← All changes | authorizer.php +2141 -4268 2.8.8 → 2.6.7 View file →

		@@ -1,31 +1,51 @@
1	1	<?php
2		-/**
3		- * Plugin Name: Authorizer
4		- * Description: Authorizer limits login attempts, restricts access to specified users, and authenticates against external sources (e.g., Google, LDAP, or CAS).
5		- * Author: Paul Ryan <prar@hawaii.edu>
6		- * Plugin URI: https://github.com/uhm-coe/authorizer
7		- * Text Domain: authorizer
8		- * Domain Path: /languages
9		- * License: GPL2
10		- * Version: 2.8.8
11		- *
12		- * @package authorizer
13		- */
	2	+/*
	3	+Plugin Name: Authorizer
	4	+Plugin URI: https://github.com/uhm-coe/authorizer
	5	+Description: Authorizer limits login attempts, restricts access to specified users, and authenticates against external sources (e.g., Google, LDAP, or CAS).
	6	+Version: 2.6.7
	7	+Author: Paul Ryan
	8	+Author URI: http://www.linkedin.com/in/paulrryan/
	9	+Text Domain: authorizer
	10	+Domain Path: /languages
	11	+License: GPL2
	12	+*/
14	13
15		-/**
16		- * Portions forked from Restricted Site Access plugin: http://wordpress.org/plugins/restricted-site-access/
17		- * Portions forked from wpCAS plugin: http://wordpress.org/extend/plugins/cas-authentication/
18		- * Portions forked from Limit Login Attempts: http://wordpress.org/plugins/limit-login-attempts/
19		- */
20	14
21		-/**
22		- * Add phpCAS library if it's not included.
23		- *
24		- * @see https://wiki.jasig.org/display/CASC/phpCAS+installation+guide
25		- */
	15	+/*
	16	+Copyright 2014 Paul Ryan (email: prar@hawaii.edu)
	17	+
	18	+This program is free software; you can redistribute it and/or modify
	19	+it under the terms of the GNU General Public License, version 2, as
	20	+published by the Free Software Foundation.
	21	+
	22	+This program is distributed in the hope that it will be useful,
	23	+but WITHOUT ANY WARRANTY; without even the implied warranty of
	24	+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	25	+GNU General Public License for more details.
	26	+
	27	+You should have received a copy of the GNU General Public License
	28	+along with this program; if not, write to the Free Software
	29	+Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
	30	+*/
	31	+
	32	+
	33	+/*
	34	+Portions forked from Restricted Site Access plugin: http://wordpress.org/plugins/restricted-site-access/
	35	+Portions forked from wpCAS plugin: http://wordpress.org/extend/plugins/cas-authentication/
	36	+Portions forked from Limit Login Attempts: http://wordpress.org/plugins/limit-login-attempts/
	37	+*/
	38	+
	39	+
	40	+define( 'MULTISITE_ADMIN', 'multisite_admin' );
	41	+define( 'SINGLE_ADMIN', 'single_admin' );
	42	+
	43	+
	44	+// Add phpCAS library if it's not included.
	45	+// @see https://wiki.jasig.org/display/CASC/phpCAS+installation+guide
26	46	if ( ! defined( 'PHPCAS_VERSION' ) ) {
27		- require_once dirname( __FILE__ ) . '/vendor/phpCAS-1.3.6/CAS.php';
	47	+ require_once dirname( __FILE__ ) . '/vendor/CAS-1.3.4/CAS.php';
28	48	}
29	49
30	50
31	51	if ( ! class_exists( 'WP_Plugin_Authorizer' ) ) {
		@@ -39,87 +59,18 @@
39	59	* @link http://hawaii.edu/coe/dcdc/wordpress/authorizer/doc/
40	60	*/
41	61	class WP_Plugin_Authorizer {
42	62
43		- /**
44		- * Constants for determining our admin context (network or individual site).
45		- */
46		- const NETWORK_CONTEXT = 'multisite_admin';
47		- const SINGLE_CONTEXT = 'single_admin';
48	63
49	64	/**
50		- * Current site ID (Multisite).
51		- *
52		- * @var string
53		- */
54		- public $current_site_blog_id = 1;
55		-
56		- /**
57		- * HTML allowed when rendering translatable strings in the Authorizer UI.
58		- * This is passed to wp_kses() when sanitizing HMTL strings.
59		- *
60		- * @var array
61		- */
62		- private $allowed_html = array(
63		- 'a' => array(
64		- 'class' => array(),
65		- 'href' => array(),
66		- 'style' => array(),
67		- 'target' => array(),
68		- 'title' => array(),
69		- ),
70		- 'b' => array(),
71		- 'br' => array(),
72		- 'div' => array(
73		- 'class' => array(),
74		- ),
75		- 'em' => array(),
76		- 'hr' => array(),
77		- 'i' => array(),
78		- 'input' => array(
79		- 'aria-describedby' => array(),
80		- 'class' => array(),
81		- 'id' => array(),
82		- 'name' => array(),
83		- 'size' => array(),
84		- 'type' => array(),
85		- 'value' => array(),
86		- ),
87		- 'label' => array(
88		- 'class' => array(),
89		- 'for' => array(),
90		- ),
91		- 'p' => array(
92		- 'style' => array(),
93		- ),
94		- 'span' => array(
95		- 'aria-hidden' => array(),
96		- 'class' => array(),
97		- 'id' => array(),
98		- 'style' => array(),
99		- ),
100		- 'strong' => array(),
101		- );
102		-
103		- /**
104	65	* Constructor.
105	66	*/
106	67	public function __construct() {
107		- // Save reference to current blog id in the network (support deprecated
108		- // constant BLOGID_CURRENT_SITE).
109		- if ( defined( 'BLOG_ID_CURRENT_SITE' ) ) {
110		- $this->current_site_blog_id = BLOG_ID_CURRENT_SITE;
111		- } elseif ( defined( 'BLOGID_CURRENT_SITE' ) ) { // deprecated.
112		- $this->current_site_blog_id = BLOGID_CURRENT_SITE;
113		- }
114		-
115	68	// Installation and uninstallation hooks.
116	69	register_activation_hook( __FILE__, array( $this, 'activate' ) );
117	70	register_deactivation_hook( __FILE__, array( $this, 'deactivate' ) );
118	71
119		- /**
120		- * Register filters.
121		- */
	72	+ // Register filters.
122	73
123	74	// Custom wp authentication routine using external service.
124	75	add_filter( 'authenticate', array( $this, 'custom_authenticate' ), 1, 3 );
125	76
		@@ -125,9 +76,13 @@
125	76
126	77	// Custom logout action using external service.
127	78	add_action( 'wp_logout', array( $this, 'custom_logout' ) );
128	79
129		- // Create settings link on Plugins page.
	80	+ // Removing this bypasses Wordpress authentication (so if external auth fails,
	81	+ // no one can log in); with it enabled, it will run if external auth fails.
	82	+ //remove_filter('authenticate', 'wp_authenticate_username_password', 20, 3);
	83	+
	84	+ // Create settings link on Plugins page
130	85	add_filter( 'plugin_action_links_' . plugin_basename( __FILE__ ), array( $this, 'plugin_settings_link' ) );
131	86	add_filter( 'network_admin_plugin_action_links_' . plugin_basename( __FILE__ ), array( $this, 'network_admin_plugin_settings_link' ) );
132	87
133	88	// Modify login page with a custom password url (if option is set).
		@@ -138,11 +93,9 @@
138	93	if ( $error && strlen( $error ) > 0 ) {
139	94	add_filter( 'login_errors', array( $this, 'show_advanced_login_error' ) );
140	95	}
141	96
142		- /**
143		- * Register actions.
144		- */
	97	+ // Register actions.
145	98
146	99	// Enable localization. Translation files stored in /languages.
147	100	add_action( 'plugins_loaded', array( $this, 'load_textdomain' ) );
148	101
		@@ -154,20 +107,18 @@
154	107
155	108	// Add users who successfully login to the approved list.
156	109	add_action( 'wp_login', array( $this, 'ensure_wordpress_user_in_approved_list_on_login' ), 10, 2 );
157	110
158		- // Create menu item in Settings.
	111	+ // Create menu item in Settings
159	112	add_action( 'admin_menu', array( $this, 'add_plugin_page' ) );
160	113
161		- // Create options page.
	114	+ // Create options page
162	115	add_action( 'admin_init', array( $this, 'page_init' ) );
163	116
164	117	// Update user role in approved list if it's changed in the WordPress edit user page.
165		- add_action( 'user_profile_update_errors', array( $this, 'edit_user_profile_update_role' ), 10, 3 );
	118	+ add_action( 'edit_user_profile_update', array( $this, 'edit_user_profile_update_role' ) );
	119	+ add_action( 'personal_options_update', array( $this, 'edit_user_profile_update_role' ) );
166	120
167		- // Update user email in approved list if it's changed in the WordPress edit user page.
168		- add_filter( 'send_email_change_email', array( $this, 'edit_user_profile_update_email' ), 10, 3 );
169		-
170	121	// Enqueue javascript and css on the plugin's options page, the
171	122	// dashboard (for the widget), and the network admin.
172	123	add_action( 'load-settings_page_authorizer', array( $this, 'load_options_page' ) );
173	124	add_action( 'admin_head-index.php', array( $this, 'load_options_page' ) );
		@@ -172,46 +123,35 @@
172	123	add_action( 'load-settings_page_authorizer', array( $this, 'load_options_page' ) );
173	124	add_action( 'admin_head-index.php', array( $this, 'load_options_page' ) );
174	125	add_action( 'load-toplevel_page_authorizer', array( $this, 'load_options_page' ) );
175	126
176		- // Add custom css and js to wp-login.php.
	127	+ // Add custom css and js to wp-login.php
177	128	add_action( 'login_enqueue_scripts', array( $this, 'login_enqueue_scripts_and_styles' ) );
178	129	add_action( 'login_footer', array( $this, 'load_login_footer_js' ) );
179	130
180		- // Create google nonce cookie when loading wp-login.php if Google is enabled.
181		- add_action( 'login_init', array( $this, 'login_init__maybe_set_google_nonce_cookie' ) );
182		-
183		- // Modify login page with external auth links (if enabled; e.g., google or cas).
	131	+ // Modify login page with external auth links (if enabled; e.g., google or cas)
184	132	add_action( 'login_form', array( $this, 'login_form_add_external_service_links' ) );
185	133
186	134	// Redirect to CAS login when visiting login page (only if option is
187	135	// enabled, CAS is the only service, and WordPress logins are hidden).
188		- // Note: hook into wp_login_errors filter so this fires after the
189		- // authenticate hook (where the redirect to CAS happens), but before html
190		- // output is started (so the redirect header doesn't complain about data
191		- // already being sent).
192		- add_filter( 'wp_login_errors', array( $this, 'wp_login_errors__maybe_redirect_to_cas' ), 10, 2 );
	136	+ add_action( 'login_head', array( $this, 'login_head_maybe_redirect_to_cas' ) );
193	137
194		- // Verify current user has access to page they are visiting.
	138	+ // Verify current user has access to page they are visiting
195	139	add_action( 'parse_request', array( $this, 'restrict_access' ), 9 );
196		- add_action( 'init', array( $this, 'init__maybe_add_network_approved_user' ) );
197	140
198		- // AJAX: Save options from dashboard widget.
	141	+ // ajax save options from dashboard widget
199	142	add_action( 'wp_ajax_update_auth_user', array( $this, 'ajax_update_auth_user' ) );
200	143
201		- // AJAX: Save options from multisite options page.
	144	+ // ajax save options from multisite options page
202	145	add_action( 'wp_ajax_save_auth_multisite_settings', array( $this, 'ajax_save_auth_multisite_settings' ) );
203	146
204		- // AJAX: Save usermeta from options page.
	147	+ // ajax save usermeta from options page
205	148	add_action( 'wp_ajax_update_auth_usermeta', array( $this, 'ajax_update_auth_usermeta' ) );
206	149
207		- // AJAX: Verify google login.
	150	+ // ajax verify google login
208	151	add_action( 'wp_ajax_process_google_login', array( $this, 'ajax_process_google_login' ) );
209	152	add_action( 'wp_ajax_nopriv_process_google_login', array( $this, 'ajax_process_google_login' ) );
210	153
211		- // AJAX: Refresh approved user list.
212		- add_action( 'wp_ajax_refresh_approved_user_list', array( $this, 'ajax_refresh_approved_user_list' ) );
213		-
214	154	// Add dashboard widget so instructors can add/edit users with access.
215	155	// Hint: For Multisite Network Admin Dashboard use wp_network_dashboard_setup instead of wp_dashboard_setup.
216	156	add_action( 'wp_dashboard_setup', array( $this, 'add_dashboard_widgets' ) );
217	157
		@@ -226,12 +166,17 @@
226	166	add_action( 'wp_enqueue_scripts', array( $this, 'auth_public_scripts' ), 20 );
227	167
228	168	// Multisite-specific actions.
229	169	if ( is_multisite() ) {
230		- // Add network admin options page (global settings for all sites).
	170	+ // Add network admin options page (global settings for all sites)
231	171	add_action( 'network_admin_menu', array( $this, 'network_admin_menu' ) );
232	172	}
233	173
	174	+ // Create login cookie (used by google login)
	175	+ if ( ! isset( $_COOKIE['login_unique'] ) ) {
	176	+ setcookie( 'login_unique', $this->get_cookie_value(), time()+1800, '/', defined( 'COOKIE_DOMAIN' ) ? COOKIE_DOMAIN : '' );
	177	+ }
	178	+
234	179	// Remove user from authorizer lists when that user is deleted in WordPress.
235	180	add_action( 'delete_user', array( $this, 'remove_user_from_authorizer_when_deleted' ) );
236	181	if ( is_multisite() ) {
237	182	// Remove multisite user from authorizer lists when that user is deleted from Network Users.
		@@ -264,20 +209,16 @@
264	209	* Will also activate the plugin for all sites/blogs if this is a "Network enable."
265	210	*
266	211	* @return void
267	212	*/
268		- public function activate( $network_wide ) {
	213	+ public function activate() {
269	214	global $wpdb;
270	215
271		- // If we're in a multisite environment, run the plugin activation for each
272		- // site when network enabling.
273		- // Note: wp-cli does not use nonces, so we skip the nonce check here to
274		- // allow the "wp plugin activate authorizer" command.
275		- // phpcs:ignore WordPress.CSRF.NonceVerification.NoNonceVerification
276		- if ( is_multisite() && $network_wide ) {
	216	+ // If we're in a multisite environment, run the plugin activation for each site when network enabling
	217	+ if ( is_multisite() && isset( $_GET['networkwide'] ) && $_GET['networkwide'] == 1 ) {
277	218
278	219	// Add super admins to the multisite approved list.
279		- $auth_multisite_settings_access_users_approved = get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', array() );
	220	+ $auth_multisite_settings_access_users_approved = get_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', array() );
280	221	$should_update_auth_multisite_settings_access_users_approved = false;
281	222	foreach ( get_super_admins() as $super_admin ) {
282	223	$user = get_user_by( 'login', $super_admin );
283	224	// Add to approved list if not there.
		@@ -282,10 +223,10 @@
282	223	$user = get_user_by( 'login', $super_admin );
283	224	// Add to approved list if not there.
284	225	if ( ! $this->in_multi_array( $user->user_email, $auth_multisite_settings_access_users_approved ) ) {
285	226	$approved_user = array(
286		- 'email' => $this->lowercase( $user->user_email ),
287		- 'role' => count( $user->roles ) > 0 ? $user->roles[0] : 'administrator',
	227	+ 'email' => $user->user_email,
	228	+ 'role' => count( $user->roles ) > 0 ? $user->roles[0] : 'administrator',
288	229	'date_added' => date( 'M Y', strtotime( $user->user_registered ) ),
289	230	'local_user' => true,
290	231	);
291	232	array_push( $auth_multisite_settings_access_users_approved, $approved_user );
		@@ -292,14 +233,13 @@
292	233	$should_update_auth_multisite_settings_access_users_approved = true;
293	234	}
294	235	}
295	236	if ( $should_update_auth_multisite_settings_access_users_approved ) {
296		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
	237	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
297	238	}
298	239
299	240	// Run plugin activation on each site in the network.
300	241	$current_blog_id = $wpdb->blogid;
301		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
302	242	$sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
303	243	foreach ( $sites as $site ) {
304	244	$blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
305	245	switch_to_blog( $blog_id );
		@@ -328,13 +268,13 @@
328	268	* @return void
329	269	*/
330	270	private function add_wp_users_to_approved_list() {
331	271	// Add current WordPress users to the approved list.
332		- $auth_multisite_settings_access_users_approved = is_multisite() ? get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', array() ) : array();
333		- $auth_settings_access_users_pending = $this->get_plugin_option( 'access_users_pending', WP_Plugin_Authorizer::SINGLE_CONTEXT );
334		- $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT );
335		- $auth_settings_access_users_blocked = $this->get_plugin_option( 'access_users_blocked', WP_Plugin_Authorizer::SINGLE_CONTEXT );
336		- $updated = false;
	272	+ $auth_multisite_settings_access_users_approved = is_multisite() ? get_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', array() ) : array();
	273	+ $auth_settings_access_users_pending = $this->get_plugin_option( 'access_users_pending', SINGLE_ADMIN );
	274	+ $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN );
	275	+ $auth_settings_access_users_blocked = $this->get_plugin_option( 'access_users_blocked', SINGLE_ADMIN );
	276	+ $updated = false;
337	277	foreach ( get_users() as $user ) {
338	278	// Skip if user is in blocked list.
339	279	if ( $this->in_multi_array( $user->user_email, $auth_settings_access_users_blocked ) ) {
340	280	continue;
		@@ -340,10 +280,10 @@
340	280	continue;
341	281	}
342	282	// Remove from pending list if there.
343	283	foreach ( $auth_settings_access_users_pending as $key => $pending_user ) {
344		- if ( 0 === strcasecmp( $pending_user['email'], $user->user_email ) ) {
345		- unset( $auth_settings_access_users_pending[ $key ] );
	284	+ if ( $pending_user['email'] == $user->user_email ) {
	285	+ unset( $auth_settings_access_users_pending[$key] );
346	286	$updated = true;
347	287	}
348	288	}
349	289	// Skip if user is in multisite approved list.
		@@ -352,10 +292,10 @@
352	292	}
353	293	// Add to approved list if not there.
354	294	if ( ! $this->in_multi_array( $user->user_email, $auth_settings_access_users_approved ) ) {
355	295	$approved_user = array(
356		- 'email' => $this->lowercase( $user->user_email ),
357		- 'role' => count( $user->roles ) > 0 ? $user->roles[0] : '',
	296	+ 'email' => $user->user_email,
	297	+ 'role' => count( $user->roles ) > 0 ? $user->roles[0] : '',
358	298	'date_added' => date( 'M Y', strtotime( $user->user_registered ) ),
359	299	'local_user' => true,
360	300	);
361	301	array_push( $auth_settings_access_users_approved, $approved_user );
		@@ -390,14 +330,13 @@
390	330
391	331	/**
392	332	* Authenticate against an external service.
393	333	*
394		- * Filter: authenticate
395		- *
396		- * @param WP_User $user user to authenticate.
	334	+ * @param WP_User $user user to authenticate
397	335	* @param string $username optional username to authenticate.
398	336	* @param string $password optional password to authenticate.
399		- * @return WP_User|WP_Error WP_User on success, WP_Error on failure.
	337	+ *
	338	+ * @return WP_User or WP_Error
400	339	*/
401	340	public function custom_authenticate( $user, $username, $password ) {
402	341	// Pass through if already authenticated.
403	342	if ( is_a( $user, 'WP_User' ) ) {
		@@ -405,20 +344,20 @@
405	344	} else {
406	345	$user = null;
407	346	}
408	347
409		- // If username and password are blank, this isn't a log in attempt.
	348	+ // If username and password are blank, this isn't a log in attempt
410	349	$is_login_attempt = strlen( $username ) > 0 && strlen( $password ) > 0;
411	350
412	351	// Check to make sure that $username is not locked out due to too
413	352	// many invalid login attempts. If it is, tell the user how much
414	353	// time remains until they can try again.
415		- $unauthenticated_user = $is_login_attempt ? get_user_by( 'login', $username ) : false;
	354	+ $unauthenticated_user = $is_login_attempt ? get_user_by( 'login', $username ) : false;
416	355	$unauthenticated_user_is_blocked = false;
417		- if ( $is_login_attempt && false !== $unauthenticated_user ) {
	356	+ if ( $is_login_attempt && $unauthenticated_user !== false ) {
418	357	$last_attempt = get_user_meta( $unauthenticated_user->ID, 'auth_settings_advanced_lockouts_time_last_failed', true );
419	358	$num_attempts = get_user_meta( $unauthenticated_user->ID, 'auth_settings_advanced_lockouts_failed_attempts', true );
420		- // Also check the auth_blocked user_meta flag (users in blocked list will get this flag).
	359	+ // Also check the auth_blocked user_meta flag (users in blocked list will get this flag)
421	360	$unauthenticated_user_is_blocked = get_user_meta( $unauthenticated_user->ID, 'auth_blocked', true ) === 'yes';
422	361	} else {
423	362	$last_attempt = get_option( 'auth_settings_advanced_lockouts_time_last_failed' );
424	363	$num_attempts = get_option( 'auth_settings_advanced_lockouts_failed_attempts' );
		@@ -432,9 +371,9 @@
432	371	return new WP_Error( 'empty_password', __( '<strong>ERROR</strong>: Incorrect username or password.', 'authorizer' ) );
433	372	}
434	373
435	374	// Grab plugin settings.
436		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
	375	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' );
437	376
438	377	// Make sure $last_attempt (time) and $num_attempts are positive integers.
439	378	// Note: this addresses resetting them if either is unset from above.
440	379	$last_attempt = abs( intval( $last_attempt ) );
		@@ -440,17 +379,17 @@
440	379	$last_attempt = abs( intval( $last_attempt ) );
441	380	$num_attempts = abs( intval( $num_attempts ) );
442	381
443	382	// Create semantic lockout variables.
444		- $lockouts = $auth_settings['advanced_lockouts'];
445		- $time_since_last_fail = time() - $last_attempt;
446		- $reset_duration = $lockouts['reset_duration'] * 60; // minutes to seconds.
447		- $num_attempts_long_lockout = $lockouts['attempts_1'] + $lockouts['attempts_2'];
448		- $num_attempts_short_lockout = $lockouts['attempts_1'];
449		- $seconds_remaining_long_lockout = $lockouts['duration_2'] * 60 - $time_since_last_fail;
	383	+ $lockouts = $auth_settings['advanced_lockouts'];
	384	+ $time_since_last_fail = time() - $last_attempt;
	385	+ $reset_duration = $lockouts['reset_duration'] * 60; // minutes to seconds
	386	+ $num_attempts_long_lockout = $lockouts['attempts_1'] + $lockouts['attempts_2'];
	387	+ $num_attempts_short_lockout = $lockouts['attempts_1'];
	388	+ $seconds_remaining_long_lockout = $lockouts['duration_2'] * 60 - $time_since_last_fail;
450	389	$seconds_remaining_short_lockout = $lockouts['duration_1'] * 60 - $time_since_last_fail;
451	390
452		- // Check if we need to institute a lockout delay.
	391	+ // Check if we need to institute a lockout delay
453	392	if ( $is_login_attempt && $time_since_last_fail > $reset_duration ) {
454	393	// Enough time has passed since the last invalid attempt and
455	394	// now that we can reset the failed attempt count, and let this
456	395	// login attempt go through.
		@@ -463,9 +402,8 @@
463	402	remove_filter( 'authenticate', 'wp_authenticate_username_password', 20, 3 );
464	403	return new WP_Error(
465	404	'empty_password',
466	405	sprintf(
467		- /* TRANSLATORS: 1: username 2: duration of lockout in seconds 3: duration of lockout as a phrase 4: lost password URL */
468	406	__( '<strong>ERROR</strong>: There have been too many invalid login attempts for the username <strong>%1$s</strong>. Please wait <strong id="seconds_remaining" data-seconds="%2$s">%3$s</strong> before trying again. <a href="%4$s" title="Password Lost and Found">Lost your password</a>?', 'authorizer' ),
469	407	$username,
470	408	$seconds_remaining_long_lockout,
471	409	$this->seconds_as_sentence( $seconds_remaining_long_lockout ),
		@@ -480,9 +418,8 @@
480	418	remove_filter( 'authenticate', 'wp_authenticate_username_password', 20, 3 );
481	419	return new WP_Error(
482	420	'empty_password',
483	421	sprintf(
484		- /* TRANSLATORS: 1: username 2: duration of lockout in seconds 3: duration of lockout as a phrase 4: lost password URL */
485	422	__( '<strong>ERROR</strong>: There have been too many invalid login attempts for the username <strong>%1$s</strong>. Please wait <strong id="seconds_remaining" data-seconds="%2$s">%3$s</strong> before trying again. <a href="%4$s" title="Password Lost and Found">Lost your password</a>?', 'authorizer' ),
486	423	$username,
487	424	$seconds_remaining_short_lockout,
488	425	$this->seconds_as_sentence( $seconds_remaining_short_lockout ),
		@@ -492,16 +429,16 @@
492	429	}
493	430
494	431	// Start external authentication.
495	432	$externally_authenticated_emails = array();
496		- $authenticated_by = '';
497		- $result = null;
	433	+ $authenticated_by = '';
	434	+ $result = null;
498	435
499	436	// Try Google authentication if it's enabled and we don't have a
500	437	// successful login yet.
501	438	if (
502		- '1' === $auth_settings['google'] &&
503		- 0 === count( $externally_authenticated_emails ) &&
	439	+ $auth_settings['google'] === '1' &&
	440	+ count( $externally_authenticated_emails ) === 0 &&
504	441	! is_wp_error( $result )
505	442	) {
506	443	$result = $this->custom_authenticate_google( $auth_settings );
507	444	if ( ! is_null( $result ) && ! is_wp_error( $result ) ) {
		@@ -516,10 +453,10 @@
516	453
517	454	// Try CAS authentication if it's enabled and we don't have a
518	455	// successful login yet.
519	456	if (
520		- '1' === $auth_settings['cas'] &&
521		- 0 === count( $externally_authenticated_emails ) &&
	457	+ $auth_settings['cas'] === '1' &&
	458	+ count( $externally_authenticated_emails ) === 0 &&
522	459	! is_wp_error( $result )
523	460	) {
524	461	$result = $this->custom_authenticate_cas( $auth_settings );
525	462	if ( ! is_null( $result ) && ! is_wp_error( $result ) ) {
		@@ -534,10 +471,10 @@
534	471
535	472	// Try LDAP authentication if it's enabled and we don't have an
536	473	// authenticated user yet.
537	474	if (
538		- '1' === $auth_settings['ldap'] &&
539		- 0 === count( $externally_authenticated_emails ) &&
	475	+ $auth_settings['ldap'] === '1' &&
	476	+ count( $externally_authenticated_emails ) === 0 &&
540	477	! is_wp_error( $result )
541	478	) {
542	479	$result = $this->custom_authenticate_ldap( $auth_settings, $username, $password );
543	480	if ( ! is_null( $result ) && ! is_wp_error( $result ) ) {
		@@ -558,46 +495,35 @@
558	495
559	496	// Remove duplicate and blank emails, if any.
560	497	$externally_authenticated_emails = array_filter( array_unique( $externally_authenticated_emails ) );
561	498
562		- /**
563		- * If we've made it this far, we should have an externally
564		- * authenticated user. The following should be set:
565		- * $externally_authenticated_emails
566		- * $authenticated_by
567		- */
	499	+ // If we've made it this far, we should have an externally
	500	+ // authenticated user. The following should be set:
	501	+ // $externally_authenticated_emails
	502	+ // $authenticated_by
568	503
569		- // Look for an existing WordPress account matching the externally
570		- // authenticated user. Perform the match either by username or email.
571		- if ( isset( $auth_settings['cas_link_on_username'] ) && 1 === intval( $auth_settings['cas_link_on_username'] ) ) {
572		- // Get the external user's WordPress account by username. This is less
573		- // secure, but a user reported having an installation where a previous
574		- // CAS plugin had created over 9000 WordPress accounts without email
575		- // addresses. This option was created to support that case, and any
576		- // other CAS servers where emails are not used as account identifiers.
577		- $user = get_user_by( 'login', $result['username']);
578		- } else {
579		- // Get the external user's WordPress account by email address. This is
580		- // the normal behavior (and the most secure).
581		- foreach ( $externally_authenticated_emails as $externally_authenticated_email ) {
582		- $user = get_user_by( 'email', $this->lowercase( $externally_authenticated_email ) );
583		- // Stop trying email addresses once we have found a match.
584		- if ( false !== $user ) {
585		- break;
586		- }
	504	+ // Get the external user's WordPress account by email address.
	505	+ foreach ( $externally_authenticated_emails as $externally_authenticated_email ) {
	506	+ $user = get_user_by( 'email', $externally_authenticated_email );
	507	+
	508	+ // If we've already found a WordPress user associated with one
	509	+ // of the supplied email addresses, don't keep examining other
	510	+ // email addresses associated with the externally authenticated user.
	511	+ if ( $user !== FALSE ) {
	512	+ break;
587	513	}
588	514	}
589	515
590	516	// Check this external user's access against the access lists
591		- // (pending, approved, blocked).
	517	+ // (pending, approved, blocked)
592	518	$result = $this->check_user_access( $user, $externally_authenticated_emails, $result );
593	519
594	520	// Fail with message if there was an error creating/adding the user.
595		- if ( is_wp_error( $result ) || 0 === $result ) {
	521	+ if ( is_wp_error( $result ) || $result === 0 ) {
596	522	return $result;
597	523	}
598	524
599		- // If we have a valid user from check_user_access(), log that user in.
	525	+ // If we created a new user in check_user_access(), log that user in.
600	526	if ( get_class( $result ) === 'WP_User' ) {
601	527	$user = $result;
602	528	}
603	529
		@@ -614,29 +540,27 @@
614	540	/**
615	541	* This function will fail with a wp_die() message to the user if they
616	542	* don't have access.
617	543	*
618		- * @param WP_User $user User to check.
619		- * @param array $user_emails Array of user's plaintext emails (in case current user doesn't have a WP account).
620		- * @param array $user_data Array of keys for email, username, first_name, last_name,
621		- * authenticated_by, google_attributes, cas_attributes, ldap_attributes.
622		- * @return WP_Error|WP_User
623		- * WP_Error if there was an error on user creation / adding user to blog.
624		- * WP_Error / wp_die() if user does not have access.
625		- * WP_User if user has access.
	544	+ * @param WP_User $user User to check
	545	+ * @param [type] $user_emails Array of user's plaintext emails (in case current user doesn't have a WP account)
	546	+ * @param [type] $user_data Array of keys for email, username, first_name, last_name,
	547	+ * authenticated_by, google_attributes, cas_attributes, ldap_attributes.
	548	+ * @return WP_Error if there was an error on user creation / adding user to blog
	549	+ * wp_die() if user does not have access
	550	+ * null if user has access (success)
	551	+ * WP_User if user has access and a new account was created for them
626	552	*/
627	553	private function check_user_access( $user, $user_emails, $user_data = array() ) {
628	554	// Grab plugin settings.
629		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
630		- $auth_settings_access_users_pending = $this->sanitize_user_list(
631		- $this->get_plugin_option( 'access_users_pending', WP_Plugin_Authorizer::SINGLE_CONTEXT )
	555	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' );
	556	+ $auth_settings_access_users_pending = $this->sanitize_user_list(
	557	+ $this->get_plugin_option( 'access_users_pending', SINGLE_ADMIN )
632	558	);
633		- $auth_settings_access_users_approved_single = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT );
634		- $auth_settings_access_users_approved_multi = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT );
635		- $auth_settings_access_users_approved = $this->sanitize_user_list(
	559	+ $auth_settings_access_users_approved = $this->sanitize_user_list(
636	560	array_merge(
637		- $auth_settings_access_users_approved_single,
638		- $auth_settings_access_users_approved_multi
	561	+ $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN ),
	562	+ $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN )
639	563	)
640	564	);
641	565
642	566	/**
		@@ -642,31 +566,28 @@
642	566	/**
643	567	* Filter whether to block the currently logging in user based on any of
644	568	* their user attributes.
645	569	*
646		- * @param bool $allow_login Whether to block the currently logging in user.
	570	+ * @param bool $user_is_blocked Whether to block the currently logging in user.
647	571	* @param array $user_data User data returned from external service.
648	572	*/
649		- $allow_login = apply_filters( 'authorizer_allow_login', true, $user_data );
650		- $blocked_by_filter = ! $allow_login; // Use this for better readability.
	573	+ $allow_login = apply_filters( 'authorizer_allow_login', true, $user_data );
651	574
652	575	// Check our externally authenticated user against the block list.
653	576	// If any of their email addresses are blocked, set the relevant user
654	577	// meta field, and show them an error screen.
655	578	foreach ( $user_emails as $user_email ) {
656		- if ( $blocked_by_filter || $this->is_email_in_list( $user_email, 'blocked' ) ) {
	579	+ if ( ! $allow_login || $this->is_email_in_list( $user_email, 'blocked' ) ) {
657	580
658	581	// Add user to blocked list if it was blocked via the filter.
659		- if ( $blocked_by_filter && ! $this->is_email_in_list( $user_email, 'blocked' ) ) {
	582	+ if ( ! $allow_login && ! $this->is_email_in_list( $user_email, 'blocked' ) ) {
660	583	$auth_settings_access_users_blocked = $this->sanitize_user_list(
661		- $this->get_plugin_option( 'access_users_blocked', WP_Plugin_Authorizer::SINGLE_CONTEXT )
	584	+ $this->get_plugin_option( 'access_users_blocked', SINGLE_ADMIN )
662	585	);
663		- array_push(
664		- $auth_settings_access_users_blocked, array(
665		- 'email' => $this->lowercase( $user_email ),
666		- 'date_added' => date( 'M Y' ),
667		- )
668		- );
	586	+ array_push( $auth_settings_access_users_blocked, array(
	587	+ 'email' => $user_email,
	588	+ 'date_added' => date( 'M Y' ),
	589	+ ));
669	590	update_option( 'auth_settings_access_users_blocked', $auth_settings_access_users_blocked );
670	591	}
671	592
672	593	// If the blocked external user has a WordPress account, mark it as
		@@ -675,11 +596,10 @@
675	596	update_user_meta( $user->ID, 'auth_blocked', 'yes' );
676	597	}
677	598
678	599	// Notify user about blocked status and return without authenticating them.
679		- // phpcs:ignore WordPress.CSRF.NonceVerification.NoNonceVerification
680		- $redirect_to = ! empty( $_REQUEST['redirect_to'] ) ? esc_url_raw( wp_unslash( $_REQUEST['redirect_to'] ) ) : home_url();
681		- $page_title = sprintf(
	600	+ $redirect_to = ! empty( $_REQUEST['redirect_to'] ) ? $_REQUEST['redirect_to'] : home_url();
	601	+ $page_title = sprintf(
682	602	/* TRANSLATORS: %s: Name of blog */
683	603	__( '%s - Access Restricted', 'authorizer' ),
684	604	get_bloginfo( 'name' )
685	605	);
		@@ -690,15 +610,13 @@
690	610	'<a class="button" href="' . wp_logout_url( $redirect_to ) . '">' .
691	611	__( 'Back', 'authorizer' ) .
692	612	'</a></p>';
693	613	update_option( 'auth_settings_advanced_login_error', $error_message );
694		- wp_die( wp_kses( $error_message, $this->allowed_html ), esc_html( $page_title ) );
695		- return new WP_Error( 'invalid_login', __( 'Invalid login attempted.', 'authorizer' ) );
	614	+ wp_die( $error_message, $page_title );
696	615	}
697	616	}
698	617
699		- // Get the default role for this user (or their current role, if they
700		- // already have an account).
	618	+ // Get the default role for this new user.
701	619	$default_role = $user && is_array( $user->roles ) && count( $user->roles ) > 0 ? $user->roles[0] : $auth_settings['access_default_role'];
702	620	/**
703	621	* Filter the role of the user currently logging in. The role will be
704	622	* set to the default (specified in Authorizer options) for new users,
		@@ -703,24 +621,13 @@
703	621	* Filter the role of the user currently logging in. The role will be
704	622	* set to the default (specified in Authorizer options) for new users,
705	623	* or the user's current role for existing users. This filter allows
706	624	* changing user roles based on custom CAS/LDAP attributes.
707		- *
708	625	* @param bool $role Role of the user currently logging in.
709	626	* @param array $user_data User data returned from external service.
710	627	*/
711	628	$approved_role = apply_filters( 'authorizer_custom_role', $default_role, $user_data );
712	629
713		- /**
714		- * Filter whether to automatically approve the currently logging in user
715		- * based on any of their user attributes.
716		- *
717		- * @param bool $automatically_approve_login
718		- * Whether to automatically approve the currently logging in user.
719		- * @param array $user_data User data returned from external service.
720		- */
721		- $automatically_approve_login = apply_filters( 'authorizer_automatically_approve_login', false, $user_data );
722		-
723	630	// Iterate through each of the email addresses provided by the external
724	631	// service and determine if any of them have access.
725	632	$last_email = end( $user_emails );
726	633	reset( $user_emails );
		@@ -730,20 +637,16 @@
730	637	// If this externally authenticated user is an existing administrator
731	638	// (administrator in single site mode, or super admin in network mode),
732	639	// and is not in the blocked list, let them in.
733	640	if ( $user && is_super_admin( $user->ID ) ) {
734		- return $user;
	641	+ return;
735	642	}
736	643
737	644	// If this externally authenticated user isn't in the approved list
738		- // and login access is set to "All authenticated users," or if they were
739		- // automatically approved in the "authorizer_approve_login" filter
740		- // above, then add them to the approved list (they'll get an account
741		- // created below if they don't have one yet).
742		- if (
743		- ! $this->is_email_in_list( $user_email, 'approved' ) &&
744		- ( 'external_users' === $auth_settings['access_who_can_login'] || $automatically_approve_login )
745		- ) {
	645	+ // and login access is set to "All authenticated users," add them
	646	+ // to the approved list (they'll get an account created below if
	647	+ // they don't have one yet).
	648	+ if ( ! $this->is_email_in_list( $user_email, 'approved' ) && $auth_settings['access_who_can_login'] === 'external_users' ) {
746	649	$is_newly_approved_user = true;
747	650
748	651	// If this user happens to be in the pending list (rare),
749	652	// remove them from pending before adding them to approved.
		@@ -748,9 +651,9 @@
748	651	// If this user happens to be in the pending list (rare),
749	652	// remove them from pending before adding them to approved.
750	653	if ( $this->is_email_in_list( $user_email, 'pending' ) ) {
751	654	foreach ( $auth_settings_access_users_pending as $key => $pending_user ) {
752		- if ( 0 === strcasecmp( $pending_user['email'], $user_email ) ) {
	655	+ if ( $pending_user['email'] === $user_email ) {
753	656	unset( $auth_settings_access_users_pending[ $key ] );
754	657	update_option( 'auth_settings_access_users_pending', $auth_settings_access_users_pending );
755	658	break;
756	659	}
		@@ -758,15 +661,14 @@
758	661	}
759	662
760	663	// Add this user to the approved list.
761	664	$approved_user = array(
762		- 'email' => $this->lowercase( $user_email ),
763		- 'role' => $approved_role,
764		- 'date_added' => date( 'Y-m-d H:i:s' ),
	665	+ 'email' => $user_email,
	666	+ 'role' => $approved_role,
	667	+ 'date_added' => date( "Y-m-d H:i:s" ),
765	668	);
766	669	array_push( $auth_settings_access_users_approved, $approved_user );
767		- array_push( $auth_settings_access_users_approved_single, $approved_user );
768		- update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved_single );
	670	+ update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved );
769	671	}
770	672
771	673	// Check our externally authenticated user against the approved
772	674	// list. If they are approved, log them in (and create their account
		@@ -780,10 +682,14 @@
780	682	if ( $default_role !== $approved_role ) {
781	683	$user_info['role'] = $approved_role;
782	684	}
783	685
784		- // If the approved external user does not have a WordPress account, create it.
	686	+ // If the approved external user does not have a WordPress account, create it
785	687	if ( ! $user ) {
	688	+ // If there's already a user with this username (e.g.,
	689	+ // johndoe/johndoe@gmail.com exists, and we're trying to add
	690	+ // johndoe/johndoe@example.com), use the full email address
	691	+ // as the username.
786	692	if ( array_key_exists( 'username', $user_data ) ) {
787	693	$username = $user_data['username'];
788	694	} else {
789	695	$username = explode( '@', $user_info['email'] );
		@@ -788,56 +694,31 @@
788	694	} else {
789	695	$username = explode( '@', $user_info['email'] );
790	696	$username = $username[0];
791	697	}
792		- // If there's already a user with this username (e.g.,
793		- // johndoe/johndoe@gmail.com exists, and we're trying to add
794		- // johndoe/johndoe@example.com), use the full email address
795		- // as the username.
796	698	if ( get_user_by( 'login', $username ) !== false ) {
797	699	$username = $user_info['email'];
798	700	}
799	701	$result = wp_insert_user(
800	702	array(
801		- 'user_login' => strtolower( $username ),
802		- 'user_pass' => wp_generate_password(), // random password.
803		- 'first_name' => array_key_exists( 'first_name', $user_data ) ? $user_data['first_name'] : '',
804		- 'last_name' => array_key_exists( 'last_name', $user_data ) ? $user_data['last_name'] : '',
805		- 'user_email' => $this->lowercase( $user_info['email'] ),
	703	+ 'user_login' => strtolower( $username ),
	704	+ 'user_pass' => wp_generate_password(), // random password
	705	+ 'first_name' => array_key_exists( 'first_name', $user_data ) ? $user_data['first_name'] : '',
	706	+ 'last_name' => array_key_exists( 'last_name', $user_data ) ? $user_data['last_name'] : '',
	707	+ 'user_email' => strtolower( $user_info['email'] ),
806	708	'user_registered' => date( 'Y-m-d H:i:s' ),
807		- 'role' => $user_info['role'],
	709	+ 'role' => $user_info['role'],
808	710	)
809	711	);
810	712
811	713	// Fail with message if error.
812		- if ( is_wp_error( $result ) || 0 === $result ) {
	714	+ if ( is_wp_error( $result ) || $result === 0 ) {
813	715	return $result;
814	716	}
815	717
816		- // Authenticate as new user.
	718	+ // Authenticate as new user
817	719	$user = new WP_User( $result );
818	720
819		- /**
820		- * Fires after an external user is authenticated for the first time
821		- * and a new WordPress account is created for them.
822		- *
823		- * @since 2.8.0
824		- *
825		- * @param WP_User $user User object.
826		- * @param array $user_data User data from external service.
827		- *
828		- * Example $user_data:
829		- * array(
830		- * 'email' => 'user@example.edu',
831		- * 'username' => 'user',
832		- * 'first_name' => 'First',
833		- * 'last_name' => 'Last',
834		- * 'authenticated_by' => 'cas',
835		- * 'cas_attributes' => array( ... ),
836		- * );
837		- */
838		- do_action( 'authorizer_user_register', $user, $user_data );
839		-
840	721	// If multisite, iterate through all sites in the network and add the user
841	722	// currently logging in to any of them that have the user on the approved list.
842	723	// Note: this is useful for first-time logins--some users will have access
843	724	// to multiple sites, and this prevents them from having to log into each
		@@ -843,21 +724,18 @@
843	724	// to multiple sites, and this prevents them from having to log into each
844	725	// site individually to get access.
845	726	if ( is_multisite() ) {
846	727	$site_ids_of_user = array_map(
847		- function ( $site_of_user ) {
848		- return intval( $site_of_user->userblog_id );
849		- },
	728	+ function ( $site_of_user ) { return $site_of_user->userblog_id; },
850	729	get_blogs_of_user( $user->ID )
851	730	);
852	731
853		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
854	732	$sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
855	733	foreach ( $sites as $site ) {
856	734	$blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
857	735
858	736	// Skip if user is already added to this site.
859		- if ( in_array( intval( $blog_id ), $site_ids_of_user, true ) ) {
	737	+ if ( in_array( $blog_id, $site_ids_of_user ) ) {
860	738	continue;
861	739	}
862	740
863	741	// Check if user is on the approved list of this site they are not added to.
		@@ -883,9 +761,9 @@
883	761	if ( $meta_key === $user_info['usermeta']['meta_key'] ) {
884	762	// Update user's usermeta value for usermeta key stored in authorizer options.
885	763	if ( strpos( $meta_key, 'acf___' ) === 0 && class_exists( 'acf' ) ) {
886	764	// We have an ACF field value, so use the ACF function to update it.
887		- update_field( str_replace( 'acf___', '', $meta_key ), $user_info['usermeta']['meta_value'], 'user_' . $user->ID );
	765	+ update_field( str_replace('acf___', '', $meta_key ), $user_info['usermeta']['meta_value'], 'user_' . $user->ID );
888	766	} else {
889	767	// We have a normal usermeta value, so just update it via the WordPress function.
890	768	update_user_meta( $user->ID, $meta_key, $user_info['usermeta']['meta_value'] );
891	769	}
		@@ -901,9 +779,9 @@
901	779	switch_to_blog( $blog_id );
902	780	// Update user's usermeta value for usermeta key stored in authorizer options.
903	781	if ( strpos( $meta_key, 'acf___' ) === 0 && class_exists( 'acf' ) ) {
904	782	// We have an ACF field value, so use the ACF function to update it.
905		- update_field( str_replace( 'acf___', '', $meta_key ), $usermeta['meta_value'], 'user_' . $user->ID );
	783	+ update_field( str_replace('acf___', '', $meta_key ), $usermeta['meta_value'], 'user_' . $user->ID );
906	784	} else {
907	785	// We have a normal usermeta value, so just update it via the WordPress function.
908	786	update_user_meta( $user->ID, $meta_key, $usermeta['meta_value'] );
909	787	}
		@@ -914,24 +792,20 @@
914	792	}
915	793	} else {
916	794	// Update first/last names of WordPress user from external
917	795	// service if that option is set.
918		- if ( ( array_key_exists( 'authenticated_by', $user_data ) && 'cas' === $user_data['authenticated_by'] && array_key_exists( 'cas_attr_update_on_login', $auth_settings ) && 1 === intval( $auth_settings['cas_attr_update_on_login'] ) ) || ( array_key_exists( 'authenticated_by', $user_data ) && 'ldap' === $user_data['authenticated_by'] && array_key_exists( 'ldap_attr_update_on_login', $auth_settings ) && 1 === intval( $auth_settings['ldap_attr_update_on_login'] ) ) ) {
919		- if ( array_key_exists( 'first_name', $user_data ) && 0 < strlen( $user_data['first_name'] ) ) {
920		- wp_update_user(
921		- array(
922		- 'ID' => $user->ID,
923		- 'first_name' => $user_data['first_name'],
924		- )
925		- );
	796	+ if ( ( array_key_exists( 'authenticated_by', $user_data ) && $user_data['authenticated_by'] === 'cas' && array_key_exists( 'cas_attr_update_on_login', $auth_settings ) && $auth_settings['cas_attr_update_on_login'] == 1 ) || ( array_key_exists( 'authenticated_by', $user_data ) && $user_data['authenticated_by'] === 'ldap' && array_key_exists( 'ldap_attr_update_on_login', $auth_settings ) && $auth_settings['ldap_attr_update_on_login'] == 1 ) ) {
	797	+ if ( array_key_exists( 'first_name', $user_data ) && strlen( $user_data['first_name'] ) > 0 ) {
	798	+ wp_update_user( array(
	799	+ 'ID' => $user->ID,
	800	+ 'first_name' => $user_data['first_name'],
	801	+ ));
926	802	}
927	803	if ( array_key_exists( 'last_name', $user_data ) && strlen( $user_data['last_name'] ) > 0 ) {
928		- wp_update_user(
929		- array(
930		- 'ID' => $user->ID,
931		- 'last_name' => $user_data['last_name'],
932		- )
933		- );
	804	+ wp_update_user( array(
	805	+ 'ID' => $user->ID,
	806	+ 'last_name' => $user_data['last_name'],
	807	+ ));
934	808	}
935	809	}
936	810
937	811	// Update this user's role if it was modified in the
		@@ -936,19 +810,12 @@
936	810
937	811	// Update this user's role if it was modified in the
938	812	// authorizer_custom_role filter.
939	813	if ( $default_role !== $approved_role ) {
940		- // Update user's role in WordPress.
941		- $user->set_role( $approved_role );
942		-
943		- // Update user's role in this site's approved list and save.
944		- foreach ( $auth_settings_access_users_approved_single as $key => $existing_user ) {
945		- if ( 0 === strcasecmp( $user->user_email, $existing_user['email'] ) ) {
946		- $auth_settings_access_users_approved_single[ $key ]['role'] = $approved_role;
947		- break;
948		- }
949		- }
950		- update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved_single );
	814	+ wp_update_user( array(
	815	+ 'ID' => $user->ID,
	816	+ 'role' => $approved_role,
	817	+ ));
951	818	}
952	819	}
953	820
954	821	// If this is multisite, add new user to current blog.
		@@ -961,34 +828,33 @@
961	828	}
962	829	}
963	830
964	831	// Ensure user has the same role as their entry in the approved list.
965		- if ( $user_info && ! in_array( $user_info['role'], $user->roles, true ) ) {
	832	+ // (This is just a precaution, the role should already be set when
	833	+ // saving admin options in the sanitizing function.)
	834	+ if ( $user_info && ! array_key_exists( $user_info['role'], $user->roles ) ) {
966	835	$user->set_role( $user_info['role'] );
967	836	}
968	837
969	838	return $user;
970	839
971		- } elseif ( 0 === strcasecmp( $user_email, $last_email ) ) {
972		- /**
973		- * Note: only do this for the last email address we are checking (we need
974		- * to iterate through them all to make sure one of them isn't approved).
975		- */
976		-
	840	+ // Note: only do this for the last email address we are checking (we need
	841	+ // to iterate through them all to make sure one of them isn't approved).
	842	+ } elseif ( $user_email === $last_email ) {
977	843	// User isn't an admin, is not blocked, and is not approved.
978	844	// Add them to the pending list and notify them and their instructor.
979	845	if ( strlen( $user_email ) > 0 && ! $this->is_email_in_list( $user_email, 'pending' ) ) {
980		- $pending_user = array();
981		- $pending_user['email'] = $this->lowercase( $user_email );
982		- $pending_user['role'] = $approved_role;
	846	+ $pending_user = array();
	847	+ $pending_user['email'] = $user_email;
	848	+ $pending_user['role'] = $approved_role;
983	849	$pending_user['date_added'] = '';
984	850	array_push( $auth_settings_access_users_pending, $pending_user );
985	851	update_option( 'auth_settings_access_users_pending', $auth_settings_access_users_pending );
986	852
987	853	// Create strings used in the email notification.
988		- $site_name = get_bloginfo( 'name' );
989		- $site_url = get_bloginfo( 'url' );
990		- $authorizer_options_url = 'settings' === $auth_settings['advanced_admin_menu'] ? admin_url( 'options-general.php?page=authorizer' ) : admin_url( '?page=authorizer' );
	854	+ $site_name = get_bloginfo( 'name' );
	855	+ $site_url = get_bloginfo( 'url' );
	856	+ $authorizer_options_url = $auth_settings['advanced_admin_menu'] === 'settings' ? admin_url( 'options-general.php?page=authorizer' ) : admin_url( '?page=authorizer' );
991	857
992	858	// Notify users with the role specified in "Which role should
993	859	// receive email notifications about pending users?".
994	860	if ( strlen( $auth_settings['access_role_receive_pending_emails'] ) > 0 ) {
		@@ -1013,11 +879,10 @@
1013	879	}
1014	880	}
1015	881
1016	882	// Notify user about pending status and return without authenticating them.
1017		- // phpcs:ignore WordPress.CSRF.NonceVerification.NoNonceVerification
1018		- $redirect_to = ! empty( $_REQUEST['redirect_to'] ) ? esc_url_raw( wp_unslash( $_REQUEST['redirect_to'] ) ) : home_url();
1019		- $page_title = get_bloginfo( 'name' ) . ' - Access Pending';
	883	+ $redirect_to = ! empty( $_REQUEST['redirect_to'] ) ? $_REQUEST['redirect_to'] : home_url();
	884	+ $page_title = get_bloginfo( 'name' ) . ' - Access Pending';
1020	885	$error_message =
1021	886	apply_filters( 'the_content', $auth_settings['access_pending_redirect_to_message'] ) .
1022	887	'<hr />' .
1023	888	'<p style="text-align: center;">' .
		@@ -1024,9 +889,9 @@
1024	889	'<a class="button" href="' . wp_logout_url( $redirect_to ) . '">' .
1025	890	__( 'Back', 'authorizer' ) .
1026	891	'</a></p>';
1027	892	update_option( 'auth_settings_advanced_login_error', $error_message );
1028		- wp_die( wp_kses( $error_message, $this->allowed_html ), esc_html( $page_title ) );
	893	+ wp_die( $error_message, $page_title );
1029	894	}
1030	895	}
1031	896
1032	897	// Sanity check: if we made it here without returning, something has gone wrong.
		@@ -1049,34 +914,24 @@
1049	914	* custom_authenticate_google() runs to verify the token; once verified
1050	915	* custom_authenticate proceeds as normal with the google email address
1051	916	* as a successfully authenticated external user.
1052	917	*
1053		- * Action: wp_ajax_process_google_login
1054		- * Action: wp_ajax_nopriv_process_google_login
1055		- *
1056		- * @return void, but die with the value to return to the success() function in AJAX call signInCallback().
	918	+ * @return void, but die with the value to return to the success() function in AJAX call signInCallback()
1057	919	*/
1058		- public function ajax_process_google_login() {
	920	+ function ajax_process_google_login() {
	921	+ $nonce = array_key_exists( 'nonce', $_POST ) ? $_POST['nonce'] : '';
	922	+ $code = array_key_exists( 'code', $_POST ) ? $_POST['code'] : null;
	923	+
1059	924	// Nonce check.
1060		- if (
1061		- ! isset( $_POST['nonce'] ) ||
1062		- ! wp_verify_nonce( sanitize_key( $_POST['nonce'] ), 'google_csrf_nonce' )
1063		- ) {
1064		- die( '' );
	925	+ if ( ! wp_verify_nonce( $nonce, 'google_csrf_nonce' ) ) {
	926	+ return '';
1065	927	}
1066	928
1067		- // Google authentication token.
1068		- // phpcs:ignore WordPress.VIP.ValidatedSanitizedInput.InputNotSanitized
1069		- $code = isset( $_POST['code'] ) ? wp_unslash( $_POST['code'] ) : null;
1070		-
1071	929	// Grab plugin settings.
1072		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
	930	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' );
1073	931
1074		- /**
1075		- * Add Google API PHP Client.
1076		- *
1077		- * @see https://github.com/google/google-api-php-client branch:v1-master
1078		- */
	932	+ // Add Google API PHP Client.
	933	+ // @see https://github.com/google/google-api-php-client branch:v1-master
1079	934	require_once dirname( __FILE__ ) . '/vendor/google-api-php-client/src/Google/autoload.php';
1080	935
1081	936	// Build the Google Client.
1082	937	$client = new Google_Client();
		@@ -1084,26 +939,14 @@
1084	939	$client->setClientId( $auth_settings['google_clientid'] );
1085	940	$client->setClientSecret( $auth_settings['google_clientsecret'] );
1086	941	$client->setRedirectUri( 'postmessage' );
1087	942
1088		- /**
1089		- * If the hosted domain parameter is set, restrict logins to that domain.
1090		- *
1091		- * Note: Will have to upgrade to google-api-php-client v2 or higher for
1092		- * this to function server-side; it's not complete in v1, so this check
1093		- * is performed manually below.
1094		- *
1095		- * if (
1096		- * array_key_exists( 'google_hosteddomain', $auth_settings ) &&
1097		- * strlen( $auth_settings['google_hosteddomain'] ) > 0
1098		- * ) {
1099		- * $google_hosteddomains = explode( "\n", str_replace( "\r", '', $auth_settings['google_hosteddomain'] ) );
1100		- * $google_hosteddomain = trim( $google_hosteddomains[0] );
1101		- * $client->setHostedDomain( $google_hosteddomain );
1102		- * }
1103		- */
	943	+ // If the hosted domain parameter is set, restrict logins to that domain.
	944	+ if ( array_key_exists( 'google_hosteddomain', $auth_settings ) && strlen( $auth_settings['google_hosteddomain'] ) > 0 ) {
	945	+ $client->setHostedDomain( $auth_settings['google_hosteddomain'] );
	946	+ }
1104	947
1105		- // Get one time use token (if it doesn't exist, we'll create one below).
	948	+ // Get one time use token (if it doesn't exist, we'll create one below)
1106	949	session_start();
1107	950	$token = array_key_exists( 'token', $_SESSION ) ? json_decode( $_SESSION['token'] ) : null;
1108	951
1109	952	if ( empty( $token ) ) {
		@@ -1111,18 +954,18 @@
1111	954	$client->authenticate( $code );
1112	955	$token = json_decode( $client->getAccessToken() );
1113	956
1114	957	// Store the token in the session for later use.
1115		- $_SESSION['token'] = wp_json_encode( $token );
	958	+ $_SESSION['token'] = json_encode( $token );
1116	959
1117		- $response = 'Successfully authenticated.';
	960	+ $response = "Successfully authenticated.";
1118	961	} else {
1119		- $client->setAccessToken( wp_json_encode( $token ) );
	962	+ $client->setAccessToken( json_encode( $token ) );
1120	963
1121	964	$response = 'Already authenticated.';
1122	965	}
1123	966
1124		- die( esc_html( $response ) );
	967	+ die( $response );
1125	968	}
1126	969
1127	970
1128	971	/**
		@@ -1127,22 +970,22 @@
1127	970
1128	971	/**
1129	972	* Validate this user's credentials against Google.
1130	973	*
1131		- * @param array $auth_settings Plugin settings.
1132		- * @return array|WP_Error Array containing email, authenticated_by, first_name,
1133		- * last_name, and username strings for the successfully
1134		- * authenticated user, or WP_Error() object on failure,
1135		- * or null if not attempting a google login.
	974	+ * @param array $auth_settings Plugin settings
	975	+ * @return [mixed] Array containing email, authenticated_by,
	976	+ * first_name, last_name, and username
	977	+ * strings for the successfully authenticated
	978	+ * user, or WP_Error() object on failure,
	979	+ * or null if not attempting a google login.
1136	980	*/
1137	981	private function custom_authenticate_google( $auth_settings ) {
1138	982	// Move on if Google auth hasn't been requested here.
1139		- // phpcs:ignore WordPress.CSRF.NonceVerification.NoNonceVerification
1140		- if ( empty( $_GET['external'] ) || 'google' !== $_GET['external'] ) {
	983	+ if ( empty( $_GET['external'] ) || $_GET['external'] !== 'google' ) {
1141	984	return null;
1142	985	}
1143	986
1144		- // Get one time use token.
	987	+ // Get one time use token
1145	988	session_start();
1146	989	$token = array_key_exists( 'token', $_SESSION ) ? json_decode( $_SESSION['token'] ) : null;
1147	990
1148	991	// No token, so this is not a succesful Google login.
		@@ -1149,13 +992,10 @@
1149	992	if ( is_null( $token ) ) {
1150	993	return null;
1151	994	}
1152	995
1153		- /**
1154		- * Add Google API PHP Client.
1155		- *
1156		- * @see https://github.com/google/google-api-php-client branch:v1-master
1157		- */
	996	+ // Add Google API PHP Client.
	997	+ // @see https://github.com/google/google-api-php-client branch:v1-master
1158	998	require_once dirname( __FILE__ ) . '/vendor/google-api-php-client/src/Google/autoload.php';
1159	999
1160	1000	// Build the Google Client.
1161	1001	$client = new Google_Client();
		@@ -1163,24 +1003,14 @@
1163	1003	$client->setClientId( $auth_settings['google_clientid'] );
1164	1004	$client->setClientSecret( $auth_settings['google_clientsecret'] );
1165	1005	$client->setRedirectUri( 'postmessage' );
1166	1006
1167		- /**
1168		- * If the hosted domain parameter is set, restrict logins to that domain.
1169		- * Note: Will have to upgrade to google-api-php-client v2 or higher for
1170		- * this to function server-side; it's not complete in v1, so this check
1171		- * is performed manually later.
1172		- * if (
1173		- * array_key_exists( 'google_hosteddomain', $auth_settings ) &&
1174		- * strlen( $auth_settings['google_hosteddomain'] ) > 0
1175		- * ) {
1176		- * $google_hosteddomains = explode( "\n", str_replace( "\r", '', $auth_settings['google_hosteddomain'] ) );
1177		- * $google_hosteddomain = trim( $google_hosteddomains[0] );
1178		- * $client->setHostedDomain( $google_hosteddomain );
1179		- * }
1180		- */
	1007	+ // If the hosted domain parameter is set, restrict logins to that domain.
	1008	+ if ( array_key_exists( 'google_hosteddomain', $auth_settings ) && strlen( $auth_settings['google_hosteddomain'] ) > 0 ) {
	1009	+ $client->setHostedDomain( $auth_settings['google_hosteddomain'] );
	1010	+ }
1181	1011
1182		- // Verify this is a successful Google authentication.
	1012	+ // Verify this is a successful Google authentication
1183	1013	try {
1184	1014	$ticket = $client->verifyIdToken( $token->id_token, $auth_settings['google_clientid'] );
1185	1015	} catch ( Google_Auth_Exception $e ) {
1186	1016	// Invalid ticket, so this in not a successful Google login.
		@@ -1191,40 +1021,37 @@
1191	1021	if ( ! $ticket ) {
1192	1022	return new WP_Error( 'invalid_google_login', __( 'Invalid Google credentials provided.', 'authorizer' ) );
1193	1023	}
1194	1024
1195		- // Get email address.
1196		- $attributes = $ticket->getAttributes();
1197		- $email = $this->lowercase( $attributes['payload']['email'] );
	1025	+ // Get email address
	1026	+ $attributes = $ticket->getAttributes();
	1027	+ $email = $attributes['payload']['email'];
1198	1028	$email_domain = substr( strrchr( $email, '@' ), 1 );
1199		- $username = current( explode( '@', $email ) );
	1029	+ $username = current( explode( '@', $email ) );
1200	1030
1201		- /**
1202		- * Fail if hd param is set and the logging in user's email address doesn't
1203		- * match the allowed hosted domain.
1204		- *
1205		- * See: https://developers.google.com/identity/protocols/OpenIDConnect#hd-param
1206		- * See: https://github.com/google/google-api-php-client/blob/v1-master/src/Google/Client.php#L407-L416
1207		- *
1208		- * Note: Will have to upgrade to google-api-php-client v2 or higher for
1209		- * this to function server-side; it's not complete in v1, so this check
1210		- * is only performed here.
1211		- */
1212		- if ( array_key_exists( 'google_hosteddomain', $auth_settings ) && strlen( $auth_settings['google_hosteddomain'] ) > 0 ) {
1213		- // Allow multiple whitelisted domains.
1214		- $google_hosteddomains = explode( "\n", str_replace( "\r", '', $auth_settings['google_hosteddomain'] ) );
1215		- if ( ! in_array( $email_domain, $google_hosteddomains, true ) ) {
1216		- $this->custom_logout();
1217		- return new WP_Error( 'invalid_google_login', __( 'Google credentials do not match the allowed hosted domain', 'authorizer' ) );
1218		- }
	1031	+ // Fail if hd param is set and the logging in user's email address doesn't
	1032	+ // match the allowed hosted domain.
	1033	+ // See: https://developers.google.com/identity/protocols/OpenIDConnect#hd-param
	1034	+ // See: https://github.com/google/google-api-php-client/blob/v1-master/src/Google/Client.php#L407-L416
	1035	+ // Note: Will have to upgrade to google-api-php-client v2 or higher for
	1036	+ // this to function server-side; it's not complete in v1, so this check
	1037	+ // is only performed here.
	1038	+ if (
	1039	+ array_key_exists( 'google_hosteddomain', $auth_settings ) &&
	1040	+ strlen( $auth_settings['google_hosteddomain'] ) > 0 &&
	1041	+ $email_domain !== $auth_settings['google_hosteddomain']
	1042	+ ) {
	1043	+ $this->custom_logout();
	1044	+ return new WP_Error( 'invalid_google_login', __( 'Google credentials do not match the allowed hosted domain', 'authorizer' ) . ' (' . $auth_settings['google_hosteddomain'] . ').' );
1219	1045	}
1220	1046
	1047	+
1221	1048	return array(
1222		- 'email' => $email,
1223		- 'username' => $username,
1224		- 'first_name' => '',
1225		- 'last_name' => '',
1226		- 'authenticated_by' => 'google',
	1049	+ 'email' => $email,
	1050	+ 'username' => $username,
	1051	+ 'first_name' => '',
	1052	+ 'last_name' => '',
	1053	+ 'authenticated_by' => 'google',
1227	1054	'google_attributes' => $attributes,
1228	1055	);
1229	1056	}
1230	1057
		@@ -1231,68 +1058,78 @@
1231	1058
1232	1059	/**
1233	1060	* Validate this user's credentials against CAS.
1234	1061	*
1235		- * @param array $auth_settings Plugin settings.
1236		- * @return array|WP_Error Array containing 'email' and 'authenticated_by' strings
1237		- * for the successfully authenticated user, or WP_Error()
1238		- * object on failure, or null if not attempting a CAS login.
	1062	+ * @param array $auth_settings Plugin settings
	1063	+ * @return [mixed] Array containing 'email' and 'authenticated_by'
	1064	+ * strings for the successfully authenticated
	1065	+ * user, or WP_Error() object on failure,
	1066	+ * or null if not attempting a CAS login.
1239	1067	*/
1240	1068	private function custom_authenticate_cas( $auth_settings ) {
1241	1069	// Move on if CAS hasn't been requested here.
1242		- // phpcs:ignore WordPress.CSRF.NonceVerification.NoNonceVerification
1243		- if ( empty( $_GET['external'] ) || 'cas' !== $_GET['external'] ) {
	1070	+ if ( empty( $_GET['external'] ) || $_GET['external'] !== 'cas' ) {
1244	1071	return null;
1245	1072	}
1246	1073
1247		- /**
1248		- * Get the CAS server version (default to SAML_VERSION_1_1).
1249		- *
1250		- * @see: https://developer.jasig.org/cas-clients/php/1.3.4/docs/api/group__public.html
1251		- */
	1074	+ // Get the CAS server version (default to SAML_VERSION_1_1).
	1075	+ // See: https://developer.jasig.org/cas-clients/php/1.3.4/docs/api/group__public.html
1252	1076	$cas_version = SAML_VERSION_1_1;
1253		- if ( 'CAS_VERSION_3_0' === $auth_settings['cas_version'] ) {
	1077	+ if ( $auth_settings['cas_version'] === 'CAS_VERSION_3_0' ) {
1254	1078	$cas_version = CAS_VERSION_3_0;
1255		- } elseif ( 'CAS_VERSION_2_0' === $auth_settings['cas_version'] ) {
	1079	+ } elseif ( $auth_settings['cas_version'] === 'CAS_VERSION_2_0' ) {
1256	1080	$cas_version = CAS_VERSION_2_0;
1257		- } elseif ( 'CAS_VERSION_1_0' === $auth_settings['cas_version'] ) {
	1081	+ } elseif ( $auth_settings['cas_version'] === 'CAS_VERSION_1_0' ) {
1258	1082	$cas_version = CAS_VERSION_1_0;
1259	1083	}
1260	1084
1261		- // Set the CAS client configuration.
	1085	+ // Set the CAS client configuration
1262	1086	phpCAS::client( $cas_version, $auth_settings['cas_host'], intval( $auth_settings['cas_port'] ), $auth_settings['cas_path'] );
1263	1087
1264		- // Allow redirects at the CAS server endpoint (e.g., allow connections
1265		- // at an old CAS URL that redirects to a newer CAS URL).
1266		- phpCAS::setExtraCurlOption( CURLOPT_FOLLOWLOCATION, true );
	1088	+ // Update server certificate bundle if it doesn't exist or is older
	1089	+ // than 6 months, then use it to ensure CAS server is legitimate.
	1090	+ // Note: only try to update if the system has the php_openssl extension.
	1091	+ $cacert_url = 'https://curl.haxx.se/ca/cacert.pem';
	1092	+ $cacert_path = plugin_dir_path( __FILE__ ) . 'vendor/cacert.pem';
	1093	+ $time_180_days = 180 * 24 * 60 * 60; // days * hours * minutes * seconds
	1094	+ $time_180_days_ago = time() - $time_180_days;
	1095	+ if (
	1096	+ extension_loaded( 'openssl' ) &&
	1097	+ ( ! file_exists( $cacert_path ) || filemtime( $cacert_path ) < $time_180_days_ago )
	1098	+ ) {
	1099	+ // Get new cacert.pem file from https://curl.haxx.se/ca/cacert.pem.
	1100	+ $response = wp_safe_remote_get( $cacert_url );
	1101	+ if (
	1102	+ is_wp_error( $response ) ||
	1103	+ 200 !== wp_remote_retrieve_response_code( $response ) ||
	1104	+ ! array_key_exists( 'body', $response )
	1105	+ ) {
	1106	+ new WP_Error( 'cannot_update_cacert', __( 'Unable to update outdated server certificates from https://curl.haxx.se/ca/cacert.pem.', 'authorizer' ) );
	1107	+ }
	1108	+ $cacert_contents = $response['body'];
1267	1109
1268		- // Use the WordPress certificate bundle at /wp-includes/certificates/ca-bundle.crt.
1269		- phpCAS::setCasServerCACert( ABSPATH . WPINC . '/certificates/ca-bundle.crt' );
1270		-
1271		- // Set the CAS service URL (including the redirect URL for WordPress when it comes back from CAS).
1272		- $cas_service_url = site_url( '/wp-login.php?external=cas' );
1273		- $login_querystring = array();
1274		- if ( isset( $_SERVER['QUERY_STRING'] ) ) {
1275		- parse_str( $_SERVER['QUERY_STRING'], $login_querystring ); // phpcs:ignore WordPress.VIP.ValidatedSanitizedInput
	1110	+ // Write out the updated certs to the plugin directory.
	1111	+ file_put_contents( $cacert_path, $cacert_contents );
1276	1112	}
1277		- if ( isset( $login_querystring['redirect_to'] ) ) {
1278		- $cas_service_url .= '&redirect_to=' . rawurlencode( $login_querystring['redirect_to'] );
1279		- }
1280		- phpCAS::setFixedServiceURL( $cas_service_url );
	1113	+ phpCAS::setCasServerCACert( $cacert_path );
1281	1114
1282		- // Authenticate against CAS.
	1115	+ // Authenticate against CAS
1283	1116	try {
1284	1117	phpCAS::forceAuthentication();
1285	1118	} catch ( CAS_AuthenticationException $e ) {
1286	1119	// CAS server threw an error in isAuthenticated(), potentially because
1287	1120	// the cached ticket is outdated. Try renewing the authentication.
1288		- error_log( __( 'CAS server returned an Authentication Exception. Details:', 'authorizer' ) ); // phpcs:ignore
1289		- error_log( print_r( $e, true ) ); // phpcs:ignore
	1121	+ try {
	1122	+ phpCAS::renewAuthentication();
	1123	+ } catch ( CAS_AuthenticationException $e ) {
	1124	+ error_log( __( 'CAS server returned an Authentication Exception. Details:', 'authorizer' ) );
	1125	+ error_log( print_r( $e, true ) );
1290	1126
1291		- // CAS server is throwing errors on this login, so try logging the
1292		- // user out of CAS and redirecting them to the login page.
1293		- phpCAS::logoutWithRedirectService( wp_login_url() );
1294		- die();
	1127	+ // CAS server is throwing errors on this login, so try logging the
	1128	+ // user out of CAS and redirecting them to the login page.
	1129	+ phpCAS::logoutWithRedirectService( wp_login_url() );
	1130	+ die();
	1131	+ }
1295	1132	}
1296	1133
1297	1134	// Get username (as specified by the CAS server).
1298	1135	$username = phpCAS::getUser();
		@@ -1302,10 +1139,10 @@
1302	1139	if ( ! filter_var( $externally_authenticated_email, FILTER_VALIDATE_EMAIL ) ) {
1303	1140	// If we can't get the user's email address from a CAS attribute,
1304	1141	// try to guess the domain from the CAS server hostname. This will only
1305	1142	// be used if we can't discover the email address from CAS attributes.
1306		- $domain_guess = preg_match( '/[^.]*\.[^.]*$/', $auth_settings['cas_host'], $matches ) === 1 ? $matches[0] : '';
1307		- $externally_authenticated_email = $this->lowercase( $username ) . '@' . $domain_guess;
	1143	+ $domain_guess = preg_match( '/[^.]*\.[^.]*$/', $auth_settings['cas_host'], $matches ) === 1 ? $matches[0] : '';
	1144	+ $externally_authenticated_email = strtolower( $username ) . '@' . $domain_guess;
1308	1145	}
1309	1146
1310	1147	// Retrieve the user attributes (e.g., email address, first name, last name) from the CAS server.
1311	1148	$cas_attributes = phpCAS::getAttributes();
		@@ -1316,45 +1153,37 @@
1316	1153	// email domain is manually entered there (instead of a reference to a
1317	1154	// CAS attribute), and combine that with the username to create the email.
1318	1155	// Otherwise, look up the CAS attribute for email.
1319	1156	if ( substr( $auth_settings['cas_attr_email'], 0, 1 ) === '@' ) {
1320		- $externally_authenticated_email = $this->lowercase( $username . $auth_settings['cas_attr_email'] );
	1157	+ $externally_authenticated_email = strtolower( $username . $auth_settings['cas_attr_email'] );
1321	1158	} elseif (
1322	1159	// If a CAS attribute has been specified as containing the email address, use that instead.
1323	1160	// Email attribute can be a string or an array of strings.
1324	1161	array_key_exists( $auth_settings['cas_attr_email'], $cas_attributes ) && (
1325	1162	(
1326		- is_array( $cas_attributes[ $auth_settings['cas_attr_email'] ] ) &&
1327		- count( $cas_attributes[ $auth_settings['cas_attr_email'] ] ) > 0
	1163	+ is_array( $cas_attributes[$auth_settings['cas_attr_email']] ) &&
	1164	+ count( $cas_attributes[$auth_settings['cas_attr_email']] ) > 0
1328	1165	) || (
1329		- is_string( $cas_attributes[ $auth_settings['cas_attr_email'] ] ) &&
1330		- strlen( $cas_attributes[ $auth_settings['cas_attr_email'] ] ) > 0
	1166	+ is_string( $cas_attributes[$auth_settings['cas_attr_email']] ) &&
	1167	+ strlen( $cas_attributes[$auth_settings['cas_attr_email']] ) > 0
1331	1168	)
1332	1169	)
1333	1170	) {
1334		- // Each of the emails in the array needs to be set to lowercase.
1335		- if ( is_array( $cas_attributes[ $auth_settings['cas_attr_email'] ] ) ) {
1336		- $externally_authenticated_email = array();
1337		- foreach ( $cas_attributes[ $auth_settings['cas_attr_email'] ] as $external_email ) {
1338		- $externally_authenticated_email[] = $this->lowercase( $external_email );
1339		- }
1340		- } else {
1341		- $externally_authenticated_email = $this->lowercase( $cas_attributes[ $auth_settings['cas_attr_email'] ] );
1342		- }
	1171	+ $externally_authenticated_email = $cas_attributes[$auth_settings['cas_attr_email']];
1343	1172	}
1344	1173	}
1345	1174
1346	1175	// Get user first name and last name.
1347		- $first_name = array_key_exists( 'cas_attr_first_name', $auth_settings ) && strlen( $auth_settings['cas_attr_first_name'] ) > 0 && array_key_exists( $auth_settings['cas_attr_first_name'], $cas_attributes ) && strlen( $cas_attributes[ $auth_settings['cas_attr_first_name'] ] ) > 0 ? $cas_attributes[ $auth_settings['cas_attr_first_name'] ] : '';
1348		- $last_name = array_key_exists( 'cas_attr_last_name', $auth_settings ) && strlen( $auth_settings['cas_attr_last_name'] ) > 0 && array_key_exists( $auth_settings['cas_attr_last_name'], $cas_attributes ) && strlen( $cas_attributes[ $auth_settings['cas_attr_last_name'] ] ) > 0 ? $cas_attributes[ $auth_settings['cas_attr_last_name'] ] : '';
	1176	+ $first_name = array_key_exists( 'cas_attr_first_name', $auth_settings ) && strlen( $auth_settings['cas_attr_first_name'] ) > 0 && array_key_exists( $auth_settings['cas_attr_first_name'], $cas_attributes ) && strlen( $cas_attributes[$auth_settings['cas_attr_first_name']] ) > 0 ? $cas_attributes[$auth_settings['cas_attr_first_name']] : '';
	1177	+ $last_name = array_key_exists( 'cas_attr_last_name', $auth_settings ) && strlen( $auth_settings['cas_attr_last_name'] ) > 0 && array_key_exists( $auth_settings['cas_attr_last_name'], $cas_attributes ) && strlen( $cas_attributes[$auth_settings['cas_attr_last_name']] ) > 0 ? $cas_attributes[$auth_settings['cas_attr_last_name']] : '';
1349	1178
1350	1179	return array(
1351		- 'email' => $externally_authenticated_email,
1352		- 'username' => $username,
1353		- 'first_name' => $first_name,
1354		- 'last_name' => $last_name,
	1180	+ 'email' => $externally_authenticated_email,
	1181	+ 'username' => $username,
	1182	+ 'first_name' => $first_name,
	1183	+ 'last_name' => $last_name,
1355	1184	'authenticated_by' => 'cas',
1356		- 'cas_attributes' => $cas_attributes,
	1185	+ 'cas_attributes' => $cas_attributes,
1357	1186	);
1358	1187	}
1359	1188
1360	1189
		@@ -1360,32 +1189,24 @@
1360	1189
1361	1190	/**
1362	1191	* Validate this user's credentials against LDAP.
1363	1192	*
1364		- * @param array $auth_settings Plugin settings.
1365		- * @param string $username Attempted username from authenticate action.
1366		- * @param string $password Attempted password from authenticate action.
1367		- * @return array|WP_Error Array containing 'email' and 'authenticated_by' strings
1368		- * for the successfully authenticated user, or WP_Error()
1369		- * object on failure, or null if skipping LDAP auth and
1370		- * falling back to WP auth.
	1193	+ * @param array $auth_settings Plugin settings
	1194	+ * @param string $username Attempted username from authenticate action
	1195	+ * @param string $password Attempted password from authenticate action
	1196	+ * @return [mixed] Array containing 'email' and 'authenticated_by'
	1197	+ * strings for the successfully authenticated
	1198	+ * user, or WP_Error() object on failure,
	1199	+ * or null if skipping LDAP auth and falling back to WP auth.
1371	1200	*/
1372	1201	private function custom_authenticate_ldap( $auth_settings, $username, $password ) {
1373		- // Get LDAP search base(s).
1374		- $search_bases = explode( "\n", str_replace( "\r", '', trim( $auth_settings['ldap_search_base'] ) ) );
1375		-
1376		- // Fail silently (fall back to WordPress authentication) if no search base specified.
1377		- if ( count( $search_bases ) < 1 ) {
1378		- return null;
1379		- }
1380		-
1381		- // Get the FQDN from the first LDAP search base domain components (dc). For
1382		- // example, ou=people,dc=example,dc=edu,dc=uk would yield user@example.edu.uk.
1383		- $search_base_components = explode( ',', trim( $search_bases[0] ) );
1384		- $domain = array();
	1202	+ // Get the FQDN from the LDAP search base domain components (dc). For
	1203	+ // example, ou=people,dc=example,dc=edu,dc=uk would yield user@example.edu.uk
	1204	+ $search_base_components = explode( ',', trim( $auth_settings['ldap_search_base'] ) );
	1205	+ $domain = array();
1385	1206	foreach ( $search_base_components as $search_base_component ) {
1386	1207	$component = explode( '=', $search_base_component );
1387		- if ( 2 === count( $component ) && 'dc' === $component[0] ) {
	1208	+ if ( count( $component ) === 2 && $component[0] === 'dc' ) {
1388	1209	$domain[] = $component[1];
1389	1210	}
1390	1211	}
1391	1212	$domain = implode( '.', $domain );
		@@ -1396,9 +1217,9 @@
1396	1217	if ( empty( $domain ) ) {
1397	1218	$domain = preg_match( '/[^.]*\.[^.]*$/', $auth_settings['ldap_host'], $matches ) === 1 ? $matches[0] : '';
1398	1219	}
1399	1220
1400		- // remove @domain if it exists in the username (i.e., if user entered their email).
	1221	+ // remove @domain if it exists in the username (i.e., if user entered their email)
1401	1222	$username = str_replace( '@' . $domain, '', $username );
1402	1223
1403	1224	// Fail silently (fall back to WordPress authentication) if both username
1404	1225	// and password are empty (this will be the case when visiting wp-login.php
		@@ -1421,13 +1242,13 @@
1421	1242	return null;
1422	1243	}
1423	1244
1424	1245	// Authenticate against LDAP using options provided in plugin settings.
1425		- $result = false;
	1246	+ $result = false;
1426	1247	$ldap_user_dn = '';
1427		- $first_name = '';
1428		- $last_name = '';
1429		- $email = '';
	1248	+ $first_name = '';
	1249	+ $last_name = '';
	1250	+ $email = '';
1430	1251
1431	1252	// Construct LDAP connection parameters. ldap_connect() takes either a
1432	1253	// hostname or a full LDAP URI as its first parameter (works with OpenLDAP
1433	1254	// 2.x.x or later). If it's an LDAP URI, the second parameter, $port, is
		@@ -1432,13 +1253,13 @@
1432	1253	// hostname or a full LDAP URI as its first parameter (works with OpenLDAP
1433	1254	// 2.x.x or later). If it's an LDAP URI, the second parameter, $port, is
1434	1255	// ignored, and port must be specified in the full URI. An LDAP URI is of
1435	1256	// the form ldap://hostname:port or ldaps://hostname:port.
1436		- $ldap_host = $auth_settings['ldap_host'];
1437		- $ldap_port = intval( $auth_settings['ldap_port'] );
1438		- $parsed_host = wp_parse_url( $ldap_host );
	1257	+ $ldap_host = $auth_settings['ldap_host'];
	1258	+ $ldap_port = intval( $auth_settings['ldap_port'] );
	1259	+ $parsed_host = parse_url( $ldap_host );
1439	1260	// Fail (fall back to WordPress auth) if invalid host is specified.
1440		- if ( false === $parsed_host ) {
	1261	+ if ( $parsed_host === false ) {
1441	1262	return null;
1442	1263	}
1443	1264	// If a scheme is in the LDAP host, use full LDAP URI instead of just hostname.
1444	1265	if ( array_key_exists( 'scheme', $parsed_host ) ) {
		@@ -1451,24 +1272,24 @@
1451	1272
1452	1273	// Establish LDAP connection.
1453	1274	$ldap = ldap_connect( $ldap_host, $ldap_port );
1454	1275	ldap_set_option( $ldap, LDAP_OPT_PROTOCOL_VERSION, 3 );
1455		- if ( 1 === intval( $auth_settings['ldap_tls'] ) ) {
1456		- if ( ! ldap_start_tls( $ldap ) ) {
	1276	+ if ( $auth_settings['ldap_tls'] == 1 ) {
	1277	+ if( ! ldap_start_tls( $ldap ) ) {
1457	1278	return null;
1458	1279	}
1459	1280	}
1460	1281
1461	1282	// Set bind credentials; attempt an anonymous bind if not provided.
1462		- $bind_rdn = null;
1463		- $bind_password = null;
	1283	+ $bind_rdn = NULL;
	1284	+ $bind_password = NULL;
1464	1285	if ( strlen( $auth_settings['ldap_user'] ) > 0 ) {
1465		- $bind_rdn = $auth_settings['ldap_user'];
1466		- $bind_password = $this->decrypt( $auth_settings['ldap_password'] );
	1286	+ $bind_rdn = $auth_settings['ldap_user'];
	1287	+ $bind_password = $this->decrypt( base64_decode( $auth_settings['ldap_password'] ) );
1467	1288	}
1468	1289
1469	1290	// Attempt LDAP bind.
1470		- $result = @ldap_bind( $ldap, $bind_rdn, stripslashes( $bind_password ) ); // phpcs:ignore
	1291	+ $result = @ldap_bind( $ldap, $bind_rdn, $bind_password );
1471	1292	if ( ! $result ) {
1472	1293	// Can't connect to LDAP, so fall back to WordPress authentication.
1473	1294	return null;
1474	1295	}
		@@ -1482,40 +1303,18 @@
1482	1303	if ( array_key_exists( 'ldap_attr_last_name', $auth_settings ) && strlen( $auth_settings['ldap_attr_last_name'] ) > 0 ) {
1483	1304	array_push( $ldap_attributes_to_retrieve, $auth_settings['ldap_attr_last_name'] );
1484	1305	}
1485	1306	if ( array_key_exists( 'ldap_attr_email', $auth_settings ) && strlen( $auth_settings['ldap_attr_email'] ) > 0 && substr( $auth_settings['ldap_attr_email'], 0, 1 ) !== '@' ) {
1486		- array_push( $ldap_attributes_to_retrieve, $this->lowercase( $auth_settings['ldap_attr_email'] ) );
	1307	+ array_push( $ldap_attributes_to_retrieve, $auth_settings['ldap_attr_email'] );
1487	1308	}
	1309	+ $ldap_search = ldap_search(
	1310	+ $ldap,
	1311	+ $auth_settings['ldap_search_base'],
	1312	+ "(" . $auth_settings['ldap_uid'] . "=" . $username . ")",
	1313	+ $ldap_attributes_to_retrieve
	1314	+ );
	1315	+ $ldap_entries = ldap_get_entries( $ldap, $ldap_search );
1488	1316
1489		- // Create default LDAP search filter (uid=$username).
1490		- $search_filter = '(' . $auth_settings['ldap_uid'] . '=' . $username . ')';
1491		-
1492		- /**
1493		- * Filter LDAP search filter.
1494		- *
1495		- * Allows for custom LDAP authentication rules (e.g., restricting login
1496		- * access to users in multiple groups, or having certain attributes).
1497		- *
1498		- * @param string $search_filter The filter to pass to ldap_search().
1499		- * @param string $ldap_uid The attribute to compare username against (from Authorizer Settings).
1500		- * @param string $username The username attempting to log in.
1501		- */
1502		- $search_filter = apply_filters( 'authorizer_ldap_search_filter', $search_filter, $auth_settings['ldap_uid'], $username );
1503		-
1504		- // Multiple search bases can be provided, so iterate through them until a match is found.
1505		- foreach ( $search_bases as $search_base ) {
1506		- $ldap_search = ldap_search(
1507		- $ldap,
1508		- $search_base,
1509		- $search_filter,
1510		- $ldap_attributes_to_retrieve
1511		- );
1512		- $ldap_entries = ldap_get_entries( $ldap, $ldap_search );
1513		- if ( $ldap_entries['count'] > 0 ) {
1514		- break;
1515		- }
1516		- }
1517		-
1518	1317	// If we didn't find any users in ldap, fall back to WordPress authentication.
1519	1318	if ( $ldap_entries['count'] < 1 ) {
1520	1319	return null;
1521	1320	}
		@@ -1521,35 +1320,32 @@
1521	1320	}
1522	1321
1523	1322	// Get the bind dn and first/last names; if there are multiple results returned, just get the last one.
1524	1323	for ( $i = 0; $i < $ldap_entries['count']; $i++ ) {
1525		- $ldap_user_dn = $ldap_entries[ $i ]['dn'];
	1324	+ $ldap_user_dn = $ldap_entries[$i]['dn'];
1526	1325
1527	1326	// Get user first name and last name.
1528		- $ldap_attr_first_name = array_key_exists( 'ldap_attr_first_name', $auth_settings ) ? $this->lowercase( $auth_settings['ldap_attr_first_name'] ) : '';
1529		- if ( strlen( $ldap_attr_first_name ) > 0 && array_key_exists( $ldap_attr_first_name, $ldap_entries[ $i ] ) && $ldap_entries[ $i ][ $ldap_attr_first_name ]['count'] > 0 && strlen( $ldap_entries[ $i ][ $ldap_attr_first_name ][0] ) > 0 ) {
1530		- $first_name = $ldap_entries[ $i ][ $ldap_attr_first_name ][0];
	1327	+ if ( array_key_exists( 'ldap_attr_first_name', $auth_settings ) && strlen( $auth_settings['ldap_attr_first_name'] ) > 0 && array_key_exists( $auth_settings['ldap_attr_first_name'], $ldap_entries[$i] ) && $ldap_entries[$i][$auth_settings['ldap_attr_first_name']]['count'] > 0 && strlen( $ldap_entries[$i][$auth_settings['ldap_attr_first_name']][0] ) > 0 ) {
	1328	+ $first_name = $ldap_entries[$i][$auth_settings['ldap_attr_first_name']][0];
1531	1329	}
1532		- $ldap_attr_last_name = array_key_exists( 'ldap_attr_last_name', $auth_settings ) ? $this->lowercase( $auth_settings['ldap_attr_last_name'] ) : '';
1533		- if ( strlen( $ldap_attr_last_name ) > 0 && array_key_exists( $ldap_attr_last_name, $ldap_entries[ $i ] ) && $ldap_entries[ $i ][ $ldap_attr_last_name ]['count'] > 0 && strlen( $ldap_entries[ $i ][ $ldap_attr_last_name ][0] ) > 0 ) {
1534		- $last_name = $ldap_entries[ $i ][ $ldap_attr_last_name ][0];
	1330	+ if ( array_key_exists( 'ldap_attr_last_name', $auth_settings ) && strlen( $auth_settings['ldap_attr_last_name'] ) > 0 && array_key_exists( $auth_settings['ldap_attr_last_name'], $ldap_entries[$i] ) && $ldap_entries[$i][$auth_settings['ldap_attr_last_name']]['count'] > 0 && strlen( $ldap_entries[$i][$auth_settings['ldap_attr_last_name']][0] ) > 0 ) {
	1331	+ $last_name = $ldap_entries[$i][$auth_settings['ldap_attr_last_name']][0];
1535	1332	}
1536	1333	// Get user email if it is specified in another field.
1537		- $ldap_attr_email = array_key_exists( 'ldap_attr_email', $auth_settings ) ? $this->lowercase( $auth_settings['ldap_attr_email'] ) : '';
1538		- if ( strlen( $ldap_attr_email ) > 0 ) {
	1334	+ if ( array_key_exists( 'ldap_attr_email', $auth_settings ) && strlen( $auth_settings['ldap_attr_email'] ) > 0 ) {
1539	1335	// If the email attribute starts with an at symbol (@), assume that the
1540	1336	// email domain is manually entered there (instead of a reference to an
1541	1337	// LDAP attribute), and combine that with the username to create the email.
1542	1338	// Otherwise, look up the LDAP attribute for email.
1543		- if ( substr( $ldap_attr_email, 0, 1 ) === '@' ) {
1544		- $email = $this->lowercase( $username . $ldap_attr_email );
1545		- } elseif ( array_key_exists( $ldap_attr_email, $ldap_entries[ $i ] ) && $ldap_entries[ $i ][ $ldap_attr_email ]['count'] > 0 && strlen( $ldap_entries[ $i ][ $ldap_attr_email ][0] ) > 0 ) {
1546		- $email = $this->lowercase( $ldap_entries[ $i ][ $ldap_attr_email ][0] );
	1339	+ if ( substr( $auth_settings['ldap_attr_email'], 0, 1 ) === '@' ) {
	1340	+ $email = strtolower( $username . $auth_settings['ldap_attr_email'] );
	1341	+ } elseif ( array_key_exists( $auth_settings['ldap_attr_email'], $ldap_entries[$i] ) && $ldap_entries[$i][$auth_settings['ldap_attr_email']]['count'] > 0 && strlen( $ldap_entries[$i][$auth_settings['ldap_attr_email']][0] ) > 0 ) {
	1342	+ $email = strtolower( $ldap_entries[$i][$auth_settings['ldap_attr_email']][0] );
1547	1343	}
1548	1344	}
1549	1345	}
1550	1346
1551		- $result = @ldap_bind( $ldap, $ldap_user_dn, stripslashes( $password ) ); // phpcs:ignore
	1347	+ $result = @ldap_bind( $ldap, $ldap_user_dn, $password );
1552	1348	if ( ! $result ) {
1553	1349	// We have a real ldap user, but an invalid password. Pass
1554	1350	// through to wp authentication after failing LDAP (since
1555	1351	// this could be a local account that happens to be the
		@@ -1557,22 +1353,22 @@
1557	1353	return null;
1558	1354	}
1559	1355
1560	1356	// User successfully authenticated against LDAP, so set the relevant variables.
1561		- $externally_authenticated_email = $this->lowercase( $username . '@' . $domain );
	1357	+ $externally_authenticated_email = $username . '@' . $domain;
1562	1358
1563	1359	// If an LDAP attribute has been specified as containing the email address, use that instead.
1564	1360	if ( strlen( $email ) > 0 ) {
1565		- $externally_authenticated_email = $this->lowercase( $email );
	1361	+ $externally_authenticated_email = $email;
1566	1362	}
1567	1363
1568	1364	return array(
1569		- 'email' => $externally_authenticated_email,
1570		- 'username' => $username,
1571		- 'first_name' => $first_name,
1572		- 'last_name' => $last_name,
	1365	+ 'email' => $externally_authenticated_email,
	1366	+ 'username' => $username,
	1367	+ 'first_name' => $first_name,
	1368	+ 'last_name' => $last_name,
1573	1369	'authenticated_by' => 'ldap',
1574		- 'ldap_attributes' => $ldap_entries,
	1370	+ 'ldap_attributes' => $ldap_entries,
1575	1371	);
1576	1372	}
1577	1373
1578	1374
		@@ -1578,20 +1374,18 @@
1578	1374
1579	1375	/**
1580	1376	* Log out of the attached external service.
1581	1377	*
1582		- * Action: wp_logout
1583		- *
1584	1378	* @return void
1585	1379	*/
1586	1380	public function custom_logout() {
1587	1381	// Grab plugin settings.
1588		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
	1382	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' );
1589	1383
1590	1384	// Reset option containing old error messages.
1591	1385	delete_option( 'auth_settings_advanced_login_error' );
1592	1386
1593		- if ( session_id() === '' ) {
	1387	+ if ( session_id() == '' ) {
1594	1388	session_start();
1595	1389	}
1596	1390
1597	1391	$current_user_authenticated_by = get_user_meta( get_current_user_id(), 'authenticated_by', true );
		@@ -1596,53 +1390,38 @@
1596	1390
1597	1391	$current_user_authenticated_by = get_user_meta( get_current_user_id(), 'authenticated_by', true );
1598	1392
1599	1393	// If logged in to CAS, Log out of CAS.
1600		- if ( 'cas' === $current_user_authenticated_by && '1' === $auth_settings['cas'] ) {
	1394	+ if ( $current_user_authenticated_by === 'cas' && $auth_settings['cas'] === '1' ) {
1601	1395	if ( ! array_key_exists( 'PHPCAS_CLIENT', $GLOBALS ) || ! array_key_exists( 'phpCAS', $_SESSION ) ) {
1602	1396
1603		- /**
1604		- * Get the CAS server version (default to SAML_VERSION_1_1).
1605		- *
1606		- * @see: https://developer.jasig.org/cas-clients/php/1.3.4/docs/api/group__public.html
1607		- */
	1397	+ // Get the CAS server version (default to SAML_VERSION_1_1).
	1398	+ // See: https://developer.jasig.org/cas-clients/php/1.3.4/docs/api/group__public.html
1608	1399	$cas_version = SAML_VERSION_1_1;
1609		- if ( 'CAS_VERSION_3_0' === $auth_settings['cas_version'] ) {
	1400	+ if ( $auth_settings['cas_version'] === 'CAS_VERSION_3_0' ) {
1610	1401	$cas_version = CAS_VERSION_3_0;
1611		- } elseif ( 'CAS_VERSION_2_0' === $auth_settings['cas_version'] ) {
	1402	+ } elseif ( $auth_settings['cas_version'] === 'CAS_VERSION_2_0' ) {
1612	1403	$cas_version = CAS_VERSION_2_0;
1613		- } elseif ( 'CAS_VERSION_1_0' === $auth_settings['cas_version'] ) {
	1404	+ } elseif ( $auth_settings['cas_version'] === 'CAS_VERSION_1_0' ) {
1614	1405	$cas_version = CAS_VERSION_1_0;
1615	1406	}
1616	1407
1617	1408	// Set the CAS client configuration if it hasn't been set already.
1618	1409	phpCAS::client( $cas_version, $auth_settings['cas_host'], intval( $auth_settings['cas_port'] ), $auth_settings['cas_path'] );
1619		- // Allow redirects at the CAS server endpoint (e.g., allow connections
1620		- // at an old CAS URL that redirects to a newer CAS URL).
1621		- phpCAS::setExtraCurlOption( CURLOPT_FOLLOWLOCATION, true );
1622	1410	// Restrict logout request origin to the CAS server only (prevent DDOS).
1623	1411	phpCAS::handleLogoutRequests( true, array( $auth_settings['cas_host'] ) );
1624	1412	}
1625		- if ( phpCAS::isAuthenticated() || phpCAS::isInitialized() ) {
1626		- // Redirect to home page, or specified page if it's been provided.
1627		- $redirect_to = site_url( '/' );
1628		- if ( ! empty( $_REQUEST['redirect_to'] ) && isset( $_REQUEST['_wpnonce'] ) && wp_verify_nonce( sanitize_key( $_REQUEST['_wpnonce'] ), 'log-out' ) ) {
1629		- $redirect_to = esc_url_raw( wp_unslash( $_REQUEST['redirect_to'] ) );
1630		- }
1631		-
1632		- phpCAS::logoutWithRedirectService( $redirect_to );
	1413	+ if ( phpCAS::isAuthenticated() ) {
	1414	+ phpCAS::logoutWithRedirectService( get_option( 'siteurl' ) );
1633	1415	}
1634	1416	}
1635	1417
1636	1418	// If session token set, log out of Google.
1637		- if ( 'google' === $current_user_authenticated_by || array_key_exists( 'token', $_SESSION ) ) {
	1419	+ if ( $current_user_authenticated_by === 'google' || array_key_exists( 'token', $_SESSION ) ) {
1638	1420	$token = json_decode( $_SESSION['token'] )->access_token;
1639	1421
1640		- /**
1641		- * Add Google API PHP Client.
1642		- *
1643		- * @see https://github.com/google/google-api-php-client branch:v1-master
1644		- */
	1422	+ // Add Google API PHP Client.
	1423	+ // @see https://github.com/google/google-api-php-client branch:v1-master
1645	1424	require_once dirname( __FILE__ ) . '/vendor/google-api-php-client/src/Google/autoload.php';
1646	1425
1647	1426	// Build the Google Client.
1648	1427	$client = new Google_Client();
		@@ -1650,9 +1429,14 @@
1650	1429	$client->setClientId( $auth_settings['google_clientid'] );
1651	1430	$client->setClientSecret( $auth_settings['google_clientsecret'] );
1652	1431	$client->setRedirectUri( 'postmessage' );
1653	1432
1654		- // Revoke the token.
	1433	+ // If the hosted domain parameter is set, restrict logins to that domain.
	1434	+ if ( array_key_exists( 'google_hosteddomain', $auth_settings ) && strlen( $auth_settings['google_hosteddomain'] ) > 0 ) {
	1435	+ $client->setHostedDomain( $auth_settings['google_hosteddomain'] );
	1436	+ }
	1437	+
	1438	+ // Revoke the token
1655	1439	$client->revokeToken( $token );
1656	1440
1657	1441	// Remove the credentials from the user's session.
1658	1442	unset( $_SESSION['token'] );
		@@ -1671,61 +1455,60 @@
1671	1455
1672	1456
1673	1457	/**
1674	1458	* Restrict access to WordPress site based on settings (everyone, logged_in_users).
	1459	+ * Hook: parse_request http://codex.wordpress.org/Plugin_API/Action_Reference/parse_request
1675	1460	*
1676		- * Action: parse_request
	1461	+ * @param array $wp WordPress object.
1677	1462	*
1678		- * @param array $wp WordPress object.
1679		- * @return WP|void WP object when passing through to WordPress authentication, or void.
	1463	+ * @return void
1680	1464	*/
1681	1465	public function restrict_access( $wp ) {
1682	1466	// Grab plugin settings.
1683		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
	1467	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' );
1684	1468
1685	1469	// Grab current user.
1686	1470	$current_user = wp_get_current_user();
1687	1471
1688	1472	$has_access = (
1689		- // Always allow access if WordPress is installing.
1690		- // phpcs:ignore WordPress.CSRF.NonceVerification.NoNonceVerification
	1473	+ // Always allow access if WordPress is installing
1691	1474	( defined( 'WP_INSTALLING' ) && isset( $_GET['key'] ) ) ||
1692		- // Always allow access to admins.
	1475	+ // Always allow access to admins
1693	1476	( current_user_can( 'create_users' ) ) ||
1694		- // Allow access if option is set to 'everyone'.
1695		- ( 'everyone' === $auth_settings['access_who_can_view'] ) ||
1696		- // Allow access to approved external users and logged in users if option is set to 'logged_in_users'.
1697		- ( 'logged_in_users' === $auth_settings['access_who_can_view'] && $this->is_user_logged_in_and_blog_user() && $this->is_email_in_list( $current_user->user_email, 'approved' ) ) ||
1698		- // Allow access for requests to /wp-json/oauth1 so oauth clients can authenticate to use the REST API.
1699		- ( property_exists( $wp, 'matched_query' ) && stripos( $wp->matched_query, 'rest_oauth1=' ) === 0 ) ||
1700		- // Allow access for non-GET requests to /wp-json/*, since REST API authentication already covers them.
1701		- ( property_exists( $wp, 'matched_query' ) && 0 === stripos( $wp->matched_query, 'rest_route=' ) && isset( $_SERVER['REQUEST_METHOD'] ) && 'GET' !== $_SERVER['REQUEST_METHOD'] ) ||
1702		- // Allow access for GET requests to /wp-json/ (root), since REST API discovery calls rely on this.
1703		- ( property_exists( $wp, 'matched_query' ) && 'rest_route=/' === $wp->matched_query )
	1477	+ // Allow access if option is set to 'everyone'
	1478	+ ( $auth_settings['access_who_can_view'] == 'everyone' ) ||
	1479	+ // Allow access to approved external users and logged in users if option is set to 'logged_in_users'
	1480	+ ( $auth_settings['access_who_can_view'] == 'logged_in_users' && $this->is_user_logged_in_and_blog_user() && $this->is_email_in_list( $current_user->user_email, 'approved' ) ) ||
	1481	+ // Allow access for requests to /wp-json/oauth1 so oauth clients can authenticate to use the REST API
	1482	+ ( property_exists( $wp, 'matched_query' ) && stripos( $wp->matched_query, "rest_oauth1=" ) === 0 ) ||
	1483	+ // Allow access for non-GET requests to /wp-json/*, since REST API authentication already covers them
	1484	+ ( property_exists( $wp, 'matched_query' ) && stripos( $wp->matched_query, "rest_route=" ) === 0 && $_SERVER['REQUEST_METHOD'] !== 'GET' ) ||
	1485	+ // Allow access for GET requests to /wp-json/ (root), since REST API discovery calls rely on this
	1486	+ ( property_exists( $wp, 'matched_query' ) && $wp->matched_query === 'rest_route=/' )
1704	1487	// Note that GET requests to a rest endpoint will be restricted by authorizer. In that case, error messages will be returned as JSON.
1705	1488	);
1706	1489
1707	1490	/**
1708		- * Developers can use the `authorizer_has_access` filter to override
1709		- * restricted access on certain pages. Note that the restriction checks
1710		- * happens before WordPress executes any queries, so use the $wp variable
1711		- * to investigate what the visitor is trying to load.
	1491	+ * Developers can use the `authorizer_has_access` filter
	1492	+ * to override restricted access on certain pages. Note that the
	1493	+ * restriction checks happens before WordPress executes any queries, so
	1494	+ * use the global `$wp` variable to investigate what the visitor is
	1495	+ * trying to load.
1712	1496	*
1713	1497	* For example, to unblock an RSS feed, place the following PHP code in
1714	1498	* the theme's functions.php file or in a simple plug-in:
1715	1499	*
1716		- * function my_feed_access_override( $has_access, $wp ) {
1717		- * // Check query variables to see if this is the feed.
1718		- * if ( ! empty( $wp->query_vars['feed'] ) ) {
	1500	+ * function my_rsa_feed_access_override( $has_access ) {
	1501	+ * global $wp;
	1502	+ * // check query variables to see if this is the feed
	1503	+ * if ( ! empty( $wp->query_vars['feed'] ) )
1719	1504	* $has_access = true;
1720		- * }
1721		- *
1722	1505	* return $has_access;
1723	1506	* }
1724		- * add_filter( 'authorizer_has_access', 'my_feed_access_override', 10, 2 );
	1507	+ * add_filter( 'authorizer_has_access', 'my_rsa_feed_access_override' );
1725	1508	*/
1726	1509	if ( apply_filters( 'authorizer_has_access', $has_access, $wp ) === true ) {
1727		- // Turn off the public notice about browsing anonymously.
	1510	+ // Turn off the public notice about browsing anonymously
1728	1511	update_option( 'auth_settings_advanced_public_notice', false );
1729	1512
1730	1513	// We've determined that the current user has access, so simply return to grant access.
1731	1514	return $wp;
		@@ -1731,13 +1514,13 @@
1731	1514	return $wp;
1732	1515	}
1733	1516
1734	1517	// Allow HEAD requests to the root (usually discovery from a REST client).
1735		- if ( 'HEAD' === $_SERVER['REQUEST_METHOD'] && empty( $wp->request ) && empty( $wp->matched_query ) ) {
	1518	+ if ( $_SERVER['REQUEST_METHOD'] === 'HEAD' && empty( $wp->request ) && empty( $wp->matched_query ) ) {
1736	1519	return $wp;
1737	1520	}
1738	1521
1739		- /* We've determined that the current user doesn't have access, so we deal with them now. */
	1522	+ // We've determined that the current user doesn't have access, so we deal with them now.
1740	1523
1741	1524	// Fringe case: In a multisite, a user of a different blog can successfully
1742	1525	// log in, but they aren't on the 'approved' whitelist for this blog.
1743	1526	// If that's the case, add them to the pending list for this blog.
		@@ -1748,19 +1531,21 @@
1748	1531	$result = $this->check_user_access( $current_user, array( $current_user->user_email ) );
1749	1532	}
1750	1533
1751	1534	// Check to see if the requested page is public. If so, show it.
1752		- if ( empty( $wp->request ) ) {
1753		- $current_page_id = 'home';
1754		- } else {
1755		- $request_query = isset( $wp->query_vars ) ? new WP_Query( $wp->query_vars ) : null;
1756		- $current_page_id = isset( $request_query->post_count ) && $request_query->post_count > 0 ? $request_query->post->ID : '';
	1535	+ $current_page_name = property_exists( $wp, 'query_vars' ) && array_key_exists( 'name', $wp->query_vars ) && strlen( $wp->query_vars['name'] ) > 0 ? $wp->query_vars['name'] : '';
	1536	+ if ( ! $current_page_name ) {
	1537	+ // Different WordPress versions store the page slug in different places; look for it elsewhere.
	1538	+ if ( property_exists( $wp, 'query_vars' ) && array_key_exists( 'pagename', $wp->query_vars ) && strlen( $wp->query_vars['pagename'] ) > 0 ) {
	1539	+ $current_page_name = $wp->query_vars['pagename'];
	1540	+ }
1757	1541	}
	1542	+ $current_page_id = empty( $wp->request ) ? 'home' : $this->get_id_from_pagename( $current_page_name );
1758	1543	if ( ! array_key_exists( 'access_public_pages', $auth_settings ) || ! is_array( $auth_settings['access_public_pages'] ) ) {
1759	1544	$auth_settings['access_public_pages'] = array();
1760	1545	}
1761		- if ( in_array( strval( $current_page_id ), $auth_settings['access_public_pages'], true ) ) {
1762		- if ( 'no_warning' === $auth_settings['access_public_warning'] ) {
	1546	+ if ( in_array( $current_page_id, $auth_settings['access_public_pages'] ) ) {
	1547	+ if ( $auth_settings['access_public_warning'] === 'no_warning' ) {
1763	1548	update_option( 'auth_settings_advanced_public_notice', false );
1764	1549	} else {
1765	1550	update_option( 'auth_settings_advanced_public_notice', true );
1766	1551	}
		@@ -1768,11 +1553,11 @@
1768	1553	}
1769	1554
1770	1555	// Check to see if any category assigned to the requested page is public. If so, show it.
1771	1556	$current_page_categories = wp_get_post_categories( $current_page_id, array( 'fields' => 'slugs' ) );
1772		- foreach ( $current_page_categories as $current_page_category ) {
1773		- if ( in_array( 'cat_' . $current_page_category, $auth_settings['access_public_pages'], true ) ) {
1774		- if ( 'no_warning' === $auth_settings['access_public_warning'] ) {
	1557	+ foreach( $current_page_categories as $current_page_category ) {
	1558	+ if ( in_array( 'cat_' . $current_page_category, $auth_settings['access_public_pages'] ) ) {
	1559	+ if ( $auth_settings['access_public_warning'] === 'no_warning' ) {
1775	1560	update_option( 'auth_settings_advanced_public_notice', false );
1776	1561	} else {
1777	1562	update_option( 'auth_settings_advanced_public_notice', true );
1778	1563	}
		@@ -1780,11 +1565,11 @@
1780	1565	}
1781	1566	}
1782	1567
1783	1568	// Check to see if this page can't be found. If so, allow showing the 404 page.
1784		- if ( strlen( $current_page_id ) < 1 ) {
1785		- if ( in_array( 'auth_public_404', $auth_settings['access_public_pages'], true ) ) {
1786		- if ( 'no_warning' === $auth_settings['access_public_warning'] ) {
	1569	+ if ( strlen( $current_page_name ) > 0 && strlen( $current_page_id ) < 1 ) {
	1570	+ if ( in_array( 'auth_public_404', $auth_settings['access_public_pages'] ) ) {
	1571	+ if ( $auth_settings['access_public_warning'] === 'no_warning' ) {
1787	1572	update_option( 'auth_settings_advanced_public_notice', false );
1788	1573	} else {
1789	1574	update_option( 'auth_settings_advanced_public_notice', true );
1790	1575	}
		@@ -1789,39 +1574,24 @@
1789	1574	update_option( 'auth_settings_advanced_public_notice', true );
1790	1575	}
1791	1576	return $wp;
1792	1577	}
1793		- }
1794	1578
1795		- // Check to see if the requested category is public. If so, show it.
1796		- $current_category_name = property_exists( $wp, 'query_vars' ) && array_key_exists( 'category_name', $wp->query_vars ) && strlen( $wp->query_vars['category_name'] ) > 0 ? $wp->query_vars['category_name'] : '';
1797		- if ( $current_category_name ) {
1798		- $current_category_name = end( explode( '/', $current_category_name ) );
1799		- if ( in_array( 'cat_' . $current_category_name, $auth_settings['access_public_pages'], true ) ) {
1800		- if ( 'no_warning' === $auth_settings['access_public_warning'] ) {
1801		- update_option( 'auth_settings_advanced_public_notice', false );
1802		- } else {
1803		- update_option( 'auth_settings_advanced_public_notice', true );
1804		- }
1805		- return $wp;
1806		- }
1807	1579	}
1808	1580
1809	1581	// User is denied access, so show them the error message. Render as JSON
1810	1582	// if this is a REST API call; otherwise, show the error message via
1811	1583	// wp_die() (rendered html), or redirect to the login URL.
1812		- $current_path = ! empty( $_SERVER['REQUEST_URI'] ) ? esc_url_raw( wp_unslash( $_SERVER['REQUEST_URI'] ) ) : home_url();
1813		- if ( property_exists( $wp, 'matched_query' ) && stripos( $wp->matched_query, 'rest_route=' ) === 0 && 'GET' === $_SERVER['REQUEST_METHOD'] ) {
1814		- wp_send_json(
1815		- array(
1816		- 'code' => 'rest_cannot_view',
1817		- 'message' => strip_tags( $auth_settings['access_redirect_to_message'] ),
1818		- 'data' => array(
1819		- 'status' => 401,
1820		- ),
1821		- )
1822		- );
1823		- } elseif ( 'message' === $auth_settings['access_redirect'] ) {
	1584	+ $current_path = empty( $_SERVER['REQUEST_URI'] ) ? home_url() : $_SERVER['REQUEST_URI'];
	1585	+ if ( property_exists( $wp, 'matched_query' ) && stripos( $wp->matched_query, "rest_route=" ) === 0 && $_SERVER['REQUEST_METHOD'] === 'GET' ) {
	1586	+ wp_send_json( array(
	1587	+ 'code' => 'rest_cannot_view',
	1588	+ 'message' => strip_tags( $auth_settings['access_redirect_to_message'] ),
	1589	+ 'data' => array(
	1590	+ 'status' => 401,
	1591	+ ),
	1592	+ ));
	1593	+ } elseif ( $auth_settings['access_redirect'] === 'message' ) {
1824	1594	$page_title = sprintf(
1825	1595	/* TRANSLATORS: %s: Name of blog */
1826	1596	__( '%s - Access Restricted', 'authorizer' ),
1827	1597	get_bloginfo( 'name' )
		@@ -1832,65 +1602,20 @@
1832	1602	'<p style="text-align: center;margin-bottom: -15px;">' .
1833	1603	'<a class="button" href="' . wp_login_url( $current_path ) . '">' .
1834	1604	__( 'Log In', 'authorizer' ) .
1835	1605	'</a></p>';
1836		- wp_die( wp_kses( $error_message, $this->allowed_html ), esc_html( $page_title ) );
1837		- } else {
	1606	+ wp_die( $error_message, $page_title );
	1607	+ } else { // if ( $auth_settings['access_redirect'] === 'login' ) {
1838	1608	wp_redirect( wp_login_url( $current_path ), 302 );
1839	1609	exit;
1840	1610	}
1841	1611
1842		- // Sanity check: we should never get here.
	1612	+ // Sanity check: we should never get here
1843	1613	wp_die( '<p>Access denied.</p>', 'Site Access Restricted' );
1844	1614	}
1845	1615
1846	1616
1847		- /**
1848		- * On an admin page load, check for edge case (network-approved user who has
1849		- * not yet been added to this particular blog in a multisite). Note: we do
1850		- * this because check_user_access() runs on the parse_request hook, which
1851		- * does not fire on wp-admin pages.
1852		- *
1853		- * Action: init
1854		- *
1855		- * @return void
1856		- */
1857		- public function init__maybe_add_network_approved_user() {
1858		- global $current_user;
1859	1617
1860		- // If this is a multisite install and we have a logged in user that's not
1861		- // a member of this blog, but is (network) approved, add them to this blog.
1862		- if (
1863		- is_admin() &&
1864		- is_multisite() &&
1865		- is_user_logged_in() &&
1866		- ! is_user_member_of_blog() &&
1867		- $this->is_email_in_list( $current_user->user_email, 'approved' )
1868		- ) {
1869		- // Get all approved users.
1870		- $auth_settings_access_users_approved = $this->sanitize_user_list(
1871		- array_merge(
1872		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT ),
1873		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT )
1874		- )
1875		- );
1876		-
1877		- // Get user info (we need user role).
1878		- $user_info = $this->get_user_info_from_list(
1879		- $current_user->user_email,
1880		- $auth_settings_access_users_approved
1881		- );
1882		-
1883		- // Add user to blog.
1884		- add_user_to_blog( get_current_blog_id(), $current_user->ID, $user_info['role'] );
1885		-
1886		- // Refresh user permissions.
1887		- $current_user = new WP_User( $current_user->ID ); // phpcs:ignore WordPress.Variables.GlobalVariables.OverrideProhibited
1888		- }
1889		- }
1890		-
1891		-
1892		-
1893	1618	/**
1894	1619	* ***************************
1895	1620	* Login page (wp-login.php)
1896	1621	* ***************************
		@@ -1899,15 +1624,11 @@
1899	1624
1900	1625
1901	1626	/**
1902	1627	* Add custom error message to login screen.
1903		- *
1904	1628	* Filter: login_errors
1905		- *
1906		- * @param string $errors Error description.
1907		- * @return string Error description with Authorizer errors added.
1908	1629	*/
1909		- public function show_advanced_login_error( $errors ) {
	1630	+ function show_advanced_login_error( $errors ) {
1910	1631	$error = get_option( 'auth_settings_advanced_login_error' );
1911	1632	delete_option( 'auth_settings_advanced_login_error' );
1912	1633	$errors = ' ' . $error . "<br />\n";
1913	1634	return $errors;
		@@ -1915,25 +1636,24 @@
1915	1636
1916	1637
1917	1638	/**
1918	1639	* Load external resources for the public-facing site.
1919		- *
1920		- * Action: wp_enqueue_scripts
1921	1640	*/
1922		- public function auth_public_scripts() {
1923		- // Load (and localize) public scripts.
1924		- $current_path = ! empty( $_SERVER['REQUEST_URI'] ) ? esc_url_raw( wp_unslash( $_SERVER['REQUEST_URI'] ) ) : home_url();
1925		- wp_enqueue_script( 'auth_public_scripts', plugins_url( '/js/authorizer-public.js', __FILE__ ), array( 'jquery' ), '2.8.0' );
	1641	+ function auth_public_scripts() {
	1642	+ // Load (and localize) public scripts
	1643	+ $current_path = empty( $_SERVER['REQUEST_URI'] ) ? home_url() : $_SERVER['REQUEST_URI'];
	1644	+ wp_enqueue_script( 'auth_public_scripts', plugins_url( '/js/authorizer-public.js', __FILE__ ), array( 'jquery' ), '2.3.2' );
1926	1645	$auth_localized = array(
1927		- 'wpLoginUrl' => wp_login_url( $current_path ),
1928		- 'publicWarning' => get_option( 'auth_settings_advanced_public_notice' ),
1929		- 'anonymousNotice' => $this->get_plugin_option( 'access_redirect_to_message' ),
1930		- 'logIn' => esc_html__( 'Log In', 'authorizer' ),
	1646	+ 'wp_login_url' => wp_login_url( $current_path ),
	1647	+ 'public_warning' => get_option( 'auth_settings_advanced_public_notice' ),
	1648	+ 'anonymous_notice' => $this->get_plugin_option( 'access_redirect_to_message' ),
	1649	+ 'log_in' => esc_html__( 'Log In', 'authorizer' ),
1931	1650	);
1932	1651	wp_localize_script( 'auth_public_scripts', 'auth', $auth_localized );
	1652	+ //update_option( 'auth_settings_advanced_public_notice', false);
1933	1653
1934		- // Load public css.
1935		- wp_register_style( 'authorizer-public-css', plugins_url( 'css/authorizer-public.css', __FILE__ ), array(), '2.8.0' );
	1654	+ // Load public css
	1655	+ wp_register_style( 'authorizer-public-css', plugins_url( 'css/authorizer-public.css', __FILE__ ), array(), '2.3.2' );
1936	1656	wp_enqueue_style( 'authorizer-public-css' );
1937	1657	}
1938	1658
1939	1659
		@@ -1939,21 +1659,19 @@
1939	1659
1940	1660	/**
1941	1661	* Enqueue JS scripts and CSS styles appearing on wp-login.php.
1942	1662	*
1943		- * Action: login_enqueue_scripts
1944		- *
1945	1663	* @return void
1946	1664	*/
1947		- public function login_enqueue_scripts_and_styles() {
	1665	+ function login_enqueue_scripts_and_styles() {
1948	1666	// Grab plugin settings.
1949		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
	1667	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' );
1950	1668
1951	1669	// Enqueue scripts appearing on wp-login.php.
1952		- wp_enqueue_script( 'auth_login_scripts', plugins_url( '/js/authorizer-login.js', __FILE__ ), array( 'jquery' ), '2.8.0' );
	1670	+ wp_enqueue_script( 'auth_login_scripts', plugins_url( '/js/authorizer-login.js', __FILE__ ), array( 'jquery' ), '2.3.2' );
1953	1671
1954	1672	// Enqueue styles appearing on wp-login.php.
1955		- wp_register_style( 'authorizer-login-css', plugins_url( '/css/authorizer-login.css', __FILE__ ), array(), '2.8.0' );
	1673	+ wp_register_style( 'authorizer-login-css', plugins_url( '/css/authorizer-login.css', __FILE__ ), array(), '2.3.2' );
1956	1674	wp_enqueue_style( 'authorizer-login-css' );
1957	1675
1958	1676	/**
1959	1677	* Developers can use the `authorizer_add_branding_option` filter
		@@ -1958,8 +1676,9 @@
1958	1676	/**
1959	1677	* Developers can use the `authorizer_add_branding_option` filter
1960	1678	* to add a radio button for "Custom WordPress login branding"
1961	1679	* under the "Advanced" tab in Authorizer options. Example:
	1680	+ *
1962	1681	* function my_authorizer_add_branding_option( $branding_options ) {
1963	1682	* $new_branding_option = array(
1964	1683	* 'value' => 'your_brand'
1965	1684	* 'description' => 'Custom Your Brand Login Screen',
		@@ -1973,23 +1692,23 @@
1973	1692	*/
1974	1693	$branding_options = array();
1975	1694	$branding_options = apply_filters( 'authorizer_add_branding_option', $branding_options );
1976	1695	foreach ( $branding_options as $branding_option ) {
1977		- // Make sure the custom brands have the required values.
	1696	+ // Make sure the custom brands have the required values
1978	1697	if ( ! ( is_array( $branding_option ) && array_key_exists( 'value', $branding_option ) && array_key_exists( 'css_url', $branding_option ) && array_key_exists( 'js_url', $branding_option ) ) ) {
1979	1698	continue;
1980	1699	}
1981	1700	if ( $auth_settings['advanced_branding'] === $branding_option['value'] ) {
1982		- wp_enqueue_script( 'auth_login_custom_scripts-' . sanitize_title( $branding_option['value'] ), $branding_option['js_url'], array( 'jquery' ), '2.8.0' );
1983		- wp_register_style( 'authorizer-login-custom-css-' . sanitize_title( $branding_option['value'] ), $branding_option['css_url'], array(), '2.8.0' );
	1701	+ wp_enqueue_script( 'auth_login_custom_scripts-' . sanitize_title( $branding_option['value'] ), $branding_option['js_url'], array( 'jquery' ), '2.3.2' );
	1702	+ wp_register_style( 'authorizer-login-custom-css-' . sanitize_title( $branding_option['value'] ), $branding_option['css_url'], array(), '2.3.2' );
1984	1703	wp_enqueue_style( 'authorizer-login-custom-css-' . sanitize_title( $branding_option['value'] ) );
1985	1704	}
1986	1705	}
1987	1706
1988	1707	// If we're using Google logins, load those resources.
1989		- if ( '1' === $auth_settings['google'] ) {
1990		- wp_enqueue_script( 'authorizer-login-custom-google', plugins_url( '/js/authorizer-login-custom_google.js', __FILE__ ), array( 'jquery' ), '2.8.0' ); ?>
1991		- <meta name="google-signin-clientid" content="<?php echo esc_attr( $auth_settings['google_clientid'] ); ?>" />
	1708	+ if ( $auth_settings['google'] === '1' ) {
	1709	+ wp_enqueue_script( 'authorizer-login-custom-google', plugins_url( '/js/authorizer-login-custom_google.js', __FILE__ ), array( 'jquery' ), '2.3.2' ); ?>
	1710	+ <meta name="google-signin-clientid" content="<?php echo $auth_settings['google_clientid']; ?>" />
1992	1711	<meta name="google-signin-scope" content="email" />
1993	1712	<meta name="google-signin-cookiepolicy" content="single_host_origin" />
1994	1713	<?php
1995	1714	}
		@@ -1997,127 +1716,110 @@
1997	1716
1998	1717
1999	1718	/**
2000	1719	* Load external resources in the footer of the wp-login.php page.
2001		- *
2002		- * Action: login_footer
	1720	+ * Run on action hook: login_footer
2003	1721	*/
2004		- public function load_login_footer_js() {
	1722	+ function load_login_footer_js() {
2005	1723	// Grab plugin settings.
2006		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
2007		- $ajaxurl = admin_url( 'admin-ajax.php' );
2008		- if ( '1' === $auth_settings['google'] ) :
2009		- ?>
2010		-<script type="text/javascript">
2011		-/* global location, window */
2012		-// Reload login page if reauth querystring param exists,
2013		-// since reauth interrupts external logins (e.g., google).
2014		-if ( location.search.indexOf( 'reauth=1' ) >= 0 ) {
2015		- location.href = location.href.replace( 'reauth=1', '' );
2016		-}
	1724	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' ); ?>
	1725	+ <?php if ( $auth_settings['google'] === '1' ): ?>
	1726	+ <script type="text/javascript">
	1727	+ // Reload login page if reauth querystring param exists,
	1728	+ // since reauth interrupts external logins (e.g., google).
	1729	+ if ( location.search.indexOf( 'reauth=1' ) >= 0 ) {
	1730	+ location.href = location.href.replace( 'reauth=1', '' );
	1731	+ }
2017	1732
2018		-// eslint-disable-next-line no-implicit-globals
2019		-function authUpdateQuerystringParam( uri, key, value ) {
2020		- var re = new RegExp( '([?&])' + key + '=.*?(&|$)', 'i' );
2021		- var separator = uri.indexOf( '?' ) !== -1 ? '&' : '?';
2022		- if ( uri.match( re ) ) {
2023		- return uri.replace( re, '$1' + key + '=' + value + '$2' );
2024		- } else {
2025		- return uri + separator + key + '=' + value;
2026		- }
2027		-}
	1733	+ function auth_update_querystring_param( uri, key, value ) {
	1734	+ var re = new RegExp( '([?&])' + key + '=.*?(&|$)', 'i' );
	1735	+ var separator = uri.indexOf( '?' ) !== -1 ? '&' : '?';
	1736	+ if ( uri.match( re ) ) {
	1737	+ return uri.replace( re, '$1' + key + '=' + value + '$2' );
	1738	+ } else {
	1739	+ return uri + separator + key + '=' + value;
	1740	+ }
	1741	+ }
2028	1742
2029		-// eslint-disable-next-line
2030		-function signInCallback( authResult ) { // jshint ignore:line
2031		- var $ = jQuery;
2032		- if ( authResult.status && authResult.status.signed_in ) {
2033		- // Hide the sign-in button now that the user is authorized, for example:
2034		- $( '#googleplus_button' ).attr( 'style', 'display: none' );
	1743	+ function signInCallback( authResult ) {
	1744	+ var $ = jQuery;
	1745	+ if ( authResult['status'] && authResult['status']['signed_in'] ) {
	1746	+ // Hide the sign-in button now that the user is authorized, for example:
	1747	+ $( '#googleplus_button' ).attr( 'style', 'display: none' );
2035	1748
2036		- // Send the code to the server
2037		- var ajaxurl = '<?php echo esc_attr( $ajaxurl ); ?>';
2038		- $.post(ajaxurl, {
2039		- action: 'process_google_login',
2040		- code: authResult.code,
2041		- nonce: $('#nonce_google_auth-<?php echo esc_attr( $this->get_cookie_value() ); ?>' ).val(),
2042		- }, function() {
2043		- // Handle or verify the server response if necessary.
2044		- // console.log( response );
	1749	+ // Send the code to the server
	1750	+ var ajaxurl = '<?php echo admin_url( "admin-ajax.php" ); ?>';
	1751	+ $.post(ajaxurl, {
	1752	+ action: 'process_google_login',
	1753	+ 'code': authResult['code'],
	1754	+ 'nonce': $('#nonce_google_auth-<?php echo $this->get_cookie_value(); ?>' ).val(),
	1755	+ }, function( response ) {
	1756	+ // Handle or verify the server response if necessary.
	1757	+ //console.log( response );
2045	1758
2046		- // Reload wp-login.php to continue the authentication process.
2047		- var newHref = authUpdateQuerystringParam( location.href, 'external', 'google' );
2048		- if ( location.href === newHref ) {
2049		- location.reload();
2050		- } else {
2051		- location.href = newHref;
2052		- }
2053		- });
2054		- } else {
2055		- // Update the app to reflect a signed out user
2056		- // Possible error values:
2057		- // "user_signed_out" - User is signed-out
2058		- // "access_denied" - User denied access to your app
2059		- // "immediate_failed" - Could not automatically log in the user
2060		- // console.log('Sign-in state: ' + authResult['error']);
	1759	+ // Reload wp-login.php to continue the authentication process.
	1760	+ var new_href = auth_update_querystring_param( location.href, 'external', 'google' );
	1761	+ if ( location.href === new_href ) {
	1762	+ location.reload();
	1763	+ } else {
	1764	+ location.href = new_href;
	1765	+ }
	1766	+ });
	1767	+ } else {
	1768	+ // Update the app to reflect a signed out user
	1769	+ // Possible error values:
	1770	+ // "user_signed_out" - User is signed-out
	1771	+ // "access_denied" - User denied access to your app
	1772	+ // "immediate_failed" - Could not automatically log in the user
	1773	+ //console.log('Sign-in state: ' + authResult['error']);
2061	1774
2062		- // If user denies access, reload the login page.
2063		- if ( authResult.error === 'access_denied' || authResult.error === 'user_signed_out' ) {
2064		- window.location.reload();
	1775	+ // If user denies access, reload the login page.
	1776	+ if ( authResult['error'] === 'access_denied' || authResult['error'] === 'user_signed_out' ) {
	1777	+ window.location.reload();
	1778	+ }
	1779	+ }
	1780	+ }
	1781	+ </script>
	1782	+ <?php endif;
2065	1783	}
2066		- }
2067		-}
2068		-</script>
2069		- <?php
2070		- endif;
2071		- }
2072	1784
2073	1785
2074	1786	/**
2075	1787	* Create links for any external authentication services that are enabled.
2076		- *
2077		- * Action: login_form
2078	1788	*/
2079		- public function login_form_add_external_service_links() {
	1789	+ function login_form_add_external_service_links() {
2080	1790	// Grab plugin settings.
2081		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
2082		- ?>
	1791	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' ); ?>
2083	1792	<div id="auth-external-service-login">
2084		- <?php if ( '1' === $auth_settings['google'] ) : ?>
2085		- <p><a id="googleplus_button" class="button button-primary button-external button-google"><span class="dashicons dashicons-googleplus"></span><span class="label"><?php esc_html_e( 'Sign in with Google', 'authorizer' ); ?></span></a></p>
	1793	+ <?php if ( $auth_settings['google'] === '1' ): ?>
	1794	+ <p><a id="googleplus_button" class="button button-primary button-external button-google"><span class="dashicons dashicons-googleplus"></span><span class="label"><?php _e( 'Sign in with Google', 'authorizer' ); ?></span></a></p>
2086	1795	<?php wp_nonce_field( 'google_csrf_nonce', 'nonce_google_auth-' . $this->get_cookie_value() ); ?>
2087	1796	<?php endif; ?>
2088	1797
2089		- <?php if ( '1' === $auth_settings['cas'] ) : ?>
2090		- <p><a class="button button-primary button-external button-cas" href="<?php echo esc_attr( $this->modify_current_url_for_cas_login() ); ?>">
	1798	+ <?php if ( $auth_settings['cas'] === '1' ): ?>
	1799	+ <p><a class="button button-primary button-external button-cas" href="<?php echo $this->modify_current_url_for_cas_login(); ?>">
2091	1800	<span class="dashicons dashicons-lock"></span>
2092		- <span class="label">
2093		- <?php
2094		- echo esc_html(
2095		- sprintf(
2096		- /* TRANSLATORS: %s: Custom CAS label from authorizer options */
2097		- __( 'Sign in with %s', 'authorizer' ),
2098		- $auth_settings['cas_custom_label']
2099		- )
	1801	+ <span class="label"><?php
	1802	+ printf(
	1803	+ /* TRANSLATORS: %s: Custom CAS label from authorizer options */
	1804	+ __( 'Sign in with %s', 'authorizer' ),
	1805	+ $auth_settings['cas_custom_label']
2100	1806	);
2101		- ?>
2102		- </span>
	1807	+ ?></span>
2103	1808	</a></p>
2104	1809	<?php endif; ?>
2105	1810
2106		- <?php if ( '1' === $auth_settings['advanced_hide_wp_login'] && isset( $_SERVER['QUERY_STRING'] ) && false === strpos( $_SERVER['QUERY_STRING'], 'external=wordpress' ) ) : // phpcs:ignore WordPress.VIP.ValidatedSanitizedInput ?>
	1811	+ <?php if ( $auth_settings['advanced_hide_wp_login'] === '1' && strpos( $_SERVER['QUERY_STRING'], 'external=wordpress' ) === false ): ?>
2107	1812	<style type="text/css">
2108		- body.login-action-login form {
2109		- padding-bottom: 8px;
	1813	+ #loginform {
	1814	+ padding-bottom: 8px !important;
2110	1815	}
2111		- body.login-action-login form p > label,
2112		- body.login-action-login form .forgetmenot,
2113		- body.login-action-login form .submit,
2114		- body.login-action-login #nav { /* csslint allow: ids */
2115		- display: none;
	1816	+ #loginform p>label, #loginform p.forgetmenot, #loginform p.submit, p#nav {
	1817	+ display: none !important;
2116	1818	}
2117	1819	</style>
2118		- <?php elseif ( '1' === $auth_settings['cas'] || '1' === $auth_settings['google'] ) : ?>
2119		- <h3> &mdash; <?php esc_html_e( 'or', 'authorizer' ); ?> &mdash; </h3>
	1820	+ <?php elseif ( $auth_settings['cas'] === '1' || $auth_settings['google'] === '1' ): ?>
	1821	+ <h3> &mdash; <?php _e( 'or', 'authorizer' ); ?> &mdash; </h3>
2120	1822	<?php endif; ?>
2121	1823	</div>
2122	1824	<?php
2123	1825
		@@ -2126,79 +1828,36 @@
2126	1828
2127	1829	/**
2128	1830	* Redirect to CAS login when visiting login page (only if option is
2129	1831	* enabled, CAS is the only service, and WordPress logins are hidden).
2130		- * Note: hook into wp_login_errors filter so this fires after the
2131		- * authenticate hook (where the redirect to CAS happens), but before html
2132		- * output is started (so the redirect header doesn't complain about data
2133		- * already being sent).
2134		- *
2135		- * Filter: wp_login_errors
2136		- *
2137		- * @param object $errors WP Error object.
2138		- * @param string $redirect_to Where to redirect on error.
2139		- * @return WP_Error|void WP Error object or void on redirect.
2140	1832	*/
2141		- public function wp_login_errors__maybe_redirect_to_cas( $errors, $redirect_to ) {
	1833	+ function login_head_maybe_redirect_to_cas() {
2142	1834	// Grab plugin settings.
2143		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
	1835	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' );
2144	1836
2145	1837	// Check whether we should redirect to CAS.
2146	1838	if (
2147		- isset( $_SERVER['QUERY_STRING'] ) &&
2148		- strpos( $_SERVER['QUERY_STRING'], 'external=wordpress' ) === false && // phpcs:ignore WordPress.VIP.ValidatedSanitizedInput
2149		- array_key_exists( 'cas_auto_login', $auth_settings ) && '1' === $auth_settings['cas_auto_login'] &&
2150		- array_key_exists( 'cas', $auth_settings ) && '1' === $auth_settings['cas'] &&
2151		- ( ! array_key_exists( 'ldap', $auth_settings ) || '1' !== $auth_settings['ldap'] ) &&
2152		- ( ! array_key_exists( 'google', $auth_settings ) || '1' !== $auth_settings['google'] ) &&
2153		- array_key_exists( 'advanced_hide_wp_login', $auth_settings ) && '1' === $auth_settings['advanced_hide_wp_login']
	1839	+ strpos( $_SERVER['QUERY_STRING'], 'external=wordpress' ) === false &&
	1840	+ array_key_exists( 'cas_auto_login', $auth_settings ) && $auth_settings['cas_auto_login'] === '1' &&
	1841	+ array_key_exists( 'cas', $auth_settings ) && $auth_settings['cas'] === '1' &&
	1842	+ ( ! array_key_exists( 'ldap', $auth_settings ) || $auth_settings['ldap'] !== '1' ) &&
	1843	+ ( ! array_key_exists( 'google', $auth_settings ) || $auth_settings['google'] !== '1' ) &&
	1844	+ array_key_exists( 'advanced_hide_wp_login', $auth_settings ) && $auth_settings['advanced_hide_wp_login'] === '1'
2154	1845	) {
2155	1846	wp_redirect( $this->modify_current_url_for_cas_login() );
2156	1847	exit;
2157	1848	}
2158		-
2159		- return $errors;
2160	1849	}
2161	1850
2162	1851
2163	1852	/**
2164		- * Set a unique cookie to add to Google auth nonce to avoid CSRF detection.
2165		- * Note: hook into login_init so this fires at the start of the visit to
2166		- * wp-login.php, but before any html output is started (so setting the
2167		- * cookie header doesn't complain about data already being sent).
2168		- *
2169		- * Action: login_init
2170		- *
2171		- * @return void
2172		- */
2173		- public function login_init__maybe_set_google_nonce_cookie() {
2174		- // Grab plugin settings.
2175		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
2176		-
2177		- // If Google logins are enabled, make sure the cookie is set.
2178		- if ( array_key_exists( 'google', $auth_settings ) && '1' === $auth_settings['google'] ) {
2179		- if ( ! isset( $_COOKIE['login_unique'] ) ) {
2180		- $this->cookie_value = md5( rand() );
2181		- setcookie( 'login_unique', $this->cookie_value, time() + 1800, '/', defined( 'COOKIE_DOMAIN' ) ? COOKIE_DOMAIN : '' );
2182		- $_COOKIE['login_unique'] = $this->cookie_value;
2183		- }
2184		- }
2185		- }
2186		-
2187		-
2188		- /**
2189	1853	* Implements hook: do_action( 'wp_login_failed', $username );
2190	1854	* Update the user meta for the user that just failed logging in.
2191	1855	* Keep track of time of last failed attempt and number of failed attempts.
2192		- *
2193		- * Action: wp_login_failed
2194		- *
2195		- * @param string $username Username to update login count for.
2196		- * @return void
2197	1856	*/
2198		- public function update_login_failed_count( $username ) {
	1857	+ function update_login_failed_count( $username ) {
2199	1858	// Grab plugin settings.
2200		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
	1859	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' );
2201	1860
2202	1861	// Get user trying to log in.
2203	1862	// If this isn't a real user, update the global failed attempt
2204	1863	// variables. We'll use these global variables to institute the
		@@ -2206,9 +1865,9 @@
2206	1865	// won't be able to determine which accounts are real by which
2207	1866	// accounts get locked out on multiple invalid attempts.
2208	1867	$user = get_user_by( 'login', $username );
2209	1868
2210		- if ( false !== $user ) {
	1869	+ if ( $user !== FALSE ) {
2211	1870	$last_attempt = get_user_meta( $user->ID, 'auth_settings_advanced_lockouts_time_last_failed', true );
2212	1871	$num_attempts = get_user_meta( $user->ID, 'auth_settings_advanced_lockouts_failed_attempts', true );
2213	1872	} else {
2214	1873	$last_attempt = get_option( 'auth_settings_advanced_lockouts_time_last_failed' );
		@@ -2222,15 +1881,15 @@
2222	1881
2223	1882	// Reset the failed attempt count if the time since the last
2224	1883	// failed attempt is greater than the reset duration.
2225	1884	$time_since_last_fail = time() - $last_attempt;
2226		- $reset_duration = $auth_settings['advanced_lockouts']['reset_duration'] * 60; // minutes to seconds.
	1885	+ $reset_duration = $auth_settings['advanced_lockouts']['reset_duration'] * 60; // minutes to seconds
2227	1886	if ( $time_since_last_fail > $reset_duration ) {
2228	1887	$num_attempts = 0;
2229	1888	}
2230	1889
2231	1890	// Set last failed time to now and increment last failed count.
2232		- if ( false !== $user ) {
	1891	+ if ( $user !== FALSE ) {
2233	1892	update_user_meta( $user->ID, 'auth_settings_advanced_lockouts_time_last_failed', time() );
2234	1893	update_user_meta( $user->ID, 'auth_settings_advanced_lockouts_failed_attempts', $num_attempts + 1 );
2235	1894	} else {
2236	1895	update_option( 'auth_settings_advanced_lockouts_time_last_failed', time() );
		@@ -2241,16 +1900,16 @@
2241	1900
2242	1901	/**
2243	1902	* When they successfully log in, make sure WordPress users are in the approved list.
2244	1903	*
2245		- * Action: wp_login
	1904	+ * @action wp_login
2246	1905	*
2247	1906	* @param string $user_login Username of the user logging in.
2248		- * @param object $user WP_User object of the user logging in.
2249		- * @return void
	1907	+ * @param WP_User $user WP_User object of the user logging in.
	1908	+ * @return null
2250	1909	*/
2251		- public function ensure_wordpress_user_in_approved_list_on_login( $user_login, $user ) {
2252		- $this->add_user_to_authorizer_when_created( $user->user_email, $user->user_registered, $user->roles );
	1910	+ function ensure_wordpress_user_in_approved_list_on_login( $user_login, $user ) {
	1911	+ $this->add_user_to_authorizer_when_created( $user->user_email, $user->user_registered, $user->user_roles );
2253	1912	}
2254	1913
2255	1914
2256	1915	/**
		@@ -2256,17 +1915,12 @@
2256	1915	/**
2257	1916	* Overwrite the URL for the lost password link on the login form.
2258	1917	* If we're authenticating against an external service, standard
2259	1918	* WordPress password resets won't work.
2260		- *
2261		- * Filter: lostpassword_url
2262		- *
2263		- * @param string $lostpassword_url URL to reset password.
2264		- * @return string URL to reset password.
2265	1919	*/
2266		- public function custom_lostpassword_url( $lostpassword_url ) {
	1920	+ function custom_lostpassword_url( $lostpassword_url ) {
2267	1921	// Grab plugin settings.
2268		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
	1922	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' );
2269	1923
2270	1924	if (
2271	1925	array_key_exists( 'ldap_lostpassword_url', $auth_settings ) &&
2272	1926	filter_var( $auth_settings['ldap_lostpassword_url'], FILTER_VALIDATE_URL )
		@@ -2289,16 +1943,15 @@
2289	1943	/**
2290	1944	* Add a link to this plugin's settings page from the WordPress Plugins page.
2291	1945	* Called from "plugin_action_links" filter in __construct() above.
2292	1946	*
2293		- * Filter: plugin_action_links_authorizer.php
	1947	+ * @param array $links array of links in the admin sidebar
2294	1948	*
2295		- * @param array $links Admin sidebar links.
2296		- * @return array Admin sidebar links with Authorizer added.
	1949	+ * @return array of links to show in the admin sidebar.
2297	1950	*/
2298	1951	public function plugin_settings_link( $links ) {
2299		- $admin_menu = $this->get_plugin_option( 'advanced_admin_menu' );
2300		- $settings_url = 'settings' === $admin_menu ? admin_url( 'options-general.php?page=authorizer' ) : admin_url( 'admin.php?page=authorizer' );
	1952	+ $admin_menu = $this->get_plugin_option( 'advanced_admin_menu' );
	1953	+ $settings_url = $admin_menu === 'settings' ? admin_url( 'options-general.php?page=authorizer' ) : admin_url( 'admin.php?page=authorizer' );
2301	1954	array_unshift( $links, '<a href="' . $settings_url . '">' . __( 'Settings', 'authorizer' ) . '</a>' );
2302	1955	return $links;
2303	1956	}
2304	1957
		@@ -2306,12 +1959,11 @@
2306	1959	/**
2307	1960	* Add a link to this plugin's network settings page from the WordPress Plugins page.
2308	1961	* Called from "network_admin_plugin_action_links" filter in __construct() above.
2309	1962	*
2310		- * Filter: network_admin_plugin_action_links_authorizer.php
	1963	+ * @param array $links array of links in the network admin sidebar
2311	1964	*
2312		- * @param array $links Network admin sidebar links.
2313		- * @return array Network admin sidebar links with Authorizer added.
	1965	+ * @return array of links to show in the network admin sidebar.
2314	1966	*/
2315	1967	public function network_admin_plugin_settings_link( $links ) {
2316	1968	$settings_link = '<a href="admin.php?page=authorizer">' . __( 'Network Settings', 'authorizer' ) . '</a>';
2317	1969	array_unshift( $links, $settings_link );
		@@ -2319,33 +1971,32 @@
2319	1971	}
2320	1972
2321	1973
2322	1974	/**
2323		- * Create the options page under Dashboard > Settings.
2324		- *
2325		- * Action: admin_menu
	1975	+ * Create the options page under Dashboard > Settings
	1976	+ * Run on action hook: admin_menu
2326	1977	*/
2327	1978	public function add_plugin_page() {
2328	1979	$admin_menu = $this->get_plugin_option( 'advanced_admin_menu' );
2329		- if ( 'settings' === $admin_menu ) {
	1980	+ if ( $admin_menu === 'settings' ) {
2330	1981	// @see http://codex.wordpress.org/Function_Reference/add_options_page
2331	1982	add_options_page(
2332		- 'Authorizer',
2333		- 'Authorizer',
2334		- 'create_users',
2335		- 'authorizer',
2336		- array( $this, 'create_admin_page' )
	1983	+ 'Authorizer', // Page title
	1984	+ 'Authorizer', // Menu title
	1985	+ 'create_users', // Capability
	1986	+ 'authorizer', // Menu slug
	1987	+ array( $this, 'create_admin_page' ) // function
2337	1988	);
2338	1989	} else {
2339	1990	// @see http://codex.wordpress.org/Function_Reference/add_menu_page
2340	1991	add_menu_page(
2341		- 'Authorizer',
2342		- 'Authorizer',
2343		- 'create_users',
2344		- 'authorizer',
2345		- array( $this, 'create_admin_page' ),
2346		- 'dashicons-groups',
2347		- '99.0018465' // position (decimal is to make overlap with other plugins less likely).
	1992	+ 'Authorizer', // Page title
	1993	+ 'Authorizer', // Menu title
	1994	+ 'create_users', // Capability
	1995	+ 'authorizer', // Menu slug
	1996	+ array( $this, 'create_admin_page' ), // callback
	1997	+ 'dashicons-groups', // icon
	1998	+ '99.0018465' // position (decimal is to make overlap with other plugins less likely)
2348	1999	);
2349	2000	}
2350	2001	}
2351	2002
		@@ -2350,75 +2001,56 @@
2350	2001	}
2351	2002
2352	2003
2353	2004	/**
2354		- * Output the HTML for the options page.
	2005	+ * Output the HTML for the options page
2355	2006	*/
2356		- public function create_admin_page() {
2357		- ?>
	2007	+ public function create_admin_page() { ?>
2358	2008	<div class="wrap">
2359		- <h2><?php esc_html_e( 'Authorizer Settings', 'authorizer' ); ?></h2>
2360		- <form method="post" action="options.php" autocomplete="off">
2361		- <?php
2362		- // This prints out all hidden settings fields.
	2009	+ <h2><?php _e( 'Authorizer Settings', 'authorizer' ); ?></h2>
	2010	+ <form method="post" action="options.php" autocomplete="off"><?php
	2011	+ // This prints out all hidden settings fields
	2012	+ // @see http://codex.wordpress.org/Function_Reference/settings_fields
2363	2013	settings_fields( 'auth_settings_group' );
2364		- // This prints out all the sections.
	2014	+ // This prints out all the sections
	2015	+ // @see http://codex.wordpress.org/Function_Reference/do_settings_sections
2365	2016	do_settings_sections( 'authorizer' );
2366		- submit_button();
2367		- ?>
	2017	+ submit_button(); ?>
2368	2018	</form>
2369		- </div>
2370		- <?php
	2019	+ </div><?php
2371	2020	}
2372	2021
2373	2022
2374	2023	/**
2375	2024	* Load external resources on this plugin's options page.
2376		- *
2377		- * Action: load-settings_page_authorizer
2378		- * Action: load-toplevel_page_authorizer
2379		- * Action: admin_head-index.php
	2025	+ * Run on action hooks: load-settings_page_authorizer, load-toplevel_page_authorizer, admin_head-index.php
2380	2026	*/
2381	2027	public function load_options_page() {
2382	2028	wp_enqueue_script(
2383	2029	'authorizer',
2384	2030	plugins_url( 'js/authorizer.js', __FILE__ ),
2385		- array( 'jquery-effects-shake' ), '2.8.7', true
	2031	+ array( 'jquery-effects-shake' ), '2.3.2', true
2386	2032	);
2387		- wp_localize_script(
2388		- 'authorizer', 'authL10n', array(
2389		- 'baseurl' => get_bloginfo( 'url' ),
2390		- 'saved' => esc_html__( 'Saved', 'authorizer' ),
2391		- 'duplicate' => esc_html__( 'Duplicate', 'authorizer' ),
2392		- 'failed' => esc_html__( 'Failed', 'authorizer' ),
2393		- 'local_wordpress_user' => esc_html__( 'Local WordPress user', 'authorizer' ),
2394		- 'block_ban_user' => esc_html__( 'Block/Ban user', 'authorizer' ),
2395		- 'remove_user' => esc_html__( 'Remove user', 'authorizer' ),
2396		- 'no_users_in' => esc_html__( 'No users in', 'authorizer' ),
2397		- 'save_changes' => esc_html__( 'Save Changes', 'authorizer' ),
2398		- 'private_pages' => esc_html__( 'Private Pages', 'authorizer' ),
2399		- 'public_pages' => esc_html__( 'Public Pages', 'authorizer' ),
2400		- 'first_page' => esc_html__( 'First page' ),
2401		- 'previous_page' => esc_html__( 'Previous page' ),
2402		- 'next_page' => esc_html__( 'Next page' ),
2403		- 'last_page' => esc_html__( 'Last page' ),
2404		- 'is_network_admin' => is_network_admin() ? '1' : '0',
2405		- )
2406		- );
	2033	+ wp_localize_script( 'authorizer', 'auth_L10n', array(
	2034	+ 'baseurl' => get_bloginfo( 'url' ),
	2035	+ 'saved' => esc_html__( 'Saved', 'authorizer' ),
	2036	+ 'failed' => esc_html__( 'Failed', 'authorizer' ),
	2037	+ 'local_wordpress_user' => esc_html__( 'Local WordPress user', 'authorizer' ),
	2038	+ 'block_ban_user' => esc_html__( 'Block/Ban user', 'authorizer' ),
	2039	+ 'remove_user' => esc_html__( 'Remove user', 'authorizer' ),
	2040	+ 'no_users_in' => esc_html__( 'No users in', 'authorizer' ),
	2041	+ 'save_changes' => esc_html__( 'Save Changes', 'authorizer' ),
	2042	+ 'private_pages' => esc_html__( 'Private Pages', 'authorizer' ),
	2043	+ 'public_pages' => esc_html__( 'Public Pages', 'authorizer' ),
	2044	+ ));
2407	2045
2408	2046	wp_enqueue_script(
2409		- 'jquery-autogrow-textarea',
2410		- plugins_url( 'vendor/jquery.autogrow-textarea/jquery.autogrow-textarea.js', __FILE__ ),
2411		- array( 'jquery' ), '2.7.0', true
2412		- );
2413		-
2414		- wp_enqueue_script(
2415	2047	'jquery.multi-select',
2416	2048	plugins_url( 'vendor/jquery.multi-select/js/jquery.multi-select.js', __FILE__ ),
2417	2049	array( 'jquery' ), '1.8', true
2418	2050	);
2419	2051
2420		- wp_register_style( 'authorizer-css', plugins_url( 'css/authorizer.css', __FILE__ ), array(), '2.8.7' );
	2052	+ wp_register_style( 'authorizer-css', plugins_url( 'css/authorizer.css', __FILE__ ), array(), '2.3.2' );
2421	2053	wp_enqueue_style( 'authorizer-css' );
2422	2054
2423	2055	wp_register_style( 'jquery-multi-select-css', plugins_url( 'vendor/jquery.multi-select/css/multi-select.css', __FILE__ ), array(), '1.8' );
2424	2056	wp_enqueue_style( 'jquery-multi-select-css' );
		@@ -2429,26 +2061,18 @@
2429	2061
2430	2062
2431	2063	/**
2432	2064	* Show custom admin notice.
2433		- *
2434		- * Note: currently unused, but if anywhere we:
2435		- * add_option( 'auth_settings_advanced_admin_notice, 'Your message.' );
2436		- * It will display and then delete that message on the admin dashboard.
2437		- *
2438		- * Filter: admin_notices
2439		- * filter: network_admin_notices
	2065	+ * Filter: admin_notice
2440	2066	*/
2441		- public function show_advanced_admin_notice() {
	2067	+ function show_advanced_admin_notice() {
2442	2068	$notice = get_option( 'auth_settings_advanced_admin_notice' );
2443	2069	delete_option( 'auth_settings_advanced_admin_notice' );
2444	2070
2445		- if ( $notice && strlen( $notice ) > 0 ) {
2446		- ?>
	2071	+ if ( $notice && strlen( $notice ) > 0 ) { ?>
2447	2072	<div class="error">
2448		- <p><?php echo wp_kses( $notice, $this->allowed_html ); ?></p>
2449		- </div>
2450		- <?php
	2073	+ <p><?php echo $notice; ?></p>
	2074	+ </div><?php
2451	2075	}
2452	2076	}
2453	2077
2454	2078
		@@ -2453,11 +2077,9 @@
2453	2077
2454	2078
2455	2079	/**
2456	2080	* Add notices to the top of the options page.
2457		- *
2458		- * Action: load-settings_page_authorizer > admin_notices
2459		- *
	2081	+ * Run on action hook chain: load-settings_page_authorizer > admin_notices
2460	2082	* Description: Check for invalid settings combinations and show a warning message, e.g.:
2461	2083	* if ( cas url inaccessible ) : ?>
2462	2084	* <div class='updated settings-error'><p>Can't reach CAS server.</p></div>
2463	2085	* <?php endif;
		@@ -2463,23 +2085,20 @@
2463	2085	* <?php endif;
2464	2086	*/
2465	2087	public function admin_notices() {
2466	2088	// Grab plugin settings.
2467		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
	2089	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' );
2468	2090
2469		- if ( '1' === $auth_settings['cas'] ) :
	2091	+ if ( $auth_settings['cas'] === '1' ) :
2470	2092	// Check if provided CAS URL is accessible.
2471		- $protocol = in_array( strval( $auth_settings['cas_port'] ), array( '80', '8080' ), true ) ? 'http' : 'https';
2472		- $cas_url = $protocol . '://' . $auth_settings['cas_host'] . ':' . $auth_settings['cas_port'] . $auth_settings['cas_path'];
2473		- $legacy_cas_url = trailingslashit( $cas_url ) . 'login'; // Check the specific CAS login endpoint (old; some servers don't register a ./login endpoint, use serviceValidate instead).
2474		- $cas_url = trailingslashit( $cas_url ) . 'serviceValidate'; // Check the specific CAS login endpoint.
2475		- if ( ! $this->url_is_accessible( $cas_url ) && ! $this->url_is_accessible( $legacy_cas_url ) ) :
2476		- $authorizer_options_url = 'settings' === $auth_settings['advanced_admin_menu'] ? admin_url( 'options-general.php?page=authorizer' ) : admin_url( '?page=authorizer' );
2477		- ?>
2478		- <div class='notice notice-warning is-dismissible'>
2479		- <p><?php esc_html_e( "Can't reach CAS server. Please provide", 'authorizer' ); ?> <a href='<?php echo esc_attr( $authorizer_options_url ); ?>&tab=external'><?php esc_html_e( 'accurate CAS settings', 'authorizer' ); ?></a> <?php esc_html_e( 'if you intend to use it.', 'authorizer' ); ?></p>
2480		- </div>
2481		- <?php
	2093	+ $protocol = in_array( $auth_settings['cas_port'], array( '80', '8080' ) ) ? 'http' : 'https';
	2094	+ $cas_url = $protocol . '://' . $auth_settings['cas_host'] . ':' . $auth_settings['cas_port'] . $auth_settings['cas_path'];
	2095	+ $cas_url = trailingslashit( $cas_url ) . 'login'; // Check the specific CAS login endpoint
	2096	+ if ( ! $this->url_is_accessible( $cas_url ) ) :
	2097	+ $authorizer_options_url = $auth_settings['advanced_admin_menu'] === 'settings' ? admin_url( 'options-general.php?page=authorizer' ) : admin_url( '?page=authorizer' );
	2098	+ ?><div class='notice notice-warning is-dismissible'>
	2099	+ <p><?php _e( "Can't reach CAS server. Please provide", 'authorizer' ); ?> <a href='<?php echo $authorizer_options_url; ?>&tab=external'><?php _e( 'accurate CAS settings', 'authorizer' ); ?></a> <?php _e( 'if you intend to use it.', 'authorizer' ); ?></p>
	2100	+ </div><?php
2482	2101	endif;
2483	2102	endif;
2484	2103	}
2485	2104
		@@ -2484,437 +2103,399 @@
2484	2103	}
2485	2104
2486	2105
2487	2106	/**
2488		- * Create sections and options.
2489		- *
2490		- * Action: admin_init
	2107	+ * Create sections and options
	2108	+ * Run on action hook: admin_init
2491	2109	*/
2492	2110	public function page_init() {
2493		- /**
2494		- * Create one setting that holds all the options (array).
2495		- *
2496		- * @see http://codex.wordpress.org/Function_Reference/register_setting
2497		- * @see http://codex.wordpress.org/Function_Reference/add_settings_section
2498		- * @see http://codex.wordpress.org/Function_Reference/add_settings_field
2499		- */
	2111	+ // Create one setting that holds all the options (array)
	2112	+ // @see http://codex.wordpress.org/Function_Reference/register_setting
	2113	+ // @see http://codex.wordpress.org/Function_Reference/add_settings_section
	2114	+ // @see http://codex.wordpress.org/Function_Reference/add_settings_field
2500	2115	register_setting(
2501		- 'auth_settings_group',
2502		- 'auth_settings',
2503		- array( $this, 'sanitize_options' )
	2116	+ 'auth_settings_group', // Option group
	2117	+ 'auth_settings', // Option name
	2118	+ array( $this, 'sanitize_options' ) // Sanitize callback
2504	2119	);
2505	2120
2506	2121	add_settings_section(
2507		- 'auth_settings_tabs',
2508		- '',
2509		- array( $this, 'print_section_info_tabs' ),
2510		- 'authorizer'
	2122	+ 'auth_settings_tabs', // HTML element ID
	2123	+ '', // HTML element Title
	2124	+ array( $this, 'print_section_info_tabs' ), // Callback (echos section content)
	2125	+ 'authorizer' // Page this section is shown on (slug)
2511	2126	);
2512	2127
2513		- // Create Access Lists section.
	2128	+ // Create Access Lists section
2514	2129	add_settings_section(
2515		- 'auth_settings_lists',
2516		- '',
2517		- array( $this, 'print_section_info_access_lists' ),
2518		- 'authorizer'
	2130	+ 'auth_settings_lists', // HTML element ID
	2131	+ '', // HTML element Title
	2132	+ array( $this, 'print_section_info_access_lists' ), // Callback (echos section content)
	2133	+ 'authorizer' // Page this section is shown on (slug)
2519	2134	);
2520	2135
2521		- // Create Login Access section.
	2136	+ // Create Login Access section
2522	2137	add_settings_section(
2523		- 'auth_settings_access_login',
2524		- '',
2525		- array( $this, 'print_section_info_access_login' ),
2526		- 'authorizer'
	2138	+ 'auth_settings_access_login', // HTML element ID
	2139	+ '', // HTML element Title
	2140	+ array( $this, 'print_section_info_access_login' ), // Callback (echos section content)
	2141	+ 'authorizer' // Page this section is shown on (slug)
2527	2142	);
2528	2143	add_settings_field(
2529		- 'auth_settings_access_who_can_login',
2530		- __( 'Who can log into the site?', 'authorizer' ),
2531		- array( $this, 'print_radio_auth_access_who_can_login' ),
2532		- 'authorizer',
2533		- 'auth_settings_access_login'
	2144	+ 'auth_settings_access_who_can_login', // HTML element ID
	2145	+ __( 'Who can log into the site?', 'authorizer' ), // HTML element Title
	2146	+ array( $this, 'print_radio_auth_access_who_can_login' ), // Callback (echos form element)
	2147	+ 'authorizer', // Page this setting is shown on (slug)
	2148	+ 'auth_settings_access_login' // Section this setting is shown on
2534	2149	);
2535	2150	add_settings_field(
2536		- 'auth_settings_access_role_receive_pending_emails',
2537		- __( 'Which role should receive email notifications about pending users?', 'authorizer' ),
2538		- array( $this, 'print_select_auth_access_role_receive_pending_emails' ),
2539		- 'authorizer',
2540		- 'auth_settings_access_login'
	2151	+ 'auth_settings_access_role_receive_pending_emails', // HTML element ID
	2152	+ __( 'Which role should receive email notifications about pending users?', 'authorizer' ), // HTML element Title
	2153	+ array( $this, 'print_select_auth_access_role_receive_pending_emails' ), // Callback (echos form element)
	2154	+ 'authorizer', // Page this setting is shown on (slug)
	2155	+ 'auth_settings_access_login' // Section this setting is shown on
2541	2156	);
2542	2157	add_settings_field(
2543		- 'auth_settings_access_pending_redirect_to_message',
2544		- __( 'What message should pending users see after attempting to log in?', 'authorizer' ),
2545		- array( $this, 'print_wysiwyg_auth_access_pending_redirect_to_message' ),
2546		- 'authorizer',
2547		- 'auth_settings_access_login'
	2158	+ 'auth_settings_access_pending_redirect_to_message', // HTML element ID
	2159	+ __( 'What message should pending users see after attempting to log in?', 'authorizer' ), // HTML element Title
	2160	+ array( $this, 'print_wysiwyg_auth_access_pending_redirect_to_message' ), // Callback (echos form element)
	2161	+ 'authorizer', // Page this setting is shown on (slug)
	2162	+ 'auth_settings_access_login' // Section this setting is shown on
2548	2163	);
2549	2164	add_settings_field(
2550		- 'auth_settings_access_blocked_redirect_to_message',
2551		- __( 'What message should blocked users see after attempting to log in?', 'authorizer' ),
2552		- array( $this, 'print_wysiwyg_auth_access_blocked_redirect_to_message' ),
2553		- 'authorizer',
2554		- 'auth_settings_access_login'
	2165	+ 'auth_settings_access_blocked_redirect_to_message', // HTML element ID
	2166	+ __( 'What message should blocked users see after attempting to log in?', 'authorizer' ), // HTML element Title
	2167	+ array( $this, 'print_wysiwyg_auth_access_blocked_redirect_to_message' ), // Callback (echos form element)
	2168	+ 'authorizer', // Page this setting is shown on (slug)
	2169	+ 'auth_settings_access_login' // Section this setting is shown on
2555	2170	);
2556	2171	add_settings_field(
2557		- 'auth_settings_access_should_email_approved_users',
2558		- __( 'Send welcome email to new approved users?', 'authorizer' ),
2559		- array( $this, 'print_checkbox_auth_access_should_email_approved_users' ),
2560		- 'authorizer',
2561		- 'auth_settings_access_login'
	2172	+ 'auth_settings_access_should_email_approved_users', // HTML element ID
	2173	+ __( 'Send welcome email to new approved users?', 'authorizer' ), // HTML element Title
	2174	+ array( $this, 'print_checkbox_auth_access_should_email_approved_users' ), // Callback (echos form element)
	2175	+ 'authorizer', // Page this setting is shown on (slug)
	2176	+ 'auth_settings_access_login' // Section this setting is shown on
2562	2177	);
2563	2178	add_settings_field(
2564		- 'auth_settings_access_email_approved_users_subject',
2565		- __( 'Welcome email subject', 'authorizer' ),
2566		- array( $this, 'print_text_auth_access_email_approved_users_subject' ),
2567		- 'authorizer',
2568		- 'auth_settings_access_login'
	2179	+ 'auth_settings_access_email_approved_users_subject', // HTML element ID
	2180	+ __( 'Welcome email subject', 'authorizer' ), // HTML element Title
	2181	+ array( $this, 'print_text_auth_access_email_approved_users_subject' ), // Callback (echos form element)
	2182	+ 'authorizer', // Page this setting is shown on (slug)
	2183	+ 'auth_settings_access_login' // Section this setting is shown on
2569	2184	);
2570	2185	add_settings_field(
2571		- 'auth_settings_access_email_approved_users_body',
2572		- __( 'Welcome email body', 'authorizer' ),
2573		- array( $this, 'print_wysiwyg_auth_access_email_approved_users_body' ),
2574		- 'authorizer',
2575		- 'auth_settings_access_login'
	2186	+ 'auth_settings_access_email_approved_users_body', // HTML element ID
	2187	+ __( 'Welcome email body', 'authorizer' ), // HTML element Title
	2188	+ array( $this, 'print_wysiwyg_auth_access_email_approved_users_body' ), // Callback (echos form element)
	2189	+ 'authorizer', // Page this setting is shown on (slug)
	2190	+ 'auth_settings_access_login' // Section this setting is shown on
2576	2191	);
2577	2192
2578		- // Create Public Access section.
	2193	+
	2194	+ // Create Public Access section
2579	2195	add_settings_section(
2580		- 'auth_settings_access_public',
2581		- '',
2582		- array( $this, 'print_section_info_access_public' ),
2583		- 'authorizer'
	2196	+ 'auth_settings_access_public', // HTML element ID
	2197	+ '', // HTML element Title
	2198	+ array( $this, 'print_section_info_access_public' ), // Callback (echos section content)
	2199	+ 'authorizer' // Page this section is shown on (slug)
2584	2200	);
2585	2201	add_settings_field(
2586		- 'auth_settings_access_who_can_view',
2587		- __( 'Who can view the site?', 'authorizer' ),
2588		- array( $this, 'print_radio_auth_access_who_can_view' ),
2589		- 'authorizer',
2590		- 'auth_settings_access_public'
	2202	+ 'auth_settings_access_who_can_view', // HTML element ID
	2203	+ __( 'Who can view the site?', 'authorizer' ), // HTML element Title
	2204	+ array( $this, 'print_radio_auth_access_who_can_view' ), // Callback (echos form element)
	2205	+ 'authorizer', // Page this setting is shown on (slug)
	2206	+ 'auth_settings_access_public' // Section this setting is shown on
2591	2207	);
2592	2208	add_settings_field(
2593		- 'auth_settings_access_public_pages',
2594		- __( 'What pages (if any) should be available to everyone?', 'authorizer' ),
2595		- array( $this, 'print_multiselect_auth_access_public_pages' ),
2596		- 'authorizer',
2597		- 'auth_settings_access_public'
	2209	+ 'auth_settings_access_public_pages', // HTML element ID
	2210	+ __( 'What pages (if any) should be available to everyone?', 'authorizer' ), // HTML element Title
	2211	+ array( $this, 'print_multiselect_auth_access_public_pages' ), // Callback (echos form element)
	2212	+ 'authorizer', // Page this setting is shown on (slug)
	2213	+ 'auth_settings_access_public' // Section this setting is shown on
2598	2214	);
2599	2215	add_settings_field(
2600		- 'auth_settings_access_redirect',
2601		- __( 'What happens to people without access when they visit a private page?', 'authorizer' ),
2602		- array( $this, 'print_radio_auth_access_redirect' ),
2603		- 'authorizer',
2604		- 'auth_settings_access_public'
	2216	+ 'auth_settings_access_redirect', // HTML element ID
	2217	+ __( 'What happens to people without access when they visit a private page?', 'authorizer' ), // HTML element Title
	2218	+ array( $this, 'print_radio_auth_access_redirect' ), // Callback (echos form element)
	2219	+ 'authorizer', // Page this setting is shown on (slug)
	2220	+ 'auth_settings_access_public' // Section this setting is shown on
2605	2221	);
2606	2222	add_settings_field(
2607		- 'auth_settings_access_public_warning',
2608		- __( 'What happens to people without access when they visit a public page?', 'authorizer' ),
2609		- array( $this, 'print_radio_auth_access_public_warning' ),
2610		- 'authorizer',
2611		- 'auth_settings_access_public'
	2223	+ 'auth_settings_access_public_warning', // HTML element ID
	2224	+ __( 'What happens to people without access when they visit a public page?', 'authorizer' ), // HTML element Title
	2225	+ array( $this, 'print_radio_auth_access_public_warning' ), // Callback (echos form element)
	2226	+ 'authorizer', // Page this setting is shown on (slug)
	2227	+ 'auth_settings_access_public' // Section this setting is shown on
2612	2228	);
2613	2229	add_settings_field(
2614		- 'auth_settings_access_redirect_to_message',
2615		- __( 'What message should people without access see?', 'authorizer' ),
2616		- array( $this, 'print_wysiwyg_auth_access_redirect_to_message' ),
2617		- 'authorizer',
2618		- 'auth_settings_access_public'
	2230	+ 'auth_settings_access_redirect_to_message', // HTML element ID
	2231	+ __( 'What message should people without access see?', 'authorizer' ), // HTML element Title
	2232	+ array( $this, 'print_wysiwyg_auth_access_redirect_to_message' ), // Callback (echos form element)
	2233	+ 'authorizer', // Page this setting is shown on (slug)
	2234	+ 'auth_settings_access_public' // Section this setting is shown on
2619	2235	);
2620	2236
2621		- // Create External Service Settings section.
	2237	+ // Create External Service Settings section
2622	2238	add_settings_section(
2623		- 'auth_settings_external',
2624		- '',
2625		- array( $this, 'print_section_info_external' ),
2626		- 'authorizer'
	2239	+ 'auth_settings_external', // HTML element ID
	2240	+ '', // HTML element Title
	2241	+ array( $this, 'print_section_info_external' ), // Callback (echos section content)
	2242	+ 'authorizer' // Page this section is shown on (slug)
2627	2243	);
2628	2244	add_settings_field(
2629		- 'auth_settings_access_default_role',
2630		- __( 'Default role for new users', 'authorizer' ),
2631		- array( $this, 'print_select_auth_access_default_role' ),
2632		- 'authorizer',
2633		- 'auth_settings_external'
	2245	+ 'auth_settings_access_default_role', // HTML element ID
	2246	+ __( 'Default role for new users', 'authorizer' ), // HTML element Title
	2247	+ array( $this, 'print_select_auth_access_default_role' ), // Callback (echos form element)
	2248	+ 'authorizer', // Page this setting is shown on (slug)
	2249	+ 'auth_settings_external' // Section this setting is shown on
2634	2250	);
2635	2251	add_settings_field(
2636		- 'auth_settings_external_google',
2637		- __( 'Google Logins', 'authorizer' ),
2638		- array( $this, 'print_checkbox_auth_external_google' ),
2639		- 'authorizer',
2640		- 'auth_settings_external'
	2252	+ 'auth_settings_external_google', // HTML element ID
	2253	+ __( 'Google Logins', 'authorizer' ), // HTML element Title
	2254	+ array( $this, 'print_checkbox_auth_external_google' ), // Callback (echos form element)
	2255	+ 'authorizer', // Page this setting is shown on (slug)
	2256	+ 'auth_settings_external' // Section this setting is shown on
2641	2257	);
2642	2258	add_settings_field(
2643		- 'auth_settings_google_clientid',
2644		- __( 'Google Client ID', 'authorizer' ),
2645		- array( $this, 'print_text_google_clientid' ),
2646		- 'authorizer',
2647		- 'auth_settings_external'
	2259	+ 'auth_settings_google_clientid', // HTML element ID
	2260	+ __( 'Google Client ID', 'authorizer' ), // HTML element Title
	2261	+ array( $this, 'print_text_google_clientid' ), // Callback (echos form element)
	2262	+ 'authorizer', // Page this setting is shown on (slug)
	2263	+ 'auth_settings_external' // Section this setting is shown on
2648	2264	);
2649	2265	add_settings_field(
2650		- 'auth_settings_google_clientsecret',
2651		- __( 'Google Client Secret', 'authorizer' ),
2652		- array( $this, 'print_text_google_clientsecret' ),
2653		- 'authorizer',
2654		- 'auth_settings_external'
	2266	+ 'auth_settings_google_clientsecret', // HTML element ID
	2267	+ __( 'Google Client Secret', 'authorizer' ), // HTML element Title
	2268	+ array( $this, 'print_text_google_clientsecret' ), // Callback (echos form element)
	2269	+ 'authorizer', // Page this setting is shown on (slug)
	2270	+ 'auth_settings_external' // Section this setting is shown on
2655	2271	);
2656	2272	add_settings_field(
2657		- 'auth_settings_google_hosteddomain',
2658		- __( 'Google Hosted Domain', 'authorizer' ),
2659		- array( $this, 'print_text_google_hosteddomain' ),
2660		- 'authorizer',
2661		- 'auth_settings_external'
	2273	+ 'auth_settings_google_hosteddomain', // HTML element ID
	2274	+ __( 'Google Hosted Domain', 'authorizer' ), // HTML element Title
	2275	+ array( $this, 'print_text_google_hosteddomain' ), // Callback (echos form element)
	2276	+ 'authorizer', // Page this setting is shown on (slug)
	2277	+ 'auth_settings_external' // Section this setting is shown on
2662	2278	);
2663	2279	add_settings_field(
2664		- 'auth_settings_external_cas',
2665		- __( 'CAS Logins', 'authorizer' ),
2666		- array( $this, 'print_checkbox_auth_external_cas' ),
2667		- 'authorizer',
2668		- 'auth_settings_external'
	2280	+ 'auth_settings_external_cas', // HTML element ID
	2281	+ __( 'CAS Logins', 'authorizer' ), // HTML element Title
	2282	+ array( $this, 'print_checkbox_auth_external_cas' ), // Callback (echos form element)
	2283	+ 'authorizer', // Page this setting is shown on (slug)
	2284	+ 'auth_settings_external' // Section this setting is shown on
2669	2285	);
2670	2286	add_settings_field(
2671		- 'auth_settings_cas_custom_label',
2672		- __( 'CAS custom label', 'authorizer' ),
2673		- array( $this, 'print_text_cas_custom_label' ),
2674		- 'authorizer',
2675		- 'auth_settings_external'
	2287	+ 'auth_settings_cas_custom_label', // HTML element ID
	2288	+ __( 'CAS custom label', 'authorizer' ), // HTML element Title
	2289	+ array( $this, 'print_text_cas_custom_label' ), // Callback (echos form element)
	2290	+ 'authorizer', // Page this setting is shown on (slug)
	2291	+ 'auth_settings_external' // Section this setting is shown on
2676	2292	);
2677	2293	add_settings_field(
2678		- 'auth_settings_cas_host',
2679		- __( 'CAS server hostname', 'authorizer' ),
2680		- array( $this, 'print_text_cas_host' ),
2681		- 'authorizer',
2682		- 'auth_settings_external'
	2294	+ 'auth_settings_cas_host', // HTML element ID
	2295	+ __( 'CAS server hostname', 'authorizer' ), // HTML element Title
	2296	+ array( $this, 'print_text_cas_host' ), // Callback (echos form element)
	2297	+ 'authorizer', // Page this setting is shown on (slug)
	2298	+ 'auth_settings_external' // Section this setting is shown on
2683	2299	);
2684	2300	add_settings_field(
2685		- 'auth_settings_cas_port',
2686		- __( 'CAS server port', 'authorizer' ),
2687		- array( $this, 'print_text_cas_port' ),
2688		- 'authorizer',
2689		- 'auth_settings_external'
	2301	+ 'auth_settings_cas_port', // HTML element ID
	2302	+ __( 'CAS server port', 'authorizer' ), // HTML element Title
	2303	+ array( $this, 'print_text_cas_port' ), // Callback (echos form element)
	2304	+ 'authorizer', // Page this setting is shown on (slug)
	2305	+ 'auth_settings_external' // Section this setting is shown on
2690	2306	);
2691	2307	add_settings_field(
2692		- 'auth_settings_cas_path',
2693		- __( 'CAS server path/context', 'authorizer' ),
2694		- array( $this, 'print_text_cas_path' ),
2695		- 'authorizer',
2696		- 'auth_settings_external'
	2308	+ 'auth_settings_cas_path', // HTML element ID
	2309	+ __( 'CAS server path/context', 'authorizer' ), // HTML element Title
	2310	+ array( $this, 'print_text_cas_path' ), // Callback (echos form element)
	2311	+ 'authorizer', // Page this setting is shown on (slug)
	2312	+ 'auth_settings_external' // Section this setting is shown on
2697	2313	);
2698	2314	add_settings_field(
2699		- 'auth_settings_cas_version',
2700		- 'CAS server version',
2701		- array( $this, 'print_select_cas_version' ),
2702		- 'authorizer',
2703		- 'auth_settings_external'
	2315	+ 'auth_settings_cas_version', // HTML element ID
	2316	+ 'CAS server version', // HTML element Title
	2317	+ array( $this, 'print_select_cas_version' ), // Callback (echos form element)
	2318	+ 'authorizer', // Page this setting is shown on (slug)
	2319	+ 'auth_settings_external' // Section this setting is shown on
2704	2320	);
2705	2321	add_settings_field(
2706		- 'auth_settings_cas_attr_email',
2707		- __( 'CAS attribute containing email address', 'authorizer' ),
2708		- array( $this, 'print_text_cas_attr_email' ),
2709		- 'authorizer',
2710		- 'auth_settings_external'
	2322	+ 'auth_settings_cas_attr_email', // HTML element ID
	2323	+ __( 'CAS attribute containing email address', 'authorizer' ), // HTML element Title
	2324	+ array( $this, 'print_text_cas_attr_email' ), // Callback (echos form element)
	2325	+ 'authorizer', // Page this setting is shown on (slug)
	2326	+ 'auth_settings_external' // Section this setting is shown on
2711	2327	);
2712	2328	add_settings_field(
2713		- 'auth_settings_cas_attr_first_name',
2714		- __( 'CAS attribute containing first name', 'authorizer' ),
2715		- array( $this, 'print_text_cas_attr_first_name' ),
2716		- 'authorizer',
2717		- 'auth_settings_external'
	2329	+ 'auth_settings_cas_attr_first_name', // HTML element ID
	2330	+ __( 'CAS attribute containing first name', 'authorizer' ), // HTML element Title
	2331	+ array( $this, 'print_text_cas_attr_first_name' ), // Callback (echos form element)
	2332	+ 'authorizer', // Page this setting is shown on (slug)
	2333	+ 'auth_settings_external' // Section this setting is shown on
2718	2334	);
2719	2335	add_settings_field(
2720		- 'auth_settings_cas_attr_last_name',
2721		- __( 'CAS attribute containing last name', 'authorizer' ),
2722		- array( $this, 'print_text_cas_attr_last_name' ),
2723		- 'authorizer',
2724		- 'auth_settings_external'
	2336	+ 'auth_settings_cas_attr_last_name', // HTML element ID
	2337	+ __( 'CAS attribute containing last name', 'authorizer' ), // HTML element Title
	2338	+ array( $this, 'print_text_cas_attr_last_name' ), // Callback (echos form element)
	2339	+ 'authorizer', // Page this setting is shown on (slug)
	2340	+ 'auth_settings_external' // Section this setting is shown on
2725	2341	);
2726	2342	add_settings_field(
2727		- 'auth_settings_cas_attr_update_on_login',
2728		- __( 'CAS attribute update', 'authorizer' ),
2729		- array( $this, 'print_checkbox_cas_attr_update_on_login' ),
2730		- 'authorizer',
2731		- 'auth_settings_external'
	2343	+ 'auth_settings_cas_attr_update_on_login', // HTML element ID
	2344	+ __( 'CAS attribute update', 'authorizer' ), // HTML element Title
	2345	+ array( $this, 'print_checkbox_cas_attr_update_on_login' ), // Callback (echos form element)
	2346	+ 'authorizer', // Page this setting is shown on (slug)
	2347	+ 'auth_settings_external' // Section this setting is shown on
2732	2348	);
2733	2349	add_settings_field(
2734		- 'auth_settings_cas_auto_login',
2735		- __( 'CAS automatic login', 'authorizer' ),
2736		- array( $this, 'print_checkbox_cas_auto_login' ),
2737		- 'authorizer',
2738		- 'auth_settings_external'
	2350	+ 'auth_settings_cas_auto_login', // HTML element ID
	2351	+ __( 'CAS automatic login', 'authorizer' ), // HTML element Title
	2352	+ array( $this, 'print_checkbox_cas_auto_login' ), // Callback (echos form element)
	2353	+ 'authorizer', // Page this setting is shown on (slug)
	2354	+ 'auth_settings_external' // Section this setting is shown on
2739	2355	);
2740	2356	add_settings_field(
2741		- 'auth_settings_cas_link_on_username',
2742		- __( 'CAS users linked by username', 'authorizer' ),
2743		- array( $this, 'print_checkbox_cas_link_on_username' ),
2744		- 'authorizer',
2745		- 'auth_settings_external'
	2357	+ 'auth_settings_external_ldap', // HTML element ID
	2358	+ __( 'LDAP Logins', 'authorizer' ), // HTML element Title
	2359	+ array( $this, 'print_checkbox_auth_external_ldap' ), // Callback (echos form element)
	2360	+ 'authorizer', // Page this setting is shown on (slug)
	2361	+ 'auth_settings_external' // Section this setting is shown on
2746	2362	);
2747	2363	add_settings_field(
2748		- 'auth_settings_external_ldap',
2749		- __( 'LDAP Logins', 'authorizer' ),
2750		- array( $this, 'print_checkbox_auth_external_ldap' ),
2751		- 'authorizer',
2752		- 'auth_settings_external'
	2364	+ 'auth_settings_ldap_host', // HTML element ID
	2365	+ __( 'LDAP Host', 'authorizer' ), // HTML element Title
	2366	+ array( $this, 'print_text_ldap_host' ), // Callback (echos form element)
	2367	+ 'authorizer', // Page this setting is shown on (slug)
	2368	+ 'auth_settings_external' // Section this setting is shown on
2753	2369	);
2754	2370	add_settings_field(
2755		- 'auth_settings_ldap_host',
2756		- __( 'LDAP Host', 'authorizer' ),
2757		- array( $this, 'print_text_ldap_host' ),
2758		- 'authorizer',
2759		- 'auth_settings_external'
	2371	+ 'auth_settings_ldap_port', // HTML element ID
	2372	+ __( 'LDAP Port', 'authorizer' ), // HTML element Title
	2373	+ array( $this, 'print_text_ldap_port' ), // Callback (echos form element)
	2374	+ 'authorizer', // Page this setting is shown on (slug)
	2375	+ 'auth_settings_external' // Section this setting is shown on
2760	2376	);
2761	2377	add_settings_field(
2762		- 'auth_settings_ldap_port',
2763		- __( 'LDAP Port', 'authorizer' ),
2764		- array( $this, 'print_text_ldap_port' ),
2765		- 'authorizer',
2766		- 'auth_settings_external'
	2378	+ 'auth_settings_ldap_tls', // HTML element ID
	2379	+ __( 'Secure Connection (TLS)', 'authorizer' ), // HTML element Title
	2380	+ array( $this, 'print_checkbox_ldap_tls' ), // Callback (echos form element)
	2381	+ 'authorizer', // Page this setting is shown on (slug)
	2382	+ 'auth_settings_external' // Section this setting is shown on
2767	2383	);
2768	2384	add_settings_field(
2769		- 'auth_settings_ldap_tls',
2770		- __( 'Use TLS', 'authorizer' ),
2771		- array( $this, 'print_checkbox_ldap_tls' ),
2772		- 'authorizer',
2773		- 'auth_settings_external'
	2385	+ 'auth_settings_ldap_search_base', // HTML element ID
	2386	+ __( 'LDAP Search Base', 'authorizer' ), // HTML element Title
	2387	+ array( $this, 'print_text_ldap_search_base' ), // Callback (echos form element)
	2388	+ 'authorizer', // Page this setting is shown on (slug)
	2389	+ 'auth_settings_external' // Section this setting is shown on
2774	2390	);
2775	2391	add_settings_field(
2776		- 'auth_settings_ldap_search_base',
2777		- __( 'LDAP Search Base', 'authorizer' ),
2778		- array( $this, 'print_text_ldap_search_base' ),
2779		- 'authorizer',
2780		- 'auth_settings_external'
	2392	+ 'auth_settings_ldap_uid', // HTML element ID
	2393	+ __( 'LDAP attribute containing username', 'authorizer' ), // HTML element Title
	2394	+ array( $this, 'print_text_ldap_uid' ), // Callback (echos form element)
	2395	+ 'authorizer', // Page this setting is shown on (slug)
	2396	+ 'auth_settings_external' // Section this setting is shown on
2781	2397	);
2782	2398	add_settings_field(
2783		- 'auth_settings_ldap_uid',
2784		- __( 'LDAP attribute containing username', 'authorizer' ),
2785		- array( $this, 'print_text_ldap_uid' ),
2786		- 'authorizer',
2787		- 'auth_settings_external'
	2399	+ 'auth_settings_ldap_attr_email', // HTML element ID
	2400	+ __( 'LDAP attribute containing email address', 'authorizer' ), // HTML element Title
	2401	+ array( $this, 'print_text_ldap_attr_email' ), // Callback (echos form element)
	2402	+ 'authorizer', // Page this setting is shown on (slug)
	2403	+ 'auth_settings_external' // Section this setting is shown on
2788	2404	);
2789	2405	add_settings_field(
2790		- 'auth_settings_ldap_attr_email',
2791		- __( 'LDAP attribute containing email address', 'authorizer' ),
2792		- array( $this, 'print_text_ldap_attr_email' ),
2793		- 'authorizer',
2794		- 'auth_settings_external'
	2406	+ 'auth_settings_ldap_user', // HTML element ID
	2407	+ __( 'LDAP Directory User', 'authorizer' ), // HTML element Title
	2408	+ array( $this, 'print_text_ldap_user' ), // Callback (echos form element)
	2409	+ 'authorizer', // Page this setting is shown on (slug)
	2410	+ 'auth_settings_external' // Section this setting is shown on
2795	2411	);
2796	2412	add_settings_field(
2797		- 'auth_settings_ldap_user',
2798		- __( 'LDAP Directory User', 'authorizer' ),
2799		- array( $this, 'print_text_ldap_user' ),
2800		- 'authorizer',
2801		- 'auth_settings_external'
	2413	+ 'auth_settings_ldap_password', // HTML element ID
	2414	+ __( 'LDAP Directory User Password', 'authorizer' ), // HTML element Title
	2415	+ array( $this, 'print_password_ldap_password' ), // Callback (echos form element)
	2416	+ 'authorizer', // Page this setting is shown on (slug)
	2417	+ 'auth_settings_external' // Section this setting is shown on
2802	2418	);
2803	2419	add_settings_field(
2804		- 'auth_settings_ldap_password',
2805		- __( 'LDAP Directory User Password', 'authorizer' ),
2806		- array( $this, 'print_password_ldap_password' ),
2807		- 'authorizer',
2808		- 'auth_settings_external'
	2420	+ 'auth_settings_ldap_lostpassword_url', // HTML element ID
	2421	+ __( 'Custom lost password URL', 'authorizer' ), // HTML element Title
	2422	+ array( $this, 'print_text_ldap_lostpassword_url' ), // Callback (echos form element)
	2423	+ 'authorizer', // Page this setting is shown on (slug)
	2424	+ 'auth_settings_external' // Section this setting is shown on
2809	2425	);
2810	2426	add_settings_field(
2811		- 'auth_settings_ldap_lostpassword_url',
2812		- __( 'Custom lost password URL', 'authorizer' ),
2813		- array( $this, 'print_text_ldap_lostpassword_url' ),
2814		- 'authorizer',
2815		- 'auth_settings_external'
	2427	+ 'auth_settings_ldap_attr_first_name', // HTML element ID
	2428	+ __( 'LDAP attribute containing first name', 'authorizer' ), // HTML element Title
	2429	+ array( $this, 'print_text_ldap_attr_first_name' ), // Callback (echos form element)
	2430	+ 'authorizer', // Page this setting is shown on (slug)
	2431	+ 'auth_settings_external' // Section this setting is shown on
2816	2432	);
2817	2433	add_settings_field(
2818		- 'auth_settings_ldap_attr_first_name',
2819		- __( 'LDAP attribute containing first name', 'authorizer' ),
2820		- array( $this, 'print_text_ldap_attr_first_name' ),
2821		- 'authorizer',
2822		- 'auth_settings_external'
	2434	+ 'auth_settings_ldap_attr_last_name', // HTML element ID
	2435	+ __( 'LDAP attribute containing last name', 'authorizer' ), // HTML element Title
	2436	+ array( $this, 'print_text_ldap_attr_last_name' ), // Callback (echos form element)
	2437	+ 'authorizer', // Page this setting is shown on (slug)
	2438	+ 'auth_settings_external' // Section this setting is shown on
2823	2439	);
2824	2440	add_settings_field(
2825		- 'auth_settings_ldap_attr_last_name',
2826		- __( 'LDAP attribute containing last name', 'authorizer' ),
2827		- array( $this, 'print_text_ldap_attr_last_name' ),
2828		- 'authorizer',
2829		- 'auth_settings_external'
	2441	+ 'auth_settings_ldap_attr_update_on_login', // HTML element ID
	2442	+ __( 'LDAP attribute update', 'authorizer' ), // HTML element Title
	2443	+ array( $this, 'print_checkbox_ldap_attr_update_on_login' ), // Callback (echos form element)
	2444	+ 'authorizer', // Page this setting is shown on (slug)
	2445	+ 'auth_settings_external' // Section this setting is shown on
2830	2446	);
2831		- add_settings_field(
2832		- 'auth_settings_ldap_attr_update_on_login',
2833		- __( 'LDAP attribute update', 'authorizer' ),
2834		- array( $this, 'print_checkbox_ldap_attr_update_on_login' ),
2835		- 'authorizer',
2836		- 'auth_settings_external'
2837		- );
2838	2447
2839		- // Create Advanced Settings section.
	2448	+ // Create Advanced Settings section
2840	2449	add_settings_section(
2841		- 'auth_settings_advanced',
2842		- '',
2843		- array( $this, 'print_section_info_advanced' ),
2844		- 'authorizer'
	2450	+ 'auth_settings_advanced', // HTML element ID
	2451	+ '', // HTML element Title
	2452	+ array( $this, 'print_section_info_advanced' ), // Callback (echos section content)
	2453	+ 'authorizer' // Page this section is shown on (slug)
2845	2454	);
2846	2455	add_settings_field(
2847		- 'auth_settings_advanced_lockouts',
2848		- __( 'Limit invalid login attempts', 'authorizer' ),
2849		- array( $this, 'print_text_auth_advanced_lockouts' ),
2850		- 'authorizer',
2851		- 'auth_settings_advanced'
	2456	+ 'auth_settings_advanced_lockouts', // HTML element ID
	2457	+ __( 'Limit invalid login attempts', 'authorizer' ), // HTML element Title
	2458	+ array( $this, 'print_text_auth_advanced_lockouts' ), // Callback (echos form element)
	2459	+ 'authorizer', // Page this setting is shown on (slug)
	2460	+ 'auth_settings_advanced' // Section this setting is shown on
2852	2461	);
2853	2462	add_settings_field(
2854		- 'auth_settings_advanced_hide_wp_login',
2855		- __( 'Hide WordPress Login', 'authorizer' ),
2856		- array( $this, 'print_checkbox_auth_advanced_hide_wp_login' ),
2857		- 'authorizer',
2858		- 'auth_settings_advanced'
	2463	+ 'auth_settings_advanced_hide_wp_login', // HTML element ID
	2464	+ __( 'Hide WordPress Login', 'authorizer' ), // HTML element Title
	2465	+ array( $this, 'print_checkbox_auth_advanced_hide_wp_login' ), // Callback (echos form element)
	2466	+ 'authorizer', // Page this setting is shown on (slug)
	2467	+ 'auth_settings_advanced' // Section this setting is shown on
2859	2468	);
2860	2469	add_settings_field(
2861		- 'auth_settings_advanced_branding',
2862		- __( 'Custom WordPress login branding', 'authorizer' ),
2863		- array( $this, 'print_radio_auth_advanced_branding' ),
2864		- 'authorizer',
2865		- 'auth_settings_advanced'
	2470	+ 'auth_settings_advanced_branding', // HTML element ID
	2471	+ __( 'Custom WordPress login branding', 'authorizer' ), // HTML element Title
	2472	+ array( $this, 'print_radio_auth_advanced_branding' ), // Callback (echos form element)
	2473	+ 'authorizer', // Page this setting is shown on (slug)
	2474	+ 'auth_settings_advanced' // Section this setting is shown on
2866	2475	);
2867	2476	add_settings_field(
2868		- 'auth_settings_advanced_admin_menu',
2869		- __( 'Authorizer admin menu item location', 'authorizer' ),
2870		- array( $this, 'print_radio_auth_advanced_admin_menu' ),
2871		- 'authorizer',
2872		- 'auth_settings_advanced'
	2477	+ 'auth_settings_advanced_admin_menu', // HTML element ID
	2478	+ __( 'Authorizer admin menu item location', 'authorizer' ), // HTML element Title
	2479	+ array( $this, 'print_radio_auth_advanced_admin_menu' ), // Callback (echos form element)
	2480	+ 'authorizer', // Page this setting is shown on (slug)
	2481	+ 'auth_settings_advanced' // Section this setting is shown on
2873	2482	);
2874	2483	add_settings_field(
2875		- 'auth_settings_advanced_usermeta',
2876		- __( 'Show custom usermeta in user list', 'authorizer' ),
2877		- array( $this, 'print_select_auth_advanced_usermeta' ),
2878		- 'authorizer',
2879		- 'auth_settings_advanced'
	2484	+ 'auth_settings_advanced_usermeta', // HTML element ID
	2485	+ __( 'Show custom usermeta in user list', 'authorizer' ), // HTML element Title
	2486	+ array( $this, 'print_select_auth_advanced_usermeta' ), // Callback (echos form element)
	2487	+ 'authorizer', // Page this setting is shown on (slug)
	2488	+ 'auth_settings_advanced' // Section this setting is shown on
2880	2489	);
2881		- add_settings_field(
2882		- 'auth_settings_advanced_users_per_page',
2883		- __( 'Number of users per page', 'authorizer' ),
2884		- array( $this, 'print_text_auth_advanced_users_per_page' ),
2885		- 'authorizer',
2886		- 'auth_settings_advanced'
2887		- );
2888		- add_settings_field(
2889		- 'auth_settings_advanced_users_sort_by',
2890		- __( 'Approved users sort method', 'authorizer' ),
2891		- array( $this, 'print_select_auth_advanced_users_sort_by' ),
2892		- 'authorizer',
2893		- 'auth_settings_advanced'
2894		- );
2895		- add_settings_field(
2896		- 'auth_settings_advanced_users_sort_order',
2897		- __( 'Approved users sort order', 'authorizer' ),
2898		- array( $this, 'print_select_auth_advanced_users_sort_order' ),
2899		- 'authorizer',
2900		- 'auth_settings_advanced'
2901		- );
2902		- add_settings_field(
2903		- 'auth_settings_advanced_widget_enabled',
2904		- __( 'Show dashboard widget to admin users', 'authorizer' ),
2905		- array( $this, 'print_checkbox_auth_advanced_widget_enabled' ),
2906		- 'authorizer',
2907		- 'auth_settings_advanced'
2908		- );
2909	2490	// On multisite installs, add an option to override all multisite settings on individual sites.
2910	2491	if ( is_multisite() ) {
2911	2492	add_settings_field(
2912		- 'auth_settings_advanced_override_multisite',
2913		- __( 'Override multisite options', 'authorizer' ),
2914		- array( $this, 'print_checkbox_auth_advanced_override_multisite' ),
2915		- 'authorizer',
2916		- 'auth_settings_advanced'
	2493	+ 'auth_settings_advanced_override_multisite', // HTML element ID
	2494	+ __( 'Override multisite options', 'authorizer' ), // HTML element Title
	2495	+ array( $this, 'print_checkbox_auth_advanced_override_multisite' ), // Callback (echos form element)
	2496	+ 'authorizer', // Page this setting is shown on (slug)
	2497	+ 'auth_settings_advanced' // Section this setting is shown on
2917	2498	);
2918	2499	}
2919	2500	}
2920	2501
		@@ -2920,30 +2501,29 @@
2920	2501
2921	2502
2922	2503	/**
2923	2504	* Set meaningful defaults for the plugin options.
2924		- *
2925	2505	* Note: This function is called on plugin activation.
2926	2506	*/
2927		- private function set_default_options() {
	2507	+ function set_default_options() {
2928	2508	global $wp_roles;
2929	2509
2930	2510	$auth_settings = get_option( 'auth_settings' );
2931		- if ( false === $auth_settings ) {
	2511	+ if ( $auth_settings === FALSE ) {
2932	2512	$auth_settings = array();
2933	2513	}
2934	2514
2935	2515	// Access Lists Defaults.
2936	2516	$auth_settings_access_users_pending = get_option( 'auth_settings_access_users_pending' );
2937		- if ( false === $auth_settings_access_users_pending ) {
	2517	+ if ( $auth_settings_access_users_pending === FALSE ) {
2938	2518	$auth_settings_access_users_pending = array();
2939	2519	}
2940	2520	$auth_settings_access_users_approved = get_option( 'auth_settings_access_users_approved' );
2941		- if ( false === $auth_settings_access_users_approved ) {
	2521	+ if ( $auth_settings_access_users_approved === FALSE ) {
2942	2522	$auth_settings_access_users_approved = array();
2943	2523	}
2944	2524	$auth_settings_access_users_blocked = get_option( 'auth_settings_access_users_blocked' );
2945		- if ( false === $auth_settings_access_users_blocked ) {
	2525	+ if ( $auth_settings_access_users_blocked === FALSE ) {
2946	2526	$auth_settings_access_users_blocked = array();
2947	2527	}
2948	2528
2949	2529	// Login Access Defaults.
		@@ -2995,12 +2575,13 @@
2995	2575	if ( ! array_key_exists( 'access_redirect_to_message', $auth_settings ) ) {
2996	2576	$auth_settings['access_redirect_to_message'] = '<p>' . __( 'Notice: You are browsing this site anonymously, and only have access to a portion of its content.', 'authorizer' ) . '</p>';
2997	2577	}
2998	2578
	2579	+
2999	2580	// External Service Defaults.
3000	2581	if ( ! array_key_exists( 'access_default_role', $auth_settings ) ) {
3001	2582	// Set default role to 'student' if that role exists, 'subscriber' otherwise.
3002		- $all_roles = $wp_roles->roles;
	2583	+ $all_roles = $wp_roles->roles;
3003	2584	$editable_roles = apply_filters( 'editable_roles', $all_roles );
3004	2585	if ( array_key_exists( 'student', $editable_roles ) ) {
3005	2586	$auth_settings['access_default_role'] = 'student';
3006	2587	} else {
		@@ -3057,11 +2638,8 @@
3057	2638	}
3058	2639	if ( ! array_key_exists( 'cas_auto_login', $auth_settings ) ) {
3059	2640	$auth_settings['cas_auto_login'] = '';
3060	2641	}
3061		- if ( ! array_key_exists( 'cas_link_on_username', $auth_settings ) ) {
3062		- $auth_settings['cas_link_on_username'] = '';
3063		- }
3064	2642
3065	2643	if ( ! array_key_exists( 'ldap_host', $auth_settings ) ) {
3066	2644	$auth_settings['ldap_host'] = '';
3067	2645	}
		@@ -3101,12 +2679,12 @@
3101	2679
3102	2680	// Advanced defaults.
3103	2681	if ( ! array_key_exists( 'advanced_lockouts', $auth_settings ) ) {
3104	2682	$auth_settings['advanced_lockouts'] = array(
3105		- 'attempts_1' => 10,
3106		- 'duration_1' => 1,
3107		- 'attempts_2' => 10,
3108		- 'duration_2' => 10,
	2683	+ 'attempts_1' => 10,
	2684	+ 'duration_1' => 1,
	2685	+ 'attempts_2' => 10,
	2686	+ 'duration_2' => 10,
3109	2687	'reset_duration' => 120,
3110	2688	);
3111	2689	}
3112	2690	if ( ! array_key_exists( 'advanced_hide_wp_login', $auth_settings ) ) {
		@@ -3120,20 +2698,8 @@
3120	2698	}
3121	2699	if ( ! array_key_exists( 'advanced_usermeta', $auth_settings ) ) {
3122	2700	$auth_settings['advanced_usermeta'] = '';
3123	2701	}
3124		- if ( ! array_key_exists( 'advanced_users_per_page', $auth_settings ) ) {
3125		- $auth_settings['advanced_users_per_page'] = 20;
3126		- }
3127		- if ( ! array_key_exists( 'advanced_users_sort_by', $auth_settings ) ) {
3128		- $auth_settings['advanced_users_sort_by'] = 'created';
3129		- }
3130		- if ( ! array_key_exists( 'advanced_users_sort_order', $auth_settings ) ) {
3131		- $auth_settings['advanced_users_sort_order'] = 'asc';
3132		- }
3133		- if ( ! array_key_exists( 'advanced_widget_enabled', $auth_settings ) ) {
3134		- $auth_settings['advanced_widget_enabled'] = '1';
3135		- }
3136	2702	if ( ! array_key_exists( 'advanced_override_multisite', $auth_settings ) ) {
3137	2703	$auth_settings['advanced_override_multisite'] = '';
3138	2704	}
3139	2705
		@@ -3144,11 +2710,11 @@
3144	2710	update_option( 'auth_settings_access_users_blocked', $auth_settings_access_users_blocked );
3145	2711
3146	2712	// Multisite defaults.
3147	2713	if ( is_multisite() ) {
3148		- $auth_multisite_settings = get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings', array() );
	2714	+ $auth_multisite_settings = get_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings', array() );
3149	2715
3150		- if ( false === $auth_multisite_settings ) {
	2716	+ if ( $auth_multisite_settings === FALSE ) {
3151	2717	$auth_multisite_settings = array();
3152	2718	}
3153	2719	// Global switch for enabling multisite options.
3154	2720	if ( ! array_key_exists( 'multisite_override', $auth_multisite_settings ) ) {
		@@ -3154,10 +2720,10 @@
3154	2720	if ( ! array_key_exists( 'multisite_override', $auth_multisite_settings ) ) {
3155	2721	$auth_multisite_settings['multisite_override'] = '';
3156	2722	}
3157	2723	// Access Lists Defaults.
3158		- $auth_multisite_settings_access_users_approved = get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved' );
3159		- if ( false === $auth_multisite_settings_access_users_approved ) {
	2724	+ $auth_multisite_settings_access_users_approved = get_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved' );
	2725	+ if ( $auth_multisite_settings_access_users_approved === FALSE ) {
3160	2726	$auth_multisite_settings_access_users_approved = array();
3161	2727	}
3162	2728	// Login Access Defaults.
3163	2729	if ( ! array_key_exists( 'access_who_can_login', $auth_multisite_settings ) ) {
		@@ -3169,9 +2735,9 @@
3169	2735	}
3170	2736	// External Service Defaults.
3171	2737	if ( ! array_key_exists( 'access_default_role', $auth_multisite_settings ) ) {
3172	2738	// Set default role to 'student' if that role exists, 'subscriber' otherwise.
3173		- $all_roles = $wp_roles->roles;
	2739	+ $all_roles = $wp_roles->roles;
3174	2740	$editable_roles = apply_filters( 'editable_roles', $all_roles );
3175	2741	if ( array_key_exists( 'student', $editable_roles ) ) {
3176	2742	$auth_multisite_settings['access_default_role'] = 'student';
3177	2743	} else {
		@@ -3225,11 +2791,8 @@
3225	2791	}
3226	2792	if ( ! array_key_exists( 'cas_auto_login', $auth_multisite_settings ) ) {
3227	2793	$auth_multisite_settings['cas_auto_login'] = '';
3228	2794	}
3229		- if ( ! array_key_exists( 'cas_link_on_username', $auth_multisite_settings ) ) {
3230		- $auth_multisite_settings['cas_link_on_username'] = '';
3231		- }
3232	2795	if ( ! array_key_exists( 'ldap_host', $auth_multisite_settings ) ) {
3233	2796	$auth_multisite_settings['ldap_host'] = '';
3234	2797	}
3235	2798	if ( ! array_key_exists( 'ldap_port', $auth_multisite_settings ) ) {
		@@ -3267,12 +2830,12 @@
3267	2830	}
3268	2831	// Advanced defaults.
3269	2832	if ( ! array_key_exists( 'advanced_lockouts', $auth_multisite_settings ) ) {
3270	2833	$auth_multisite_settings['advanced_lockouts'] = array(
3271		- 'attempts_1' => 10,
3272		- 'duration_1' => 1,
3273		- 'attempts_2' => 10,
3274		- 'duration_2' => 10,
	2834	+ 'attempts_1' => 10,
	2835	+ 'duration_1' => 1,
	2836	+ 'attempts_2' => 10,
	2837	+ 'duration_2' => 10,
3275	2838	'reset_duration' => 120,
3276	2839	);
3277	2840	}
3278	2841	if ( ! array_key_exists( 'advanced_hide_wp_login', $auth_multisite_settings ) ) {
		@@ -3277,23 +2840,11 @@
3277	2840	}
3278	2841	if ( ! array_key_exists( 'advanced_hide_wp_login', $auth_multisite_settings ) ) {
3279	2842	$auth_multisite_settings['advanced_hide_wp_login'] = '';
3280	2843	}
3281		- if ( ! array_key_exists( 'advanced_users_per_page', $auth_multisite_settings ) ) {
3282		- $auth_multisite_settings['advanced_users_per_page'] = 20;
3283		- }
3284		- if ( ! array_key_exists( 'advanced_users_sort_by', $auth_multisite_settings ) ) {
3285		- $auth_multisite_settings['advanced_users_sort_by'] = 'created';
3286		- }
3287		- if ( ! array_key_exists( 'advanced_users_sort_order', $auth_multisite_settings ) ) {
3288		- $auth_multisite_settings['advanced_users_sort_order'] = 'asc';
3289		- }
3290		- if ( ! array_key_exists( 'advanced_widget_enabled', $auth_multisite_settings ) ) {
3291		- $auth_multisite_settings['advanced_widget_enabled'] = '1';
3292		- }
3293	2844	// Save default network options to database.
3294		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings', $auth_multisite_settings );
3295		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
	2845	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings', $auth_multisite_settings );
	2846	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
3296	2847	}
3297	2848
3298	2849	return $auth_settings;
3299	2850	}
		@@ -3300,15 +2851,12 @@
3300	2851
3301	2852
3302	2853	/**
3303	2854	* List sanitizer.
3304		- *
3305		- * @param array $list Array of users to sanitize.
3306		- * @param string $side_effect Set to 'update roles' if role syncing should be performed.
3307		- * @param string $multisite_mode Set to 'multisite' to sync roles on all sites the user belongs to.
3308		- * @return array Array of sanitized users.
	2855	+ * $side_effect = 'none' or 'update roles' to make sure WP user roles match
	2856	+ * $multisite_mode = 'single' or 'multisite' to indicate which user roles to change (this site or all sites)
3309	2857	*/
3310		- private function sanitize_user_list( $list, $side_effect = 'none', $multisite_mode = 'single' ) {
	2858	+ function sanitize_user_list( $list, $side_effect = 'none', $multisite_mode = 'single' ) {
3311	2859	// If it's not a list, make it so.
3312	2860	if ( ! is_array( $list ) ) {
3313	2861	$list = array();
3314	2862	}
		@@ -3313,16 +2861,16 @@
3313	2861	$list = array();
3314	2862	}
3315	2863	foreach ( $list as $key => $user_info ) {
3316	2864	if ( strlen( $user_info['email'] ) < 1 ) {
3317		- // Make sure there are no empty entries in the list.
3318		- unset( $list[ $key ] );
3319		- } elseif ( 'update roles' === $side_effect ) {
	2865	+ // Make sure there are no empty entries in the list
	2866	+ unset( $list[$key] );
	2867	+ } elseif ( $side_effect === 'update roles' ) {
3320	2868	// Make sure the WordPress user accounts have the same role
3321	2869	// as that indicated in the list.
3322	2870	$wp_user = get_user_by( 'email', $user_info['email'] );
3323	2871	if ( $wp_user ) {
3324		- if ( is_multisite() && 'multisite' === $multisite_mode ) {
	2872	+ if ( is_multisite() && $multisite_mode === 'multisite' ) {
3325	2873	foreach ( get_blogs_of_user( $wp_user->ID ) as $blog ) {
3326	2874	add_user_to_blog( $blog->userblog_id, $wp_user->ID, $user_info['role'] );
3327	2875	}
3328	2876	} else {
		@@ -3335,21 +2883,18 @@
3335	2883	}
3336	2884
3337	2885
3338	2886	/**
3339		- * Settings sanitizer callback.
3340		- *
3341		- * @param array $auth_settings Authorizer settings array.
3342		- * @return array Sanitized Authorizer settings array.
	2887	+ * Settings sanitizer callback
3343	2888	*/
3344		- public function sanitize_options( $auth_settings ) {
	2889	+ function sanitize_options( $auth_settings ) {
3345	2890	// Default to "Approved Users" login access restriction.
3346		- if ( ! in_array( $auth_settings['access_who_can_login'], array( 'external_users', 'approved_users' ), true ) ) {
	2891	+ if ( ! in_array( $auth_settings['access_who_can_login'], array( 'external_users', 'approved_users' ) ) ) {
3347	2892	$auth_settings['access_who_can_login'] = 'approved_users';
3348	2893	}
3349	2894
3350	2895	// Default to "Everyone" view access restriction.
3351		- if ( ! in_array( $auth_settings['access_who_can_view'], array( 'everyone', 'logged_in_users' ), true ) ) {
	2896	+ if ( ! in_array( $auth_settings['access_who_can_view'], array( 'everyone', 'logged_in_users' ) ) ) {
3352	2897	$auth_settings['access_who_can_view'] = 'everyone';
3353	2898	}
3354	2899
3355	2900	// Default to WordPress login access redirect.
		@@ -3354,9 +2899,9 @@
3354	2899
3355	2900	// Default to WordPress login access redirect.
3356	2901	// Note: this option doesn't exist in multisite options, so we first
3357	2902	// check to see if it exists.
3358		- if ( array_key_exists( 'access_redirect', $auth_settings ) && ! in_array( $auth_settings['access_redirect'], array( 'login', 'page', 'message' ), true ) ) {
	2903	+ if ( array_key_exists( 'access_redirect', $auth_settings ) && ! in_array( $auth_settings['access_redirect'], array( 'login', 'page', 'message' ) ) ) {
3359	2904	$auth_settings['access_redirect'] = 'login';
3360	2905	}
3361	2906
3362	2907	// Default to warning message for anonymous users on public pages.
		@@ -3361,64 +2906,61 @@
3361	2906
3362	2907	// Default to warning message for anonymous users on public pages.
3363	2908	// Note: this option doesn't exist in multisite options, so we first
3364	2909	// check to see if it exists.
3365		- if ( array_key_exists( 'access_public_warning', $auth_settings ) && ! in_array( $auth_settings['access_public_warning'], array( 'no_warning', 'warning' ), true ) ) {
	2910	+ if ( array_key_exists( 'access_public_warning', $auth_settings ) && ! in_array( $auth_settings['access_public_warning'], array( 'no_warning', 'warning' ) ) ) {
3366	2911	$auth_settings['access_public_warning'] = 'no_warning';
3367	2912	}
3368	2913
3369		- // Sanitize Send welcome email (checkbox: value can only be '1' or empty string).
	2914	+ // Sanitize Send welcome email (checkbox: value can only be '1' or empty string)
3370	2915	$auth_settings['access_should_email_approved_users'] = array_key_exists( 'access_should_email_approved_users', $auth_settings ) && strlen( $auth_settings['access_should_email_approved_users'] ) > 0 ? '1' : '';
3371	2916
3372		- // Sanitize Enable Google Logins (checkbox: value can only be '1' or empty string).
	2917	+ // Sanitize Enable Google Logins (checkbox: value can only be '1' or empty string)
3373	2918	$auth_settings['google'] = array_key_exists( 'google', $auth_settings ) && strlen( $auth_settings['google'] ) > 0 ? '1' : '';
3374	2919
3375		- // Sanitize Enable CAS Logins (checkbox: value can only be '1' or empty string).
	2920	+ // Sanitize Enable CAS Logins (checkbox: value can only be '1' or empty string)
3376	2921	$auth_settings['cas'] = array_key_exists( 'cas', $auth_settings ) && strlen( $auth_settings['cas'] ) > 0 ? '1' : '';
3377	2922
3378		- // Sanitize CAS Host setting.
	2923	+ // Sanitize CAS Host setting
3379	2924	$auth_settings['cas_host'] = filter_var( $auth_settings['cas_host'], FILTER_SANITIZE_URL );
3380	2925
3381		- // Sanitize CAS Port (int).
	2926	+ // Sanitize CAS Port (int)
3382	2927	$auth_settings['cas_port'] = filter_var( $auth_settings['cas_port'], FILTER_SANITIZE_NUMBER_INT );
3383	2928
3384		- // Sanitize CAS attribute update (checkbox: value can only be '1' or empty string).
	2929	+ // Sanitize CAS attribute update (checkbox: value can only be '1' or empty string)
3385	2930	$auth_settings['cas_attr_update_on_login'] = array_key_exists( 'cas_attr_update_on_login', $auth_settings ) && strlen( $auth_settings['cas_attr_update_on_login'] ) > 0 ? '1' : '';
3386	2931
3387		- // Sanitize CAS auto-login (checkbox: value can only be '1' or empty string).
	2932	+ // Sanitize CAS auto-login (checkbox: value can only be '1' or empty string)
3388	2933	$auth_settings['cas_auto_login'] = array_key_exists( 'cas_auto_login', $auth_settings ) && strlen( $auth_settings['cas_auto_login'] ) > 0 ? '1' : '';
3389	2934
3390		- // Sanitize CAS link on username (checkbox: value can only be '1' or empty string).
3391		- $auth_settings['cas_link_on_username'] = array_key_exists( 'cas_link_on_username', $auth_settings ) && strlen( $auth_settings['cas_link_on_username'] ) > 0 ? '1' : '';
3392		-
3393		- // Sanitize Enable LDAP Logins (checkbox: value can only be '1' or empty string).
	2935	+ // Sanitize Enable LDAP Logins (checkbox: value can only be '1' or empty string)
3394	2936	$auth_settings['ldap'] = array_key_exists( 'ldap', $auth_settings ) && strlen( $auth_settings['ldap'] ) > 0 ? '1' : '';
3395	2937
3396		- // Sanitize LDAP Host setting.
	2938	+ // Sanitize LDAP Host setting
3397	2939	$auth_settings['ldap_host'] = filter_var( $auth_settings['ldap_host'], FILTER_SANITIZE_URL );
3398	2940
3399		- // Sanitize LDAP Port (int).
	2941	+ // Sanitize LDAP Port (int)
3400	2942	$auth_settings['ldap_port'] = filter_var( $auth_settings['ldap_port'], FILTER_SANITIZE_NUMBER_INT );
3401	2943
3402		- // Sanitize LDAP TLS (checkbox: value can only be '1' or empty string).
	2944	+ // Sanitize LDAP TLS (checkbox: value can only be '1' or empty string)
3403	2945	$auth_settings['ldap_tls'] = array_key_exists( 'ldap_tls', $auth_settings ) && strlen( $auth_settings['ldap_tls'] ) > 0 ? '1' : '';
3404	2946
3405		- // Sanitize LDAP attributes (basically make sure they don't have any parentheses).
	2947	+ // Sanitize LDAP attributes (basically make sure they don't have any parentheses)
3406	2948	$auth_settings['ldap_uid'] = filter_var( $auth_settings['ldap_uid'], FILTER_SANITIZE_EMAIL );
3407	2949
3408		- // Sanitize LDAP Lost Password URL.
	2950	+ // Sanitize LDAP Lost Password URL
3409	2951	$auth_settings['ldap_lostpassword_url'] = filter_var( $auth_settings['ldap_lostpassword_url'], FILTER_SANITIZE_URL );
3410	2952
3411		- // Obfuscate LDAP directory user password.
	2953	+ // Obfuscate LDAP directory user password
3412	2954	if ( strlen( $auth_settings['ldap_password'] ) > 0 ) {
3413	2955	// encrypt the directory user password for some minor obfuscation in the database.
3414		- $auth_settings['ldap_password'] = $this->encrypt( $auth_settings['ldap_password'] );
	2956	+ $auth_settings['ldap_password'] = base64_encode( $this->encrypt( $auth_settings['ldap_password'] ) );
3415	2957	}
3416	2958
3417		- // Sanitize LDAP attribute update (checkbox: value can only be '1' or empty string).
	2959	+ // Sanitize LDAP attribute update (checkbox: value can only be '1' or empty string)
3418	2960	$auth_settings['ldap_attr_update_on_login'] = array_key_exists( 'ldap_attr_update_on_login', $auth_settings ) && strlen( $auth_settings['ldap_attr_update_on_login'] ) > 0 ? '1' : '';
3419	2961
3420		- // Make sure public pages is an empty array if it's empty.
	2962	+ // Make sure public pages is an empty array if it's empty
3421	2963	// Note: this option doesn't exist in multisite options, so we first
3422	2964	// check to see if it exists.
3423	2965	if ( array_key_exists( 'access_public_pages', $auth_settings ) && ! is_array( $auth_settings['access_public_pages'] ) ) {
3424	2966	$auth_settings['access_public_pages'] = array();
		@@ -3426,31 +2968,15 @@
3426	2968
3427	2969	// Make sure all lockout options are integers (attempts_1,
3428	2970	// duration_1, attempts_2, duration_2, reset_duration).
3429	2971	foreach ( $auth_settings['advanced_lockouts'] as $key => $value ) {
3430		- $auth_settings['advanced_lockouts'][ $key ] = filter_var( $value, FILTER_SANITIZE_NUMBER_INT );
	2972	+ $auth_settings['advanced_lockouts'][$key] = filter_var( $value, FILTER_SANITIZE_NUMBER_INT );
3431	2973	}
3432	2974
3433		- // Sanitize Hide WordPress logins (checkbox: value can only be '1' or empty string).
	2975	+ // Sanitize Hide WordPress logins (checkbox: value can only be '1' or empty string)
3434	2976	$auth_settings['advanced_hide_wp_login'] = array_key_exists( 'advanced_hide_wp_login', $auth_settings ) && strlen( $auth_settings['advanced_hide_wp_login'] ) > 0 ? '1' : '';
3435	2977
3436		- // Sanitize Users per page (text: value can only int from 1 to MAX_INT).
3437		- $auth_settings['advanced_users_per_page'] = array_key_exists( 'advanced_users_per_page', $auth_settings ) && intval( $auth_settings['advanced_users_per_page'] ) > 0 ? intval( $auth_settings['advanced_users_per_page'] ) : 1;
3438		-
3439		- // Sanitize Sort users by (select: value can be 'email', 'role', 'date_added', 'created').
3440		- if ( ! isset( $auth_settings['advanced_users_sort_by'] ) || ! in_array( $auth_settings['advanced_users_sort_by'], array( 'email', 'role', 'date_added', 'created' ), true ) ) {
3441		- $auth_settings['advanced_users_sort_by'] = 'created';
3442		- }
3443		-
3444		- // Sanitize Sort users order (select: value can be 'asc', 'desc').
3445		- if ( ! isset( $auth_settings['advanced_users_sort_order'] ) || ! in_array( $auth_settings['advanced_users_sort_order'], array( 'asc', 'desc' ), true ) ) {
3446		- $auth_settings['advanced_users_sort_order'] = 'asc';
3447		- }
3448		-
3449		- // Sanitize Show Dashboard Widget (checkbox: value can only be '1' or empty string).
3450		- $auth_settings['advanced_widget_enabled'] = array_key_exists( 'advanced_widget_enabled', $auth_settings ) && strlen( $auth_settings['advanced_widget_enabled'] ) > 0 ? '1' : '';
3451		-
3452		- // Sanitize Override multisite options (checkbox: value can only be '1' or empty string).
	2978	+ // Sanitize Override multisite options (checkbox: value can only be '1' or empty string)
3453	2979	$auth_settings['advanced_override_multisite'] = array_key_exists( 'advanced_override_multisite', $auth_settings ) && strlen( $auth_settings['advanced_override_multisite'] ) > 0 ? '1' : '';
3454	2980
3455	2981	return $auth_settings;
3456	2982	}
		@@ -3457,201 +2983,90 @@
3457	2983
3458	2984
3459	2985	/**
3460	2986	* Keep authorizer approved users' roles in sync with WordPress roles
3461		- * if someone changes the role via the WordPress Edit User page
3462		- * (wp-admin/user-edit.php or wp-admin/profile.php).
	2987	+ * if someone changes the role via the WordPress Edit User options page.
3463	2988	*
3464		- * Action: user_profile_update_errors
3465		- *
3466		- * @param WP_Error $errors Errors object to add any custom errors to (passed by reference).
3467		- * @param bool $update True if updating existing user, false if saving a new one.
3468		- * @param stdClass $user Updated WP_User object for user being edited (passed by reference).
	2989	+ * @action edit_user_profile_update
	2990	+ * @ref https://codex.wordpress.org/Plugin_API/Action_Reference/edit_user_profile_update
	2991	+ * @param int $user_id The user ID of the user being edited
	2992	+
	2993	+ * @action personal_options_update
	2994	+ * @ref https://codex.wordpress.org/Plugin_API/Action_Reference/personal_options_update
	2995	+ * @param int $user_id The user ID of the user being edited
3469	2996	*/
3470		- public function edit_user_profile_update_role( &$errors, $update, &$user ) {
3471		- // Do nothing if we're not updating role.
3472		- if ( ! property_exists( $user, 'role' ) ) {
	2997	+ function edit_user_profile_update_role( $user_id ) {
	2998	+ if ( ! current_user_can( 'edit_user', $user_id ) ) {
3473	2999	return;
3474	3000	}
3475	3001
3476		- // Safety check; will likely not fire if we reach this function.
3477		- if ( ! current_user_can( 'edit_user', $user->ID ) ) {
3478		- return;
3479		- }
3480		-
3481		- // Don't perform Authorizer updates if we have a WordPress error.
3482		- $errors_on_user_update = $errors->get_error_codes();
3483		- if ( ! empty( $errors_on_user_update ) ) {
3484		- return;
3485		- }
3486		-
3487		- // Get original user object (fail if not a real WordPress user).
3488		- $userdata = get_userdata( $user->ID );
3489		- if ( ! $userdata ) {
3490		- return;
3491		- }
3492		-
3493	3002	// If user is in approved list, update his/her associated role.
3494		- if ( $this->is_email_in_list( $userdata->user_email, 'approved' ) ) {
3495		- $auth_settings_access_users_approved = $this->sanitize_user_list( $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT ) );
3496		- foreach ( $auth_settings_access_users_approved as $key => $check_user ) {
3497		- if ( 0 === strcasecmp( $check_user['email'], $userdata->user_email ) ) {
3498		- $auth_settings_access_users_approved[ $key ]['role'] = $user->role;
3499		- }
3500		- }
3501		- update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved );
3502		- }
3503		- }
3504		-
3505		-
3506		- /**
3507		- * Sync any email address changes to WordPress accounts to the corresponding
3508		- * entry in the Authorizer approved list.
3509		- *
3510		- * Note: This filter fires in wp_update_user() if the update includes an
3511		- * email address change, and fires after all security and integrity checks
3512		- * have been performed, so we can simply update the Authorizer approved
3513		- * list, changing the email address on the approved entry, and removing any
3514		- * existing entries that also have the new email address (duplicates).
3515		- *
3516		- * Filter: send_email_change_email
3517		- *
3518		- * @param bool $send Whether to send the email.
3519		- * @param array $user The original user array.
3520		- * @param array $userdata The updated user array.
3521		- */
3522		- public function edit_user_profile_update_email( $send, $user, $userdata ) {
3523		- // If we're in multisite, update the email on all sites in the network
3524		- // (and remove from any subsites if it's a network-approved user).
3525		- if ( is_multisite() ) {
3526		- // If it's a multisite approved user, sync the email there.
3527		- $changed_user_is_multisite_user = false;
3528		- if ( $this->is_email_in_list( $user['user_email'], 'approved', 'multisite' ) ) {
3529		- $changed_user_is_multisite_user = true;
3530		- $auth_multisite_settings_access_users_approved = $this->sanitize_user_list(
3531		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT )
3532		- );
3533		- foreach ( $auth_multisite_settings_access_users_approved as $key => $check_user ) {
3534		- // Update old user email in approved list to the new email.
3535		- if ( 0 === strcasecmp( $check_user['email'], $user['user_email'] ) ) {
3536		- $auth_multisite_settings_access_users_approved[ $key ]['email'] = $this->lowercase( $userdata['user_email'] );
	3003	+ $wp_user = get_user_by( 'id', $user_id );
	3004	+ if ( $this->is_email_in_list( $wp_user->get( 'user_email' ), 'approved' ) ) {
	3005	+ $auth_settings_access_users_approved = $this->sanitize_user_list( $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN ) );
	3006	+ // Find approved user and sync with the corresponding WP_User.
	3007	+ foreach ( $auth_settings_access_users_approved as $key => $user ) {
	3008	+ if ( $user['email'] === $wp_user->user_email ) {
	3009	+ // Sync user role.
	3010	+ if ( array_key_exists( 'role', $_REQUEST ) ) {
	3011	+ $auth_settings_access_users_approved[$key]['role'] = $_REQUEST['role'];
3537	3012	}
3538		- // If new user email is already in approved list, remove that entry.
3539		- if ( 0 === strcasecmp( $check_user['email'], $userdata['user_email'] ) ) {
3540		- unset( $auth_multisite_settings_access_users_approved[ $key ] );
	3013	+ // Sync email address.
	3014	+ if ( array_key_exists( 'email', $_REQUEST ) ) {
	3015	+ $auth_settings_access_users_approved[$key]['email'] = $_REQUEST['email'];
3541	3016	}
3542	3017	}
3543		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
3544	3018	}
3545	3019
3546		- // Go through all approved lists on individual sites and sync this user there.
3547		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
3548		- $sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
3549		- foreach ( $sites as $site ) {
3550		- $updated = false;
3551		- $blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
3552		- $auth_settings_access_users_approved = get_blog_option( $blog_id, 'auth_settings_access_users_approved', array() );
3553		- foreach ( $auth_settings_access_users_approved as $key => $check_user ) {
3554		- // Update old user email in approved list to the new email.
3555		- if ( 0 === strcasecmp( $check_user['email'], $user['user_email'] ) ) {
3556		- // But if the user is already a multisite user, just remove the entry in the subsite.
3557		- if ( $changed_user_is_multisite_user ) {
3558		- unset( $auth_settings_access_users_approved[ $key ] );
3559		- } else {
3560		- $auth_settings_access_users_approved[ $key ]['email'] = $this->lowercase( $userdata['user_email'] );
3561		- }
3562		- $updated = true;
3563		- }
3564		- // If new user email is already in approved list, remove that entry.
3565		- if ( 0 === strcasecmp( $check_user['email'], $userdata['user_email'] ) ) {
3566		- unset( $auth_settings_access_users_approved[ $key ] );
3567		- $updated = true;
3568		- }
3569		- }
3570		- if ( $updated ) {
3571		- update_blog_option( $blog_id, 'auth_settings_access_users_approved', $auth_settings_access_users_approved );
3572		- }
3573		- }
3574		- } else {
3575		- // In a single site environment, just find the old user in the approved list and update the email.
3576		- if ( $this->is_email_in_list( $user['user_email'], 'approved' ) ) {
3577		- $auth_settings_access_users_approved = $this->sanitize_user_list( $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT ) );
3578		- foreach ( $auth_settings_access_users_approved as $key => $check_user ) {
3579		- // Update old user email in approved list to the new email.
3580		- if ( 0 === strcasecmp( $check_user['email'], $user['user_email'] ) ) {
3581		- $auth_settings_access_users_approved[ $key ]['email'] = $this->lowercase( $userdata['user_email'] );
3582		- }
3583		- // If new user email is already in approved list, remove that entry.
3584		- if ( 0 === strcasecmp( $check_user['email'], $userdata['user_email'] ) ) {
3585		- unset( $auth_settings_access_users_approved[ $key ] );
3586		- }
3587		- }
3588		- update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved );
3589		- }
	3020	+ update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved );
3590	3021	}
3591		-
3592		- // We're hooking into this filter merely for its location in the codebase,
3593		- // so make sure to return the filter value unmodified.
3594		- return $send;
3595	3022	}
3596	3023
3597	3024
3598	3025	/**
3599		- * Settings print callback.
3600		- *
3601		- * @param string $args Args (e.g., multisite admin mode).
3602		- * @return void
	3026	+ * Settings print callbacks
3603	3027	*/
3604		- public function print_section_info_tabs( $args = '' ) {
3605		- if ( WP_Plugin_Authorizer::NETWORK_CONTEXT === $this->get_admin_mode( $args ) ) :
3606		- ?>
	3028	+ function print_section_info_tabs( $args = '' ) {
	3029	+ if ( MULTISITE_ADMIN === $this->get_admin_mode( $args )): ?>
3607	3030	<h2 class="nav-tab-wrapper">
3608		- <a class="nav-tab nav-tab-access_lists nav-tab-active" href="javascript:chooseTab('access_lists' );"><?php esc_html_e( 'Access Lists', 'authorizer' ); ?></a>
3609		- <a class="nav-tab nav-tab-external" href="javascript:chooseTab('external' );"><?php esc_html_e( 'External Service', 'authorizer' ); ?></a>
3610		- <a class="nav-tab nav-tab-advanced" href="javascript:chooseTab('advanced' );"><?php esc_html_e( 'Advanced', 'authorizer' ); ?></a>
	3031	+ <a class="nav-tab nav-tab-access_lists nav-tab-active" href="javascript:choose_tab('access_lists' );"><?php _e( 'Access Lists', 'authorizer' ); ?></a>
	3032	+ <a class="nav-tab nav-tab-external" href="javascript:choose_tab('external' );"><?php _e( 'External Service', 'authorizer' ); ?></a>
	3033	+ <a class="nav-tab nav-tab-advanced" href="javascript:choose_tab('advanced' );"><?php _e( 'Advanced', 'authorizer' ); ?></a>
3611	3034	</h2>
3612		- <?php else : ?>
	3035	+ <?php else: ?>
3613	3036	<h2 class="nav-tab-wrapper">
3614		- <a class="nav-tab nav-tab-access_lists nav-tab-active" href="javascript:chooseTab('access_lists' );"><?php esc_html_e( 'Access Lists', 'authorizer' ); ?></a>
3615		- <a class="nav-tab nav-tab-access_login" href="javascript:chooseTab('access_login' );"><?php esc_html_e( 'Login Access', 'authorizer' ); ?></a>
3616		- <a class="nav-tab nav-tab-access_public" href="javascript:chooseTab('access_public' );"><?php esc_html_e( 'Public Access', 'authorizer' ); ?></a>
3617		- <a class="nav-tab nav-tab-external" href="javascript:chooseTab('external' );"><?php esc_html_e( 'External Service', 'authorizer' ); ?></a>
3618		- <a class="nav-tab nav-tab-advanced" href="javascript:chooseTab('advanced' );"><?php esc_html_e( 'Advanced', 'authorizer' ); ?></a>
	3037	+ <a class="nav-tab nav-tab-access_lists nav-tab-active" href="javascript:choose_tab('access_lists' );"><?php _e( 'Access Lists', 'authorizer' ); ?></a>
	3038	+ <a class="nav-tab nav-tab-access_login" href="javascript:choose_tab('access_login' );"><?php _e( 'Login Access', 'authorizer' ); ?></a>
	3039	+ <a class="nav-tab nav-tab-access_public" href="javascript:choose_tab('access_public' );"><?php _e( 'Public Access', 'authorizer' ); ?></a>
	3040	+ <a class="nav-tab nav-tab-external" href="javascript:choose_tab('external' );"><?php _e( 'External Service', 'authorizer' ); ?></a>
	3041	+ <a class="nav-tab nav-tab-advanced" href="javascript:choose_tab('advanced' );"><?php _e( 'Advanced', 'authorizer' ); ?></a>
3619	3042	</h2>
3620		- <?php
3621		- endif;
	3043	+ <?php endif;
3622	3044	}
3623	3045
3624	3046
3625		- /**
3626		- * Settings print callback.
3627		- *
3628		- * @param string $args Args (e.g., multisite admin mode).
3629		- * @return void
3630		- */
3631		- public function print_section_info_access_lists( $args = '' ) {
	3047	+ function print_section_info_access_lists( $args = '' ) {
3632	3048	$admin_mode = $this->get_admin_mode( $args );
3633		- ?>
3634		- <div id="section_info_access_lists" class="section_info">
3635		- <p><?php esc_html_e( 'Manage who has access to this site using these lists.', 'authorizer' ); ?></p>
	3049	+ ?><div id="section_info_access_lists" class="section_info">
	3050	+ <p><?php _e( 'Manage who has access to this site using these lists.', 'authorizer' ); ?></p>
3636	3051	<ol>
3637		- <li><?php echo wp_kses( __( "<strong>Pending</strong> users are users who have successfully logged in to the site, but who haven't yet been approved (or blocked) by you.", 'authorizer' ), $this->allowed_html ); ?></li>
3638		- <li><?php echo wp_kses( __( '<strong>Approved</strong> users have access to the site once they successfully log in.', 'authorizer' ), $this->allowed_html ); ?></li>
3639		- <li><?php echo wp_kses( __( '<strong>Blocked</strong> users will receive an error message when they try to visit the site after authenticating.', 'authorizer' ), $this->allowed_html ); ?><br><?php esc_html_e( 'Note: if you want to block all email addresses from a domain, say anyone@example.com, simply add "@example.com" to the blocked list.', 'authorizer' ); ?></li>
	3052	+ <li><?php _e( "<strong>Pending</strong> users are users who have successfully logged in to the site, but who haven't yet been approved (or blocked) by you.", 'authorizer' ); ?></li>
	3053	+ <li><?php _e( '<strong>Approved</strong> users have access to the site once they successfully log in.', 'authorizer' ); ?></li>
	3054	+ <li><?php _e( '<strong>Blocked</strong> users will receive an error message when they try to visit the site after authenticating.', 'authorizer' ); ?></li>
3640	3055	</ol>
3641	3056	</div>
3642	3057	<table class="form-table">
3643	3058	<tbody>
3644	3059	<tr>
3645		- <th scope="row"><?php esc_html_e( 'Pending Users', 'authorizer' ); ?> <em>(<?php echo esc_html( $this->get_user_count_from_list( 'pending', $admin_mode ) ); ?>)</em></th>
	3060	+ <th scope="row"><?php _e( 'Pending Users', 'authorizer' ); ?> <em>(<?php echo $this->get_user_count_from_list( 'pending', $admin_mode ); ?>)</em></th>
3646	3061	<td><?php $this->print_combo_auth_access_users_pending(); ?></td>
3647	3062	</tr>
3648	3063	<tr>
3649		- <th scope="row"><?php esc_html_e( 'Approved Users', 'authorizer' ); ?> <em>(<?php echo esc_html( $this->get_user_count_from_list( 'approved', $admin_mode ) ); ?>)</em></th>
	3064	+ <th scope="row"><?php _e( 'Approved Users', 'authorizer' ); ?> <em>(<?php echo $this->get_user_count_from_list( 'approved', $admin_mode ); ?>)</em></th>
3650	3065	<td><?php $this->print_combo_auth_access_users_approved(); ?></td>
3651	3066	</tr>
3652	3067	<tr>
3653		- <th scope="row"><?php esc_html_e( 'Blocked Users', 'authorizer' ); ?> <em>(<?php echo esc_html( $this->get_user_count_from_list( 'blocked', $admin_mode ) ); ?>)</em></th>
	3068	+ <th scope="row"><?php _e( 'Blocked Users', 'authorizer' ); ?> <em>(<?php echo $this->get_user_count_from_list( 'blocked', $admin_mode ); ?>)</em></th>
3654	3069	<td><?php $this->print_combo_auth_access_users_blocked(); ?></td>
3655	3070	</tr>
3656	3071	</tbody>
3657	3072	</table>
		@@ -3658,516 +3073,276 @@
3658	3073	<?php
3659	3074	}
3660	3075
3661	3076
3662		- /**
3663		- * Settings print callback.
3664		- *
3665		- * @param string $args Args (e.g., multisite admin mode).
3666		- * @return void
3667		- */
3668		- public function print_combo_auth_access_users_pending( $args = '' ) {
	3077	+ function print_combo_auth_access_users_pending( $args = '' ) {
3669	3078	// Get plugin option.
3670		- $option = 'access_users_pending';
	3079	+ $option = 'access_users_pending';
3671	3080	$auth_settings_option = $this->get_plugin_option( $option );
3672	3081	$auth_settings_option = is_array( $auth_settings_option ) ? $auth_settings_option : array();
3673	3082
3674		- // Render wrapper div (for aligning pager to width of content).
3675		- ?>
3676		- <div class="wrapper_<?php echo esc_attr( $option ); ?>">
3677		- <ul id="list_auth_settings_access_users_pending" style="margin:0;">
3678		- <?php
3679		- if ( count( $auth_settings_option ) > 0 ) :
3680		- foreach ( $auth_settings_option as $key => $pending_user ) :
3681		- if ( empty( $pending_user ) || count( $pending_user ) < 1 ) :
3682		- continue;
3683		- endif;
3684		- $pending_user['is_wp_user'] = false;
3685		- ?>
3686		- <li>
3687		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>_<?php echo esc_attr( $key ); ?>" value="<?php echo esc_attr( $pending_user['email'] ); ?>" readonly="true" class="auth-email" />
3688		- <select id="auth_settings_<?php echo esc_attr( $option ); ?>_<?php echo esc_attr( $key ); ?>_role" class="auth-role">
3689		- <?php $this->wp_dropdown_permitted_roles( $pending_user['role'] ); ?>
3690		- </select>
3691		- <a href="javascript:void(0);" class="button-primary" id="approve_user_<?php echo esc_attr( $key ); ?>" onclick="authAddUser( this, 'approved', false ); authIgnoreUser( this, 'pending' );"><span class="glyphicon glyphicon-ok"></span> <?php esc_html_e( 'Approve', 'authorizer' ); ?></a>
3692		- <a href="javascript:void(0);" class="button-primary" id="block_user_<?php echo esc_attr( $key ); ?>" onclick="authAddUser( this, 'blocked', false ); authIgnoreUser( this, 'pending' );"><span class="glyphicon glyphicon-ban-circle"></span> <?php esc_html_e( 'Block', 'authorizer' ); ?></a>
3693		- <a href="javascript:void(0);" class="button button-secondary" id="ignore_user_<?php echo esc_attr( $key ); ?>" onclick="authIgnoreUser( this, 'pending' );" title="<?php esc_html_e( 'Remove user', 'authorizer' ); ?>"><span class="glyphicon glyphicon-remove"></span> <?php esc_html_e( 'Ignore', 'authorizer' ); ?></a>
3694		- </li>
3695		- <?php endforeach; ?>
3696		- <?php else : ?>
3697		- <li class="auth-empty"><em><?php esc_html_e( 'No pending users', 'authorizer' ); ?></em></li>
3698		- <?php endif; ?>
3699		- </ul>
3700		- </div>
	3083	+ // Print option elements.
	3084	+ ?><ul id="list_auth_settings_access_users_pending" style="margin:0;">
	3085	+ <?php if ( count( $auth_settings_option ) > 0 ) : ?>
	3086	+ <?php foreach ( $auth_settings_option as $key => $pending_user ): ?>
	3087	+ <?php if ( empty( $pending_user ) || count( $pending_user ) < 1 ) continue; ?>
	3088	+ <?php $pending_user['is_wp_user'] = false; ?>
	3089	+ <li>
	3090	+ <input type="text" id="auth_settings_<?php echo $option; ?>_<?php echo $key; ?>" value="<?php echo $pending_user['email']; ?>" readonly="true" class="auth-email" />
	3091	+ <select id="auth_settings_<?php echo $option; ?>_<?php echo $key; ?>_role" class="auth-role">
	3092	+ <?php $this->wp_dropdown_permitted_roles( $pending_user['role'] ); ?>
	3093	+ </select>
	3094	+ <a href="javascript:void(0);" class="button-primary" id="approve_user_<?php echo $key; ?>" onclick="auth_add_user( this, 'approved', false ); auth_ignore_user( this, 'pending' );"><span class="glyphicon glyphicon-ok"></span> <?php _e( 'Approve', 'authorizer' ); ?></a>
	3095	+ <a href="javascript:void(0);" class="button-primary" id="block_user_<?php echo $key; ?>" onclick="auth_add_user( this, 'blocked', false ); auth_ignore_user( this, 'pending' );"><span class="glyphicon glyphicon-ban-circle"></span> <?php _e( 'Block', 'authorizer' ); ?></a>
	3096	+ <a href="javascript:void(0);" class="button button-secondary" id="ignore_user_<?php echo $key; ?>" onclick="auth_ignore_user( this, 'pending' );" title="<?php _e( 'Remove user', 'authorizer' ); ?>"><span class="glyphicon glyphicon-remove"></span> <?php _e( 'Ignore', 'authorizer' ); ?></a>
	3097	+ </li>
	3098	+ <?php endforeach; ?>
	3099	+ <?php else: ?>
	3100	+ <li class="auth-empty"><em><?php _e( 'No pending users', 'authorizer' ); ?></em></li>
	3101	+ <?php endif; ?>
	3102	+ </ul>
3701	3103	<?php
3702	3104	}
3703	3105
3704	3106
3705		- /**
3706		- * Settings print callback.
3707		- *
3708		- * @param string $args Args (e.g., multisite admin mode).
3709		- * @return void
3710		- */
3711		- public function print_combo_auth_access_users_approved( $args = '' ) {
	3107	+ function print_combo_auth_access_users_approved( $args = '' ) {
3712	3108	// Get plugin option.
3713		- $option = 'access_users_approved';
3714		- $admin_mode = $this->get_admin_mode( $args );
	3109	+ $option = 'access_users_approved';
	3110	+ $admin_mode = $this->get_admin_mode( $args );
3715	3111	$auth_settings_option = $this->get_plugin_option( $option, $admin_mode, 'no override' );
3716	3112	$auth_settings_option = is_array( $auth_settings_option ) ? $auth_settings_option : array();
3717	3113
3718		- // Get multisite approved users (will be added to top of list, greyed out).
3719		- $auth_override_multisite = $this->get_plugin_option( 'advanced_override_multisite' );
3720		- $auth_multisite_settings = $this->get_plugin_options( WP_Plugin_Authorizer::NETWORK_CONTEXT );
	3114	+ // Get multisite approved users (add them to top of list, greyed out).
	3115	+ $auth_override_multisite = $this->get_plugin_option( 'advanced_override_multisite' );
	3116	+ $auth_multisite_settings = $this->get_plugin_options( MULTISITE_ADMIN );
3721	3117	$auth_settings_option_multisite = array();
3722	3118	if (
3723	3119	is_multisite() &&
3724		- ! is_network_admin() &&
3725		- 1 !== intval( $auth_override_multisite ) &&
	3120	+ $auth_override_multisite != '1' &&
3726	3121	array_key_exists( 'multisite_override', $auth_multisite_settings ) &&
3727		- '1' === $auth_multisite_settings['multisite_override']
	3122	+ $auth_multisite_settings['multisite_override'] === '1'
3728	3123	) {
3729		- $auth_settings_option_multisite = $this->get_plugin_option( $option, WP_Plugin_Authorizer::NETWORK_CONTEXT, 'allow override' );
	3124	+ $auth_settings_option_multisite = $this->get_plugin_option( $option, MULTISITE_ADMIN, 'allow override' );
3730	3125	$auth_settings_option_multisite = is_array( $auth_settings_option_multisite ) ? $auth_settings_option_multisite : array();
3731		- // Add multisite users to the beginning of the main user array.
3732		- foreach ( array_reverse( $auth_settings_option_multisite ) as $approved_user ) {
3733		- $approved_user['multisite_user'] = true;
3734		- array_unshift( $auth_settings_option, $approved_user );
3735		- }
3736	3126	}
3737	3127
3738	3128	// Get default role for new user dropdown.
3739		- $access_default_role = $this->get_plugin_option( 'access_default_role', WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
	3129	+ $access_default_role = $this->get_plugin_option( 'access_default_role', SINGLE_ADMIN, 'allow override' );
3740	3130
3741	3131	// Get custom usermeta field to show.
3742	3132	$advanced_usermeta = $this->get_plugin_option( 'advanced_usermeta' );
3743	3133
3744	3134	// Adjust javascript function prefixes if multisite.
3745		- $js_function_prefix = WP_Plugin_Authorizer::NETWORK_CONTEXT === $admin_mode ? 'authMultisite' : 'auth';
3746		- $is_multisite_admin_page = WP_Plugin_Authorizer::NETWORK_CONTEXT === $admin_mode;
	3135	+ $js_function_prefix = $admin_mode === MULTISITE_ADMIN ? 'auth_multisite_' : 'auth_';
	3136	+ $multisite_admin_page = $admin_mode === MULTISITE_ADMIN;
3747	3137
3748		- // Filter user list to search terms.
3749		- // phpcs:ignore WordPress.CSRF.NonceVerification.NoNonceVerification
3750		- if ( isset( $_REQUEST['search'] ) && strlen( sanitize_text_field( wp_unslash( $_REQUEST['search'] ) ) ) > 0 ) {
3751		- // phpcs:ignore WordPress.CSRF.NonceVerification.NoNonceVerification
3752		- $search_term = sanitize_text_field( wp_unslash( $_REQUEST['search'] ) );
3753		- $auth_settings_option = array_filter(
3754		- $auth_settings_option, function ( $user ) use ( $search_term ) {
3755		- return stripos( $user['email'], $search_term ) !== false ||
3756		- stripos( $user['role'], $search_term ) !== false ||
3757		- stripos( $user['date_added'], $search_term ) !== false;
3758		- }
3759		- );
3760		- }
3761		-
3762		- // Sort user list.
3763		- $sort_by = $this->get_plugin_option( 'advanced_users_sort_by', WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' ); // email, role, date_added (registered), created (date approved).
3764		- $sort_order = $this->get_plugin_option( 'advanced_users_sort_order', WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' ); // asc or desc.
3765		- $sort_dimension = array();
3766		- if ( in_array( $sort_by, array( 'email', 'role', 'date_added' ), true ) ) {
3767		- foreach ( $auth_settings_option as $key => $user ) {
3768		- if ( 'date_added' === $sort_by ) {
3769		- $sort_dimension[ $key ] = date( 'Ymd', strtotime( $user[ $sort_by ] ) );
3770		- } else {
3771		- $sort_dimension[ $key ] = strtolower( $user[ $sort_by ] );
3772		- }
3773		- }
3774		- $sort_order = 'asc' === $sort_order ? SORT_ASC : SORT_DESC;
3775		- array_multisort( $sort_dimension, $sort_order, $auth_settings_option );
3776		- } elseif ( 'created' === $sort_by && 'asc' !== $sort_order ) {
3777		- // If default sort method and reverse order, just reverse the array.
3778		- $auth_settings_option = array_reverse( $auth_settings_option );
3779		- }
3780		-
3781		- // Ensure array keys run from 0..max (keys in database will be the original,
3782		- // index, and removing users will not reorder the array keys of other users).
3783		- $auth_settings_option = array_values( $auth_settings_option );
3784		-
3785		- // Get pager params.
3786		- $total_users = count( $auth_settings_option );
3787		- $users_per_page = intval( $this->get_plugin_option( 'advanced_users_per_page', WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' ) );
3788		- // phpcs:ignore WordPress.CSRF.NonceVerification.NoNonceVerification
3789		- $current_page = isset( $_REQUEST['paged'] ) ? intval( $_REQUEST['paged'] ) : 1;
3790		- $total_pages = ceil( $total_users / $users_per_page );
3791		- if ( $total_pages < 1 ) {
3792		- $total_pages = 1;
3793		- }
3794		-
3795		- // Make sure current_page is between 1 and max pages.
3796		- if ( $current_page < 1 ) {
3797		- $current_page = 1;
3798		- } elseif ( $current_page > $total_pages ) {
3799		- $current_page = $total_pages;
3800		- }
3801		-
3802		- // Render wrapper div (for aligning pager to width of content).
3803		- ?>
3804		- <div class="wrapper_<?php echo esc_attr( $option ); ?>">
3805		- <?php $this->render_user_pager( $current_page, $users_per_page, $total_users, 'top' ); ?>
3806		- <ul id="list_auth_settings_access_users_approved" class="<?php echo strlen( $advanced_usermeta ) > 0 ? 'has-usermeta' : ''; ?>">
3807		- <?php
3808		- $offset = ( $current_page - 1 ) * $users_per_page;
3809		- $max = min( $offset + $users_per_page, count( $auth_settings_option ) );
3810		- for ( $key = $offset; $key < $max; $key++ ) :
3811		- $approved_user = $auth_settings_option[ $key ];
	3138	+ ?><ul id="list_auth_settings_access_users_approved" style="margin:0;">
	3139	+ <?php if ( ! $multisite_admin_page ) :
	3140	+ foreach ( $auth_settings_option_multisite as $key => $approved_user ) :
3812	3141	if ( empty( $approved_user ) || count( $approved_user ) < 1 ) :
3813	3142	continue;
3814	3143	endif;
3815		- $this->render_user_element( $approved_user, $key, $option, $admin_mode, $advanced_usermeta );
3816		- endfor;
3817		- ?>
3818		- </ul>
	3144	+ $approved_wp_user = get_user_by( 'email', $approved_user['email'] );
	3145	+ if ( $approved_wp_user ) :
	3146	+ $approved_user['email'] = $approved_wp_user->user_email;
	3147	+ $approved_user['role'] = $multisite_admin_page || count( $approved_wp_user->roles ) === 0 ? $approved_user['role'] : array_shift( $approved_wp_user->roles );
	3148	+ $approved_user['date_added'] = $approved_wp_user->user_registered;
	3149	+ // Get usermeta field from the WordPress user's real usermeta.
	3150	+ if ( strlen( $advanced_usermeta ) > 0 ) :
	3151	+ if ( strpos( $advanced_usermeta, 'acf___' ) === 0 && class_exists( 'acf' ) ) :
	3152	+ // Get ACF Field value for the user
	3153	+ $approved_user['usermeta'] = get_field( str_replace('acf___', '', $advanced_usermeta ), 'user_' . $approved_wp_user->ID );
	3154	+ else :
	3155	+ // Get regular usermeta value for the user.
	3156	+ $approved_user['usermeta'] = get_user_meta( $approved_wp_user->ID, $advanced_usermeta, true );
	3157	+ endif;
3819	3158
3820		- <div id="new_auth_settings_<?php echo esc_attr( $option ); ?>">
3821		- <textarea id="new_approved_user_email" placeholder="<?php esc_attr_e( 'email address', 'authorizer' ); ?>" class="auth-email new autogrow-short" rows="1"></textarea>
3822		- <select id="new_approved_user_role" class="auth-role">
3823		- <?php $this->wp_dropdown_permitted_roles( $access_default_role, 'not disabled', $admin_mode ); ?>
3824		- </select>
3825		- <div class="btn-group">
3826		- <a href="javascript:void(0);" class="btn button-primary dropdown-toggle button-add-user" id="approve_user_new" onclick="<?php echo esc_attr( $js_function_prefix ); ?>AddUser(this, 'approved' );"><span class="glyphicon glyphicon-ok"></span> <?php esc_html_e( 'Approve', 'authorizer' ); ?></a>
3827		- <button type="button" class="btn button-primary dropdown-toggle" data-toggle="dropdown">
3828		- <span class="caret"></span>
3829		- <span class="sr-only"><?php esc_html_e( 'Toggle Dropdown', 'authorizer' ); ?></span>
3830		- </button>
3831		- <ul class="dropdown-menu" role="menu">
3832		- <li><a href="javascript:void(0);" onclick="<?php echo esc_attr( $js_function_prefix ); ?>AddUser( document.getElementById( 'approve_user_new' ), 'approved', true);"><?php esc_html_e( 'Create a new WordPress account, and email the user an activation link.', 'authorizer' ); ?></a></li>
3833		- </ul>
3834		- </div>
3835		- </div>
3836		- <?php $this->render_user_pager( $current_page, $users_per_page, $total_users, 'bottom' ); ?>
3837		- </div>
3838		- <?php
3839		- }
	3159	+ if ( is_array( $approved_user['usermeta'] ) || is_object( $approved_user['usermeta'] ) ) :
	3160	+ $approved_user['usermeta'] = serialize( $approved_user['usermeta'] );
	3161	+ endif;
	3162	+ endif;
	3163	+ endif;
	3164	+ if ( ! array_key_exists( 'usermeta', $approved_user ) ) :
	3165	+ $approved_user['usermeta'] = '';
	3166	+ endif; ?>
	3167	+ <li>
	3168	+ <input type="text" id="auth_multisite_settings_<?php echo $option; ?>_<?php echo $key; ?>" value="<?php echo $approved_user['email']; ?>" readonly="true" class="auth-email auth-multisite-email" />
	3169	+ <select id="auth_multisite_settings_<?php echo $option; ?>_<?php echo $key; ?>_role" class="auth-role auth-multisite-role" disabled="disabled">
	3170	+ <?php $this->wp_dropdown_permitted_roles( $approved_user['role'] ); ?>
	3171	+ </select>
	3172	+ <input type="text" id="auth_multisite_settings_<?php echo $option; ?>_<?php echo $key; ?>_date_added" value="<?php echo date( 'M Y', strtotime( $approved_user['date_added'] ) ); ?>" readonly="true" class="auth-date-added auth-multisite-date-added" disabled="disabled" />
	3173	+ <?php if ( strlen( $advanced_usermeta ) > 0 ) :
	3174	+ $should_show_usermeta_in_text_field = true; // Fallback renderer for usermeta; try to use a select first.
	3175	+ if ( strpos( $advanced_usermeta, 'acf___' ) === 0 && class_exists( 'acf' ) ) :
	3176	+ $field_object = get_field_object( str_replace('acf___', '', $advanced_usermeta ) );
	3177	+ if ( is_array( $field_object ) && array_key_exists( 'type', $field_object ) && $field_object['type'] === 'select' ) :
	3178	+ $should_show_usermeta_in_text_field = false; ?>
	3179	+ <select id="auth_settings_<?php echo $option; ?>_<?php echo $key; ?>_usermeta" class="auth-usermeta auth-multisite-usermeta" onchange="<?php echo $js_function_prefix; ?>update_usermeta( this );">
	3180	+ <option value=""<?php if ( empty( $approved_user['usermeta'] ) ) echo ' selected="selected"'; ?>><?php _e( '-- None --', 'authorizer' ); ?></option>
	3181	+ <?php foreach ( $field_object['choices'] as $key => $label ) : ?>
	3182	+ <option value="<?php echo $key; ?>"<?php if ( $key === $approved_user['usermeta'] || ( is_array( $approved_user['usermeta'] ) && array_key_exists( get_current_blog_id(), $approved_user['usermeta'] ) && $key === $approved_user['usermeta'][get_current_blog_id()]['meta_value'] ) ) echo ' selected="selected"'; ?>><?php echo $label; ?></option>
	3183	+ <?php endforeach; ?>
	3184	+ </select>
	3185	+ <?php endif; ?>
	3186	+ <?php endif; ?>
	3187	+ <?php if ( $should_show_usermeta_in_text_field ) : ?>
	3188	+ <input type="text" id="auth_multisite_settings_<?php echo $option; ?>_<?php echo $key; ?>_usermeta" value="<?php echo htmlspecialchars( $approved_user['usermeta'], ENT_COMPAT ); ?>" class="auth-usermeta auth-multisite-usermeta" />
	3189	+ <a class="button button-small button-primary update-usermeta" id="update_usermeta_<?php echo $key; ?>" onclick="<?php echo $js_function_prefix; ?>update_usermeta( this );" title="Update usermeta"><span class="glyphicon glyphicon-floppy-saved"></span></a>
	3190	+ <?php endif; ?>
	3191	+ <?php endif; ?>
	3192	+ &nbsp;&nbsp;<a title="WordPress Multisite user" class="auth-multisite-user"><span class="glyphicon glyphicon-globe"></span></a>
	3193	+ </li>
	3194	+ <?php endforeach;
	3195	+ endif;
	3196	+ foreach ( $auth_settings_option as $key => $approved_user ):
	3197	+ $is_current_user = false;
	3198	+ $local_user_icon = array_key_exists( 'local_user', $approved_user ) && $approved_user['local_user'] === 'true' ? '&nbsp;<a title="Local WordPress user" class="auth-local-user"><span class="glyphicon glyphicon-user"></span></a>' : '';
	3199	+ if ( empty( $approved_user ) || count( $approved_user ) < 1 ) :
	3200	+ continue;
	3201	+ endif;
	3202	+ $approved_wp_user = get_user_by( 'email', $approved_user['email'] );
	3203	+ if ( $approved_wp_user ) :
	3204	+ $approved_user['email'] = $approved_wp_user->user_email;
	3205	+ $approved_user['role'] = $multisite_admin_page || count( $approved_wp_user->roles ) === 0 ? $approved_user['role'] : array_shift( $approved_wp_user->roles );
	3206	+ $approved_user['date_added'] = $approved_wp_user->user_registered;
	3207	+ $approved_user['is_wp_user'] = true;
	3208	+ $is_current_user = $approved_wp_user->ID === get_current_user_id();
	3209	+ // Get usermeta field from the WordPress user's real usermeta.
	3210	+ if ( strlen( $advanced_usermeta ) > 0 ) :
	3211	+ if ( strpos( $advanced_usermeta, 'acf___' ) === 0 && class_exists( 'acf' ) ) :
	3212	+ // Get ACF Field value for the user
	3213	+ $approved_user['usermeta'] = get_field( str_replace('acf___', '', $advanced_usermeta ), 'user_' . $approved_wp_user->ID );
	3214	+ else :
	3215	+ // Get regular usermeta value for the user.
	3216	+ $approved_user['usermeta'] = get_user_meta( $approved_wp_user->ID, $advanced_usermeta, true );
	3217	+ endif;
3840	3218
3841		-
3842		- /**
3843		- * Renders the html elements for the pager above and below the Approved User list.
3844		- *
3845		- * @param integer $current_page Which page we are currently viewing.
3846		- * @param integer $users_per_page How many users to show per page.
3847		- * @param integer $total_users Total count of users in list.
3848		- * @param string $which Where to render the pager ('top' or 'bottom').
3849		- * @return void
3850		- */
3851		- private function render_user_pager( $current_page = 1, $users_per_page = 20, $total_users = 0, $which = 'top' ) {
3852		- $total_pages = ceil( $total_users / $users_per_page );
3853		- if ( $total_pages < 1 ) {
3854		- $total_pages = 1;
3855		- }
3856		-
3857		- /* TRANSLATORS: %s: number of users */
3858		- $output = ' <span class="displaying-num">' . sprintf( _n( '%s user', '%s users', $total_users, 'authorizer' ), number_format_i18n( $total_users ) ) . '</span>';
3859		-
3860		- $disable_first = $current_page <= 1;
3861		- $disable_prev = $current_page <= 1;
3862		- $disable_next = $current_page >= $total_pages;
3863		- $disable_last = $current_page >= $total_pages;
3864		-
3865		- $current_url = '';
3866		- if ( isset( $_SERVER['HTTP_HOST'], $_SERVER['REQUEST_URI'] ) ) {
3867		- $current_url = set_url_scheme( esc_url_raw( wp_unslash( $_SERVER['HTTP_HOST'] ) ) . esc_url_raw( wp_unslash( $_SERVER['REQUEST_URI'] ) ) );
3868		- $current_url = remove_query_arg( wp_removable_query_args(), $current_url );
3869		- }
3870		-
3871		- $page_links = array();
3872		-
3873		- $total_pages_before = '<span class="paging-input">';
3874		- $total_pages_after = '</span></span>';
3875		-
3876		- if ( $disable_first ) {
3877		- $page_links[] = '<span class="button disabled first-page tablenav-pages-navspan" aria-hidden="true">&laquo;</span>';
3878		- } else {
3879		- $page_links[] = sprintf(
3880		- "<a class='button first-page' href='%s'><span class='screen-reader-text'>%s</span><span aria-hidden='true'>%s</span></a>",
3881		- esc_url( remove_query_arg( 'paged', $current_url ) ),
3882		- __( 'First page' ),
3883		- '&laquo;'
3884		- );
3885		- }
3886		-
3887		- if ( $disable_prev ) {
3888		- $page_links[] = '<span class="button disabled prev-page tablenav-pages-navspan" aria-hidden="true">&lsaquo;</span>';
3889		- } else {
3890		- $page_links[] = sprintf(
3891		- "<a class='button prev-page' href='%s'><span class='screen-reader-text'>%s</span><span aria-hidden='true'>%s</span></a>",
3892		- esc_url( add_query_arg( 'paged', max( 1, $current_page - 1 ), $current_url ) ),
3893		- __( 'Previous page' ),
3894		- '&lsaquo;'
3895		- );
3896		- }
3897		-
3898		- if ( 'bottom' === $which ) {
3899		- $html_current_page = '<span class="current-page-text">' . $current_page . '</span>';
3900		- $total_pages_before = '<span class="screen-reader-text">' . __( 'Current Page' ) . '</span><span id="table-paging" class="paging-input"><span class="tablenav-paging-text">';
3901		- } else {
3902		- $html_current_page = sprintf(
3903		- "%s<input class='current-page' id='current-page-selector' type='text' name='paged' value='%s' size='%d' aria-describedby='table-paging' /><span class='tablenav-paging-text'>",
3904		- '<label for="current-page-selector" class="screen-reader-text">' . __( 'Current Page' ) . '</label>',
3905		- $current_page,
3906		- strlen( $total_pages )
3907		- );
3908		- }
3909		- /* TRANSLATORS: %s: number of pages */
3910		- $html_total_pages = sprintf( "<span class='total-pages'>%s</span>", number_format_i18n( $total_pages ) );
3911		- /* TRANSLATORS: 1: number of current page 2: number of total pages */
3912		- $page_links[] = $total_pages_before . sprintf( _x( '%1$s of %2$s', 'paging' ), $html_current_page, $html_total_pages ) . $total_pages_after;
3913		-
3914		- if ( $disable_next ) {
3915		- $page_links[] = '<span class="button disabled next-page tablenav-pages-navspan" aria-hidden="true">&rsaquo;</span>';
3916		- } else {
3917		- $page_links[] = sprintf(
3918		- "<a class='button next-page' href='%s'><span class='screen-reader-text'>%s</span><span aria-hidden='true'>%s</span></a>",
3919		- esc_url( add_query_arg( 'paged', min( $total_pages, $current_page + 1 ), $current_url ) ),
3920		- __( 'Next page' ),
3921		- '&rsaquo;'
3922		- );
3923		- }
3924		-
3925		- if ( $disable_last ) {
3926		- $page_links[] = '<span class="button disabled last-page tablenav-pages-navspan" aria-hidden="true">&raquo;</span>';
3927		- } else {
3928		- $page_links[] = sprintf(
3929		- "<a class='button last-page' href='%s'><span class='screen-reader-text'>%s</span><span aria-hidden='true'>%s</span></a>",
3930		- esc_url( add_query_arg( 'paged', $total_pages, $current_url ) ),
3931		- __( 'Last page' ),
3932		- '&raquo;'
3933		- );
3934		- }
3935		-
3936		- $pagination_links_class = 'pagination-links';
3937		- $output .= "\n<span class='$pagination_links_class'>" . join( "\n", $page_links ) . '</span>';
3938		-
3939		- $search_form = array();
3940		- if ( 'top' === $which ) {
3941		- // phpcs:ignore WordPress.CSRF.NonceVerification.NoNonceVerification
3942		- $search_term = isset( $_REQUEST['search'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['search'] ) ) : '';
3943		- $search_form[] = '<div class="search-box">';
3944		- $search_form[] = '<label class="screen-reader-text" for="user-search-input">' . __( 'Search Users', 'authorizer' ) . '</label>';
3945		- $search_form[] = '<input type="search" size="14" id="user-search-input" name="search" value="' . $search_term . '">';
3946		- $search_form[] = '<input type="button" id="search-submit" class="button" value="' . __( 'Search', 'authorizer' ) . '">';
3947		- $search_form[] = '</div>';
3948		- }
3949		- $search_form = join( "\n", $search_form );
3950		-
3951		- $output = "<div class='tablenav-pages'>$output</div>";
3952		- ?>
3953		- <div class="tablenav top">
3954		- <?php echo wp_kses( $output, $this->allowed_html ); ?>
3955		- <?php echo wp_kses( $search_form, $this->allowed_html ); ?>
3956		- </div>
3957		- <?php
3958		- }
3959		-
3960		-
3961		- /**
3962		- * Renders the html <li> element for a given user in a list.
3963		- *
3964		- * @param array $approved_user User array to render.
3965		- * @param int $key Index of user in list of users.
3966		- * @param string $option List user is in (e.g., 'access_users_approved').
3967		- * @param string $admin_mode Current admin context.
3968		- * @param string $advanced_usermeta Usermeta field to display.
3969		- * @return void
3970		- */
3971		- private function render_user_element( $approved_user, $key, $option, $admin_mode, $advanced_usermeta ) {
3972		- $is_local_user = array_key_exists( 'local_user', $approved_user ) && 'true' === $approved_user['local_user'];
3973		- $is_multisite_user = array_key_exists( 'multisite_user', $approved_user ) && true === $approved_user['multisite_user'];
3974		- $option_prefix = $is_multisite_user ? 'auth_multisite_settings_' : 'auth_settings_';
3975		- $option_id = $option_prefix . $option . '_' . $key;
3976		- $approved_wp_user = get_user_by( 'email', $approved_user['email'] );
3977		- $is_current_user = $approved_wp_user && get_current_user_id() === $approved_wp_user->ID;
3978		-
3979		- // Adjust javascript function prefixes if multisite.
3980		- $js_function_prefix = WP_Plugin_Authorizer::NETWORK_CONTEXT === $admin_mode ? 'authMultisite' : 'auth';
3981		- $is_multisite_admin_page = WP_Plugin_Authorizer::NETWORK_CONTEXT === $admin_mode;
3982		-
3983		- if ( ! $approved_wp_user ) :
3984		- $approved_user['is_wp_user'] = false;
3985		- else :
3986		- $approved_user['is_wp_user'] = true;
3987		- $approved_user['email'] = $approved_wp_user->user_email;
3988		- $approved_user['role'] = $is_multisite_admin_page || count( $approved_wp_user->roles ) === 0 ? $approved_user['role'] : array_shift( $approved_wp_user->roles );
3989		- $approved_user['date_added'] = $approved_wp_user->user_registered;
3990		-
3991		- // Get usermeta field from the WordPress user's real usermeta.
3992		- if ( strlen( $advanced_usermeta ) > 0 ) :
3993		- if ( strpos( $advanced_usermeta, 'acf___' ) === 0 && class_exists( 'acf' ) ) :
3994		- // Get ACF Field value for the user.
3995		- $approved_user['usermeta'] = get_field( str_replace( 'acf___', '', $advanced_usermeta ), 'user_' . $approved_wp_user->ID );
	3219	+ if ( is_array( $approved_user['usermeta'] ) || is_object( $approved_user['usermeta'] ) ) :
	3220	+ $approved_user['usermeta'] = serialize( $approved_user['usermeta'] );
	3221	+ endif;
	3222	+ endif;
3996	3223	else :
3997		- // Get regular usermeta value for the user.
3998		- $approved_user['usermeta'] = get_user_meta( $approved_wp_user->ID, $advanced_usermeta, true );
	3224	+ $approved_user['is_wp_user'] = false;
3999	3225	endif;
4000		- if ( is_array( $approved_user['usermeta'] ) || is_object( $approved_user['usermeta'] ) ) :
4001		- $approved_user['usermeta'] = serialize( $approved_user['usermeta'] );
4002		- endif;
4003		- endif;
4004		- endif;
4005		- if ( ! array_key_exists( 'usermeta', $approved_user ) ) :
4006		- $approved_user['usermeta'] = '';
4007		- endif;
4008		- ?>
4009		- <li>
4010		- <input
4011		- type="text"
4012		- id="<?php echo esc_attr( $option_id ); ?>"
4013		- value="<?php echo esc_attr( $approved_user['email'] ); ?>"
4014		- readonly="true"
4015		- class="<?php echo esc_attr( $this->create_class_name( 'email', $is_multisite_user ) ); ?>"
4016		- />
4017		- <select
4018		- id="<?php echo esc_attr( $option_id ); ?>_role"
4019		- class="<?php echo esc_attr( $this->create_class_name( 'role', $is_multisite_user ) ); ?>"
4020		- onchange="<?php echo esc_attr( $js_function_prefix ); ?>ChangeRole( this );"
4021		- <?php if ( $is_multisite_user ) : ?>
4022		- disabled="disabled"
4023		- <?php endif; ?>
4024		- >
4025		- <?php $disable_input = $is_current_user ? 'disabled' : null; ?>
4026		- <?php $this->wp_dropdown_permitted_roles( $approved_user['role'], $disable_input, $admin_mode ); ?>
	3226	+ if ( ! array_key_exists( 'usermeta', $approved_user ) ) :
	3227	+ $approved_user['usermeta'] = '';
	3228	+ endif; ?>
	3229	+ <li>
	3230	+ <input type="text" id="auth_settings_<?php echo $option; ?>_<?php echo $key; ?>" value="<?php echo $approved_user['email']; ?>" readonly="true" class="auth-email" />
	3231	+ <select id="auth_settings_<?php echo $option; ?>_<?php echo $key; ?>_role" class="auth-role" onchange="<?php echo $js_function_prefix; ?>change_role( this );">
	3232	+ <?php $disable_input = $is_current_user ? 'disabled' : null; ?>
	3233	+ <?php $this->wp_dropdown_permitted_roles( $approved_user['role'], $disable_input, $admin_mode ); ?>
	3234	+ </select>
	3235	+ <input type="text" id="auth_settings_<?php echo $option; ?>_<?php echo $key; ?>_date_added" value="<?php echo date( 'M Y', strtotime( $approved_user['date_added'] ) ); ?>" readonly="true" class="auth-date-added" />
	3236	+ <?php if ( strlen( $advanced_usermeta ) > 0 ) :
	3237	+ $should_show_usermeta_in_text_field = true; // Fallback renderer for usermeta; try to use a select first.
	3238	+ if ( strpos( $advanced_usermeta, 'acf___' ) === 0 && class_exists( 'acf' ) ) :
	3239	+ $field_object = get_field_object( str_replace('acf___', '', $advanced_usermeta ) );
	3240	+ if ( is_array( $field_object ) && array_key_exists( 'type', $field_object ) && $field_object['type'] === 'select' ) :
	3241	+ $should_show_usermeta_in_text_field = false; ?>
	3242	+ <select id="auth_settings_<?php echo $option; ?>_<?php echo $key; ?>_usermeta" class="auth-usermeta" onchange="<?php echo $js_function_prefix; ?>update_usermeta( this );" >
	3243	+ <option value=""<?php if ( empty( $approved_user['usermeta'] ) ) echo ' selected="selected"'; ?>><?php _e( '-- None --', 'authorizer' ); ?></option>
	3244	+ <?php foreach ( $field_object['choices'] as $key => $label ) : ?>
	3245	+ <option value="<?php echo $key; ?>"<?php if ( $key === $approved_user['usermeta'] || ( is_array( $approved_user['usermeta'] ) && $key === $approved_user['usermeta']['meta_value'] ) ) echo ' selected="selected"'; ?>><?php echo $label; ?></option>
	3246	+ <?php endforeach; ?>
	3247	+ </select>
	3248	+ <?php endif; ?>
	3249	+ <?php endif; ?>
	3250	+ <?php if ( $should_show_usermeta_in_text_field ) : ?>
	3251	+ <input type="text" id="auth_settings_<?php echo $option; ?>_<?php echo $key; ?>_usermeta" value="<?php echo htmlspecialchars( $approved_user['usermeta'], ENT_COMPAT ); ?>" class="auth-usermeta" />
	3252	+ <a class="button button-small button-primary update-usermeta" id="update_usermeta_<?php echo $key; ?>" onclick="<?php echo $js_function_prefix; ?>update_usermeta( this );" title="Update usermeta"><span class="glyphicon glyphicon-floppy-saved"></span></a>
	3253	+ <?php endif; ?>
	3254	+ <?php endif; ?>
	3255	+ <?php if ( ! $is_current_user ): ?>
	3256	+ <?php if ( ! $multisite_admin_page ) : ?>
	3257	+ <a class="button" id="block_user_<?php echo $key; ?>" onclick="<?php echo $js_function_prefix; ?>add_user( this, 'blocked', false ); <?php echo $js_function_prefix; ?>ignore_user( this, 'approved' );" title="<?php _e( 'Block/Ban user', 'authorizer' ); ?>"><span class="glyphicon glyphicon-ban-circle"></span></a>
	3258	+ <?php endif; ?>
	3259	+ <a class="button" id="ignore_user_<?php echo $key; ?>" onclick="<?php echo $js_function_prefix; ?>ignore_user(this, 'approved' );" title="<?php _e( 'Remove user', 'authorizer' ); ?>"><span class="glyphicon glyphicon-remove"></span></a>
	3260	+ <?php endif; ?>
	3261	+ <?php echo $local_user_icon; ?>
	3262	+ </li>
	3263	+ <?php endforeach; ?>
	3264	+ </ul>
	3265	+ <div id="new_auth_settings_<?php echo $option; ?>">
	3266	+ <input type="text" id="new_approved_user_email" placeholder="<?php _e( 'email address', 'authorizer' ); ?>" class="auth-email new" />
	3267	+ <select id="new_approved_user_role" class="auth-role">
	3268	+ <?php $this->wp_dropdown_permitted_roles( $access_default_role, 'not disabled', $admin_mode ); ?>
4027	3269	</select>
4028		- <input
4029		- type="text"
4030		- id="<?php echo esc_attr( $option_id ); ?>_date_added"
4031		- value="<?php echo esc_attr( date( 'M Y', strtotime( $approved_user['date_added'] ) ) ); ?>"
4032		- readonly="true"
4033		- class="<?php echo esc_attr( $this->create_class_name( 'date-added', $is_multisite_user ) ); ?>"
4034		- />
4035		- <?php
4036		- if ( strlen( $advanced_usermeta ) > 0 ) :
4037		- $should_show_usermeta_in_text_field = true; // Fallback renderer for usermeta; try to use a select first.
4038		- if ( strpos( $advanced_usermeta, 'acf___' ) === 0 && class_exists( 'acf' ) ) :
4039		- $field_object = get_field_object( str_replace( 'acf___', '', $advanced_usermeta ) );
4040		- if ( is_array( $field_object ) && array_key_exists( 'type', $field_object ) && 'select' === $field_object['type'] ) :
4041		- $should_show_usermeta_in_text_field = false;
4042		- ?>
4043		- <select
4044		- id="<?php echo esc_attr( $option_id ); ?>_usermeta"
4045		- class="<?php echo esc_attr( $this->create_class_name( 'usermeta', $is_multisite_user ) ); ?>"
4046		- onchange="<?php echo esc_attr( $js_function_prefix ); ?>UpdateUsermeta( this );"
4047		- >
4048		- <option value=""<?php selected( empty( $approved_user['usermeta'] ) ); ?>><?php esc_html_e( '-- None --', 'authorizer' ); ?></option>
4049		- <?php foreach ( $field_object['choices'] as $key => $label ) : ?>
4050		- <option value="<?php echo esc_attr( $key ); ?>"<?php selected( $key === $approved_user['usermeta'] || ( isset( $approved_user['usermeta']['meta_value'] ) && $key === $approved_user['usermeta']['meta_value'] ) ); ?>><?php echo esc_html( $label ); ?></option>
4051		- <?php endforeach; ?>
4052		- </select>
4053		- <?php endif; ?>
4054		- <?php endif; ?>
4055		- <?php if ( $should_show_usermeta_in_text_field ) : ?>
4056		- <input
4057		- type="text"
4058		- id="<?php echo esc_attr( $option_id ); ?>_usermeta"
4059		- value="<?php echo esc_attr( $approved_user['usermeta'], ENT_COMPAT ); ?>"
4060		- class="<?php echo esc_attr( $this->create_class_name( 'usermeta', $is_multisite_user ) ); ?>"
4061		- />
4062		- <a class="button button-small button-primary update-usermeta" id="update_usermeta_<?php echo esc_attr( $key ); ?>" onclick="<?php echo esc_attr( $js_function_prefix ); ?>UpdateUsermeta( this );" title="Update usermeta"><span class="glyphicon glyphicon-floppy-saved"></span></a>
4063		- <?php endif; ?>
4064		- <?php endif; ?>
4065		- <?php if ( ! $is_current_user && ! $is_multisite_user ) : ?>
4066		- <?php if ( ! $is_multisite_admin_page ) : ?>
4067		- <a class="button" id="block_user_<?php echo esc_attr( $key ); ?>" onclick="<?php echo esc_attr( $js_function_prefix ); ?>AddUser( this, 'blocked', false ); <?php echo esc_attr( $js_function_prefix ); ?>IgnoreUser( this, 'approved' );" title="<?php esc_attr_e( 'Block/Ban user', 'authorizer' ); ?>"><span class="glyphicon glyphicon-ban-circle"></span></a>
4068		- <?php endif; ?>
4069		- <a class="button" id="ignore_user_<?php echo esc_attr( $key ); ?>" onclick="<?php echo esc_attr( $js_function_prefix ); ?>IgnoreUser(this, 'approved' );" title="<?php esc_attr_e( 'Remove user', 'authorizer' ); ?>"><span class="glyphicon glyphicon-remove"></span></a>
4070		- <?php endif; ?>
4071		- <?php if ( $is_local_user ) : ?>
4072		- &nbsp;<a title="Local WordPress user" class="auth-local-user"><span class="glyphicon glyphicon-user"></span></a>
4073		- <?php endif; ?>
4074		- <?php if ( $is_multisite_user ) : ?>
4075		- &nbsp;<a title="WordPress Multisite user" class="auth-multisite-user"><span class="glyphicon glyphicon-globe"></span></a>
4076		- <?php endif; ?>
4077		- </li>
	3270	+ <div class="btn-group">
	3271	+ <a href="javascript:void(0);" class="btn button-primary dropdown-toggle" id="approve_user_new" onclick="<?php echo $js_function_prefix; ?>add_user(this, 'approved' );"><span class="glyphicon glyphicon-ok"></span> <?php _e( 'Approve', 'authorizer' ); ?></a>
	3272	+ <button type="button" class="btn button-primary dropdown-toggle" data-toggle="dropdown">
	3273	+ <span class="caret"></span>
	3274	+ <span class="sr-only"><?php _e( 'Toggle Dropdown', 'authorizer' ); ?></span>
	3275	+ </button>
	3276	+ <ul class="dropdown-menu" role="menu">
	3277	+ <li><a href="javascript:void(0);" onclick="<?php echo $js_function_prefix; ?>add_user( document.getElementById('approve_user_new' ), 'approved', true);"><?php _e( 'Create a local WordPress <br />account instead, and email <br />the user their password.', 'authorizer' ); ?></a></li>
	3278	+ </ul>
	3279	+ </div>
	3280	+ </div>
4078	3281	<?php
4079	3282	}
4080	3283
4081	3284
4082		- /**
4083		- * Settings print callback.
4084		- *
4085		- * @param string $args Args (e.g., multisite admin mode).
4086		- * @return void
4087		- */
4088		- public function print_combo_auth_access_users_blocked( $args = '' ) {
	3285	+ function print_combo_auth_access_users_blocked( $args = '' ) {
4089	3286	// Get plugin option.
4090		- $option = 'access_users_blocked';
	3287	+ $option = 'access_users_blocked';
4091	3288	$auth_settings_option = $this->get_plugin_option( $option );
4092	3289	$auth_settings_option = is_array( $auth_settings_option ) ? $auth_settings_option : array();
4093	3290
4094	3291	// Get default role for new blocked user dropdown.
4095		- $access_default_role = $this->get_plugin_option( 'access_default_role', WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
	3292	+ $access_default_role = $this->get_plugin_option( 'access_default_role', SINGLE_ADMIN, 'allow override' );
4096	3293
4097		- // Render wrapper div (for aligning pager to width of content).
4098		- ?>
4099		- <div class="wrapper_<?php echo esc_attr( $option ); ?>">
4100		- <ul id="list_auth_settings_<?php echo esc_attr( $option ); ?>" style="margin:0;">
4101		- <?php
4102		- foreach ( $auth_settings_option as $key => $blocked_user ) :
4103		- if ( empty( $blocked_user ) || count( $blocked_user ) < 1 ) :
4104		- continue;
4105		- endif;
4106		- $blocked_wp_user = get_user_by( 'email', $blocked_user['email'] );
4107		- if ( $blocked_wp_user ) :
4108		- $blocked_user['email'] = $blocked_wp_user->user_email;
4109		- $blocked_user['role'] = array_shift( $blocked_wp_user->roles );
4110		- $blocked_user['date_added'] = $blocked_wp_user->user_registered;
4111		- $blocked_user['is_wp_user'] = true;
4112		- else :
4113		- $blocked_user['is_wp_user'] = false;
4114		- endif;
4115		- ?>
4116		- <li>
4117		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>_<?php echo esc_attr( $key ); ?>" value="<?php echo esc_attr( $blocked_user['email'] ); ?>" readonly="true" class="auth-email" />
4118		- <select id="auth_settings_<?php echo esc_attr( $option ); ?>_<?php echo esc_attr( $key ); ?>_role" class="auth-role">
4119		- <?php $this->wp_dropdown_permitted_roles( $blocked_user['role'] ); ?>
4120		- </select>
4121		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>_<?php echo esc_attr( $key ); ?>_date_added" value="<?php echo esc_attr( date( 'M Y', strtotime( $blocked_user['date_added'] ) ) ); ?>" readonly="true" class="auth-date-added" />
4122		- <a class="button" id="ignore_user_<?php echo esc_attr( $key ); ?>" onclick="authIgnoreUser( this, 'blocked' );" title="<?php esc_attr_e( 'Remove user', 'authorizer' ); ?>"><span class="glyphicon glyphicon-remove"></span></a>
4123		- </li>
4124		- <?php endforeach; ?>
4125		- </ul>
4126		- <div id="new_auth_settings_<?php echo esc_attr( $option ); ?>">
4127		- <input type="text" id="new_blocked_user_email" placeholder="<?php esc_attr_e( 'email address', 'authorizer' ); ?>" class="auth-email new" />
4128		- <select id="new_blocked_user_role" class="auth-role">
4129		- <option value="<?php echo esc_attr( $access_default_role ); ?>"><?php echo esc_html( ucfirst( $access_default_role ) ); ?></option>
4130		- </select>
4131		- <a href="javascript:void(0);" class="button-primary button-add-user" id="block_user_new" onclick="authAddUser( this, 'blocked' );"><span class="glyphicon glyphicon-ban-circle"></span> <?php esc_html_e( 'Block', 'authorizer' ); ?></a>
4132		- </div>
	3294	+ // Print option elements.
	3295	+ ?><ul id="list_auth_settings_<?php echo $option; ?>" style="margin:0;">
	3296	+ <?php foreach ( $auth_settings_option as $key => $blocked_user ): ?>
	3297	+ <?php if ( empty( $blocked_user ) || count( $blocked_user ) < 1 ) continue; ?>
	3298	+ <?php if ( $blocked_wp_user = get_user_by( 'email', $blocked_user['email'] ) ): ?>
	3299	+ <?php $blocked_user['email'] = $blocked_wp_user->user_email; ?>
	3300	+ <?php $blocked_user['role'] = array_shift( $blocked_wp_user->roles ); ?>
	3301	+ <?php $blocked_user['date_added'] = $blocked_wp_user->user_registered; ?>
	3302	+ <?php $blocked_user['is_wp_user'] = true; ?>
	3303	+ <?php else: ?>
	3304	+ <?php $blocked_user['is_wp_user'] = false; ?>
	3305	+ <?php endif; ?>
	3306	+ <li>
	3307	+ <input type="text" id="auth_settings_<?php echo $option; ?>_<?php echo $key; ?>" value="<?php echo $blocked_user['email']; ?>" readonly="true" class="auth-email" />
	3308	+ <select id="auth_settings_<?php echo $option; ?>_<?php echo $key; ?>_role" class="auth-role">
	3309	+ <?php $this->wp_dropdown_permitted_roles( $blocked_user['role'] ); ?>
	3310	+ </select>
	3311	+ <input type="text" id="auth_settings_<?php echo $option; ?>_<?php echo $key; ?>_date_added" value="<?php echo date( 'M Y', strtotime( $blocked_user['date_added'] ) ); ?>" readonly="true" class="auth-date-added" />
	3312	+ <a class="button" id="ignore_user_<?php echo $key; ?>" onclick="auth_ignore_user(this, 'blocked' );" title="<?php _e( 'Remove user', 'authorizer' ); ?>"><span class="glyphicon glyphicon-remove"></span></a>
	3313	+ </li>
	3314	+ <?php endforeach; ?>
	3315	+ </ul>
	3316	+ <div id="new_auth_settings_<?php echo $option; ?>">
	3317	+ <input type="text" id="new_blocked_user_email" placeholder="<?php _e( 'email address', 'authorizer' ); ?>" class="auth-email new" />
	3318	+ <select id="new_blocked_user_role" class="auth-role">
	3319	+ <option value="<?php echo $access_default_role; ?>"><?php echo ucfirst( $access_default_role ); ?></option>
	3320	+ </select>
	3321	+ <a href="javascript:void(0);" class="button-primary" id="block_user_new" onclick="auth_add_user(this, 'blocked' );"><span class="glyphicon glyphicon-ban-circle"></span> <?php _e( 'Block', 'authorizer' ); ?></a>
4133	3322	</div>
4134	3323	<?php
4135	3324	}
4136	3325
4137	3326
4138		- /**
4139		- * Settings print callback.
4140		- *
4141		- * @param string $args Args (e.g., multisite admin mode).
4142		- * @return void
4143		- */
4144		- public function print_section_info_access_login( $args = '' ) {
4145		- ?>
4146		- <div id="section_info_access_login" class="section_info">
	3327	+ function print_section_info_access_login( $args = '' ) {
	3328	+ ?><div id="section_info_access_login" class="section_info">
4147	3329	<?php wp_nonce_field( 'save_auth_settings', 'nonce_save_auth_settings' ); ?>
4148		- <p><?php esc_html_e( 'Choose who is able to log into this site below.', 'authorizer' ); ?></p>
4149		- </div>
4150		- <?php
	3330	+ <p><?php _e( 'Choose who is able to log into this site below.', 'authorizer' ); ?></p>
	3331	+ </div><?php
4151	3332	}
4152	3333
4153	3334
4154		- /**
4155		- * Settings print callback.
4156		- *
4157		- * @param string $args Args (e.g., multisite admin mode).
4158		- * @return void
4159		- */
4160		- public function print_radio_auth_access_who_can_login( $args = '' ) {
	3335	+ function print_radio_auth_access_who_can_login( $args = '' ) {
4161	3336	// Get plugin option.
4162		- $option = 'access_who_can_login';
4163		- $admin_mode = $this->get_admin_mode( $args );
	3337	+ $option = 'access_who_can_login';
	3338	+ $admin_mode = $this->get_admin_mode( $args );
4164	3339	$auth_settings_option = $this->get_plugin_option( $option, $admin_mode, 'allow override', 'print overlay' );
4165	3340
4166	3341	// If this site is configured independently of any multisite overrides, make sure we are not grabbing the multisite value; otherwise, grab the multisite value to show behind the disabled overlay.
4167		- if ( is_multisite() && 1 === intval( $this->get_plugin_option( 'advanced_override_multisite' ) ) ) {
	3342	+ if ( is_multisite() && $this->get_plugin_option( 'advanced_override_multisite' ) == '1' ) {
4168	3343	$auth_settings_option = $this->get_plugin_option( $option );
4169		- } elseif ( is_multisite() && WP_Plugin_Authorizer::SINGLE_CONTEXT === $admin_mode && $this->get_plugin_option( 'multisite_override', WP_Plugin_Authorizer::NETWORK_CONTEXT ) === '1' ) {
	3344	+ } elseif ( is_multisite() && $admin_mode === SINGLE_ADMIN && $this->get_plugin_option( 'multisite_override', MULTISITE_ADMIN ) === '1' ) {
4170	3345	// Workaround: javascript code hides/shows other settings based
4171	3346	// on the selection in this option. If this option is overridden
4172	3347	// by a multisite option, it should show that value in order to
4173	3348	// correctly display the other appropriate options.
		@@ -4173,49 +3348,33 @@
4173	3348	// correctly display the other appropriate options.
4174	3349	// Side effect: this site option will be overwritten by the
4175	3350	// multisite option on save. Since this is a 2-item radio, we
4176	3351	// determined this was acceptable.
4177		- $auth_settings_option = $this->get_plugin_option( $option, WP_Plugin_Authorizer::NETWORK_CONTEXT );
	3352	+ $auth_settings_option = $this->get_plugin_option( $option, MULTISITE_ADMIN );
4178	3353	}
4179	3354
4180	3355	// Print option elements.
4181		- ?>
4182		- <input type="radio" id="radio_auth_settings_<?php echo esc_attr( $option ); ?>_external_users" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="external_users"<?php checked( 'external_users' === $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo esc_attr( $option ); ?>_external_users"><?php esc_html_e( 'All authenticated users (All external service users and all WordPress users)', 'authorizer' ); ?></label><br />
4183		- <input type="radio" id="radio_auth_settings_<?php echo esc_attr( $option ); ?>_approved_users" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="approved_users"<?php checked( 'approved_users' === $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo esc_attr( $option ); ?>_approved_users"><?php esc_html_e( 'Only', 'authorizer' ); ?> <a href="javascript:chooseTab('access_lists' );" id="dashboard_link_approved_users"><?php esc_html_e( 'approved users', 'authorizer' ); ?></a> <?php esc_html_e( '(Approved external users and all WordPress users)', 'authorizer' ); ?></label><br />
4184		- <?php
	3356	+ ?><input type="radio" id="radio_auth_settings_<?php echo $option; ?>_external_users" name="auth_settings[<?php echo $option; ?>]" value="external_users"<?php checked( 'external_users' == $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo $option; ?>_external_users"><?php _e( 'All authenticated users (All external service users and all WordPress users)', 'authorizer' ); ?></label><br />
	3357	+ <input type="radio" id="radio_auth_settings_<?php echo $option; ?>_approved_users" name="auth_settings[<?php echo $option; ?>]" value="approved_users"<?php checked( 'approved_users' == $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo $option; ?>_approved_users"><?php _e( 'Only', 'authorizer' ); ?> <a href="javascript:choose_tab('access_lists' );" id="dashboard_link_approved_users"><?php _e( 'approved users', 'authorizer' ); ?></a> <?php _e( '(Approved external users and all WordPress users)', 'authorizer' ); ?></label><br /><?php
4185	3358	}
4186	3359
4187	3360
4188		- /**
4189		- * Settings print callback.
4190		- *
4191		- * @param string $args Args (e.g., multisite admin mode).
4192		- * @return void
4193		- */
4194		- public function print_select_auth_access_role_receive_pending_emails( $args = '' ) {
	3361	+ function print_select_auth_access_role_receive_pending_emails( $args = '' ) {
4195	3362	// Get plugin option.
4196		- $option = 'access_role_receive_pending_emails';
	3363	+ $option = 'access_role_receive_pending_emails';
4197	3364	$auth_settings_option = $this->get_plugin_option( $option );
4198	3365
4199	3366	// Print option elements.
4200		- ?>
4201		- <select id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]">
4202		- <option value="---" <?php selected( $auth_settings_option, '---' ); ?>><?php esc_html_e( "None (Don't send notification emails)", 'authorizer' ); ?></option>
	3367	+ ?><select id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]">
	3368	+ <option value="---" <?php selected( $auth_settings_option, '---' ); ?>><?php _e( "None (Don't send notification emails)", 'authorizer' ); ?></option>
4203	3369	<?php wp_dropdown_roles( $auth_settings_option ); ?>
4204		- </select>
4205		- <?php
	3370	+ </select><?php
4206	3371	}
4207	3372
4208	3373
4209		- /**
4210		- * Settings print callback.
4211		- *
4212		- * @param string $args Args (e.g., multisite admin mode).
4213		- * @return void
4214		- */
4215		- public function print_wysiwyg_auth_access_pending_redirect_to_message( $args = '' ) {
	3374	+ function print_wysiwyg_auth_access_pending_redirect_to_message( $args = '' ) {
4216	3375	// Get plugin option.
4217		- $option = 'access_pending_redirect_to_message';
	3376	+ $option = 'access_pending_redirect_to_message';
4218	3377	$auth_settings_option = $this->get_plugin_option( $option );
4219	3378
4220	3379	// Print option elements.
4221	3380	wp_editor(
		@@ -4224,25 +3383,19 @@
4224	3383	array(
4225	3384	'media_buttons' => false,
4226	3385	'textarea_name' => "auth_settings[$option]",
4227	3386	'textarea_rows' => 5,
4228		- 'tinymce' => true,
4229		- 'teeny' => true,
4230		- 'quicktags' => false,
	3387	+ 'tinymce' => true,
	3388	+ 'teeny' => true,
	3389	+ 'quicktags' => false,
4231	3390	)
4232	3391	);
4233	3392	}
4234	3393
4235	3394
4236		- /**
4237		- * Settings print callback.
4238		- *
4239		- * @param string $args Args (e.g., multisite admin mode).
4240		- * @return void
4241		- */
4242		- public function print_wysiwyg_auth_access_blocked_redirect_to_message( $args = '' ) {
	3395	+ function print_wysiwyg_auth_access_blocked_redirect_to_message( $args = '' ) {
4243	3396	// Get plugin option.
4244		- $option = 'access_blocked_redirect_to_message';
	3397	+ $option = 'access_blocked_redirect_to_message';
4245	3398	$auth_settings_option = $this->get_plugin_option( $option );
4246	3399
4247	3400	// Print option elements.
4248	3401	wp_editor(
		@@ -4251,61 +3404,39 @@
4251	3404	array(
4252	3405	'media_buttons' => false,
4253	3406	'textarea_name' => "auth_settings[$option]",
4254	3407	'textarea_rows' => 5,
4255		- 'tinymce' => true,
4256		- 'teeny' => true,
4257		- 'quicktags' => false,
	3408	+ 'tinymce' => true,
	3409	+ 'teeny' => true,
	3410	+ 'quicktags' => false,
4258	3411	)
4259	3412	);
4260	3413	}
4261	3414
4262	3415
4263		- /**
4264		- * Settings print callback.
4265		- *
4266		- * @param string $args Args (e.g., multisite admin mode).
4267		- * @return void
4268		- */
4269		- public function print_checkbox_auth_access_should_email_approved_users( $args = '' ) {
	3416	+ function print_checkbox_auth_access_should_email_approved_users( $args = '' ) {
4270	3417	// Get plugin option.
4271		- $option = 'access_should_email_approved_users';
	3418	+ $option = 'access_should_email_approved_users';
4272	3419	$auth_settings_option = $this->get_plugin_option( $option );
4273	3420
4274	3421	// Print option elements.
4275		- ?>
4276		- <input type="checkbox" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="1"<?php checked( 1 === intval( $auth_settings_option ) ); ?> /><label for="auth_settings_<?php echo esc_attr( $option ); ?>"><?php esc_html_e( 'Send a welcome email when approving a new user', 'authorizer' ); ?></label>
4277		- <?php
	3422	+ ?><input type="checkbox" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="1"<?php checked( 1 == $auth_settings_option ); ?> /><label for="auth_settings_<?php echo $option; ?>"><?php _e( 'Send a welcome email when approving a new user', 'authorizer' ); ?></label><?php
4278	3423	}
4279	3424
4280	3425
4281		- /**
4282		- * Settings print callback.
4283		- *
4284		- * @param string $args Args (e.g., multisite admin mode).
4285		- * @return void
4286		- */
4287		- public function print_text_auth_access_email_approved_users_subject( $args = '' ) {
	3426	+ function print_text_auth_access_email_approved_users_subject( $args = '' ) {
4288	3427	// Get plugin option.
4289		- $option = 'access_email_approved_users_subject';
	3428	+ $option = 'access_email_approved_users_subject';
4290	3429	$auth_settings_option = $this->get_plugin_option( $option );
4291	3430
4292	3431	// Print option elements.
4293		- ?>
4294		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="Welcome to [site_name]!" style="width:320px;" /><br /><small><?php echo wp_kses( __( 'You can use the <b>[site_name]</b> shortcode.', 'authorizer' ), $this->allowed_html ); ?></small>
4295		- <?php
	3432	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="Welcome to [site_name]!" style="width:320px;" /><br /><small><?php _e( 'You can use the <b>[site_name]</b> shortcode.', 'authorizer' ); ?></small><?php
4296	3433	}
4297	3434
4298	3435
4299		- /**
4300		- * Settings print callback.
4301		- *
4302		- * @param string $args Args (e.g., multisite admin mode).
4303		- * @return void
4304		- */
4305		- public function print_wysiwyg_auth_access_email_approved_users_body( $args = '' ) {
	3436	+ function print_wysiwyg_auth_access_email_approved_users_body( $args = '' ) {
4306	3437	// Get plugin option.
4307		- $option = 'access_email_approved_users_body';
	3438	+ $option = 'access_email_approved_users_body';
4308	3439	$auth_settings_option = $this->get_plugin_option( $option );
4309	3440
4310	3441	// Print option elements.
4311	3442	wp_editor(
		@@ -4314,60 +3445,42 @@
4314	3445	array(
4315	3446	'media_buttons' => false,
4316	3447	'textarea_name' => "auth_settings[$option]",
4317	3448	'textarea_rows' => 9,
4318		- 'tinymce' => true,
4319		- 'teeny' => true,
4320		- 'quicktags' => false,
	3449	+ 'tinymce' => true,
	3450	+ 'teeny' => true,
	3451	+ 'quicktags' => false,
4321	3452	)
4322	3453	);
4323		- ?>
4324		- <small>
4325		- <?php
4326		- printf(
4327		- /* TRANSLATORS: 1: Shortcode for site name 2: Shortcode for site URL 3: Shortcode for user email */
4328		- wp_kses( __( 'You can use %1$s, %2$s, and %3$s shortcodes.', 'authorizer' ), $this->allowed_html ),
4329		- '<b>[site_name]</b>',
4330		- '<b>[site_url]</b>',
4331		- '<b>[user_email]</b>'
4332		- );
4333		- ?>
4334		- </small>
4335		- <?php
	3454	+
	3455	+ ?><small><?php printf(
	3456	+ /* TRANSLATORS: 1: Shortcode for site name 2: Shortcode for site URL 3: Shortcode for user email */
	3457	+ __( 'You can use %1$s, %2$s, and %3$s shortcodes.', 'authorizer' ),
	3458	+ '<b>[site_name]</b>',
	3459	+ '<b>[site_url]</b>',
	3460	+ '<b>[user_email]</b>'
	3461	+ ); ?></small><?php
	3462	+
4336	3463	}
4337	3464
4338	3465
4339		- /**
4340		- * Settings print callback.
4341		- *
4342		- * @param string $args Args (e.g., multisite admin mode).
4343		- * @return void
4344		- */
4345		- public function print_section_info_access_public( $args = '' ) {
4346		- ?>
4347		- <div id="section_info_access_public" class="section_info">
4348		- <p><?php esc_html_e( 'Choose your public access options here.', 'authorizer' ); ?></p>
4349		- </div>
4350		- <?php
	3466	+ function print_section_info_access_public( $args = '' ) {
	3467	+ ?><div id="section_info_access_public" class="section_info">
	3468	+ <p><?php _e( 'Choose your public access options here.', 'authorizer' ); ?></p>
	3469	+ </div><?php
4351	3470	}
4352	3471
4353	3472
4354		- /**
4355		- * Settings print callback.
4356		- *
4357		- * @param string $args Args (e.g., multisite admin mode).
4358		- * @return void
4359		- */
4360		- public function print_radio_auth_access_who_can_view( $args = '' ) {
	3473	+ function print_radio_auth_access_who_can_view( $args = '' ) {
4361	3474	// Get plugin option.
4362		- $option = 'access_who_can_view';
4363		- $admin_mode = $this->get_admin_mode( $args );
	3475	+ $option = 'access_who_can_view';
	3476	+ $admin_mode = $this->get_admin_mode( $args );
4364	3477	$auth_settings_option = $this->get_plugin_option( $option, $admin_mode, 'allow override', 'print overlay' );
4365	3478
4366	3479	// If this site is configured independently of any multisite overrides, make sure we are not grabbing the multisite value; otherwise, grab the multisite value to show behind the disabled overlay.
4367		- if ( is_multisite() && 1 === intval( $this->get_plugin_option( 'advanced_override_multisite' ) ) ) {
	3480	+ if ( is_multisite() && $this->get_plugin_option( 'advanced_override_multisite' ) == '1' ) {
4368	3481	$auth_settings_option = $this->get_plugin_option( $option );
4369		- } elseif ( is_multisite() && WP_Plugin_Authorizer::SINGLE_CONTEXT === $admin_mode && '1' === $this->get_plugin_option( 'multisite_override', WP_Plugin_Authorizer::NETWORK_CONTEXT ) ) {
	3482	+ } elseif ( is_multisite() && $admin_mode === SINGLE_ADMIN && $this->get_plugin_option( 'multisite_override', MULTISITE_ADMIN ) === '1' ) {
4370	3483	// Workaround: javascript code hides/shows other settings based
4371	3484	// on the selection in this option. If this option is overridden
4372	3485	// by a multisite option, it should show that value in order to
4373	3486	// correctly display the other appropriate options.
		@@ -4373,66 +3486,42 @@
4373	3486	// correctly display the other appropriate options.
4374	3487	// Side effect: this site option will be overwritten by the
4375	3488	// multisite option on save. Since this is a 2-item radio, we
4376	3489	// determined this was acceptable.
4377		- $auth_settings_option = $this->get_plugin_option( $option, WP_Plugin_Authorizer::NETWORK_CONTEXT );
	3490	+ $auth_settings_option = $this->get_plugin_option( $option, MULTISITE_ADMIN );
4378	3491	}
4379	3492
4380	3493	// Print option elements.
4381		- ?>
4382		- <input type="radio" id="radio_auth_settings_<?php echo esc_attr( $option ); ?>_everyone" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="everyone"<?php checked( 'everyone' === $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo esc_attr( $option ); ?>_everyone"><?php esc_html_e( 'Everyone can see the site', 'authorizer' ); ?></label><br />
4383		- <input type="radio" id="radio_auth_settings_<?php echo esc_attr( $option ); ?>_logged_in_users" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="logged_in_users"<?php checked( 'logged_in_users' === $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo esc_attr( $option ); ?>_logged_in_users"><?php esc_html_e( 'Only logged in users can see the site', 'authorizer' ); ?></label><br />
4384		- <?php
	3494	+ ?><input type="radio" id="radio_auth_settings_<?php echo $option; ?>_everyone" name="auth_settings[<?php echo $option; ?>]" value="everyone"<?php checked( 'everyone' == $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo $option; ?>_everyone"><?php _e( 'Everyone can see the site', 'authorizer' ); ?></label><br />
	3495	+ <input type="radio" id="radio_auth_settings_<?php echo $option; ?>_logged_in_users" name="auth_settings[<?php echo $option; ?>]" value="logged_in_users"<?php checked( 'logged_in_users' == $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo $option; ?>_logged_in_users"><?php _e( 'Only logged in users can see the site', 'authorizer' ); ?></label><br /><?php
4385	3496	}
4386	3497
4387	3498
4388		- /**
4389		- * Settings print callback.
4390		- *
4391		- * @param string $args Args (e.g., multisite admin mode).
4392		- * @return void
4393		- */
4394		- public function print_radio_auth_access_redirect( $args = '' ) {
	3499	+ function print_radio_auth_access_redirect( $args = '' ) {
4395	3500	// Get plugin option.
4396		- $option = 'access_redirect';
	3501	+ $option = 'access_redirect';
4397	3502	$auth_settings_option = $this->get_plugin_option( $option );
4398	3503
4399	3504	// Print option elements.
4400		- ?>
4401		- <input type="radio" id="radio_auth_settings_<?php echo esc_attr( $option ); ?>_to_login" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="login"<?php checked( 'login' === $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo esc_attr( $option ); ?>_to_login"><?php esc_html_e( 'Send them to the login screen', 'authorizer' ); ?></label><br />
4402		- <input type="radio" id="radio_auth_settings_<?php echo esc_attr( $option ); ?>_to_message" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="message"<?php checked( 'message' === $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo esc_attr( $option ); ?>_to_message"><?php esc_html_e( 'Show them the anonymous access message (below)', 'authorizer' ); ?></label>
4403		- <?php
	3505	+ ?><input type="radio" id="radio_auth_settings_<?php echo $option; ?>_to_login" name="auth_settings[<?php echo $option; ?>]" value="login"<?php checked( 'login' == $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo $option; ?>_to_login"><?php _e( 'Send them to the login screen', 'authorizer' ); ?></label><br />
	3506	+ <input type="radio" id="radio_auth_settings_<?php echo $option; ?>_to_message" name="auth_settings[<?php echo $option; ?>]" value="message"<?php checked( 'message' == $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo $option; ?>_to_message"><?php _e( 'Show them the anonymous access message (below)', 'authorizer' ); ?></label><?php
4404	3507	}
4405	3508
4406	3509
4407		- /**
4408		- * Settings print callback.
4409		- *
4410		- * @param string $args Args (e.g., multisite admin mode).
4411		- * @return void
4412		- */
4413		- public function print_radio_auth_access_public_warning( $args = '' ) {
	3510	+ function print_radio_auth_access_public_warning( $args = '' ) {
4414	3511	// Get plugin option.
4415		- $option = 'access_public_warning';
	3512	+ $option = 'access_public_warning';
4416	3513	$auth_settings_option = $this->get_plugin_option( $option );
4417	3514
4418	3515	// Print option elements.
4419		- ?>
4420		- <input type="radio" id="radio_auth_settings_<?php echo esc_attr( $option ); ?>_no" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="no_warning"<?php checked( 'no_warning' === $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo esc_attr( $option ); ?>_no"><?php echo wp_kses( __( 'Show them the page <strong>without</strong> the anonymous access message', 'authorizer' ), $this->allowed_html ); ?></label><br />
4421		- <input type="radio" id="radio_auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="warning"<?php checked( 'warning' === $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo esc_attr( $option ); ?>"><?php echo wp_kses( __( 'Show them the page <strong>with</strong> the anonymous access message (marked up as a <a href="http://getbootstrap.com/components/#alerts-dismissible" target="_blank">Bootstrap Dismissible Alert</a>)', 'authorizer' ), $this->allowed_html ); ?></label>
4422		- <?php
	3516	+ ?><input type="radio" id="radio_auth_settings_<?php echo $option; ?>_no" name="auth_settings[<?php echo $option; ?>]" value="no_warning"<?php checked( 'no_warning' == $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo $option; ?>_no"><?php _e( 'Show them the page <strong>without</strong> the anonymous access message', 'authorizer' ); ?></label><br />
	3517	+ <input type="radio" id="radio_auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="warning"<?php checked( 'warning' == $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo $option; ?>"><?php _e( 'Show them the page <strong>with</strong> the anonymous access message (marked up as a <a href="http://getbootstrap.com/components/#alerts-dismissible" target="_blank">Bootstrap Dismissible Alert</a>)', 'authorizer' ); ?></label><?php
4423	3518	}
4424	3519
4425	3520
4426		- /**
4427		- * Settings print callback.
4428		- *
4429		- * @param string $args Args (e.g., multisite admin mode).
4430		- * @return void
4431		- */
4432		- public function print_wysiwyg_auth_access_redirect_to_message( $args = '' ) {
	3521	+ function print_wysiwyg_auth_access_redirect_to_message( $args = '' ) {
4433	3522	// Get plugin option.
4434		- $option = 'access_redirect_to_message';
	3523	+ $option = 'access_redirect_to_message';
4435	3524	$auth_settings_option = $this->get_plugin_option( $option );
4436	3525
4437	3526	// Print option elements.
4438	3527	wp_editor(
		@@ -4441,25 +3530,19 @@
4441	3530	array(
4442	3531	'media_buttons' => false,
4443	3532	'textarea_name' => "auth_settings[$option]",
4444	3533	'textarea_rows' => 5,
4445		- 'tinymce' => true,
4446		- 'teeny' => true,
4447		- 'quicktags' => false,
	3534	+ 'tinymce' => true,
	3535	+ 'teeny' => true,
	3536	+ 'quicktags' => false,
4448	3537	)
4449	3538	);
4450	3539	}
4451	3540
4452	3541
4453		- /**
4454		- * Settings print callback.
4455		- *
4456		- * @param string $args Args (e.g., multisite admin mode).
4457		- * @return void
4458		- */
4459		- public function print_multiselect_auth_access_public_pages( $args = '' ) {
	3542	+ function print_multiselect_auth_access_public_pages( $args = '' ) {
4460	3543	// Get plugin option.
4461		- $option = 'access_public_pages';
	3544	+ $option = 'access_public_pages';
4462	3545	$auth_settings_option = $this->get_plugin_option( $option );
4463	3546	$auth_settings_option = is_array( $auth_settings_option ) ? $auth_settings_option : array();
4464	3547
4465	3548	$post_types = array_merge( array( 'page', 'post' ), get_post_types( array( '_builtin' => false ), 'names' ) );
		@@ -4465,188 +3548,120 @@
4465	3548	$post_types = array_merge( array( 'page', 'post' ), get_post_types( array( '_builtin' => false ), 'names' ) );
4466	3549	$post_types = is_array( $post_types ) ? $post_types : array();
4467	3550
4468	3551	// Print option elements.
4469		- ?>
4470		- <select id="auth_settings_<?php echo esc_attr( $option ); ?>" multiple="multiple" name="auth_settings[<?php echo esc_attr( $option ); ?>][]">
4471		- <optgroup label="<?php esc_attr_e( 'Home', 'authorizer' ); ?>">
4472		- <option value="home" <?php selected( in_array( 'home', $auth_settings_option, true ) ); ?>><?php esc_html_e( 'Home Page', 'authorizer' ); ?></option>
4473		- <option value="auth_public_404" <?php selected( in_array( 'auth_public_404', $auth_settings_option, true ) ); ?>><?php esc_html_e( 'Nonexistent (404) Pages', 'authorizer' ); ?></option>
	3552	+ ?><select id="auth_settings_<?php echo $option; ?>" multiple="multiple" name="auth_settings[<?php echo $option; ?>][]">
	3553	+ <optgroup label="<?php _e( 'Home', 'authorizer' ); ?>">
	3554	+ <option value="home" <?php echo in_array( 'home', $auth_settings_option ) ? 'selected="selected"' : ''; ?>><?php _e( 'Home Page', 'authorizer' ); ?></option>
	3555	+ <option value="auth_public_404" <?php echo in_array( 'auth_public_404', $auth_settings_option ) ? 'selected="selected"' : ''; ?>><?php _e( 'Nonexistent (404) Pages', 'authorizer' ); ?></option>
4474	3556	</optgroup>
4475		- <?php foreach ( $post_types as $post_type ) : ?>
4476		- <optgroup label="<?php echo esc_attr( ucfirst( $post_type ) ); ?>">
4477		- <?php
4478		- $pages = get_posts(
4479		- array(
4480		- 'post_type' => $post_type,
4481		- 'posts_per_page' => 1000, // phpcs:ignore WordPress.VIP.PostsPerPage.posts_per_page_posts_per_page
4482		- )
4483		- );
4484		- $pages = is_array( $pages ) ? $pages : array();
4485		- foreach ( $pages as $page ) :
4486		- ?>
4487		- <option value="<?php echo esc_attr( $page->ID ); ?>" <?php selected( in_array( strval( $page->ID ), $auth_settings_option, true ) ); ?>><?php echo esc_html( $page->post_title ); ?></option>
	3557	+ <?php foreach ( $post_types as $post_type ): ?>
	3558	+ <optgroup label="<?php echo ucfirst( $post_type ); ?>">
	3559	+ <?php $pages = get_posts( array( 'post_type' => $post_type, 'posts_per_page' => -1 ) ); ?>
	3560	+ <?php $pages = is_array( $pages ) ? $pages : array(); ?>
	3561	+ <?php foreach ( $pages as $page ): ?>
	3562	+ <option value="<?php echo $page->ID; ?>" <?php echo in_array( $page->ID, $auth_settings_option ) ? 'selected="selected"' : ''; ?>><?php echo $page->post_title; ?></option>
4488	3563	<?php endforeach; ?>
4489	3564	</optgroup>
4490	3565	<?php endforeach; ?>
4491		- <optgroup label="<?php esc_attr_e( 'Categories', 'authorizer' ); ?>">
4492		- <?php
4493		- // If sitepress-multilingual-cms plugin is enabled, temporarily disable
4494		- // its terms_clauses filter since it conflicts with the category handling.
4495		- if ( array_key_exists( 'sitepress', $GLOBALS ) && is_object( $GLOBALS['sitepress'] ) ) {
4496		- remove_filter( 'terms_clauses', array( $GLOBALS['sitepress'], 'terms_clauses' ) );
4497		- $categories = get_categories( array( 'hide_empty' => false ) );
4498		- add_filter( 'terms_clauses', array( $GLOBALS['sitepress'], 'terms_clauses' ) );
4499		- } else {
4500		- $categories = get_categories( array( 'hide_empty' => false ) );
4501		- }
4502		- foreach ( $categories as $category ) :
4503		- ?>
4504		- <option value="<?php echo esc_attr( 'cat_' . $category->slug ); ?>" <?php selected( in_array( 'cat_' . $category->slug, $auth_settings_option, true ) ); ?>><?php echo esc_html( $category->name ); ?></option>
	3566	+ <optgroup label="<?php _e( 'Categories', 'authorizer' ); ?>">
	3567	+ <?php foreach ( get_categories() as $category ) : ?>
	3568	+ <option value="<?php echo 'cat_' . $category->slug; ?>" <?php echo in_array( 'cat_' . $category->slug, $auth_settings_option ) ? 'selected="selected"' : ''; ?>><?php echo $category->name; ?></option>
4505	3569	<?php endforeach; ?>
4506	3570	</optgroup>
4507		- </select>
4508		- <?php
	3571	+ </select><?php
4509	3572	}
4510	3573
4511	3574
4512		- /**
4513		- * Settings print callback.
4514		- *
4515		- * @param string $args Args (e.g., multisite admin mode).
4516		- * @return void
4517		- */
4518		- public function print_section_info_external( $args = '' ) {
4519		- ?>
4520		- <div id="section_info_external" class="section_info">
4521		- <p><?php esc_html_e( 'Enter your external server settings below.', 'authorizer' ); ?></p>
4522		- </div>
4523		- <?php
	3575	+ function print_section_info_external( $args = '' ) {
	3576	+ ?><div id="section_info_external" class="section_info">
	3577	+ <p><?php _e( 'Enter your external server settings below.', 'authorizer' ); ?></p>
	3578	+ </div><?php
4524	3579	}
4525	3580
4526	3581
4527		- /**
4528		- * Settings print callback.
4529		- *
4530		- * @param string $args Args (e.g., multisite admin mode).
4531		- * @return void
4532		- */
4533		- public function print_select_auth_access_default_role( $args = '' ) {
	3582	+ function get_admin_mode( $args ) {
	3583	+ if ( is_array( $args ) && array_key_exists( MULTISITE_ADMIN, $args ) && $args[MULTISITE_ADMIN] === true ) {
	3584	+ return MULTISITE_ADMIN;
	3585	+ } else {
	3586	+ return SINGLE_ADMIN;
	3587	+ }
	3588	+ }
	3589	+
	3590	+
	3591	+ function print_select_auth_access_default_role( $args = '' ) {
4534	3592	// Get plugin option.
4535		- $option = 'access_default_role';
	3593	+ $option = 'access_default_role';
4536	3594	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4537	3595
4538	3596	// Print option elements.
4539		- ?>
4540		- <select id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]">
	3597	+ ?><select id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]">
4541	3598	<?php wp_dropdown_roles( $auth_settings_option ); ?>
4542		- <option value=""<?php selected( '' === $auth_settings_option ); ?>><?php esc_html_e( '-- None --', 'authorizer' ); ?></option>
4543		- </select>
4544		- <?php
	3599	+ </select><?php
4545	3600	}
4546	3601
4547	3602
4548		- /**
4549		- * Settings print callback.
4550		- *
4551		- * @param string $args Args (e.g., multisite admin mode).
4552		- * @return void
4553		- */
4554		- public function print_checkbox_auth_external_google( $args = '' ) {
	3603	+ function print_checkbox_auth_external_google( $args = '' ) {
4555	3604	// Get plugin option.
4556		- $option = 'google';
	3605	+ $option = 'google';
4557	3606	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4558	3607
4559	3608	// Print option elements.
4560		- ?>
4561		- <input type="checkbox" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="1"<?php checked( 1 === intval( $auth_settings_option ) ); ?> /><label for="auth_settings_<?php echo esc_attr( $option ); ?>"><?php esc_html_e( 'Enable Google Logins', 'authorizer' ); ?></label>
4562		- <?php
	3609	+ ?><input type="checkbox" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="1"<?php checked( 1 == $auth_settings_option ); ?> /><label for="auth_settings_<?php echo $option; ?>"><?php _e( 'Enable Google Logins', 'authorizer' ); ?></label><?php
4563	3610	}
4564	3611
4565	3612
4566		- /**
4567		- * Settings print callback.
4568		- *
4569		- * @param string $args Args (e.g., multisite admin mode).
4570		- * @return void
4571		- */
4572		- public function print_text_google_clientid( $args = '' ) {
	3613	+ function print_text_google_clientid( $args = '' ) {
4573	3614	// Get plugin option.
4574		- $option = 'google_clientid';
	3615	+ $option = 'google_clientid';
4575	3616	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4576	3617
4577	3618	// Print option elements.
4578		- $site_url_parts = wp_parse_url( get_site_url() );
4579		- $site_url_host = $site_url_parts['scheme'] . '://' . $site_url_parts['host'] . '/';
4580		-
4581		- esc_html_e( "If you don't have a Google Client ID and Secret, generate them by following these instructions:", 'authorizer' );
4582		- ?>
	3619	+ $site_url_parts = parse_url( get_site_url() );
	3620	+ $site_url_host = $site_url_parts['scheme'] . '://' . $site_url_parts['host'] . '/';
	3621	+ ?><?php _e( "If you don't have a Google Client ID and Secret, generate them by following these instructions:", 'authorizer' ); ?>
4583	3622	<ol>
4584		- <li><?php echo wp_kses( __( 'Click <strong>Create a Project</strong> on the <a href="https://cloud.google.com/console" target="_blank">Google Developers Console</a>. You can name it whatever you want.', 'authorizer' ), $this->allowed_html ); ?></li>
4585		- <li><?php echo wp_kses( __( 'Within the project, navigate to <em>APIs and Auth</em> &gt; <em>Credentials</em>, then click <strong>Create New Client ID</strong> under OAuth. Use these settings:', 'authorizer' ), $this->allowed_html ); ?>
	3623	+ <li><?php _e( 'Click <strong>Create a Project</strong> on the <a href="https://cloud.google.com/console" target="_blank">Google Developers Console</a>. You can name it whatever you want.', 'authorizer' ); ?></li>
	3624	+ <li><?php _e( 'Within the project, navigate to <em>APIs and Auth</em> &gt; <em>Credentials</em>, then click <strong>Create New Client ID</strong> under OAuth. Use these settings:', 'authorizer' ); ?>
4586	3625	<ul>
4587		- <li><?php echo wp_kses( __( 'Application Type: <strong>Web application</strong>', 'authorizer' ), $this->allowed_html ); ?></li>
4588		- <li><?php esc_html_e( 'Authorized Javascript Origins:', 'authorizer' ); ?> <strong><?php echo esc_html( rtrim( $site_url_host, '/' ) ); ?></strong></li>
4589		- <li><?php echo wp_kses( __( 'Authorized Redirect URI: <em>none</em>', 'authorizer' ), $this->allowed_html ); ?></li>
	3626	+ <li><?php _e( 'Application Type: <strong>Web application</strong>', 'authorizer' ); ?></li>
	3627	+ <li><?php _e( 'Authorized Javascript Origins:', 'authorizer' ); ?> <strong><?php echo rtrim( $site_url_host, '/' ); ?></strong></li>
	3628	+ <li><?php _e( 'Authorized Redirect URI: <em>none</em>', 'authorizer' ); ?></li>
4590	3629	</ul>
4591	3630	</li>
4592		- <li><?php esc_html_e( 'Copy/paste your new Client ID/Secret pair into the fields below.', 'authorizer' ); ?></li>
4593		- <li><?php echo wp_kses( __( '<strong>Note</strong>: Navigate to <em>APIs and Auth</em> &gt; <em>Consent screen</em> to change the way the Google consent screen appears after a user has successfully entered their password, but before they are redirected back to WordPress.', 'authorizer' ), $this->allowed_html ); ?></li>
4594		- <li><?php echo wp_kses( __( 'Note: Google may have a more recent version of these instructions in their <a href="https://developers.google.com/identity/sign-in/web/devconsole-project" target="_blank">developer documentation</a>.', 'authorizer' ), $this->allowed_html ); ?></li>
	3631	+ <li><?php _e( 'Copy/paste your new Client ID/Secret pair into the fields below.', 'authorizer' ); ?></li>
	3632	+ <li><?php _e( '<strong>Note</strong>: Navigate to <em>APIs and Auth</em> &gt; <em>Consent screen</em> to change the way the Google consent screen appears after a user has successfully entered their password, but before they are redirected back to WordPress.', 'authorizer' ); ?></li>
	3633	+ <li><?php _e( 'Note: Google may have a more recent version of these instructions in their <a href="https://developers.google.com/identity/sign-in/web/devconsole-project" target="_blank">developer documentation</a>.', 'authorizer' ); ?></li>
4595	3634	</ol>
4596		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" style="width:560px;" />
4597		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: 1234567890123-kdjr85yt6vjr6d8g7dhr8g7d6durjf7g.apps.googleusercontent.com', 'authorizer' ); ?></label>
4598		- <?php
	3635	+ <input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="1234567890123-kdjr85yt6vjr6d8g7dhr8g7d6durjf7g.apps.googleusercontent.com" style="width:560px;" /><?php
4599	3636	}
4600	3637
4601	3638
4602		- /**
4603		- * Settings print callback.
4604		- *
4605		- * @param string $args Args (e.g., multisite admin mode).
4606		- * @return void
4607		- */
4608		- public function print_text_google_clientsecret( $args = '' ) {
	3639	+ function print_text_google_clientsecret( $args = '' ) {
4609	3640	// Get plugin option.
4610		- $option = 'google_clientsecret';
	3641	+ $option = 'google_clientsecret';
4611	3642	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4612	3643
4613	3644	// Print option elements.
4614		- ?>
4615		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" style="width:220px;" />
4616		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: sDNgX5_pr_5bly-frKmvp8jT', 'authorizer' ); ?></label>
4617		- <?php
	3645	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="sDNgX5_pr_5bly-frKmvp8jT" style="width:220px;" /><?php
4618	3646	}
4619	3647
4620	3648
4621		- /**
4622		- * Settings print callback.
4623		- *
4624		- * @param string $args Args (e.g., multisite admin mode).
4625		- * @return void
4626		- */
4627		- public function print_text_google_hosteddomain( $args = '' ) {
	3649	+ function print_text_google_hosteddomain( $args = '' ) {
4628	3650	// Get plugin option.
4629		- $option = 'google_hosteddomain';
	3651	+ $option = 'google_hosteddomain';
4630	3652	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4631	3653
4632	3654	// Print option elements.
4633		- ?>
4634		- <textarea id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" placeholder="" style="width:220px;"><?php echo esc_html( $auth_settings_option ); ?></textarea>
4635		- <br /><small><?php esc_html_e( 'Restrict Google logins to a specific Google Apps hosted domain (for example, mycollege.edu). Leave blank to allow all Google sign-ins.', 'authorizer' ); ?><br /><?php esc_html_e( 'If restricting to multiple domains, add one domain per line.', 'authorizer' ); ?></small>
	3655	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" style="width:220px;" /><br />
	3656	+ <small><?php _e( 'Restrict Google logins to a specific Google Apps hosted domain (for example, mycollege.edu). Leave blank to allow all Google sign-ins.', 'authorizer' ); ?></small>
4636	3657	<?php
4637	3658	}
4638	3659
4639	3660
4640		- /**
4641		- * Settings print callback.
4642		- *
4643		- * @param string $args Args (e.g., multisite admin mode).
4644		- * @return void
4645		- */
4646		- public function print_checkbox_auth_external_cas( $args = '' ) {
	3661	+ function print_checkbox_auth_external_cas( $args = '' ) {
4647	3662	// Get plugin option.
4648		- $option = 'cas';
	3663	+ $option = 'cas';
4649	3664	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4650	3665
4651	3666	// Make sure php5-curl extension is installed on server.
4652	3667	$curl_installed_message = ! function_exists( 'curl_init' ) ? __( '<a href="http://www.php.net//manual/en/curl.installation.php" target="_blank" style="color: red;">PHP CURL extension</a> is not installed', 'authorizer' ) : '';
		@@ -4665,558 +3680,305 @@
4665	3680	')</span>';
4666	3681	}
4667	3682
4668	3683	// Print option elements.
4669		- ?>
4670		- <input type="checkbox" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="1"<?php checked( 1 === intval( $auth_settings_option ) ); ?> /><label for="auth_settings_<?php echo esc_attr( $option ); ?>"><?php esc_html_e( 'Enable CAS Logins', 'authorizer' ); ?></label> <?php echo wp_kses( $error_message, $this->allowed_html ); ?>
4671		- <?php
	3684	+ ?><input type="checkbox" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="1"<?php checked( 1 == $auth_settings_option ); ?> /><label for="auth_settings_<?php echo $option; ?>"><?php _e( 'Enable CAS Logins', 'authorizer' ); ?></label> <?php echo $error_message; ?><?php
4672	3685	}
4673	3686
4674	3687
4675		- /**
4676		- * Settings print callback.
4677		- *
4678		- * @param string $args Args (e.g., multisite admin mode).
4679		- * @return void
4680		- */
4681		- public function print_text_cas_custom_label( $args = '' ) {
	3688	+ function print_text_cas_custom_label( $args = '' ) {
4682	3689	// Get plugin option.
4683		- $option = 'cas_custom_label';
	3690	+ $option = 'cas_custom_label';
4684	3691	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4685	3692
4686	3693	// Print option elements.
4687		- esc_html_e( 'The button on the login page will read:', 'authorizer' );
4688		- ?>
4689		- <p><a class="button-primary button-large" style="padding: 3px 16px; height: 36px;"><span class="dashicons dashicons-lock" style="margin: 4px 4px 0 0;"></span> <strong><?php esc_html_e( 'Sign in with', 'authorizer' ); ?> </strong><input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="CAS" style="width: 100px;" /></a></p>
4690		- <?php
	3694	+ ?><?php _e( 'The button on the login page will read:', 'authorizer' ); ?><p><a class="button-primary button-large" style="padding: 3px 16px; height: 36px;"><span class="dashicons dashicons-lock" style="margin: 4px 4px 0 0;"></span> <strong><?php _e( 'Sign in with', 'authorizer' ); ?> </strong><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="CAS" style="width: 100px;" /></a></p><?php
4691	3695	}
4692	3696
4693	3697
4694		- /**
4695		- * Settings print callback.
4696		- *
4697		- * @param string $args Args (e.g., multisite admin mode).
4698		- * @return void
4699		- */
4700		- public function print_text_cas_host( $args = '' ) {
	3698	+ function print_text_cas_host( $args = '' ) {
4701	3699	// Get plugin option.
4702		- $option = 'cas_host';
	3700	+ $option = 'cas_host';
4703	3701	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4704	3702
4705	3703	// Print option elements.
4706		- ?>
4707		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" />
4708		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: authn.example.edu', 'authorizer' ); ?></label>
4709		- <?php
	3704	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="authn.example.edu" /><?php
4710	3705	}
4711	3706
4712	3707
4713		- /**
4714		- * Settings print callback.
4715		- *
4716		- * @param string $args Args (e.g., multisite admin mode).
4717		- * @return void
4718		- */
4719		- public function print_text_cas_port( $args = '' ) {
	3708	+ function print_text_cas_port( $args = '' ) {
4720	3709	// Get plugin option.
4721		- $option = 'cas_port';
	3710	+ $option = 'cas_port';
4722	3711	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4723	3712
4724	3713	// Print option elements.
4725		- ?>
4726		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" style="width:50px;" />
4727		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: 443', 'authorizer' ); ?></label>
4728		- <?php
	3714	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="443" style="width:50px;" /><?php
4729	3715	}
4730	3716
4731	3717
4732		- /**
4733		- * Settings print callback.
4734		- *
4735		- * @param string $args Args (e.g., multisite admin mode).
4736		- * @return void
4737		- */
4738		- public function print_text_cas_path( $args = '' ) {
	3718	+ function print_text_cas_path( $args = '' ) {
4739	3719	// Get plugin option.
4740		- $option = 'cas_path';
	3720	+ $option = 'cas_path';
4741	3721	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4742	3722
4743	3723	// Print option elements.
4744		- ?>
4745		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" />
4746		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: /cas', 'authorizer' ); ?></label>
4747		- <?php
	3724	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="/cas" /><?php
4748	3725	}
4749	3726
4750	3727
4751		- /**
4752		- * Settings print callback.
4753		- *
4754		- * @param string $args Args (e.g., multisite admin mode).
4755		- * @return void
4756		- */
4757		- public function print_select_cas_version( $args = '' ) {
	3728	+ function print_select_cas_version( $args = '' ) {
4758	3729	// Get plugin option.
4759		- $option = 'cas_version';
	3730	+ $option = 'cas_version';
4760	3731	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4761	3732
4762	3733	// Print option elements.
4763		- ?>
4764		- <select id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]">
	3734	+ ?><select id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]">
4765	3735	<option value="SAML_VERSION_1_1" <?php selected( $auth_settings_option, 'SAML_VERSION_1_1' ); ?>>SAML_VERSION_1_1</option>
4766	3736	<option value="CAS_VERSION_3_0" <?php selected( $auth_settings_option, 'CAS_VERSION_3_0' ); ?>>CAS_VERSION_3_0</option>
4767	3737	<option value="CAS_VERSION_2_0" <?php selected( $auth_settings_option, 'CAS_VERSION_2_0' ); ?>>CAS_VERSION_2_0</option>
4768	3738	<option value="CAS_VERSION_1_0" <?php selected( $auth_settings_option, 'CAS_VERSION_1_0' ); ?>>CAS_VERSION_1_0</option>
4769		- </select>
4770		- <?php
	3739	+ </select><?php
4771	3740	}
4772	3741
4773	3742
4774		- /**
4775		- * Settings print callback.
4776		- *
4777		- * @param string $args Args (e.g., multisite admin mode).
4778		- * @return void
4779		- */
4780		- public function print_text_cas_attr_email( $args = '' ) {
	3743	+ function print_text_cas_attr_email( $args = '' ) {
4781	3744	// Get plugin option.
4782		- $option = 'cas_attr_email';
	3745	+ $option = 'cas_attr_email';
4783	3746	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4784	3747
4785	3748	// Print option elements.
4786		- ?>
4787		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" />
4788		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: mail', 'authorizer' ); ?></label>
4789		- <br /><small><?php echo wp_kses( __( "Note: If your CAS server doesn't return an attribute containing an email, you can specify the @domain portion of the email address here, and the email address will be constructed from it and the username. For example, if user 'bob' logs in and his email address should be bob@example.edu, then enter <strong>@example.edu</strong> in this field.", 'authorizer' ), $this->allowed_html ); ?></small>
4790		- <?php
	3749	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="mail" />
	3750	+ <br /><small><?php _e( "Note: If your CAS server doesn't return an attribute containing an email, you can specify the @domain portion of the email address here, and the email address will be constructed from it and the username. For example, if user 'bob' logs in and his email address should be bob@example.edu, then enter <strong>@example.edu</strong> in this field.", 'authorizer' ); ?></small><?php
4791	3751	}
4792	3752
4793	3753
4794		- /**
4795		- * Settings print callback.
4796		- *
4797		- * @param string $args Args (e.g., multisite admin mode).
4798		- * @return void
4799		- */
4800		- public function print_text_cas_attr_first_name( $args = '' ) {
	3754	+ function print_text_cas_attr_first_name( $args = '' ) {
4801	3755	// Get plugin option.
4802		- $option = 'cas_attr_first_name';
	3756	+ $option = 'cas_attr_first_name';
4803	3757	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4804	3758
4805	3759	// Print option elements.
4806		- ?>
4807		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" />
4808		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: givenName', 'authorizer' ); ?></label>
4809		- <?php
	3760	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="givenName" /><?php
4810	3761	}
4811	3762
4812	3763
4813		- /**
4814		- * Settings print callback.
4815		- *
4816		- * @param string $args Args (e.g., multisite admin mode).
4817		- * @return void
4818		- */
4819		- public function print_text_cas_attr_last_name( $args = '' ) {
	3764	+ function print_text_cas_attr_last_name( $args = '' ) {
4820	3765	// Get plugin option.
4821		- $option = 'cas_attr_last_name';
	3766	+ $option = 'cas_attr_last_name';
4822	3767	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4823	3768
4824	3769	// Print option elements.
4825		- ?>
4826		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" />
4827		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: sn', 'authorizer' ); ?></label>
4828		- <?php
	3770	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="sn" /><?php
4829	3771	}
4830	3772
4831	3773
4832		- /**
4833		- * Settings print callback.
4834		- *
4835		- * @param string $args Args (e.g., multisite admin mode).
4836		- * @return void
4837		- */
4838		- public function print_checkbox_cas_attr_update_on_login( $args = '' ) {
	3774	+ function print_checkbox_cas_attr_update_on_login( $args = '' ) {
4839	3775	// Get plugin option.
4840		- $option = 'cas_attr_update_on_login';
	3776	+ $option = 'cas_attr_update_on_login';
4841	3777	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4842	3778
4843	3779	// Print option elements.
4844		- ?>
4845		- <input type="checkbox" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="1"<?php checked( 1 === intval( $auth_settings_option ) ); ?> /><label for="auth_settings_<?php echo esc_attr( $option ); ?>"><?php esc_html_e( 'Update first and last name fields on login (will overwrite any name the user has supplied in their profile)', 'authorizer' ); ?></label>
4846		- <?php
	3780	+ ?><input type="checkbox" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="1"<?php checked( 1 == $auth_settings_option ); ?> /><label for="auth_settings_<?php echo $option; ?>"><?php _e( 'Update first and last name fields on login (will overwrite any name the user has supplied in their profile)', 'authorizer' ); ?></label><?php
4847	3781	}
4848	3782
4849	3783
4850		- /**
4851		- * Settings print callback.
4852		- *
4853		- * @param string $args Args (e.g., multisite admin mode).
4854		- * @return void
4855		- */
4856		- public function print_checkbox_cas_auto_login( $args = '' ) {
	3784	+ function print_checkbox_cas_auto_login( $args = '' ) {
4857	3785	// Get plugin option.
4858		- $option = 'cas_auto_login';
	3786	+ $option = 'cas_auto_login';
4859	3787	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4860	3788
4861	3789	// Print option elements.
4862		- ?>
4863		- <input type="checkbox" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="1"<?php checked( 1 === intval( $auth_settings_option ) ); ?> /><label for="auth_settings_<?php echo esc_attr( $option ); ?>"><?php esc_html_e( "Immediately redirect to CAS login form if it's the only enabled external service and WordPress logins are hidden", 'authorizer' ); ?></label>
4864		- <p><small><?php esc_html_e( 'Note: This feature will only work if you have checked "Hide WordPress Logins" in Advanced settings, and if CAS is the only enabled service (i.e., no Google or LDAP). If you have enabled CAS Single Sign-On (SSO), and a user has already logged into CAS elsewhere, enabling this feature will allow automatic logins without any user interaction.', 'authorizer' ); ?></small></p>
4865		- <?php
	3790	+ ?><input type="checkbox" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="1"<?php checked( 1 == $auth_settings_option ); ?> /><label for="auth_settings_<?php echo $option; ?>"><?php _e( "Immediately redirect to CAS login form if it's the only enabled external service and WordPress logins are hidden", 'authorizer' ); ?></label>
	3791	+ <p><small><?php _e( 'Note: This feature will only work if you have checked "Hide WordPress Logins" in Advanced settings, and if CAS is the only enabled service (i.e., no Google or LDAP). If you have enabled CAS Single Sign-On (SSO), and a user has already logged into CAS elsewhere, enabling this feature will allow automatic logins without any user interaction.', 'authorizer' ); ?></small></p><?php
4866	3792	}
4867	3793
4868	3794
4869		- /**
4870		- * Settings print callback.
4871		- *
4872		- * @param string $args Args (e.g., multisite admin mode).
4873		- * @return void
4874		- */
4875		- public function print_checkbox_cas_link_on_username( $args = '' ) {
	3795	+ function print_checkbox_auth_external_ldap( $args = '' ) {
4876	3796	// Get plugin option.
4877		- $option = 'cas_link_on_username';
	3797	+ $option = 'ldap';
4878	3798	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4879	3799
4880		- // Print option elements.
4881		- ?>
4882		- <input type="checkbox" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="1"<?php checked( 1 === intval( $auth_settings_option ) ); ?> /><label for="auth_settings_<?php echo esc_attr( $option ); ?>"><?php esc_html_e( "Link CAS accounts to WordPress accounts by their username (leave this off to link by email address)", 'authorizer' ); ?></label>
4883		- <p><small><?php esc_html_e( "Note: The default (and most secure) behavior is to associate WordPress accounts with CAS accounts by the email they have in common. However, some uncommon CAS server configurations don't contain email addresses for users. Enable this option if your CAS server doesn't have an attribute containing an email, or if you have WordPress accounts that don't have emails.", 'authorizer' ); ?></small></p>
4884		- <?php
4885		- }
4886		-
4887		-
4888		- /**
4889		- * Settings print callback.
4890		- *
4891		- * @param string $args Args (e.g., multisite admin mode).
4892		- * @return void
4893		- */
4894		- public function print_checkbox_auth_external_ldap( $args = '' ) {
4895		- // Get plugin option.
4896		- $option = 'ldap';
4897		- $auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4898		-
4899	3800	// Make sure php5-ldap extension is installed on server.
4900	3801	$ldap_installed_message = ! function_exists( 'ldap_connect' ) ? '<span style="color: red;">(' . __( 'Warning: <a href="http://www.php.net/manual/en/ldap.installation.php" target="_blank" style="color: red;">PHP LDAP extension</a> is <strong>not</strong> installed', 'authorizer' ) . ')</span>' : '';
4901	3802
4902	3803	// Print option elements.
4903		- ?>
4904		- <input type="checkbox" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="1"<?php checked( 1 === intval( $auth_settings_option ) ); ?> /><label for="auth_settings_<?php echo esc_attr( $option ); ?>"><?php esc_html_e( 'Enable LDAP Logins', 'authorizer' ); ?></label> <?php echo wp_kses( $ldap_installed_message, $this->allowed_html ); ?>
4905		- <?php
	3804	+ ?><input type="checkbox" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="1"<?php checked( 1 == $auth_settings_option ); ?> /><label for="auth_settings_<?php echo $option; ?>"><?php _e( 'Enable LDAP Logins', 'authorizer' ); ?></label> <?php echo $ldap_installed_message; ?><?php
4906	3805	}
4907	3806
4908	3807
4909		- /**
4910		- * Settings print callback.
4911		- *
4912		- * @param string $args Args (e.g., multisite admin mode).
4913		- * @return void
4914		- */
4915		- public function print_text_ldap_host( $args = '' ) {
	3808	+ function print_text_ldap_host( $args = '' ) {
4916	3809	// Get plugin option.
4917		- $option = 'ldap_host';
	3810	+ $option = 'ldap_host';
4918	3811	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4919	3812
4920	3813	// Print option elements.
4921		- ?>
4922		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" style="width:330px;" />
4923		- <br /><small><?php esc_html_e( 'Specify either a hostname (for example, ldap.example.edu) or a full LDAP URI (for example, ldaps://ldap.example.edu:636).', 'authorizer' ); ?></small>
4924		- <?php
	3814	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="ldap.example.edu" style="width:330px;" />
	3815	+ <br /><small><?php _e( "Specify either a hostname (for example, ldap.example.edu) or a full LDAP URI (for example, ldaps://ldap.example.edu:636).", 'authorizer' ); ?></small><?php
4925	3816	}
4926	3817
4927	3818
4928		- /**
4929		- * Settings print callback.
4930		- *
4931		- * @param string $args Args (e.g., multisite admin mode).
4932		- * @return void
4933		- */
4934		- public function print_text_ldap_port( $args = '' ) {
	3819	+ function print_text_ldap_port( $args = '' ) {
4935	3820	// Get plugin option.
4936		- $option = 'ldap_port';
	3821	+ $option = 'ldap_port';
4937	3822	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4938	3823
4939	3824	// Print option elements.
4940		- ?>
4941		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" style="width:50px;" />
4942		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: 389', 'authorizer' ); ?></label>
4943		- <br /><small><?php esc_html_e( 'If a full LDAP URI (ldaps://hostname:port) is specified above, this field is ignored.', 'authorizer' ); ?></small>
4944		- <?php
	3825	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="389" style="width:50px;" />
	3826	+ <br /><small><?php _e( "If a full LDAP URI (ldaps://hostname:port) is specified above, this field is ignored.", 'authorizer' ); ?></small><?php
4945	3827	}
4946	3828
4947	3829
4948		- /**
4949		- * Settings print callback.
4950		- *
4951		- * @param string $args Args (e.g., multisite admin mode).
4952		- * @return void
4953		- */
4954		- public function print_checkbox_ldap_tls( $args = '' ) {
	3830	+ function print_checkbox_ldap_tls( $args = '' ) {
4955	3831	// Get plugin option.
4956		- $option = 'ldap_tls';
	3832	+ $option = 'ldap_tls';
4957	3833	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4958	3834
4959	3835	// Print option elements.
4960		- ?>
4961		- <input type="checkbox" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="1"<?php checked( 1 === intval( $auth_settings_option ) ); ?> /><label for="auth_settings_<?php echo esc_attr( $option ); ?>"><?php esc_html_e( 'Use TLS', 'authorizer' ); ?></label>
4962		- <br /><small><?php esc_html_e( 'If ldaps is used, this should be unchecked', 'authorizer' ); ?></small>
4963		- <?php
	3836	+ ?><input type="checkbox" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="1"<?php checked( 1 == $auth_settings_option ); ?> /><label for="auth_settings_<?php echo $option; ?>"><?php _e( 'Use TLS', 'authorizer' ); ?></label><?php
4964	3837	}
4965	3838
4966	3839
4967		- /**
4968		- * Settings print callback.
4969		- *
4970		- * @param string $args Args (e.g., multisite admin mode).
4971		- * @return void
4972		- */
4973		- public function print_text_ldap_search_base( $args = '' ) {
	3840	+ function print_text_ldap_search_base( $args = '' ) {
4974	3841	// Get plugin option.
4975		- $option = 'ldap_search_base';
	3842	+ $option = 'ldap_search_base';
4976	3843	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4977	3844
4978	3845	// Print option elements.
4979		- ?>
4980		- <textarea id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" placeholder="" style="width:330px;"><?php echo esc_attr( $auth_settings_option ); ?></textarea>
4981		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: ou=people,dc=example,dc=edu', 'authorizer' ); ?></label>
4982		- <br /><small><?php esc_html_e( 'If you have multiple search bases, separate them by newlines (one per line).', 'authorizer' ); ?></small>
4983		- <?php
	3846	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="ou=people,dc=example,dc=edu" style="width:330px;" /><?php
4984	3847	}
4985	3848
4986	3849
4987		- /**
4988		- * Settings print callback.
4989		- *
4990		- * @param string $args Args (e.g., multisite admin mode).
4991		- * @return void
4992		- */
4993		- public function print_text_ldap_uid( $args = '' ) {
	3850	+ function print_text_ldap_uid( $args = '' ) {
4994	3851	// Get plugin option.
4995		- $option = 'ldap_uid';
	3852	+ $option = 'ldap_uid';
4996	3853	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4997	3854
4998	3855	// Print option elements.
4999		- ?>
5000		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" style="width:80px;" />
5001		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: uid', 'authorizer' ); ?></label>
5002		- <?php
	3856	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="uid" style="width:80px;" /><?php
5003	3857	}
5004	3858
5005	3859
5006		- /**
5007		- * Settings print callback.
5008		- *
5009		- * @param string $args Args (e.g., multisite admin mode).
5010		- * @return void
5011		- */
5012		- public function print_text_ldap_attr_email( $args = '' ) {
	3860	+ function print_text_ldap_attr_email( $args = '' ) {
5013	3861	// Get plugin option.
5014		- $option = 'ldap_attr_email';
	3862	+ $option = 'ldap_attr_email';
5015	3863	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5016	3864
5017	3865	// Print option elements.
5018		- ?>
5019		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" />
5020		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: mail', 'authorizer' ); ?></label>
5021		- <br /><small><?php echo wp_kses( __( "Note: If your LDAP server doesn't return an attribute containing an email, you can specify the @domain portion of the email address here, and the email address will be constructed from it and the username. For example, if user 'bob' logs in and his email address should be bob@example.edu, then enter <strong>@example.edu</strong> in this field.", 'authorizer' ), $this->allowed_html ); ?></small>
5022		- <?php
	3866	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="mail" />
	3867	+ <br /><small><?php _e( "Note: If your LDAP server doesn't return an attribute containing an email, you can specify the @domain portion of the email address here, and the email address will be constructed from it and the username. For example, if user 'bob' logs in and his email address should be bob@example.edu, then enter <strong>@example.edu</strong> in this field.", 'authorizer' ); ?></small><?php
5023	3868	}
5024	3869
5025	3870
5026		- /**
5027		- * Settings print callback.
5028		- *
5029		- * @param string $args Args (e.g., multisite admin mode).
5030		- * @return void
5031		- */
5032		- public function print_text_ldap_user( $args = '' ) {
	3871	+ function print_text_ldap_user( $args = '' ) {
5033	3872	// Get plugin option.
5034		- $option = 'ldap_user';
	3873	+ $option = 'ldap_user';
5035	3874	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5036	3875
5037	3876	// Print option elements.
5038		- ?>
5039		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" style="width:330px;" />
5040		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: cn=directory-user,ou=specials,dc=example,dc=edu', 'authorizer' ); ?></label>
5041		- <?php
	3877	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="cn=directory-user,ou=specials,dc=example,dc=edu" style="width:330px;" /><?php
5042	3878	}
5043	3879
5044	3880
5045		- /**
5046		- * Settings print callback.
5047		- *
5048		- * @param string $args Args (e.g., multisite admin mode).
5049		- * @return void
5050		- */
5051		- public function print_password_ldap_password( $args = '' ) {
	3881	+ function print_password_ldap_password( $args = '' ) {
5052	3882	// Get plugin option.
5053		- $option = 'ldap_password';
	3883	+ $option = 'ldap_password';
5054	3884	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5055	3885
5056	3886	// Print option elements.
5057		- ?>
5058		- <input type="password" id="garbage_to_stop_autofill" name="garbage" value="" autocomplete="off" style="display:none;" />
5059		- <input type="password" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $this->decrypt( $auth_settings_option ) ); ?>" autocomplete="new-password" />
5060		- <?php
	3887	+ ?><input type="password" id="garbage_to_stop_autofill" name="garbage" value="" autocomplete="off" style="display:none;" />
	3888	+ <input type="password" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $this->decrypt( base64_decode( $auth_settings_option ) ); ?>" autocomplete="off" /><?php
5061	3889	}
5062	3890
5063	3891
5064		- /**
5065		- * Settings print callback.
5066		- *
5067		- * @param string $args Args (e.g., multisite admin mode).
5068		- * @return void
5069		- */
5070		- public function print_text_ldap_lostpassword_url( $args = '' ) {
	3892	+ function print_text_ldap_lostpassword_url( $args = '' ) {
5071	3893	// Get plugin option.
5072		- $option = 'ldap_lostpassword_url';
	3894	+ $option = 'ldap_lostpassword_url';
5073	3895	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5074	3896
5075	3897	// Print option elements.
5076		- ?>
5077		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" style="width: 400px;" />
5078		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: https://myschool.example.edu:8888/am-forgot-password', 'authorizer' ); ?></label>
5079		- <?php
	3898	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="https://myschool.example.edu:8888/am-forgot-password" style="width: 400px;" /><?php
5080	3899	}
5081	3900
5082	3901
5083		- /**
5084		- * Settings print callback.
5085		- *
5086		- * @param string $args Args (e.g., multisite admin mode).
5087		- * @return void
5088		- */
5089		- public function print_text_ldap_attr_first_name( $args = '' ) {
	3902	+ function print_text_ldap_attr_first_name( $args = '' ) {
5090	3903	// Get plugin option.
5091		- $option = 'ldap_attr_first_name';
	3904	+ $option = 'ldap_attr_first_name';
5092	3905	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5093	3906
5094	3907	// Print option elements.
5095		- ?>
5096		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" />
5097		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: givenname', 'authorizer' ); ?></label>
5098		- <?php
	3908	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="givenname" /><?php
5099	3909	}
5100	3910
5101	3911
5102		- /**
5103		- * Settings print callback.
5104		- *
5105		- * @param string $args Args (e.g., multisite admin mode).
5106		- * @return void
5107		- */
5108		- public function print_text_ldap_attr_last_name( $args = '' ) {
	3912	+ function print_text_ldap_attr_last_name( $args = '' ) {
5109	3913	// Get plugin option.
5110		- $option = 'ldap_attr_last_name';
	3914	+ $option = 'ldap_attr_last_name';
5111	3915	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5112	3916
5113	3917	// Print option elements.
5114		- ?>
5115		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" />
5116		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: sn', 'authorizer' ); ?></label>
5117		- <?php
	3918	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="sn" /><?php
5118	3919	}
5119	3920
5120	3921
5121		- /**
5122		- * Settings print callback.
5123		- *
5124		- * @param string $args Args (e.g., multisite admin mode).
5125		- * @return void
5126		- */
5127		- public function print_checkbox_ldap_attr_update_on_login( $args = '' ) {
	3922	+ function print_checkbox_ldap_attr_update_on_login( $args = '' ) {
5128	3923	// Get plugin option.
5129		- $option = 'ldap_attr_update_on_login';
	3924	+ $option = 'ldap_attr_update_on_login';
5130	3925	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5131	3926
5132	3927	// Print option elements.
5133		- ?>
5134		- <input type="checkbox" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="1"<?php checked( 1 === intval( $auth_settings_option ) ); ?> /><label for="auth_settings_<?php echo esc_attr( $option ); ?>"><?php esc_html_e( 'Update first and last name fields on login (will overwrite any name the user has supplied in their profile)', 'authorizer' ); ?></label>
5135		- <?php
	3928	+ ?><input type="checkbox" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="1"<?php checked( 1 == $auth_settings_option ); ?> /><label for="auth_settings_<?php echo $option; ?>"><?php _e( 'Update first and last name fields on login (will overwrite any name the user has supplied in their profile)', 'authorizer' ); ?></label><?php
5136	3929	}
5137	3930
5138	3931
5139		- /**
5140		- * Settings print callback.
5141		- *
5142		- * @param string $args Args (e.g., multisite admin mode).
5143		- * @return void
5144		- */
5145		- public function print_section_info_advanced( $args = '' ) {
5146		- ?>
5147		- <div id="section_info_advanced" class="section_info">
5148		- <p><?php esc_html_e( 'You may optionally specify some advanced settings below.', 'authorizer' ); ?></p>
5149		- </div>
5150		- <?php
	3932	+ function print_section_info_advanced( $args = '' ) {
	3933	+ ?><div id="section_info_advanced" class="section_info">
	3934	+ <p><?php _e( 'You may optionally specify some advanced settings below.', 'authorizer' ); ?></p>
	3935	+ </div><?php
5151	3936	}
5152	3937
5153	3938
5154		- /**
5155		- * Settings print callback.
5156		- *
5157		- * @param string $args Args (e.g., multisite admin mode).
5158		- * @return void
5159		- */
5160		- public function print_text_auth_advanced_lockouts( $args = '' ) {
	3939	+ function print_text_auth_advanced_lockouts( $args = '' ) {
5161	3940	// Get plugin option.
5162		- $option = 'advanced_lockouts';
	3941	+ $option = 'advanced_lockouts';
5163	3942	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5164	3943
5165	3944	// Print option elements.
5166		- esc_html_e( 'After', 'authorizer' );
5167		- ?>
5168		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>_attempts_1" name="auth_settings[<?php echo esc_attr( $option ); ?>][attempts_1]" value="<?php echo esc_attr( $auth_settings_option['attempts_1'] ); ?>" placeholder="10" style="width:30px;" />
5169		- <?php esc_html_e( 'invalid password attempts, delay further attempts on that user for', 'authorizer' ); ?>
5170		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>_duration_1" name="auth_settings[<?php echo esc_attr( $option ); ?>][duration_1]" value="<?php echo esc_attr( $auth_settings_option['duration_1'] ); ?>" placeholder="1" style="width:30px;" />
5171		- <?php esc_html_e( 'minute(s).', 'authorizer' ); ?>
	3945	+ ?><?php _e( 'After', 'authorizer' ); ?>
	3946	+ <input type="text" id="auth_settings_<?php echo $option; ?>_attempts_1" name="auth_settings[<?php echo $option; ?>][attempts_1]" value="<?php echo $auth_settings_option['attempts_1']; ?>" placeholder="10" style="width:30px;" />
	3947	+ <?php _e( 'invalid password attempts, delay further attempts on that user for', 'authorizer' ); ?>
	3948	+ <input type="text" id="auth_settings_<?php echo $option; ?>_duration_1" name="auth_settings[<?php echo $option; ?>][duration_1]" value="<?php echo $auth_settings_option['duration_1']; ?>" placeholder="1" style="width:30px;" />
	3949	+ <?php _e( 'minute(s).', 'authorizer' ); ?>
5172	3950	<br />
5173		- <?php esc_html_e( 'After', 'authorizer' ); ?>
5174		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>_attempts_2" name="auth_settings[<?php echo esc_attr( $option ); ?>][attempts_2]" value="<?php echo esc_attr( $auth_settings_option['attempts_2'] ); ?>" placeholder="10" style="width:30px;" />
5175		- <?php esc_html_e( 'more invalid attempts, increase the delay to', 'authorizer' ); ?>
5176		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>_duration_2" name="auth_settings[<?php echo esc_attr( $option ); ?>][duration_2]" value="<?php echo esc_attr( $auth_settings_option['duration_2'] ); ?>" placeholder="10" style="width:30px;" />
5177		- <?php esc_html_e( 'minutes.', 'authorizer' ); ?>
	3951	+ <?php _e( 'After', 'authorizer' ); ?>
	3952	+ <input type="text" id="auth_settings_<?php echo $option; ?>_attempts_2" name="auth_settings[<?php echo $option; ?>][attempts_2]" value="<?php echo $auth_settings_option['attempts_2']; ?>" placeholder="10" style="width:30px;" />
	3953	+ <?php _e( 'more invalid attempts, increase the delay to', 'authorizer' ); ?>
	3954	+ <input type="text" id="auth_settings_<?php echo $option; ?>_duration_2" name="auth_settings[<?php echo $option; ?>][duration_2]" value="<?php echo $auth_settings_option['duration_2']; ?>" placeholder="10" style="width:30px;" />
	3955	+ <?php _e( 'minutes.', 'authorizer' ); ?>
5178	3956	<br />
5179		- <?php esc_html_e( 'Reset the delays after', 'authorizer' ); ?>
5180		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>_reset_duration" name="auth_settings[<?php echo esc_attr( $option ); ?>][reset_duration]" value="<?php echo esc_attr( $auth_settings_option['reset_duration'] ); ?>" placeholder="240" style="width:40px;" />
5181		- <?php esc_html_e( 'minutes with no invalid attempts.', 'authorizer' ); ?>
5182		- <?php
	3957	+ <?php _e( 'Reset the delays after', 'authorizer' ); ?>
	3958	+ <input type="text" id="auth_settings_<?php echo $option; ?>_reset_duration" name="auth_settings[<?php echo $option; ?>][reset_duration]" value="<?php echo $auth_settings_option['reset_duration']; ?>" placeholder="240" style="width:40px;" />
	3959	+ <?php _e( 'minutes with no invalid attempts.', 'authorizer' ); ?><?php
5183	3960	}
5184	3961
5185	3962
5186		- /**
5187		- * Settings print callback.
5188		- *
5189		- * @param string $args Args (e.g., multisite admin mode).
5190		- * @return void
5191		- */
5192		- public function print_checkbox_auth_advanced_hide_wp_login( $args = '' ) {
	3963	+ function print_checkbox_auth_advanced_hide_wp_login( $args = '' ) {
5193	3964	// Get plugin option.
5194		- $option = 'advanced_hide_wp_login';
	3965	+ $option = 'advanced_hide_wp_login';
5195	3966	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5196	3967
5197	3968	// Print option elements.
5198		- ?>
5199		- <input type="checkbox" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="1"<?php checked( 1 === intval( $auth_settings_option ) ); ?> /><label for="auth_settings_<?php echo esc_attr( $option ); ?>"><?php esc_html_e( 'Hide WordPress Logins', 'authorizer' ); ?></label>
5200		- <p><small><?php esc_html_e( 'Note: You can always access the WordPress logins by adding external=wordpress to the wp-login URL, like so:', 'authorizer' ); ?><br /><a href="<?php echo esc_attr( wp_login_url() ); ?>?external=wordpress" target="_blank"><?php echo esc_html( wp_login_url() ); ?>?external=wordpress</a>.</p>
5201		- <?php
	3969	+ ?><input type="checkbox" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="1"<?php checked( 1 == $auth_settings_option ); ?> /><label for="auth_settings_<?php echo $option; ?>"><?php _e( 'Hide WordPress Logins', 'authorizer' ); ?></label>
	3970	+ <p><small><?php _e( 'Note: You can always access the WordPress logins by adding external=wordpress to the wp-login URL, like so:', 'authorizer' ); ?><br /><a href="<?php echo wp_login_url(); ?>?external=wordpress" target="_blank"><?php echo wp_login_url(); ?>?external=wordpress</a>.</p><?php
5202	3971	}
5203	3972
5204	3973
5205		- /**
5206		- * Settings print callback.
5207		- *
5208		- * @param string $args Args (e.g., multisite admin mode).
5209		- * @return void
5210		- */
5211		- public function print_radio_auth_advanced_branding( $args = '' ) {
	3974	+ function print_radio_auth_advanced_branding( $args = '' ) {
5212	3975	// Get plugin option.
5213		- $option = 'advanced_branding';
	3976	+ $option = 'advanced_branding';
5214	3977	$auth_settings_option = $this->get_plugin_option( $option );
5215	3978
5216	3979	// Print option elements.
5217		- ?>
5218		- <input type="radio" id="radio_auth_settings_<?php echo esc_attr( $option ); ?>_default" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="default"<?php checked( 'default' === $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo esc_attr( $option ); ?>_default"><?php esc_html_e( 'Default WordPress login screen', 'authorizer' ); ?></label><br />
	3980	+ ?><input type="radio" id="radio_auth_settings_<?php echo $option; ?>_default" name="auth_settings[<?php echo $option; ?>]" value="default"<?php checked( 'default' == $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo $option; ?>_default"><?php _e( 'Default WordPress login screen', 'authorizer' ); ?></label><br />
5219	3981	<?php
5220	3982
5221	3983	/**
5222	3984	* Developers can use the `authorizer_add_branding_option` filter
		@@ -5221,8 +3983,9 @@
5221	3983	/**
5222	3984	* Developers can use the `authorizer_add_branding_option` filter
5223	3985	* to add a radio button for "Custom WordPress login branding"
5224	3986	* under the "Advanced" tab in Authorizer options. Example:
	3987	+ *
5225	3988	* function my_authorizer_add_branding_option( $branding_options ) {
5226	3989	* $new_branding_option = array(
5227	3990	* 'value' => 'your_brand'
5228	3991	* 'description' => 'Custom Your Brand Login Screen',
		@@ -5236,274 +3999,133 @@
5236	3999	*/
5237	4000	$branding_options = array();
5238	4001	$branding_options = apply_filters( 'authorizer_add_branding_option', $branding_options );
5239	4002	foreach ( $branding_options as $branding_option ) {
5240		- // Make sure the custom brands have the required values.
	4003	+ // Make sure the custom brands have the required values
5241	4004	if ( ! ( is_array( $branding_option ) && array_key_exists( 'value', $branding_option ) && array_key_exists( 'description', $branding_option ) ) ) {
5242	4005	continue;
5243	4006	}
5244		- ?>
5245		- <input type="radio" id="radio_auth_settings_<?php echo esc_attr( $option ); ?>_<?php echo esc_attr( sanitize_title( $branding_option['value'] ) ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $branding_option['value'] ); ?>"<?php checked( $branding_option['value'] === $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo esc_attr( $option ); ?>_<?php echo esc_attr( sanitize_title( $branding_option['value'] ) ); ?>"><?php echo esc_html( $branding_option['description'] ); ?></label><br />
5246		- <?php
	4007	+ ?><input type="radio" id="radio_auth_settings_<?php echo $option; ?>_<?php echo sanitize_title( $branding_option['value'] ); ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $branding_option['value']; ?>"<?php checked( $branding_option['value'] == $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo $option; ?>_<?php echo sanitize_title( $branding_option['value'] ); ?>"><?php echo $branding_option['description']; ?></label><br /><?php
5247	4008	}
5248	4009
5249	4010	// Print message about adding custom brands if there are none.
5250	4011	if ( count( $branding_options ) === 0 ) {
5251		- ?>
5252		- <p><em><?php echo wp_kses( __( '<strong>Note for theme developers</strong>: Add more options here by using the `authorizer_add_branding_option` filter in your theme. You can see an example theme that implements this filter in the plugin directory under sample-theme-add-branding.', 'authorizer' ), $this->allowed_html ); ?></em></p>
5253		- <?php
	4012	+ ?><p><em><?php _e( '<strong>Note for theme developers</strong>: Add more options here by using the `authorizer_add_branding_option` filter in your theme. You can see an example theme that implements this filter in the plugin directory under sample-theme-add-branding.', 'authorizer' ); ?></em></p><?php
5254	4013	}
5255	4014	}
5256	4015
5257	4016
5258		- /**
5259		- * Settings print callback.
5260		- *
5261		- * @param string $args Args (e.g., multisite admin mode).
5262		- * @return void
5263		- */
5264		- public function print_radio_auth_advanced_admin_menu( $args = '' ) {
	4017	+ function print_radio_auth_advanced_admin_menu( $args = '' ) {
5265	4018	// Get plugin option.
5266		- $option = 'advanced_admin_menu';
	4019	+ $option = 'advanced_admin_menu';
5267	4020	$auth_settings_option = $this->get_plugin_option( $option );
5268	4021
5269	4022	// Print option elements.
5270		- ?>
5271		- <input type="radio" id="radio_auth_settings_<?php echo esc_attr( $option ); ?>_settings" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="settings"<?php checked( 'settings' === $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo esc_attr( $option ); ?>_settings"><?php esc_html_e( 'Show in Settings menu', 'authorizer' ); ?></label><br />
5272		- <input type="radio" id="radio_auth_settings_<?php echo esc_attr( $option ); ?>_top" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="top"<?php checked( 'top' === $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo esc_attr( $option ); ?>_top"><?php esc_html_e( 'Show in sidebar (top level)', 'authorizer' ); ?></label><br />
5273		- <?php
	4023	+ ?><input type="radio" id="radio_auth_settings_<?php echo $option; ?>_settings" name="auth_settings[<?php echo $option; ?>]" value="settings"<?php checked( 'settings' == $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo $option; ?>_settings"><?php _e( 'Show in Settings menu', 'authorizer' ); ?></label><br />
	4024	+ <input type="radio" id="radio_auth_settings_<?php echo $option; ?>_top" name="auth_settings[<?php echo $option; ?>]" value="top"<?php checked( 'top' == $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo $option; ?>_top"><?php _e( 'Show in sidebar (top level)', 'authorizer' ); ?></label><br /><?php
5274	4025
5275	4026	}
5276	4027
5277	4028
5278		- /**
5279		- * Settings print callback.
5280		- *
5281		- * @param string $args Args (e.g., multisite admin mode).
5282		- * @return void
5283		- */
5284		- public function print_select_auth_advanced_usermeta( $args = '' ) {
	4029	+ function print_select_auth_advanced_usermeta( $args = '' ) {
5285	4030	// Get plugin option.
5286		- $option = 'advanced_usermeta';
	4031	+ $option = 'advanced_usermeta';
5287	4032	$auth_settings_option = $this->get_plugin_option( $option );
5288	4033
5289	4034	// Print option elements.
5290		- ?>
5291		- <select id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]">
5292		- <option value=""><?php esc_html_e( '-- None --', 'authorizer' ); ?></option>
5293		- <?php
5294		- if ( class_exists( 'acf' ) ) :
	4035	+ ?><select id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]">
	4036	+ <option value=""><?php _e( '-- None --', 'authorizer' ); ?></option>
	4037	+ <?php if ( class_exists( 'acf' ) ) :
5295	4038	// Get ACF 5 fields. Note: it would be much easier to use `get_field_objects()`
5296	4039	// or `get_field_objects( 'user_' . get_current_user_id() )`, but neither will
5297	4040	// list fields that have never been given values for users (i.e., new ACF
5298	4041	// fields). Therefore we fall back on finding any ACF fields applied to users
5299	4042	// (user_role or user_form location rules in the field group definition).
5300		- $fields = array();
	4043	+ $fields = array();
5301	4044	$acf_field_group_ids = array();
5302		- $acf_field_groups = new WP_Query(
5303		- array(
5304		- 'post_type' => 'acf-field-group',
5305		- )
5306		- );
	4045	+ $acf_field_groups = new WP_Query( array(
	4046	+ 'post_type' => 'acf-field-group',
	4047	+ ));
5307	4048	while ( $acf_field_groups->have_posts() ) : $acf_field_groups->the_post();
5308	4049	if ( strpos( get_the_content(), 's:5:"param";s:9:"user_role"' ) !== false || strpos( get_the_content(), 's:5:"param";s:9:"user_form"' ) !== false ) :
5309	4050	array_push( $acf_field_group_ids, get_the_ID() );
5310	4051	endif;
5311		- endwhile;
5312		- wp_reset_postdata();
	4052	+ endwhile; wp_reset_postdata();
5313	4053	foreach ( $acf_field_group_ids as $acf_field_group_id ) :
5314		- $acf_fields = new WP_Query(
5315		- array(
5316		- 'post_type' => 'acf-field',
5317		- 'post_parent' => $acf_field_group_id,
5318		- )
5319		- );
	4054	+ $acf_fields = new WP_Query( array(
	4055	+ 'post_type' => 'acf-field',
	4056	+ 'post_parent' => $acf_field_group_id,
	4057	+ ));
5320	4058	while ( $acf_fields->have_posts() ) : $acf_fields->the_post();
5321	4059	global $post;
5322		- $fields[ $post->post_name ] = get_field_object( $post->post_name );
5323		- endwhile;
5324		- wp_reset_postdata();
	4060	+ $fields[$post->post_name] = get_field_object( $post->post_name );
	4061	+ endwhile; wp_reset_postdata();
5325	4062	endforeach;
5326	4063	// Get ACF 4 fields.
5327		- $acf4_field_groups = new WP_Query(
5328		- array(
5329		- 'post_type' => 'acf',
5330		- )
5331		- );
	4064	+ $acf4_field_groups = new WP_Query( array(
	4065	+ 'post_type' => 'acf',
	4066	+ ));
5332	4067	while ( $acf4_field_groups->have_posts() ) : $acf4_field_groups->the_post();
5333	4068	$field_group_rules = get_post_meta( get_the_ID(), 'rule', true );
5334		- if ( is_array( $field_group_rules ) && array_key_exists( 'param', $field_group_rules ) && 'ef_user' === $field_group_rules['param'] ) :
	4069	+ if ( is_array( $field_group_rules ) && array_key_exists( 'param', $field_group_rules ) && $field_group_rules['param'] === 'ef_user' ) :
5335	4070	$acf4_fields = get_post_custom( get_the_ID() );
5336	4071	foreach ( $acf4_fields as $meta_key => $meta_value ) :
5337	4072	if ( strpos( $meta_key, 'field_' ) === 0 ) :
5338		- $meta_value = unserialize( $meta_value[0] );
5339		- $fields[ $meta_key ] = $meta_value;
	4073	+ $meta_value = unserialize( $meta_value[0] );
	4074	+ $fields[$meta_key] = $meta_value;
5340	4075	endif;
5341	4076	endforeach;
5342	4077	endif;
5343		- endwhile;
5344		- wp_reset_postdata();
5345		- ?>
	4078	+ endwhile; wp_reset_postdata(); ?>
5346	4079	<optgroup label="ACF User Fields:">
5347		- <?php foreach ( (array) $fields as $field => $field_object ) : ?>
5348		- <option value="acf___<?php echo esc_attr( $field_object['key'] ); ?>"<?php selected( "acf___{$field_object['key']}" === $auth_settings_option ); ?>><?php echo esc_html( $field_object['label'] ); ?></option>
	4080	+ <?php foreach ( (array)$fields as $field => $field_object ) : ?>
	4081	+ <option value="acf___<?php echo $field_object['key']; ?>"<?php if ( $auth_settings_option === "acf___{$field_object['key']}" ) echo ' selected="selected"'; ?>><?php echo $field_object['label']; ?></option>
5349	4082	<?php endforeach; ?>
5350	4083	</optgroup>
5351	4084	<?php endif; ?>
5352		- <optgroup label="<?php esc_attr_e( 'All Usermeta:', 'authorizer' ); ?>">
5353		- <?php
5354		- foreach ( $this->get_all_usermeta_keys() as $meta_key ) :
5355		- if ( substr( $meta_key, 0, 3 ) === 'wp_' ) :
5356		- continue;
5357		- endif;
5358		- ?>
5359		- <option value="<?php echo esc_attr( $meta_key ); ?>"<?php selected( $auth_settings_option === $meta_key ); ?>><?php echo esc_html( $meta_key ); ?></option>
	4085	+ <optgroup label="<?php _e( 'All Usermeta:', 'authorizer' ); ?>">
	4086	+ <?php foreach ( $this->get_all_usermeta_keys() as $meta_key ) : if ( substr( $meta_key, 0, 3 ) === 'wp_' ) continue; ?>
	4087	+ <option value="<?php echo $meta_key; ?>"<?php if ( $auth_settings_option === $meta_key ) echo ' selected="selected"'; ?>><?php echo $meta_key; ?></option>
5360	4088	<?php endforeach; ?>
5361	4089	</optgroup>
5362		- </select>
5363		- <?php
	4090	+ </select><?php
5364	4091	}
5365	4092
5366	4093
5367		- /**
5368		- * Settings print callback.
5369		- *
5370		- * @param string $args Args (e.g., multisite admin mode).
5371		- * @return void
5372		- */
5373		- public function print_text_auth_advanced_users_per_page( $args = '' ) {
	4094	+ function print_checkbox_auth_advanced_override_multisite( $args = '' ) {
5374	4095	// Get plugin option.
5375		- $option = 'advanced_users_per_page';
5376		- $auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5377		-
5378		- // Print option elements.
5379		- ?>
5380		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" size="4" />
5381		- <?php
5382		- }
5383		-
5384		-
5385		- /**
5386		- * Settings print callback.
5387		- *
5388		- * @param string $args Args (e.g., multisite admin mode).
5389		- * @return void
5390		- */
5391		- public function print_select_auth_advanced_users_sort_by( $args = '' ) {
5392		- // Get plugin option.
5393		- $option = 'advanced_users_sort_by';
5394		- $auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5395		-
5396		- // Print option elements.
5397		- ?>
5398		- <select id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]">
5399		- <option value="created" <?php selected( $auth_settings_option, 'created' ); ?>><?php esc_html_e( 'Date approved', 'authorizer' ); ?></option>
5400		- <option value="email" <?php selected( $auth_settings_option, 'email' ); ?>><?php esc_html_e( 'Email', 'authorizer' ); ?></option>
5401		- <option value="role" <?php selected( $auth_settings_option, 'role' ); ?>><?php esc_html_e( 'Role', 'authorizer' ); ?></option>
5402		- <option value="date_added" <?php selected( $auth_settings_option, 'date_added' ); ?>><?php esc_html_e( 'Date registered', 'authorizer' ); ?></option>
5403		- </select>
5404		- <?php
5405		- }
5406		-
5407		-
5408		- /**
5409		- * Settings print callback.
5410		- *
5411		- * @param string $args Args (e.g., multisite admin mode).
5412		- * @return void
5413		- */
5414		- public function print_select_auth_advanced_users_sort_order( $args = '' ) {
5415		- // Get plugin option.
5416		- $option = 'advanced_users_sort_order';
5417		- $auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5418		-
5419		- // Print option elements.
5420		- ?>
5421		- <select id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]">
5422		- <option value="asc" <?php selected( $auth_settings_option, 'asc' ); ?>><?php esc_html_e( 'Ascending', 'authorizer' ); ?></option>
5423		- <option value="desc" <?php selected( $auth_settings_option, 'desc' ); ?>><?php esc_html_e( 'Descending', 'authorizer' ); ?></option>
5424		- </select>
5425		- <?php
5426		- }
5427		-
5428		-
5429		- /**
5430		- * Settings print callback.
5431		- *
5432		- * @param string $args Args (e.g., multisite admin mode).
5433		- * @return void
5434		- */
5435		- public function print_checkbox_auth_advanced_widget_enabled( $args = '' ) {
5436		- // Get plugin option.
5437		- $option = 'advanced_widget_enabled';
5438		- $auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5439		-
5440		- // Print option elements.
5441		- ?>
5442		- <input type="checkbox" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="1"<?php checked( 1 === intval( $auth_settings_option ) ); ?> /><label for="auth_settings_<?php echo esc_attr( $option ); ?>"><?php esc_html_e( 'Show Dashboard Widget', 'authorizer' ); ?></label>
5443		- <p><small><?php esc_html_e( 'Note: Only users with the create_users capability will be able to see the dashboard widget.', 'authorizer' ); ?></small></p>
5444		- <?php
5445		- }
5446		-
5447		-
5448		- /**
5449		- * Settings print callback.
5450		- *
5451		- * @param string $args Args (e.g., multisite admin mode).
5452		- * @return void
5453		- */
5454		- public function print_checkbox_auth_advanced_override_multisite( $args = '' ) {
5455		- // Get plugin option.
5456		- $option = 'advanced_override_multisite';
	4096	+ $option = 'advanced_override_multisite';
5457	4097	$auth_settings_option = $this->get_plugin_option( $option );
5458	4098
5459	4099	// Print option elements.
5460		- ?>
5461		- <input type="checkbox" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="1"<?php checked( 1 === intval( $auth_settings_option ) ); ?> /><label for="auth_settings_<?php echo esc_attr( $option ); ?>"><?php esc_html_e( "Configure this site independently (don't inherit any multisite settings)", 'authorizer' ); ?></label>
5462		- <?php
	4100	+ ?><input type="checkbox" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="1"<?php checked( 1 == $auth_settings_option ); ?> /><label for="auth_settings_<?php echo $option; ?>"><?php _e( "Configure this site independently (don't inherit any multisite settings)", 'authorizer' ); ?></label><?php
5463	4101	}
5464	4102
5465	4103
5466	4104
5467	4105	/**
5468		- * Determines whether we are in single site or multisite admin context.
5469		- *
5470		- * @param string $args Args (e.g., multisite admin mode).
5471		- * @return int Current mode.
5472		- */
5473		- private function get_admin_mode( $args ) {
5474		- if ( is_array( $args ) && array_key_exists( WP_Plugin_Authorizer::NETWORK_CONTEXT, $args ) && true === $args[ WP_Plugin_Authorizer::NETWORK_CONTEXT ] ) {
5475		- return WP_Plugin_Authorizer::NETWORK_CONTEXT;
5476		- } else {
5477		- return WP_Plugin_Authorizer::SINGLE_CONTEXT;
5478		- }
5479		- }
5480		-
5481		-
5482		- /**
5483	4106	* Add help documentation to the options page.
5484		- *
5485		- * Action: load-settings_page_authorizer > admin_head
	4107	+ * Run on action hook chain: load-settings_page_authorizer > admin_head
5486	4108	*/
5487	4109	public function admin_head() {
5488	4110	$screen = get_current_screen();
5489	4111
5490		- // Add help tab for Access Lists Settings.
	4112	+ // Add help tab for Access Lists Settings
5491	4113	$help_auth_settings_access_lists_content = '
5492		- <p>' . __( "<strong>Pending Users</strong>: Pending users are users who have successfully logged in to the site, but who haven't yet been approved (or blocked) by you.", 'authorizer' ) . '</p>
5493		- <p>' . __( '<strong>Approved Users</strong>: Approved users have access to the site once they successfully log in.', 'authorizer' ) . '</p>
5494		- <p>' . __( '<strong>Blocked Users</strong>: Blocked users will receive an error message when they try to visit the site after authenticating.', 'authorizer' ) . '</p>
5495		- <p>' . __( 'Users in the <strong>Pending</strong> list appear automatically after a new user tries to log in from the configured external authentication service. You can add users to the <strong>Approved</strong> or <strong>Blocked</strong> lists by typing them in manually, or by clicking the <em>Approve</em> or <em>Block</em> buttons next to a user in the <strong>Pending</strong> list.', 'authorizer' ) . '</p>
	4114	+ <p>' . __( "<strong>Pending Users</strong>: Pending users are users who have successfully logged in to the site, but who haven't yet been approved (or blocked) by you.", 'authorizer' ) .'</p>
	4115	+ <p>' . __( "<strong>Approved Users</strong>: Approved users have access to the site once they successfully log in.", 'authorizer' ) . '</p>
	4116	+ <p>' . __( "<strong>Blocked Users</strong>: Blocked users will receive an error message when they try to visit the site after authenticating.", 'authorizer' ) . '</p>
	4117	+ <p>' . __( "Users in the <strong>Pending</strong> list appear automatically after a new user tries to log in from the configured external authentication service. You can add users to the <strong>Approved</strong> or <strong>Blocked</strong> lists by typing them in manually, or by clicking the <em>Approve</em> or <em>Block</em> buttons next to a user in the <strong>Pending</strong> list.", 'authorizer' ) . '</p>
5496	4118	';
5497	4119	$screen->add_help_tab(
5498	4120	array(
5499		- 'id' => 'help_auth_settings_access_lists_content',
5500		- 'title' => __( 'Access Lists', 'authorizer' ),
	4121	+ 'id' => 'help_auth_settings_access_lists_content',
	4122	+ 'title' => __( 'Access Lists', 'authorizer' ),
5501	4123	'content' => $help_auth_settings_access_lists_content,
5502	4124	)
5503	4125	);
5504	4126
5505		- // Add help tab for Login Access Settings.
	4127	+ // Add help tab for Login Access Settings
5506	4128	$help_auth_settings_access_login_content = '
5507	4129	<p>' . __( "<strong>Who can log in to the site?</strong>: Choose the level of access restriction you'd like to use on your site here. You can leave the site open to anyone with a WordPress account or an account on an external service like Google, CAS, or LDAP, or restrict it to WordPress users and only the external users that you specify via the <em>Access Lists</em>.", 'authorizer' ) . '</p>
5508	4130	<p>' . __( "<strong>Which role should receive email notifications about pending users?</strong>: If you've restricted access to <strong>approved users</strong>, you can determine which WordPress users will receive a notification email everytime a new external user successfully logs in and is added to the pending list. All users of the specified role will receive an email, and the external user will get a message (specified below) telling them their access is pending approval.", 'authorizer' ) . '</p>
5509	4131	<p>' . __( '<strong>What message should pending users see after attempting to log in?</strong>: Here you can specify the exact message a new external user will see once they try to log in to the site for the first time.', 'authorizer' ) . '</p>
		@@ -5509,84 +4131,84 @@
5509	4131	<p>' . __( '<strong>What message should pending users see after attempting to log in?</strong>: Here you can specify the exact message a new external user will see once they try to log in to the site for the first time.', 'authorizer' ) . '</p>
5510	4132	';
5511	4133	$screen->add_help_tab(
5512	4134	array(
5513		- 'id' => 'help_auth_settings_access_login_content',
5514		- 'title' => __( 'Login Access', 'authorizer' ),
	4135	+ 'id' => 'help_auth_settings_access_login_content',
	4136	+ 'title' => __( 'Login Access', 'authorizer' ),
5515	4137	'content' => $help_auth_settings_access_login_content,
5516	4138	)
5517	4139	);
5518	4140
5519		- // Add help tab for Public Access Settings.
	4141	+ // Add help tab for Public Access Settings
5520	4142	$help_auth_settings_access_public_content = '
5521	4143	<p>' . __( "<strong>Who can view the site?</strong>: You can restrict the site's visibility by only allowing logged in users to see pages. If you do so, you can customize the specifics about the site's privacy using the settings below.", 'authorizer' ) . '</p>
5522	4144	<p>' . __( "<strong>What pages (if any) should be available to everyone?</strong>: If you'd like to declare certain pages on your site as always public (such as the course syllabus, introduction, or calendar), specify those pages here. These pages will always be available no matter what access restrictions exist.", 'authorizer' ) . '</p>
5523		- <p>' . __( '<strong>What happens to people without access when they visit a <em>private</em> page?</strong>: Choose the response anonymous users receive when visiting the site. You can choose between immediately taking them to the <strong>login screen</strong>, or simply showing them a <strong>message</strong>.', 'authorizer' ) . '</p>
5524		- <p>' . __( '<strong>What happens to people without access when they visit a <em>public</em> page?</strong>: Choose the response anonymous users receive when visiting a page on the site marked as public. You can choose between showing them the page without any message, or showing them a the page with a message above the content.', 'authorizer' ) . '</p>
5525		- <p>' . __( '<strong>What message should people without access see?</strong>: If you chose to show new users a <strong>message</strong> above, type that message here.', 'authorizer' ) . '</p>
	4145	+ <p>' . __( "<strong>What happens to people without access when they visit a <em>private</em> page?</strong>: Choose the response anonymous users receive when visiting the site. You can choose between immediately taking them to the <strong>login screen</strong>, or simply showing them a <strong>message</strong>.", 'authorizer' ) . '</p>
	4146	+ <p>' . __( "<strong>What happens to people without access when they visit a <em>public</em> page?</strong>: Choose the response anonymous users receive when visiting a page on the site marked as public. You can choose between showing them the page without any message, or showing them a the page with a message above the content.", 'authorizer' ) . '</p>
	4147	+ <p>' . __( "<strong>What message should people without access see?</strong>: If you chose to show new users a <strong>message</strong> above, type that message here.", 'authorizer' ) . '</p>
5526	4148	';
5527	4149	$screen->add_help_tab(
5528	4150	array(
5529		- 'id' => 'help_auth_settings_access_public_content',
5530		- 'title' => __( 'Public Access', 'authorizer' ),
	4151	+ 'id' => 'help_auth_settings_access_public_content',
	4152	+ 'title' => __( 'Public Access', 'authorizer' ),
5531	4153	'content' => $help_auth_settings_access_public_content,
5532	4154	)
5533	4155	);
5534	4156
5535		- // Add help tab for External Service (CAS, LDAP) Settings.
	4157	+ // Add help tab for External Service (CAS, LDAP) Settings
5536	4158	$help_auth_settings_external_content = '
5537	4159	<p>' . __( "<strong>Type of external service to authenticate against</strong>: Choose which authentication service type you will be using. You'll have to fill out different fields below depending on which service you choose.", 'authorizer' ) . '</p>
5538		- <p>' . __( '<strong>Enable Google Logins</strong>: Choose if you want to allow users to log in with their Google Account credentials. You will need to enter your API Client ID and Secret to enable Google Logins.', 'authorizer' ) . '</p>
5539		- <p>' . __( '<strong>Enable CAS Logins</strong>: Choose if you want to allow users to log in with via CAS (Central Authentication Service). You will need to enter details about your CAS server (host, port, and path) to enable CAS Logins.', 'authorizer' ) . '</p>
5540		- <p>' . __( '<strong>Enable LDAP Logins</strong>: Choose if you want to allow users to log in with their LDAP (Lightweight Directory Access Protocol) credentials. You will need to enter details about your LDAP server (host, port, search base, uid attribute, directory user, directory user password, and whether to use TLS) to enable Google Logins.', 'authorizer' ) . '</p>
5541		- <p>' . __( '<strong>Default role for new CAS users</strong>: Specify which role new external users will get by default. Be sure to choose a role with limited permissions!', 'authorizer' ) . '</p>
5542		- <p><strong><em>' . __( 'If you enable Google logins:', 'authorizer' ) . '</em></strong></p>
	4160	+ <p>' . __( "<strong>Enable Google Logins</strong>: Choose if you want to allow users to log in with their Google Account credentials. You will need to enter your API Client ID and Secret to enable Google Logins.", 'authorizer' ) . '</p>
	4161	+ <p>' . __( "<strong>Enable CAS Logins</strong>: Choose if you want to allow users to log in with via CAS (Central Authentication Service). You will need to enter details about your CAS server (host, port, and path) to enable CAS Logins.", 'authorizer' ) . '</p>
	4162	+ <p>' . __( "<strong>Enable LDAP Logins</strong>: Choose if you want to allow users to log in with their LDAP (Lightweight Directory Access Protocol) credentials. You will need to enter details about your LDAP server (host, port, search base, uid attribute, directory user, directory user password, and whether to use TLS) to enable Google Logins.", 'authorizer' ) . '</p>
	4163	+ <p>' . __( "<strong>Default role for new CAS users</strong>: Specify which role new external users will get by default. Be sure to choose a role with limited permissions!", 'authorizer' ) . '</p>
	4164	+ <p><strong><em>' . __( "If you enable Google logins:", 'authorizer' ) . '</em></strong></p>
5543	4165	<ul>
5544	4166	<li>' . __( "<strong>Google Client ID</strong>: You can generate this ID by creating a new Project in the <a href='https://cloud.google.com/console'>Google Developers Console</a>. A Client ID typically looks something like this: 1234567890123-kdjr85yt6vjr6d8g7dhr8g7d6durjf7g.apps.googleusercontent.com", 'authorizer' ) . '</li>
5545	4167	<li>' . __( "<strong>Google Client Secret</strong>: You can generate this secret by creating a new Project in the <a href='https://cloud.google.com/console'>Google Developers Console</a>. A Client Secret typically looks something like this: sDNgX5_pr_5bly-frKmvp8jT", 'authorizer' ) . '</li>
5546	4168	</ul>
5547		- <p><strong><em>' . __( 'If you enable CAS logins:', 'authorizer' ) . '</em></strong></p>
	4169	+ <p><strong><em>' . __( "If you enable CAS logins:", 'authorizer' ) . '</em></strong></p>
5548	4170	<ul>
5549		- <li>' . __( '<strong>CAS server hostname</strong>: Enter the hostname of the CAS server you authenticate against (e.g., authn.example.edu).', 'authorizer' ) . '</li>
5550		- <li>' . __( '<strong>CAS server port</strong>: Enter the port on the CAS server to connect to (e.g., 443).', 'authorizer' ) . '</li>
5551		- <li>' . __( '<strong>CAS server path/context</strong>: Enter the path to the login endpoint on the CAS server (e.g., /cas).', 'authorizer' ) . '</li>
	4171	+ <li>' . __( "<strong>CAS server hostname</strong>: Enter the hostname of the CAS server you authenticate against (e.g., authn.example.edu).", 'authorizer' ) . '</li>
	4172	+ <li>' . __( "<strong>CAS server port</strong>: Enter the port on the CAS server to connect to (e.g., 443).", 'authorizer' ) . '</li>
	4173	+ <li>' . __( "<strong>CAS server path/context</strong>: Enter the path to the login endpoint on the CAS server (e.g., /cas).", 'authorizer' ) . '</li>
5552	4174	<li>' . __( "<strong>CAS attribute containing first name</strong>: Enter the CAS attribute that has the user's first name. When this user first logs in, their WordPress account will have their first name retrieved from CAS and added to their WordPress profile.", 'authorizer' ) . '</li>
5553	4175	<li>' . __( "<strong>CAS attribute containing last name</strong>: Enter the CAS attribute that has the user's last name. When this user first logs in, their WordPress account will have their last name retrieved from CAS and added to their WordPress profile.", 'authorizer' ) . '</li>
5554		- <li>' . __( '<strong>CAS attribute update</strong>: Select whether the first and last names retrieved from CAS should overwrite any value the user has entered in the first and last name fields in their WordPress profile. If this is not set, this only happens the first time they log in.', 'authorizer' ) . '</li>
	4176	+ <li>' . __( "<strong>CAS attribute update</strong>: Select whether the first and last names retrieved from CAS should overwrite any value the user has entered in the first and last name fields in their WordPress profile. If this is not set, this only happens the first time they log in.", 'authorizer' ) . '</li>
5555	4177	</ul>
5556		- <p><strong><em>' . __( 'If you enable LDAP logins:', 'authorizer' ) . '</em></strong></p>
	4178	+ <p><strong><em>' . __( "If you enable LDAP logins:", 'authorizer' ) . '</em></strong></p>
5557	4179	<ul>
5558		- <li>' . __( '<strong>LDAP Host</strong>: Enter the URL of the LDAP server you authenticate against.', 'authorizer' ) . '</li>
5559		- <li>' . __( '<strong>LDAP Port</strong>: Enter the port number that the LDAP server listens on.', 'authorizer' ) . '</li>
5560		- <li>' . __( '<strong>LDAP Search Base</strong>: Enter the LDAP string that represents the search base, e.g., ou=people,dc=example,dc=edu', 'authorizer' ) . '</li>
5561		- <li>' . __( '<strong>LDAP attribute containing username</strong>: Enter the name of the LDAP attribute that contains the usernames used by those attempting to log in. The plugin will search on this attribute to find the cn to bind against for login attempts.', 'authorizer' ) . '</li>
5562		- <li>' . __( '<strong>LDAP Directory User</strong>: Enter the name of the LDAP user that has permissions to browse the directory.', 'authorizer' ) . '</li>
5563		- <li>' . __( '<strong>LDAP Directory User Password</strong>: Enter the password for the LDAP user that has permission to browse the directory.', 'authorizer' ) . '</li>
5564		- <li>' . __( '<strong>Use TLS</strong>: Select whether all communication with the LDAP server should be performed over a TLS-secured connection.', 'authorizer' ) . '</li>
	4180	+ <li>' . __( "<strong>LDAP Host</strong>: Enter the URL of the LDAP server you authenticate against.", 'authorizer' ) . '</li>
	4181	+ <li>' . __( "<strong>LDAP Port</strong>: Enter the port number that the LDAP server listens on.", 'authorizer' ) . '</li>
	4182	+ <li>' . __( "<strong>LDAP Search Base</strong>: Enter the LDAP string that represents the search base, e.g., ou=people,dc=example,dc=edu", 'authorizer' ) . '</li>
	4183	+ <li>' . __( "<strong>LDAP attribute containing username</strong>: Enter the name of the LDAP attribute that contains the usernames used by those attempting to log in. The plugin will search on this attribute to find the cn to bind against for login attempts.", 'authorizer' ) . '</li>
	4184	+ <li>' . __( "<strong>LDAP Directory User</strong>: Enter the name of the LDAP user that has permissions to browse the directory.", 'authorizer' ) . '</li>
	4185	+ <li>' . __( "<strong>LDAP Directory User Password</strong>: Enter the password for the LDAP user that has permission to browse the directory.", 'authorizer' ) . '</li>
	4186	+ <li>' . __( "<strong>Secure Connection (TLS)</strong>: Select whether all communication with the LDAP server should be performed over a TLS-secured connection.", 'authorizer' ) . '</li>
5565	4187	<li>' . __( "<strong>Custom lost password URL</strong>: The WordPress login page contains a link to recover a lost password. If you have external users who shouldn't change the password on their WordPress account, point them to the appropriate location to change the password on their external authentication service here.", 'authorizer' ) . '</li>
5566	4188	<li>' . __( "<strong>LDAP attribute containing first name</strong>: Enter the LDAP attribute that has the user's first name. When this user first logs in, their WordPress account will have their first name retrieved from LDAP and added to their WordPress profile.", 'authorizer' ) . '</li>
5567	4189	<li>' . __( "<strong>LDAP attribute containing last name</strong>: Enter the LDAP attribute that has the user's last name. When this user first logs in, their WordPress account will have their last name retrieved from LDAP and added to their WordPress profile.", 'authorizer' ) . '</li>
5568		- <li>' . __( '<strong>LDAP attribute update</strong>: Select whether the first and last names retrieved from LDAP should overwrite any value the user has entered in the first and last name fields in their WordPress profile. If this is not set, this only happens the first time they log in.', 'authorizer' ) . '</li>
	4190	+ <li>' . __( "<strong>LDAP attribute update</strong>: Select whether the first and last names retrieved from LDAP should overwrite any value the user has entered in the first and last name fields in their WordPress profile. If this is not set, this only happens the first time they log in.", 'authorizer' ) . '</li>
5569	4191	</ul>
5570	4192	';
5571	4193	$screen->add_help_tab(
5572	4194	array(
5573		- 'id' => 'help_auth_settings_external_content',
5574		- 'title' => __( 'External Service', 'authorizer' ),
	4195	+ 'id' => 'help_auth_settings_external_content',
	4196	+ 'title' => __( 'External Service', 'authorizer' ),
5575	4197	'content' => $help_auth_settings_external_content,
5576	4198	)
5577	4199	);
5578	4200
5579		- // Add help tab for Advanced Settings.
	4201	+ // Add help tab for Advanced Settings
5580	4202	$help_auth_settings_advanced_content = '
5581		- <p>' . __( '<strong>Limit invalid login attempts</strong>: Choose how soon (and for how long) to restrict access to individuals (or bots) making repeated invalid login attempts. You may set a shorter delay first, and then a longer delay after repeated invalid attempts; you may also set how much time must pass before the delays will be reset to normal.', 'authorizer' ) . '</p>
5582		- <p>' . __( '<strong>Hide WordPress Logins</strong>: If you want to hide the WordPress username and password fields and the Log In button on the wp-login screen, enable this option. Note: You can always access the WordPress logins by adding external=wordpress to the wp-login URL, like so:', 'authorizer' ) . ' <a href="' . wp_login_url() . '?external=wordpress" target="_blank">' . wp_login_url() . '?external=wordpress</a>.</p>
	4203	+ <p>' . __( "<strong>Limit invalid login attempts</strong>: Choose how soon (and for how long) to restrict access to individuals (or bots) making repeated invalid login attempts. You may set a shorter delay first, and then a longer delay after repeated invalid attempts; you may also set how much time must pass before the delays will be reset to normal.", 'authorizer' ) . '</p>
	4204	+ <p>' . __( "<strong>Hide WordPress Logins</strong>: If you want to hide the WordPress username and password fields and the Log In button on the wp-login screen, enable this option. Note: You can always access the WordPress logins by adding external=wordpress to the wp-login URL, like so:", 'authorizer' ) . ' <a href="' . wp_login_url() . '?external=wordpress" target="_blank">' . wp_login_url() . '?external=wordpress</a>.</p>
5583	4205	<p>' . __( "<strong>Custom WordPress login branding</strong>: If you'd like to use custom branding on the WordPress login page, select that here. You will need to use the `authorizer_add_branding_option` filter in your theme to add it. You can see an example theme that implements this filter in the plugin directory under sample-theme-add-branding.", 'authorizer' ) . '</p>
5584	4206	';
5585	4207	$screen->add_help_tab(
5586	4208	array(
5587		- 'id' => 'help_auth_settings_advanced_content',
5588		- 'title' => __( 'Advanced', 'authorizer' ),
	4209	+ 'id' => 'help_auth_settings_advanced_content',
	4210	+ 'title' => __( 'Advanced', 'authorizer' ),
5589	4211	'content' => $help_auth_settings_advanced_content,
5590	4212	)
5591	4213	);
5592	4214	}
		@@ -5601,66 +4223,65 @@
5601	4223
5602	4224
5603	4225	/**
5604	4226	* Network Admin menu item
	4227	+ * Hook: network_admin_menu
5605	4228	*
5606		- * Action: network_admin_menu
5607		- *
	4229	+ * @param none
5608	4230	* @return void
5609	4231	*/
5610	4232	public function network_admin_menu() {
5611	4233	// @see http://codex.wordpress.org/Function_Reference/add_menu_page
5612	4234	add_menu_page(
5613		- 'Authorizer',
5614		- 'Authorizer',
5615		- 'manage_network_options',
5616		- 'authorizer',
	4235	+ 'Authorizer', // Page title
	4236	+ 'Authorizer', // Menu title
	4237	+ 'manage_network_options', // Capability
	4238	+ 'authorizer', // Menu slug
5617	4239	array( $this, 'create_network_admin_page' ),
5618		- 'dashicons-groups',
5619		- 89 // Position.
	4240	+ 'dashicons-groups', // Icon URL
	4241	+ 89 // Position
5620	4242	);
5621	4243	}
5622	4244
5623	4245
5624	4246	/**
5625		- * Output the HTML for the options page.
	4247	+ * Output the HTML for the options page
5626	4248	*/
5627	4249	public function create_network_admin_page() {
5628	4250	if ( ! current_user_can( 'manage_network_options' ) ) {
5629		- wp_die( wp_kses( __( 'You do not have sufficient permissions to access this page.', 'authorizer' ), $this->allowed_html ) );
	4251	+ wp_die( __( 'You do not have sufficient permissions to access this page.', 'authorizer' ) );
5630	4252	}
5631		- $auth_settings = get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings', array() );
5632		- ?>
	4253	+ $auth_settings = get_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings', array() ); ?>
5633	4254	<div class="wrap">
5634	4255	<form method="post" action="" autocomplete="off">
5635		- <h2><?php esc_html_e( 'Authorizer Settings', 'authorizer' ); ?></h2>
5636		- <p><?php echo wp_kses( __( 'Most <strong>Authorizer</strong> settings are set in the individual sites, but you can specify a few options here that apply to <strong>all sites in the network</strong>. These settings will override settings in the individual sites.', 'authorizer' ), $this->allowed_html ); ?></p>
	4256	+ <h2><?php _e( 'Authorizer Settings', 'authorizer' ); ?></h2>
	4257	+ <p><?php _e( 'Most <strong>Authorizer</strong> settings are set in the individual sites, but you can specify a few options here that apply to <strong>all sites in the network</strong>. These settings will override settings in the individual sites.', 'authorizer' ); ?></p>
5637	4258
5638		- <input type="checkbox" id="auth_settings_multisite_override" name="auth_settings[multisite_override]" value="1"<?php checked( 1 === intval( $auth_settings['multisite_override'] ) ); ?> /><label for="auth_settings_multisite_override"><?php esc_html_e( 'Override individual site settings with the settings below', 'authorizer' ); ?></label>
	4259	+ <input type="checkbox" id="auth_settings_multisite_override" name="auth_settings[multisite_override]" value="1"<?php checked( 1 == $auth_settings['multisite_override'] ); ?> /><label for="auth_settings_multisite_override"><?php _e( 'Override individual site settings with the settings below', 'authorizer' ); ?></label>
5639	4260
5640	4261	<div id="auth_multisite_settings_disabled_overlay" style="display: none;"></div>
5641	4262
5642	4263	<div class="wrap" id="auth_multisite_settings">
5643		- <?php $this->print_section_info_tabs( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?>
	4264	+ <?php $this->print_section_info_tabs( array( MULTISITE_ADMIN => true ) ); ?>
5644	4265
5645	4266	<?php wp_nonce_field( 'save_auth_settings', 'nonce_save_auth_settings' ); ?>
5646	4267
5647		- <?php // Custom access lists (for network, we only really want approved list, not pending or blocked). ?>
	4268	+ <?php // Custom access lists (for network, we only really want approved list, not pending or blocked) ?>
5648	4269	<div id="section_info_access_lists" class="section_info">
5649		- <p><?php esc_html_e( 'Manage who has access to all sites in the network.', 'authorizer' ); ?></p>
	4270	+ <p><?php _e( 'Manage who has access to all sites in the network.', 'authorizer' ); ?></p>
5650	4271	</div>
5651	4272	<table class="form-table"><tbody>
5652	4273	<tr>
5653		- <th scope="row"><?php esc_html_e( 'Who can log in to sites in this network?', 'authorizer' ); ?></th>
5654		- <td><?php $this->print_radio_auth_access_who_can_login( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4274	+ <th scope="row"><?php _e( 'Who can log in to sites in this network?', 'authorizer' ); ?></th>
	4275	+ <td><?php $this->print_radio_auth_access_who_can_login( array( MULTISITE_ADMIN => true ) ); ?></td>
5655	4276	</tr>
5656	4277	<tr>
5657		- <th scope="row"><?php esc_html_e( 'Who can view sites in this network?', 'authorizer' ); ?></th>
5658		- <td><?php $this->print_radio_auth_access_who_can_view( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4278	+ <th scope="row"><?php _e( 'Who can view sites in this network?', 'authorizer' ); ?></th>
	4279	+ <td><?php $this->print_radio_auth_access_who_can_view( array( MULTISITE_ADMIN => true ) ); ?></td>
5659	4280	</tr>
5660	4281	<tr>
5661		- <th scope="row"><?php esc_html_e( 'Approved Users (All Sites)', 'authorizer' ); ?><br /><small><em><?php echo wp_kses( __( 'Note: these users will <strong>not</strong> receive welcome emails when approved. Only users approved from individual sites can receive these messages.', 'authorizer' ), $this->allowed_html ); ?></em></small></th>
5662		- <td><?php $this->print_combo_auth_access_users_approved( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4282	+ <th scope="row"><?php _e( 'Approved Users (All Sites)', 'authorizer' ); ?><br /><small><em><?php _e( 'Note: these users will <strong>not</strong> receive welcome emails when approved. Only users approved from individual sites can receive these messages.', 'authorizer' ); ?></em></small></th>
	4283	+ <td><?php $this->print_combo_auth_access_users_approved( array( MULTISITE_ADMIN => true ) ); ?></td>
5663	4284	</tr>
5664	4285	</tbody></table>
5665	4286
5666	4287	<?php $this->print_section_info_external(); ?>
		@@ -5665,160 +4286,140 @@
5665	4286
5666	4287	<?php $this->print_section_info_external(); ?>
5667	4288	<table class="form-table"><tbody>
5668	4289	<tr>
5669		- <th scope="row"><?php esc_html_e( 'Default role for new users', 'authorizer' ); ?></th>
5670		- <td><?php $this->print_select_auth_access_default_role( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4290	+ <th scope="row"><?php _e( 'Default role for new users', 'authorizer' ); ?></th>
	4291	+ <td><?php $this->print_select_auth_access_default_role( array( MULTISITE_ADMIN => true ) ); ?></td>
5671	4292	</tr>
5672	4293	<tr>
5673		- <th scope="row"><?php esc_html_e( 'Google Logins', 'authorizer' ); ?></th>
5674		- <td><?php $this->print_checkbox_auth_external_google( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4294	+ <th scope="row"><?php _e( 'Google Logins', 'authorizer' ); ?></th>
	4295	+ <td><?php $this->print_checkbox_auth_external_google( array( MULTISITE_ADMIN => true ) ); ?></td>
5675	4296	</tr>
5676	4297	<tr>
5677		- <th scope="row"><?php esc_html_e( 'Google Client ID', 'authorizer' ); ?></th>
5678		- <td><?php $this->print_text_google_clientid( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4298	+ <th scope="row"><?php _e( 'Google Client ID', 'authorizer' ); ?></th>
	4299	+ <td><?php $this->print_text_google_clientid( array( MULTISITE_ADMIN => true ) ); ?></td>
5679	4300	</tr>
5680	4301	<tr>
5681		- <th scope="row"><?php esc_html_e( 'Google Client Secret', 'authorizer' ); ?></th>
5682		- <td><?php $this->print_text_google_clientsecret( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4302	+ <th scope="row"><?php _e( 'Google Client Secret', 'authorizer' ); ?></th>
	4303	+ <td><?php $this->print_text_google_clientsecret( array( MULTISITE_ADMIN => true ) ); ?></td>
5683	4304	</tr>
5684	4305	<tr>
5685		- <th scope="row"><?php esc_html_e( 'Google Hosted Domain', 'authorizer' ); ?></th>
5686		- <td><?php $this->print_text_google_hosteddomain( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4306	+ <th scope="row"><?php _e( 'Google Hosted Domain', 'authorizer' ); ?></th>
	4307	+ <td><?php $this->print_text_google_hosteddomain( array( MULTISITE_ADMIN => true ) ); ?></td>
5687	4308	</tr>
5688	4309	<tr>
5689		- <th scope="row"><?php esc_html_e( 'CAS Logins', 'authorizer' ); ?></th>
5690		- <td><?php $this->print_checkbox_auth_external_cas( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4310	+ <th scope="row"><?php _e( 'CAS Logins', 'authorizer' ); ?></th>
	4311	+ <td><?php $this->print_checkbox_auth_external_cas( array( MULTISITE_ADMIN => true ) ); ?></td>
5691	4312	</tr>
5692	4313	<tr>
5693		- <th scope="row"><?php esc_html_e( 'CAS Custom Label', 'authorizer' ); ?></th>
5694		- <td><?php $this->print_text_cas_custom_label( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4314	+ <th scope="row"><?php _e( 'CAS Custom Label', 'authorizer' ); ?></th>
	4315	+ <td><?php $this->print_text_cas_custom_label( array( MULTISITE_ADMIN => true ) ); ?></td>
5695	4316	</tr>
5696	4317	<tr>
5697		- <th scope="row"><?php esc_html_e( 'CAS server hostname', 'authorizer' ); ?></th>
5698		- <td><?php $this->print_text_cas_host( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4318	+ <th scope="row"><?php _e( 'CAS server hostname', 'authorizer' ); ?></th>
	4319	+ <td><?php $this->print_text_cas_host( array( MULTISITE_ADMIN => true ) ); ?></td>
5699	4320	</tr>
5700	4321	<tr>
5701		- <th scope="row"><?php esc_html_e( 'CAS server port', 'authorizer' ); ?></th>
5702		- <td><?php $this->print_text_cas_port( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4322	+ <th scope="row"><?php _e( 'CAS server port', 'authorizer' ); ?></th>
	4323	+ <td><?php $this->print_text_cas_port( array( MULTISITE_ADMIN => true ) ); ?></td>
5703	4324	</tr>
5704	4325	<tr>
5705		- <th scope="row"><?php esc_html_e( 'CAS server path/context', 'authorizer' ); ?></th>
5706		- <td><?php $this->print_text_cas_path( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4326	+ <th scope="row"><?php _e( 'CAS server path/context', 'authorizer' ); ?></th>
	4327	+ <td><?php $this->print_text_cas_path( array( MULTISITE_ADMIN => true ) ); ?></td>
5707	4328	</tr>
5708	4329	<tr>
5709		- <th scope="row"><?php esc_html_e( 'CAS server version', 'authorizer' ); ?></th>
5710		- <td><?php $this->print_select_cas_version( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4330	+ <th scope="row"><?php _e( 'CAS server version', 'authorizer' ); ?></th>
	4331	+ <td><?php $this->print_select_cas_version( array( MULTISITE_ADMIN => true ) ); ?></td>
5711	4332	</tr>
5712	4333	<tr>
5713		- <th scope="row"><?php esc_html_e( 'CAS attribute containing email', 'authorizer' ); ?></th>
5714		- <td><?php $this->print_text_cas_attr_email( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4334	+ <th scope="row"><?php _e( 'CAS attribute containing email', 'authorizer' ); ?></th>
	4335	+ <td><?php $this->print_text_cas_attr_email( array( MULTISITE_ADMIN => true ) ); ?></td>
5715	4336	</tr>
5716	4337	<tr>
5717		- <th scope="row"><?php esc_html_e( 'CAS attribute containing first name', 'authorizer' ); ?></th>
5718		- <td><?php $this->print_text_cas_attr_first_name( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4338	+ <th scope="row"><?php _e( 'CAS attribute containing first name', 'authorizer' ); ?></th>
	4339	+ <td><?php $this->print_text_cas_attr_first_name( array( MULTISITE_ADMIN => true ) ); ?></td>
5719	4340	</tr>
5720	4341	<tr>
5721		- <th scope="row"><?php esc_html_e( 'CAS attribute containing last name', 'authorizer' ); ?></th>
5722		- <td><?php $this->print_text_cas_attr_last_name( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4342	+ <th scope="row"><?php _e( 'CAS attribute containing last name', 'authorizer' ); ?></th>
	4343	+ <td><?php $this->print_text_cas_attr_last_name( array( MULTISITE_ADMIN => true ) ); ?></td>
5723	4344	</tr>
5724	4345	<tr>
5725		- <th scope="row"><?php esc_html_e( 'CAS attribute update', 'authorizer' ); ?></th>
5726		- <td><?php $this->print_checkbox_cas_attr_update_on_login( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4346	+ <th scope="row"><?php _e( 'CAS attribute update', 'authorizer' ); ?></th>
	4347	+ <td><?php $this->print_checkbox_cas_attr_update_on_login( array( MULTISITE_ADMIN => true ) ); ?></td>
5727	4348	</tr>
5728	4349	<tr>
5729		- <th scope="row"><?php esc_html_e( 'CAS automatic login', 'authorizer' ); ?></th>
5730		- <td><?php $this->print_checkbox_cas_auto_login( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4350	+ <th scope="row"><?php _e( 'CAS automatic login', 'authorizer' ); ?></th>
	4351	+ <td><?php $this->print_checkbox_cas_auto_login( array( MULTISITE_ADMIN => true ) ); ?></td>
5731	4352	</tr>
5732	4353	<tr>
5733		- <th scope="row"><?php esc_html_e( 'CAS users linked by username', 'authorizer' ); ?></th>
5734		- <td><?php $this->print_checkbox_cas_link_on_username( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4354	+ <th scope="row"><?php _e( 'LDAP Logins', 'authorizer' ); ?></th>
	4355	+ <td><?php $this->print_checkbox_auth_external_ldap( array( MULTISITE_ADMIN => true ) ); ?></td>
5735	4356	</tr>
5736	4357	<tr>
5737		- <th scope="row"><?php esc_html_e( 'LDAP Logins', 'authorizer' ); ?></th>
5738		- <td><?php $this->print_checkbox_auth_external_ldap( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4358	+ <th scope="row"><?php _e( 'LDAP Host', 'authorizer' ); ?></th>
	4359	+ <td><?php $this->print_text_ldap_host( array( MULTISITE_ADMIN => true ) ); ?></td>
5739	4360	</tr>
5740	4361	<tr>
5741		- <th scope="row"><?php esc_html_e( 'LDAP Host', 'authorizer' ); ?></th>
5742		- <td><?php $this->print_text_ldap_host( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4362	+ <th scope="row"><?php _e( 'LDAP Port', 'authorizer' ); ?></th>
	4363	+ <td><?php $this->print_text_ldap_port( array( MULTISITE_ADMIN => true ) ); ?></td>
5743	4364	</tr>
5744	4365	<tr>
5745		- <th scope="row"><?php esc_html_e( 'LDAP Port', 'authorizer' ); ?></th>
5746		- <td><?php $this->print_text_ldap_port( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4366	+ <th scope="row"><?php _e( 'Secure Connection (TLS)', 'authorizer' ); ?></th>
	4367	+ <td><?php $this->print_checkbox_ldap_tls( array( MULTISITE_ADMIN => true ) ); ?></td>
5747	4368	</tr>
5748	4369	<tr>
5749		- <th scope="row"><?php esc_html_e( 'Use TLS', 'authorizer' ); ?></th>
5750		- <td><?php $this->print_checkbox_ldap_tls( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4370	+ <th scope="row"><?php _e( 'LDAP Search Base', 'authorizer' ); ?></th>
	4371	+ <td><?php $this->print_text_ldap_search_base( array( MULTISITE_ADMIN => true ) ); ?></td>
5751	4372	</tr>
5752	4373	<tr>
5753		- <th scope="row"><?php esc_html_e( 'LDAP Search Base', 'authorizer' ); ?></th>
5754		- <td><?php $this->print_text_ldap_search_base( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4374	+ <th scope="row"><?php _e( 'LDAP attribute containing username', 'authorizer' ); ?></th>
	4375	+ <td><?php $this->print_text_ldap_uid( array( MULTISITE_ADMIN => true ) ); ?></td>
5755	4376	</tr>
5756	4377	<tr>
5757		- <th scope="row"><?php esc_html_e( 'LDAP attribute containing username', 'authorizer' ); ?></th>
5758		- <td><?php $this->print_text_ldap_uid( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4378	+ <th scope="row"><?php _e( 'LDAP attribute containing email', 'authorizer' ); ?></th>
	4379	+ <td><?php $this->print_text_ldap_attr_email( array( MULTISITE_ADMIN => true ) ); ?></td>
5759	4380	</tr>
5760	4381	<tr>
5761		- <th scope="row"><?php esc_html_e( 'LDAP attribute containing email', 'authorizer' ); ?></th>
5762		- <td><?php $this->print_text_ldap_attr_email( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4382	+ <th scope="row"><?php _e( 'LDAP Directory User', 'authorizer' ); ?></th>
	4383	+ <td><?php $this->print_text_ldap_user( array( MULTISITE_ADMIN => true ) ); ?></td>
5763	4384	</tr>
5764	4385	<tr>
5765		- <th scope="row"><?php esc_html_e( 'LDAP Directory User', 'authorizer' ); ?></th>
5766		- <td><?php $this->print_text_ldap_user( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4386	+ <th scope="row"><?php _e( 'LDAP Directory User Password', 'authorizer' ); ?></th>
	4387	+ <td><?php $this->print_password_ldap_password( array( MULTISITE_ADMIN => true ) ); ?></td>
5767	4388	</tr>
5768	4389	<tr>
5769		- <th scope="row"><?php esc_html_e( 'LDAP Directory User Password', 'authorizer' ); ?></th>
5770		- <td><?php $this->print_password_ldap_password( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4390	+ <th scope="row"><?php _e( 'Custom lost password URL', 'authorizer' ); ?></th>
	4391	+ <td><?php $this->print_text_ldap_lostpassword_url( array( MULTISITE_ADMIN => true ) ); ?></td>
5771	4392	</tr>
5772	4393	<tr>
5773		- <th scope="row"><?php esc_html_e( 'Custom lost password URL', 'authorizer' ); ?></th>
5774		- <td><?php $this->print_text_ldap_lostpassword_url( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4394	+ <th scope="row"><?php _e( 'LDAP attribute containing first name', 'authorizer' ); ?></th>
	4395	+ <td><?php $this->print_text_ldap_attr_first_name( array( MULTISITE_ADMIN => true ) ); ?></td>
5775	4396	</tr>
5776	4397	<tr>
5777		- <th scope="row"><?php esc_html_e( 'LDAP attribute containing first name', 'authorizer' ); ?></th>
5778		- <td><?php $this->print_text_ldap_attr_first_name( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4398	+ <th scope="row"><?php _e( 'LDAP attribute containing last name', 'authorizer' ); ?></th>
	4399	+ <td><?php $this->print_text_ldap_attr_last_name( array( MULTISITE_ADMIN => true ) ); ?></td>
5779	4400	</tr>
5780	4401	<tr>
5781		- <th scope="row"><?php esc_html_e( 'LDAP attribute containing last name', 'authorizer' ); ?></th>
5782		- <td><?php $this->print_text_ldap_attr_last_name( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4402	+ <th scope="row"><?php _e( 'LDAP attribute update', 'authorizer' ); ?></th>
	4403	+ <td><?php $this->print_checkbox_ldap_attr_update_on_login( array( MULTISITE_ADMIN => true ) ); ?></td>
5783	4404	</tr>
5784		- <tr>
5785		- <th scope="row"><?php esc_html_e( 'LDAP attribute update', 'authorizer' ); ?></th>
5786		- <td><?php $this->print_checkbox_ldap_attr_update_on_login( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
5787		- </tr>
5788	4405	</tbody></table>
5789	4406
5790	4407	<?php $this->print_section_info_advanced(); ?>
5791	4408	<table class="form-table"><tbody>
5792	4409	<tr>
5793		- <th scope="row"><?php esc_html_e( 'Limit invalid login attempts', 'authorizer' ); ?></th>
5794		- <td><?php $this->print_text_auth_advanced_lockouts( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4410	+ <th scope="row"><?php _e( 'Limit invalid login attempts', 'authorizer' ); ?></th>
	4411	+ <td><?php $this->print_text_auth_advanced_lockouts( array( MULTISITE_ADMIN => true ) ); ?></td>
5795	4412	</tr>
5796	4413	<tr>
5797		- <th scope="row"><?php esc_html_e( 'Hide WordPress Logins', 'authorizer' ); ?></th>
5798		- <td><?php $this->print_checkbox_auth_advanced_hide_wp_login( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4414	+ <th scope="row"><?php _e( 'Hide WordPress Logins', 'authorizer' ); ?></th>
	4415	+ <td><?php $this->print_checkbox_auth_advanced_hide_wp_login( array( MULTISITE_ADMIN => true ) ); ?></td>
5799	4416	</tr>
5800		- <tr>
5801		- <th scope="row"><?php esc_html_e( 'Number of users per page', 'authorizer' ); ?></th>
5802		- <td><?php $this->print_text_auth_advanced_users_per_page( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
5803		- </tr>
5804		- <tr>
5805		- <th scope="row"><?php esc_html_e( 'Approved users sort method', 'authorizer' ); ?></th>
5806		- <td><?php $this->print_select_auth_advanced_users_sort_by( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
5807		- </tr>
5808		- <tr>
5809		- <th scope="row"><?php esc_html_e( 'Approved users sort order', 'authorizer' ); ?></th>
5810		- <td><?php $this->print_select_auth_advanced_users_sort_order( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
5811		- </tr>
5812		- <tr>
5813		- <th scope="row"><?php esc_html_e( 'Show Dashboard Widget', 'authorizer' ); ?></th>
5814		- <td><?php $this->print_checkbox_auth_advanced_widget_enabled( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
5815		- </tr>
5816	4417	</tbody></table>
5817	4418
5818	4419	<br class="clear" />
5819	4420	</div>
5820		- <input type="button" name="submit" id="submit" class="button button-primary" value="<?php esc_attr_e( 'Save Changes', 'authorizer' ); ?>" onclick="saveAuthMultisiteSettings(this);" />
	4421	+ <input type="button" name="submit" id="submit" class="button button-primary" value="<?php _e( 'Save Changes', 'authorizer' ); ?>" onclick="save_auth_multisite_settings(this);" />
5821	4422	</form>
5822	4423	</div>
5823	4424	<?php
5824	4425	}
		@@ -5825,12 +4426,10 @@
5825	4426
5826	4427
5827	4428	/**
5828	4429	* Save multisite settings (ajax call).
5829		- *
5830		- * Action: wp_ajax_save_auth_multisite_settings
5831	4430	*/
5832		- public function ajax_save_auth_multisite_settings() {
	4431	+ function ajax_save_auth_multisite_settings() {
5833	4432	// Fail silently if current user doesn't have permissions.
5834	4433	if ( ! current_user_can( 'manage_network_options' ) ) {
5835	4434	die( '' );
5836	4435	}
		@@ -5835,14 +4434,14 @@
5835	4434	die( '' );
5836	4435	}
5837	4436
5838	4437	// Make sure nonce exists.
5839		- if ( empty( $_POST['nonce'] ) ) {
	4438	+ if ( empty( $_POST['nonce_save_auth_settings'] ) ) {
5840	4439	die( '' );
5841	4440	}
5842	4441
5843	4442	// Nonce check.
5844		- if ( ! wp_verify_nonce( sanitize_key( $_POST['nonce'] ), 'save_auth_settings' ) ) {
	4443	+ if ( ! wp_verify_nonce( $_POST['nonce_save_auth_settings'], 'save_auth_settings' ) ) {
5845	4444	die( '' );
5846	4445	}
5847	4446
5848	4447	// Assert multisite.
		@@ -5850,15 +4449,15 @@
5850	4449	die( '' );
5851	4450	}
5852	4451
5853	4452	// Get multisite settings.
5854		- $auth_multisite_settings = get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings', array() );
	4453	+ $auth_multisite_settings = get_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings', array() );
5855	4454
5856		- // Sanitize settings.
	4455	+ // Sanitize settings
5857	4456	$auth_multisite_settings = $this->sanitize_options( $_POST );
5858	4457
5859		- // Filter options to only the allowed values (multisite options are a subset of all options).
5860		- $allowed = array(
	4458	+ // Filter options to only the allowed values (multisite options are a subset of all options)
	4459	+ $allowed = array(
5861	4460	'multisite_override',
5862	4461	'access_who_can_login',
5863	4462	'access_who_can_view',
5864	4463	'access_default_role',
		@@ -5876,9 +4475,8 @@
5876	4475	'cas_attr_first_name',
5877	4476	'cas_attr_last_name',
5878	4477	'cas_attr_update_on_login',
5879	4478	'cas_auto_login',
5880		- 'cas_link_on_username',
5881	4479	'ldap',
5882	4480	'ldap_host',
5883	4481	'ldap_port',
5884	4482	'ldap_tls',
		@@ -5892,17 +4490,13 @@
5892	4490	'ldap_attr_last_name',
5893	4491	'ldap_attr_update_on_login',
5894	4492	'advanced_lockouts',
5895	4493	'advanced_hide_wp_login',
5896		- 'advanced_users_per_page',
5897		- 'advanced_users_sort_by',
5898		- 'advanced_users_sort_order',
5899		- 'advanced_widget_enabled',
5900	4494	);
5901	4495	$auth_multisite_settings = array_intersect_key( $auth_multisite_settings, array_flip( $allowed ) );
5902	4496
5903	4497	// Update multisite settings in database.
5904		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings', $auth_multisite_settings );
	4498	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings', $auth_multisite_settings );
5905	4499
5906	4500	// Return 'success' value to AJAX call.
5907	4501	die( 'success' );
5908	4502	}
		@@ -5916,67 +4510,42 @@
5916	4510	*/
5917	4511
5918	4512
5919	4513
5920		- /**
5921		- * Load Authorizer dashboard widget if it's enabled.
5922		- *
5923		- * Action: wp_dashboard_setup
5924		- */
5925		- public function add_dashboard_widgets() {
5926		- $widget_enabled = $this->get_plugin_option( 'advanced_widget_enabled', WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' ) === '1';
5927		-
5928		- // Load authorizer dashboard widget if it's enabled and user has permission.
5929		- if ( current_user_can( 'create_users' ) && $widget_enabled ) {
5930		- // Add dashboard widget for adding/editing users with access.
	4514	+ function add_dashboard_widgets() {
	4515	+ // Only users who can edit can see the authorizer dashboard widget
	4516	+ if ( current_user_can( 'create_users' ) ) {
	4517	+ // Add dashboard widget for adding/editing users with access
5931	4518	wp_add_dashboard_widget( 'auth_dashboard_widget', __( 'Authorizer Settings', 'authorizer' ), array( $this, 'add_auth_dashboard_widget' ) );
5932	4519	}
5933	4520	}
5934	4521
5935	4522
5936		- /**
5937		- * Render Authorizer dashboard widget (callback).
5938		- */
5939		- public function add_auth_dashboard_widget() {
5940		- ?>
5941		- <form method="post" id="auth_settings_access_form" action="">
	4523	+ function add_auth_dashboard_widget() {
	4524	+ ?><form method="post" id="auth_settings_access_form" action="">
5942	4525	<?php $this->print_section_info_access_login(); ?>
5943	4526	<div>
5944		- <h2><?php esc_html_e( 'Pending Users', 'authorizer' ); ?></h2>
	4527	+ <h2><?php _e( 'Pending Users', 'authorizer' ); ?></h2>
5945	4528	<?php $this->print_combo_auth_access_users_pending(); ?>
5946	4529	</div>
5947	4530	<div>
5948		- <h2><?php esc_html_e( 'Approved Users', 'authorizer' ); ?></h2>
	4531	+ <h2><?php _e( 'Approved Users', 'authorizer' ); ?></h2>
5949	4532	<?php $this->print_combo_auth_access_users_approved(); ?>
5950	4533	</div>
5951	4534	<div>
5952		- <h2><?php esc_html_e( 'Blocked Users', 'authorizer' ); ?></h2>
	4535	+ <h2><?php _e( 'Blocked Users', 'authorizer' ); ?></h2>
5953	4536	<?php $this->print_combo_auth_access_users_blocked(); ?>
5954	4537	</div>
5955	4538	<br class="clear" />
5956		- </form>
5957		- <?php
	4539	+ </form><?php
5958	4540	}
5959	4541
5960	4542
5961		-
5962		- /**
5963		- * ***************************
5964		- * AJAX Actions
5965		- * ***************************
5966		- */
5967		-
5968		-
5969		-
5970		- /**
5971		- * Re-render the Approved User list (usually triggered if pager params have
5972		- * changed, e.g., current page, search term, sort order).
5973		- *
5974		- * Action: wp_ajax_refresh_approved_user_list
5975		- *
5976		- * @return void
5977		- */
5978		- public function ajax_refresh_approved_user_list() {
	4543	+ // Fired on a change event from the optional usermeta field in the
	4544	+ // approved user list. Updates the selected usermeta value, or saves it
	4545	+ // in the user's approved list entry if the user hasn't logged in yet
	4546	+ // and created a WordPress account.
	4547	+ function ajax_update_auth_usermeta() {
5979	4548	// Fail silently if current user doesn't have permissions.
5980	4549	if ( ! current_user_can( 'create_users' ) ) {
5981	4550	die( '' );
5982	4551	}
		@@ -5981,175 +4550,35 @@
5981	4550	die( '' );
5982	4551	}
5983	4552
5984	4553	// Nonce check.
5985		- if ( empty( $_POST['nonce'] ) || ! wp_verify_nonce( sanitize_key( $_POST['nonce'] ), 'save_auth_settings' ) ) {
	4554	+ if ( empty( $_POST['nonce_save_auth_settings'] ) || ! wp_verify_nonce( $_POST['nonce_save_auth_settings'], 'save_auth_settings' ) ) {
5986	4555	die( '' );
5987	4556	}
5988	4557
5989	4558	// Fail if required post data doesn't exist.
5990		- if ( ! array_key_exists( 'paged', $_REQUEST ) ) {
	4559	+ if ( ! array_key_exists( 'email', $_REQUEST ) || ! array_key_exists( 'usermeta', $_REQUEST ) ) {
5991	4560	die( '' );
5992	4561	}
5993	4562
5994		- // Get defaults.
5995		- $success = true;
5996		- $message = '';
5997		- $is_network_admin = isset( $_REQUEST['is_network_admin'] ) && '1' === $_REQUEST['is_network_admin'];
5998		-
5999		- // Get user list.
6000		- $option = 'access_users_approved';
6001		- $admin_mode = is_multisite() && $is_network_admin ? WP_Plugin_Authorizer::NETWORK_CONTEXT : WP_Plugin_Authorizer::SINGLE_CONTEXT;
6002		- $auth_settings_option = $this->get_plugin_option( $option, $admin_mode, 'no override' );
6003		- $auth_settings_option = is_array( $auth_settings_option ) ? $auth_settings_option : array();
6004		-
6005		- // Get multisite approved users (will be added to top of list, greyed out).
6006		- $auth_override_multisite = $this->get_plugin_option( 'advanced_override_multisite' );
6007		- $auth_multisite_settings = $this->get_plugin_options( WP_Plugin_Authorizer::NETWORK_CONTEXT );
6008		- $auth_settings_option_multisite = array();
6009		- if (
6010		- is_multisite() &&
6011		- ! $is_network_admin &&
6012		- 1 !== intval( $auth_override_multisite ) &&
6013		- array_key_exists( 'multisite_override', $auth_multisite_settings ) &&
6014		- '1' === $auth_multisite_settings['multisite_override']
6015		- ) {
6016		- $auth_settings_option_multisite = $this->get_plugin_option( $option, WP_Plugin_Authorizer::NETWORK_CONTEXT, 'allow override' );
6017		- $auth_settings_option_multisite = is_array( $auth_settings_option_multisite ) ? $auth_settings_option_multisite : array();
6018		- // Add multisite users to the beginning of the main user array.
6019		- foreach ( array_reverse( $auth_settings_option_multisite ) as $approved_user ) {
6020		- $approved_user['multisite_user'] = true;
6021		- array_unshift( $auth_settings_option, $approved_user );
6022		- }
6023		- }
6024		-
6025		- // Get custom usermeta field to show.
6026		- $advanced_usermeta = $this->get_plugin_option( 'advanced_usermeta' );
6027		-
6028		- // Filter user list to search terms.
6029		- if ( ! empty( $_REQUEST['search'] ) ) {
6030		- $search_term = sanitize_text_field( wp_unslash( $_REQUEST['search'] ) );
6031		- $auth_settings_option = array_filter(
6032		- $auth_settings_option, function ( $user ) use ( $search_term ) {
6033		- return stripos( $user['email'], $search_term ) !== false ||
6034		- stripos( $user['role'], $search_term ) !== false ||
6035		- stripos( $user['date_added'], $search_term ) !== false;
6036		- }
6037		- );
6038		- }
6039		-
6040		- // Sort user list.
6041		- $sort_by = $this->get_plugin_option( 'advanced_users_sort_by', WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' ); // email, role, date_added (registered), created (date approved).
6042		- $sort_order = $this->get_plugin_option( 'advanced_users_sort_order', WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' ); // asc or desc.
6043		- $sort_dimension = array();
6044		- if ( in_array( $sort_by, array( 'email', 'role', 'date_added' ), true ) ) {
6045		- foreach ( $auth_settings_option as $key => $user ) {
6046		- if ( 'date_added' === $sort_by ) {
6047		- $sort_dimension[ $key ] = date( 'Ymd', strtotime( $user[ $sort_by ] ) );
6048		- } else {
6049		- $sort_dimension[ $key ] = strtolower( $user[ $sort_by ] );
6050		- }
6051		- }
6052		- $sort_order = 'asc' === $sort_order ? SORT_ASC : SORT_DESC;
6053		- array_multisort( $sort_dimension, $sort_order, $auth_settings_option );
6054		- } elseif ( 'created' === $sort_by && 'asc' !== $sort_order ) {
6055		- // If default sort method and reverse order, just reverse the array.
6056		- $auth_settings_option = array_reverse( $auth_settings_option );
6057		- }
6058		-
6059		- // Ensure array keys run from 0..max (keys in database will be the original,
6060		- // index, and removing users will not reorder the array keys of other users).
6061		- $auth_settings_option = array_values( $auth_settings_option );
6062		-
6063		- // Get pager params.
6064		- $total_users = count( $auth_settings_option );
6065		- $users_per_page = intval( $this->get_plugin_option( 'advanced_users_per_page', WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' ) );
6066		- $current_page = isset( $_REQUEST['paged'] ) ? intval( $_REQUEST['paged'] ) : 1;
6067		- $total_pages = ceil( $total_users / $users_per_page );
6068		- if ( $total_pages < 1 ) {
6069		- $total_pages = 1;
6070		- }
6071		-
6072		- // Make sure current_page is between 1 and max pages.
6073		- if ( $current_page < 1 ) {
6074		- $current_page = 1;
6075		- } elseif ( $current_page > $total_pages ) {
6076		- $current_page = $total_pages;
6077		- }
6078		-
6079		- // Render user list.
6080		- ob_start();
6081		- $offset = ( $current_page - 1 ) * $users_per_page;
6082		- $max = min( $offset + $users_per_page, count( $auth_settings_option ) );
6083		- for ( $key = $offset; $key < $max; $key++ ) :
6084		- $approved_user = $auth_settings_option[ $key ];
6085		- if ( empty( $approved_user ) || count( $approved_user ) < 1 ) :
6086		- continue;
6087		- endif;
6088		- $this->render_user_element( $approved_user, $key, $option, $admin_mode, $advanced_usermeta );
6089		- endfor;
6090		-
6091		- // Send response to client.
6092		- $response = array(
6093		- 'success' => $success,
6094		- 'message' => $message,
6095		- 'html' => ob_get_clean(),
6096		- /* TRANSLATORS: %s: number of users */
6097		- 'total_users_html' => sprintf( _n( '%s user', '%s users', $total_users, 'authorizer' ), number_format_i18n( $total_users ) ),
6098		- 'total_pages_html' => number_format_i18n( $total_pages ),
6099		- 'total_pages' => $total_pages,
6100		- );
6101		- header( 'content-type: application/json' );
6102		- echo wp_json_encode( $response );
6103		- exit;
6104		- }
6105		-
6106		-
6107		- /**
6108		- * Fired on a change event from the optional usermeta field in the approved
6109		- * user list. Updates the selected usermeta value, or saves it in the user's
6110		- * approved list entry if the user hasn't logged in yet and created a
6111		- * WordPress account.
6112		- *
6113		- * Action: wp_ajax_update_auth_usermeta
6114		- *
6115		- * @return void
6116		- */
6117		- public function ajax_update_auth_usermeta() {
6118		- // Fail silently if current user doesn't have permissions.
6119		- if ( ! current_user_can( 'create_users' ) ) {
6120		- die( '' );
6121		- }
6122		-
6123		- // Nonce check.
6124		- if ( empty( $_POST['nonce'] ) || ! wp_verify_nonce( sanitize_key( $_POST['nonce'] ), 'save_auth_settings' ) ) {
6125		- die( '' );
6126		- }
6127		-
6128		- // Fail if required post data doesn't exist.
6129		- if ( ! isset( $_REQUEST['email'], $_REQUEST['usermeta'] ) ) {
6130		- die( '' );
6131		- }
6132		-
6133	4563	// Get values to update from post data.
6134		- $email = sanitize_email( wp_unslash( $_REQUEST['email'] ) );
6135		- $meta_value = sanitize_meta( 'authorizer-usermeta', wp_unslash( $_REQUEST['usermeta'] ), 'user' );
6136		- $meta_key = $this->get_plugin_option( 'advanced_usermeta' );
	4564	+ $email = $_REQUEST['email'];
	4565	+ $meta_value = $_REQUEST['usermeta'];
	4566	+ $meta_key = $this->get_plugin_option( 'advanced_usermeta' );
6137	4567
6138	4568	// If user doesn't exist, save usermeta selection to authorizer
6139	4569	// list. This value will get saved to usermeta when the user first
6140	4570	// logs in (i.e., when their WordPress account is created).
6141		- $wp_user = get_user_by( 'email', $email );
6142		- if ( ! $wp_user ) {
	4571	+ if ( ! ( $wp_user = get_user_by( 'email', $email ) ) ) {
6143	4572	// Look through multisite approved users and add a usermeta
6144	4573	// reference for the current blog if the user is found.
6145		- $auth_multisite_settings_access_users_approved = is_multisite() ? get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', array() ) : array();
	4574	+ $auth_multisite_settings_access_users_approved = is_multisite() ? get_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', array() ) : array();
6146	4575	$should_update_auth_multisite_settings_access_users_approved = false;
6147	4576	foreach ( $auth_multisite_settings_access_users_approved as $index => $approved_user ) {
6148		- if ( 0 === strcasecmp( $email, $approved_user['email'] ) ) {
6149		- if ( ! is_array( $auth_multisite_settings_access_users_approved[ $index ]['usermeta'] ) ) {
	4577	+ if ( $email === $approved_user['email'] ) {
	4578	+ if ( ! is_array( $auth_multisite_settings_access_users_approved[$index]['usermeta'] ) ) {
6150	4579	// Initialize the array of usermeta for each blog this user belongs to.
6151		- $auth_multisite_settings_access_users_approved[ $index ]['usermeta'] = array();
	4580	+ $auth_multisite_settings_access_users_approved[$index]['usermeta'] = array();
6152	4581	} else {
6153	4582	// There is already usermeta associated with this
6154	4583	// preapproved user; iterate through it and make
6155	4584	// sure it's not for old meta_keys (delete it if
		@@ -6155,53 +4584,55 @@
6155	4584	// sure it's not for old meta_keys (delete it if
6156	4585	// so). This can happen if someone changes the
6157	4586	// usermeta key in authorizer options, and we don't
6158	4587	// want to hang on to old data.
6159		- foreach ( $auth_multisite_settings_access_users_approved[ $index ]['usermeta'] as $blog_id => $usermeta ) {
	4588	+ foreach ( $auth_multisite_settings_access_users_approved[$index]['usermeta'] as $blog_id => $usermeta ) {
6160	4589	if ( array_key_exists( 'meta_key', $usermeta ) && $usermeta['meta_key'] === $meta_key ) {
6161	4590	continue;
6162	4591	} else {
6163		- unset( $auth_multisite_settings_access_users_approved[ $index ]['usermeta'][ $blog_id ] );
	4592	+ unset( $auth_multisite_settings_access_users_approved[$index]['usermeta'][$blog_id] );
6164	4593	}
6165	4594	}
6166	4595	}
6167		- $auth_multisite_settings_access_users_approved[ $index ]['usermeta'][ get_current_blog_id() ] = array(
6168		- 'meta_key' => $meta_key,
	4596	+ $auth_multisite_settings_access_users_approved[$index]['usermeta'][get_current_blog_id()] = array(
	4597	+ 'meta_key' => $meta_key,
6169	4598	'meta_value' => $meta_value,
6170	4599	);
6171		- $should_update_auth_multisite_settings_access_users_approved = true;
	4600	+ $should_update_auth_multisite_settings_access_users_approved = true;
6172	4601	}
6173	4602	}
6174	4603	if ( $should_update_auth_multisite_settings_access_users_approved ) {
6175		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
	4604	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
6176	4605	}
6177	4606
6178	4607	// Look through the approved users (of the current blog in a
6179	4608	// multisite install, or just of the single site) and add a
6180	4609	// usermeta reference if the user is found.
6181		- $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT );
	4610	+ $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN );
6182	4611	$should_update_auth_settings_access_users_approved = false;
6183	4612	foreach ( $auth_settings_access_users_approved as $index => $approved_user ) {
6184		- if ( 0 === strcasecmp( $email, $approved_user['email'] ) ) {
6185		- $auth_settings_access_users_approved[ $index ]['usermeta'] = array(
6186		- 'meta_key' => $meta_key,
	4613	+ if ( $email === $approved_user['email'] ) {
	4614	+ $auth_settings_access_users_approved[$index]['usermeta'] = array(
	4615	+ 'meta_key' => $meta_key,
6187	4616	'meta_value' => $meta_value,
6188	4617	);
6189		- $should_update_auth_settings_access_users_approved = true;
	4618	+ $should_update_auth_settings_access_users_approved = true;
6190	4619	}
6191	4620	}
6192	4621	if ( $should_update_auth_settings_access_users_approved ) {
6193	4622	update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved );
6194	4623	}
	4624	+
6195	4625	} else {
6196	4626	// Update user's usermeta value for usermeta key stored in authorizer options.
6197	4627	if ( strpos( $meta_key, 'acf___' ) === 0 && class_exists( 'acf' ) ) {
6198	4628	// We have an ACF field value, so use the ACF function to update it.
6199		- update_field( str_replace( 'acf___', '', $meta_key ), $meta_value, 'user_' . $wp_user->ID );
	4629	+ update_field( str_replace('acf___', '', $meta_key ), $meta_value, 'user_' . $wp_user->ID );
6200	4630	} else {
6201	4631	// We have a normal usermeta value, so just update it via the WordPress function.
6202	4632	update_user_meta( $wp_user->ID, $meta_key, $meta_value );
6203	4633	}
	4634	+
6204	4635	}
6205	4636
6206	4637	// Return 'success' value to AJAX call.
6207	4638	die( 'success' );
		@@ -6207,17 +4638,9 @@
6207	4638	die( 'success' );
6208	4639	}
6209	4640
6210	4641
6211		- /**
6212		- * Fired on a change event from the user fields in the user lists. Updates
6213		- * the selected user value.
6214		- *
6215		- * Action: wp_ajax_update_auth_user
6216		- *
6217		- * @return void
6218		- */
6219		- public function ajax_update_auth_user() {
	4642	+ function ajax_update_auth_user() {
6220	4643	// Fail silently if current user doesn't have permissions.
6221	4644	if ( ! current_user_can( 'create_users' ) ) {
6222	4645	die( '' );
6223	4646	}
		@@ -6222,79 +4645,76 @@
6222	4645	die( '' );
6223	4646	}
6224	4647
6225	4648	// Nonce check.
6226		- if ( empty( $_POST['nonce'] ) || ! wp_verify_nonce( sanitize_key( $_POST['nonce'] ), 'save_auth_settings' ) ) {
	4649	+ if ( empty( $_POST['nonce_save_auth_settings'] ) || ! wp_verify_nonce( $_POST['nonce_save_auth_settings'], 'save_auth_settings' ) ) {
6227	4650	die( '' );
6228	4651	}
6229	4652
6230	4653	// Fail if requesting a change to an invalid setting.
6231		- if ( ! isset( $_POST['setting'] ) || ! in_array( wp_unslash( $_POST['setting'] ), array( 'access_users_pending', 'access_users_approved', 'access_users_blocked' ), true ) ) {
	4654	+ if ( ! in_array( $_POST['setting'], array( 'access_users_pending', 'access_users_approved', 'access_users_blocked' ) ) ) {
6232	4655	die( '' );
6233	4656	}
6234	4657
6235		- // Track any emails that couldn't be added (used when adding users).
6236		- $invalid_emails = array();
6237		-
6238	4658	// Editing a pending list entry.
6239		- if ( 'access_users_pending' === $_POST['setting'] ) {
6240		- // Sanitize posted data.
6241		- $access_users_pending = array();
6242		- if ( isset( $_POST['access_users_pending'] ) && is_array( $_POST['access_users_pending'] ) ) {
6243		- $access_users_pending = $this->sanitize_update_auth_users( wp_unslash( $_POST['access_users_pending'] ) );
	4659	+ if ( $_POST['setting'] === 'access_users_pending' ) {
	4660	+ // Initialize posted data if empty.
	4661	+ if ( ! ( array_key_exists( 'access_users_pending', $_POST ) && is_array( $_POST['access_users_pending'] ) ) ) {
	4662	+ $_POST['access_users_pending'] = array();
6244	4663	}
6245	4664
6246	4665	// Deal with each modified user (add or remove).
6247		- foreach ( $access_users_pending as $pending_user ) {
	4666	+ foreach ( $_POST['access_users_pending'] as $pending_user ) {
6248	4667
6249		- if ( 'add' === $pending_user['edit_action'] ) {
	4668	+ if ( $pending_user['edit_action'] === 'add' ) {
6250	4669
6251	4670	// Add new user to pending list and save (skip if it's
6252	4671	// already there--someone else might have just done it).
6253	4672	if ( ! $this->is_email_in_list( $pending_user['email'], 'pending' ) ) {
6254	4673	$auth_settings_access_users_pending = $this->sanitize_user_list(
6255		- $this->get_plugin_option( 'access_users_pending', WP_Plugin_Authorizer::SINGLE_CONTEXT )
	4674	+ $this->get_plugin_option( 'access_users_pending', SINGLE_ADMIN )
6256	4675	);
6257	4676	array_push( $auth_settings_access_users_pending, $pending_user );
6258	4677	update_option( 'auth_settings_access_users_pending', $auth_settings_access_users_pending );
6259	4678	}
6260		- } elseif ( 'remove' === $pending_user['edit_action'] ) {
6261	4679
6262		- // Remove user from pending list and save.
6263		- $auth_settings_access_users_pending = $this->get_plugin_option( 'access_users_pending', WP_Plugin_Authorizer::SINGLE_CONTEXT );
6264		- foreach ( $auth_settings_access_users_pending as $key => $existing_user ) {
6265		- if ( 0 === strcasecmp( $pending_user['email'], $existing_user['email'] ) ) {
6266		- unset( $auth_settings_access_users_pending[ $key ] );
6267		- update_option( 'auth_settings_access_users_pending', $auth_settings_access_users_pending );
6268		- break;
	4680	+ } elseif ( $pending_user['edit_action'] === 'remove' ) {
	4681	+
	4682	+ // Remove user from pending list and save
	4683	+ if ( $this->is_email_in_list( $pending_user['email'], 'pending' ) ) {
	4684	+ $auth_settings_access_users_pending = $this->sanitize_user_list(
	4685	+ $this->get_plugin_option( 'access_users_pending', SINGLE_ADMIN )
	4686	+ );
	4687	+ foreach ( $auth_settings_access_users_pending as $key => $existing_user ) {
	4688	+ if ( $pending_user['email'] == $existing_user['email'] ) {
	4689	+ unset( $auth_settings_access_users_pending[$key] );
	4690	+ break;
	4691	+ }
6269	4692	}
	4693	+ update_option( 'auth_settings_access_users_pending', $auth_settings_access_users_pending );
6270	4694	}
	4695	+
6271	4696	}
6272	4697	}
6273	4698	}
6274	4699
6275	4700	// Editing an approved list entry.
6276		- if ( 'access_users_approved' === $_POST['setting'] ) {
6277		- // Sanitize posted data.
6278		- $access_users_approved = array();
6279		- if ( isset( $_POST['access_users_approved'] ) && is_array( $_POST['access_users_approved'] ) ) {
6280		- $access_users_approved = $this->sanitize_update_auth_users( wp_unslash( $_POST['access_users_approved'] ) );
	4701	+ if ( $_POST['setting'] === 'access_users_approved' ) {
	4702	+ // Initialize posted data if empty.
	4703	+ if ( ! ( array_key_exists( 'access_users_approved', $_POST ) && is_array( $_POST['access_users_approved'] ) ) ) {
	4704	+ $_POST['access_users_approved'] = array();
6281	4705	}
6282	4706
6283	4707	// Deal with each modified user (add, remove, or change_role).
6284		- foreach ( $access_users_approved as $approved_user ) {
6285		- // Skip blank entries.
6286		- if ( strlen( $approved_user['email'] ) < 1 ) {
6287		- continue;
6288		- }
	4708	+ foreach ( $_POST['access_users_approved'] as $approved_user ) {
6289	4709
6290	4710	// New user (create user, or add existing user to current site in multisite).
6291		- if ( 'add' === $approved_user['edit_action'] ) {
	4711	+ if ( $approved_user['edit_action'] === 'add' ) {
6292	4712	$new_user = get_user_by( 'email', $approved_user['email'] );
6293		- if ( false !== $new_user ) {
	4713	+ if ( $new_user !== false ) {
6294	4714	// If we're adding an existing multisite user, make sure their
6295	4715	// newly-assigned role is updated on all sites they are already in.
6296		- if ( is_multisite() && 'false' !== $approved_user['multisite_user'] ) {
	4716	+ if ( is_multisite() && $approved_user['multisite_user'] !== 'false' ) {
6297	4717	foreach ( get_blogs_of_user( $new_user->ID ) as $blog ) {
6298	4718	add_user_to_blog( $blog->userblog_id, $new_user->ID, $approved_user['role'] );
6299	4719	}
6300	4720	}
		@@ -6301,9 +4721,9 @@
6301	4721	// If this user already has an account on another site in the network, add them to this site.
6302	4722	if ( is_multisite() ) {
6303	4723	add_user_to_blog( get_current_blog_id(), $new_user->ID, $approved_user['role'] );
6304	4724	}
6305		- } elseif ( $approved_user['local_user'] && 'false' !== $approved_user['local_user'] ) {
	4725	+ } elseif ( $approved_user['local_user'] === 'true' ) {
6306	4726	// Create a WP account for this new *local* user and email the password.
6307	4727	$plaintext_password = wp_generate_password(); // random password
6308	4728	// If there's already a user with this username (e.g.,
6309	4729	// johndoe/johndoe@gmail.com exists, and we're trying to add
		@@ -6311,26 +4731,26 @@
6311	4731	// as the username.
6312	4732	$username = explode( '@', $approved_user['email'] );
6313	4733	$username = $username[0];
6314	4734	if ( get_user_by( 'login', $username ) !== false ) {
6315		- $username = $this->lowercase( $approved_user['email'] );
	4735	+ $username = $approved_user['email'];
6316	4736	}
6317		- if ( 'false' !== $approved_user['multisite_user'] ) {
	4737	+ if ( $approved_user['multisite_user'] !== 'false' ) {
6318	4738	$result = wpmu_create_user(
6319	4739	strtolower( $username ),
6320	4740	$plaintext_password,
6321		- $this->lowercase( $approved_user['email'] )
	4741	+ strtolower( $approved_user['email'] )
6322	4742	);
6323	4743	} else {
6324	4744	$result = wp_insert_user(
6325	4745	array(
6326		- 'user_login' => strtolower( $username ),
6327		- 'user_pass' => $plaintext_password,
6328		- 'first_name' => '',
6329		- 'last_name' => '',
6330		- 'user_email' => $this->lowercase( $approved_user['email'] ),
	4746	+ 'user_login' => strtolower( $username ),
	4747	+ 'user_pass' => $plaintext_password,
	4748	+ 'first_name' => '',
	4749	+ 'last_name' => '',
	4750	+ 'user_email' => strtolower( $approved_user['email'] ),
6331	4751	'user_registered' => date( 'Y-m-d H:i:s' ),
6332		- 'role' => $approved_user['role'],
	4752	+ 'role' => $approved_user['role'],
6333	4753	)
6334	4754	);
6335	4755	}
6336	4756	if ( ! is_wp_error( $result ) ) {
		@@ -6336,8 +4756,9 @@
6336	4756	if ( ! is_wp_error( $result ) ) {
6337	4757	// Email login credentials to new user.
6338	4758	wp_new_user_notification( $result, null, 'both' );
6339	4759	}
	4760	+
6340	4761	}
6341	4762
6342	4763	// Email new user welcome message if plugin option is set.
6343	4764	$this->maybe_email_welcome_message( $approved_user['email'] );
		@@ -6343,46 +4764,41 @@
6343	4764	$this->maybe_email_welcome_message( $approved_user['email'] );
6344	4765
6345	4766	// Add new user to approved list and save (skip if it's
6346	4767	// already there--someone else might have just done it).
6347		- if ( 'false' !== $approved_user['multisite_user'] ) {
	4768	+ if ( $approved_user['multisite_user'] !== 'false' ) {
6348	4769	if ( ! $this->is_email_in_list( $approved_user['email'], 'approved', 'multisite' ) ) {
6349	4770	$auth_multisite_settings_access_users_approved = $this->sanitize_user_list(
6350		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT )
	4771	+ $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN )
6351	4772	);
6352		- $approved_user['date_added'] = date( 'M Y' );
	4773	+ $approved_user['date_added'] = date( 'M Y' );
6353	4774	array_push( $auth_multisite_settings_access_users_approved, $approved_user );
6354		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
6355		- } else {
6356		- $invalid_emails[] = $approved_user['email'];
	4775	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
6357	4776	}
6358	4777	} else {
6359	4778	if ( ! $this->is_email_in_list( $approved_user['email'], 'approved' ) ) {
6360	4779	$auth_settings_access_users_approved = $this->sanitize_user_list(
6361		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT )
	4780	+ $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN )
6362	4781	);
6363		- $approved_user['date_added'] = date( 'M Y' );
	4782	+ $approved_user['date_added'] = date( 'M Y' );
6364	4783	array_push( $auth_settings_access_users_approved, $approved_user );
6365	4784	update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved );
6366		- } else {
6367		- $invalid_emails[] = $approved_user['email'];
6368	4785	}
6369	4786	}
6370	4787
6371	4788	// If we've added a new multisite user, go through all pending/approved/blocked lists
6372	4789	// on individual sites and remove this user from them (to prevent duplicate entries).
6373		- if ( 'false' !== $approved_user['multisite_user'] && is_multisite() ) {
	4790	+ if ( $approved_user['multisite_user'] !== 'false' && is_multisite() ) {
6374	4791	$list_names = array( 'access_users_pending', 'access_users_approved', 'access_users_blocked' );
6375		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
6376	4792	$sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
6377	4793	foreach ( $sites as $site ) {
6378	4794	$blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
6379	4795	foreach ( $list_names as $list_name ) {
6380		- $user_list = get_blog_option( $blog_id, 'auth_settings_' . $list_name, array() );
	4796	+ $user_list = get_blog_option( $blog_id, 'auth_settings_' . $list_name, array() );
6381	4797	$list_changed = false;
6382	4798	foreach ( $user_list as $key => $user ) {
6383		- if ( 0 === strcasecmp( $user['email'], $approved_user['email'] ) ) {
6384		- unset( $user_list[ $key ] );
	4799	+ if ( $user['email'] == $approved_user['email'] ) {
	4800	+ unset( $user_list[$key] );
6385	4801	$list_changed = true;
6386	4802	}
6387	4803	}
6388	4804	if ( $list_changed ) {
		@@ -6390,47 +4806,44 @@
6390	4806	}
6391	4807	}
6392	4808	}
6393	4809	}
6394		- } elseif ( 'remove' === $approved_user['edit_action'] ) { // Remove user from approved list and save (also remove their role if they have a WordPress account).
6395		- if ( 'false' !== $approved_user['multisite_user'] ) {
6396		- $auth_multisite_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT );
6397		- foreach ( $auth_multisite_settings_access_users_approved as $key => $existing_user ) {
6398		- if ( 0 === strcasecmp( $approved_user['email'], $existing_user['email'] ) ) {
6399		- // Remove role of the associated WordPress user from all blogs (but don't delete the user).
6400		- $user = get_user_by( 'email', $approved_user['email'] );
6401		- if ( false !== $user ) {
6402		- // Loop through all of the blogs this user is a member of and remove their capabilities.
6403		- foreach ( get_blogs_of_user( $user->ID ) as $blog ) {
6404		- remove_user_from_blog( $user->ID, $blog->userblog_id, '' );
6405		- }
	4810	+
	4811	+ // Remove user from approved list and save
	4812	+ } elseif ( $approved_user['edit_action'] === 'remove' ) {
	4813	+ if ( $approved_user['multisite_user'] !== 'false' ) {
	4814	+ if ( $this->is_email_in_list( $approved_user['email'], 'approved', 'multisite' ) ) {
	4815	+ $auth_multisite_settings_access_users_approved = $this->sanitize_user_list(
	4816	+ $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN )
	4817	+ );
	4818	+ foreach ( $auth_multisite_settings_access_users_approved as $key => $existing_user ) {
	4819	+ if ( $approved_user['email'] == $existing_user['email'] ) {
	4820	+ unset( $auth_multisite_settings_access_users_approved[$key] );
	4821	+ break;
6406	4822	}
6407		- // Remove entry from Approved Users list.
6408		- unset( $auth_multisite_settings_access_users_approved[ $key ] );
6409		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
6410		- break;
6411	4823	}
	4824	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
6412	4825	}
6413	4826	} else {
6414		- $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT );
6415		- foreach ( $auth_settings_access_users_approved as $key => $existing_user ) {
6416		- if ( 0 === strcasecmp( $approved_user['email'], $existing_user['email'] ) ) {
6417		- // Remove role of the associated WordPress user (but don't delete the user).
6418		- $user = get_user_by( 'email', $approved_user['email'] );
6419		- if ( false !== $user ) {
6420		- $user->set_role( '' );
	4827	+ if ( $this->is_email_in_list( $approved_user['email'], 'approved' ) ) {
	4828	+ $auth_settings_access_users_approved = $this->sanitize_user_list(
	4829	+ $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN )
	4830	+ );
	4831	+ foreach ( $auth_settings_access_users_approved as $key => $existing_user ) {
	4832	+ if ( $approved_user['email'] == $existing_user['email'] ) {
	4833	+ unset( $auth_settings_access_users_approved[$key] );
	4834	+ break;
6421	4835	}
6422		- // Remove entry from Approved Users list.
6423		- unset( $auth_settings_access_users_approved[ $key ] );
6424		- update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved );
6425		- break;
6426	4836	}
	4837	+ update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved );
6427	4838	}
6428	4839	}
6429		- } elseif ( 'change_role' === $approved_user['edit_action'] ) { // Update user's role in WordPress.
	4840	+
	4841	+ // Update user's role in WordPress
	4842	+ } elseif ( $approved_user['edit_action'] === 'change_role' ) {
6430	4843	$changed_user = get_user_by( 'email', $approved_user['email'] );
6431	4844	if ( $changed_user ) {
6432		- if ( is_multisite() && 'false' !== $approved_user['multisite_user'] ) {
	4845	+ if ( is_multisite() && $approved_user['multisite_user'] !== 'false' ) {
6433	4846	foreach ( get_blogs_of_user( $changed_user->ID ) as $blog ) {
6434	4847	add_user_to_blog( $blog->userblog_id, $changed_user->ID, $approved_user['role'] );
6435	4848	}
6436	4849	} else {
		@@ -6437,30 +4850,30 @@
6437	4850	$changed_user->set_role( $approved_user['role'] );
6438	4851	}
6439	4852	}
6440	4853
6441		- if ( 'false' !== $approved_user['multisite_user'] ) {
	4854	+ if ( $approved_user['multisite_user'] !== 'false' ) {
6442	4855	if ( $this->is_email_in_list( $approved_user['email'], 'approved', 'multisite' ) ) {
6443	4856	$auth_multisite_settings_access_users_approved = $this->sanitize_user_list(
6444		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT )
	4857	+ $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN )
6445	4858	);
6446	4859	foreach ( $auth_multisite_settings_access_users_approved as $key => $existing_user ) {
6447		- if ( 0 === strcasecmp( $approved_user['email'], $existing_user['email'] ) ) {
6448		- $auth_multisite_settings_access_users_approved[ $key ]['role'] = $approved_user['role'];
	4860	+ if ( $approved_user['email'] == $existing_user['email'] ) {
	4861	+ $auth_multisite_settings_access_users_approved[$key]['role'] = $approved_user['role'];
6449	4862	break;
6450	4863	}
6451	4864	}
6452		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
	4865	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
6453	4866	}
6454	4867	} else {
6455	4868	// Update user's role in approved list and save.
6456	4869	if ( $this->is_email_in_list( $approved_user['email'], 'approved' ) ) {
6457	4870	$auth_settings_access_users_approved = $this->sanitize_user_list(
6458		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT )
	4871	+ $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN )
6459	4872	);
6460	4873	foreach ( $auth_settings_access_users_approved as $key => $existing_user ) {
6461		- if ( 0 === strcasecmp( $approved_user['email'], $existing_user['email'] ) ) {
6462		- $auth_settings_access_users_approved[ $key ]['role'] = $approved_user['role'];
	4874	+ if ( $approved_user['email'] == $existing_user['email'] ) {
	4875	+ $auth_settings_access_users_approved[$key]['role'] = $approved_user['role'];
6463	4876	break;
6464	4877	}
6465	4878	}
6466	4879	update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved );
		@@ -6465,33 +4878,28 @@
6465	4878	}
6466	4879	update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved );
6467	4880	}
6468	4881	}
	4882	+
6469	4883	}
6470	4884	}
6471	4885	}
6472	4886
6473	4887	// Editing a blocked list entry.
6474		- if ( 'access_users_blocked' === $_POST['setting'] ) {
6475		- // Sanitize post data.
6476		- $access_users_blocked = array();
6477		- if ( isset( $_POST['access_users_blocked'] ) && is_array( $_POST['access_users_blocked'] ) ) {
6478		- $access_users_blocked = $this->sanitize_update_auth_users(
6479		- wp_unslash( $_POST['access_users_blocked'] ),
6480		- array(
6481		- 'allow_wildcard_email' => true,
6482		- )
6483		- );
	4888	+ if ( $_POST['setting'] === 'access_users_blocked' ) {
	4889	+ // Initialize posted data if empty.
	4890	+ if ( ! ( array_key_exists( 'access_users_blocked', $_POST ) && is_array( $_POST['access_users_blocked'] ) ) ) {
	4891	+ $_POST['access_users_blocked'] = array();
6484	4892	}
6485	4893
6486	4894	// Deal with each modified user (add or remove).
6487		- foreach ( $access_users_blocked as $blocked_user ) {
	4895	+ foreach ( $_POST['access_users_blocked'] as $blocked_user ) {
6488	4896
6489		- if ( 'add' === $blocked_user['edit_action'] ) {
	4897	+ if ( $blocked_user['edit_action'] === 'add' ) {
6490	4898
6491	4899	// Add auth_blocked usermeta for the user.
6492	4900	$blocked_wp_user = get_user_by( 'email', $blocked_user['email'] );
6493		- if ( false !== $blocked_wp_user ) {
	4901	+ if ( $blocked_wp_user !== false ) {
6494	4902	update_user_meta( $blocked_wp_user->ID, 'auth_blocked', 'yes' );
6495	4903	}
6496	4904
6497	4905	// Add new user to blocked list and save (skip if it's
		@@ -6497,162 +4905,48 @@
6497	4905	// Add new user to blocked list and save (skip if it's
6498	4906	// already there--someone else might have just done it).
6499	4907	if ( ! $this->is_email_in_list( $blocked_user['email'], 'blocked' ) ) {
6500	4908	$auth_settings_access_users_blocked = $this->sanitize_user_list(
6501		- $this->get_plugin_option( 'access_users_blocked', WP_Plugin_Authorizer::SINGLE_CONTEXT )
	4909	+ $this->get_plugin_option( 'access_users_blocked', SINGLE_ADMIN )
6502	4910	);
6503		- $blocked_user['date_added'] = date( 'M Y' );
	4911	+ $blocked_user['date_added'] = date( 'M Y' );
6504	4912	array_push( $auth_settings_access_users_blocked, $blocked_user );
6505	4913	update_option( 'auth_settings_access_users_blocked', $auth_settings_access_users_blocked );
6506		- } else {
6507		- $invalid_emails[] = $blocked_user['email'];
6508	4914	}
6509		- } elseif ( 'remove' === $blocked_user['edit_action'] ) {
6510	4915
	4916	+ } elseif ( $blocked_user['edit_action'] === 'remove' ) {
	4917	+
6511	4918	// Remove auth_blocked usermeta for the user.
6512	4919	$unblocked_user = get_user_by( 'email', $blocked_user['email'] );
6513		- if ( false !== $unblocked_user ) {
	4920	+ if ( $unblocked_user !== false ) {
6514	4921	delete_user_meta( $unblocked_user->ID, 'auth_blocked', 'yes' );
6515	4922	}
6516	4923
6517		- // Remove user from blocked list and save.
6518		- $auth_settings_access_users_blocked = $this->get_plugin_option( 'access_users_blocked', WP_Plugin_Authorizer::SINGLE_CONTEXT );
6519		- foreach ( $auth_settings_access_users_blocked as $key => $existing_user ) {
6520		- if ( 0 === strcasecmp( $blocked_user['email'], $existing_user['email'] ) ) {
6521		- unset( $auth_settings_access_users_blocked[ $key ] );
6522		- update_option( 'auth_settings_access_users_blocked', $auth_settings_access_users_blocked );
6523		- break;
	4924	+ // Remove user from blocked list and save
	4925	+ if ( $this->is_email_in_list( $blocked_user['email'], 'blocked' ) ) {
	4926	+ $auth_settings_access_users_blocked = $this->sanitize_user_list(
	4927	+ $this->get_plugin_option( 'access_users_blocked', SINGLE_ADMIN )
	4928	+ );
	4929	+ foreach ( $auth_settings_access_users_blocked as $key => $existing_user ) {
	4930	+ if ( $blocked_user['email'] == $existing_user['email'] ) {
	4931	+ unset( $auth_settings_access_users_blocked[$key] );
	4932	+ break;
	4933	+ }
6524	4934	}
	4935	+ update_option( 'auth_settings_access_users_blocked', $auth_settings_access_users_blocked );
6525	4936	}
	4937	+
6526	4938	}
6527	4939	}
6528	4940	}
6529	4941
6530		- // Send response to client.
6531		- $response = array(
6532		- 'success' => true,
6533		- 'invalid_emails' => $invalid_emails,
6534		- );
6535		- header( 'content-type: application/json' );
6536		- echo wp_json_encode( $response );
6537		- exit;
	4942	+ // Return 'success' value to AJAX call.
	4943	+ die( 'success' );
6538	4944	}
6539	4945
6540	4946
6541		- /**
6542		- * Sanitizes an array of user update commands coming from the AJAX handler in Authorizer Settings.
6543		- *
6544		- * Example $users array:
6545		- * array(
6546		- * array(
6547		- * edit_action: 'add' or 'remove' or 'change_role',
6548		- * email: 'johndoe@example.com',
6549		- * role: 'subscriber',
6550		- * date_added: 'Jun 2014',
6551		- * local_user: 'true' or 'false',
6552		- * multisite_user: 'true' or 'false',
6553		- * ),
6554		- * ...
6555		- * )
6556		- *
6557		- * @param array $users Users to edit.
6558		- * @param array $args Options (e.g., 'allow_wildcard_email' => true).
6559		- * @return array Sanitized users to edit.
6560		- */
6561		- private function sanitize_update_auth_users( $users = array(), $args = array() ) {
6562		- if ( ! is_array( $users ) ) {
6563		- $users = array();
6564		- }
6565		- if ( isset( $args['allow_wildcard_email'] ) && $args['allow_wildcard_email'] ) {
6566		- $users = array_map( array( $this, 'sanitize_update_auth_user_allow_wildcard_email' ), $users );
6567		- } else {
6568		- $users = array_map( array( $this, 'sanitize_update_auth_user' ), $users );
6569		- }
6570	4947
6571		- // Remove any entries that failed email address validation.
6572		- $users = array_filter( $users, array( $this, 'remove_invalid_auth_users' ) );
6573		-
6574		- return $users;
6575		- }
6576		-
6577		-
6578	4948	/**
6579		- * This array filter will remove any users who failed email address validation
6580		- * (which would set their email to a blank string).
6581		- * @param array $user User data to check for a valid email.
6582		- * @return bool Whether to filter out the user.
6583		- */
6584		- private function remove_invalid_auth_users( $user ) {
6585		- return isset( $user['email'] ) && strlen( $user['email'] ) > 0;
6586		- }
6587		-
6588		- /**
6589		- * Callback for array_map in sanitize_update_auth_users().
6590		- *
6591		- * @param array $user User data to sanitize.
6592		- * @return array Sanitized user data.
6593		- */
6594		- private function sanitize_update_auth_user( $user ) {
6595		- if ( array_key_exists( 'edit_action', $user ) ) {
6596		- $user['edit_action'] = sanitize_text_field( $user['edit_action'] );
6597		- }
6598		- if ( isset( $user['email'] ) ) {
6599		- $user['email'] = sanitize_email( $user['email'] );
6600		- }
6601		- if ( isset( $user['role'] ) ) {
6602		- $user['role'] = sanitize_text_field( $user['role'] );
6603		- }
6604		- if ( isset( $user['date_added'] ) ) {
6605		- $user['date_added'] = sanitize_text_field( $user['date_added'] );
6606		- }
6607		- if ( isset( $user['local_user'] ) ) {
6608		- $user['local_user'] = 'true' === $user['local_user'] ? 'true' : 'false';
6609		- }
6610		- if ( isset( $user['multisite_user'] ) ) {
6611		- $user['multisite_user'] = 'true' === $user['multisite_user'] ? 'true' : 'false';
6612		- }
6613		-
6614		- return $user;
6615		- }
6616		-
6617		-
6618		-
6619		- /**
6620		- * Callback for array_map in sanitize_update_auth_users().
6621		- *
6622		- * @param array $user User data to sanitize.
6623		- * @return array Sanitized user data.
6624		- */
6625		- private function sanitize_update_auth_user_allow_wildcard_email( $user ) {
6626		- if ( array_key_exists( 'edit_action', $user ) ) {
6627		- $user['edit_action'] = sanitize_text_field( $user['edit_action'] );
6628		- }
6629		- if ( isset( $user['email'] ) ) {
6630		- if ( strpos( $user['email'], '@' ) === 0 ) {
6631		- $user['email'] = sanitize_text_field( $user['email'] );
6632		- } else {
6633		- $user['email'] = sanitize_email( $user['email'] );
6634		- }
6635		- }
6636		- if ( isset( $user['role'] ) ) {
6637		- $user['role'] = sanitize_text_field( $user['role'] );
6638		- }
6639		- if ( isset( $user['date_added'] ) ) {
6640		- $user['date_added'] = sanitize_text_field( $user['date_added'] );
6641		- }
6642		- if ( isset( $user['local_user'] ) ) {
6643		- $user['local_user'] = 'true' === $user['local_user'] ? 'true' : 'false';
6644		- }
6645		- if ( isset( $user['multisite_user'] ) ) {
6646		- $user['multisite_user'] = 'true' === $user['multisite_user'] ? 'true' : 'false';
6647		- }
6648		-
6649		- return $user;
6650		- }
6651		-
6652		-
6653		-
6654		- /**
6655	4949	* ***************************
6656	4950	* Helper functions
6657	4951	* ***************************
6658	4952	*/
		@@ -6660,20 +4954,20 @@
6660	4954
6661	4955	/**
6662	4956	* Retrieves a specific plugin option from db. Multisite enabled.
6663	4957	*
6664		- * @param string $option Option name.
6665		- * @param string $admin_mode WP_Plugin_Authorizer::NETWORK_CONTEXT will retrieve the multisite value.
6666		- * @param string $override_mode 'allow override' will retrieve the multisite value if it exists.
6667		- * @param string $print_mode 'print overlay' will output overlay that hides this option on the settings page.
6668		- * @return mixed Option value, or null on failure.
	4958	+ * @param string $option Option name
	4959	+ * @param string $admin_mode MULTISITE_ADMIN will retrieve the multisite value
	4960	+ * @param string $override_mode 'allow override' will retrieve the multisite value if it exists
	4961	+ * @param string $print_mode 'print overlay' will output overlay that hides this option on the settings page
	4962	+ * @return mixed Option value, or null on failure
6669	4963	*/
6670		- private function get_plugin_option( $option, $admin_mode = WP_Plugin_Authorizer::SINGLE_CONTEXT, $override_mode = 'no override', $print_mode = 'no overlay' ) {
	4964	+ private function get_plugin_option( $option, $admin_mode = SINGLE_ADMIN, $override_mode = 'no override', $print_mode = 'no overlay' ) {
6671	4965	// Special case for user lists (they are saved seperately to prevent concurrency issues).
6672		- if ( in_array( $option, array( 'access_users_pending', 'access_users_approved', 'access_users_blocked' ), true ) ) {
6673		- $list = WP_Plugin_Authorizer::NETWORK_CONTEXT === $admin_mode ? array() : get_option( 'auth_settings_' . $option );
6674		- if ( is_multisite() && WP_Plugin_Authorizer::NETWORK_CONTEXT === $admin_mode ) {
6675		- $list = get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_' . $option, array() );
	4966	+ if ( in_array( $option, array( 'access_users_pending', 'access_users_approved', 'access_users_blocked' ) ) ) {
	4967	+ $list = $admin_mode === MULTISITE_ADMIN ? array() : get_option( 'auth_settings_' . $option );
	4968	+ if ( is_multisite() && $admin_mode === MULTISITE_ADMIN ) {
	4969	+ $list = get_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_' . $option, array() );
6676	4970	}
6677	4971	return $list;
6678	4972	}
6679	4973
		@@ -6687,26 +4981,24 @@
6687	4981
6688	4982	// If requested and appropriate, print the overlay hiding the
6689	4983	// single site option that is overridden by a multisite option.
6690	4984	if (
6691		- WP_Plugin_Authorizer::NETWORK_CONTEXT !== $admin_mode &&
6692		- 'allow override' === $override_mode &&
6693		- 'print overlay' === $print_mode &&
	4985	+ $admin_mode !== MULTISITE_ADMIN &&
	4986	+ $override_mode === 'allow override' &&
	4987	+ $print_mode === 'print overlay' &&
6694	4988	array_key_exists( 'multisite_override', $auth_settings ) &&
6695		- '1' === $auth_settings['multisite_override'] &&
6696		- ( ! array_key_exists( 'advanced_override_multisite', $auth_settings ) || 1 !== intval( $auth_settings['advanced_override_multisite'] ) )
	4989	+ $auth_settings['multisite_override'] === '1' &&
	4990	+ ( ! array_key_exists( 'advanced_override_multisite', $auth_settings ) || $auth_settings['advanced_override_multisite'] != '1' )
6697	4991	) {
6698	4992	// Get original plugin options (not overridden value). We'll
6699	4993	// show this old value behind the disabled overlay.
6700		- // $auth_settings = $this->get_plugin_options( $admin_mode, 'no override' );
6701		- // (This feature is disabled).
6702		- //
	4994	+ $auth_settings = $this->get_plugin_options( $admin_mode, 'no override' );
	4995	+
6703	4996	$name = "auth_settings[$option]";
6704		- $id = "auth_settings_$option";
6705		- ?>
6706		- <div id="overlay-hide-auth_settings_<?php echo esc_attr( $option ); ?>" class="auth_multisite_override_overlay">
	4997	+ $id = "auth_settings_$option"; ?>
	4998	+ <div id="overlay-hide-auth_settings_<?php echo $option; ?>" class="auth_multisite_override_overlay">
6707	4999	<span class="overlay-note">
6708		- <?php esc_html_e( 'This setting is overridden by a', 'authorizer' ); ?> <a href="<?php echo esc_attr( network_admin_url( 'admin.php?page=authorizer' ) ); ?>"><?php esc_html_e( 'multisite option', 'authorizer' ); ?></a>.
	5000	+ <?php _e( 'This setting is overridden by a', 'authorizer' ); ?> <a href="<?php echo network_admin_url( 'admin.php?page=authorizer&tab=external' ); ?>"><?php _e( 'multisite option', 'authorizer' ); ?></a>.
6709	5001	</span>
6710	5002	</div>
6711	5003	<?php
6712	5004	}
		@@ -6712,9 +5004,9 @@
6712	5004	}
6713	5005
6714	5006	// If we're getting an option in a site that has overridden the multisite override, make
6715	5007	// sure we are returning the option value from that site (not the multisite value).
6716		- if ( array_key_exists( 'advanced_override_multisite', $auth_settings ) && 1 === intval( $auth_settings['advanced_override_multisite'] ) ) {
	5008	+ if ( array_key_exists( 'advanced_override_multisite', $auth_settings ) && $auth_settings['advanced_override_multisite'] == '1' ) {
6717	5009	$auth_settings = $this->get_plugin_options( $admin_mode, 'no override' );
6718	5010	}
6719	5011
6720	5012	// Set option to null if it wasn't found.
		@@ -6721,116 +5013,98 @@
6721	5013	if ( ! array_key_exists( $option, $auth_settings ) ) {
6722	5014	return null;
6723	5015	}
6724	5016
6725		- return $auth_settings[ $option ];
	5017	+ return $auth_settings[$option];
6726	5018	}
6727	5019
6728	5020	/**
6729	5021	* Retrieves all plugin options from db. Multisite enabled.
6730	5022	*
6731		- * @param string $admin_mode WP_Plugin_Authorizer::NETWORK_CONTEXT will retrieve the multisite value.
6732		- * @param string $override_mode 'allow override' will retrieve the multisite value if it exists.
6733		- * @return mixed Option value, or null on failure.
	5023	+ * @param string $admin_mode MULTISITE_ADMIN will retrieve the multisite value
	5024	+ * @param string $override_mode 'allow override' will retrieve the multisite value if it exists
	5025	+ * @return mixed Option value, or null on failure
6734	5026	*/
6735		- private function get_plugin_options( $admin_mode = WP_Plugin_Authorizer::SINGLE_CONTEXT, $override_mode = 'no override' ) {
6736		- // Grab plugin settings (skip if in WP_Plugin_Authorizer::NETWORK_CONTEXT mode).
6737		- $auth_settings = WP_Plugin_Authorizer::NETWORK_CONTEXT === $admin_mode ? array() : get_option( 'auth_settings' );
	5027	+ private function get_plugin_options( $admin_mode = SINGLE_ADMIN, $override_mode = 'no override' ) {
	5028	+ // Grab plugin settings (skip if in MULTISITE_ADMIN mode).
	5029	+ $auth_settings = $admin_mode === MULTISITE_ADMIN ? array() : get_option( 'auth_settings' );
6738	5030
6739	5031	// Initialize to default values if the plugin option doesn't exist.
6740		- if ( false === $auth_settings ) {
	5032	+ if ( $auth_settings === FALSE ) {
6741	5033	$auth_settings = $this->set_default_options();
6742	5034	}
6743	5035
6744	5036	// Merge multisite options if we're in a network and the current site hasn't overridden multisite settings.
6745		- if ( is_multisite() && ( ! array_key_exists( 'advanced_override_multisite', $auth_settings ) || 1 !== intval( $auth_settings['advanced_override_multisite'] ) ) ) {
	5037	+ if ( is_multisite() && ( ! array_key_exists( 'advanced_override_multisite', $auth_settings ) || $auth_settings['advanced_override_multisite'] != '1' ) ) {
6746	5038	// Get multisite options.
6747		- $auth_multisite_settings = get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings', array() );
	5039	+ $auth_multisite_settings = get_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings', array() );
6748	5040
6749	5041	// Return the multisite options if we're viewing the network admin options page.
6750	5042	// Otherwise override options with their multisite equivalents.
6751		- if ( WP_Plugin_Authorizer::NETWORK_CONTEXT === $admin_mode ) {
	5043	+ if ( $admin_mode === MULTISITE_ADMIN ) {
6752	5044	$auth_settings = $auth_multisite_settings;
6753	5045	} elseif (
6754		- 'allow override' === $override_mode &&
	5046	+ $override_mode === 'allow override' &&
6755	5047	array_key_exists( 'multisite_override', $auth_multisite_settings ) &&
6756		- '1' === $auth_multisite_settings['multisite_override']
	5048	+ $auth_multisite_settings['multisite_override'] === '1'
6757	5049	) {
6758	5050	// Keep track of the multisite override selection.
6759	5051	$auth_settings['multisite_override'] = $auth_multisite_settings['multisite_override'];
6760	5052
6761		- /**
6762		- * Note: the options below should be the complete list of overridden
6763		- * options. It is *not* the complete list of all options (some options
6764		- * don't have a multisite equivalent).
6765		- */
	5053	+ // Note: the options below should be the complete list of
	5054	+ // overridden options. It is *not* the complete list of all
	5055	+ // options (some options don't have a multisite equivalent)
6766	5056
6767		- /**
6768		- * Note: access_users_approved, access_users_pending, and
6769		- * access_users_blocked do not get overridden. However, since
6770		- * access_users_approved has a multisite equivalent, you must retrieve
6771		- * them both seperately. This is done because the two lists should be
6772		- * treated differently.
6773		- *
6774		- * $approved_users = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT );
6775		- * $ms_approved_users = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT );
6776		- */
	5057	+ // Note: access_users_approved, access_users_pending, and
	5058	+ // access_users_blocked do not get overridden. However,
	5059	+ // since access_users_approved has a multisite equivalent,
	5060	+ // you must retrieve them both seperately. This is done
	5061	+ // because the two lists should be treated differently.
	5062	+ // $approved_users = $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN );
	5063	+ // $ms_approved_users = $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN );
6777	5064
6778		- // Override external services (google, cas, or ldap) and associated options.
6779		- $auth_settings['google'] = $auth_multisite_settings['google'];
6780		- $auth_settings['google_clientid'] = $auth_multisite_settings['google_clientid'];
6781		- $auth_settings['google_clientsecret'] = $auth_multisite_settings['google_clientsecret'];
6782		- $auth_settings['google_hosteddomain'] = $auth_multisite_settings['google_hosteddomain'];
6783		- $auth_settings['cas'] = $auth_multisite_settings['cas'];
6784		- $auth_settings['cas_custom_label'] = $auth_multisite_settings['cas_custom_label'];
6785		- $auth_settings['cas_host'] = $auth_multisite_settings['cas_host'];
6786		- $auth_settings['cas_port'] = $auth_multisite_settings['cas_port'];
6787		- $auth_settings['cas_path'] = $auth_multisite_settings['cas_path'];
6788		- $auth_settings['cas_version'] = $auth_multisite_settings['cas_version'];
6789		- $auth_settings['cas_attr_email'] = $auth_multisite_settings['cas_attr_email'];
6790		- $auth_settings['cas_attr_first_name'] = $auth_multisite_settings['cas_attr_first_name'];
6791		- $auth_settings['cas_attr_last_name'] = $auth_multisite_settings['cas_attr_last_name'];
6792		- $auth_settings['cas_attr_update_on_login'] = $auth_multisite_settings['cas_attr_update_on_login'];
6793		- $auth_settings['cas_auto_login'] = $auth_multisite_settings['cas_auto_login'];
6794		- $auth_settings['cas_link_on_username'] = $auth_multisite_settings['cas_link_on_username'];
6795		- $auth_settings['ldap'] = $auth_multisite_settings['ldap'];
6796		- $auth_settings['ldap_host'] = $auth_multisite_settings['ldap_host'];
6797		- $auth_settings['ldap_port'] = $auth_multisite_settings['ldap_port'];
6798		- $auth_settings['ldap_tls'] = $auth_multisite_settings['ldap_tls'];
6799		- $auth_settings['ldap_search_base'] = $auth_multisite_settings['ldap_search_base'];
6800		- $auth_settings['ldap_uid'] = $auth_multisite_settings['ldap_uid'];
6801		- $auth_settings['ldap_attr_email'] = $auth_multisite_settings['ldap_attr_email'];
6802		- $auth_settings['ldap_user'] = $auth_multisite_settings['ldap_user'];
6803		- $auth_settings['ldap_password'] = $auth_multisite_settings['ldap_password'];
6804		- $auth_settings['ldap_lostpassword_url'] = $auth_multisite_settings['ldap_lostpassword_url'];
6805		- $auth_settings['ldap_attr_first_name'] = $auth_multisite_settings['ldap_attr_first_name'];
6806		- $auth_settings['ldap_attr_last_name'] = $auth_multisite_settings['ldap_attr_last_name'];
	5065	+ // Override external services (google, cas, or ldap) and associated options
	5066	+ $auth_settings['google'] = $auth_multisite_settings['google'];
	5067	+ $auth_settings['google_clientid'] = $auth_multisite_settings['google_clientid'];
	5068	+ $auth_settings['google_clientsecret'] = $auth_multisite_settings['google_clientsecret'];
	5069	+ $auth_settings['google_hosteddomain'] = $auth_multisite_settings['google_hosteddomain'];
	5070	+ $auth_settings['cas'] = $auth_multisite_settings['cas'];
	5071	+ $auth_settings['cas_custom_label'] = $auth_multisite_settings['cas_custom_label'];
	5072	+ $auth_settings['cas_host'] = $auth_multisite_settings['cas_host'];
	5073	+ $auth_settings['cas_port'] = $auth_multisite_settings['cas_port'];
	5074	+ $auth_settings['cas_path'] = $auth_multisite_settings['cas_path'];
	5075	+ $auth_settings['cas_version'] = $auth_multisite_settings['cas_version'];
	5076	+ $auth_settings['cas_attr_email'] = $auth_multisite_settings['cas_attr_email'];
	5077	+ $auth_settings['cas_attr_first_name'] = $auth_multisite_settings['cas_attr_first_name'];
	5078	+ $auth_settings['cas_attr_last_name'] = $auth_multisite_settings['cas_attr_last_name'];
	5079	+ $auth_settings['cas_attr_update_on_login'] = $auth_multisite_settings['cas_attr_update_on_login'];
	5080	+ $auth_settings['cas_auto_login'] = $auth_multisite_settings['cas_auto_login'];
	5081	+ $auth_settings['ldap'] = $auth_multisite_settings['ldap'];
	5082	+ $auth_settings['ldap_host'] = $auth_multisite_settings['ldap_host'];
	5083	+ $auth_settings['ldap_port'] = $auth_multisite_settings['ldap_port'];
	5084	+ $auth_settings['ldap_tls'] = $auth_multisite_settings['ldap_tls'];
	5085	+ $auth_settings['ldap_search_base'] = $auth_multisite_settings['ldap_search_base'];
	5086	+ $auth_settings['ldap_uid'] = $auth_multisite_settings['ldap_uid'];
	5087	+ $auth_settings['ldap_attr_email'] = $auth_multisite_settings['ldap_attr_email'];
	5088	+ $auth_settings['ldap_user'] = $auth_multisite_settings['ldap_user'];
	5089	+ $auth_settings['ldap_password'] = $auth_multisite_settings['ldap_password'];
	5090	+ $auth_settings['ldap_lostpassword_url'] = $auth_multisite_settings['ldap_lostpassword_url'];
	5091	+ $auth_settings['ldap_attr_first_name'] = $auth_multisite_settings['ldap_attr_first_name'];
	5092	+ $auth_settings['ldap_attr_last_name'] = $auth_multisite_settings['ldap_attr_last_name'];
6807	5093	$auth_settings['ldap_attr_update_on_login'] = $auth_multisite_settings['ldap_attr_update_on_login'];
6808	5094
6809		- // Override access_who_can_login and access_who_can_view.
	5095	+ // Override access_who_can_login and access_who_can_view
6810	5096	$auth_settings['access_who_can_login'] = $auth_multisite_settings['access_who_can_login'];
6811		- $auth_settings['access_who_can_view'] = $auth_multisite_settings['access_who_can_view'];
	5097	+ $auth_settings['access_who_can_view'] = $auth_multisite_settings['access_who_can_view'];
6812	5098
6813		- // Override access_default_role.
	5099	+ // Override access_default_role
6814	5100	$auth_settings['access_default_role'] = $auth_multisite_settings['access_default_role'];
6815	5101
6816		- // Override lockouts.
	5102	+ // Override lockouts
6817	5103	$auth_settings['advanced_lockouts'] = $auth_multisite_settings['advanced_lockouts'];
6818	5104
6819		- // Override Hide WordPress login.
	5105	+ // Override Hide WordPress login
6820	5106	$auth_settings['advanced_hide_wp_login'] = $auth_multisite_settings['advanced_hide_wp_login'];
6821		-
6822		- // Override Users per page.
6823		- $auth_settings['advanced_users_per_page'] = $auth_multisite_settings['advanced_users_per_page'];
6824		-
6825		- // Override Sort users by.
6826		- $auth_settings['advanced_users_sort_by'] = $auth_multisite_settings['advanced_users_sort_by'];
6827		-
6828		- // Override Sort users order.
6829		- $auth_settings['advanced_users_sort_order'] = $auth_multisite_settings['advanced_users_sort_order'];
6830		-
6831		- // Override Show Dashboard Widget.
6832		- $auth_settings['advanced_widget_enabled'] = $auth_multisite_settings['advanced_widget_enabled'];
6833	5107	}
6834	5108	}
6835	5109	return $auth_settings;
6836	5110	}
		@@ -6837,27 +5111,23 @@
6837	5111
6838	5112
6839	5113	/**
6840	5114	* Remove user from authorizer lists when that user is deleted in WordPress.
6841		- *
6842		- * Action: delete_user
6843		- *
6844		- * @param int $user_id User ID to remove.
6845		- * @return void
	5115	+ * Run on action hook: delete_user
6846	5116	*/
6847		- public function remove_user_from_authorizer_when_deleted( $user_id ) {
6848		- $user = get_user_by( 'id', $user_id );
	5117	+ function remove_user_from_authorizer_when_deleted( $user_id ) {
	5118	+ $user = get_user_by( 'id', $user_id );
6849	5119	$deleted_email = $user->user_email;
6850	5120
6851	5121	// Remove user from pending/approved lists and save.
6852	5122	$list_names = array( 'access_users_pending', 'access_users_approved' );
6853	5123	foreach ( $list_names as $list_name ) {
6854		- $user_list = $this->sanitize_user_list( $this->get_plugin_option( $list_name, WP_Plugin_Authorizer::SINGLE_CONTEXT ) );
	5124	+ $user_list = $this->sanitize_user_list( $this->get_plugin_option( $list_name, SINGLE_ADMIN ) );
6855	5125	$list_changed = false;
6856	5126	foreach ( $user_list as $key => $existing_user ) {
6857		- if ( 0 === strcasecmp( $deleted_email, $existing_user['email'] ) ) {
	5127	+ if ( $deleted_email === $existing_user['email'] ) {
6858	5128	$list_changed = true;
6859		- unset( $user_list[ $key ] );
	5129	+ unset( $user_list[$key] );
6860	5130	}
6861	5131	}
6862	5132	if ( $list_changed ) {
6863	5133	update_option( 'auth_settings_' . $list_name, $user_list );
		@@ -6867,35 +5137,30 @@
6867	5137
6868	5138
6869	5139	/**
6870	5140	* Remove multisite user from authorizer lists when that user is deleted from Network Users.
6871		- *
6872		- * Action: wpmu_delete_user
6873		- *
6874		- * @param int $user_id User ID to remove.
6875		- * @return void
	5141	+ * Run on action hook: wpmu_delete_user
6876	5142	*/
6877		- public function remove_network_user_from_authorizer_when_deleted( $user_id ) {
6878		- $user = get_user_by( 'id', $user_id );
	5143	+ function remove_network_user_from_authorizer_when_deleted( $user_id ) {
	5144	+ $user = get_user_by( 'id', $user_id );
6879	5145	$deleted_email = $user->user_email;
6880	5146
6881	5147	// Go through multisite approved user list and remove this user.
6882	5148	$auth_multisite_settings_access_users_approved = $this->sanitize_user_list(
6883		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT )
	5149	+ $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN )
6884	5150	);
6885		- $list_changed = false;
	5151	+ $list_changed = false;
6886	5152	foreach ( $auth_multisite_settings_access_users_approved as $key => $existing_user ) {
6887		- if ( 0 === strcasecmp( $deleted_email, $existing_user['email'] ) ) {
	5153	+ if ( $deleted_email === $existing_user['email'] ) {
6888	5154	$list_changed = true;
6889		- unset( $auth_multisite_settings_access_users_approved[ $key ] );
	5155	+ unset( $auth_multisite_settings_access_users_approved[$key] );
6890	5156	}
6891	5157	}
6892	5158	if ( $list_changed ) {
6893		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
	5159	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
6894	5160	}
6895	5161
6896	5162	// Go through all pending/approved lists on individual sites and remove this user from them.
6897		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
6898	5163	$sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
6899	5164	foreach ( $sites as $site ) {
6900	5165	$blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
6901	5166	$this->remove_network_user_from_site_when_removed( $user_id, $blog_id );
		@@ -6905,27 +5170,22 @@
6905	5170
6906	5171
6907	5172	/**
6908	5173	* Remove multisite user from a specific site's lists when that user is removed from the site.
6909		- *
6910		- * Action: remove_user_from_blog
6911		- *
6912		- * @param int $user_id User ID to remove.
6913		- * @param int $blog_id Blog ID to remove from.
6914		- * @return void
	5174	+ * Run on action hook: remove_user_from_blog
6915	5175	*/
6916		- public function remove_network_user_from_site_when_removed( $user_id, $blog_id ) {
6917		- $user = get_user_by( 'id', $user_id );
	5176	+ function remove_network_user_from_site_when_removed( $user_id, $blog_id ) {
	5177	+ $user = get_user_by( 'id', $user_id );
6918	5178	$deleted_email = $user->user_email;
6919	5179
6920	5180	$list_names = array( 'access_users_pending', 'access_users_approved' );
6921	5181	foreach ( $list_names as $list_name ) {
6922		- $user_list = get_blog_option( $blog_id, 'auth_settings_' . $list_name, array() );
	5182	+ $user_list = get_blog_option( $blog_id, 'auth_settings_' . $list_name, array() );
6923	5183	$list_changed = false;
6924	5184	foreach ( $user_list as $key => $existing_user ) {
6925		- if ( 0 === strcasecmp( $deleted_email, $existing_user['email'] ) ) {
	5185	+ if ( $deleted_email === $existing_user['email'] ) {
6926	5186	$list_changed = true;
6927		- unset( $user_list[ $key ] );
	5187	+ unset( $user_list[$key] );
6928	5188	}
6929	5189	}
6930	5190	if ( $list_changed ) {
6931	5191	update_blog_option( $blog_id, 'auth_settings_' . $list_name, $user_list );
		@@ -6935,30 +5195,26 @@
6935	5195
6936	5196
6937	5197	/**
6938	5198	* Helper: Add multisite user to a specific site's approved list.
6939		- *
6940		- * @param int $user_id User ID to add.
6941		- * @param int $blog_id Blog ID to add to.
6942		- * @return void
6943	5199	*/
6944		- private function add_network_user_to_site( $user_id, $blog_id ) {
	5200	+ function add_network_user_to_site( $user_id, $blog_id ) {
6945	5201	// Switch to blog.
6946	5202	switch_to_blog( $blog_id );
6947	5203
6948	5204	// Get user details and role.
6949		- $access_default_role = $this->get_plugin_option( 'access_default_role', WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
6950		- $user = get_user_by( 'id', $user_id );
6951		- $user_email = $user->user_email;
6952		- $user_role = $user && is_array( $user->roles ) && count( $user->roles ) > 0 ? $user->roles[0] : $access_default_role;
	5205	+ $access_default_role = $this->get_plugin_option( 'access_default_role', SINGLE_ADMIN, 'allow override' );
	5206	+ $user = get_user_by( 'id', $user_id );
	5207	+ $user_email = $user->user_email;
	5208	+ $user_role = $user && is_array( $user->roles ) && count( $user->roles ) > 0 ? $user->roles[0] : $access_default_role;
6953	5209
6954	5210	// Add user to approved list if not already there and not in blocked list.
6955		- $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT );
6956		- $auth_settings_access_users_blocked = $this->get_plugin_option( 'access_users_blocked', WP_Plugin_Authorizer::SINGLE_CONTEXT );
	5211	+ $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN );
	5212	+ $auth_settings_access_users_blocked = $this->get_plugin_option( 'access_users_blocked', SINGLE_ADMIN );
6957	5213	if ( ! $this->in_multi_array( $user_email, $auth_settings_access_users_approved ) && ! $this->in_multi_array( $user_email, $auth_settings_access_users_blocked ) ) {
6958	5214	$approved_user = array(
6959		- 'email' => $this->lowercase( $user_email ),
6960		- 'role' => $user_role,
	5215	+ 'email' => $user_email,
	5216	+ 'role' => $user_role,
6961	5217	'date_added' => date( 'M Y', strtotime( $user->user_registered ) ),
6962	5218	'local_user' => true,
6963	5219	);
6964	5220	array_push( $auth_settings_access_users_approved, $approved_user );
		@@ -6975,17 +5231,17 @@
6975	5231	* When an existing user is invited to the current site (or a new user is created),
6976	5232	* add them to the authorizer approved list. This action fires when the admin
6977	5233	* doesn't select the "Skip Confirmation Email" option.
6978	5234	*
6979		- * Action: invite_user
	5235	+ * @action invite_user
6980	5236	*
6981		- * @param int $user_id The invited user's ID.
6982		- * @param array $role The role of the invited user (or none if a new user creation).
	5237	+ * @param int $user_id The invited user's ID.
	5238	+ * @param array $role The role of the invited user (or none if a new user creation).
6983	5239	* @param string $newuser_key The key of the invitation.
6984	5240	*/
6985		- public function add_existing_user_to_authorizer_when_created( $user_id, $role = array(), $newuser_key = '' ) {
	5241	+ function add_existing_user_to_authorizer_when_created( $user_id, $role = array(), $newuser_key = '' ) {
6986	5242	$user = get_user_by( 'id', $user_id );
6987		- $this->add_user_to_authorizer_when_created( $user->user_email, $user->user_registered, $user->roles, $role );
	5243	+ $this->add_user_to_authorizer_when_created( $user->user_email, $user->user_registered, $user->user_roles, $role );
6988	5244	}
6989	5245
6990	5246
6991	5247	/**
		@@ -6993,16 +5249,16 @@
6993	5249	* When an existing user is invited to the current site (or a new user is created),
6994	5250	* add them to the authorizer approved list. This action fires when the admin
6995	5251	* selects the "Skip Confirmation Email" option.
6996	5252	*
6997		- * Action: added_existing_user
	5253	+ * @action added_existing_user
6998	5254	*
6999		- * @param int $user_id The invited user's ID.
7000		- * @param mixed $result True on success or a WP_Error object if the user doesn't exist.
	5255	+ * @param int $user_id The invited user's ID.
	5256	+ * @param mixed $result True on success or a WP_Error object if the user doesn't exist.
7001	5257	*/
7002		- public function add_existing_user_to_authorizer_when_created_noconfirmation( $user_id, $result ) {
	5258	+ function add_existing_user_to_authorizer_when_created_noconfirmation( $user_id, $result ) {
7003	5259	$user = get_user_by( 'id', $user_id );
7004		- $this->add_user_to_authorizer_when_created( $user->user_email, $user->user_registered, $user->roles );
	5260	+ $this->add_user_to_authorizer_when_created( $user->user_email, $user->user_registered, $user->user_roles );
7005	5261	}
7006	5262
7007	5263
7008	5264	/**
		@@ -7009,18 +5265,17 @@
7009	5265	* Multisite:
7010	5266	* When a new user is invited to the current site (or a new user is created),
7011	5267	* add them to the authorizer approved list.
7012	5268	*
7013		- * Action: after_signup_user
	5269	+ * @action after_signup_user
7014	5270	*
7015		- * @param string $user User's requested login name.
	5271	+ * @param string $user User's requested login name.
7016	5272	* @param string $user_email User's email address.
7017		- * @param string $key User's activation key.
7018		- * @param array $meta Additional signup meta, including initially set roles.
	5273	+ * @param string $key User's activation key.
	5274	+ * @param array $meta Additional signup meta.
7019	5275	*/
7020		- public function add_new_user_to_authorizer_when_created( $user, $user_email, $key, $meta ) {
7021		- $user_roles = isset( $meta['new_role'] ) ? array( $meta['new_role'] ) : array();
7022		- $this->add_user_to_authorizer_when_created( $user_email, time(), $user_roles );
	5276	+ function add_new_user_to_authorizer_when_created( $user, $user_email, $key, $meta ) {
	5277	+ $this->add_user_to_authorizer_when_created( $user_email, time() );
7023	5278	}
7024	5279
7025	5280
7026	5281	/**
		@@ -7027,18 +5282,17 @@
7027	5282	* Single site:
7028	5283	* When a new user is added in single site mode, add them to the authorizer
7029	5284	* approved list.
7030	5285	*
7031		- * Action: edit_user_created_user
	5286	+ * @action edit_user_created_user
7032	5287	*
7033		- * @param int $user_id ID of the newly created user.
7034		- * @param string $notify Type of notification that should happen. See
7035		- * wp_send_new_user_notifications() for more
7036		- * information on possible values.
	5288	+ * @param int $user_id ID of the newly created user.
	5289	+ * @param string $notify Type of notification that should happen. See wp_send_new_user_notifications()
	5290	+ * for more information on possible values.
7037	5291	*/
7038		- public function add_new_user_to_authorizer_when_created_single_site( $user_id, $notify ) {
	5292	+ function add_new_user_to_authorizer_when_created_single_site( $user_id, $notify ) {
7039	5293	$user = get_user_by( 'id', $user_id );
7040		- $this->add_user_to_authorizer_when_created( $user->user_email, $user->user_registered, $user->roles );
	5294	+ $this->add_user_to_authorizer_when_created( $user->user_email, $user->user_registered, $user->user_roles );
7041	5295	}
7042	5296
7043	5297
7044	5298	/**
		@@ -7043,36 +5297,20 @@
7043	5297
7044	5298	/**
7045	5299	* Helper: When a new user is added/invited to the current site (or a new
7046	5300	* user is created), add them to the authorizer approved list.
7047		- *
7048		- * @param string $user_email Email address of user to add.
7049		- * @param string $date_registered Date user registered.
7050		- * @param array $user_roles Role to add for user.
7051		- * @param array $default_role Default role, if no role specified.
7052	5301	*/
7053	5302	private function add_user_to_authorizer_when_created( $user_email, $date_registered, $user_roles = array(), $default_role = array() ) {
7054		- $auth_multisite_settings_access_users_approved = is_multisite() ? get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', array() ) : array();
7055		- $auth_settings_access_users_pending = $this->get_plugin_option( 'access_users_pending', WP_Plugin_Authorizer::SINGLE_CONTEXT );
7056		- $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT );
7057		- $auth_settings_access_users_blocked = $this->get_plugin_option( 'access_users_blocked', WP_Plugin_Authorizer::SINGLE_CONTEXT );
	5303	+ $auth_multisite_settings_access_users_approved = is_multisite() ? get_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', array() ) : array();
	5304	+ $auth_settings_access_users_pending = $this->get_plugin_option( 'access_users_pending', SINGLE_ADMIN );
	5305	+ $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN );
	5306	+ $auth_settings_access_users_blocked = $this->get_plugin_option( 'access_users_blocked', SINGLE_ADMIN );
7058	5307
7059	5308	// Get default role if one isn't specified.
7060	5309	if ( count( $default_role ) < 1 ) {
7061	5310	$default_role = '';
7062	5311	} else {
7063		- // If default role was provided, it came from the invite_user hook, and
7064		- // only contains the role's display name. Here we look up the actual role
7065		- // name to save (and default to no role if the display name isn't found).
7066		- global $wp_roles;
7067		- $default_role_display_name = $default_role['name'];
7068		- $default_role = '';
7069		- foreach ( $wp_roles->role_names as $role_name => $display_name ) {
7070		- if ( $default_role_display_name === $display_name ) {
7071		- $default_role = $role_name;
7072		- break;
7073		- }
7074		- }
	5312	+ $default_role = strtolower( $default_role['name'] );
7075	5313	}
7076	5314
7077	5315	$updated = false;
7078	5316
		@@ -7081,10 +5319,10 @@
7081	5319	return;
7082	5320	}
7083	5321	// Remove from pending list if there.
7084	5322	foreach ( $auth_settings_access_users_pending as $key => $pending_user ) {
7085		- if ( 0 === strcasecmp( $pending_user['email'], $user_email ) ) {
7086		- unset( $auth_settings_access_users_pending[ $key ] );
	5323	+ if ( $pending_user['email'] == $user_email ) {
	5324	+ unset( $auth_settings_access_users_pending[$key] );
7087	5325	$updated = true;
7088	5326	}
7089	5327	}
7090	5328	// Skip if user is in multisite approved list.
		@@ -7093,10 +5331,10 @@
7093	5331	}
7094	5332	// Add to approved list if not there.
7095	5333	if ( ! $this->in_multi_array( $user_email, $auth_settings_access_users_approved ) ) {
7096	5334	$approved_user = array(
7097		- 'email' => $this->lowercase( $user_email ),
7098		- 'role' => is_array( $user_roles ) && count( $user_roles ) > 0 ? $user_roles[0] : $default_role,
	5335	+ 'email' => $user_email,
	5336	+ 'role' => is_array( $user_roles ) && count( $user_roles ) > 0 ? $user_roles[0] : $default_role,
7099	5337	'date_added' => date( 'M Y', strtotime( $date_registered ) ),
7100	5338	'local_user' => true,
7101	5339	);
7102	5340	array_push( $auth_settings_access_users_approved, $approved_user );
		@@ -7115,33 +5353,32 @@
7115	5353	* When a user is granted super admin status (checkbox on network user edit
7116	5354	* screen), add them to the authorizer network approved list. Also remove
7117	5355	* them from pending/approved list on any individual sites.
7118	5356	*
7119		- * Action: grant_super_admin
	5357	+ * @action grant_super_admin
7120	5358	*
7121	5359	* @param int $user_id The user's ID.
7122	5360	*/
7123		- public function grant_super_admin__add_to_network_approved( $user_id ) {
7124		- $user = get_user_by( 'id', $user_id );
	5361	+ function grant_super_admin__add_to_network_approved( $user_id ) {
	5362	+ $user = get_user_by( 'id', $user_id );
7125	5363	$user_email = $user->user_email;
7126	5364
7127	5365	// Add user to multisite approved user list (if not already there).
7128	5366	$auth_multisite_settings_access_users_approved = $this->sanitize_user_list(
7129		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT )
	5367	+ $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN )
7130	5368	);
7131	5369	if ( ! $this->in_multi_array( $user_email, $auth_multisite_settings_access_users_approved ) ) {
7132	5370	$multisite_approved_user = array(
7133		- 'email' => $this->lowercase( $user_email ),
7134		- 'role' => count( $user->roles ) > 0 ? $user->roles[0] : 'administrator',
	5371	+ 'email' => $user_email,
	5372	+ 'role' => count( $user->roles ) > 0 ? $user->roles[0] : 'administrator',
7135	5373	'date_added' => date( 'M Y', strtotime( $user->user_registered ) ),
7136	5374	'local_user' => true,
7137	5375	);
7138	5376	array_push( $auth_multisite_settings_access_users_approved, $multisite_approved_user );
7139		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
	5377	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
7140	5378	}
7141	5379
7142	5380	// Go through all pending/approved lists on individual sites and remove this user from them.
7143		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
7144	5381	$sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
7145	5382	foreach ( $sites as $site ) {
7146	5383	$blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
7147	5384	$this->remove_network_user_from_site_when_removed( $user_id, $blog_id );
		@@ -7154,29 +5391,29 @@
7154	5391	* When a user's super admin status is revoked (checkbox on network user edit
7155	5392	* screen), remove them from the authorizer network approved list. Also add
7156	5393	* them to approved list on any individual sites they are already a part of.
7157	5394	*
7158		- * Action: revoke_super_admin
	5395	+ * @action revoke_super_admin
7159	5396	*
7160	5397	* @param int $user_id The user's ID.
7161	5398	*/
7162		- public function revoke_super_admin__remove_from_network_approved( $user_id ) {
7163		- $user = get_user_by( 'id', $user_id );
	5399	+ function revoke_super_admin__remove_from_network_approved( $user_id ) {
	5400	+ $user = get_user_by( 'id', $user_id );
7164	5401	$revoked_email = $user->user_email;
7165	5402
7166	5403	// Go through multisite approved user list and remove this user.
7167	5404	$auth_multisite_settings_access_users_approved = $this->sanitize_user_list(
7168		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT )
	5405	+ $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN )
7169	5406	);
7170		- $list_changed = false;
	5407	+ $list_changed = false;
7171	5408	foreach ( $auth_multisite_settings_access_users_approved as $key => $existing_user ) {
7172		- if ( 0 === strcasecmp( $revoked_email, $existing_user['email'] ) ) {
	5409	+ if ( $revoked_email === $existing_user['email'] ) {
7173	5410	$list_changed = true;
7174		- unset( $auth_multisite_settings_access_users_approved[ $key ] );
	5411	+ unset( $auth_multisite_settings_access_users_approved[$key] );
7175	5412	}
7176	5413	}
7177	5414	if ( $list_changed ) {
7178		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
	5415	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
7179	5416	}
7180	5417
7181	5418	// Go through this user's current sites and add them to the approved list
7182	5419	// (since they are no longer on the network approved list).
		@@ -7187,21 +5424,14 @@
7187	5424	}
7188	5425
7189	5426	}
7190	5427
7191		- /**
7192		- * Send a welcome email message to a newly approved user (if the "Should
7193		- * email approved users" setting is enabled).
7194		- *
7195		- * @param string $email Email address to send welcome email to.
7196		- * @return bool Whether the email was sent.
7197		- */
7198	5428	private function maybe_email_welcome_message( $email ) {
7199	5429	// Get option for whether to email welcome messages.
7200	5430	$should_email_new_approved_users = $this->get_plugin_option( 'access_should_email_approved_users' );
7201	5431
7202	5432	// Do not send welcome email if option not enabled.
7203		- if ( '1' !== $should_email_new_approved_users ) {
	5433	+ if ( $should_email_new_approved_users !== '1' ) {
7204	5434	return false;
7205	5435	}
7206	5436
7207	5437	// Make sure we didn't just email this user (can happen with
		@@ -7207,15 +5437,15 @@
7207	5437	// Make sure we didn't just email this user (can happen with
7208	5438	// multiple admins saving at the same time, or by clicking
7209	5439	// Approve button too rapidly).
7210	5440	$recently_sent_emails = get_option( 'auth_settings_recently_sent_emails' );
7211		- if ( false === $recently_sent_emails ) {
	5441	+ if ( $recently_sent_emails === FALSE ) {
7212	5442	$recently_sent_emails = array();
7213	5443	}
7214	5444	foreach ( $recently_sent_emails as $key => $recently_sent_email ) {
7215	5445	if ( $recently_sent_email['time'] < strtotime( 'now -1 minutes' ) ) {
7216	5446	// Remove emails sent more than 1 minute ago.
7217		- unset( $recently_sent_emails[ $key ] );
	5447	+ unset( $recently_sent_emails[$key] );
7218	5448	} elseif ( $recently_sent_email['email'] === $email ) {
7219	5449	// Sent an email to this user within the last 1 minute, so
7220	5450	// quit without sending.
7221	5451	return false;
		@@ -7223,15 +5453,15 @@
7223	5453	}
7224	5454	// Add the email we're about to send to the list.
7225	5455	$recently_sent_emails[] = array(
7226	5456	'email' => $email,
7227		- 'time' => time(),
	5457	+ 'time' => time(),
7228	5458	);
7229	5459	update_option( 'auth_settings_recently_sent_emails', $recently_sent_emails );
7230	5460
7231		- // Get welcome email subject and body text.
	5461	+ // Get welcome email subject and body text
7232	5462	$subject = $this->get_plugin_option( 'access_email_approved_users_subject' );
7233		- $body = apply_filters( 'the_content', $this->get_plugin_option( 'access_email_approved_users_body' ) );
	5463	+ $body = apply_filters( 'the_content', $this->get_plugin_option( 'access_email_approved_users_body' ) );
7234	5464
7235	5465	// Fail if the subject/body options don't exist or are empty.
7236	5466	if ( is_null( $subject ) || is_null( $body ) || strlen( $subject ) === 0 || strlen( $body ) === 0 ) {
7237	5467	return false;
		@@ -7238,14 +5468,14 @@
7238	5468	}
7239	5469
7240	5470	// Replace approved shortcode patterns in subject and body.
7241	5471	$site_name = get_bloginfo( 'name' );
7242		- $site_url = get_site_url();
7243		- $subject = str_replace( '[site_name]', $site_name, $subject );
7244		- $body = str_replace( '[site_name]', $site_name, $body );
7245		- $body = str_replace( '[site_url]', $site_url, $body );
7246		- $body = str_replace( '[user_email]', $email, $body );
7247		- $headers = 'Content-type: text/html' . "\r\n";
	5472	+ $site_url = get_site_url();
	5473	+ $subject = str_replace( '[site_name]', $site_name, $subject );
	5474	+ $body = str_replace( '[site_name]', $site_name, $body );
	5475	+ $body = str_replace( '[site_url]', $site_url, $body );
	5476	+ $body = str_replace( '[user_email]', $email, $body );
	5477	+ $headers = 'Content-type: text/html' . "\r\n";
7248	5478
7249	5479	// Send email.
7250	5480	wp_mail( $email, $subject, $body, $headers );
7251	5481
		@@ -7255,22 +5485,14 @@
7255	5485
7256	5486
7257	5487	/**
7258	5488	* Generate a unique cookie to add to nonces to prevent CSRF.
7259		- *
7260		- * @var string
7261	5489	*/
7262		- private $cookie_value = null;
7263		-
7264		- /**
7265		- * Retrieve the unique login cookie.
7266		- *
7267		- * @return string Login cookie value.
7268		- */
7269		- private function get_cookie_value() {
	5490	+ protected $cookie_value = null;
	5491	+ function get_cookie_value() {
7270	5492	if ( ! $this->cookie_value ) {
7271	5493	if ( isset( $_COOKIE['login_unique'] ) ) {
7272		- $this->cookie_value = sanitize_key( wp_unslash( $_COOKIE['login_unique'] ) );
	5494	+ $this->cookie_value = $_COOKIE['login_unique'];
7273	5495	} else {
7274	5496	$this->cookie_value = md5( rand() );
7275	5497	}
7276	5498	}
		@@ -7278,51 +5500,23 @@
7278	5500	}
7279	5501
7280	5502
7281	5503	/**
7282		- * Encryption key (not secret!).
7283		- *
7284		- * @var string
7285		- */
7286		- private static $key = "8QxnrvjdtweisvCBKEY!+0\0\0";
7287		-
7288		- /**
7289		- * Encryption salt (not secret!).
7290		- *
7291		- * @var string
7292		- */
7293		- private static $iv = 'R_O2D]jPn]1[fhJl!-P1.oe';
7294		-
7295		- /**
7296	5504	* Basic encryption using a public (not secret!) key. Used for general
7297	5505	* database obfuscation of passwords.
7298		- *
7299		- * @param string $text String to encrypt.
7300		- * @param string $library Encryption library to use (openssl).
7301		- * @return string Encrypted string.
7302	5506	*/
7303		- private function encrypt( $text, $library = 'openssl' ) {
	5507	+ private static $key = "8QxnrvjdtweisvCBKEY!+0\0\0";
	5508	+ function encrypt( $text ) {
7304	5509	$result = '';
7305	5510
7306		- // Use openssl library (better) if it is enabled.
7307		- if ( function_exists( 'openssl_encrypt' ) && 'openssl' === $library ) {
7308		- $result = base64_encode(
7309		- openssl_encrypt(
7310		- $text,
7311		- 'AES-256-CBC',
7312		- hash( 'sha256', self::$key ),
7313		- 0,
7314		- substr( hash( 'sha256', self::$iv ), 0, 16 )
7315		- )
7316		- );
7317		- } elseif ( function_exists( 'mcrypt_encrypt' ) ) { // Use mcrypt library (deprecated in PHP 7.1) if php5-mcrypt extension is enabled.
7318		- $result = base64_encode( mcrypt_encrypt( MCRYPT_RIJNDAEL_256, self::$key, $text, MCRYPT_MODE_ECB, 'abcdefghijklmnopqrstuvwxyz012345' ) );
7319		- } else { // Fall back to basic obfuscation.
7320		- $length = strlen( $text );
7321		- for ( $i = 0; $i < $length; $i++ ) {
7322		- $char = substr( $text, $i, 1 );
	5511	+ // Use mcrypt library (better) if php5-mcrypt extension is enabled.
	5512	+ if ( function_exists( 'mcrypt_encrypt' ) ) {
	5513	+ $result = mcrypt_encrypt( MCRYPT_RIJNDAEL_256, self::$key, $text, MCRYPT_MODE_ECB, 'abcdefghijklmnopqrstuvwxyz012345' );
	5514	+ } else {
	5515	+ for ( $i = 0; $i < strlen( $text ); $i++ ) {
	5516	+ $char = substr( $text, $i, 1 );
7323	5517	$keychar = substr( self::$key, ( $i % strlen( self::$key ) ) - 1, 1 );
7324		- $char = chr( ord( $char ) + ord( $keychar ) );
	5518	+ $char = chr( ord( $char ) + ord( $keychar ) );
7325	5519	$result .= $char;
7326	5520	}
7327	5521	$result = base64_encode( $result );
7328	5522	}
		@@ -7330,38 +5524,20 @@
7330	5524	return $result;
7331	5525	}
7332	5526
7333	5527
7334		- /**
7335		- * Basic decryption using a public (not secret!) key. Used for general
7336		- * database obfuscation of passwords.
7337		- *
7338		- * @param string $secret String to encrypt.
7339		- * @param string $library Encryption lib to use (openssl).
7340		- * @return string Decrypted string
7341		- */
7342		- private function decrypt( $secret, $library = 'openssl' ) {
	5528	+ function decrypt( $secret ) {
7343	5529	$result = '';
7344	5530
7345		- // Use openssl library (better) if it is enabled.
7346		- if ( function_exists( 'openssl_decrypt' ) && 'openssl' === $library ) {
7347		- $result = openssl_decrypt(
7348		- base64_decode( $secret ),
7349		- 'AES-256-CBC',
7350		- hash( 'sha256', self::$key ),
7351		- 0,
7352		- substr( hash( 'sha256', self::$iv ), 0, 16 )
7353		- );
7354		- } elseif ( function_exists( 'mcrypt_decrypt' ) ) { // Use mcrypt library (deprecated in PHP 7.1) if php5-mcrypt extension is enabled.
7355		- $secret = base64_decode( $secret );
	5531	+ // Use mcrypt library (better) if php5-mcrypt extension is enabled.
	5532	+ if ( function_exists( 'mcrypt_decrypt' ) ) {
7356	5533	$result = rtrim( mcrypt_decrypt( MCRYPT_RIJNDAEL_256, self::$key, $secret, MCRYPT_MODE_ECB, 'abcdefghijklmnopqrstuvwxyz012345' ), "\0$result" );
7357		- } else { // Fall back to basic obfuscation.
	5534	+ } else {
7358	5535	$secret = base64_decode( $secret );
7359		- $length = strlen( $secret );
7360		- for ( $i = 0; $i < $length; $i++ ) {
7361		- $char = substr( $secret, $i, 1 );
	5536	+ for ( $i = 0; $i < strlen( $secret ); $i++ ) {
	5537	+ $char = substr( $secret, $i, 1 );
7362	5538	$keychar = substr( self::$key, ( $i % strlen( self::$key ) ) - 1, 1 );
7363		- $char = chr( ord( $char ) - ord( $keychar ) );
	5539	+ $char = chr( ord( $char ) - ord( $keychar ) );
7364	5540	$result .= $char;
7365	5541	}
7366	5542	}
7367	5543
		@@ -7372,12 +5548,10 @@
7372	5548	/**
7373	5549	* In a multisite environment, returns true if the current user is logged
7374	5550	* in and a user of the current blog. In single site mode, simply returns
7375	5551	* true if the current user is logged in.
7376		- *
7377		- * @return bool Whether current user is logged in and a user of the current blog.
7378	5552	*/
7379		- protected function is_user_logged_in_and_blog_user() {
	5553	+ function is_user_logged_in_and_blog_user() {
7380	5554	$is_user_logged_in_and_blog_user = false;
7381	5555	if ( is_multisite() ) {
7382	5556	$is_user_logged_in_and_blog_user = is_user_logged_in() && is_user_member_of_blog( get_current_user_id() );
7383	5557	} else {
		@@ -7390,57 +5564,39 @@
7390	5564	/**
7391	5565	* Helper function to determine whether a given email is in one of
7392	5566	* the lists (pending, approved, blocked). Defaults to the list of
7393	5567	* approved users.
7394		- *
7395		- * @param string $email Email to check existent of.
7396		- * @param string $list List to look for email in.
7397		- * @param string $multisite_mode Admin context.
7398		- * @return boolean Whether email was found.
7399	5568	*/
7400		- protected function is_email_in_list( $email = '', $list = 'approved', $multisite_mode = 'single' ) {
7401		- if ( empty( $email ) ) {
	5569	+ function is_email_in_list( $email = '', $list = 'approved', $multisite_mode = 'single' ) {
	5570	+ if ( empty( $email ) )
7402	5571	return false;
7403		- }
7404	5572
7405	5573	switch ( $list ) {
7406		- case 'pending':
7407		- $auth_settings_access_users_pending = $this->get_plugin_option( 'access_users_pending', WP_Plugin_Authorizer::SINGLE_CONTEXT );
7408		- return $this->in_multi_array( $email, $auth_settings_access_users_pending );
7409		- case 'blocked':
7410		- $auth_settings_access_users_blocked = $this->get_plugin_option( 'access_users_blocked', WP_Plugin_Authorizer::SINGLE_CONTEXT );
7411		- // Blocked list can have wildcard matches, e.g., @baddomain.com, which
7412		- // should match any email address at that domain. Check if any wildcards
7413		- // exist, and if the email address has that domain.
7414		- $email_in_blocked_domain = false;
7415		- $blocked_domains = preg_grep( '/^@.*/', array_map(
7416		- function ( $blocked_item ) { return $blocked_item['email']; },
7417		- $auth_settings_access_users_blocked
7418		- ) );
7419		- foreach ( $blocked_domains as $blocked_domain ) {
7420		- $email_domain = substr( $email, strrpos( $email, '@' ) );
7421		- if ( $email_domain === $blocked_domain ) {
7422		- $email_in_blocked_domain = true;
7423		- break;
7424		- }
7425		- }
7426		- return $email_in_blocked_domain || $this->in_multi_array( $email, $auth_settings_access_users_blocked );
7427		- case 'approved':
7428		- default:
7429		- if ( 'single' !== $multisite_mode ) {
7430		- // Get multisite users only.
7431		- $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT );
7432		- } elseif ( is_multisite() && 1 === intval( $this->get_plugin_option( 'advanced_override_multisite' ) ) ) {
7433		- // This site has overridden any multisite settings, so only get its users.
7434		- $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT );
7435		- } else {
7436		- // Get all site users and all multisite users.
7437		- $auth_settings_access_users_approved = array_merge(
7438		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT ),
7439		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT )
7440		- );
7441		- }
7442		- return $this->in_multi_array( $email, $auth_settings_access_users_approved );
	5574	+ case 'pending':
	5575	+ $auth_settings_access_users_pending = $this->get_plugin_option( 'access_users_pending', SINGLE_ADMIN );
	5576	+ return $this->in_multi_array( $email, $auth_settings_access_users_pending );
	5577	+ break;
	5578	+ case 'blocked':
	5579	+ $auth_settings_access_users_blocked = $this->get_plugin_option( 'access_users_blocked', SINGLE_ADMIN );
	5580	+ return $this->in_multi_array( $email, $auth_settings_access_users_blocked );
	5581	+ break;
	5582	+ case 'approved':
	5583	+ default:
	5584	+ if ( $multisite_mode !== 'single' ) {
	5585	+ // Get multisite users only.
	5586	+ $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN );
	5587	+ } elseif ( is_multisite() && $this->get_plugin_option( 'advanced_override_multisite' ) == '1' ) {
	5588	+ // This site has overridden any multisite settings, so only get its users.
	5589	+ $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN );
	5590	+ } else {
	5591	+ // Get all site users and all multisite users.
	5592	+ $auth_settings_access_users_approved = array_merge(
	5593	+ $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN ),
	5594	+ $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN )
	5595	+ );
	5596	+ }
	5597	+ return $this->in_multi_array( $email, $auth_settings_access_users_approved );
	5598	+ break;
7443	5599	}
7444	5600	}
7445	5601
7446	5602
		@@ -7446,37 +5602,36 @@
7446	5602
7447	5603	/**
7448	5604	* Helper function to get number of users (including multisite users)
7449	5605	* in a given list (pending, approved, or blocked).
7450		- *
7451		- * @param string $list List to get count of.
7452		- * @param string $admin_mode WP_Plugin_Authorizer::SINGLE_CONTEXT or WP_Plugin_Authorizer::NETWORK_CONTEXT determines whether to include multisite users.
7453		- * @return int Number of users in list.
	5606	+ * @param string $list
	5607	+ * @param string $admin_mode SINGLE_ADMIN or MULTISITE_ADMIN determines whether to include multisite users
	5608	+ * @return int number of users in list
7454	5609	*/
7455		- protected function get_user_count_from_list( $list, $admin_mode = WP_Plugin_Authorizer::SINGLE_CONTEXT ) {
	5610	+ function get_user_count_from_list( $list, $admin_mode = SINGLE_ADMIN ) {
7456	5611	$auth_settings_access_users = array();
7457	5612
7458	5613	switch ( $list ) {
7459		- case 'pending':
7460		- $auth_settings_access_users = $this->get_plugin_option( 'access_users_pending', WP_Plugin_Authorizer::SINGLE_CONTEXT );
7461		- break;
7462		- case 'blocked':
7463		- $auth_settings_access_users = $this->get_plugin_option( 'access_users_blocked', WP_Plugin_Authorizer::SINGLE_CONTEXT );
7464		- break;
7465		- case 'approved':
7466		- if ( WP_Plugin_Authorizer::SINGLE_CONTEXT !== $admin_mode ) {
7467		- // Get multisite users only.
7468		- $auth_settings_access_users = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT );
7469		- } elseif ( is_multisite() && 1 === intval( $this->get_plugin_option( 'advanced_override_multisite' ) ) ) {
7470		- // This site has overridden any multisite settings, so only get its users.
7471		- $auth_settings_access_users = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT );
7472		- } else {
7473		- // Get all site users and all multisite users.
7474		- $auth_settings_access_users = array_merge(
7475		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT ),
7476		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT )
7477		- );
7478		- }
	5614	+ case 'pending':
	5615	+ $auth_settings_access_users = $this->get_plugin_option( 'access_users_pending', SINGLE_ADMIN );
	5616	+ break;
	5617	+ case 'blocked':
	5618	+ $auth_settings_access_users = $this->get_plugin_option( 'access_users_blocked', SINGLE_ADMIN );
	5619	+ break;
	5620	+ case 'approved':
	5621	+ if ( $admin_mode !== SINGLE_ADMIN ) {
	5622	+ // Get multisite users only.
	5623	+ $auth_settings_access_users = $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN );
	5624	+ } elseif ( is_multisite() && $this->get_plugin_option( 'advanced_override_multisite' ) == '1' ) {
	5625	+ // This site has overridden any multisite settings, so only get its users.
	5626	+ $auth_settings_access_users = $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN );
	5627	+ } else {
	5628	+ // Get all site users and all multisite users.
	5629	+ $auth_settings_access_users = array_merge(
	5630	+ $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN ),
	5631	+ $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN )
	5632	+ );
	5633	+ }
7479	5634	}
7480	5635
7481	5636	return count( $auth_settings_access_users );
7482	5637	}
		@@ -7483,27 +5638,21 @@
7483	5638
7484	5639
7485	5640	/**
7486	5641	* Helper function to search a multidimensional array for a value.
7487		- *
7488		- * @param string $needle Value to search for.
7489		- * @param array $haystack Multidimensional array to search.
7490		- * @param string $strict_mode 'strict' if strict comparisons should be used.
7491		- * @param string $case_sensitivity 'case sensitive' if comparisons should respect case.
7492		- * @return bool Whether needle was found.
7493	5642	*/
7494		- protected function in_multi_array( $needle = '', $haystack = array(), $strict_mode = 'not strict', $case_sensitivity = 'case insensitive' ) {
	5643	+ function in_multi_array( $needle = '', $haystack = array(), $strict_mode = 'not strict', $case_sensitivity = 'case insensitive' ) {
7495	5644	if ( ! is_array( $haystack ) ) {
7496	5645	return false;
7497	5646	}
7498		- if ( 'case insensitive' === $case_sensitivity ) {
	5647	+ if ( $case_sensitivity === 'case insensitive' ) {
7499	5648	$needle = strtolower( $needle );
7500	5649	}
7501	5650	foreach ( $haystack as $item ) {
7502		- if ( 'case insensitive' === $case_sensitivity && ! is_array( $item ) ) {
	5651	+ if ( $case_sensitivity === 'case insensitive' && ! is_array( $item ) ) {
7503	5652	$item = strtolower( $item );
7504	5653	}
7505		- if ( ( 'strict' === $strict_mode ? $item === $needle : $item == $needle ) || ( is_array( $item ) && $this->in_multi_array( $needle, $item, $strict_mode, $case_sensitivity ) ) ) { // phpcs:ignore WordPress.PHP.StrictComparisons.LooseComparison
	5654	+ if ( ( $strict_mode === 'strict' ? $item === $needle : $item == $needle ) || ( is_array( $item ) && $this->in_multi_array( $needle, $item, $strict_mode, $case_sensitivity ) ) ) {
7506	5655	return true;
7507	5656	}
7508	5657	}
7509	5658	return false;
		@@ -7510,31 +5659,43 @@
7510	5659	}
7511	5660
7512	5661
7513	5662	/**
	5663	+ * Helper function to get a WordPress page ID from the pagename.
	5664	+ *
	5665	+ * @param string $pagename Page Slug
	5666	+ * @return int Page/Post ID
	5667	+ */
	5668	+ function get_id_from_pagename( $pagename = '' ) {
	5669	+ global $wpdb;
	5670	+ $page_id = $wpdb->get_var( "SELECT ID FROM $wpdb->posts WHERE post_name = '" . sanitize_title_for_query( $pagename ) . "'" );
	5671	+ return $page_id;
	5672	+ }
	5673	+
	5674	+
	5675	+ /**
7514	5676	* Helper function to determine if an URL is accessible.
7515	5677	*
7516		- * @param string $url URL that should be publicly reachable.
7517		- * @return boolean Whether the URL is publicly reachable.
	5678	+ * @param string $url URL that should be publicly reachable
	5679	+ * @return boolean Whether the URL is publicly reachable
7518	5680	*/
7519		- protected function url_is_accessible( $url ) {
	5681	+ function url_is_accessible( $url ) {
7520	5682	// Use wp_remote_retrieve_response_code() to retrieve the URL.
7521		- $response = wp_remote_get( $url );
	5683	+ $response = wp_remote_get( $url );
7522	5684	$response_code = wp_remote_retrieve_response_code( $response );
7523	5685
7524		- // Return true if the document has loaded successfully without any redirection or error.
7525		- return $response_code >= 200 && $response_code < 400;
	5686	+ // Return true if the document has loaded successfully without any redirection or error
	5687	+ return $response_code >= 200 && $response_code < 300;
7526	5688	}
7527	5689
7528	5690
7529	5691	/**
7530	5692	* Helper function to reconstruct a URL split using parse_url().
7531		- *
7532		- * @param array $parts Array returned from parse_url().
7533		- * @return string URL.
	5693	+ * @param array $parts Array returned from parse_url().
	5694	+ * @return string URL.
7534	5695	*/
7535		- protected function build_url( $parts = array() ) {
7536		- return (
	5696	+ function build_url( $parts = array() ) {
	5697	+ return
7537	5698	( isset( $parts['scheme'] ) ? "{$parts['scheme']}:" : '' ) .
7538	5699	( ( isset( $parts['user'] ) || isset( $parts['host'] ) ) ? '//' : '' ) .
7539	5700	( isset( $parts['user'] ) ? "{$parts['user']}" : '' ) .
7540	5701	( isset( $parts['pass'] ) ? ":{$parts['pass']}" : '' ) .
		@@ -7542,30 +5703,21 @@
7542	5703	( isset( $parts['host'] ) ? "{$parts['host']}" : '' ) .
7543	5704	( isset( $parts['port'] ) ? ":{$parts['port']}" : '' ) .
7544	5705	( isset( $parts['path'] ) ? "{$parts['path']}" : '' ) .
7545	5706	( isset( $parts['query'] ) ? "?{$parts['query']}" : '' ) .
7546		- ( isset( $parts['fragment'] ) ? "#{$parts['fragment']}" : '' )
7547		- );
	5707	+ ( isset( $parts['fragment'] ) ? "#{$parts['fragment']}" : '' );
7548	5708	}
7549	5709
7550	5710
7551		- /**
7552		- * Helper function that prints option tags for a select element for all
7553		- * roles the current user has permission to assign.
7554		- *
7555		- * @param string $selected_role Which role should be selected in the dropdown.
7556		- * @param string $disable_input 'disabled' if select element should be disabled.
7557		- * @param int $admin_mode WP_Plugin_Authorizer::NETWORK_CONTEXT if we are in that context.
7558		- * @return void
7559		- */
7560		- protected function wp_dropdown_permitted_roles( $selected_role = 'subscriber', $disable_input = 'not disabled', $admin_mode = WP_Plugin_Authorizer::SINGLE_CONTEXT ) {
7561		- $roles = get_editable_roles();
	5711	+ // Helper function that builds option tags for a select element for all
	5712	+ // roles the current user has permission to assign.
	5713	+ function wp_dropdown_permitted_roles( $selected_role = 'subscriber', $disable_input = 'not disabled', $admin_mode = SINGLE_ADMIN ) {
	5714	+ $roles = get_editable_roles();
7562	5715	$current_user = wp_get_current_user();
7563	5716
7564	5717	// If we're in network admin, also show any roles that might exist only on
7565	5718	// specific sites in the network (themes can add their own roles).
7566		- if ( WP_Plugin_Authorizer::NETWORK_CONTEXT === $admin_mode ) {
7567		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
	5719	+ if ( $admin_mode === MULTISITE_ADMIN ) {
7568	5720	$sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
7569	5721	foreach ( $sites as $site ) {
7570	5722	$blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
7571	5723	switch_to_blog( $blog_id );
		@@ -7574,11 +5726,11 @@
7574	5726	}
7575	5727	$unique_role_names = array();
7576	5728	foreach ( $roles as $role_name => $role_info ) {
7577	5729	if ( array_key_exists( $role_name, $unique_role_names ) ) {
7578		- unset( $roles[ $role_name ] );
	5730	+ unset( $roles[$role_name] );
7579	5731	} else {
7580		- $unique_role_names[ $role_name ] = true;
	5732	+ $unique_role_names[$role_name] = true;
7581	5733	}
7582	5734	}
7583	5735	}
7584	5736
		@@ -7590,43 +5742,39 @@
7590	5742	}
7591	5743
7592	5744	// Print an option element for each permitted role.
7593	5745	foreach ( $roles as $name => $role ) {
7594		- $is_selected = $selected_role === $name;
	5746	+ $selected = $selected_role === $name ? ' selected="selected"' : '';
7595	5747
7596		- // Don't let a user change their own role (but network admins always can).
7597		- $is_disabled = $selected_role !== $name && 'disabled' === $disable_input && ! ( is_multisite() && current_user_can( 'manage_network' ) );
7598		- ?>
7599		- <option value="<?php echo esc_attr( $name ); ?>"<?php selected( $is_selected ); ?><?php disabled( $is_disabled ); ?>><?php echo esc_html( $role['name'] ); ?></option>
7600		- <?php
	5748	+ // Don't let a user change their own role
	5749	+ $disabled = $selected_role !== $name && $disable_input === 'disabled' ? ' disabled="disabled"' : '';
	5750	+
	5751	+ // But network admins can always change their role.
	5752	+ if ( is_multisite() && current_user_can( 'manage_network' ) ) {
	5753	+ $disabled = '';
	5754	+ }
	5755	+
	5756	+ ?><option value="<?php echo $name; ?>"<?php echo $selected . $disabled; ?>><?php echo $role['name']; ?></option><?php
7601	5757	}
7602	5758
7603	5759	// Print default role (no role).
7604		- $is_selected = strlen( $selected_role ) === 0 || ! array_key_exists( $selected_role, $roles );
7605		- $is_disabled = strlen( $selected_role ) > 0 && 'disabled' === $disable_input && ! ( is_multisite() && current_user_can( 'manage_network' ) );
7606		- ?>
7607		- <option value=""<?php selected( $is_selected ); ?><?php disabled( $is_disabled ); ?>><?php esc_html_e( '&mdash; No role for this site &mdash;', 'authorizer' ); ?></option>
7608		- <?php
	5760	+ $selected = strlen( $selected_role ) == 0 || ! array_key_exists( $selected_role, $roles ) ? ' selected="selected"' : '';
	5761	+ $disabled = strlen( $selected_role ) > 0 && $disable_input === 'disabled' ? ' disabled="disabled"' : '';
	5762	+ if ( is_multisite() && current_user_can( 'manage_network' ) ) {
	5763	+ $disabled = '';
	5764	+ }
	5765	+ ?><option value=""<?php echo $selected . $disabled; ?>><?php _e( '&mdash; No role for this site &mdash;', 'authorizer' ); ?></option><?php
7609	5766
7610	5767	}
7611	5768
7612	5769
7613		- /**
7614		- * Helper function to get a single user info array from one of the access
7615		- * control lists (pending, approved, or blocked).
7616		- *
7617		- * @param string $email Email address to retrieve info for.
7618		- * @param string $list List to get info from.
7619		- * @return mixed false if not found, otherwise: array(
7620		- * 'email' => '',
7621		- * 'role' => '',
7622		- * 'date_added' => '',
7623		- * ['usermeta' => [''|array()]]
7624		- * );
7625		- */
7626		- protected function get_user_info_from_list( $email, $list ) {
	5770	+ // Helper function to get a single user info array from one of the
	5771	+ // access control lists (pending, approved, or blocked).
	5772	+ // Returns: false if not found; otherwise
	5773	+ // array( 'email' => '', 'role' => '', 'date_added' => '', ['usermeta' => [''|array()]] );
	5774	+ function get_user_info_from_list( $email, $list ) {
7627	5775	foreach ( $list as $user_info ) {
7628		- if ( 0 === strcasecmp( $user_info['email'], $email ) ) {
	5776	+ if ( $user_info['email'] === $email ) {
7629	5777	return $user_info;
7630	5778	}
7631	5779	}
7632	5780	return false;
		@@ -7631,49 +5779,29 @@
7631	5779	}
7632	5780	return false;
7633	5781	}
7634	5782
7635		- /**
7636		- * Helper function to convert a string to lowercase. Prefers to use mb_strtolower,
7637		- * but will fall back to strtolower if the former is not available.
7638		- *
7639		- * @param string $string String to convert to lowercase.
7640		- * @return string Input in lowercase.
7641		- */
7642		- protected function lowercase( $string ) {
7643		- return function_exists( 'mb_strtolower' ) ? mb_strtolower( $string ) : strtolower( $string );
7644		- }
7645	5783
7646		-
7647		- /**
7648		- * Helper function to convert seconds to human readable text.
7649		- *
7650		- * @see: http://csl.name/php-secs-to-human-text/
7651		- *
7652		- * @param int $secs Seconds to display as readable text.
7653		- * @return string Readable version of number of seconds.
7654		- */
7655		- protected function seconds_as_sentence( $secs ) {
	5784	+ // Helper function to convert seconds to human readable text.
	5785	+ // Source: http://csl.name/php-secs-to-human-text/
	5786	+ function seconds_as_sentence( $secs ) {
7656	5787	$units = array(
7657		- 'week' => 3600 * 24 * 7,
7658		- 'day' => 3600 * 24,
7659		- 'hour' => 3600,
7660		- 'minute' => 60,
7661		- 'second' => 1,
	5788	+ "week" => 7 * 24 * 3600,
	5789	+ "day" => 24 * 3600,
	5790	+ "hour" => 3600,
	5791	+ "minute" => 60,
	5792	+ "second" => 1,
7662	5793	);
7663	5794
7664		- // Specifically handle zero.
7665		- if ( 0 === intval( $secs ) ) {
7666		- return '0 seconds';
7667		- }
	5795	+ // specifically handle zero
	5796	+ if ( $secs == 0 ) return "0 seconds";
7668	5797
7669		- $s = '';
	5798	+ $s = "";
7670	5799
7671	5800	foreach ( $units as $name => $divisor ) {
7672		- $quot = intval( $secs / $divisor );
7673		- if ( $quot ) {
7674		- $s .= "$quot $name";
7675		- $s .= ( abs( $quot ) > 1 ? 's' : '' ) . ', ';
	5801	+ if ( $quot = intval( $secs / $divisor ) ) {
	5802	+ $s .= "$quot $name";
	5803	+ $s .= ( abs( $quot ) > 1 ? "s" : "" ) . ", ";
7676	5804	$secs -= $quot * $divisor;
7677	5805	}
7678	5806	}
7679	5807
		@@ -7679,14 +5807,10 @@
7679	5807
7680	5808	return substr( $s, 0, -2 );
7681	5809	}
7682	5810
7683		- /**
7684		- * Helper function to get all available usermeta keys as an array.
7685		- *
7686		- * @return array All usermeta keys for user.
7687		- */
7688		- protected function get_all_usermeta_keys() {
	5811	+ // Helper function to get all available usermeta keys as an array.
	5812	+ function get_all_usermeta_keys() {
7689	5813	global $wpdb;
7690	5814	$usermeta_keys = $wpdb->get_col( "SELECT DISTINCT $wpdb->usermeta.meta_key FROM $wpdb->usermeta" );
7691	5815	return $usermeta_keys;
7692	5816	}
		@@ -7693,12 +5817,10 @@
7693	5817
7694	5818
7695	5819	/**
7696	5820	* Load translated strings from *.mo files in /languages.
7697		- *
7698		- * Action: plugins_loaded
7699	5821	*/
7700		- public function load_textdomain() {
	5822	+ function load_textdomain() {
7701	5823	load_plugin_textdomain(
7702	5824	'authorizer',
7703	5825	false,
7704	5826	plugin_basename( dirname( __FILE__ ) ) . '/languages'
		@@ -7709,17 +5831,14 @@
7709	5831	/**
7710	5832	* Generate CAS authentication URL (wp-login.php URL with reauth=1 removed
7711	5833	* and external=cas added).
7712	5834	*/
7713		- private function modify_current_url_for_cas_login() {
	5835	+ function modify_current_url_for_cas_login() {
7714	5836	// Construct the URL of the current page (wp-login.php).
7715		- $url = '';
7716		- if ( isset( $_SERVER['HTTP_HOST'], $_SERVER['REQUEST_URI'] ) ) {
7717		- $url = set_url_scheme( esc_url_raw( wp_unslash( $_SERVER['HTTP_HOST'] ) ) . esc_url_raw( wp_unslash( $_SERVER['REQUEST_URI'] ) ) );
7718		- }
	5837	+ $url = 'http' . ( isset( $_SERVER['HTTPS'] ) ? 's' : '' ) . '://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
7719	5838
7720	5839	// Parse the URL into its components.
7721		- $parsed_url = wp_parse_url( $url );
	5840	+ $parsed_url = parse_url( $url );
7722	5841
7723	5842	// Fix up the querystring values (remove reauth, make sure external=cas).
7724	5843	$querystring = array();
7725	5844	if ( array_key_exists( 'query', $parsed_url ) ) {
		@@ -7726,9 +5845,9 @@
7726	5845	parse_str( $parsed_url['query'], $querystring );
7727	5846	}
7728	5847	unset( $querystring['reauth'] );
7729	5848	$querystring['external'] = 'cas';
7730		- $parsed_url['query'] = http_build_query( $querystring );
	5849	+ $parsed_url['query'] = http_build_query( $querystring );
7731	5850
7732	5851	// Return the URL as a string.
7733	5852	return $this->unparse_url( $parsed_url );
7734	5853	}
		@@ -7735,21 +5854,20 @@
7735	5854
7736	5855
7737	5856	/**
7738	5857	* Reconstruct a URL after it has been deconstructed with parse_url().
7739		- *
7740		- * @param array $parsed_url Keys from parse_url().
7741		- * @return string URL constructed from the components in $parsed_url.
	5858	+ * @param $parsed_url array() with keys from parse_url().
	5859	+ * @return string URL constructed from the components in $parsed_url.
7742	5860	*/
7743		- protected function unparse_url( $parsed_url = array() ) {
7744		- $scheme = isset( $parsed_url['scheme'] ) ? $parsed_url['scheme'] . '://' : '';
7745		- $host = isset( $parsed_url['host'] ) ? $parsed_url['host'] : '';
7746		- $port = isset( $parsed_url['port'] ) ? ':' . $parsed_url['port'] : '';
7747		- $user = isset( $parsed_url['user'] ) ? $parsed_url['user'] : '';
7748		- $pass = isset( $parsed_url['pass'] ) ? ':' . $parsed_url['pass'] : '';
7749		- $pass = $user || $pass ? "$pass@" : '';
7750		- $path = isset( $parsed_url['path'] ) ? $parsed_url['path'] : '';
7751		- $query = isset( $parsed_url['query'] ) ? '?' . $parsed_url['query'] : '';
	5861	+ function unparse_url( $parsed_url = array() ) {
	5862	+ $scheme = isset( $parsed_url['scheme'] ) ? $parsed_url['scheme'] . '://' : '';
	5863	+ $host = isset( $parsed_url['host'] ) ? $parsed_url['host'] : '';
	5864	+ $port = isset( $parsed_url['port'] ) ? ':' . $parsed_url['port'] : '';
	5865	+ $user = isset( $parsed_url['user'] ) ? $parsed_url['user'] : '';
	5866	+ $pass = isset( $parsed_url['pass'] ) ? ':' . $parsed_url['pass'] : '';
	5867	+ $pass = $user || $pass ? "$pass@" : '';
	5868	+ $path = isset( $parsed_url['path'] ) ? $parsed_url['path'] : '';
	5869	+ $query = isset( $parsed_url['query'] ) ? '?' . $parsed_url['query'] : '';
7752	5870	$fragment = isset( $parsed_url['fragment'] ) ? '#' . $parsed_url['fragment'] : '';
7753	5871	return "$scheme$user$pass$host$port$path$query$fragment";
7754	5872	}
7755	5873
		@@ -7754,32 +5872,35 @@
7754	5872	}
7755	5873
7756	5874
7757	5875	/**
7758		- * Helper function to generate an HTML class name for an option (used in
7759		- * Authorizer Settings in the Approved User list).
7760		- *
7761		- * @param string $suffix Unique part of class name.
7762		- * @param boolean $is_multisite_user Whether the class name should indicate it's a multisite user.
7763		- * @return string Class name, e.g., "auth-email auth-multisite-email".
7764		- */
7765		- private function create_class_name( $suffix = '', $is_multisite_user = false ) {
7766		- return $is_multisite_user ? "auth-$suffix auth-multisite-$suffix" : "auth-$suffix";
7767		- }
7768		-
7769		-
7770		- /**
7771	5876	* Plugin Update Routines.
7772		- *
7773		- * Action: plugins_loaded
7774	5877	*/
7775		- public function auth_update_check() {
7776		- // Get current version.
7777		- $needs_updating = false;
7778		- if ( is_multisite() ) {
7779		- $auth_version = get_blog_option( $this->current_site_blog_id, 'auth_version' );
7780		- } else {
7781		- $auth_version = get_option( 'auth_version' );
	5878	+ function auth_update_check() {
	5879	+ // Update: Set default values for newly added options (forgot to do
	5880	+ // this, so some users are getting debug log notices about undefined
	5881	+ // indexes in $auth_settings).
	5882	+ $update_if_older_than = 20160831;
	5883	+ $auth_version = get_option( 'auth_version' );
	5884	+ if ( $auth_version === false || intval( $auth_version ) < $update_if_older_than ) {
	5885	+ // Provide default values for any $auth_settings options that don't exist.
	5886	+ if ( is_multisite() ) {
	5887	+ // Get all blog ids
	5888	+ $sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
	5889	+ foreach ( $sites as $site ) {
	5890	+ $blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
	5891	+ switch_to_blog( $blog_id );
	5892	+ // Set meaningful defaults for other sites in the network.
	5893	+ $this->set_default_options();
	5894	+ // Switch back to original blog. See: https://codex.wordpress.org/Function_Reference/restore_current_blog
	5895	+ restore_current_blog();
	5896	+ }
	5897	+ } else {
	5898	+ // Set meaningful defaults for this site.
	5899	+ $this->set_default_options();
	5900	+ }
	5901	+ // Update version to reflect this change has been made.
	5902	+ update_option( 'auth_version', $update_if_older_than );
7782	5903	}
7783	5904
7784	5905	// Update: migrate user lists to own options (addresses concurrency
7785	5906	// when saving plugin options, since user lists are changed often
		@@ -7789,9 +5910,10 @@
7789	5910	// log in; approved and blocked lists are changed whenever an admin
7790	5911	// changes them from the multisite panel, the dashboard widget, or
7791	5912	// the plugin options page.
7792	5913	$update_if_older_than = 20140709;
7793		- if ( false === $auth_version || intval( $auth_version ) < $update_if_older_than ) {
	5914	+ $auth_version = get_option( 'auth_version' );
	5915	+ if ( $auth_version === false || intval( $auth_version ) < $update_if_older_than ) {
7794	5916	// Copy single site user lists to new options (if they exist).
7795	5917	$auth_settings = get_option( 'auth_settings' );
7796	5918	if ( is_array( $auth_settings ) && array_key_exists( 'access_users_pending', $auth_settings ) ) {
7797	5919	update_option( 'auth_settings_access_users_pending', $auth_settings['access_users_pending'] );
		@@ -7809,285 +5931,36 @@
7809	5931	update_option( 'auth_settings', $auth_settings );
7810	5932	}
7811	5933	// Copy multisite user lists to new options (if they exist).
7812	5934	if ( is_multisite() ) {
7813		- $auth_multisite_settings = get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings', array() );
	5935	+ $auth_multisite_settings = get_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings', array() );
7814	5936	if ( is_array( $auth_multisite_settings ) && array_key_exists( 'access_users_pending', $auth_multisite_settings ) ) {
7815		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_pending', $auth_multisite_settings['access_users_pending'] );
	5937	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_pending', $auth_multisite_settings['access_users_pending'] );
7816	5938	unset( $auth_multisite_settings['access_users_pending'] );
7817		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings', $auth_multisite_settings );
	5939	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings', $auth_multisite_settings );
7818	5940	}
7819	5941	if ( is_array( $auth_multisite_settings ) && array_key_exists( 'access_users_approved', $auth_multisite_settings ) ) {
7820		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings['access_users_approved'] );
	5942	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings['access_users_approved'] );
7821	5943	unset( $auth_multisite_settings['access_users_approved'] );
7822		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings', $auth_multisite_settings );
	5944	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings', $auth_multisite_settings );
7823	5945	}
7824	5946	if ( is_array( $auth_multisite_settings ) && array_key_exists( 'access_users_blocked', $auth_multisite_settings ) ) {
7825		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_blocked', $auth_multisite_settings['access_users_blocked'] );
	5947	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_blocked', $auth_multisite_settings['access_users_blocked'] );
7826	5948	unset( $auth_multisite_settings['access_users_blocked'] );
7827		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings', $auth_multisite_settings );
	5949	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings', $auth_multisite_settings );
7828	5950	}
7829	5951	}
7830	5952	// Update version to reflect this change has been made.
7831		- $auth_version = $update_if_older_than;
7832		- $needs_updating = true;
	5953	+ update_option( 'auth_version', $update_if_older_than );
7833	5954	}
7834	5955
7835		- // Update: Set default values for newly added options (forgot to do
7836		- // this, so some users are getting debug log notices about undefined
7837		- // indexes in $auth_settings).
7838		- $update_if_older_than = 20160831;
7839		- if ( false === $auth_version || intval( $auth_version ) < $update_if_older_than ) {
7840		- // Provide default values for any $auth_settings options that don't exist.
7841		- if ( is_multisite() ) {
7842		- // Get all blog ids.
7843		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
7844		- $sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
7845		- foreach ( $sites as $site ) {
7846		- $blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
7847		- switch_to_blog( $blog_id );
7848		- // Set meaningful defaults for other sites in the network.
7849		- $this->set_default_options();
7850		- // Switch back to original blog.
7851		- restore_current_blog();
7852		- }
7853		- } else {
7854		- // Set meaningful defaults for this site.
7855		- $this->set_default_options();
7856		- }
7857		- // Update version to reflect this change has been made.
7858		- $auth_version = $update_if_older_than;
7859		- $needs_updating = true;
7860		- }
7861		-
7862		- // Update: Migrate LDAP passwords encrypted with mcrypt since mcrypt is
7863		- // deprecated as of PHP 7.1. Use openssl library instead.
7864		- $update_if_older_than = 20170510;
7865		- if ( false === $auth_version || intval( $auth_version ) < $update_if_older_than ) {
7866		- if ( is_multisite() ) {
7867		- // Reencrypt LDAP passwords in each site in the network.
7868		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
7869		- $sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
7870		- foreach ( $sites as $site ) {
7871		- $blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
7872		- $auth_settings = get_blog_option( $blog_id, 'auth_settings', array() );
7873		- if ( array_key_exists( 'ldap_password', $auth_settings ) && strlen( $auth_settings['ldap_password'] ) > 0 ) {
7874		- $plaintext_ldap_password = $this->decrypt( $auth_settings['ldap_password'], 'mcrypt' );
7875		- $auth_settings['ldap_password'] = $this->encrypt( $plaintext_ldap_password );
7876		- update_blog_option( $blog_id, 'auth_settings', $auth_settings );
7877		- }
7878		- }
7879		- } else {
7880		- // Reencrypt LDAP password on this single-site install.
7881		- $auth_settings = get_option( 'auth_settings', array() );
7882		- if ( array_key_exists( 'ldap_password', $auth_settings ) && strlen( $auth_settings['ldap_password'] ) > 0 ) {
7883		- $plaintext_ldap_password = $this->decrypt( $auth_settings['ldap_password'], 'mcrypt' );
7884		- $auth_settings['ldap_password'] = $this->encrypt( $plaintext_ldap_password );
7885		- update_option( 'auth_settings', $auth_settings );
7886		- }
7887		- }
7888		- // Update version to reflect this change has been made.
7889		- $auth_version = $update_if_older_than;
7890		- $needs_updating = true;
7891		- }
7892		-
7893		- // Update: Migrate LDAP passwords encrypted with mcrypt since mcrypt is
7894		- // deprecated as of PHP 7.1. Use openssl library instead.
7895		- // Note: Forgot to update the auth_multisite_settings ldap password! Do it here.
7896		- $update_if_older_than = 20170511;
7897		- if ( false === $auth_version || intval( $auth_version ) < $update_if_older_than ) {
7898		- if ( is_multisite() ) {
7899		- // Reencrypt LDAP password in network (multisite) options.
7900		- $auth_multisite_settings = get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings', array() );
7901		- if ( array_key_exists( 'ldap_password', $auth_multisite_settings ) && strlen( $auth_multisite_settings['ldap_password'] ) > 0 ) {
7902		- $plaintext_ldap_password = $this->decrypt( $auth_multisite_settings['ldap_password'], 'mcrypt' );
7903		- $auth_multisite_settings['ldap_password'] = $this->encrypt( $plaintext_ldap_password );
7904		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings', $auth_multisite_settings );
7905		- }
7906		- }
7907		- // Update version to reflect this change has been made.
7908		- $auth_version = $update_if_older_than;
7909		- $needs_updating = true;
7910		- }
7911		-
7912		- // Update: Remove duplicates from approved list caused by authorizer_automatically_approve_login
7913		- // filter not respecting users who are already in the approved list
7914		- // (causing them to get re-added each time they logged in).
7915		- $update_if_older_than = 20170711;
7916		- if ( false === $auth_version || intval( $auth_version ) < $update_if_older_than ) {
7917		- // Remove duplicates from approved user lists.
7918		- if ( is_multisite() ) {
7919		- // Remove duplicates from each site in the multisite.
7920		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
7921		- $sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
7922		- foreach ( $sites as $site ) {
7923		- $blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
7924		- $auth_settings_access_users_approved = get_blog_option( $blog_id, 'auth_settings_access_users_approved', array() );
7925		- if ( is_array( $auth_settings_access_users_approved ) ) {
7926		- $should_update = false;
7927		- $distinct_emails = array();
7928		- foreach ( $auth_settings_access_users_approved as $key => $user ) {
7929		- if ( in_array( $user['email'], $distinct_emails, true ) ) {
7930		- $should_update = true;
7931		- unset( $auth_settings_access_users_approved[ $key ] );
7932		- } else {
7933		- $distinct_emails[] = $user['email'];
7934		- }
7935		- }
7936		- if ( $should_update ) {
7937		- update_blog_option( $blog_id, 'auth_settings_access_users_approved', $auth_settings_access_users_approved );
7938		- }
7939		- }
7940		- }
7941		- // Remove duplicates from multisite approved user list.
7942		- $auth_multisite_settings_access_users_approved = get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', array() );
7943		- if ( is_array( $auth_multisite_settings_access_users_approved ) ) {
7944		- $should_update = false;
7945		- $distinct_emails = array();
7946		- foreach ( $auth_multisite_settings_access_users_approved as $key => $user ) {
7947		- if ( in_array( $user['email'], $distinct_emails, true ) ) {
7948		- $should_update = true;
7949		- unset( $auth_multisite_settings_access_users_approved[ $key ] );
7950		- } else {
7951		- $distinct_emails[] = $user['email'];
7952		- }
7953		- }
7954		- if ( $should_update ) {
7955		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
7956		- }
7957		- }
7958		- } else {
7959		- // Remove duplicates from single site approved user list.
7960		- $auth_settings_access_users_approved = get_option( 'auth_settings_access_users_approved' );
7961		- if ( is_array( $auth_settings_access_users_approved ) ) {
7962		- $should_update = false;
7963		- $distinct_emails = array();
7964		- foreach ( $auth_settings_access_users_approved as $key => $user ) {
7965		- if ( in_array( $user['email'], $distinct_emails, true ) ) {
7966		- $should_update = true;
7967		- unset( $auth_settings_access_users_approved[ $key ] );
7968		- } else {
7969		- $distinct_emails[] = $user['email'];
7970		- }
7971		- }
7972		- if ( $should_update ) {
7973		- update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved );
7974		- }
7975		- }
7976		- }
7977		- // Update version to reflect this change has been made.
7978		- $auth_version = $update_if_older_than;
7979		- $needs_updating = true;
7980		- }
7981		-
7982		- // Update: Set default value for newly added option advanced_widget_enabled.
7983		- $update_if_older_than = 20171023;
7984		- if ( false === $auth_version || intval( $auth_version ) < $update_if_older_than ) {
7985		- // Provide default values for any $auth_settings options that don't exist.
7986		- if ( is_multisite() ) {
7987		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
7988		- $sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
7989		- foreach ( $sites as $site ) {
7990		- $blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
7991		- switch_to_blog( $blog_id );
7992		- $this->set_default_options();
7993		- restore_current_blog();
7994		- }
7995		- } else {
7996		- $this->set_default_options();
7997		- }
7998		- // Update version to reflect this change has been made.
7999		- $auth_version = $update_if_older_than;
8000		- $needs_updating = true;
8001		- }
8002		-
8003		- // Update: Set default value for newly added option advanced_users_per_page.
8004		- $update_if_older_than = 20171215;
8005		- if ( false === $auth_version || intval( $auth_version ) < $update_if_older_than ) {
8006		- // Provide default values for any $auth_settings options that don't exist.
8007		- if ( is_multisite() ) {
8008		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
8009		- $sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
8010		- foreach ( $sites as $site ) {
8011		- $blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
8012		- switch_to_blog( $blog_id );
8013		- $this->set_default_options();
8014		- restore_current_blog();
8015		- }
8016		- } else {
8017		- $this->set_default_options();
8018		- }
8019		- // Update version to reflect this change has been made.
8020		- $auth_version = $update_if_older_than;
8021		- $needs_updating = true;
8022		- }
8023		-
8024		- // Update: Set default value for newly added options advanced_users_sort_by and advanced_users_sort_order.
8025		- $update_if_older_than = 20171219;
8026		- if ( false === $auth_version || intval( $auth_version ) < $update_if_older_than ) {
8027		- // Provide default values for any $auth_settings options that don't exist.
8028		- if ( is_multisite() ) {
8029		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
8030		- $sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
8031		- foreach ( $sites as $site ) {
8032		- $blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
8033		- switch_to_blog( $blog_id );
8034		- $this->set_default_options();
8035		- restore_current_blog();
8036		- }
8037		- } else {
8038		- $this->set_default_options();
8039		- }
8040		- // Update version to reflect this change has been made.
8041		- $auth_version = $update_if_older_than;
8042		- $needs_updating = true;
8043		- }
8044		-
8045		- // Update: Set default value for newly added option cas_link_on_username.
8046		- $update_if_older_than = 20190227;
8047		- if ( false === $auth_version || intval( $auth_version ) < $update_if_older_than ) {
8048		- // Provide default values for any $auth_settings options that don't exist.
8049		- if ( is_multisite() ) {
8050		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
8051		- $sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
8052		- foreach ( $sites as $site ) {
8053		- $blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
8054		- switch_to_blog( $blog_id );
8055		- $this->set_default_options();
8056		- restore_current_blog();
8057		- }
8058		- } else {
8059		- $this->set_default_options();
8060		- }
8061		- // Update version to reflect this change has been made.
8062		- $auth_version = $update_if_older_than;
8063		- $needs_updating = true;
8064		- }
8065		-
8066		- /*
8067		- // Update: TEMPLATE
8068		- $update_if_older_than = YYYYMMDD;
8069		- if ( $auth_version === false || intval( $auth_version ) < $update_if_older_than ) {
8070		- UPDATE CODE HERE
8071		- // Update version to reflect this change has been made.
8072		- $auth_version = $update_if_older_than;
8073		- $needs_updating = true;
8074		- }
8075		- */
8076		-
8077		- // Save new version number if we performed any updates.
8078		- if ( $needs_updating ) {
8079		- if ( is_multisite() ) {
8080		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
8081		- $sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
8082		- foreach ( $sites as $site ) {
8083		- $blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
8084		- update_blog_option( $blog_id, 'auth_version', $auth_version );
8085		- }
8086		- } else {
8087		- update_option( 'auth_version', $auth_version );
8088		- }
8089		- }
	5956	+ // // Update: TEMPLATE
	5957	+ // $update_if_older_than = YYYYMMDD;
	5958	+ // $auth_version = get_option( 'auth_version' );
	5959	+ // if ( $auth_version === false || intval( $auth_version ) < $update_if_older_than ) {
	5960	+ // UPDATE CODE HERE
	5961	+ // update_option( 'auth_version', $update_if_older_than );
	5962	+ // }
8090	5963	}
8091	5964
8092	5965	}
8093	5966	}