs and Auth</em> &gt; <em>Consent screen</em> to change the way the Google consent screen appears after a user has successfully entered their password, but before they are redirected back to WordPress.', 'authorizer' ), $this->allowed_html ); ?></li>
4595		- <li><?php echo wp_kses( __( 'Note: Google may have a more recent version of these instructions in their <a href="https://developers.google.com/identity/sign-in/web/devconsole-project" target="_blank">developer documentation</a>.', 'authorizer' ), $this->allowed_html ); ?></li>
	3783	+ <li><?php _e( 'Copy/paste your new Client ID/Secret pair into the fields below.', 'authorizer' ); ?></li>
	3784	+ <li><?php _e( '<strong>Note</strong>: Navigate to <em>APIs and Auth</em> &gt; <em>Consent screen</em> to change the way the Google consent screen appears after a user has successfully entered their password, but before they are redirected back to WordPress.', 'authorizer' ); ?></li>
	3785	+ <li><?php _e( 'Note: Google may have a more recent version of these instructions in their <a href="https://developers.google.com/identity/sign-in/web/devconsole-project" target="_blank">developer documentation</a>.', 'authorizer' ); ?></li>
4596	3786	</ol>
4597		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" style="width:560px;" />
4598		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: 1234567890123-kdjr85yt6vjr6d8g7dhr8g7d6durjf7g.apps.googleusercontent.com', 'authorizer' ); ?></label>
4599		- <?php
	3787	+ <input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" style="width:560px;" />
	3788	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: 1234567890123-kdjr85yt6vjr6d8g7dhr8g7d6durjf7g.apps.googleusercontent.com', 'authorizer'); ?></label><?php
4600	3789	}
4601	3790
4602	3791
4603		- /**
4604		- * Settings print callback.
4605		- *
4606		- * @param string $args Args (e.g., multisite admin mode).
4607		- * @return void
4608		- */
4609		- public function print_text_google_clientsecret( $args = '' ) {
	3792	+ function print_text_google_clientsecret( $args = '' ) {
4610	3793	// Get plugin option.
4611		- $option = 'google_clientsecret';
	3794	+ $option = 'google_clientsecret';
4612	3795	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4613	3796
4614	3797	// Print option elements.
4615		- ?>
4616		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" style="width:220px;" />
4617		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: sDNgX5_pr_5bly-frKmvp8jT', 'authorizer' ); ?></label>
4618		- <?php
	3798	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" style="width:220px;" />
	3799	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: sDNgX5_pr_5bly-frKmvp8jT', 'authorizer'); ?></label><?php
4619	3800	}
4620	3801
4621	3802
4622		- /**
4623		- * Settings print callback.
4624		- *
4625		- * @param string $args Args (e.g., multisite admin mode).
4626		- * @return void
4627		- */
4628		- public function print_text_google_hosteddomain( $args = '' ) {
	3803	+ function print_text_google_hosteddomain( $args = '' ) {
4629	3804	// Get plugin option.
4630		- $option = 'google_hosteddomain';
	3805	+ $option = 'google_hosteddomain';
4631	3806	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4632	3807
4633	3808	// Print option elements.
4634		- ?>
4635		- <textarea id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" placeholder="" style="width:220px;"><?php echo esc_html( $auth_settings_option ); ?></textarea>
4636		- <br /><small><?php esc_html_e( 'Restrict Google logins to a specific Google Apps hosted domain (for example, mycollege.edu). Leave blank to allow all Google sign-ins.', 'authorizer' ); ?><br /><?php esc_html_e( 'If restricting to multiple domains, add one domain per line.', 'authorizer' ); ?></small>
	3809	+ ?><textarea id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" placeholder="" style="width:220px;"><?php echo $auth_settings_option; ?></textarea>
	3810	+ <br /><small><?php _e( 'Restrict Google logins to a specific Google Apps hosted domain (for example, mycollege.edu). Leave blank to allow all Google sign-ins.', 'authorizer' ); ?><br /><?php _e( 'If restricting to multiple domains, add one domain per line.', 'authorizer' ); ?></small>
4637	3811	<?php
4638	3812	}
4639	3813
4640	3814
4641		- /**
4642		- * Settings print callback.
4643		- *
4644		- * @param string $args Args (e.g., multisite admin mode).
4645		- * @return void
4646		- */
4647		- public function print_checkbox_auth_external_cas( $args = '' ) {
	3815	+ function print_checkbox_auth_external_cas( $args = '' ) {
4648	3816	// Get plugin option.
4649		- $option = 'cas';
	3817	+ $option = 'cas';
4650	3818	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4651	3819
4652	3820	// Make sure php5-curl extension is installed on server.
4653	3821	$curl_installed_message = ! function_exists( 'curl_init' ) ? __( '<a href="http://www.php.net//manual/en/curl.installation.php" target="_blank" style="color: red;">PHP CURL extension</a> is not installed', 'authorizer' ) : '';
		@@ -4666,217 +3834,128 @@
4666	3834	')</span>';
4667	3835	}
4668	3836
4669	3837	// Print option elements.
4670		- ?>
4671		- <input type="checkbox" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="1"<?php checked( 1 === intval( $auth_settings_option ) ); ?> /><label for="auth_settings_<?php echo esc_attr( $option ); ?>"><?php esc_html_e( 'Enable CAS Logins', 'authorizer' ); ?></label> <?php echo wp_kses( $error_message, $this->allowed_html ); ?>
4672		- <?php
	3838	+ ?><input type="checkbox" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="1"<?php checked( 1 == $auth_settings_option ); ?> /><label for="auth_settings_<?php echo $option; ?>"><?php _e( 'Enable CAS Logins', 'authorizer' ); ?></label> <?php echo $error_message; ?><?php
4673	3839	}
4674	3840
4675	3841
4676		- /**
4677		- * Settings print callback.
4678		- *
4679		- * @param string $args Args (e.g., multisite admin mode).
4680		- * @return void
4681		- */
4682		- public function print_text_cas_custom_label( $args = '' ) {
	3842	+ function print_text_cas_custom_label( $args = '' ) {
4683	3843	// Get plugin option.
4684		- $option = 'cas_custom_label';
	3844	+ $option = 'cas_custom_label';
4685	3845	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4686	3846
4687	3847	// Print option elements.
4688		- esc_html_e( 'The button on the login page will read:', 'authorizer' );
4689		- ?>
4690		- <p><a class="button-primary button-large" style="padding: 3px 16px; height: 36px;"><span class="dashicons dashicons-lock" style="margin: 4px 4px 0 0;"></span> <strong><?php esc_html_e( 'Sign in with', 'authorizer' ); ?> </strong><input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="CAS" style="width: 100px;" /></a></p>
4691		- <?php
	3848	+ ?><?php _e( 'The button on the login page will read:', 'authorizer' ); ?><p><a class="button-primary button-large" style="padding: 3px 16px; height: 36px;"><span class="dashicons dashicons-lock" style="margin: 4px 4px 0 0;"></span> <strong><?php _e( 'Sign in with', 'authorizer' ); ?> </strong><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="CAS" style="width: 100px;" /></a></p><?php
4692	3849	}
4693	3850
4694	3851
4695		- /**
4696		- * Settings print callback.
4697		- *
4698		- * @param string $args Args (e.g., multisite admin mode).
4699		- * @return void
4700		- */
4701		- public function print_text_cas_host( $args = '' ) {
	3852	+ function print_text_cas_host( $args = '' ) {
4702	3853	// Get plugin option.
4703		- $option = 'cas_host';
	3854	+ $option = 'cas_host';
4704	3855	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4705	3856
4706	3857	// Print option elements.
4707		- ?>
4708		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" />
4709		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: authn.example.edu', 'authorizer' ); ?></label>
4710		- <?php
	3858	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" />
	3859	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: authn.example.edu', 'authorizer'); ?></label><?php
4711	3860	}
4712	3861
4713	3862
4714		- /**
4715		- * Settings print callback.
4716		- *
4717		- * @param string $args Args (e.g., multisite admin mode).
4718		- * @return void
4719		- */
4720		- public function print_text_cas_port( $args = '' ) {
	3863	+ function print_text_cas_port( $args = '' ) {
4721	3864	// Get plugin option.
4722		- $option = 'cas_port';
	3865	+ $option = 'cas_port';
4723	3866	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4724	3867
4725	3868	// Print option elements.
4726		- ?>
4727		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" style="width:50px;" />
4728		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: 443', 'authorizer' ); ?></label>
4729		- <?php
	3869	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" style="width:50px;" />
	3870	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: 443', 'authorizer'); ?></label><?php
4730	3871	}
4731	3872
4732	3873
4733		- /**
4734		- * Settings print callback.
4735		- *
4736		- * @param string $args Args (e.g., multisite admin mode).
4737		- * @return void
4738		- */
4739		- public function print_text_cas_path( $args = '' ) {
	3874	+ function print_text_cas_path( $args = '' ) {
4740	3875	// Get plugin option.
4741		- $option = 'cas_path';
	3876	+ $option = 'cas_path';
4742	3877	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4743	3878
4744	3879	// Print option elements.
4745		- ?>
4746		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" />
4747		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: /cas', 'authorizer' ); ?></label>
4748		- <?php
	3880	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" />
	3881	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: /cas', 'authorizer'); ?></label><?php
4749	3882	}
4750	3883
4751	3884
4752		- /**
4753		- * Settings print callback.
4754		- *
4755		- * @param string $args Args (e.g., multisite admin mode).
4756		- * @return void
4757		- */
4758		- public function print_select_cas_version( $args = '' ) {
	3885	+ function print_select_cas_version( $args = '' ) {
4759	3886	// Get plugin option.
4760		- $option = 'cas_version';
	3887	+ $option = 'cas_version';
4761	3888	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4762	3889
4763	3890	// Print option elements.
4764		- ?>
4765		- <select id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]">
	3891	+ ?><select id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]">
4766	3892	<option value="SAML_VERSION_1_1" <?php selected( $auth_settings_option, 'SAML_VERSION_1_1' ); ?>>SAML_VERSION_1_1</option>
4767	3893	<option value="CAS_VERSION_3_0" <?php selected( $auth_settings_option, 'CAS_VERSION_3_0' ); ?>>CAS_VERSION_3_0</option>
4768	3894	<option value="CAS_VERSION_2_0" <?php selected( $auth_settings_option, 'CAS_VERSION_2_0' ); ?>>CAS_VERSION_2_0</option>
4769	3895	<option value="CAS_VERSION_1_0" <?php selected( $auth_settings_option, 'CAS_VERSION_1_0' ); ?>>CAS_VERSION_1_0</option>
4770		- </select>
4771		- <?php
	3896	+ </select><?php
4772	3897	}
4773	3898
4774	3899
4775		- /**
4776		- * Settings print callback.
4777		- *
4778		- * @param string $args Args (e.g., multisite admin mode).
4779		- * @return void
4780		- */
4781		- public function print_text_cas_attr_email( $args = '' ) {
	3900	+ function print_text_cas_attr_email( $args = '' ) {
4782	3901	// Get plugin option.
4783		- $option = 'cas_attr_email';
	3902	+ $option = 'cas_attr_email';
4784	3903	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4785	3904
4786	3905	// Print option elements.
4787		- ?>
4788		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" />
4789		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: mail', 'authorizer' ); ?></label>
4790		- <br /><small><?php echo wp_kses( __( "Note: If your CAS server doesn't return an attribute containing an email, you can specify the @domain portion of the email address here, and the email address will be constructed from it and the username. For example, if user 'bob' logs in and his email address should be bob@example.edu, then enter <strong>@example.edu</strong> in this field.", 'authorizer' ), $this->allowed_html ); ?></small>
4791		- <?php
	3906	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" />
	3907	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: mail', 'authorizer'); ?></label>
	3908	+ <br /><small><?php _e( "Note: If your CAS server doesn't return an attribute containing an email, you can specify the @domain portion of the email address here, and the email address will be constructed from it and the username. For example, if user 'bob' logs in and his email address should be bob@example.edu, then enter <strong>@example.edu</strong> in this field.", 'authorizer' ); ?></small><?php
4792	3909	}
4793	3910
4794	3911
4795		- /**
4796		- * Settings print callback.
4797		- *
4798		- * @param string $args Args (e.g., multisite admin mode).
4799		- * @return void
4800		- */
4801		- public function print_text_cas_attr_first_name( $args = '' ) {
	3912	+ function print_text_cas_attr_first_name( $args = '' ) {
4802	3913	// Get plugin option.
4803		- $option = 'cas_attr_first_name';
	3914	+ $option = 'cas_attr_first_name';
4804	3915	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4805	3916
4806	3917	// Print option elements.
4807		- ?>
4808		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" />
4809		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: givenName', 'authorizer' ); ?></label>
4810		- <?php
	3918	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" />
	3919	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: givenName', 'authorizer'); ?></label><?php
4811	3920	}
4812	3921
4813	3922
4814		- /**
4815		- * Settings print callback.
4816		- *
4817		- * @param string $args Args (e.g., multisite admin mode).
4818		- * @return void
4819		- */
4820		- public function print_text_cas_attr_last_name( $args = '' ) {
	3923	+ function print_text_cas_attr_last_name( $args = '' ) {
4821	3924	// Get plugin option.
4822		- $option = 'cas_attr_last_name';
	3925	+ $option = 'cas_attr_last_name';
4823	3926	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4824	3927
4825	3928	// Print option elements.
4826		- ?>
4827		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" />
4828		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: sn', 'authorizer' ); ?></label>
4829		- <?php
	3929	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" />
	3930	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: sn', 'authorizer'); ?></label><?php
4830	3931	}
4831	3932
4832	3933
4833		- /**
4834		- * Settings print callback.
4835		- *
4836		- * @param string $args Args (e.g., multisite admin mode).
4837		- * @return void
4838		- */
4839		- public function print_checkbox_cas_attr_update_on_login( $args = '' ) {
	3934	+ function print_checkbox_cas_attr_update_on_login( $args = '' ) {
4840	3935	// Get plugin option.
4841		- $option = 'cas_attr_update_on_login';
	3936	+ $option = 'cas_attr_update_on_login';
4842	3937	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4843	3938
4844	3939	// Print option elements.
4845		- ?>
4846		- <input type="checkbox" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="1"<?php checked( 1 === intval( $auth_settings_option ) ); ?> /><label for="auth_settings_<?php echo esc_attr( $option ); ?>"><?php esc_html_e( 'Update first and last name fields on login (will overwrite any name the user has supplied in their profile)', 'authorizer' ); ?></label>
4847		- <?php
	3940	+ ?><input type="checkbox" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="1"<?php checked( 1 == $auth_settings_option ); ?> /><label for="auth_settings_<?php echo $option; ?>"><?php _e( 'Update first and last name fields on login (will overwrite any name the user has supplied in their profile)', 'authorizer' ); ?></label><?php
4848	3941	}
4849	3942
4850	3943
4851		- /**
4852		- * Settings print callback.
4853		- *
4854		- * @param string $args Args (e.g., multisite admin mode).
4855		- * @return void
4856		- */
4857		- public function print_checkbox_cas_auto_login( $args = '' ) {
	3944	+ function print_checkbox_cas_auto_login( $args = '' ) {
4858	3945	// Get plugin option.
4859		- $option = 'cas_auto_login';
	3946	+ $option = 'cas_auto_login';
4860	3947	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4861	3948
4862	3949	// Print option elements.
4863		- ?>
4864		- <input type="checkbox" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="1"<?php checked( 1 === intval( $auth_settings_option ) ); ?> /><label for="auth_settings_<?php echo esc_attr( $option ); ?>"><?php esc_html_e( "Immediately redirect to CAS login form if it's the only enabled external service and WordPress logins are hidden", 'authorizer' ); ?></label>
4865		- <p><small><?php esc_html_e( 'Note: This feature will only work if you have checked "Hide WordPress Logins" in Advanced settings, and if CAS is the only enabled service (i.e., no Google or LDAP). If you have enabled CAS Single Sign-On (SSO), and a user has already logged into CAS elsewhere, enabling this feature will allow automatic logins without any user interaction.', 'authorizer' ); ?></small></p>
4866		- <?php
	3950	+ ?><input type="checkbox" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="1"<?php checked( 1 == $auth_settings_option ); ?> /><label for="auth_settings_<?php echo $option; ?>"><?php _e( "Immediately redirect to CAS login form if it's the only enabled external service and WordPress logins are hidden", 'authorizer' ); ?></label>
	3951	+ <p><small><?php _e( 'Note: This feature will only work if you have checked "Hide WordPress Logins" in Advanced settings, and if CAS is the only enabled service (i.e., no Google or LDAP). If you have enabled CAS Single Sign-On (SSO), and a user has already logged into CAS elsewhere, enabling this feature will allow automatic logins without any user interaction.', 'authorizer' ); ?></small></p><?php
4867	3952	}
4868	3953
4869	3954
4870		- /**
4871		- * Settings print callback.
4872		- *
4873		- * @param string $args Args (e.g., multisite admin mode).
4874		- * @return void
4875		- */
4876		- public function print_checkbox_auth_external_ldap( $args = '' ) {
	3955	+ function print_checkbox_auth_external_ldap( $args = '' ) {
4877	3956	// Get plugin option.
4878		- $option = 'ldap';
	3957	+ $option = 'ldap';
4879	3958	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4880	3959
4881	3960	// Make sure php5-ldap extension is installed on server.
4882	3961	$ldap_installed_message = ! function_exists( 'ldap_connect' ) ? '<span style="color: red;">(' . __( 'Warning: <a href="http://www.php.net/manual/en/ldap.installation.php" target="_blank" style="color: red;">PHP LDAP extension</a> is <strong>not</strong> installed', 'authorizer' ) . ')</span>' : '';
		@@ -4881,324 +3960,193 @@
4881	3960	// Make sure php5-ldap extension is installed on server.
4882	3961	$ldap_installed_message = ! function_exists( 'ldap_connect' ) ? '<span style="color: red;">(' . __( 'Warning: <a href="http://www.php.net/manual/en/ldap.installation.php" target="_blank" style="color: red;">PHP LDAP extension</a> is <strong>not</strong> installed', 'authorizer' ) . ')</span>' : '';
4883	3962
4884	3963	// Print option elements.
4885		- ?>
4886		- <input type="checkbox" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="1"<?php checked( 1 === intval( $auth_settings_option ) ); ?> /><label for="auth_settings_<?php echo esc_attr( $option ); ?>"><?php esc_html_e( 'Enable LDAP Logins', 'authorizer' ); ?></label> <?php echo wp_kses( $ldap_installed_message, $this->allowed_html ); ?>
4887		- <?php
	3964	+ ?><input type="checkbox" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="1"<?php checked( 1 == $auth_settings_option ); ?> /><label for="auth_settings_<?php echo $option; ?>"><?php _e( 'Enable LDAP Logins', 'authorizer' ); ?></label> <?php echo $ldap_installed_message; ?><?php
4888	3965	}
4889	3966
4890	3967
4891		- /**
4892		- * Settings print callback.
4893		- *
4894		- * @param string $args Args (e.g., multisite admin mode).
4895		- * @return void
4896		- */
4897		- public function print_text_ldap_host( $args = '' ) {
	3968	+ function print_text_ldap_host( $args = '' ) {
4898	3969	// Get plugin option.
4899		- $option = 'ldap_host';
	3970	+ $option = 'ldap_host';
4900	3971	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4901	3972
4902	3973	// Print option elements.
4903		- ?>
4904		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" style="width:330px;" />
4905		- <br /><small><?php esc_html_e( 'Specify either a hostname (for example, ldap.example.edu) or a full LDAP URI (for example, ldaps://ldap.example.edu:636).', 'authorizer' ); ?></small>
4906		- <?php
	3974	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" style="width:330px;" />
	3975	+ <br /><small><?php _e( "Specify either a hostname (for example, ldap.example.edu) or a full LDAP URI (for example, ldaps://ldap.example.edu:636).", 'authorizer' ); ?></small><?php
4907	3976	}
4908	3977
4909	3978
4910		- /**
4911		- * Settings print callback.
4912		- *
4913		- * @param string $args Args (e.g., multisite admin mode).
4914		- * @return void
4915		- */
4916		- public function print_text_ldap_port( $args = '' ) {
	3979	+ function print_text_ldap_port( $args = '' ) {
4917	3980	// Get plugin option.
4918		- $option = 'ldap_port';
	3981	+ $option = 'ldap_port';
4919	3982	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4920	3983
4921	3984	// Print option elements.
4922		- ?>
4923		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" style="width:50px;" />
4924		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: 389', 'authorizer' ); ?></label>
4925		- <br /><small><?php esc_html_e( 'If a full LDAP URI (ldaps://hostname:port) is specified above, this field is ignored.', 'authorizer' ); ?></small>
4926		- <?php
	3985	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" style="width:50px;" />
	3986	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: 389', 'authorizer' ); ?></label>
	3987	+ <br /><small><?php _e( "If a full LDAP URI (ldaps://hostname:port) is specified above, this field is ignored.", 'authorizer' ); ?></small><?php
4927	3988	}
4928	3989
4929	3990
4930		- /**
4931		- * Settings print callback.
4932		- *
4933		- * @param string $args Args (e.g., multisite admin mode).
4934		- * @return void
4935		- */
4936		- public function print_checkbox_ldap_tls( $args = '' ) {
	3991	+ function print_checkbox_ldap_tls( $args = '' ) {
4937	3992	// Get plugin option.
4938		- $option = 'ldap_tls';
	3993	+ $option = 'ldap_tls';
4939	3994	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4940	3995
4941	3996	// Print option elements.
4942		- ?>
4943		- <input type="checkbox" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="1"<?php checked( 1 === intval( $auth_settings_option ) ); ?> /><label for="auth_settings_<?php echo esc_attr( $option ); ?>"><?php esc_html_e( 'Use TLS', 'authorizer' ); ?></label>
4944		- <br /><small><?php esc_html_e( 'If ldaps is used, this should be unchecked', 'authorizer' ); ?></small>
4945		- <?php
	3997	+ ?><input type="checkbox" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="1"<?php checked( 1 == $auth_settings_option ); ?> /><label for="auth_settings_<?php echo $option; ?>"><?php _e( 'Use TLS', 'authorizer' ); ?></label><?php
4946	3998	}
4947	3999
4948	4000
4949		- /**
4950		- * Settings print callback.
4951		- *
4952		- * @param string $args Args (e.g., multisite admin mode).
4953		- * @return void
4954		- */
4955		- public function print_text_ldap_search_base( $args = '' ) {
	4001	+ function print_text_ldap_search_base( $args = '' ) {
4956	4002	// Get plugin option.
4957		- $option = 'ldap_search_base';
	4003	+ $option = 'ldap_search_base';
4958	4004	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4959	4005
4960	4006	// Print option elements.
4961		- ?>
4962		- <textarea id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" placeholder="" style="width:330px;"><?php echo esc_attr( $auth_settings_option ); ?></textarea>
4963		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: ou=people,dc=example,dc=edu', 'authorizer' ); ?></label>
4964		- <br /><small><?php esc_html_e( 'If you have multiple search bases, separate them by newlines (one per line).', 'authorizer' ); ?></small>
4965		- <?php
	4007	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" style="width:330px;" />
	4008	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: ou=people,dc=example,dc=edu', 'authorizer'); ?></label><?php
4966	4009	}
4967	4010
4968	4011
4969		- /**
4970		- * Settings print callback.
4971		- *
4972		- * @param string $args Args (e.g., multisite admin mode).
4973		- * @return void
4974		- */
4975		- public function print_text_ldap_uid( $args = '' ) {
	4012	+ function print_text_ldap_uid( $args = '' ) {
4976	4013	// Get plugin option.
4977		- $option = 'ldap_uid';
	4014	+ $option = 'ldap_uid';
4978	4015	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4979	4016
4980	4017	// Print option elements.
4981		- ?>
4982		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" style="width:80px;" />
4983		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: uid', 'authorizer' ); ?></label>
4984		- <?php
	4018	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" style="width:80px;" />
	4019	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: uid', 'authorizer' ); ?></label><?php
4985	4020	}
4986	4021
4987	4022
4988		- /**
4989		- * Settings print callback.
4990		- *
4991		- * @param string $args Args (e.g., multisite admin mode).
4992		- * @return void
4993		- */
4994		- public function print_text_ldap_attr_email( $args = '' ) {
	4023	+ function print_text_ldap_attr_email( $args = '' ) {
4995	4024	// Get plugin option.
4996		- $option = 'ldap_attr_email';
	4025	+ $option = 'ldap_attr_email';
4997	4026	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4998	4027
4999	4028	// Print option elements.
5000		- ?>
5001		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" />
5002		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: mail', 'authorizer' ); ?></label>
5003		- <br /><small><?php echo wp_kses( __( "Note: If your LDAP server doesn't return an attribute containing an email, you can specify the @domain portion of the email address here, and the email address will be constructed from it and the username. For example, if user 'bob' logs in and his email address should be bob@example.edu, then enter <strong>@example.edu</strong> in this field.", 'authorizer' ), $this->allowed_html ); ?></small>
5004		- <?php
	4029	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" />
	4030	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: mail', 'authorizer' ); ?></label>
	4031	+ <br /><small><?php _e( "Note: If your LDAP server doesn't return an attribute containing an email, you can specify the @domain portion of the email address here, and the email address will be constructed from it and the username. For example, if user 'bob' logs in and his email address should be bob@example.edu, then enter <strong>@example.edu</strong> in this field.", 'authorizer' ); ?></small><?php
5005	4032	}
5006	4033
5007	4034
5008		- /**
5009		- * Settings print callback.
5010		- *
5011		- * @param string $args Args (e.g., multisite admin mode).
5012		- * @return void
5013		- */
5014		- public function print_text_ldap_user( $args = '' ) {
	4035	+ function print_text_ldap_user( $args = '' ) {
5015	4036	// Get plugin option.
5016		- $option = 'ldap_user';
	4037	+ $option = 'ldap_user';
5017	4038	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5018	4039
5019	4040	// Print option elements.
5020		- ?>
5021		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" style="width:330px;" />
5022		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: cn=directory-user,ou=specials,dc=example,dc=edu', 'authorizer' ); ?></label>
5023		- <?php
	4041	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" style="width:330px;" />
	4042	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: cn=directory-user,ou=specials,dc=example,dc=edu', 'authorizer' ); ?></label><?php
5024	4043	}
5025	4044
5026	4045
5027		- /**
5028		- * Settings print callback.
5029		- *
5030		- * @param string $args Args (e.g., multisite admin mode).
5031		- * @return void
5032		- */
5033		- public function print_password_ldap_password( $args = '' ) {
	4046	+ function print_password_ldap_password( $args = '' ) {
5034	4047	// Get plugin option.
5035		- $option = 'ldap_password';
	4048	+ $option = 'ldap_password';
5036	4049	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5037	4050
5038	4051	// Print option elements.
5039		- ?>
5040		- <input type="password" id="garbage_to_stop_autofill" name="garbage" value="" autocomplete="off" style="display:none;" />
5041		- <input type="password" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $this->decrypt( $auth_settings_option ) ); ?>" autocomplete="off" />
5042		- <?php
	4052	+ ?><input type="password" id="garbage_to_stop_autofill" name="garbage" value="" autocomplete="off" style="display:none;" />
	4053	+ <input type="password" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $this->decrypt( $auth_settings_option ); ?>" autocomplete="off" /><?php
5043	4054	}
5044	4055
5045	4056
5046		- /**
5047		- * Settings print callback.
5048		- *
5049		- * @param string $args Args (e.g., multisite admin mode).
5050		- * @return void
5051		- */
5052		- public function print_text_ldap_lostpassword_url( $args = '' ) {
	4057	+ function print_text_ldap_lostpassword_url( $args = '' ) {
5053	4058	// Get plugin option.
5054		- $option = 'ldap_lostpassword_url';
	4059	+ $option = 'ldap_lostpassword_url';
5055	4060	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5056	4061
5057	4062	// Print option elements.
5058		- ?>
5059		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" style="width: 400px;" />
5060		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: https://myschool.example.edu:8888/am-forgot-password', 'authorizer' ); ?></label>
5061		- <?php
	4063	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" style="width: 400px;" />
	4064	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: https://myschool.example.edu:8888/am-forgot-password', 'authorizer' ); ?></label><?php
5062	4065	}
5063	4066
5064	4067
5065		- /**
5066		- * Settings print callback.
5067		- *
5068		- * @param string $args Args (e.g., multisite admin mode).
5069		- * @return void
5070		- */
5071		- public function print_text_ldap_attr_first_name( $args = '' ) {
	4068	+ function print_text_ldap_attr_first_name( $args = '' ) {
5072	4069	// Get plugin option.
5073		- $option = 'ldap_attr_first_name';
	4070	+ $option = 'ldap_attr_first_name';
5074	4071	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5075	4072
5076	4073	// Print option elements.
5077		- ?>
5078		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" />
5079		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: givenname', 'authorizer' ); ?></label>
5080		- <?php
	4074	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" />
	4075	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: givenname', 'authorizer' ); ?></label><?php
5081	4076	}
5082	4077
5083	4078
5084		- /**
5085		- * Settings print callback.
5086		- *
5087		- * @param string $args Args (e.g., multisite admin mode).
5088		- * @return void
5089		- */
5090		- public function print_text_ldap_attr_last_name( $args = '' ) {
	4079	+ function print_text_ldap_attr_last_name( $args = '' ) {
5091	4080	// Get plugin option.
5092		- $option = 'ldap_attr_last_name';
	4081	+ $option = 'ldap_attr_last_name';
5093	4082	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5094	4083
5095	4084	// Print option elements.
5096		- ?>
5097		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" />
5098		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: sn', 'authorizer' ); ?></label>
5099		- <?php
	4085	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" />
	4086	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: sn', 'authorizer' ); ?></label><?php
5100	4087	}
5101	4088
5102	4089
5103		- /**
5104		- * Settings print callback.
5105		- *
5106		- * @param string $args Args (e.g., multisite admin mode).
5107		- * @return void
5108		- */
5109		- public function print_checkbox_ldap_attr_update_on_login( $args = '' ) {
	4090	+ function print_checkbox_ldap_attr_update_on_login( $args = '' ) {
5110	4091	// Get plugin option.
5111		- $option = 'ldap_attr_update_on_login';
	4092	+ $option = 'ldap_attr_update_on_login';
5112	4093	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5113	4094
5114	4095	// Print option elements.
5115		- ?>
5116		- <input type="checkbox" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="1"<?php checked( 1 === intval( $auth_settings_option ) ); ?> /><label for="auth_settings_<?php echo esc_attr( $option ); ?>"><?php esc_html_e( 'Update first and last name fields on login (will overwrite any name the user has supplied in their profile)', 'authorizer' ); ?></label>
5117		- <?php
	4096	+ ?><input type="checkbox" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="1"<?php checked( 1 == $auth_settings_option ); ?> /><label for="auth_settings_<?php echo $option; ?>"><?php _e( 'Update first and last name fields on login (will overwrite any name the user has supplied in their profile)', 'authorizer' ); ?></label><?php
5118	4097	}
5119	4098
5120	4099
5121		- /**
5122		- * Settings print callback.
5123		- *
5124		- * @param string $args Args (e.g., multisite admin mode).
5125		- * @return void
5126		- */
5127		- public function print_section_info_advanced( $args = '' ) {
5128		- ?>
5129		- <div id="section_info_advanced" class="section_info">
5130		- <p><?php esc_html_e( 'You may optionally specify some advanced settings below.', 'authorizer' ); ?></p>
5131		- </div>
5132		- <?php
	4100	+ function print_section_info_advanced( $args = '' ) {
	4101	+ ?><div id="section_info_advanced" class="section_info">
	4102	+ <p><?php _e( 'You may optionally specify some advanced settings below.', 'authorizer' ); ?></p>
	4103	+ </div><?php
5133	4104	}
5134	4105
5135	4106
5136		- /**
5137		- * Settings print callback.
5138		- *
5139		- * @param string $args Args (e.g., multisite admin mode).
5140		- * @return void
5141		- */
5142		- public function print_text_auth_advanced_lockouts( $args = '' ) {
	4107	+ function print_text_auth_advanced_lockouts( $args = '' ) {
5143	4108	// Get plugin option.
5144		- $option = 'advanced_lockouts';
	4109	+ $option = 'advanced_lockouts';
5145	4110	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5146	4111
5147	4112	// Print option elements.
5148		- esc_html_e( 'After', 'authorizer' );
5149		- ?>
5150		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>_attempts_1" name="auth_settings[<?php echo esc_attr( $option ); ?>][attempts_1]" value="<?php echo esc_attr( $auth_settings_option['attempts_1'] ); ?>" placeholder="10" style="width:30px;" />
5151		- <?php esc_html_e( 'invalid password attempts, delay further attempts on that user for', 'authorizer' ); ?>
5152		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>_duration_1" name="auth_settings[<?php echo esc_attr( $option ); ?>][duration_1]" value="<?php echo esc_attr( $auth_settings_option['duration_1'] ); ?>" placeholder="1" style="width:30px;" />
5153		- <?php esc_html_e( 'minute(s).', 'authorizer' ); ?>
	4113	+ ?><?php _e( 'After', 'authorizer' ); ?>
	4114	+ <input type="text" id="auth_settings_<?php echo $option; ?>_attempts_1" name="auth_settings[<?php echo $option; ?>][attempts_1]" value="<?php echo $auth_settings_option['attempts_1']; ?>" placeholder="10" style="width:30px;" />
	4115	+ <?php _e( 'invalid password attempts, delay further attempts on that user for', 'authorizer' ); ?>
	4116	+ <input type="text" id="auth_settings_<?php echo $option; ?>_duration_1" name="auth_settings[<?php echo $option; ?>][duration_1]" value="<?php echo $auth_settings_option['duration_1']; ?>" placeholder="1" style="width:30px;" />
	4117	+ <?php _e( 'minute(s).', 'authorizer' ); ?>
5154	4118	<br />
5155		- <?php esc_html_e( 'After', 'authorizer' ); ?>
5156		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>_attempts_2" name="auth_settings[<?php echo esc_attr( $option ); ?>][attempts_2]" value="<?php echo esc_attr( $auth_settings_option['attempts_2'] ); ?>" placeholder="10" style="width:30px;" />
5157		- <?php esc_html_e( 'more invalid attempts, increase the delay to', 'authorizer' ); ?>
5158		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>_duration_2" name="auth_settings[<?php echo esc_attr( $option ); ?>][duration_2]" value="<?php echo esc_attr( $auth_settings_option['duration_2'] ); ?>" placeholder="10" style="width:30px;" />
5159		- <?php esc_html_e( 'minutes.', 'authorizer' ); ?>
	4119	+ <?php _e( 'After', 'authorizer' ); ?>
	4120	+ <input type="text" id="auth_settings_<?php echo $option; ?>_attempts_2" name="auth_settings[<?php echo $option; ?>][attempts_2]" value="<?php echo $auth_settings_option['attempts_2']; ?>" placeholder="10" style="width:30px;" />
	4121	+ <?php _e( 'more invalid attempts, increase the delay to', 'authorizer' ); ?>
	4122	+ <input type="text" id="auth_settings_<?php echo $option; ?>_duration_2" name="auth_settings[<?php echo $option; ?>][duration_2]" value="<?php echo $auth_settings_option['duration_2']; ?>" placeholder="10" style="width:30px;" />
	4123	+ <?php _e( 'minutes.', 'authorizer' ); ?>
5160	4124	<br />
5161		- <?php esc_html_e( 'Reset the delays after', 'authorizer' ); ?>
5162		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>_reset_duration" name="auth_settings[<?php echo esc_attr( $option ); ?>][reset_duration]" value="<?php echo esc_attr( $auth_settings_option['reset_duration'] ); ?>" placeholder="240" style="width:40px;" />
5163		- <?php esc_html_e( 'minutes with no invalid attempts.', 'authorizer' ); ?>
5164		- <?php
	4125	+ <?php _e( 'Reset the delays after', 'authorizer' ); ?>
	4126	+ <input type="text" id="auth_settings_<?php echo $option; ?>_reset_duration" name="auth_settings[<?php echo $option; ?>][reset_duration]" value="<?php echo $auth_settings_option['reset_duration']; ?>" placeholder="240" style="width:40px;" />
	4127	+ <?php _e( 'minutes with no invalid attempts.', 'authorizer' ); ?><?php
5165	4128	}
5166	4129
5167	4130
5168		- /**
5169		- * Settings print callback.
5170		- *
5171		- * @param string $args Args (e.g., multisite admin mode).
5172		- * @return void
5173		- */
5174		- public function print_checkbox_auth_advanced_hide_wp_login( $args = '' ) {
	4131	+ function print_checkbox_auth_advanced_hide_wp_login( $args = '' ) {
5175	4132	// Get plugin option.
5176		- $option = 'advanced_hide_wp_login';
	4133	+ $option = 'advanced_hide_wp_login';
5177	4134	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5178	4135
5179	4136	// Print option elements.
5180		- ?>
5181		- <input type="checkbox" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="1"<?php checked( 1 === intval( $auth_settings_option ) ); ?> /><label for="auth_settings_<?php echo esc_attr( $option ); ?>"><?php esc_html_e( 'Hide WordPress Logins', 'authorizer' ); ?></label>
5182		- <p><small><?php esc_html_e( 'Note: You can always access the WordPress logins by adding external=wordpress to the wp-login URL, like so:', 'authorizer' ); ?><br /><a href="<?php echo esc_attr( wp_login_url() ); ?>?external=wordpress" target="_blank"><?php echo esc_html( wp_login_url() ); ?>?external=wordpress</a>.</p>
5183		- <?php
	4137	+ ?><input type="checkbox" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="1"<?php checked( 1 == $auth_settings_option ); ?> /><label for="auth_settings_<?php echo $option; ?>"><?php _e( 'Hide WordPress Logins', 'authorizer' ); ?></label>
	4138	+ <p><small><?php _e( 'Note: You can always access the WordPress logins by adding external=wordpress to the wp-login URL, like so:', 'authorizer' ); ?><br /><a href="<?php echo wp_login_url(); ?>?external=wordpress" target="_blank"><?php echo wp_login_url(); ?>?external=wordpress</a>.</p><?php
5184	4139	}
5185	4140
5186	4141
5187		- /**
5188		- * Settings print callback.
5189		- *
5190		- * @param string $args Args (e.g., multisite admin mode).
5191		- * @return void
5192		- */
5193		- public function print_radio_auth_advanced_branding( $args = '' ) {
	4142	+ function print_radio_auth_advanced_branding( $args = '' ) {
5194	4143	// Get plugin option.
5195		- $option = 'advanced_branding';
	4144	+ $option = 'advanced_branding';
5196	4145	$auth_settings_option = $this->get_plugin_option( $option );
5197	4146
5198	4147	// Print option elements.
5199		- ?>
5200		- <input type="radio" id="radio_auth_settings_<?php echo esc_attr( $option ); ?>_default" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="default"<?php checked( 'default' === $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo esc_attr( $option ); ?>_default"><?php esc_html_e( 'Default WordPress login screen', 'authorizer' ); ?></label><br />
	4148	+ ?><input type="radio" id="radio_auth_settings_<?php echo $option; ?>_default" name="auth_settings[<?php echo $option; ?>]" value="default"<?php checked( 'default' == $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo $option; ?>_default"><?php _e( 'Default WordPress login screen', 'authorizer' ); ?></label><br />
5201	4149	<?php
5202	4150
5203	4151	/**
5204	4152	* Developers can use the `authorizer_add_branding_option` filter
		@@ -5203,8 +4151,9 @@
5203	4151	/**
5204	4152	* Developers can use the `authorizer_add_branding_option` filter
5205	4153	* to add a radio button for "Custom WordPress login branding"
5206	4154	* under the "Advanced" tab in Authorizer options. Example:
	4155	+ *
5207	4156	* function my_authorizer_add_branding_option( $branding_options ) {
5208	4157	* $new_branding_option = array(
5209	4158	* 'value' => 'your_brand'
5210	4159	* 'description' => 'Custom Your Brand Login Screen',
		@@ -5218,274 +4167,133 @@
5218	4167	*/
5219	4168	$branding_options = array();
5220	4169	$branding_options = apply_filters( 'authorizer_add_branding_option', $branding_options );
5221	4170	foreach ( $branding_options as $branding_option ) {
5222		- // Make sure the custom brands have the required values.
	4171	+ // Make sure the custom brands have the required values
5223	4172	if ( ! ( is_array( $branding_option ) && array_key_exists( 'value', $branding_option ) && array_key_exists( 'description', $branding_option ) ) ) {
5224	4173	continue;
5225	4174	}
5226		- ?>
5227		- <input type="radio" id="radio_auth_settings_<?php echo esc_attr( $option ); ?>_<?php echo esc_attr( sanitize_title( $branding_option['value'] ) ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $branding_option['value'] ); ?>"<?php checked( $branding_option['value'] === $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo esc_attr( $option ); ?>_<?php echo esc_attr( sanitize_title( $branding_option['value'] ) ); ?>"><?php echo esc_html( $branding_option['description'] ); ?></label><br />
5228		- <?php
	4175	+ ?><input type="radio" id="radio_auth_settings_<?php echo $option; ?>_<?php echo sanitize_title( $branding_option['value'] ); ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $branding_option['value']; ?>"<?php checked( $branding_option['value'] == $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo $option; ?>_<?php echo sanitize_title( $branding_option['value'] ); ?>"><?php echo $branding_option['description']; ?></label><br /><?php
5229	4176	}
5230	4177
5231	4178	// Print message about adding custom brands if there are none.
5232	4179	if ( count( $branding_options ) === 0 ) {
5233		- ?>
5234		- <p><em><?php echo wp_kses( __( '<strong>Note for theme developers</strong>: Add more options here by using the `authorizer_add_branding_option` filter in your theme. You can see an example theme that implements this filter in the plugin directory under sample-theme-add-branding.', 'authorizer' ), $this->allowed_html ); ?></em></p>
5235		- <?php
	4180	+ ?><p><em><?php _e( '<strong>Note for theme developers</strong>: Add more options here by using the `authorizer_add_branding_option` filter in your theme. You can see an example theme that implements this filter in the plugin directory under sample-theme-add-branding.', 'authorizer' ); ?></em></p><?php
5236	4181	}
5237	4182	}
5238	4183
5239	4184
5240		- /**
5241		- * Settings print callback.
5242		- *
5243		- * @param string $args Args (e.g., multisite admin mode).
5244		- * @return void
5245		- */
5246		- public function print_radio_auth_advanced_admin_menu( $args = '' ) {
	4185	+ function print_radio_auth_advanced_admin_menu( $args = '' ) {
5247	4186	// Get plugin option.
5248		- $option = 'advanced_admin_menu';
	4187	+ $option = 'advanced_admin_menu';
5249	4188	$auth_settings_option = $this->get_plugin_option( $option );
5250	4189
5251	4190	// Print option elements.
5252		- ?>
5253		- <input type="radio" id="radio_auth_settings_<?php echo esc_attr( $option ); ?>_settings" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="settings"<?php checked( 'settings' === $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo esc_attr( $option ); ?>_settings"><?php esc_html_e( 'Show in Settings menu', 'authorizer' ); ?></label><br />
5254		- <input type="radio" id="radio_auth_settings_<?php echo esc_attr( $option ); ?>_top" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="top"<?php checked( 'top' === $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo esc_attr( $option ); ?>_top"><?php esc_html_e( 'Show in sidebar (top level)', 'authorizer' ); ?></label><br />
5255		- <?php
	4191	+ ?><input type="radio" id="radio_auth_settings_<?php echo $option; ?>_settings" name="auth_settings[<?php echo $option; ?>]" value="settings"<?php checked( 'settings' == $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo $option; ?>_settings"><?php _e( 'Show in Settings menu', 'authorizer' ); ?></label><br />
	4192	+ <input type="radio" id="radio_auth_settings_<?php echo $option; ?>_top" name="auth_settings[<?php echo $option; ?>]" value="top"<?php checked( 'top' == $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo $option; ?>_top"><?php _e( 'Show in sidebar (top level)', 'authorizer' ); ?></label><br /><?php
5256	4193
5257	4194	}
5258	4195
5259	4196
5260		- /**
5261		- * Settings print callback.
5262		- *
5263		- * @param string $args Args (e.g., multisite admin mode).
5264		- * @return void
5265		- */
5266		- public function print_select_auth_advanced_usermeta( $args = '' ) {
	4197	+ function print_select_auth_advanced_usermeta( $args = '' ) {
5267	4198	// Get plugin option.
5268		- $option = 'advanced_usermeta';
	4199	+ $option = 'advanced_usermeta';
5269	4200	$auth_settings_option = $this->get_plugin_option( $option );
5270	4201
5271	4202	// Print option elements.
5272		- ?>
5273		- <select id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]">
5274		- <option value=""><?php esc_html_e( '-- None --', 'authorizer' ); ?></option>
5275		- <?php
5276		- if ( class_exists( 'acf' ) ) :
	4203	+ ?><select id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]">
	4204	+ <option value=""><?php _e( '-- None --', 'authorizer' ); ?></option>
	4205	+ <?php if ( class_exists( 'acf' ) ) :
5277	4206	// Get ACF 5 fields. Note: it would be much easier to use `get_field_objects()`
5278	4207	// or `get_field_objects( 'user_' . get_current_user_id() )`, but neither will
5279	4208	// list fields that have never been given values for users (i.e., new ACF
5280	4209	// fields). Therefore we fall back on finding any ACF fields applied to users
5281	4210	// (user_role or user_form location rules in the field group definition).
5282		- $fields = array();
	4211	+ $fields = array();
5283	4212	$acf_field_group_ids = array();
5284		- $acf_field_groups = new WP_Query(
5285		- array(
5286		- 'post_type' => 'acf-field-group',
5287		- )
5288		- );
	4213	+ $acf_field_groups = new WP_Query( array(
	4214	+ 'post_type' => 'acf-field-group',
	4215	+ ));
5289	4216	while ( $acf_field_groups->have_posts() ) : $acf_field_groups->the_post();
5290	4217	if ( strpos( get_the_content(), 's:5:"param";s:9:"user_role"' ) !== false || strpos( get_the_content(), 's:5:"param";s:9:"user_form"' ) !== false ) :
5291	4218	array_push( $acf_field_group_ids, get_the_ID() );
5292	4219	endif;
5293		- endwhile;
5294		- wp_reset_postdata();
	4220	+ endwhile; wp_reset_postdata();
5295	4221	foreach ( $acf_field_group_ids as $acf_field_group_id ) :
5296		- $acf_fields = new WP_Query(
5297		- array(
5298		- 'post_type' => 'acf-field',
5299		- 'post_parent' => $acf_field_group_id,
5300		- )
5301		- );
	4222	+ $acf_fields = new WP_Query( array(
	4223	+ 'post_type' => 'acf-field',
	4224	+ 'post_parent' => $acf_field_group_id,
	4225	+ ));
5302	4226	while ( $acf_fields->have_posts() ) : $acf_fields->the_post();
5303	4227	global $post;
5304		- $fields[ $post->post_name ] = get_field_object( $post->post_name );
5305		- endwhile;
5306		- wp_reset_postdata();
	4228	+ $fields[$post->post_name] = get_field_object( $post->post_name );
	4229	+ endwhile; wp_reset_postdata();
5307	4230	endforeach;
5308	4231	// Get ACF 4 fields.
5309		- $acf4_field_groups = new WP_Query(
5310		- array(
5311		- 'post_type' => 'acf',
5312		- )
5313		- );
	4232	+ $acf4_field_groups = new WP_Query( array(
	4233	+ 'post_type' => 'acf',
	4234	+ ));
5314	4235	while ( $acf4_field_groups->have_posts() ) : $acf4_field_groups->the_post();
5315	4236	$field_group_rules = get_post_meta( get_the_ID(), 'rule', true );
5316		- if ( is_array( $field_group_rules ) && array_key_exists( 'param', $field_group_rules ) && 'ef_user' === $field_group_rules['param'] ) :
	4237	+ if ( is_array( $field_group_rules ) && array_key_exists( 'param', $field_group_rules ) && $field_group_rules['param'] === 'ef_user' ) :
5317	4238	$acf4_fields = get_post_custom( get_the_ID() );
5318	4239	foreach ( $acf4_fields as $meta_key => $meta_value ) :
5319	4240	if ( strpos( $meta_key, 'field_' ) === 0 ) :
5320		- $meta_value = unserialize( $meta_value[0] );
5321		- $fields[ $meta_key ] = $meta_value;
	4241	+ $meta_value = unserialize( $meta_value[0] );
	4242	+ $fields[$meta_key] = $meta_value;
5322	4243	endif;
5323	4244	endforeach;
5324	4245	endif;
5325		- endwhile;
5326		- wp_reset_postdata();
5327		- ?>
	4246	+ endwhile; wp_reset_postdata(); ?>
5328	4247	<optgroup label="ACF User Fields:">
5329		- <?php foreach ( (array) $fields as $field => $field_object ) : ?>
5330		- <option value="acf___<?php echo esc_attr( $field_object['key'] ); ?>"<?php selected( "acf___{$field_object['key']}" === $auth_settings_option ); ?>><?php echo esc_html( $field_object['label'] ); ?></option>
	4248	+ <?php foreach ( (array)$fields as $field => $field_object ) : ?>
	4249	+ <option value="acf___<?php echo $field_object['key']; ?>"<?php if ( $auth_settings_option === "acf___{$field_object['key']}" ) echo ' selected="selected"'; ?>><?php echo $field_object['label']; ?></option>
5331	4250	<?php endforeach; ?>
5332	4251	</optgroup>
5333	4252	<?php endif; ?>
5334		- <optgroup label="<?php esc_attr_e( 'All Usermeta:', 'authorizer' ); ?>">
5335		- <?php
5336		- foreach ( $this->get_all_usermeta_keys() as $meta_key ) :
5337		- if ( substr( $meta_key, 0, 3 ) === 'wp_' ) :
5338		- continue;
5339		- endif;
5340		- ?>
5341		- <option value="<?php echo esc_attr( $meta_key ); ?>"<?php selected( $auth_settings_option === $meta_key ); ?>><?php echo esc_html( $meta_key ); ?></option>
	4253	+ <optgroup label="<?php _e( 'All Usermeta:', 'authorizer' ); ?>">
	4254	+ <?php foreach ( $this->get_all_usermeta_keys() as $meta_key ) : if ( substr( $meta_key, 0, 3 ) === 'wp_' ) continue; ?>
	4255	+ <option value="<?php echo $meta_key; ?>"<?php if ( $auth_settings_option === $meta_key ) echo ' selected="selected"'; ?>><?php echo $meta_key; ?></option>
5342	4256	<?php endforeach; ?>
5343	4257	</optgroup>
5344		- </select>
5345		- <?php
	4258	+ </select><?php
5346	4259	}
5347	4260
5348	4261
5349		- /**
5350		- * Settings print callback.
5351		- *
5352		- * @param string $args Args (e.g., multisite admin mode).
5353		- * @return void
5354		- */
5355		- public function print_text_auth_advanced_users_per_page( $args = '' ) {
	4262	+ function print_checkbox_auth_advanced_override_multisite( $args = '' ) {
5356	4263	// Get plugin option.
5357		- $option = 'advanced_users_per_page';
5358		- $auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5359		-
5360		- // Print option elements.
5361		- ?>
5362		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" size="4" />
5363		- <?php
5364		- }
5365		-
5366		-
5367		- /**
5368		- * Settings print callback.
5369		- *
5370		- * @param string $args Args (e.g., multisite admin mode).
5371		- * @return void
5372		- */
5373		- public function print_select_auth_advanced_users_sort_by( $args = '' ) {
5374		- // Get plugin option.
5375		- $option = 'advanced_users_sort_by';
5376		- $auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5377		-
5378		- // Print option elements.
5379		- ?>
5380		- <select id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]">
5381		- <option value="created" <?php selected( $auth_settings_option, 'created' ); ?>><?php esc_html_e( 'Date approved', 'authorizer' ); ?></option>
5382		- <option value="email" <?php selected( $auth_settings_option, 'email' ); ?>><?php esc_html_e( 'Email', 'authorizer' ); ?></option>
5383		- <option value="role" <?php selected( $auth_settings_option, 'role' ); ?>><?php esc_html_e( 'Role', 'authorizer' ); ?></option>
5384		- <option value="date_added" <?php selected( $auth_settings_option, 'date_added' ); ?>><?php esc_html_e( 'Date registered', 'authorizer' ); ?></option>
5385		- </select>
5386		- <?php
5387		- }
5388		-
5389		-
5390		- /**
5391		- * Settings print callback.
5392		- *
5393		- * @param string $args Args (e.g., multisite admin mode).
5394		- * @return void
5395		- */
5396		- public function print_select_auth_advanced_users_sort_order( $args = '' ) {
5397		- // Get plugin option.
5398		- $option = 'advanced_users_sort_order';
5399		- $auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5400		-
5401		- // Print option elements.
5402		- ?>
5403		- <select id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]">
5404		- <option value="asc" <?php selected( $auth_settings_option, 'asc' ); ?>><?php esc_html_e( 'Ascending', 'authorizer' ); ?></option>
5405		- <option value="desc" <?php selected( $auth_settings_option, 'desc' ); ?>><?php esc_html_e( 'Descending', 'authorizer' ); ?></option>
5406		- </select>
5407		- <?php
5408		- }
5409		-
5410		-
5411		- /**
5412		- * Settings print callback.
5413		- *
5414		- * @param string $args Args (e.g., multisite admin mode).
5415		- * @return void
5416		- */
5417		- public function print_checkbox_auth_advanced_widget_enabled( $args = '' ) {
5418		- // Get plugin option.
5419		- $option = 'advanced_widget_enabled';
5420		- $auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5421		-
5422		- // Print option elements.
5423		- ?>
5424		- <input type="checkbox" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="1"<?php checked( 1 === intval( $auth_settings_option ) ); ?> /><label for="auth_settings_<?php echo esc_attr( $option ); ?>"><?php esc_html_e( 'Show Dashboard Widget', 'authorizer' ); ?></label>
5425		- <p><small><?php esc_html_e( 'Note: Only users with the create_users capability will be able to see the dashboard widget.', 'authorizer' ); ?></small></p>
5426		- <?php
5427		- }
5428		-
5429		-
5430		- /**
5431		- * Settings print callback.
5432		- *
5433		- * @param string $args Args (e.g., multisite admin mode).
5434		- * @return void
5435		- */
5436		- public function print_checkbox_auth_advanced_override_multisite( $args = '' ) {
5437		- // Get plugin option.
5438		- $option = 'advanced_override_multisite';
	4264	+ $option = 'advanced_override_multisite';
5439	4265	$auth_settings_option = $this->get_plugin_option( $option );
5440	4266
5441	4267	// Print option elements.
5442		- ?>
5443		- <input type="checkbox" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="1"<?php checked( 1 === intval( $auth_settings_option ) ); ?> /><label for="auth_settings_<?php echo esc_attr( $option ); ?>"><?php esc_html_e( "Configure this site independently (don't inherit any multisite settings)", 'authorizer' ); ?></label>
5444		- <?php
	4268	+ ?><input type="checkbox" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="1"<?php checked( 1 == $auth_settings_option ); ?> /><label for="auth_settings_<?php echo $option; ?>"><?php _e( "Configure this site independently (don't inherit any multisite settings)", 'authorizer' ); ?></label><?php
5445	4269	}
5446	4270
5447	4271
5448	4272
5449	4273	/**
5450		- * Determines whether we are in single site or multisite admin context.
5451		- *
5452		- * @param string $args Args (e.g., multisite admin mode).
5453		- * @return int Current mode.
5454		- */
5455		- private function get_admin_mode( $args ) {
5456		- if ( is_array( $args ) && array_key_exists( WP_Plugin_Authorizer::NETWORK_CONTEXT, $args ) && true === $args[ WP_Plugin_Authorizer::NETWORK_CONTEXT ] ) {
5457		- return WP_Plugin_Authorizer::NETWORK_CONTEXT;
5458		- } else {
5459		- return WP_Plugin_Authorizer::SINGLE_CONTEXT;
5460		- }
5461		- }
5462		-
5463		-
5464		- /**
5465	4274	* Add help documentation to the options page.
5466		- *
5467		- * Action: load-settings_page_authorizer > admin_head
	4275	+ * Run on action hook chain: load-settings_page_authorizer > admin_head
5468	4276	*/
5469	4277	public function admin_head() {
5470	4278	$screen = get_current_screen();
5471	4279
5472		- // Add help tab for Access Lists Settings.
	4280	+ // Add help tab for Access Lists Settings
5473	4281	$help_auth_settings_access_lists_content = '
5474		- <p>' . __( "<strong>Pending Users</strong>: Pending users are users who have successfully logged in to the site, but who haven't yet been approved (or blocked) by you.", 'authorizer' ) . '</p>
5475		- <p>' . __( '<strong>Approved Users</strong>: Approved users have access to the site once they successfully log in.', 'authorizer' ) . '</p>
5476		- <p>' . __( '<strong>Blocked Users</strong>: Blocked users will receive an error message when they try to visit the site after authenticating.', 'authorizer' ) . '</p>
5477		- <p>' . __( 'Users in the <strong>Pending</strong> list appear automatically after a new user tries to log in from the configured external authentication service. You can add users to the <strong>Approved</strong> or <strong>Blocked</strong> lists by typing them in manually, or by clicking the <em>Approve</em> or <em>Block</em> buttons next to a user in the <strong>Pending</strong> list.', 'authorizer' ) . '</p>
	4282	+ <p>' . __( "<strong>Pending Users</strong>: Pending users are users who have successfully logged in to the site, but who haven't yet been approved (or blocked) by you.", 'authorizer' ) .'</p>
	4283	+ <p>' . __( "<strong>Approved Users</strong>: Approved users have access to the site once they successfully log in.", 'authorizer' ) . '</p>
	4284	+ <p>' . __( "<strong>Blocked Users</strong>: Blocked users will receive an error message when they try to visit the site after authenticating.", 'authorizer' ) . '</p>
	4285	+ <p>' . __( "Users in the <strong>Pending</strong> list appear automatically after a new user tries to log in from the configured external authentication service. You can add users to the <strong>Approved</strong> or <strong>Blocked</strong> lists by typing them in manually, or by clicking the <em>Approve</em> or <em>Block</em> buttons next to a user in the <strong>Pending</strong> list.", 'authorizer' ) . '</p>
5478	4286	';
5479	4287	$screen->add_help_tab(
5480	4288	array(
5481		- 'id' => 'help_auth_settings_access_lists_content',
5482		- 'title' => __( 'Access Lists', 'authorizer' ),
	4289	+ 'id' => 'help_auth_settings_access_lists_content',
	4290	+ 'title' => __( 'Access Lists', 'authorizer' ),
5483	4291	'content' => $help_auth_settings_access_lists_content,
5484	4292	)
5485	4293	);
5486	4294
5487		- // Add help tab for Login Access Settings.
	4295	+ // Add help tab for Login Access Settings
5488	4296	$help_auth_settings_access_login_content = '
5489	4297	<p>' . __( "<strong>Who can log in to the site?</strong>: Choose the level of access restriction you'd like to use on your site here. You can leave the site open to anyone with a WordPress account or an account on an external service like Google, CAS, or LDAP, or restrict it to WordPress users and only the external users that you specify via the <em>Access Lists</em>.", 'authorizer' ) . '</p>
5490	4298	<p>' . __( "<strong>Which role should receive email notifications about pending users?</strong>: If you've restricted access to <strong>approved users</strong>, you can determine which WordPress users will receive a notification email everytime a new external user successfully logs in and is added to the pending list. All users of the specified role will receive an email, and the external user will get a message (specified below) telling them their access is pending approval.", 'authorizer' ) . '</p>
5491	4299	<p>' . __( '<strong>What message should pending users see after attempting to log in?</strong>: Here you can specify the exact message a new external user will see once they try to log in to the site for the first time.', 'authorizer' ) . '</p>
		@@ -5491,84 +4299,84 @@
5491	4299	<p>' . __( '<strong>What message should pending users see after attempting to log in?</strong>: Here you can specify the exact message a new external user will see once they try to log in to the site for the first time.', 'authorizer' ) . '</p>
5492	4300	';
5493	4301	$screen->add_help_tab(
5494	4302	array(
5495		- 'id' => 'help_auth_settings_access_login_content',
5496		- 'title' => __( 'Login Access', 'authorizer' ),
	4303	+ 'id' => 'help_auth_settings_access_login_content',
	4304	+ 'title' => __( 'Login Access', 'authorizer' ),
5497	4305	'content' => $help_auth_settings_access_login_content,
5498	4306	)
5499	4307	);
5500	4308
5501		- // Add help tab for Public Access Settings.
	4309	+ // Add help tab for Public Access Settings
5502	4310	$help_auth_settings_access_public_content = '
5503	4311	<p>' . __( "<strong>Who can view the site?</strong>: You can restrict the site's visibility by only allowing logged in users to see pages. If you do so, you can customize the specifics about the site's privacy using the settings below.", 'authorizer' ) . '</p>
5504	4312	<p>' . __( "<strong>What pages (if any) should be available to everyone?</strong>: If you'd like to declare certain pages on your site as always public (such as the course syllabus, introduction, or calendar), specify those pages here. These pages will always be available no matter what access restrictions exist.", 'authorizer' ) . '</p>
5505		- <p>' . __( '<strong>What happens to people without access when they visit a <em>private</em> page?</strong>: Choose the response anonymous users receive when visiting the site. You can choose between immediately taking them to the <strong>login screen</strong>, or simply showing them a <strong>message</strong>.', 'authorizer' ) . '</p>
5506		- <p>' . __( '<strong>What happens to people without access when they visit a <em>public</em> page?</strong>: Choose the response anonymous users receive when visiting a page on the site marked as public. You can choose between showing them the page without any message, or showing them a the page with a message above the content.', 'authorizer' ) . '</p>
5507		- <p>' . __( '<strong>What message should people without access see?</strong>: If you chose to show new users a <strong>message</strong> above, type that message here.', 'authorizer' ) . '</p>
	4313	+ <p>' . __( "<strong>What happens to people without access when they visit a <em>private</em> page?</strong>: Choose the response anonymous users receive when visiting the site. You can choose between immediately taking them to the <strong>login screen</strong>, or simply showing them a <strong>message</strong>.", 'authorizer' ) . '</p>
	4314	+ <p>' . __( "<strong>What happens to people without access when they visit a <em>public</em> page?</strong>: Choose the response anonymous users receive when visiting a page on the site marked as public. You can choose between showing them the page without any message, or showing them a the page with a message above the content.", 'authorizer' ) . '</p>
	4315	+ <p>' . __( "<strong>What message should people without access see?</strong>: If you chose to show new users a <strong>message</strong> above, type that message here.", 'authorizer' ) . '</p>
5508	4316	';
5509	4317	$screen->add_help_tab(
5510	4318	array(
5511		- 'id' => 'help_auth_settings_access_public_content',
5512		- 'title' => __( 'Public Access', 'authorizer' ),
	4319	+ 'id' => 'help_auth_settings_access_public_content',
	4320	+ 'title' => __( 'Public Access', 'authorizer' ),
5513	4321	'content' => $help_auth_settings_access_public_content,
5514	4322	)
5515	4323	);
5516	4324
5517		- // Add help tab for External Service (CAS, LDAP) Settings.
	4325	+ // Add help tab for External Service (CAS, LDAP) Settings
5518	4326	$help_auth_settings_external_content = '
5519	4327	<p>' . __( "<strong>Type of external service to authenticate against</strong>: Choose which authentication service type you will be using. You'll have to fill out different fields below depending on which service you choose.", 'authorizer' ) . '</p>
5520		- <p>' . __( '<strong>Enable Google Logins</strong>: Choose if you want to allow users to log in with their Google Account credentials. You will need to enter your API Client ID and Secret to enable Google Logins.', 'authorizer' ) . '</p>
5521		- <p>' . __( '<strong>Enable CAS Logins</strong>: Choose if you want to allow users to log in with via CAS (Central Authentication Service). You will need to enter details about your CAS server (host, port, and path) to enable CAS Logins.', 'authorizer' ) . '</p>
5522		- <p>' . __( '<strong>Enable LDAP Logins</strong>: Choose if you want to allow users to log in with their LDAP (Lightweight Directory Access Protocol) credentials. You will need to enter details about your LDAP server (host, port, search base, uid attribute, directory user, directory user password, and whether to use TLS) to enable Google Logins.', 'authorizer' ) . '</p>
5523		- <p>' . __( '<strong>Default role for new CAS users</strong>: Specify which role new external users will get by default. Be sure to choose a role with limited permissions!', 'authorizer' ) . '</p>
5524		- <p><strong><em>' . __( 'If you enable Google logins:', 'authorizer' ) . '</em></strong></p>
	4328	+ <p>' . __( "<strong>Enable Google Logins</strong>: Choose if you want to allow users to log in with their Google Account credentials. You will need to enter your API Client ID and Secret to enable Google Logins.", 'authorizer' ) . '</p>
	4329	+ <p>' . __( "<strong>Enable CAS Logins</strong>: Choose if you want to allow users to log in with via CAS (Central Authentication Service). You will need to enter details about your CAS server (host, port, and path) to enable CAS Logins.", 'authorizer' ) . '</p>
	4330	+ <p>' . __( "<strong>Enable LDAP Logins</strong>: Choose if you want to allow users to log in with their LDAP (Lightweight Directory Access Protocol) credentials. You will need to enter details about your LDAP server (host, port, search base, uid attribute, directory user, directory user password, and whether to use TLS) to enable Google Logins.", 'authorizer' ) . '</p>
	4331	+ <p>' . __( "<strong>Default role for new CAS users</strong>: Specify which role new external users will get by default. Be sure to choose a role with limited permissions!", 'authorizer' ) . '</p>
	4332	+ <p><strong><em>' . __( "If you enable Google logins:", 'authorizer' ) . '</em></strong></p>
5525	4333	<ul>
5526	4334	<li>' . __( "<strong>Google Client ID</strong>: You can generate this ID by creating a new Project in the <a href='https://cloud.google.com/console'>Google Developers Console</a>. A Client ID typically looks something like this: 1234567890123-kdjr85yt6vjr6d8g7dhr8g7d6durjf7g.apps.googleusercontent.com", 'authorizer' ) . '</li>
5527	4335	<li>' . __( "<strong>Google Client Secret</strong>: You can generate this secret by creating a new Project in the <a href='https://cloud.google.com/console'>Google Developers Console</a>. A Client Secret typically looks something like this: sDNgX5_pr_5bly-frKmvp8jT", 'authorizer' ) . '</li>
5528	4336	</ul>
5529		- <p><strong><em>' . __( 'If you enable CAS logins:', 'authorizer' ) . '</em></strong></p>
	4337	+ <p><strong><em>' . __( "If you enable CAS logins:", 'authorizer' ) . '</em></strong></p>
5530	4338	<ul>
5531		- <li>' . __( '<strong>CAS server hostname</strong>: Enter the hostname of the CAS server you authenticate against (e.g., authn.example.edu).', 'authorizer' ) . '</li>
5532		- <li>' . __( '<strong>CAS server port</strong>: Enter the port on the CAS server to connect to (e.g., 443).', 'authorizer' ) . '</li>
5533		- <li>' . __( '<strong>CAS server path/context</strong>: Enter the path to the login endpoint on the CAS server (e.g., /cas).', 'authorizer' ) . '</li>
	4339	+ <li>' . __( "<strong>CAS server hostname</strong>: Enter the hostname of the CAS server you authenticate against (e.g., authn.example.edu).", 'authorizer' ) . '</li>
	4340	+ <li>' . __( "<strong>CAS server port</strong>: Enter the port on the CAS server to connect to (e.g., 443).", 'authorizer' ) . '</li>
	4341	+ <li>' . __( "<strong>CAS server path/context</strong>: Enter the path to the login endpoint on the CAS server (e.g., /cas).", 'authorizer' ) . '</li>
5534	4342	<li>' . __( "<strong>CAS attribute containing first name</strong>: Enter the CAS attribute that has the user's first name. When this user first logs in, their WordPress account will have their first name retrieved from CAS and added to their WordPress profile.", 'authorizer' ) . '</li>
5535	4343	<li>' . __( "<strong>CAS attribute containing last name</strong>: Enter the CAS attribute that has the user's last name. When this user first logs in, their WordPress account will have their last name retrieved from CAS and added to their WordPress profile.", 'authorizer' ) . '</li>
5536		- <li>' . __( '<strong>CAS attribute update</strong>: Select whether the first and last names retrieved from CAS should overwrite any value the user has entered in the first and last name fields in their WordPress profile. If this is not set, this only happens the first time they log in.', 'authorizer' ) . '</li>
	4344	+ <li>' . __( "<strong>CAS attribute update</strong>: Select whether the first and last names retrieved from CAS should overwrite any value the user has entered in the first and last name fields in their WordPress profile. If this is not set, this only happens the first time they log in.", 'authorizer' ) . '</li>
5537	4345	</ul>
5538		- <p><strong><em>' . __( 'If you enable LDAP logins:', 'authorizer' ) . '</em></strong></p>
	4346	+ <p><strong><em>' . __( "If you enable LDAP logins:", 'authorizer' ) . '</em></strong></p>
5539	4347	<ul>
5540		- <li>' . __( '<strong>LDAP Host</strong>: Enter the URL of the LDAP server you authenticate against.', 'authorizer' ) . '</li>
5541		- <li>' . __( '<strong>LDAP Port</strong>: Enter the port number that the LDAP server listens on.', 'authorizer' ) . '</li>
5542		- <li>' . __( '<strong>LDAP Search Base</strong>: Enter the LDAP string that represents the search base, e.g., ou=people,dc=example,dc=edu', 'authorizer' ) . '</li>
5543		- <li>' . __( '<strong>LDAP attribute containing username</strong>: Enter the name of the LDAP attribute that contains the usernames used by those attempting to log in. The plugin will search on this attribute to find the cn to bind against for login attempts.', 'authorizer' ) . '</li>
5544		- <li>' . __( '<strong>LDAP Directory User</strong>: Enter the name of the LDAP user that has permissions to browse the directory.', 'authorizer' ) . '</li>
5545		- <li>' . __( '<strong>LDAP Directory User Password</strong>: Enter the password for the LDAP user that has permission to browse the directory.', 'authorizer' ) . '</li>
5546		- <li>' . __( '<strong>Use TLS</strong>: Select whether all communication with the LDAP server should be performed over a TLS-secured connection.', 'authorizer' ) . '</li>
	4348	+ <li>' . __( "<strong>LDAP Host</strong>: Enter the URL of the LDAP server you authenticate against.", 'authorizer' ) . '</li>
	4349	+ <li>' . __( "<strong>LDAP Port</strong>: Enter the port number that the LDAP server listens on.", 'authorizer' ) . '</li>
	4350	+ <li>' . __( "<strong>LDAP Search Base</strong>: Enter the LDAP string that represents the search base, e.g., ou=people,dc=example,dc=edu", 'authorizer' ) . '</li>
	4351	+ <li>' . __( "<strong>LDAP attribute containing username</strong>: Enter the name of the LDAP attribute that contains the usernames used by those attempting to log in. The plugin will search on this attribute to find the cn to bind against for login attempts.", 'authorizer' ) . '</li>
	4352	+ <li>' . __( "<strong>LDAP Directory User</strong>: Enter the name of the LDAP user that has permissions to browse the directory.", 'authorizer' ) . '</li>
	4353	+ <li>' . __( "<strong>LDAP Directory User Password</strong>: Enter the password for the LDAP user that has permission to browse the directory.", 'authorizer' ) . '</li>
	4354	+ <li>' . __( "<strong>Secure Connection (TLS)</strong>: Select whether all communication with the LDAP server should be performed over a TLS-secured connection.", 'authorizer' ) . '</li>
5547	4355	<li>' . __( "<strong>Custom lost password URL</strong>: The WordPress login page contains a link to recover a lost password. If you have external users who shouldn't change the password on their WordPress account, point them to the appropriate location to change the password on their external authentication service here.", 'authorizer' ) . '</li>
5548	4356	<li>' . __( "<strong>LDAP attribute containing first name</strong>: Enter the LDAP attribute that has the user's first name. When this user first logs in, their WordPress account will have their first name retrieved from LDAP and added to their WordPress profile.", 'authorizer' ) . '</li>
5549	4357	<li>' . __( "<strong>LDAP attribute containing last name</strong>: Enter the LDAP attribute that has the user's last name. When this user first logs in, their WordPress account will have their last name retrieved from LDAP and added to their WordPress profile.", 'authorizer' ) . '</li>
5550		- <li>' . __( '<strong>LDAP attribute update</strong>: Select whether the first and last names retrieved from LDAP should overwrite any value the user has entered in the first and last name fields in their WordPress profile. If this is not set, this only happens the first time they log in.', 'authorizer' ) . '</li>
	4358	+ <li>' . __( "<strong>LDAP attribute update</strong>: Select whether the first and last names retrieved from LDAP should overwrite any value the user has entered in the first and last name fields in their WordPress profile. If this is not set, this only happens the first time they log in.", 'authorizer' ) . '</li>
5551	4359	</ul>
5552	4360	';
5553	4361	$screen->add_help_tab(
5554	4362	array(
5555		- 'id' => 'help_auth_settings_external_content',
5556		- 'title' => __( 'External Service', 'authorizer' ),
	4363	+ 'id' => 'help_auth_settings_external_content',
	4364	+ 'title' => __( 'External Service', 'authorizer' ),
5557	4365	'content' => $help_auth_settings_external_content,
5558	4366	)
5559	4367	);
5560	4368
5561		- // Add help tab for Advanced Settings.
	4369	+ // Add help tab for Advanced Settings
5562	4370	$help_auth_settings_advanced_content = '
5563		- <p>' . __( '<strong>Limit invalid login attempts</strong>: Choose how soon (and for how long) to restrict access to individuals (or bots) making repeated invalid login attempts. You may set a shorter delay first, and then a longer delay after repeated invalid attempts; you may also set how much time must pass before the delays will be reset to normal.', 'authorizer' ) . '</p>
5564		- <p>' . __( '<strong>Hide WordPress Logins</strong>: If you want to hide the WordPress username and password fields and the Log In button on the wp-login screen, enable this option. Note: You can always access the WordPress logins by adding external=wordpress to the wp-login URL, like so:', 'authorizer' ) . ' <a href="' . wp_login_url() . '?external=wordpress" target="_blank">' . wp_login_url() . '?external=wordpress</a>.</p>
	4371	+ <p>' . __( "<strong>Limit invalid login attempts</strong>: Choose how soon (and for how long) to restrict access to individuals (or bots) making repeated invalid login attempts. You may set a shorter delay first, and then a longer delay after repeated invalid attempts; you may also set how much time must pass before the delays will be reset to normal.", 'authorizer' ) . '</p>
	4372	+ <p>' . __( "<strong>Hide WordPress Logins</strong>: If you want to hide the WordPress username and password fields and the Log In button on the wp-login screen, enable this option. Note: You can always access the WordPress logins by adding external=wordpress to the wp-login URL, like so:", 'authorizer' ) . ' <a href="' . wp_login_url() . '?external=wordpress" target="_blank">' . wp_login_url() . '?external=wordpress</a>.</p>
5565	4373	<p>' . __( "<strong>Custom WordPress login branding</strong>: If you'd like to use custom branding on the WordPress login page, select that here. You will need to use the `authorizer_add_branding_option` filter in your theme to add it. You can see an example theme that implements this filter in the plugin directory under sample-theme-add-branding.", 'authorizer' ) . '</p>
5566	4374	';
5567	4375	$screen->add_help_tab(
5568	4376	array(
5569		- 'id' => 'help_auth_settings_advanced_content',
5570		- 'title' => __( 'Advanced', 'authorizer' ),
	4377	+ 'id' => 'help_auth_settings_advanced_content',
	4378	+ 'title' => __( 'Advanced', 'authorizer' ),
5571	4379	'content' => $help_auth_settings_advanced_content,
5572	4380	)
5573	4381	);
5574	4382	}
		@@ -5583,66 +4391,65 @@
5583	4391
5584	4392
5585	4393	/**
5586	4394	* Network Admin menu item
	4395	+ * Hook: network_admin_menu
5587	4396	*
5588		- * Action: network_admin_menu
5589		- *
	4397	+ * @param none
5590	4398	* @return void
5591	4399	*/
5592	4400	public function network_admin_menu() {
5593	4401	// @see http://codex.wordpress.org/Function_Reference/add_menu_page
5594	4402	add_menu_page(
5595		- 'Authorizer',
5596		- 'Authorizer',
5597		- 'manage_network_options',
5598		- 'authorizer',
	4403	+ 'Authorizer', // Page title
	4404	+ 'Authorizer', // Menu title
	4405	+ 'manage_network_options', // Capability
	4406	+ 'authorizer', // Menu slug
5599	4407	array( $this, 'create_network_admin_page' ),
5600		- 'dashicons-groups',
5601		- 89 // Position.
	4408	+ 'dashicons-groups', // Icon URL
	4409	+ 89 // Position
5602	4410	);
5603	4411	}
5604	4412
5605	4413
5606	4414	/**
5607		- * Output the HTML for the options page.
	4415	+ * Output the HTML for the options page
5608	4416	*/
5609	4417	public function create_network_admin_page() {
5610	4418	if ( ! current_user_can( 'manage_network_options' ) ) {
5611		- wp_die( wp_kses( __( 'You do not have sufficient permissions to access this page.', 'authorizer' ), $this->allowed_html ) );
	4419	+ wp_die( __( 'You do not have sufficient permissions to access this page.', 'authorizer' ) );
5612	4420	}
5613		- $auth_settings = get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings', array() );
5614		- ?>
	4421	+ $auth_settings = get_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings', array() ); ?>
5615	4422	<div class="wrap">
5616	4423	<form method="post" action="" autocomplete="off">
5617		- <h2><?php esc_html_e( 'Authorizer Settings', 'authorizer' ); ?></h2>
5618		- <p><?php echo wp_kses( __( 'Most <strong>Authorizer</strong> settings are set in the individual sites, but you can specify a few options here that apply to <strong>all sites in the network</strong>. These settings will override settings in the individual sites.', 'authorizer' ), $this->allowed_html ); ?></p>
	4424	+ <h2><?php _e( 'Authorizer Settings', 'authorizer' ); ?></h2>
	4425	+ <p><?php _e( 'Most <strong>Authorizer</strong> settings are set in the individual sites, but you can specify a few options here that apply to <strong>all sites in the network</strong>. These settings will override settings in the individual sites.', 'authorizer' ); ?></p>
5619	4426
5620		- <input type="checkbox" id="auth_settings_multisite_override" name="auth_settings[multisite_override]" value="1"<?php checked( 1 === intval( $auth_settings['multisite_override'] ) ); ?> /><label for="auth_settings_multisite_override"><?php esc_html_e( 'Override individual site settings with the settings below', 'authorizer' ); ?></label>
	4427	+ <input type="checkbox" id="auth_settings_multisite_override" name="auth_settings[multisite_override]" value="1"<?php checked( 1 == $auth_settings['multisite_override'] ); ?> /><label for="auth_settings_multisite_override"><?php _e( 'Override individual site settings with the settings below', 'authorizer' ); ?></label>
5621	4428
5622	4429	<div id="auth_multisite_settings_disabled_overlay" style="display: none;"></div>
5623	4430
5624	4431	<div class="wrap" id="auth_multisite_settings">
5625		- <?php $this->print_section_info_tabs( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?>
	4432	+ <?php $this->print_section_info_tabs( array( MULTISITE_ADMIN => true ) ); ?>
5626	4433
5627	4434	<?php wp_nonce_field( 'save_auth_settings', 'nonce_save_auth_settings' ); ?>
5628	4435
5629		- <?php // Custom access lists (for network, we only really want approved list, not pending or blocked). ?>
	4436	+ <?php // Custom access lists (for network, we only really want approved list, not pending or blocked) ?>
5630	4437	<div id="section_info_access_lists" class="section_info">
5631		- <p><?php esc_html_e( 'Manage who has access to all sites in the network.', 'authorizer' ); ?></p>
	4438	+ <p><?php _e( 'Manage who has access to all sites in the network.', 'authorizer' ); ?></p>
5632	4439	</div>
5633	4440	<table class="form-table"><tbody>
5634	4441	<tr>
5635		- <th scope="row"><?php esc_html_e( 'Who can log in to sites in this network?', 'authorizer' ); ?></th>
5636		- <td><?php $this->print_radio_auth_access_who_can_login( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4442	+ <th scope="row"><?php _e( 'Who can log in to sites in this network?', 'authorizer' ); ?></th>
	4443	+ <td><?php $this->print_radio_auth_access_who_can_login( array( MULTISITE_ADMIN => true ) ); ?></td>
5637	4444	</tr>
5638	4445	<tr>
5639		- <th scope="row"><?php esc_html_e( 'Who can view sites in this network?', 'authorizer' ); ?></th>
5640		- <td><?php $this->print_radio_auth_access_who_can_view( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4446	+ <th scope="row"><?php _e( 'Who can view sites in this network?', 'authorizer' ); ?></th>
	4447	+ <td><?php $this->print_radio_auth_access_who_can_view( array( MULTISITE_ADMIN => true ) ); ?></td>
5641	4448	</tr>
5642	4449	<tr>
5643		- <th scope="row"><?php esc_html_e( 'Approved Users (All Sites)', 'authorizer' ); ?><br /><small><em><?php echo wp_kses( __( 'Note: these users will <strong>not</strong> receive welcome emails when approved. Only users approved from individual sites can receive these messages.', 'authorizer' ), $this->allowed_html ); ?></em></small></th>
5644		- <td><?php $this->print_combo_auth_access_users_approved( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4450	+ <th scope="row"><?php _e( 'Approved Users (All Sites)', 'authorizer' ); ?><br /><small><em><?php _e( 'Note: these users will <strong>not</strong> receive welcome emails when approved. Only users approved from individual sites can receive these messages.', 'authorizer' ); ?></em></small></th>
	4451	+ <td><?php $this->print_combo_auth_access_users_approved( array( MULTISITE_ADMIN => true ) ); ?></td>
5645	4452	</tr>
5646	4453	</tbody></table>
5647	4454
5648	4455	<?php $this->print_section_info_external(); ?>
		@@ -5647,122 +4454,122 @@
5647	4454
5648	4455	<?php $this->print_section_info_external(); ?>
5649	4456	<table class="form-table"><tbody>
5650	4457	<tr>
5651		- <th scope="row"><?php esc_html_e( 'Default role for new users', 'authorizer' ); ?></th>
5652		- <td><?php $this->print_select_auth_access_default_role( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4458	+ <th scope="row"><?php _e( 'Default role for new users', 'authorizer' ); ?></th>
	4459	+ <td><?php $this->print_select_auth_access_default_role( array( MULTISITE_ADMIN => true ) ); ?></td>
5653	4460	</tr>
5654	4461	<tr>
5655		- <th scope="row"><?php esc_html_e( 'Google Logins', 'authorizer' ); ?></th>
5656		- <td><?php $this->print_checkbox_auth_external_google( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4462	+ <th scope="row"><?php _e( 'Google Logins', 'authorizer' ); ?></th>
	4463	+ <td><?php $this->print_checkbox_auth_external_google( array( MULTISITE_ADMIN => true ) ); ?></td>
5657	4464	</tr>
5658	4465	<tr>
5659		- <th scope="row"><?php esc_html_e( 'Google Client ID', 'authorizer' ); ?></th>
5660		- <td><?php $this->print_text_google_clientid( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4466	+ <th scope="row"><?php _e( 'Google Client ID', 'authorizer' ); ?></th>
	4467	+ <td><?php $this->print_text_google_clientid( array( MULTISITE_ADMIN => true ) ); ?></td>
5661	4468	</tr>
5662	4469	<tr>
5663		- <th scope="row"><?php esc_html_e( 'Google Client Secret', 'authorizer' ); ?></th>
5664		- <td><?php $this->print_text_google_clientsecret( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4470	+ <th scope="row"><?php _e( 'Google Client Secret', 'authorizer' ); ?></th>
	4471	+ <td><?php $this->print_text_google_clientsecret( array( MULTISITE_ADMIN => true ) ); ?></td>
5665	4472	</tr>
5666	4473	<tr>
5667		- <th scope="row"><?php esc_html_e( 'Google Hosted Domain', 'authorizer' ); ?></th>
5668		- <td><?php $this->print_text_google_hosteddomain( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4474	+ <th scope="row"><?php _e( 'Google Hosted Domain', 'authorizer' ); ?></th>
	4475	+ <td><?php $this->print_text_google_hosteddomain( array( MULTISITE_ADMIN => true ) ); ?></td>
5669	4476	</tr>
5670	4477	<tr>
5671		- <th scope="row"><?php esc_html_e( 'CAS Logins', 'authorizer' ); ?></th>
5672		- <td><?php $this->print_checkbox_auth_external_cas( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4478	+ <th scope="row"><?php _e( 'CAS Logins', 'authorizer' ); ?></th>
	4479	+ <td><?php $this->print_checkbox_auth_external_cas( array( MULTISITE_ADMIN => true ) ); ?></td>
5673	4480	</tr>
5674	4481	<tr>
5675		- <th scope="row"><?php esc_html_e( 'CAS Custom Label', 'authorizer' ); ?></th>
5676		- <td><?php $this->print_text_cas_custom_label( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4482	+ <th scope="row"><?php _e( 'CAS Custom Label', 'authorizer' ); ?></th>
	4483	+ <td><?php $this->print_text_cas_custom_label( array( MULTISITE_ADMIN => true ) ); ?></td>
5677	4484	</tr>
5678	4485	<tr>
5679		- <th scope="row"><?php esc_html_e( 'CAS server hostname', 'authorizer' ); ?></th>
5680		- <td><?php $this->print_text_cas_host( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4486	+ <th scope="row"><?php _e( 'CAS server hostname', 'authorizer' ); ?></th>
	4487	+ <td><?php $this->print_text_cas_host( array( MULTISITE_ADMIN => true ) ); ?></td>
5681	4488	</tr>
5682	4489	<tr>
5683		- <th scope="row"><?php esc_html_e( 'CAS server port', 'authorizer' ); ?></th>
5684		- <td><?php $this->print_text_cas_port( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4490	+ <th scope="row"><?php _e( 'CAS server port', 'authorizer' ); ?></th>
	4491	+ <td><?php $this->print_text_cas_port( array( MULTISITE_ADMIN => true ) ); ?></td>
5685	4492	</tr>
5686	4493	<tr>
5687		- <th scope="row"><?php esc_html_e( 'CAS server path/context', 'authorizer' ); ?></th>
5688		- <td><?php $this->print_text_cas_path( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4494	+ <th scope="row"><?php _e( 'CAS server path/context', 'authorizer' ); ?></th>
	4495	+ <td><?php $this->print_text_cas_path( array( MULTISITE_ADMIN => true ) ); ?></td>
5689	4496	</tr>
5690	4497	<tr>
5691		- <th scope="row"><?php esc_html_e( 'CAS server version', 'authorizer' ); ?></th>
5692		- <td><?php $this->print_select_cas_version( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4498	+ <th scope="row"><?php _e( 'CAS server version', 'authorizer' ); ?></th>
	4499	+ <td><?php $this->print_select_cas_version( array( MULTISITE_ADMIN => true ) ); ?></td>
5693	4500	</tr>
5694	4501	<tr>
5695		- <th scope="row"><?php esc_html_e( 'CAS attribute containing email', 'authorizer' ); ?></th>
5696		- <td><?php $this->print_text_cas_attr_email( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4502	+ <th scope="row"><?php _e( 'CAS attribute containing email', 'authorizer' ); ?></th>
	4503	+ <td><?php $this->print_text_cas_attr_email( array( MULTISITE_ADMIN => true ) ); ?></td>
5697	4504	</tr>
5698	4505	<tr>
5699		- <th scope="row"><?php esc_html_e( 'CAS attribute containing first name', 'authorizer' ); ?></th>
5700		- <td><?php $this->print_text_cas_attr_first_name( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4506	+ <th scope="row"><?php _e( 'CAS attribute containing first name', 'authorizer' ); ?></th>
	4507	+ <td><?php $this->print_text_cas_attr_first_name( array( MULTISITE_ADMIN => true ) ); ?></td>
5701	4508	</tr>
5702	4509	<tr>
5703		- <th scope="row"><?php esc_html_e( 'CAS attribute containing last name', 'authorizer' ); ?></th>
5704		- <td><?php $this->print_text_cas_attr_last_name( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4510	+ <th scope="row"><?php _e( 'CAS attribute containing last name', 'authorizer' ); ?></th>
	4511	+ <td><?php $this->print_text_cas_attr_last_name( array( MULTISITE_ADMIN => true ) ); ?></td>
5705	4512	</tr>
5706	4513	<tr>
5707		- <th scope="row"><?php esc_html_e( 'CAS attribute update', 'authorizer' ); ?></th>
5708		- <td><?php $this->print_checkbox_cas_attr_update_on_login( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4514	+ <th scope="row"><?php _e( 'CAS attribute update', 'authorizer' ); ?></th>
	4515	+ <td><?php $this->print_checkbox_cas_attr_update_on_login( array( MULTISITE_ADMIN => true ) ); ?></td>
5709	4516	</tr>
5710	4517	<tr>
5711		- <th scope="row"><?php esc_html_e( 'CAS automatic login', 'authorizer' ); ?></th>
5712		- <td><?php $this->print_checkbox_cas_auto_login( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4518	+ <th scope="row"><?php _e( 'CAS automatic login', 'authorizer' ); ?></th>
	4519	+ <td><?php $this->print_checkbox_cas_auto_login( array( MULTISITE_ADMIN => true ) ); ?></td>
5713	4520	</tr>
5714	4521	<tr>
5715		- <th scope="row"><?php esc_html_e( 'LDAP Logins', 'authorizer' ); ?></th>
5716		- <td><?php $this->print_checkbox_auth_external_ldap( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4522	+ <th scope="row"><?php _e( 'LDAP Logins', 'authorizer' ); ?></th>
	4523	+ <td><?php $this->print_checkbox_auth_external_ldap( array( MULTISITE_ADMIN => true ) ); ?></td>
5717	4524	</tr>
5718	4525	<tr>
5719		- <th scope="row"><?php esc_html_e( 'LDAP Host', 'authorizer' ); ?></th>
5720		- <td><?php $this->print_text_ldap_host( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4526	+ <th scope="row"><?php _e( 'LDAP Host', 'authorizer' ); ?></th>
	4527	+ <td><?php $this->print_text_ldap_host( array( MULTISITE_ADMIN => true ) ); ?></td>
5721	4528	</tr>
5722	4529	<tr>
5723		- <th scope="row"><?php esc_html_e( 'LDAP Port', 'authorizer' ); ?></th>
5724		- <td><?php $this->print_text_ldap_port( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4530	+ <th scope="row"><?php _e( 'LDAP Port', 'authorizer' ); ?></th>
	4531	+ <td><?php $this->print_text_ldap_port( array( MULTISITE_ADMIN => true ) ); ?></td>
5725	4532	</tr>
5726	4533	<tr>
5727		- <th scope="row"><?php esc_html_e( 'Use TLS', 'authorizer' ); ?></th>
5728		- <td><?php $this->print_checkbox_ldap_tls( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4534	+ <th scope="row"><?php _e( 'Secure Connection (TLS)', 'authorizer' ); ?></th>
	4535	+ <td><?php $this->print_checkbox_ldap_tls( array( MULTISITE_ADMIN => true ) ); ?></td>
5729	4536	</tr>
5730	4537	<tr>
5731		- <th scope="row"><?php esc_html_e( 'LDAP Search Base', 'authorizer' ); ?></th>
5732		- <td><?php $this->print_text_ldap_search_base( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4538	+ <th scope="row"><?php _e( 'LDAP Search Base', 'authorizer' ); ?></th>
	4539	+ <td><?php $this->print_text_ldap_search_base( array( MULTISITE_ADMIN => true ) ); ?></td>
5733	4540	</tr>
5734	4541	<tr>
5735		- <th scope="row"><?php esc_html_e( 'LDAP attribute containing username', 'authorizer' ); ?></th>
5736		- <td><?php $this->print_text_ldap_uid( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4542	+ <th scope="row"><?php _e( 'LDAP attribute containing username', 'authorizer' ); ?></th>
	4543	+ <td><?php $this->print_text_ldap_uid( array( MULTISITE_ADMIN => true ) ); ?></td>
5737	4544	</tr>
5738	4545	<tr>
5739		- <th scope="row"><?php esc_html_e( 'LDAP attribute containing email', 'authorizer' ); ?></th>
5740		- <td><?php $this->print_text_ldap_attr_email( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4546	+ <th scope="row"><?php _e( 'LDAP attribute containing email', 'authorizer' ); ?></th>
	4547	+ <td><?php $this->print_text_ldap_attr_email( array( MULTISITE_ADMIN => true ) ); ?></td>
5741	4548	</tr>
5742	4549	<tr>
5743		- <th scope="row"><?php esc_html_e( 'LDAP Directory User', 'authorizer' ); ?></th>
5744		- <td><?php $this->print_text_ldap_user( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4550	+ <th scope="row"><?php _e( 'LDAP Directory User', 'authorizer' ); ?></th>
	4551	+ <td><?php $this->print_text_ldap_user( array( MULTISITE_ADMIN => true ) ); ?></td>
5745	4552	</tr>
5746	4553	<tr>
5747		- <th scope="row"><?php esc_html_e( 'LDAP Directory User Password', 'authorizer' ); ?></th>
5748		- <td><?php $this->print_password_ldap_password( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4554	+ <th scope="row"><?php _e( 'LDAP Directory User Password', 'authorizer' ); ?></th>
	4555	+ <td><?php $this->print_password_ldap_password( array( MULTISITE_ADMIN => true ) ); ?></td>
5749	4556	</tr>
5750	4557	<tr>
5751		- <th scope="row"><?php esc_html_e( 'Custom lost password URL', 'authorizer' ); ?></th>
5752		- <td><?php $this->print_text_ldap_lostpassword_url( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4558	+ <th scope="row"><?php _e( 'Custom lost password URL', 'authorizer' ); ?></th>
	4559	+ <td><?php $this->print_text_ldap_lostpassword_url( array( MULTISITE_ADMIN => true ) ); ?></td>
5753	4560	</tr>
5754	4561	<tr>
5755		- <th scope="row"><?php esc_html_e( 'LDAP attribute containing first name', 'authorizer' ); ?></th>
5756		- <td><?php $this->print_text_ldap_attr_first_name( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4562	+ <th scope="row"><?php _e( 'LDAP attribute containing first name', 'authorizer' ); ?></th>
	4563	+ <td><?php $this->print_text_ldap_attr_first_name( array( MULTISITE_ADMIN => true ) ); ?></td>
5757	4564	</tr>
5758	4565	<tr>
5759		- <th scope="row"><?php esc_html_e( 'LDAP attribute containing last name', 'authorizer' ); ?></th>
5760		- <td><?php $this->print_text_ldap_attr_last_name( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4566	+ <th scope="row"><?php _e( 'LDAP attribute containing last name', 'authorizer' ); ?></th>
	4567	+ <td><?php $this->print_text_ldap_attr_last_name( array( MULTISITE_ADMIN => true ) ); ?></td>
5761	4568	</tr>
5762	4569	<tr>
5763		- <th scope="row"><?php esc_html_e( 'LDAP attribute update', 'authorizer' ); ?></th>
5764		- <td><?php $this->print_checkbox_ldap_attr_update_on_login( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4570	+ <th scope="row"><?php _e( 'LDAP attribute update', 'authorizer' ); ?></th>
	4571	+ <td><?php $this->print_checkbox_ldap_attr_update_on_login( array( MULTISITE_ADMIN => true ) ); ?></td>
5765	4572	</tr>
5766	4573	</tbody></table>
5767	4574
5768	4575	<?php $this->print_section_info_advanced(); ?>
		@@ -5767,36 +4574,20 @@
5767	4574
5768	4575	<?php $this->print_section_info_advanced(); ?>
5769	4576	<table class="form-table"><tbody>
5770	4577	<tr>
5771		- <th scope="row"><?php esc_html_e( 'Limit invalid login attempts', 'authorizer' ); ?></th>
5772		- <td><?php $this->print_text_auth_advanced_lockouts( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4578	+ <th scope="row"><?php _e( 'Limit invalid login attempts', 'authorizer' ); ?></th>
	4579	+ <td><?php $this->print_text_auth_advanced_lockouts( array( MULTISITE_ADMIN => true ) ); ?></td>
5773	4580	</tr>
5774	4581	<tr>
5775		- <th scope="row"><?php esc_html_e( 'Hide WordPress Logins', 'authorizer' ); ?></th>
5776		- <td><?php $this->print_checkbox_auth_advanced_hide_wp_login( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4582	+ <th scope="row"><?php _e( 'Hide WordPress Logins', 'authorizer' ); ?></th>
	4583	+ <td><?php $this->print_checkbox_auth_advanced_hide_wp_login( array( MULTISITE_ADMIN => true ) ); ?></td>
5777	4584	</tr>
5778		- <tr>
5779		- <th scope="row"><?php esc_html_e( 'Number of users per page', 'authorizer' ); ?></th>
5780		- <td><?php $this->print_text_auth_advanced_users_per_page( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
5781		- </tr>
5782		- <tr>
5783		- <th scope="row"><?php esc_html_e( 'Approved users sort method', 'authorizer' ); ?></th>
5784		- <td><?php $this->print_select_auth_advanced_users_sort_by( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
5785		- </tr>
5786		- <tr>
5787		- <th scope="row"><?php esc_html_e( 'Approved users sort order', 'authorizer' ); ?></th>
5788		- <td><?php $this->print_select_auth_advanced_users_sort_order( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
5789		- </tr>
5790		- <tr>
5791		- <th scope="row"><?php esc_html_e( 'Show Dashboard Widget', 'authorizer' ); ?></th>
5792		- <td><?php $this->print_checkbox_auth_advanced_widget_enabled( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
5793		- </tr>
5794	4585	</tbody></table>
5795	4586
5796	4587	<br class="clear" />
5797	4588	</div>
5798		- <input type="button" name="submit" id="submit" class="button button-primary" value="<?php esc_attr_e( 'Save Changes', 'authorizer' ); ?>" onclick="saveAuthMultisiteSettings(this);" />
	4589	+ <input type="button" name="submit" id="submit" class="button button-primary" value="<?php _e( 'Save Changes', 'authorizer' ); ?>" onclick="save_auth_multisite_settings(this);" />
5799	4590	</form>
5800	4591	</div>
5801	4592	<?php
5802	4593	}
		@@ -5803,12 +4594,10 @@
5803	4594
5804	4595
5805	4596	/**
5806	4597	* Save multisite settings (ajax call).
5807		- *
5808		- * Action: wp_ajax_save_auth_multisite_settings
5809	4598	*/
5810		- public function ajax_save_auth_multisite_settings() {
	4599	+ function ajax_save_auth_multisite_settings() {
5811	4600	// Fail silently if current user doesn't have permissions.
5812	4601	if ( ! current_user_can( 'manage_network_options' ) ) {
5813	4602	die( '' );
5814	4603	}
		@@ -5813,14 +4602,14 @@
5813	4602	die( '' );
5814	4603	}
5815	4604
5816	4605	// Make sure nonce exists.
5817		- if ( empty( $_POST['nonce'] ) ) {
	4606	+ if ( empty( $_POST['nonce_save_auth_settings'] ) ) {
5818	4607	die( '' );
5819	4608	}
5820	4609
5821	4610	// Nonce check.
5822		- if ( ! wp_verify_nonce( sanitize_key( $_POST['nonce'] ), 'save_auth_settings' ) ) {
	4611	+ if ( ! wp_verify_nonce( $_POST['nonce_save_auth_settings'], 'save_auth_settings' ) ) {
5823	4612	die( '' );
5824	4613	}
5825	4614
5826	4615	// Assert multisite.
		@@ -5828,15 +4617,15 @@
5828	4617	die( '' );
5829	4618	}
5830	4619
5831	4620	// Get multisite settings.
5832		- $auth_multisite_settings = get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings', array() );
	4621	+ $auth_multisite_settings = get_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings', array() );
5833	4622
5834		- // Sanitize settings.
	4623	+ // Sanitize settings
5835	4624	$auth_multisite_settings = $this->sanitize_options( $_POST );
5836	4625
5837		- // Filter options to only the allowed values (multisite options are a subset of all options).
5838		- $allowed = array(
	4626	+ // Filter options to only the allowed values (multisite options are a subset of all options)
	4627	+ $allowed = array(
5839	4628	'multisite_override',
5840	4629	'access_who_can_login',
5841	4630	'access_who_can_view',
5842	4631	'access_default_role',
		@@ -5869,17 +4658,13 @@
5869	4658	'ldap_attr_last_name',
5870	4659	'ldap_attr_update_on_login',
5871	4660	'advanced_lockouts',
5872	4661	'advanced_hide_wp_login',
5873		- 'advanced_users_per_page',
5874		- 'advanced_users_sort_by',
5875		- 'advanced_users_sort_order',
5876		- 'advanced_widget_enabled',
5877	4662	);
5878	4663	$auth_multisite_settings = array_intersect_key( $auth_multisite_settings, array_flip( $allowed ) );
5879	4664
5880	4665	// Update multisite settings in database.
5881		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings', $auth_multisite_settings );
	4666	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings', $auth_multisite_settings );
5882	4667
5883	4668	// Return 'success' value to AJAX call.
5884	4669	die( 'success' );
5885	4670	}
		@@ -5893,67 +4678,42 @@
5893	4678	*/
5894	4679
5895	4680
5896	4681
5897		- /**
5898		- * Load Authorizer dashboard widget if it's enabled.
5899		- *
5900		- * Action: wp_dashboard_setup
5901		- */
5902		- public function add_dashboard_widgets() {
5903		- $widget_enabled = $this->get_plugin_option( 'advanced_widget_enabled', WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' ) === '1';
5904		-
5905		- // Load authorizer dashboard widget if it's enabled and user has permission.
5906		- if ( current_user_can( 'create_users' ) && $widget_enabled ) {
5907		- // Add dashboard widget for adding/editing users with access.
	4682	+ function add_dashboard_widgets() {
	4683	+ // Only users who can edit can see the authorizer dashboard widget
	4684	+ if ( current_user_can( 'create_users' ) ) {
	4685	+ // Add dashboard widget for adding/editing users with access
5908	4686	wp_add_dashboard_widget( 'auth_dashboard_widget', __( 'Authorizer Settings', 'authorizer' ), array( $this, 'add_auth_dashboard_widget' ) );
5909	4687	}
5910	4688	}
5911	4689
5912	4690
5913		- /**
5914		- * Render Authorizer dashboard widget (callback).
5915		- */
5916		- public function add_auth_dashboard_widget() {
5917		- ?>
5918		- <form method="post" id="auth_settings_access_form" action="">
	4691	+ function add_auth_dashboard_widget() {
	4692	+ ?><form method="post" id="auth_settings_access_form" action="">
5919	4693	<?php $this->print_section_info_access_login(); ?>
5920	4694	<div>
5921		- <h2><?php esc_html_e( 'Pending Users', 'authorizer' ); ?></h2>
	4695	+ <h2><?php _e( 'Pending Users', 'authorizer' ); ?></h2>
5922	4696	<?php $this->print_combo_auth_access_users_pending(); ?>
5923	4697	</div>
5924	4698	<div>
5925		- <h2><?php esc_html_e( 'Approved Users', 'authorizer' ); ?></h2>
	4699	+ <h2><?php _e( 'Approved Users', 'authorizer' ); ?></h2>
5926	4700	<?php $this->print_combo_auth_access_users_approved(); ?>
5927	4701	</div>
5928	4702	<div>
5929		- <h2><?php esc_html_e( 'Blocked Users', 'authorizer' ); ?></h2>
	4703	+ <h2><?php _e( 'Blocked Users', 'authorizer' ); ?></h2>
5930	4704	<?php $this->print_combo_auth_access_users_blocked(); ?>
5931	4705	</div>
5932	4706	<br class="clear" />
5933		- </form>
5934		- <?php
	4707	+ </form><?php
5935	4708	}
5936	4709
5937	4710
5938		-
5939		- /**
5940		- * ***************************
5941		- * AJAX Actions
5942		- * ***************************
5943		- */
5944		-
5945		-
5946		-
5947		- /**
5948		- * Re-render the Approved User list (usually triggered if pager params have
5949		- * changed, e.g., current page, search term, sort order).
5950		- *
5951		- * Action: wp_ajax_refresh_approved_user_list
5952		- *
5953		- * @return void
5954		- */
5955		- public function ajax_refresh_approved_user_list() {
	4711	+ // Fired on a change event from the optional usermeta field in the
	4712	+ // approved user list. Updates the selected usermeta value, or saves it
	4713	+ // in the user's approved list entry if the user hasn't logged in yet
	4714	+ // and created a WordPress account.
	4715	+ function ajax_update_auth_usermeta() {
5956	4716	// Fail silently if current user doesn't have permissions.
5957	4717	if ( ! current_user_can( 'create_users' ) ) {
5958	4718	die( '' );
5959	4719	}
		@@ -5958,175 +4718,35 @@
5958	4718	die( '' );
5959	4719	}
5960	4720
5961	4721	// Nonce check.
5962		- if ( empty( $_POST['nonce'] ) || ! wp_verify_nonce( sanitize_key( $_POST['nonce'] ), 'save_auth_settings' ) ) {
	4722	+ if ( empty( $_POST['nonce_save_auth_settings'] ) || ! wp_verify_nonce( $_POST['nonce_save_auth_settings'], 'save_auth_settings' ) ) {
5963	4723	die( '' );
5964	4724	}
5965	4725
5966	4726	// Fail if required post data doesn't exist.
5967		- if ( ! array_key_exists( 'paged', $_REQUEST ) ) {
	4727	+ if ( ! array_key_exists( 'email', $_REQUEST ) || ! array_key_exists( 'usermeta', $_REQUEST ) ) {
5968	4728	die( '' );
5969	4729	}
5970	4730
5971		- // Get defaults.
5972		- $success = true;
5973		- $message = '';
5974		- $is_network_admin = isset( $_REQUEST['is_network_admin'] ) && '1' === $_REQUEST['is_network_admin'];
5975		-
5976		- // Get user list.
5977		- $option = 'access_users_approved';
5978		- $admin_mode = is_multisite() && $is_network_admin ? WP_Plugin_Authorizer::NETWORK_CONTEXT : WP_Plugin_Authorizer::SINGLE_CONTEXT;
5979		- $auth_settings_option = $this->get_plugin_option( $option, $admin_mode, 'no override' );
5980		- $auth_settings_option = is_array( $auth_settings_option ) ? $auth_settings_option : array();
5981		-
5982		- // Get multisite approved users (will be added to top of list, greyed out).
5983		- $auth_override_multisite = $this->get_plugin_option( 'advanced_override_multisite' );
5984		- $auth_multisite_settings = $this->get_plugin_options( WP_Plugin_Authorizer::NETWORK_CONTEXT );
5985		- $auth_settings_option_multisite = array();
5986		- if (
5987		- is_multisite() &&
5988		- ! $is_network_admin &&
5989		- 1 !== intval( $auth_override_multisite ) &&
5990		- array_key_exists( 'multisite_override', $auth_multisite_settings ) &&
5991		- '1' === $auth_multisite_settings['multisite_override']
5992		- ) {
5993		- $auth_settings_option_multisite = $this->get_plugin_option( $option, WP_Plugin_Authorizer::NETWORK_CONTEXT, 'allow override' );
5994		- $auth_settings_option_multisite = is_array( $auth_settings_option_multisite ) ? $auth_settings_option_multisite : array();
5995		- // Add multisite users to the beginning of the main user array.
5996		- foreach ( array_reverse( $auth_settings_option_multisite ) as $approved_user ) {
5997		- $approved_user['multisite_user'] = true;
5998		- array_unshift( $auth_settings_option, $approved_user );
5999		- }
6000		- }
6001		-
6002		- // Get custom usermeta field to show.
6003		- $advanced_usermeta = $this->get_plugin_option( 'advanced_usermeta' );
6004		-
6005		- // Filter user list to search terms.
6006		- if ( ! empty( $_REQUEST['search'] ) ) {
6007		- $search_term = sanitize_text_field( wp_unslash( $_REQUEST['search'] ) );
6008		- $auth_settings_option = array_filter(
6009		- $auth_settings_option, function ( $user ) use ( $search_term ) {
6010		- return stripos( $user['email'], $search_term ) !== false ||
6011		- stripos( $user['role'], $search_term ) !== false ||
6012		- stripos( $user['date_added'], $search_term ) !== false;
6013		- }
6014		- );
6015		- }
6016		-
6017		- // Sort user list.
6018		- $sort_by = $this->get_plugin_option( 'advanced_users_sort_by', WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' ); // email, role, date_added (registered), created (date approved).
6019		- $sort_order = $this->get_plugin_option( 'advanced_users_sort_order', WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' ); // asc or desc.
6020		- $sort_dimension = array();
6021		- if ( in_array( $sort_by, array( 'email', 'role', 'date_added' ), true ) ) {
6022		- foreach ( $auth_settings_option as $key => $user ) {
6023		- if ( 'date_added' === $sort_by ) {
6024		- $sort_dimension[ $key ] = date( 'Ymd', strtotime( $user[ $sort_by ] ) );
6025		- } else {
6026		- $sort_dimension[ $key ] = strtolower( $user[ $sort_by ] );
6027		- }
6028		- }
6029		- $sort_order = 'asc' === $sort_order ? SORT_ASC : SORT_DESC;
6030		- array_multisort( $sort_dimension, $sort_order, $auth_settings_option );
6031		- } elseif ( 'created' === $sort_by && 'asc' !== $sort_order ) {
6032		- // If default sort method and reverse order, just reverse the array.
6033		- $auth_settings_option = array_reverse( $auth_settings_option );
6034		- }
6035		-
6036		- // Ensure array keys run from 0..max (keys in database will be the original,
6037		- // index, and removing users will not reorder the array keys of other users).
6038		- $auth_settings_option = array_values( $auth_settings_option );
6039		-
6040		- // Get pager params.
6041		- $total_users = count( $auth_settings_option );
6042		- $users_per_page = intval( $this->get_plugin_option( 'advanced_users_per_page', WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' ) );
6043		- $current_page = isset( $_REQUEST['paged'] ) ? intval( $_REQUEST['paged'] ) : 1;
6044		- $total_pages = ceil( $total_users / $users_per_page );
6045		- if ( $total_pages < 1 ) {
6046		- $total_pages = 1;
6047		- }
6048		-
6049		- // Make sure current_page is between 1 and max pages.
6050		- if ( $current_page < 1 ) {
6051		- $current_page = 1;
6052		- } elseif ( $current_page > $total_pages ) {
6053		- $current_page = $total_pages;
6054		- }
6055		-
6056		- // Render user list.
6057		- ob_start();
6058		- $offset = ( $current_page - 1 ) * $users_per_page;
6059		- $max = min( $offset + $users_per_page, count( $auth_settings_option ) );
6060		- for ( $key = $offset; $key < $max; $key++ ) :
6061		- $approved_user = $auth_settings_option[ $key ];
6062		- if ( empty( $approved_user ) || count( $approved_user ) < 1 ) :
6063		- continue;
6064		- endif;
6065		- $this->render_user_element( $approved_user, $key, $option, $admin_mode, $advanced_usermeta );
6066		- endfor;
6067		-
6068		- // Send response to client.
6069		- $response = array(
6070		- 'success' => $success,
6071		- 'message' => $message,
6072		- 'html' => ob_get_clean(),
6073		- /* TRANSLATORS: %s: number of users */
6074		- 'total_users_html' => sprintf( _n( '%s user', '%s users', $total_users, 'authorizer' ), number_format_i18n( $total_users ) ),
6075		- 'total_pages_html' => number_format_i18n( $total_pages ),
6076		- 'total_pages' => $total_pages,
6077		- );
6078		- header( 'content-type: application/json' );
6079		- echo wp_json_encode( $response );
6080		- exit;
6081		- }
6082		-
6083		-
6084		- /**
6085		- * Fired on a change event from the optional usermeta field in the approved
6086		- * user list. Updates the selected usermeta value, or saves it in the user's
6087		- * approved list entry if the user hasn't logged in yet and created a
6088		- * WordPress account.
6089		- *
6090		- * Action: wp_ajax_update_auth_usermeta
6091		- *
6092		- * @return void
6093		- */
6094		- public function ajax_update_auth_usermeta() {
6095		- // Fail silently if current user doesn't have permissions.
6096		- if ( ! current_user_can( 'create_users' ) ) {
6097		- die( '' );
6098		- }
6099		-
6100		- // Nonce check.
6101		- if ( empty( $_POST['nonce'] ) || ! wp_verify_nonce( sanitize_key( $_POST['nonce'] ), 'save_auth_settings' ) ) {
6102		- die( '' );
6103		- }
6104		-
6105		- // Fail if required post data doesn't exist.
6106		- if ( ! isset( $_REQUEST['email'], $_REQUEST['usermeta'] ) ) {
6107		- die( '' );
6108		- }
6109		-
6110	4731	// Get values to update from post data.
6111		- $email = sanitize_email( wp_unslash( $_REQUEST['email'] ) );
6112		- $meta_value = sanitize_meta( 'authorizer-usermeta', wp_unslash( $_REQUEST['usermeta'] ), 'user' );
6113		- $meta_key = $this->get_plugin_option( 'advanced_usermeta' );
	4732	+ $email = $_REQUEST['email'];
	4733	+ $meta_value = $_REQUEST['usermeta'];
	4734	+ $meta_key = $this->get_plugin_option( 'advanced_usermeta' );
6114	4735
6115	4736	// If user doesn't exist, save usermeta selection to authorizer
6116	4737	// list. This value will get saved to usermeta when the user first
6117	4738	// logs in (i.e., when their WordPress account is created).
6118		- $wp_user = get_user_by( 'email', $email );
6119		- if ( ! $wp_user ) {
	4739	+ if ( ! ( $wp_user = get_user_by( 'email', $email ) ) ) {
6120	4740	// Look through multisite approved users and add a usermeta
6121	4741	// reference for the current blog if the user is found.
6122		- $auth_multisite_settings_access_users_approved = is_multisite() ? get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', array() ) : array();
	4742	+ $auth_multisite_settings_access_users_approved = is_multisite() ? get_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', array() ) : array();
6123	4743	$should_update_auth_multisite_settings_access_users_approved = false;
6124	4744	foreach ( $auth_multisite_settings_access_users_approved as $index => $approved_user ) {
6125	4745	if ( 0 === strcasecmp( $email, $approved_user['email'] ) ) {
6126		- if ( ! is_array( $auth_multisite_settings_access_users_approved[ $index ]['usermeta'] ) ) {
	4746	+ if ( ! is_array( $auth_multisite_settings_access_users_approved[$index]['usermeta'] ) ) {
6127	4747	// Initialize the array of usermeta for each blog this user belongs to.
6128		- $auth_multisite_settings_access_users_approved[ $index ]['usermeta'] = array();
	4748	+ $auth_multisite_settings_access_users_approved[$index]['usermeta'] = array();
6129	4749	} else {
6130	4750	// There is already usermeta associated with this
6131	4751	// preapproved user; iterate through it and make
6132	4752	// sure it's not for old meta_keys (delete it if
		@@ -6132,53 +4752,55 @@
6132	4752	// sure it's not for old meta_keys (delete it if
6133	4753	// so). This can happen if someone changes the
6134	4754	// usermeta key in authorizer options, and we don't
6135	4755	// want to hang on to old data.
6136		- foreach ( $auth_multisite_settings_access_users_approved[ $index ]['usermeta'] as $blog_id => $usermeta ) {
	4756	+ foreach ( $auth_multisite_settings_access_users_approved[$index]['usermeta'] as $blog_id => $usermeta ) {
6137	4757	if ( array_key_exists( 'meta_key', $usermeta ) && $usermeta['meta_key'] === $meta_key ) {
6138	4758	continue;
6139	4759	} else {
6140		- unset( $auth_multisite_settings_access_users_approved[ $index ]['usermeta'][ $blog_id ] );
	4760	+ unset( $auth_multisite_settings_access_users_approved[$index]['usermeta'][$blog_id] );
6141	4761	}
6142	4762	}
6143	4763	}
6144		- $auth_multisite_settings_access_users_approved[ $index ]['usermeta'][ get_current_blog_id() ] = array(
6145		- 'meta_key' => $meta_key,
	4764	+ $auth_multisite_settings_access_users_approved[$index]['usermeta'][get_current_blog_id()] = array(
	4765	+ 'meta_key' => $meta_key,
6146	4766	'meta_value' => $meta_value,
6147	4767	);
6148		- $should_update_auth_multisite_settings_access_users_approved = true;
	4768	+ $should_update_auth_multisite_settings_access_users_approved = true;
6149	4769	}
6150	4770	}
6151	4771	if ( $should_update_auth_multisite_settings_access_users_approved ) {
6152		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
	4772	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
6153	4773	}
6154	4774
6155	4775	// Look through the approved users (of the current blog in a
6156	4776	// multisite install, or just of the single site) and add a
6157	4777	// usermeta reference if the user is found.
6158		- $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT );
	4778	+ $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN );
6159	4779	$should_update_auth_settings_access_users_approved = false;
6160	4780	foreach ( $auth_settings_access_users_approved as $index => $approved_user ) {
6161	4781	if ( 0 === strcasecmp( $email, $approved_user['email'] ) ) {
6162		- $auth_settings_access_users_approved[ $index ]['usermeta'] = array(
6163		- 'meta_key' => $meta_key,
	4782	+ $auth_settings_access_users_approved[$index]['usermeta'] = array(
	4783	+ 'meta_key' => $meta_key,
6164	4784	'meta_value' => $meta_value,
6165	4785	);
6166		- $should_update_auth_settings_access_users_approved = true;
	4786	+ $should_update_auth_settings_access_users_approved = true;
6167	4787	}
6168	4788	}
6169	4789	if ( $should_update_auth_settings_access_users_approved ) {
6170	4790	update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved );
6171	4791	}
	4792	+
6172	4793	} else {
6173	4794	// Update user's usermeta value for usermeta key stored in authorizer options.
6174	4795	if ( strpos( $meta_key, 'acf___' ) === 0 && class_exists( 'acf' ) ) {
6175	4796	// We have an ACF field value, so use the ACF function to update it.
6176		- update_field( str_replace( 'acf___', '', $meta_key ), $meta_value, 'user_' . $wp_user->ID );
	4797	+ update_field( str_replace('acf___', '', $meta_key ), $meta_value, 'user_' . $wp_user->ID );
6177	4798	} else {
6178	4799	// We have a normal usermeta value, so just update it via the WordPress function.
6179	4800	update_user_meta( $wp_user->ID, $meta_key, $meta_value );
6180	4801	}
	4802	+
6181	4803	}
6182	4804
6183	4805	// Return 'success' value to AJAX call.
6184	4806	die( 'success' );
		@@ -6184,17 +4806,9 @@
6184	4806	die( 'success' );
6185	4807	}
6186	4808
6187	4809
6188		- /**
6189		- * Fired on a change event from the user fields in the user lists. Updates
6190		- * the selected user value.
6191		- *
6192		- * Action: wp_ajax_update_auth_user
6193		- *
6194		- * @return void
6195		- */
6196		- public function ajax_update_auth_user() {
	4810	+ function ajax_update_auth_user() {
6197	4811	// Fail silently if current user doesn't have permissions.
6198	4812	if ( ! current_user_can( 'create_users' ) ) {
6199	4813	die( '' );
6200	4814	}
		@@ -6199,83 +4813,76 @@
6199	4813	die( '' );
6200	4814	}
6201	4815
6202	4816	// Nonce check.
6203		- if ( empty( $_POST['nonce'] ) || ! wp_verify_nonce( sanitize_key( $_POST['nonce'] ), 'save_auth_settings' ) ) {
	4817	+ if ( empty( $_POST['nonce_save_auth_settings'] ) || ! wp_verify_nonce( $_POST['nonce_save_auth_settings'], 'save_auth_settings' ) ) {
6204	4818	die( '' );
6205	4819	}
6206	4820
6207	4821	// Fail if requesting a change to an invalid setting.
6208		- if ( ! isset( $_POST['setting'] ) || ! in_array( wp_unslash( $_POST['setting'] ), array( 'access_users_pending', 'access_users_approved', 'access_users_blocked' ), true ) ) {
	4822	+ if ( ! in_array( $_POST['setting'], array( 'access_users_pending', 'access_users_approved', 'access_users_blocked' ) ) ) {
6209	4823	die( '' );
6210	4824	}
6211	4825
6212		- // Track any emails that couldn't be added (used when adding users).
6213		- $invalid_emails = array();
6214		-
6215	4826	// Editing a pending list entry.
6216		- if ( 'access_users_pending' === $_POST['setting'] ) {
6217		- // Sanitize posted data.
6218		- $access_users_pending = array();
6219		- if ( isset( $_POST['access_users_pending'] ) && is_array( $_POST['access_users_pending'] ) ) {
6220		- $access_users_pending = $this->sanitize_update_auth_users( wp_unslash( $_POST['access_users_pending'] ) );
	4827	+ if ( $_POST['setting'] === 'access_users_pending' ) {
	4828	+ // Initialize posted data if empty.
	4829	+ if ( ! ( array_key_exists( 'access_users_pending', $_POST ) && is_array( $_POST['access_users_pending'] ) ) ) {
	4830	+ $_POST['access_users_pending'] = array();
6221	4831	}
6222	4832
6223	4833	// Deal with each modified user (add or remove).
6224		- foreach ( $access_users_pending as $pending_user ) {
	4834	+ foreach ( $_POST['access_users_pending'] as $pending_user ) {
6225	4835
6226		- if ( 'add' === $pending_user['edit_action'] ) {
	4836	+ if ( $pending_user['edit_action'] === 'add' ) {
6227	4837
6228	4838	// Add new user to pending list and save (skip if it's
6229	4839	// already there--someone else might have just done it).
6230	4840	if ( ! $this->is_email_in_list( $pending_user['email'], 'pending' ) ) {
6231	4841	$auth_settings_access_users_pending = $this->sanitize_user_list(
6232		- $this->get_plugin_option( 'access_users_pending', WP_Plugin_Authorizer::SINGLE_CONTEXT )
	4842	+ $this->get_plugin_option( 'access_users_pending', SINGLE_ADMIN )
6233	4843	);
6234	4844	array_push( $auth_settings_access_users_pending, $pending_user );
6235	4845	update_option( 'auth_settings_access_users_pending', $auth_settings_access_users_pending );
6236	4846	}
6237		- } elseif ( 'remove' === $pending_user['edit_action'] ) {
6238	4847
6239		- // Remove user from pending list and save.
	4848	+ } elseif ( $pending_user['edit_action'] === 'remove' ) {
	4849	+
	4850	+ // Remove user from pending list and save
6240	4851	if ( $this->is_email_in_list( $pending_user['email'], 'pending' ) ) {
6241	4852	$auth_settings_access_users_pending = $this->sanitize_user_list(
6242		- $this->get_plugin_option( 'access_users_pending', WP_Plugin_Authorizer::SINGLE_CONTEXT )
	4853	+ $this->get_plugin_option( 'access_users_pending', SINGLE_ADMIN )
6243	4854	);
6244	4855	foreach ( $auth_settings_access_users_pending as $key => $existing_user ) {
6245	4856	if ( 0 === strcasecmp( $pending_user['email'], $existing_user['email'] ) ) {
6246		- unset( $auth_settings_access_users_pending[ $key ] );
	4857	+ unset( $auth_settings_access_users_pending[$key] );
6247	4858	break;
6248	4859	}
6249	4860	}
6250	4861	update_option( 'auth_settings_access_users_pending', $auth_settings_access_users_pending );
6251	4862	}
	4863	+
6252	4864	}
6253	4865	}
6254	4866	}
6255	4867
6256	4868	// Editing an approved list entry.
6257		- if ( 'access_users_approved' === $_POST['setting'] ) {
6258		- // Sanitize posted data.
6259		- $access_users_approved = array();
6260		- if ( isset( $_POST['access_users_approved'] ) && is_array( $_POST['access_users_approved'] ) ) {
6261		- $access_users_approved = $this->sanitize_update_auth_users( wp_unslash( $_POST['access_users_approved'] ) );
	4869	+ if ( $_POST['setting'] === 'access_users_approved' ) {
	4870	+ // Initialize posted data if empty.
	4871	+ if ( ! ( array_key_exists( 'access_users_approved', $_POST ) && is_array( $_POST['access_users_approved'] ) ) ) {
	4872	+ $_POST['access_users_approved'] = array();
6262	4873	}
6263	4874
6264	4875	// Deal with each modified user (add, remove, or change_role).
6265		- foreach ( $access_users_approved as $approved_user ) {
6266		- // Skip blank entries.
6267		- if ( strlen( $approved_user['email'] ) < 1 ) {
6268		- continue;
6269		- }
	4876	+ foreach ( $_POST['access_users_approved'] as $approved_user ) {
6270	4877
6271	4878	// New user (create user, or add existing user to current site in multisite).
6272		- if ( 'add' === $approved_user['edit_action'] ) {
	4879	+ if ( $approved_user['edit_action'] === 'add' ) {
6273	4880	$new_user = get_user_by( 'email', $approved_user['email'] );
6274		- if ( false !== $new_user ) {
	4881	+ if ( $new_user !== false ) {
6275	4882	// If we're adding an existing multisite user, make sure their
6276	4883	// newly-assigned role is updated on all sites they are already in.
6277		- if ( is_multisite() && 'false' !== $approved_user['multisite_user'] ) {
	4884	+ if ( is_multisite() && $approved_user['multisite_user'] !== 'false' ) {
6278	4885	foreach ( get_blogs_of_user( $new_user->ID ) as $blog ) {
6279	4886	add_user_to_blog( $blog->userblog_id, $new_user->ID, $approved_user['role'] );
6280	4887	}
6281	4888	}
		@@ -6282,9 +4889,9 @@
6282	4889	// If this user already has an account on another site in the network, add them to this site.
6283	4890	if ( is_multisite() ) {
6284	4891	add_user_to_blog( get_current_blog_id(), $new_user->ID, $approved_user['role'] );
6285	4892	}
6286		- } elseif ( $approved_user['local_user'] && 'false' !== $approved_user['local_user'] ) {
	4893	+ } elseif ( $approved_user['local_user'] === 'true' ) {
6287	4894	// Create a WP account for this new *local* user and email the password.
6288	4895	$plaintext_password = wp_generate_password(); // random password
6289	4896	// If there's already a user with this username (e.g.,
6290	4897	// johndoe/johndoe@gmail.com exists, and we're trying to add
		@@ -6292,26 +4899,26 @@
6292	4899	// as the username.
6293	4900	$username = explode( '@', $approved_user['email'] );
6294	4901	$username = $username[0];
6295	4902	if ( get_user_by( 'login', $username ) !== false ) {
6296		- $username = $this->lowercase( $approved_user['email'] );
	4903	+ $username = mb_strtolower( $approved_user['email'] );
6297	4904	}
6298		- if ( 'false' !== $approved_user['multisite_user'] ) {
	4905	+ if ( $approved_user['multisite_user'] !== 'false' ) {
6299	4906	$result = wpmu_create_user(
6300	4907	strtolower( $username ),
6301	4908	$plaintext_password,
6302		- $this->lowercase( $approved_user['email'] )
	4909	+ mb_strtolower( $approved_user['email'] )
6303	4910	);
6304	4911	} else {
6305	4912	$result = wp_insert_user(
6306	4913	array(
6307		- 'user_login' => strtolower( $username ),
6308		- 'user_pass' => $plaintext_password,
6309		- 'first_name' => '',
6310		- 'last_name' => '',
6311		- 'user_email' => $this->lowercase( $approved_user['email'] ),
	4914	+ 'user_login' => strtolower( $username ),
	4915	+ 'user_pass' => $plaintext_password,
	4916	+ 'first_name' => '',
	4917	+ 'last_name' => '',
	4918	+ 'user_email' => mb_strtolower( $approved_user['email'] ),
6312	4919	'user_registered' => date( 'Y-m-d H:i:s' ),
6313		- 'role' => $approved_user['role'],
	4920	+ 'role' => $approved_user['role'],
6314	4921	)
6315	4922	);
6316	4923	}
6317	4924	if ( ! is_wp_error( $result ) ) {
		@@ -6317,8 +4924,9 @@
6317	4924	if ( ! is_wp_error( $result ) ) {
6318	4925	// Email login credentials to new user.
6319	4926	wp_new_user_notification( $result, null, 'both' );
6320	4927	}
	4928	+
6321	4929	}
6322	4930
6323	4931	// Email new user welcome message if plugin option is set.
6324	4932	$this->maybe_email_welcome_message( $approved_user['email'] );
		@@ -6324,46 +4932,41 @@
6324	4932	$this->maybe_email_welcome_message( $approved_user['email'] );
6325	4933
6326	4934	// Add new user to approved list and save (skip if it's
6327	4935	// already there--someone else might have just done it).
6328		- if ( 'false' !== $approved_user['multisite_user'] ) {
	4936	+ if ( $approved_user['multisite_user'] !== 'false' ) {
6329	4937	if ( ! $this->is_email_in_list( $approved_user['email'], 'approved', 'multisite' ) ) {
6330	4938	$auth_multisite_settings_access_users_approved = $this->sanitize_user_list(
6331		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT )
	4939	+ $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN )
6332	4940	);
6333		- $approved_user['date_added'] = date( 'M Y' );
	4941	+ $approved_user['date_added'] = date( 'M Y' );
6334	4942	array_push( $auth_multisite_settings_access_users_approved, $approved_user );
6335		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
6336		- } else {
6337		- $invalid_emails[] = $approved_user['email'];
	4943	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
6338	4944	}
6339	4945	} else {
6340	4946	if ( ! $this->is_email_in_list( $approved_user['email'], 'approved' ) ) {
6341	4947	$auth_settings_access_users_approved = $this->sanitize_user_list(
6342		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT )
	4948	+ $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN )
6343	4949	);
6344		- $approved_user['date_added'] = date( 'M Y' );
	4950	+ $approved_user['date_added'] = date( 'M Y' );
6345	4951	array_push( $auth_settings_access_users_approved, $approved_user );
6346	4952	update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved );
6347		- } else {
6348		- $invalid_emails[] = $approved_user['email'];
6349	4953	}
6350	4954	}
6351	4955
6352	4956	// If we've added a new multisite user, go through all pending/approved/blocked lists
6353	4957	// on individual sites and remove this user from them (to prevent duplicate entries).
6354		- if ( 'false' !== $approved_user['multisite_user'] && is_multisite() ) {
	4958	+ if ( $approved_user['multisite_user'] !== 'false' && is_multisite() ) {
6355	4959	$list_names = array( 'access_users_pending', 'access_users_approved', 'access_users_blocked' );
6356		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
6357	4960	$sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
6358	4961	foreach ( $sites as $site ) {
6359	4962	$blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
6360	4963	foreach ( $list_names as $list_name ) {
6361		- $user_list = get_blog_option( $blog_id, 'auth_settings_' . $list_name, array() );
	4964	+ $user_list = get_blog_option( $blog_id, 'auth_settings_' . $list_name, array() );
6362	4965	$list_changed = false;
6363	4966	foreach ( $user_list as $key => $user ) {
6364	4967	if ( 0 === strcasecmp( $user['email'], $approved_user['email'] ) ) {
6365		- unset( $user_list[ $key ] );
	4968	+ unset( $user_list[$key] );
6366	4969	$list_changed = true;
6367	4970	}
6368	4971	}
6369	4972	if ( $list_changed ) {
		@@ -6371,19 +4974,21 @@
6371	4974	}
6372	4975	}
6373	4976	}
6374	4977	}
6375		- } elseif ( 'remove' === $approved_user['edit_action'] ) { // Remove user from approved list and save (also remove their role if they have a WordPress account).
6376		- if ( 'false' !== $approved_user['multisite_user'] ) {
	4978	+
	4979	+ // Remove user from approved list and save (also remove their role if they have a WordPress account)
	4980	+ } elseif ( $approved_user['edit_action'] === 'remove' ) {
	4981	+ if ( $approved_user['multisite_user'] !== 'false' ) {
6377	4982	if ( $this->is_email_in_list( $approved_user['email'], 'approved', 'multisite' ) ) {
6378	4983	$auth_multisite_settings_access_users_approved = $this->sanitize_user_list(
6379		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT )
	4984	+ $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN )
6380	4985	);
6381	4986	foreach ( $auth_multisite_settings_access_users_approved as $key => $existing_user ) {
6382	4987	if ( 0 === strcasecmp( $approved_user['email'], $existing_user['email'] ) ) {
6383	4988	// Remove role of the associated WordPress user from all blogs (but don't delete the user).
6384	4989	$user = get_user_by( 'email', $approved_user['email'] );
6385		- if ( false !== $user ) {
	4990	+ if ( $user !== false ) {
6386	4991	// Loop through all of the blogs this user is a member of and remove their capabilities.
6387	4992	foreach ( get_blogs_of_user( $user->ID ) as $blog ) {
6388	4993	remove_user_from_blog( $user->ID, $blog->userblog_id, '' );
6389	4994	}
		@@ -6388,28 +4993,28 @@
6388	4993	remove_user_from_blog( $user->ID, $blog->userblog_id, '' );
6389	4994	}
6390	4995	}
6391	4996	// Remove entry from Approved Users list.
6392		- unset( $auth_multisite_settings_access_users_approved[ $key ] );
	4997	+ unset( $auth_multisite_settings_access_users_approved[$key] );
6393	4998	break;
6394	4999	}
6395	5000	}
6396		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
	5001	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
6397	5002	}
6398	5003	} else {
6399	5004	if ( $this->is_email_in_list( $approved_user['email'], 'approved' ) ) {
6400	5005	$auth_settings_access_users_approved = $this->sanitize_user_list(
6401		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT )
	5006	+ $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN )
6402	5007	);
6403	5008	foreach ( $auth_settings_access_users_approved as $key => $existing_user ) {
6404	5009	if ( 0 === strcasecmp( $approved_user['email'], $existing_user['email'] ) ) {
6405	5010	// Remove role of the associated WordPress user (but don't delete the user).
6406	5011	$user = get_user_by( 'email', $approved_user['email'] );
6407		- if ( false !== $user ) {
	5012	+ if ( $user !== false ) {
6408	5013	$user->set_role( '' );
6409	5014	}
6410	5015	// Remove entry from Approved Users list.
6411		- unset( $auth_settings_access_users_approved[ $key ] );
	5016	+ unset( $auth_settings_access_users_approved[$key] );
6412	5017	break;
6413	5018	}
6414	5019	}
6415	5020	update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved );
		@@ -6414,12 +5019,14 @@
6414	5019	}
6415	5020	update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved );
6416	5021	}
6417	5022	}
6418		- } elseif ( 'change_role' === $approved_user['edit_action'] ) { // Update user's role in WordPress.
	5023	+
	5024	+ // Update user's role in WordPress
	5025	+ } elseif ( $approved_user['edit_action'] === 'change_role' ) {
6419	5026	$changed_user = get_user_by( 'email', $approved_user['email'] );
6420	5027	if ( $changed_user ) {
6421		- if ( is_multisite() && 'false' !== $approved_user['multisite_user'] ) {
	5028	+ if ( is_multisite() && $approved_user['multisite_user'] !== 'false' ) {
6422	5029	foreach ( get_blogs_of_user( $changed_user->ID ) as $blog ) {
6423	5030	add_user_to_blog( $blog->userblog_id, $changed_user->ID, $approved_user['role'] );
6424	5031	}
6425	5032	} else {
		@@ -6426,30 +5033,30 @@
6426	5033	$changed_user->set_role( $approved_user['role'] );
6427	5034	}
6428	5035	}
6429	5036
6430		- if ( 'false' !== $approved_user['multisite_user'] ) {
	5037	+ if ( $approved_user['multisite_user'] !== 'false' ) {
6431	5038	if ( $this->is_email_in_list( $approved_user['email'], 'approved', 'multisite' ) ) {
6432	5039	$auth_multisite_settings_access_users_approved = $this->sanitize_user_list(
6433		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT )
	5040	+ $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN )
6434	5041	);
6435	5042	foreach ( $auth_multisite_settings_access_users_approved as $key => $existing_user ) {
6436	5043	if ( 0 === strcasecmp( $approved_user['email'], $existing_user['email'] ) ) {
6437		- $auth_multisite_settings_access_users_approved[ $key ]['role'] = $approved_user['role'];
	5044	+ $auth_multisite_settings_access_users_approved[$key]['role'] = $approved_user['role'];
6438	5045	break;
6439	5046	}
6440	5047	}
6441		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
	5048	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
6442	5049	}
6443	5050	} else {
6444	5051	// Update user's role in approved list and save.
6445	5052	if ( $this->is_email_in_list( $approved_user['email'], 'approved' ) ) {
6446	5053	$auth_settings_access_users_approved = $this->sanitize_user_list(
6447		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT )
	5054	+ $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN )
6448	5055	);
6449	5056	foreach ( $auth_settings_access_users_approved as $key => $existing_user ) {
6450		- if ( 0 === strcasecmp( $approved_user['email'], $existing_user['email'] ) ) {
6451		- $auth_settings_access_users_approved[ $key ]['role'] = $approved_user['role'];
	5057	+ if ( 0 === strcasecmp( $approved_user['email'], $existing_user['email'] ) ) {
	5058	+ $auth_settings_access_users_approved[$key]['role'] = $approved_user['role'];
6452	5059	break;
6453	5060	}
6454	5061	}
6455	5062	update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved );
		@@ -6454,28 +5061,28 @@
6454	5061	}
6455	5062	update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved );
6456	5063	}
6457	5064	}
	5065	+
6458	5066	}
6459	5067	}
6460	5068	}
6461	5069
6462	5070	// Editing a blocked list entry.
6463		- if ( 'access_users_blocked' === $_POST['setting'] ) {
6464		- // Sanitize post data.
6465		- $access_users_blocked = array();
6466		- if ( isset( $_POST['access_users_blocked'] ) && is_array( $_POST['access_users_blocked'] ) ) {
6467		- $access_users_blocked = $this->sanitize_update_auth_users( wp_unslash( $_POST['access_users_blocked'] ) );
	5071	+ if ( $_POST['setting'] === 'access_users_blocked' ) {
	5072	+ // Initialize posted data if empty.
	5073	+ if ( ! ( array_key_exists( 'access_users_blocked', $_POST ) && is_array( $_POST['access_users_blocked'] ) ) ) {
	5074	+ $_POST['access_users_blocked'] = array();
6468	5075	}
6469	5076
6470	5077	// Deal with each modified user (add or remove).
6471		- foreach ( $access_users_blocked as $blocked_user ) {
	5078	+ foreach ( $_POST['access_users_blocked'] as $blocked_user ) {
6472	5079
6473		- if ( 'add' === $blocked_user['edit_action'] ) {
	5080	+ if ( $blocked_user['edit_action'] === 'add' ) {
6474	5081
6475	5082	// Add auth_blocked usermeta for the user.
6476	5083	$blocked_wp_user = get_user_by( 'email', $blocked_user['email'] );
6477		- if ( false !== $blocked_wp_user ) {
	5084	+ if ( $blocked_wp_user !== false ) {
6478	5085	update_user_meta( $blocked_wp_user->ID, 'auth_blocked', 'yes' );
6479	5086	}
6480	5087
6481	5088	// Add new user to blocked list and save (skip if it's
		@@ -6481,113 +5088,48 @@
6481	5088	// Add new user to blocked list and save (skip if it's
6482	5089	// already there--someone else might have just done it).
6483	5090	if ( ! $this->is_email_in_list( $blocked_user['email'], 'blocked' ) ) {
6484	5091	$auth_settings_access_users_blocked = $this->sanitize_user_list(
6485		- $this->get_plugin_option( 'access_users_blocked', WP_Plugin_Authorizer::SINGLE_CONTEXT )
	5092	+ $this->get_plugin_option( 'access_users_blocked', SINGLE_ADMIN )
6486	5093	);
6487		- $blocked_user['date_added'] = date( 'M Y' );
	5094	+ $blocked_user['date_added'] = date( 'M Y' );
6488	5095	array_push( $auth_settings_access_users_blocked, $blocked_user );
6489	5096	update_option( 'auth_settings_access_users_blocked', $auth_settings_access_users_blocked );
6490		- } else {
6491		- $invalid_emails[] = $blocked_user['email'];
6492	5097	}
6493		- } elseif ( 'remove' === $blocked_user['edit_action'] ) {
6494	5098
	5099	+ } elseif ( $blocked_user['edit_action'] === 'remove' ) {
	5100	+
6495	5101	// Remove auth_blocked usermeta for the user.
6496	5102	$unblocked_user = get_user_by( 'email', $blocked_user['email'] );
6497		- if ( false !== $unblocked_user ) {
	5103	+ if ( $unblocked_user !== false ) {
6498	5104	delete_user_meta( $unblocked_user->ID, 'auth_blocked', 'yes' );
6499	5105	}
6500	5106
6501		- // Remove user from blocked list and save.
	5107	+ // Remove user from blocked list and save
6502	5108	if ( $this->is_email_in_list( $blocked_user['email'], 'blocked' ) ) {
6503	5109	$auth_settings_access_users_blocked = $this->sanitize_user_list(
6504		- $this->get_plugin_option( 'access_users_blocked', WP_Plugin_Authorizer::SINGLE_CONTEXT )
	5110	+ $this->get_plugin_option( 'access_users_blocked', SINGLE_ADMIN )
6505	5111	);
6506	5112	foreach ( $auth_settings_access_users_blocked as $key => $existing_user ) {
6507	5113	if ( 0 === strcasecmp( $blocked_user['email'], $existing_user['email'] ) ) {
6508		- unset( $auth_settings_access_users_blocked[ $key ] );
	5114	+ unset( $auth_settings_access_users_blocked[$key] );
6509	5115	break;
6510	5116	}
6511	5117	}
6512	5118	update_option( 'auth_settings_access_users_blocked', $auth_settings_access_users_blocked );
6513	5119	}
	5120	+
6514	5121	}
6515	5122	}
6516	5123	}
6517	5124
6518		- // Send response to client.
6519		- $response = array(
6520		- 'success' => true,
6521		- 'invalid_emails' => $invalid_emails,
6522		- );
6523		- header( 'content-type: application/json' );
6524		- echo wp_json_encode( $response );
6525		- exit;
	5125	+ // Return 'success' value to AJAX call.
	5126	+ die( 'success' );
6526	5127	}
6527	5128
6528	5129
6529		- /**
6530		- * Sanitizes an array of user update commands coming from the AJAX handler in Authorizer Settings.
6531		- *
6532		- * Example $users array:
6533		- * array(
6534		- * array(
6535		- * edit_action: 'add' or 'remove' or 'change_role',
6536		- * email: 'johndoe@example.com',
6537		- * role: 'subscriber',
6538		- * date_added: 'Jun 2014',
6539		- * local_user: 'true' or 'false',
6540		- * multisite_user: 'true' or 'false',
6541		- * ),
6542		- * ...
6543		- * )
6544		- *
6545		- * @param array $users Users to edit.
6546		- * @return array Sanitized users to edit.
6547		- */
6548		- private function sanitize_update_auth_users( $users = array() ) {
6549		- if ( ! is_array( $users ) ) {
6550		- $users = array();
6551		- }
6552		- $users = array_map( array( $this, 'sanitize_update_auth_user' ), $users );
6553	5130
6554		- return $users;
6555		- }
6556		-
6557		-
6558	5131	/**
6559		- * Callback for array_map in sanitize_update_auth_users().
6560		- *
6561		- * @param array $user User data to sanitize.
6562		- * @return array Sanitized user data.
6563		- */
6564		- private function sanitize_update_auth_user( $user ) {
6565		- if ( array_key_exists( 'edit_action', $user ) ) {
6566		- $user['edit_action'] = sanitize_text_field( $user['edit_action'] );
6567		- }
6568		- if ( isset( $user['email'] ) ) {
6569		- $user['email'] = sanitize_email( $user['email'] );
6570		- }
6571		- if ( isset( $user['role'] ) ) {
6572		- $user['role'] = sanitize_text_field( $user['role'] );
6573		- }
6574		- if ( isset( $user['date_added'] ) ) {
6575		- $user['date_added'] = sanitize_text_field( $user['date_added'] );
6576		- }
6577		- if ( isset( $user['local_user'] ) ) {
6578		- $user['local_user'] = 'true' === $user['local_user'] ? 'true' : 'false';
6579		- }
6580		- if ( isset( $user['multisite_user'] ) ) {
6581		- $user['multisite_user'] = 'true' === $user['multisite_user'] ? 'true' : 'false';
6582		- }
6583		-
6584		- return $user;
6585		- }
6586		-
6587		-
6588		-
6589		- /**
6590	5132	* ***************************
6591	5133	* Helper functions
6592	5134	* ***************************
6593	5135	*/
		@@ -6595,20 +5137,20 @@
6595	5137
6596	5138	/**
6597	5139	* Retrieves a specific plugin option from db. Multisite enabled.
6598	5140	*
6599		- * @param string $option Option name.
6600		- * @param string $admin_mode WP_Plugin_Authorizer::NETWORK_CONTEXT will retrieve the multisite value.
6601		- * @param string $override_mode 'allow override' will retrieve the multisite value if it exists.
6602		- * @param string $print_mode 'print overlay' will output overlay that hides this option on the settings page.
6603		- * @return mixed Option value, or null on failure.
	5141	+ * @param string $option Option name
	5142	+ * @param string $admin_mode MULTISITE_ADMIN will retrieve the multisite value
	5143	+ * @param string $override_mode 'allow override' will retrieve the multisite value if it exists
	5144	+ * @param string $print_mode 'print overlay' will output overlay that hides this option on the settings page
	5145	+ * @return mixed Option value, or null on failure
6604	5146	*/
6605		- private function get_plugin_option( $option, $admin_mode = WP_Plugin_Authorizer::SINGLE_CONTEXT, $override_mode = 'no override', $print_mode = 'no overlay' ) {
	5147	+ private function get_plugin_option( $option, $admin_mode = SINGLE_ADMIN, $override_mode = 'no override', $print_mode = 'no overlay' ) {
6606	5148	// Special case for user lists (they are saved seperately to prevent concurrency issues).
6607		- if ( in_array( $option, array( 'access_users_pending', 'access_users_approved', 'access_users_blocked' ), true ) ) {
6608		- $list = WP_Plugin_Authorizer::NETWORK_CONTEXT === $admin_mode ? array() : get_option( 'auth_settings_' . $option );
6609		- if ( is_multisite() && WP_Plugin_Authorizer::NETWORK_CONTEXT === $admin_mode ) {
6610		- $list = get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_' . $option, array() );
	5149	+ if ( in_array( $option, array( 'access_users_pending', 'access_users_approved', 'access_users_blocked' ) ) ) {
	5150	+ $list = $admin_mode === MULTISITE_ADMIN ? array() : get_option( 'auth_settings_' . $option );
	5151	+ if ( is_multisite() && $admin_mode === MULTISITE_ADMIN ) {
	5152	+ $list = get_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_' . $option, array() );
6611	5153	}
6612	5154	return $list;
6613	5155	}
6614	5156
		@@ -6622,26 +5164,24 @@
6622	5164
6623	5165	// If requested and appropriate, print the overlay hiding the
6624	5166	// single site option that is overridden by a multisite option.
6625	5167	if (
6626		- WP_Plugin_Authorizer::NETWORK_CONTEXT !== $admin_mode &&
6627		- 'allow override' === $override_mode &&
6628		- 'print overlay' === $print_mode &&
	5168	+ $admin_mode !== MULTISITE_ADMIN &&
	5169	+ $override_mode === 'allow override' &&
	5170	+ $print_mode === 'print overlay' &&
6629	5171	array_key_exists( 'multisite_override', $auth_settings ) &&
6630		- '1' === $auth_settings['multisite_override'] &&
6631		- ( ! array_key_exists( 'advanced_override_multisite', $auth_settings ) || 1 !== intval( $auth_settings['advanced_override_multisite'] ) )
	5172	+ $auth_settings['multisite_override'] === '1' &&
	5173	+ ( ! array_key_exists( 'advanced_override_multisite', $auth_settings ) || $auth_settings['advanced_override_multisite'] != '1' )
6632	5174	) {
6633	5175	// Get original plugin options (not overridden value). We'll
6634	5176	// show this old value behind the disabled overlay.
6635		- // $auth_settings = $this->get_plugin_options( $admin_mode, 'no override' );
6636		- // (This feature is disabled).
6637		- //
	5177	+ $auth_settings = $this->get_plugin_options( $admin_mode, 'no override' );
	5178	+
6638	5179	$name = "auth_settings[$option]";
6639		- $id = "auth_settings_$option";
6640		- ?>
6641		- <div id="overlay-hide-auth_settings_<?php echo esc_attr( $option ); ?>" class="auth_multisite_override_overlay">
	5180	+ $id = "auth_settings_$option"; ?>
	5181	+ <div id="overlay-hide-auth_settings_<?php echo $option; ?>" class="auth_multisite_override_overlay">
6642	5182	<span class="overlay-note">
6643		- <?php esc_html_e( 'This setting is overridden by a', 'authorizer' ); ?> <a href="<?php echo esc_attr( network_admin_url( 'admin.php?page=authorizer' ) ); ?>"><?php esc_html_e( 'multisite option', 'authorizer' ); ?></a>.
	5183	+ <?php _e( 'This setting is overridden by a', 'authorizer' ); ?> <a href="<?php echo network_admin_url( 'admin.php?page=authorizer&tab=external' ); ?>"><?php _e( 'multisite option', 'authorizer' ); ?></a>.
6644	5184	</span>
6645	5185	</div>
6646	5186	<?php
6647	5187	}
		@@ -6647,9 +5187,9 @@
6647	5187	}
6648	5188
6649	5189	// If we're getting an option in a site that has overridden the multisite override, make
6650	5190	// sure we are returning the option value from that site (not the multisite value).
6651		- if ( array_key_exists( 'advanced_override_multisite', $auth_settings ) && 1 === intval( $auth_settings['advanced_override_multisite'] ) ) {
	5191	+ if ( array_key_exists( 'advanced_override_multisite', $auth_settings ) && $auth_settings['advanced_override_multisite'] == '1' ) {
6652	5192	$auth_settings = $this->get_plugin_options( $admin_mode, 'no override' );
6653	5193	}
6654	5194
6655	5195	// Set option to null if it wasn't found.
		@@ -6656,115 +5196,98 @@
6656	5196	if ( ! array_key_exists( $option, $auth_settings ) ) {
6657	5197	return null;
6658	5198	}
6659	5199
6660		- return $auth_settings[ $option ];
	5200	+ return $auth_settings[$option];
6661	5201	}
6662	5202
6663	5203	/**
6664	5204	* Retrieves all plugin options from db. Multisite enabled.
6665	5205	*
6666		- * @param string $admin_mode WP_Plugin_Authorizer::NETWORK_CONTEXT will retrieve the multisite value.
6667		- * @param string $override_mode 'allow override' will retrieve the multisite value if it exists.
6668		- * @return mixed Option value, or null on failure.
	5206	+ * @param string $admin_mode MULTISITE_ADMIN will retrieve the multisite value
	5207	+ * @param string $override_mode 'allow override' will retrieve the multisite value if it exists
	5208	+ * @return mixed Option value, or null on failure
6669	5209	*/
6670		- private function get_plugin_options( $admin_mode = WP_Plugin_Authorizer::SINGLE_CONTEXT, $override_mode = 'no override' ) {
6671		- // Grab plugin settings (skip if in WP_Plugin_Authorizer::NETWORK_CONTEXT mode).
6672		- $auth_settings = WP_Plugin_Authorizer::NETWORK_CONTEXT === $admin_mode ? array() : get_option( 'auth_settings' );
	5210	+ private function get_plugin_options( $admin_mode = SINGLE_ADMIN, $override_mode = 'no override' ) {
	5211	+ // Grab plugin settings (skip if in MULTISITE_ADMIN mode).
	5212	+ $auth_settings = $admin_mode === MULTISITE_ADMIN ? array() : get_option( 'auth_settings' );
6673	5213
6674	5214	// Initialize to default values if the plugin option doesn't exist.
6675		- if ( false === $auth_settings ) {
	5215	+ if ( $auth_settings === FALSE ) {
6676	5216	$auth_settings = $this->set_default_options();
6677	5217	}
6678	5218
6679	5219	// Merge multisite options if we're in a network and the current site hasn't overridden multisite settings.
6680		- if ( is_multisite() && ( ! array_key_exists( 'advanced_override_multisite', $auth_settings ) || 1 !== intval( $auth_settings['advanced_override_multisite'] ) ) ) {
	5220	+ if ( is_multisite() && ( ! array_key_exists( 'advanced_override_multisite', $auth_settings ) || $auth_settings['advanced_override_multisite'] != '1' ) ) {
6681	5221	// Get multisite options.
6682		- $auth_multisite_settings = get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings', array() );
	5222	+ $auth_multisite_settings = get_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings', array() );
6683	5223
6684	5224	// Return the multisite options if we're viewing the network admin options page.
6685	5225	// Otherwise override options with their multisite equivalents.
6686		- if ( WP_Plugin_Authorizer::NETWORK_CONTEXT === $admin_mode ) {
	5226	+ if ( $admin_mode === MULTISITE_ADMIN ) {
6687	5227	$auth_settings = $auth_multisite_settings;
6688	5228	} elseif (
6689		- 'allow override' === $override_mode &&
	5229	+ $override_mode === 'allow override' &&
6690	5230	array_key_exists( 'multisite_override', $auth_multisite_settings ) &&
6691		- '1' === $auth_multisite_settings['multisite_override']
	5231	+ $auth_multisite_settings['multisite_override'] === '1'
6692	5232	) {
6693	5233	// Keep track of the multisite override selection.
6694	5234	$auth_settings['multisite_override'] = $auth_multisite_settings['multisite_override'];
6695	5235
6696		- /**
6697		- * Note: the options below should be the complete list of overridden
6698		- * options. It is *not* the complete list of all options (some options
6699		- * don't have a multisite equivalent).
6700		- */
	5236	+ // Note: the options below should be the complete list of
	5237	+ // overridden options. It is *not* the complete list of all
	5238	+ // options (some options don't have a multisite equivalent)
6701	5239
6702		- /**
6703		- * Note: access_users_approved, access_users_pending, and
6704		- * access_users_blocked do not get overridden. However, since
6705		- * access_users_approved has a multisite equivalent, you must retrieve
6706		- * them both seperately. This is done because the two lists should be
6707		- * treated differently.
6708		- *
6709		- * $approved_users = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT );
6710		- * $ms_approved_users = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT );
6711		- */
	5240	+ // Note: access_users_approved, access_users_pending, and
	5241	+ // access_users_blocked do not get overridden. However,
	5242	+ // since access_users_approved has a multisite equivalent,
	5243	+ // you must retrieve them both seperately. This is done
	5244	+ // because the two lists should be treated differently.
	5245	+ // $approved_users = $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN );
	5246	+ // $ms_approved_users = $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN );
6712	5247
6713		- // Override external services (google, cas, or ldap) and associated options.
6714		- $auth_settings['google'] = $auth_multisite_settings['google'];
6715		- $auth_settings['google_clientid'] = $auth_multisite_settings['google_clientid'];
6716		- $auth_settings['google_clientsecret'] = $auth_multisite_settings['google_clientsecret'];
6717		- $auth_settings['google_hosteddomain'] = $auth_multisite_settings['google_hosteddomain'];
6718		- $auth_settings['cas'] = $auth_multisite_settings['cas'];
6719		- $auth_settings['cas_custom_label'] = $auth_multisite_settings['cas_custom_label'];
6720		- $auth_settings['cas_host'] = $auth_multisite_settings['cas_host'];
6721		- $auth_settings['cas_port'] = $auth_multisite_settings['cas_port'];
6722		- $auth_settings['cas_path'] = $auth_multisite_settings['cas_path'];
6723		- $auth_settings['cas_version'] = $auth_multisite_settings['cas_version'];
6724		- $auth_settings['cas_attr_email'] = $auth_multisite_settings['cas_attr_email'];
6725		- $auth_settings['cas_attr_first_name'] = $auth_multisite_settings['cas_attr_first_name'];
6726		- $auth_settings['cas_attr_last_name'] = $auth_multisite_settings['cas_attr_last_name'];
6727		- $auth_settings['cas_attr_update_on_login'] = $auth_multisite_settings['cas_attr_update_on_login'];
6728		- $auth_settings['cas_auto_login'] = $auth_multisite_settings['cas_auto_login'];
6729		- $auth_settings['ldap'] = $auth_multisite_settings['ldap'];
6730		- $auth_settings['ldap_host'] = $auth_multisite_settings['ldap_host'];
6731		- $auth_settings['ldap_port'] = $auth_multisite_settings['ldap_port'];
6732		- $auth_settings['ldap_tls'] = $auth_multisite_settings['ldap_tls'];
6733		- $auth_settings['ldap_search_base'] = $auth_multisite_settings['ldap_search_base'];
6734		- $auth_settings['ldap_uid'] = $auth_multisite_settings['ldap_uid'];
6735		- $auth_settings['ldap_attr_email'] = $auth_multisite_settings['ldap_attr_email'];
6736		- $auth_settings['ldap_user'] = $auth_multisite_settings['ldap_user'];
6737		- $auth_settings['ldap_password'] = $auth_multisite_settings['ldap_password'];
6738		- $auth_settings['ldap_lostpassword_url'] = $auth_multisite_settings['ldap_lostpassword_url'];
6739		- $auth_settings['ldap_attr_first_name'] = $auth_multisite_settings['ldap_attr_first_name'];
6740		- $auth_settings['ldap_attr_last_name'] = $auth_multisite_settings['ldap_attr_last_name'];
	5248	+ // Override external services (google, cas, or ldap) and associated options
	5249	+ $auth_settings['google'] = $auth_multisite_settings['google'];
	5250	+ $auth_settings['google_clientid'] = $auth_multisite_settings['google_clientid'];
	5251	+ $auth_settings['google_clientsecret'] = $auth_multisite_settings['google_clientsecret'];
	5252	+ $auth_settings['google_hosteddomain'] = $auth_multisite_settings['google_hosteddomain'];
	5253	+ $auth_settings['cas'] = $auth_multisite_settings['cas'];
	5254	+ $auth_settings['cas_custom_label'] = $auth_multisite_settings['cas_custom_label'];
	5255	+ $auth_settings['cas_host'] = $auth_multisite_settings['cas_host'];
	5256	+ $auth_settings['cas_port'] = $auth_multisite_settings['cas_port'];
	5257	+ $auth_settings['cas_path'] = $auth_multisite_settings['cas_path'];
	5258	+ $auth_settings['cas_version'] = $auth_multisite_settings['cas_version'];
	5259	+ $auth_settings['cas_attr_email'] = $auth_multisite_settings['cas_attr_email'];
	5260	+ $auth_settings['cas_attr_first_name'] = $auth_multisite_settings['cas_attr_first_name'];
	5261	+ $auth_settings['cas_attr_last_name'] = $auth_multisite_settings['cas_attr_last_name'];
	5262	+ $auth_settings['cas_attr_update_on_login'] = $auth_multisite_settings['cas_attr_update_on_login'];
	5263	+ $auth_settings['cas_auto_login'] = $auth_multisite_settings['cas_auto_login'];
	5264	+ $auth_settings['ldap'] = $auth_multisite_settings['ldap'];
	5265	+ $auth_settings['ldap_host'] = $auth_multisite_settings['ldap_host'];
	5266	+ $auth_settings['ldap_port'] = $auth_multisite_settings['ldap_port'];
	5267	+ $auth_settings['ldap_tls'] = $auth_multisite_settings['ldap_tls'];
	5268	+ $auth_settings['ldap_search_base'] = $auth_multisite_settings['ldap_search_base'];
	5269	+ $auth_settings['ldap_uid'] = $auth_multisite_settings['ldap_uid'];
	5270	+ $auth_settings['ldap_attr_email'] = $auth_multisite_settings['ldap_attr_email'];
	5271	+ $auth_settings['ldap_user'] = $auth_multisite_settings['ldap_user'];
	5272	+ $auth_settings['ldap_password'] = $auth_multisite_settings['ldap_password'];
	5273	+ $auth_settings['ldap_lostpassword_url'] = $auth_multisite_settings['ldap_lostpassword_url'];
	5274	+ $auth_settings['ldap_attr_first_name'] = $auth_multisite_settings['ldap_attr_first_name'];
	5275	+ $auth_settings['ldap_attr_last_name'] = $auth_multisite_settings['ldap_attr_last_name'];
6741	5276	$auth_settings['ldap_attr_update_on_login'] = $auth_multisite_settings['ldap_attr_update_on_login'];
6742	5277
6743		- // Override access_who_can_login and access_who_can_view.
	5278	+ // Override access_who_can_login and access_who_can_view
6744	5279	$auth_settings['access_who_can_login'] = $auth_multisite_settings['access_who_can_login'];
6745		- $auth_settings['access_who_can_view'] = $auth_multisite_settings['access_who_can_view'];
	5280	+ $auth_settings['access_who_can_view'] = $auth_multisite_settings['access_who_can_view'];
6746	5281
6747		- // Override access_default_role.
	5282	+ // Override access_default_role
6748	5283	$auth_settings['access_default_role'] = $auth_multisite_settings['access_default_role'];
6749	5284
6750		- // Override lockouts.
	5285	+ // Override lockouts
6751	5286	$auth_settings['advanced_lockouts'] = $auth_multisite_settings['advanced_lockouts'];
6752	5287
6753		- // Override Hide WordPress login.
	5288	+ // Override Hide WordPress login
6754	5289	$auth_settings['advanced_hide_wp_login'] = $auth_multisite_settings['advanced_hide_wp_login'];
6755		-
6756		- // Override Users per page.
6757		- $auth_settings['advanced_users_per_page'] = $auth_multisite_settings['advanced_users_per_page'];
6758		-
6759		- // Override Sort users by.
6760		- $auth_settings['advanced_users_sort_by'] = $auth_multisite_settings['advanced_users_sort_by'];
6761		-
6762		- // Override Sort users order.
6763		- $auth_settings['advanced_users_sort_order'] = $auth_multisite_settings['advanced_users_sort_order'];
6764		-
6765		- // Override Show Dashboard Widget.
6766		- $auth_settings['advanced_widget_enabled'] = $auth_multisite_settings['advanced_widget_enabled'];
6767	5290	}
6768	5291	}
6769	5292	return $auth_settings;
6770	5293	}
		@@ -6771,27 +5294,23 @@
6771	5294
6772	5295
6773	5296	/**
6774	5297	* Remove user from authorizer lists when that user is deleted in WordPress.
6775		- *
6776		- * Action: delete_user
6777		- *
6778		- * @param int $user_id User ID to remove.
6779		- * @return void
	5298	+ * Run on action hook: delete_user
6780	5299	*/
6781		- public function remove_user_from_authorizer_when_deleted( $user_id ) {
6782		- $user = get_user_by( 'id', $user_id );
	5300	+ function remove_user_from_authorizer_when_deleted( $user_id ) {
	5301	+ $user = get_user_by( 'id', $user_id );
6783	5302	$deleted_email = $user->user_email;
6784	5303
6785	5304	// Remove user from pending/approved lists and save.
6786	5305	$list_names = array( 'access_users_pending', 'access_users_approved' );
6787	5306	foreach ( $list_names as $list_name ) {
6788		- $user_list = $this->sanitize_user_list( $this->get_plugin_option( $list_name, WP_Plugin_Authorizer::SINGLE_CONTEXT ) );
	5307	+ $user_list = $this->sanitize_user_list( $this->get_plugin_option( $list_name, SINGLE_ADMIN ) );
6789	5308	$list_changed = false;
6790	5309	foreach ( $user_list as $key => $existing_user ) {
6791	5310	if ( 0 === strcasecmp( $deleted_email, $existing_user['email'] ) ) {
6792	5311	$list_changed = true;
6793		- unset( $user_list[ $key ] );
	5312	+ unset( $user_list[$key] );
6794	5313	}
6795	5314	}
6796	5315	if ( $list_changed ) {
6797	5316	update_option( 'auth_settings_' . $list_name, $user_list );
		@@ -6801,35 +5320,30 @@
6801	5320
6802	5321
6803	5322	/**
6804	5323	* Remove multisite user from authorizer lists when that user is deleted from Network Users.
6805		- *
6806		- * Action: wpmu_delete_user
6807		- *
6808		- * @param int $user_id User ID to remove.
6809		- * @return void
	5324	+ * Run on action hook: wpmu_delete_user
6810	5325	*/
6811		- public function remove_network_user_from_authorizer_when_deleted( $user_id ) {
6812		- $user = get_user_by( 'id', $user_id );
	5326	+ function remove_network_user_from_authorizer_when_deleted( $user_id ) {
	5327	+ $user = get_user_by( 'id', $user_id );
6813	5328	$deleted_email = $user->user_email;
6814	5329
6815	5330	// Go through multisite approved user list and remove this user.
6816	5331	$auth_multisite_settings_access_users_approved = $this->sanitize_user_list(
6817		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT )
	5332	+ $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN )
6818	5333	);
6819		- $list_changed = false;
	5334	+ $list_changed = false;
6820	5335	foreach ( $auth_multisite_settings_access_users_approved as $key => $existing_user ) {
6821	5336	if ( 0 === strcasecmp( $deleted_email, $existing_user['email'] ) ) {
6822	5337	$list_changed = true;
6823		- unset( $auth_multisite_settings_access_users_approved[ $key ] );
	5338	+ unset( $auth_multisite_settings_access_users_approved[$key] );
6824	5339	}
6825	5340	}
6826	5341	if ( $list_changed ) {
6827		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
	5342	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
6828	5343	}
6829	5344
6830	5345	// Go through all pending/approved lists on individual sites and remove this user from them.
6831		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
6832	5346	$sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
6833	5347	foreach ( $sites as $site ) {
6834	5348	$blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
6835	5349	$this->remove_network_user_from_site_when_removed( $user_id, $blog_id );
		@@ -6839,27 +5353,22 @@
6839	5353
6840	5354
6841	5355	/**
6842	5356	* Remove multisite user from a specific site's lists when that user is removed from the site.
6843		- *
6844		- * Action: remove_user_from_blog
6845		- *
6846		- * @param int $user_id User ID to remove.
6847		- * @param int $blog_id Blog ID to remove from.
6848		- * @return void
	5357	+ * Run on action hook: remove_user_from_blog
6849	5358	*/
6850		- public function remove_network_user_from_site_when_removed( $user_id, $blog_id ) {
6851		- $user = get_user_by( 'id', $user_id );
	5359	+ function remove_network_user_from_site_when_removed( $user_id, $blog_id ) {
	5360	+ $user = get_user_by( 'id', $user_id );
6852	5361	$deleted_email = $user->user_email;
6853	5362
6854	5363	$list_names = array( 'access_users_pending', 'access_users_approved' );
6855	5364	foreach ( $list_names as $list_name ) {
6856		- $user_list = get_blog_option( $blog_id, 'auth_settings_' . $list_name, array() );
	5365	+ $user_list = get_blog_option( $blog_id, 'auth_settings_' . $list_name, array() );
6857	5366	$list_changed = false;
6858	5367	foreach ( $user_list as $key => $existing_user ) {
6859	5368	if ( 0 === strcasecmp( $deleted_email, $existing_user['email'] ) ) {
6860	5369	$list_changed = true;
6861		- unset( $user_list[ $key ] );
	5370	+ unset( $user_list[$key] );
6862	5371	}
6863	5372	}
6864	5373	if ( $list_changed ) {
6865	5374	update_blog_option( $blog_id, 'auth_settings_' . $list_name, $user_list );
		@@ -6869,30 +5378,26 @@
6869	5378
6870	5379
6871	5380	/**
6872	5381	* Helper: Add multisite user to a specific site's approved list.
6873		- *
6874		- * @param int $user_id User ID to add.
6875		- * @param int $blog_id Blog ID to add to.
6876		- * @return void
6877	5382	*/
6878		- private function add_network_user_to_site( $user_id, $blog_id ) {
	5383	+ function add_network_user_to_site( $user_id, $blog_id ) {
6879	5384	// Switch to blog.
6880	5385	switch_to_blog( $blog_id );
6881	5386
6882	5387	// Get user details and role.
6883		- $access_default_role = $this->get_plugin_option( 'access_default_role', WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
6884		- $user = get_user_by( 'id', $user_id );
6885		- $user_email = $user->user_email;
6886		- $user_role = $user && is_array( $user->roles ) && count( $user->roles ) > 0 ? $user->roles[0] : $access_default_role;
	5388	+ $access_default_role = $this->get_plugin_option( 'access_default_role', SINGLE_ADMIN, 'allow override' );
	5389	+ $user = get_user_by( 'id', $user_id );
	5390	+ $user_email = $user->user_email;
	5391	+ $user_role = $user && is_array( $user->roles ) && count( $user->roles ) > 0 ? $user->roles[0] : $access_default_role;
6887	5392
6888	5393	// Add user to approved list if not already there and not in blocked list.
6889		- $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT );
6890		- $auth_settings_access_users_blocked = $this->get_plugin_option( 'access_users_blocked', WP_Plugin_Authorizer::SINGLE_CONTEXT );
	5394	+ $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN );
	5395	+ $auth_settings_access_users_blocked = $this->get_plugin_option( 'access_users_blocked', SINGLE_ADMIN );
6891	5396	if ( ! $this->in_multi_array( $user_email, $auth_settings_access_users_approved ) && ! $this->in_multi_array( $user_email, $auth_settings_access_users_blocked ) ) {
6892	5397	$approved_user = array(
6893		- 'email' => $this->lowercase( $user_email ),
6894		- 'role' => $user_role,
	5398	+ 'email' => mb_strtolower( $user_email ),
	5399	+ 'role' => $user_role,
6895	5400	'date_added' => date( 'M Y', strtotime( $user->user_registered ) ),
6896	5401	'local_user' => true,
6897	5402	);
6898	5403	array_push( $auth_settings_access_users_approved, $approved_user );
		@@ -6909,17 +5414,17 @@
6909	5414	* When an existing user is invited to the current site (or a new user is created),
6910	5415	* add them to the authorizer approved list. This action fires when the admin
6911	5416	* doesn't select the "Skip Confirmation Email" option.
6912	5417	*
6913		- * Action: invite_user
	5418	+ * @action invite_user
6914	5419	*
6915		- * @param int $user_id The invited user's ID.
6916		- * @param array $role The role of the invited user (or none if a new user creation).
	5420	+ * @param int $user_id The invited user's ID.
	5421	+ * @param array $role The role of the invited user (or none if a new user creation).
6917	5422	* @param string $newuser_key The key of the invitation.
6918	5423	*/
6919		- public function add_existing_user_to_authorizer_when_created( $user_id, $role = array(), $newuser_key = '' ) {
	5424	+ function add_existing_user_to_authorizer_when_created( $user_id, $role = array(), $newuser_key = '' ) {
6920	5425	$user = get_user_by( 'id', $user_id );
6921		- $this->add_user_to_authorizer_when_created( $user->user_email, $user->user_registered, $user->roles, $role );
	5426	+ $this->add_user_to_authorizer_when_created( $user->user_email, $user->user_registered, $user->user_roles, $role );
6922	5427	}
6923	5428
6924	5429
6925	5430	/**
		@@ -6927,16 +5432,16 @@
6927	5432	* When an existing user is invited to the current site (or a new user is created),
6928	5433	* add them to the authorizer approved list. This action fires when the admin
6929	5434	* selects the "Skip Confirmation Email" option.
6930	5435	*
6931		- * Action: added_existing_user
	5436	+ * @action added_existing_user
6932	5437	*
6933		- * @param int $user_id The invited user's ID.
6934		- * @param mixed $result True on success or a WP_Error object if the user doesn't exist.
	5438	+ * @param int $user_id The invited user's ID.
	5439	+ * @param mixed $result True on success or a WP_Error object if the user doesn't exist.
6935	5440	*/
6936		- public function add_existing_user_to_authorizer_when_created_noconfirmation( $user_id, $result ) {
	5441	+ function add_existing_user_to_authorizer_when_created_noconfirmation( $user_id, $result ) {
6937	5442	$user = get_user_by( 'id', $user_id );
6938		- $this->add_user_to_authorizer_when_created( $user->user_email, $user->user_registered, $user->roles );
	5443	+ $this->add_user_to_authorizer_when_created( $user->user_email, $user->user_registered, $user->user_roles );
6939	5444	}
6940	5445
6941	5446
6942	5447	/**
		@@ -6943,18 +5448,17 @@
6943	5448	* Multisite:
6944	5449	* When a new user is invited to the current site (or a new user is created),
6945	5450	* add them to the authorizer approved list.
6946	5451	*
6947		- * Action: after_signup_user
	5452	+ * @action after_signup_user
6948	5453	*
6949		- * @param string $user User's requested login name.
	5454	+ * @param string $user User's requested login name.
6950	5455	* @param string $user_email User's email address.
6951		- * @param string $key User's activation key.
6952		- * @param array $meta Additional signup meta, including initially set roles.
	5456	+ * @param string $key User's activation key.
	5457	+ * @param array $meta Additional signup meta.
6953	5458	*/
6954		- public function add_new_user_to_authorizer_when_created( $user, $user_email, $key, $meta ) {
6955		- $user_roles = isset( $meta['new_role'] ) ? array( $meta['new_role'] ) : array();
6956		- $this->add_user_to_authorizer_when_created( $user_email, time(), $user_roles );
	5459	+ function add_new_user_to_authorizer_when_created( $user, $user_email, $key, $meta ) {
	5460	+ $this->add_user_to_authorizer_when_created( $user_email, time() );
6957	5461	}
6958	5462
6959	5463
6960	5464	/**
		@@ -6961,18 +5465,17 @@
6961	5465	* Single site:
6962	5466	* When a new user is added in single site mode, add them to the authorizer
6963	5467	* approved list.
6964	5468	*
6965		- * Action: edit_user_created_user
	5469	+ * @action edit_user_created_user
6966	5470	*
6967		- * @param int $user_id ID of the newly created user.
6968		- * @param string $notify Type of notification that should happen. See
6969		- * wp_send_new_user_notifications() for more
6970		- * information on possible values.
	5471	+ * @param int $user_id ID of the newly created user.
	5472	+ * @param string $notify Type of notification that should happen. See wp_send_new_user_notifications()
	5473	+ * for more information on possible values.
6971	5474	*/
6972		- public function add_new_user_to_authorizer_when_created_single_site( $user_id, $notify ) {
	5475	+ function add_new_user_to_authorizer_when_created_single_site( $user_id, $notify ) {
6973	5476	$user = get_user_by( 'id', $user_id );
6974		- $this->add_user_to_authorizer_when_created( $user->user_email, $user->user_registered, $user->roles );
	5477	+ $this->add_user_to_authorizer_when_created( $user->user_email, $user->user_registered, $user->user_roles );
6975	5478	}
6976	5479
6977	5480
6978	5481	/**
		@@ -6977,36 +5480,20 @@
6977	5480
6978	5481	/**
6979	5482	* Helper: When a new user is added/invited to the current site (or a new
6980	5483	* user is created), add them to the authorizer approved list.
6981		- *
6982		- * @param string $user_email Email address of user to add.
6983		- * @param string $date_registered Date user registered.
6984		- * @param array $user_roles Role to add for user.
6985		- * @param array $default_role Default role, if no role specified.
6986	5484	*/
6987	5485	private function add_user_to_authorizer_when_created( $user_email, $date_registered, $user_roles = array(), $default_role = array() ) {
6988		- $auth_multisite_settings_access_users_approved = is_multisite() ? get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', array() ) : array();
6989		- $auth_settings_access_users_pending = $this->get_plugin_option( 'access_users_pending', WP_Plugin_Authorizer::SINGLE_CONTEXT );
6990		- $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT );
6991		- $auth_settings_access_users_blocked = $this->get_plugin_option( 'access_users_blocked', WP_Plugin_Authorizer::SINGLE_CONTEXT );
	5486	+ $auth_multisite_settings_access_users_approved = is_multisite() ? get_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', array() ) : array();
	5487	+ $auth_settings_access_users_pending = $this->get_plugin_option( 'access_users_pending', SINGLE_ADMIN );
	5488	+ $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN );
	5489	+ $auth_settings_access_users_blocked = $this->get_plugin_option( 'access_users_blocked', SINGLE_ADMIN );
6992	5490
6993	5491	// Get default role if one isn't specified.
6994	5492	if ( count( $default_role ) < 1 ) {
6995	5493	$default_role = '';
6996	5494	} else {
6997		- // If default role was provided, it came from the invite_user hook, and
6998		- // only contains the role's display name. Here we look up the actual role
6999		- // name to save (and default to no role if the display name isn't found).
7000		- global $wp_roles;
7001		- $default_role_display_name = $default_role['name'];
7002		- $default_role = '';
7003		- foreach ( $wp_roles->role_names as $role_name => $display_name ) {
7004		- if ( $default_role_display_name === $display_name ) {
7005		- $default_role = $role_name;
7006		- break;
7007		- }
7008		- }
	5495	+ $default_role = strtolower( $default_role['name'] );
7009	5496	}
7010	5497
7011	5498	$updated = false;
7012	5499
		@@ -7016,9 +5503,9 @@
7016	5503	}
7017	5504	// Remove from pending list if there.
7018	5505	foreach ( $auth_settings_access_users_pending as $key => $pending_user ) {
7019	5506	if ( 0 === strcasecmp( $pending_user['email'], $user_email ) ) {
7020		- unset( $auth_settings_access_users_pending[ $key ] );
	5507	+ unset( $auth_settings_access_users_pending[$key] );
7021	5508	$updated = true;
7022	5509	}
7023	5510	}
7024	5511	// Skip if user is in multisite approved list.
		@@ -7027,10 +5514,10 @@
7027	5514	}
7028	5515	// Add to approved list if not there.
7029	5516	if ( ! $this->in_multi_array( $user_email, $auth_settings_access_users_approved ) ) {
7030	5517	$approved_user = array(
7031		- 'email' => $this->lowercase( $user_email ),
7032		- 'role' => is_array( $user_roles ) && count( $user_roles ) > 0 ? $user_roles[0] : $default_role,
	5518	+ 'email' => mb_strtolower( $user_email ),
	5519	+ 'role' => is_array( $user_roles ) && count( $user_roles ) > 0 ? $user_roles[0] : $default_role,
7033	5520	'date_added' => date( 'M Y', strtotime( $date_registered ) ),
7034	5521	'local_user' => true,
7035	5522	);
7036	5523	array_push( $auth_settings_access_users_approved, $approved_user );
		@@ -7049,33 +5536,32 @@
7049	5536	* When a user is granted super admin status (checkbox on network user edit
7050	5537	* screen), add them to the authorizer network approved list. Also remove
7051	5538	* them from pending/approved list on any individual sites.
7052	5539	*
7053		- * Action: grant_super_admin
	5540	+ * @action grant_super_admin
7054	5541	*
7055	5542	* @param int $user_id The user's ID.
7056	5543	*/
7057		- public function grant_super_admin__add_to_network_approved( $user_id ) {
7058		- $user = get_user_by( 'id', $user_id );
	5544	+ function grant_super_admin__add_to_network_approved( $user_id ) {
	5545	+ $user = get_user_by( 'id', $user_id );
7059	5546	$user_email = $user->user_email;
7060	5547
7061	5548	// Add user to multisite approved user list (if not already there).
7062	5549	$auth_multisite_settings_access_users_approved = $this->sanitize_user_list(
7063		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT )
	5550	+ $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN )
7064	5551	);
7065	5552	if ( ! $this->in_multi_array( $user_email, $auth_multisite_settings_access_users_approved ) ) {
7066	5553	$multisite_approved_user = array(
7067		- 'email' => $this->lowercase( $user_email ),
7068		- 'role' => count( $user->roles ) > 0 ? $user->roles[0] : 'administrator',
	5554	+ 'email' => mb_strtolower( $user_email ),
	5555	+ 'role' => count( $user->roles ) > 0 ? $user->roles[0] : 'administrator',
7069	5556	'date_added' => date( 'M Y', strtotime( $user->user_registered ) ),
7070	5557	'local_user' => true,
7071	5558	);
7072	5559	array_push( $auth_multisite_settings_access_users_approved, $multisite_approved_user );
7073		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
	5560	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
7074	5561	}
7075	5562
7076	5563	// Go through all pending/approved lists on individual sites and remove this user from them.
7077		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
7078	5564	$sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
7079	5565	foreach ( $sites as $site ) {
7080	5566	$blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
7081	5567	$this->remove_network_user_from_site_when_removed( $user_id, $blog_id );
		@@ -7088,29 +5574,29 @@
7088	5574	* When a user's super admin status is revoked (checkbox on network user edit
7089	5575	* screen), remove them from the authorizer network approved list. Also add
7090	5576	* them to approved list on any individual sites they are already a part of.
7091	5577	*
7092		- * Action: revoke_super_admin
	5578	+ * @action revoke_super_admin
7093	5579	*
7094	5580	* @param int $user_id The user's ID.
7095	5581	*/
7096		- public function revoke_super_admin__remove_from_network_approved( $user_id ) {
7097		- $user = get_user_by( 'id', $user_id );
	5582	+ function revoke_super_admin__remove_from_network_approved( $user_id ) {
	5583	+ $user = get_user_by( 'id', $user_id );
7098	5584	$revoked_email = $user->user_email;
7099	5585
7100	5586	// Go through multisite approved user list and remove this user.
7101	5587	$auth_multisite_settings_access_users_approved = $this->sanitize_user_list(
7102		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT )
	5588	+ $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN )
7103	5589	);
7104		- $list_changed = false;
	5590	+ $list_changed = false;
7105	5591	foreach ( $auth_multisite_settings_access_users_approved as $key => $existing_user ) {
7106	5592	if ( 0 === strcasecmp( $revoked_email, $existing_user['email'] ) ) {
7107	5593	$list_changed = true;
7108		- unset( $auth_multisite_settings_access_users_approved[ $key ] );
	5594	+ unset( $auth_multisite_settings_access_users_approved[$key] );
7109	5595	}
7110	5596	}
7111	5597	if ( $list_changed ) {
7112		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
	5598	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
7113	5599	}
7114	5600
7115	5601	// Go through this user's current sites and add them to the approved list
7116	5602	// (since they are no longer on the network approved list).
		@@ -7121,21 +5607,14 @@
7121	5607	}
7122	5608
7123	5609	}
7124	5610
7125		- /**
7126		- * Send a welcome email message to a newly approved user (if the "Should
7127		- * email approved users" setting is enabled).
7128		- *
7129		- * @param string $email Email address to send welcome email to.
7130		- * @return bool Whether the email was sent.
7131		- */
7132	5611	private function maybe_email_welcome_message( $email ) {
7133	5612	// Get option for whether to email welcome messages.
7134	5613	$should_email_new_approved_users = $this->get_plugin_option( 'access_should_email_approved_users' );
7135	5614
7136	5615	// Do not send welcome email if option not enabled.
7137		- if ( '1' !== $should_email_new_approved_users ) {
	5616	+ if ( $should_email_new_approved_users !== '1' ) {
7138	5617	return false;
7139	5618	}
7140	5619
7141	5620	// Make sure we didn't just email this user (can happen with
		@@ -7141,15 +5620,15 @@
7141	5620	// Make sure we didn't just email this user (can happen with
7142	5621	// multiple admins saving at the same time, or by clicking
7143	5622	// Approve button too rapidly).
7144	5623	$recently_sent_emails = get_option( 'auth_settings_recently_sent_emails' );
7145		- if ( false === $recently_sent_emails ) {
	5624	+ if ( $recently_sent_emails === FALSE ) {
7146	5625	$recently_sent_emails = array();
7147	5626	}
7148	5627	foreach ( $recently_sent_emails as $key => $recently_sent_email ) {
7149	5628	if ( $recently_sent_email['time'] < strtotime( 'now -1 minutes' ) ) {
7150	5629	// Remove emails sent more than 1 minute ago.
7151		- unset( $recently_sent_emails[ $key ] );
	5630	+ unset( $recently_sent_emails[$key] );
7152	5631	} elseif ( $recently_sent_email['email'] === $email ) {
7153	5632	// Sent an email to this user within the last 1 minute, so
7154	5633	// quit without sending.
7155	5634	return false;
		@@ -7157,15 +5636,15 @@
7157	5636	}
7158	5637	// Add the email we're about to send to the list.
7159	5638	$recently_sent_emails[] = array(
7160	5639	'email' => $email,
7161		- 'time' => time(),
	5640	+ 'time' => time(),
7162	5641	);
7163	5642	update_option( 'auth_settings_recently_sent_emails', $recently_sent_emails );
7164	5643
7165		- // Get welcome email subject and body text.
	5644	+ // Get welcome email subject and body text
7166	5645	$subject = $this->get_plugin_option( 'access_email_approved_users_subject' );
7167		- $body = apply_filters( 'the_content', $this->get_plugin_option( 'access_email_approved_users_body' ) );
	5646	+ $body = apply_filters( 'the_content', $this->get_plugin_option( 'access_email_approved_users_body' ) );
7168	5647
7169	5648	// Fail if the subject/body options don't exist or are empty.
7170	5649	if ( is_null( $subject ) || is_null( $body ) || strlen( $subject ) === 0 || strlen( $body ) === 0 ) {
7171	5650	return false;
		@@ -7172,14 +5651,14 @@
7172	5651	}
7173	5652
7174	5653	// Replace approved shortcode patterns in subject and body.
7175	5654	$site_name = get_bloginfo( 'name' );
7176		- $site_url = get_site_url();
7177		- $subject = str_replace( '[site_name]', $site_name, $subject );
7178		- $body = str_replace( '[site_name]', $site_name, $body );
7179		- $body = str_replace( '[site_url]', $site_url, $body );
7180		- $body = str_replace( '[user_email]', $email, $body );
7181		- $headers = 'Content-type: text/html' . "\r\n";
	5655	+ $site_url = get_site_url();
	5656	+ $subject = str_replace( '[site_name]', $site_name, $subject );
	5657	+ $body = str_replace( '[site_name]', $site_name, $body );
	5658	+ $body = str_replace( '[site_url]', $site_url, $body );
	5659	+ $body = str_replace( '[user_email]', $email, $body );
	5660	+ $headers = 'Content-type: text/html' . "\r\n";
7182	5661
7183	5662	// Send email.
7184	5663	wp_mail( $email, $subject, $body, $headers );
7185	5664
		@@ -7189,22 +5668,14 @@
7189	5668
7190	5669
7191	5670	/**
7192	5671	* Generate a unique cookie to add to nonces to prevent CSRF.
7193		- *
7194		- * @var string
7195	5672	*/
7196		- private $cookie_value = null;
7197		-
7198		- /**
7199		- * Retrieve the unique login cookie.
7200		- *
7201		- * @return string Login cookie value.
7202		- */
7203		- private function get_cookie_value() {
	5673	+ protected $cookie_value = null;
	5674	+ function get_cookie_value() {
7204	5675	if ( ! $this->cookie_value ) {
7205	5676	if ( isset( $_COOKIE['login_unique'] ) ) {
7206		- $this->cookie_value = sanitize_key( wp_unslash( $_COOKIE['login_unique'] ) );
	5677	+ $this->cookie_value = $_COOKIE['login_unique'];
7207	5678	} else {
7208	5679	$this->cookie_value = md5( rand() );
7209	5680	}
7210	5681	}
		@@ -7212,51 +5683,37 @@
7212	5683	}
7213	5684
7214	5685
7215	5686	/**
7216		- * Encryption key (not secret!).
7217		- *
7218		- * @var string
7219		- */
7220		- private static $key = "8QxnrvjdtweisvCBKEY!+0\0\0";
7221		-
7222		- /**
7223		- * Encryption salt (not secret!).
7224		- *
7225		- * @var string
7226		- */
7227		- private static $iv = 'R_O2D]jPn]1[fhJl!-P1.oe';
7228		-
7229		- /**
7230	5687	* Basic encryption using a public (not secret!) key. Used for general
7231	5688	* database obfuscation of passwords.
7232		- *
7233		- * @param string $text String to encrypt.
7234		- * @param string $library Encryption library to use (openssl).
7235		- * @return string Encrypted string.
	5689	+ * @param $text String to encrypt.
	5690	+ * @param $library Encryption lib to use (openssl).
	5691	+ * @return Encrypted string
7236	5692	*/
7237		- private function encrypt( $text, $library = 'openssl' ) {
	5693	+ private static $key = "8QxnrvjdtweisvCBKEY!+0\0\0";
	5694	+ private static $iv = "R_O2D]jPn]1[fhJl!-P1.oe";
	5695	+ function encrypt( $text, $library = 'openssl' ) {
7238	5696	$result = '';
7239	5697
7240	5698	// Use openssl library (better) if it is enabled.
7241		- if ( function_exists( 'openssl_encrypt' ) && 'openssl' === $library ) {
7242		- $result = base64_encode(
7243		- openssl_encrypt(
7244		- $text,
7245		- 'AES-256-CBC',
7246		- hash( 'sha256', self::$key ),
7247		- 0,
7248		- substr( hash( 'sha256', self::$iv ), 0, 16 )
7249		- )
7250		- );
7251		- } elseif ( function_exists( 'mcrypt_encrypt' ) ) { // Use mcrypt library (deprecated in PHP 7.1) if php5-mcrypt extension is enabled.
	5699	+ if ( function_exists( 'openssl_encrypt' ) && $library === 'openssl' ) {
	5700	+ $result = base64_encode( openssl_encrypt(
	5701	+ $text,
	5702	+ 'AES-256-CBC',
	5703	+ hash( 'sha256', self::$key ),
	5704	+ 0,
	5705	+ substr( hash( 'sha256', self::$iv ), 0, 16 )
	5706	+ ) );
	5707	+ // Use mcrypt library (deprecated in PHP 7.1) if php5-mcrypt extension is enabled.
	5708	+ } else if ( function_exists( 'mcrypt_encrypt' ) ) {
7252	5709	$result = base64_encode( mcrypt_encrypt( MCRYPT_RIJNDAEL_256, self::$key, $text, MCRYPT_MODE_ECB, 'abcdefghijklmnopqrstuvwxyz012345' ) );
7253		- } else { // Fall back to basic obfuscation.
7254		- $length = strlen( $text );
7255		- for ( $i = 0; $i < $length; $i++ ) {
7256		- $char = substr( $text, $i, 1 );
	5710	+ // Fall back to basic obfuscation.
	5711	+ } else {
	5712	+ for ( $i = 0; $i < strlen( $text ); $i++ ) {
	5713	+ $char = substr( $text, $i, 1 );
7257	5714	$keychar = substr( self::$key, ( $i % strlen( self::$key ) ) - 1, 1 );
7258		- $char = chr( ord( $char ) + ord( $keychar ) );
	5715	+ $char = chr( ord( $char ) + ord( $keychar ) );
7259	5716	$result .= $char;
7260	5717	}
7261	5718	$result = base64_encode( $result );
7262	5719	}
		@@ -7267,18 +5724,17 @@
7267	5724
7268	5725	/**
7269	5726	* Basic decryption using a public (not secret!) key. Used for general
7270	5727	* database obfuscation of passwords.
7271		- *
7272		- * @param string $secret String to encrypt.
7273		- * @param string $library Encryption lib to use (openssl).
7274		- * @return string Decrypted string
	5728	+ * @param $text String to encrypt.
	5729	+ * @param $library Encryption lib to use (openssl).
	5730	+ * @return Decrypted string
7275	5731	*/
7276		- private function decrypt( $secret, $library = 'openssl' ) {
	5732	+ function decrypt( $secret, $library = 'openssl' ) {
7277	5733	$result = '';
7278	5734
7279	5735	// Use openssl library (better) if it is enabled.
7280		- if ( function_exists( 'openssl_decrypt' ) && 'openssl' === $library ) {
	5736	+ if ( function_exists( 'openssl_decrypt' ) && $library === 'openssl' ) {
7281	5737	$result = openssl_decrypt(
7282	5738	base64_decode( $secret ),
7283	5739	'AES-256-CBC',
7284	5740	hash( 'sha256', self::$key ),
		@@ -7284,18 +5740,19 @@
7284	5740	hash( 'sha256', self::$key ),
7285	5741	0,
7286	5742	substr( hash( 'sha256', self::$iv ), 0, 16 )
7287	5743	);
7288		- } elseif ( function_exists( 'mcrypt_decrypt' ) ) { // Use mcrypt library (deprecated in PHP 7.1) if php5-mcrypt extension is enabled.
	5744	+ // Use mcrypt library (deprecated in PHP 7.1) if php5-mcrypt extension is enabled.
	5745	+ } else if ( function_exists( 'mcrypt_decrypt' ) ) {
7289	5746	$secret = base64_decode( $secret );
7290	5747	$result = rtrim( mcrypt_decrypt( MCRYPT_RIJNDAEL_256, self::$key, $secret, MCRYPT_MODE_ECB, 'abcdefghijklmnopqrstuvwxyz012345' ), "\0$result" );
7291		- } else { // Fall back to basic obfuscation.
	5748	+ // Fall back to basic obfuscation.
	5749	+ } else {
7292	5750	$secret = base64_decode( $secret );
7293		- $length = strlen( $secret );
7294		- for ( $i = 0; $i < $length; $i++ ) {
7295		- $char = substr( $secret, $i, 1 );
	5751	+ for ( $i = 0; $i < strlen( $secret ); $i++ ) {
	5752	+ $char = substr( $secret, $i, 1 );
7296	5753	$keychar = substr( self::$key, ( $i % strlen( self::$key ) ) - 1, 1 );
7297		- $char = chr( ord( $char ) - ord( $keychar ) );
	5754	+ $char = chr( ord( $char ) - ord( $keychar ) );
7298	5755	$result .= $char;
7299	5756	}
7300	5757	}
7301	5758
		@@ -7306,12 +5763,10 @@
7306	5763	/**
7307	5764	* In a multisite environment, returns true if the current user is logged
7308	5765	* in and a user of the current blog. In single site mode, simply returns
7309	5766	* true if the current user is logged in.
7310		- *
7311		- * @return bool Whether current user is logged in and a user of the current blog.
7312	5767	*/
7313		- protected function is_user_logged_in_and_blog_user() {
	5768	+ function is_user_logged_in_and_blog_user() {
7314	5769	$is_user_logged_in_and_blog_user = false;
7315	5770	if ( is_multisite() ) {
7316	5771	$is_user_logged_in_and_blog_user = is_user_logged_in() && is_user_member_of_blog( get_current_user_id() );
7317	5772	} else {
		@@ -7324,42 +5779,39 @@
7324	5779	/**
7325	5780	* Helper function to determine whether a given email is in one of
7326	5781	* the lists (pending, approved, blocked). Defaults to the list of
7327	5782	* approved users.
7328		- *
7329		- * @param string $email Email to check existent of.
7330		- * @param string $list List to look for email in.
7331		- * @param string $multisite_mode Admin context.
7332		- * @return boolean Whether email was found.
7333	5783	*/
7334		- protected function is_email_in_list( $email = '', $list = 'approved', $multisite_mode = 'single' ) {
7335		- if ( empty( $email ) ) {
	5784	+ function is_email_in_list( $email = '', $list = 'approved', $multisite_mode = 'single' ) {
	5785	+ if ( empty( $email ) )
7336	5786	return false;
7337		- }
7338	5787
7339	5788	switch ( $list ) {
7340		- case 'pending':
7341		- $auth_settings_access_users_pending = $this->get_plugin_option( 'access_users_pending', WP_Plugin_Authorizer::SINGLE_CONTEXT );
7342		- return $this->in_multi_array( $email, $auth_settings_access_users_pending );
7343		- case 'blocked':
7344		- $auth_settings_access_users_blocked = $this->get_plugin_option( 'access_users_blocked', WP_Plugin_Authorizer::SINGLE_CONTEXT );
7345		- return $this->in_multi_array( $email, $auth_settings_access_users_blocked );
7346		- case 'approved':
7347		- default:
7348		- if ( 'single' !== $multisite_mode ) {
7349		- // Get multisite users only.
7350		- $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT );
7351		- } elseif ( is_multisite() && 1 === intval( $this->get_plugin_option( 'advanced_override_multisite' ) ) ) {
7352		- // This site has overridden any multisite settings, so only get its users.
7353		- $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT );
7354		- } else {
7355		- // Get all site users and all multisite users.
7356		- $auth_settings_access_users_approved = array_merge(
7357		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT ),
7358		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT )
7359		- );
7360		- }
7361		- return $this->in_multi_array( $email, $auth_settings_access_users_approved );
	5789	+ case 'pending':
	5790	+ $auth_settings_access_users_pending = $this->get_plugin_option( 'access_users_pending', SINGLE_ADMIN );
	5791	+ return $this->in_multi_array( $email, $auth_settings_access_users_pending );
	5792	+ break;
	5793	+ case 'blocked':
	5794	+ $auth_settings_access_users_blocked = $this->get_plugin_option( 'access_users_blocked', SINGLE_ADMIN );
	5795	+ return $this->in_multi_array( $email, $auth_settings_access_users_blocked );
	5796	+ break;
	5797	+ case 'approved':
	5798	+ default:
	5799	+ if ( $multisite_mode !== 'single' ) {
	5800	+ // Get multisite users only.
	5801	+ $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN );
	5802	+ } elseif ( is_multisite() && $this->get_plugin_option( 'advanced_override_multisite' ) == '1' ) {
	5803	+ // This site has overridden any multisite settings, so only get its users.
	5804	+ $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN );
	5805	+ } else {
	5806	+ // Get all site users and all multisite users.
	5807	+ $auth_settings_access_users_approved = array_merge(
	5808	+ $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN ),
	5809	+ $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN )
	5810	+ );
	5811	+ }
	5812	+ return $this->in_multi_array( $email, $auth_settings_access_users_approved );
	5813	+ break;
7362	5814	}
7363	5815	}
7364	5816
7365	5817
		@@ -7365,37 +5817,36 @@
7365	5817
7366	5818	/**
7367	5819	* Helper function to get number of users (including multisite users)
7368	5820	* in a given list (pending, approved, or blocked).
7369		- *
7370		- * @param string $list List to get count of.
7371		- * @param string $admin_mode WP_Plugin_Authorizer::SINGLE_CONTEXT or WP_Plugin_Authorizer::NETWORK_CONTEXT determines whether to include multisite users.
7372		- * @return int Number of users in list.
	5821	+ * @param string $list
	5822	+ * @param string $admin_mode SINGLE_ADMIN or MULTISITE_ADMIN determines whether to include multisite users
	5823	+ * @return int number of users in list
7373	5824	*/
7374		- protected function get_user_count_from_list( $list, $admin_mode = WP_Plugin_Authorizer::SINGLE_CONTEXT ) {
	5825	+ function get_user_count_from_list( $list, $admin_mode = SINGLE_ADMIN ) {
7375	5826	$auth_settings_access_users = array();
7376	5827
7377	5828	switch ( $list ) {
7378		- case 'pending':
7379		- $auth_settings_access_users = $this->get_plugin_option( 'access_users_pending', WP_Plugin_Authorizer::SINGLE_CONTEXT );
7380		- break;
7381		- case 'blocked':
7382		- $auth_settings_access_users = $this->get_plugin_option( 'access_users_blocked', WP_Plugin_Authorizer::SINGLE_CONTEXT );
7383		- break;
7384		- case 'approved':
7385		- if ( WP_Plugin_Authorizer::SINGLE_CONTEXT !== $admin_mode ) {
7386		- // Get multisite users only.
7387		- $auth_settings_access_users = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT );
7388		- } elseif ( is_multisite() && 1 === intval( $this->get_plugin_option( 'advanced_override_multisite' ) ) ) {
7389		- // This site has overridden any multisite settings, so only get its users.
7390		- $auth_settings_access_users = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT );
7391		- } else {
7392		- // Get all site users and all multisite users.
7393		- $auth_settings_access_users = array_merge(
7394		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT ),
7395		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT )
7396		- );
7397		- }
	5829	+ case 'pending':
	5830	+ $auth_settings_access_users = $this->get_plugin_option( 'access_users_pending', SINGLE_ADMIN );
	5831	+ break;
	5832	+ case 'blocked':
	5833	+ $auth_settings_access_users = $this->get_plugin_option( 'access_users_blocked', SINGLE_ADMIN );
	5834	+ break;
	5835	+ case 'approved':
	5836	+ if ( $admin_mode !== SINGLE_ADMIN ) {
	5837	+ // Get multisite users only.
	5838	+ $auth_settings_access_users = $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN );
	5839	+ } elseif ( is_multisite() && $this->get_plugin_option( 'advanced_override_multisite' ) == '1' ) {
	5840	+ // This site has overridden any multisite settings, so only get its users.
	5841	+ $auth_settings_access_users = $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN );
	5842	+ } else {
	5843	+ // Get all site users and all multisite users.
	5844	+ $auth_settings_access_users = array_merge(
	5845	+ $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN ),
	5846	+ $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN )
	5847	+ );
	5848	+ }
7398	5849	}
7399	5850
7400	5851	return count( $auth_settings_access_users );
7401	5852	}
		@@ -7402,27 +5853,21 @@
7402	5853
7403	5854
7404	5855	/**
7405	5856	* Helper function to search a multidimensional array for a value.
7406		- *
7407		- * @param string $needle Value to search for.
7408		- * @param array $haystack Multidimensional array to search.
7409		- * @param string $strict_mode 'strict' if strict comparisons should be used.
7410		- * @param string $case_sensitivity 'case sensitive' if comparisons should respect case.
7411		- * @return bool Whether needle was found.
7412	5857	*/
7413		- protected function in_multi_array( $needle = '', $haystack = array(), $strict_mode = 'not strict', $case_sensitivity = 'case insensitive' ) {
	5858	+ function in_multi_array( $needle = '', $haystack = array(), $strict_mode = 'not strict', $case_sensitivity = 'case insensitive' ) {
7414	5859	if ( ! is_array( $haystack ) ) {
7415	5860	return false;
7416	5861	}
7417		- if ( 'case insensitive' === $case_sensitivity ) {
	5862	+ if ( $case_sensitivity === 'case insensitive' ) {
7418	5863	$needle = strtolower( $needle );
7419	5864	}
7420	5865	foreach ( $haystack as $item ) {
7421		- if ( 'case insensitive' === $case_sensitivity && ! is_array( $item ) ) {
	5866	+ if ( $case_sensitivity === 'case insensitive' && ! is_array( $item ) ) {
7422	5867	$item = strtolower( $item );
7423	5868	}
7424		- if ( ( 'strict' === $strict_mode ? $item === $needle : $item == $needle ) || ( is_array( $item ) && $this->in_multi_array( $needle, $item, $strict_mode, $case_sensitivity ) ) ) { // phpcs:ignore WordPress.PHP.StrictComparisons.LooseComparison
	5869	+ if ( ( $strict_mode === 'strict' ? $item === $needle : $item == $needle ) || ( is_array( $item ) && $this->in_multi_array( $needle, $item, $strict_mode, $case_sensitivity ) ) ) {
7425	5870	return true;
7426	5871	}
7427	5872	}
7428	5873	return false;
		@@ -7431,17 +5876,17 @@
7431	5876
7432	5877	/**
7433	5878	* Helper function to determine if an URL is accessible.
7434	5879	*
7435		- * @param string $url URL that should be publicly reachable.
7436		- * @return boolean Whether the URL is publicly reachable.
	5880	+ * @param string $url URL that should be publicly reachable
	5881	+ * @return boolean Whether the URL is publicly reachable
7437	5882	*/
7438		- protected function url_is_accessible( $url ) {
	5883	+ function url_is_accessible( $url ) {
7439	5884	// Use wp_remote_retrieve_response_code() to retrieve the URL.
7440		- $response = wp_remote_get( $url );
	5885	+ $response = wp_remote_get( $url );
7441	5886	$response_code = wp_remote_retrieve_response_code( $response );
7442	5887
7443		- // Return true if the document has loaded successfully without any redirection or error.
	5888	+ // Return true if the document has loaded successfully without any redirection or error
7444	5889	return $response_code >= 200 && $response_code < 400;
7445	5890	}
7446	5891
7447	5892
		@@ -7446,14 +5891,13 @@
7446	5891
7447	5892
7448	5893	/**
7449	5894	* Helper function to reconstruct a URL split using parse_url().
7450		- *
7451		- * @param array $parts Array returned from parse_url().
7452		- * @return string URL.
	5895	+ * @param array $parts Array returned from parse_url().
	5896	+ * @return string URL.
7453	5897	*/
7454		- protected function build_url( $parts = array() ) {
7455		- return (
	5898	+ function build_url( $parts = array() ) {
	5899	+ return
7456	5900	( isset( $parts['scheme'] ) ? "{$parts['scheme']}:" : '' ) .
7457	5901	( ( isset( $parts['user'] ) || isset( $parts['host'] ) ) ? '//' : '' ) .
7458	5902	( isset( $parts['user'] ) ? "{$parts['user']}" : '' ) .
7459	5903	( isset( $parts['pass'] ) ? ":{$parts['pass']}" : '' ) .
		@@ -7461,30 +5905,21 @@
7461	5905	( isset( $parts['host'] ) ? "{$parts['host']}" : '' ) .
7462	5906	( isset( $parts['port'] ) ? ":{$parts['port']}" : '' ) .
7463	5907	( isset( $parts['path'] ) ? "{$parts['path']}" : '' ) .
7464	5908	( isset( $parts['query'] ) ? "?{$parts['query']}" : '' ) .
7465		- ( isset( $parts['fragment'] ) ? "#{$parts['fragment']}" : '' )
7466		- );
	5909	+ ( isset( $parts['fragment'] ) ? "#{$parts['fragment']}" : '' );
7467	5910	}
7468	5911
7469	5912
7470		- /**
7471		- * Helper function that prints option tags for a select element for all
7472		- * roles the current user has permission to assign.
7473		- *
7474		- * @param string $selected_role Which role should be selected in the dropdown.
7475		- * @param string $disable_input 'disabled' if select element should be disabled.
7476		- * @param int $admin_mode WP_Plugin_Authorizer::NETWORK_CONTEXT if we are in that context.
7477		- * @return void
7478		- */
7479		- protected function wp_dropdown_permitted_roles( $selected_role = 'subscriber', $disable_input = 'not disabled', $admin_mode = WP_Plugin_Authorizer::SINGLE_CONTEXT ) {
7480		- $roles = get_editable_roles();
	5913	+ // Helper function that builds option tags for a select element for all
	5914	+ // roles the current user has permission to assign.
	5915	+ function wp_dropdown_permitted_roles( $selected_role = 'subscriber', $disable_input = 'not disabled', $admin_mode = SINGLE_ADMIN ) {
	5916	+ $roles = get_editable_roles();
7481	5917	$current_user = wp_get_current_user();
7482	5918
7483	5919	// If we're in network admin, also show any roles that might exist only on
7484	5920	// specific sites in the network (themes can add their own roles).
7485		- if ( WP_Plugin_Authorizer::NETWORK_CONTEXT === $admin_mode ) {
7486		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
	5921	+ if ( $admin_mode === MULTISITE_ADMIN ) {
7487	5922	$sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
7488	5923	foreach ( $sites as $site ) {
7489	5924	$blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
7490	5925	switch_to_blog( $blog_id );
		@@ -7493,11 +5928,11 @@
7493	5928	}
7494	5929	$unique_role_names = array();
7495	5930	foreach ( $roles as $role_name => $role_info ) {
7496	5931	if ( array_key_exists( $role_name, $unique_role_names ) ) {
7497		- unset( $roles[ $role_name ] );
	5932	+ unset( $roles[$role_name] );
7498	5933	} else {
7499		- $unique_role_names[ $role_name ] = true;
	5934	+ $unique_role_names[$role_name] = true;
7500	5935	}
7501	5936	}
7502	5937	}
7503	5938
		@@ -7509,41 +5944,37 @@
7509	5944	}
7510	5945
7511	5946	// Print an option element for each permitted role.
7512	5947	foreach ( $roles as $name => $role ) {
7513		- $is_selected = $selected_role === $name;
	5948	+ $selected = $selected_role === $name ? ' selected="selected"' : '';
7514	5949
7515		- // Don't let a user change their own role (but network admins always can).
7516		- $is_disabled = $selected_role !== $name && 'disabled' === $disable_input && ! ( is_multisite() && current_user_can( 'manage_network' ) );
7517		- ?>
7518		- <option value="<?php echo esc_attr( $name ); ?>"<?php selected( $is_selected ); ?><?php disabled( $is_disabled ); ?>><?php echo esc_html( $role['name'] ); ?></option>
7519		- <?php
	5950	+ // Don't let a user change their own role
	5951	+ $disabled = $selected_role !== $name && $disable_input === 'disabled' ? ' disabled="disabled"' : '';
	5952	+
	5953	+ // But network admins can always change their role.
	5954	+ if ( is_multisite() && current_user_can( 'manage_network' ) ) {
	5955	+ $disabled = '';
	5956	+ }
	5957	+
	5958	+ ?><option value="<?php echo $name; ?>"<?php echo $selected . $disabled; ?>><?php echo $role['name']; ?></option><?php
7520	5959	}
7521	5960
7522	5961	// Print default role (no role).
7523		- $is_selected = strlen( $selected_role ) === 0 || ! array_key_exists( $selected_role, $roles );
7524		- $is_disabled = strlen( $selected_role ) > 0 && 'disabled' === $disable_input && ! ( is_multisite() && current_user_can( 'manage_network' ) );
7525		- ?>
7526		- <option value=""<?php selected( $is_selected ); ?><?php disabled( $is_disabled ); ?>><?php esc_html_e( '&mdash; No role for this site &mdash;', 'authorizer' ); ?></option>
7527		- <?php
	5962	+ $selected = strlen( $selected_role ) == 0 || ! array_key_exists( $selected_role, $roles ) ? ' selected="selected"' : '';
	5963	+ $disabled = strlen( $selected_role ) > 0 && $disable_input === 'disabled' ? ' disabled="disabled"' : '';
	5964	+ if ( is_multisite() && current_user_can( 'manage_network' ) ) {
	5965	+ $disabled = '';
	5966	+ }
	5967	+ ?><option value=""<?php echo $selected . $disabled; ?>><?php _e( '&mdash; No role for this site &mdash;', 'authorizer' ); ?></option><?php
7528	5968
7529	5969	}
7530	5970
7531	5971
7532		- /**
7533		- * Helper function to get a single user info array from one of the access
7534		- * control lists (pending, approved, or blocked).
7535		- *
7536		- * @param string $email Email address to retrieve info for.
7537		- * @param string $list List to get info from.
7538		- * @return mixed false if not found, otherwise: array(
7539		- * 'email' => '',
7540		- * 'role' => '',
7541		- * 'date_added' => '',
7542		- * ['usermeta' => [''|array()]]
7543		- * );
7544		- */
7545		- protected function get_user_info_from_list( $email, $list ) {
	5972	+ // Helper function to get a single user info array from one of the
	5973	+ // access control lists (pending, approved, or blocked).
	5974	+ // Returns: false if not found; otherwise
	5975	+ // array( 'email' => '', 'role' => '', 'date_added' => '', ['usermeta' => [''|array()]] );
	5976	+ function get_user_info_from_list( $email, $list ) {
7546	5977	foreach ( $list as $user_info ) {
7547	5978	if ( 0 === strcasecmp( $user_info['email'], $email ) ) {
7548	5979	return $user_info;
7549	5980	}
		@@ -7550,49 +5981,29 @@
7550	5981	}
7551	5982	return false;
7552	5983	}
7553	5984
7554		- /**
7555		- * Helper function to convert a string to lowercase. Prefers to use mb_strtolower,
7556		- * but will fall back to strtolower if the former is not available.
7557		- *
7558		- * @param string $string String to convert to lowercase.
7559		- * @return string Input in lowercase.
7560		- */
7561		- protected function lowercase( $string ) {
7562		- return function_exists( 'mb_strtolower' ) ? mb_strtolower( $string ) : strtolower( $string );
7563		- }
7564	5985
7565		-
7566		- /**
7567		- * Helper function to convert seconds to human readable text.
7568		- *
7569		- * @see: http://csl.name/php-secs-to-human-text/
7570		- *
7571		- * @param int $secs Seconds to display as readable text.
7572		- * @return string Readable version of number of seconds.
7573		- */
7574		- protected function seconds_as_sentence( $secs ) {
	5986	+ // Helper function to convert seconds to human readable text.
	5987	+ // Source: http://csl.name/php-secs-to-human-text/
	5988	+ function seconds_as_sentence( $secs ) {
7575	5989	$units = array(
7576		- 'week' => 3600 * 24 * 7,
7577		- 'day' => 3600 * 24,
7578		- 'hour' => 3600,
7579		- 'minute' => 60,
7580		- 'second' => 1,
	5990	+ "week" => 7 * 24 * 3600,
	5991	+ "day" => 24 * 3600,
	5992	+ "hour" => 3600,
	5993	+ "minute" => 60,
	5994	+ "second" => 1,
7581	5995	);
7582	5996
7583		- // Specifically handle zero.
7584		- if ( 0 === intval( $secs ) ) {
7585		- return '0 seconds';
7586		- }
	5997	+ // specifically handle zero
	5998	+ if ( $secs == 0 ) return "0 seconds";
7587	5999
7588		- $s = '';
	6000	+ $s = "";
7589	6001
7590	6002	foreach ( $units as $name => $divisor ) {
7591		- $quot = intval( $secs / $divisor );
7592		- if ( $quot ) {
7593		- $s .= "$quot $name";
7594		- $s .= ( abs( $quot ) > 1 ? 's' : '' ) . ', ';
	6003	+ if ( $quot = intval( $secs / $divisor ) ) {
	6004	+ $s .= "$quot $name";
	6005	+ $s .= ( abs( $quot ) > 1 ? "s" : "" ) . ", ";
7595	6006	$secs -= $quot * $divisor;
7596	6007	}
7597	6008	}
7598	6009
		@@ -7598,14 +6009,10 @@
7598	6009
7599	6010	return substr( $s, 0, -2 );
7600	6011	}
7601	6012
7602		- /**
7603		- * Helper function to get all available usermeta keys as an array.
7604		- *
7605		- * @return array All usermeta keys for user.
7606		- */
7607		- protected function get_all_usermeta_keys() {
	6013	+ // Helper function to get all available usermeta keys as an array.
	6014	+ function get_all_usermeta_keys() {
7608	6015	global $wpdb;
7609	6016	$usermeta_keys = $wpdb->get_col( "SELECT DISTINCT $wpdb->usermeta.meta_key FROM $wpdb->usermeta" );
7610	6017	return $usermeta_keys;
7611	6018	}
		@@ -7612,12 +6019,10 @@
7612	6019
7613	6020
7614	6021	/**
7615	6022	* Load translated strings from *.mo files in /languages.
7616		- *
7617		- * Action: plugins_loaded
7618	6023	*/
7619		- public function load_textdomain() {
	6024	+ function load_textdomain() {
7620	6025	load_plugin_textdomain(
7621	6026	'authorizer',
7622	6027	false,
7623	6028	plugin_basename( dirname( __FILE__ ) ) . '/languages'
		@@ -7628,17 +6033,14 @@
7628	6033	/**
7629	6034	* Generate CAS authentication URL (wp-login.php URL with reauth=1 removed
7630	6035	* and external=cas added).
7631	6036	*/
7632		- private function modify_current_url_for_cas_login() {
	6037	+ function modify_current_url_for_cas_login() {
7633	6038	// Construct the URL of the current page (wp-login.php).
7634		- $url = '';
7635		- if ( isset( $_SERVER['HTTP_HOST'], $_SERVER['REQUEST_URI'] ) ) {
7636		- $url = set_url_scheme( esc_url_raw( wp_unslash( $_SERVER['HTTP_HOST'] ) ) . esc_url_raw( wp_unslash( $_SERVER['REQUEST_URI'] ) ) );
7637		- }
	6039	+ $url = 'http' . ( isset( $_SERVER['HTTPS'] ) ? 's' : '' ) . '://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
7638	6040
7639	6041	// Parse the URL into its components.
7640		- $parsed_url = wp_parse_url( $url );
	6042	+ $parsed_url = parse_url( $url );
7641	6043
7642	6044	// Fix up the querystring values (remove reauth, make sure external=cas).
7643	6045	$querystring = array();
7644	6046	if ( array_key_exists( 'query', $parsed_url ) ) {
		@@ -7645,9 +6047,9 @@
7645	6047	parse_str( $parsed_url['query'], $querystring );
7646	6048	}
7647	6049	unset( $querystring['reauth'] );
7648	6050	$querystring['external'] = 'cas';
7649		- $parsed_url['query'] = http_build_query( $querystring );
	6051	+ $parsed_url['query'] = http_build_query( $querystring );
7650	6052
7651	6053	// Return the URL as a string.
7652	6054	return $this->unparse_url( $parsed_url );
7653	6055	}
		@@ -7654,21 +6056,20 @@
7654	6056
7655	6057
7656	6058	/**
7657	6059	* Reconstruct a URL after it has been deconstructed with parse_url().
7658		- *
7659		- * @param array $parsed_url Keys from parse_url().
7660		- * @return string URL constructed from the components in $parsed_url.
	6060	+ * @param $parsed_url array() with keys from parse_url().
	6061	+ * @return string URL constructed from the components in $parsed_url.
7661	6062	*/
7662		- protected function unparse_url( $parsed_url = array() ) {
7663		- $scheme = isset( $parsed_url['scheme'] ) ? $parsed_url['scheme'] . '://' : '';
7664		- $host = isset( $parsed_url['host'] ) ? $parsed_url['host'] : '';
7665		- $port = isset( $parsed_url['port'] ) ? ':' . $parsed_url['port'] : '';
7666		- $user = isset( $parsed_url['user'] ) ? $parsed_url['user'] : '';
7667		- $pass = isset( $parsed_url['pass'] ) ? ':' . $parsed_url['pass'] : '';
7668		- $pass = $user || $pass ? "$pass@" : '';
7669		- $path = isset( $parsed_url['path'] ) ? $parsed_url['path'] : '';
7670		- $query = isset( $parsed_url['query'] ) ? '?' . $parsed_url['query'] : '';
	6063	+ function unparse_url( $parsed_url = array() ) {
	6064	+ $scheme = isset( $parsed_url['scheme'] ) ? $parsed_url['scheme'] . '://' : '';
	6065	+ $host = isset( $parsed_url['host'] ) ? $parsed_url['host'] : '';
	6066	+ $port = isset( $parsed_url['port'] ) ? ':' . $parsed_url['port'] : '';
	6067	+ $user = isset( $parsed_url['user'] ) ? $parsed_url['user'] : '';
	6068	+ $pass = isset( $parsed_url['pass'] ) ? ':' . $parsed_url['pass'] : '';
	6069	+ $pass = $user || $pass ? "$pass@" : '';
	6070	+ $path = isset( $parsed_url['path'] ) ? $parsed_url['path'] : '';
	6071	+ $query = isset( $parsed_url['query'] ) ? '?' . $parsed_url['query'] : '';
7671	6072	$fragment = isset( $parsed_url['fragment'] ) ? '#' . $parsed_url['fragment'] : '';
7672	6073	return "$scheme$user$pass$host$port$path$query$fragment";
7673	6074	}
7674	6075
		@@ -7673,30 +6074,15 @@
7673	6074	}
7674	6075
7675	6076
7676	6077	/**
7677		- * Helper function to generate an HTML class name for an option (used in
7678		- * Authorizer Settings in the Approved User list).
7679		- *
7680		- * @param string $suffix Unique part of class name.
7681		- * @param boolean $is_multisite_user Whether the class name should indicate it's a multisite user.
7682		- * @return string Class name, e.g., "auth-email auth-multisite-email".
7683		- */
7684		- private function create_class_name( $suffix = '', $is_multisite_user = false ) {
7685		- return $is_multisite_user ? "auth-$suffix auth-multisite-$suffix" : "auth-$suffix";
7686		- }
7687		-
7688		-
7689		- /**
7690	6078	* Plugin Update Routines.
7691		- *
7692		- * Action: plugins_loaded
7693	6079	*/
7694		- public function auth_update_check() {
	6080	+ function auth_update_check() {
7695	6081	// Get current version.
7696	6082	$needs_updating = false;
7697	6083	if ( is_multisite() ) {
7698		- $auth_version = get_blog_option( $this->current_site_blog_id, 'auth_version' );
	6084	+ $auth_version = get_blog_option( BLOG_ID_CURRENT_SITE, 'auth_version' );
7699	6085	} else {
7700	6086	$auth_version = get_option( 'auth_version' );
7701	6087	}
7702	6088
		@@ -7708,9 +6094,9 @@
7708	6094	// log in; approved and blocked lists are changed whenever an admin
7709	6095	// changes them from the multisite panel, the dashboard widget, or
7710	6096	// the plugin options page.
7711	6097	$update_if_older_than = 20140709;
7712		- if ( false === $auth_version || intval( $auth_version ) < $update_if_older_than ) {
	6098	+ if ( $auth_version === false || intval( $auth_version ) < $update_if_older_than ) {
7713	6099	// Copy single site user lists to new options (if they exist).
7714	6100	$auth_settings = get_option( 'auth_settings' );
7715	6101	if ( is_array( $auth_settings ) && array_key_exists( 'access_users_pending', $auth_settings ) ) {
7716	6102	update_option( 'auth_settings_access_users_pending', $auth_settings['access_users_pending'] );
		@@ -7728,27 +6114,27 @@
7728	6114	update_option( 'auth_settings', $auth_settings );
7729	6115	}
7730	6116	// Copy multisite user lists to new options (if they exist).
7731	6117	if ( is_multisite() ) {
7732		- $auth_multisite_settings = get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings', array() );
	6118	+ $auth_multisite_settings = get_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings', array() );
7733	6119	if ( is_array( $auth_multisite_settings ) && array_key_exists( 'access_users_pending', $auth_multisite_settings ) ) {
7734		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_pending', $auth_multisite_settings['access_users_pending'] );
	6120	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_pending', $auth_multisite_settings['access_users_pending'] );
7735	6121	unset( $auth_multisite_settings['access_users_pending'] );
7736		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings', $auth_multisite_settings );
	6122	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings', $auth_multisite_settings );
7737	6123	}
7738	6124	if ( is_array( $auth_multisite_settings ) && array_key_exists( 'access_users_approved', $auth_multisite_settings ) ) {
7739		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings['access_users_approved'] );
	6125	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings['access_users_approved'] );
7740	6126	unset( $auth_multisite_settings['access_users_approved'] );
7741		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings', $auth_multisite_settings );
	6127	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings', $auth_multisite_settings );
7742	6128	}
7743	6129	if ( is_array( $auth_multisite_settings ) && array_key_exists( 'access_users_blocked', $auth_multisite_settings ) ) {
7744		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_blocked', $auth_multisite_settings['access_users_blocked'] );
	6130	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_blocked', $auth_multisite_settings['access_users_blocked'] );
7745	6131	unset( $auth_multisite_settings['access_users_blocked'] );
7746		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings', $auth_multisite_settings );
	6132	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings', $auth_multisite_settings );
7747	6133	}
7748	6134	}
7749	6135	// Update version to reflect this change has been made.
7750		- $auth_version = $update_if_older_than;
	6136	+ $auth_version = $update_if_older_than;
7751	6137	$needs_updating = true;
7752	6138	}
7753	6139
7754	6140	// Update: Set default values for newly added options (forgot to do
		@@ -7754,13 +6140,12 @@
7754	6140	// Update: Set default values for newly added options (forgot to do
7755	6141	// this, so some users are getting debug log notices about undefined
7756	6142	// indexes in $auth_settings).
7757	6143	$update_if_older_than = 20160831;
7758		- if ( false === $auth_version || intval( $auth_version ) < $update_if_older_than ) {
	6144	+ if ( $auth_version === false || intval( $auth_version ) < $update_if_older_than ) {
7759	6145	// Provide default values for any $auth_settings options that don't exist.
7760	6146	if ( is_multisite() ) {
7761		- // Get all blog ids.
7762		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
	6147	+ // Get all blog ids
7763	6148	$sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
7764	6149	foreach ( $sites as $site ) {
7765	6150	$blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
7766	6151	switch_to_blog( $blog_id );
		@@ -7765,9 +6150,9 @@
7765	6150	$blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
7766	6151	switch_to_blog( $blog_id );
7767	6152	// Set meaningful defaults for other sites in the network.
7768	6153	$this->set_default_options();
7769		- // Switch back to original blog.
	6154	+ // Switch back to original blog. See: https://codex.wordpress.org/Function_Reference/restore_current_blog
7770	6155	restore_current_blog();
7771	6156	}
7772	6157	} else {
7773	6158	// Set meaningful defaults for this site.
		@@ -7773,9 +6158,9 @@
7773	6158	// Set meaningful defaults for this site.
7774	6159	$this->set_default_options();
7775	6160	}
7776	6161	// Update version to reflect this change has been made.
7777		- $auth_version = $update_if_older_than;
	6162	+ $auth_version = $update_if_older_than;
7778	6163	$needs_updating = true;
7779	6164	}
7780	6165
7781	6166	// Update: Migrate LDAP passwords encrypted with mcrypt since mcrypt is
		@@ -7780,18 +6165,17 @@
7780	6165
7781	6166	// Update: Migrate LDAP passwords encrypted with mcrypt since mcrypt is
7782	6167	// deprecated as of PHP 7.1. Use openssl library instead.
7783	6168	$update_if_older_than = 20170510;
7784		- if ( false === $auth_version || intval( $auth_version ) < $update_if_older_than ) {
	6169	+ if ( $auth_version === false || intval( $auth_version ) < $update_if_older_than ) {
7785	6170	if ( is_multisite() ) {
7786	6171	// Reencrypt LDAP passwords in each site in the network.
7787		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
7788	6172	$sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
7789	6173	foreach ( $sites as $site ) {
7790		- $blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
	6174	+ $blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
7791	6175	$auth_settings = get_blog_option( $blog_id, 'auth_settings', array() );
7792	6176	if ( array_key_exists( 'ldap_password', $auth_settings ) && strlen( $auth_settings['ldap_password'] ) > 0 ) {
7793		- $plaintext_ldap_password = $this->decrypt( $auth_settings['ldap_password'], 'mcrypt' );
	6177	+ $plaintext_ldap_password = $this->decrypt( $auth_settings['ldap_password'], 'mcrypt' );
7794	6178	$auth_settings['ldap_password'] = $this->encrypt( $plaintext_ldap_password );
7795	6179	update_blog_option( $blog_id, 'auth_settings', $auth_settings );
7796	6180	}
7797	6181	}
		@@ -7798,15 +6182,15 @@
7798	6182	} else {
7799	6183	// Reencrypt LDAP password on this single-site install.
7800	6184	$auth_settings = get_option( 'auth_settings', array() );
7801	6185	if ( array_key_exists( 'ldap_password', $auth_settings ) && strlen( $auth_settings['ldap_password'] ) > 0 ) {
7802		- $plaintext_ldap_password = $this->decrypt( $auth_settings['ldap_password'], 'mcrypt' );
	6186	+ $plaintext_ldap_password = $this->decrypt( $auth_settings['ldap_password'], 'mcrypt' );
7803	6187	$auth_settings['ldap_password'] = $this->encrypt( $plaintext_ldap_password );
7804	6188	update_option( 'auth_settings', $auth_settings );
7805	6189	}
7806	6190	}
7807	6191	// Update version to reflect this change has been made.
7808		- $auth_version = $update_if_older_than;
	6192	+ $auth_version = $update_if_older_than;
7809	6193	$needs_updating = true;
7810	6194	}
7811	6195
7812	6196	// Update: Migrate LDAP passwords encrypted with mcrypt since mcrypt is
		@@ -7812,20 +6196,20 @@
7812	6196	// Update: Migrate LDAP passwords encrypted with mcrypt since mcrypt is
7813	6197	// deprecated as of PHP 7.1. Use openssl library instead.
7814	6198	// Note: Forgot to update the auth_multisite_settings ldap password! Do it here.
7815	6199	$update_if_older_than = 20170511;
7816		- if ( false === $auth_version || intval( $auth_version ) < $update_if_older_than ) {
	6200	+ if ( $auth_version === false || intval( $auth_version ) < $update_if_older_than ) {
7817	6201	if ( is_multisite() ) {
7818	6202	// Reencrypt LDAP password in network (multisite) options.
7819		- $auth_multisite_settings = get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings', array() );
	6203	+ $auth_multisite_settings = get_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings', array() );
7820	6204	if ( array_key_exists( 'ldap_password', $auth_multisite_settings ) && strlen( $auth_multisite_settings['ldap_password'] ) > 0 ) {
7821		- $plaintext_ldap_password = $this->decrypt( $auth_multisite_settings['ldap_password'], 'mcrypt' );
	6205	+ $plaintext_ldap_password = $this->decrypt( $auth_multisite_settings['ldap_password'], 'mcrypt' );
7822	6206	$auth_multisite_settings['ldap_password'] = $this->encrypt( $plaintext_ldap_password );
7823		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings', $auth_multisite_settings );
	6207	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings', $auth_multisite_settings );
7824	6208	}
7825	6209	}
7826	6210	// Update version to reflect this change has been made.
7827		- $auth_version = $update_if_older_than;
	6211	+ $auth_version = $update_if_older_than;
7828	6212	$needs_updating = true;
7829	6213	}
7830	6214
7831	6215	// Update: Remove duplicates from approved list caused by authorizer_automatically_approve_login
		@@ -7831,24 +6215,23 @@
7831	6215	// Update: Remove duplicates from approved list caused by authorizer_automatically_approve_login
7832	6216	// filter not respecting users who are already in the approved list
7833	6217	// (causing them to get re-added each time they logged in).
7834	6218	$update_if_older_than = 20170711;
7835		- if ( false === $auth_version || intval( $auth_version ) < $update_if_older_than ) {
	6219	+ if ( $auth_version === false || intval( $auth_version ) < $update_if_older_than ) {
7836	6220	// Remove duplicates from approved user lists.
7837	6221	if ( is_multisite() ) {
7838		- // Remove duplicates from each site in the multisite.
7839		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
	6222	+ // Remove duplicates from each site in the multisite
7840	6223	$sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
7841	6224	foreach ( $sites as $site ) {
7842		- $blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
	6225	+ $blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
7843	6226	$auth_settings_access_users_approved = get_blog_option( $blog_id, 'auth_settings_access_users_approved', array() );
7844	6227	if ( is_array( $auth_settings_access_users_approved ) ) {
7845		- $should_update = false;
	6228	+ $should_update = false;
7846	6229	$distinct_emails = array();
7847	6230	foreach ( $auth_settings_access_users_approved as $key => $user ) {
7848		- if ( in_array( $user['email'], $distinct_emails, true ) ) {
	6231	+ if ( in_array( $user['email'], $distinct_emails ) ) {
7849	6232	$should_update = true;
7850		- unset( $auth_settings_access_users_approved[ $key ] );
	6233	+ unset( $auth_settings_access_users_approved[$key] );
7851	6234	} else {
7852	6235	$distinct_emails[] = $user['email'];
7853	6236	}
7854	6237	}
		@@ -7857,22 +6240,22 @@
7857	6240	}
7858	6241	}
7859	6242	}
7860	6243	// Remove duplicates from multisite approved user list.
7861		- $auth_multisite_settings_access_users_approved = get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', array() );
	6244	+ $auth_multisite_settings_access_users_approved = get_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', array() );
7862	6245	if ( is_array( $auth_multisite_settings_access_users_approved ) ) {
7863		- $should_update = false;
	6246	+ $should_update = false;
7864	6247	$distinct_emails = array();
7865	6248	foreach ( $auth_multisite_settings_access_users_approved as $key => $user ) {
7866		- if ( in_array( $user['email'], $distinct_emails, true ) ) {
	6249	+ if ( in_array( $user['email'], $distinct_emails ) ) {
7867	6250	$should_update = true;
7868		- unset( $auth_multisite_settings_access_users_approved[ $key ] );
	6251	+ unset( $auth_multisite_settings_access_users_approved[$key] );
7869	6252	} else {
7870	6253	$distinct_emails[] = $user['email'];
7871	6254	}
7872	6255	}
7873	6256	if ( $should_update ) {
7874		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
	6257	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
7875	6258	}
7876	6259	}
7877	6260	} else {
7878	6261	// Remove duplicates from single site approved user list.
		@@ -7877,14 +6260,14 @@
7877	6260	} else {
7878	6261	// Remove duplicates from single site approved user list.
7879	6262	$auth_settings_access_users_approved = get_option( 'auth_settings_access_users_approved' );
7880	6263	if ( is_array( $auth_settings_access_users_approved ) ) {
7881		- $should_update = false;
	6264	+ $should_update = false;
7882	6265	$distinct_emails = array();
7883	6266	foreach ( $auth_settings_access_users_approved as $key => $user ) {
7884		- if ( in_array( $user['email'], $distinct_emails, true ) ) {
	6267	+ if ( in_array( $user['email'], $distinct_emails ) ) {
7885	6268	$should_update = true;
7886		- unset( $auth_settings_access_users_approved[ $key ] );
	6269	+ unset( $auth_settings_access_users_approved[$key] );
7887	6270	} else {
7888	6271	$distinct_emails[] = $user['email'];
7889	6272	}
7890	6273	}
		@@ -7893,90 +6276,24 @@
7893	6276	}
7894	6277	}
7895	6278	}
7896	6279	// Update version to reflect this change has been made.
7897		- $auth_version = $update_if_older_than;
	6280	+ $auth_version = $update_if_older_than;
7898	6281	$needs_updating = true;
7899	6282	}
7900	6283
7901		- // Update: Set default value for newly added option advanced_widget_enabled.
7902		- $update_if_older_than = 20171023;
7903		- if ( false === $auth_version || intval( $auth_version ) < $update_if_older_than ) {
7904		- // Provide default values for any $auth_settings options that don't exist.
7905		- if ( is_multisite() ) {
7906		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
7907		- $sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
7908		- foreach ( $sites as $site ) {
7909		- $blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
7910		- switch_to_blog( $blog_id );
7911		- $this->set_default_options();
7912		- restore_current_blog();
7913		- }
7914		- } else {
7915		- $this->set_default_options();
7916		- }
7917		- // Update version to reflect this change has been made.
7918		- $auth_version = $update_if_older_than;
7919		- $needs_updating = true;
7920		- }
	6284	+ // // Update: TEMPLATE
	6285	+ // $update_if_older_than = YYYYMMDD;
	6286	+ // if ( $auth_version === false || intval( $auth_version ) < $update_if_older_than ) {
	6287	+ // UPDATE CODE HERE
	6288	+ // // Update version to reflect this change has been made.
	6289	+ // $auth_version = $update_if_older_than;
	6290	+ // $needs_updating = true;
	6291	+ // }
7921	6292
7922		- // Update: Set default value for newly added option advanced_users_per_page.
7923		- $update_if_older_than = 20171215;
7924		- if ( false === $auth_version || intval( $auth_version ) < $update_if_older_than ) {
7925		- // Provide default values for any $auth_settings options that don't exist.
7926		- if ( is_multisite() ) {
7927		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
7928		- $sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
7929		- foreach ( $sites as $site ) {
7930		- $blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
7931		- switch_to_blog( $blog_id );
7932		- $this->set_default_options();
7933		- restore_current_blog();
7934		- }
7935		- } else {
7936		- $this->set_default_options();
7937		- }
7938		- // Update version to reflect this change has been made.
7939		- $auth_version = $update_if_older_than;
7940		- $needs_updating = true;
7941		- }
7942		-
7943		- // Update: Set default value for newly added options advanced_users_sort_by and advanced_users_sort_order.
7944		- $update_if_older_than = 20171219;
7945		- if ( false === $auth_version || intval( $auth_version ) < $update_if_older_than ) {
7946		- // Provide default values for any $auth_settings options that don't exist.
7947		- if ( is_multisite() ) {
7948		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
7949		- $sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
7950		- foreach ( $sites as $site ) {
7951		- $blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
7952		- switch_to_blog( $blog_id );
7953		- $this->set_default_options();
7954		- restore_current_blog();
7955		- }
7956		- } else {
7957		- $this->set_default_options();
7958		- }
7959		- // Update version to reflect this change has been made.
7960		- $auth_version = $update_if_older_than;
7961		- $needs_updating = true;
7962		- }
7963		-
7964		- /*
7965		- // Update: TEMPLATE
7966		- $update_if_older_than = YYYYMMDD;
7967		- if ( $auth_version === false || intval( $auth_version ) < $update_if_older_than ) {
7968		- UPDATE CODE HERE
7969		- // Update version to reflect this change has been made.
7970		- $auth_version = $update_if_older_than;
7971		- $needs_updating = true;
7972		- }
7973		- */
7974		-
7975	6293	// Save new version number if we performed any updates.
7976	6294	if ( $needs_updating ) {
7977	6295	if ( is_multisite() ) {
7978		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
7979	6296	$sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
7980	6297	foreach ( $sites as $site ) {
7981	6298	$blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
7982	6299	update_blog_option( $blog_id, 'auth_version', $auth_version );