← All changes | authorizer.php +2162 -4167 2.8.7 → 2.6.8 View file →

		@@ -1,31 +1,51 @@
1	1	<?php
2		-/**
3		- * Plugin Name: Authorizer
4		- * Description: Authorizer limits login attempts, restricts access to specified users, and authenticates against external sources (e.g., Google, LDAP, or CAS).
5		- * Author: Paul Ryan <prar@hawaii.edu>
6		- * Plugin URI: https://github.com/uhm-coe/authorizer
7		- * Text Domain: authorizer
8		- * Domain Path: /languages
9		- * License: GPL2
10		- * Version: 2.8.7
11		- *
12		- * @package authorizer
13		- */
	2	+/*
	3	+Plugin Name: Authorizer
	4	+Plugin URI: https://github.com/uhm-coe/authorizer
	5	+Description: Authorizer limits login attempts, restricts access to specified users, and authenticates against external sources (e.g., Google, LDAP, or CAS).
	6	+Version: 2.6.8
	7	+Author: Paul Ryan
	8	+Author URI: http://www.linkedin.com/in/paulrryan/
	9	+Text Domain: authorizer
	10	+Domain Path: /languages
	11	+License: GPL2
	12	+*/
14	13
15		-/**
16		- * Portions forked from Restricted Site Access plugin: http://wordpress.org/plugins/restricted-site-access/
17		- * Portions forked from wpCAS plugin: http://wordpress.org/extend/plugins/cas-authentication/
18		- * Portions forked from Limit Login Attempts: http://wordpress.org/plugins/limit-login-attempts/
19		- */
20	14
21		-/**
22		- * Add phpCAS library if it's not included.
23		- *
24		- * @see https://wiki.jasig.org/display/CASC/phpCAS+installation+guide
25		- */
	15	+/*
	16	+Copyright 2014 Paul Ryan (email: prar@hawaii.edu)
	17	+
	18	+This program is free software; you can redistribute it and/or modify
	19	+it under the terms of the GNU General Public License, version 2, as
	20	+published by the Free Software Foundation.
	21	+
	22	+This program is distributed in the hope that it will be useful,
	23	+but WITHOUT ANY WARRANTY; without even the implied warranty of
	24	+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	25	+GNU General Public License for more details.
	26	+
	27	+You should have received a copy of the GNU General Public License
	28	+along with this program; if not, write to the Free Software
	29	+Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
	30	+*/
	31	+
	32	+
	33	+/*
	34	+Portions forked from Restricted Site Access plugin: http://wordpress.org/plugins/restricted-site-access/
	35	+Portions forked from wpCAS plugin: http://wordpress.org/extend/plugins/cas-authentication/
	36	+Portions forked from Limit Login Attempts: http://wordpress.org/plugins/limit-login-attempts/
	37	+*/
	38	+
	39	+
	40	+define( 'MULTISITE_ADMIN', 'multisite_admin' );
	41	+define( 'SINGLE_ADMIN', 'single_admin' );
	42	+
	43	+
	44	+// Add phpCAS library if it's not included.
	45	+// @see https://wiki.jasig.org/display/CASC/phpCAS+installation+guide
26	46	if ( ! defined( 'PHPCAS_VERSION' ) ) {
27		- require_once dirname( __FILE__ ) . '/vendor/phpCAS-1.3.6/CAS.php';
	47	+ require_once dirname( __FILE__ ) . '/vendor/CAS-1.3.4/CAS.php';
28	48	}
29	49
30	50
31	51	if ( ! class_exists( 'WP_Plugin_Authorizer' ) ) {
		@@ -39,87 +59,18 @@
39	59	* @link http://hawaii.edu/coe/dcdc/wordpress/authorizer/doc/
40	60	*/
41	61	class WP_Plugin_Authorizer {
42	62
43		- /**
44		- * Constants for determining our admin context (network or individual site).
45		- */
46		- const NETWORK_CONTEXT = 'multisite_admin';
47		- const SINGLE_CONTEXT = 'single_admin';
48	63
49	64	/**
50		- * Current site ID (Multisite).
51		- *
52		- * @var string
53		- */
54		- public $current_site_blog_id = 1;
55		-
56		- /**
57		- * HTML allowed when rendering translatable strings in the Authorizer UI.
58		- * This is passed to wp_kses() when sanitizing HMTL strings.
59		- *
60		- * @var array
61		- */
62		- private $allowed_html = array(
63		- 'a' => array(
64		- 'class' => array(),
65		- 'href' => array(),
66		- 'style' => array(),
67		- 'target' => array(),
68		- 'title' => array(),
69		- ),
70		- 'b' => array(),
71		- 'br' => array(),
72		- 'div' => array(
73		- 'class' => array(),
74		- ),
75		- 'em' => array(),
76		- 'hr' => array(),
77		- 'i' => array(),
78		- 'input' => array(
79		- 'aria-describedby' => array(),
80		- 'class' => array(),
81		- 'id' => array(),
82		- 'name' => array(),
83		- 'size' => array(),
84		- 'type' => array(),
85		- 'value' => array(),
86		- ),
87		- 'label' => array(
88		- 'class' => array(),
89		- 'for' => array(),
90		- ),
91		- 'p' => array(
92		- 'style' => array(),
93		- ),
94		- 'span' => array(
95		- 'aria-hidden' => array(),
96		- 'class' => array(),
97		- 'id' => array(),
98		- 'style' => array(),
99		- ),
100		- 'strong' => array(),
101		- );
102		-
103		- /**
104	65	* Constructor.
105	66	*/
106	67	public function __construct() {
107		- // Save reference to current blog id in the network (support deprecated
108		- // constant BLOGID_CURRENT_SITE).
109		- if ( defined( 'BLOG_ID_CURRENT_SITE' ) ) {
110		- $this->current_site_blog_id = BLOG_ID_CURRENT_SITE;
111		- } elseif ( defined( 'BLOGID_CURRENT_SITE' ) ) { // deprecated.
112		- $this->current_site_blog_id = BLOGID_CURRENT_SITE;
113		- }
114		-
115	68	// Installation and uninstallation hooks.
116	69	register_activation_hook( __FILE__, array( $this, 'activate' ) );
117	70	register_deactivation_hook( __FILE__, array( $this, 'deactivate' ) );
118	71
119		- /**
120		- * Register filters.
121		- */
	72	+ // Register filters.
122	73
123	74	// Custom wp authentication routine using external service.
124	75	add_filter( 'authenticate', array( $this, 'custom_authenticate' ), 1, 3 );
125	76
		@@ -125,9 +76,13 @@
125	76
126	77	// Custom logout action using external service.
127	78	add_action( 'wp_logout', array( $this, 'custom_logout' ) );
128	79
129		- // Create settings link on Plugins page.
	80	+ // Removing this bypasses Wordpress authentication (so if external auth fails,
	81	+ // no one can log in); with it enabled, it will run if external auth fails.
	82	+ //remove_filter('authenticate', 'wp_authenticate_username_password', 20, 3);
	83	+
	84	+ // Create settings link on Plugins page
130	85	add_filter( 'plugin_action_links_' . plugin_basename( __FILE__ ), array( $this, 'plugin_settings_link' ) );
131	86	add_filter( 'network_admin_plugin_action_links_' . plugin_basename( __FILE__ ), array( $this, 'network_admin_plugin_settings_link' ) );
132	87
133	88	// Modify login page with a custom password url (if option is set).
		@@ -138,11 +93,9 @@
138	93	if ( $error && strlen( $error ) > 0 ) {
139	94	add_filter( 'login_errors', array( $this, 'show_advanced_login_error' ) );
140	95	}
141	96
142		- /**
143		- * Register actions.
144		- */
	97	+ // Register actions.
145	98
146	99	// Enable localization. Translation files stored in /languages.
147	100	add_action( 'plugins_loaded', array( $this, 'load_textdomain' ) );
148	101
		@@ -154,20 +107,18 @@
154	107
155	108	// Add users who successfully login to the approved list.
156	109	add_action( 'wp_login', array( $this, 'ensure_wordpress_user_in_approved_list_on_login' ), 10, 2 );
157	110
158		- // Create menu item in Settings.
	111	+ // Create menu item in Settings
159	112	add_action( 'admin_menu', array( $this, 'add_plugin_page' ) );
160	113
161		- // Create options page.
	114	+ // Create options page
162	115	add_action( 'admin_init', array( $this, 'page_init' ) );
163	116
164	117	// Update user role in approved list if it's changed in the WordPress edit user page.
165		- add_action( 'user_profile_update_errors', array( $this, 'edit_user_profile_update_role' ), 10, 3 );
	118	+ add_action( 'edit_user_profile_update', array( $this, 'edit_user_profile_update_role' ) );
	119	+ add_action( 'personal_options_update', array( $this, 'edit_user_profile_update_role' ) );
166	120
167		- // Update user email in approved list if it's changed in the WordPress edit user page.
168		- add_filter( 'send_email_change_email', array( $this, 'edit_user_profile_update_email' ), 10, 3 );
169		-
170	121	// Enqueue javascript and css on the plugin's options page, the
171	122	// dashboard (for the widget), and the network admin.
172	123	add_action( 'load-settings_page_authorizer', array( $this, 'load_options_page' ) );
173	124	add_action( 'admin_head-index.php', array( $this, 'load_options_page' ) );
		@@ -172,46 +123,36 @@
172	123	add_action( 'load-settings_page_authorizer', array( $this, 'load_options_page' ) );
173	124	add_action( 'admin_head-index.php', array( $this, 'load_options_page' ) );
174	125	add_action( 'load-toplevel_page_authorizer', array( $this, 'load_options_page' ) );
175	126
176		- // Add custom css and js to wp-login.php.
	127	+ // Add custom css and js to wp-login.php
177	128	add_action( 'login_enqueue_scripts', array( $this, 'login_enqueue_scripts_and_styles' ) );
178	129	add_action( 'login_footer', array( $this, 'load_login_footer_js' ) );
179	130
180		- // Create google nonce cookie when loading wp-login.php if Google is enabled.
181		- add_action( 'login_init', array( $this, 'login_init__maybe_set_google_nonce_cookie' ) );
182		-
183		- // Modify login page with external auth links (if enabled; e.g., google or cas).
	131	+ // Modify login page with external auth links (if enabled; e.g., google or cas)
184	132	add_action( 'login_form', array( $this, 'login_form_add_external_service_links' ) );
185	133
186	134	// Redirect to CAS login when visiting login page (only if option is
187	135	// enabled, CAS is the only service, and WordPress logins are hidden).
188		- // Note: hook into wp_login_errors filter so this fires after the
189		- // authenticate hook (where the redirect to CAS happens), but before html
190		- // output is started (so the redirect header doesn't complain about data
191		- // already being sent).
192		- add_filter( 'wp_login_errors', array( $this, 'wp_login_errors__maybe_redirect_to_cas' ), 10, 2 );
	136	+ add_action( 'login_head', array( $this, 'login_head_maybe_redirect_to_cas' ) );
193	137
194		- // Verify current user has access to page they are visiting.
	138	+ // Verify current user has access to page they are visiting
195	139	add_action( 'parse_request', array( $this, 'restrict_access' ), 9 );
196	140	add_action( 'init', array( $this, 'init__maybe_add_network_approved_user' ) );
197	141
198		- // AJAX: Save options from dashboard widget.
	142	+ // ajax save options from dashboard widget
199	143	add_action( 'wp_ajax_update_auth_user', array( $this, 'ajax_update_auth_user' ) );
200	144
201		- // AJAX: Save options from multisite options page.
	145	+ // ajax save options from multisite options page
202	146	add_action( 'wp_ajax_save_auth_multisite_settings', array( $this, 'ajax_save_auth_multisite_settings' ) );
203	147
204		- // AJAX: Save usermeta from options page.
	148	+ // ajax save usermeta from options page
205	149	add_action( 'wp_ajax_update_auth_usermeta', array( $this, 'ajax_update_auth_usermeta' ) );
206	150
207		- // AJAX: Verify google login.
	151	+ // ajax verify google login
208	152	add_action( 'wp_ajax_process_google_login', array( $this, 'ajax_process_google_login' ) );
209	153	add_action( 'wp_ajax_nopriv_process_google_login', array( $this, 'ajax_process_google_login' ) );
210	154
211		- // AJAX: Refresh approved user list.
212		- add_action( 'wp_ajax_refresh_approved_user_list', array( $this, 'ajax_refresh_approved_user_list' ) );
213		-
214	155	// Add dashboard widget so instructors can add/edit users with access.
215	156	// Hint: For Multisite Network Admin Dashboard use wp_network_dashboard_setup instead of wp_dashboard_setup.
216	157	add_action( 'wp_dashboard_setup', array( $this, 'add_dashboard_widgets' ) );
217	158
		@@ -226,12 +167,17 @@
226	167	add_action( 'wp_enqueue_scripts', array( $this, 'auth_public_scripts' ), 20 );
227	168
228	169	// Multisite-specific actions.
229	170	if ( is_multisite() ) {
230		- // Add network admin options page (global settings for all sites).
	171	+ // Add network admin options page (global settings for all sites)
231	172	add_action( 'network_admin_menu', array( $this, 'network_admin_menu' ) );
232	173	}
233	174
	175	+ // Create login cookie (used by google login)
	176	+ if ( ! isset( $_COOKIE['login_unique'] ) ) {
	177	+ setcookie( 'login_unique', $this->get_cookie_value(), time()+1800, '/', defined( 'COOKIE_DOMAIN' ) ? COOKIE_DOMAIN : '' );
	178	+ }
	179	+
234	180	// Remove user from authorizer lists when that user is deleted in WordPress.
235	181	add_action( 'delete_user', array( $this, 'remove_user_from_authorizer_when_deleted' ) );
236	182	if ( is_multisite() ) {
237	183	// Remove multisite user from authorizer lists when that user is deleted from Network Users.
		@@ -264,20 +210,16 @@
264	210	* Will also activate the plugin for all sites/blogs if this is a "Network enable."
265	211	*
266	212	* @return void
267	213	*/
268		- public function activate( $network_wide ) {
	214	+ public function activate() {
269	215	global $wpdb;
270	216
271		- // If we're in a multisite environment, run the plugin activation for each
272		- // site when network enabling.
273		- // Note: wp-cli does not use nonces, so we skip the nonce check here to
274		- // allow the "wp plugin activate authorizer" command.
275		- // phpcs:ignore WordPress.CSRF.NonceVerification.NoNonceVerification
276		- if ( is_multisite() && $network_wide ) {
	217	+ // If we're in a multisite environment, run the plugin activation for each site when network enabling
	218	+ if ( is_multisite() && isset( $_GET['networkwide'] ) && $_GET['networkwide'] == 1 ) {
277	219
278	220	// Add super admins to the multisite approved list.
279		- $auth_multisite_settings_access_users_approved = get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', array() );
	221	+ $auth_multisite_settings_access_users_approved = get_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', array() );
280	222	$should_update_auth_multisite_settings_access_users_approved = false;
281	223	foreach ( get_super_admins() as $super_admin ) {
282	224	$user = get_user_by( 'login', $super_admin );
283	225	// Add to approved list if not there.
		@@ -282,10 +224,10 @@
282	224	$user = get_user_by( 'login', $super_admin );
283	225	// Add to approved list if not there.
284	226	if ( ! $this->in_multi_array( $user->user_email, $auth_multisite_settings_access_users_approved ) ) {
285	227	$approved_user = array(
286		- 'email' => $this->lowercase( $user->user_email ),
287		- 'role' => count( $user->roles ) > 0 ? $user->roles[0] : 'administrator',
	228	+ 'email' => $user->user_email,
	229	+ 'role' => count( $user->roles ) > 0 ? $user->roles[0] : 'administrator',
288	230	'date_added' => date( 'M Y', strtotime( $user->user_registered ) ),
289	231	'local_user' => true,
290	232	);
291	233	array_push( $auth_multisite_settings_access_users_approved, $approved_user );
		@@ -292,14 +234,13 @@
292	234	$should_update_auth_multisite_settings_access_users_approved = true;
293	235	}
294	236	}
295	237	if ( $should_update_auth_multisite_settings_access_users_approved ) {
296		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
	238	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
297	239	}
298	240
299	241	// Run plugin activation on each site in the network.
300	242	$current_blog_id = $wpdb->blogid;
301		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
302	243	$sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
303	244	foreach ( $sites as $site ) {
304	245	$blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
305	246	switch_to_blog( $blog_id );
		@@ -328,13 +269,13 @@
328	269	* @return void
329	270	*/
330	271	private function add_wp_users_to_approved_list() {
331	272	// Add current WordPress users to the approved list.
332		- $auth_multisite_settings_access_users_approved = is_multisite() ? get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', array() ) : array();
333		- $auth_settings_access_users_pending = $this->get_plugin_option( 'access_users_pending', WP_Plugin_Authorizer::SINGLE_CONTEXT );
334		- $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT );
335		- $auth_settings_access_users_blocked = $this->get_plugin_option( 'access_users_blocked', WP_Plugin_Authorizer::SINGLE_CONTEXT );
336		- $updated = false;
	273	+ $auth_multisite_settings_access_users_approved = is_multisite() ? get_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', array() ) : array();
	274	+ $auth_settings_access_users_pending = $this->get_plugin_option( 'access_users_pending', SINGLE_ADMIN );
	275	+ $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN );
	276	+ $auth_settings_access_users_blocked = $this->get_plugin_option( 'access_users_blocked', SINGLE_ADMIN );
	277	+ $updated = false;
337	278	foreach ( get_users() as $user ) {
338	279	// Skip if user is in blocked list.
339	280	if ( $this->in_multi_array( $user->user_email, $auth_settings_access_users_blocked ) ) {
340	281	continue;
		@@ -340,10 +281,10 @@
340	281	continue;
341	282	}
342	283	// Remove from pending list if there.
343	284	foreach ( $auth_settings_access_users_pending as $key => $pending_user ) {
344		- if ( 0 === strcasecmp( $pending_user['email'], $user->user_email ) ) {
345		- unset( $auth_settings_access_users_pending[ $key ] );
	285	+ if ( $pending_user['email'] == $user->user_email ) {
	286	+ unset( $auth_settings_access_users_pending[$key] );
346	287	$updated = true;
347	288	}
348	289	}
349	290	// Skip if user is in multisite approved list.
		@@ -352,10 +293,10 @@
352	293	}
353	294	// Add to approved list if not there.
354	295	if ( ! $this->in_multi_array( $user->user_email, $auth_settings_access_users_approved ) ) {
355	296	$approved_user = array(
356		- 'email' => $this->lowercase( $user->user_email ),
357		- 'role' => count( $user->roles ) > 0 ? $user->roles[0] : '',
	297	+ 'email' => $user->user_email,
	298	+ 'role' => count( $user->roles ) > 0 ? $user->roles[0] : '',
358	299	'date_added' => date( 'M Y', strtotime( $user->user_registered ) ),
359	300	'local_user' => true,
360	301	);
361	302	array_push( $auth_settings_access_users_approved, $approved_user );
		@@ -390,14 +331,13 @@
390	331
391	332	/**
392	333	* Authenticate against an external service.
393	334	*
394		- * Filter: authenticate
395		- *
396		- * @param WP_User $user user to authenticate.
	335	+ * @param WP_User $user user to authenticate
397	336	* @param string $username optional username to authenticate.
398	337	* @param string $password optional password to authenticate.
399		- * @return WP_User|WP_Error WP_User on success, WP_Error on failure.
	338	+ *
	339	+ * @return WP_User or WP_Error
400	340	*/
401	341	public function custom_authenticate( $user, $username, $password ) {
402	342	// Pass through if already authenticated.
403	343	if ( is_a( $user, 'WP_User' ) ) {
		@@ -405,20 +345,20 @@
405	345	} else {
406	346	$user = null;
407	347	}
408	348
409		- // If username and password are blank, this isn't a log in attempt.
	349	+ // If username and password are blank, this isn't a log in attempt
410	350	$is_login_attempt = strlen( $username ) > 0 && strlen( $password ) > 0;
411	351
412	352	// Check to make sure that $username is not locked out due to too
413	353	// many invalid login attempts. If it is, tell the user how much
414	354	// time remains until they can try again.
415		- $unauthenticated_user = $is_login_attempt ? get_user_by( 'login', $username ) : false;
	355	+ $unauthenticated_user = $is_login_attempt ? get_user_by( 'login', $username ) : false;
416	356	$unauthenticated_user_is_blocked = false;
417		- if ( $is_login_attempt && false !== $unauthenticated_user ) {
	357	+ if ( $is_login_attempt && $unauthenticated_user !== false ) {
418	358	$last_attempt = get_user_meta( $unauthenticated_user->ID, 'auth_settings_advanced_lockouts_time_last_failed', true );
419	359	$num_attempts = get_user_meta( $unauthenticated_user->ID, 'auth_settings_advanced_lockouts_failed_attempts', true );
420		- // Also check the auth_blocked user_meta flag (users in blocked list will get this flag).
	360	+ // Also check the auth_blocked user_meta flag (users in blocked list will get this flag)
421	361	$unauthenticated_user_is_blocked = get_user_meta( $unauthenticated_user->ID, 'auth_blocked', true ) === 'yes';
422	362	} else {
423	363	$last_attempt = get_option( 'auth_settings_advanced_lockouts_time_last_failed' );
424	364	$num_attempts = get_option( 'auth_settings_advanced_lockouts_failed_attempts' );
		@@ -432,9 +372,9 @@
432	372	return new WP_Error( 'empty_password', __( '<strong>ERROR</strong>: Incorrect username or password.', 'authorizer' ) );
433	373	}
434	374
435	375	// Grab plugin settings.
436		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
	376	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' );
437	377
438	378	// Make sure $last_attempt (time) and $num_attempts are positive integers.
439	379	// Note: this addresses resetting them if either is unset from above.
440	380	$last_attempt = abs( intval( $last_attempt ) );
		@@ -440,17 +380,17 @@
440	380	$last_attempt = abs( intval( $last_attempt ) );
441	381	$num_attempts = abs( intval( $num_attempts ) );
442	382
443	383	// Create semantic lockout variables.
444		- $lockouts = $auth_settings['advanced_lockouts'];
445		- $time_since_last_fail = time() - $last_attempt;
446		- $reset_duration = $lockouts['reset_duration'] * 60; // minutes to seconds.
447		- $num_attempts_long_lockout = $lockouts['attempts_1'] + $lockouts['attempts_2'];
448		- $num_attempts_short_lockout = $lockouts['attempts_1'];
449		- $seconds_remaining_long_lockout = $lockouts['duration_2'] * 60 - $time_since_last_fail;
	384	+ $lockouts = $auth_settings['advanced_lockouts'];
	385	+ $time_since_last_fail = time() - $last_attempt;
	386	+ $reset_duration = $lockouts['reset_duration'] * 60; // minutes to seconds
	387	+ $num_attempts_long_lockout = $lockouts['attempts_1'] + $lockouts['attempts_2'];
	388	+ $num_attempts_short_lockout = $lockouts['attempts_1'];
	389	+ $seconds_remaining_long_lockout = $lockouts['duration_2'] * 60 - $time_since_last_fail;
450	390	$seconds_remaining_short_lockout = $lockouts['duration_1'] * 60 - $time_since_last_fail;
451	391
452		- // Check if we need to institute a lockout delay.
	392	+ // Check if we need to institute a lockout delay
453	393	if ( $is_login_attempt && $time_since_last_fail > $reset_duration ) {
454	394	// Enough time has passed since the last invalid attempt and
455	395	// now that we can reset the failed attempt count, and let this
456	396	// login attempt go through.
		@@ -463,9 +403,8 @@
463	403	remove_filter( 'authenticate', 'wp_authenticate_username_password', 20, 3 );
464	404	return new WP_Error(
465	405	'empty_password',
466	406	sprintf(
467		- /* TRANSLATORS: 1: username 2: duration of lockout in seconds 3: duration of lockout as a phrase 4: lost password URL */
468	407	__( '<strong>ERROR</strong>: There have been too many invalid login attempts for the username <strong>%1$s</strong>. Please wait <strong id="seconds_remaining" data-seconds="%2$s">%3$s</strong> before trying again. <a href="%4$s" title="Password Lost and Found">Lost your password</a>?', 'authorizer' ),
469	408	$username,
470	409	$seconds_remaining_long_lockout,
471	410	$this->seconds_as_sentence( $seconds_remaining_long_lockout ),
		@@ -480,9 +419,8 @@
480	419	remove_filter( 'authenticate', 'wp_authenticate_username_password', 20, 3 );
481	420	return new WP_Error(
482	421	'empty_password',
483	422	sprintf(
484		- /* TRANSLATORS: 1: username 2: duration of lockout in seconds 3: duration of lockout as a phrase 4: lost password URL */
485	423	__( '<strong>ERROR</strong>: There have been too many invalid login attempts for the username <strong>%1$s</strong>. Please wait <strong id="seconds_remaining" data-seconds="%2$s">%3$s</strong> before trying again. <a href="%4$s" title="Password Lost and Found">Lost your password</a>?', 'authorizer' ),
486	424	$username,
487	425	$seconds_remaining_short_lockout,
488	426	$this->seconds_as_sentence( $seconds_remaining_short_lockout ),
		@@ -492,16 +430,16 @@
492	430	}
493	431
494	432	// Start external authentication.
495	433	$externally_authenticated_emails = array();
496		- $authenticated_by = '';
497		- $result = null;
	434	+ $authenticated_by = '';
	435	+ $result = null;
498	436
499	437	// Try Google authentication if it's enabled and we don't have a
500	438	// successful login yet.
501	439	if (
502		- '1' === $auth_settings['google'] &&
503		- 0 === count( $externally_authenticated_emails ) &&
	440	+ $auth_settings['google'] === '1' &&
	441	+ count( $externally_authenticated_emails ) === 0 &&
504	442	! is_wp_error( $result )
505	443	) {
506	444	$result = $this->custom_authenticate_google( $auth_settings );
507	445	if ( ! is_null( $result ) && ! is_wp_error( $result ) ) {
		@@ -516,10 +454,10 @@
516	454
517	455	// Try CAS authentication if it's enabled and we don't have a
518	456	// successful login yet.
519	457	if (
520		- '1' === $auth_settings['cas'] &&
521		- 0 === count( $externally_authenticated_emails ) &&
	458	+ $auth_settings['cas'] === '1' &&
	459	+ count( $externally_authenticated_emails ) === 0 &&
522	460	! is_wp_error( $result )
523	461	) {
524	462	$result = $this->custom_authenticate_cas( $auth_settings );
525	463	if ( ! is_null( $result ) && ! is_wp_error( $result ) ) {
		@@ -534,10 +472,10 @@
534	472
535	473	// Try LDAP authentication if it's enabled and we don't have an
536	474	// authenticated user yet.
537	475	if (
538		- '1' === $auth_settings['ldap'] &&
539		- 0 === count( $externally_authenticated_emails ) &&
	476	+ $auth_settings['ldap'] === '1' &&
	477	+ count( $externally_authenticated_emails ) === 0 &&
540	478	! is_wp_error( $result )
541	479	) {
542	480	$result = $this->custom_authenticate_ldap( $auth_settings, $username, $password );
543	481	if ( ! is_null( $result ) && ! is_wp_error( $result ) ) {
		@@ -558,46 +496,35 @@
558	496
559	497	// Remove duplicate and blank emails, if any.
560	498	$externally_authenticated_emails = array_filter( array_unique( $externally_authenticated_emails ) );
561	499
562		- /**
563		- * If we've made it this far, we should have an externally
564		- * authenticated user. The following should be set:
565		- * $externally_authenticated_emails
566		- * $authenticated_by
567		- */
	500	+ // If we've made it this far, we should have an externally
	501	+ // authenticated user. The following should be set:
	502	+ // $externally_authenticated_emails
	503	+ // $authenticated_by
568	504
569		- // Look for an existing WordPress account matching the externally
570		- // authenticated user. Perform the match either by username or email.
571		- if ( isset( $auth_settings['cas_link_on_username'] ) && 1 === intval( $auth_settings['cas_link_on_username'] ) ) {
572		- // Get the external user's WordPress account by username. This is less
573		- // secure, but a user reported having an installation where a previous
574		- // CAS plugin had created over 9000 WordPress accounts without email
575		- // addresses. This option was created to support that case, and any
576		- // other CAS servers where emails are not used as account identifiers.
577		- $user = get_user_by( 'login', $result['username']);
578		- } else {
579		- // Get the external user's WordPress account by email address. This is
580		- // the normal behavior (and the most secure).
581		- foreach ( $externally_authenticated_emails as $externally_authenticated_email ) {
582		- $user = get_user_by( 'email', $this->lowercase( $externally_authenticated_email ) );
583		- // Stop trying email addresses once we have found a match.
584		- if ( false !== $user ) {
585		- break;
586		- }
	505	+ // Get the external user's WordPress account by email address.
	506	+ foreach ( $externally_authenticated_emails as $externally_authenticated_email ) {
	507	+ $user = get_user_by( 'email', $externally_authenticated_email );
	508	+
	509	+ // If we've already found a WordPress user associated with one
	510	+ // of the supplied email addresses, don't keep examining other
	511	+ // email addresses associated with the externally authenticated user.
	512	+ if ( $user !== FALSE ) {
	513	+ break;
587	514	}
588	515	}
589	516
590	517	// Check this external user's access against the access lists
591		- // (pending, approved, blocked).
	518	+ // (pending, approved, blocked)
592	519	$result = $this->check_user_access( $user, $externally_authenticated_emails, $result );
593	520
594	521	// Fail with message if there was an error creating/adding the user.
595		- if ( is_wp_error( $result ) || 0 === $result ) {
	522	+ if ( is_wp_error( $result ) || $result === 0 ) {
596	523	return $result;
597	524	}
598	525
599		- // If we have a valid user from check_user_access(), log that user in.
	526	+ // If we created a new user in check_user_access(), log that user in.
600	527	if ( get_class( $result ) === 'WP_User' ) {
601	528	$user = $result;
602	529	}
603	530
		@@ -614,29 +541,27 @@
614	541	/**
615	542	* This function will fail with a wp_die() message to the user if they
616	543	* don't have access.
617	544	*
618		- * @param WP_User $user User to check.
619		- * @param array $user_emails Array of user's plaintext emails (in case current user doesn't have a WP account).
620		- * @param array $user_data Array of keys for email, username, first_name, last_name,
621		- * authenticated_by, google_attributes, cas_attributes, ldap_attributes.
622		- * @return WP_Error|WP_User
623		- * WP_Error if there was an error on user creation / adding user to blog.
624		- * WP_Error / wp_die() if user does not have access.
625		- * WP_User if user has access.
	545	+ * @param WP_User $user User to check
	546	+ * @param [type] $user_emails Array of user's plaintext emails (in case current user doesn't have a WP account)
	547	+ * @param [type] $user_data Array of keys for email, username, first_name, last_name,
	548	+ * authenticated_by, google_attributes, cas_attributes, ldap_attributes.
	549	+ * @return WP_Error if there was an error on user creation / adding user to blog
	550	+ * wp_die() if user does not have access
	551	+ * null if user has access (success)
	552	+ * WP_User if user has access and a new account was created for them
626	553	*/
627	554	private function check_user_access( $user, $user_emails, $user_data = array() ) {
628	555	// Grab plugin settings.
629		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
630		- $auth_settings_access_users_pending = $this->sanitize_user_list(
631		- $this->get_plugin_option( 'access_users_pending', WP_Plugin_Authorizer::SINGLE_CONTEXT )
	556	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' );
	557	+ $auth_settings_access_users_pending = $this->sanitize_user_list(
	558	+ $this->get_plugin_option( 'access_users_pending', SINGLE_ADMIN )
632	559	);
633		- $auth_settings_access_users_approved_single = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT );
634		- $auth_settings_access_users_approved_multi = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT );
635		- $auth_settings_access_users_approved = $this->sanitize_user_list(
	560	+ $auth_settings_access_users_approved = $this->sanitize_user_list(
636	561	array_merge(
637		- $auth_settings_access_users_approved_single,
638		- $auth_settings_access_users_approved_multi
	562	+ $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN ),
	563	+ $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN )
639	564	)
640	565	);
641	566
642	567	/**
		@@ -645,9 +570,9 @@
645	570	*
646	571	* @param bool $allow_login Whether to block the currently logging in user.
647	572	* @param array $user_data User data returned from external service.
648	573	*/
649		- $allow_login = apply_filters( 'authorizer_allow_login', true, $user_data );
	574	+ $allow_login = apply_filters( 'authorizer_allow_login', true, $user_data );
650	575	$blocked_by_filter = ! $allow_login; // Use this for better readability.
651	576
652	577	// Check our externally authenticated user against the block list.
653	578	// If any of their email addresses are blocked, set the relevant user
		@@ -657,16 +582,14 @@
657	582
658	583	// Add user to blocked list if it was blocked via the filter.
659	584	if ( $blocked_by_filter && ! $this->is_email_in_list( $user_email, 'blocked' ) ) {
660	585	$auth_settings_access_users_blocked = $this->sanitize_user_list(
661		- $this->get_plugin_option( 'access_users_blocked', WP_Plugin_Authorizer::SINGLE_CONTEXT )
	586	+ $this->get_plugin_option( 'access_users_blocked', SINGLE_ADMIN )
662	587	);
663		- array_push(
664		- $auth_settings_access_users_blocked, array(
665		- 'email' => $this->lowercase( $user_email ),
666		- 'date_added' => date( 'M Y' ),
667		- )
668		- );
	588	+ array_push( $auth_settings_access_users_blocked, array(
	589	+ 'email' => $user_email,
	590	+ 'date_added' => date( 'M Y' ),
	591	+ ));
669	592	update_option( 'auth_settings_access_users_blocked', $auth_settings_access_users_blocked );
670	593	}
671	594
672	595	// If the blocked external user has a WordPress account, mark it as
		@@ -675,11 +598,10 @@
675	598	update_user_meta( $user->ID, 'auth_blocked', 'yes' );
676	599	}
677	600
678	601	// Notify user about blocked status and return without authenticating them.
679		- // phpcs:ignore WordPress.CSRF.NonceVerification.NoNonceVerification
680		- $redirect_to = ! empty( $_REQUEST['redirect_to'] ) ? esc_url_raw( wp_unslash( $_REQUEST['redirect_to'] ) ) : home_url();
681		- $page_title = sprintf(
	602	+ $redirect_to = ! empty( $_REQUEST['redirect_to'] ) ? $_REQUEST['redirect_to'] : home_url();
	603	+ $page_title = sprintf(
682	604	/* TRANSLATORS: %s: Name of blog */
683	605	__( '%s - Access Restricted', 'authorizer' ),
684	606	get_bloginfo( 'name' )
685	607	);
		@@ -690,15 +612,13 @@
690	612	'<a class="button" href="' . wp_logout_url( $redirect_to ) . '">' .
691	613	__( 'Back', 'authorizer' ) .
692	614	'</a></p>';
693	615	update_option( 'auth_settings_advanced_login_error', $error_message );
694		- wp_die( wp_kses( $error_message, $this->allowed_html ), esc_html( $page_title ) );
695		- return new WP_Error( 'invalid_login', __( 'Invalid login attempted.', 'authorizer' ) );
	616	+ wp_die( $error_message, $page_title );
696	617	}
697	618	}
698	619
699		- // Get the default role for this user (or their current role, if they
700		- // already have an account).
	620	+ // Get the default role for this new user.
701	621	$default_role = $user && is_array( $user->roles ) && count( $user->roles ) > 0 ? $user->roles[0] : $auth_settings['access_default_role'];
702	622	/**
703	623	* Filter the role of the user currently logging in. The role will be
704	624	* set to the default (specified in Authorizer options) for new users,
		@@ -703,9 +623,8 @@
703	623	* Filter the role of the user currently logging in. The role will be
704	624	* set to the default (specified in Authorizer options) for new users,
705	625	* or the user's current role for existing users. This filter allows
706	626	* changing user roles based on custom CAS/LDAP attributes.
707		- *
708	627	* @param bool $role Role of the user currently logging in.
709	628	* @param array $user_data User data returned from external service.
710	629	*/
711	630	$approved_role = apply_filters( 'authorizer_custom_role', $default_role, $user_data );
		@@ -730,9 +649,9 @@
730	649	// If this externally authenticated user is an existing administrator
731	650	// (administrator in single site mode, or super admin in network mode),
732	651	// and is not in the blocked list, let them in.
733	652	if ( $user && is_super_admin( $user->ID ) ) {
734		- return $user;
	653	+ return;
735	654	}
736	655
737	656	// If this externally authenticated user isn't in the approved list
738	657	// and login access is set to "All authenticated users," or if they were
		@@ -738,12 +657,14 @@
738	657	// and login access is set to "All authenticated users," or if they were
739	658	// automatically approved in the "authorizer_approve_login" filter
740	659	// above, then add them to the approved list (they'll get an account
741	660	// created below if they don't have one yet).
742		- if (
	661	+ if ( (
743	662	! $this->is_email_in_list( $user_email, 'approved' ) &&
744		- ( 'external_users' === $auth_settings['access_who_can_login'] || $automatically_approve_login )
745		- ) {
	663	+ $auth_settings['access_who_can_login'] === 'external_users'
	664	+ ) || (
	665	+ $automatically_approve_login
	666	+ ) ) {
746	667	$is_newly_approved_user = true;
747	668
748	669	// If this user happens to be in the pending list (rare),
749	670	// remove them from pending before adding them to approved.
		@@ -748,9 +669,9 @@
748	669	// If this user happens to be in the pending list (rare),
749	670	// remove them from pending before adding them to approved.
750	671	if ( $this->is_email_in_list( $user_email, 'pending' ) ) {
751	672	foreach ( $auth_settings_access_users_pending as $key => $pending_user ) {
752		- if ( 0 === strcasecmp( $pending_user['email'], $user_email ) ) {
	673	+ if ( $pending_user['email'] === $user_email ) {
753	674	unset( $auth_settings_access_users_pending[ $key ] );
754	675	update_option( 'auth_settings_access_users_pending', $auth_settings_access_users_pending );
755	676	break;
756	677	}
		@@ -758,15 +679,14 @@
758	679	}
759	680
760	681	// Add this user to the approved list.
761	682	$approved_user = array(
762		- 'email' => $this->lowercase( $user_email ),
763		- 'role' => $approved_role,
764		- 'date_added' => date( 'Y-m-d H:i:s' ),
	683	+ 'email' => $user_email,
	684	+ 'role' => $approved_role,
	685	+ 'date_added' => date( "Y-m-d H:i:s" ),
765	686	);
766	687	array_push( $auth_settings_access_users_approved, $approved_user );
767		- array_push( $auth_settings_access_users_approved_single, $approved_user );
768		- update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved_single );
	688	+ update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved );
769	689	}
770	690
771	691	// Check our externally authenticated user against the approved
772	692	// list. If they are approved, log them in (and create their account
		@@ -780,10 +700,14 @@
780	700	if ( $default_role !== $approved_role ) {
781	701	$user_info['role'] = $approved_role;
782	702	}
783	703
784		- // If the approved external user does not have a WordPress account, create it.
	704	+ // If the approved external user does not have a WordPress account, create it
785	705	if ( ! $user ) {
	706	+ // If there's already a user with this username (e.g.,
	707	+ // johndoe/johndoe@gmail.com exists, and we're trying to add
	708	+ // johndoe/johndoe@example.com), use the full email address
	709	+ // as the username.
786	710	if ( array_key_exists( 'username', $user_data ) ) {
787	711	$username = $user_data['username'];
788	712	} else {
789	713	$username = explode( '@', $user_info['email'] );
		@@ -788,56 +712,31 @@
788	712	} else {
789	713	$username = explode( '@', $user_info['email'] );
790	714	$username = $username[0];
791	715	}
792		- // If there's already a user with this username (e.g.,
793		- // johndoe/johndoe@gmail.com exists, and we're trying to add
794		- // johndoe/johndoe@example.com), use the full email address
795		- // as the username.
796	716	if ( get_user_by( 'login', $username ) !== false ) {
797	717	$username = $user_info['email'];
798	718	}
799	719	$result = wp_insert_user(
800	720	array(
801		- 'user_login' => strtolower( $username ),
802		- 'user_pass' => wp_generate_password(), // random password.
803		- 'first_name' => array_key_exists( 'first_name', $user_data ) ? $user_data['first_name'] : '',
804		- 'last_name' => array_key_exists( 'last_name', $user_data ) ? $user_data['last_name'] : '',
805		- 'user_email' => $this->lowercase( $user_info['email'] ),
	721	+ 'user_login' => strtolower( $username ),
	722	+ 'user_pass' => wp_generate_password(), // random password
	723	+ 'first_name' => array_key_exists( 'first_name', $user_data ) ? $user_data['first_name'] : '',
	724	+ 'last_name' => array_key_exists( 'last_name', $user_data ) ? $user_data['last_name'] : '',
	725	+ 'user_email' => strtolower( $user_info['email'] ),
806	726	'user_registered' => date( 'Y-m-d H:i:s' ),
807		- 'role' => $user_info['role'],
	727	+ 'role' => $user_info['role'],
808	728	)
809	729	);
810	730
811	731	// Fail with message if error.
812		- if ( is_wp_error( $result ) || 0 === $result ) {
	732	+ if ( is_wp_error( $result ) || $result === 0 ) {
813	733	return $result;
814	734	}
815	735
816		- // Authenticate as new user.
	736	+ // Authenticate as new user
817	737	$user = new WP_User( $result );
818	738
819		- /**
820		- * Fires after an external user is authenticated for the first time
821		- * and a new WordPress account is created for them.
822		- *
823		- * @since 2.8.0
824		- *
825		- * @param WP_User $user User object.
826		- * @param array $user_data User data from external service.
827		- *
828		- * Example $user_data:
829		- * array(
830		- * 'email' => 'user@example.edu',
831		- * 'username' => 'user',
832		- * 'first_name' => 'First',
833		- * 'last_name' => 'Last',
834		- * 'authenticated_by' => 'cas',
835		- * 'cas_attributes' => array( ... ),
836		- * );
837		- */
838		- do_action( 'authorizer_user_register', $user, $user_data );
839		-
840	739	// If multisite, iterate through all sites in the network and add the user
841	740	// currently logging in to any of them that have the user on the approved list.
842	741	// Note: this is useful for first-time logins--some users will have access
843	742	// to multiple sites, and this prevents them from having to log into each
		@@ -843,21 +742,18 @@
843	742	// to multiple sites, and this prevents them from having to log into each
844	743	// site individually to get access.
845	744	if ( is_multisite() ) {
846	745	$site_ids_of_user = array_map(
847		- function ( $site_of_user ) {
848		- return intval( $site_of_user->userblog_id );
849		- },
	746	+ function ( $site_of_user ) { return $site_of_user->userblog_id; },
850	747	get_blogs_of_user( $user->ID )
851	748	);
852	749
853		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
854	750	$sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
855	751	foreach ( $sites as $site ) {
856	752	$blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
857	753
858	754	// Skip if user is already added to this site.
859		- if ( in_array( intval( $blog_id ), $site_ids_of_user, true ) ) {
	755	+ if ( in_array( $blog_id, $site_ids_of_user ) ) {
860	756	continue;
861	757	}
862	758
863	759	// Check if user is on the approved list of this site they are not added to.
		@@ -883,9 +779,9 @@
883	779	if ( $meta_key === $user_info['usermeta']['meta_key'] ) {
884	780	// Update user's usermeta value for usermeta key stored in authorizer options.
885	781	if ( strpos( $meta_key, 'acf___' ) === 0 && class_exists( 'acf' ) ) {
886	782	// We have an ACF field value, so use the ACF function to update it.
887		- update_field( str_replace( 'acf___', '', $meta_key ), $user_info['usermeta']['meta_value'], 'user_' . $user->ID );
	783	+ update_field( str_replace('acf___', '', $meta_key ), $user_info['usermeta']['meta_value'], 'user_' . $user->ID );
888	784	} else {
889	785	// We have a normal usermeta value, so just update it via the WordPress function.
890	786	update_user_meta( $user->ID, $meta_key, $user_info['usermeta']['meta_value'] );
891	787	}
		@@ -901,9 +797,9 @@
901	797	switch_to_blog( $blog_id );
902	798	// Update user's usermeta value for usermeta key stored in authorizer options.
903	799	if ( strpos( $meta_key, 'acf___' ) === 0 && class_exists( 'acf' ) ) {
904	800	// We have an ACF field value, so use the ACF function to update it.
905		- update_field( str_replace( 'acf___', '', $meta_key ), $usermeta['meta_value'], 'user_' . $user->ID );
	801	+ update_field( str_replace('acf___', '', $meta_key ), $usermeta['meta_value'], 'user_' . $user->ID );
906	802	} else {
907	803	// We have a normal usermeta value, so just update it via the WordPress function.
908	804	update_user_meta( $user->ID, $meta_key, $usermeta['meta_value'] );
909	805	}
		@@ -914,24 +810,20 @@
914	810	}
915	811	} else {
916	812	// Update first/last names of WordPress user from external
917	813	// service if that option is set.
918		- if ( ( array_key_exists( 'authenticated_by', $user_data ) && 'cas' === $user_data['authenticated_by'] && array_key_exists( 'cas_attr_update_on_login', $auth_settings ) && 1 === intval( $auth_settings['cas_attr_update_on_login'] ) ) || ( array_key_exists( 'authenticated_by', $user_data ) && 'ldap' === $user_data['authenticated_by'] && array_key_exists( 'ldap_attr_update_on_login', $auth_settings ) && 1 === intval( $auth_settings['ldap_attr_update_on_login'] ) ) ) {
919		- if ( array_key_exists( 'first_name', $user_data ) && 0 < strlen( $user_data['first_name'] ) ) {
920		- wp_update_user(
921		- array(
922		- 'ID' => $user->ID,
923		- 'first_name' => $user_data['first_name'],
924		- )
925		- );
	814	+ if ( ( array_key_exists( 'authenticated_by', $user_data ) && $user_data['authenticated_by'] === 'cas' && array_key_exists( 'cas_attr_update_on_login', $auth_settings ) && $auth_settings['cas_attr_update_on_login'] == 1 ) || ( array_key_exists( 'authenticated_by', $user_data ) && $user_data['authenticated_by'] === 'ldap' && array_key_exists( 'ldap_attr_update_on_login', $auth_settings ) && $auth_settings['ldap_attr_update_on_login'] == 1 ) ) {
	815	+ if ( array_key_exists( 'first_name', $user_data ) && strlen( $user_data['first_name'] ) > 0 ) {
	816	+ wp_update_user( array(
	817	+ 'ID' => $user->ID,
	818	+ 'first_name' => $user_data['first_name'],
	819	+ ));
926	820	}
927	821	if ( array_key_exists( 'last_name', $user_data ) && strlen( $user_data['last_name'] ) > 0 ) {
928		- wp_update_user(
929		- array(
930		- 'ID' => $user->ID,
931		- 'last_name' => $user_data['last_name'],
932		- )
933		- );
	822	+ wp_update_user( array(
	823	+ 'ID' => $user->ID,
	824	+ 'last_name' => $user_data['last_name'],
	825	+ ));
934	826	}
935	827	}
936	828
937	829	// Update this user's role if it was modified in the
		@@ -936,19 +828,12 @@
936	828
937	829	// Update this user's role if it was modified in the
938	830	// authorizer_custom_role filter.
939	831	if ( $default_role !== $approved_role ) {
940		- // Update user's role in WordPress.
941		- $user->set_role( $approved_role );
942		-
943		- // Update user's role in this site's approved list and save.
944		- foreach ( $auth_settings_access_users_approved_single as $key => $existing_user ) {
945		- if ( 0 === strcasecmp( $user->user_email, $existing_user['email'] ) ) {
946		- $auth_settings_access_users_approved_single[ $key ]['role'] = $approved_role;
947		- break;
948		- }
949		- }
950		- update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved_single );
	832	+ wp_update_user( array(
	833	+ 'ID' => $user->ID,
	834	+ 'role' => $approved_role,
	835	+ ));
951	836	}
952	837	}
953	838
954	839	// If this is multisite, add new user to current blog.
		@@ -961,34 +846,33 @@
961	846	}
962	847	}
963	848
964	849	// Ensure user has the same role as their entry in the approved list.
965		- if ( $user_info && ! in_array( $user_info['role'], $user->roles, true ) ) {
	850	+ // (This is just a precaution, the role should already be set when
	851	+ // saving admin options in the sanitizing function.)
	852	+ if ( $user_info && ! array_key_exists( $user_info['role'], $user->roles ) ) {
966	853	$user->set_role( $user_info['role'] );
967	854	}
968	855
969	856	return $user;
970	857
971		- } elseif ( 0 === strcasecmp( $user_email, $last_email ) ) {
972		- /**
973		- * Note: only do this for the last email address we are checking (we need
974		- * to iterate through them all to make sure one of them isn't approved).
975		- */
976		-
	858	+ // Note: only do this for the last email address we are checking (we need
	859	+ // to iterate through them all to make sure one of them isn't approved).
	860	+ } elseif ( $user_email === $last_email ) {
977	861	// User isn't an admin, is not blocked, and is not approved.
978	862	// Add them to the pending list and notify them and their instructor.
979	863	if ( strlen( $user_email ) > 0 && ! $this->is_email_in_list( $user_email, 'pending' ) ) {
980		- $pending_user = array();
981		- $pending_user['email'] = $this->lowercase( $user_email );
982		- $pending_user['role'] = $approved_role;
	864	+ $pending_user = array();
	865	+ $pending_user['email'] = $user_email;
	866	+ $pending_user['role'] = $approved_role;
983	867	$pending_user['date_added'] = '';
984	868	array_push( $auth_settings_access_users_pending, $pending_user );
985	869	update_option( 'auth_settings_access_users_pending', $auth_settings_access_users_pending );
986	870
987	871	// Create strings used in the email notification.
988		- $site_name = get_bloginfo( 'name' );
989		- $site_url = get_bloginfo( 'url' );
990		- $authorizer_options_url = 'settings' === $auth_settings['advanced_admin_menu'] ? admin_url( 'options-general.php?page=authorizer' ) : admin_url( '?page=authorizer' );
	872	+ $site_name = get_bloginfo( 'name' );
	873	+ $site_url = get_bloginfo( 'url' );
	874	+ $authorizer_options_url = $auth_settings['advanced_admin_menu'] === 'settings' ? admin_url( 'options-general.php?page=authorizer' ) : admin_url( '?page=authorizer' );
991	875
992	876	// Notify users with the role specified in "Which role should
993	877	// receive email notifications about pending users?".
994	878	if ( strlen( $auth_settings['access_role_receive_pending_emails'] ) > 0 ) {
		@@ -1013,11 +897,10 @@
1013	897	}
1014	898	}
1015	899
1016	900	// Notify user about pending status and return without authenticating them.
1017		- // phpcs:ignore WordPress.CSRF.NonceVerification.NoNonceVerification
1018		- $redirect_to = ! empty( $_REQUEST['redirect_to'] ) ? esc_url_raw( wp_unslash( $_REQUEST['redirect_to'] ) ) : home_url();
1019		- $page_title = get_bloginfo( 'name' ) . ' - Access Pending';
	901	+ $redirect_to = ! empty( $_REQUEST['redirect_to'] ) ? $_REQUEST['redirect_to'] : home_url();
	902	+ $page_title = get_bloginfo( 'name' ) . ' - Access Pending';
1020	903	$error_message =
1021	904	apply_filters( 'the_content', $auth_settings['access_pending_redirect_to_message'] ) .
1022	905	'<hr />' .
1023	906	'<p style="text-align: center;">' .
		@@ -1024,9 +907,9 @@
1024	907	'<a class="button" href="' . wp_logout_url( $redirect_to ) . '">' .
1025	908	__( 'Back', 'authorizer' ) .
1026	909	'</a></p>';
1027	910	update_option( 'auth_settings_advanced_login_error', $error_message );
1028		- wp_die( wp_kses( $error_message, $this->allowed_html ), esc_html( $page_title ) );
	911	+ wp_die( $error_message, $page_title );
1029	912	}
1030	913	}
1031	914
1032	915	// Sanity check: if we made it here without returning, something has gone wrong.
		@@ -1049,34 +932,24 @@
1049	932	* custom_authenticate_google() runs to verify the token; once verified
1050	933	* custom_authenticate proceeds as normal with the google email address
1051	934	* as a successfully authenticated external user.
1052	935	*
1053		- * Action: wp_ajax_process_google_login
1054		- * Action: wp_ajax_nopriv_process_google_login
1055		- *
1056		- * @return void, but die with the value to return to the success() function in AJAX call signInCallback().
	936	+ * @return void, but die with the value to return to the success() function in AJAX call signInCallback()
1057	937	*/
1058		- public function ajax_process_google_login() {
	938	+ function ajax_process_google_login() {
	939	+ $nonce = array_key_exists( 'nonce', $_POST ) ? $_POST['nonce'] : '';
	940	+ $code = array_key_exists( 'code', $_POST ) ? $_POST['code'] : null;
	941	+
1059	942	// Nonce check.
1060		- if (
1061		- ! isset( $_POST['nonce'] ) ||
1062		- ! wp_verify_nonce( sanitize_key( $_POST['nonce'] ), 'google_csrf_nonce' )
1063		- ) {
1064		- die( '' );
	943	+ if ( ! wp_verify_nonce( $nonce, 'google_csrf_nonce' ) ) {
	944	+ return '';
1065	945	}
1066	946
1067		- // Google authentication token.
1068		- // phpcs:ignore WordPress.VIP.ValidatedSanitizedInput.InputNotSanitized
1069		- $code = isset( $_POST['code'] ) ? wp_unslash( $_POST['code'] ) : null;
1070		-
1071	947	// Grab plugin settings.
1072		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
	948	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' );
1073	949
1074		- /**
1075		- * Add Google API PHP Client.
1076		- *
1077		- * @see https://github.com/google/google-api-php-client branch:v1-master
1078		- */
	950	+ // Add Google API PHP Client.
	951	+ // @see https://github.com/google/google-api-php-client branch:v1-master
1079	952	require_once dirname( __FILE__ ) . '/vendor/google-api-php-client/src/Google/autoload.php';
1080	953
1081	954	// Build the Google Client.
1082	955	$client = new Google_Client();
		@@ -1084,26 +957,14 @@
1084	957	$client->setClientId( $auth_settings['google_clientid'] );
1085	958	$client->setClientSecret( $auth_settings['google_clientsecret'] );
1086	959	$client->setRedirectUri( 'postmessage' );
1087	960
1088		- /**
1089		- * If the hosted domain parameter is set, restrict logins to that domain.
1090		- *
1091		- * Note: Will have to upgrade to google-api-php-client v2 or higher for
1092		- * this to function server-side; it's not complete in v1, so this check
1093		- * is performed manually below.
1094		- *
1095		- * if (
1096		- * array_key_exists( 'google_hosteddomain', $auth_settings ) &&
1097		- * strlen( $auth_settings['google_hosteddomain'] ) > 0
1098		- * ) {
1099		- * $google_hosteddomains = explode( "\n", str_replace( "\r", '', $auth_settings['google_hosteddomain'] ) );
1100		- * $google_hosteddomain = trim( $google_hosteddomains[0] );
1101		- * $client->setHostedDomain( $google_hosteddomain );
1102		- * }
1103		- */
	961	+ // If the hosted domain parameter is set, restrict logins to that domain.
	962	+ if ( array_key_exists( 'google_hosteddomain', $auth_settings ) && strlen( $auth_settings['google_hosteddomain'] ) > 0 ) {
	963	+ $client->setHostedDomain( $auth_settings['google_hosteddomain'] );
	964	+ }
1104	965
1105		- // Get one time use token (if it doesn't exist, we'll create one below).
	966	+ // Get one time use token (if it doesn't exist, we'll create one below)
1106	967	session_start();
1107	968	$token = array_key_exists( 'token', $_SESSION ) ? json_decode( $_SESSION['token'] ) : null;
1108	969
1109	970	if ( empty( $token ) ) {
		@@ -1111,18 +972,18 @@
1111	972	$client->authenticate( $code );
1112	973	$token = json_decode( $client->getAccessToken() );
1113	974
1114	975	// Store the token in the session for later use.
1115		- $_SESSION['token'] = wp_json_encode( $token );
	976	+ $_SESSION['token'] = json_encode( $token );
1116	977
1117		- $response = 'Successfully authenticated.';
	978	+ $response = "Successfully authenticated.";
1118	979	} else {
1119		- $client->setAccessToken( wp_json_encode( $token ) );
	980	+ $client->setAccessToken( json_encode( $token ) );
1120	981
1121	982	$response = 'Already authenticated.';
1122	983	}
1123	984
1124		- die( esc_html( $response ) );
	985	+ die( $response );
1125	986	}
1126	987
1127	988
1128	989	/**
		@@ -1127,22 +988,22 @@
1127	988
1128	989	/**
1129	990	* Validate this user's credentials against Google.
1130	991	*
1131		- * @param array $auth_settings Plugin settings.
1132		- * @return array|WP_Error Array containing email, authenticated_by, first_name,
1133		- * last_name, and username strings for the successfully
1134		- * authenticated user, or WP_Error() object on failure,
1135		- * or null if not attempting a google login.
	992	+ * @param array $auth_settings Plugin settings
	993	+ * @return [mixed] Array containing email, authenticated_by,
	994	+ * first_name, last_name, and username
	995	+ * strings for the successfully authenticated
	996	+ * user, or WP_Error() object on failure,
	997	+ * or null if not attempting a google login.
1136	998	*/
1137	999	private function custom_authenticate_google( $auth_settings ) {
1138	1000	// Move on if Google auth hasn't been requested here.
1139		- // phpcs:ignore WordPress.CSRF.NonceVerification.NoNonceVerification
1140		- if ( empty( $_GET['external'] ) || 'google' !== $_GET['external'] ) {
	1001	+ if ( empty( $_GET['external'] ) || $_GET['external'] !== 'google' ) {
1141	1002	return null;
1142	1003	}
1143	1004
1144		- // Get one time use token.
	1005	+ // Get one time use token
1145	1006	session_start();
1146	1007	$token = array_key_exists( 'token', $_SESSION ) ? json_decode( $_SESSION['token'] ) : null;
1147	1008
1148	1009	// No token, so this is not a succesful Google login.
		@@ -1149,13 +1010,10 @@
1149	1010	if ( is_null( $token ) ) {
1150	1011	return null;
1151	1012	}
1152	1013
1153		- /**
1154		- * Add Google API PHP Client.
1155		- *
1156		- * @see https://github.com/google/google-api-php-client branch:v1-master
1157		- */
	1014	+ // Add Google API PHP Client.
	1015	+ // @see https://github.com/google/google-api-php-client branch:v1-master
1158	1016	require_once dirname( __FILE__ ) . '/vendor/google-api-php-client/src/Google/autoload.php';
1159	1017
1160	1018	// Build the Google Client.
1161	1019	$client = new Google_Client();
		@@ -1163,24 +1021,14 @@
1163	1021	$client->setClientId( $auth_settings['google_clientid'] );
1164	1022	$client->setClientSecret( $auth_settings['google_clientsecret'] );
1165	1023	$client->setRedirectUri( 'postmessage' );
1166	1024
1167		- /**
1168		- * If the hosted domain parameter is set, restrict logins to that domain.
1169		- * Note: Will have to upgrade to google-api-php-client v2 or higher for
1170		- * this to function server-side; it's not complete in v1, so this check
1171		- * is performed manually later.
1172		- * if (
1173		- * array_key_exists( 'google_hosteddomain', $auth_settings ) &&
1174		- * strlen( $auth_settings['google_hosteddomain'] ) > 0
1175		- * ) {
1176		- * $google_hosteddomains = explode( "\n", str_replace( "\r", '', $auth_settings['google_hosteddomain'] ) );
1177		- * $google_hosteddomain = trim( $google_hosteddomains[0] );
1178		- * $client->setHostedDomain( $google_hosteddomain );
1179		- * }
1180		- */
	1025	+ // If the hosted domain parameter is set, restrict logins to that domain.
	1026	+ if ( array_key_exists( 'google_hosteddomain', $auth_settings ) && strlen( $auth_settings['google_hosteddomain'] ) > 0 ) {
	1027	+ $client->setHostedDomain( $auth_settings['google_hosteddomain'] );
	1028	+ }
1181	1029
1182		- // Verify this is a successful Google authentication.
	1030	+ // Verify this is a successful Google authentication
1183	1031	try {
1184	1032	$ticket = $client->verifyIdToken( $token->id_token, $auth_settings['google_clientid'] );
1185	1033	} catch ( Google_Auth_Exception $e ) {
1186	1034	// Invalid ticket, so this in not a successful Google login.
		@@ -1191,40 +1039,37 @@
1191	1039	if ( ! $ticket ) {
1192	1040	return new WP_Error( 'invalid_google_login', __( 'Invalid Google credentials provided.', 'authorizer' ) );
1193	1041	}
1194	1042
1195		- // Get email address.
1196		- $attributes = $ticket->getAttributes();
1197		- $email = $this->lowercase( $attributes['payload']['email'] );
	1043	+ // Get email address
	1044	+ $attributes = $ticket->getAttributes();
	1045	+ $email = $attributes['payload']['email'];
1198	1046	$email_domain = substr( strrchr( $email, '@' ), 1 );
1199		- $username = current( explode( '@', $email ) );
	1047	+ $username = current( explode( '@', $email ) );
1200	1048
1201		- /**
1202		- * Fail if hd param is set and the logging in user's email address doesn't
1203		- * match the allowed hosted domain.
1204		- *
1205		- * See: https://developers.google.com/identity/protocols/OpenIDConnect#hd-param
1206		- * See: https://github.com/google/google-api-php-client/blob/v1-master/src/Google/Client.php#L407-L416
1207		- *
1208		- * Note: Will have to upgrade to google-api-php-client v2 or higher for
1209		- * this to function server-side; it's not complete in v1, so this check
1210		- * is only performed here.
1211		- */
1212		- if ( array_key_exists( 'google_hosteddomain', $auth_settings ) && strlen( $auth_settings['google_hosteddomain'] ) > 0 ) {
1213		- // Allow multiple whitelisted domains.
1214		- $google_hosteddomains = explode( "\n", str_replace( "\r", '', $auth_settings['google_hosteddomain'] ) );
1215		- if ( ! in_array( $email_domain, $google_hosteddomains, true ) ) {
1216		- $this->custom_logout();
1217		- return new WP_Error( 'invalid_google_login', __( 'Google credentials do not match the allowed hosted domain', 'authorizer' ) );
1218		- }
	1049	+ // Fail if hd param is set and the logging in user's email address doesn't
	1050	+ // match the allowed hosted domain.
	1051	+ // See: https://developers.google.com/identity/protocols/OpenIDConnect#hd-param
	1052	+ // See: https://github.com/google/google-api-php-client/blob/v1-master/src/Google/Client.php#L407-L416
	1053	+ // Note: Will have to upgrade to google-api-php-client v2 or higher for
	1054	+ // this to function server-side; it's not complete in v1, so this check
	1055	+ // is only performed here.
	1056	+ if (
	1057	+ array_key_exists( 'google_hosteddomain', $auth_settings ) &&
	1058	+ strlen( $auth_settings['google_hosteddomain'] ) > 0 &&
	1059	+ $email_domain !== $auth_settings['google_hosteddomain']
	1060	+ ) {
	1061	+ $this->custom_logout();
	1062	+ return new WP_Error( 'invalid_google_login', __( 'Google credentials do not match the allowed hosted domain', 'authorizer' ) . ' (' . $auth_settings['google_hosteddomain'] . ').' );
1219	1063	}
1220	1064
	1065	+
1221	1066	return array(
1222		- 'email' => $email,
1223		- 'username' => $username,
1224		- 'first_name' => '',
1225		- 'last_name' => '',
1226		- 'authenticated_by' => 'google',
	1067	+ 'email' => $email,
	1068	+ 'username' => $username,
	1069	+ 'first_name' => '',
	1070	+ 'last_name' => '',
	1071	+ 'authenticated_by' => 'google',
1227	1072	'google_attributes' => $attributes,
1228	1073	);
1229	1074	}
1230	1075
		@@ -1231,68 +1076,78 @@
1231	1076
1232	1077	/**
1233	1078	* Validate this user's credentials against CAS.
1234	1079	*
1235		- * @param array $auth_settings Plugin settings.
1236		- * @return array|WP_Error Array containing 'email' and 'authenticated_by' strings
1237		- * for the successfully authenticated user, or WP_Error()
1238		- * object on failure, or null if not attempting a CAS login.
	1080	+ * @param array $auth_settings Plugin settings
	1081	+ * @return [mixed] Array containing 'email' and 'authenticated_by'
	1082	+ * strings for the successfully authenticated
	1083	+ * user, or WP_Error() object on failure,
	1084	+ * or null if not attempting a CAS login.
1239	1085	*/
1240	1086	private function custom_authenticate_cas( $auth_settings ) {
1241	1087	// Move on if CAS hasn't been requested here.
1242		- // phpcs:ignore WordPress.CSRF.NonceVerification.NoNonceVerification
1243		- if ( empty( $_GET['external'] ) || 'cas' !== $_GET['external'] ) {
	1088	+ if ( empty( $_GET['external'] ) || $_GET['external'] !== 'cas' ) {
1244	1089	return null;
1245	1090	}
1246	1091
1247		- /**
1248		- * Get the CAS server version (default to SAML_VERSION_1_1).
1249		- *
1250		- * @see: https://developer.jasig.org/cas-clients/php/1.3.4/docs/api/group__public.html
1251		- */
	1092	+ // Get the CAS server version (default to SAML_VERSION_1_1).
	1093	+ // See: https://developer.jasig.org/cas-clients/php/1.3.4/docs/api/group__public.html
1252	1094	$cas_version = SAML_VERSION_1_1;
1253		- if ( 'CAS_VERSION_3_0' === $auth_settings['cas_version'] ) {
	1095	+ if ( $auth_settings['cas_version'] === 'CAS_VERSION_3_0' ) {
1254	1096	$cas_version = CAS_VERSION_3_0;
1255		- } elseif ( 'CAS_VERSION_2_0' === $auth_settings['cas_version'] ) {
	1097	+ } elseif ( $auth_settings['cas_version'] === 'CAS_VERSION_2_0' ) {
1256	1098	$cas_version = CAS_VERSION_2_0;
1257		- } elseif ( 'CAS_VERSION_1_0' === $auth_settings['cas_version'] ) {
	1099	+ } elseif ( $auth_settings['cas_version'] === 'CAS_VERSION_1_0' ) {
1258	1100	$cas_version = CAS_VERSION_1_0;
1259	1101	}
1260	1102
1261		- // Set the CAS client configuration.
	1103	+ // Set the CAS client configuration
1262	1104	phpCAS::client( $cas_version, $auth_settings['cas_host'], intval( $auth_settings['cas_port'] ), $auth_settings['cas_path'] );
1263	1105
1264		- // Allow redirects at the CAS server endpoint (e.g., allow connections
1265		- // at an old CAS URL that redirects to a newer CAS URL).
1266		- phpCAS::setExtraCurlOption( CURLOPT_FOLLOWLOCATION, true );
	1106	+ // Update server certificate bundle if it doesn't exist or is older
	1107	+ // than 6 months, then use it to ensure CAS server is legitimate.
	1108	+ // Note: only try to update if the system has the php_openssl extension.
	1109	+ $cacert_url = 'https://curl.haxx.se/ca/cacert.pem';
	1110	+ $cacert_path = plugin_dir_path( __FILE__ ) . 'vendor/cacert.pem';
	1111	+ $time_180_days = 180 * 24 * 60 * 60; // days * hours * minutes * seconds
	1112	+ $time_180_days_ago = time() - $time_180_days;
	1113	+ if (
	1114	+ extension_loaded( 'openssl' ) &&
	1115	+ ( ! file_exists( $cacert_path ) || filemtime( $cacert_path ) < $time_180_days_ago )
	1116	+ ) {
	1117	+ // Get new cacert.pem file from https://curl.haxx.se/ca/cacert.pem.
	1118	+ $response = wp_safe_remote_get( $cacert_url );
	1119	+ if (
	1120	+ is_wp_error( $response ) ||
	1121	+ 200 !== wp_remote_retrieve_response_code( $response ) ||
	1122	+ ! array_key_exists( 'body', $response )
	1123	+ ) {
	1124	+ new WP_Error( 'cannot_update_cacert', __( 'Unable to update outdated server certificates from https://curl.haxx.se/ca/cacert.pem.', 'authorizer' ) );
	1125	+ }
	1126	+ $cacert_contents = $response['body'];
1267	1127
1268		- // Use the WordPress certificate bundle at /wp-includes/certificates/ca-bundle.crt.
1269		- phpCAS::setCasServerCACert( ABSPATH . WPINC . '/certificates/ca-bundle.crt' );
1270		-
1271		- // Set the CAS service URL (including the redirect URL for WordPress when it comes back from CAS).
1272		- $cas_service_url = site_url( '/wp-login.php?external=cas' );
1273		- $login_querystring = array();
1274		- if ( isset( $_SERVER['QUERY_STRING'] ) ) {
1275		- parse_str( $_SERVER['QUERY_STRING'], $login_querystring ); // phpcs:ignore WordPress.VIP.ValidatedSanitizedInput
	1128	+ // Write out the updated certs to the plugin directory.
	1129	+ file_put_contents( $cacert_path, $cacert_contents );
1276	1130	}
1277		- if ( isset( $login_querystring['redirect_to'] ) ) {
1278		- $cas_service_url .= '&redirect_to=' . rawurlencode( $login_querystring['redirect_to'] );
1279		- }
1280		- phpCAS::setFixedServiceURL( $cas_service_url );
	1131	+ phpCAS::setCasServerCACert( $cacert_path );
1281	1132
1282		- // Authenticate against CAS.
	1133	+ // Authenticate against CAS
1283	1134	try {
1284	1135	phpCAS::forceAuthentication();
1285	1136	} catch ( CAS_AuthenticationException $e ) {
1286	1137	// CAS server threw an error in isAuthenticated(), potentially because
1287	1138	// the cached ticket is outdated. Try renewing the authentication.
1288		- error_log( __( 'CAS server returned an Authentication Exception. Details:', 'authorizer' ) ); // phpcs:ignore
1289		- error_log( print_r( $e, true ) ); // phpcs:ignore
	1139	+ try {
	1140	+ phpCAS::renewAuthentication();
	1141	+ } catch ( CAS_AuthenticationException $e ) {
	1142	+ error_log( __( 'CAS server returned an Authentication Exception. Details:', 'authorizer' ) );
	1143	+ error_log( print_r( $e, true ) );
1290	1144
1291		- // CAS server is throwing errors on this login, so try logging the
1292		- // user out of CAS and redirecting them to the login page.
1293		- phpCAS::logoutWithRedirectService( wp_login_url() );
1294		- die();
	1145	+ // CAS server is throwing errors on this login, so try logging the
	1146	+ // user out of CAS and redirecting them to the login page.
	1147	+ phpCAS::logoutWithRedirectService( wp_login_url() );
	1148	+ die();
	1149	+ }
1295	1150	}
1296	1151
1297	1152	// Get username (as specified by the CAS server).
1298	1153	$username = phpCAS::getUser();
		@@ -1302,10 +1157,10 @@
1302	1157	if ( ! filter_var( $externally_authenticated_email, FILTER_VALIDATE_EMAIL ) ) {
1303	1158	// If we can't get the user's email address from a CAS attribute,
1304	1159	// try to guess the domain from the CAS server hostname. This will only
1305	1160	// be used if we can't discover the email address from CAS attributes.
1306		- $domain_guess = preg_match( '/[^.]*\.[^.]*$/', $auth_settings['cas_host'], $matches ) === 1 ? $matches[0] : '';
1307		- $externally_authenticated_email = $this->lowercase( $username ) . '@' . $domain_guess;
	1161	+ $domain_guess = preg_match( '/[^.]*\.[^.]*$/', $auth_settings['cas_host'], $matches ) === 1 ? $matches[0] : '';
	1162	+ $externally_authenticated_email = strtolower( $username ) . '@' . $domain_guess;
1308	1163	}
1309	1164
1310	1165	// Retrieve the user attributes (e.g., email address, first name, last name) from the CAS server.
1311	1166	$cas_attributes = phpCAS::getAttributes();
		@@ -1316,45 +1171,37 @@
1316	1171	// email domain is manually entered there (instead of a reference to a
1317	1172	// CAS attribute), and combine that with the username to create the email.
1318	1173	// Otherwise, look up the CAS attribute for email.
1319	1174	if ( substr( $auth_settings['cas_attr_email'], 0, 1 ) === '@' ) {
1320		- $externally_authenticated_email = $this->lowercase( $username . $auth_settings['cas_attr_email'] );
	1175	+ $externally_authenticated_email = strtolower( $username . $auth_settings['cas_attr_email'] );
1321	1176	} elseif (
1322	1177	// If a CAS attribute has been specified as containing the email address, use that instead.
1323	1178	// Email attribute can be a string or an array of strings.
1324	1179	array_key_exists( $auth_settings['cas_attr_email'], $cas_attributes ) && (
1325	1180	(
1326		- is_array( $cas_attributes[ $auth_settings['cas_attr_email'] ] ) &&
1327		- count( $cas_attributes[ $auth_settings['cas_attr_email'] ] ) > 0
	1181	+ is_array( $cas_attributes[$auth_settings['cas_attr_email']] ) &&
	1182	+ count( $cas_attributes[$auth_settings['cas_attr_email']] ) > 0
1328	1183	) || (
1329		- is_string( $cas_attributes[ $auth_settings['cas_attr_email'] ] ) &&
1330		- strlen( $cas_attributes[ $auth_settings['cas_attr_email'] ] ) > 0
	1184	+ is_string( $cas_attributes[$auth_settings['cas_attr_email']] ) &&
	1185	+ strlen( $cas_attributes[$auth_settings['cas_attr_email']] ) > 0
1331	1186	)
1332	1187	)
1333	1188	) {
1334		- // Each of the emails in the array needs to be set to lowercase.
1335		- if ( is_array( $cas_attributes[ $auth_settings['cas_attr_email'] ] ) ) {
1336		- $externally_authenticated_email = array();
1337		- foreach ( $cas_attributes[ $auth_settings['cas_attr_email'] ] as $external_email ) {
1338		- $externally_authenticated_email[] = $this->lowercase( $external_email );
1339		- }
1340		- } else {
1341		- $externally_authenticated_email = $this->lowercase( $cas_attributes[ $auth_settings['cas_attr_email'] ] );
1342		- }
	1189	+ $externally_authenticated_email = $cas_attributes[$auth_settings['cas_attr_email']];
1343	1190	}
1344	1191	}
1345	1192
1346	1193	// Get user first name and last name.
1347		- $first_name = array_key_exists( 'cas_attr_first_name', $auth_settings ) && strlen( $auth_settings['cas_attr_first_name'] ) > 0 && array_key_exists( $auth_settings['cas_attr_first_name'], $cas_attributes ) && strlen( $cas_attributes[ $auth_settings['cas_attr_first_name'] ] ) > 0 ? $cas_attributes[ $auth_settings['cas_attr_first_name'] ] : '';
1348		- $last_name = array_key_exists( 'cas_attr_last_name', $auth_settings ) && strlen( $auth_settings['cas_attr_last_name'] ) > 0 && array_key_exists( $auth_settings['cas_attr_last_name'], $cas_attributes ) && strlen( $cas_attributes[ $auth_settings['cas_attr_last_name'] ] ) > 0 ? $cas_attributes[ $auth_settings['cas_attr_last_name'] ] : '';
	1194	+ $first_name = array_key_exists( 'cas_attr_first_name', $auth_settings ) && strlen( $auth_settings['cas_attr_first_name'] ) > 0 && array_key_exists( $auth_settings['cas_attr_first_name'], $cas_attributes ) && strlen( $cas_attributes[$auth_settings['cas_attr_first_name']] ) > 0 ? $cas_attributes[$auth_settings['cas_attr_first_name']] : '';
	1195	+ $last_name = array_key_exists( 'cas_attr_last_name', $auth_settings ) && strlen( $auth_settings['cas_attr_last_name'] ) > 0 && array_key_exists( $auth_settings['cas_attr_last_name'], $cas_attributes ) && strlen( $cas_attributes[$auth_settings['cas_attr_last_name']] ) > 0 ? $cas_attributes[$auth_settings['cas_attr_last_name']] : '';
1349	1196
1350	1197	return array(
1351		- 'email' => $externally_authenticated_email,
1352		- 'username' => $username,
1353		- 'first_name' => $first_name,
1354		- 'last_name' => $last_name,
	1198	+ 'email' => $externally_authenticated_email,
	1199	+ 'username' => $username,
	1200	+ 'first_name' => $first_name,
	1201	+ 'last_name' => $last_name,
1355	1202	'authenticated_by' => 'cas',
1356		- 'cas_attributes' => $cas_attributes,
	1203	+ 'cas_attributes' => $cas_attributes,
1357	1204	);
1358	1205	}
1359	1206
1360	1207
		@@ -1360,32 +1207,24 @@
1360	1207
1361	1208	/**
1362	1209	* Validate this user's credentials against LDAP.
1363	1210	*
1364		- * @param array $auth_settings Plugin settings.
1365		- * @param string $username Attempted username from authenticate action.
1366		- * @param string $password Attempted password from authenticate action.
1367		- * @return array|WP_Error Array containing 'email' and 'authenticated_by' strings
1368		- * for the successfully authenticated user, or WP_Error()
1369		- * object on failure, or null if skipping LDAP auth and
1370		- * falling back to WP auth.
	1211	+ * @param array $auth_settings Plugin settings
	1212	+ * @param string $username Attempted username from authenticate action
	1213	+ * @param string $password Attempted password from authenticate action
	1214	+ * @return [mixed] Array containing 'email' and 'authenticated_by'
	1215	+ * strings for the successfully authenticated
	1216	+ * user, or WP_Error() object on failure,
	1217	+ * or null if skipping LDAP auth and falling back to WP auth.
1371	1218	*/
1372	1219	private function custom_authenticate_ldap( $auth_settings, $username, $password ) {
1373		- // Get LDAP search base(s).
1374		- $search_bases = explode( "\n", str_replace( "\r", '', trim( $auth_settings['ldap_search_base'] ) ) );
1375		-
1376		- // Fail silently (fall back to WordPress authentication) if no search base specified.
1377		- if ( count( $search_bases ) < 1 ) {
1378		- return null;
1379		- }
1380		-
1381		- // Get the FQDN from the first LDAP search base domain components (dc). For
1382		- // example, ou=people,dc=example,dc=edu,dc=uk would yield user@example.edu.uk.
1383		- $search_base_components = explode( ',', trim( $search_bases[0] ) );
1384		- $domain = array();
	1220	+ // Get the FQDN from the LDAP search base domain components (dc). For
	1221	+ // example, ou=people,dc=example,dc=edu,dc=uk would yield user@example.edu.uk
	1222	+ $search_base_components = explode( ',', trim( $auth_settings['ldap_search_base'] ) );
	1223	+ $domain = array();
1385	1224	foreach ( $search_base_components as $search_base_component ) {
1386	1225	$component = explode( '=', $search_base_component );
1387		- if ( 2 === count( $component ) && 'dc' === $component[0] ) {
	1226	+ if ( count( $component ) === 2 && $component[0] === 'dc' ) {
1388	1227	$domain[] = $component[1];
1389	1228	}
1390	1229	}
1391	1230	$domain = implode( '.', $domain );
		@@ -1396,9 +1235,9 @@
1396	1235	if ( empty( $domain ) ) {
1397	1236	$domain = preg_match( '/[^.]*\.[^.]*$/', $auth_settings['ldap_host'], $matches ) === 1 ? $matches[0] : '';
1398	1237	}
1399	1238
1400		- // remove @domain if it exists in the username (i.e., if user entered their email).
	1239	+ // remove @domain if it exists in the username (i.e., if user entered their email)
1401	1240	$username = str_replace( '@' . $domain, '', $username );
1402	1241
1403	1242	// Fail silently (fall back to WordPress authentication) if both username
1404	1243	// and password are empty (this will be the case when visiting wp-login.php
		@@ -1421,13 +1260,13 @@
1421	1260	return null;
1422	1261	}
1423	1262
1424	1263	// Authenticate against LDAP using options provided in plugin settings.
1425		- $result = false;
	1264	+ $result = false;
1426	1265	$ldap_user_dn = '';
1427		- $first_name = '';
1428		- $last_name = '';
1429		- $email = '';
	1266	+ $first_name = '';
	1267	+ $last_name = '';
	1268	+ $email = '';
1430	1269
1431	1270	// Construct LDAP connection parameters. ldap_connect() takes either a
1432	1271	// hostname or a full LDAP URI as its first parameter (works with OpenLDAP
1433	1272	// 2.x.x or later). If it's an LDAP URI, the second parameter, $port, is
		@@ -1432,13 +1271,13 @@
1432	1271	// hostname or a full LDAP URI as its first parameter (works with OpenLDAP
1433	1272	// 2.x.x or later). If it's an LDAP URI, the second parameter, $port, is
1434	1273	// ignored, and port must be specified in the full URI. An LDAP URI is of
1435	1274	// the form ldap://hostname:port or ldaps://hostname:port.
1436		- $ldap_host = $auth_settings['ldap_host'];
1437		- $ldap_port = intval( $auth_settings['ldap_port'] );
1438		- $parsed_host = wp_parse_url( $ldap_host );
	1275	+ $ldap_host = $auth_settings['ldap_host'];
	1276	+ $ldap_port = intval( $auth_settings['ldap_port'] );
	1277	+ $parsed_host = parse_url( $ldap_host );
1439	1278	// Fail (fall back to WordPress auth) if invalid host is specified.
1440		- if ( false === $parsed_host ) {
	1279	+ if ( $parsed_host === false ) {
1441	1280	return null;
1442	1281	}
1443	1282	// If a scheme is in the LDAP host, use full LDAP URI instead of just hostname.
1444	1283	if ( array_key_exists( 'scheme', $parsed_host ) ) {
		@@ -1451,24 +1290,24 @@
1451	1290
1452	1291	// Establish LDAP connection.
1453	1292	$ldap = ldap_connect( $ldap_host, $ldap_port );
1454	1293	ldap_set_option( $ldap, LDAP_OPT_PROTOCOL_VERSION, 3 );
1455		- if ( 1 === intval( $auth_settings['ldap_tls'] ) ) {
1456		- if ( ! ldap_start_tls( $ldap ) ) {
	1294	+ if ( $auth_settings['ldap_tls'] == 1 ) {
	1295	+ if( ! ldap_start_tls( $ldap ) ) {
1457	1296	return null;
1458	1297	}
1459	1298	}
1460	1299
1461	1300	// Set bind credentials; attempt an anonymous bind if not provided.
1462		- $bind_rdn = null;
1463		- $bind_password = null;
	1301	+ $bind_rdn = NULL;
	1302	+ $bind_password = NULL;
1464	1303	if ( strlen( $auth_settings['ldap_user'] ) > 0 ) {
1465		- $bind_rdn = $auth_settings['ldap_user'];
1466		- $bind_password = $this->decrypt( $auth_settings['ldap_password'] );
	1304	+ $bind_rdn = $auth_settings['ldap_user'];
	1305	+ $bind_password = $this->decrypt( base64_decode( $auth_settings['ldap_password'] ) );
1467	1306	}
1468	1307
1469	1308	// Attempt LDAP bind.
1470		- $result = @ldap_bind( $ldap, $bind_rdn, stripslashes( $bind_password ) ); // phpcs:ignore
	1309	+ $result = @ldap_bind( $ldap, $bind_rdn, $bind_password );
1471	1310	if ( ! $result ) {
1472	1311	// Can't connect to LDAP, so fall back to WordPress authentication.
1473	1312	return null;
1474	1313	}
		@@ -1482,40 +1321,18 @@
1482	1321	if ( array_key_exists( 'ldap_attr_last_name', $auth_settings ) && strlen( $auth_settings['ldap_attr_last_name'] ) > 0 ) {
1483	1322	array_push( $ldap_attributes_to_retrieve, $auth_settings['ldap_attr_last_name'] );
1484	1323	}
1485	1324	if ( array_key_exists( 'ldap_attr_email', $auth_settings ) && strlen( $auth_settings['ldap_attr_email'] ) > 0 && substr( $auth_settings['ldap_attr_email'], 0, 1 ) !== '@' ) {
1486		- array_push( $ldap_attributes_to_retrieve, $this->lowercase( $auth_settings['ldap_attr_email'] ) );
	1325	+ array_push( $ldap_attributes_to_retrieve, $auth_settings['ldap_attr_email'] );
1487	1326	}
	1327	+ $ldap_search = ldap_search(
	1328	+ $ldap,
	1329	+ $auth_settings['ldap_search_base'],
	1330	+ "(" . $auth_settings['ldap_uid'] . "=" . $username . ")",
	1331	+ $ldap_attributes_to_retrieve
	1332	+ );
	1333	+ $ldap_entries = ldap_get_entries( $ldap, $ldap_search );
1488	1334
1489		- // Create default LDAP search filter (uid=$username).
1490		- $search_filter = '(' . $auth_settings['ldap_uid'] . '=' . $username . ')';
1491		-
1492		- /**
1493		- * Filter LDAP search filter.
1494		- *
1495		- * Allows for custom LDAP authentication rules (e.g., restricting login
1496		- * access to users in multiple groups, or having certain attributes).
1497		- *
1498		- * @param string $search_filter The filter to pass to ldap_search().
1499		- * @param string $ldap_uid The attribute to compare username against (from Authorizer Settings).
1500		- * @param string $username The username attempting to log in.
1501		- */
1502		- $search_filter = apply_filters( 'authorizer_ldap_search_filter', $search_filter, $auth_settings['ldap_uid'], $username );
1503		-
1504		- // Multiple search bases can be provided, so iterate through them until a match is found.
1505		- foreach ( $search_bases as $search_base ) {
1506		- $ldap_search = ldap_search(
1507		- $ldap,
1508		- $search_base,
1509		- $search_filter,
1510		- $ldap_attributes_to_retrieve
1511		- );
1512		- $ldap_entries = ldap_get_entries( $ldap, $ldap_search );
1513		- if ( $ldap_entries['count'] > 0 ) {
1514		- break;
1515		- }
1516		- }
1517		-
1518	1335	// If we didn't find any users in ldap, fall back to WordPress authentication.
1519	1336	if ( $ldap_entries['count'] < 1 ) {
1520	1337	return null;
1521	1338	}
		@@ -1521,35 +1338,32 @@
1521	1338	}
1522	1339
1523	1340	// Get the bind dn and first/last names; if there are multiple results returned, just get the last one.
1524	1341	for ( $i = 0; $i < $ldap_entries['count']; $i++ ) {
1525		- $ldap_user_dn = $ldap_entries[ $i ]['dn'];
	1342	+ $ldap_user_dn = $ldap_entries[$i]['dn'];
1526	1343
1527	1344	// Get user first name and last name.
1528		- $ldap_attr_first_name = array_key_exists( 'ldap_attr_first_name', $auth_settings ) ? $this->lowercase( $auth_settings['ldap_attr_first_name'] ) : '';
1529		- if ( strlen( $ldap_attr_first_name ) > 0 && array_key_exists( $ldap_attr_first_name, $ldap_entries[ $i ] ) && $ldap_entries[ $i ][ $ldap_attr_first_name ]['count'] > 0 && strlen( $ldap_entries[ $i ][ $ldap_attr_first_name ][0] ) > 0 ) {
1530		- $first_name = $ldap_entries[ $i ][ $ldap_attr_first_name ][0];
	1345	+ if ( array_key_exists( 'ldap_attr_first_name', $auth_settings ) && strlen( $auth_settings['ldap_attr_first_name'] ) > 0 && array_key_exists( $auth_settings['ldap_attr_first_name'], $ldap_entries[$i] ) && $ldap_entries[$i][$auth_settings['ldap_attr_first_name']]['count'] > 0 && strlen( $ldap_entries[$i][$auth_settings['ldap_attr_first_name']][0] ) > 0 ) {
	1346	+ $first_name = $ldap_entries[$i][$auth_settings['ldap_attr_first_name']][0];
1531	1347	}
1532		- $ldap_attr_last_name = array_key_exists( 'ldap_attr_last_name', $auth_settings ) ? $this->lowercase( $auth_settings['ldap_attr_last_name'] ) : '';
1533		- if ( strlen( $ldap_attr_last_name ) > 0 && array_key_exists( $ldap_attr_last_name, $ldap_entries[ $i ] ) && $ldap_entries[ $i ][ $ldap_attr_last_name ]['count'] > 0 && strlen( $ldap_entries[ $i ][ $ldap_attr_last_name ][0] ) > 0 ) {
1534		- $last_name = $ldap_entries[ $i ][ $ldap_attr_last_name ][0];
	1348	+ if ( array_key_exists( 'ldap_attr_last_name', $auth_settings ) && strlen( $auth_settings['ldap_attr_last_name'] ) > 0 && array_key_exists( $auth_settings['ldap_attr_last_name'], $ldap_entries[$i] ) && $ldap_entries[$i][$auth_settings['ldap_attr_last_name']]['count'] > 0 && strlen( $ldap_entries[$i][$auth_settings['ldap_attr_last_name']][0] ) > 0 ) {
	1349	+ $last_name = $ldap_entries[$i][$auth_settings['ldap_attr_last_name']][0];
1535	1350	}
1536	1351	// Get user email if it is specified in another field.
1537		- $ldap_attr_email = array_key_exists( 'ldap_attr_email', $auth_settings ) ? $this->lowercase( $auth_settings['ldap_attr_email'] ) : '';
1538		- if ( strlen( $ldap_attr_email ) > 0 ) {
	1352	+ if ( array_key_exists( 'ldap_attr_email', $auth_settings ) && strlen( $auth_settings['ldap_attr_email'] ) > 0 ) {
1539	1353	// If the email attribute starts with an at symbol (@), assume that the
1540	1354	// email domain is manually entered there (instead of a reference to an
1541	1355	// LDAP attribute), and combine that with the username to create the email.
1542	1356	// Otherwise, look up the LDAP attribute for email.
1543		- if ( substr( $ldap_attr_email, 0, 1 ) === '@' ) {
1544		- $email = $this->lowercase( $username . $ldap_attr_email );
1545		- } elseif ( array_key_exists( $ldap_attr_email, $ldap_entries[ $i ] ) && $ldap_entries[ $i ][ $ldap_attr_email ]['count'] > 0 && strlen( $ldap_entries[ $i ][ $ldap_attr_email ][0] ) > 0 ) {
1546		- $email = $this->lowercase( $ldap_entries[ $i ][ $ldap_attr_email ][0] );
	1357	+ if ( substr( $auth_settings['ldap_attr_email'], 0, 1 ) === '@' ) {
	1358	+ $email = strtolower( $username . $auth_settings['ldap_attr_email'] );
	1359	+ } elseif ( array_key_exists( $auth_settings['ldap_attr_email'], $ldap_entries[$i] ) && $ldap_entries[$i][$auth_settings['ldap_attr_email']]['count'] > 0 && strlen( $ldap_entries[$i][$auth_settings['ldap_attr_email']][0] ) > 0 ) {
	1360	+ $email = strtolower( $ldap_entries[$i][$auth_settings['ldap_attr_email']][0] );
1547	1361	}
1548	1362	}
1549	1363	}
1550	1364
1551		- $result = @ldap_bind( $ldap, $ldap_user_dn, stripslashes( $password ) ); // phpcs:ignore
	1365	+ $result = @ldap_bind( $ldap, $ldap_user_dn, html_entity_decode( $password ) );
1552	1366	if ( ! $result ) {
1553	1367	// We have a real ldap user, but an invalid password. Pass
1554	1368	// through to wp authentication after failing LDAP (since
1555	1369	// this could be a local account that happens to be the
		@@ -1557,22 +1371,22 @@
1557	1371	return null;
1558	1372	}
1559	1373
1560	1374	// User successfully authenticated against LDAP, so set the relevant variables.
1561		- $externally_authenticated_email = $this->lowercase( $username . '@' . $domain );
	1375	+ $externally_authenticated_email = $username . '@' . $domain;
1562	1376
1563	1377	// If an LDAP attribute has been specified as containing the email address, use that instead.
1564	1378	if ( strlen( $email ) > 0 ) {
1565		- $externally_authenticated_email = $this->lowercase( $email );
	1379	+ $externally_authenticated_email = $email;
1566	1380	}
1567	1381
1568	1382	return array(
1569		- 'email' => $externally_authenticated_email,
1570		- 'username' => $username,
1571		- 'first_name' => $first_name,
1572		- 'last_name' => $last_name,
	1383	+ 'email' => $externally_authenticated_email,
	1384	+ 'username' => $username,
	1385	+ 'first_name' => $first_name,
	1386	+ 'last_name' => $last_name,
1573	1387	'authenticated_by' => 'ldap',
1574		- 'ldap_attributes' => $ldap_entries,
	1388	+ 'ldap_attributes' => $ldap_entries,
1575	1389	);
1576	1390	}
1577	1391
1578	1392
		@@ -1578,20 +1392,18 @@
1578	1392
1579	1393	/**
1580	1394	* Log out of the attached external service.
1581	1395	*
1582		- * Action: wp_logout
1583		- *
1584	1396	* @return void
1585	1397	*/
1586	1398	public function custom_logout() {
1587	1399	// Grab plugin settings.
1588		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
	1400	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' );
1589	1401
1590	1402	// Reset option containing old error messages.
1591	1403	delete_option( 'auth_settings_advanced_login_error' );
1592	1404
1593		- if ( session_id() === '' ) {
	1405	+ if ( session_id() == '' ) {
1594	1406	session_start();
1595	1407	}
1596	1408
1597	1409	$current_user_authenticated_by = get_user_meta( get_current_user_id(), 'authenticated_by', true );
		@@ -1596,53 +1408,38 @@
1596	1408
1597	1409	$current_user_authenticated_by = get_user_meta( get_current_user_id(), 'authenticated_by', true );
1598	1410
1599	1411	// If logged in to CAS, Log out of CAS.
1600		- if ( 'cas' === $current_user_authenticated_by && '1' === $auth_settings['cas'] ) {
	1412	+ if ( $current_user_authenticated_by === 'cas' && $auth_settings['cas'] === '1' ) {
1601	1413	if ( ! array_key_exists( 'PHPCAS_CLIENT', $GLOBALS ) || ! array_key_exists( 'phpCAS', $_SESSION ) ) {
1602	1414
1603		- /**
1604		- * Get the CAS server version (default to SAML_VERSION_1_1).
1605		- *
1606		- * @see: https://developer.jasig.org/cas-clients/php/1.3.4/docs/api/group__public.html
1607		- */
	1415	+ // Get the CAS server version (default to SAML_VERSION_1_1).
	1416	+ // See: https://developer.jasig.org/cas-clients/php/1.3.4/docs/api/group__public.html
1608	1417	$cas_version = SAML_VERSION_1_1;
1609		- if ( 'CAS_VERSION_3_0' === $auth_settings['cas_version'] ) {
	1418	+ if ( $auth_settings['cas_version'] === 'CAS_VERSION_3_0' ) {
1610	1419	$cas_version = CAS_VERSION_3_0;
1611		- } elseif ( 'CAS_VERSION_2_0' === $auth_settings['cas_version'] ) {
	1420	+ } elseif ( $auth_settings['cas_version'] === 'CAS_VERSION_2_0' ) {
1612	1421	$cas_version = CAS_VERSION_2_0;
1613		- } elseif ( 'CAS_VERSION_1_0' === $auth_settings['cas_version'] ) {
	1422	+ } elseif ( $auth_settings['cas_version'] === 'CAS_VERSION_1_0' ) {
1614	1423	$cas_version = CAS_VERSION_1_0;
1615	1424	}
1616	1425
1617	1426	// Set the CAS client configuration if it hasn't been set already.
1618	1427	phpCAS::client( $cas_version, $auth_settings['cas_host'], intval( $auth_settings['cas_port'] ), $auth_settings['cas_path'] );
1619		- // Allow redirects at the CAS server endpoint (e.g., allow connections
1620		- // at an old CAS URL that redirects to a newer CAS URL).
1621		- phpCAS::setExtraCurlOption( CURLOPT_FOLLOWLOCATION, true );
1622	1428	// Restrict logout request origin to the CAS server only (prevent DDOS).
1623	1429	phpCAS::handleLogoutRequests( true, array( $auth_settings['cas_host'] ) );
1624	1430	}
1625		- if ( phpCAS::isAuthenticated() || phpCAS::isInitialized() ) {
1626		- // Redirect to home page, or specified page if it's been provided.
1627		- $redirect_to = site_url( '/' );
1628		- if ( ! empty( $_REQUEST['redirect_to'] ) && isset( $_REQUEST['_wpnonce'] ) && wp_verify_nonce( sanitize_key( $_REQUEST['_wpnonce'] ), 'log-out' ) ) {
1629		- $redirect_to = esc_url_raw( wp_unslash( $_REQUEST['redirect_to'] ) );
1630		- }
1631		-
1632		- phpCAS::logoutWithRedirectService( $redirect_to );
	1431	+ if ( phpCAS::isAuthenticated() ) {
	1432	+ phpCAS::logoutWithRedirectService( get_option( 'siteurl' ) );
1633	1433	}
1634	1434	}
1635	1435
1636	1436	// If session token set, log out of Google.
1637		- if ( 'google' === $current_user_authenticated_by || array_key_exists( 'token', $_SESSION ) ) {
	1437	+ if ( $current_user_authenticated_by === 'google' || array_key_exists( 'token', $_SESSION ) ) {
1638	1438	$token = json_decode( $_SESSION['token'] )->access_token;
1639	1439
1640		- /**
1641		- * Add Google API PHP Client.
1642		- *
1643		- * @see https://github.com/google/google-api-php-client branch:v1-master
1644		- */
	1440	+ // Add Google API PHP Client.
	1441	+ // @see https://github.com/google/google-api-php-client branch:v1-master
1645	1442	require_once dirname( __FILE__ ) . '/vendor/google-api-php-client/src/Google/autoload.php';
1646	1443
1647	1444	// Build the Google Client.
1648	1445	$client = new Google_Client();
		@@ -1650,9 +1447,14 @@
1650	1447	$client->setClientId( $auth_settings['google_clientid'] );
1651	1448	$client->setClientSecret( $auth_settings['google_clientsecret'] );
1652	1449	$client->setRedirectUri( 'postmessage' );
1653	1450
1654		- // Revoke the token.
	1451	+ // If the hosted domain parameter is set, restrict logins to that domain.
	1452	+ if ( array_key_exists( 'google_hosteddomain', $auth_settings ) && strlen( $auth_settings['google_hosteddomain'] ) > 0 ) {
	1453	+ $client->setHostedDomain( $auth_settings['google_hosteddomain'] );
	1454	+ }
	1455	+
	1456	+ // Revoke the token
1655	1457	$client->revokeToken( $token );
1656	1458
1657	1459	// Remove the credentials from the user's session.
1658	1460	unset( $_SESSION['token'] );
		@@ -1671,61 +1473,60 @@
1671	1473
1672	1474
1673	1475	/**
1674	1476	* Restrict access to WordPress site based on settings (everyone, logged_in_users).
	1477	+ * Hook: parse_request http://codex.wordpress.org/Plugin_API/Action_Reference/parse_request
1675	1478	*
1676		- * Action: parse_request
	1479	+ * @param array $wp WordPress object.
1677	1480	*
1678		- * @param array $wp WordPress object.
1679		- * @return WP|void WP object when passing through to WordPress authentication, or void.
	1481	+ * @return void
1680	1482	*/
1681	1483	public function restrict_access( $wp ) {
1682	1484	// Grab plugin settings.
1683		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
	1485	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' );
1684	1486
1685	1487	// Grab current user.
1686	1488	$current_user = wp_get_current_user();
1687	1489
1688	1490	$has_access = (
1689		- // Always allow access if WordPress is installing.
1690		- // phpcs:ignore WordPress.CSRF.NonceVerification.NoNonceVerification
	1491	+ // Always allow access if WordPress is installing
1691	1492	( defined( 'WP_INSTALLING' ) && isset( $_GET['key'] ) ) ||
1692		- // Always allow access to admins.
	1493	+ // Always allow access to admins
1693	1494	( current_user_can( 'create_users' ) ) ||
1694		- // Allow access if option is set to 'everyone'.
1695		- ( 'everyone' === $auth_settings['access_who_can_view'] ) ||
1696		- // Allow access to approved external users and logged in users if option is set to 'logged_in_users'.
1697		- ( 'logged_in_users' === $auth_settings['access_who_can_view'] && $this->is_user_logged_in_and_blog_user() && $this->is_email_in_list( $current_user->user_email, 'approved' ) ) ||
1698		- // Allow access for requests to /wp-json/oauth1 so oauth clients can authenticate to use the REST API.
1699		- ( property_exists( $wp, 'matched_query' ) && stripos( $wp->matched_query, 'rest_oauth1=' ) === 0 ) ||
1700		- // Allow access for non-GET requests to /wp-json/*, since REST API authentication already covers them.
1701		- ( property_exists( $wp, 'matched_query' ) && 0 === stripos( $wp->matched_query, 'rest_route=' ) && isset( $_SERVER['REQUEST_METHOD'] ) && 'GET' !== $_SERVER['REQUEST_METHOD'] ) ||
1702		- // Allow access for GET requests to /wp-json/ (root), since REST API discovery calls rely on this.
1703		- ( property_exists( $wp, 'matched_query' ) && 'rest_route=/' === $wp->matched_query )
	1495	+ // Allow access if option is set to 'everyone'
	1496	+ ( $auth_settings['access_who_can_view'] == 'everyone' ) ||
	1497	+ // Allow access to approved external users and logged in users if option is set to 'logged_in_users'
	1498	+ ( $auth_settings['access_who_can_view'] == 'logged_in_users' && $this->is_user_logged_in_and_blog_user() && $this->is_email_in_list( $current_user->user_email, 'approved' ) ) ||
	1499	+ // Allow access for requests to /wp-json/oauth1 so oauth clients can authenticate to use the REST API
	1500	+ ( property_exists( $wp, 'matched_query' ) && stripos( $wp->matched_query, "rest_oauth1=" ) === 0 ) ||
	1501	+ // Allow access for non-GET requests to /wp-json/*, since REST API authentication already covers them
	1502	+ ( property_exists( $wp, 'matched_query' ) && stripos( $wp->matched_query, "rest_route=" ) === 0 && $_SERVER['REQUEST_METHOD'] !== 'GET' ) ||
	1503	+ // Allow access for GET requests to /wp-json/ (root), since REST API discovery calls rely on this
	1504	+ ( property_exists( $wp, 'matched_query' ) && $wp->matched_query === 'rest_route=/' )
1704	1505	// Note that GET requests to a rest endpoint will be restricted by authorizer. In that case, error messages will be returned as JSON.
1705	1506	);
1706	1507
1707	1508	/**
1708		- * Developers can use the `authorizer_has_access` filter to override
1709		- * restricted access on certain pages. Note that the restriction checks
1710		- * happens before WordPress executes any queries, so use the $wp variable
1711		- * to investigate what the visitor is trying to load.
	1509	+ * Developers can use the `authorizer_has_access` filter
	1510	+ * to override restricted access on certain pages. Note that the
	1511	+ * restriction checks happens before WordPress executes any queries, so
	1512	+ * use the global `$wp` variable to investigate what the visitor is
	1513	+ * trying to load.
1712	1514	*
1713	1515	* For example, to unblock an RSS feed, place the following PHP code in
1714	1516	* the theme's functions.php file or in a simple plug-in:
1715	1517	*
1716		- * function my_feed_access_override( $has_access, $wp ) {
1717		- * // Check query variables to see if this is the feed.
1718		- * if ( ! empty( $wp->query_vars['feed'] ) ) {
	1518	+ * function my_rsa_feed_access_override( $has_access ) {
	1519	+ * global $wp;
	1520	+ * // check query variables to see if this is the feed
	1521	+ * if ( ! empty( $wp->query_vars['feed'] ) )
1719	1522	* $has_access = true;
1720		- * }
1721		- *
1722	1523	* return $has_access;
1723	1524	* }
1724		- * add_filter( 'authorizer_has_access', 'my_feed_access_override', 10, 2 );
	1525	+ * add_filter( 'authorizer_has_access', 'my_rsa_feed_access_override' );
1725	1526	*/
1726	1527	if ( apply_filters( 'authorizer_has_access', $has_access, $wp ) === true ) {
1727		- // Turn off the public notice about browsing anonymously.
	1528	+ // Turn off the public notice about browsing anonymously
1728	1529	update_option( 'auth_settings_advanced_public_notice', false );
1729	1530
1730	1531	// We've determined that the current user has access, so simply return to grant access.
1731	1532	return $wp;
		@@ -1731,13 +1532,13 @@
1731	1532	return $wp;
1732	1533	}
1733	1534
1734	1535	// Allow HEAD requests to the root (usually discovery from a REST client).
1735		- if ( 'HEAD' === $_SERVER['REQUEST_METHOD'] && empty( $wp->request ) && empty( $wp->matched_query ) ) {
	1536	+ if ( $_SERVER['REQUEST_METHOD'] === 'HEAD' && empty( $wp->request ) && empty( $wp->matched_query ) ) {
1736	1537	return $wp;
1737	1538	}
1738	1539
1739		- /* We've determined that the current user doesn't have access, so we deal with them now. */
	1540	+ // We've determined that the current user doesn't have access, so we deal with them now.
1740	1541
1741	1542	// Fringe case: In a multisite, a user of a different blog can successfully
1742	1543	// log in, but they aren't on the 'approved' whitelist for this blog.
1743	1544	// If that's the case, add them to the pending list for this blog.
		@@ -1748,19 +1549,21 @@
1748	1549	$result = $this->check_user_access( $current_user, array( $current_user->user_email ) );
1749	1550	}
1750	1551
1751	1552	// Check to see if the requested page is public. If so, show it.
1752		- if ( empty( $wp->request ) ) {
1753		- $current_page_id = 'home';
1754		- } else {
1755		- $request_query = isset( $wp->query_vars ) ? new WP_Query( $wp->query_vars ) : null;
1756		- $current_page_id = isset( $request_query->post_count ) && $request_query->post_count > 0 ? $request_query->post->ID : '';
	1553	+ $current_page_name = property_exists( $wp, 'query_vars' ) && array_key_exists( 'name', $wp->query_vars ) && strlen( $wp->query_vars['name'] ) > 0 ? $wp->query_vars['name'] : '';
	1554	+ if ( ! $current_page_name ) {
	1555	+ // Different WordPress versions store the page slug in different places; look for it elsewhere.
	1556	+ if ( property_exists( $wp, 'query_vars' ) && array_key_exists( 'pagename', $wp->query_vars ) && strlen( $wp->query_vars['pagename'] ) > 0 ) {
	1557	+ $current_page_name = $wp->query_vars['pagename'];
	1558	+ }
1757	1559	}
	1560	+ $current_page_id = empty( $wp->request ) ? 'home' : $this->get_id_from_pagename( $current_page_name );
1758	1561	if ( ! array_key_exists( 'access_public_pages', $auth_settings ) || ! is_array( $auth_settings['access_public_pages'] ) ) {
1759	1562	$auth_settings['access_public_pages'] = array();
1760	1563	}
1761		- if ( in_array( strval( $current_page_id ), $auth_settings['access_public_pages'], true ) ) {
1762		- if ( 'no_warning' === $auth_settings['access_public_warning'] ) {
	1564	+ if ( in_array( $current_page_id, $auth_settings['access_public_pages'] ) ) {
	1565	+ if ( $auth_settings['access_public_warning'] === 'no_warning' ) {
1763	1566	update_option( 'auth_settings_advanced_public_notice', false );
1764	1567	} else {
1765	1568	update_option( 'auth_settings_advanced_public_notice', true );
1766	1569	}
		@@ -1768,11 +1571,11 @@
1768	1571	}
1769	1572
1770	1573	// Check to see if any category assigned to the requested page is public. If so, show it.
1771	1574	$current_page_categories = wp_get_post_categories( $current_page_id, array( 'fields' => 'slugs' ) );
1772		- foreach ( $current_page_categories as $current_page_category ) {
1773		- if ( in_array( 'cat_' . $current_page_category, $auth_settings['access_public_pages'], true ) ) {
1774		- if ( 'no_warning' === $auth_settings['access_public_warning'] ) {
	1575	+ foreach( $current_page_categories as $current_page_category ) {
	1576	+ if ( in_array( 'cat_' . $current_page_category, $auth_settings['access_public_pages'] ) ) {
	1577	+ if ( $auth_settings['access_public_warning'] === 'no_warning' ) {
1775	1578	update_option( 'auth_settings_advanced_public_notice', false );
1776	1579	} else {
1777	1580	update_option( 'auth_settings_advanced_public_notice', true );
1778	1581	}
		@@ -1780,11 +1583,11 @@
1780	1583	}
1781	1584	}
1782	1585
1783	1586	// Check to see if this page can't be found. If so, allow showing the 404 page.
1784		- if ( strlen( $current_page_id ) < 1 ) {
1785		- if ( in_array( 'auth_public_404', $auth_settings['access_public_pages'], true ) ) {
1786		- if ( 'no_warning' === $auth_settings['access_public_warning'] ) {
	1587	+ if ( strlen( $current_page_name ) > 0 && strlen( $current_page_id ) < 1 ) {
	1588	+ if ( in_array( 'auth_public_404', $auth_settings['access_public_pages'] ) ) {
	1589	+ if ( $auth_settings['access_public_warning'] === 'no_warning' ) {
1787	1590	update_option( 'auth_settings_advanced_public_notice', false );
1788	1591	} else {
1789	1592	update_option( 'auth_settings_advanced_public_notice', true );
1790	1593	}
		@@ -1789,8 +1592,9 @@
1789	1592	update_option( 'auth_settings_advanced_public_notice', true );
1790	1593	}
1791	1594	return $wp;
1792	1595	}
	1596	+
1793	1597	}
1794	1598
1795	1599	// Check to see if the requested category is public. If so, show it.
1796	1600	$current_category_name = property_exists( $wp, 'query_vars' ) && array_key_exists( 'category_name', $wp->query_vars ) && strlen( $wp->query_vars['category_name'] ) > 0 ? $wp->query_vars['category_name'] : '';
		@@ -1795,10 +1599,10 @@
1795	1599	// Check to see if the requested category is public. If so, show it.
1796	1600	$current_category_name = property_exists( $wp, 'query_vars' ) && array_key_exists( 'category_name', $wp->query_vars ) && strlen( $wp->query_vars['category_name'] ) > 0 ? $wp->query_vars['category_name'] : '';
1797	1601	if ( $current_category_name ) {
1798	1602	$current_category_name = end( explode( '/', $current_category_name ) );
1799		- if ( in_array( 'cat_' . $current_category_name, $auth_settings['access_public_pages'], true ) ) {
1800		- if ( 'no_warning' === $auth_settings['access_public_warning'] ) {
	1603	+ if ( in_array( 'cat_' . $current_category_name, $auth_settings['access_public_pages'] ) ) {
	1604	+ if ( $auth_settings['access_public_warning'] === 'no_warning' ) {
1801	1605	update_option( 'auth_settings_advanced_public_notice', false );
1802	1606	} else {
1803	1607	update_option( 'auth_settings_advanced_public_notice', true );
1804	1608	}
		@@ -1808,20 +1612,18 @@
1808	1612
1809	1613	// User is denied access, so show them the error message. Render as JSON
1810	1614	// if this is a REST API call; otherwise, show the error message via
1811	1615	// wp_die() (rendered html), or redirect to the login URL.
1812		- $current_path = ! empty( $_SERVER['REQUEST_URI'] ) ? esc_url_raw( wp_unslash( $_SERVER['REQUEST_URI'] ) ) : home_url();
1813		- if ( property_exists( $wp, 'matched_query' ) && stripos( $wp->matched_query, 'rest_route=' ) === 0 && 'GET' === $_SERVER['REQUEST_METHOD'] ) {
1814		- wp_send_json(
1815		- array(
1816		- 'code' => 'rest_cannot_view',
1817		- 'message' => strip_tags( $auth_settings['access_redirect_to_message'] ),
1818		- 'data' => array(
1819		- 'status' => 401,
1820		- ),
1821		- )
1822		- );
1823		- } elseif ( 'message' === $auth_settings['access_redirect'] ) {
	1616	+ $current_path = empty( $_SERVER['REQUEST_URI'] ) ? home_url() : $_SERVER['REQUEST_URI'];
	1617	+ if ( property_exists( $wp, 'matched_query' ) && stripos( $wp->matched_query, "rest_route=" ) === 0 && $_SERVER['REQUEST_METHOD'] === 'GET' ) {
	1618	+ wp_send_json( array(
	1619	+ 'code' => 'rest_cannot_view',
	1620	+ 'message' => strip_tags( $auth_settings['access_redirect_to_message'] ),
	1621	+ 'data' => array(
	1622	+ 'status' => 401,
	1623	+ ),
	1624	+ ));
	1625	+ } elseif ( $auth_settings['access_redirect'] === 'message' ) {
1824	1626	$page_title = sprintf(
1825	1627	/* TRANSLATORS: %s: Name of blog */
1826	1628	__( '%s - Access Restricted', 'authorizer' ),
1827	1629	get_bloginfo( 'name' )
		@@ -1832,15 +1634,15 @@
1832	1634	'<p style="text-align: center;margin-bottom: -15px;">' .
1833	1635	'<a class="button" href="' . wp_login_url( $current_path ) . '">' .
1834	1636	__( 'Log In', 'authorizer' ) .
1835	1637	'</a></p>';
1836		- wp_die( wp_kses( $error_message, $this->allowed_html ), esc_html( $page_title ) );
1837		- } else {
	1638	+ wp_die( $error_message, $page_title );
	1639	+ } else { // if ( $auth_settings['access_redirect'] === 'login' ) {
1838	1640	wp_redirect( wp_login_url( $current_path ), 302 );
1839	1641	exit;
1840	1642	}
1841	1643
1842		- // Sanity check: we should never get here.
	1644	+ // Sanity check: we should never get here
1843	1645	wp_die( '<p>Access denied.</p>', 'Site Access Restricted' );
1844	1646	}
1845	1647
1846	1648
		@@ -1849,11 +1651,9 @@
1849	1651	* not yet been added to this particular blog in a multisite). Note: we do
1850	1652	* this because check_user_access() runs on the parse_request hook, which
1851	1653	* does not fire on wp-admin pages.
1852	1654	*
1853		- * Action: init
1854		- *
1855		- * @return void
	1655	+ * Hook: admin_menu
1856	1656	*/
1857	1657	public function init__maybe_add_network_approved_user() {
1858	1658	global $current_user;
1859	1659
		@@ -1868,10 +1668,10 @@
1868	1668	) {
1869	1669	// Get all approved users.
1870	1670	$auth_settings_access_users_approved = $this->sanitize_user_list(
1871	1671	array_merge(
1872		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT ),
1873		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT )
	1672	+ $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN ),
	1673	+ $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN )
1874	1674	)
1875	1675	);
1876	1676
1877	1677	// Get user info (we need user role).
		@@ -1883,9 +1683,9 @@
1883	1683	// Add user to blog.
1884	1684	add_user_to_blog( get_current_blog_id(), $current_user->ID, $user_info['role'] );
1885	1685
1886	1686	// Refresh user permissions.
1887		- $current_user = new WP_User( $current_user->ID ); // phpcs:ignore WordPress.Variables.GlobalVariables.OverrideProhibited
	1687	+ $current_user = new WP_User( $current_user->ID );
1888	1688	}
1889	1689	}
1890	1690
1891	1691
		@@ -1899,15 +1699,11 @@
1899	1699
1900	1700
1901	1701	/**
1902	1702	* Add custom error message to login screen.
1903		- *
1904	1703	* Filter: login_errors
1905		- *
1906		- * @param string $errors Error description.
1907		- * @return string Error description with Authorizer errors added.
1908	1704	*/
1909		- public function show_advanced_login_error( $errors ) {
	1705	+ function show_advanced_login_error( $errors ) {
1910	1706	$error = get_option( 'auth_settings_advanced_login_error' );
1911	1707	delete_option( 'auth_settings_advanced_login_error' );
1912	1708	$errors = ' ' . $error . "<br />\n";
1913	1709	return $errors;
		@@ -1915,25 +1711,24 @@
1915	1711
1916	1712
1917	1713	/**
1918	1714	* Load external resources for the public-facing site.
1919		- *
1920		- * Action: wp_enqueue_scripts
1921	1715	*/
1922		- public function auth_public_scripts() {
1923		- // Load (and localize) public scripts.
1924		- $current_path = ! empty( $_SERVER['REQUEST_URI'] ) ? esc_url_raw( wp_unslash( $_SERVER['REQUEST_URI'] ) ) : home_url();
1925		- wp_enqueue_script( 'auth_public_scripts', plugins_url( '/js/authorizer-public.js', __FILE__ ), array( 'jquery' ), '2.8.0' );
	1716	+ function auth_public_scripts() {
	1717	+ // Load (and localize) public scripts
	1718	+ $current_path = empty( $_SERVER['REQUEST_URI'] ) ? home_url() : $_SERVER['REQUEST_URI'];
	1719	+ wp_enqueue_script( 'auth_public_scripts', plugins_url( '/js/authorizer-public.js', __FILE__ ), array( 'jquery' ), '2.3.2' );
1926	1720	$auth_localized = array(
1927		- 'wpLoginUrl' => wp_login_url( $current_path ),
1928		- 'publicWarning' => get_option( 'auth_settings_advanced_public_notice' ),
1929		- 'anonymousNotice' => $this->get_plugin_option( 'access_redirect_to_message' ),
1930		- 'logIn' => esc_html__( 'Log In', 'authorizer' ),
	1721	+ 'wp_login_url' => wp_login_url( $current_path ),
	1722	+ 'public_warning' => get_option( 'auth_settings_advanced_public_notice' ),
	1723	+ 'anonymous_notice' => $this->get_plugin_option( 'access_redirect_to_message' ),
	1724	+ 'log_in' => esc_html__( 'Log In', 'authorizer' ),
1931	1725	);
1932	1726	wp_localize_script( 'auth_public_scripts', 'auth', $auth_localized );
	1727	+ //update_option( 'auth_settings_advanced_public_notice', false);
1933	1728
1934		- // Load public css.
1935		- wp_register_style( 'authorizer-public-css', plugins_url( 'css/authorizer-public.css', __FILE__ ), array(), '2.8.0' );
	1729	+ // Load public css
	1730	+ wp_register_style( 'authorizer-public-css', plugins_url( 'css/authorizer-public.css', __FILE__ ), array(), '2.3.2' );
1936	1731	wp_enqueue_style( 'authorizer-public-css' );
1937	1732	}
1938	1733
1939	1734
		@@ -1939,21 +1734,19 @@
1939	1734
1940	1735	/**
1941	1736	* Enqueue JS scripts and CSS styles appearing on wp-login.php.
1942	1737	*
1943		- * Action: login_enqueue_scripts
1944		- *
1945	1738	* @return void
1946	1739	*/
1947		- public function login_enqueue_scripts_and_styles() {
	1740	+ function login_enqueue_scripts_and_styles() {
1948	1741	// Grab plugin settings.
1949		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
	1742	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' );
1950	1743
1951	1744	// Enqueue scripts appearing on wp-login.php.
1952		- wp_enqueue_script( 'auth_login_scripts', plugins_url( '/js/authorizer-login.js', __FILE__ ), array( 'jquery' ), '2.8.0' );
	1745	+ wp_enqueue_script( 'auth_login_scripts', plugins_url( '/js/authorizer-login.js', __FILE__ ), array( 'jquery' ), '2.3.2' );
1953	1746
1954	1747	// Enqueue styles appearing on wp-login.php.
1955		- wp_register_style( 'authorizer-login-css', plugins_url( '/css/authorizer-login.css', __FILE__ ), array(), '2.8.0' );
	1748	+ wp_register_style( 'authorizer-login-css', plugins_url( '/css/authorizer-login.css', __FILE__ ), array(), '2.3.2' );
1956	1749	wp_enqueue_style( 'authorizer-login-css' );
1957	1750
1958	1751	/**
1959	1752	* Developers can use the `authorizer_add_branding_option` filter
		@@ -1958,8 +1751,9 @@
1958	1751	/**
1959	1752	* Developers can use the `authorizer_add_branding_option` filter
1960	1753	* to add a radio button for "Custom WordPress login branding"
1961	1754	* under the "Advanced" tab in Authorizer options. Example:
	1755	+ *
1962	1756	* function my_authorizer_add_branding_option( $branding_options ) {
1963	1757	* $new_branding_option = array(
1964	1758	* 'value' => 'your_brand'
1965	1759	* 'description' => 'Custom Your Brand Login Screen',
		@@ -1973,23 +1767,23 @@
1973	1767	*/
1974	1768	$branding_options = array();
1975	1769	$branding_options = apply_filters( 'authorizer_add_branding_option', $branding_options );
1976	1770	foreach ( $branding_options as $branding_option ) {
1977		- // Make sure the custom brands have the required values.
	1771	+ // Make sure the custom brands have the required values
1978	1772	if ( ! ( is_array( $branding_option ) && array_key_exists( 'value', $branding_option ) && array_key_exists( 'css_url', $branding_option ) && array_key_exists( 'js_url', $branding_option ) ) ) {
1979	1773	continue;
1980	1774	}
1981	1775	if ( $auth_settings['advanced_branding'] === $branding_option['value'] ) {
1982		- wp_enqueue_script( 'auth_login_custom_scripts-' . sanitize_title( $branding_option['value'] ), $branding_option['js_url'], array( 'jquery' ), '2.8.0' );
1983		- wp_register_style( 'authorizer-login-custom-css-' . sanitize_title( $branding_option['value'] ), $branding_option['css_url'], array(), '2.8.0' );
	1776	+ wp_enqueue_script( 'auth_login_custom_scripts-' . sanitize_title( $branding_option['value'] ), $branding_option['js_url'], array( 'jquery' ), '2.3.2' );
	1777	+ wp_register_style( 'authorizer-login-custom-css-' . sanitize_title( $branding_option['value'] ), $branding_option['css_url'], array(), '2.3.2' );
1984	1778	wp_enqueue_style( 'authorizer-login-custom-css-' . sanitize_title( $branding_option['value'] ) );
1985	1779	}
1986	1780	}
1987	1781
1988	1782	// If we're using Google logins, load those resources.
1989		- if ( '1' === $auth_settings['google'] ) {
1990		- wp_enqueue_script( 'authorizer-login-custom-google', plugins_url( '/js/authorizer-login-custom_google.js', __FILE__ ), array( 'jquery' ), '2.8.0' ); ?>
1991		- <meta name="google-signin-clientid" content="<?php echo esc_attr( $auth_settings['google_clientid'] ); ?>" />
	1783	+ if ( $auth_settings['google'] === '1' ) {
	1784	+ wp_enqueue_script( 'authorizer-login-custom-google', plugins_url( '/js/authorizer-login-custom_google.js', __FILE__ ), array( 'jquery' ), '2.3.2' ); ?>
	1785	+ <meta name="google-signin-clientid" content="<?php echo $auth_settings['google_clientid']; ?>" />
1992	1786	<meta name="google-signin-scope" content="email" />
1993	1787	<meta name="google-signin-cookiepolicy" content="single_host_origin" />
1994	1788	<?php
1995	1789	}
		@@ -1997,127 +1791,110 @@
1997	1791
1998	1792
1999	1793	/**
2000	1794	* Load external resources in the footer of the wp-login.php page.
2001		- *
2002		- * Action: login_footer
	1795	+ * Run on action hook: login_footer
2003	1796	*/
2004		- public function load_login_footer_js() {
	1797	+ function load_login_footer_js() {
2005	1798	// Grab plugin settings.
2006		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
2007		- $ajaxurl = admin_url( 'admin-ajax.php' );
2008		- if ( '1' === $auth_settings['google'] ) :
2009		- ?>
2010		-<script type="text/javascript">
2011		-/* global location, window */
2012		-// Reload login page if reauth querystring param exists,
2013		-// since reauth interrupts external logins (e.g., google).
2014		-if ( location.search.indexOf( 'reauth=1' ) >= 0 ) {
2015		- location.href = location.href.replace( 'reauth=1', '' );
2016		-}
	1799	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' ); ?>
	1800	+ <?php if ( $auth_settings['google'] === '1' ): ?>
	1801	+ <script type="text/javascript">
	1802	+ // Reload login page if reauth querystring param exists,
	1803	+ // since reauth interrupts external logins (e.g., google).
	1804	+ if ( location.search.indexOf( 'reauth=1' ) >= 0 ) {
	1805	+ location.href = location.href.replace( 'reauth=1', '' );
	1806	+ }
2017	1807
2018		-// eslint-disable-next-line no-implicit-globals
2019		-function authUpdateQuerystringParam( uri, key, value ) {
2020		- var re = new RegExp( '([?&])' + key + '=.*?(&|$)', 'i' );
2021		- var separator = uri.indexOf( '?' ) !== -1 ? '&' : '?';
2022		- if ( uri.match( re ) ) {
2023		- return uri.replace( re, '$1' + key + '=' + value + '$2' );
2024		- } else {
2025		- return uri + separator + key + '=' + value;
2026		- }
2027		-}
	1808	+ function auth_update_querystring_param( uri, key, value ) {
	1809	+ var re = new RegExp( '([?&])' + key + '=.*?(&|$)', 'i' );
	1810	+ var separator = uri.indexOf( '?' ) !== -1 ? '&' : '?';
	1811	+ if ( uri.match( re ) ) {
	1812	+ return uri.replace( re, '$1' + key + '=' + value + '$2' );
	1813	+ } else {
	1814	+ return uri + separator + key + '=' + value;
	1815	+ }
	1816	+ }
2028	1817
2029		-// eslint-disable-next-line
2030		-function signInCallback( authResult ) { // jshint ignore:line
2031		- var $ = jQuery;
2032		- if ( authResult.status && authResult.status.signed_in ) {
2033		- // Hide the sign-in button now that the user is authorized, for example:
2034		- $( '#googleplus_button' ).attr( 'style', 'display: none' );
	1818	+ function signInCallback( authResult ) {
	1819	+ var $ = jQuery;
	1820	+ if ( authResult['status'] && authResult['status']['signed_in'] ) {
	1821	+ // Hide the sign-in button now that the user is authorized, for example:
	1822	+ $( '#googleplus_button' ).attr( 'style', 'display: none' );
2035	1823
2036		- // Send the code to the server
2037		- var ajaxurl = '<?php echo esc_attr( $ajaxurl ); ?>';
2038		- $.post(ajaxurl, {
2039		- action: 'process_google_login',
2040		- code: authResult.code,
2041		- nonce: $('#nonce_google_auth-<?php echo esc_attr( $this->get_cookie_value() ); ?>' ).val(),
2042		- }, function() {
2043		- // Handle or verify the server response if necessary.
2044		- // console.log( response );
	1824	+ // Send the code to the server
	1825	+ var ajaxurl = '<?php echo admin_url( "admin-ajax.php" ); ?>';
	1826	+ $.post(ajaxurl, {
	1827	+ action: 'process_google_login',
	1828	+ 'code': authResult['code'],
	1829	+ 'nonce': $('#nonce_google_auth-<?php echo $this->get_cookie_value(); ?>' ).val(),
	1830	+ }, function( response ) {
	1831	+ // Handle or verify the server response if necessary.
	1832	+ //console.log( response );
2045	1833
2046		- // Reload wp-login.php to continue the authentication process.
2047		- var newHref = authUpdateQuerystringParam( location.href, 'external', 'google' );
2048		- if ( location.href === newHref ) {
2049		- location.reload();
2050		- } else {
2051		- location.href = newHref;
2052		- }
2053		- });
2054		- } else {
2055		- // Update the app to reflect a signed out user
2056		- // Possible error values:
2057		- // "user_signed_out" - User is signed-out
2058		- // "access_denied" - User denied access to your app
2059		- // "immediate_failed" - Could not automatically log in the user
2060		- // console.log('Sign-in state: ' + authResult['error']);
	1834	+ // Reload wp-login.php to continue the authentication process.
	1835	+ var new_href = auth_update_querystring_param( location.href, 'external', 'google' );
	1836	+ if ( location.href === new_href ) {
	1837	+ location.reload();
	1838	+ } else {
	1839	+ location.href = new_href;
	1840	+ }
	1841	+ });
	1842	+ } else {
	1843	+ // Update the app to reflect a signed out user
	1844	+ // Possible error values:
	1845	+ // "user_signed_out" - User is signed-out
	1846	+ // "access_denied" - User denied access to your app
	1847	+ // "immediate_failed" - Could not automatically log in the user
	1848	+ //console.log('Sign-in state: ' + authResult['error']);
2061	1849
2062		- // If user denies access, reload the login page.
2063		- if ( authResult.error === 'access_denied' || authResult.error === 'user_signed_out' ) {
2064		- window.location.reload();
	1850	+ // If user denies access, reload the login page.
	1851	+ if ( authResult['error'] === 'access_denied' || authResult['error'] === 'user_signed_out' ) {
	1852	+ window.location.reload();
	1853	+ }
	1854	+ }
	1855	+ }
	1856	+ </script>
	1857	+ <?php endif;
2065	1858	}
2066		- }
2067		-}
2068		-</script>
2069		- <?php
2070		- endif;
2071		- }
2072	1859
2073	1860
2074	1861	/**
2075	1862	* Create links for any external authentication services that are enabled.
2076		- *
2077		- * Action: login_form
2078	1863	*/
2079		- public function login_form_add_external_service_links() {
	1864	+ function login_form_add_external_service_links() {
2080	1865	// Grab plugin settings.
2081		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
2082		- ?>
	1866	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' ); ?>
2083	1867	<div id="auth-external-service-login">
2084		- <?php if ( '1' === $auth_settings['google'] ) : ?>
2085		- <p><a id="googleplus_button" class="button button-primary button-external button-google"><span class="dashicons dashicons-googleplus"></span><span class="label"><?php esc_html_e( 'Sign in with Google', 'authorizer' ); ?></span></a></p>
	1868	+ <?php if ( $auth_settings['google'] === '1' ): ?>
	1869	+ <p><a id="googleplus_button" class="button button-primary button-external button-google"><span class="dashicons dashicons-googleplus"></span><span class="label"><?php _e( 'Sign in with Google', 'authorizer' ); ?></span></a></p>
2086	1870	<?php wp_nonce_field( 'google_csrf_nonce', 'nonce_google_auth-' . $this->get_cookie_value() ); ?>
2087	1871	<?php endif; ?>
2088	1872
2089		- <?php if ( '1' === $auth_settings['cas'] ) : ?>
2090		- <p><a class="button button-primary button-external button-cas" href="<?php echo esc_attr( $this->modify_current_url_for_cas_login() ); ?>">
	1873	+ <?php if ( $auth_settings['cas'] === '1' ): ?>
	1874	+ <p><a class="button button-primary button-external button-cas" href="<?php echo $this->modify_current_url_for_cas_login(); ?>">
2091	1875	<span class="dashicons dashicons-lock"></span>
2092		- <span class="label">
2093		- <?php
2094		- echo esc_html(
2095		- sprintf(
2096		- /* TRANSLATORS: %s: Custom CAS label from authorizer options */
2097		- __( 'Sign in with %s', 'authorizer' ),
2098		- $auth_settings['cas_custom_label']
2099		- )
	1876	+ <span class="label"><?php
	1877	+ printf(
	1878	+ /* TRANSLATORS: %s: Custom CAS label from authorizer options */
	1879	+ __( 'Sign in with %s', 'authorizer' ),
	1880	+ $auth_settings['cas_custom_label']
2100	1881	);
2101		- ?>
2102		- </span>
	1882	+ ?></span>
2103	1883	</a></p>
2104	1884	<?php endif; ?>
2105	1885
2106		- <?php if ( '1' === $auth_settings['advanced_hide_wp_login'] && isset( $_SERVER['QUERY_STRING'] ) && false === strpos( $_SERVER['QUERY_STRING'], 'external=wordpress' ) ) : // phpcs:ignore WordPress.VIP.ValidatedSanitizedInput ?>
	1886	+ <?php if ( $auth_settings['advanced_hide_wp_login'] === '1' && strpos( $_SERVER['QUERY_STRING'], 'external=wordpress' ) === false ): ?>
2107	1887	<style type="text/css">
2108		- body.login-action-login form {
2109		- padding-bottom: 8px;
	1888	+ #loginform {
	1889	+ padding-bottom: 8px !important;
2110	1890	}
2111		- body.login-action-login form p > label,
2112		- body.login-action-login form .forgetmenot,
2113		- body.login-action-login form .submit,
2114		- body.login-action-login #nav { /* csslint allow: ids */
2115		- display: none;
	1891	+ #loginform p>label, #loginform p.forgetmenot, #loginform p.submit, p#nav {
	1892	+ display: none !important;
2116	1893	}
2117	1894	</style>
2118		- <?php elseif ( '1' === $auth_settings['cas'] || '1' === $auth_settings['google'] ) : ?>
2119		- <h3> &mdash; <?php esc_html_e( 'or', 'authorizer' ); ?> &mdash; </h3>
	1895	+ <?php elseif ( $auth_settings['cas'] === '1' || $auth_settings['google'] === '1' ): ?>
	1896	+ <h3> &mdash; <?php _e( 'or', 'authorizer' ); ?> &mdash; </h3>
2120	1897	<?php endif; ?>
2121	1898	</div>
2122	1899	<?php
2123	1900
		@@ -2126,79 +1903,36 @@
2126	1903
2127	1904	/**
2128	1905	* Redirect to CAS login when visiting login page (only if option is
2129	1906	* enabled, CAS is the only service, and WordPress logins are hidden).
2130		- * Note: hook into wp_login_errors filter so this fires after the
2131		- * authenticate hook (where the redirect to CAS happens), but before html
2132		- * output is started (so the redirect header doesn't complain about data
2133		- * already being sent).
2134		- *
2135		- * Filter: wp_login_errors
2136		- *
2137		- * @param object $errors WP Error object.
2138		- * @param string $redirect_to Where to redirect on error.
2139		- * @return WP_Error|void WP Error object or void on redirect.
2140	1907	*/
2141		- public function wp_login_errors__maybe_redirect_to_cas( $errors, $redirect_to ) {
	1908	+ function login_head_maybe_redirect_to_cas() {
2142	1909	// Grab plugin settings.
2143		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
	1910	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' );
2144	1911
2145	1912	// Check whether we should redirect to CAS.
2146	1913	if (
2147		- isset( $_SERVER['QUERY_STRING'] ) &&
2148		- strpos( $_SERVER['QUERY_STRING'], 'external=wordpress' ) === false && // phpcs:ignore WordPress.VIP.ValidatedSanitizedInput
2149		- array_key_exists( 'cas_auto_login', $auth_settings ) && '1' === $auth_settings['cas_auto_login'] &&
2150		- array_key_exists( 'cas', $auth_settings ) && '1' === $auth_settings['cas'] &&
2151		- ( ! array_key_exists( 'ldap', $auth_settings ) || '1' !== $auth_settings['ldap'] ) &&
2152		- ( ! array_key_exists( 'google', $auth_settings ) || '1' !== $auth_settings['google'] ) &&
2153		- array_key_exists( 'advanced_hide_wp_login', $auth_settings ) && '1' === $auth_settings['advanced_hide_wp_login']
	1914	+ strpos( $_SERVER['QUERY_STRING'], 'external=wordpress' ) === false &&
	1915	+ array_key_exists( 'cas_auto_login', $auth_settings ) && $auth_settings['cas_auto_login'] === '1' &&
	1916	+ array_key_exists( 'cas', $auth_settings ) && $auth_settings['cas'] === '1' &&
	1917	+ ( ! array_key_exists( 'ldap', $auth_settings ) || $auth_settings['ldap'] !== '1' ) &&
	1918	+ ( ! array_key_exists( 'google', $auth_settings ) || $auth_settings['google'] !== '1' ) &&
	1919	+ array_key_exists( 'advanced_hide_wp_login', $auth_settings ) && $auth_settings['advanced_hide_wp_login'] === '1'
2154	1920	) {
2155	1921	wp_redirect( $this->modify_current_url_for_cas_login() );
2156	1922	exit;
2157	1923	}
2158		-
2159		- return $errors;
2160	1924	}
2161	1925
2162	1926
2163	1927	/**
2164		- * Set a unique cookie to add to Google auth nonce to avoid CSRF detection.
2165		- * Note: hook into login_init so this fires at the start of the visit to
2166		- * wp-login.php, but before any html output is started (so setting the
2167		- * cookie header doesn't complain about data already being sent).
2168		- *
2169		- * Action: login_init
2170		- *
2171		- * @return void
2172		- */
2173		- public function login_init__maybe_set_google_nonce_cookie() {
2174		- // Grab plugin settings.
2175		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
2176		-
2177		- // If Google logins are enabled, make sure the cookie is set.
2178		- if ( array_key_exists( 'google', $auth_settings ) && '1' === $auth_settings['google'] ) {
2179		- if ( ! isset( $_COOKIE['login_unique'] ) ) {
2180		- $this->cookie_value = md5( rand() );
2181		- setcookie( 'login_unique', $this->cookie_value, time() + 1800, '/', defined( 'COOKIE_DOMAIN' ) ? COOKIE_DOMAIN : '' );
2182		- $_COOKIE['login_unique'] = $this->cookie_value;
2183		- }
2184		- }
2185		- }
2186		-
2187		-
2188		- /**
2189	1928	* Implements hook: do_action( 'wp_login_failed', $username );
2190	1929	* Update the user meta for the user that just failed logging in.
2191	1930	* Keep track of time of last failed attempt and number of failed attempts.
2192		- *
2193		- * Action: wp_login_failed
2194		- *
2195		- * @param string $username Username to update login count for.
2196		- * @return void
2197	1931	*/
2198		- public function update_login_failed_count( $username ) {
	1932	+ function update_login_failed_count( $username ) {
2199	1933	// Grab plugin settings.
2200		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
	1934	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' );
2201	1935
2202	1936	// Get user trying to log in.
2203	1937	// If this isn't a real user, update the global failed attempt
2204	1938	// variables. We'll use these global variables to institute the
		@@ -2206,9 +1940,9 @@
2206	1940	// won't be able to determine which accounts are real by which
2207	1941	// accounts get locked out on multiple invalid attempts.
2208	1942	$user = get_user_by( 'login', $username );
2209	1943
2210		- if ( false !== $user ) {
	1944	+ if ( $user !== FALSE ) {
2211	1945	$last_attempt = get_user_meta( $user->ID, 'auth_settings_advanced_lockouts_time_last_failed', true );
2212	1946	$num_attempts = get_user_meta( $user->ID, 'auth_settings_advanced_lockouts_failed_attempts', true );
2213	1947	} else {
2214	1948	$last_attempt = get_option( 'auth_settings_advanced_lockouts_time_last_failed' );
		@@ -2222,15 +1956,15 @@
2222	1956
2223	1957	// Reset the failed attempt count if the time since the last
2224	1958	// failed attempt is greater than the reset duration.
2225	1959	$time_since_last_fail = time() - $last_attempt;
2226		- $reset_duration = $auth_settings['advanced_lockouts']['reset_duration'] * 60; // minutes to seconds.
	1960	+ $reset_duration = $auth_settings['advanced_lockouts']['reset_duration'] * 60; // minutes to seconds
2227	1961	if ( $time_since_last_fail > $reset_duration ) {
2228	1962	$num_attempts = 0;
2229	1963	}
2230	1964
2231	1965	// Set last failed time to now and increment last failed count.
2232		- if ( false !== $user ) {
	1966	+ if ( $user !== FALSE ) {
2233	1967	update_user_meta( $user->ID, 'auth_settings_advanced_lockouts_time_last_failed', time() );
2234	1968	update_user_meta( $user->ID, 'auth_settings_advanced_lockouts_failed_attempts', $num_attempts + 1 );
2235	1969	} else {
2236	1970	update_option( 'auth_settings_advanced_lockouts_time_last_failed', time() );
		@@ -2241,16 +1975,16 @@
2241	1975
2242	1976	/**
2243	1977	* When they successfully log in, make sure WordPress users are in the approved list.
2244	1978	*
2245		- * Action: wp_login
	1979	+ * @action wp_login
2246	1980	*
2247	1981	* @param string $user_login Username of the user logging in.
2248		- * @param object $user WP_User object of the user logging in.
2249		- * @return void
	1982	+ * @param WP_User $user WP_User object of the user logging in.
	1983	+ * @return null
2250	1984	*/
2251		- public function ensure_wordpress_user_in_approved_list_on_login( $user_login, $user ) {
2252		- $this->add_user_to_authorizer_when_created( $user->user_email, $user->user_registered, $user->roles );
	1985	+ function ensure_wordpress_user_in_approved_list_on_login( $user_login, $user ) {
	1986	+ $this->add_user_to_authorizer_when_created( $user->user_email, $user->user_registered, $user->user_roles );
2253	1987	}
2254	1988
2255	1989
2256	1990	/**
		@@ -2256,17 +1990,12 @@
2256	1990	/**
2257	1991	* Overwrite the URL for the lost password link on the login form.
2258	1992	* If we're authenticating against an external service, standard
2259	1993	* WordPress password resets won't work.
2260		- *
2261		- * Filter: lostpassword_url
2262		- *
2263		- * @param string $lostpassword_url URL to reset password.
2264		- * @return string URL to reset password.
2265	1994	*/
2266		- public function custom_lostpassword_url( $lostpassword_url ) {
	1995	+ function custom_lostpassword_url( $lostpassword_url ) {
2267	1996	// Grab plugin settings.
2268		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
	1997	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' );
2269	1998
2270	1999	if (
2271	2000	array_key_exists( 'ldap_lostpassword_url', $auth_settings ) &&
2272	2001	filter_var( $auth_settings['ldap_lostpassword_url'], FILTER_VALIDATE_URL )
		@@ -2289,16 +2018,15 @@
2289	2018	/**
2290	2019	* Add a link to this plugin's settings page from the WordPress Plugins page.
2291	2020	* Called from "plugin_action_links" filter in __construct() above.
2292	2021	*
2293		- * Filter: plugin_action_links_authorizer.php
	2022	+ * @param array $links array of links in the admin sidebar
2294	2023	*
2295		- * @param array $links Admin sidebar links.
2296		- * @return array Admin sidebar links with Authorizer added.
	2024	+ * @return array of links to show in the admin sidebar.
2297	2025	*/
2298	2026	public function plugin_settings_link( $links ) {
2299		- $admin_menu = $this->get_plugin_option( 'advanced_admin_menu' );
2300		- $settings_url = 'settings' === $admin_menu ? admin_url( 'options-general.php?page=authorizer' ) : admin_url( 'admin.php?page=authorizer' );
	2027	+ $admin_menu = $this->get_plugin_option( 'advanced_admin_menu' );
	2028	+ $settings_url = $admin_menu === 'settings' ? admin_url( 'options-general.php?page=authorizer' ) : admin_url( 'admin.php?page=authorizer' );
2301	2029	array_unshift( $links, '<a href="' . $settings_url . '">' . __( 'Settings', 'authorizer' ) . '</a>' );
2302	2030	return $links;
2303	2031	}
2304	2032
		@@ -2306,12 +2034,11 @@
2306	2034	/**
2307	2035	* Add a link to this plugin's network settings page from the WordPress Plugins page.
2308	2036	* Called from "network_admin_plugin_action_links" filter in __construct() above.
2309	2037	*
2310		- * Filter: network_admin_plugin_action_links_authorizer.php
	2038	+ * @param array $links array of links in the network admin sidebar
2311	2039	*
2312		- * @param array $links Network admin sidebar links.
2313		- * @return array Network admin sidebar links with Authorizer added.
	2040	+ * @return array of links to show in the network admin sidebar.
2314	2041	*/
2315	2042	public function network_admin_plugin_settings_link( $links ) {
2316	2043	$settings_link = '<a href="admin.php?page=authorizer">' . __( 'Network Settings', 'authorizer' ) . '</a>';
2317	2044	array_unshift( $links, $settings_link );
		@@ -2319,33 +2046,32 @@
2319	2046	}
2320	2047
2321	2048
2322	2049	/**
2323		- * Create the options page under Dashboard > Settings.
2324		- *
2325		- * Action: admin_menu
	2050	+ * Create the options page under Dashboard > Settings
	2051	+ * Run on action hook: admin_menu
2326	2052	*/
2327	2053	public function add_plugin_page() {
2328	2054	$admin_menu = $this->get_plugin_option( 'advanced_admin_menu' );
2329		- if ( 'settings' === $admin_menu ) {
	2055	+ if ( $admin_menu === 'settings' ) {
2330	2056	// @see http://codex.wordpress.org/Function_Reference/add_options_page
2331	2057	add_options_page(
2332		- 'Authorizer',
2333		- 'Authorizer',
2334		- 'create_users',
2335		- 'authorizer',
2336		- array( $this, 'create_admin_page' )
	2058	+ 'Authorizer', // Page title
	2059	+ 'Authorizer', // Menu title
	2060	+ 'create_users', // Capability
	2061	+ 'authorizer', // Menu slug
	2062	+ array( $this, 'create_admin_page' ) // function
2337	2063	);
2338	2064	} else {
2339	2065	// @see http://codex.wordpress.org/Function_Reference/add_menu_page
2340	2066	add_menu_page(
2341		- 'Authorizer',
2342		- 'Authorizer',
2343		- 'create_users',
2344		- 'authorizer',
2345		- array( $this, 'create_admin_page' ),
2346		- 'dashicons-groups',
2347		- '99.0018465' // position (decimal is to make overlap with other plugins less likely).
	2067	+ 'Authorizer', // Page title
	2068	+ 'Authorizer', // Menu title
	2069	+ 'create_users', // Capability
	2070	+ 'authorizer', // Menu slug
	2071	+ array( $this, 'create_admin_page' ), // callback
	2072	+ 'dashicons-groups', // icon
	2073	+ '99.0018465' // position (decimal is to make overlap with other plugins less likely)
2348	2074	);
2349	2075	}
2350	2076	}
2351	2077
		@@ -2350,75 +2076,56 @@
2350	2076	}
2351	2077
2352	2078
2353	2079	/**
2354		- * Output the HTML for the options page.
	2080	+ * Output the HTML for the options page
2355	2081	*/
2356		- public function create_admin_page() {
2357		- ?>
	2082	+ public function create_admin_page() { ?>
2358	2083	<div class="wrap">
2359		- <h2><?php esc_html_e( 'Authorizer Settings', 'authorizer' ); ?></h2>
2360		- <form method="post" action="options.php" autocomplete="off">
2361		- <?php
2362		- // This prints out all hidden settings fields.
	2084	+ <h2><?php _e( 'Authorizer Settings', 'authorizer' ); ?></h2>
	2085	+ <form method="post" action="options.php" autocomplete="off"><?php
	2086	+ // This prints out all hidden settings fields
	2087	+ // @see http://codex.wordpress.org/Function_Reference/settings_fields
2363	2088	settings_fields( 'auth_settings_group' );
2364		- // This prints out all the sections.
	2089	+ // This prints out all the sections
	2090	+ // @see http://codex.wordpress.org/Function_Reference/do_settings_sections
2365	2091	do_settings_sections( 'authorizer' );
2366		- submit_button();
2367		- ?>
	2092	+ submit_button(); ?>
2368	2093	</form>
2369		- </div>
2370		- <?php
	2094	+ </div><?php
2371	2095	}
2372	2096
2373	2097
2374	2098	/**
2375	2099	* Load external resources on this plugin's options page.
2376		- *
2377		- * Action: load-settings_page_authorizer
2378		- * Action: load-toplevel_page_authorizer
2379		- * Action: admin_head-index.php
	2100	+ * Run on action hooks: load-settings_page_authorizer, load-toplevel_page_authorizer, admin_head-index.php
2380	2101	*/
2381	2102	public function load_options_page() {
2382	2103	wp_enqueue_script(
2383	2104	'authorizer',
2384	2105	plugins_url( 'js/authorizer.js', __FILE__ ),
2385		- array( 'jquery-effects-shake' ), '2.8.7', true
	2106	+ array( 'jquery-effects-shake' ), '2.3.2', true
2386	2107	);
2387		- wp_localize_script(
2388		- 'authorizer', 'authL10n', array(
2389		- 'baseurl' => get_bloginfo( 'url' ),
2390		- 'saved' => esc_html__( 'Saved', 'authorizer' ),
2391		- 'duplicate' => esc_html__( 'Duplicate', 'authorizer' ),
2392		- 'failed' => esc_html__( 'Failed', 'authorizer' ),
2393		- 'local_wordpress_user' => esc_html__( 'Local WordPress user', 'authorizer' ),
2394		- 'block_ban_user' => esc_html__( 'Block/Ban user', 'authorizer' ),
2395		- 'remove_user' => esc_html__( 'Remove user', 'authorizer' ),
2396		- 'no_users_in' => esc_html__( 'No users in', 'authorizer' ),
2397		- 'save_changes' => esc_html__( 'Save Changes', 'authorizer' ),
2398		- 'private_pages' => esc_html__( 'Private Pages', 'authorizer' ),
2399		- 'public_pages' => esc_html__( 'Public Pages', 'authorizer' ),
2400		- 'first_page' => esc_html__( 'First page' ),
2401		- 'previous_page' => esc_html__( 'Previous page' ),
2402		- 'next_page' => esc_html__( 'Next page' ),
2403		- 'last_page' => esc_html__( 'Last page' ),
2404		- 'is_network_admin' => is_network_admin() ? '1' : '0',
2405		- )
2406		- );
	2108	+ wp_localize_script( 'authorizer', 'auth_L10n', array(
	2109	+ 'baseurl' => get_bloginfo( 'url' ),
	2110	+ 'saved' => esc_html__( 'Saved', 'authorizer' ),
	2111	+ 'failed' => esc_html__( 'Failed', 'authorizer' ),
	2112	+ 'local_wordpress_user' => esc_html__( 'Local WordPress user', 'authorizer' ),
	2113	+ 'block_ban_user' => esc_html__( 'Block/Ban user', 'authorizer' ),
	2114	+ 'remove_user' => esc_html__( 'Remove user', 'authorizer' ),
	2115	+ 'no_users_in' => esc_html__( 'No users in', 'authorizer' ),
	2116	+ 'save_changes' => esc_html__( 'Save Changes', 'authorizer' ),
	2117	+ 'private_pages' => esc_html__( 'Private Pages', 'authorizer' ),
	2118	+ 'public_pages' => esc_html__( 'Public Pages', 'authorizer' ),
	2119	+ ));
2407	2120
2408	2121	wp_enqueue_script(
2409		- 'jquery-autogrow-textarea',
2410		- plugins_url( 'vendor/jquery.autogrow-textarea/jquery.autogrow-textarea.js', __FILE__ ),
2411		- array( 'jquery' ), '2.7.0', true
2412		- );
2413		-
2414		- wp_enqueue_script(
2415	2122	'jquery.multi-select',
2416	2123	plugins_url( 'vendor/jquery.multi-select/js/jquery.multi-select.js', __FILE__ ),
2417	2124	array( 'jquery' ), '1.8', true
2418	2125	);
2419	2126
2420		- wp_register_style( 'authorizer-css', plugins_url( 'css/authorizer.css', __FILE__ ), array(), '2.8.7' );
	2127	+ wp_register_style( 'authorizer-css', plugins_url( 'css/authorizer.css', __FILE__ ), array(), '2.3.2' );
2421	2128	wp_enqueue_style( 'authorizer-css' );
2422	2129
2423	2130	wp_register_style( 'jquery-multi-select-css', plugins_url( 'vendor/jquery.multi-select/css/multi-select.css', __FILE__ ), array(), '1.8' );
2424	2131	wp_enqueue_style( 'jquery-multi-select-css' );
		@@ -2429,26 +2136,18 @@
2429	2136
2430	2137
2431	2138	/**
2432	2139	* Show custom admin notice.
2433		- *
2434		- * Note: currently unused, but if anywhere we:
2435		- * add_option( 'auth_settings_advanced_admin_notice, 'Your message.' );
2436		- * It will display and then delete that message on the admin dashboard.
2437		- *
2438		- * Filter: admin_notices
2439		- * filter: network_admin_notices
	2140	+ * Filter: admin_notice
2440	2141	*/
2441		- public function show_advanced_admin_notice() {
	2142	+ function show_advanced_admin_notice() {
2442	2143	$notice = get_option( 'auth_settings_advanced_admin_notice' );
2443	2144	delete_option( 'auth_settings_advanced_admin_notice' );
2444	2145
2445		- if ( $notice && strlen( $notice ) > 0 ) {
2446		- ?>
	2146	+ if ( $notice && strlen( $notice ) > 0 ) { ?>
2447	2147	<div class="error">
2448		- <p><?php echo wp_kses( $notice, $this->allowed_html ); ?></p>
2449		- </div>
2450		- <?php
	2148	+ <p><?php echo $notice; ?></p>
	2149	+ </div><?php
2451	2150	}
2452	2151	}
2453	2152
2454	2153
		@@ -2453,11 +2152,9 @@
2453	2152
2454	2153
2455	2154	/**
2456	2155	* Add notices to the top of the options page.
2457		- *
2458		- * Action: load-settings_page_authorizer > admin_notices
2459		- *
	2156	+ * Run on action hook chain: load-settings_page_authorizer > admin_notices
2460	2157	* Description: Check for invalid settings combinations and show a warning message, e.g.:
2461	2158	* if ( cas url inaccessible ) : ?>
2462	2159	* <div class='updated settings-error'><p>Can't reach CAS server.</p></div>
2463	2160	* <?php endif;
		@@ -2463,23 +2160,20 @@
2463	2160	* <?php endif;
2464	2161	*/
2465	2162	public function admin_notices() {
2466	2163	// Grab plugin settings.
2467		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
	2164	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' );
2468	2165
2469		- if ( '1' === $auth_settings['cas'] ) :
	2166	+ if ( $auth_settings['cas'] === '1' ) :
2470	2167	// Check if provided CAS URL is accessible.
2471		- $protocol = in_array( strval( $auth_settings['cas_port'] ), array( '80', '8080' ), true ) ? 'http' : 'https';
2472		- $cas_url = $protocol . '://' . $auth_settings['cas_host'] . ':' . $auth_settings['cas_port'] . $auth_settings['cas_path'];
2473		- $legacy_cas_url = trailingslashit( $cas_url ) . 'login'; // Check the specific CAS login endpoint (old; some servers don't register a ./login endpoint, use serviceValidate instead).
2474		- $cas_url = trailingslashit( $cas_url ) . 'serviceValidate'; // Check the specific CAS login endpoint.
2475		- if ( ! $this->url_is_accessible( $cas_url ) && ! $this->url_is_accessible( $legacy_cas_url ) ) :
2476		- $authorizer_options_url = 'settings' === $auth_settings['advanced_admin_menu'] ? admin_url( 'options-general.php?page=authorizer' ) : admin_url( '?page=authorizer' );
2477		- ?>
2478		- <div class='notice notice-warning is-dismissible'>
2479		- <p><?php esc_html_e( "Can't reach CAS server. Please provide", 'authorizer' ); ?> <a href='<?php echo esc_attr( $authorizer_options_url ); ?>&tab=external'><?php esc_html_e( 'accurate CAS settings', 'authorizer' ); ?></a> <?php esc_html_e( 'if you intend to use it.', 'authorizer' ); ?></p>
2480		- </div>
2481		- <?php
	2168	+ $protocol = in_array( $auth_settings['cas_port'], array( '80', '8080' ) ) ? 'http' : 'https';
	2169	+ $cas_url = $protocol . '://' . $auth_settings['cas_host'] . ':' . $auth_settings['cas_port'] . $auth_settings['cas_path'];
	2170	+ $cas_url = trailingslashit( $cas_url ) . 'login'; // Check the specific CAS login endpoint
	2171	+ if ( ! $this->url_is_accessible( $cas_url ) ) :
	2172	+ $authorizer_options_url = $auth_settings['advanced_admin_menu'] === 'settings' ? admin_url( 'options-general.php?page=authorizer' ) : admin_url( '?page=authorizer' );
	2173	+ ?><div class='notice notice-warning is-dismissible'>
	2174	+ <p><?php _e( "Can't reach CAS server. Please provide", 'authorizer' ); ?> <a href='<?php echo $authorizer_options_url; ?>&tab=external'><?php _e( 'accurate CAS settings', 'authorizer' ); ?></a> <?php _e( 'if you intend to use it.', 'authorizer' ); ?></p>
	2175	+ </div><?php
2482	2176	endif;
2483	2177	endif;
2484	2178	}
2485	2179
		@@ -2484,437 +2178,399 @@
2484	2178	}
2485	2179
2486	2180
2487	2181	/**
2488		- * Create sections and options.
2489		- *
2490		- * Action: admin_init
	2182	+ * Create sections and options
	2183	+ * Run on action hook: admin_init
2491	2184	*/
2492	2185	public function page_init() {
2493		- /**
2494		- * Create one setting that holds all the options (array).
2495		- *
2496		- * @see http://codex.wordpress.org/Function_Reference/register_setting
2497		- * @see http://codex.wordpress.org/Function_Reference/add_settings_section
2498		- * @see http://codex.wordpress.org/Function_Reference/add_settings_field
2499		- */
	2186	+ // Create one setting that holds all the options (array)
	2187	+ // @see http://codex.wordpress.org/Function_Reference/register_setting
	2188	+ // @see http://codex.wordpress.org/Function_Reference/add_settings_section
	2189	+ // @see http://codex.wordpress.org/Function_Reference/add_settings_field
2500	2190	register_setting(
2501		- 'auth_settings_group',
2502		- 'auth_settings',
2503		- array( $this, 'sanitize_options' )
	2191	+ 'auth_settings_group', // Option group
	2192	+ 'auth_settings', // Option name
	2193	+ array( $this, 'sanitize_options' ) // Sanitize callback
2504	2194	);
2505	2195
2506	2196	add_settings_section(
2507		- 'auth_settings_tabs',
2508		- '',
2509		- array( $this, 'print_section_info_tabs' ),
2510		- 'authorizer'
	2197	+ 'auth_settings_tabs', // HTML element ID
	2198	+ '', // HTML element Title
	2199	+ array( $this, 'print_section_info_tabs' ), // Callback (echos section content)
	2200	+ 'authorizer' // Page this section is shown on (slug)
2511	2201	);
2512	2202
2513		- // Create Access Lists section.
	2203	+ // Create Access Lists section
2514	2204	add_settings_section(
2515		- 'auth_settings_lists',
2516		- '',
2517		- array( $this, 'print_section_info_access_lists' ),
2518		- 'authorizer'
	2205	+ 'auth_settings_lists', // HTML element ID
	2206	+ '', // HTML element Title
	2207	+ array( $this, 'print_section_info_access_lists' ), // Callback (echos section content)
	2208	+ 'authorizer' // Page this section is shown on (slug)
2519	2209	);
2520	2210
2521		- // Create Login Access section.
	2211	+ // Create Login Access section
2522	2212	add_settings_section(
2523		- 'auth_settings_access_login',
2524		- '',
2525		- array( $this, 'print_section_info_access_login' ),
2526		- 'authorizer'
	2213	+ 'auth_settings_access_login', // HTML element ID
	2214	+ '', // HTML element Title
	2215	+ array( $this, 'print_section_info_access_login' ), // Callback (echos section content)
	2216	+ 'authorizer' // Page this section is shown on (slug)
2527	2217	);
2528	2218	add_settings_field(
2529		- 'auth_settings_access_who_can_login',
2530		- __( 'Who can log into the site?', 'authorizer' ),
2531		- array( $this, 'print_radio_auth_access_who_can_login' ),
2532		- 'authorizer',
2533		- 'auth_settings_access_login'
	2219	+ 'auth_settings_access_who_can_login', // HTML element ID
	2220	+ __( 'Who can log into the site?', 'authorizer' ), // HTML element Title
	2221	+ array( $this, 'print_radio_auth_access_who_can_login' ), // Callback (echos form element)
	2222	+ 'authorizer', // Page this setting is shown on (slug)
	2223	+ 'auth_settings_access_login' // Section this setting is shown on
2534	2224	);
2535	2225	add_settings_field(
2536		- 'auth_settings_access_role_receive_pending_emails',
2537		- __( 'Which role should receive email notifications about pending users?', 'authorizer' ),
2538		- array( $this, 'print_select_auth_access_role_receive_pending_emails' ),
2539		- 'authorizer',
2540		- 'auth_settings_access_login'
	2226	+ 'auth_settings_access_role_receive_pending_emails', // HTML element ID
	2227	+ __( 'Which role should receive email notifications about pending users?', 'authorizer' ), // HTML element Title
	2228	+ array( $this, 'print_select_auth_access_role_receive_pending_emails' ), // Callback (echos form element)
	2229	+ 'authorizer', // Page this setting is shown on (slug)
	2230	+ 'auth_settings_access_login' // Section this setting is shown on
2541	2231	);
2542	2232	add_settings_field(
2543		- 'auth_settings_access_pending_redirect_to_message',
2544		- __( 'What message should pending users see after attempting to log in?', 'authorizer' ),
2545		- array( $this, 'print_wysiwyg_auth_access_pending_redirect_to_message' ),
2546		- 'authorizer',
2547		- 'auth_settings_access_login'
	2233	+ 'auth_settings_access_pending_redirect_to_message', // HTML element ID
	2234	+ __( 'What message should pending users see after attempting to log in?', 'authorizer' ), // HTML element Title
	2235	+ array( $this, 'print_wysiwyg_auth_access_pending_redirect_to_message' ), // Callback (echos form element)
	2236	+ 'authorizer', // Page this setting is shown on (slug)
	2237	+ 'auth_settings_access_login' // Section this setting is shown on
2548	2238	);
2549	2239	add_settings_field(
2550		- 'auth_settings_access_blocked_redirect_to_message',
2551		- __( 'What message should blocked users see after attempting to log in?', 'authorizer' ),
2552		- array( $this, 'print_wysiwyg_auth_access_blocked_redirect_to_message' ),
2553		- 'authorizer',
2554		- 'auth_settings_access_login'
	2240	+ 'auth_settings_access_blocked_redirect_to_message', // HTML element ID
	2241	+ __( 'What message should blocked users see after attempting to log in?', 'authorizer' ), // HTML element Title
	2242	+ array( $this, 'print_wysiwyg_auth_access_blocked_redirect_to_message' ), // Callback (echos form element)
	2243	+ 'authorizer', // Page this setting is shown on (slug)
	2244	+ 'auth_settings_access_login' // Section this setting is shown on
2555	2245	);
2556	2246	add_settings_field(
2557		- 'auth_settings_access_should_email_approved_users',
2558		- __( 'Send welcome email to new approved users?', 'authorizer' ),
2559		- array( $this, 'print_checkbox_auth_access_should_email_approved_users' ),
2560		- 'authorizer',
2561		- 'auth_settings_access_login'
	2247	+ 'auth_settings_access_should_email_approved_users', // HTML element ID
	2248	+ __( 'Send welcome email to new approved users?', 'authorizer' ), // HTML element Title
	2249	+ array( $this, 'print_checkbox_auth_access_should_email_approved_users' ), // Callback (echos form element)
	2250	+ 'authorizer', // Page this setting is shown on (slug)
	2251	+ 'auth_settings_access_login' // Section this setting is shown on
2562	2252	);
2563	2253	add_settings_field(
2564		- 'auth_settings_access_email_approved_users_subject',
2565		- __( 'Welcome email subject', 'authorizer' ),
2566		- array( $this, 'print_text_auth_access_email_approved_users_subject' ),
2567		- 'authorizer',
2568		- 'auth_settings_access_login'
	2254	+ 'auth_settings_access_email_approved_users_subject', // HTML element ID
	2255	+ __( 'Welcome email subject', 'authorizer' ), // HTML element Title
	2256	+ array( $this, 'print_text_auth_access_email_approved_users_subject' ), // Callback (echos form element)
	2257	+ 'authorizer', // Page this setting is shown on (slug)
	2258	+ 'auth_settings_access_login' // Section this setting is shown on
2569	2259	);
2570	2260	add_settings_field(
2571		- 'auth_settings_access_email_approved_users_body',
2572		- __( 'Welcome email body', 'authorizer' ),
2573		- array( $this, 'print_wysiwyg_auth_access_email_approved_users_body' ),
2574		- 'authorizer',
2575		- 'auth_settings_access_login'
	2261	+ 'auth_settings_access_email_approved_users_body', // HTML element ID
	2262	+ __( 'Welcome email body', 'authorizer' ), // HTML element Title
	2263	+ array( $this, 'print_wysiwyg_auth_access_email_approved_users_body' ), // Callback (echos form element)
	2264	+ 'authorizer', // Page this setting is shown on (slug)
	2265	+ 'auth_settings_access_login' // Section this setting is shown on
2576	2266	);
2577	2267
2578		- // Create Public Access section.
	2268	+
	2269	+ // Create Public Access section
2579	2270	add_settings_section(
2580		- 'auth_settings_access_public',
2581		- '',
2582		- array( $this, 'print_section_info_access_public' ),
2583		- 'authorizer'
	2271	+ 'auth_settings_access_public', // HTML element ID
	2272	+ '', // HTML element Title
	2273	+ array( $this, 'print_section_info_access_public' ), // Callback (echos section content)
	2274	+ 'authorizer' // Page this section is shown on (slug)
2584	2275	);
2585	2276	add_settings_field(
2586		- 'auth_settings_access_who_can_view',
2587		- __( 'Who can view the site?', 'authorizer' ),
2588		- array( $this, 'print_radio_auth_access_who_can_view' ),
2589		- 'authorizer',
2590		- 'auth_settings_access_public'
	2277	+ 'auth_settings_access_who_can_view', // HTML element ID
	2278	+ __( 'Who can view the site?', 'authorizer' ), // HTML element Title
	2279	+ array( $this, 'print_radio_auth_access_who_can_view' ), // Callback (echos form element)
	2280	+ 'authorizer', // Page this setting is shown on (slug)
	2281	+ 'auth_settings_access_public' // Section this setting is shown on
2591	2282	);
2592	2283	add_settings_field(
2593		- 'auth_settings_access_public_pages',
2594		- __( 'What pages (if any) should be available to everyone?', 'authorizer' ),
2595		- array( $this, 'print_multiselect_auth_access_public_pages' ),
2596		- 'authorizer',
2597		- 'auth_settings_access_public'
	2284	+ 'auth_settings_access_public_pages', // HTML element ID
	2285	+ __( 'What pages (if any) should be available to everyone?', 'authorizer' ), // HTML element Title
	2286	+ array( $this, 'print_multiselect_auth_access_public_pages' ), // Callback (echos form element)
	2287	+ 'authorizer', // Page this setting is shown on (slug)
	2288	+ 'auth_settings_access_public' // Section this setting is shown on
2598	2289	);
2599	2290	add_settings_field(
2600		- 'auth_settings_access_redirect',
2601		- __( 'What happens to people without access when they visit a private page?', 'authorizer' ),
2602		- array( $this, 'print_radio_auth_access_redirect' ),
2603		- 'authorizer',
2604		- 'auth_settings_access_public'
	2291	+ 'auth_settings_access_redirect', // HTML element ID
	2292	+ __( 'What happens to people without access when they visit a private page?', 'authorizer' ), // HTML element Title
	2293	+ array( $this, 'print_radio_auth_access_redirect' ), // Callback (echos form element)
	2294	+ 'authorizer', // Page this setting is shown on (slug)
	2295	+ 'auth_settings_access_public' // Section this setting is shown on
2605	2296	);
2606	2297	add_settings_field(
2607		- 'auth_settings_access_public_warning',
2608		- __( 'What happens to people without access when they visit a public page?', 'authorizer' ),
2609		- array( $this, 'print_radio_auth_access_public_warning' ),
2610		- 'authorizer',
2611		- 'auth_settings_access_public'
	2298	+ 'auth_settings_access_public_warning', // HTML element ID
	2299	+ __( 'What happens to people without access when they visit a public page?', 'authorizer' ), // HTML element Title
	2300	+ array( $this, 'print_radio_auth_access_public_warning' ), // Callback (echos form element)
	2301	+ 'authorizer', // Page this setting is shown on (slug)
	2302	+ 'auth_settings_access_public' // Section this setting is shown on
2612	2303	);
2613	2304	add_settings_field(
2614		- 'auth_settings_access_redirect_to_message',
2615		- __( 'What message should people without access see?', 'authorizer' ),
2616		- array( $this, 'print_wysiwyg_auth_access_redirect_to_message' ),
2617		- 'authorizer',
2618		- 'auth_settings_access_public'
	2305	+ 'auth_settings_access_redirect_to_message', // HTML element ID
	2306	+ __( 'What message should people without access see?', 'authorizer' ), // HTML element Title
	2307	+ array( $this, 'print_wysiwyg_auth_access_redirect_to_message' ), // Callback (echos form element)
	2308	+ 'authorizer', // Page this setting is shown on (slug)
	2309	+ 'auth_settings_access_public' // Section this setting is shown on
2619	2310	);
2620	2311
2621		- // Create External Service Settings section.
	2312	+ // Create External Service Settings section
2622	2313	add_settings_section(
2623		- 'auth_settings_external',
2624		- '',
2625		- array( $this, 'print_section_info_external' ),
2626		- 'authorizer'
	2314	+ 'auth_settings_external', // HTML element ID
	2315	+ '', // HTML element Title
	2316	+ array( $this, 'print_section_info_external' ), // Callback (echos section content)
	2317	+ 'authorizer' // Page this section is shown on (slug)
2627	2318	);
2628	2319	add_settings_field(
2629		- 'auth_settings_access_default_role',
2630		- __( 'Default role for new users', 'authorizer' ),
2631		- array( $this, 'print_select_auth_access_default_role' ),
2632		- 'authorizer',
2633		- 'auth_settings_external'
	2320	+ 'auth_settings_access_default_role', // HTML element ID
	2321	+ __( 'Default role for new users', 'authorizer' ), // HTML element Title
	2322	+ array( $this, 'print_select_auth_access_default_role' ), // Callback (echos form element)
	2323	+ 'authorizer', // Page this setting is shown on (slug)
	2324	+ 'auth_settings_external' // Section this setting is shown on
2634	2325	);
2635	2326	add_settings_field(
2636		- 'auth_settings_external_google',
2637		- __( 'Google Logins', 'authorizer' ),
2638		- array( $this, 'print_checkbox_auth_external_google' ),
2639		- 'authorizer',
2640		- 'auth_settings_external'
	2327	+ 'auth_settings_external_google', // HTML element ID
	2328	+ __( 'Google Logins', 'authorizer' ), // HTML element Title
	2329	+ array( $this, 'print_checkbox_auth_external_google' ), // Callback (echos form element)
	2330	+ 'authorizer', // Page this setting is shown on (slug)
	2331	+ 'auth_settings_external' // Section this setting is shown on
2641	2332	);
2642	2333	add_settings_field(
2643		- 'auth_settings_google_clientid',
2644		- __( 'Google Client ID', 'authorizer' ),
2645		- array( $this, 'print_text_google_clientid' ),
2646		- 'authorizer',
2647		- 'auth_settings_external'
	2334	+ 'auth_settings_google_clientid', // HTML element ID
	2335	+ __( 'Google Client ID', 'authorizer' ), // HTML element Title
	2336	+ array( $this, 'print_text_google_clientid' ), // Callback (echos form element)
	2337	+ 'authorizer', // Page this setting is shown on (slug)
	2338	+ 'auth_settings_external' // Section this setting is shown on
2648	2339	);
2649	2340	add_settings_field(
2650		- 'auth_settings_google_clientsecret',
2651		- __( 'Google Client Secret', 'authorizer' ),
2652		- array( $this, 'print_text_google_clientsecret' ),
2653		- 'authorizer',
2654		- 'auth_settings_external'
	2341	+ 'auth_settings_google_clientsecret', // HTML element ID
	2342	+ __( 'Google Client Secret', 'authorizer' ), // HTML element Title
	2343	+ array( $this, 'print_text_google_clientsecret' ), // Callback (echos form element)
	2344	+ 'authorizer', // Page this setting is shown on (slug)
	2345	+ 'auth_settings_external' // Section this setting is shown on
2655	2346	);
2656	2347	add_settings_field(
2657		- 'auth_settings_google_hosteddomain',
2658		- __( 'Google Hosted Domain', 'authorizer' ),
2659		- array( $this, 'print_text_google_hosteddomain' ),
2660		- 'authorizer',
2661		- 'auth_settings_external'
	2348	+ 'auth_settings_google_hosteddomain', // HTML element ID
	2349	+ __( 'Google Hosted Domain', 'authorizer' ), // HTML element Title
	2350	+ array( $this, 'print_text_google_hosteddomain' ), // Callback (echos form element)
	2351	+ 'authorizer', // Page this setting is shown on (slug)
	2352	+ 'auth_settings_external' // Section this setting is shown on
2662	2353	);
2663	2354	add_settings_field(
2664		- 'auth_settings_external_cas',
2665		- __( 'CAS Logins', 'authorizer' ),
2666		- array( $this, 'print_checkbox_auth_external_cas' ),
2667		- 'authorizer',
2668		- 'auth_settings_external'
	2355	+ 'auth_settings_external_cas', // HTML element ID
	2356	+ __( 'CAS Logins', 'authorizer' ), // HTML element Title
	2357	+ array( $this, 'print_checkbox_auth_external_cas' ), // Callback (echos form element)
	2358	+ 'authorizer', // Page this setting is shown on (slug)
	2359	+ 'auth_settings_external' // Section this setting is shown on
2669	2360	);
2670	2361	add_settings_field(
2671		- 'auth_settings_cas_custom_label',
2672		- __( 'CAS custom label', 'authorizer' ),
2673		- array( $this, 'print_text_cas_custom_label' ),
2674		- 'authorizer',
2675		- 'auth_settings_external'
	2362	+ 'auth_settings_cas_custom_label', // HTML element ID
	2363	+ __( 'CAS custom label', 'authorizer' ), // HTML element Title
	2364	+ array( $this, 'print_text_cas_custom_label' ), // Callback (echos form element)
	2365	+ 'authorizer', // Page this setting is shown on (slug)
	2366	+ 'auth_settings_external' // Section this setting is shown on
2676	2367	);
2677	2368	add_settings_field(
2678		- 'auth_settings_cas_host',
2679		- __( 'CAS server hostname', 'authorizer' ),
2680		- array( $this, 'print_text_cas_host' ),
2681		- 'authorizer',
2682		- 'auth_settings_external'
	2369	+ 'auth_settings_cas_host', // HTML element ID
	2370	+ __( 'CAS server hostname', 'authorizer' ), // HTML element Title
	2371	+ array( $this, 'print_text_cas_host' ), // Callback (echos form element)
	2372	+ 'authorizer', // Page this setting is shown on (slug)
	2373	+ 'auth_settings_external' // Section this setting is shown on
2683	2374	);
2684	2375	add_settings_field(
2685		- 'auth_settings_cas_port',
2686		- __( 'CAS server port', 'authorizer' ),
2687		- array( $this, 'print_text_cas_port' ),
2688		- 'authorizer',
2689		- 'auth_settings_external'
	2376	+ 'auth_settings_cas_port', // HTML element ID
	2377	+ __( 'CAS server port', 'authorizer' ), // HTML element Title
	2378	+ array( $this, 'print_text_cas_port' ), // Callback (echos form element)
	2379	+ 'authorizer', // Page this setting is shown on (slug)
	2380	+ 'auth_settings_external' // Section this setting is shown on
2690	2381	);
2691	2382	add_settings_field(
2692		- 'auth_settings_cas_path',
2693		- __( 'CAS server path/context', 'authorizer' ),
2694		- array( $this, 'print_text_cas_path' ),
2695		- 'authorizer',
2696		- 'auth_settings_external'
	2383	+ 'auth_settings_cas_path', // HTML element ID
	2384	+ __( 'CAS server path/context', 'authorizer' ), // HTML element Title
	2385	+ array( $this, 'print_text_cas_path' ), // Callback (echos form element)
	2386	+ 'authorizer', // Page this setting is shown on (slug)
	2387	+ 'auth_settings_external' // Section this setting is shown on
2697	2388	);
2698	2389	add_settings_field(
2699		- 'auth_settings_cas_version',
2700		- 'CAS server version',
2701		- array( $this, 'print_select_cas_version' ),
2702		- 'authorizer',
2703		- 'auth_settings_external'
	2390	+ 'auth_settings_cas_version', // HTML element ID
	2391	+ 'CAS server version', // HTML element Title
	2392	+ array( $this, 'print_select_cas_version' ), // Callback (echos form element)
	2393	+ 'authorizer', // Page this setting is shown on (slug)
	2394	+ 'auth_settings_external' // Section this setting is shown on
2704	2395	);
2705	2396	add_settings_field(
2706		- 'auth_settings_cas_attr_email',
2707		- __( 'CAS attribute containing email address', 'authorizer' ),
2708		- array( $this, 'print_text_cas_attr_email' ),
2709		- 'authorizer',
2710		- 'auth_settings_external'
	2397	+ 'auth_settings_cas_attr_email', // HTML element ID
	2398	+ __( 'CAS attribute containing email address', 'authorizer' ), // HTML element Title
	2399	+ array( $this, 'print_text_cas_attr_email' ), // Callback (echos form element)
	2400	+ 'authorizer', // Page this setting is shown on (slug)
	2401	+ 'auth_settings_external' // Section this setting is shown on
2711	2402	);
2712	2403	add_settings_field(
2713		- 'auth_settings_cas_attr_first_name',
2714		- __( 'CAS attribute containing first name', 'authorizer' ),
2715		- array( $this, 'print_text_cas_attr_first_name' ),
2716		- 'authorizer',
2717		- 'auth_settings_external'
	2404	+ 'auth_settings_cas_attr_first_name', // HTML element ID
	2405	+ __( 'CAS attribute containing first name', 'authorizer' ), // HTML element Title
	2406	+ array( $this, 'print_text_cas_attr_first_name' ), // Callback (echos form element)
	2407	+ 'authorizer', // Page this setting is shown on (slug)
	2408	+ 'auth_settings_external' // Section this setting is shown on
2718	2409	);
2719	2410	add_settings_field(
2720		- 'auth_settings_cas_attr_last_name',
2721		- __( 'CAS attribute containing last name', 'authorizer' ),
2722		- array( $this, 'print_text_cas_attr_last_name' ),
2723		- 'authorizer',
2724		- 'auth_settings_external'
	2411	+ 'auth_settings_cas_attr_last_name', // HTML element ID
	2412	+ __( 'CAS attribute containing last name', 'authorizer' ), // HTML element Title
	2413	+ array( $this, 'print_text_cas_attr_last_name' ), // Callback (echos form element)
	2414	+ 'authorizer', // Page this setting is shown on (slug)
	2415	+ 'auth_settings_external' // Section this setting is shown on
2725	2416	);
2726	2417	add_settings_field(
2727		- 'auth_settings_cas_attr_update_on_login',
2728		- __( 'CAS attribute update', 'authorizer' ),
2729		- array( $this, 'print_checkbox_cas_attr_update_on_login' ),
2730		- 'authorizer',
2731		- 'auth_settings_external'
	2418	+ 'auth_settings_cas_attr_update_on_login', // HTML element ID
	2419	+ __( 'CAS attribute update', 'authorizer' ), // HTML element Title
	2420	+ array( $this, 'print_checkbox_cas_attr_update_on_login' ), // Callback (echos form element)
	2421	+ 'authorizer', // Page this setting is shown on (slug)
	2422	+ 'auth_settings_external' // Section this setting is shown on
2732	2423	);
2733	2424	add_settings_field(
2734		- 'auth_settings_cas_auto_login',
2735		- __( 'CAS automatic login', 'authorizer' ),
2736		- array( $this, 'print_checkbox_cas_auto_login' ),
2737		- 'authorizer',
2738		- 'auth_settings_external'
	2425	+ 'auth_settings_cas_auto_login', // HTML element ID
	2426	+ __( 'CAS automatic login', 'authorizer' ), // HTML element Title
	2427	+ array( $this, 'print_checkbox_cas_auto_login' ), // Callback (echos form element)
	2428	+ 'authorizer', // Page this setting is shown on (slug)
	2429	+ 'auth_settings_external' // Section this setting is shown on
2739	2430	);
2740	2431	add_settings_field(
2741		- 'auth_settings_cas_link_on_username',
2742		- __( 'CAS users linked by username', 'authorizer' ),
2743		- array( $this, 'print_checkbox_cas_link_on_username' ),
2744		- 'authorizer',
2745		- 'auth_settings_external'
	2432	+ 'auth_settings_external_ldap', // HTML element ID
	2433	+ __( 'LDAP Logins', 'authorizer' ), // HTML element Title
	2434	+ array( $this, 'print_checkbox_auth_external_ldap' ), // Callback (echos form element)
	2435	+ 'authorizer', // Page this setting is shown on (slug)
	2436	+ 'auth_settings_external' // Section this setting is shown on
2746	2437	);
2747	2438	add_settings_field(
2748		- 'auth_settings_external_ldap',
2749		- __( 'LDAP Logins', 'authorizer' ),
2750		- array( $this, 'print_checkbox_auth_external_ldap' ),
2751		- 'authorizer',
2752		- 'auth_settings_external'
	2439	+ 'auth_settings_ldap_host', // HTML element ID
	2440	+ __( 'LDAP Host', 'authorizer' ), // HTML element Title
	2441	+ array( $this, 'print_text_ldap_host' ), // Callback (echos form element)
	2442	+ 'authorizer', // Page this setting is shown on (slug)
	2443	+ 'auth_settings_external' // Section this setting is shown on
2753	2444	);
2754	2445	add_settings_field(
2755		- 'auth_settings_ldap_host',
2756		- __( 'LDAP Host', 'authorizer' ),
2757		- array( $this, 'print_text_ldap_host' ),
2758		- 'authorizer',
2759		- 'auth_settings_external'
	2446	+ 'auth_settings_ldap_port', // HTML element ID
	2447	+ __( 'LDAP Port', 'authorizer' ), // HTML element Title
	2448	+ array( $this, 'print_text_ldap_port' ), // Callback (echos form element)
	2449	+ 'authorizer', // Page this setting is shown on (slug)
	2450	+ 'auth_settings_external' // Section this setting is shown on
2760	2451	);
2761	2452	add_settings_field(
2762		- 'auth_settings_ldap_port',
2763		- __( 'LDAP Port', 'authorizer' ),
2764		- array( $this, 'print_text_ldap_port' ),
2765		- 'authorizer',
2766		- 'auth_settings_external'
	2453	+ 'auth_settings_ldap_tls', // HTML element ID
	2454	+ __( 'Secure Connection (TLS)', 'authorizer' ), // HTML element Title
	2455	+ array( $this, 'print_checkbox_ldap_tls' ), // Callback (echos form element)
	2456	+ 'authorizer', // Page this setting is shown on (slug)
	2457	+ 'auth_settings_external' // Section this setting is shown on
2767	2458	);
2768	2459	add_settings_field(
2769		- 'auth_settings_ldap_tls',
2770		- __( 'Use TLS', 'authorizer' ),
2771		- array( $this, 'print_checkbox_ldap_tls' ),
2772		- 'authorizer',
2773		- 'auth_settings_external'
	2460	+ 'auth_settings_ldap_search_base', // HTML element ID
	2461	+ __( 'LDAP Search Base', 'authorizer' ), // HTML element Title
	2462	+ array( $this, 'print_text_ldap_search_base' ), // Callback (echos form element)
	2463	+ 'authorizer', // Page this setting is shown on (slug)
	2464	+ 'auth_settings_external' // Section this setting is shown on
2774	2465	);
2775	2466	add_settings_field(
2776		- 'auth_settings_ldap_search_base',
2777		- __( 'LDAP Search Base', 'authorizer' ),
2778		- array( $this, 'print_text_ldap_search_base' ),
2779		- 'authorizer',
2780		- 'auth_settings_external'
	2467	+ 'auth_settings_ldap_uid', // HTML element ID
	2468	+ __( 'LDAP attribute containing username', 'authorizer' ), // HTML element Title
	2469	+ array( $this, 'print_text_ldap_uid' ), // Callback (echos form element)
	2470	+ 'authorizer', // Page this setting is shown on (slug)
	2471	+ 'auth_settings_external' // Section this setting is shown on
2781	2472	);
2782	2473	add_settings_field(
2783		- 'auth_settings_ldap_uid',
2784		- __( 'LDAP attribute containing username', 'authorizer' ),
2785		- array( $this, 'print_text_ldap_uid' ),
2786		- 'authorizer',
2787		- 'auth_settings_external'
	2474	+ 'auth_settings_ldap_attr_email', // HTML element ID
	2475	+ __( 'LDAP attribute containing email address', 'authorizer' ), // HTML element Title
	2476	+ array( $this, 'print_text_ldap_attr_email' ), // Callback (echos form element)
	2477	+ 'authorizer', // Page this setting is shown on (slug)
	2478	+ 'auth_settings_external' // Section this setting is shown on
2788	2479	);
2789	2480	add_settings_field(
2790		- 'auth_settings_ldap_attr_email',
2791		- __( 'LDAP attribute containing email address', 'authorizer' ),
2792		- array( $this, 'print_text_ldap_attr_email' ),
2793		- 'authorizer',
2794		- 'auth_settings_external'
	2481	+ 'auth_settings_ldap_user', // HTML element ID
	2482	+ __( 'LDAP Directory User', 'authorizer' ), // HTML element Title
	2483	+ array( $this, 'print_text_ldap_user' ), // Callback (echos form element)
	2484	+ 'authorizer', // Page this setting is shown on (slug)
	2485	+ 'auth_settings_external' // Section this setting is shown on
2795	2486	);
2796	2487	add_settings_field(
2797		- 'auth_settings_ldap_user',
2798		- __( 'LDAP Directory User', 'authorizer' ),
2799		- array( $this, 'print_text_ldap_user' ),
2800		- 'authorizer',
2801		- 'auth_settings_external'
	2488	+ 'auth_settings_ldap_password', // HTML element ID
	2489	+ __( 'LDAP Directory User Password', 'authorizer' ), // HTML element Title
	2490	+ array( $this, 'print_password_ldap_password' ), // Callback (echos form element)
	2491	+ 'authorizer', // Page this setting is shown on (slug)
	2492	+ 'auth_settings_external' // Section this setting is shown on
2802	2493	);
2803	2494	add_settings_field(
2804		- 'auth_settings_ldap_password',
2805		- __( 'LDAP Directory User Password', 'authorizer' ),
2806		- array( $this, 'print_password_ldap_password' ),
2807		- 'authorizer',
2808		- 'auth_settings_external'
	2495	+ 'auth_settings_ldap_lostpassword_url', // HTML element ID
	2496	+ __( 'Custom lost password URL', 'authorizer' ), // HTML element Title
	2497	+ array( $this, 'print_text_ldap_lostpassword_url' ), // Callback (echos form element)
	2498	+ 'authorizer', // Page this setting is shown on (slug)
	2499	+ 'auth_settings_external' // Section this setting is shown on
2809	2500	);
2810	2501	add_settings_field(
2811		- 'auth_settings_ldap_lostpassword_url',
2812		- __( 'Custom lost password URL', 'authorizer' ),
2813		- array( $this, 'print_text_ldap_lostpassword_url' ),
2814		- 'authorizer',
2815		- 'auth_settings_external'
	2502	+ 'auth_settings_ldap_attr_first_name', // HTML element ID
	2503	+ __( 'LDAP attribute containing first name', 'authorizer' ), // HTML element Title
	2504	+ array( $this, 'print_text_ldap_attr_first_name' ), // Callback (echos form element)
	2505	+ 'authorizer', // Page this setting is shown on (slug)
	2506	+ 'auth_settings_external' // Section this setting is shown on
2816	2507	);
2817	2508	add_settings_field(
2818		- 'auth_settings_ldap_attr_first_name',
2819		- __( 'LDAP attribute containing first name', 'authorizer' ),
2820		- array( $this, 'print_text_ldap_attr_first_name' ),
2821		- 'authorizer',
2822		- 'auth_settings_external'
	2509	+ 'auth_settings_ldap_attr_last_name', // HTML element ID
	2510	+ __( 'LDAP attribute containing last name', 'authorizer' ), // HTML element Title
	2511	+ array( $this, 'print_text_ldap_attr_last_name' ), // Callback (echos form element)
	2512	+ 'authorizer', // Page this setting is shown on (slug)
	2513	+ 'auth_settings_external' // Section this setting is shown on
2823	2514	);
2824	2515	add_settings_field(
2825		- 'auth_settings_ldap_attr_last_name',
2826		- __( 'LDAP attribute containing last name', 'authorizer' ),
2827		- array( $this, 'print_text_ldap_attr_last_name' ),
2828		- 'authorizer',
2829		- 'auth_settings_external'
	2516	+ 'auth_settings_ldap_attr_update_on_login', // HTML element ID
	2517	+ __( 'LDAP attribute update', 'authorizer' ), // HTML element Title
	2518	+ array( $this, 'print_checkbox_ldap_attr_update_on_login' ), // Callback (echos form element)
	2519	+ 'authorizer', // Page this setting is shown on (slug)
	2520	+ 'auth_settings_external' // Section this setting is shown on
2830	2521	);
2831		- add_settings_field(
2832		- 'auth_settings_ldap_attr_update_on_login',
2833		- __( 'LDAP attribute update', 'authorizer' ),
2834		- array( $this, 'print_checkbox_ldap_attr_update_on_login' ),
2835		- 'authorizer',
2836		- 'auth_settings_external'
2837		- );
2838	2522
2839		- // Create Advanced Settings section.
	2523	+ // Create Advanced Settings section
2840	2524	add_settings_section(
2841		- 'auth_settings_advanced',
2842		- '',
2843		- array( $this, 'print_section_info_advanced' ),
2844		- 'authorizer'
	2525	+ 'auth_settings_advanced', // HTML element ID
	2526	+ '', // HTML element Title
	2527	+ array( $this, 'print_section_info_advanced' ), // Callback (echos section content)
	2528	+ 'authorizer' // Page this section is shown on (slug)
2845	2529	);
2846	2530	add_settings_field(
2847		- 'auth_settings_advanced_lockouts',
2848		- __( 'Limit invalid login attempts', 'authorizer' ),
2849		- array( $this, 'print_text_auth_advanced_lockouts' ),
2850		- 'authorizer',
2851		- 'auth_settings_advanced'
	2531	+ 'auth_settings_advanced_lockouts', // HTML element ID
	2532	+ __( 'Limit invalid login attempts', 'authorizer' ), // HTML element Title
	2533	+ array( $this, 'print_text_auth_advanced_lockouts' ), // Callback (echos form element)
	2534	+ 'authorizer', // Page this setting is shown on (slug)
	2535	+ 'auth_settings_advanced' // Section this setting is shown on
2852	2536	);
2853	2537	add_settings_field(
2854		- 'auth_settings_advanced_hide_wp_login',
2855		- __( 'Hide WordPress Login', 'authorizer' ),
2856		- array( $this, 'print_checkbox_auth_advanced_hide_wp_login' ),
2857		- 'authorizer',
2858		- 'auth_settings_advanced'
	2538	+ 'auth_settings_advanced_hide_wp_login', // HTML element ID
	2539	+ __( 'Hide WordPress Login', 'authorizer' ), // HTML element Title
	2540	+ array( $this, 'print_checkbox_auth_advanced_hide_wp_login' ), // Callback (echos form element)
	2541	+ 'authorizer', // Page this setting is shown on (slug)
	2542	+ 'auth_settings_advanced' // Section this setting is shown on
2859	2543	);
2860	2544	add_settings_field(
2861		- 'auth_settings_advanced_branding',
2862		- __( 'Custom WordPress login branding', 'authorizer' ),
2863		- array( $this, 'print_radio_auth_advanced_branding' ),
2864		- 'authorizer',
2865		- 'auth_settings_advanced'
	2545	+ 'auth_settings_advanced_branding', // HTML element ID
	2546	+ __( 'Custom WordPress login branding', 'authorizer' ), // HTML element Title
	2547	+ array( $this, 'print_radio_auth_advanced_branding' ), // Callback (echos form element)
	2548	+ 'authorizer', // Page this setting is shown on (slug)
	2549	+ 'auth_settings_advanced' // Section this setting is shown on
2866	2550	);
2867	2551	add_settings_field(
2868		- 'auth_settings_advanced_admin_menu',
2869		- __( 'Authorizer admin menu item location', 'authorizer' ),
2870		- array( $this, 'print_radio_auth_advanced_admin_menu' ),
2871		- 'authorizer',
2872		- 'auth_settings_advanced'
	2552	+ 'auth_settings_advanced_admin_menu', // HTML element ID
	2553	+ __( 'Authorizer admin menu item location', 'authorizer' ), // HTML element Title
	2554	+ array( $this, 'print_radio_auth_advanced_admin_menu' ), // Callback (echos form element)
	2555	+ 'authorizer', // Page this setting is shown on (slug)
	2556	+ 'auth_settings_advanced' // Section this setting is shown on
2873	2557	);
2874	2558	add_settings_field(
2875		- 'auth_settings_advanced_usermeta',
2876		- __( 'Show custom usermeta in user list', 'authorizer' ),
2877		- array( $this, 'print_select_auth_advanced_usermeta' ),
2878		- 'authorizer',
2879		- 'auth_settings_advanced'
	2559	+ 'auth_settings_advanced_usermeta', // HTML element ID
	2560	+ __( 'Show custom usermeta in user list', 'authorizer' ), // HTML element Title
	2561	+ array( $this, 'print_select_auth_advanced_usermeta' ), // Callback (echos form element)
	2562	+ 'authorizer', // Page this setting is shown on (slug)
	2563	+ 'auth_settings_advanced' // Section this setting is shown on
2880	2564	);
2881		- add_settings_field(
2882		- 'auth_settings_advanced_users_per_page',
2883		- __( 'Number of users per page', 'authorizer' ),
2884		- array( $this, 'print_text_auth_advanced_users_per_page' ),
2885		- 'authorizer',
2886		- 'auth_settings_advanced'
2887		- );
2888		- add_settings_field(
2889		- 'auth_settings_advanced_users_sort_by',
2890		- __( 'Approved users sort method', 'authorizer' ),
2891		- array( $this, 'print_select_auth_advanced_users_sort_by' ),
2892		- 'authorizer',
2893		- 'auth_settings_advanced'
2894		- );
2895		- add_settings_field(
2896		- 'auth_settings_advanced_users_sort_order',
2897		- __( 'Approved users sort order', 'authorizer' ),
2898		- array( $this, 'print_select_auth_advanced_users_sort_order' ),
2899		- 'authorizer',
2900		- 'auth_settings_advanced'
2901		- );
2902		- add_settings_field(
2903		- 'auth_settings_advanced_widget_enabled',
2904		- __( 'Show dashboard widget to admin users', 'authorizer' ),
2905		- array( $this, 'print_checkbox_auth_advanced_widget_enabled' ),
2906		- 'authorizer',
2907		- 'auth_settings_advanced'
2908		- );
2909	2565	// On multisite installs, add an option to override all multisite settings on individual sites.
2910	2566	if ( is_multisite() ) {
2911	2567	add_settings_field(
2912		- 'auth_settings_advanced_override_multisite',
2913		- __( 'Override multisite options', 'authorizer' ),
2914		- array( $this, 'print_checkbox_auth_advanced_override_multisite' ),
2915		- 'authorizer',
2916		- 'auth_settings_advanced'
	2568	+ 'auth_settings_advanced_override_multisite', // HTML element ID
	2569	+ __( 'Override multisite options', 'authorizer' ), // HTML element Title
	2570	+ array( $this, 'print_checkbox_auth_advanced_override_multisite' ), // Callback (echos form element)
	2571	+ 'authorizer', // Page this setting is shown on (slug)
	2572	+ 'auth_settings_advanced' // Section this setting is shown on
2917	2573	);
2918	2574	}
2919	2575	}
2920	2576
		@@ -2920,30 +2576,29 @@
2920	2576
2921	2577
2922	2578	/**
2923	2579	* Set meaningful defaults for the plugin options.
2924		- *
2925	2580	* Note: This function is called on plugin activation.
2926	2581	*/
2927		- private function set_default_options() {
	2582	+ function set_default_options() {
2928	2583	global $wp_roles;
2929	2584
2930	2585	$auth_settings = get_option( 'auth_settings' );
2931		- if ( false === $auth_settings ) {
	2586	+ if ( $auth_settings === FALSE ) {
2932	2587	$auth_settings = array();
2933	2588	}
2934	2589
2935	2590	// Access Lists Defaults.
2936	2591	$auth_settings_access_users_pending = get_option( 'auth_settings_access_users_pending' );
2937		- if ( false === $auth_settings_access_users_pending ) {
	2592	+ if ( $auth_settings_access_users_pending === FALSE ) {
2938	2593	$auth_settings_access_users_pending = array();
2939	2594	}
2940	2595	$auth_settings_access_users_approved = get_option( 'auth_settings_access_users_approved' );
2941		- if ( false === $auth_settings_access_users_approved ) {
	2596	+ if ( $auth_settings_access_users_approved === FALSE ) {
2942	2597	$auth_settings_access_users_approved = array();
2943	2598	}
2944	2599	$auth_settings_access_users_blocked = get_option( 'auth_settings_access_users_blocked' );
2945		- if ( false === $auth_settings_access_users_blocked ) {
	2600	+ if ( $auth_settings_access_users_blocked === FALSE ) {
2946	2601	$auth_settings_access_users_blocked = array();
2947	2602	}
2948	2603
2949	2604	// Login Access Defaults.
		@@ -2995,12 +2650,13 @@
2995	2650	if ( ! array_key_exists( 'access_redirect_to_message', $auth_settings ) ) {
2996	2651	$auth_settings['access_redirect_to_message'] = '<p>' . __( 'Notice: You are browsing this site anonymously, and only have access to a portion of its content.', 'authorizer' ) . '</p>';
2997	2652	}
2998	2653
	2654	+
2999	2655	// External Service Defaults.
3000	2656	if ( ! array_key_exists( 'access_default_role', $auth_settings ) ) {
3001	2657	// Set default role to 'student' if that role exists, 'subscriber' otherwise.
3002		- $all_roles = $wp_roles->roles;
	2658	+ $all_roles = $wp_roles->roles;
3003	2659	$editable_roles = apply_filters( 'editable_roles', $all_roles );
3004	2660	if ( array_key_exists( 'student', $editable_roles ) ) {
3005	2661	$auth_settings['access_default_role'] = 'student';
3006	2662	} else {
		@@ -3057,11 +2713,8 @@
3057	2713	}
3058	2714	if ( ! array_key_exists( 'cas_auto_login', $auth_settings ) ) {
3059	2715	$auth_settings['cas_auto_login'] = '';
3060	2716	}
3061		- if ( ! array_key_exists( 'cas_link_on_username', $auth_settings ) ) {
3062		- $auth_settings['cas_link_on_username'] = '';
3063		- }
3064	2717
3065	2718	if ( ! array_key_exists( 'ldap_host', $auth_settings ) ) {
3066	2719	$auth_settings['ldap_host'] = '';
3067	2720	}
		@@ -3101,12 +2754,12 @@
3101	2754
3102	2755	// Advanced defaults.
3103	2756	if ( ! array_key_exists( 'advanced_lockouts', $auth_settings ) ) {
3104	2757	$auth_settings['advanced_lockouts'] = array(
3105		- 'attempts_1' => 10,
3106		- 'duration_1' => 1,
3107		- 'attempts_2' => 10,
3108		- 'duration_2' => 10,
	2758	+ 'attempts_1' => 10,
	2759	+ 'duration_1' => 1,
	2760	+ 'attempts_2' => 10,
	2761	+ 'duration_2' => 10,
3109	2762	'reset_duration' => 120,
3110	2763	);
3111	2764	}
3112	2765	if ( ! array_key_exists( 'advanced_hide_wp_login', $auth_settings ) ) {
		@@ -3120,20 +2773,8 @@
3120	2773	}
3121	2774	if ( ! array_key_exists( 'advanced_usermeta', $auth_settings ) ) {
3122	2775	$auth_settings['advanced_usermeta'] = '';
3123	2776	}
3124		- if ( ! array_key_exists( 'advanced_users_per_page', $auth_settings ) ) {
3125		- $auth_settings['advanced_users_per_page'] = 20;
3126		- }
3127		- if ( ! array_key_exists( 'advanced_users_sort_by', $auth_settings ) ) {
3128		- $auth_settings['advanced_users_sort_by'] = 'created';
3129		- }
3130		- if ( ! array_key_exists( 'advanced_users_sort_order', $auth_settings ) ) {
3131		- $auth_settings['advanced_users_sort_order'] = 'asc';
3132		- }
3133		- if ( ! array_key_exists( 'advanced_widget_enabled', $auth_settings ) ) {
3134		- $auth_settings['advanced_widget_enabled'] = '1';
3135		- }
3136	2777	if ( ! array_key_exists( 'advanced_override_multisite', $auth_settings ) ) {
3137	2778	$auth_settings['advanced_override_multisite'] = '';
3138	2779	}
3139	2780
		@@ -3144,11 +2785,11 @@
3144	2785	update_option( 'auth_settings_access_users_blocked', $auth_settings_access_users_blocked );
3145	2786
3146	2787	// Multisite defaults.
3147	2788	if ( is_multisite() ) {
3148		- $auth_multisite_settings = get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings', array() );
	2789	+ $auth_multisite_settings = get_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings', array() );
3149	2790
3150		- if ( false === $auth_multisite_settings ) {
	2791	+ if ( $auth_multisite_settings === FALSE ) {
3151	2792	$auth_multisite_settings = array();
3152	2793	}
3153	2794	// Global switch for enabling multisite options.
3154	2795	if ( ! array_key_exists( 'multisite_override', $auth_multisite_settings ) ) {
		@@ -3154,10 +2795,10 @@
3154	2795	if ( ! array_key_exists( 'multisite_override', $auth_multisite_settings ) ) {
3155	2796	$auth_multisite_settings['multisite_override'] = '';
3156	2797	}
3157	2798	// Access Lists Defaults.
3158		- $auth_multisite_settings_access_users_approved = get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved' );
3159		- if ( false === $auth_multisite_settings_access_users_approved ) {
	2799	+ $auth_multisite_settings_access_users_approved = get_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved' );
	2800	+ if ( $auth_multisite_settings_access_users_approved === FALSE ) {
3160	2801	$auth_multisite_settings_access_users_approved = array();
3161	2802	}
3162	2803	// Login Access Defaults.
3163	2804	if ( ! array_key_exists( 'access_who_can_login', $auth_multisite_settings ) ) {
		@@ -3169,9 +2810,9 @@
3169	2810	}
3170	2811	// External Service Defaults.
3171	2812	if ( ! array_key_exists( 'access_default_role', $auth_multisite_settings ) ) {
3172	2813	// Set default role to 'student' if that role exists, 'subscriber' otherwise.
3173		- $all_roles = $wp_roles->roles;
	2814	+ $all_roles = $wp_roles->roles;
3174	2815	$editable_roles = apply_filters( 'editable_roles', $all_roles );
3175	2816	if ( array_key_exists( 'student', $editable_roles ) ) {
3176	2817	$auth_multisite_settings['access_default_role'] = 'student';
3177	2818	} else {
		@@ -3225,11 +2866,8 @@
3225	2866	}
3226	2867	if ( ! array_key_exists( 'cas_auto_login', $auth_multisite_settings ) ) {
3227	2868	$auth_multisite_settings['cas_auto_login'] = '';
3228	2869	}
3229		- if ( ! array_key_exists( 'cas_link_on_username', $auth_multisite_settings ) ) {
3230		- $auth_multisite_settings['cas_link_on_username'] = '';
3231		- }
3232	2870	if ( ! array_key_exists( 'ldap_host', $auth_multisite_settings ) ) {
3233	2871	$auth_multisite_settings['ldap_host'] = '';
3234	2872	}
3235	2873	if ( ! array_key_exists( 'ldap_port', $auth_multisite_settings ) ) {
		@@ -3267,12 +2905,12 @@
3267	2905	}
3268	2906	// Advanced defaults.
3269	2907	if ( ! array_key_exists( 'advanced_lockouts', $auth_multisite_settings ) ) {
3270	2908	$auth_multisite_settings['advanced_lockouts'] = array(
3271		- 'attempts_1' => 10,
3272		- 'duration_1' => 1,
3273		- 'attempts_2' => 10,
3274		- 'duration_2' => 10,
	2909	+ 'attempts_1' => 10,
	2910	+ 'duration_1' => 1,
	2911	+ 'attempts_2' => 10,
	2912	+ 'duration_2' => 10,
3275	2913	'reset_duration' => 120,
3276	2914	);
3277	2915	}
3278	2916	if ( ! array_key_exists( 'advanced_hide_wp_login', $auth_multisite_settings ) ) {
		@@ -3277,23 +2915,11 @@
3277	2915	}
3278	2916	if ( ! array_key_exists( 'advanced_hide_wp_login', $auth_multisite_settings ) ) {
3279	2917	$auth_multisite_settings['advanced_hide_wp_login'] = '';
3280	2918	}
3281		- if ( ! array_key_exists( 'advanced_users_per_page', $auth_multisite_settings ) ) {
3282		- $auth_multisite_settings['advanced_users_per_page'] = 20;
3283		- }
3284		- if ( ! array_key_exists( 'advanced_users_sort_by', $auth_multisite_settings ) ) {
3285		- $auth_multisite_settings['advanced_users_sort_by'] = 'created';
3286		- }
3287		- if ( ! array_key_exists( 'advanced_users_sort_order', $auth_multisite_settings ) ) {
3288		- $auth_multisite_settings['advanced_users_sort_order'] = 'asc';
3289		- }
3290		- if ( ! array_key_exists( 'advanced_widget_enabled', $auth_multisite_settings ) ) {
3291		- $auth_multisite_settings['advanced_widget_enabled'] = '1';
3292		- }
3293	2919	// Save default network options to database.
3294		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings', $auth_multisite_settings );
3295		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
	2920	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings', $auth_multisite_settings );
	2921	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
3296	2922	}
3297	2923
3298	2924	return $auth_settings;
3299	2925	}
		@@ -3300,15 +2926,12 @@
3300	2926
3301	2927
3302	2928	/**
3303	2929	* List sanitizer.
3304		- *
3305		- * @param array $list Array of users to sanitize.
3306		- * @param string $side_effect Set to 'update roles' if role syncing should be performed.
3307		- * @param string $multisite_mode Set to 'multisite' to sync roles on all sites the user belongs to.
3308		- * @return array Array of sanitized users.
	2930	+ * $side_effect = 'none' or 'update roles' to make sure WP user roles match
	2931	+ * $multisite_mode = 'single' or 'multisite' to indicate which user roles to change (this site or all sites)
3309	2932	*/
3310		- private function sanitize_user_list( $list, $side_effect = 'none', $multisite_mode = 'single' ) {
	2933	+ function sanitize_user_list( $list, $side_effect = 'none', $multisite_mode = 'single' ) {
3311	2934	// If it's not a list, make it so.
3312	2935	if ( ! is_array( $list ) ) {
3313	2936	$list = array();
3314	2937	}
		@@ -3313,16 +2936,16 @@
3313	2936	$list = array();
3314	2937	}
3315	2938	foreach ( $list as $key => $user_info ) {
3316	2939	if ( strlen( $user_info['email'] ) < 1 ) {
3317		- // Make sure there are no empty entries in the list.
3318		- unset( $list[ $key ] );
3319		- } elseif ( 'update roles' === $side_effect ) {
	2940	+ // Make sure there are no empty entries in the list
	2941	+ unset( $list[$key] );
	2942	+ } elseif ( $side_effect === 'update roles' ) {
3320	2943	// Make sure the WordPress user accounts have the same role
3321	2944	// as that indicated in the list.
3322	2945	$wp_user = get_user_by( 'email', $user_info['email'] );
3323	2946	if ( $wp_user ) {
3324		- if ( is_multisite() && 'multisite' === $multisite_mode ) {
	2947	+ if ( is_multisite() && $multisite_mode === 'multisite' ) {
3325	2948	foreach ( get_blogs_of_user( $wp_user->ID ) as $blog ) {
3326	2949	add_user_to_blog( $blog->userblog_id, $wp_user->ID, $user_info['role'] );
3327	2950	}
3328	2951	} else {
		@@ -3335,21 +2958,18 @@
3335	2958	}
3336	2959
3337	2960
3338	2961	/**
3339		- * Settings sanitizer callback.
3340		- *
3341		- * @param array $auth_settings Authorizer settings array.
3342		- * @return array Sanitized Authorizer settings array.
	2962	+ * Settings sanitizer callback
3343	2963	*/
3344		- public function sanitize_options( $auth_settings ) {
	2964	+ function sanitize_options( $auth_settings ) {
3345	2965	// Default to "Approved Users" login access restriction.
3346		- if ( ! in_array( $auth_settings['access_who_can_login'], array( 'external_users', 'approved_users' ), true ) ) {
	2966	+ if ( ! in_array( $auth_settings['access_who_can_login'], array( 'external_users', 'approved_users' ) ) ) {
3347	2967	$auth_settings['access_who_can_login'] = 'approved_users';
3348	2968	}
3349	2969
3350	2970	// Default to "Everyone" view access restriction.
3351		- if ( ! in_array( $auth_settings['access_who_can_view'], array( 'everyone', 'logged_in_users' ), true ) ) {
	2971	+ if ( ! in_array( $auth_settings['access_who_can_view'], array( 'everyone', 'logged_in_users' ) ) ) {
3352	2972	$auth_settings['access_who_can_view'] = 'everyone';
3353	2973	}
3354	2974
3355	2975	// Default to WordPress login access redirect.
		@@ -3354,9 +2974,9 @@
3354	2974
3355	2975	// Default to WordPress login access redirect.
3356	2976	// Note: this option doesn't exist in multisite options, so we first
3357	2977	// check to see if it exists.
3358		- if ( array_key_exists( 'access_redirect', $auth_settings ) && ! in_array( $auth_settings['access_redirect'], array( 'login', 'page', 'message' ), true ) ) {
	2978	+ if ( array_key_exists( 'access_redirect', $auth_settings ) && ! in_array( $auth_settings['access_redirect'], array( 'login', 'page', 'message' ) ) ) {
3359	2979	$auth_settings['access_redirect'] = 'login';
3360	2980	}
3361	2981
3362	2982	// Default to warning message for anonymous users on public pages.
		@@ -3361,64 +2981,61 @@
3361	2981
3362	2982	// Default to warning message for anonymous users on public pages.
3363	2983	// Note: this option doesn't exist in multisite options, so we first
3364	2984	// check to see if it exists.
3365		- if ( array_key_exists( 'access_public_warning', $auth_settings ) && ! in_array( $auth_settings['access_public_warning'], array( 'no_warning', 'warning' ), true ) ) {
	2985	+ if ( array_key_exists( 'access_public_warning', $auth_settings ) && ! in_array( $auth_settings['access_public_warning'], array( 'no_warning', 'warning' ) ) ) {
3366	2986	$auth_settings['access_public_warning'] = 'no_warning';
3367	2987	}
3368	2988
3369		- // Sanitize Send welcome email (checkbox: value can only be '1' or empty string).
	2989	+ // Sanitize Send welcome email (checkbox: value can only be '1' or empty string)
3370	2990	$auth_settings['access_should_email_approved_users'] = array_key_exists( 'access_should_email_approved_users', $auth_settings ) && strlen( $auth_settings['access_should_email_approved_users'] ) > 0 ? '1' : '';
3371	2991
3372		- // Sanitize Enable Google Logins (checkbox: value can only be '1' or empty string).
	2992	+ // Sanitize Enable Google Logins (checkbox: value can only be '1' or empty string)
3373	2993	$auth_settings['google'] = array_key_exists( 'google', $auth_settings ) && strlen( $auth_settings['google'] ) > 0 ? '1' : '';
3374	2994
3375		- // Sanitize Enable CAS Logins (checkbox: value can only be '1' or empty string).
	2995	+ // Sanitize Enable CAS Logins (checkbox: value can only be '1' or empty string)
3376	2996	$auth_settings['cas'] = array_key_exists( 'cas', $auth_settings ) && strlen( $auth_settings['cas'] ) > 0 ? '1' : '';
3377	2997
3378		- // Sanitize CAS Host setting.
	2998	+ // Sanitize CAS Host setting
3379	2999	$auth_settings['cas_host'] = filter_var( $auth_settings['cas_host'], FILTER_SANITIZE_URL );
3380	3000
3381		- // Sanitize CAS Port (int).
	3001	+ // Sanitize CAS Port (int)
3382	3002	$auth_settings['cas_port'] = filter_var( $auth_settings['cas_port'], FILTER_SANITIZE_NUMBER_INT );
3383	3003
3384		- // Sanitize CAS attribute update (checkbox: value can only be '1' or empty string).
	3004	+ // Sanitize CAS attribute update (checkbox: value can only be '1' or empty string)
3385	3005	$auth_settings['cas_attr_update_on_login'] = array_key_exists( 'cas_attr_update_on_login', $auth_settings ) && strlen( $auth_settings['cas_attr_update_on_login'] ) > 0 ? '1' : '';
3386	3006
3387		- // Sanitize CAS auto-login (checkbox: value can only be '1' or empty string).
	3007	+ // Sanitize CAS auto-login (checkbox: value can only be '1' or empty string)
3388	3008	$auth_settings['cas_auto_login'] = array_key_exists( 'cas_auto_login', $auth_settings ) && strlen( $auth_settings['cas_auto_login'] ) > 0 ? '1' : '';
3389	3009
3390		- // Sanitize CAS link on username (checkbox: value can only be '1' or empty string).
3391		- $auth_settings['cas_link_on_username'] = array_key_exists( 'cas_link_on_username', $auth_settings ) && strlen( $auth_settings['cas_link_on_username'] ) > 0 ? '1' : '';
3392		-
3393		- // Sanitize Enable LDAP Logins (checkbox: value can only be '1' or empty string).
	3010	+ // Sanitize Enable LDAP Logins (checkbox: value can only be '1' or empty string)
3394	3011	$auth_settings['ldap'] = array_key_exists( 'ldap', $auth_settings ) && strlen( $auth_settings['ldap'] ) > 0 ? '1' : '';
3395	3012
3396		- // Sanitize LDAP Host setting.
	3013	+ // Sanitize LDAP Host setting
3397	3014	$auth_settings['ldap_host'] = filter_var( $auth_settings['ldap_host'], FILTER_SANITIZE_URL );
3398	3015
3399		- // Sanitize LDAP Port (int).
	3016	+ // Sanitize LDAP Port (int)
3400	3017	$auth_settings['ldap_port'] = filter_var( $auth_settings['ldap_port'], FILTER_SANITIZE_NUMBER_INT );
3401	3018
3402		- // Sanitize LDAP TLS (checkbox: value can only be '1' or empty string).
	3019	+ // Sanitize LDAP TLS (checkbox: value can only be '1' or empty string)
3403	3020	$auth_settings['ldap_tls'] = array_key_exists( 'ldap_tls', $auth_settings ) && strlen( $auth_settings['ldap_tls'] ) > 0 ? '1' : '';
3404	3021
3405		- // Sanitize LDAP attributes (basically make sure they don't have any parentheses).
	3022	+ // Sanitize LDAP attributes (basically make sure they don't have any parentheses)
3406	3023	$auth_settings['ldap_uid'] = filter_var( $auth_settings['ldap_uid'], FILTER_SANITIZE_EMAIL );
3407	3024
3408		- // Sanitize LDAP Lost Password URL.
	3025	+ // Sanitize LDAP Lost Password URL
3409	3026	$auth_settings['ldap_lostpassword_url'] = filter_var( $auth_settings['ldap_lostpassword_url'], FILTER_SANITIZE_URL );
3410	3027
3411		- // Obfuscate LDAP directory user password.
	3028	+ // Obfuscate LDAP directory user password
3412	3029	if ( strlen( $auth_settings['ldap_password'] ) > 0 ) {
3413	3030	// encrypt the directory user password for some minor obfuscation in the database.
3414		- $auth_settings['ldap_password'] = $this->encrypt( $auth_settings['ldap_password'] );
	3031	+ $auth_settings['ldap_password'] = base64_encode( $this->encrypt( $auth_settings['ldap_password'] ) );
3415	3032	}
3416	3033
3417		- // Sanitize LDAP attribute update (checkbox: value can only be '1' or empty string).
	3034	+ // Sanitize LDAP attribute update (checkbox: value can only be '1' or empty string)
3418	3035	$auth_settings['ldap_attr_update_on_login'] = array_key_exists( 'ldap_attr_update_on_login', $auth_settings ) && strlen( $auth_settings['ldap_attr_update_on_login'] ) > 0 ? '1' : '';
3419	3036
3420		- // Make sure public pages is an empty array if it's empty.
	3037	+ // Make sure public pages is an empty array if it's empty
3421	3038	// Note: this option doesn't exist in multisite options, so we first
3422	3039	// check to see if it exists.
3423	3040	if ( array_key_exists( 'access_public_pages', $auth_settings ) && ! is_array( $auth_settings['access_public_pages'] ) ) {
3424	3041	$auth_settings['access_public_pages'] = array();
		@@ -3426,31 +3043,15 @@
3426	3043
3427	3044	// Make sure all lockout options are integers (attempts_1,
3428	3045	// duration_1, attempts_2, duration_2, reset_duration).
3429	3046	foreach ( $auth_settings['advanced_lockouts'] as $key => $value ) {
3430		- $auth_settings['advanced_lockouts'][ $key ] = filter_var( $value, FILTER_SANITIZE_NUMBER_INT );
	3047	+ $auth_settings['advanced_lockouts'][$key] = filter_var( $value, FILTER_SANITIZE_NUMBER_INT );
3431	3048	}
3432	3049
3433		- // Sanitize Hide WordPress logins (checkbox: value can only be '1' or empty string).
	3050	+ // Sanitize Hide WordPress logins (checkbox: value can only be '1' or empty string)
3434	3051	$auth_settings['advanced_hide_wp_login'] = array_key_exists( 'advanced_hide_wp_login', $auth_settings ) && strlen( $auth_settings['advanced_hide_wp_login'] ) > 0 ? '1' : '';
3435	3052
3436		- // Sanitize Users per page (text: value can only int from 1 to MAX_INT).
3437		- $auth_settings['advanced_users_per_page'] = array_key_exists( 'advanced_users_per_page', $auth_settings ) && intval( $auth_settings['advanced_users_per_page'] ) > 0 ? intval( $auth_settings['advanced_users_per_page'] ) : 1;
3438		-
3439		- // Sanitize Sort users by (select: value can be 'email', 'role', 'date_added', 'created').
3440		- if ( ! isset( $auth_settings['advanced_users_sort_by'] ) || ! in_array( $auth_settings['advanced_users_sort_by'], array( 'email', 'role', 'date_added', 'created' ), true ) ) {
3441		- $auth_settings['advanced_users_sort_by'] = 'created';
3442		- }
3443		-
3444		- // Sanitize Sort users order (select: value can be 'asc', 'desc').
3445		- if ( ! isset( $auth_settings['advanced_users_sort_order'] ) || ! in_array( $auth_settings['advanced_users_sort_order'], array( 'asc', 'desc' ), true ) ) {
3446		- $auth_settings['advanced_users_sort_order'] = 'asc';
3447		- }
3448		-
3449		- // Sanitize Show Dashboard Widget (checkbox: value can only be '1' or empty string).
3450		- $auth_settings['advanced_widget_enabled'] = array_key_exists( 'advanced_widget_enabled', $auth_settings ) && strlen( $auth_settings['advanced_widget_enabled'] ) > 0 ? '1' : '';
3451		-
3452		- // Sanitize Override multisite options (checkbox: value can only be '1' or empty string).
	3053	+ // Sanitize Override multisite options (checkbox: value can only be '1' or empty string)
3453	3054	$auth_settings['advanced_override_multisite'] = array_key_exists( 'advanced_override_multisite', $auth_settings ) && strlen( $auth_settings['advanced_override_multisite'] ) > 0 ? '1' : '';
3454	3055
3455	3056	return $auth_settings;
3456	3057	}
		@@ -3457,201 +3058,90 @@
3457	3058
3458	3059
3459	3060	/**
3460	3061	* Keep authorizer approved users' roles in sync with WordPress roles
3461		- * if someone changes the role via the WordPress Edit User page
3462		- * (wp-admin/user-edit.php or wp-admin/profile.php).
	3062	+ * if someone changes the role via the WordPress Edit User options page.
3463	3063	*
3464		- * Action: user_profile_update_errors
3465		- *
3466		- * @param WP_Error $errors Errors object to add any custom errors to (passed by reference).
3467		- * @param bool $update True if updating existing user, false if saving a new one.
3468		- * @param stdClass $user Updated WP_User object for user being edited (passed by reference).
	3064	+ * @action edit_user_profile_update
	3065	+ * @ref https://codex.wordpress.org/Plugin_API/Action_Reference/edit_user_profile_update
	3066	+ * @param int $user_id The user ID of the user being edited
	3067	+
	3068	+ * @action personal_options_update
	3069	+ * @ref https://codex.wordpress.org/Plugin_API/Action_Reference/personal_options_update
	3070	+ * @param int $user_id The user ID of the user being edited
3469	3071	*/
3470		- public function edit_user_profile_update_role( &$errors, $update, &$user ) {
3471		- // Do nothing if we're not updating role.
3472		- if ( ! property_exists( $user, 'role' ) ) {
	3072	+ function edit_user_profile_update_role( $user_id ) {
	3073	+ if ( ! current_user_can( 'edit_user', $user_id ) ) {
3473	3074	return;
3474	3075	}
3475	3076
3476		- // Safety check; will likely not fire if we reach this function.
3477		- if ( ! current_user_can( 'edit_user', $user->ID ) ) {
3478		- return;
3479		- }
3480		-
3481		- // Don't perform Authorizer updates if we have a WordPress error.
3482		- $errors_on_user_update = $errors->get_error_codes();
3483		- if ( ! empty( $errors_on_user_update ) ) {
3484		- return;
3485		- }
3486		-
3487		- // Get original user object (fail if not a real WordPress user).
3488		- $userdata = get_userdata( $user->ID );
3489		- if ( ! $userdata ) {
3490		- return;
3491		- }
3492		-
3493	3077	// If user is in approved list, update his/her associated role.
3494		- if ( $this->is_email_in_list( $userdata->user_email, 'approved' ) ) {
3495		- $auth_settings_access_users_approved = $this->sanitize_user_list( $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT ) );
3496		- foreach ( $auth_settings_access_users_approved as $key => $check_user ) {
3497		- if ( 0 === strcasecmp( $check_user['email'], $userdata->user_email ) ) {
3498		- $auth_settings_access_users_approved[ $key ]['role'] = $user->role;
3499		- }
3500		- }
3501		- update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved );
3502		- }
3503		- }
3504		-
3505		-
3506		- /**
3507		- * Sync any email address changes to WordPress accounts to the corresponding
3508		- * entry in the Authorizer approved list.
3509		- *
3510		- * Note: This filter fires in wp_update_user() if the update includes an
3511		- * email address change, and fires after all security and integrity checks
3512		- * have been performed, so we can simply update the Authorizer approved
3513		- * list, changing the email address on the approved entry, and removing any
3514		- * existing entries that also have the new email address (duplicates).
3515		- *
3516		- * Filter: send_email_change_email
3517		- *
3518		- * @param bool $send Whether to send the email.
3519		- * @param array $user The original user array.
3520		- * @param array $userdata The updated user array.
3521		- */
3522		- public function edit_user_profile_update_email( $send, $user, $userdata ) {
3523		- // If we're in multisite, update the email on all sites in the network
3524		- // (and remove from any subsites if it's a network-approved user).
3525		- if ( is_multisite() ) {
3526		- // If it's a multisite approved user, sync the email there.
3527		- $changed_user_is_multisite_user = false;
3528		- if ( $this->is_email_in_list( $user['user_email'], 'approved', 'multisite' ) ) {
3529		- $changed_user_is_multisite_user = true;
3530		- $auth_multisite_settings_access_users_approved = $this->sanitize_user_list(
3531		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT )
3532		- );
3533		- foreach ( $auth_multisite_settings_access_users_approved as $key => $check_user ) {
3534		- // Update old user email in approved list to the new email.
3535		- if ( 0 === strcasecmp( $check_user['email'], $user['user_email'] ) ) {
3536		- $auth_multisite_settings_access_users_approved[ $key ]['email'] = $this->lowercase( $userdata['user_email'] );
	3078	+ $wp_user = get_user_by( 'id', $user_id );
	3079	+ if ( $this->is_email_in_list( $wp_user->get( 'user_email' ), 'approved' ) ) {
	3080	+ $auth_settings_access_users_approved = $this->sanitize_user_list( $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN ) );
	3081	+ // Find approved user and sync with the corresponding WP_User.
	3082	+ foreach ( $auth_settings_access_users_approved as $key => $user ) {
	3083	+ if ( $user['email'] === $wp_user->user_email ) {
	3084	+ // Sync user role.
	3085	+ if ( array_key_exists( 'role', $_REQUEST ) ) {
	3086	+ $auth_settings_access_users_approved[$key]['role'] = $_REQUEST['role'];
3537	3087	}
3538		- // If new user email is already in approved list, remove that entry.
3539		- if ( 0 === strcasecmp( $check_user['email'], $userdata['user_email'] ) ) {
3540		- unset( $auth_multisite_settings_access_users_approved[ $key ] );
	3088	+ // Sync email address.
	3089	+ if ( array_key_exists( 'email', $_REQUEST ) ) {
	3090	+ $auth_settings_access_users_approved[$key]['email'] = $_REQUEST['email'];
3541	3091	}
3542	3092	}
3543		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
3544	3093	}
3545	3094
3546		- // Go through all approved lists on individual sites and sync this user there.
3547		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
3548		- $sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
3549		- foreach ( $sites as $site ) {
3550		- $updated = false;
3551		- $blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
3552		- $auth_settings_access_users_approved = get_blog_option( $blog_id, 'auth_settings_access_users_approved', array() );
3553		- foreach ( $auth_settings_access_users_approved as $key => $check_user ) {
3554		- // Update old user email in approved list to the new email.
3555		- if ( 0 === strcasecmp( $check_user['email'], $user['user_email'] ) ) {
3556		- // But if the user is already a multisite user, just remove the entry in the subsite.
3557		- if ( $changed_user_is_multisite_user ) {
3558		- unset( $auth_settings_access_users_approved[ $key ] );
3559		- } else {
3560		- $auth_settings_access_users_approved[ $key ]['email'] = $this->lowercase( $userdata['user_email'] );
3561		- }
3562		- $updated = true;
3563		- }
3564		- // If new user email is already in approved list, remove that entry.
3565		- if ( 0 === strcasecmp( $check_user['email'], $userdata['user_email'] ) ) {
3566		- unset( $auth_settings_access_users_approved[ $key ] );
3567		- $updated = true;
3568		- }
3569		- }
3570		- if ( $updated ) {
3571		- update_blog_option( $blog_id, 'auth_settings_access_users_approved', $auth_settings_access_users_approved );
3572		- }
3573		- }
3574		- } else {
3575		- // In a single site environment, just find the old user in the approved list and update the email.
3576		- if ( $this->is_email_in_list( $user['user_email'], 'approved' ) ) {
3577		- $auth_settings_access_users_approved = $this->sanitize_user_list( $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT ) );
3578		- foreach ( $auth_settings_access_users_approved as $key => $check_user ) {
3579		- // Update old user email in approved list to the new email.
3580		- if ( 0 === strcasecmp( $check_user['email'], $user['user_email'] ) ) {
3581		- $auth_settings_access_users_approved[ $key ]['email'] = $this->lowercase( $userdata['user_email'] );
3582		- }
3583		- // If new user email is already in approved list, remove that entry.
3584		- if ( 0 === strcasecmp( $check_user['email'], $userdata['user_email'] ) ) {
3585		- unset( $auth_settings_access_users_approved[ $key ] );
3586		- }
3587		- }
3588		- update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved );
3589		- }
	3095	+ update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved );
3590	3096	}
3591		-
3592		- // We're hooking into this filter merely for its location in the codebase,
3593		- // so make sure to return the filter value unmodified.
3594		- return $send;
3595	3097	}
3596	3098
3597	3099
3598	3100	/**
3599		- * Settings print callback.
3600		- *
3601		- * @param string $args Args (e.g., multisite admin mode).
3602		- * @return void
	3101	+ * Settings print callbacks
3603	3102	*/
3604		- public function print_section_info_tabs( $args = '' ) {
3605		- if ( WP_Plugin_Authorizer::NETWORK_CONTEXT === $this->get_admin_mode( $args ) ) :
3606		- ?>
	3103	+ function print_section_info_tabs( $args = '' ) {
	3104	+ if ( MULTISITE_ADMIN === $this->get_admin_mode( $args )): ?>
3607	3105	<h2 class="nav-tab-wrapper">
3608		- <a class="nav-tab nav-tab-access_lists nav-tab-active" href="javascript:chooseTab('access_lists' );"><?php esc_html_e( 'Access Lists', 'authorizer' ); ?></a>
3609		- <a class="nav-tab nav-tab-external" href="javascript:chooseTab('external' );"><?php esc_html_e( 'External Service', 'authorizer' ); ?></a>
3610		- <a class="nav-tab nav-tab-advanced" href="javascript:chooseTab('advanced' );"><?php esc_html_e( 'Advanced', 'authorizer' ); ?></a>
	3106	+ <a class="nav-tab nav-tab-access_lists nav-tab-active" href="javascript:choose_tab('access_lists' );"><?php _e( 'Access Lists', 'authorizer' ); ?></a>
	3107	+ <a class="nav-tab nav-tab-external" href="javascript:choose_tab('external' );"><?php _e( 'External Service', 'authorizer' ); ?></a>
	3108	+ <a class="nav-tab nav-tab-advanced" href="javascript:choose_tab('advanced' );"><?php _e( 'Advanced', 'authorizer' ); ?></a>
3611	3109	</h2>
3612		- <?php else : ?>
	3110	+ <?php else: ?>
3613	3111	<h2 class="nav-tab-wrapper">
3614		- <a class="nav-tab nav-tab-access_lists nav-tab-active" href="javascript:chooseTab('access_lists' );"><?php esc_html_e( 'Access Lists', 'authorizer' ); ?></a>
3615		- <a class="nav-tab nav-tab-access_login" href="javascript:chooseTab('access_login' );"><?php esc_html_e( 'Login Access', 'authorizer' ); ?></a>
3616		- <a class="nav-tab nav-tab-access_public" href="javascript:chooseTab('access_public' );"><?php esc_html_e( 'Public Access', 'authorizer' ); ?></a>
3617		- <a class="nav-tab nav-tab-external" href="javascript:chooseTab('external' );"><?php esc_html_e( 'External Service', 'authorizer' ); ?></a>
3618		- <a class="nav-tab nav-tab-advanced" href="javascript:chooseTab('advanced' );"><?php esc_html_e( 'Advanced', 'authorizer' ); ?></a>
	3112	+ <a class="nav-tab nav-tab-access_lists nav-tab-active" href="javascript:choose_tab('access_lists' );"><?php _e( 'Access Lists', 'authorizer' ); ?></a>
	3113	+ <a class="nav-tab nav-tab-access_login" href="javascript:choose_tab('access_login' );"><?php _e( 'Login Access', 'authorizer' ); ?></a>
	3114	+ <a class="nav-tab nav-tab-access_public" href="javascript:choose_tab('access_public' );"><?php _e( 'Public Access', 'authorizer' ); ?></a>
	3115	+ <a class="nav-tab nav-tab-external" href="javascript:choose_tab('external' );"><?php _e( 'External Service', 'authorizer' ); ?></a>
	3116	+ <a class="nav-tab nav-tab-advanced" href="javascript:choose_tab('advanced' );"><?php _e( 'Advanced', 'authorizer' ); ?></a>
3619	3117	</h2>
3620		- <?php
3621		- endif;
	3118	+ <?php endif;
3622	3119	}
3623	3120
3624	3121
3625		- /**
3626		- * Settings print callback.
3627		- *
3628		- * @param string $args Args (e.g., multisite admin mode).
3629		- * @return void
3630		- */
3631		- public function print_section_info_access_lists( $args = '' ) {
	3122	+ function print_section_info_access_lists( $args = '' ) {
3632	3123	$admin_mode = $this->get_admin_mode( $args );
3633		- ?>
3634		- <div id="section_info_access_lists" class="section_info">
3635		- <p><?php esc_html_e( 'Manage who has access to this site using these lists.', 'authorizer' ); ?></p>
	3124	+ ?><div id="section_info_access_lists" class="section_info">
	3125	+ <p><?php _e( 'Manage who has access to this site using these lists.', 'authorizer' ); ?></p>
3636	3126	<ol>
3637		- <li><?php echo wp_kses( __( "<strong>Pending</strong> users are users who have successfully logged in to the site, but who haven't yet been approved (or blocked) by you.", 'authorizer' ), $this->allowed_html ); ?></li>
3638		- <li><?php echo wp_kses( __( '<strong>Approved</strong> users have access to the site once they successfully log in.', 'authorizer' ), $this->allowed_html ); ?></li>
3639		- <li><?php echo wp_kses( __( '<strong>Blocked</strong> users will receive an error message when they try to visit the site after authenticating.', 'authorizer' ), $this->allowed_html ); ?><br><?php esc_html_e( 'Note: if you want to block all email addresses from a domain, say anyone@example.com, simply add "@example.com" to the blocked list.', 'authorizer' ); ?></li>
	3127	+ <li><?php _e( "<strong>Pending</strong> users are users who have successfully logged in to the site, but who haven't yet been approved (or blocked) by you.", 'authorizer' ); ?></li>
	3128	+ <li><?php _e( '<strong>Approved</strong> users have access to the site once they successfully log in.', 'authorizer' ); ?></li>
	3129	+ <li><?php _e( '<strong>Blocked</strong> users will receive an error message when they try to visit the site after authenticating.', 'authorizer' ); ?></li>
3640	3130	</ol>
3641	3131	</div>
3642	3132	<table class="form-table">
3643	3133	<tbody>
3644	3134	<tr>
3645		- <th scope="row"><?php esc_html_e( 'Pending Users', 'authorizer' ); ?> <em>(<?php echo esc_html( $this->get_user_count_from_list( 'pending', $admin_mode ) ); ?>)</em></th>
	3135	+ <th scope="row"><?php _e( 'Pending Users', 'authorizer' ); ?> <em>(<?php echo $this->get_user_count_from_list( 'pending', $admin_mode ); ?>)</em></th>
3646	3136	<td><?php $this->print_combo_auth_access_users_pending(); ?></td>
3647	3137	</tr>
3648	3138	<tr>
3649		- <th scope="row"><?php esc_html_e( 'Approved Users', 'authorizer' ); ?> <em>(<?php echo esc_html( $this->get_user_count_from_list( 'approved', $admin_mode ) ); ?>)</em></th>
	3139	+ <th scope="row"><?php _e( 'Approved Users', 'authorizer' ); ?> <em>(<?php echo $this->get_user_count_from_list( 'approved', $admin_mode ); ?>)</em></th>
3650	3140	<td><?php $this->print_combo_auth_access_users_approved(); ?></td>
3651	3141	</tr>
3652	3142	<tr>
3653		- <th scope="row"><?php esc_html_e( 'Blocked Users', 'authorizer' ); ?> <em>(<?php echo esc_html( $this->get_user_count_from_list( 'blocked', $admin_mode ) ); ?>)</em></th>
	3143	+ <th scope="row"><?php _e( 'Blocked Users', 'authorizer' ); ?> <em>(<?php echo $this->get_user_count_from_list( 'blocked', $admin_mode ); ?>)</em></th>
3654	3144	<td><?php $this->print_combo_auth_access_users_blocked(); ?></td>
3655	3145	</tr>
3656	3146	</tbody>
3657	3147	</table>
		@@ -3658,516 +3148,276 @@
3658	3148	<?php
3659	3149	}
3660	3150
3661	3151
3662		- /**
3663		- * Settings print callback.
3664		- *
3665		- * @param string $args Args (e.g., multisite admin mode).
3666		- * @return void
3667		- */
3668		- public function print_combo_auth_access_users_pending( $args = '' ) {
	3152	+ function print_combo_auth_access_users_pending( $args = '' ) {
3669	3153	// Get plugin option.
3670		- $option = 'access_users_pending';
	3154	+ $option = 'access_users_pending';
3671	3155	$auth_settings_option = $this->get_plugin_option( $option );
3672	3156	$auth_settings_option = is_array( $auth_settings_option ) ? $auth_settings_option : array();
3673	3157
3674		- // Render wrapper div (for aligning pager to width of content).
3675		- ?>
3676		- <div class="wrapper_<?php echo esc_attr( $option ); ?>">
3677		- <ul id="list_auth_settings_access_users_pending" style="margin:0;">
3678		- <?php
3679		- if ( count( $auth_settings_option ) > 0 ) :
3680		- foreach ( $auth_settings_option as $key => $pending_user ) :
3681		- if ( empty( $pending_user ) || count( $pending_user ) < 1 ) :
3682		- continue;
3683		- endif;
3684		- $pending_user['is_wp_user'] = false;
3685		- ?>
3686		- <li>
3687		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>_<?php echo esc_attr( $key ); ?>" value="<?php echo esc_attr( $pending_user['email'] ); ?>" readonly="true" class="auth-email" />
3688		- <select id="auth_settings_<?php echo esc_attr( $option ); ?>_<?php echo esc_attr( $key ); ?>_role" class="auth-role">
3689		- <?php $this->wp_dropdown_permitted_roles( $pending_user['role'] ); ?>
3690		- </select>
3691		- <a href="javascript:void(0);" class="button-primary" id="approve_user_<?php echo esc_attr( $key ); ?>" onclick="authAddUser( this, 'approved', false ); authIgnoreUser( this, 'pending' );"><span class="glyphicon glyphicon-ok"></span> <?php esc_html_e( 'Approve', 'authorizer' ); ?></a>
3692		- <a href="javascript:void(0);" class="button-primary" id="block_user_<?php echo esc_attr( $key ); ?>" onclick="authAddUser( this, 'blocked', false ); authIgnoreUser( this, 'pending' );"><span class="glyphicon glyphicon-ban-circle"></span> <?php esc_html_e( 'Block', 'authorizer' ); ?></a>
3693		- <a href="javascript:void(0);" class="button button-secondary" id="ignore_user_<?php echo esc_attr( $key ); ?>" onclick="authIgnoreUser( this, 'pending' );" title="<?php esc_html_e( 'Remove user', 'authorizer' ); ?>"><span class="glyphicon glyphicon-remove"></span> <?php esc_html_e( 'Ignore', 'authorizer' ); ?></a>
3694		- </li>
3695		- <?php endforeach; ?>
3696		- <?php else : ?>
3697		- <li class="auth-empty"><em><?php esc_html_e( 'No pending users', 'authorizer' ); ?></em></li>
3698		- <?php endif; ?>
3699		- </ul>
3700		- </div>
	3158	+ // Print option elements.
	3159	+ ?><ul id="list_auth_settings_access_users_pending" style="margin:0;">
	3160	+ <?php if ( count( $auth_settings_option ) > 0 ) : ?>
	3161	+ <?php foreach ( $auth_settings_option as $key => $pending_user ): ?>
	3162	+ <?php if ( empty( $pending_user ) || count( $pending_user ) < 1 ) continue; ?>
	3163	+ <?php $pending_user['is_wp_user'] = false; ?>
	3164	+ <li>
	3165	+ <input type="text" id="auth_settings_<?php echo $option; ?>_<?php echo $key; ?>" value="<?php echo $pending_user['email']; ?>" readonly="true" class="auth-email" />
	3166	+ <select id="auth_settings_<?php echo $option; ?>_<?php echo $key; ?>_role" class="auth-role">
	3167	+ <?php $this->wp_dropdown_permitted_roles( $pending_user['role'] ); ?>
	3168	+ </select>
	3169	+ <a href="javascript:void(0);" class="button-primary" id="approve_user_<?php echo $key; ?>" onclick="auth_add_user( this, 'approved', false ); auth_ignore_user( this, 'pending' );"><span class="glyphicon glyphicon-ok"></span> <?php _e( 'Approve', 'authorizer' ); ?></a>
	3170	+ <a href="javascript:void(0);" class="button-primary" id="block_user_<?php echo $key; ?>" onclick="auth_add_user( this, 'blocked', false ); auth_ignore_user( this, 'pending' );"><span class="glyphicon glyphicon-ban-circle"></span> <?php _e( 'Block', 'authorizer' ); ?></a>
	3171	+ <a href="javascript:void(0);" class="button button-secondary" id="ignore_user_<?php echo $key; ?>" onclick="auth_ignore_user( this, 'pending' );" title="<?php _e( 'Remove user', 'authorizer' ); ?>"><span class="glyphicon glyphicon-remove"></span> <?php _e( 'Ignore', 'authorizer' ); ?></a>
	3172	+ </li>
	3173	+ <?php endforeach; ?>
	3174	+ <?php else: ?>
	3175	+ <li class="auth-empty"><em><?php _e( 'No pending users', 'authorizer' ); ?></em></li>
	3176	+ <?php endif; ?>
	3177	+ </ul>
3701	3178	<?php
3702	3179	}
3703	3180
3704	3181
3705		- /**
3706		- * Settings print callback.
3707		- *
3708		- * @param string $args Args (e.g., multisite admin mode).
3709		- * @return void
3710		- */
3711		- public function print_combo_auth_access_users_approved( $args = '' ) {
	3182	+ function print_combo_auth_access_users_approved( $args = '' ) {
3712	3183	// Get plugin option.
3713		- $option = 'access_users_approved';
3714		- $admin_mode = $this->get_admin_mode( $args );
	3184	+ $option = 'access_users_approved';
	3185	+ $admin_mode = $this->get_admin_mode( $args );
3715	3186	$auth_settings_option = $this->get_plugin_option( $option, $admin_mode, 'no override' );
3716	3187	$auth_settings_option = is_array( $auth_settings_option ) ? $auth_settings_option : array();
3717	3188
3718		- // Get multisite approved users (will be added to top of list, greyed out).
3719		- $auth_override_multisite = $this->get_plugin_option( 'advanced_override_multisite' );
3720		- $auth_multisite_settings = $this->get_plugin_options( WP_Plugin_Authorizer::NETWORK_CONTEXT );
	3189	+ // Get multisite approved users (add them to top of list, greyed out).
	3190	+ $auth_override_multisite = $this->get_plugin_option( 'advanced_override_multisite' );
	3191	+ $auth_multisite_settings = $this->get_plugin_options( MULTISITE_ADMIN );
3721	3192	$auth_settings_option_multisite = array();
3722	3193	if (
3723	3194	is_multisite() &&
3724		- ! is_network_admin() &&
3725		- 1 !== intval( $auth_override_multisite ) &&
	3195	+ $auth_override_multisite != '1' &&
3726	3196	array_key_exists( 'multisite_override', $auth_multisite_settings ) &&
3727		- '1' === $auth_multisite_settings['multisite_override']
	3197	+ $auth_multisite_settings['multisite_override'] === '1'
3728	3198	) {
3729		- $auth_settings_option_multisite = $this->get_plugin_option( $option, WP_Plugin_Authorizer::NETWORK_CONTEXT, 'allow override' );
	3199	+ $auth_settings_option_multisite = $this->get_plugin_option( $option, MULTISITE_ADMIN, 'allow override' );
3730	3200	$auth_settings_option_multisite = is_array( $auth_settings_option_multisite ) ? $auth_settings_option_multisite : array();
3731		- // Add multisite users to the beginning of the main user array.
3732		- foreach ( array_reverse( $auth_settings_option_multisite ) as $approved_user ) {
3733		- $approved_user['multisite_user'] = true;
3734		- array_unshift( $auth_settings_option, $approved_user );
3735		- }
3736	3201	}
3737	3202
3738	3203	// Get default role for new user dropdown.
3739		- $access_default_role = $this->get_plugin_option( 'access_default_role', WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
	3204	+ $access_default_role = $this->get_plugin_option( 'access_default_role', SINGLE_ADMIN, 'allow override' );
3740	3205
3741	3206	// Get custom usermeta field to show.
3742	3207	$advanced_usermeta = $this->get_plugin_option( 'advanced_usermeta' );
3743	3208
3744	3209	// Adjust javascript function prefixes if multisite.
3745		- $js_function_prefix = WP_Plugin_Authorizer::NETWORK_CONTEXT === $admin_mode ? 'authMultisite' : 'auth';
3746		- $is_multisite_admin_page = WP_Plugin_Authorizer::NETWORK_CONTEXT === $admin_mode;
	3210	+ $js_function_prefix = $admin_mode === MULTISITE_ADMIN ? 'auth_multisite_' : 'auth_';
	3211	+ $multisite_admin_page = $admin_mode === MULTISITE_ADMIN;
3747	3212
3748		- // Filter user list to search terms.
3749		- // phpcs:ignore WordPress.CSRF.NonceVerification.NoNonceVerification
3750		- if ( isset( $_REQUEST['search'] ) && strlen( sanitize_text_field( wp_unslash( $_REQUEST['search'] ) ) ) > 0 ) {
3751		- // phpcs:ignore WordPress.CSRF.NonceVerification.NoNonceVerification
3752		- $search_term = sanitize_text_field( wp_unslash( $_REQUEST['search'] ) );
3753		- $auth_settings_option = array_filter(
3754		- $auth_settings_option, function ( $user ) use ( $search_term ) {
3755		- return stripos( $user['email'], $search_term ) !== false ||
3756		- stripos( $user['role'], $search_term ) !== false ||
3757		- stripos( $user['date_added'], $search_term ) !== false;
3758		- }
3759		- );
3760		- }
3761		-
3762		- // Sort user list.
3763		- $sort_by = $this->get_plugin_option( 'advanced_users_sort_by', WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' ); // email, role, date_added (registered), created (date approved).
3764		- $sort_order = $this->get_plugin_option( 'advanced_users_sort_order', WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' ); // asc or desc.
3765		- $sort_dimension = array();
3766		- if ( in_array( $sort_by, array( 'email', 'role', 'date_added' ), true ) ) {
3767		- foreach ( $auth_settings_option as $key => $user ) {
3768		- if ( 'date_added' === $sort_by ) {
3769		- $sort_dimension[ $key ] = date( 'Ymd', strtotime( $user[ $sort_by ] ) );
3770		- } else {
3771		- $sort_dimension[ $key ] = strtolower( $user[ $sort_by ] );
3772		- }
3773		- }
3774		- $sort_order = 'asc' === $sort_order ? SORT_ASC : SORT_DESC;
3775		- array_multisort( $sort_dimension, $sort_order, $auth_settings_option );
3776		- } elseif ( 'created' === $sort_by && 'asc' !== $sort_order ) {
3777		- // If default sort method and reverse order, just reverse the array.
3778		- $auth_settings_option = array_reverse( $auth_settings_option );
3779		- }
3780		-
3781		- // Ensure array keys run from 0..max (keys in database will be the original,
3782		- // index, and removing users will not reorder the array keys of other users).
3783		- $auth_settings_option = array_values( $auth_settings_option );
3784		-
3785		- // Get pager params.
3786		- $total_users = count( $auth_settings_option );
3787		- $users_per_page = intval( $this->get_plugin_option( 'advanced_users_per_page', WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' ) );
3788		- // phpcs:ignore WordPress.CSRF.NonceVerification.NoNonceVerification
3789		- $current_page = isset( $_REQUEST['paged'] ) ? intval( $_REQUEST['paged'] ) : 1;
3790		- $total_pages = ceil( $total_users / $users_per_page );
3791		- if ( $total_pages < 1 ) {
3792		- $total_pages = 1;
3793		- }
3794		-
3795		- // Make sure current_page is between 1 and max pages.
3796		- if ( $current_page < 1 ) {
3797		- $current_page = 1;
3798		- } elseif ( $current_page > $total_pages ) {
3799		- $current_page = $total_pages;
3800		- }
3801		-
3802		- // Render wrapper div (for aligning pager to width of content).
3803		- ?>
3804		- <div class="wrapper_<?php echo esc_attr( $option ); ?>">
3805		- <?php $this->render_user_pager( $current_page, $users_per_page, $total_users, 'top' ); ?>
3806		- <ul id="list_auth_settings_access_users_approved" class="<?php echo strlen( $advanced_usermeta ) > 0 ? 'has-usermeta' : ''; ?>">
3807		- <?php
3808		- $offset = ( $current_page - 1 ) * $users_per_page;
3809		- $max = min( $offset + $users_per_page, count( $auth_settings_option ) );
3810		- for ( $key = $offset; $key < $max; $key++ ) :
3811		- $approved_user = $auth_settings_option[ $key ];
	3213	+ ?><ul id="list_auth_settings_access_users_approved" style="margin:0;">
	3214	+ <?php if ( ! $multisite_admin_page ) :
	3215	+ foreach ( $auth_settings_option_multisite as $key => $approved_user ) :
3812	3216	if ( empty( $approved_user ) || count( $approved_user ) < 1 ) :
3813	3217	continue;
3814	3218	endif;
3815		- $this->render_user_element( $approved_user, $key, $option, $admin_mode, $advanced_usermeta );
3816		- endfor;
3817		- ?>
3818		- </ul>
	3219	+ $approved_wp_user = get_user_by( 'email', $approved_user['email'] );
	3220	+ if ( $approved_wp_user ) :
	3221	+ $approved_user['email'] = $approved_wp_user->user_email;
	3222	+ $approved_user['role'] = $multisite_admin_page || count( $approved_wp_user->roles ) === 0 ? $approved_user['role'] : array_shift( $approved_wp_user->roles );
	3223	+ $approved_user['date_added'] = $approved_wp_user->user_registered;
	3224	+ // Get usermeta field from the WordPress user's real usermeta.
	3225	+ if ( strlen( $advanced_usermeta ) > 0 ) :
	3226	+ if ( strpos( $advanced_usermeta, 'acf___' ) === 0 && class_exists( 'acf' ) ) :
	3227	+ // Get ACF Field value for the user
	3228	+ $approved_user['usermeta'] = get_field( str_replace('acf___', '', $advanced_usermeta ), 'user_' . $approved_wp_user->ID );
	3229	+ else :
	3230	+ // Get regular usermeta value for the user.
	3231	+ $approved_user['usermeta'] = get_user_meta( $approved_wp_user->ID, $advanced_usermeta, true );
	3232	+ endif;
3819	3233
3820		- <div id="new_auth_settings_<?php echo esc_attr( $option ); ?>">
3821		- <textarea id="new_approved_user_email" placeholder="<?php esc_attr_e( 'email address', 'authorizer' ); ?>" class="auth-email new autogrow-short" rows="1"></textarea>
3822		- <select id="new_approved_user_role" class="auth-role">
3823		- <?php $this->wp_dropdown_permitted_roles( $access_default_role, 'not disabled', $admin_mode ); ?>
3824		- </select>
3825		- <div class="btn-group">
3826		- <a href="javascript:void(0);" class="btn button-primary dropdown-toggle button-add-user" id="approve_user_new" onclick="<?php echo esc_attr( $js_function_prefix ); ?>AddUser(this, 'approved' );"><span class="glyphicon glyphicon-ok"></span> <?php esc_html_e( 'Approve', 'authorizer' ); ?></a>
3827		- <button type="button" class="btn button-primary dropdown-toggle" data-toggle="dropdown">
3828		- <span class="caret"></span>
3829		- <span class="sr-only"><?php esc_html_e( 'Toggle Dropdown', 'authorizer' ); ?></span>
3830		- </button>
3831		- <ul class="dropdown-menu" role="menu">
3832		- <li><a href="javascript:void(0);" onclick="<?php echo esc_attr( $js_function_prefix ); ?>AddUser( document.getElementById( 'approve_user_new' ), 'approved', true);"><?php esc_html_e( 'Create a new WordPress account, and email the user an activation link.', 'authorizer' ); ?></a></li>
3833		- </ul>
3834		- </div>
3835		- </div>
3836		- <?php $this->render_user_pager( $current_page, $users_per_page, $total_users, 'bottom' ); ?>
3837		- </div>
3838		- <?php
3839		- }
	3234	+ if ( is_array( $approved_user['usermeta'] ) || is_object( $approved_user['usermeta'] ) ) :
	3235	+ $approved_user['usermeta'] = serialize( $approved_user['usermeta'] );
	3236	+ endif;
	3237	+ endif;
	3238	+ endif;
	3239	+ if ( ! array_key_exists( 'usermeta', $approved_user ) ) :
	3240	+ $approved_user['usermeta'] = '';
	3241	+ endif; ?>
	3242	+ <li>
	3243	+ <input type="text" id="auth_multisite_settings_<?php echo $option; ?>_<?php echo $key; ?>" value="<?php echo $approved_user['email']; ?>" readonly="true" class="auth-email auth-multisite-email" />
	3244	+ <select id="auth_multisite_settings_<?php echo $option; ?>_<?php echo $key; ?>_role" class="auth-role auth-multisite-role" disabled="disabled">
	3245	+ <?php $this->wp_dropdown_permitted_roles( $approved_user['role'] ); ?>
	3246	+ </select>
	3247	+ <input type="text" id="auth_multisite_settings_<?php echo $option; ?>_<?php echo $key; ?>_date_added" value="<?php echo date( 'M Y', strtotime( $approved_user['date_added'] ) ); ?>" readonly="true" class="auth-date-added auth-multisite-date-added" disabled="disabled" />
	3248	+ <?php if ( strlen( $advanced_usermeta ) > 0 ) :
	3249	+ $should_show_usermeta_in_text_field = true; // Fallback renderer for usermeta; try to use a select first.
	3250	+ if ( strpos( $advanced_usermeta, 'acf___' ) === 0 && class_exists( 'acf' ) ) :
	3251	+ $field_object = get_field_object( str_replace('acf___', '', $advanced_usermeta ) );
	3252	+ if ( is_array( $field_object ) && array_key_exists( 'type', $field_object ) && $field_object['type'] === 'select' ) :
	3253	+ $should_show_usermeta_in_text_field = false; ?>
	3254	+ <select id="auth_settings_<?php echo $option; ?>_<?php echo $key; ?>_usermeta" class="auth-usermeta auth-multisite-usermeta" onchange="<?php echo $js_function_prefix; ?>update_usermeta( this );">
	3255	+ <option value=""<?php if ( empty( $approved_user['usermeta'] ) ) echo ' selected="selected"'; ?>><?php _e( '-- None --', 'authorizer' ); ?></option>
	3256	+ <?php foreach ( $field_object['choices'] as $key => $label ) : ?>
	3257	+ <option value="<?php echo $key; ?>"<?php if ( $key === $approved_user['usermeta'] || ( is_array( $approved_user['usermeta'] ) && array_key_exists( get_current_blog_id(), $approved_user['usermeta'] ) && $key === $approved_user['usermeta'][get_current_blog_id()]['meta_value'] ) ) echo ' selected="selected"'; ?>><?php echo $label; ?></option>
	3258	+ <?php endforeach; ?>
	3259	+ </select>
	3260	+ <?php endif; ?>
	3261	+ <?php endif; ?>
	3262	+ <?php if ( $should_show_usermeta_in_text_field ) : ?>
	3263	+ <input type="text" id="auth_multisite_settings_<?php echo $option; ?>_<?php echo $key; ?>_usermeta" value="<?php echo htmlspecialchars( $approved_user['usermeta'], ENT_COMPAT ); ?>" class="auth-usermeta auth-multisite-usermeta" />
	3264	+ <a class="button button-small button-primary update-usermeta" id="update_usermeta_<?php echo $key; ?>" onclick="<?php echo $js_function_prefix; ?>update_usermeta( this );" title="Update usermeta"><span class="glyphicon glyphicon-floppy-saved"></span></a>
	3265	+ <?php endif; ?>
	3266	+ <?php endif; ?>
	3267	+ &nbsp;&nbsp;<a title="WordPress Multisite user" class="auth-multisite-user"><span class="glyphicon glyphicon-globe"></span></a>
	3268	+ </li>
	3269	+ <?php endforeach;
	3270	+ endif;
	3271	+ foreach ( $auth_settings_option as $key => $approved_user ):
	3272	+ $is_current_user = false;
	3273	+ $local_user_icon = array_key_exists( 'local_user', $approved_user ) && $approved_user['local_user'] === 'true' ? '&nbsp;<a title="Local WordPress user" class="auth-local-user"><span class="glyphicon glyphicon-user"></span></a>' : '';
	3274	+ if ( empty( $approved_user ) || count( $approved_user ) < 1 ) :
	3275	+ continue;
	3276	+ endif;
	3277	+ $approved_wp_user = get_user_by( 'email', $approved_user['email'] );
	3278	+ if ( $approved_wp_user ) :
	3279	+ $approved_user['email'] = $approved_wp_user->user_email;
	3280	+ $approved_user['role'] = $multisite_admin_page || count( $approved_wp_user->roles ) === 0 ? $approved_user['role'] : array_shift( $approved_wp_user->roles );
	3281	+ $approved_user['date_added'] = $approved_wp_user->user_registered;
	3282	+ $approved_user['is_wp_user'] = true;
	3283	+ $is_current_user = $approved_wp_user->ID === get_current_user_id();
	3284	+ // Get usermeta field from the WordPress user's real usermeta.
	3285	+ if ( strlen( $advanced_usermeta ) > 0 ) :
	3286	+ if ( strpos( $advanced_usermeta, 'acf___' ) === 0 && class_exists( 'acf' ) ) :
	3287	+ // Get ACF Field value for the user
	3288	+ $approved_user['usermeta'] = get_field( str_replace('acf___', '', $advanced_usermeta ), 'user_' . $approved_wp_user->ID );
	3289	+ else :
	3290	+ // Get regular usermeta value for the user.
	3291	+ $approved_user['usermeta'] = get_user_meta( $approved_wp_user->ID, $advanced_usermeta, true );
	3292	+ endif;
3840	3293
3841		-
3842		- /**
3843		- * Renders the html elements for the pager above and below the Approved User list.
3844		- *
3845		- * @param integer $current_page Which page we are currently viewing.
3846		- * @param integer $users_per_page How many users to show per page.
3847		- * @param integer $total_users Total count of users in list.
3848		- * @param string $which Where to render the pager ('top' or 'bottom').
3849		- * @return void
3850		- */
3851		- private function render_user_pager( $current_page = 1, $users_per_page = 20, $total_users = 0, $which = 'top' ) {
3852		- $total_pages = ceil( $total_users / $users_per_page );
3853		- if ( $total_pages < 1 ) {
3854		- $total_pages = 1;
3855		- }
3856		-
3857		- /* TRANSLATORS: %s: number of users */
3858		- $output = ' <span class="displaying-num">' . sprintf( _n( '%s user', '%s users', $total_users, 'authorizer' ), number_format_i18n( $total_users ) ) . '</span>';
3859		-
3860		- $disable_first = $current_page <= 1;
3861		- $disable_prev = $current_page <= 1;
3862		- $disable_next = $current_page >= $total_pages;
3863		- $disable_last = $current_page >= $total_pages;
3864		-
3865		- $current_url = '';
3866		- if ( isset( $_SERVER['HTTP_HOST'], $_SERVER['REQUEST_URI'] ) ) {
3867		- $current_url = set_url_scheme( esc_url_raw( wp_unslash( $_SERVER['HTTP_HOST'] ) ) . esc_url_raw( wp_unslash( $_SERVER['REQUEST_URI'] ) ) );
3868		- $current_url = remove_query_arg( wp_removable_query_args(), $current_url );
3869		- }
3870		-
3871		- $page_links = array();
3872		-
3873		- $total_pages_before = '<span class="paging-input">';
3874		- $total_pages_after = '</span></span>';
3875		-
3876		- if ( $disable_first ) {
3877		- $page_links[] = '<span class="button disabled first-page tablenav-pages-navspan" aria-hidden="true">&laquo;</span>';
3878		- } else {
3879		- $page_links[] = sprintf(
3880		- "<a class='button first-page' href='%s'><span class='screen-reader-text'>%s</span><span aria-hidden='true'>%s</span></a>",
3881		- esc_url( remove_query_arg( 'paged', $current_url ) ),
3882		- __( 'First page' ),
3883		- '&laquo;'
3884		- );
3885		- }
3886		-
3887		- if ( $disable_prev ) {
3888		- $page_links[] = '<span class="button disabled prev-page tablenav-pages-navspan" aria-hidden="true">&lsaquo;</span>';
3889		- } else {
3890		- $page_links[] = sprintf(
3891		- "<a class='button prev-page' href='%s'><span class='screen-reader-text'>%s</span><span aria-hidden='true'>%s</span></a>",
3892		- esc_url( add_query_arg( 'paged', max( 1, $current_page - 1 ), $current_url ) ),
3893		- __( 'Previous page' ),
3894		- '&lsaquo;'
3895		- );
3896		- }
3897		-
3898		- if ( 'bottom' === $which ) {
3899		- $html_current_page = '<span class="current-page-text">' . $current_page . '</span>';
3900		- $total_pages_before = '<span class="screen-reader-text">' . __( 'Current Page' ) . '</span><span id="table-paging" class="paging-input"><span class="tablenav-paging-text">';
3901		- } else {
3902		- $html_current_page = sprintf(
3903		- "%s<input class='current-page' id='current-page-selector' type='text' name='paged' value='%s' size='%d' aria-describedby='table-paging' /><span class='tablenav-paging-text'>",
3904		- '<label for="current-page-selector" class="screen-reader-text">' . __( 'Current Page' ) . '</label>',
3905		- $current_page,
3906		- strlen( $total_pages )
3907		- );
3908		- }
3909		- /* TRANSLATORS: %s: number of pages */
3910		- $html_total_pages = sprintf( "<span class='total-pages'>%s</span>", number_format_i18n( $total_pages ) );
3911		- /* TRANSLATORS: 1: number of current page 2: number of total pages */
3912		- $page_links[] = $total_pages_before . sprintf( _x( '%1$s of %2$s', 'paging' ), $html_current_page, $html_total_pages ) . $total_pages_after;
3913		-
3914		- if ( $disable_next ) {
3915		- $page_links[] = '<span class="button disabled next-page tablenav-pages-navspan" aria-hidden="true">&rsaquo;</span>';
3916		- } else {
3917		- $page_links[] = sprintf(
3918		- "<a class='button next-page' href='%s'><span class='screen-reader-text'>%s</span><span aria-hidden='true'>%s</span></a>",
3919		- esc_url( add_query_arg( 'paged', min( $total_pages, $current_page + 1 ), $current_url ) ),
3920		- __( 'Next page' ),
3921		- '&rsaquo;'
3922		- );
3923		- }
3924		-
3925		- if ( $disable_last ) {
3926		- $page_links[] = '<span class="button disabled last-page tablenav-pages-navspan" aria-hidden="true">&raquo;</span>';
3927		- } else {
3928		- $page_links[] = sprintf(
3929		- "<a class='button last-page' href='%s'><span class='screen-reader-text'>%s</span><span aria-hidden='true'>%s</span></a>",
3930		- esc_url( add_query_arg( 'paged', $total_pages, $current_url ) ),
3931		- __( 'Last page' ),
3932		- '&raquo;'
3933		- );
3934		- }
3935		-
3936		- $pagination_links_class = 'pagination-links';
3937		- $output .= "\n<span class='$pagination_links_class'>" . join( "\n", $page_links ) . '</span>';
3938		-
3939		- $search_form = array();
3940		- if ( 'top' === $which ) {
3941		- // phpcs:ignore WordPress.CSRF.NonceVerification.NoNonceVerification
3942		- $search_term = isset( $_REQUEST['search'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['search'] ) ) : '';
3943		- $search_form[] = '<div class="search-box">';
3944		- $search_form[] = '<label class="screen-reader-text" for="user-search-input">' . __( 'Search Users', 'authorizer' ) . '</label>';
3945		- $search_form[] = '<input type="search" size="14" id="user-search-input" name="search" value="' . $search_term . '">';
3946		- $search_form[] = '<input type="button" id="search-submit" class="button" value="' . __( 'Search', 'authorizer' ) . '">';
3947		- $search_form[] = '</div>';
3948		- }
3949		- $search_form = join( "\n", $search_form );
3950		-
3951		- $output = "<div class='tablenav-pages'>$output</div>";
3952		- ?>
3953		- <div class="tablenav top">
3954		- <?php echo wp_kses( $output, $this->allowed_html ); ?>
3955		- <?php echo wp_kses( $search_form, $this->allowed_html ); ?>
3956		- </div>
3957		- <?php
3958		- }
3959		-
3960		-
3961		- /**
3962		- * Renders the html <li> element for a given user in a list.
3963		- *
3964		- * @param array $approved_user User array to render.
3965		- * @param int $key Index of user in list of users.
3966		- * @param string $option List user is in (e.g., 'access_users_approved').
3967		- * @param string $admin_mode Current admin context.
3968		- * @param string $advanced_usermeta Usermeta field to display.
3969		- * @return void
3970		- */
3971		- private function render_user_element( $approved_user, $key, $option, $admin_mode, $advanced_usermeta ) {
3972		- $is_local_user = array_key_exists( 'local_user', $approved_user ) && 'true' === $approved_user['local_user'];
3973		- $is_multisite_user = array_key_exists( 'multisite_user', $approved_user ) && true === $approved_user['multisite_user'];
3974		- $option_prefix = $is_multisite_user ? 'auth_multisite_settings_' : 'auth_settings_';
3975		- $option_id = $option_prefix . $option . '_' . $key;
3976		- $approved_wp_user = get_user_by( 'email', $approved_user['email'] );
3977		- $is_current_user = $approved_wp_user && get_current_user_id() === $approved_wp_user->ID;
3978		-
3979		- // Adjust javascript function prefixes if multisite.
3980		- $js_function_prefix = WP_Plugin_Authorizer::NETWORK_CONTEXT === $admin_mode ? 'authMultisite' : 'auth';
3981		- $is_multisite_admin_page = WP_Plugin_Authorizer::NETWORK_CONTEXT === $admin_mode;
3982		-
3983		- if ( ! $approved_wp_user ) :
3984		- $approved_user['is_wp_user'] = false;
3985		- else :
3986		- $approved_user['is_wp_user'] = true;
3987		- $approved_user['email'] = $approved_wp_user->user_email;
3988		- $approved_user['role'] = $is_multisite_admin_page || count( $approved_wp_user->roles ) === 0 ? $approved_user['role'] : array_shift( $approved_wp_user->roles );
3989		- $approved_user['date_added'] = $approved_wp_user->user_registered;
3990		-
3991		- // Get usermeta field from the WordPress user's real usermeta.
3992		- if ( strlen( $advanced_usermeta ) > 0 ) :
3993		- if ( strpos( $advanced_usermeta, 'acf___' ) === 0 && class_exists( 'acf' ) ) :
3994		- // Get ACF Field value for the user.
3995		- $approved_user['usermeta'] = get_field( str_replace( 'acf___', '', $advanced_usermeta ), 'user_' . $approved_wp_user->ID );
	3294	+ if ( is_array( $approved_user['usermeta'] ) || is_object( $approved_user['usermeta'] ) ) :
	3295	+ $approved_user['usermeta'] = serialize( $approved_user['usermeta'] );
	3296	+ endif;
	3297	+ endif;
3996	3298	else :
3997		- // Get regular usermeta value for the user.
3998		- $approved_user['usermeta'] = get_user_meta( $approved_wp_user->ID, $advanced_usermeta, true );
	3299	+ $approved_user['is_wp_user'] = false;
3999	3300	endif;
4000		- if ( is_array( $approved_user['usermeta'] ) || is_object( $approved_user['usermeta'] ) ) :
4001		- $approved_user['usermeta'] = serialize( $approved_user['usermeta'] );
4002		- endif;
4003		- endif;
4004		- endif;
4005		- if ( ! array_key_exists( 'usermeta', $approved_user ) ) :
4006		- $approved_user['usermeta'] = '';
4007		- endif;
4008		- ?>
4009		- <li>
4010		- <input
4011		- type="text"
4012		- id="<?php echo esc_attr( $option_id ); ?>"
4013		- value="<?php echo esc_attr( $approved_user['email'] ); ?>"
4014		- readonly="true"
4015		- class="<?php echo esc_attr( $this->create_class_name( 'email', $is_multisite_user ) ); ?>"
4016		- />
4017		- <select
4018		- id="<?php echo esc_attr( $option_id ); ?>_role"
4019		- class="<?php echo esc_attr( $this->create_class_name( 'role', $is_multisite_user ) ); ?>"
4020		- onchange="<?php echo esc_attr( $js_function_prefix ); ?>ChangeRole( this );"
4021		- <?php if ( $is_multisite_user ) : ?>
4022		- disabled="disabled"
4023		- <?php endif; ?>
4024		- >
4025		- <?php $disable_input = $is_current_user ? 'disabled' : null; ?>
4026		- <?php $this->wp_dropdown_permitted_roles( $approved_user['role'], $disable_input, $admin_mode ); ?>
	3301	+ if ( ! array_key_exists( 'usermeta', $approved_user ) ) :
	3302	+ $approved_user['usermeta'] = '';
	3303	+ endif; ?>
	3304	+ <li>
	3305	+ <input type="text" id="auth_settings_<?php echo $option; ?>_<?php echo $key; ?>" value="<?php echo $approved_user['email']; ?>" readonly="true" class="auth-email" />
	3306	+ <select id="auth_settings_<?php echo $option; ?>_<?php echo $key; ?>_role" class="auth-role" onchange="<?php echo $js_function_prefix; ?>change_role( this );">
	3307	+ <?php $disable_input = $is_current_user ? 'disabled' : null; ?>
	3308	+ <?php $this->wp_dropdown_permitted_roles( $approved_user['role'], $disable_input, $admin_mode ); ?>
	3309	+ </select>
	3310	+ <input type="text" id="auth_settings_<?php echo $option; ?>_<?php echo $key; ?>_date_added" value="<?php echo date( 'M Y', strtotime( $approved_user['date_added'] ) ); ?>" readonly="true" class="auth-date-added" />
	3311	+ <?php if ( strlen( $advanced_usermeta ) > 0 ) :
	3312	+ $should_show_usermeta_in_text_field = true; // Fallback renderer for usermeta; try to use a select first.
	3313	+ if ( strpos( $advanced_usermeta, 'acf___' ) === 0 && class_exists( 'acf' ) ) :
	3314	+ $field_object = get_field_object( str_replace('acf___', '', $advanced_usermeta ) );
	3315	+ if ( is_array( $field_object ) && array_key_exists( 'type', $field_object ) && $field_object['type'] === 'select' ) :
	3316	+ $should_show_usermeta_in_text_field = false; ?>
	3317	+ <select id="auth_settings_<?php echo $option; ?>_<?php echo $key; ?>_usermeta" class="auth-usermeta" onchange="<?php echo $js_function_prefix; ?>update_usermeta( this );" >
	3318	+ <option value=""<?php if ( empty( $approved_user['usermeta'] ) ) echo ' selected="selected"'; ?>><?php _e( '-- None --', 'authorizer' ); ?></option>
	3319	+ <?php foreach ( $field_object['choices'] as $key => $label ) : ?>
	3320	+ <option value="<?php echo $key; ?>"<?php if ( $key === $approved_user['usermeta'] || ( is_array( $approved_user['usermeta'] ) && $key === $approved_user['usermeta']['meta_value'] ) ) echo ' selected="selected"'; ?>><?php echo $label; ?></option>
	3321	+ <?php endforeach; ?>
	3322	+ </select>
	3323	+ <?php endif; ?>
	3324	+ <?php endif; ?>
	3325	+ <?php if ( $should_show_usermeta_in_text_field ) : ?>
	3326	+ <input type="text" id="auth_settings_<?php echo $option; ?>_<?php echo $key; ?>_usermeta" value="<?php echo htmlspecialchars( $approved_user['usermeta'], ENT_COMPAT ); ?>" class="auth-usermeta" />
	3327	+ <a class="button button-small button-primary update-usermeta" id="update_usermeta_<?php echo $key; ?>" onclick="<?php echo $js_function_prefix; ?>update_usermeta( this );" title="Update usermeta"><span class="glyphicon glyphicon-floppy-saved"></span></a>
	3328	+ <?php endif; ?>
	3329	+ <?php endif; ?>
	3330	+ <?php if ( ! $is_current_user ): ?>
	3331	+ <?php if ( ! $multisite_admin_page ) : ?>
	3332	+ <a class="button" id="block_user_<?php echo $key; ?>" onclick="<?php echo $js_function_prefix; ?>add_user( this, 'blocked', false ); <?php echo $js_function_prefix; ?>ignore_user( this, 'approved' );" title="<?php _e( 'Block/Ban user', 'authorizer' ); ?>"><span class="glyphicon glyphicon-ban-circle"></span></a>
	3333	+ <?php endif; ?>
	3334	+ <a class="button" id="ignore_user_<?php echo $key; ?>" onclick="<?php echo $js_function_prefix; ?>ignore_user(this, 'approved' );" title="<?php _e( 'Remove user', 'authorizer' ); ?>"><span class="glyphicon glyphicon-remove"></span></a>
	3335	+ <?php endif; ?>
	3336	+ <?php echo $local_user_icon; ?>
	3337	+ </li>
	3338	+ <?php endforeach; ?>
	3339	+ </ul>
	3340	+ <div id="new_auth_settings_<?php echo $option; ?>">
	3341	+ <input type="text" id="new_approved_user_email" placeholder="<?php _e( 'email address', 'authorizer' ); ?>" class="auth-email new" />
	3342	+ <select id="new_approved_user_role" class="auth-role">
	3343	+ <?php $this->wp_dropdown_permitted_roles( $access_default_role, 'not disabled', $admin_mode ); ?>
4027	3344	</select>
4028		- <input
4029		- type="text"
4030		- id="<?php echo esc_attr( $option_id ); ?>_date_added"
4031		- value="<?php echo esc_attr( date( 'M Y', strtotime( $approved_user['date_added'] ) ) ); ?>"
4032		- readonly="true"
4033		- class="<?php echo esc_attr( $this->create_class_name( 'date-added', $is_multisite_user ) ); ?>"
4034		- />
4035		- <?php
4036		- if ( strlen( $advanced_usermeta ) > 0 ) :
4037		- $should_show_usermeta_in_text_field = true; // Fallback renderer for usermeta; try to use a select first.
4038		- if ( strpos( $advanced_usermeta, 'acf___' ) === 0 && class_exists( 'acf' ) ) :
4039		- $field_object = get_field_object( str_replace( 'acf___', '', $advanced_usermeta ) );
4040		- if ( is_array( $field_object ) && array_key_exists( 'type', $field_object ) && 'select' === $field_object['type'] ) :
4041		- $should_show_usermeta_in_text_field = false;
4042		- ?>
4043		- <select
4044		- id="<?php echo esc_attr( $option_id ); ?>_usermeta"
4045		- class="<?php echo esc_attr( $this->create_class_name( 'usermeta', $is_multisite_user ) ); ?>"
4046		- onchange="<?php echo esc_attr( $js_function_prefix ); ?>UpdateUsermeta( this );"
4047		- >
4048		- <option value=""<?php selected( empty( $approved_user['usermeta'] ) ); ?>><?php esc_html_e( '-- None --', 'authorizer' ); ?></option>
4049		- <?php foreach ( $field_object['choices'] as $key => $label ) : ?>
4050		- <option value="<?php echo esc_attr( $key ); ?>"<?php selected( $key === $approved_user['usermeta'] || ( isset( $approved_user['usermeta']['meta_value'] ) && $key === $approved_user['usermeta']['meta_value'] ) ); ?>><?php echo esc_html( $label ); ?></option>
4051		- <?php endforeach; ?>
4052		- </select>
4053		- <?php endif; ?>
4054		- <?php endif; ?>
4055		- <?php if ( $should_show_usermeta_in_text_field ) : ?>
4056		- <input
4057		- type="text"
4058		- id="<?php echo esc_attr( $option_id ); ?>_usermeta"
4059		- value="<?php echo esc_attr( $approved_user['usermeta'], ENT_COMPAT ); ?>"
4060		- class="<?php echo esc_attr( $this->create_class_name( 'usermeta', $is_multisite_user ) ); ?>"
4061		- />
4062		- <a class="button button-small button-primary update-usermeta" id="update_usermeta_<?php echo esc_attr( $key ); ?>" onclick="<?php echo esc_attr( $js_function_prefix ); ?>UpdateUsermeta( this );" title="Update usermeta"><span class="glyphicon glyphicon-floppy-saved"></span></a>
4063		- <?php endif; ?>
4064		- <?php endif; ?>
4065		- <?php if ( ! $is_current_user && ! $is_multisite_user ) : ?>
4066		- <?php if ( ! $is_multisite_admin_page ) : ?>
4067		- <a class="button" id="block_user_<?php echo esc_attr( $key ); ?>" onclick="<?php echo esc_attr( $js_function_prefix ); ?>AddUser( this, 'blocked', false ); <?php echo esc_attr( $js_function_prefix ); ?>IgnoreUser( this, 'approved' );" title="<?php esc_attr_e( 'Block/Ban user', 'authorizer' ); ?>"><span class="glyphicon glyphicon-ban-circle"></span></a>
4068		- <?php endif; ?>
4069		- <a class="button" id="ignore_user_<?php echo esc_attr( $key ); ?>" onclick="<?php echo esc_attr( $js_function_prefix ); ?>IgnoreUser(this, 'approved' );" title="<?php esc_attr_e( 'Remove user', 'authorizer' ); ?>"><span class="glyphicon glyphicon-remove"></span></a>
4070		- <?php endif; ?>
4071		- <?php if ( $is_local_user ) : ?>
4072		- &nbsp;<a title="Local WordPress user" class="auth-local-user"><span class="glyphicon glyphicon-user"></span></a>
4073		- <?php endif; ?>
4074		- <?php if ( $is_multisite_user ) : ?>
4075		- &nbsp;<a title="WordPress Multisite user" class="auth-multisite-user"><span class="glyphicon glyphicon-globe"></span></a>
4076		- <?php endif; ?>
4077		- </li>
	3345	+ <div class="btn-group">
	3346	+ <a href="javascript:void(0);" class="btn button-primary dropdown-toggle" id="approve_user_new" onclick="<?php echo $js_function_prefix; ?>add_user(this, 'approved' );"><span class="glyphicon glyphicon-ok"></span> <?php _e( 'Approve', 'authorizer' ); ?></a>
	3347	+ <button type="button" class="btn button-primary dropdown-toggle" data-toggle="dropdown">
	3348	+ <span class="caret"></span>
	3349	+ <span class="sr-only"><?php _e( 'Toggle Dropdown', 'authorizer' ); ?></span>
	3350	+ </button>
	3351	+ <ul class="dropdown-menu" role="menu">
	3352	+ <li><a href="javascript:void(0);" onclick="<?php echo $js_function_prefix; ?>add_user( document.getElementById('approve_user_new' ), 'approved', true);"><?php _e( 'Create a local WordPress <br />account instead, and email <br />the user their password.', 'authorizer' ); ?></a></li>
	3353	+ </ul>
	3354	+ </div>
	3355	+ </div>
4078	3356	<?php
4079	3357	}
4080	3358
4081	3359
4082		- /**
4083		- * Settings print callback.
4084		- *
4085		- * @param string $args Args (e.g., multisite admin mode).
4086		- * @return void
4087		- */
4088		- public function print_combo_auth_access_users_blocked( $args = '' ) {
	3360	+ function print_combo_auth_access_users_blocked( $args = '' ) {
4089	3361	// Get plugin option.
4090		- $option = 'access_users_blocked';
	3362	+ $option = 'access_users_blocked';
4091	3363	$auth_settings_option = $this->get_plugin_option( $option );
4092	3364	$auth_settings_option = is_array( $auth_settings_option ) ? $auth_settings_option : array();
4093	3365
4094	3366	// Get default role for new blocked user dropdown.
4095		- $access_default_role = $this->get_plugin_option( 'access_default_role', WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
	3367	+ $access_default_role = $this->get_plugin_option( 'access_default_role', SINGLE_ADMIN, 'allow override' );
4096	3368
4097		- // Render wrapper div (for aligning pager to width of content).
4098		- ?>
4099		- <div class="wrapper_<?php echo esc_attr( $option ); ?>">
4100		- <ul id="list_auth_settings_<?php echo esc_attr( $option ); ?>" style="margin:0;">
4101		- <?php
4102		- foreach ( $auth_settings_option as $key => $blocked_user ) :
4103		- if ( empty( $blocked_user ) || count( $blocked_user ) < 1 ) :
4104		- continue;
4105		- endif;
4106		- $blocked_wp_user = get_user_by( 'email', $blocked_user['email'] );
4107		- if ( $blocked_wp_user ) :
4108		- $blocked_user['email'] = $blocked_wp_user->user_email;
4109		- $blocked_user['role'] = array_shift( $blocked_wp_user->roles );
4110		- $blocked_user['date_added'] = $blocked_wp_user->user_registered;
4111		- $blocked_user['is_wp_user'] = true;
4112		- else :
4113		- $blocked_user['is_wp_user'] = false;
4114		- endif;
4115		- ?>
4116		- <li>
4117		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>_<?php echo esc_attr( $key ); ?>" value="<?php echo esc_attr( $blocked_user['email'] ); ?>" readonly="true" class="auth-email" />
4118		- <select id="auth_settings_<?php echo esc_attr( $option ); ?>_<?php echo esc_attr( $key ); ?>_role" class="auth-role">
4119		- <?php $this->wp_dropdown_permitted_roles( $blocked_user['role'] ); ?>
4120		- </select>
4121		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>_<?php echo esc_attr( $key ); ?>_date_added" value="<?php echo esc_attr( date( 'M Y', strtotime( $blocked_user['date_added'] ) ) ); ?>" readonly="true" class="auth-date-added" />
4122		- <a class="button" id="ignore_user_<?php echo esc_attr( $key ); ?>" onclick="authIgnoreUser( this, 'blocked' );" title="<?php esc_attr_e( 'Remove user', 'authorizer' ); ?>"><span class="glyphicon glyphicon-remove"></span></a>
4123		- </li>
4124		- <?php endforeach; ?>
4125		- </ul>
4126		- <div id="new_auth_settings_<?php echo esc_attr( $option ); ?>">
4127		- <input type="text" id="new_blocked_user_email" placeholder="<?php esc_attr_e( 'email address', 'authorizer' ); ?>" class="auth-email new" />
4128		- <select id="new_blocked_user_role" class="auth-role">
4129		- <option value="<?php echo esc_attr( $access_default_role ); ?>"><?php echo esc_html( ucfirst( $access_default_role ) ); ?></option>
4130		- </select>
4131		- <a href="javascript:void(0);" class="button-primary button-add-user" id="block_user_new" onclick="authAddUser( this, 'blocked' );"><span class="glyphicon glyphicon-ban-circle"></span> <?php esc_html_e( 'Block', 'authorizer' ); ?></a>
4132		- </div>
	3369	+ // Print option elements.
	3370	+ ?><ul id="list_auth_settings_<?php echo $option; ?>" style="margin:0;">
	3371	+ <?php foreach ( $auth_settings_option as $key => $blocked_user ): ?>
	3372	+ <?php if ( empty( $blocked_user ) || count( $blocked_user ) < 1 ) continue; ?>
	3373	+ <?php if ( $blocked_wp_user = get_user_by( 'email', $blocked_user['email'] ) ): ?>
	3374	+ <?php $blocked_user['email'] = $blocked_wp_user->user_email; ?>
	3375	+ <?php $blocked_user['role'] = array_shift( $blocked_wp_user->roles ); ?>
	3376	+ <?php $blocked_user['date_added'] = $blocked_wp_user->user_registered; ?>
	3377	+ <?php $blocked_user['is_wp_user'] = true; ?>
	3378	+ <?php else: ?>
	3379	+ <?php $blocked_user['is_wp_user'] = false; ?>
	3380	+ <?php endif; ?>
	3381	+ <li>
	3382	+ <input type="text" id="auth_settings_<?php echo $option; ?>_<?php echo $key; ?>" value="<?php echo $blocked_user['email']; ?>" readonly="true" class="auth-email" />
	3383	+ <select id="auth_settings_<?php echo $option; ?>_<?php echo $key; ?>_role" class="auth-role">
	3384	+ <?php $this->wp_dropdown_permitted_roles( $blocked_user['role'] ); ?>
	3385	+ </select>
	3386	+ <input type="text" id="auth_settings_<?php echo $option; ?>_<?php echo $key; ?>_date_added" value="<?php echo date( 'M Y', strtotime( $blocked_user['date_added'] ) ); ?>" readonly="true" class="auth-date-added" />
	3387	+ <a class="button" id="ignore_user_<?php echo $key; ?>" onclick="auth_ignore_user(this, 'blocked' );" title="<?php _e( 'Remove user', 'authorizer' ); ?>"><span class="glyphicon glyphicon-remove"></span></a>
	3388	+ </li>
	3389	+ <?php endforeach; ?>
	3390	+ </ul>
	3391	+ <div id="new_auth_settings_<?php echo $option; ?>">
	3392	+ <input type="text" id="new_blocked_user_email" placeholder="<?php _e( 'email address', 'authorizer' ); ?>" class="auth-email new" />
	3393	+ <select id="new_blocked_user_role" class="auth-role">
	3394	+ <option value="<?php echo $access_default_role; ?>"><?php echo ucfirst( $access_default_role ); ?></option>
	3395	+ </select>
	3396	+ <a href="javascript:void(0);" class="button-primary" id="block_user_new" onclick="auth_add_user(this, 'blocked' );"><span class="glyphicon glyphicon-ban-circle"></span> <?php _e( 'Block', 'authorizer' ); ?></a>
4133	3397	</div>
4134	3398	<?php
4135	3399	}
4136	3400
4137	3401
4138		- /**
4139		- * Settings print callback.
4140		- *
4141		- * @param string $args Args (e.g., multisite admin mode).
4142		- * @return void
4143		- */
4144		- public function print_section_info_access_login( $args = '' ) {
4145		- ?>
4146		- <div id="section_info_access_login" class="section_info">
	3402	+ function print_section_info_access_login( $args = '' ) {
	3403	+ ?><div id="section_info_access_login" class="section_info">
4147	3404	<?php wp_nonce_field( 'save_auth_settings', 'nonce_save_auth_settings' ); ?>
4148		- <p><?php esc_html_e( 'Choose who is able to log into this site below.', 'authorizer' ); ?></p>
4149		- </div>
4150		- <?php
	3405	+ <p><?php _e( 'Choose who is able to log into this site below.', 'authorizer' ); ?></p>
	3406	+ </div><?php
4151	3407	}
4152	3408
4153	3409
4154		- /**
4155		- * Settings print callback.
4156		- *
4157		- * @param string $args Args (e.g., multisite admin mode).
4158		- * @return void
4159		- */
4160		- public function print_radio_auth_access_who_can_login( $args = '' ) {
	3410	+ function print_radio_auth_access_who_can_login( $args = '' ) {
4161	3411	// Get plugin option.
4162		- $option = 'access_who_can_login';
4163		- $admin_mode = $this->get_admin_mode( $args );
	3412	+ $option = 'access_who_can_login';
	3413	+ $admin_mode = $this->get_admin_mode( $args );
4164	3414	$auth_settings_option = $this->get_plugin_option( $option, $admin_mode, 'allow override', 'print overlay' );
4165	3415
4166	3416	// If this site is configured independently of any multisite overrides, make sure we are not grabbing the multisite value; otherwise, grab the multisite value to show behind the disabled overlay.
4167		- if ( is_multisite() && 1 === intval( $this->get_plugin_option( 'advanced_override_multisite' ) ) ) {
	3417	+ if ( is_multisite() && $this->get_plugin_option( 'advanced_override_multisite' ) == '1' ) {
4168	3418	$auth_settings_option = $this->get_plugin_option( $option );
4169		- } elseif ( is_multisite() && WP_Plugin_Authorizer::SINGLE_CONTEXT === $admin_mode && $this->get_plugin_option( 'multisite_override', WP_Plugin_Authorizer::NETWORK_CONTEXT ) === '1' ) {
	3419	+ } elseif ( is_multisite() && $admin_mode === SINGLE_ADMIN && $this->get_plugin_option( 'multisite_override', MULTISITE_ADMIN ) === '1' ) {
4170	3420	// Workaround: javascript code hides/shows other settings based
4171	3421	// on the selection in this option. If this option is overridden
4172	3422	// by a multisite option, it should show that value in order to
4173	3423	// correctly display the other appropriate options.
		@@ -4173,49 +3423,33 @@
4173	3423	// correctly display the other appropriate options.
4174	3424	// Side effect: this site option will be overwritten by the
4175	3425	// multisite option on save. Since this is a 2-item radio, we
4176	3426	// determined this was acceptable.
4177		- $auth_settings_option = $this->get_plugin_option( $option, WP_Plugin_Authorizer::NETWORK_CONTEXT );
	3427	+ $auth_settings_option = $this->get_plugin_option( $option, MULTISITE_ADMIN );
4178	3428	}
4179	3429
4180	3430	// Print option elements.
4181		- ?>
4182		- <input type="radio" id="radio_auth_settings_<?php echo esc_attr( $option ); ?>_external_users" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="external_users"<?php checked( 'external_users' === $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo esc_attr( $option ); ?>_external_users"><?php esc_html_e( 'All authenticated users (All external service users and all WordPress users)', 'authorizer' ); ?></label><br />
4183		- <input type="radio" id="radio_auth_settings_<?php echo esc_attr( $option ); ?>_approved_users" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="approved_users"<?php checked( 'approved_users' === $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo esc_attr( $option ); ?>_approved_users"><?php esc_html_e( 'Only', 'authorizer' ); ?> <a href="javascript:chooseTab('access_lists' );" id="dashboard_link_approved_users"><?php esc_html_e( 'approved users', 'authorizer' ); ?></a> <?php esc_html_e( '(Approved external users and all WordPress users)', 'authorizer' ); ?></label><br />
4184		- <?php
	3431	+ ?><input type="radio" id="radio_auth_settings_<?php echo $option; ?>_external_users" name="auth_settings[<?php echo $option; ?>]" value="external_users"<?php checked( 'external_users' == $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo $option; ?>_external_users"><?php _e( 'All authenticated users (All external service users and all WordPress users)', 'authorizer' ); ?></label><br />
	3432	+ <input type="radio" id="radio_auth_settings_<?php echo $option; ?>_approved_users" name="auth_settings[<?php echo $option; ?>]" value="approved_users"<?php checked( 'approved_users' == $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo $option; ?>_approved_users"><?php _e( 'Only', 'authorizer' ); ?> <a href="javascript:choose_tab('access_lists' );" id="dashboard_link_approved_users"><?php _e( 'approved users', 'authorizer' ); ?></a> <?php _e( '(Approved external users and all WordPress users)', 'authorizer' ); ?></label><br /><?php
4185	3433	}
4186	3434
4187	3435
4188		- /**
4189		- * Settings print callback.
4190		- *
4191		- * @param string $args Args (e.g., multisite admin mode).
4192		- * @return void
4193		- */
4194		- public function print_select_auth_access_role_receive_pending_emails( $args = '' ) {
	3436	+ function print_select_auth_access_role_receive_pending_emails( $args = '' ) {
4195	3437	// Get plugin option.
4196		- $option = 'access_role_receive_pending_emails';
	3438	+ $option = 'access_role_receive_pending_emails';
4197	3439	$auth_settings_option = $this->get_plugin_option( $option );
4198	3440
4199	3441	// Print option elements.
4200		- ?>
4201		- <select id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]">
4202		- <option value="---" <?php selected( $auth_settings_option, '---' ); ?>><?php esc_html_e( "None (Don't send notification emails)", 'authorizer' ); ?></option>
	3442	+ ?><select id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]">
	3443	+ <option value="---" <?php selected( $auth_settings_option, '---' ); ?>><?php _e( "None (Don't send notification emails)", 'authorizer' ); ?></option>
4203	3444	<?php wp_dropdown_roles( $auth_settings_option ); ?>
4204		- </select>
4205		- <?php
	3445	+ </select><?php
4206	3446	}
4207	3447
4208	3448
4209		- /**
4210		- * Settings print callback.
4211		- *
4212		- * @param string $args Args (e.g., multisite admin mode).
4213		- * @return void
4214		- */
4215		- public function print_wysiwyg_auth_access_pending_redirect_to_message( $args = '' ) {
	3449	+ function print_wysiwyg_auth_access_pending_redirect_to_message( $args = '' ) {
4216	3450	// Get plugin option.
4217		- $option = 'access_pending_redirect_to_message';
	3451	+ $option = 'access_pending_redirect_to_message';
4218	3452	$auth_settings_option = $this->get_plugin_option( $option );
4219	3453
4220	3454	// Print option elements.
4221	3455	wp_editor(
		@@ -4224,25 +3458,19 @@
4224	3458	array(
4225	3459	'media_buttons' => false,
4226	3460	'textarea_name' => "auth_settings[$option]",
4227	3461	'textarea_rows' => 5,
4228		- 'tinymce' => true,
4229		- 'teeny' => true,
4230		- 'quicktags' => false,
	3462	+ 'tinymce' => true,
	3463	+ 'teeny' => true,
	3464	+ 'quicktags' => false,
4231	3465	)
4232	3466	);
4233	3467	}
4234	3468
4235	3469
4236		- /**
4237		- * Settings print callback.
4238		- *
4239		- * @param string $args Args (e.g., multisite admin mode).
4240		- * @return void
4241		- */
4242		- public function print_wysiwyg_auth_access_blocked_redirect_to_message( $args = '' ) {
	3470	+ function print_wysiwyg_auth_access_blocked_redirect_to_message( $args = '' ) {
4243	3471	// Get plugin option.
4244		- $option = 'access_blocked_redirect_to_message';
	3472	+ $option = 'access_blocked_redirect_to_message';
4245	3473	$auth_settings_option = $this->get_plugin_option( $option );
4246	3474
4247	3475	// Print option elements.
4248	3476	wp_editor(
		@@ -4251,61 +3479,39 @@
4251	3479	array(
4252	3480	'media_buttons' => false,
4253	3481	'textarea_name' => "auth_settings[$option]",
4254	3482	'textarea_rows' => 5,
4255		- 'tinymce' => true,
4256		- 'teeny' => true,
4257		- 'quicktags' => false,
	3483	+ 'tinymce' => true,
	3484	+ 'teeny' => true,
	3485	+ 'quicktags' => false,
4258	3486	)
4259	3487	);
4260	3488	}
4261	3489
4262	3490
4263		- /**
4264		- * Settings print callback.
4265		- *
4266		- * @param string $args Args (e.g., multisite admin mode).
4267		- * @return void
4268		- */
4269		- public function print_checkbox_auth_access_should_email_approved_users( $args = '' ) {
	3491	+ function print_checkbox_auth_access_should_email_approved_users( $args = '' ) {
4270	3492	// Get plugin option.
4271		- $option = 'access_should_email_approved_users';
	3493	+ $option = 'access_should_email_approved_users';
4272	3494	$auth_settings_option = $this->get_plugin_option( $option );
4273	3495
4274	3496	// Print option elements.
4275		- ?>
4276		- <input type="checkbox" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="1"<?php checked( 1 === intval( $auth_settings_option ) ); ?> /><label for="auth_settings_<?php echo esc_attr( $option ); ?>"><?php esc_html_e( 'Send a welcome email when approving a new user', 'authorizer' ); ?></label>
4277		- <?php
	3497	+ ?><input type="checkbox" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="1"<?php checked( 1 == $auth_settings_option ); ?> /><label for="auth_settings_<?php echo $option; ?>"><?php _e( 'Send a welcome email when approving a new user', 'authorizer' ); ?></label><?php
4278	3498	}
4279	3499
4280	3500
4281		- /**
4282		- * Settings print callback.
4283		- *
4284		- * @param string $args Args (e.g., multisite admin mode).
4285		- * @return void
4286		- */
4287		- public function print_text_auth_access_email_approved_users_subject( $args = '' ) {
	3501	+ function print_text_auth_access_email_approved_users_subject( $args = '' ) {
4288	3502	// Get plugin option.
4289		- $option = 'access_email_approved_users_subject';
	3503	+ $option = 'access_email_approved_users_subject';
4290	3504	$auth_settings_option = $this->get_plugin_option( $option );
4291	3505
4292	3506	// Print option elements.
4293		- ?>
4294		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="Welcome to [site_name]!" style="width:320px;" /><br /><small><?php echo wp_kses( __( 'You can use the <b>[site_name]</b> shortcode.', 'authorizer' ), $this->allowed_html ); ?></small>
4295		- <?php
	3507	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="Welcome to [site_name]!" style="width:320px;" /><br /><small><?php _e( 'You can use the <b>[site_name]</b> shortcode.', 'authorizer' ); ?></small><?php
4296	3508	}
4297	3509
4298	3510
4299		- /**
4300		- * Settings print callback.
4301		- *
4302		- * @param string $args Args (e.g., multisite admin mode).
4303		- * @return void
4304		- */
4305		- public function print_wysiwyg_auth_access_email_approved_users_body( $args = '' ) {
	3511	+ function print_wysiwyg_auth_access_email_approved_users_body( $args = '' ) {
4306	3512	// Get plugin option.
4307		- $option = 'access_email_approved_users_body';
	3513	+ $option = 'access_email_approved_users_body';
4308	3514	$auth_settings_option = $this->get_plugin_option( $option );
4309	3515
4310	3516	// Print option elements.
4311	3517	wp_editor(
		@@ -4314,60 +3520,42 @@
4314	3520	array(
4315	3521	'media_buttons' => false,
4316	3522	'textarea_name' => "auth_settings[$option]",
4317	3523	'textarea_rows' => 9,
4318		- 'tinymce' => true,
4319		- 'teeny' => true,
4320		- 'quicktags' => false,
	3524	+ 'tinymce' => true,
	3525	+ 'teeny' => true,
	3526	+ 'quicktags' => false,
4321	3527	)
4322	3528	);
4323		- ?>
4324		- <small>
4325		- <?php
4326		- printf(
4327		- /* TRANSLATORS: 1: Shortcode for site name 2: Shortcode for site URL 3: Shortcode for user email */
4328		- wp_kses( __( 'You can use %1$s, %2$s, and %3$s shortcodes.', 'authorizer' ), $this->allowed_html ),
4329		- '<b>[site_name]</b>',
4330		- '<b>[site_url]</b>',
4331		- '<b>[user_email]</b>'
4332		- );
4333		- ?>
4334		- </small>
4335		- <?php
	3529	+
	3530	+ ?><small><?php printf(
	3531	+ /* TRANSLATORS: 1: Shortcode for site name 2: Shortcode for site URL 3: Shortcode for user email */
	3532	+ __( 'You can use %1$s, %2$s, and %3$s shortcodes.', 'authorizer' ),
	3533	+ '<b>[site_name]</b>',
	3534	+ '<b>[site_url]</b>',
	3535	+ '<b>[user_email]</b>'
	3536	+ ); ?></small><?php
	3537	+
4336	3538	}
4337	3539
4338	3540
4339		- /**
4340		- * Settings print callback.
4341		- *
4342		- * @param string $args Args (e.g., multisite admin mode).
4343		- * @return void
4344		- */
4345		- public function print_section_info_access_public( $args = '' ) {
4346		- ?>
4347		- <div id="section_info_access_public" class="section_info">
4348		- <p><?php esc_html_e( 'Choose your public access options here.', 'authorizer' ); ?></p>
4349		- </div>
4350		- <?php
	3541	+ function print_section_info_access_public( $args = '' ) {
	3542	+ ?><div id="section_info_access_public" class="section_info">
	3543	+ <p><?php _e( 'Choose your public access options here.', 'authorizer' ); ?></p>
	3544	+ </div><?php
4351	3545	}
4352	3546
4353	3547
4354		- /**
4355		- * Settings print callback.
4356		- *
4357		- * @param string $args Args (e.g., multisite admin mode).
4358		- * @return void
4359		- */
4360		- public function print_radio_auth_access_who_can_view( $args = '' ) {
	3548	+ function print_radio_auth_access_who_can_view( $args = '' ) {
4361	3549	// Get plugin option.
4362		- $option = 'access_who_can_view';
4363		- $admin_mode = $this->get_admin_mode( $args );
	3550	+ $option = 'access_who_can_view';
	3551	+ $admin_mode = $this->get_admin_mode( $args );
4364	3552	$auth_settings_option = $this->get_plugin_option( $option, $admin_mode, 'allow override', 'print overlay' );
4365	3553
4366	3554	// If this site is configured independently of any multisite overrides, make sure we are not grabbing the multisite value; otherwise, grab the multisite value to show behind the disabled overlay.
4367		- if ( is_multisite() && 1 === intval( $this->get_plugin_option( 'advanced_override_multisite' ) ) ) {
	3555	+ if ( is_multisite() && $this->get_plugin_option( 'advanced_override_multisite' ) == '1' ) {
4368	3556	$auth_settings_option = $this->get_plugin_option( $option );
4369		- } elseif ( is_multisite() && WP_Plugin_Authorizer::SINGLE_CONTEXT === $admin_mode && '1' === $this->get_plugin_option( 'multisite_override', WP_Plugin_Authorizer::NETWORK_CONTEXT ) ) {
	3557	+ } elseif ( is_multisite() && $admin_mode === SINGLE_ADMIN && $this->get_plugin_option( 'multisite_override', MULTISITE_ADMIN ) === '1' ) {
4370	3558	// Workaround: javascript code hides/shows other settings based
4371	3559	// on the selection in this option. If this option is overridden
4372	3560	// by a multisite option, it should show that value in order to
4373	3561	// correctly display the other appropriate options.
		@@ -4373,66 +3561,42 @@
4373	3561	// correctly display the other appropriate options.
4374	3562	// Side effect: this site option will be overwritten by the
4375	3563	// multisite option on save. Since this is a 2-item radio, we
4376	3564	// determined this was acceptable.
4377		- $auth_settings_option = $this->get_plugin_option( $option, WP_Plugin_Authorizer::NETWORK_CONTEXT );
	3565	+ $auth_settings_option = $this->get_plugin_option( $option, MULTISITE_ADMIN );
4378	3566	}
4379	3567
4380	3568	// Print option elements.
4381		- ?>
4382		- <input type="radio" id="radio_auth_settings_<?php echo esc_attr( $option ); ?>_everyone" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="everyone"<?php checked( 'everyone' === $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo esc_attr( $option ); ?>_everyone"><?php esc_html_e( 'Everyone can see the site', 'authorizer' ); ?></label><br />
4383		- <input type="radio" id="radio_auth_settings_<?php echo esc_attr( $option ); ?>_logged_in_users" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="logged_in_users"<?php checked( 'logged_in_users' === $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo esc_attr( $option ); ?>_logged_in_users"><?php esc_html_e( 'Only logged in users can see the site', 'authorizer' ); ?></label><br />
4384		- <?php
	3569	+ ?><input type="radio" id="radio_auth_settings_<?php echo $option; ?>_everyone" name="auth_settings[<?php echo $option; ?>]" value="everyone"<?php checked( 'everyone' == $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo $option; ?>_everyone"><?php _e( 'Everyone can see the site', 'authorizer' ); ?></label><br />
	3570	+ <input type="radio" id="radio_auth_settings_<?php echo $option; ?>_logged_in_users" name="auth_settings[<?php echo $option; ?>]" value="logged_in_users"<?php checked( 'logged_in_users' == $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo $option; ?>_logged_in_users"><?php _e( 'Only logged in users can see the site', 'authorizer' ); ?></label><br /><?php
4385	3571	}
4386	3572
4387	3573
4388		- /**
4389		- * Settings print callback.
4390		- *
4391		- * @param string $args Args (e.g., multisite admin mode).
4392		- * @return void
4393		- */
4394		- public function print_radio_auth_access_redirect( $args = '' ) {
	3574	+ function print_radio_auth_access_redirect( $args = '' ) {
4395	3575	// Get plugin option.
4396		- $option = 'access_redirect';
	3576	+ $option = 'access_redirect';
4397	3577	$auth_settings_option = $this->get_plugin_option( $option );
4398	3578
4399	3579	// Print option elements.
4400		- ?>
4401		- <input type="radio" id="radio_auth_settings_<?php echo esc_attr( $option ); ?>_to_login" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="login"<?php checked( 'login' === $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo esc_attr( $option ); ?>_to_login"><?php esc_html_e( 'Send them to the login screen', 'authorizer' ); ?></label><br />
4402		- <input type="radio" id="radio_auth_settings_<?php echo esc_attr( $option ); ?>_to_message" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="message"<?php checked( 'message' === $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo esc_attr( $option ); ?>_to_message"><?php esc_html_e( 'Show them the anonymous access message (below)', 'authorizer' ); ?></label>
4403		- <?php
	3580	+ ?><input type="radio" id="radio_auth_settings_<?php echo $option; ?>_to_login" name="auth_settings[<?php echo $option; ?>]" value="login"<?php checked( 'login' == $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo $option; ?>_to_login"><?php _e( 'Send them to the login screen', 'authorizer' ); ?></label><br />
	3581	+ <input type="radio" id="radio_auth_settings_<?php echo $option; ?>_to_message" name="auth_settings[<?php echo $option; ?>]" value="message"<?php checked( 'message' == $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo $option; ?>_to_message"><?php _e( 'Show them the anonymous access message (below)', 'authorizer' ); ?></label><?php
4404	3582	}
4405	3583
4406	3584
4407		- /**
4408		- * Settings print callback.
4409		- *
4410		- * @param string $args Args (e.g., multisite admin mode).
4411		- * @return void
4412		- */
4413		- public function print_radio_auth_access_public_warning( $args = '' ) {
	3585	+ function print_radio_auth_access_public_warning( $args = '' ) {
4414	3586	// Get plugin option.
4415		- $option = 'access_public_warning';
	3587	+ $option = 'access_public_warning';
4416	3588	$auth_settings_option = $this->get_plugin_option( $option );
4417	3589
4418	3590	// Print option elements.
4419		- ?>
4420		- <input type="radio" id="radio_auth_settings_<?php echo esc_attr( $option ); ?>_no" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="no_warning"<?php checked( 'no_warning' === $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo esc_attr( $option ); ?>_no"><?php echo wp_kses( __( 'Show them the page <strong>without</strong> the anonymous access message', 'authorizer' ), $this->allowed_html ); ?></label><br />
4421		- <input type="radio" id="radio_auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="warning"<?php checked( 'warning' === $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo esc_attr( $option ); ?>"><?php echo wp_kses( __( 'Show them the page <strong>with</strong> the anonymous access message (marked up as a <a href="http://getbootstrap.com/components/#alerts-dismissible" target="_blank">Bootstrap Dismissible Alert</a>)', 'authorizer' ), $this->allowed_html ); ?></label>
4422		- <?php
	3591	+ ?><input type="radio" id="radio_auth_settings_<?php echo $option; ?>_no" name="auth_settings[<?php echo $option; ?>]" value="no_warning"<?php checked( 'no_warning' == $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo $option; ?>_no"><?php _e( 'Show them the page <strong>without</strong> the anonymous access message', 'authorizer' ); ?></label><br />
	3592	+ <input type="radio" id="radio_auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="warning"<?php checked( 'warning' == $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo $option; ?>"><?php _e( 'Show them the page <strong>with</strong> the anonymous access message (marked up as a <a href="http://getbootstrap.com/components/#alerts-dismissible" target="_blank">Bootstrap Dismissible Alert</a>)', 'authorizer' ); ?></label><?php
4423	3593	}
4424	3594
4425	3595
4426		- /**
4427		- * Settings print callback.
4428		- *
4429		- * @param string $args Args (e.g., multisite admin mode).
4430		- * @return void
4431		- */
4432		- public function print_wysiwyg_auth_access_redirect_to_message( $args = '' ) {
	3596	+ function print_wysiwyg_auth_access_redirect_to_message( $args = '' ) {
4433	3597	// Get plugin option.
4434		- $option = 'access_redirect_to_message';
	3598	+ $option = 'access_redirect_to_message';
4435	3599	$auth_settings_option = $this->get_plugin_option( $option );
4436	3600
4437	3601	// Print option elements.
4438	3602	wp_editor(
		@@ -4441,25 +3605,19 @@
4441	3605	array(
4442	3606	'media_buttons' => false,
4443	3607	'textarea_name' => "auth_settings[$option]",
4444	3608	'textarea_rows' => 5,
4445		- 'tinymce' => true,
4446		- 'teeny' => true,
4447		- 'quicktags' => false,
	3609	+ 'tinymce' => true,
	3610	+ 'teeny' => true,
	3611	+ 'quicktags' => false,
4448	3612	)
4449	3613	);
4450	3614	}
4451	3615
4452	3616
4453		- /**
4454		- * Settings print callback.
4455		- *
4456		- * @param string $args Args (e.g., multisite admin mode).
4457		- * @return void
4458		- */
4459		- public function print_multiselect_auth_access_public_pages( $args = '' ) {
	3617	+ function print_multiselect_auth_access_public_pages( $args = '' ) {
4460	3618	// Get plugin option.
4461		- $option = 'access_public_pages';
	3619	+ $option = 'access_public_pages';
4462	3620	$auth_settings_option = $this->get_plugin_option( $option );
4463	3621	$auth_settings_option = is_array( $auth_settings_option ) ? $auth_settings_option : array();
4464	3622
4465	3623	$post_types = array_merge( array( 'page', 'post' ), get_post_types( array( '_builtin' => false ), 'names' ) );
		@@ -4465,31 +3623,23 @@
4465	3623	$post_types = array_merge( array( 'page', 'post' ), get_post_types( array( '_builtin' => false ), 'names' ) );
4466	3624	$post_types = is_array( $post_types ) ? $post_types : array();
4467	3625
4468	3626	// Print option elements.
4469		- ?>
4470		- <select id="auth_settings_<?php echo esc_attr( $option ); ?>" multiple="multiple" name="auth_settings[<?php echo esc_attr( $option ); ?>][]">
4471		- <optgroup label="<?php esc_attr_e( 'Home', 'authorizer' ); ?>">
4472		- <option value="home" <?php selected( in_array( 'home', $auth_settings_option, true ) ); ?>><?php esc_html_e( 'Home Page', 'authorizer' ); ?></option>
4473		- <option value="auth_public_404" <?php selected( in_array( 'auth_public_404', $auth_settings_option, true ) ); ?>><?php esc_html_e( 'Nonexistent (404) Pages', 'authorizer' ); ?></option>
	3627	+ ?><select id="auth_settings_<?php echo $option; ?>" multiple="multiple" name="auth_settings[<?php echo $option; ?>][]">
	3628	+ <optgroup label="<?php _e( 'Home', 'authorizer' ); ?>">
	3629	+ <option value="home" <?php echo in_array( 'home', $auth_settings_option ) ? 'selected="selected"' : ''; ?>><?php _e( 'Home Page', 'authorizer' ); ?></option>
	3630	+ <option value="auth_public_404" <?php echo in_array( 'auth_public_404', $auth_settings_option ) ? 'selected="selected"' : ''; ?>><?php _e( 'Nonexistent (404) Pages', 'authorizer' ); ?></option>
4474	3631	</optgroup>
4475		- <?php foreach ( $post_types as $post_type ) : ?>
4476		- <optgroup label="<?php echo esc_attr( ucfirst( $post_type ) ); ?>">
4477		- <?php
4478		- $pages = get_posts(
4479		- array(
4480		- 'post_type' => $post_type,
4481		- 'posts_per_page' => 1000, // phpcs:ignore WordPress.VIP.PostsPerPage.posts_per_page_posts_per_page
4482		- )
4483		- );
4484		- $pages = is_array( $pages ) ? $pages : array();
4485		- foreach ( $pages as $page ) :
4486		- ?>
4487		- <option value="<?php echo esc_attr( $page->ID ); ?>" <?php selected( in_array( strval( $page->ID ), $auth_settings_option, true ) ); ?>><?php echo esc_html( $page->post_title ); ?></option>
	3632	+ <?php foreach ( $post_types as $post_type ): ?>
	3633	+ <optgroup label="<?php echo ucfirst( $post_type ); ?>">
	3634	+ <?php $pages = get_posts( array( 'post_type' => $post_type, 'posts_per_page' => -1 ) ); ?>
	3635	+ <?php $pages = is_array( $pages ) ? $pages : array(); ?>
	3636	+ <?php foreach ( $pages as $page ): ?>
	3637	+ <option value="<?php echo $page->ID; ?>" <?php echo in_array( $page->ID, $auth_settings_option ) ? 'selected="selected"' : ''; ?>><?php echo $page->post_title; ?></option>
4488	3638	<?php endforeach; ?>
4489	3639	</optgroup>
4490	3640	<?php endforeach; ?>
4491		- <optgroup label="<?php esc_attr_e( 'Categories', 'authorizer' ); ?>">
	3641	+ <optgroup label="<?php _e( 'Categories', 'authorizer' ); ?>">
4492	3642	<?php
4493	3643	// If sitepress-multilingual-cms plugin is enabled, temporarily disable
4494	3644	// its terms_clauses filter since it conflicts with the category handling.
4495	3645	if ( array_key_exists( 'sitepress', $GLOBALS ) && is_object( $GLOBALS['sitepress'] ) ) {
		@@ -4498,155 +3648,107 @@
4498	3648	add_filter( 'terms_clauses', array( $GLOBALS['sitepress'], 'terms_clauses' ) );
4499	3649	} else {
4500	3650	$categories = get_categories( array( 'hide_empty' => false ) );
4501	3651	}
4502		- foreach ( $categories as $category ) :
4503		- ?>
4504		- <option value="<?php echo esc_attr( 'cat_' . $category->slug ); ?>" <?php selected( in_array( 'cat_' . $category->slug, $auth_settings_option, true ) ); ?>><?php echo esc_html( $category->name ); ?></option>
	3652	+ foreach ( $categories as $category ) : ?>
	3653	+ <option value="<?php echo 'cat_' . $category->slug; ?>" <?php echo in_array( 'cat_' . $category->slug, $auth_settings_option ) ? 'selected="selected"' : ''; ?>><?php echo $category->name; ?></option>
4505	3654	<?php endforeach; ?>
4506	3655	</optgroup>
4507		- </select>
4508		- <?php
	3656	+ </select><?php
4509	3657	}
4510	3658
4511	3659
4512		- /**
4513		- * Settings print callback.
4514		- *
4515		- * @param string $args Args (e.g., multisite admin mode).
4516		- * @return void
4517		- */
4518		- public function print_section_info_external( $args = '' ) {
4519		- ?>
4520		- <div id="section_info_external" class="section_info">
4521		- <p><?php esc_html_e( 'Enter your external server settings below.', 'authorizer' ); ?></p>
4522		- </div>
4523		- <?php
	3660	+ function print_section_info_external( $args = '' ) {
	3661	+ ?><div id="section_info_external" class="section_info">
	3662	+ <p><?php _e( 'Enter your external server settings below.', 'authorizer' ); ?></p>
	3663	+ </div><?php
4524	3664	}
4525	3665
4526	3666
4527		- /**
4528		- * Settings print callback.
4529		- *
4530		- * @param string $args Args (e.g., multisite admin mode).
4531		- * @return void
4532		- */
4533		- public function print_select_auth_access_default_role( $args = '' ) {
	3667	+ function get_admin_mode( $args ) {
	3668	+ if ( is_array( $args ) && array_key_exists( MULTISITE_ADMIN, $args ) && $args[MULTISITE_ADMIN] === true ) {
	3669	+ return MULTISITE_ADMIN;
	3670	+ } else {
	3671	+ return SINGLE_ADMIN;
	3672	+ }
	3673	+ }
	3674	+
	3675	+
	3676	+ function print_select_auth_access_default_role( $args = '' ) {
4534	3677	// Get plugin option.
4535		- $option = 'access_default_role';
	3678	+ $option = 'access_default_role';
4536	3679	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4537	3680
4538	3681	// Print option elements.
4539		- ?>
4540		- <select id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]">
	3682	+ ?><select id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]">
4541	3683	<?php wp_dropdown_roles( $auth_settings_option ); ?>
4542		- <option value=""<?php selected( '' === $auth_settings_option ); ?>><?php esc_html_e( '-- None --', 'authorizer' ); ?></option>
4543		- </select>
4544		- <?php
	3684	+ </select><?php
4545	3685	}
4546	3686
4547	3687
4548		- /**
4549		- * Settings print callback.
4550		- *
4551		- * @param string $args Args (e.g., multisite admin mode).
4552		- * @return void
4553		- */
4554		- public function print_checkbox_auth_external_google( $args = '' ) {
	3688	+ function print_checkbox_auth_external_google( $args = '' ) {
4555	3689	// Get plugin option.
4556		- $option = 'google';
	3690	+ $option = 'google';
4557	3691	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4558	3692
4559	3693	// Print option elements.
4560		- ?>
4561		- <input type="checkbox" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="1"<?php checked( 1 === intval( $auth_settings_option ) ); ?> /><label for="auth_settings_<?php echo esc_attr( $option ); ?>"><?php esc_html_e( 'Enable Google Logins', 'authorizer' ); ?></label>
4562		- <?php
	3694	+ ?><input type="checkbox" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="1"<?php checked( 1 == $auth_settings_option ); ?> /><label for="auth_settings_<?php echo $option; ?>"><?php _e( 'Enable Google Logins', 'authorizer' ); ?></label><?php
4563	3695	}
4564	3696
4565	3697
4566		- /**
4567		- * Settings print callback.
4568		- *
4569		- * @param string $args Args (e.g., multisite admin mode).
4570		- * @return void
4571		- */
4572		- public function print_text_google_clientid( $args = '' ) {
	3698	+ function print_text_google_clientid( $args = '' ) {
4573	3699	// Get plugin option.
4574		- $option = 'google_clientid';
	3700	+ $option = 'google_clientid';
4575	3701	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4576	3702
4577	3703	// Print option elements.
4578		- $site_url_parts = wp_parse_url( get_site_url() );
4579		- $site_url_host = $site_url_parts['scheme'] . '://' . $site_url_parts['host'] . '/';
4580		-
4581		- esc_html_e( "If you don't have a Google Client ID and Secret, generate them by following these instructions:", 'authorizer' );
4582		- ?>
	3704	+ $site_url_parts = parse_url( get_site_url() );
	3705	+ $site_url_host = $site_url_parts['scheme'] . '://' . $site_url_parts['host'] . '/';
	3706	+ ?><?php _e( "If you don't have a Google Client ID and Secret, generate them by following these instructions:", 'authorizer' ); ?>
4583	3707	<ol>
4584		- <li><?php echo wp_kses( __( 'Click <strong>Create a Project</strong> on the <a href="https://cloud.google.com/console" target="_blank">Google Developers Console</a>. You can name it whatever you want.', 'authorizer' ), $this->allowed_html ); ?></li>
4585		- <li><?php echo wp_kses( __( 'Within the project, navigate to <em>APIs and Auth</em> &gt; <em>Credentials</em>, then click <strong>Create New Client ID</strong> under OAuth. Use these settings:', 'authorizer' ), $this->allowed_html ); ?>
	3708	+ <li><?php _e( 'Click <strong>Create a Project</strong> on the <a href="https://cloud.google.com/console" target="_blank">Google Developers Console</a>. You can name it whatever you want.', 'authorizer' ); ?></li>
	3709	+ <li><?php _e( 'Within the project, navigate to <em>APIs and Auth</em> &gt; <em>Credentials</em>, then click <strong>Create New Client ID</strong> under OAuth. Use these settings:', 'authorizer' ); ?>
4586	3710	<ul>
4587		- <li><?php echo wp_kses( __( 'Application Type: <strong>Web application</strong>', 'authorizer' ), $this->allowed_html ); ?></li>
4588		- <li><?php esc_html_e( 'Authorized Javascript Origins:', 'authorizer' ); ?> <strong><?php echo esc_html( rtrim( $site_url_host, '/' ) ); ?></strong></li>
4589		- <li><?php echo wp_kses( __( 'Authorized Redirect URI: <em>none</em>', 'authorizer' ), $this->allowed_html ); ?></li>
	3711	+ <li><?php _e( 'Application Type: <strong>Web application</strong>', 'authorizer' ); ?></li>
	3712	+ <li><?php _e( 'Authorized Javascript Origins:', 'authorizer' ); ?> <strong><?php echo rtrim( $site_url_host, '/' ); ?></strong></li>
	3713	+ <li><?php _e( 'Authorized Redirect URI: <em>none</em>', 'authorizer' ); ?></li>
4590	3714	</ul>
4591	3715	</li>
4592		- <li><?php esc_html_e( 'Copy/paste your new Client ID/Secret pair into the fields below.', 'authorizer' ); ?></li>
4593		- <li><?php echo wp_kses( __( '<strong>Note</strong>: Navigate to <em>APIs and Auth</em> &gt; <em>Consent screen</em> to change the way the Google consent screen appears after a user has successfully entered their password, but before they are redirected back to WordPress.', 'authorizer' ), $this->allowed_html ); ?></li>
4594		- <li><?php echo wp_kses( __( 'Note: Google may have a more recent version of these instructions in their <a href="https://developers.google.com/identity/sign-in/web/devconsole-project" target="_blank">developer documentation</a>.', 'authorizer' ), $this->allowed_html ); ?></li>
	3716	+ <li><?php _e( 'Copy/paste your new Client ID/Secret pair into the fields below.', 'authorizer' ); ?></li>
	3717	+ <li><?php _e( '<strong>Note</strong>: Navigate to <em>APIs and Auth</em> &gt; <em>Consent screen</em> to change the way the Google consent screen appears after a user has successfully entered their password, but before they are redirected back to WordPress.', 'authorizer' ); ?></li>
	3718	+ <li><?php _e( 'Note: Google may have a more recent version of these instructions in their <a href="https://developers.google.com/identity/sign-in/web/devconsole-project" target="_blank">developer documentation</a>.', 'authorizer' ); ?></li>
4595	3719	</ol>
4596		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" style="width:560px;" />
4597		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: 1234567890123-kdjr85yt6vjr6d8g7dhr8g7d6durjf7g.apps.googleusercontent.com', 'authorizer' ); ?></label>
4598		- <?php
	3720	+ <input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" style="width:560px;" />
	3721	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: 1234567890123-kdjr85yt6vjr6d8g7dhr8g7d6durjf7g.apps.googleusercontent.com', 'authorizer'); ?></label><?php
4599	3722	}
4600	3723
4601	3724
4602		- /**
4603		- * Settings print callback.
4604		- *
4605		- * @param string $args Args (e.g., multisite admin mode).
4606		- * @return void
4607		- */
4608		- public function print_text_google_clientsecret( $args = '' ) {
	3725	+ function print_text_google_clientsecret( $args = '' ) {
4609	3726	// Get plugin option.
4610		- $option = 'google_clientsecret';
	3727	+ $option = 'google_clientsecret';
4611	3728	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4612	3729
4613	3730	// Print option elements.
4614		- ?>
4615		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" style="width:220px;" />
4616		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: sDNgX5_pr_5bly-frKmvp8jT', 'authorizer' ); ?></label>
4617		- <?php
	3731	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" style="width:220px;" />
	3732	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: sDNgX5_pr_5bly-frKmvp8jT', 'authorizer'); ?></label><?php
4618	3733	}
4619	3734
4620	3735
4621		- /**
4622		- * Settings print callback.
4623		- *
4624		- * @param string $args Args (e.g., multisite admin mode).
4625		- * @return void
4626		- */
4627		- public function print_text_google_hosteddomain( $args = '' ) {
	3736	+ function print_text_google_hosteddomain( $args = '' ) {
4628	3737	// Get plugin option.
4629		- $option = 'google_hosteddomain';
	3738	+ $option = 'google_hosteddomain';
4630	3739	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4631	3740
4632	3741	// Print option elements.
4633		- ?>
4634		- <textarea id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" placeholder="" style="width:220px;"><?php echo esc_html( $auth_settings_option ); ?></textarea>
4635		- <br /><small><?php esc_html_e( 'Restrict Google logins to a specific Google Apps hosted domain (for example, mycollege.edu). Leave blank to allow all Google sign-ins.', 'authorizer' ); ?><br /><?php esc_html_e( 'If restricting to multiple domains, add one domain per line.', 'authorizer' ); ?></small>
	3742	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" style="width:220px;" />
	3743	+ <br /><small><?php _e( 'Restrict Google logins to a specific Google Apps hosted domain (for example, mycollege.edu). Leave blank to allow all Google sign-ins.', 'authorizer' ); ?></small>
4636	3744	<?php
4637	3745	}
4638	3746
4639	3747
4640		- /**
4641		- * Settings print callback.
4642		- *
4643		- * @param string $args Args (e.g., multisite admin mode).
4644		- * @return void
4645		- */
4646		- public function print_checkbox_auth_external_cas( $args = '' ) {
	3748	+ function print_checkbox_auth_external_cas( $args = '' ) {
4647	3749	// Get plugin option.
4648		- $option = 'cas';
	3750	+ $option = 'cas';
4649	3751	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4650	3752
4651	3753	// Make sure php5-curl extension is installed on server.
4652	3754	$curl_installed_message = ! function_exists( 'curl_init' ) ? __( '<a href="http://www.php.net//manual/en/curl.installation.php" target="_blank" style="color: red;">PHP CURL extension</a> is not installed', 'authorizer' ) : '';
		@@ -4665,558 +3767,319 @@
4665	3767	')</span>';
4666	3768	}
4667	3769
4668	3770	// Print option elements.
4669		- ?>
4670		- <input type="checkbox" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="1"<?php checked( 1 === intval( $auth_settings_option ) ); ?> /><label for="auth_settings_<?php echo esc_attr( $option ); ?>"><?php esc_html_e( 'Enable CAS Logins', 'authorizer' ); ?></label> <?php echo wp_kses( $error_message, $this->allowed_html ); ?>
4671		- <?php
	3771	+ ?><input type="checkbox" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="1"<?php checked( 1 == $auth_settings_option ); ?> /><label for="auth_settings_<?php echo $option; ?>"><?php _e( 'Enable CAS Logins', 'authorizer' ); ?></label> <?php echo $error_message; ?><?php
4672	3772	}
4673	3773
4674	3774
4675		- /**
4676		- * Settings print callback.
4677		- *
4678		- * @param string $args Args (e.g., multisite admin mode).
4679		- * @return void
4680		- */
4681		- public function print_text_cas_custom_label( $args = '' ) {
	3775	+ function print_text_cas_custom_label( $args = '' ) {
4682	3776	// Get plugin option.
4683		- $option = 'cas_custom_label';
	3777	+ $option = 'cas_custom_label';
4684	3778	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4685	3779
4686	3780	// Print option elements.
4687		- esc_html_e( 'The button on the login page will read:', 'authorizer' );
4688		- ?>
4689		- <p><a class="button-primary button-large" style="padding: 3px 16px; height: 36px;"><span class="dashicons dashicons-lock" style="margin: 4px 4px 0 0;"></span> <strong><?php esc_html_e( 'Sign in with', 'authorizer' ); ?> </strong><input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="CAS" style="width: 100px;" /></a></p>
4690		- <?php
	3781	+ ?><?php _e( 'The button on the login page will read:', 'authorizer' ); ?><p><a class="button-primary button-large" style="padding: 3px 16px; height: 36px;"><span class="dashicons dashicons-lock" style="margin: 4px 4px 0 0;"></span> <strong><?php _e( 'Sign in with', 'authorizer' ); ?> </strong><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="CAS" style="width: 100px;" /></a></p><?php
4691	3782	}
4692	3783
4693	3784
4694		- /**
4695		- * Settings print callback.
4696		- *
4697		- * @param string $args Args (e.g., multisite admin mode).
4698		- * @return void
4699		- */
4700		- public function print_text_cas_host( $args = '' ) {
	3785	+ function print_text_cas_host( $args = '' ) {
4701	3786	// Get plugin option.
4702		- $option = 'cas_host';
	3787	+ $option = 'cas_host';
4703	3788	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4704	3789
4705	3790	// Print option elements.
4706		- ?>
4707		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" />
4708		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: authn.example.edu', 'authorizer' ); ?></label>
4709		- <?php
	3791	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" />
	3792	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: authn.example.edu', 'authorizer'); ?></label><?php
4710	3793	}
4711	3794
4712	3795
4713		- /**
4714		- * Settings print callback.
4715		- *
4716		- * @param string $args Args (e.g., multisite admin mode).
4717		- * @return void
4718		- */
4719		- public function print_text_cas_port( $args = '' ) {
	3796	+ function print_text_cas_port( $args = '' ) {
4720	3797	// Get plugin option.
4721		- $option = 'cas_port';
	3798	+ $option = 'cas_port';
4722	3799	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4723	3800
4724	3801	// Print option elements.
4725		- ?>
4726		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" style="width:50px;" />
4727		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: 443', 'authorizer' ); ?></label>
4728		- <?php
	3802	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" style="width:50px;" />
	3803	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: 443', 'authorizer'); ?></label><?php
4729	3804	}
4730	3805
4731	3806
4732		- /**
4733		- * Settings print callback.
4734		- *
4735		- * @param string $args Args (e.g., multisite admin mode).
4736		- * @return void
4737		- */
4738		- public function print_text_cas_path( $args = '' ) {
	3807	+ function print_text_cas_path( $args = '' ) {
4739	3808	// Get plugin option.
4740		- $option = 'cas_path';
	3809	+ $option = 'cas_path';
4741	3810	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4742	3811
4743	3812	// Print option elements.
4744		- ?>
4745		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" />
4746		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: /cas', 'authorizer' ); ?></label>
4747		- <?php
	3813	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" />
	3814	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: /cas', 'authorizer'); ?></label><?php
4748	3815	}
4749	3816
4750	3817
4751		- /**
4752		- * Settings print callback.
4753		- *
4754		- * @param string $args Args (e.g., multisite admin mode).
4755		- * @return void
4756		- */
4757		- public function print_select_cas_version( $args = '' ) {
	3818	+ function print_select_cas_version( $args = '' ) {
4758	3819	// Get plugin option.
4759		- $option = 'cas_version';
	3820	+ $option = 'cas_version';
4760	3821	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4761	3822
4762	3823	// Print option elements.
4763		- ?>
4764		- <select id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]">
	3824	+ ?><select id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]">
4765	3825	<option value="SAML_VERSION_1_1" <?php selected( $auth_settings_option, 'SAML_VERSION_1_1' ); ?>>SAML_VERSION_1_1</option>
4766	3826	<option value="CAS_VERSION_3_0" <?php selected( $auth_settings_option, 'CAS_VERSION_3_0' ); ?>>CAS_VERSION_3_0</option>
4767	3827	<option value="CAS_VERSION_2_0" <?php selected( $auth_settings_option, 'CAS_VERSION_2_0' ); ?>>CAS_VERSION_2_0</option>
4768	3828	<option value="CAS_VERSION_1_0" <?php selected( $auth_settings_option, 'CAS_VERSION_1_0' ); ?>>CAS_VERSION_1_0</option>
4769		- </select>
4770		- <?php
	3829	+ </select><?php
4771	3830	}
4772	3831
4773	3832
4774		- /**
4775		- * Settings print callback.
4776		- *
4777		- * @param string $args Args (e.g., multisite admin mode).
4778		- * @return void
4779		- */
4780		- public function print_text_cas_attr_email( $args = '' ) {
	3833	+ function print_text_cas_attr_email( $args = '' ) {
4781	3834	// Get plugin option.
4782		- $option = 'cas_attr_email';
	3835	+ $option = 'cas_attr_email';
4783	3836	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4784	3837
4785	3838	// Print option elements.
4786		- ?>
4787		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" />
4788		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: mail', 'authorizer' ); ?></label>
4789		- <br /><small><?php echo wp_kses( __( "Note: If your CAS server doesn't return an attribute containing an email, you can specify the @domain portion of the email address here, and the email address will be constructed from it and the username. For example, if user 'bob' logs in and his email address should be bob@example.edu, then enter <strong>@example.edu</strong> in this field.", 'authorizer' ), $this->allowed_html ); ?></small>
4790		- <?php
	3839	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" />
	3840	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: mail', 'authorizer'); ?></label>
	3841	+ <br /><small><?php _e( "Note: If your CAS server doesn't return an attribute containing an email, you can specify the @domain portion of the email address here, and the email address will be constructed from it and the username. For example, if user 'bob' logs in and his email address should be bob@example.edu, then enter <strong>@example.edu</strong> in this field.", 'authorizer' ); ?></small><?php
4791	3842	}
4792	3843
4793	3844
4794		- /**
4795		- * Settings print callback.
4796		- *
4797		- * @param string $args Args (e.g., multisite admin mode).
4798		- * @return void
4799		- */
4800		- public function print_text_cas_attr_first_name( $args = '' ) {
	3845	+ function print_text_cas_attr_first_name( $args = '' ) {
4801	3846	// Get plugin option.
4802		- $option = 'cas_attr_first_name';
	3847	+ $option = 'cas_attr_first_name';
4803	3848	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4804	3849
4805	3850	// Print option elements.
4806		- ?>
4807		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" />
4808		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: givenName', 'authorizer' ); ?></label>
4809		- <?php
	3851	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" />
	3852	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: givenName', 'authorizer'); ?></label><?php
4810	3853	}
4811	3854
4812	3855
4813		- /**
4814		- * Settings print callback.
4815		- *
4816		- * @param string $args Args (e.g., multisite admin mode).
4817		- * @return void
4818		- */
4819		- public function print_text_cas_attr_last_name( $args = '' ) {
	3856	+ function print_text_cas_attr_last_name( $args = '' ) {
4820	3857	// Get plugin option.
4821		- $option = 'cas_attr_last_name';
	3858	+ $option = 'cas_attr_last_name';
4822	3859	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4823	3860
4824	3861	// Print option elements.
4825		- ?>
4826		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" />
4827		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: sn', 'authorizer' ); ?></label>
4828		- <?php
	3862	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" />
	3863	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: sn', 'authorizer'); ?></label><?php
4829	3864	}
4830	3865
4831	3866
4832		- /**
4833		- * Settings print callback.
4834		- *
4835		- * @param string $args Args (e.g., multisite admin mode).
4836		- * @return void
4837		- */
4838		- public function print_checkbox_cas_attr_update_on_login( $args = '' ) {
	3867	+ function print_checkbox_cas_attr_update_on_login( $args = '' ) {
4839	3868	// Get plugin option.
4840		- $option = 'cas_attr_update_on_login';
	3869	+ $option = 'cas_attr_update_on_login';
4841	3870	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4842	3871
4843	3872	// Print option elements.
4844		- ?>
4845		- <input type="checkbox" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="1"<?php checked( 1 === intval( $auth_settings_option ) ); ?> /><label for="auth_settings_<?php echo esc_attr( $option ); ?>"><?php esc_html_e( 'Update first and last name fields on login (will overwrite any name the user has supplied in their profile)', 'authorizer' ); ?></label>
4846		- <?php
	3873	+ ?><input type="checkbox" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="1"<?php checked( 1 == $auth_settings_option ); ?> /><label for="auth_settings_<?php echo $option; ?>"><?php _e( 'Update first and last name fields on login (will overwrite any name the user has supplied in their profile)', 'authorizer' ); ?></label><?php
4847	3874	}
4848	3875
4849	3876
4850		- /**
4851		- * Settings print callback.
4852		- *
4853		- * @param string $args Args (e.g., multisite admin mode).
4854		- * @return void
4855		- */
4856		- public function print_checkbox_cas_auto_login( $args = '' ) {
	3877	+ function print_checkbox_cas_auto_login( $args = '' ) {
4857	3878	// Get plugin option.
4858		- $option = 'cas_auto_login';
	3879	+ $option = 'cas_auto_login';
4859	3880	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4860	3881
4861	3882	// Print option elements.
4862		- ?>
4863		- <input type="checkbox" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="1"<?php checked( 1 === intval( $auth_settings_option ) ); ?> /><label for="auth_settings_<?php echo esc_attr( $option ); ?>"><?php esc_html_e( "Immediately redirect to CAS login form if it's the only enabled external service and WordPress logins are hidden", 'authorizer' ); ?></label>
4864		- <p><small><?php esc_html_e( 'Note: This feature will only work if you have checked "Hide WordPress Logins" in Advanced settings, and if CAS is the only enabled service (i.e., no Google or LDAP). If you have enabled CAS Single Sign-On (SSO), and a user has already logged into CAS elsewhere, enabling this feature will allow automatic logins without any user interaction.', 'authorizer' ); ?></small></p>
4865		- <?php
	3883	+ ?><input type="checkbox" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="1"<?php checked( 1 == $auth_settings_option ); ?> /><label for="auth_settings_<?php echo $option; ?>"><?php _e( "Immediately redirect to CAS login form if it's the only enabled external service and WordPress logins are hidden", 'authorizer' ); ?></label>
	3884	+ <p><small><?php _e( 'Note: This feature will only work if you have checked "Hide WordPress Logins" in Advanced settings, and if CAS is the only enabled service (i.e., no Google or LDAP). If you have enabled CAS Single Sign-On (SSO), and a user has already logged into CAS elsewhere, enabling this feature will allow automatic logins without any user interaction.', 'authorizer' ); ?></small></p><?php
4866	3885	}
4867	3886
4868	3887
4869		- /**
4870		- * Settings print callback.
4871		- *
4872		- * @param string $args Args (e.g., multisite admin mode).
4873		- * @return void
4874		- */
4875		- public function print_checkbox_cas_link_on_username( $args = '' ) {
	3888	+ function print_checkbox_auth_external_ldap( $args = '' ) {
4876	3889	// Get plugin option.
4877		- $option = 'cas_link_on_username';
	3890	+ $option = 'ldap';
4878	3891	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4879	3892
4880		- // Print option elements.
4881		- ?>
4882		- <input type="checkbox" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="1"<?php checked( 1 === intval( $auth_settings_option ) ); ?> /><label for="auth_settings_<?php echo esc_attr( $option ); ?>"><?php esc_html_e( "Link CAS accounts to WordPress accounts by their username (leave this off to link by email address)", 'authorizer' ); ?></label>
4883		- <p><small><?php esc_html_e( "Note: The default (and most secure) behavior is to associate WordPress accounts with CAS accounts by the email they have in common. However, some uncommon CAS server configurations don't contain email addresses for users. Enable this option if your CAS server doesn't have an attribute containing an email, or if you have WordPress accounts that don't have emails.", 'authorizer' ); ?></small></p>
4884		- <?php
4885		- }
4886		-
4887		-
4888		- /**
4889		- * Settings print callback.
4890		- *
4891		- * @param string $args Args (e.g., multisite admin mode).
4892		- * @return void
4893		- */
4894		- public function print_checkbox_auth_external_ldap( $args = '' ) {
4895		- // Get plugin option.
4896		- $option = 'ldap';
4897		- $auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4898		-
4899	3893	// Make sure php5-ldap extension is installed on server.
4900	3894	$ldap_installed_message = ! function_exists( 'ldap_connect' ) ? '<span style="color: red;">(' . __( 'Warning: <a href="http://www.php.net/manual/en/ldap.installation.php" target="_blank" style="color: red;">PHP LDAP extension</a> is <strong>not</strong> installed', 'authorizer' ) . ')</span>' : '';
4901	3895
4902	3896	// Print option elements.
4903		- ?>
4904		- <input type="checkbox" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="1"<?php checked( 1 === intval( $auth_settings_option ) ); ?> /><label for="auth_settings_<?php echo esc_attr( $option ); ?>"><?php esc_html_e( 'Enable LDAP Logins', 'authorizer' ); ?></label> <?php echo wp_kses( $ldap_installed_message, $this->allowed_html ); ?>
4905		- <?php
	3897	+ ?><input type="checkbox" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="1"<?php checked( 1 == $auth_settings_option ); ?> /><label for="auth_settings_<?php echo $option; ?>"><?php _e( 'Enable LDAP Logins', 'authorizer' ); ?></label> <?php echo $ldap_installed_message; ?><?php
4906	3898	}
4907	3899
4908	3900
4909		- /**
4910		- * Settings print callback.
4911		- *
4912		- * @param string $args Args (e.g., multisite admin mode).
4913		- * @return void
4914		- */
4915		- public function print_text_ldap_host( $args = '' ) {
	3901	+ function print_text_ldap_host( $args = '' ) {
4916	3902	// Get plugin option.
4917		- $option = 'ldap_host';
	3903	+ $option = 'ldap_host';
4918	3904	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4919	3905
4920	3906	// Print option elements.
4921		- ?>
4922		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" style="width:330px;" />
4923		- <br /><small><?php esc_html_e( 'Specify either a hostname (for example, ldap.example.edu) or a full LDAP URI (for example, ldaps://ldap.example.edu:636).', 'authorizer' ); ?></small>
4924		- <?php
	3907	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" style="width:330px;" />
	3908	+ <br /><small><?php _e( "Specify either a hostname (for example, ldap.example.edu) or a full LDAP URI (for example, ldaps://ldap.example.edu:636).", 'authorizer' ); ?></small><?php
4925	3909	}
4926	3910
4927	3911
4928		- /**
4929		- * Settings print callback.
4930		- *
4931		- * @param string $args Args (e.g., multisite admin mode).
4932		- * @return void
4933		- */
4934		- public function print_text_ldap_port( $args = '' ) {
	3912	+ function print_text_ldap_port( $args = '' ) {
4935	3913	// Get plugin option.
4936		- $option = 'ldap_port';
	3914	+ $option = 'ldap_port';
4937	3915	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4938	3916
4939	3917	// Print option elements.
4940		- ?>
4941		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" style="width:50px;" />
4942		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: 389', 'authorizer' ); ?></label>
4943		- <br /><small><?php esc_html_e( 'If a full LDAP URI (ldaps://hostname:port) is specified above, this field is ignored.', 'authorizer' ); ?></small>
4944		- <?php
	3918	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" style="width:50px;" />
	3919	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: 389', 'authorizer' ); ?></label>
	3920	+ <br /><small><?php _e( "If a full LDAP URI (ldaps://hostname:port) is specified above, this field is ignored.", 'authorizer' ); ?></small><?php
4945	3921	}
4946	3922
4947	3923
4948		- /**
4949		- * Settings print callback.
4950		- *
4951		- * @param string $args Args (e.g., multisite admin mode).
4952		- * @return void
4953		- */
4954		- public function print_checkbox_ldap_tls( $args = '' ) {
	3924	+ function print_checkbox_ldap_tls( $args = '' ) {
4955	3925	// Get plugin option.
4956		- $option = 'ldap_tls';
	3926	+ $option = 'ldap_tls';
4957	3927	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4958	3928
4959	3929	// Print option elements.
4960		- ?>
4961		- <input type="checkbox" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="1"<?php checked( 1 === intval( $auth_settings_option ) ); ?> /><label for="auth_settings_<?php echo esc_attr( $option ); ?>"><?php esc_html_e( 'Use TLS', 'authorizer' ); ?></label>
4962		- <br /><small><?php esc_html_e( 'If ldaps is used, this should be unchecked', 'authorizer' ); ?></small>
4963		- <?php
	3930	+ ?><input type="checkbox" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="1"<?php checked( 1 == $auth_settings_option ); ?> /><label for="auth_settings_<?php echo $option; ?>"><?php _e( 'Use TLS', 'authorizer' ); ?></label><?php
4964	3931	}
4965	3932
4966	3933
4967		- /**
4968		- * Settings print callback.
4969		- *
4970		- * @param string $args Args (e.g., multisite admin mode).
4971		- * @return void
4972		- */
4973		- public function print_text_ldap_search_base( $args = '' ) {
	3934	+ function print_text_ldap_search_base( $args = '' ) {
4974	3935	// Get plugin option.
4975		- $option = 'ldap_search_base';
	3936	+ $option = 'ldap_search_base';
4976	3937	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4977	3938
4978	3939	// Print option elements.
4979		- ?>
4980		- <textarea id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" placeholder="" style="width:330px;"><?php echo esc_attr( $auth_settings_option ); ?></textarea>
4981		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: ou=people,dc=example,dc=edu', 'authorizer' ); ?></label>
4982		- <br /><small><?php esc_html_e( 'If you have multiple search bases, separate them by newlines (one per line).', 'authorizer' ); ?></small>
4983		- <?php
	3940	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" style="width:330px;" />
	3941	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: ou=people,dc=example,dc=edu', 'authorizer'); ?></label><?php
4984	3942	}
4985	3943
4986	3944
4987		- /**
4988		- * Settings print callback.
4989		- *
4990		- * @param string $args Args (e.g., multisite admin mode).
4991		- * @return void
4992		- */
4993		- public function print_text_ldap_uid( $args = '' ) {
	3945	+ function print_text_ldap_uid( $args = '' ) {
4994	3946	// Get plugin option.
4995		- $option = 'ldap_uid';
	3947	+ $option = 'ldap_uid';
4996	3948	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4997	3949
4998	3950	// Print option elements.
4999		- ?>
5000		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" style="width:80px;" />
5001		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: uid', 'authorizer' ); ?></label>
5002		- <?php
	3951	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" style="width:80px;" />
	3952	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: uid', 'authorizer' ); ?></label><?php
5003	3953	}
5004	3954
5005	3955
5006		- /**
5007		- * Settings print callback.
5008		- *
5009		- * @param string $args Args (e.g., multisite admin mode).
5010		- * @return void
5011		- */
5012		- public function print_text_ldap_attr_email( $args = '' ) {
	3956	+ function print_text_ldap_attr_email( $args = '' ) {
5013	3957	// Get plugin option.
5014		- $option = 'ldap_attr_email';
	3958	+ $option = 'ldap_attr_email';
5015	3959	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5016	3960
5017	3961	// Print option elements.
5018		- ?>
5019		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" />
5020		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: mail', 'authorizer' ); ?></label>
5021		- <br /><small><?php echo wp_kses( __( "Note: If your LDAP server doesn't return an attribute containing an email, you can specify the @domain portion of the email address here, and the email address will be constructed from it and the username. For example, if user 'bob' logs in and his email address should be bob@example.edu, then enter <strong>@example.edu</strong> in this field.", 'authorizer' ), $this->allowed_html ); ?></small>
5022		- <?php
	3962	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" />
	3963	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: mail', 'authorizer' ); ?></label>
	3964	+ <br /><small><?php _e( "Note: If your LDAP server doesn't return an attribute containing an email, you can specify the @domain portion of the email address here, and the email address will be constructed from it and the username. For example, if user 'bob' logs in and his email address should be bob@example.edu, then enter <strong>@example.edu</strong> in this field.", 'authorizer' ); ?></small><?php
5023	3965	}
5024	3966
5025	3967
5026		- /**
5027		- * Settings print callback.
5028		- *
5029		- * @param string $args Args (e.g., multisite admin mode).
5030		- * @return void
5031		- */
5032		- public function print_text_ldap_user( $args = '' ) {
	3968	+ function print_text_ldap_user( $args = '' ) {
5033	3969	// Get plugin option.
5034		- $option = 'ldap_user';
	3970	+ $option = 'ldap_user';
5035	3971	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5036	3972
5037	3973	// Print option elements.
5038		- ?>
5039		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" style="width:330px;" />
5040		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: cn=directory-user,ou=specials,dc=example,dc=edu', 'authorizer' ); ?></label>
5041		- <?php
	3974	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" style="width:330px;" />
	3975	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: cn=directory-user,ou=specials,dc=example,dc=edu', 'authorizer' ); ?></label><?php
5042	3976	}
5043	3977
5044	3978
5045		- /**
5046		- * Settings print callback.
5047		- *
5048		- * @param string $args Args (e.g., multisite admin mode).
5049		- * @return void
5050		- */
5051		- public function print_password_ldap_password( $args = '' ) {
	3979	+ function print_password_ldap_password( $args = '' ) {
5052	3980	// Get plugin option.
5053		- $option = 'ldap_password';
	3981	+ $option = 'ldap_password';
5054	3982	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5055	3983
5056	3984	// Print option elements.
5057		- ?>
5058		- <input type="password" id="garbage_to_stop_autofill" name="garbage" value="" autocomplete="off" style="display:none;" />
5059		- <input type="password" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $this->decrypt( $auth_settings_option ) ); ?>" autocomplete="new-password" />
5060		- <?php
	3985	+ ?><input type="password" id="garbage_to_stop_autofill" name="garbage" value="" autocomplete="off" style="display:none;" />
	3986	+ <input type="password" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $this->decrypt( base64_decode( $auth_settings_option ) ); ?>" autocomplete="off" /><?php
5061	3987	}
5062	3988
5063	3989
5064		- /**
5065		- * Settings print callback.
5066		- *
5067		- * @param string $args Args (e.g., multisite admin mode).
5068		- * @return void
5069		- */
5070		- public function print_text_ldap_lostpassword_url( $args = '' ) {
	3990	+ function print_text_ldap_lostpassword_url( $args = '' ) {
5071	3991	// Get plugin option.
5072		- $option = 'ldap_lostpassword_url';
	3992	+ $option = 'ldap_lostpassword_url';
5073	3993	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5074	3994
5075	3995	// Print option elements.
5076		- ?>
5077		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" style="width: 400px;" />
5078		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: https://myschool.example.edu:8888/am-forgot-password', 'authorizer' ); ?></label>
5079		- <?php
	3996	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" style="width: 400px;" />
	3997	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: https://myschool.example.edu:8888/am-forgot-password', 'authorizer' ); ?></label><?php
5080	3998	}
5081	3999
5082	4000
5083		- /**
5084		- * Settings print callback.
5085		- *
5086		- * @param string $args Args (e.g., multisite admin mode).
5087		- * @return void
5088		- */
5089		- public function print_text_ldap_attr_first_name( $args = '' ) {
	4001	+ function print_text_ldap_attr_first_name( $args = '' ) {
5090	4002	// Get plugin option.
5091		- $option = 'ldap_attr_first_name';
	4003	+ $option = 'ldap_attr_first_name';
5092	4004	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5093	4005
5094	4006	// Print option elements.
5095		- ?>
5096		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" />
5097		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: givenname', 'authorizer' ); ?></label>
5098		- <?php
	4007	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" />
	4008	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: givenname', 'authorizer' ); ?></label><?php
5099	4009	}
5100	4010
5101	4011
5102		- /**
5103		- * Settings print callback.
5104		- *
5105		- * @param string $args Args (e.g., multisite admin mode).
5106		- * @return void
5107		- */
5108		- public function print_text_ldap_attr_last_name( $args = '' ) {
	4012	+ function print_text_ldap_attr_last_name( $args = '' ) {
5109	4013	// Get plugin option.
5110		- $option = 'ldap_attr_last_name';
	4014	+ $option = 'ldap_attr_last_name';
5111	4015	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5112	4016
5113	4017	// Print option elements.
5114		- ?>
5115		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" />
5116		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: sn', 'authorizer' ); ?></label>
5117		- <?php
	4018	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" />
	4019	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: sn', 'authorizer' ); ?></label><?php
5118	4020	}
5119	4021
5120	4022
5121		- /**
5122		- * Settings print callback.
5123		- *
5124		- * @param string $args Args (e.g., multisite admin mode).
5125		- * @return void
5126		- */
5127		- public function print_checkbox_ldap_attr_update_on_login( $args = '' ) {
	4023	+ function print_checkbox_ldap_attr_update_on_login( $args = '' ) {
5128	4024	// Get plugin option.
5129		- $option = 'ldap_attr_update_on_login';
	4025	+ $option = 'ldap_attr_update_on_login';
5130	4026	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5131	4027
5132	4028	// Print option elements.
5133		- ?>
5134		- <input type="checkbox" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="1"<?php checked( 1 === intval( $auth_settings_option ) ); ?> /><label for="auth_settings_<?php echo esc_attr( $option ); ?>"><?php esc_html_e( 'Update first and last name fields on login (will overwrite any name the user has supplied in their profile)', 'authorizer' ); ?></label>
5135		- <?php
	4029	+ ?><input type="checkbox" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="1"<?php checked( 1 == $auth_settings_option ); ?> /><label for="auth_settings_<?php echo $option; ?>"><?php _e( 'Update first and last name fields on login (will overwrite any name the user has supplied in their profile)', 'authorizer' ); ?></label><?php
5136	4030	}
5137	4031
5138	4032
5139		- /**
5140		- * Settings print callback.
5141		- *
5142		- * @param string $args Args (e.g., multisite admin mode).
5143		- * @return void
5144		- */
5145		- public function print_section_info_advanced( $args = '' ) {
5146		- ?>
5147		- <div id="section_info_advanced" class="section_info">
5148		- <p><?php esc_html_e( 'You may optionally specify some advanced settings below.', 'authorizer' ); ?></p>
5149		- </div>
5150		- <?php
	4033	+ function print_section_info_advanced( $args = '' ) {
	4034	+ ?><div id="section_info_advanced" class="section_info">
	4035	+ <p><?php _e( 'You may optionally specify some advanced settings below.', 'authorizer' ); ?></p>
	4036	+ </div><?php
5151	4037	}
5152	4038
5153	4039
5154		- /**
5155		- * Settings print callback.
5156		- *
5157		- * @param string $args Args (e.g., multisite admin mode).
5158		- * @return void
5159		- */
5160		- public function print_text_auth_advanced_lockouts( $args = '' ) {
	4040	+ function print_text_auth_advanced_lockouts( $args = '' ) {
5161	4041	// Get plugin option.
5162		- $option = 'advanced_lockouts';
	4042	+ $option = 'advanced_lockouts';
5163	4043	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5164	4044
5165	4045	// Print option elements.
5166		- esc_html_e( 'After', 'authorizer' );
5167		- ?>
5168		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>_attempts_1" name="auth_settings[<?php echo esc_attr( $option ); ?>][attempts_1]" value="<?php echo esc_attr( $auth_settings_option['attempts_1'] ); ?>" placeholder="10" style="width:30px;" />
5169		- <?php esc_html_e( 'invalid password attempts, delay further attempts on that user for', 'authorizer' ); ?>
5170		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>_duration_1" name="auth_settings[<?php echo esc_attr( $option ); ?>][duration_1]" value="<?php echo esc_attr( $auth_settings_option['duration_1'] ); ?>" placeholder="1" style="width:30px;" />
5171		- <?php esc_html_e( 'minute(s).', 'authorizer' ); ?>
	4046	+ ?><?php _e( 'After', 'authorizer' ); ?>
	4047	+ <input type="text" id="auth_settings_<?php echo $option; ?>_attempts_1" name="auth_settings[<?php echo $option; ?>][attempts_1]" value="<?php echo $auth_settings_option['attempts_1']; ?>" placeholder="10" style="width:30px;" />
	4048	+ <?php _e( 'invalid password attempts, delay further attempts on that user for', 'authorizer' ); ?>
	4049	+ <input type="text" id="auth_settings_<?php echo $option; ?>_duration_1" name="auth_settings[<?php echo $option; ?>][duration_1]" value="<?php echo $auth_settings_option['duration_1']; ?>" placeholder="1" style="width:30px;" />
	4050	+ <?php _e( 'minute(s).', 'authorizer' ); ?>
5172	4051	<br />
5173		- <?php esc_html_e( 'After', 'authorizer' ); ?>
5174		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>_attempts_2" name="auth_settings[<?php echo esc_attr( $option ); ?>][attempts_2]" value="<?php echo esc_attr( $auth_settings_option['attempts_2'] ); ?>" placeholder="10" style="width:30px;" />
5175		- <?php esc_html_e( 'more invalid attempts, increase the delay to', 'authorizer' ); ?>
5176		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>_duration_2" name="auth_settings[<?php echo esc_attr( $option ); ?>][duration_2]" value="<?php echo esc_attr( $auth_settings_option['duration_2'] ); ?>" placeholder="10" style="width:30px;" />
5177		- <?php esc_html_e( 'minutes.', 'authorizer' ); ?>
	4052	+ <?php _e( 'After', 'authorizer' ); ?>
	4053	+ <input type="text" id="auth_settings_<?php echo $option; ?>_attempts_2" name="auth_settings[<?php echo $option; ?>][attempts_2]" value="<?php echo $auth_settings_option['attempts_2']; ?>" placeholder="10" style="width:30px;" />
	4054	+ <?php _e( 'more invalid attempts, increase the delay to', 'authorizer' ); ?>
	4055	+ <input type="text" id="auth_settings_<?php echo $option; ?>_duration_2" name="auth_settings[<?php echo $option; ?>][duration_2]" value="<?php echo $auth_settings_option['duration_2']; ?>" placeholder="10" style="width:30px;" />
	4056	+ <?php _e( 'minutes.', 'authorizer' ); ?>
5178	4057	<br />
5179		- <?php esc_html_e( 'Reset the delays after', 'authorizer' ); ?>
5180		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>_reset_duration" name="auth_settings[<?php echo esc_attr( $option ); ?>][reset_duration]" value="<?php echo esc_attr( $auth_settings_option['reset_duration'] ); ?>" placeholder="240" style="width:40px;" />
5181		- <?php esc_html_e( 'minutes with no invalid attempts.', 'authorizer' ); ?>
5182		- <?php
	4058	+ <?php _e( 'Reset the delays after', 'authorizer' ); ?>
	4059	+ <input type="text" id="auth_settings_<?php echo $option; ?>_reset_duration" name="auth_settings[<?php echo $option; ?>][reset_duration]" value="<?php echo $auth_settings_option['reset_duration']; ?>" placeholder="240" style="width:40px;" />
	4060	+ <?php _e( 'minutes with no invalid attempts.', 'authorizer' ); ?><?php
5183	4061	}
5184	4062
5185	4063
5186		- /**
5187		- * Settings print callback.
5188		- *
5189		- * @param string $args Args (e.g., multisite admin mode).
5190		- * @return void
5191		- */
5192		- public function print_checkbox_auth_advanced_hide_wp_login( $args = '' ) {
	4064	+ function print_checkbox_auth_advanced_hide_wp_login( $args = '' ) {
5193	4065	// Get plugin option.
5194		- $option = 'advanced_hide_wp_login';
	4066	+ $option = 'advanced_hide_wp_login';
5195	4067	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5196	4068
5197	4069	// Print option elements.
5198		- ?>
5199		- <input type="checkbox" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="1"<?php checked( 1 === intval( $auth_settings_option ) ); ?> /><label for="auth_settings_<?php echo esc_attr( $option ); ?>"><?php esc_html_e( 'Hide WordPress Logins', 'authorizer' ); ?></label>
5200		- <p><small><?php esc_html_e( 'Note: You can always access the WordPress logins by adding external=wordpress to the wp-login URL, like so:', 'authorizer' ); ?><br /><a href="<?php echo esc_attr( wp_login_url() ); ?>?external=wordpress" target="_blank"><?php echo esc_html( wp_login_url() ); ?>?external=wordpress</a>.</p>
5201		- <?php
	4070	+ ?><input type="checkbox" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="1"<?php checked( 1 == $auth_settings_option ); ?> /><label for="auth_settings_<?php echo $option; ?>"><?php _e( 'Hide WordPress Logins', 'authorizer' ); ?></label>
	4071	+ <p><small><?php _e( 'Note: You can always access the WordPress logins by adding external=wordpress to the wp-login URL, like so:', 'authorizer' ); ?><br /><a href="<?php echo wp_login_url(); ?>?external=wordpress" target="_blank"><?php echo wp_login_url(); ?>?external=wordpress</a>.</p><?php
5202	4072	}
5203	4073
5204	4074
5205		- /**
5206		- * Settings print callback.
5207		- *
5208		- * @param string $args Args (e.g., multisite admin mode).
5209		- * @return void
5210		- */
5211		- public function print_radio_auth_advanced_branding( $args = '' ) {
	4075	+ function print_radio_auth_advanced_branding( $args = '' ) {
5212	4076	// Get plugin option.
5213		- $option = 'advanced_branding';
	4077	+ $option = 'advanced_branding';
5214	4078	$auth_settings_option = $this->get_plugin_option( $option );
5215	4079
5216	4080	// Print option elements.
5217		- ?>
5218		- <input type="radio" id="radio_auth_settings_<?php echo esc_attr( $option ); ?>_default" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="default"<?php checked( 'default' === $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo esc_attr( $option ); ?>_default"><?php esc_html_e( 'Default WordPress login screen', 'authorizer' ); ?></label><br />
	4081	+ ?><input type="radio" id="radio_auth_settings_<?php echo $option; ?>_default" name="auth_settings[<?php echo $option; ?>]" value="default"<?php checked( 'default' == $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo $option; ?>_default"><?php _e( 'Default WordPress login screen', 'authorizer' ); ?></label><br />
5219	4082	<?php
5220	4083
5221	4084	/**
5222	4085	* Developers can use the `authorizer_add_branding_option` filter
		@@ -5221,8 +4084,9 @@
5221	4084	/**
5222	4085	* Developers can use the `authorizer_add_branding_option` filter
5223	4086	* to add a radio button for "Custom WordPress login branding"
5224	4087	* under the "Advanced" tab in Authorizer options. Example:
	4088	+ *
5225	4089	* function my_authorizer_add_branding_option( $branding_options ) {
5226	4090	* $new_branding_option = array(
5227	4091	* 'value' => 'your_brand'
5228	4092	* 'description' => 'Custom Your Brand Login Screen',
		@@ -5236,274 +4100,133 @@
5236	4100	*/
5237	4101	$branding_options = array();
5238	4102	$branding_options = apply_filters( 'authorizer_add_branding_option', $branding_options );
5239	4103	foreach ( $branding_options as $branding_option ) {
5240		- // Make sure the custom brands have the required values.
	4104	+ // Make sure the custom brands have the required values
5241	4105	if ( ! ( is_array( $branding_option ) && array_key_exists( 'value', $branding_option ) && array_key_exists( 'description', $branding_option ) ) ) {
5242	4106	continue;
5243	4107	}
5244		- ?>
5245		- <input type="radio" id="radio_auth_settings_<?php echo esc_attr( $option ); ?>_<?php echo esc_attr( sanitize_title( $branding_option['value'] ) ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $branding_option['value'] ); ?>"<?php checked( $branding_option['value'] === $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo esc_attr( $option ); ?>_<?php echo esc_attr( sanitize_title( $branding_option['value'] ) ); ?>"><?php echo esc_html( $branding_option['description'] ); ?></label><br />
5246		- <?php
	4108	+ ?><input type="radio" id="radio_auth_settings_<?php echo $option; ?>_<?php echo sanitize_title( $branding_option['value'] ); ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $branding_option['value']; ?>"<?php checked( $branding_option['value'] == $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo $option; ?>_<?php echo sanitize_title( $branding_option['value'] ); ?>"><?php echo $branding_option['description']; ?></label><br /><?php
5247	4109	}
5248	4110
5249	4111	// Print message about adding custom brands if there are none.
5250	4112	if ( count( $branding_options ) === 0 ) {
5251		- ?>
5252		- <p><em><?php echo wp_kses( __( '<strong>Note for theme developers</strong>: Add more options here by using the `authorizer_add_branding_option` filter in your theme. You can see an example theme that implements this filter in the plugin directory under sample-theme-add-branding.', 'authorizer' ), $this->allowed_html ); ?></em></p>
5253		- <?php
	4113	+ ?><p><em><?php _e( '<strong>Note for theme developers</strong>: Add more options here by using the `authorizer_add_branding_option` filter in your theme. You can see an example theme that implements this filter in the plugin directory under sample-theme-add-branding.', 'authorizer' ); ?></em></p><?php
5254	4114	}
5255	4115	}
5256	4116
5257	4117
5258		- /**
5259		- * Settings print callback.
5260		- *
5261		- * @param string $args Args (e.g., multisite admin mode).
5262		- * @return void
5263		- */
5264		- public function print_radio_auth_advanced_admin_menu( $args = '' ) {
	4118	+ function print_radio_auth_advanced_admin_menu( $args = '' ) {
5265	4119	// Get plugin option.
5266		- $option = 'advanced_admin_menu';
	4120	+ $option = 'advanced_admin_menu';
5267	4121	$auth_settings_option = $this->get_plugin_option( $option );
5268	4122
5269	4123	// Print option elements.
5270		- ?>
5271		- <input type="radio" id="radio_auth_settings_<?php echo esc_attr( $option ); ?>_settings" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="settings"<?php checked( 'settings' === $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo esc_attr( $option ); ?>_settings"><?php esc_html_e( 'Show in Settings menu', 'authorizer' ); ?></label><br />
5272		- <input type="radio" id="radio_auth_settings_<?php echo esc_attr( $option ); ?>_top" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="top"<?php checked( 'top' === $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo esc_attr( $option ); ?>_top"><?php esc_html_e( 'Show in sidebar (top level)', 'authorizer' ); ?></label><br />
5273		- <?php
	4124	+ ?><input type="radio" id="radio_auth_settings_<?php echo $option; ?>_settings" name="auth_settings[<?php echo $option; ?>]" value="settings"<?php checked( 'settings' == $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo $option; ?>_settings"><?php _e( 'Show in Settings menu', 'authorizer' ); ?></label><br />
	4125	+ <input type="radio" id="radio_auth_settings_<?php echo $option; ?>_top" name="auth_settings[<?php echo $option; ?>]" value="top"<?php checked( 'top' == $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo $option; ?>_top"><?php _e( 'Show in sidebar (top level)', 'authorizer' ); ?></label><br /><?php
5274	4126
5275	4127	}
5276	4128
5277	4129
5278		- /**
5279		- * Settings print callback.
5280		- *
5281		- * @param string $args Args (e.g., multisite admin mode).
5282		- * @return void
5283		- */
5284		- public function print_select_auth_advanced_usermeta( $args = '' ) {
	4130	+ function print_select_auth_advanced_usermeta( $args = '' ) {
5285	4131	// Get plugin option.
5286		- $option = 'advanced_usermeta';
	4132	+ $option = 'advanced_usermeta';
5287	4133	$auth_settings_option = $this->get_plugin_option( $option );
5288	4134
5289	4135	// Print option elements.
5290		- ?>
5291		- <select id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]">
5292		- <option value=""><?php esc_html_e( '-- None --', 'authorizer' ); ?></option>
5293		- <?php
5294		- if ( class_exists( 'acf' ) ) :
	4136	+ ?><select id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]">
	4137	+ <option value=""><?php _e( '-- None --', 'authorizer' ); ?></option>
	4138	+ <?php if ( class_exists( 'acf' ) ) :
5295	4139	// Get ACF 5 fields. Note: it would be much easier to use `get_field_objects()`
5296	4140	// or `get_field_objects( 'user_' . get_current_user_id() )`, but neither will
5297	4141	// list fields that have never been given values for users (i.e., new ACF
5298	4142	// fields). Therefore we fall back on finding any ACF fields applied to users
5299	4143	// (user_role or user_form location rules in the field group definition).
5300		- $fields = array();
	4144	+ $fields = array();
5301	4145	$acf_field_group_ids = array();
5302		- $acf_field_groups = new WP_Query(
5303		- array(
5304		- 'post_type' => 'acf-field-group',
5305		- )
5306		- );
	4146	+ $acf_field_groups = new WP_Query( array(
	4147	+ 'post_type' => 'acf-field-group',
	4148	+ ));
5307	4149	while ( $acf_field_groups->have_posts() ) : $acf_field_groups->the_post();
5308	4150	if ( strpos( get_the_content(), 's:5:"param";s:9:"user_role"' ) !== false || strpos( get_the_content(), 's:5:"param";s:9:"user_form"' ) !== false ) :
5309	4151	array_push( $acf_field_group_ids, get_the_ID() );
5310	4152	endif;
5311		- endwhile;
5312		- wp_reset_postdata();
	4153	+ endwhile; wp_reset_postdata();
5313	4154	foreach ( $acf_field_group_ids as $acf_field_group_id ) :
5314		- $acf_fields = new WP_Query(
5315		- array(
5316		- 'post_type' => 'acf-field',
5317		- 'post_parent' => $acf_field_group_id,
5318		- )
5319		- );
	4155	+ $acf_fields = new WP_Query( array(
	4156	+ 'post_type' => 'acf-field',
	4157	+ 'post_parent' => $acf_field_group_id,
	4158	+ ));
5320	4159	while ( $acf_fields->have_posts() ) : $acf_fields->the_post();
5321	4160	global $post;
5322		- $fields[ $post->post_name ] = get_field_object( $post->post_name );
5323		- endwhile;
5324		- wp_reset_postdata();
	4161	+ $fields[$post->post_name] = get_field_object( $post->post_name );
	4162	+ endwhile; wp_reset_postdata();
5325	4163	endforeach;
5326	4164	// Get ACF 4 fields.
5327		- $acf4_field_groups = new WP_Query(
5328		- array(
5329		- 'post_type' => 'acf',
5330		- )
5331		- );
	4165	+ $acf4_field_groups = new WP_Query( array(
	4166	+ 'post_type' => 'acf',
	4167	+ ));
5332	4168	while ( $acf4_field_groups->have_posts() ) : $acf4_field_groups->the_post();
5333	4169	$field_group_rules = get_post_meta( get_the_ID(), 'rule', true );
5334		- if ( is_array( $field_group_rules ) && array_key_exists( 'param', $field_group_rules ) && 'ef_user' === $field_group_rules['param'] ) :
	4170	+ if ( is_array( $field_group_rules ) && array_key_exists( 'param', $field_group_rules ) && $field_group_rules['param'] === 'ef_user' ) :
5335	4171	$acf4_fields = get_post_custom( get_the_ID() );
5336	4172	foreach ( $acf4_fields as $meta_key => $meta_value ) :
5337	4173	if ( strpos( $meta_key, 'field_' ) === 0 ) :
5338		- $meta_value = unserialize( $meta_value[0] );
5339		- $fields[ $meta_key ] = $meta_value;
	4174	+ $meta_value = unserialize( $meta_value[0] );
	4175	+ $fields[$meta_key] = $meta_value;
5340	4176	endif;
5341	4177	endforeach;
5342	4178	endif;
5343		- endwhile;
5344		- wp_reset_postdata();
5345		- ?>
	4179	+ endwhile; wp_reset_postdata(); ?>
5346	4180	<optgroup label="ACF User Fields:">
5347		- <?php foreach ( (array) $fields as $field => $field_object ) : ?>
5348		- <option value="acf___<?php echo esc_attr( $field_object['key'] ); ?>"<?php selected( "acf___{$field_object['key']}" === $auth_settings_option ); ?>><?php echo esc_html( $field_object['label'] ); ?></option>
	4181	+ <?php foreach ( (array)$fields as $field => $field_object ) : ?>
	4182	+ <option value="acf___<?php echo $field_object['key']; ?>"<?php if ( $auth_settings_option === "acf___{$field_object['key']}" ) echo ' selected="selected"'; ?>><?php echo $field_object['label']; ?></option>
5349	4183	<?php endforeach; ?>
5350	4184	</optgroup>
5351	4185	<?php endif; ?>
5352		- <optgroup label="<?php esc_attr_e( 'All Usermeta:', 'authorizer' ); ?>">
5353		- <?php
5354		- foreach ( $this->get_all_usermeta_keys() as $meta_key ) :
5355		- if ( substr( $meta_key, 0, 3 ) === 'wp_' ) :
5356		- continue;
5357		- endif;
5358		- ?>
5359		- <option value="<?php echo esc_attr( $meta_key ); ?>"<?php selected( $auth_settings_option === $meta_key ); ?>><?php echo esc_html( $meta_key ); ?></option>
	4186	+ <optgroup label="<?php _e( 'All Usermeta:', 'authorizer' ); ?>">
	4187	+ <?php foreach ( $this->get_all_usermeta_keys() as $meta_key ) : if ( substr( $meta_key, 0, 3 ) === 'wp_' ) continue; ?>
	4188	+ <option value="<?php echo $meta_key; ?>"<?php if ( $auth_settings_option === $meta_key ) echo ' selected="selected"'; ?>><?php echo $meta_key; ?></option>
5360	4189	<?php endforeach; ?>
5361	4190	</optgroup>
5362		- </select>
5363		- <?php
	4191	+ </select><?php
5364	4192	}
5365	4193
5366	4194
5367		- /**
5368		- * Settings print callback.
5369		- *
5370		- * @param string $args Args (e.g., multisite admin mode).
5371		- * @return void
5372		- */
5373		- public function print_text_auth_advanced_users_per_page( $args = '' ) {
	4195	+ function print_checkbox_auth_advanced_override_multisite( $args = '' ) {
5374	4196	// Get plugin option.
5375		- $option = 'advanced_users_per_page';
5376		- $auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5377		-
5378		- // Print option elements.
5379		- ?>
5380		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" size="4" />
5381		- <?php
5382		- }
5383		-
5384		-
5385		- /**
5386		- * Settings print callback.
5387		- *
5388		- * @param string $args Args (e.g., multisite admin mode).
5389		- * @return void
5390		- */
5391		- public function print_select_auth_advanced_users_sort_by( $args = '' ) {
5392		- // Get plugin option.
5393		- $option = 'advanced_users_sort_by';
5394		- $auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5395		-
5396		- // Print option elements.
5397		- ?>
5398		- <select id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]">
5399		- <option value="created" <?php selected( $auth_settings_option, 'created' ); ?>><?php esc_html_e( 'Date approved', 'authorizer' ); ?></option>
5400		- <option value="email" <?php selected( $auth_settings_option, 'email' ); ?>><?php esc_html_e( 'Email', 'authorizer' ); ?></option>
5401		- <option value="role" <?php selected( $auth_settings_option, 'role' ); ?>><?php esc_html_e( 'Role', 'authorizer' ); ?></option>
5402		- <option value="date_added" <?php selected( $auth_settings_option, 'date_added' ); ?>><?php esc_html_e( 'Date registered', 'authorizer' ); ?></option>
5403		- </select>
5404		- <?php
5405		- }
5406		-
5407		-
5408		- /**
5409		- * Settings print callback.
5410		- *
5411		- * @param string $args Args (e.g., multisite admin mode).
5412		- * @return void
5413		- */
5414		- public function print_select_auth_advanced_users_sort_order( $args = '' ) {
5415		- // Get plugin option.
5416		- $option = 'advanced_users_sort_order';
5417		- $auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5418		-
5419		- // Print option elements.
5420		- ?>
5421		- <select id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]">
5422		- <option value="asc" <?php selected( $auth_settings_option, 'asc' ); ?>><?php esc_html_e( 'Ascending', 'authorizer' ); ?></option>
5423		- <option value="desc" <?php selected( $auth_settings_option, 'desc' ); ?>><?php esc_html_e( 'Descending', 'authorizer' ); ?></option>
5424		- </select>
5425		- <?php
5426		- }
5427		-
5428		-
5429		- /**
5430		- * Settings print callback.
5431		- *
5432		- * @param string $args Args (e.g., multisite admin mode).
5433		- * @return void
5434		- */
5435		- public function print_checkbox_auth_advanced_widget_enabled( $args = '' ) {
5436		- // Get plugin option.
5437		- $option = 'advanced_widget_enabled';
5438		- $auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5439		-
5440		- // Print option elements.
5441		- ?>
5442		- <input type="checkbox" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="1"<?php checked( 1 === intval( $auth_settings_option ) ); ?> /><label for="auth_settings_<?php echo esc_attr( $option ); ?>"><?php esc_html_e( 'Show Dashboard Widget', 'authorizer' ); ?></label>
5443		- <p><small><?php esc_html_e( 'Note: Only users with the create_users capability will be able to see the dashboard widget.', 'authorizer' ); ?></small></p>
5444		- <?php
5445		- }
5446		-
5447		-
5448		- /**
5449		- * Settings print callback.
5450		- *
5451		- * @param string $args Args (e.g., multisite admin mode).
5452		- * @return void
5453		- */
5454		- public function print_checkbox_auth_advanced_override_multisite( $args = '' ) {
5455		- // Get plugin option.
5456		- $option = 'advanced_override_multisite';
	4197	+ $option = 'advanced_override_multisite';
5457	4198	$auth_settings_option = $this->get_plugin_option( $option );
5458	4199
5459	4200	// Print option elements.
5460		- ?>
5461		- <input type="checkbox" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="1"<?php checked( 1 === intval( $auth_settings_option ) ); ?> /><label for="auth_settings_<?php echo esc_attr( $option ); ?>"><?php esc_html_e( "Configure this site independently (don't inherit any multisite settings)", 'authorizer' ); ?></label>
5462		- <?php
	4201	+ ?><input type="checkbox" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="1"<?php checked( 1 == $auth_settings_option ); ?> /><label for="auth_settings_<?php echo $option; ?>"><?php _e( "Configure this site independently (don't inherit any multisite settings)", 'authorizer' ); ?></label><?php
5463	4202	}
5464	4203
5465	4204
5466	4205
5467	4206	/**
5468		- * Determines whether we are in single site or multisite admin context.
5469		- *
5470		- * @param string $args Args (e.g., multisite admin mode).
5471		- * @return int Current mode.
5472		- */
5473		- private function get_admin_mode( $args ) {
5474		- if ( is_array( $args ) && array_key_exists( WP_Plugin_Authorizer::NETWORK_CONTEXT, $args ) && true === $args[ WP_Plugin_Authorizer::NETWORK_CONTEXT ] ) {
5475		- return WP_Plugin_Authorizer::NETWORK_CONTEXT;
5476		- } else {
5477		- return WP_Plugin_Authorizer::SINGLE_CONTEXT;
5478		- }
5479		- }
5480		-
5481		-
5482		- /**
5483	4207	* Add help documentation to the options page.
5484		- *
5485		- * Action: load-settings_page_authorizer > admin_head
	4208	+ * Run on action hook chain: load-settings_page_authorizer > admin_head
5486	4209	*/
5487	4210	public function admin_head() {
5488	4211	$screen = get_current_screen();
5489	4212
5490		- // Add help tab for Access Lists Settings.
	4213	+ // Add help tab for Access Lists Settings
5491	4214	$help_auth_settings_access_lists_content = '
5492		- <p>' . __( "<strong>Pending Users</strong>: Pending users are users who have successfully logged in to the site, but who haven't yet been approved (or blocked) by you.", 'authorizer' ) . '</p>
5493		- <p>' . __( '<strong>Approved Users</strong>: Approved users have access to the site once they successfully log in.', 'authorizer' ) . '</p>
5494		- <p>' . __( '<strong>Blocked Users</strong>: Blocked users will receive an error message when they try to visit the site after authenticating.', 'authorizer' ) . '</p>
5495		- <p>' . __( 'Users in the <strong>Pending</strong> list appear automatically after a new user tries to log in from the configured external authentication service. You can add users to the <strong>Approved</strong> or <strong>Blocked</strong> lists by typing them in manually, or by clicking the <em>Approve</em> or <em>Block</em> buttons next to a user in the <strong>Pending</strong> list.', 'authorizer' ) . '</p>
	4215	+ <p>' . __( "<strong>Pending Users</strong>: Pending users are users who have successfully logged in to the site, but who haven't yet been approved (or blocked) by you.", 'authorizer' ) .'</p>
	4216	+ <p>' . __( "<strong>Approved Users</strong>: Approved users have access to the site once they successfully log in.", 'authorizer' ) . '</p>
	4217	+ <p>' . __( "<strong>Blocked Users</strong>: Blocked users will receive an error message when they try to visit the site after authenticating.", 'authorizer' ) . '</p>
	4218	+ <p>' . __( "Users in the <strong>Pending</strong> list appear automatically after a new user tries to log in from the configured external authentication service. You can add users to the <strong>Approved</strong> or <strong>Blocked</strong> lists by typing them in manually, or by clicking the <em>Approve</em> or <em>Block</em> buttons next to a user in the <strong>Pending</strong> list.", 'authorizer' ) . '</p>
5496	4219	';
5497	4220	$screen->add_help_tab(
5498	4221	array(
5499		- 'id' => 'help_auth_settings_access_lists_content',
5500		- 'title' => __( 'Access Lists', 'authorizer' ),
	4222	+ 'id' => 'help_auth_settings_access_lists_content',
	4223	+ 'title' => __( 'Access Lists', 'authorizer' ),
5501	4224	'content' => $help_auth_settings_access_lists_content,
5502	4225	)
5503	4226	);
5504	4227
5505		- // Add help tab for Login Access Settings.
	4228	+ // Add help tab for Login Access Settings
5506	4229	$help_auth_settings_access_login_content = '
5507	4230	<p>' . __( "<strong>Who can log in to the site?</strong>: Choose the level of access restriction you'd like to use on your site here. You can leave the site open to anyone with a WordPress account or an account on an external service like Google, CAS, or LDAP, or restrict it to WordPress users and only the external users that you specify via the <em>Access Lists</em>.", 'authorizer' ) . '</p>
5508	4231	<p>' . __( "<strong>Which role should receive email notifications about pending users?</strong>: If you've restricted access to <strong>approved users</strong>, you can determine which WordPress users will receive a notification email everytime a new external user successfully logs in and is added to the pending list. All users of the specified role will receive an email, and the external user will get a message (specified below) telling them their access is pending approval.", 'authorizer' ) . '</p>
5509	4232	<p>' . __( '<strong>What message should pending users see after attempting to log in?</strong>: Here you can specify the exact message a new external user will see once they try to log in to the site for the first time.', 'authorizer' ) . '</p>
		@@ -5509,84 +4232,84 @@
5509	4232	<p>' . __( '<strong>What message should pending users see after attempting to log in?</strong>: Here you can specify the exact message a new external user will see once they try to log in to the site for the first time.', 'authorizer' ) . '</p>
5510	4233	';
5511	4234	$screen->add_help_tab(
5512	4235	array(
5513		- 'id' => 'help_auth_settings_access_login_content',
5514		- 'title' => __( 'Login Access', 'authorizer' ),
	4236	+ 'id' => 'help_auth_settings_access_login_content',
	4237	+ 'title' => __( 'Login Access', 'authorizer' ),
5515	4238	'content' => $help_auth_settings_access_login_content,
5516	4239	)
5517	4240	);
5518	4241
5519		- // Add help tab for Public Access Settings.
	4242	+ // Add help tab for Public Access Settings
5520	4243	$help_auth_settings_access_public_content = '
5521	4244	<p>' . __( "<strong>Who can view the site?</strong>: You can restrict the site's visibility by only allowing logged in users to see pages. If you do so, you can customize the specifics about the site's privacy using the settings below.", 'authorizer' ) . '</p>
5522	4245	<p>' . __( "<strong>What pages (if any) should be available to everyone?</strong>: If you'd like to declare certain pages on your site as always public (such as the course syllabus, introduction, or calendar), specify those pages here. These pages will always be available no matter what access restrictions exist.", 'authorizer' ) . '</p>
5523		- <p>' . __( '<strong>What happens to people without access when they visit a <em>private</em> page?</strong>: Choose the response anonymous users receive when visiting the site. You can choose between immediately taking them to the <strong>login screen</strong>, or simply showing them a <strong>message</strong>.', 'authorizer' ) . '</p>
5524		- <p>' . __( '<strong>What happens to people without access when they visit a <em>public</em> page?</strong>: Choose the response anonymous users receive when visiting a page on the site marked as public. You can choose between showing them the page without any message, or showing them a the page with a message above the content.', 'authorizer' ) . '</p>
5525		- <p>' . __( '<strong>What message should people without access see?</strong>: If you chose to show new users a <strong>message</strong> above, type that message here.', 'authorizer' ) . '</p>
	4246	+ <p>' . __( "<strong>What happens to people without access when they visit a <em>private</em> page?</strong>: Choose the response anonymous users receive when visiting the site. You can choose between immediately taking them to the <strong>login screen</strong>, or simply showing them a <strong>message</strong>.", 'authorizer' ) . '</p>
	4247	+ <p>' . __( "<strong>What happens to people without access when they visit a <em>public</em> page?</strong>: Choose the response anonymous users receive when visiting a page on the site marked as public. You can choose between showing them the page without any message, or showing them a the page with a message above the content.", 'authorizer' ) . '</p>
	4248	+ <p>' . __( "<strong>What message should people without access see?</strong>: If you chose to show new users a <strong>message</strong> above, type that message here.", 'authorizer' ) . '</p>
5526	4249	';
5527	4250	$screen->add_help_tab(
5528	4251	array(
5529		- 'id' => 'help_auth_settings_access_public_content',
5530		- 'title' => __( 'Public Access', 'authorizer' ),
	4252	+ 'id' => 'help_auth_settings_access_public_content',
	4253	+ 'title' => __( 'Public Access', 'authorizer' ),
5531	4254	'content' => $help_auth_settings_access_public_content,
5532	4255	)
5533	4256	);
5534	4257
5535		- // Add help tab for External Service (CAS, LDAP) Settings.
	4258	+ // Add help tab for External Service (CAS, LDAP) Settings
5536	4259	$help_auth_settings_external_content = '
5537	4260	<p>' . __( "<strong>Type of external service to authenticate against</strong>: Choose which authentication service type you will be using. You'll have to fill out different fields below depending on which service you choose.", 'authorizer' ) . '</p>
5538		- <p>' . __( '<strong>Enable Google Logins</strong>: Choose if you want to allow users to log in with their Google Account credentials. You will need to enter your API Client ID and Secret to enable Google Logins.', 'authorizer' ) . '</p>
5539		- <p>' . __( '<strong>Enable CAS Logins</strong>: Choose if you want to allow users to log in with via CAS (Central Authentication Service). You will need to enter details about your CAS server (host, port, and path) to enable CAS Logins.', 'authorizer' ) . '</p>
5540		- <p>' . __( '<strong>Enable LDAP Logins</strong>: Choose if you want to allow users to log in with their LDAP (Lightweight Directory Access Protocol) credentials. You will need to enter details about your LDAP server (host, port, search base, uid attribute, directory user, directory user password, and whether to use TLS) to enable Google Logins.', 'authorizer' ) . '</p>
5541		- <p>' . __( '<strong>Default role for new CAS users</strong>: Specify which role new external users will get by default. Be sure to choose a role with limited permissions!', 'authorizer' ) . '</p>
5542		- <p><strong><em>' . __( 'If you enable Google logins:', 'authorizer' ) . '</em></strong></p>
	4261	+ <p>' . __( "<strong>Enable Google Logins</strong>: Choose if you want to allow users to log in with their Google Account credentials. You will need to enter your API Client ID and Secret to enable Google Logins.", 'authorizer' ) . '</p>
	4262	+ <p>' . __( "<strong>Enable CAS Logins</strong>: Choose if you want to allow users to log in with via CAS (Central Authentication Service). You will need to enter details about your CAS server (host, port, and path) to enable CAS Logins.", 'authorizer' ) . '</p>
	4263	+ <p>' . __( "<strong>Enable LDAP Logins</strong>: Choose if you want to allow users to log in with their LDAP (Lightweight Directory Access Protocol) credentials. You will need to enter details about your LDAP server (host, port, search base, uid attribute, directory user, directory user password, and whether to use TLS) to enable Google Logins.", 'authorizer' ) . '</p>
	4264	+ <p>' . __( "<strong>Default role for new CAS users</strong>: Specify which role new external users will get by default. Be sure to choose a role with limited permissions!", 'authorizer' ) . '</p>
	4265	+ <p><strong><em>' . __( "If you enable Google logins:", 'authorizer' ) . '</em></strong></p>
5543	4266	<ul>
5544	4267	<li>' . __( "<strong>Google Client ID</strong>: You can generate this ID by creating a new Project in the <a href='https://cloud.google.com/console'>Google Developers Console</a>. A Client ID typically looks something like this: 1234567890123-kdjr85yt6vjr6d8g7dhr8g7d6durjf7g.apps.googleusercontent.com", 'authorizer' ) . '</li>
5545	4268	<li>' . __( "<strong>Google Client Secret</strong>: You can generate this secret by creating a new Project in the <a href='https://cloud.google.com/console'>Google Developers Console</a>. A Client Secret typically looks something like this: sDNgX5_pr_5bly-frKmvp8jT", 'authorizer' ) . '</li>
5546	4269	</ul>
5547		- <p><strong><em>' . __( 'If you enable CAS logins:', 'authorizer' ) . '</em></strong></p>
	4270	+ <p><strong><em>' . __( "If you enable CAS logins:", 'authorizer' ) . '</em></strong></p>
5548	4271	<ul>
5549		- <li>' . __( '<strong>CAS server hostname</strong>: Enter the hostname of the CAS server you authenticate against (e.g., authn.example.edu).', 'authorizer' ) . '</li>
5550		- <li>' . __( '<strong>CAS server port</strong>: Enter the port on the CAS server to connect to (e.g., 443).', 'authorizer' ) . '</li>
5551		- <li>' . __( '<strong>CAS server path/context</strong>: Enter the path to the login endpoint on the CAS server (e.g., /cas).', 'authorizer' ) . '</li>
	4272	+ <li>' . __( "<strong>CAS server hostname</strong>: Enter the hostname of the CAS server you authenticate against (e.g., authn.example.edu).", 'authorizer' ) . '</li>
	4273	+ <li>' . __( "<strong>CAS server port</strong>: Enter the port on the CAS server to connect to (e.g., 443).", 'authorizer' ) . '</li>
	4274	+ <li>' . __( "<strong>CAS server path/context</strong>: Enter the path to the login endpoint on the CAS server (e.g., /cas).", 'authorizer' ) . '</li>
5552	4275	<li>' . __( "<strong>CAS attribute containing first name</strong>: Enter the CAS attribute that has the user's first name. When this user first logs in, their WordPress account will have their first name retrieved from CAS and added to their WordPress profile.", 'authorizer' ) . '</li>
5553	4276	<li>' . __( "<strong>CAS attribute containing last name</strong>: Enter the CAS attribute that has the user's last name. When this user first logs in, their WordPress account will have their last name retrieved from CAS and added to their WordPress profile.", 'authorizer' ) . '</li>
5554		- <li>' . __( '<strong>CAS attribute update</strong>: Select whether the first and last names retrieved from CAS should overwrite any value the user has entered in the first and last name fields in their WordPress profile. If this is not set, this only happens the first time they log in.', 'authorizer' ) . '</li>
	4277	+ <li>' . __( "<strong>CAS attribute update</strong>: Select whether the first and last names retrieved from CAS should overwrite any value the user has entered in the first and last name fields in their WordPress profile. If this is not set, this only happens the first time they log in.", 'authorizer' ) . '</li>
5555	4278	</ul>
5556		- <p><strong><em>' . __( 'If you enable LDAP logins:', 'authorizer' ) . '</em></strong></p>
	4279	+ <p><strong><em>' . __( "If you enable LDAP logins:", 'authorizer' ) . '</em></strong></p>
5557	4280	<ul>
5558		- <li>' . __( '<strong>LDAP Host</strong>: Enter the URL of the LDAP server you authenticate against.', 'authorizer' ) . '</li>
5559		- <li>' . __( '<strong>LDAP Port</strong>: Enter the port number that the LDAP server listens on.', 'authorizer' ) . '</li>
5560		- <li>' . __( '<strong>LDAP Search Base</strong>: Enter the LDAP string that represents the search base, e.g., ou=people,dc=example,dc=edu', 'authorizer' ) . '</li>
5561		- <li>' . __( '<strong>LDAP attribute containing username</strong>: Enter the name of the LDAP attribute that contains the usernames used by those attempting to log in. The plugin will search on this attribute to find the cn to bind against for login attempts.', 'authorizer' ) . '</li>
5562		- <li>' . __( '<strong>LDAP Directory User</strong>: Enter the name of the LDAP user that has permissions to browse the directory.', 'authorizer' ) . '</li>
5563		- <li>' . __( '<strong>LDAP Directory User Password</strong>: Enter the password for the LDAP user that has permission to browse the directory.', 'authorizer' ) . '</li>
5564		- <li>' . __( '<strong>Use TLS</strong>: Select whether all communication with the LDAP server should be performed over a TLS-secured connection.', 'authorizer' ) . '</li>
	4281	+ <li>' . __( "<strong>LDAP Host</strong>: Enter the URL of the LDAP server you authenticate against.", 'authorizer' ) . '</li>
	4282	+ <li>' . __( "<strong>LDAP Port</strong>: Enter the port number that the LDAP server listens on.", 'authorizer' ) . '</li>
	4283	+ <li>' . __( "<strong>LDAP Search Base</strong>: Enter the LDAP string that represents the search base, e.g., ou=people,dc=example,dc=edu", 'authorizer' ) . '</li>
	4284	+ <li>' . __( "<strong>LDAP attribute containing username</strong>: Enter the name of the LDAP attribute that contains the usernames used by those attempting to log in. The plugin will search on this attribute to find the cn to bind against for login attempts.", 'authorizer' ) . '</li>
	4285	+ <li>' . __( "<strong>LDAP Directory User</strong>: Enter the name of the LDAP user that has permissions to browse the directory.", 'authorizer' ) . '</li>
	4286	+ <li>' . __( "<strong>LDAP Directory User Password</strong>: Enter the password for the LDAP user that has permission to browse the directory.", 'authorizer' ) . '</li>
	4287	+ <li>' . __( "<strong>Secure Connection (TLS)</strong>: Select whether all communication with the LDAP server should be performed over a TLS-secured connection.", 'authorizer' ) . '</li>
5565	4288	<li>' . __( "<strong>Custom lost password URL</strong>: The WordPress login page contains a link to recover a lost password. If you have external users who shouldn't change the password on their WordPress account, point them to the appropriate location to change the password on their external authentication service here.", 'authorizer' ) . '</li>
5566	4289	<li>' . __( "<strong>LDAP attribute containing first name</strong>: Enter the LDAP attribute that has the user's first name. When this user first logs in, their WordPress account will have their first name retrieved from LDAP and added to their WordPress profile.", 'authorizer' ) . '</li>
5567	4290	<li>' . __( "<strong>LDAP attribute containing last name</strong>: Enter the LDAP attribute that has the user's last name. When this user first logs in, their WordPress account will have their last name retrieved from LDAP and added to their WordPress profile.", 'authorizer' ) . '</li>
5568		- <li>' . __( '<strong>LDAP attribute update</strong>: Select whether the first and last names retrieved from LDAP should overwrite any value the user has entered in the first and last name fields in their WordPress profile. If this is not set, this only happens the first time they log in.', 'authorizer' ) . '</li>
	4291	+ <li>' . __( "<strong>LDAP attribute update</strong>: Select whether the first and last names retrieved from LDAP should overwrite any value the user has entered in the first and last name fields in their WordPress profile. If this is not set, this only happens the first time they log in.", 'authorizer' ) . '</li>
5569	4292	</ul>
5570	4293	';
5571	4294	$screen->add_help_tab(
5572	4295	array(
5573		- 'id' => 'help_auth_settings_external_content',
5574		- 'title' => __( 'External Service', 'authorizer' ),
	4296	+ 'id' => 'help_auth_settings_external_content',
	4297	+ 'title' => __( 'External Service', 'authorizer' ),
5575	4298	'content' => $help_auth_settings_external_content,
5576	4299	)
5577	4300	);
5578	4301
5579		- // Add help tab for Advanced Settings.
	4302	+ // Add help tab for Advanced Settings
5580	4303	$help_auth_settings_advanced_content = '
5581		- <p>' . __( '<strong>Limit invalid login attempts</strong>: Choose how soon (and for how long) to restrict access to individuals (or bots) making repeated invalid login attempts. You may set a shorter delay first, and then a longer delay after repeated invalid attempts; you may also set how much time must pass before the delays will be reset to normal.', 'authorizer' ) . '</p>
5582		- <p>' . __( '<strong>Hide WordPress Logins</strong>: If you want to hide the WordPress username and password fields and the Log In button on the wp-login screen, enable this option. Note: You can always access the WordPress logins by adding external=wordpress to the wp-login URL, like so:', 'authorizer' ) . ' <a href="' . wp_login_url() . '?external=wordpress" target="_blank">' . wp_login_url() . '?external=wordpress</a>.</p>
	4304	+ <p>' . __( "<strong>Limit invalid login attempts</strong>: Choose how soon (and for how long) to restrict access to individuals (or bots) making repeated invalid login attempts. You may set a shorter delay first, and then a longer delay after repeated invalid attempts; you may also set how much time must pass before the delays will be reset to normal.", 'authorizer' ) . '</p>
	4305	+ <p>' . __( "<strong>Hide WordPress Logins</strong>: If you want to hide the WordPress username and password fields and the Log In button on the wp-login screen, enable this option. Note: You can always access the WordPress logins by adding external=wordpress to the wp-login URL, like so:", 'authorizer' ) . ' <a href="' . wp_login_url() . '?external=wordpress" target="_blank">' . wp_login_url() . '?external=wordpress</a>.</p>
5583	4306	<p>' . __( "<strong>Custom WordPress login branding</strong>: If you'd like to use custom branding on the WordPress login page, select that here. You will need to use the `authorizer_add_branding_option` filter in your theme to add it. You can see an example theme that implements this filter in the plugin directory under sample-theme-add-branding.", 'authorizer' ) . '</p>
5584	4307	';
5585	4308	$screen->add_help_tab(
5586	4309	array(
5587		- 'id' => 'help_auth_settings_advanced_content',
5588		- 'title' => __( 'Advanced', 'authorizer' ),
	4310	+ 'id' => 'help_auth_settings_advanced_content',
	4311	+ 'title' => __( 'Advanced', 'authorizer' ),
5589	4312	'content' => $help_auth_settings_advanced_content,
5590	4313	)
5591	4314	);
5592	4315	}
		@@ -5601,66 +4324,65 @@
5601	4324
5602	4325
5603	4326	/**
5604	4327	* Network Admin menu item
	4328	+ * Hook: network_admin_menu
5605	4329	*
5606		- * Action: network_admin_menu
5607		- *
	4330	+ * @param none
5608	4331	* @return void
5609	4332	*/
5610	4333	public function network_admin_menu() {
5611	4334	// @see http://codex.wordpress.org/Function_Reference/add_menu_page
5612	4335	add_menu_page(
5613		- 'Authorizer',
5614		- 'Authorizer',
5615		- 'manage_network_options',
5616		- 'authorizer',
	4336	+ 'Authorizer', // Page title
	4337	+ 'Authorizer', // Menu title
	4338	+ 'manage_network_options', // Capability
	4339	+ 'authorizer', // Menu slug
5617	4340	array( $this, 'create_network_admin_page' ),
5618		- 'dashicons-groups',
5619		- 89 // Position.
	4341	+ 'dashicons-groups', // Icon URL
	4342	+ 89 // Position
5620	4343	);
5621	4344	}
5622	4345
5623	4346
5624	4347	/**
5625		- * Output the HTML for the options page.
	4348	+ * Output the HTML for the options page
5626	4349	*/
5627	4350	public function create_network_admin_page() {
5628	4351	if ( ! current_user_can( 'manage_network_options' ) ) {
5629		- wp_die( wp_kses( __( 'You do not have sufficient permissions to access this page.', 'authorizer' ), $this->allowed_html ) );
	4352	+ wp_die( __( 'You do not have sufficient permissions to access this page.', 'authorizer' ) );
5630	4353	}
5631		- $auth_settings = get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings', array() );
5632		- ?>
	4354	+ $auth_settings = get_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings', array() ); ?>
5633	4355	<div class="wrap">
5634	4356	<form method="post" action="" autocomplete="off">
5635		- <h2><?php esc_html_e( 'Authorizer Settings', 'authorizer' ); ?></h2>
5636		- <p><?php echo wp_kses( __( 'Most <strong>Authorizer</strong> settings are set in the individual sites, but you can specify a few options here that apply to <strong>all sites in the network</strong>. These settings will override settings in the individual sites.', 'authorizer' ), $this->allowed_html ); ?></p>
	4357	+ <h2><?php _e( 'Authorizer Settings', 'authorizer' ); ?></h2>
	4358	+ <p><?php _e( 'Most <strong>Authorizer</strong> settings are set in the individual sites, but you can specify a few options here that apply to <strong>all sites in the network</strong>. These settings will override settings in the individual sites.', 'authorizer' ); ?></p>
5637	4359
5638		- <input type="checkbox" id="auth_settings_multisite_override" name="auth_settings[multisite_override]" value="1"<?php checked( 1 === intval( $auth_settings['multisite_override'] ) ); ?> /><label for="auth_settings_multisite_override"><?php esc_html_e( 'Override individual site settings with the settings below', 'authorizer' ); ?></label>
	4360	+ <input type="checkbox" id="auth_settings_multisite_override" name="auth_settings[multisite_override]" value="1"<?php checked( 1 == $auth_settings['multisite_override'] ); ?> /><label for="auth_settings_multisite_override"><?php _e( 'Override individual site settings with the settings below', 'authorizer' ); ?></label>
5639	4361
5640	4362	<div id="auth_multisite_settings_disabled_overlay" style="display: none;"></div>
5641	4363
5642	4364	<div class="wrap" id="auth_multisite_settings">
5643		- <?php $this->print_section_info_tabs( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?>
	4365	+ <?php $this->print_section_info_tabs( array( MULTISITE_ADMIN => true ) ); ?>
5644	4366
5645	4367	<?php wp_nonce_field( 'save_auth_settings', 'nonce_save_auth_settings' ); ?>
5646	4368
5647		- <?php // Custom access lists (for network, we only really want approved list, not pending or blocked). ?>
	4369	+ <?php // Custom access lists (for network, we only really want approved list, not pending or blocked) ?>
5648	4370	<div id="section_info_access_lists" class="section_info">
5649		- <p><?php esc_html_e( 'Manage who has access to all sites in the network.', 'authorizer' ); ?></p>
	4371	+ <p><?php _e( 'Manage who has access to all sites in the network.', 'authorizer' ); ?></p>
5650	4372	</div>
5651	4373	<table class="form-table"><tbody>
5652	4374	<tr>
5653		- <th scope="row"><?php esc_html_e( 'Who can log in to sites in this network?', 'authorizer' ); ?></th>
5654		- <td><?php $this->print_radio_auth_access_who_can_login( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4375	+ <th scope="row"><?php _e( 'Who can log in to sites in this network?', 'authorizer' ); ?></th>
	4376	+ <td><?php $this->print_radio_auth_access_who_can_login( array( MULTISITE_ADMIN => true ) ); ?></td>
5655	4377	</tr>
5656	4378	<tr>
5657		- <th scope="row"><?php esc_html_e( 'Who can view sites in this network?', 'authorizer' ); ?></th>
5658		- <td><?php $this->print_radio_auth_access_who_can_view( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4379	+ <th scope="row"><?php _e( 'Who can view sites in this network?', 'authorizer' ); ?></th>
	4380	+ <td><?php $this->print_radio_auth_access_who_can_view( array( MULTISITE_ADMIN => true ) ); ?></td>
5659	4381	</tr>
5660	4382	<tr>
5661		- <th scope="row"><?php esc_html_e( 'Approved Users (All Sites)', 'authorizer' ); ?><br /><small><em><?php echo wp_kses( __( 'Note: these users will <strong>not</strong> receive welcome emails when approved. Only users approved from individual sites can receive these messages.', 'authorizer' ), $this->allowed_html ); ?></em></small></th>
5662		- <td><?php $this->print_combo_auth_access_users_approved( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4383	+ <th scope="row"><?php _e( 'Approved Users (All Sites)', 'authorizer' ); ?><br /><small><em><?php _e( 'Note: these users will <strong>not</strong> receive welcome emails when approved. Only users approved from individual sites can receive these messages.', 'authorizer' ); ?></em></small></th>
	4384	+ <td><?php $this->print_combo_auth_access_users_approved( array( MULTISITE_ADMIN => true ) ); ?></td>
5663	4385	</tr>
5664	4386	</tbody></table>
5665	4387
5666	4388	<?php $this->print_section_info_external(); ?>
		@@ -5665,160 +4387,140 @@
5665	4387
5666	4388	<?php $this->print_section_info_external(); ?>
5667	4389	<table class="form-table"><tbody>
5668	4390	<tr>
5669		- <th scope="row"><?php esc_html_e( 'Default role for new users', 'authorizer' ); ?></th>
5670		- <td><?php $this->print_select_auth_access_default_role( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4391	+ <th scope="row"><?php _e( 'Default role for new users', 'authorizer' ); ?></th>
	4392	+ <td><?php $this->print_select_auth_access_default_role( array( MULTISITE_ADMIN => true ) ); ?></td>
5671	4393	</tr>
5672	4394	<tr>
5673		- <th scope="row"><?php esc_html_e( 'Google Logins', 'authorizer' ); ?></th>
5674		- <td><?php $this->print_checkbox_auth_external_google( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4395	+ <th scope="row"><?php _e( 'Google Logins', 'authorizer' ); ?></th>
	4396	+ <td><?php $this->print_checkbox_auth_external_google( array( MULTISITE_ADMIN => true ) ); ?></td>
5675	4397	</tr>
5676	4398	<tr>
5677		- <th scope="row"><?php esc_html_e( 'Google Client ID', 'authorizer' ); ?></th>
5678		- <td><?php $this->print_text_google_clientid( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4399	+ <th scope="row"><?php _e( 'Google Client ID', 'authorizer' ); ?></th>
	4400	+ <td><?php $this->print_text_google_clientid( array( MULTISITE_ADMIN => true ) ); ?></td>
5679	4401	</tr>
5680	4402	<tr>
5681		- <th scope="row"><?php esc_html_e( 'Google Client Secret', 'authorizer' ); ?></th>
5682		- <td><?php $this->print_text_google_clientsecret( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4403	+ <th scope="row"><?php _e( 'Google Client Secret', 'authorizer' ); ?></th>
	4404	+ <td><?php $this->print_text_google_clientsecret( array( MULTISITE_ADMIN => true ) ); ?></td>
5683	4405	</tr>
5684	4406	<tr>
5685		- <th scope="row"><?php esc_html_e( 'Google Hosted Domain', 'authorizer' ); ?></th>
5686		- <td><?php $this->print_text_google_hosteddomain( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4407	+ <th scope="row"><?php _e( 'Google Hosted Domain', 'authorizer' ); ?></th>
	4408	+ <td><?php $this->print_text_google_hosteddomain( array( MULTISITE_ADMIN => true ) ); ?></td>
5687	4409	</tr>
5688	4410	<tr>
5689		- <th scope="row"><?php esc_html_e( 'CAS Logins', 'authorizer' ); ?></th>
5690		- <td><?php $this->print_checkbox_auth_external_cas( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4411	+ <th scope="row"><?php _e( 'CAS Logins', 'authorizer' ); ?></th>
	4412	+ <td><?php $this->print_checkbox_auth_external_cas( array( MULTISITE_ADMIN => true ) ); ?></td>
5691	4413	</tr>
5692	4414	<tr>
5693		- <th scope="row"><?php esc_html_e( 'CAS Custom Label', 'authorizer' ); ?></th>
5694		- <td><?php $this->print_text_cas_custom_label( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4415	+ <th scope="row"><?php _e( 'CAS Custom Label', 'authorizer' ); ?></th>
	4416	+ <td><?php $this->print_text_cas_custom_label( array( MULTISITE_ADMIN => true ) ); ?></td>
5695	4417	</tr>
5696	4418	<tr>
5697		- <th scope="row"><?php esc_html_e( 'CAS server hostname', 'authorizer' ); ?></th>
5698		- <td><?php $this->print_text_cas_host( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4419	+ <th scope="row"><?php _e( 'CAS server hostname', 'authorizer' ); ?></th>
	4420	+ <td><?php $this->print_text_cas_host( array( MULTISITE_ADMIN => true ) ); ?></td>
5699	4421	</tr>
5700	4422	<tr>
5701		- <th scope="row"><?php esc_html_e( 'CAS server port', 'authorizer' ); ?></th>
5702		- <td><?php $this->print_text_cas_port( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4423	+ <th scope="row"><?php _e( 'CAS server port', 'authorizer' ); ?></th>
	4424	+ <td><?php $this->print_text_cas_port( array( MULTISITE_ADMIN => true ) ); ?></td>
5703	4425	</tr>
5704	4426	<tr>
5705		- <th scope="row"><?php esc_html_e( 'CAS server path/context', 'authorizer' ); ?></th>
5706		- <td><?php $this->print_text_cas_path( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4427	+ <th scope="row"><?php _e( 'CAS server path/context', 'authorizer' ); ?></th>
	4428	+ <td><?php $this->print_text_cas_path( array( MULTISITE_ADMIN => true ) ); ?></td>
5707	4429	</tr>
5708	4430	<tr>
5709		- <th scope="row"><?php esc_html_e( 'CAS server version', 'authorizer' ); ?></th>
5710		- <td><?php $this->print_select_cas_version( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4431	+ <th scope="row"><?php _e( 'CAS server version', 'authorizer' ); ?></th>
	4432	+ <td><?php $this->print_select_cas_version( array( MULTISITE_ADMIN => true ) ); ?></td>
5711	4433	</tr>
5712	4434	<tr>
5713		- <th scope="row"><?php esc_html_e( 'CAS attribute containing email', 'authorizer' ); ?></th>
5714		- <td><?php $this->print_text_cas_attr_email( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4435	+ <th scope="row"><?php _e( 'CAS attribute containing email', 'authorizer' ); ?></th>
	4436	+ <td><?php $this->print_text_cas_attr_email( array( MULTISITE_ADMIN => true ) ); ?></td>
5715	4437	</tr>
5716	4438	<tr>
5717		- <th scope="row"><?php esc_html_e( 'CAS attribute containing first name', 'authorizer' ); ?></th>
5718		- <td><?php $this->print_text_cas_attr_first_name( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4439	+ <th scope="row"><?php _e( 'CAS attribute containing first name', 'authorizer' ); ?></th>
	4440	+ <td><?php $this->print_text_cas_attr_first_name( array( MULTISITE_ADMIN => true ) ); ?></td>
5719	4441	</tr>
5720	4442	<tr>
5721		- <th scope="row"><?php esc_html_e( 'CAS attribute containing last name', 'authorizer' ); ?></th>
5722		- <td><?php $this->print_text_cas_attr_last_name( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4443	+ <th scope="row"><?php _e( 'CAS attribute containing last name', 'authorizer' ); ?></th>
	4444	+ <td><?php $this->print_text_cas_attr_last_name( array( MULTISITE_ADMIN => true ) ); ?></td>
5723	4445	</tr>
5724	4446	<tr>
5725		- <th scope="row"><?php esc_html_e( 'CAS attribute update', 'authorizer' ); ?></th>
5726		- <td><?php $this->print_checkbox_cas_attr_update_on_login( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4447	+ <th scope="row"><?php _e( 'CAS attribute update', 'authorizer' ); ?></th>
	4448	+ <td><?php $this->print_checkbox_cas_attr_update_on_login( array( MULTISITE_ADMIN => true ) ); ?></td>
5727	4449	</tr>
5728	4450	<tr>
5729		- <th scope="row"><?php esc_html_e( 'CAS automatic login', 'authorizer' ); ?></th>
5730		- <td><?php $this->print_checkbox_cas_auto_login( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4451	+ <th scope="row"><?php _e( 'CAS automatic login', 'authorizer' ); ?></th>
	4452	+ <td><?php $this->print_checkbox_cas_auto_login( array( MULTISITE_ADMIN => true ) ); ?></td>
5731	4453	</tr>
5732	4454	<tr>
5733		- <th scope="row"><?php esc_html_e( 'CAS users linked by username', 'authorizer' ); ?></th>
5734		- <td><?php $this->print_checkbox_cas_link_on_username( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4455	+ <th scope="row"><?php _e( 'LDAP Logins', 'authorizer' ); ?></th>
	4456	+ <td><?php $this->print_checkbox_auth_external_ldap( array( MULTISITE_ADMIN => true ) ); ?></td>
5735	4457	</tr>
5736	4458	<tr>
5737		- <th scope="row"><?php esc_html_e( 'LDAP Logins', 'authorizer' ); ?></th>
5738		- <td><?php $this->print_checkbox_auth_external_ldap( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4459	+ <th scope="row"><?php _e( 'LDAP Host', 'authorizer' ); ?></th>
	4460	+ <td><?php $this->print_text_ldap_host( array( MULTISITE_ADMIN => true ) ); ?></td>
5739	4461	</tr>
5740	4462	<tr>
5741		- <th scope="row"><?php esc_html_e( 'LDAP Host', 'authorizer' ); ?></th>
5742		- <td><?php $this->print_text_ldap_host( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4463	+ <th scope="row"><?php _e( 'LDAP Port', 'authorizer' ); ?></th>
	4464	+ <td><?php $this->print_text_ldap_port( array( MULTISITE_ADMIN => true ) ); ?></td>
5743	4465	</tr>
5744	4466	<tr>
5745		- <th scope="row"><?php esc_html_e( 'LDAP Port', 'authorizer' ); ?></th>
5746		- <td><?php $this->print_text_ldap_port( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4467	+ <th scope="row"><?php _e( 'Secure Connection (TLS)', 'authorizer' ); ?></th>
	4468	+ <td><?php $this->print_checkbox_ldap_tls( array( MULTISITE_ADMIN => true ) ); ?></td>
5747	4469	</tr>
5748	4470	<tr>
5749		- <th scope="row"><?php esc_html_e( 'Use TLS', 'authorizer' ); ?></th>
5750		- <td><?php $this->print_checkbox_ldap_tls( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4471	+ <th scope="row"><?php _e( 'LDAP Search Base', 'authorizer' ); ?></th>
	4472	+ <td><?php $this->print_text_ldap_search_base( array( MULTISITE_ADMIN => true ) ); ?></td>
5751	4473	</tr>
5752	4474	<tr>
5753		- <th scope="row"><?php esc_html_e( 'LDAP Search Base', 'authorizer' ); ?></th>
5754		- <td><?php $this->print_text_ldap_search_base( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4475	+ <th scope="row"><?php _e( 'LDAP attribute containing username', 'authorizer' ); ?></th>
	4476	+ <td><?php $this->print_text_ldap_uid( array( MULTISITE_ADMIN => true ) ); ?></td>
5755	4477	</tr>
5756	4478	<tr>
5757		- <th scope="row"><?php esc_html_e( 'LDAP attribute containing username', 'authorizer' ); ?></th>
5758		- <td><?php $this->print_text_ldap_uid( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4479	+ <th scope="row"><?php _e( 'LDAP attribute containing email', 'authorizer' ); ?></th>
	4480	+ <td><?php $this->print_text_ldap_attr_email( array( MULTISITE_ADMIN => true ) ); ?></td>
5759	4481	</tr>
5760	4482	<tr>
5761		- <th scope="row"><?php esc_html_e( 'LDAP attribute containing email', 'authorizer' ); ?></th>
5762		- <td><?php $this->print_text_ldap_attr_email( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4483	+ <th scope="row"><?php _e( 'LDAP Directory User', 'authorizer' ); ?></th>
	4484	+ <td><?php $this->print_text_ldap_user( array( MULTISITE_ADMIN => true ) ); ?></td>
5763	4485	</tr>
5764	4486	<tr>
5765		- <th scope="row"><?php esc_html_e( 'LDAP Directory User', 'authorizer' ); ?></th>
5766		- <td><?php $this->print_text_ldap_user( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4487	+ <th scope="row"><?php _e( 'LDAP Directory User Password', 'authorizer' ); ?></th>
	4488	+ <td><?php $this->print_password_ldap_password( array( MULTISITE_ADMIN => true ) ); ?></td>
5767	4489	</tr>
5768	4490	<tr>
5769		- <th scope="row"><?php esc_html_e( 'LDAP Directory User Password', 'authorizer' ); ?></th>
5770		- <td><?php $this->print_password_ldap_password( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4491	+ <th scope="row"><?php _e( 'Custom lost password URL', 'authorizer' ); ?></th>
	4492	+ <td><?php $this->print_text_ldap_lostpassword_url( array( MULTISITE_ADMIN => true ) ); ?></td>
5771	4493	</tr>
5772	4494	<tr>
5773		- <th scope="row"><?php esc_html_e( 'Custom lost password URL', 'authorizer' ); ?></th>
5774		- <td><?php $this->print_text_ldap_lostpassword_url( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4495	+ <th scope="row"><?php _e( 'LDAP attribute containing first name', 'authorizer' ); ?></th>
	4496	+ <td><?php $this->print_text_ldap_attr_first_name( array( MULTISITE_ADMIN => true ) ); ?></td>
5775	4497	</tr>
5776	4498	<tr>
5777		- <th scope="row"><?php esc_html_e( 'LDAP attribute containing first name', 'authorizer' ); ?></th>
5778		- <td><?php $this->print_text_ldap_attr_first_name( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4499	+ <th scope="row"><?php _e( 'LDAP attribute containing last name', 'authorizer' ); ?></th>
	4500	+ <td><?php $this->print_text_ldap_attr_last_name( array( MULTISITE_ADMIN => true ) ); ?></td>
5779	4501	</tr>
5780	4502	<tr>
5781		- <th scope="row"><?php esc_html_e( 'LDAP attribute containing last name', 'authorizer' ); ?></th>
5782		- <td><?php $this->print_text_ldap_attr_last_name( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4503	+ <th scope="row"><?php _e( 'LDAP attribute update', 'authorizer' ); ?></th>
	4504	+ <td><?php $this->print_checkbox_ldap_attr_update_on_login( array( MULTISITE_ADMIN => true ) ); ?></td>
5783	4505	</tr>
5784		- <tr>
5785		- <th scope="row"><?php esc_html_e( 'LDAP attribute update', 'authorizer' ); ?></th>
5786		- <td><?php $this->print_checkbox_ldap_attr_update_on_login( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
5787		- </tr>
5788	4506	</tbody></table>
5789	4507
5790	4508	<?php $this->print_section_info_advanced(); ?>
5791	4509	<table class="form-table"><tbody>
5792	4510	<tr>
5793		- <th scope="row"><?php esc_html_e( 'Limit invalid login attempts', 'authorizer' ); ?></th>
5794		- <td><?php $this->print_text_auth_advanced_lockouts( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4511	+ <th scope="row"><?php _e( 'Limit invalid login attempts', 'authorizer' ); ?></th>
	4512	+ <td><?php $this->print_text_auth_advanced_lockouts( array( MULTISITE_ADMIN => true ) ); ?></td>
5795	4513	</tr>
5796	4514	<tr>
5797		- <th scope="row"><?php esc_html_e( 'Hide WordPress Logins', 'authorizer' ); ?></th>
5798		- <td><?php $this->print_checkbox_auth_advanced_hide_wp_login( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4515	+ <th scope="row"><?php _e( 'Hide WordPress Logins', 'authorizer' ); ?></th>
	4516	+ <td><?php $this->print_checkbox_auth_advanced_hide_wp_login( array( MULTISITE_ADMIN => true ) ); ?></td>
5799	4517	</tr>
5800		- <tr>
5801		- <th scope="row"><?php esc_html_e( 'Number of users per page', 'authorizer' ); ?></th>
5802		- <td><?php $this->print_text_auth_advanced_users_per_page( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
5803		- </tr>
5804		- <tr>
5805		- <th scope="row"><?php esc_html_e( 'Approved users sort method', 'authorizer' ); ?></th>
5806		- <td><?php $this->print_select_auth_advanced_users_sort_by( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
5807		- </tr>
5808		- <tr>
5809		- <th scope="row"><?php esc_html_e( 'Approved users sort order', 'authorizer' ); ?></th>
5810		- <td><?php $this->print_select_auth_advanced_users_sort_order( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
5811		- </tr>
5812		- <tr>
5813		- <th scope="row"><?php esc_html_e( 'Show Dashboard Widget', 'authorizer' ); ?></th>
5814		- <td><?php $this->print_checkbox_auth_advanced_widget_enabled( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
5815		- </tr>
5816	4518	</tbody></table>
5817	4519
5818	4520	<br class="clear" />
5819	4521	</div>
5820		- <input type="button" name="submit" id="submit" class="button button-primary" value="<?php esc_attr_e( 'Save Changes', 'authorizer' ); ?>" onclick="saveAuthMultisiteSettings(this);" />
	4522	+ <input type="button" name="submit" id="submit" class="button button-primary" value="<?php _e( 'Save Changes', 'authorizer' ); ?>" onclick="save_auth_multisite_settings(this);" />
5821	4523	</form>
5822	4524	</div>
5823	4525	<?php
5824	4526	}
		@@ -5825,12 +4527,10 @@
5825	4527
5826	4528
5827	4529	/**
5828	4530	* Save multisite settings (ajax call).
5829		- *
5830		- * Action: wp_ajax_save_auth_multisite_settings
5831	4531	*/
5832		- public function ajax_save_auth_multisite_settings() {
	4532	+ function ajax_save_auth_multisite_settings() {
5833	4533	// Fail silently if current user doesn't have permissions.
5834	4534	if ( ! current_user_can( 'manage_network_options' ) ) {
5835	4535	die( '' );
5836	4536	}
		@@ -5835,14 +4535,14 @@
5835	4535	die( '' );
5836	4536	}
5837	4537
5838	4538	// Make sure nonce exists.
5839		- if ( empty( $_POST['nonce'] ) ) {
	4539	+ if ( empty( $_POST['nonce_save_auth_settings'] ) ) {
5840	4540	die( '' );
5841	4541	}
5842	4542
5843	4543	// Nonce check.
5844		- if ( ! wp_verify_nonce( sanitize_key( $_POST['nonce'] ), 'save_auth_settings' ) ) {
	4544	+ if ( ! wp_verify_nonce( $_POST['nonce_save_auth_settings'], 'save_auth_settings' ) ) {
5845	4545	die( '' );
5846	4546	}
5847	4547
5848	4548	// Assert multisite.
		@@ -5850,15 +4550,15 @@
5850	4550	die( '' );
5851	4551	}
5852	4552
5853	4553	// Get multisite settings.
5854		- $auth_multisite_settings = get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings', array() );
	4554	+ $auth_multisite_settings = get_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings', array() );
5855	4555
5856		- // Sanitize settings.
	4556	+ // Sanitize settings
5857	4557	$auth_multisite_settings = $this->sanitize_options( $_POST );
5858	4558
5859		- // Filter options to only the allowed values (multisite options are a subset of all options).
5860		- $allowed = array(
	4559	+ // Filter options to only the allowed values (multisite options are a subset of all options)
	4560	+ $allowed = array(
5861	4561	'multisite_override',
5862	4562	'access_who_can_login',
5863	4563	'access_who_can_view',
5864	4564	'access_default_role',
		@@ -5876,9 +4576,8 @@
5876	4576	'cas_attr_first_name',
5877	4577	'cas_attr_last_name',
5878	4578	'cas_attr_update_on_login',
5879	4579	'cas_auto_login',
5880		- 'cas_link_on_username',
5881	4580	'ldap',
5882	4581	'ldap_host',
5883	4582	'ldap_port',
5884	4583	'ldap_tls',
		@@ -5892,17 +4591,13 @@
5892	4591	'ldap_attr_last_name',
5893	4592	'ldap_attr_update_on_login',
5894	4593	'advanced_lockouts',
5895	4594	'advanced_hide_wp_login',
5896		- 'advanced_users_per_page',
5897		- 'advanced_users_sort_by',
5898		- 'advanced_users_sort_order',
5899		- 'advanced_widget_enabled',
5900	4595	);
5901	4596	$auth_multisite_settings = array_intersect_key( $auth_multisite_settings, array_flip( $allowed ) );
5902	4597
5903	4598	// Update multisite settings in database.
5904		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings', $auth_multisite_settings );
	4599	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings', $auth_multisite_settings );
5905	4600
5906	4601	// Return 'success' value to AJAX call.
5907	4602	die( 'success' );
5908	4603	}
		@@ -5916,67 +4611,42 @@
5916	4611	*/
5917	4612
5918	4613
5919	4614
5920		- /**
5921		- * Load Authorizer dashboard widget if it's enabled.
5922		- *
5923		- * Action: wp_dashboard_setup
5924		- */
5925		- public function add_dashboard_widgets() {
5926		- $widget_enabled = $this->get_plugin_option( 'advanced_widget_enabled', WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' ) === '1';
5927		-
5928		- // Load authorizer dashboard widget if it's enabled and user has permission.
5929		- if ( current_user_can( 'create_users' ) && $widget_enabled ) {
5930		- // Add dashboard widget for adding/editing users with access.
	4615	+ function add_dashboard_widgets() {
	4616	+ // Only users who can edit can see the authorizer dashboard widget
	4617	+ if ( current_user_can( 'create_users' ) ) {
	4618	+ // Add dashboard widget for adding/editing users with access
5931	4619	wp_add_dashboard_widget( 'auth_dashboard_widget', __( 'Authorizer Settings', 'authorizer' ), array( $this, 'add_auth_dashboard_widget' ) );
5932	4620	}
5933	4621	}
5934	4622
5935	4623
5936		- /**
5937		- * Render Authorizer dashboard widget (callback).
5938		- */
5939		- public function add_auth_dashboard_widget() {
5940		- ?>
5941		- <form method="post" id="auth_settings_access_form" action="">
	4624	+ function add_auth_dashboard_widget() {
	4625	+ ?><form method="post" id="auth_settings_access_form" action="">
5942	4626	<?php $this->print_section_info_access_login(); ?>
5943	4627	<div>
5944		- <h2><?php esc_html_e( 'Pending Users', 'authorizer' ); ?></h2>
	4628	+ <h2><?php _e( 'Pending Users', 'authorizer' ); ?></h2>
5945	4629	<?php $this->print_combo_auth_access_users_pending(); ?>
5946	4630	</div>
5947	4631	<div>
5948		- <h2><?php esc_html_e( 'Approved Users', 'authorizer' ); ?></h2>
	4632	+ <h2><?php _e( 'Approved Users', 'authorizer' ); ?></h2>
5949	4633	<?php $this->print_combo_auth_access_users_approved(); ?>
5950	4634	</div>
5951	4635	<div>
5952		- <h2><?php esc_html_e( 'Blocked Users', 'authorizer' ); ?></h2>
	4636	+ <h2><?php _e( 'Blocked Users', 'authorizer' ); ?></h2>
5953	4637	<?php $this->print_combo_auth_access_users_blocked(); ?>
5954	4638	</div>
5955	4639	<br class="clear" />
5956		- </form>
5957		- <?php
	4640	+ </form><?php
5958	4641	}
5959	4642
5960	4643
5961		-
5962		- /**
5963		- * ***************************
5964		- * AJAX Actions
5965		- * ***************************
5966		- */
5967		-
5968		-
5969		-
5970		- /**
5971		- * Re-render the Approved User list (usually triggered if pager params have
5972		- * changed, e.g., current page, search term, sort order).
5973		- *
5974		- * Action: wp_ajax_refresh_approved_user_list
5975		- *
5976		- * @return void
5977		- */
5978		- public function ajax_refresh_approved_user_list() {
	4644	+ // Fired on a change event from the optional usermeta field in the
	4645	+ // approved user list. Updates the selected usermeta value, or saves it
	4646	+ // in the user's approved list entry if the user hasn't logged in yet
	4647	+ // and created a WordPress account.
	4648	+ function ajax_update_auth_usermeta() {
5979	4649	// Fail silently if current user doesn't have permissions.
5980	4650	if ( ! current_user_can( 'create_users' ) ) {
5981	4651	die( '' );
5982	4652	}
		@@ -5981,175 +4651,35 @@
5981	4651	die( '' );
5982	4652	}
5983	4653
5984	4654	// Nonce check.
5985		- if ( empty( $_POST['nonce'] ) || ! wp_verify_nonce( sanitize_key( $_POST['nonce'] ), 'save_auth_settings' ) ) {
	4655	+ if ( empty( $_POST['nonce_save_auth_settings'] ) || ! wp_verify_nonce( $_POST['nonce_save_auth_settings'], 'save_auth_settings' ) ) {
5986	4656	die( '' );
5987	4657	}
5988	4658
5989	4659	// Fail if required post data doesn't exist.
5990		- if ( ! array_key_exists( 'paged', $_REQUEST ) ) {
	4660	+ if ( ! array_key_exists( 'email', $_REQUEST ) || ! array_key_exists( 'usermeta', $_REQUEST ) ) {
5991	4661	die( '' );
5992	4662	}
5993	4663
5994		- // Get defaults.
5995		- $success = true;
5996		- $message = '';
5997		- $is_network_admin = isset( $_REQUEST['is_network_admin'] ) && '1' === $_REQUEST['is_network_admin'];
5998		-
5999		- // Get user list.
6000		- $option = 'access_users_approved';
6001		- $admin_mode = is_multisite() && $is_network_admin ? WP_Plugin_Authorizer::NETWORK_CONTEXT : WP_Plugin_Authorizer::SINGLE_CONTEXT;
6002		- $auth_settings_option = $this->get_plugin_option( $option, $admin_mode, 'no override' );
6003		- $auth_settings_option = is_array( $auth_settings_option ) ? $auth_settings_option : array();
6004		-
6005		- // Get multisite approved users (will be added to top of list, greyed out).
6006		- $auth_override_multisite = $this->get_plugin_option( 'advanced_override_multisite' );
6007		- $auth_multisite_settings = $this->get_plugin_options( WP_Plugin_Authorizer::NETWORK_CONTEXT );
6008		- $auth_settings_option_multisite = array();
6009		- if (
6010		- is_multisite() &&
6011		- ! $is_network_admin &&
6012		- 1 !== intval( $auth_override_multisite ) &&
6013		- array_key_exists( 'multisite_override', $auth_multisite_settings ) &&
6014		- '1' === $auth_multisite_settings['multisite_override']
6015		- ) {
6016		- $auth_settings_option_multisite = $this->get_plugin_option( $option, WP_Plugin_Authorizer::NETWORK_CONTEXT, 'allow override' );
6017		- $auth_settings_option_multisite = is_array( $auth_settings_option_multisite ) ? $auth_settings_option_multisite : array();
6018		- // Add multisite users to the beginning of the main user array.
6019		- foreach ( array_reverse( $auth_settings_option_multisite ) as $approved_user ) {
6020		- $approved_user['multisite_user'] = true;
6021		- array_unshift( $auth_settings_option, $approved_user );
6022		- }
6023		- }
6024		-
6025		- // Get custom usermeta field to show.
6026		- $advanced_usermeta = $this->get_plugin_option( 'advanced_usermeta' );
6027		-
6028		- // Filter user list to search terms.
6029		- if ( ! empty( $_REQUEST['search'] ) ) {
6030		- $search_term = sanitize_text_field( wp_unslash( $_REQUEST['search'] ) );
6031		- $auth_settings_option = array_filter(
6032		- $auth_settings_option, function ( $user ) use ( $search_term ) {
6033		- return stripos( $user['email'], $search_term ) !== false ||
6034		- stripos( $user['role'], $search_term ) !== false ||
6035		- stripos( $user['date_added'], $search_term ) !== false;
6036		- }
6037		- );
6038		- }
6039		-
6040		- // Sort user list.
6041		- $sort_by = $this->get_plugin_option( 'advanced_users_sort_by', WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' ); // email, role, date_added (registered), created (date approved).
6042		- $sort_order = $this->get_plugin_option( 'advanced_users_sort_order', WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' ); // asc or desc.
6043		- $sort_dimension = array();
6044		- if ( in_array( $sort_by, array( 'email', 'role', 'date_added' ), true ) ) {
6045		- foreach ( $auth_settings_option as $key => $user ) {
6046		- if ( 'date_added' === $sort_by ) {
6047		- $sort_dimension[ $key ] = date( 'Ymd', strtotime( $user[ $sort_by ] ) );
6048		- } else {
6049		- $sort_dimension[ $key ] = strtolower( $user[ $sort_by ] );
6050		- }
6051		- }
6052		- $sort_order = 'asc' === $sort_order ? SORT_ASC : SORT_DESC;
6053		- array_multisort( $sort_dimension, $sort_order, $auth_settings_option );
6054		- } elseif ( 'created' === $sort_by && 'asc' !== $sort_order ) {
6055		- // If default sort method and reverse order, just reverse the array.
6056		- $auth_settings_option = array_reverse( $auth_settings_option );
6057		- }
6058		-
6059		- // Ensure array keys run from 0..max (keys in database will be the original,
6060		- // index, and removing users will not reorder the array keys of other users).
6061		- $auth_settings_option = array_values( $auth_settings_option );
6062		-
6063		- // Get pager params.
6064		- $total_users = count( $auth_settings_option );
6065		- $users_per_page = intval( $this->get_plugin_option( 'advanced_users_per_page', WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' ) );
6066		- $current_page = isset( $_REQUEST['paged'] ) ? intval( $_REQUEST['paged'] ) : 1;
6067		- $total_pages = ceil( $total_users / $users_per_page );
6068		- if ( $total_pages < 1 ) {
6069		- $total_pages = 1;
6070		- }
6071		-
6072		- // Make sure current_page is between 1 and max pages.
6073		- if ( $current_page < 1 ) {
6074		- $current_page = 1;
6075		- } elseif ( $current_page > $total_pages ) {
6076		- $current_page = $total_pages;
6077		- }
6078		-
6079		- // Render user list.
6080		- ob_start();
6081		- $offset = ( $current_page - 1 ) * $users_per_page;
6082		- $max = min( $offset + $users_per_page, count( $auth_settings_option ) );
6083		- for ( $key = $offset; $key < $max; $key++ ) :
6084		- $approved_user = $auth_settings_option[ $key ];
6085		- if ( empty( $approved_user ) || count( $approved_user ) < 1 ) :
6086		- continue;
6087		- endif;
6088		- $this->render_user_element( $approved_user, $key, $option, $admin_mode, $advanced_usermeta );
6089		- endfor;
6090		-
6091		- // Send response to client.
6092		- $response = array(
6093		- 'success' => $success,
6094		- 'message' => $message,
6095		- 'html' => ob_get_clean(),
6096		- /* TRANSLATORS: %s: number of users */
6097		- 'total_users_html' => sprintf( _n( '%s user', '%s users', $total_users, 'authorizer' ), number_format_i18n( $total_users ) ),
6098		- 'total_pages_html' => number_format_i18n( $total_pages ),
6099		- 'total_pages' => $total_pages,
6100		- );
6101		- header( 'content-type: application/json' );
6102		- echo wp_json_encode( $response );
6103		- exit;
6104		- }
6105		-
6106		-
6107		- /**
6108		- * Fired on a change event from the optional usermeta field in the approved
6109		- * user list. Updates the selected usermeta value, or saves it in the user's
6110		- * approved list entry if the user hasn't logged in yet and created a
6111		- * WordPress account.
6112		- *
6113		- * Action: wp_ajax_update_auth_usermeta
6114		- *
6115		- * @return void
6116		- */
6117		- public function ajax_update_auth_usermeta() {
6118		- // Fail silently if current user doesn't have permissions.
6119		- if ( ! current_user_can( 'create_users' ) ) {
6120		- die( '' );
6121		- }
6122		-
6123		- // Nonce check.
6124		- if ( empty( $_POST['nonce'] ) || ! wp_verify_nonce( sanitize_key( $_POST['nonce'] ), 'save_auth_settings' ) ) {
6125		- die( '' );
6126		- }
6127		-
6128		- // Fail if required post data doesn't exist.
6129		- if ( ! isset( $_REQUEST['email'], $_REQUEST['usermeta'] ) ) {
6130		- die( '' );
6131		- }
6132		-
6133	4664	// Get values to update from post data.
6134		- $email = sanitize_email( wp_unslash( $_REQUEST['email'] ) );
6135		- $meta_value = sanitize_meta( 'authorizer-usermeta', wp_unslash( $_REQUEST['usermeta'] ), 'user' );
6136		- $meta_key = $this->get_plugin_option( 'advanced_usermeta' );
	4665	+ $email = $_REQUEST['email'];
	4666	+ $meta_value = $_REQUEST['usermeta'];
	4667	+ $meta_key = $this->get_plugin_option( 'advanced_usermeta' );
6137	4668
6138	4669	// If user doesn't exist, save usermeta selection to authorizer
6139	4670	// list. This value will get saved to usermeta when the user first
6140	4671	// logs in (i.e., when their WordPress account is created).
6141		- $wp_user = get_user_by( 'email', $email );
6142		- if ( ! $wp_user ) {
	4672	+ if ( ! ( $wp_user = get_user_by( 'email', $email ) ) ) {
6143	4673	// Look through multisite approved users and add a usermeta
6144	4674	// reference for the current blog if the user is found.
6145		- $auth_multisite_settings_access_users_approved = is_multisite() ? get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', array() ) : array();
	4675	+ $auth_multisite_settings_access_users_approved = is_multisite() ? get_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', array() ) : array();
6146	4676	$should_update_auth_multisite_settings_access_users_approved = false;
6147	4677	foreach ( $auth_multisite_settings_access_users_approved as $index => $approved_user ) {
6148		- if ( 0 === strcasecmp( $email, $approved_user['email'] ) ) {
6149		- if ( ! is_array( $auth_multisite_settings_access_users_approved[ $index ]['usermeta'] ) ) {
	4678	+ if ( $email === $approved_user['email'] ) {
	4679	+ if ( ! is_array( $auth_multisite_settings_access_users_approved[$index]['usermeta'] ) ) {
6150	4680	// Initialize the array of usermeta for each blog this user belongs to.
6151		- $auth_multisite_settings_access_users_approved[ $index ]['usermeta'] = array();
	4681	+ $auth_multisite_settings_access_users_approved[$index]['usermeta'] = array();
6152	4682	} else {
6153	4683	// There is already usermeta associated with this
6154	4684	// preapproved user; iterate through it and make
6155	4685	// sure it's not for old meta_keys (delete it if
		@@ -6155,53 +4685,55 @@
6155	4685	// sure it's not for old meta_keys (delete it if
6156	4686	// so). This can happen if someone changes the
6157	4687	// usermeta key in authorizer options, and we don't
6158	4688	// want to hang on to old data.
6159		- foreach ( $auth_multisite_settings_access_users_approved[ $index ]['usermeta'] as $blog_id => $usermeta ) {
	4689	+ foreach ( $auth_multisite_settings_access_users_approved[$index]['usermeta'] as $blog_id => $usermeta ) {
6160	4690	if ( array_key_exists( 'meta_key', $usermeta ) && $usermeta['meta_key'] === $meta_key ) {
6161	4691	continue;
6162	4692	} else {
6163		- unset( $auth_multisite_settings_access_users_approved[ $index ]['usermeta'][ $blog_id ] );
	4693	+ unset( $auth_multisite_settings_access_users_approved[$index]['usermeta'][$blog_id] );
6164	4694	}
6165	4695	}
6166	4696	}
6167		- $auth_multisite_settings_access_users_approved[ $index ]['usermeta'][ get_current_blog_id() ] = array(
6168		- 'meta_key' => $meta_key,
	4697	+ $auth_multisite_settings_access_users_approved[$index]['usermeta'][get_current_blog_id()] = array(
	4698	+ 'meta_key' => $meta_key,
6169	4699	'meta_value' => $meta_value,
6170	4700	);
6171		- $should_update_auth_multisite_settings_access_users_approved = true;
	4701	+ $should_update_auth_multisite_settings_access_users_approved = true;
6172	4702	}
6173	4703	}
6174	4704	if ( $should_update_auth_multisite_settings_access_users_approved ) {
6175		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
	4705	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
6176	4706	}
6177	4707
6178	4708	// Look through the approved users (of the current blog in a
6179	4709	// multisite install, or just of the single site) and add a
6180	4710	// usermeta reference if the user is found.
6181		- $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT );
	4711	+ $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN );
6182	4712	$should_update_auth_settings_access_users_approved = false;
6183	4713	foreach ( $auth_settings_access_users_approved as $index => $approved_user ) {
6184		- if ( 0 === strcasecmp( $email, $approved_user['email'] ) ) {
6185		- $auth_settings_access_users_approved[ $index ]['usermeta'] = array(
6186		- 'meta_key' => $meta_key,
	4714	+ if ( $email === $approved_user['email'] ) {
	4715	+ $auth_settings_access_users_approved[$index]['usermeta'] = array(
	4716	+ 'meta_key' => $meta_key,
6187	4717	'meta_value' => $meta_value,
6188	4718	);
6189		- $should_update_auth_settings_access_users_approved = true;
	4719	+ $should_update_auth_settings_access_users_approved = true;
6190	4720	}
6191	4721	}
6192	4722	if ( $should_update_auth_settings_access_users_approved ) {
6193	4723	update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved );
6194	4724	}
	4725	+
6195	4726	} else {
6196	4727	// Update user's usermeta value for usermeta key stored in authorizer options.
6197	4728	if ( strpos( $meta_key, 'acf___' ) === 0 && class_exists( 'acf' ) ) {
6198	4729	// We have an ACF field value, so use the ACF function to update it.
6199		- update_field( str_replace( 'acf___', '', $meta_key ), $meta_value, 'user_' . $wp_user->ID );
	4730	+ update_field( str_replace('acf___', '', $meta_key ), $meta_value, 'user_' . $wp_user->ID );
6200	4731	} else {
6201	4732	// We have a normal usermeta value, so just update it via the WordPress function.
6202	4733	update_user_meta( $wp_user->ID, $meta_key, $meta_value );
6203	4734	}
	4735	+
6204	4736	}
6205	4737
6206	4738	// Return 'success' value to AJAX call.
6207	4739	die( 'success' );
		@@ -6207,17 +4739,9 @@
6207	4739	die( 'success' );
6208	4740	}
6209	4741
6210	4742
6211		- /**
6212		- * Fired on a change event from the user fields in the user lists. Updates
6213		- * the selected user value.
6214		- *
6215		- * Action: wp_ajax_update_auth_user
6216		- *
6217		- * @return void
6218		- */
6219		- public function ajax_update_auth_user() {
	4743	+ function ajax_update_auth_user() {
6220	4744	// Fail silently if current user doesn't have permissions.
6221	4745	if ( ! current_user_can( 'create_users' ) ) {
6222	4746	die( '' );
6223	4747	}
		@@ -6222,79 +4746,76 @@
6222	4746	die( '' );
6223	4747	}
6224	4748
6225	4749	// Nonce check.
6226		- if ( empty( $_POST['nonce'] ) || ! wp_verify_nonce( sanitize_key( $_POST['nonce'] ), 'save_auth_settings' ) ) {
	4750	+ if ( empty( $_POST['nonce_save_auth_settings'] ) || ! wp_verify_nonce( $_POST['nonce_save_auth_settings'], 'save_auth_settings' ) ) {
6227	4751	die( '' );
6228	4752	}
6229	4753
6230	4754	// Fail if requesting a change to an invalid setting.
6231		- if ( ! isset( $_POST['setting'] ) || ! in_array( wp_unslash( $_POST['setting'] ), array( 'access_users_pending', 'access_users_approved', 'access_users_blocked' ), true ) ) {
	4755	+ if ( ! in_array( $_POST['setting'], array( 'access_users_pending', 'access_users_approved', 'access_users_blocked' ) ) ) {
6232	4756	die( '' );
6233	4757	}
6234	4758
6235		- // Track any emails that couldn't be added (used when adding users).
6236		- $invalid_emails = array();
6237		-
6238	4759	// Editing a pending list entry.
6239		- if ( 'access_users_pending' === $_POST['setting'] ) {
6240		- // Sanitize posted data.
6241		- $access_users_pending = array();
6242		- if ( isset( $_POST['access_users_pending'] ) && is_array( $_POST['access_users_pending'] ) ) {
6243		- $access_users_pending = $this->sanitize_update_auth_users( wp_unslash( $_POST['access_users_pending'] ) );
	4760	+ if ( $_POST['setting'] === 'access_users_pending' ) {
	4761	+ // Initialize posted data if empty.
	4762	+ if ( ! ( array_key_exists( 'access_users_pending', $_POST ) && is_array( $_POST['access_users_pending'] ) ) ) {
	4763	+ $_POST['access_users_pending'] = array();
6244	4764	}
6245	4765
6246	4766	// Deal with each modified user (add or remove).
6247		- foreach ( $access_users_pending as $pending_user ) {
	4767	+ foreach ( $_POST['access_users_pending'] as $pending_user ) {
6248	4768
6249		- if ( 'add' === $pending_user['edit_action'] ) {
	4769	+ if ( $pending_user['edit_action'] === 'add' ) {
6250	4770
6251	4771	// Add new user to pending list and save (skip if it's
6252	4772	// already there--someone else might have just done it).
6253	4773	if ( ! $this->is_email_in_list( $pending_user['email'], 'pending' ) ) {
6254	4774	$auth_settings_access_users_pending = $this->sanitize_user_list(
6255		- $this->get_plugin_option( 'access_users_pending', WP_Plugin_Authorizer::SINGLE_CONTEXT )
	4775	+ $this->get_plugin_option( 'access_users_pending', SINGLE_ADMIN )
6256	4776	);
6257	4777	array_push( $auth_settings_access_users_pending, $pending_user );
6258	4778	update_option( 'auth_settings_access_users_pending', $auth_settings_access_users_pending );
6259	4779	}
6260		- } elseif ( 'remove' === $pending_user['edit_action'] ) {
6261	4780
6262		- // Remove user from pending list and save.
6263		- $auth_settings_access_users_pending = $this->get_plugin_option( 'access_users_pending', WP_Plugin_Authorizer::SINGLE_CONTEXT );
6264		- foreach ( $auth_settings_access_users_pending as $key => $existing_user ) {
6265		- if ( 0 === strcasecmp( $pending_user['email'], $existing_user['email'] ) ) {
6266		- unset( $auth_settings_access_users_pending[ $key ] );
6267		- update_option( 'auth_settings_access_users_pending', $auth_settings_access_users_pending );
6268		- break;
	4781	+ } elseif ( $pending_user['edit_action'] === 'remove' ) {
	4782	+
	4783	+ // Remove user from pending list and save
	4784	+ if ( $this->is_email_in_list( $pending_user['email'], 'pending' ) ) {
	4785	+ $auth_settings_access_users_pending = $this->sanitize_user_list(
	4786	+ $this->get_plugin_option( 'access_users_pending', SINGLE_ADMIN )
	4787	+ );
	4788	+ foreach ( $auth_settings_access_users_pending as $key => $existing_user ) {
	4789	+ if ( $pending_user['email'] == $existing_user['email'] ) {
	4790	+ unset( $auth_settings_access_users_pending[$key] );
	4791	+ break;
	4792	+ }
6269	4793	}
	4794	+ update_option( 'auth_settings_access_users_pending', $auth_settings_access_users_pending );
6270	4795	}
	4796	+
6271	4797	}
6272	4798	}
6273	4799	}
6274	4800
6275	4801	// Editing an approved list entry.
6276		- if ( 'access_users_approved' === $_POST['setting'] ) {
6277		- // Sanitize posted data.
6278		- $access_users_approved = array();
6279		- if ( isset( $_POST['access_users_approved'] ) && is_array( $_POST['access_users_approved'] ) ) {
6280		- $access_users_approved = $this->sanitize_update_auth_users( wp_unslash( $_POST['access_users_approved'] ) );
	4802	+ if ( $_POST['setting'] === 'access_users_approved' ) {
	4803	+ // Initialize posted data if empty.
	4804	+ if ( ! ( array_key_exists( 'access_users_approved', $_POST ) && is_array( $_POST['access_users_approved'] ) ) ) {
	4805	+ $_POST['access_users_approved'] = array();
6281	4806	}
6282	4807
6283	4808	// Deal with each modified user (add, remove, or change_role).
6284		- foreach ( $access_users_approved as $approved_user ) {
6285		- // Skip blank entries.
6286		- if ( strlen( $approved_user['email'] ) < 1 ) {
6287		- continue;
6288		- }
	4809	+ foreach ( $_POST['access_users_approved'] as $approved_user ) {
6289	4810
6290	4811	// New user (create user, or add existing user to current site in multisite).
6291		- if ( 'add' === $approved_user['edit_action'] ) {
	4812	+ if ( $approved_user['edit_action'] === 'add' ) {
6292	4813	$new_user = get_user_by( 'email', $approved_user['email'] );
6293		- if ( false !== $new_user ) {
	4814	+ if ( $new_user !== false ) {
6294	4815	// If we're adding an existing multisite user, make sure their
6295	4816	// newly-assigned role is updated on all sites they are already in.
6296		- if ( is_multisite() && 'false' !== $approved_user['multisite_user'] ) {
	4817	+ if ( is_multisite() && $approved_user['multisite_user'] !== 'false' ) {
6297	4818	foreach ( get_blogs_of_user( $new_user->ID ) as $blog ) {
6298	4819	add_user_to_blog( $blog->userblog_id, $new_user->ID, $approved_user['role'] );
6299	4820	}
6300	4821	}
		@@ -6301,9 +4822,9 @@
6301	4822	// If this user already has an account on another site in the network, add them to this site.
6302	4823	if ( is_multisite() ) {
6303	4824	add_user_to_blog( get_current_blog_id(), $new_user->ID, $approved_user['role'] );
6304	4825	}
6305		- } elseif ( $approved_user['local_user'] && 'false' !== $approved_user['local_user'] ) {
	4826	+ } elseif ( $approved_user['local_user'] === 'true' ) {
6306	4827	// Create a WP account for this new *local* user and email the password.
6307	4828	$plaintext_password = wp_generate_password(); // random password
6308	4829	// If there's already a user with this username (e.g.,
6309	4830	// johndoe/johndoe@gmail.com exists, and we're trying to add
		@@ -6311,26 +4832,26 @@
6311	4832	// as the username.
6312	4833	$username = explode( '@', $approved_user['email'] );
6313	4834	$username = $username[0];
6314	4835	if ( get_user_by( 'login', $username ) !== false ) {
6315		- $username = $this->lowercase( $approved_user['email'] );
	4836	+ $username = $approved_user['email'];
6316	4837	}
6317		- if ( 'false' !== $approved_user['multisite_user'] ) {
	4838	+ if ( $approved_user['multisite_user'] !== 'false' ) {
6318	4839	$result = wpmu_create_user(
6319	4840	strtolower( $username ),
6320	4841	$plaintext_password,
6321		- $this->lowercase( $approved_user['email'] )
	4842	+ strtolower( $approved_user['email'] )
6322	4843	);
6323	4844	} else {
6324	4845	$result = wp_insert_user(
6325	4846	array(
6326		- 'user_login' => strtolower( $username ),
6327		- 'user_pass' => $plaintext_password,
6328		- 'first_name' => '',
6329		- 'last_name' => '',
6330		- 'user_email' => $this->lowercase( $approved_user['email'] ),
	4847	+ 'user_login' => strtolower( $username ),
	4848	+ 'user_pass' => $plaintext_password,
	4849	+ 'first_name' => '',
	4850	+ 'last_name' => '',
	4851	+ 'user_email' => strtolower( $approved_user['email'] ),
6331	4852	'user_registered' => date( 'Y-m-d H:i:s' ),
6332		- 'role' => $approved_user['role'],
	4853	+ 'role' => $approved_user['role'],
6333	4854	)
6334	4855	);
6335	4856	}
6336	4857	if ( ! is_wp_error( $result ) ) {
		@@ -6336,8 +4857,9 @@
6336	4857	if ( ! is_wp_error( $result ) ) {
6337	4858	// Email login credentials to new user.
6338	4859	wp_new_user_notification( $result, null, 'both' );
6339	4860	}
	4861	+
6340	4862	}
6341	4863
6342	4864	// Email new user welcome message if plugin option is set.
6343	4865	$this->maybe_email_welcome_message( $approved_user['email'] );
		@@ -6343,46 +4865,41 @@
6343	4865	$this->maybe_email_welcome_message( $approved_user['email'] );
6344	4866
6345	4867	// Add new user to approved list and save (skip if it's
6346	4868	// already there--someone else might have just done it).
6347		- if ( 'false' !== $approved_user['multisite_user'] ) {
	4869	+ if ( $approved_user['multisite_user'] !== 'false' ) {
6348	4870	if ( ! $this->is_email_in_list( $approved_user['email'], 'approved', 'multisite' ) ) {
6349	4871	$auth_multisite_settings_access_users_approved = $this->sanitize_user_list(
6350		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT )
	4872	+ $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN )
6351	4873	);
6352		- $approved_user['date_added'] = date( 'M Y' );
	4874	+ $approved_user['date_added'] = date( 'M Y' );
6353	4875	array_push( $auth_multisite_settings_access_users_approved, $approved_user );
6354		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
6355		- } else {
6356		- $invalid_emails[] = $approved_user['email'];
	4876	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
6357	4877	}
6358	4878	} else {
6359	4879	if ( ! $this->is_email_in_list( $approved_user['email'], 'approved' ) ) {
6360	4880	$auth_settings_access_users_approved = $this->sanitize_user_list(
6361		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT )
	4881	+ $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN )
6362	4882	);
6363		- $approved_user['date_added'] = date( 'M Y' );
	4883	+ $approved_user['date_added'] = date( 'M Y' );
6364	4884	array_push( $auth_settings_access_users_approved, $approved_user );
6365	4885	update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved );
6366		- } else {
6367		- $invalid_emails[] = $approved_user['email'];
6368	4886	}
6369	4887	}
6370	4888
6371	4889	// If we've added a new multisite user, go through all pending/approved/blocked lists
6372	4890	// on individual sites and remove this user from them (to prevent duplicate entries).
6373		- if ( 'false' !== $approved_user['multisite_user'] && is_multisite() ) {
	4891	+ if ( $approved_user['multisite_user'] !== 'false' && is_multisite() ) {
6374	4892	$list_names = array( 'access_users_pending', 'access_users_approved', 'access_users_blocked' );
6375		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
6376	4893	$sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
6377	4894	foreach ( $sites as $site ) {
6378	4895	$blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
6379	4896	foreach ( $list_names as $list_name ) {
6380		- $user_list = get_blog_option( $blog_id, 'auth_settings_' . $list_name, array() );
	4897	+ $user_list = get_blog_option( $blog_id, 'auth_settings_' . $list_name, array() );
6381	4898	$list_changed = false;
6382	4899	foreach ( $user_list as $key => $user ) {
6383		- if ( 0 === strcasecmp( $user['email'], $approved_user['email'] ) ) {
6384		- unset( $user_list[ $key ] );
	4900	+ if ( $user['email'] == $approved_user['email'] ) {
	4901	+ unset( $user_list[$key] );
6385	4902	$list_changed = true;
6386	4903	}
6387	4904	}
6388	4905	if ( $list_changed ) {
		@@ -6390,47 +4907,44 @@
6390	4907	}
6391	4908	}
6392	4909	}
6393	4910	}
6394		- } elseif ( 'remove' === $approved_user['edit_action'] ) { // Remove user from approved list and save (also remove their role if they have a WordPress account).
6395		- if ( 'false' !== $approved_user['multisite_user'] ) {
6396		- $auth_multisite_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT );
6397		- foreach ( $auth_multisite_settings_access_users_approved as $key => $existing_user ) {
6398		- if ( 0 === strcasecmp( $approved_user['email'], $existing_user['email'] ) ) {
6399		- // Remove role of the associated WordPress user from all blogs (but don't delete the user).
6400		- $user = get_user_by( 'email', $approved_user['email'] );
6401		- if ( false !== $user ) {
6402		- // Loop through all of the blogs this user is a member of and remove their capabilities.
6403		- foreach ( get_blogs_of_user( $user->ID ) as $blog ) {
6404		- remove_user_from_blog( $user->ID, $blog->userblog_id, '' );
6405		- }
	4911	+
	4912	+ // Remove user from approved list and save
	4913	+ } elseif ( $approved_user['edit_action'] === 'remove' ) {
	4914	+ if ( $approved_user['multisite_user'] !== 'false' ) {
	4915	+ if ( $this->is_email_in_list( $approved_user['email'], 'approved', 'multisite' ) ) {
	4916	+ $auth_multisite_settings_access_users_approved = $this->sanitize_user_list(
	4917	+ $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN )
	4918	+ );
	4919	+ foreach ( $auth_multisite_settings_access_users_approved as $key => $existing_user ) {
	4920	+ if ( $approved_user['email'] == $existing_user['email'] ) {
	4921	+ unset( $auth_multisite_settings_access_users_approved[$key] );
	4922	+ break;
6406	4923	}
6407		- // Remove entry from Approved Users list.
6408		- unset( $auth_multisite_settings_access_users_approved[ $key ] );
6409		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
6410		- break;
6411	4924	}
	4925	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
6412	4926	}
6413	4927	} else {
6414		- $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT );
6415		- foreach ( $auth_settings_access_users_approved as $key => $existing_user ) {
6416		- if ( 0 === strcasecmp( $approved_user['email'], $existing_user['email'] ) ) {
6417		- // Remove role of the associated WordPress user (but don't delete the user).
6418		- $user = get_user_by( 'email', $approved_user['email'] );
6419		- if ( false !== $user ) {
6420		- $user->set_role( '' );
	4928	+ if ( $this->is_email_in_list( $approved_user['email'], 'approved' ) ) {
	4929	+ $auth_settings_access_users_approved = $this->sanitize_user_list(
	4930	+ $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN )
	4931	+ );
	4932	+ foreach ( $auth_settings_access_users_approved as $key => $existing_user ) {
	4933	+ if ( $approved_user['email'] == $existing_user['email'] ) {
	4934	+ unset( $auth_settings_access_users_approved[$key] );
	4935	+ break;
6421	4936	}
6422		- // Remove entry from Approved Users list.
6423		- unset( $auth_settings_access_users_approved[ $key ] );
6424		- update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved );
6425		- break;
6426	4937	}
	4938	+ update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved );
6427	4939	}
6428	4940	}
6429		- } elseif ( 'change_role' === $approved_user['edit_action'] ) { // Update user's role in WordPress.
	4941	+
	4942	+ // Update user's role in WordPress
	4943	+ } elseif ( $approved_user['edit_action'] === 'change_role' ) {
6430	4944	$changed_user = get_user_by( 'email', $approved_user['email'] );
6431	4945	if ( $changed_user ) {
6432		- if ( is_multisite() && 'false' !== $approved_user['multisite_user'] ) {
	4946	+ if ( is_multisite() && $approved_user['multisite_user'] !== 'false' ) {
6433	4947	foreach ( get_blogs_of_user( $changed_user->ID ) as $blog ) {
6434	4948	add_user_to_blog( $blog->userblog_id, $changed_user->ID, $approved_user['role'] );
6435	4949	}
6436	4950	} else {
		@@ -6437,30 +4951,30 @@
6437	4951	$changed_user->set_role( $approved_user['role'] );
6438	4952	}
6439	4953	}
6440	4954
6441		- if ( 'false' !== $approved_user['multisite_user'] ) {
	4955	+ if ( $approved_user['multisite_user'] !== 'false' ) {
6442	4956	if ( $this->is_email_in_list( $approved_user['email'], 'approved', 'multisite' ) ) {
6443	4957	$auth_multisite_settings_access_users_approved = $this->sanitize_user_list(
6444		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT )
	4958	+ $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN )
6445	4959	);
6446	4960	foreach ( $auth_multisite_settings_access_users_approved as $key => $existing_user ) {
6447		- if ( 0 === strcasecmp( $approved_user['email'], $existing_user['email'] ) ) {
6448		- $auth_multisite_settings_access_users_approved[ $key ]['role'] = $approved_user['role'];
	4961	+ if ( $approved_user['email'] == $existing_user['email'] ) {
	4962	+ $auth_multisite_settings_access_users_approved[$key]['role'] = $approved_user['role'];
6449	4963	break;
6450	4964	}
6451	4965	}
6452		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
	4966	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
6453	4967	}
6454	4968	} else {
6455	4969	// Update user's role in approved list and save.
6456	4970	if ( $this->is_email_in_list( $approved_user['email'], 'approved' ) ) {
6457	4971	$auth_settings_access_users_approved = $this->sanitize_user_list(
6458		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT )
	4972	+ $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN )
6459	4973	);
6460	4974	foreach ( $auth_settings_access_users_approved as $key => $existing_user ) {
6461		- if ( 0 === strcasecmp( $approved_user['email'], $existing_user['email'] ) ) {
6462		- $auth_settings_access_users_approved[ $key ]['role'] = $approved_user['role'];
	4975	+ if ( $approved_user['email'] == $existing_user['email'] ) {
	4976	+ $auth_settings_access_users_approved[$key]['role'] = $approved_user['role'];
6463	4977	break;
6464	4978	}
6465	4979	}
6466	4980	update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved );
		@@ -6465,33 +4979,28 @@
6465	4979	}
6466	4980	update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved );
6467	4981	}
6468	4982	}
	4983	+
6469	4984	}
6470	4985	}
6471	4986	}
6472	4987
6473	4988	// Editing a blocked list entry.
6474		- if ( 'access_users_blocked' === $_POST['setting'] ) {
6475		- // Sanitize post data.
6476		- $access_users_blocked = array();
6477		- if ( isset( $_POST['access_users_blocked'] ) && is_array( $_POST['access_users_blocked'] ) ) {
6478		- $access_users_blocked = $this->sanitize_update_auth_users(
6479		- wp_unslash( $_POST['access_users_blocked'] ),
6480		- array(
6481		- 'allow_wildcard_email' => true,
6482		- )
6483		- );
	4989	+ if ( $_POST['setting'] === 'access_users_blocked' ) {
	4990	+ // Initialize posted data if empty.
	4991	+ if ( ! ( array_key_exists( 'access_users_blocked', $_POST ) && is_array( $_POST['access_users_blocked'] ) ) ) {
	4992	+ $_POST['access_users_blocked'] = array();
6484	4993	}
6485	4994
6486	4995	// Deal with each modified user (add or remove).
6487		- foreach ( $access_users_blocked as $blocked_user ) {
	4996	+ foreach ( $_POST['access_users_blocked'] as $blocked_user ) {
6488	4997
6489		- if ( 'add' === $blocked_user['edit_action'] ) {
	4998	+ if ( $blocked_user['edit_action'] === 'add' ) {
6490	4999
6491	5000	// Add auth_blocked usermeta for the user.
6492	5001	$blocked_wp_user = get_user_by( 'email', $blocked_user['email'] );
6493		- if ( false !== $blocked_wp_user ) {
	5002	+ if ( $blocked_wp_user !== false ) {
6494	5003	update_user_meta( $blocked_wp_user->ID, 'auth_blocked', 'yes' );
6495	5004	}
6496	5005
6497	5006	// Add new user to blocked list and save (skip if it's
		@@ -6497,162 +5006,48 @@
6497	5006	// Add new user to blocked list and save (skip if it's
6498	5007	// already there--someone else might have just done it).
6499	5008	if ( ! $this->is_email_in_list( $blocked_user['email'], 'blocked' ) ) {
6500	5009	$auth_settings_access_users_blocked = $this->sanitize_user_list(
6501		- $this->get_plugin_option( 'access_users_blocked', WP_Plugin_Authorizer::SINGLE_CONTEXT )
	5010	+ $this->get_plugin_option( 'access_users_blocked', SINGLE_ADMIN )
6502	5011	);
6503		- $blocked_user['date_added'] = date( 'M Y' );
	5012	+ $blocked_user['date_added'] = date( 'M Y' );
6504	5013	array_push( $auth_settings_access_users_blocked, $blocked_user );
6505	5014	update_option( 'auth_settings_access_users_blocked', $auth_settings_access_users_blocked );
6506		- } else {
6507		- $invalid_emails[] = $blocked_user['email'];
6508	5015	}
6509		- } elseif ( 'remove' === $blocked_user['edit_action'] ) {
6510	5016
	5017	+ } elseif ( $blocked_user['edit_action'] === 'remove' ) {
	5018	+
6511	5019	// Remove auth_blocked usermeta for the user.
6512	5020	$unblocked_user = get_user_by( 'email', $blocked_user['email'] );
6513		- if ( false !== $unblocked_user ) {
	5021	+ if ( $unblocked_user !== false ) {
6514	5022	delete_user_meta( $unblocked_user->ID, 'auth_blocked', 'yes' );
6515	5023	}
6516	5024
6517		- // Remove user from blocked list and save.
6518		- $auth_settings_access_users_blocked = $this->get_plugin_option( 'access_users_blocked', WP_Plugin_Authorizer::SINGLE_CONTEXT );
6519		- foreach ( $auth_settings_access_users_blocked as $key => $existing_user ) {
6520		- if ( 0 === strcasecmp( $blocked_user['email'], $existing_user['email'] ) ) {
6521		- unset( $auth_settings_access_users_blocked[ $key ] );
6522		- update_option( 'auth_settings_access_users_blocked', $auth_settings_access_users_blocked );
6523		- break;
	5025	+ // Remove user from blocked list and save
	5026	+ if ( $this->is_email_in_list( $blocked_user['email'], 'blocked' ) ) {
	5027	+ $auth_settings_access_users_blocked = $this->sanitize_user_list(
	5028	+ $this->get_plugin_option( 'access_users_blocked', SINGLE_ADMIN )
	5029	+ );
	5030	+ foreach ( $auth_settings_access_users_blocked as $key => $existing_user ) {
	5031	+ if ( $blocked_user['email'] == $existing_user['email'] ) {
	5032	+ unset( $auth_settings_access_users_blocked[$key] );
	5033	+ break;
	5034	+ }
6524	5035	}
	5036	+ update_option( 'auth_settings_access_users_blocked', $auth_settings_access_users_blocked );
6525	5037	}
	5038	+
6526	5039	}
6527	5040	}
6528	5041	}
6529	5042
6530		- // Send response to client.
6531		- $response = array(
6532		- 'success' => true,
6533		- 'invalid_emails' => $invalid_emails,
6534		- );
6535		- header( 'content-type: application/json' );
6536		- echo wp_json_encode( $response );
6537		- exit;
	5043	+ // Return 'success' value to AJAX call.
	5044	+ die( 'success' );
6538	5045	}
6539	5046
6540	5047
6541		- /**
6542		- * Sanitizes an array of user update commands coming from the AJAX handler in Authorizer Settings.
6543		- *
6544		- * Example $users array:
6545		- * array(
6546		- * array(
6547		- * edit_action: 'add' or 'remove' or 'change_role',
6548		- * email: 'johndoe@example.com',
6549		- * role: 'subscriber',
6550		- * date_added: 'Jun 2014',
6551		- * local_user: 'true' or 'false',
6552		- * multisite_user: 'true' or 'false',
6553		- * ),
6554		- * ...
6555		- * )
6556		- *
6557		- * @param array $users Users to edit.
6558		- * @param array $args Options (e.g., 'allow_wildcard_email' => true).
6559		- * @return array Sanitized users to edit.
6560		- */
6561		- private function sanitize_update_auth_users( $users = array(), $args = array() ) {
6562		- if ( ! is_array( $users ) ) {
6563		- $users = array();
6564		- }
6565		- if ( isset( $args['allow_wildcard_email'] ) && $args['allow_wildcard_email'] ) {
6566		- $users = array_map( array( $this, 'sanitize_update_auth_user_allow_wildcard_email' ), $users );
6567		- } else {
6568		- $users = array_map( array( $this, 'sanitize_update_auth_user' ), $users );
6569		- }
6570	5048
6571		- // Remove any entries that failed email address validation.
6572		- $users = array_filter( $users, array( $this, 'remove_invalid_auth_users' ) );
6573		-
6574		- return $users;
6575		- }
6576		-
6577		-
6578	5049	/**
6579		- * This array filter will remove any users who failed email address validation
6580		- * (which would set their email to a blank string).
6581		- * @param array $user User data to check for a valid email.
6582		- * @return bool Whether to filter out the user.
6583		- */
6584		- private function remove_invalid_auth_users( $user ) {
6585		- return isset( $user['email'] ) && strlen( $user['email'] ) > 0;
6586		- }
6587		-
6588		- /**
6589		- * Callback for array_map in sanitize_update_auth_users().
6590		- *
6591		- * @param array $user User data to sanitize.
6592		- * @return array Sanitized user data.
6593		- */
6594		- private function sanitize_update_auth_user( $user ) {
6595		- if ( array_key_exists( 'edit_action', $user ) ) {
6596		- $user['edit_action'] = sanitize_text_field( $user['edit_action'] );
6597		- }
6598		- if ( isset( $user['email'] ) ) {
6599		- $user['email'] = sanitize_email( $user['email'] );
6600		- }
6601		- if ( isset( $user['role'] ) ) {
6602		- $user['role'] = sanitize_text_field( $user['role'] );
6603		- }
6604		- if ( isset( $user['date_added'] ) ) {
6605		- $user['date_added'] = sanitize_text_field( $user['date_added'] );
6606		- }
6607		- if ( isset( $user['local_user'] ) ) {
6608		- $user['local_user'] = 'true' === $user['local_user'] ? 'true' : 'false';
6609		- }
6610		- if ( isset( $user['multisite_user'] ) ) {
6611		- $user['multisite_user'] = 'true' === $user['multisite_user'] ? 'true' : 'false';
6612		- }
6613		-
6614		- return $user;
6615		- }
6616		-
6617		-
6618		-
6619		- /**
6620		- * Callback for array_map in sanitize_update_auth_users().
6621		- *
6622		- * @param array $user User data to sanitize.
6623		- * @return array Sanitized user data.
6624		- */
6625		- private function sanitize_update_auth_user_allow_wildcard_email( $user ) {
6626		- if ( array_key_exists( 'edit_action', $user ) ) {
6627		- $user['edit_action'] = sanitize_text_field( $user['edit_action'] );
6628		- }
6629		- if ( isset( $user['email'] ) ) {
6630		- if ( strpos( $user['email'], '@' ) === 0 ) {
6631		- $user['email'] = sanitize_text_field( $user['email'] );
6632		- } else {
6633		- $user['email'] = sanitize_email( $user['email'] );
6634		- }
6635		- }
6636		- if ( isset( $user['role'] ) ) {
6637		- $user['role'] = sanitize_text_field( $user['role'] );
6638		- }
6639		- if ( isset( $user['date_added'] ) ) {
6640		- $user['date_added'] = sanitize_text_field( $user['date_added'] );
6641		- }
6642		- if ( isset( $user['local_user'] ) ) {
6643		- $user['local_user'] = 'true' === $user['local_user'] ? 'true' : 'false';
6644		- }
6645		- if ( isset( $user['multisite_user'] ) ) {
6646		- $user['multisite_user'] = 'true' === $user['multisite_user'] ? 'true' : 'false';
6647		- }
6648		-
6649		- return $user;
6650		- }
6651		-
6652		-
6653		-
6654		- /**
6655	5050	* ***************************
6656	5051	* Helper functions
6657	5052	* ***************************
6658	5053	*/
		@@ -6660,20 +5055,20 @@
6660	5055
6661	5056	/**
6662	5057	* Retrieves a specific plugin option from db. Multisite enabled.
6663	5058	*
6664		- * @param string $option Option name.
6665		- * @param string $admin_mode WP_Plugin_Authorizer::NETWORK_CONTEXT will retrieve the multisite value.
6666		- * @param string $override_mode 'allow override' will retrieve the multisite value if it exists.
6667		- * @param string $print_mode 'print overlay' will output overlay that hides this option on the settings page.
6668		- * @return mixed Option value, or null on failure.
	5059	+ * @param string $option Option name
	5060	+ * @param string $admin_mode MULTISITE_ADMIN will retrieve the multisite value
	5061	+ * @param string $override_mode 'allow override' will retrieve the multisite value if it exists
	5062	+ * @param string $print_mode 'print overlay' will output overlay that hides this option on the settings page
	5063	+ * @return mixed Option value, or null on failure
6669	5064	*/
6670		- private function get_plugin_option( $option, $admin_mode = WP_Plugin_Authorizer::SINGLE_CONTEXT, $override_mode = 'no override', $print_mode = 'no overlay' ) {
	5065	+ private function get_plugin_option( $option, $admin_mode = SINGLE_ADMIN, $override_mode = 'no override', $print_mode = 'no overlay' ) {
6671	5066	// Special case for user lists (they are saved seperately to prevent concurrency issues).
6672		- if ( in_array( $option, array( 'access_users_pending', 'access_users_approved', 'access_users_blocked' ), true ) ) {
6673		- $list = WP_Plugin_Authorizer::NETWORK_CONTEXT === $admin_mode ? array() : get_option( 'auth_settings_' . $option );
6674		- if ( is_multisite() && WP_Plugin_Authorizer::NETWORK_CONTEXT === $admin_mode ) {
6675		- $list = get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_' . $option, array() );
	5067	+ if ( in_array( $option, array( 'access_users_pending', 'access_users_approved', 'access_users_blocked' ) ) ) {
	5068	+ $list = $admin_mode === MULTISITE_ADMIN ? array() : get_option( 'auth_settings_' . $option );
	5069	+ if ( is_multisite() && $admin_mode === MULTISITE_ADMIN ) {
	5070	+ $list = get_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_' . $option, array() );
6676	5071	}
6677	5072	return $list;
6678	5073	}
6679	5074
		@@ -6687,26 +5082,24 @@
6687	5082
6688	5083	// If requested and appropriate, print the overlay hiding the
6689	5084	// single site option that is overridden by a multisite option.
6690	5085	if (
6691		- WP_Plugin_Authorizer::NETWORK_CONTEXT !== $admin_mode &&
6692		- 'allow override' === $override_mode &&
6693		- 'print overlay' === $print_mode &&
	5086	+ $admin_mode !== MULTISITE_ADMIN &&
	5087	+ $override_mode === 'allow override' &&
	5088	+ $print_mode === 'print overlay' &&
6694	5089	array_key_exists( 'multisite_override', $auth_settings ) &&
6695		- '1' === $auth_settings['multisite_override'] &&
6696		- ( ! array_key_exists( 'advanced_override_multisite', $auth_settings ) || 1 !== intval( $auth_settings['advanced_override_multisite'] ) )
	5090	+ $auth_settings['multisite_override'] === '1' &&
	5091	+ ( ! array_key_exists( 'advanced_override_multisite', $auth_settings ) || $auth_settings['advanced_override_multisite'] != '1' )
6697	5092	) {
6698	5093	// Get original plugin options (not overridden value). We'll
6699	5094	// show this old value behind the disabled overlay.
6700		- // $auth_settings = $this->get_plugin_options( $admin_mode, 'no override' );
6701		- // (This feature is disabled).
6702		- //
	5095	+ $auth_settings = $this->get_plugin_options( $admin_mode, 'no override' );
	5096	+
6703	5097	$name = "auth_settings[$option]";
6704		- $id = "auth_settings_$option";
6705		- ?>
6706		- <div id="overlay-hide-auth_settings_<?php echo esc_attr( $option ); ?>" class="auth_multisite_override_overlay">
	5098	+ $id = "auth_settings_$option"; ?>
	5099	+ <div id="overlay-hide-auth_settings_<?php echo $option; ?>" class="auth_multisite_override_overlay">
6707	5100	<span class="overlay-note">
6708		- <?php esc_html_e( 'This setting is overridden by a', 'authorizer' ); ?> <a href="<?php echo esc_attr( network_admin_url( 'admin.php?page=authorizer' ) ); ?>"><?php esc_html_e( 'multisite option', 'authorizer' ); ?></a>.
	5101	+ <?php _e( 'This setting is overridden by a', 'authorizer' ); ?> <a href="<?php echo network_admin_url( 'admin.php?page=authorizer&tab=external' ); ?>"><?php _e( 'multisite option', 'authorizer' ); ?></a>.
6709	5102	</span>
6710	5103	</div>
6711	5104	<?php
6712	5105	}
		@@ -6712,9 +5105,9 @@
6712	5105	}
6713	5106
6714	5107	// If we're getting an option in a site that has overridden the multisite override, make
6715	5108	// sure we are returning the option value from that site (not the multisite value).
6716		- if ( array_key_exists( 'advanced_override_multisite', $auth_settings ) && 1 === intval( $auth_settings['advanced_override_multisite'] ) ) {
	5109	+ if ( array_key_exists( 'advanced_override_multisite', $auth_settings ) && $auth_settings['advanced_override_multisite'] == '1' ) {
6717	5110	$auth_settings = $this->get_plugin_options( $admin_mode, 'no override' );
6718	5111	}
6719	5112
6720	5113	// Set option to null if it wasn't found.
		@@ -6721,116 +5114,98 @@
6721	5114	if ( ! array_key_exists( $option, $auth_settings ) ) {
6722	5115	return null;
6723	5116	}
6724	5117
6725		- return $auth_settings[ $option ];
	5118	+ return $auth_settings[$option];
6726	5119	}
6727	5120
6728	5121	/**
6729	5122	* Retrieves all plugin options from db. Multisite enabled.
6730	5123	*
6731		- * @param string $admin_mode WP_Plugin_Authorizer::NETWORK_CONTEXT will retrieve the multisite value.
6732		- * @param string $override_mode 'allow override' will retrieve the multisite value if it exists.
6733		- * @return mixed Option value, or null on failure.
	5124	+ * @param string $admin_mode MULTISITE_ADMIN will retrieve the multisite value
	5125	+ * @param string $override_mode 'allow override' will retrieve the multisite value if it exists
	5126	+ * @return mixed Option value, or null on failure
6734	5127	*/
6735		- private function get_plugin_options( $admin_mode = WP_Plugin_Authorizer::SINGLE_CONTEXT, $override_mode = 'no override' ) {
6736		- // Grab plugin settings (skip if in WP_Plugin_Authorizer::NETWORK_CONTEXT mode).
6737		- $auth_settings = WP_Plugin_Authorizer::NETWORK_CONTEXT === $admin_mode ? array() : get_option( 'auth_settings' );
	5128	+ private function get_plugin_options( $admin_mode = SINGLE_ADMIN, $override_mode = 'no override' ) {
	5129	+ // Grab plugin settings (skip if in MULTISITE_ADMIN mode).
	5130	+ $auth_settings = $admin_mode === MULTISITE_ADMIN ? array() : get_option( 'auth_settings' );
6738	5131
6739	5132	// Initialize to default values if the plugin option doesn't exist.
6740		- if ( false === $auth_settings ) {
	5133	+ if ( $auth_settings === FALSE ) {
6741	5134	$auth_settings = $this->set_default_options();
6742	5135	}
6743	5136
6744	5137	// Merge multisite options if we're in a network and the current site hasn't overridden multisite settings.
6745		- if ( is_multisite() && ( ! array_key_exists( 'advanced_override_multisite', $auth_settings ) || 1 !== intval( $auth_settings['advanced_override_multisite'] ) ) ) {
	5138	+ if ( is_multisite() && ( ! array_key_exists( 'advanced_override_multisite', $auth_settings ) || $auth_settings['advanced_override_multisite'] != '1' ) ) {
6746	5139	// Get multisite options.
6747		- $auth_multisite_settings = get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings', array() );
	5140	+ $auth_multisite_settings = get_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings', array() );
6748	5141
6749	5142	// Return the multisite options if we're viewing the network admin options page.
6750	5143	// Otherwise override options with their multisite equivalents.
6751		- if ( WP_Plugin_Authorizer::NETWORK_CONTEXT === $admin_mode ) {
	5144	+ if ( $admin_mode === MULTISITE_ADMIN ) {
6752	5145	$auth_settings = $auth_multisite_settings;
6753	5146	} elseif (
6754		- 'allow override' === $override_mode &&
	5147	+ $override_mode === 'allow override' &&
6755	5148	array_key_exists( 'multisite_override', $auth_multisite_settings ) &&
6756		- '1' === $auth_multisite_settings['multisite_override']
	5149	+ $auth_multisite_settings['multisite_override'] === '1'
6757	5150	) {
6758	5151	// Keep track of the multisite override selection.
6759	5152	$auth_settings['multisite_override'] = $auth_multisite_settings['multisite_override'];
6760	5153
6761		- /**
6762		- * Note: the options below should be the complete list of overridden
6763		- * options. It is *not* the complete list of all options (some options
6764		- * don't have a multisite equivalent).
6765		- */
	5154	+ // Note: the options below should be the complete list of
	5155	+ // overridden options. It is *not* the complete list of all
	5156	+ // options (some options don't have a multisite equivalent)
6766	5157
6767		- /**
6768		- * Note: access_users_approved, access_users_pending, and
6769		- * access_users_blocked do not get overridden. However, since
6770		- * access_users_approved has a multisite equivalent, you must retrieve
6771		- * them both seperately. This is done because the two lists should be
6772		- * treated differently.
6773		- *
6774		- * $approved_users = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT );
6775		- * $ms_approved_users = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT );
6776		- */
	5158	+ // Note: access_users_approved, access_users_pending, and
	5159	+ // access_users_blocked do not get overridden. However,
	5160	+ // since access_users_approved has a multisite equivalent,
	5161	+ // you must retrieve them both seperately. This is done
	5162	+ // because the two lists should be treated differently.
	5163	+ // $approved_users = $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN );
	5164	+ // $ms_approved_users = $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN );
6777	5165
6778		- // Override external services (google, cas, or ldap) and associated options.
6779		- $auth_settings['google'] = $auth_multisite_settings['google'];
6780		- $auth_settings['google_clientid'] = $auth_multisite_settings['google_clientid'];
6781		- $auth_settings['google_clientsecret'] = $auth_multisite_settings['google_clientsecret'];
6782		- $auth_settings['google_hosteddomain'] = $auth_multisite_settings['google_hosteddomain'];
6783		- $auth_settings['cas'] = $auth_multisite_settings['cas'];
6784		- $auth_settings['cas_custom_label'] = $auth_multisite_settings['cas_custom_label'];
6785		- $auth_settings['cas_host'] = $auth_multisite_settings['cas_host'];
6786		- $auth_settings['cas_port'] = $auth_multisite_settings['cas_port'];
6787		- $auth_settings['cas_path'] = $auth_multisite_settings['cas_path'];
6788		- $auth_settings['cas_version'] = $auth_multisite_settings['cas_version'];
6789		- $auth_settings['cas_attr_email'] = $auth_multisite_settings['cas_attr_email'];
6790		- $auth_settings['cas_attr_first_name'] = $auth_multisite_settings['cas_attr_first_name'];
6791		- $auth_settings['cas_attr_last_name'] = $auth_multisite_settings['cas_attr_last_name'];
6792		- $auth_settings['cas_attr_update_on_login'] = $auth_multisite_settings['cas_attr_update_on_login'];
6793		- $auth_settings['cas_auto_login'] = $auth_multisite_settings['cas_auto_login'];
6794		- $auth_settings['cas_link_on_username'] = $auth_multisite_settings['cas_link_on_username'];
6795		- $auth_settings['ldap'] = $auth_multisite_settings['ldap'];
6796		- $auth_settings['ldap_host'] = $auth_multisite_settings['ldap_host'];
6797		- $auth_settings['ldap_port'] = $auth_multisite_settings['ldap_port'];
6798		- $auth_settings['ldap_tls'] = $auth_multisite_settings['ldap_tls'];
6799		- $auth_settings['ldap_search_base'] = $auth_multisite_settings['ldap_search_base'];
6800		- $auth_settings['ldap_uid'] = $auth_multisite_settings['ldap_uid'];
6801		- $auth_settings['ldap_attr_email'] = $auth_multisite_settings['ldap_attr_email'];
6802		- $auth_settings['ldap_user'] = $auth_multisite_settings['ldap_user'];
6803		- $auth_settings['ldap_password'] = $auth_multisite_settings['ldap_password'];
6804		- $auth_settings['ldap_lostpassword_url'] = $auth_multisite_settings['ldap_lostpassword_url'];
6805		- $auth_settings['ldap_attr_first_name'] = $auth_multisite_settings['ldap_attr_first_name'];
6806		- $auth_settings['ldap_attr_last_name'] = $auth_multisite_settings['ldap_attr_last_name'];
	5166	+ // Override external services (google, cas, or ldap) and associated options
	5167	+ $auth_settings['google'] = $auth_multisite_settings['google'];
	5168	+ $auth_settings['google_clientid'] = $auth_multisite_settings['google_clientid'];
	5169	+ $auth_settings['google_clientsecret'] = $auth_multisite_settings['google_clientsecret'];
	5170	+ $auth_settings['google_hosteddomain'] = $auth_multisite_settings['google_hosteddomain'];
	5171	+ $auth_settings['cas'] = $auth_multisite_settings['cas'];
	5172	+ $auth_settings['cas_custom_label'] = $auth_multisite_settings['cas_custom_label'];
	5173	+ $auth_settings['cas_host'] = $auth_multisite_settings['cas_host'];
	5174	+ $auth_settings['cas_port'] = $auth_multisite_settings['cas_port'];
	5175	+ $auth_settings['cas_path'] = $auth_multisite_settings['cas_path'];
	5176	+ $auth_settings['cas_version'] = $auth_multisite_settings['cas_version'];
	5177	+ $auth_settings['cas_attr_email'] = $auth_multisite_settings['cas_attr_email'];
	5178	+ $auth_settings['cas_attr_first_name'] = $auth_multisite_settings['cas_attr_first_name'];
	5179	+ $auth_settings['cas_attr_last_name'] = $auth_multisite_settings['cas_attr_last_name'];
	5180	+ $auth_settings['cas_attr_update_on_login'] = $auth_multisite_settings['cas_attr_update_on_login'];
	5181	+ $auth_settings['cas_auto_login'] = $auth_multisite_settings['cas_auto_login'];
	5182	+ $auth_settings['ldap'] = $auth_multisite_settings['ldap'];
	5183	+ $auth_settings['ldap_host'] = $auth_multisite_settings['ldap_host'];
	5184	+ $auth_settings['ldap_port'] = $auth_multisite_settings['ldap_port'];
	5185	+ $auth_settings['ldap_tls'] = $auth_multisite_settings['ldap_tls'];
	5186	+ $auth_settings['ldap_search_base'] = $auth_multisite_settings['ldap_search_base'];
	5187	+ $auth_settings['ldap_uid'] = $auth_multisite_settings['ldap_uid'];
	5188	+ $auth_settings['ldap_attr_email'] = $auth_multisite_settings['ldap_attr_email'];
	5189	+ $auth_settings['ldap_user'] = $auth_multisite_settings['ldap_user'];
	5190	+ $auth_settings['ldap_password'] = $auth_multisite_settings['ldap_password'];
	5191	+ $auth_settings['ldap_lostpassword_url'] = $auth_multisite_settings['ldap_lostpassword_url'];
	5192	+ $auth_settings['ldap_attr_first_name'] = $auth_multisite_settings['ldap_attr_first_name'];
	5193	+ $auth_settings['ldap_attr_last_name'] = $auth_multisite_settings['ldap_attr_last_name'];
6807	5194	$auth_settings['ldap_attr_update_on_login'] = $auth_multisite_settings['ldap_attr_update_on_login'];
6808	5195
6809		- // Override access_who_can_login and access_who_can_view.
	5196	+ // Override access_who_can_login and access_who_can_view
6810	5197	$auth_settings['access_who_can_login'] = $auth_multisite_settings['access_who_can_login'];
6811		- $auth_settings['access_who_can_view'] = $auth_multisite_settings['access_who_can_view'];
	5198	+ $auth_settings['access_who_can_view'] = $auth_multisite_settings['access_who_can_view'];
6812	5199
6813		- // Override access_default_role.
	5200	+ // Override access_default_role
6814	5201	$auth_settings['access_default_role'] = $auth_multisite_settings['access_default_role'];
6815	5202
6816		- // Override lockouts.
	5203	+ // Override lockouts
6817	5204	$auth_settings['advanced_lockouts'] = $auth_multisite_settings['advanced_lockouts'];
6818	5205
6819		- // Override Hide WordPress login.
	5206	+ // Override Hide WordPress login
6820	5207	$auth_settings['advanced_hide_wp_login'] = $auth_multisite_settings['advanced_hide_wp_login'];
6821		-
6822		- // Override Users per page.
6823		- $auth_settings['advanced_users_per_page'] = $auth_multisite_settings['advanced_users_per_page'];
6824		-
6825		- // Override Sort users by.
6826		- $auth_settings['advanced_users_sort_by'] = $auth_multisite_settings['advanced_users_sort_by'];
6827		-
6828		- // Override Sort users order.
6829		- $auth_settings['advanced_users_sort_order'] = $auth_multisite_settings['advanced_users_sort_order'];
6830		-
6831		- // Override Show Dashboard Widget.
6832		- $auth_settings['advanced_widget_enabled'] = $auth_multisite_settings['advanced_widget_enabled'];
6833	5208	}
6834	5209	}
6835	5210	return $auth_settings;
6836	5211	}
		@@ -6837,27 +5212,23 @@
6837	5212
6838	5213
6839	5214	/**
6840	5215	* Remove user from authorizer lists when that user is deleted in WordPress.
6841		- *
6842		- * Action: delete_user
6843		- *
6844		- * @param int $user_id User ID to remove.
6845		- * @return void
	5216	+ * Run on action hook: delete_user
6846	5217	*/
6847		- public function remove_user_from_authorizer_when_deleted( $user_id ) {
6848		- $user = get_user_by( 'id', $user_id );
	5218	+ function remove_user_from_authorizer_when_deleted( $user_id ) {
	5219	+ $user = get_user_by( 'id', $user_id );
6849	5220	$deleted_email = $user->user_email;
6850	5221
6851	5222	// Remove user from pending/approved lists and save.
6852	5223	$list_names = array( 'access_users_pending', 'access_users_approved' );
6853	5224	foreach ( $list_names as $list_name ) {
6854		- $user_list = $this->sanitize_user_list( $this->get_plugin_option( $list_name, WP_Plugin_Authorizer::SINGLE_CONTEXT ) );
	5225	+ $user_list = $this->sanitize_user_list( $this->get_plugin_option( $list_name, SINGLE_ADMIN ) );
6855	5226	$list_changed = false;
6856	5227	foreach ( $user_list as $key => $existing_user ) {
6857		- if ( 0 === strcasecmp( $deleted_email, $existing_user['email'] ) ) {
	5228	+ if ( $deleted_email === $existing_user['email'] ) {
6858	5229	$list_changed = true;
6859		- unset( $user_list[ $key ] );
	5230	+ unset( $user_list[$key] );
6860	5231	}
6861	5232	}
6862	5233	if ( $list_changed ) {
6863	5234	update_option( 'auth_settings_' . $list_name, $user_list );
		@@ -6867,35 +5238,30 @@
6867	5238
6868	5239
6869	5240	/**
6870	5241	* Remove multisite user from authorizer lists when that user is deleted from Network Users.
6871		- *
6872		- * Action: wpmu_delete_user
6873		- *
6874		- * @param int $user_id User ID to remove.
6875		- * @return void
	5242	+ * Run on action hook: wpmu_delete_user
6876	5243	*/
6877		- public function remove_network_user_from_authorizer_when_deleted( $user_id ) {
6878		- $user = get_user_by( 'id', $user_id );
	5244	+ function remove_network_user_from_authorizer_when_deleted( $user_id ) {
	5245	+ $user = get_user_by( 'id', $user_id );
6879	5246	$deleted_email = $user->user_email;
6880	5247
6881	5248	// Go through multisite approved user list and remove this user.
6882	5249	$auth_multisite_settings_access_users_approved = $this->sanitize_user_list(
6883		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT )
	5250	+ $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN )
6884	5251	);
6885		- $list_changed = false;
	5252	+ $list_changed = false;
6886	5253	foreach ( $auth_multisite_settings_access_users_approved as $key => $existing_user ) {
6887		- if ( 0 === strcasecmp( $deleted_email, $existing_user['email'] ) ) {
	5254	+ if ( $deleted_email === $existing_user['email'] ) {
6888	5255	$list_changed = true;
6889		- unset( $auth_multisite_settings_access_users_approved[ $key ] );
	5256	+ unset( $auth_multisite_settings_access_users_approved[$key] );
6890	5257	}
6891	5258	}
6892	5259	if ( $list_changed ) {
6893		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
	5260	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
6894	5261	}
6895	5262
6896	5263	// Go through all pending/approved lists on individual sites and remove this user from them.
6897		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
6898	5264	$sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
6899	5265	foreach ( $sites as $site ) {
6900	5266	$blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
6901	5267	$this->remove_network_user_from_site_when_removed( $user_id, $blog_id );
		@@ -6905,27 +5271,22 @@
6905	5271
6906	5272
6907	5273	/**
6908	5274	* Remove multisite user from a specific site's lists when that user is removed from the site.
6909		- *
6910		- * Action: remove_user_from_blog
6911		- *
6912		- * @param int $user_id User ID to remove.
6913		- * @param int $blog_id Blog ID to remove from.
6914		- * @return void
	5275	+ * Run on action hook: remove_user_from_blog
6915	5276	*/
6916		- public function remove_network_user_from_site_when_removed( $user_id, $blog_id ) {
6917		- $user = get_user_by( 'id', $user_id );
	5277	+ function remove_network_user_from_site_when_removed( $user_id, $blog_id ) {
	5278	+ $user = get_user_by( 'id', $user_id );
6918	5279	$deleted_email = $user->user_email;
6919	5280
6920	5281	$list_names = array( 'access_users_pending', 'access_users_approved' );
6921	5282	foreach ( $list_names as $list_name ) {
6922		- $user_list = get_blog_option( $blog_id, 'auth_settings_' . $list_name, array() );
	5283	+ $user_list = get_blog_option( $blog_id, 'auth_settings_' . $list_name, array() );
6923	5284	$list_changed = false;
6924	5285	foreach ( $user_list as $key => $existing_user ) {
6925		- if ( 0 === strcasecmp( $deleted_email, $existing_user['email'] ) ) {
	5286	+ if ( $deleted_email === $existing_user['email'] ) {
6926	5287	$list_changed = true;
6927		- unset( $user_list[ $key ] );
	5288	+ unset( $user_list[$key] );
6928	5289	}
6929	5290	}
6930	5291	if ( $list_changed ) {
6931	5292	update_blog_option( $blog_id, 'auth_settings_' . $list_name, $user_list );
		@@ -6935,30 +5296,26 @@
6935	5296
6936	5297
6937	5298	/**
6938	5299	* Helper: Add multisite user to a specific site's approved list.
6939		- *
6940		- * @param int $user_id User ID to add.
6941		- * @param int $blog_id Blog ID to add to.
6942		- * @return void
6943	5300	*/
6944		- private function add_network_user_to_site( $user_id, $blog_id ) {
	5301	+ function add_network_user_to_site( $user_id, $blog_id ) {
6945	5302	// Switch to blog.
6946	5303	switch_to_blog( $blog_id );
6947	5304
6948	5305	// Get user details and role.
6949		- $access_default_role = $this->get_plugin_option( 'access_default_role', WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
6950		- $user = get_user_by( 'id', $user_id );
6951		- $user_email = $user->user_email;
6952		- $user_role = $user && is_array( $user->roles ) && count( $user->roles ) > 0 ? $user->roles[0] : $access_default_role;
	5306	+ $access_default_role = $this->get_plugin_option( 'access_default_role', SINGLE_ADMIN, 'allow override' );
	5307	+ $user = get_user_by( 'id', $user_id );
	5308	+ $user_email = $user->user_email;
	5309	+ $user_role = $user && is_array( $user->roles ) && count( $user->roles ) > 0 ? $user->roles[0] : $access_default_role;
6953	5310
6954	5311	// Add user to approved list if not already there and not in blocked list.
6955		- $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT );
6956		- $auth_settings_access_users_blocked = $this->get_plugin_option( 'access_users_blocked', WP_Plugin_Authorizer::SINGLE_CONTEXT );
	5312	+ $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN );
	5313	+ $auth_settings_access_users_blocked = $this->get_plugin_option( 'access_users_blocked', SINGLE_ADMIN );
6957	5314	if ( ! $this->in_multi_array( $user_email, $auth_settings_access_users_approved ) && ! $this->in_multi_array( $user_email, $auth_settings_access_users_blocked ) ) {
6958	5315	$approved_user = array(
6959		- 'email' => $this->lowercase( $user_email ),
6960		- 'role' => $user_role,
	5316	+ 'email' => $user_email,
	5317	+ 'role' => $user_role,
6961	5318	'date_added' => date( 'M Y', strtotime( $user->user_registered ) ),
6962	5319	'local_user' => true,
6963	5320	);
6964	5321	array_push( $auth_settings_access_users_approved, $approved_user );
		@@ -6975,17 +5332,17 @@
6975	5332	* When an existing user is invited to the current site (or a new user is created),
6976	5333	* add them to the authorizer approved list. This action fires when the admin
6977	5334	* doesn't select the "Skip Confirmation Email" option.
6978	5335	*
6979		- * Action: invite_user
	5336	+ * @action invite_user
6980	5337	*
6981		- * @param int $user_id The invited user's ID.
6982		- * @param array $role The role of the invited user (or none if a new user creation).
	5338	+ * @param int $user_id The invited user's ID.
	5339	+ * @param array $role The role of the invited user (or none if a new user creation).
6983	5340	* @param string $newuser_key The key of the invitation.
6984	5341	*/
6985		- public function add_existing_user_to_authorizer_when_created( $user_id, $role = array(), $newuser_key = '' ) {
	5342	+ function add_existing_user_to_authorizer_when_created( $user_id, $role = array(), $newuser_key = '' ) {
6986	5343	$user = get_user_by( 'id', $user_id );
6987		- $this->add_user_to_authorizer_when_created( $user->user_email, $user->user_registered, $user->roles, $role );
	5344	+ $this->add_user_to_authorizer_when_created( $user->user_email, $user->user_registered, $user->user_roles, $role );
6988	5345	}
6989	5346
6990	5347
6991	5348	/**
		@@ -6993,16 +5350,16 @@
6993	5350	* When an existing user is invited to the current site (or a new user is created),
6994	5351	* add them to the authorizer approved list. This action fires when the admin
6995	5352	* selects the "Skip Confirmation Email" option.
6996	5353	*
6997		- * Action: added_existing_user
	5354	+ * @action added_existing_user
6998	5355	*
6999		- * @param int $user_id The invited user's ID.
7000		- * @param mixed $result True on success or a WP_Error object if the user doesn't exist.
	5356	+ * @param int $user_id The invited user's ID.
	5357	+ * @param mixed $result True on success or a WP_Error object if the user doesn't exist.
7001	5358	*/
7002		- public function add_existing_user_to_authorizer_when_created_noconfirmation( $user_id, $result ) {
	5359	+ function add_existing_user_to_authorizer_when_created_noconfirmation( $user_id, $result ) {
7003	5360	$user = get_user_by( 'id', $user_id );
7004		- $this->add_user_to_authorizer_when_created( $user->user_email, $user->user_registered, $user->roles );
	5361	+ $this->add_user_to_authorizer_when_created( $user->user_email, $user->user_registered, $user->user_roles );
7005	5362	}
7006	5363
7007	5364
7008	5365	/**
		@@ -7009,18 +5366,17 @@
7009	5366	* Multisite:
7010	5367	* When a new user is invited to the current site (or a new user is created),
7011	5368	* add them to the authorizer approved list.
7012	5369	*
7013		- * Action: after_signup_user
	5370	+ * @action after_signup_user
7014	5371	*
7015		- * @param string $user User's requested login name.
	5372	+ * @param string $user User's requested login name.
7016	5373	* @param string $user_email User's email address.
7017		- * @param string $key User's activation key.
7018		- * @param array $meta Additional signup meta, including initially set roles.
	5374	+ * @param string $key User's activation key.
	5375	+ * @param array $meta Additional signup meta.
7019	5376	*/
7020		- public function add_new_user_to_authorizer_when_created( $user, $user_email, $key, $meta ) {
7021		- $user_roles = isset( $meta['new_role'] ) ? array( $meta['new_role'] ) : array();
7022		- $this->add_user_to_authorizer_when_created( $user_email, time(), $user_roles );
	5377	+ function add_new_user_to_authorizer_when_created( $user, $user_email, $key, $meta ) {
	5378	+ $this->add_user_to_authorizer_when_created( $user_email, time() );
7023	5379	}
7024	5380
7025	5381
7026	5382	/**
		@@ -7027,18 +5383,17 @@
7027	5383	* Single site:
7028	5384	* When a new user is added in single site mode, add them to the authorizer
7029	5385	* approved list.
7030	5386	*
7031		- * Action: edit_user_created_user
	5387	+ * @action edit_user_created_user
7032	5388	*
7033		- * @param int $user_id ID of the newly created user.
7034		- * @param string $notify Type of notification that should happen. See
7035		- * wp_send_new_user_notifications() for more
7036		- * information on possible values.
	5389	+ * @param int $user_id ID of the newly created user.
	5390	+ * @param string $notify Type of notification that should happen. See wp_send_new_user_notifications()
	5391	+ * for more information on possible values.
7037	5392	*/
7038		- public function add_new_user_to_authorizer_when_created_single_site( $user_id, $notify ) {
	5393	+ function add_new_user_to_authorizer_when_created_single_site( $user_id, $notify ) {
7039	5394	$user = get_user_by( 'id', $user_id );
7040		- $this->add_user_to_authorizer_when_created( $user->user_email, $user->user_registered, $user->roles );
	5395	+ $this->add_user_to_authorizer_when_created( $user->user_email, $user->user_registered, $user->user_roles );
7041	5396	}
7042	5397
7043	5398
7044	5399	/**
		@@ -7043,36 +5398,20 @@
7043	5398
7044	5399	/**
7045	5400	* Helper: When a new user is added/invited to the current site (or a new
7046	5401	* user is created), add them to the authorizer approved list.
7047		- *
7048		- * @param string $user_email Email address of user to add.
7049		- * @param string $date_registered Date user registered.
7050		- * @param array $user_roles Role to add for user.
7051		- * @param array $default_role Default role, if no role specified.
7052	5402	*/
7053	5403	private function add_user_to_authorizer_when_created( $user_email, $date_registered, $user_roles = array(), $default_role = array() ) {
7054		- $auth_multisite_settings_access_users_approved = is_multisite() ? get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', array() ) : array();
7055		- $auth_settings_access_users_pending = $this->get_plugin_option( 'access_users_pending', WP_Plugin_Authorizer::SINGLE_CONTEXT );
7056		- $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT );
7057		- $auth_settings_access_users_blocked = $this->get_plugin_option( 'access_users_blocked', WP_Plugin_Authorizer::SINGLE_CONTEXT );
	5404	+ $auth_multisite_settings_access_users_approved = is_multisite() ? get_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', array() ) : array();
	5405	+ $auth_settings_access_users_pending = $this->get_plugin_option( 'access_users_pending', SINGLE_ADMIN );
	5406	+ $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN );
	5407	+ $auth_settings_access_users_blocked = $this->get_plugin_option( 'access_users_blocked', SINGLE_ADMIN );
7058	5408
7059	5409	// Get default role if one isn't specified.
7060	5410	if ( count( $default_role ) < 1 ) {
7061	5411	$default_role = '';
7062	5412	} else {
7063		- // If default role was provided, it came from the invite_user hook, and
7064		- // only contains the role's display name. Here we look up the actual role
7065		- // name to save (and default to no role if the display name isn't found).
7066		- global $wp_roles;
7067		- $default_role_display_name = $default_role['name'];
7068		- $default_role = '';
7069		- foreach ( $wp_roles->role_names as $role_name => $display_name ) {
7070		- if ( $default_role_display_name === $display_name ) {
7071		- $default_role = $role_name;
7072		- break;
7073		- }
7074		- }
	5413	+ $default_role = strtolower( $default_role['name'] );
7075	5414	}
7076	5415
7077	5416	$updated = false;
7078	5417
		@@ -7081,10 +5420,10 @@
7081	5420	return;
7082	5421	}
7083	5422	// Remove from pending list if there.
7084	5423	foreach ( $auth_settings_access_users_pending as $key => $pending_user ) {
7085		- if ( 0 === strcasecmp( $pending_user['email'], $user_email ) ) {
7086		- unset( $auth_settings_access_users_pending[ $key ] );
	5424	+ if ( $pending_user['email'] == $user_email ) {
	5425	+ unset( $auth_settings_access_users_pending[$key] );
7087	5426	$updated = true;
7088	5427	}
7089	5428	}
7090	5429	// Skip if user is in multisite approved list.
		@@ -7093,10 +5432,10 @@
7093	5432	}
7094	5433	// Add to approved list if not there.
7095	5434	if ( ! $this->in_multi_array( $user_email, $auth_settings_access_users_approved ) ) {
7096	5435	$approved_user = array(
7097		- 'email' => $this->lowercase( $user_email ),
7098		- 'role' => is_array( $user_roles ) && count( $user_roles ) > 0 ? $user_roles[0] : $default_role,
	5436	+ 'email' => $user_email,
	5437	+ 'role' => is_array( $user_roles ) && count( $user_roles ) > 0 ? $user_roles[0] : $default_role,
7099	5438	'date_added' => date( 'M Y', strtotime( $date_registered ) ),
7100	5439	'local_user' => true,
7101	5440	);
7102	5441	array_push( $auth_settings_access_users_approved, $approved_user );
		@@ -7115,33 +5454,32 @@
7115	5454	* When a user is granted super admin status (checkbox on network user edit
7116	5455	* screen), add them to the authorizer network approved list. Also remove
7117	5456	* them from pending/approved list on any individual sites.
7118	5457	*
7119		- * Action: grant_super_admin
	5458	+ * @action grant_super_admin
7120	5459	*
7121	5460	* @param int $user_id The user's ID.
7122	5461	*/
7123		- public function grant_super_admin__add_to_network_approved( $user_id ) {
7124		- $user = get_user_by( 'id', $user_id );
	5462	+ function grant_super_admin__add_to_network_approved( $user_id ) {
	5463	+ $user = get_user_by( 'id', $user_id );
7125	5464	$user_email = $user->user_email;
7126	5465
7127	5466	// Add user to multisite approved user list (if not already there).
7128	5467	$auth_multisite_settings_access_users_approved = $this->sanitize_user_list(
7129		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT )
	5468	+ $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN )
7130	5469	);
7131	5470	if ( ! $this->in_multi_array( $user_email, $auth_multisite_settings_access_users_approved ) ) {
7132	5471	$multisite_approved_user = array(
7133		- 'email' => $this->lowercase( $user_email ),
7134		- 'role' => count( $user->roles ) > 0 ? $user->roles[0] : 'administrator',
	5472	+ 'email' => $user_email,
	5473	+ 'role' => count( $user->roles ) > 0 ? $user->roles[0] : 'administrator',
7135	5474	'date_added' => date( 'M Y', strtotime( $user->user_registered ) ),
7136	5475	'local_user' => true,
7137	5476	);
7138	5477	array_push( $auth_multisite_settings_access_users_approved, $multisite_approved_user );
7139		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
	5478	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
7140	5479	}
7141	5480
7142	5481	// Go through all pending/approved lists on individual sites and remove this user from them.
7143		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
7144	5482	$sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
7145	5483	foreach ( $sites as $site ) {
7146	5484	$blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
7147	5485	$this->remove_network_user_from_site_when_removed( $user_id, $blog_id );
		@@ -7154,29 +5492,29 @@
7154	5492	* When a user's super admin status is revoked (checkbox on network user edit
7155	5493	* screen), remove them from the authorizer network approved list. Also add
7156	5494	* them to approved list on any individual sites they are already a part of.
7157	5495	*
7158		- * Action: revoke_super_admin
	5496	+ * @action revoke_super_admin
7159	5497	*
7160	5498	* @param int $user_id The user's ID.
7161	5499	*/
7162		- public function revoke_super_admin__remove_from_network_approved( $user_id ) {
7163		- $user = get_user_by( 'id', $user_id );
	5500	+ function revoke_super_admin__remove_from_network_approved( $user_id ) {
	5501	+ $user = get_user_by( 'id', $user_id );
7164	5502	$revoked_email = $user->user_email;
7165	5503
7166	5504	// Go through multisite approved user list and remove this user.
7167	5505	$auth_multisite_settings_access_users_approved = $this->sanitize_user_list(
7168		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT )
	5506	+ $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN )
7169	5507	);
7170		- $list_changed = false;
	5508	+ $list_changed = false;
7171	5509	foreach ( $auth_multisite_settings_access_users_approved as $key => $existing_user ) {
7172		- if ( 0 === strcasecmp( $revoked_email, $existing_user['email'] ) ) {
	5510	+ if ( $revoked_email === $existing_user['email'] ) {
7173	5511	$list_changed = true;
7174		- unset( $auth_multisite_settings_access_users_approved[ $key ] );
	5512	+ unset( $auth_multisite_settings_access_users_approved[$key] );
7175	5513	}
7176	5514	}
7177	5515	if ( $list_changed ) {
7178		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
	5516	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
7179	5517	}
7180	5518
7181	5519	// Go through this user's current sites and add them to the approved list
7182	5520	// (since they are no longer on the network approved list).
		@@ -7187,21 +5525,14 @@
7187	5525	}
7188	5526
7189	5527	}
7190	5528
7191		- /**
7192		- * Send a welcome email message to a newly approved user (if the "Should
7193		- * email approved users" setting is enabled).
7194		- *
7195		- * @param string $email Email address to send welcome email to.
7196		- * @return bool Whether the email was sent.
7197		- */
7198	5529	private function maybe_email_welcome_message( $email ) {
7199	5530	// Get option for whether to email welcome messages.
7200	5531	$should_email_new_approved_users = $this->get_plugin_option( 'access_should_email_approved_users' );
7201	5532
7202	5533	// Do not send welcome email if option not enabled.
7203		- if ( '1' !== $should_email_new_approved_users ) {
	5534	+ if ( $should_email_new_approved_users !== '1' ) {
7204	5535	return false;
7205	5536	}
7206	5537
7207	5538	// Make sure we didn't just email this user (can happen with
		@@ -7207,15 +5538,15 @@
7207	5538	// Make sure we didn't just email this user (can happen with
7208	5539	// multiple admins saving at the same time, or by clicking
7209	5540	// Approve button too rapidly).
7210	5541	$recently_sent_emails = get_option( 'auth_settings_recently_sent_emails' );
7211		- if ( false === $recently_sent_emails ) {
	5542	+ if ( $recently_sent_emails === FALSE ) {
7212	5543	$recently_sent_emails = array();
7213	5544	}
7214	5545	foreach ( $recently_sent_emails as $key => $recently_sent_email ) {
7215	5546	if ( $recently_sent_email['time'] < strtotime( 'now -1 minutes' ) ) {
7216	5547	// Remove emails sent more than 1 minute ago.
7217		- unset( $recently_sent_emails[ $key ] );
	5548	+ unset( $recently_sent_emails[$key] );
7218	5549	} elseif ( $recently_sent_email['email'] === $email ) {
7219	5550	// Sent an email to this user within the last 1 minute, so
7220	5551	// quit without sending.
7221	5552	return false;
		@@ -7223,15 +5554,15 @@
7223	5554	}
7224	5555	// Add the email we're about to send to the list.
7225	5556	$recently_sent_emails[] = array(
7226	5557	'email' => $email,
7227		- 'time' => time(),
	5558	+ 'time' => time(),
7228	5559	);
7229	5560	update_option( 'auth_settings_recently_sent_emails', $recently_sent_emails );
7230	5561
7231		- // Get welcome email subject and body text.
	5562	+ // Get welcome email subject and body text
7232	5563	$subject = $this->get_plugin_option( 'access_email_approved_users_subject' );
7233		- $body = apply_filters( 'the_content', $this->get_plugin_option( 'access_email_approved_users_body' ) );
	5564	+ $body = apply_filters( 'the_content', $this->get_plugin_option( 'access_email_approved_users_body' ) );
7234	5565
7235	5566	// Fail if the subject/body options don't exist or are empty.
7236	5567	if ( is_null( $subject ) || is_null( $body ) || strlen( $subject ) === 0 || strlen( $body ) === 0 ) {
7237	5568	return false;
		@@ -7238,14 +5569,14 @@
7238	5569	}
7239	5570
7240	5571	// Replace approved shortcode patterns in subject and body.
7241	5572	$site_name = get_bloginfo( 'name' );
7242		- $site_url = get_site_url();
7243		- $subject = str_replace( '[site_name]', $site_name, $subject );
7244		- $body = str_replace( '[site_name]', $site_name, $body );
7245		- $body = str_replace( '[site_url]', $site_url, $body );
7246		- $body = str_replace( '[user_email]', $email, $body );
7247		- $headers = 'Content-type: text/html' . "\r\n";
	5573	+ $site_url = get_site_url();
	5574	+ $subject = str_replace( '[site_name]', $site_name, $subject );
	5575	+ $body = str_replace( '[site_name]', $site_name, $body );
	5576	+ $body = str_replace( '[site_url]', $site_url, $body );
	5577	+ $body = str_replace( '[user_email]', $email, $body );
	5578	+ $headers = 'Content-type: text/html' . "\r\n";
7248	5579
7249	5580	// Send email.
7250	5581	wp_mail( $email, $subject, $body, $headers );
7251	5582
		@@ -7255,22 +5586,14 @@
7255	5586
7256	5587
7257	5588	/**
7258	5589	* Generate a unique cookie to add to nonces to prevent CSRF.
7259		- *
7260		- * @var string
7261	5590	*/
7262		- private $cookie_value = null;
7263		-
7264		- /**
7265		- * Retrieve the unique login cookie.
7266		- *
7267		- * @return string Login cookie value.
7268		- */
7269		- private function get_cookie_value() {
	5591	+ protected $cookie_value = null;
	5592	+ function get_cookie_value() {
7270	5593	if ( ! $this->cookie_value ) {
7271	5594	if ( isset( $_COOKIE['login_unique'] ) ) {
7272		- $this->cookie_value = sanitize_key( wp_unslash( $_COOKIE['login_unique'] ) );
	5595	+ $this->cookie_value = $_COOKIE['login_unique'];
7273	5596	} else {
7274	5597	$this->cookie_value = md5( rand() );
7275	5598	}
7276	5599	}
		@@ -7278,51 +5601,23 @@
7278	5601	}
7279	5602
7280	5603
7281	5604	/**
7282		- * Encryption key (not secret!).
7283		- *
7284		- * @var string
7285		- */
7286		- private static $key = "8QxnrvjdtweisvCBKEY!+0\0\0";
7287		-
7288		- /**
7289		- * Encryption salt (not secret!).
7290		- *
7291		- * @var string
7292		- */
7293		- private static $iv = 'R_O2D]jPn]1[fhJl!-P1.oe';
7294		-
7295		- /**
7296	5605	* Basic encryption using a public (not secret!) key. Used for general
7297	5606	* database obfuscation of passwords.
7298		- *
7299		- * @param string $text String to encrypt.
7300		- * @param string $library Encryption library to use (openssl).
7301		- * @return string Encrypted string.
7302	5607	*/
7303		- private function encrypt( $text, $library = 'openssl' ) {
	5608	+ private static $key = "8QxnrvjdtweisvCBKEY!+0\0\0";
	5609	+ function encrypt( $text ) {
7304	5610	$result = '';
7305	5611
7306		- // Use openssl library (better) if it is enabled.
7307		- if ( function_exists( 'openssl_encrypt' ) && 'openssl' === $library ) {
7308		- $result = base64_encode(
7309		- openssl_encrypt(
7310		- $text,
7311		- 'AES-256-CBC',
7312		- hash( 'sha256', self::$key ),
7313		- 0,
7314		- substr( hash( 'sha256', self::$iv ), 0, 16 )
7315		- )
7316		- );
7317		- } elseif ( function_exists( 'mcrypt_encrypt' ) ) { // Use mcrypt library (deprecated in PHP 7.1) if php5-mcrypt extension is enabled.
7318		- $result = base64_encode( mcrypt_encrypt( MCRYPT_RIJNDAEL_256, self::$key, $text, MCRYPT_MODE_ECB, 'abcdefghijklmnopqrstuvwxyz012345' ) );
7319		- } else { // Fall back to basic obfuscation.
7320		- $length = strlen( $text );
7321		- for ( $i = 0; $i < $length; $i++ ) {
7322		- $char = substr( $text, $i, 1 );
	5612	+ // Use mcrypt library (better) if php5-mcrypt extension is enabled.
	5613	+ if ( function_exists( 'mcrypt_encrypt' ) ) {
	5614	+ $result = mcrypt_encrypt( MCRYPT_RIJNDAEL_256, self::$key, $text, MCRYPT_MODE_ECB, 'abcdefghijklmnopqrstuvwxyz012345' );
	5615	+ } else {
	5616	+ for ( $i = 0; $i < strlen( $text ); $i++ ) {
	5617	+ $char = substr( $text, $i, 1 );
7323	5618	$keychar = substr( self::$key, ( $i % strlen( self::$key ) ) - 1, 1 );
7324		- $char = chr( ord( $char ) + ord( $keychar ) );
	5619	+ $char = chr( ord( $char ) + ord( $keychar ) );
7325	5620	$result .= $char;
7326	5621	}
7327	5622	$result = base64_encode( $result );
7328	5623	}
		@@ -7330,38 +5625,20 @@
7330	5625	return $result;
7331	5626	}
7332	5627
7333	5628
7334		- /**
7335		- * Basic decryption using a public (not secret!) key. Used for general
7336		- * database obfuscation of passwords.
7337		- *
7338		- * @param string $secret String to encrypt.
7339		- * @param string $library Encryption lib to use (openssl).
7340		- * @return string Decrypted string
7341		- */
7342		- private function decrypt( $secret, $library = 'openssl' ) {
	5629	+ function decrypt( $secret ) {
7343	5630	$result = '';
7344	5631
7345		- // Use openssl library (better) if it is enabled.
7346		- if ( function_exists( 'openssl_decrypt' ) && 'openssl' === $library ) {
7347		- $result = openssl_decrypt(
7348		- base64_decode( $secret ),
7349		- 'AES-256-CBC',
7350		- hash( 'sha256', self::$key ),
7351		- 0,
7352		- substr( hash( 'sha256', self::$iv ), 0, 16 )
7353		- );
7354		- } elseif ( function_exists( 'mcrypt_decrypt' ) ) { // Use mcrypt library (deprecated in PHP 7.1) if php5-mcrypt extension is enabled.
7355		- $secret = base64_decode( $secret );
	5632	+ // Use mcrypt library (better) if php5-mcrypt extension is enabled.
	5633	+ if ( function_exists( 'mcrypt_decrypt' ) ) {
7356	5634	$result = rtrim( mcrypt_decrypt( MCRYPT_RIJNDAEL_256, self::$key, $secret, MCRYPT_MODE_ECB, 'abcdefghijklmnopqrstuvwxyz012345' ), "\0$result" );
7357		- } else { // Fall back to basic obfuscation.
	5635	+ } else {
7358	5636	$secret = base64_decode( $secret );
7359		- $length = strlen( $secret );
7360		- for ( $i = 0; $i < $length; $i++ ) {
7361		- $char = substr( $secret, $i, 1 );
	5637	+ for ( $i = 0; $i < strlen( $secret ); $i++ ) {
	5638	+ $char = substr( $secret, $i, 1 );
7362	5639	$keychar = substr( self::$key, ( $i % strlen( self::$key ) ) - 1, 1 );
7363		- $char = chr( ord( $char ) - ord( $keychar ) );
	5640	+ $char = chr( ord( $char ) - ord( $keychar ) );
7364	5641	$result .= $char;
7365	5642	}
7366	5643	}
7367	5644
		@@ -7372,12 +5649,10 @@
7372	5649	/**
7373	5650	* In a multisite environment, returns true if the current user is logged
7374	5651	* in and a user of the current blog. In single site mode, simply returns
7375	5652	* true if the current user is logged in.
7376		- *
7377		- * @return bool Whether current user is logged in and a user of the current blog.
7378	5653	*/
7379		- protected function is_user_logged_in_and_blog_user() {
	5654	+ function is_user_logged_in_and_blog_user() {
7380	5655	$is_user_logged_in_and_blog_user = false;
7381	5656	if ( is_multisite() ) {
7382	5657	$is_user_logged_in_and_blog_user = is_user_logged_in() && is_user_member_of_blog( get_current_user_id() );
7383	5658	} else {
		@@ -7390,57 +5665,39 @@
7390	5665	/**
7391	5666	* Helper function to determine whether a given email is in one of
7392	5667	* the lists (pending, approved, blocked). Defaults to the list of
7393	5668	* approved users.
7394		- *
7395		- * @param string $email Email to check existent of.
7396		- * @param string $list List to look for email in.
7397		- * @param string $multisite_mode Admin context.
7398		- * @return boolean Whether email was found.
7399	5669	*/
7400		- protected function is_email_in_list( $email = '', $list = 'approved', $multisite_mode = 'single' ) {
7401		- if ( empty( $email ) ) {
	5670	+ function is_email_in_list( $email = '', $list = 'approved', $multisite_mode = 'single' ) {
	5671	+ if ( empty( $email ) )
7402	5672	return false;
7403		- }
7404	5673
7405	5674	switch ( $list ) {
7406		- case 'pending':
7407		- $auth_settings_access_users_pending = $this->get_plugin_option( 'access_users_pending', WP_Plugin_Authorizer::SINGLE_CONTEXT );
7408		- return $this->in_multi_array( $email, $auth_settings_access_users_pending );
7409		- case 'blocked':
7410		- $auth_settings_access_users_blocked = $this->get_plugin_option( 'access_users_blocked', WP_Plugin_Authorizer::SINGLE_CONTEXT );
7411		- // Blocked list can have wildcard matches, e.g., @baddomain.com, which
7412		- // should match any email address at that domain. Check if any wildcards
7413		- // exist, and if the email address has that domain.
7414		- $email_in_blocked_domain = false;
7415		- $blocked_domains = preg_grep( '/^@.*/', array_map(
7416		- function ( $blocked_item ) { return $blocked_item['email']; },
7417		- $auth_settings_access_users_blocked
7418		- ) );
7419		- foreach ( $blocked_domains as $blocked_domain ) {
7420		- $email_domain = substr( $email, strrpos( $email, '@' ) );
7421		- if ( $email_domain === $blocked_domain ) {
7422		- $email_in_blocked_domain = true;
7423		- break;
7424		- }
7425		- }
7426		- return $email_in_blocked_domain || $this->in_multi_array( $email, $auth_settings_access_users_blocked );
7427		- case 'approved':
7428		- default:
7429		- if ( 'single' !== $multisite_mode ) {
7430		- // Get multisite users only.
7431		- $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT );
7432		- } elseif ( is_multisite() && 1 === intval( $this->get_plugin_option( 'advanced_override_multisite' ) ) ) {
7433		- // This site has overridden any multisite settings, so only get its users.
7434		- $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT );
7435		- } else {
7436		- // Get all site users and all multisite users.
7437		- $auth_settings_access_users_approved = array_merge(
7438		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT ),
7439		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT )
7440		- );
7441		- }
7442		- return $this->in_multi_array( $email, $auth_settings_access_users_approved );
	5675	+ case 'pending':
	5676	+ $auth_settings_access_users_pending = $this->get_plugin_option( 'access_users_pending', SINGLE_ADMIN );
	5677	+ return $this->in_multi_array( $email, $auth_settings_access_users_pending );
	5678	+ break;
	5679	+ case 'blocked':
	5680	+ $auth_settings_access_users_blocked = $this->get_plugin_option( 'access_users_blocked', SINGLE_ADMIN );
	5681	+ return $this->in_multi_array( $email, $auth_settings_access_users_blocked );
	5682	+ break;
	5683	+ case 'approved':
	5684	+ default:
	5685	+ if ( $multisite_mode !== 'single' ) {
	5686	+ // Get multisite users only.
	5687	+ $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN );
	5688	+ } elseif ( is_multisite() && $this->get_plugin_option( 'advanced_override_multisite' ) == '1' ) {
	5689	+ // This site has overridden any multisite settings, so only get its users.
	5690	+ $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN );
	5691	+ } else {
	5692	+ // Get all site users and all multisite users.
	5693	+ $auth_settings_access_users_approved = array_merge(
	5694	+ $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN ),
	5695	+ $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN )
	5696	+ );
	5697	+ }
	5698	+ return $this->in_multi_array( $email, $auth_settings_access_users_approved );
	5699	+ break;
7443	5700	}
7444	5701	}
7445	5702
7446	5703
		@@ -7446,37 +5703,36 @@
7446	5703
7447	5704	/**
7448	5705	* Helper function to get number of users (including multisite users)
7449	5706	* in a given list (pending, approved, or blocked).
7450		- *
7451		- * @param string $list List to get count of.
7452		- * @param string $admin_mode WP_Plugin_Authorizer::SINGLE_CONTEXT or WP_Plugin_Authorizer::NETWORK_CONTEXT determines whether to include multisite users.
7453		- * @return int Number of users in list.
	5707	+ * @param string $list
	5708	+ * @param string $admin_mode SINGLE_ADMIN or MULTISITE_ADMIN determines whether to include multisite users
	5709	+ * @return int number of users in list
7454	5710	*/
7455		- protected function get_user_count_from_list( $list, $admin_mode = WP_Plugin_Authorizer::SINGLE_CONTEXT ) {
	5711	+ function get_user_count_from_list( $list, $admin_mode = SINGLE_ADMIN ) {
7456	5712	$auth_settings_access_users = array();
7457	5713
7458	5714	switch ( $list ) {
7459		- case 'pending':
7460		- $auth_settings_access_users = $this->get_plugin_option( 'access_users_pending', WP_Plugin_Authorizer::SINGLE_CONTEXT );
7461		- break;
7462		- case 'blocked':
7463		- $auth_settings_access_users = $this->get_plugin_option( 'access_users_blocked', WP_Plugin_Authorizer::SINGLE_CONTEXT );
7464		- break;
7465		- case 'approved':
7466		- if ( WP_Plugin_Authorizer::SINGLE_CONTEXT !== $admin_mode ) {
7467		- // Get multisite users only.
7468		- $auth_settings_access_users = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT );
7469		- } elseif ( is_multisite() && 1 === intval( $this->get_plugin_option( 'advanced_override_multisite' ) ) ) {
7470		- // This site has overridden any multisite settings, so only get its users.
7471		- $auth_settings_access_users = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT );
7472		- } else {
7473		- // Get all site users and all multisite users.
7474		- $auth_settings_access_users = array_merge(
7475		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT ),
7476		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT )
7477		- );
7478		- }
	5715	+ case 'pending':
	5716	+ $auth_settings_access_users = $this->get_plugin_option( 'access_users_pending', SINGLE_ADMIN );
	5717	+ break;
	5718	+ case 'blocked':
	5719	+ $auth_settings_access_users = $this->get_plugin_option( 'access_users_blocked', SINGLE_ADMIN );
	5720	+ break;
	5721	+ case 'approved':
	5722	+ if ( $admin_mode !== SINGLE_ADMIN ) {
	5723	+ // Get multisite users only.
	5724	+ $auth_settings_access_users = $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN );
	5725	+ } elseif ( is_multisite() && $this->get_plugin_option( 'advanced_override_multisite' ) == '1' ) {
	5726	+ // This site has overridden any multisite settings, so only get its users.
	5727	+ $auth_settings_access_users = $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN );
	5728	+ } else {
	5729	+ // Get all site users and all multisite users.
	5730	+ $auth_settings_access_users = array_merge(
	5731	+ $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN ),
	5732	+ $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN )
	5733	+ );
	5734	+ }
7479	5735	}
7480	5736
7481	5737	return count( $auth_settings_access_users );
7482	5738	}
		@@ -7483,27 +5739,21 @@
7483	5739
7484	5740
7485	5741	/**
7486	5742	* Helper function to search a multidimensional array for a value.
7487		- *
7488		- * @param string $needle Value to search for.
7489		- * @param array $haystack Multidimensional array to search.
7490		- * @param string $strict_mode 'strict' if strict comparisons should be used.
7491		- * @param string $case_sensitivity 'case sensitive' if comparisons should respect case.
7492		- * @return bool Whether needle was found.
7493	5743	*/
7494		- protected function in_multi_array( $needle = '', $haystack = array(), $strict_mode = 'not strict', $case_sensitivity = 'case insensitive' ) {
	5744	+ function in_multi_array( $needle = '', $haystack = array(), $strict_mode = 'not strict', $case_sensitivity = 'case insensitive' ) {
7495	5745	if ( ! is_array( $haystack ) ) {
7496	5746	return false;
7497	5747	}
7498		- if ( 'case insensitive' === $case_sensitivity ) {
	5748	+ if ( $case_sensitivity === 'case insensitive' ) {
7499	5749	$needle = strtolower( $needle );
7500	5750	}
7501	5751	foreach ( $haystack as $item ) {
7502		- if ( 'case insensitive' === $case_sensitivity && ! is_array( $item ) ) {
	5752	+ if ( $case_sensitivity === 'case insensitive' && ! is_array( $item ) ) {
7503	5753	$item = strtolower( $item );
7504	5754	}
7505		- if ( ( 'strict' === $strict_mode ? $item === $needle : $item == $needle ) || ( is_array( $item ) && $this->in_multi_array( $needle, $item, $strict_mode, $case_sensitivity ) ) ) { // phpcs:ignore WordPress.PHP.StrictComparisons.LooseComparison
	5755	+ if ( ( $strict_mode === 'strict' ? $item === $needle : $item == $needle ) || ( is_array( $item ) && $this->in_multi_array( $needle, $item, $strict_mode, $case_sensitivity ) ) ) {
7506	5756	return true;
7507	5757	}
7508	5758	}
7509	5759	return false;
		@@ -7510,31 +5760,43 @@
7510	5760	}
7511	5761
7512	5762
7513	5763	/**
	5764	+ * Helper function to get a WordPress page ID from the pagename.
	5765	+ *
	5766	+ * @param string $pagename Page Slug
	5767	+ * @return int Page/Post ID
	5768	+ */
	5769	+ function get_id_from_pagename( $pagename = '' ) {
	5770	+ global $wpdb;
	5771	+ $page_id = $wpdb->get_var( "SELECT ID FROM $wpdb->posts WHERE post_name = '" . sanitize_title_for_query( $pagename ) . "'" );
	5772	+ return $page_id;
	5773	+ }
	5774	+
	5775	+
	5776	+ /**
7514	5777	* Helper function to determine if an URL is accessible.
7515	5778	*
7516		- * @param string $url URL that should be publicly reachable.
7517		- * @return boolean Whether the URL is publicly reachable.
	5779	+ * @param string $url URL that should be publicly reachable
	5780	+ * @return boolean Whether the URL is publicly reachable
7518	5781	*/
7519		- protected function url_is_accessible( $url ) {
	5782	+ function url_is_accessible( $url ) {
7520	5783	// Use wp_remote_retrieve_response_code() to retrieve the URL.
7521		- $response = wp_remote_get( $url );
	5784	+ $response = wp_remote_get( $url );
7522	5785	$response_code = wp_remote_retrieve_response_code( $response );
7523	5786
7524		- // Return true if the document has loaded successfully without any redirection or error.
7525		- return $response_code >= 200 && $response_code < 400;
	5787	+ // Return true if the document has loaded successfully without any redirection or error
	5788	+ return $response_code >= 200 && $response_code < 300;
7526	5789	}
7527	5790
7528	5791
7529	5792	/**
7530	5793	* Helper function to reconstruct a URL split using parse_url().
7531		- *
7532		- * @param array $parts Array returned from parse_url().
7533		- * @return string URL.
	5794	+ * @param array $parts Array returned from parse_url().
	5795	+ * @return string URL.
7534	5796	*/
7535		- protected function build_url( $parts = array() ) {
7536		- return (
	5797	+ function build_url( $parts = array() ) {
	5798	+ return
7537	5799	( isset( $parts['scheme'] ) ? "{$parts['scheme']}:" : '' ) .
7538	5800	( ( isset( $parts['user'] ) || isset( $parts['host'] ) ) ? '//' : '' ) .
7539	5801	( isset( $parts['user'] ) ? "{$parts['user']}" : '' ) .
7540	5802	( isset( $parts['pass'] ) ? ":{$parts['pass']}" : '' ) .
		@@ -7542,30 +5804,21 @@
7542	5804	( isset( $parts['host'] ) ? "{$parts['host']}" : '' ) .
7543	5805	( isset( $parts['port'] ) ? ":{$parts['port']}" : '' ) .
7544	5806	( isset( $parts['path'] ) ? "{$parts['path']}" : '' ) .
7545	5807	( isset( $parts['query'] ) ? "?{$parts['query']}" : '' ) .
7546		- ( isset( $parts['fragment'] ) ? "#{$parts['fragment']}" : '' )
7547		- );
	5808	+ ( isset( $parts['fragment'] ) ? "#{$parts['fragment']}" : '' );
7548	5809	}
7549	5810
7550	5811
7551		- /**
7552		- * Helper function that prints option tags for a select element for all
7553		- * roles the current user has permission to assign.
7554		- *
7555		- * @param string $selected_role Which role should be selected in the dropdown.
7556		- * @param string $disable_input 'disabled' if select element should be disabled.
7557		- * @param int $admin_mode WP_Plugin_Authorizer::NETWORK_CONTEXT if we are in that context.
7558		- * @return void
7559		- */
7560		- protected function wp_dropdown_permitted_roles( $selected_role = 'subscriber', $disable_input = 'not disabled', $admin_mode = WP_Plugin_Authorizer::SINGLE_CONTEXT ) {
7561		- $roles = get_editable_roles();
	5812	+ // Helper function that builds option tags for a select element for all
	5813	+ // roles the current user has permission to assign.
	5814	+ function wp_dropdown_permitted_roles( $selected_role = 'subscriber', $disable_input = 'not disabled', $admin_mode = SINGLE_ADMIN ) {
	5815	+ $roles = get_editable_roles();
7562	5816	$current_user = wp_get_current_user();
7563	5817
7564	5818	// If we're in network admin, also show any roles that might exist only on
7565	5819	// specific sites in the network (themes can add their own roles).
7566		- if ( WP_Plugin_Authorizer::NETWORK_CONTEXT === $admin_mode ) {
7567		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
	5820	+ if ( $admin_mode === MULTISITE_ADMIN ) {
7568	5821	$sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
7569	5822	foreach ( $sites as $site ) {
7570	5823	$blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
7571	5824	switch_to_blog( $blog_id );
		@@ -7574,11 +5827,11 @@
7574	5827	}
7575	5828	$unique_role_names = array();
7576	5829	foreach ( $roles as $role_name => $role_info ) {
7577	5830	if ( array_key_exists( $role_name, $unique_role_names ) ) {
7578		- unset( $roles[ $role_name ] );
	5831	+ unset( $roles[$role_name] );
7579	5832	} else {
7580		- $unique_role_names[ $role_name ] = true;
	5833	+ $unique_role_names[$role_name] = true;
7581	5834	}
7582	5835	}
7583	5836	}
7584	5837
		@@ -7590,43 +5843,39 @@
7590	5843	}
7591	5844
7592	5845	// Print an option element for each permitted role.
7593	5846	foreach ( $roles as $name => $role ) {
7594		- $is_selected = $selected_role === $name;
	5847	+ $selected = $selected_role === $name ? ' selected="selected"' : '';
7595	5848
7596		- // Don't let a user change their own role (but network admins always can).
7597		- $is_disabled = $selected_role !== $name && 'disabled' === $disable_input && ! ( is_multisite() && current_user_can( 'manage_network' ) );
7598		- ?>
7599		- <option value="<?php echo esc_attr( $name ); ?>"<?php selected( $is_selected ); ?><?php disabled( $is_disabled ); ?>><?php echo esc_html( $role['name'] ); ?></option>
7600		- <?php
	5849	+ // Don't let a user change their own role
	5850	+ $disabled = $selected_role !== $name && $disable_input === 'disabled' ? ' disabled="disabled"' : '';
	5851	+
	5852	+ // But network admins can always change their role.
	5853	+ if ( is_multisite() && current_user_can( 'manage_network' ) ) {
	5854	+ $disabled = '';
	5855	+ }
	5856	+
	5857	+ ?><option value="<?php echo $name; ?>"<?php echo $selected . $disabled; ?>><?php echo $role['name']; ?></option><?php
7601	5858	}
7602	5859
7603	5860	// Print default role (no role).
7604		- $is_selected = strlen( $selected_role ) === 0 || ! array_key_exists( $selected_role, $roles );
7605		- $is_disabled = strlen( $selected_role ) > 0 && 'disabled' === $disable_input && ! ( is_multisite() && current_user_can( 'manage_network' ) );
7606		- ?>
7607		- <option value=""<?php selected( $is_selected ); ?><?php disabled( $is_disabled ); ?>><?php esc_html_e( '&mdash; No role for this site &mdash;', 'authorizer' ); ?></option>
7608		- <?php
	5861	+ $selected = strlen( $selected_role ) == 0 || ! array_key_exists( $selected_role, $roles ) ? ' selected="selected"' : '';
	5862	+ $disabled = strlen( $selected_role ) > 0 && $disable_input === 'disabled' ? ' disabled="disabled"' : '';
	5863	+ if ( is_multisite() && current_user_can( 'manage_network' ) ) {
	5864	+ $disabled = '';
	5865	+ }
	5866	+ ?><option value=""<?php echo $selected . $disabled; ?>><?php _e( '&mdash; No role for this site &mdash;', 'authorizer' ); ?></option><?php
7609	5867
7610	5868	}
7611	5869
7612	5870
7613		- /**
7614		- * Helper function to get a single user info array from one of the access
7615		- * control lists (pending, approved, or blocked).
7616		- *
7617		- * @param string $email Email address to retrieve info for.
7618		- * @param string $list List to get info from.
7619		- * @return mixed false if not found, otherwise: array(
7620		- * 'email' => '',
7621		- * 'role' => '',
7622		- * 'date_added' => '',
7623		- * ['usermeta' => [''|array()]]
7624		- * );
7625		- */
7626		- protected function get_user_info_from_list( $email, $list ) {
	5871	+ // Helper function to get a single user info array from one of the
	5872	+ // access control lists (pending, approved, or blocked).
	5873	+ // Returns: false if not found; otherwise
	5874	+ // array( 'email' => '', 'role' => '', 'date_added' => '', ['usermeta' => [''|array()]] );
	5875	+ function get_user_info_from_list( $email, $list ) {
7627	5876	foreach ( $list as $user_info ) {
7628		- if ( 0 === strcasecmp( $user_info['email'], $email ) ) {
	5877	+ if ( $user_info['email'] === $email ) {
7629	5878	return $user_info;
7630	5879	}
7631	5880	}
7632	5881	return false;
		@@ -7631,49 +5880,29 @@
7631	5880	}
7632	5881	return false;
7633	5882	}
7634	5883
7635		- /**
7636		- * Helper function to convert a string to lowercase. Prefers to use mb_strtolower,
7637		- * but will fall back to strtolower if the former is not available.
7638		- *
7639		- * @param string $string String to convert to lowercase.
7640		- * @return string Input in lowercase.
7641		- */
7642		- protected function lowercase( $string ) {
7643		- return function_exists( 'mb_strtolower' ) ? mb_strtolower( $string ) : strtolower( $string );
7644		- }
7645	5884
7646		-
7647		- /**
7648		- * Helper function to convert seconds to human readable text.
7649		- *
7650		- * @see: http://csl.name/php-secs-to-human-text/
7651		- *
7652		- * @param int $secs Seconds to display as readable text.
7653		- * @return string Readable version of number of seconds.
7654		- */
7655		- protected function seconds_as_sentence( $secs ) {
	5885	+ // Helper function to convert seconds to human readable text.
	5886	+ // Source: http://csl.name/php-secs-to-human-text/
	5887	+ function seconds_as_sentence( $secs ) {
7656	5888	$units = array(
7657		- 'week' => 3600 * 24 * 7,
7658		- 'day' => 3600 * 24,
7659		- 'hour' => 3600,
7660		- 'minute' => 60,
7661		- 'second' => 1,
	5889	+ "week" => 7 * 24 * 3600,
	5890	+ "day" => 24 * 3600,
	5891	+ "hour" => 3600,
	5892	+ "minute" => 60,
	5893	+ "second" => 1,
7662	5894	);
7663	5895
7664		- // Specifically handle zero.
7665		- if ( 0 === intval( $secs ) ) {
7666		- return '0 seconds';
7667		- }
	5896	+ // specifically handle zero
	5897	+ if ( $secs == 0 ) return "0 seconds";
7668	5898
7669		- $s = '';
	5899	+ $s = "";
7670	5900
7671	5901	foreach ( $units as $name => $divisor ) {
7672		- $quot = intval( $secs / $divisor );
7673		- if ( $quot ) {
7674		- $s .= "$quot $name";
7675		- $s .= ( abs( $quot ) > 1 ? 's' : '' ) . ', ';
	5902	+ if ( $quot = intval( $secs / $divisor ) ) {
	5903	+ $s .= "$quot $name";
	5904	+ $s .= ( abs( $quot ) > 1 ? "s" : "" ) . ", ";
7676	5905	$secs -= $quot * $divisor;
7677	5906	}
7678	5907	}
7679	5908
		@@ -7679,14 +5908,10 @@
7679	5908
7680	5909	return substr( $s, 0, -2 );
7681	5910	}
7682	5911
7683		- /**
7684		- * Helper function to get all available usermeta keys as an array.
7685		- *
7686		- * @return array All usermeta keys for user.
7687		- */
7688		- protected function get_all_usermeta_keys() {
	5912	+ // Helper function to get all available usermeta keys as an array.
	5913	+ function get_all_usermeta_keys() {
7689	5914	global $wpdb;
7690	5915	$usermeta_keys = $wpdb->get_col( "SELECT DISTINCT $wpdb->usermeta.meta_key FROM $wpdb->usermeta" );
7691	5916	return $usermeta_keys;
7692	5917	}
		@@ -7693,12 +5918,10 @@
7693	5918
7694	5919
7695	5920	/**
7696	5921	* Load translated strings from *.mo files in /languages.
7697		- *
7698		- * Action: plugins_loaded
7699	5922	*/
7700		- public function load_textdomain() {
	5923	+ function load_textdomain() {
7701	5924	load_plugin_textdomain(
7702	5925	'authorizer',
7703	5926	false,
7704	5927	plugin_basename( dirname( __FILE__ ) ) . '/languages'
		@@ -7709,17 +5932,14 @@
7709	5932	/**
7710	5933	* Generate CAS authentication URL (wp-login.php URL with reauth=1 removed
7711	5934	* and external=cas added).
7712	5935	*/
7713		- private function modify_current_url_for_cas_login() {
	5936	+ function modify_current_url_for_cas_login() {
7714	5937	// Construct the URL of the current page (wp-login.php).
7715		- $url = '';
7716		- if ( isset( $_SERVER['HTTP_HOST'], $_SERVER['REQUEST_URI'] ) ) {
7717		- $url = set_url_scheme( esc_url_raw( wp_unslash( $_SERVER['HTTP_HOST'] ) ) . esc_url_raw( wp_unslash( $_SERVER['REQUEST_URI'] ) ) );
7718		- }
	5938	+ $url = 'http' . ( isset( $_SERVER['HTTPS'] ) ? 's' : '' ) . '://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
7719	5939
7720	5940	// Parse the URL into its components.
7721		- $parsed_url = wp_parse_url( $url );
	5941	+ $parsed_url = parse_url( $url );
7722	5942
7723	5943	// Fix up the querystring values (remove reauth, make sure external=cas).
7724	5944	$querystring = array();
7725	5945	if ( array_key_exists( 'query', $parsed_url ) ) {
		@@ -7726,9 +5946,9 @@
7726	5946	parse_str( $parsed_url['query'], $querystring );
7727	5947	}
7728	5948	unset( $querystring['reauth'] );
7729	5949	$querystring['external'] = 'cas';
7730		- $parsed_url['query'] = http_build_query( $querystring );
	5950	+ $parsed_url['query'] = http_build_query( $querystring );
7731	5951
7732	5952	// Return the URL as a string.
7733	5953	return $this->unparse_url( $parsed_url );
7734	5954	}
		@@ -7735,21 +5955,20 @@
7735	5955
7736	5956
7737	5957	/**
7738	5958	* Reconstruct a URL after it has been deconstructed with parse_url().
7739		- *
7740		- * @param array $parsed_url Keys from parse_url().
7741		- * @return string URL constructed from the components in $parsed_url.
	5959	+ * @param $parsed_url array() with keys from parse_url().
	5960	+ * @return string URL constructed from the components in $parsed_url.
7742	5961	*/
7743		- protected function unparse_url( $parsed_url = array() ) {
7744		- $scheme = isset( $parsed_url['scheme'] ) ? $parsed_url['scheme'] . '://' : '';
7745		- $host = isset( $parsed_url['host'] ) ? $parsed_url['host'] : '';
7746		- $port = isset( $parsed_url['port'] ) ? ':' . $parsed_url['port'] : '';
7747		- $user = isset( $parsed_url['user'] ) ? $parsed_url['user'] : '';
7748		- $pass = isset( $parsed_url['pass'] ) ? ':' . $parsed_url['pass'] : '';
7749		- $pass = $user || $pass ? "$pass@" : '';
7750		- $path = isset( $parsed_url['path'] ) ? $parsed_url['path'] : '';
7751		- $query = isset( $parsed_url['query'] ) ? '?' . $parsed_url['query'] : '';
	5962	+ function unparse_url( $parsed_url = array() ) {
	5963	+ $scheme = isset( $parsed_url['scheme'] ) ? $parsed_url['scheme'] . '://' : '';
	5964	+ $host = isset( $parsed_url['host'] ) ? $parsed_url['host'] : '';
	5965	+ $port = isset( $parsed_url['port'] ) ? ':' . $parsed_url['port'] : '';
	5966	+ $user = isset( $parsed_url['user'] ) ? $parsed_url['user'] : '';
	5967	+ $pass = isset( $parsed_url['pass'] ) ? ':' . $parsed_url['pass'] : '';
	5968	+ $pass = $user || $pass ? "$pass@" : '';
	5969	+ $path = isset( $parsed_url['path'] ) ? $parsed_url['path'] : '';
	5970	+ $query = isset( $parsed_url['query'] ) ? '?' . $parsed_url['query'] : '';
7752	5971	$fragment = isset( $parsed_url['fragment'] ) ? '#' . $parsed_url['fragment'] : '';
7753	5972	return "$scheme$user$pass$host$port$path$query$fragment";
7754	5973	}
7755	5974
		@@ -7754,32 +5973,35 @@
7754	5973	}
7755	5974
7756	5975
7757	5976	/**
7758		- * Helper function to generate an HTML class name for an option (used in
7759		- * Authorizer Settings in the Approved User list).
7760		- *
7761		- * @param string $suffix Unique part of class name.
7762		- * @param boolean $is_multisite_user Whether the class name should indicate it's a multisite user.
7763		- * @return string Class name, e.g., "auth-email auth-multisite-email".
7764		- */
7765		- private function create_class_name( $suffix = '', $is_multisite_user = false ) {
7766		- return $is_multisite_user ? "auth-$suffix auth-multisite-$suffix" : "auth-$suffix";
7767		- }
7768		-
7769		-
7770		- /**
7771	5977	* Plugin Update Routines.
7772		- *
7773		- * Action: plugins_loaded
7774	5978	*/
7775		- public function auth_update_check() {
7776		- // Get current version.
7777		- $needs_updating = false;
7778		- if ( is_multisite() ) {
7779		- $auth_version = get_blog_option( $this->current_site_blog_id, 'auth_version' );
7780		- } else {
7781		- $auth_version = get_option( 'auth_version' );
	5979	+ function auth_update_check() {
	5980	+ // Update: Set default values for newly added options (forgot to do
	5981	+ // this, so some users are getting debug log notices about undefined
	5982	+ // indexes in $auth_settings).
	5983	+ $update_if_older_than = 20160831;
	5984	+ $auth_version = get_option( 'auth_version' );
	5985	+ if ( $auth_version === false || intval( $auth_version ) < $update_if_older_than ) {
	5986	+ // Provide default values for any $auth_settings options that don't exist.
	5987	+ if ( is_multisite() ) {
	5988	+ // Get all blog ids
	5989	+ $sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
	5990	+ foreach ( $sites as $site ) {
	5991	+ $blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
	5992	+ switch_to_blog( $blog_id );
	5993	+ // Set meaningful defaults for other sites in the network.
	5994	+ $this->set_default_options();
	5995	+ // Switch back to original blog. See: https://codex.wordpress.org/Function_Reference/restore_current_blog
	5996	+ restore_current_blog();
	5997	+ }
	5998	+ } else {
	5999	+ // Set meaningful defaults for this site.
	6000	+ $this->set_default_options();
	6001	+ }
	6002	+ // Update version to reflect this change has been made.
	6003	+ update_option( 'auth_version', $update_if_older_than );
7782	6004	}
7783	6005
7784	6006	// Update: migrate user lists to own options (addresses concurrency
7785	6007	// when saving plugin options, since user lists are changed often
		@@ -7789,9 +6011,10 @@
7789	6011	// log in; approved and blocked lists are changed whenever an admin
7790	6012	// changes them from the multisite panel, the dashboard widget, or
7791	6013	// the plugin options page.
7792	6014	$update_if_older_than = 20140709;
7793		- if ( false === $auth_version || intval( $auth_version ) < $update_if_older_than ) {
	6015	+ $auth_version = get_option( 'auth_version' );
	6016	+ if ( $auth_version === false || intval( $auth_version ) < $update_if_older_than ) {
7794	6017	// Copy single site user lists to new options (if they exist).
7795	6018	$auth_settings = get_option( 'auth_settings' );
7796	6019	if ( is_array( $auth_settings ) && array_key_exists( 'access_users_pending', $auth_settings ) ) {
7797	6020	update_option( 'auth_settings_access_users_pending', $auth_settings['access_users_pending'] );
		@@ -7809,264 +6032,36 @@
7809	6032	update_option( 'auth_settings', $auth_settings );
7810	6033	}
7811	6034	// Copy multisite user lists to new options (if they exist).
7812	6035	if ( is_multisite() ) {
7813		- $auth_multisite_settings = get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings', array() );
	6036	+ $auth_multisite_settings = get_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings', array() );
7814	6037	if ( is_array( $auth_multisite_settings ) && array_key_exists( 'access_users_pending', $auth_multisite_settings ) ) {
7815		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_pending', $auth_multisite_settings['access_users_pending'] );
	6038	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_pending', $auth_multisite_settings['access_users_pending'] );
7816	6039	unset( $auth_multisite_settings['access_users_pending'] );
7817		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings', $auth_multisite_settings );
	6040	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings', $auth_multisite_settings );
7818	6041	}
7819	6042	if ( is_array( $auth_multisite_settings ) && array_key_exists( 'access_users_approved', $auth_multisite_settings ) ) {
7820		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings['access_users_approved'] );
	6043	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings['access_users_approved'] );
7821	6044	unset( $auth_multisite_settings['access_users_approved'] );
7822		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings', $auth_multisite_settings );
	6045	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings', $auth_multisite_settings );
7823	6046	}
7824	6047	if ( is_array( $auth_multisite_settings ) && array_key_exists( 'access_users_blocked', $auth_multisite_settings ) ) {
7825		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_blocked', $auth_multisite_settings['access_users_blocked'] );
	6048	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings_access_users_blocked', $auth_multisite_settings['access_users_blocked'] );
7826	6049	unset( $auth_multisite_settings['access_users_blocked'] );
7827		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings', $auth_multisite_settings );
	6050	+ update_blog_option( BLOG_ID_CURRENT_SITE, 'auth_multisite_settings', $auth_multisite_settings );
7828	6051	}
7829	6052	}
7830	6053	// Update version to reflect this change has been made.
7831		- $auth_version = $update_if_older_than;
7832		- $needs_updating = true;
	6054	+ update_option( 'auth_version', $update_if_older_than );
7833	6055	}
7834	6056
7835		- // Update: Set default values for newly added options (forgot to do
7836		- // this, so some users are getting debug log notices about undefined
7837		- // indexes in $auth_settings).
7838		- $update_if_older_than = 20160831;
7839		- if ( false === $auth_version || intval( $auth_version ) < $update_if_older_than ) {
7840		- // Provide default values for any $auth_settings options that don't exist.
7841		- if ( is_multisite() ) {
7842		- // Get all blog ids.
7843		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
7844		- $sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
7845		- foreach ( $sites as $site ) {
7846		- $blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
7847		- switch_to_blog( $blog_id );
7848		- // Set meaningful defaults for other sites in the network.
7849		- $this->set_default_options();
7850		- // Switch back to original blog.
7851		- restore_current_blog();
7852		- }
7853		- } else {
7854		- // Set meaningful defaults for this site.
7855		- $this->set_default_options();
7856		- }
7857		- // Update version to reflect this change has been made.
7858		- $auth_version = $update_if_older_than;
7859		- $needs_updating = true;
7860		- }
7861		-
7862		- // Update: Migrate LDAP passwords encrypted with mcrypt since mcrypt is
7863		- // deprecated as of PHP 7.1. Use openssl library instead.
7864		- $update_if_older_than = 20170510;
7865		- if ( false === $auth_version || intval( $auth_version ) < $update_if_older_than ) {
7866		- if ( is_multisite() ) {
7867		- // Reencrypt LDAP passwords in each site in the network.
7868		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
7869		- $sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
7870		- foreach ( $sites as $site ) {
7871		- $blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
7872		- $auth_settings = get_blog_option( $blog_id, 'auth_settings', array() );
7873		- if ( array_key_exists( 'ldap_password', $auth_settings ) && strlen( $auth_settings['ldap_password'] ) > 0 ) {
7874		- $plaintext_ldap_password = $this->decrypt( $auth_settings['ldap_password'], 'mcrypt' );
7875		- $auth_settings['ldap_password'] = $this->encrypt( $plaintext_ldap_password );
7876		- update_blog_option( $blog_id, 'auth_settings', $auth_settings );
7877		- }
7878		- }
7879		- } else {
7880		- // Reencrypt LDAP password on this single-site install.
7881		- $auth_settings = get_option( 'auth_settings', array() );
7882		- if ( array_key_exists( 'ldap_password', $auth_settings ) && strlen( $auth_settings['ldap_password'] ) > 0 ) {
7883		- $plaintext_ldap_password = $this->decrypt( $auth_settings['ldap_password'], 'mcrypt' );
7884		- $auth_settings['ldap_password'] = $this->encrypt( $plaintext_ldap_password );
7885		- update_option( 'auth_settings', $auth_settings );
7886		- }
7887		- }
7888		- // Update version to reflect this change has been made.
7889		- $auth_version = $update_if_older_than;
7890		- $needs_updating = true;
7891		- }
7892		-
7893		- // Update: Migrate LDAP passwords encrypted with mcrypt since mcrypt is
7894		- // deprecated as of PHP 7.1. Use openssl library instead.
7895		- // Note: Forgot to update the auth_multisite_settings ldap password! Do it here.
7896		- $update_if_older_than = 20170511;
7897		- if ( false === $auth_version || intval( $auth_version ) < $update_if_older_than ) {
7898		- if ( is_multisite() ) {
7899		- // Reencrypt LDAP password in network (multisite) options.
7900		- $auth_multisite_settings = get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings', array() );
7901		- if ( array_key_exists( 'ldap_password', $auth_multisite_settings ) && strlen( $auth_multisite_settings['ldap_password'] ) > 0 ) {
7902		- $plaintext_ldap_password = $this->decrypt( $auth_multisite_settings['ldap_password'], 'mcrypt' );
7903		- $auth_multisite_settings['ldap_password'] = $this->encrypt( $plaintext_ldap_password );
7904		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings', $auth_multisite_settings );
7905		- }
7906		- }
7907		- // Update version to reflect this change has been made.
7908		- $auth_version = $update_if_older_than;
7909		- $needs_updating = true;
7910		- }
7911		-
7912		- // Update: Remove duplicates from approved list caused by authorizer_automatically_approve_login
7913		- // filter not respecting users who are already in the approved list
7914		- // (causing them to get re-added each time they logged in).
7915		- $update_if_older_than = 20170711;
7916		- if ( false === $auth_version || intval( $auth_version ) < $update_if_older_than ) {
7917		- // Remove duplicates from approved user lists.
7918		- if ( is_multisite() ) {
7919		- // Remove duplicates from each site in the multisite.
7920		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
7921		- $sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
7922		- foreach ( $sites as $site ) {
7923		- $blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
7924		- $auth_settings_access_users_approved = get_blog_option( $blog_id, 'auth_settings_access_users_approved', array() );
7925		- if ( is_array( $auth_settings_access_users_approved ) ) {
7926		- $should_update = false;
7927		- $distinct_emails = array();
7928		- foreach ( $auth_settings_access_users_approved as $key => $user ) {
7929		- if ( in_array( $user['email'], $distinct_emails, true ) ) {
7930		- $should_update = true;
7931		- unset( $auth_settings_access_users_approved[ $key ] );
7932		- } else {
7933		- $distinct_emails[] = $user['email'];
7934		- }
7935		- }
7936		- if ( $should_update ) {
7937		- update_blog_option( $blog_id, 'auth_settings_access_users_approved', $auth_settings_access_users_approved );
7938		- }
7939		- }
7940		- }
7941		- // Remove duplicates from multisite approved user list.
7942		- $auth_multisite_settings_access_users_approved = get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', array() );
7943		- if ( is_array( $auth_multisite_settings_access_users_approved ) ) {
7944		- $should_update = false;
7945		- $distinct_emails = array();
7946		- foreach ( $auth_multisite_settings_access_users_approved as $key => $user ) {
7947		- if ( in_array( $user['email'], $distinct_emails, true ) ) {
7948		- $should_update = true;
7949		- unset( $auth_multisite_settings_access_users_approved[ $key ] );
7950		- } else {
7951		- $distinct_emails[] = $user['email'];
7952		- }
7953		- }
7954		- if ( $should_update ) {
7955		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
7956		- }
7957		- }
7958		- } else {
7959		- // Remove duplicates from single site approved user list.
7960		- $auth_settings_access_users_approved = get_option( 'auth_settings_access_users_approved' );
7961		- if ( is_array( $auth_settings_access_users_approved ) ) {
7962		- $should_update = false;
7963		- $distinct_emails = array();
7964		- foreach ( $auth_settings_access_users_approved as $key => $user ) {
7965		- if ( in_array( $user['email'], $distinct_emails, true ) ) {
7966		- $should_update = true;
7967		- unset( $auth_settings_access_users_approved[ $key ] );
7968		- } else {
7969		- $distinct_emails[] = $user['email'];
7970		- }
7971		- }
7972		- if ( $should_update ) {
7973		- update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved );
7974		- }
7975		- }
7976		- }
7977		- // Update version to reflect this change has been made.
7978		- $auth_version = $update_if_older_than;
7979		- $needs_updating = true;
7980		- }
7981		-
7982		- // Update: Set default value for newly added option advanced_widget_enabled.
7983		- $update_if_older_than = 20171023;
7984		- if ( false === $auth_version || intval( $auth_version ) < $update_if_older_than ) {
7985		- // Provide default values for any $auth_settings options that don't exist.
7986		- if ( is_multisite() ) {
7987		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
7988		- $sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
7989		- foreach ( $sites as $site ) {
7990		- $blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
7991		- switch_to_blog( $blog_id );
7992		- $this->set_default_options();
7993		- restore_current_blog();
7994		- }
7995		- } else {
7996		- $this->set_default_options();
7997		- }
7998		- // Update version to reflect this change has been made.
7999		- $auth_version = $update_if_older_than;
8000		- $needs_updating = true;
8001		- }
8002		-
8003		- // Update: Set default value for newly added option advanced_users_per_page.
8004		- $update_if_older_than = 20171215;
8005		- if ( false === $auth_version || intval( $auth_version ) < $update_if_older_than ) {
8006		- // Provide default values for any $auth_settings options that don't exist.
8007		- if ( is_multisite() ) {
8008		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
8009		- $sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
8010		- foreach ( $sites as $site ) {
8011		- $blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
8012		- switch_to_blog( $blog_id );
8013		- $this->set_default_options();
8014		- restore_current_blog();
8015		- }
8016		- } else {
8017		- $this->set_default_options();
8018		- }
8019		- // Update version to reflect this change has been made.
8020		- $auth_version = $update_if_older_than;
8021		- $needs_updating = true;
8022		- }
8023		-
8024		- // Update: Set default value for newly added options advanced_users_sort_by and advanced_users_sort_order.
8025		- $update_if_older_than = 20171219;
8026		- if ( false === $auth_version || intval( $auth_version ) < $update_if_older_than ) {
8027		- // Provide default values for any $auth_settings options that don't exist.
8028		- if ( is_multisite() ) {
8029		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
8030		- $sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
8031		- foreach ( $sites as $site ) {
8032		- $blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
8033		- switch_to_blog( $blog_id );
8034		- $this->set_default_options();
8035		- restore_current_blog();
8036		- }
8037		- } else {
8038		- $this->set_default_options();
8039		- }
8040		- // Update version to reflect this change has been made.
8041		- $auth_version = $update_if_older_than;
8042		- $needs_updating = true;
8043		- }
8044		-
8045		- /*
8046		- // Update: TEMPLATE
8047		- $update_if_older_than = YYYYMMDD;
8048		- if ( $auth_version === false || intval( $auth_version ) < $update_if_older_than ) {
8049		- UPDATE CODE HERE
8050		- // Update version to reflect this change has been made.
8051		- $auth_version = $update_if_older_than;
8052		- $needs_updating = true;
8053		- }
8054		- */
8055		-
8056		- // Save new version number if we performed any updates.
8057		- if ( $needs_updating ) {
8058		- if ( is_multisite() ) {
8059		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
8060		- $sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
8061		- foreach ( $sites as $site ) {
8062		- $blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
8063		- update_blog_option( $blog_id, 'auth_version', $auth_version );
8064		- }
8065		- } else {
8066		- update_option( 'auth_version', $auth_version );
8067		- }
8068		- }
	6057	+ // // Update: TEMPLATE
	6058	+ // $update_if_older_than = YYYYMMDD;
	6059	+ // $auth_version = get_option( 'auth_version' );
	6060	+ // if ( $auth_version === false || intval( $auth_version ) < $update_if_older_than ) {
	6061	+ // UPDATE CODE HERE
	6062	+ // update_option( 'auth_version', $update_if_older_than );
	6063	+ // }
8069	6064	}
8070	6065
8071	6066	}
8072	6067	}