← All changes | authorizer.php +2181 -3246 2.8.6 → 2.7.0 View file →

		@@ -1,31 +1,51 @@
1	1	<?php
2		-/**
3		- * Plugin Name: Authorizer
4		- * Description: Authorizer limits login attempts, restricts access to specified users, and authenticates against external sources (e.g., Google, LDAP, or CAS).
5		- * Author: Paul Ryan <prar@hawaii.edu>
6		- * Plugin URI: https://github.com/uhm-coe/authorizer
7		- * Text Domain: authorizer
8		- * Domain Path: /languages
9		- * License: GPL2
10		- * Version: 2.8.6
11		- *
12		- * @package authorizer
13		- */
	2	+/*
	3	+Plugin Name: Authorizer
	4	+Plugin URI: https://github.com/uhm-coe/authorizer
	5	+Description: Authorizer limits login attempts, restricts access to specified users, and authenticates against external sources (e.g., Google, LDAP, or CAS).
	6	+Version: 2.7.0
	7	+Author: Paul Ryan
	8	+Author URI: http://www.linkedin.com/in/paulrryan/
	9	+Text Domain: authorizer
	10	+Domain Path: /languages
	11	+License: GPL2
	12	+*/
14	13
15		-/**
16		- * Portions forked from Restricted Site Access plugin: http://wordpress.org/plugins/restricted-site-access/
17		- * Portions forked from wpCAS plugin: http://wordpress.org/extend/plugins/cas-authentication/
18		- * Portions forked from Limit Login Attempts: http://wordpress.org/plugins/limit-login-attempts/
19		- */
20	14
21		-/**
22		- * Add phpCAS library if it's not included.
23		- *
24		- * @see https://wiki.jasig.org/display/CASC/phpCAS+installation+guide
25		- */
	15	+/*
	16	+Copyright 2014 Paul Ryan (email: prar@hawaii.edu)
	17	+
	18	+This program is free software; you can redistribute it and/or modify
	19	+it under the terms of the GNU General Public License, version 2, as
	20	+published by the Free Software Foundation.
	21	+
	22	+This program is distributed in the hope that it will be useful,
	23	+but WITHOUT ANY WARRANTY; without even the implied warranty of
	24	+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	25	+GNU General Public License for more details.
	26	+
	27	+You should have received a copy of the GNU General Public License
	28	+along with this program; if not, write to the Free Software
	29	+Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
	30	+*/
	31	+
	32	+
	33	+/*
	34	+Portions forked from Restricted Site Access plugin: http://wordpress.org/plugins/restricted-site-access/
	35	+Portions forked from wpCAS plugin: http://wordpress.org/extend/plugins/cas-authentication/
	36	+Portions forked from Limit Login Attempts: http://wordpress.org/plugins/limit-login-attempts/
	37	+*/
	38	+
	39	+
	40	+define( 'MULTISITE_ADMIN', 'multisite_admin' );
	41	+define( 'SINGLE_ADMIN', 'single_admin' );
	42	+
	43	+
	44	+// Add phpCAS library if it's not included.
	45	+// @see https://wiki.jasig.org/display/CASC/phpCAS+installation+guide
26	46	if ( ! defined( 'PHPCAS_VERSION' ) ) {
27		- require_once dirname( __FILE__ ) . '/vendor/phpCAS-1.3.6/CAS.php';
	47	+ require_once dirname( __FILE__ ) . '/vendor/CAS-1.3.5/CAS.php';
28	48	}
29	49
30	50
31	51	if ( ! class_exists( 'WP_Plugin_Authorizer' ) ) {
		@@ -40,68 +60,13 @@
40	60	*/
41	61	class WP_Plugin_Authorizer {
42	62
43	63	/**
44		- * Constants for determining our admin context (network or individual site).
	64	+ * Properties.
45	65	*/
46		- const NETWORK_CONTEXT = 'multisite_admin';
47		- const SINGLE_CONTEXT = 'single_admin';
48		-
49		- /**
50		- * Current site ID (Multisite).
51		- *
52		- * @var string
53		- */
54	66	public $current_site_blog_id = 1;
55	67
56	68	/**
57		- * HTML allowed when rendering translatable strings in the Authorizer UI.
58		- * This is passed to wp_kses() when sanitizing HMTL strings.
59		- *
60		- * @var array
61		- */
62		- private $allowed_html = array(
63		- 'a' => array(
64		- 'class' => array(),
65		- 'href' => array(),
66		- 'style' => array(),
67		- 'target' => array(),
68		- 'title' => array(),
69		- ),
70		- 'b' => array(),
71		- 'br' => array(),
72		- 'div' => array(
73		- 'class' => array(),
74		- ),
75		- 'em' => array(),
76		- 'hr' => array(),
77		- 'i' => array(),
78		- 'input' => array(
79		- 'aria-describedby' => array(),
80		- 'class' => array(),
81		- 'id' => array(),
82		- 'name' => array(),
83		- 'size' => array(),
84		- 'type' => array(),
85		- 'value' => array(),
86		- ),
87		- 'label' => array(
88		- 'class' => array(),
89		- 'for' => array(),
90		- ),
91		- 'p' => array(
92		- 'style' => array(),
93		- ),
94		- 'span' => array(
95		- 'aria-hidden' => array(),
96		- 'class' => array(),
97		- 'id' => array(),
98		- 'style' => array(),
99		- ),
100		- 'strong' => array(),
101		- );
102		-
103		- /**
104	69	* Constructor.
105	70	*/
106	71	public function __construct() {
107	72	// Save reference to current blog id in the network (support deprecated
		@@ -108,9 +73,9 @@
108	73	// constant BLOGID_CURRENT_SITE).
109	74	if ( defined( 'BLOG_ID_CURRENT_SITE' ) ) {
110	75	$this->current_site_blog_id = BLOG_ID_CURRENT_SITE;
111	76	} elseif ( defined( 'BLOGID_CURRENT_SITE' ) ) { // deprecated.
112		- $this->current_site_blog_id = BLOGID_CURRENT_SITE;
	77	+ $this->current_site->blog_id = BLOGID_CURRENT_SITE;
113	78	}
114	79
115	80	// Installation and uninstallation hooks.
116	81	register_activation_hook( __FILE__, array( $this, 'activate' ) );
		@@ -115,11 +80,9 @@
115	80	// Installation and uninstallation hooks.
116	81	register_activation_hook( __FILE__, array( $this, 'activate' ) );
117	82	register_deactivation_hook( __FILE__, array( $this, 'deactivate' ) );
118	83
119		- /**
120		- * Register filters.
121		- */
	84	+ // Register filters.
122	85
123	86	// Custom wp authentication routine using external service.
124	87	add_filter( 'authenticate', array( $this, 'custom_authenticate' ), 1, 3 );
125	88
		@@ -125,9 +88,13 @@
125	88
126	89	// Custom logout action using external service.
127	90	add_action( 'wp_logout', array( $this, 'custom_logout' ) );
128	91
129		- // Create settings link on Plugins page.
	92	+ // Removing this bypasses Wordpress authentication (so if external auth fails,
	93	+ // no one can log in); with it enabled, it will run if external auth fails.
	94	+ //remove_filter('authenticate', 'wp_authenticate_username_password', 20, 3);
	95	+
	96	+ // Create settings link on Plugins page
130	97	add_filter( 'plugin_action_links_' . plugin_basename( __FILE__ ), array( $this, 'plugin_settings_link' ) );
131	98	add_filter( 'network_admin_plugin_action_links_' . plugin_basename( __FILE__ ), array( $this, 'network_admin_plugin_settings_link' ) );
132	99
133	100	// Modify login page with a custom password url (if option is set).
		@@ -138,11 +105,9 @@
138	105	if ( $error && strlen( $error ) > 0 ) {
139	106	add_filter( 'login_errors', array( $this, 'show_advanced_login_error' ) );
140	107	}
141	108
142		- /**
143		- * Register actions.
144		- */
	109	+ // Register actions.
145	110
146	111	// Enable localization. Translation files stored in /languages.
147	112	add_action( 'plugins_loaded', array( $this, 'load_textdomain' ) );
148	113
		@@ -154,12 +119,12 @@
154	119
155	120	// Add users who successfully login to the approved list.
156	121	add_action( 'wp_login', array( $this, 'ensure_wordpress_user_in_approved_list_on_login' ), 10, 2 );
157	122
158		- // Create menu item in Settings.
	123	+ // Create menu item in Settings
159	124	add_action( 'admin_menu', array( $this, 'add_plugin_page' ) );
160	125
161		- // Create options page.
	126	+ // Create options page
162	127	add_action( 'admin_init', array( $this, 'page_init' ) );
163	128
164	129	// Update user role in approved list if it's changed in the WordPress edit user page.
165	130	add_action( 'user_profile_update_errors', array( $this, 'edit_user_profile_update_role' ), 10, 3 );
		@@ -172,9 +137,9 @@
172	137	add_action( 'load-settings_page_authorizer', array( $this, 'load_options_page' ) );
173	138	add_action( 'admin_head-index.php', array( $this, 'load_options_page' ) );
174	139	add_action( 'load-toplevel_page_authorizer', array( $this, 'load_options_page' ) );
175	140
176		- // Add custom css and js to wp-login.php.
	141	+ // Add custom css and js to wp-login.php
177	142	add_action( 'login_enqueue_scripts', array( $this, 'login_enqueue_scripts_and_styles' ) );
178	143	add_action( 'login_footer', array( $this, 'load_login_footer_js' ) );
179	144
180	145	// Create google nonce cookie when loading wp-login.php if Google is enabled.
		@@ -179,9 +144,9 @@
179	144
180	145	// Create google nonce cookie when loading wp-login.php if Google is enabled.
181	146	add_action( 'login_init', array( $this, 'login_init__maybe_set_google_nonce_cookie' ) );
182	147
183		- // Modify login page with external auth links (if enabled; e.g., google or cas).
	148	+ // Modify login page with external auth links (if enabled; e.g., google or cas)
184	149	add_action( 'login_form', array( $this, 'login_form_add_external_service_links' ) );
185	150
186	151	// Redirect to CAS login when visiting login page (only if option is
187	152	// enabled, CAS is the only service, and WordPress logins are hidden).
		@@ -190,26 +155,26 @@
190	155	// output is started (so the redirect header doesn't complain about data
191	156	// already being sent).
192	157	add_filter( 'wp_login_errors', array( $this, 'wp_login_errors__maybe_redirect_to_cas' ), 10, 2 );
193	158
194		- // Verify current user has access to page they are visiting.
	159	+ // Verify current user has access to page they are visiting
195	160	add_action( 'parse_request', array( $this, 'restrict_access' ), 9 );
196	161	add_action( 'init', array( $this, 'init__maybe_add_network_approved_user' ) );
197	162
198		- // AJAX: Save options from dashboard widget.
	163	+ // ajax save options from dashboard widget
199	164	add_action( 'wp_ajax_update_auth_user', array( $this, 'ajax_update_auth_user' ) );
200	165
201		- // AJAX: Save options from multisite options page.
	166	+ // ajax save options from multisite options page
202	167	add_action( 'wp_ajax_save_auth_multisite_settings', array( $this, 'ajax_save_auth_multisite_settings' ) );
203	168
204		- // AJAX: Save usermeta from options page.
	169	+ // ajax save usermeta from options page
205	170	add_action( 'wp_ajax_update_auth_usermeta', array( $this, 'ajax_update_auth_usermeta' ) );
206	171
207		- // AJAX: Verify google login.
	172	+ // ajax verify google login
208	173	add_action( 'wp_ajax_process_google_login', array( $this, 'ajax_process_google_login' ) );
209	174	add_action( 'wp_ajax_nopriv_process_google_login', array( $this, 'ajax_process_google_login' ) );
210	175
211		- // AJAX: Refresh approved user list.
	176	+ // ajax refresh approved user list
212	177	add_action( 'wp_ajax_refresh_approved_user_list', array( $this, 'ajax_refresh_approved_user_list' ) );
213	178
214	179	// Add dashboard widget so instructors can add/edit users with access.
215	180	// Hint: For Multisite Network Admin Dashboard use wp_network_dashboard_setup instead of wp_dashboard_setup.
		@@ -226,9 +191,9 @@
226	191	add_action( 'wp_enqueue_scripts', array( $this, 'auth_public_scripts' ), 20 );
227	192
228	193	// Multisite-specific actions.
229	194	if ( is_multisite() ) {
230		- // Add network admin options page (global settings for all sites).
	195	+ // Add network admin options page (global settings for all sites)
231	196	add_action( 'network_admin_menu', array( $this, 'network_admin_menu' ) );
232	197	}
233	198
234	199	// Remove user from authorizer lists when that user is deleted in WordPress.
		@@ -264,20 +229,16 @@
264	229	* Will also activate the plugin for all sites/blogs if this is a "Network enable."
265	230	*
266	231	* @return void
267	232	*/
268		- public function activate( $network_wide ) {
	233	+ public function activate() {
269	234	global $wpdb;
270	235
271		- // If we're in a multisite environment, run the plugin activation for each
272		- // site when network enabling.
273		- // Note: wp-cli does not use nonces, so we skip the nonce check here to
274		- // allow the "wp plugin activate authorizer" command.
275		- // phpcs:ignore WordPress.CSRF.NonceVerification.NoNonceVerification
276		- if ( is_multisite() && $network_wide ) {
	236	+ // If we're in a multisite environment, run the plugin activation for each site when network enabling
	237	+ if ( is_multisite() && isset( $_GET['networkwide'] ) && $_GET['networkwide'] == 1 ) {
277	238
278	239	// Add super admins to the multisite approved list.
279		- $auth_multisite_settings_access_users_approved = get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', array() );
	240	+ $auth_multisite_settings_access_users_approved = get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', array() );
280	241	$should_update_auth_multisite_settings_access_users_approved = false;
281	242	foreach ( get_super_admins() as $super_admin ) {
282	243	$user = get_user_by( 'login', $super_admin );
283	244	// Add to approved list if not there.
		@@ -282,10 +243,10 @@
282	243	$user = get_user_by( 'login', $super_admin );
283	244	// Add to approved list if not there.
284	245	if ( ! $this->in_multi_array( $user->user_email, $auth_multisite_settings_access_users_approved ) ) {
285	246	$approved_user = array(
286		- 'email' => $this->lowercase( $user->user_email ),
287		- 'role' => count( $user->roles ) > 0 ? $user->roles[0] : 'administrator',
	247	+ 'email' => $this->lowercase( $user->user_email ),
	248	+ 'role' => count( $user->roles ) > 0 ? $user->roles[0] : 'administrator',
288	249	'date_added' => date( 'M Y', strtotime( $user->user_registered ) ),
289	250	'local_user' => true,
290	251	);
291	252	array_push( $auth_multisite_settings_access_users_approved, $approved_user );
		@@ -297,9 +258,8 @@
297	258	}
298	259
299	260	// Run plugin activation on each site in the network.
300	261	$current_blog_id = $wpdb->blogid;
301		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
302	262	$sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
303	263	foreach ( $sites as $site ) {
304	264	$blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
305	265	switch_to_blog( $blog_id );
		@@ -329,12 +289,12 @@
329	289	*/
330	290	private function add_wp_users_to_approved_list() {
331	291	// Add current WordPress users to the approved list.
332	292	$auth_multisite_settings_access_users_approved = is_multisite() ? get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', array() ) : array();
333		- $auth_settings_access_users_pending = $this->get_plugin_option( 'access_users_pending', WP_Plugin_Authorizer::SINGLE_CONTEXT );
334		- $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT );
335		- $auth_settings_access_users_blocked = $this->get_plugin_option( 'access_users_blocked', WP_Plugin_Authorizer::SINGLE_CONTEXT );
336		- $updated = false;
	293	+ $auth_settings_access_users_pending = $this->get_plugin_option( 'access_users_pending', SINGLE_ADMIN );
	294	+ $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN );
	295	+ $auth_settings_access_users_blocked = $this->get_plugin_option( 'access_users_blocked', SINGLE_ADMIN );
	296	+ $updated = false;
337	297	foreach ( get_users() as $user ) {
338	298	// Skip if user is in blocked list.
339	299	if ( $this->in_multi_array( $user->user_email, $auth_settings_access_users_blocked ) ) {
340	300	continue;
		@@ -341,9 +301,9 @@
341	301	}
342	302	// Remove from pending list if there.
343	303	foreach ( $auth_settings_access_users_pending as $key => $pending_user ) {
344	304	if ( 0 === strcasecmp( $pending_user['email'], $user->user_email ) ) {
345		- unset( $auth_settings_access_users_pending[ $key ] );
	305	+ unset( $auth_settings_access_users_pending[$key] );
346	306	$updated = true;
347	307	}
348	308	}
349	309	// Skip if user is in multisite approved list.
		@@ -352,10 +312,10 @@
352	312	}
353	313	// Add to approved list if not there.
354	314	if ( ! $this->in_multi_array( $user->user_email, $auth_settings_access_users_approved ) ) {
355	315	$approved_user = array(
356		- 'email' => $this->lowercase( $user->user_email ),
357		- 'role' => count( $user->roles ) > 0 ? $user->roles[0] : '',
	316	+ 'email' => $this->lowercase( $user->user_email ),
	317	+ 'role' => count( $user->roles ) > 0 ? $user->roles[0] : '',
358	318	'date_added' => date( 'M Y', strtotime( $user->user_registered ) ),
359	319	'local_user' => true,
360	320	);
361	321	array_push( $auth_settings_access_users_approved, $approved_user );
		@@ -390,14 +350,13 @@
390	350
391	351	/**
392	352	* Authenticate against an external service.
393	353	*
394		- * Filter: authenticate
395		- *
396		- * @param WP_User $user user to authenticate.
	354	+ * @param WP_User $user user to authenticate
397	355	* @param string $username optional username to authenticate.
398	356	* @param string $password optional password to authenticate.
399		- * @return WP_User|WP_Error WP_User on success, WP_Error on failure.
	357	+ *
	358	+ * @return WP_User or WP_Error
400	359	*/
401	360	public function custom_authenticate( $user, $username, $password ) {
402	361	// Pass through if already authenticated.
403	362	if ( is_a( $user, 'WP_User' ) ) {
		@@ -405,20 +364,20 @@
405	364	} else {
406	365	$user = null;
407	366	}
408	367
409		- // If username and password are blank, this isn't a log in attempt.
	368	+ // If username and password are blank, this isn't a log in attempt
410	369	$is_login_attempt = strlen( $username ) > 0 && strlen( $password ) > 0;
411	370
412	371	// Check to make sure that $username is not locked out due to too
413	372	// many invalid login attempts. If it is, tell the user how much
414	373	// time remains until they can try again.
415		- $unauthenticated_user = $is_login_attempt ? get_user_by( 'login', $username ) : false;
	374	+ $unauthenticated_user = $is_login_attempt ? get_user_by( 'login', $username ) : false;
416	375	$unauthenticated_user_is_blocked = false;
417		- if ( $is_login_attempt && false !== $unauthenticated_user ) {
	376	+ if ( $is_login_attempt && $unauthenticated_user !== false ) {
418	377	$last_attempt = get_user_meta( $unauthenticated_user->ID, 'auth_settings_advanced_lockouts_time_last_failed', true );
419	378	$num_attempts = get_user_meta( $unauthenticated_user->ID, 'auth_settings_advanced_lockouts_failed_attempts', true );
420		- // Also check the auth_blocked user_meta flag (users in blocked list will get this flag).
	379	+ // Also check the auth_blocked user_meta flag (users in blocked list will get this flag)
421	380	$unauthenticated_user_is_blocked = get_user_meta( $unauthenticated_user->ID, 'auth_blocked', true ) === 'yes';
422	381	} else {
423	382	$last_attempt = get_option( 'auth_settings_advanced_lockouts_time_last_failed' );
424	383	$num_attempts = get_option( 'auth_settings_advanced_lockouts_failed_attempts' );
		@@ -432,9 +391,9 @@
432	391	return new WP_Error( 'empty_password', __( '<strong>ERROR</strong>: Incorrect username or password.', 'authorizer' ) );
433	392	}
434	393
435	394	// Grab plugin settings.
436		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
	395	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' );
437	396
438	397	// Make sure $last_attempt (time) and $num_attempts are positive integers.
439	398	// Note: this addresses resetting them if either is unset from above.
440	399	$last_attempt = abs( intval( $last_attempt ) );
		@@ -440,17 +399,17 @@
440	399	$last_attempt = abs( intval( $last_attempt ) );
441	400	$num_attempts = abs( intval( $num_attempts ) );
442	401
443	402	// Create semantic lockout variables.
444		- $lockouts = $auth_settings['advanced_lockouts'];
445		- $time_since_last_fail = time() - $last_attempt;
446		- $reset_duration = $lockouts['reset_duration'] * 60; // minutes to seconds.
447		- $num_attempts_long_lockout = $lockouts['attempts_1'] + $lockouts['attempts_2'];
448		- $num_attempts_short_lockout = $lockouts['attempts_1'];
449		- $seconds_remaining_long_lockout = $lockouts['duration_2'] * 60 - $time_since_last_fail;
	403	+ $lockouts = $auth_settings['advanced_lockouts'];
	404	+ $time_since_last_fail = time() - $last_attempt;
	405	+ $reset_duration = $lockouts['reset_duration'] * 60; // minutes to seconds
	406	+ $num_attempts_long_lockout = $lockouts['attempts_1'] + $lockouts['attempts_2'];
	407	+ $num_attempts_short_lockout = $lockouts['attempts_1'];
	408	+ $seconds_remaining_long_lockout = $lockouts['duration_2'] * 60 - $time_since_last_fail;
450	409	$seconds_remaining_short_lockout = $lockouts['duration_1'] * 60 - $time_since_last_fail;
451	410
452		- // Check if we need to institute a lockout delay.
	411	+ // Check if we need to institute a lockout delay
453	412	if ( $is_login_attempt && $time_since_last_fail > $reset_duration ) {
454	413	// Enough time has passed since the last invalid attempt and
455	414	// now that we can reset the failed attempt count, and let this
456	415	// login attempt go through.
		@@ -463,9 +422,8 @@
463	422	remove_filter( 'authenticate', 'wp_authenticate_username_password', 20, 3 );
464	423	return new WP_Error(
465	424	'empty_password',
466	425	sprintf(
467		- /* TRANSLATORS: 1: username 2: duration of lockout in seconds 3: duration of lockout as a phrase 4: lost password URL */
468	426	__( '<strong>ERROR</strong>: There have been too many invalid login attempts for the username <strong>%1$s</strong>. Please wait <strong id="seconds_remaining" data-seconds="%2$s">%3$s</strong> before trying again. <a href="%4$s" title="Password Lost and Found">Lost your password</a>?', 'authorizer' ),
469	427	$username,
470	428	$seconds_remaining_long_lockout,
471	429	$this->seconds_as_sentence( $seconds_remaining_long_lockout ),
		@@ -480,9 +438,8 @@
480	438	remove_filter( 'authenticate', 'wp_authenticate_username_password', 20, 3 );
481	439	return new WP_Error(
482	440	'empty_password',
483	441	sprintf(
484		- /* TRANSLATORS: 1: username 2: duration of lockout in seconds 3: duration of lockout as a phrase 4: lost password URL */
485	442	__( '<strong>ERROR</strong>: There have been too many invalid login attempts for the username <strong>%1$s</strong>. Please wait <strong id="seconds_remaining" data-seconds="%2$s">%3$s</strong> before trying again. <a href="%4$s" title="Password Lost and Found">Lost your password</a>?', 'authorizer' ),
486	443	$username,
487	444	$seconds_remaining_short_lockout,
488	445	$this->seconds_as_sentence( $seconds_remaining_short_lockout ),
		@@ -492,16 +449,16 @@
492	449	}
493	450
494	451	// Start external authentication.
495	452	$externally_authenticated_emails = array();
496		- $authenticated_by = '';
497		- $result = null;
	453	+ $authenticated_by = '';
	454	+ $result = null;
498	455
499	456	// Try Google authentication if it's enabled and we don't have a
500	457	// successful login yet.
501	458	if (
502		- '1' === $auth_settings['google'] &&
503		- 0 === count( $externally_authenticated_emails ) &&
	459	+ $auth_settings['google'] === '1' &&
	460	+ count( $externally_authenticated_emails ) === 0 &&
504	461	! is_wp_error( $result )
505	462	) {
506	463	$result = $this->custom_authenticate_google( $auth_settings );
507	464	if ( ! is_null( $result ) && ! is_wp_error( $result ) ) {
		@@ -516,10 +473,10 @@
516	473
517	474	// Try CAS authentication if it's enabled and we don't have a
518	475	// successful login yet.
519	476	if (
520		- '1' === $auth_settings['cas'] &&
521		- 0 === count( $externally_authenticated_emails ) &&
	477	+ $auth_settings['cas'] === '1' &&
	478	+ count( $externally_authenticated_emails ) === 0 &&
522	479	! is_wp_error( $result )
523	480	) {
524	481	$result = $this->custom_authenticate_cas( $auth_settings );
525	482	if ( ! is_null( $result ) && ! is_wp_error( $result ) ) {
		@@ -534,10 +491,10 @@
534	491
535	492	// Try LDAP authentication if it's enabled and we don't have an
536	493	// authenticated user yet.
537	494	if (
538		- '1' === $auth_settings['ldap'] &&
539		- 0 === count( $externally_authenticated_emails ) &&
	495	+ $auth_settings['ldap'] === '1' &&
	496	+ count( $externally_authenticated_emails ) === 0 &&
540	497	! is_wp_error( $result )
541	498	) {
542	499	$result = $this->custom_authenticate_ldap( $auth_settings, $username, $password );
543	500	if ( ! is_null( $result ) && ! is_wp_error( $result ) ) {
		@@ -558,14 +515,12 @@
558	515
559	516	// Remove duplicate and blank emails, if any.
560	517	$externally_authenticated_emails = array_filter( array_unique( $externally_authenticated_emails ) );
561	518
562		- /**
563		- * If we've made it this far, we should have an externally
564		- * authenticated user. The following should be set:
565		- * $externally_authenticated_emails
566		- * $authenticated_by
567		- */
	519	+ // If we've made it this far, we should have an externally
	520	+ // authenticated user. The following should be set:
	521	+ // $externally_authenticated_emails
	522	+ // $authenticated_by
568	523
569	524	// Get the external user's WordPress account by email address.
570	525	foreach ( $externally_authenticated_emails as $externally_authenticated_email ) {
571	526	$user = get_user_by( 'email', $this->lowercase( $externally_authenticated_email ) );
		@@ -572,23 +527,23 @@
572	527
573	528	// If we've already found a WordPress user associated with one
574	529	// of the supplied email addresses, don't keep examining other
575	530	// email addresses associated with the externally authenticated user.
576		- if ( false !== $user ) {
	531	+ if ( $user !== FALSE ) {
577	532	break;
578	533	}
579	534	}
580	535
581	536	// Check this external user's access against the access lists
582		- // (pending, approved, blocked).
	537	+ // (pending, approved, blocked)
583	538	$result = $this->check_user_access( $user, $externally_authenticated_emails, $result );
584	539
585	540	// Fail with message if there was an error creating/adding the user.
586		- if ( is_wp_error( $result ) || 0 === $result ) {
	541	+ if ( is_wp_error( $result ) || $result === 0 ) {
587	542	return $result;
588	543	}
589	544
590		- // If we have a valid user from check_user_access(), log that user in.
	545	+ // If we created a new user in check_user_access(), log that user in.
591	546	if ( get_class( $result ) === 'WP_User' ) {
592	547	$user = $result;
593	548	}
594	549
		@@ -605,26 +560,26 @@
605	560	/**
606	561	* This function will fail with a wp_die() message to the user if they
607	562	* don't have access.
608	563	*
609		- * @param WP_User $user User to check.
610		- * @param array $user_emails Array of user's plaintext emails (in case current user doesn't have a WP account).
611		- * @param array $user_data Array of keys for email, username, first_name, last_name,
612		- * authenticated_by, google_attributes, cas_attributes, ldap_attributes.
613		- * @return WP_Error|void|WP_User
614		- * WP_Error if there was an error on user creation / adding user to blog.
615		- * wp_die() if user does not have access.
616		- * WP_User if user has access.
	564	+ * @param WP_User $user User to check
	565	+ * @param [type] $user_emails Array of user's plaintext emails (in case current user doesn't have a WP account)
	566	+ * @param [type] $user_data Array of keys for email, username, first_name, last_name,
	567	+ * authenticated_by, google_attributes, cas_attributes, ldap_attributes.
	568	+ * @return WP_Error if there was an error on user creation / adding user to blog
	569	+ * wp_die() if user does not have access
	570	+ * null if user has access (success)
	571	+ * WP_User if user has access and a new account was created for them
617	572	*/
618	573	private function check_user_access( $user, $user_emails, $user_data = array() ) {
619	574	// Grab plugin settings.
620		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
621		- $auth_settings_access_users_pending = $this->sanitize_user_list(
622		- $this->get_plugin_option( 'access_users_pending', WP_Plugin_Authorizer::SINGLE_CONTEXT )
	575	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' );
	576	+ $auth_settings_access_users_pending = $this->sanitize_user_list(
	577	+ $this->get_plugin_option( 'access_users_pending', SINGLE_ADMIN )
623	578	);
624		- $auth_settings_access_users_approved_single = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT );
625		- $auth_settings_access_users_approved_multi = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT );
626		- $auth_settings_access_users_approved = $this->sanitize_user_list(
	579	+ $auth_settings_access_users_approved_single = $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN );
	580	+ $auth_settings_access_users_approved_multi = $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN );
	581	+ $auth_settings_access_users_approved = $this->sanitize_user_list(
627	582	array_merge(
628	583	$auth_settings_access_users_approved_single,
629	584	$auth_settings_access_users_approved_multi
630	585	)
		@@ -636,9 +591,9 @@
636	591	*
637	592	* @param bool $allow_login Whether to block the currently logging in user.
638	593	* @param array $user_data User data returned from external service.
639	594	*/
640		- $allow_login = apply_filters( 'authorizer_allow_login', true, $user_data );
	595	+ $allow_login = apply_filters( 'authorizer_allow_login', true, $user_data );
641	596	$blocked_by_filter = ! $allow_login; // Use this for better readability.
642	597
643	598	// Check our externally authenticated user against the block list.
644	599	// If any of their email addresses are blocked, set the relevant user
		@@ -648,16 +603,14 @@
648	603
649	604	// Add user to blocked list if it was blocked via the filter.
650	605	if ( $blocked_by_filter && ! $this->is_email_in_list( $user_email, 'blocked' ) ) {
651	606	$auth_settings_access_users_blocked = $this->sanitize_user_list(
652		- $this->get_plugin_option( 'access_users_blocked', WP_Plugin_Authorizer::SINGLE_CONTEXT )
	607	+ $this->get_plugin_option( 'access_users_blocked', SINGLE_ADMIN )
653	608	);
654		- array_push(
655		- $auth_settings_access_users_blocked, array(
656		- 'email' => $this->lowercase( $user_email ),
657		- 'date_added' => date( 'M Y' ),
658		- )
659		- );
	609	+ array_push( $auth_settings_access_users_blocked, array(
	610	+ 'email' => $this->lowercase( $user_email ),
	611	+ 'date_added' => date( 'M Y' ),
	612	+ ));
660	613	update_option( 'auth_settings_access_users_blocked', $auth_settings_access_users_blocked );
661	614	}
662	615
663	616	// If the blocked external user has a WordPress account, mark it as
		@@ -666,11 +619,10 @@
666	619	update_user_meta( $user->ID, 'auth_blocked', 'yes' );
667	620	}
668	621
669	622	// Notify user about blocked status and return without authenticating them.
670		- // phpcs:ignore WordPress.CSRF.NonceVerification.NoNonceVerification
671		- $redirect_to = ! empty( $_REQUEST['redirect_to'] ) ? esc_url_raw( wp_unslash( $_REQUEST['redirect_to'] ) ) : home_url();
672		- $page_title = sprintf(
	623	+ $redirect_to = ! empty( $_REQUEST['redirect_to'] ) ? $_REQUEST['redirect_to'] : home_url();
	624	+ $page_title = sprintf(
673	625	/* TRANSLATORS: %s: Name of blog */
674	626	__( '%s - Access Restricted', 'authorizer' ),
675	627	get_bloginfo( 'name' )
676	628	);
		@@ -681,9 +633,9 @@
681	633	'<a class="button" href="' . wp_logout_url( $redirect_to ) . '">' .
682	634	__( 'Back', 'authorizer' ) .
683	635	'</a></p>';
684	636	update_option( 'auth_settings_advanced_login_error', $error_message );
685		- wp_die( wp_kses( $error_message, $this->allowed_html ), esc_html( $page_title ) );
	637	+ wp_die( $error_message, $page_title );
686	638	}
687	639	}
688	640
689	641	// Get the default role for this user (or their current role, if they
		@@ -693,9 +645,8 @@
693	645	* Filter the role of the user currently logging in. The role will be
694	646	* set to the default (specified in Authorizer options) for new users,
695	647	* or the user's current role for existing users. This filter allows
696	648	* changing user roles based on custom CAS/LDAP attributes.
697		- *
698	649	* @param bool $role Role of the user currently logging in.
699	650	* @param array $user_data User data returned from external service.
700	651	*/
701	652	$approved_role = apply_filters( 'authorizer_custom_role', $default_role, $user_data );
		@@ -720,9 +671,9 @@
720	671	// If this externally authenticated user is an existing administrator
721	672	// (administrator in single site mode, or super admin in network mode),
722	673	// and is not in the blocked list, let them in.
723	674	if ( $user && is_super_admin( $user->ID ) ) {
724		- return $user;
	675	+ return;
725	676	}
726	677
727	678	// If this externally authenticated user isn't in the approved list
728	679	// and login access is set to "All authenticated users," or if they were
		@@ -730,9 +681,9 @@
730	681	// above, then add them to the approved list (they'll get an account
731	682	// created below if they don't have one yet).
732	683	if (
733	684	! $this->is_email_in_list( $user_email, 'approved' ) &&
734		- ( 'external_users' === $auth_settings['access_who_can_login'] || $automatically_approve_login )
	685	+ ( $auth_settings['access_who_can_login'] === 'external_users' || $automatically_approve_login )
735	686	) {
736	687	$is_newly_approved_user = true;
737	688
738	689	// If this user happens to be in the pending list (rare),
		@@ -748,11 +699,11 @@
748	699	}
749	700
750	701	// Add this user to the approved list.
751	702	$approved_user = array(
752		- 'email' => $this->lowercase( $user_email ),
753		- 'role' => $approved_role,
754		- 'date_added' => date( 'Y-m-d H:i:s' ),
	703	+ 'email' => $this->lowercase( $user_email ),
	704	+ 'role' => $approved_role,
	705	+ 'date_added' => date( "Y-m-d H:i:s" ),
755	706	);
756	707	array_push( $auth_settings_access_users_approved, $approved_user );
757	708	array_push( $auth_settings_access_users_approved_single, $approved_user );
758	709	update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved_single );
		@@ -770,9 +721,9 @@
770	721	if ( $default_role !== $approved_role ) {
771	722	$user_info['role'] = $approved_role;
772	723	}
773	724
774		- // If the approved external user does not have a WordPress account, create it.
	725	+ // If the approved external user does not have a WordPress account, create it
775	726	if ( ! $user ) {
776	727	// If there's already a user with this username (e.g.,
777	728	// johndoe/johndoe@gmail.com exists, and we're trying to add
778	729	// johndoe/johndoe@example.com), use the full email address
		@@ -787,47 +738,26 @@
787	738	$username = $user_info['email'];
788	739	}
789	740	$result = wp_insert_user(
790	741	array(
791		- 'user_login' => strtolower( $username ),
792		- 'user_pass' => wp_generate_password(), // random password.
793		- 'first_name' => array_key_exists( 'first_name', $user_data ) ? $user_data['first_name'] : '',
794		- 'last_name' => array_key_exists( 'last_name', $user_data ) ? $user_data['last_name'] : '',
795		- 'user_email' => $this->lowercase( $user_info['email'] ),
	742	+ 'user_login' => strtolower( $username ),
	743	+ 'user_pass' => wp_generate_password(), // random password
	744	+ 'first_name' => array_key_exists( 'first_name', $user_data ) ? $user_data['first_name'] : '',
	745	+ 'last_name' => array_key_exists( 'last_name', $user_data ) ? $user_data['last_name'] : '',
	746	+ 'user_email' => $this->lowercase( $user_info['email'] ),
796	747	'user_registered' => date( 'Y-m-d H:i:s' ),
797		- 'role' => $user_info['role'],
	748	+ 'role' => $user_info['role'],
798	749	)
799	750	);
800	751
801	752	// Fail with message if error.
802		- if ( is_wp_error( $result ) || 0 === $result ) {
	753	+ if ( is_wp_error( $result ) || $result === 0 ) {
803	754	return $result;
804	755	}
805	756
806		- // Authenticate as new user.
	757	+ // Authenticate as new user
807	758	$user = new WP_User( $result );
808	759
809		- /**
810		- * Fires after an external user is authenticated for the first time
811		- * and a new WordPress account is created for them.
812		- *
813		- * @since 2.8.0
814		- *
815		- * @param WP_User $user User object.
816		- * @param array $user_data User data from external service.
817		- *
818		- * Example $user_data:
819		- * array(
820		- * 'email' => 'user@example.edu',
821		- * 'username' => 'user',
822		- * 'first_name' => 'First',
823		- * 'last_name' => 'Last',
824		- * 'authenticated_by' => 'cas',
825		- * 'cas_attributes' => array( ... ),
826		- * );
827		- */
828		- do_action( 'authorizer_user_register', $user, $user_data );
829		-
830	760	// If multisite, iterate through all sites in the network and add the user
831	761	// currently logging in to any of them that have the user on the approved list.
832	762	// Note: this is useful for first-time logins--some users will have access
833	763	// to multiple sites, and this prevents them from having to log into each
		@@ -833,21 +763,18 @@
833	763	// to multiple sites, and this prevents them from having to log into each
834	764	// site individually to get access.
835	765	if ( is_multisite() ) {
836	766	$site_ids_of_user = array_map(
837		- function ( $site_of_user ) {
838		- return intval( $site_of_user->userblog_id );
839		- },
	767	+ function ( $site_of_user ) { return $site_of_user->userblog_id; },
840	768	get_blogs_of_user( $user->ID )
841	769	);
842	770
843		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
844	771	$sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
845	772	foreach ( $sites as $site ) {
846	773	$blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
847	774
848	775	// Skip if user is already added to this site.
849		- if ( in_array( intval( $blog_id ), $site_ids_of_user, true ) ) {
	776	+ if ( in_array( $blog_id, $site_ids_of_user ) ) {
850	777	continue;
851	778	}
852	779
853	780	// Check if user is on the approved list of this site they are not added to.
		@@ -873,9 +800,9 @@
873	800	if ( $meta_key === $user_info['usermeta']['meta_key'] ) {
874	801	// Update user's usermeta value for usermeta key stored in authorizer options.
875	802	if ( strpos( $meta_key, 'acf___' ) === 0 && class_exists( 'acf' ) ) {
876	803	// We have an ACF field value, so use the ACF function to update it.
877		- update_field( str_replace( 'acf___', '', $meta_key ), $user_info['usermeta']['meta_value'], 'user_' . $user->ID );
	804	+ update_field( str_replace('acf___', '', $meta_key ), $user_info['usermeta']['meta_value'], 'user_' . $user->ID );
878	805	} else {
879	806	// We have a normal usermeta value, so just update it via the WordPress function.
880	807	update_user_meta( $user->ID, $meta_key, $user_info['usermeta']['meta_value'] );
881	808	}
		@@ -891,9 +818,9 @@
891	818	switch_to_blog( $blog_id );
892	819	// Update user's usermeta value for usermeta key stored in authorizer options.
893	820	if ( strpos( $meta_key, 'acf___' ) === 0 && class_exists( 'acf' ) ) {
894	821	// We have an ACF field value, so use the ACF function to update it.
895		- update_field( str_replace( 'acf___', '', $meta_key ), $usermeta['meta_value'], 'user_' . $user->ID );
	822	+ update_field( str_replace('acf___', '', $meta_key ), $usermeta['meta_value'], 'user_' . $user->ID );
896	823	} else {
897	824	// We have a normal usermeta value, so just update it via the WordPress function.
898	825	update_user_meta( $user->ID, $meta_key, $usermeta['meta_value'] );
899	826	}
		@@ -904,24 +831,20 @@
904	831	}
905	832	} else {
906	833	// Update first/last names of WordPress user from external
907	834	// service if that option is set.
908		- if ( ( array_key_exists( 'authenticated_by', $user_data ) && 'cas' === $user_data['authenticated_by'] && array_key_exists( 'cas_attr_update_on_login', $auth_settings ) && 1 === intval( $auth_settings['cas_attr_update_on_login'] ) ) || ( array_key_exists( 'authenticated_by', $user_data ) && 'ldap' === $user_data['authenticated_by'] && array_key_exists( 'ldap_attr_update_on_login', $auth_settings ) && 1 === intval( $auth_settings['ldap_attr_update_on_login'] ) ) ) {
909		- if ( array_key_exists( 'first_name', $user_data ) && 0 < strlen( $user_data['first_name'] ) ) {
910		- wp_update_user(
911		- array(
912		- 'ID' => $user->ID,
913		- 'first_name' => $user_data['first_name'],
914		- )
915		- );
	835	+ if ( ( array_key_exists( 'authenticated_by', $user_data ) && $user_data['authenticated_by'] === 'cas' && array_key_exists( 'cas_attr_update_on_login', $auth_settings ) && $auth_settings['cas_attr_update_on_login'] == 1 ) || ( array_key_exists( 'authenticated_by', $user_data ) && $user_data['authenticated_by'] === 'ldap' && array_key_exists( 'ldap_attr_update_on_login', $auth_settings ) && $auth_settings['ldap_attr_update_on_login'] == 1 ) ) {
	836	+ if ( array_key_exists( 'first_name', $user_data ) && strlen( $user_data['first_name'] ) > 0 ) {
	837	+ wp_update_user( array(
	838	+ 'ID' => $user->ID,
	839	+ 'first_name' => $user_data['first_name'],
	840	+ ));
916	841	}
917	842	if ( array_key_exists( 'last_name', $user_data ) && strlen( $user_data['last_name'] ) > 0 ) {
918		- wp_update_user(
919		- array(
920		- 'ID' => $user->ID,
921		- 'last_name' => $user_data['last_name'],
922		- )
923		- );
	843	+ wp_update_user( array(
	844	+ 'ID' => $user->ID,
	845	+ 'last_name' => $user_data['last_name'],
	846	+ ));
924	847	}
925	848	}
926	849
927	850	// Update this user's role if it was modified in the
		@@ -932,9 +855,9 @@
932	855
933	856	// Update user's role in this site's approved list and save.
934	857	foreach ( $auth_settings_access_users_approved_single as $key => $existing_user ) {
935	858	if ( 0 === strcasecmp( $user->user_email, $existing_user['email'] ) ) {
936		- $auth_settings_access_users_approved_single[ $key ]['role'] = $approved_role;
	859	+ $auth_settings_access_users_approved_single[$key]['role'] = $approved_role;
937	860	break;
938	861	}
939	862	}
940	863	update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved_single );
		@@ -951,34 +874,31 @@
951	874	}
952	875	}
953	876
954	877	// Ensure user has the same role as their entry in the approved list.
955		- if ( $user_info && ! in_array( $user_info['role'], $user->roles, true ) ) {
	878	+ if ( $user_info && ! in_array( $user_info['role'], $user->roles ) ) {
956	879	$user->set_role( $user_info['role'] );
957	880	}
958	881
959	882	return $user;
960	883
	884	+ // Note: only do this for the last email address we are checking (we need
	885	+ // to iterate through them all to make sure one of them isn't approved).
961	886	} elseif ( 0 === strcasecmp( $user_email, $last_email ) ) {
962		- /**
963		- * Note: only do this for the last email address we are checking (we need
964		- * to iterate through them all to make sure one of them isn't approved).
965		- */
966		-
967	887	// User isn't an admin, is not blocked, and is not approved.
968	888	// Add them to the pending list and notify them and their instructor.
969	889	if ( strlen( $user_email ) > 0 && ! $this->is_email_in_list( $user_email, 'pending' ) ) {
970		- $pending_user = array();
971		- $pending_user['email'] = $this->lowercase( $user_email );
972		- $pending_user['role'] = $approved_role;
	890	+ $pending_user = array();
	891	+ $pending_user['email'] = $this->lowercase( $user_email );
	892	+ $pending_user['role'] = $approved_role;
973	893	$pending_user['date_added'] = '';
974	894	array_push( $auth_settings_access_users_pending, $pending_user );
975	895	update_option( 'auth_settings_access_users_pending', $auth_settings_access_users_pending );
976	896
977	897	// Create strings used in the email notification.
978		- $site_name = get_bloginfo( 'name' );
979		- $site_url = get_bloginfo( 'url' );
980		- $authorizer_options_url = 'settings' === $auth_settings['advanced_admin_menu'] ? admin_url( 'options-general.php?page=authorizer' ) : admin_url( '?page=authorizer' );
	898	+ $site_name = get_bloginfo( 'name' );
	899	+ $site_url = get_bloginfo( 'url' );
	900	+ $authorizer_options_url = $auth_settings['advanced_admin_menu'] === 'settings' ? admin_url( 'options-general.php?page=authorizer' ) : admin_url( '?page=authorizer' );
981	901
982	902	// Notify users with the role specified in "Which role should
983	903	// receive email notifications about pending users?".
984	904	if ( strlen( $auth_settings['access_role_receive_pending_emails'] ) > 0 ) {
		@@ -1003,11 +923,10 @@
1003	923	}
1004	924	}
1005	925
1006	926	// Notify user about pending status and return without authenticating them.
1007		- // phpcs:ignore WordPress.CSRF.NonceVerification.NoNonceVerification
1008		- $redirect_to = ! empty( $_REQUEST['redirect_to'] ) ? esc_url_raw( wp_unslash( $_REQUEST['redirect_to'] ) ) : home_url();
1009		- $page_title = get_bloginfo( 'name' ) . ' - Access Pending';
	927	+ $redirect_to = ! empty( $_REQUEST['redirect_to'] ) ? $_REQUEST['redirect_to'] : home_url();
	928	+ $page_title = get_bloginfo( 'name' ) . ' - Access Pending';
1010	929	$error_message =
1011	930	apply_filters( 'the_content', $auth_settings['access_pending_redirect_to_message'] ) .
1012	931	'<hr />' .
1013	932	'<p style="text-align: center;">' .
		@@ -1014,9 +933,9 @@
1014	933	'<a class="button" href="' . wp_logout_url( $redirect_to ) . '">' .
1015	934	__( 'Back', 'authorizer' ) .
1016	935	'</a></p>';
1017	936	update_option( 'auth_settings_advanced_login_error', $error_message );
1018		- wp_die( wp_kses( $error_message, $this->allowed_html ), esc_html( $page_title ) );
	937	+ wp_die( $error_message, $page_title );
1019	938	}
1020	939	}
1021	940
1022	941	// Sanity check: if we made it here without returning, something has gone wrong.
		@@ -1039,34 +958,24 @@
1039	958	* custom_authenticate_google() runs to verify the token; once verified
1040	959	* custom_authenticate proceeds as normal with the google email address
1041	960	* as a successfully authenticated external user.
1042	961	*
1043		- * Action: wp_ajax_process_google_login
1044		- * Action: wp_ajax_nopriv_process_google_login
1045		- *
1046		- * @return void, but die with the value to return to the success() function in AJAX call signInCallback().
	962	+ * @return void, but die with the value to return to the success() function in AJAX call signInCallback()
1047	963	*/
1048		- public function ajax_process_google_login() {
	964	+ function ajax_process_google_login() {
	965	+ $nonce = array_key_exists( 'nonce', $_POST ) ? $_POST['nonce'] : '';
	966	+ $code = array_key_exists( 'code', $_POST ) ? $_POST['code'] : null;
	967	+
1049	968	// Nonce check.
1050		- if (
1051		- ! isset( $_POST['nonce'] ) ||
1052		- ! wp_verify_nonce( sanitize_key( $_POST['nonce'] ), 'google_csrf_nonce' )
1053		- ) {
1054		- die( '' );
	969	+ if ( ! wp_verify_nonce( $nonce, 'google_csrf_nonce' ) ) {
	970	+ return '';
1055	971	}
1056	972
1057		- // Google authentication token.
1058		- // phpcs:ignore WordPress.VIP.ValidatedSanitizedInput.InputNotSanitized
1059		- $code = isset( $_POST['code'] ) ? wp_unslash( $_POST['code'] ) : null;
1060		-
1061	973	// Grab plugin settings.
1062		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
	974	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' );
1063	975
1064		- /**
1065		- * Add Google API PHP Client.
1066		- *
1067		- * @see https://github.com/google/google-api-php-client branch:v1-master
1068		- */
	976	+ // Add Google API PHP Client.
	977	+ // @see https://github.com/google/google-api-php-client branch:v1-master
1069	978	require_once dirname( __FILE__ ) . '/vendor/google-api-php-client/src/Google/autoload.php';
1070	979
1071	980	// Build the Google Client.
1072	981	$client = new Google_Client();
		@@ -1074,26 +983,19 @@
1074	983	$client->setClientId( $auth_settings['google_clientid'] );
1075	984	$client->setClientSecret( $auth_settings['google_clientsecret'] );
1076	985	$client->setRedirectUri( 'postmessage' );
1077	986
1078		- /**
1079		- * If the hosted domain parameter is set, restrict logins to that domain.
1080		- *
1081		- * Note: Will have to upgrade to google-api-php-client v2 or higher for
1082		- * this to function server-side; it's not complete in v1, so this check
1083		- * is performed manually below.
1084		- *
1085		- * if (
1086		- * array_key_exists( 'google_hosteddomain', $auth_settings ) &&
1087		- * strlen( $auth_settings['google_hosteddomain'] ) > 0
1088		- * ) {
1089		- * $google_hosteddomains = explode( "\n", str_replace( "\r", '', $auth_settings['google_hosteddomain'] ) );
1090		- * $google_hosteddomain = trim( $google_hosteddomains[0] );
1091		- * $client->setHostedDomain( $google_hosteddomain );
1092		- * }
1093		- */
	987	+ // If the hosted domain parameter is set, restrict logins to that domain.
	988	+ // Note: Will have to upgrade to google-api-php-client v2 or higher for
	989	+ // this to function server-side; it's not complete in v1, so this check
	990	+ // is performed manually below.
	991	+ // if ( array_key_exists( 'google_hosteddomain', $auth_settings ) && strlen( $auth_settings['google_hosteddomain'] ) > 0 ) {
	992	+ // $google_hosteddomains = explode( "\n", str_replace( "\r", '', $auth_settings['google_hosteddomain'] ) );
	993	+ // $google_hosteddomain = trim( $google_hosteddomains[0] );
	994	+ // $client->setHostedDomain( $google_hosteddomain );
	995	+ // }
1094	996
1095		- // Get one time use token (if it doesn't exist, we'll create one below).
	997	+ // Get one time use token (if it doesn't exist, we'll create one below)
1096	998	session_start();
1097	999	$token = array_key_exists( 'token', $_SESSION ) ? json_decode( $_SESSION['token'] ) : null;
1098	1000
1099	1001	if ( empty( $token ) ) {
		@@ -1101,18 +1003,18 @@
1101	1003	$client->authenticate( $code );
1102	1004	$token = json_decode( $client->getAccessToken() );
1103	1005
1104	1006	// Store the token in the session for later use.
1105		- $_SESSION['token'] = wp_json_encode( $token );
	1007	+ $_SESSION['token'] = json_encode( $token );
1106	1008
1107		- $response = 'Successfully authenticated.';
	1009	+ $response = "Successfully authenticated.";
1108	1010	} else {
1109		- $client->setAccessToken( wp_json_encode( $token ) );
	1011	+ $client->setAccessToken( json_encode( $token ) );
1110	1012
1111	1013	$response = 'Already authenticated.';
1112	1014	}
1113	1015
1114		- die( esc_html( $response ) );
	1016	+ die( $response );
1115	1017	}
1116	1018
1117	1019
1118	1020	/**
		@@ -1117,22 +1019,22 @@
1117	1019
1118	1020	/**
1119	1021	* Validate this user's credentials against Google.
1120	1022	*
1121		- * @param array $auth_settings Plugin settings.
1122		- * @return array|WP_Error Array containing email, authenticated_by, first_name,
1123		- * last_name, and username strings for the successfully
1124		- * authenticated user, or WP_Error() object on failure,
1125		- * or null if not attempting a google login.
	1023	+ * @param array $auth_settings Plugin settings
	1024	+ * @return [mixed] Array containing email, authenticated_by,
	1025	+ * first_name, last_name, and username
	1026	+ * strings for the successfully authenticated
	1027	+ * user, or WP_Error() object on failure,
	1028	+ * or null if not attempting a google login.
1126	1029	*/
1127	1030	private function custom_authenticate_google( $auth_settings ) {
1128	1031	// Move on if Google auth hasn't been requested here.
1129		- // phpcs:ignore WordPress.CSRF.NonceVerification.NoNonceVerification
1130		- if ( empty( $_GET['external'] ) || 'google' !== $_GET['external'] ) {
	1032	+ if ( empty( $_GET['external'] ) || $_GET['external'] !== 'google' ) {
1131	1033	return null;
1132	1034	}
1133	1035
1134		- // Get one time use token.
	1036	+ // Get one time use token
1135	1037	session_start();
1136	1038	$token = array_key_exists( 'token', $_SESSION ) ? json_decode( $_SESSION['token'] ) : null;
1137	1039
1138	1040	// No token, so this is not a succesful Google login.
		@@ -1139,13 +1041,10 @@
1139	1041	if ( is_null( $token ) ) {
1140	1042	return null;
1141	1043	}
1142	1044
1143		- /**
1144		- * Add Google API PHP Client.
1145		- *
1146		- * @see https://github.com/google/google-api-php-client branch:v1-master
1147		- */
	1045	+ // Add Google API PHP Client.
	1046	+ // @see https://github.com/google/google-api-php-client branch:v1-master
1148	1047	require_once dirname( __FILE__ ) . '/vendor/google-api-php-client/src/Google/autoload.php';
1149	1048
1150	1049	// Build the Google Client.
1151	1050	$client = new Google_Client();
		@@ -1153,24 +1052,19 @@
1153	1052	$client->setClientId( $auth_settings['google_clientid'] );
1154	1053	$client->setClientSecret( $auth_settings['google_clientsecret'] );
1155	1054	$client->setRedirectUri( 'postmessage' );
1156	1055
1157		- /**
1158		- * If the hosted domain parameter is set, restrict logins to that domain.
1159		- * Note: Will have to upgrade to google-api-php-client v2 or higher for
1160		- * this to function server-side; it's not complete in v1, so this check
1161		- * is performed manually later.
1162		- * if (
1163		- * array_key_exists( 'google_hosteddomain', $auth_settings ) &&
1164		- * strlen( $auth_settings['google_hosteddomain'] ) > 0
1165		- * ) {
1166		- * $google_hosteddomains = explode( "\n", str_replace( "\r", '', $auth_settings['google_hosteddomain'] ) );
1167		- * $google_hosteddomain = trim( $google_hosteddomains[0] );
1168		- * $client->setHostedDomain( $google_hosteddomain );
1169		- * }
1170		- */
	1056	+ // If the hosted domain parameter is set, restrict logins to that domain.
	1057	+ // Note: Will have to upgrade to google-api-php-client v2 or higher for
	1058	+ // this to function server-side; it's not complete in v1, so this check
	1059	+ // is performed manually below.
	1060	+ // if ( array_key_exists( 'google_hosteddomain', $auth_settings ) && strlen( $auth_settings['google_hosteddomain'] ) > 0 ) {
	1061	+ // $google_hosteddomains = explode( "\n", str_replace( "\r", '', $auth_settings['google_hosteddomain'] ) );
	1062	+ // $google_hosteddomain = trim( $google_hosteddomains[0] );
	1063	+ // $client->setHostedDomain( $google_hosteddomain );
	1064	+ // }
1171	1065
1172		- // Verify this is a successful Google authentication.
	1066	+ // Verify this is a successful Google authentication
1173	1067	try {
1174	1068	$ticket = $client->verifyIdToken( $token->id_token, $auth_settings['google_clientid'] );
1175	1069	} catch ( Google_Auth_Exception $e ) {
1176	1070	// Invalid ticket, so this in not a successful Google login.
		@@ -1181,29 +1075,25 @@
1181	1075	if ( ! $ticket ) {
1182	1076	return new WP_Error( 'invalid_google_login', __( 'Invalid Google credentials provided.', 'authorizer' ) );
1183	1077	}
1184	1078
1185		- // Get email address.
1186		- $attributes = $ticket->getAttributes();
1187		- $email = $this->lowercase( $attributes['payload']['email'] );
	1079	+ // Get email address
	1080	+ $attributes = $ticket->getAttributes();
	1081	+ $email = $this->lowercase( $attributes['payload']['email'] );
1188	1082	$email_domain = substr( strrchr( $email, '@' ), 1 );
1189		- $username = current( explode( '@', $email ) );
	1083	+ $username = current( explode( '@', $email ) );
1190	1084
1191		- /**
1192		- * Fail if hd param is set and the logging in user's email address doesn't
1193		- * match the allowed hosted domain.
1194		- *
1195		- * See: https://developers.google.com/identity/protocols/OpenIDConnect#hd-param
1196		- * See: https://github.com/google/google-api-php-client/blob/v1-master/src/Google/Client.php#L407-L416
1197		- *
1198		- * Note: Will have to upgrade to google-api-php-client v2 or higher for
1199		- * this to function server-side; it's not complete in v1, so this check
1200		- * is only performed here.
1201		- */
	1085	+ // Fail if hd param is set and the logging in user's email address doesn't
	1086	+ // match the allowed hosted domain.
	1087	+ // See: https://developers.google.com/identity/protocols/OpenIDConnect#hd-param
	1088	+ // See: https://github.com/google/google-api-php-client/blob/v1-master/src/Google/Client.php#L407-L416
	1089	+ // Note: Will have to upgrade to google-api-php-client v2 or higher for
	1090	+ // this to function server-side; it's not complete in v1, so this check
	1091	+ // is only performed here.
1202	1092	if ( array_key_exists( 'google_hosteddomain', $auth_settings ) && strlen( $auth_settings['google_hosteddomain'] ) > 0 ) {
1203	1093	// Allow multiple whitelisted domains.
1204	1094	$google_hosteddomains = explode( "\n", str_replace( "\r", '', $auth_settings['google_hosteddomain'] ) );
1205		- if ( ! in_array( $email_domain, $google_hosteddomains, true ) ) {
	1095	+ if ( ! in_array( $email_domain, $google_hosteddomains ) ) {
1206	1096	$this->custom_logout();
1207	1097	return new WP_Error( 'invalid_google_login', __( 'Google credentials do not match the allowed hosted domain', 'authorizer' ) );
1208	1098	}
1209	1099	}
		@@ -1208,13 +1098,13 @@
1208	1098	}
1209	1099	}
1210	1100
1211	1101	return array(
1212		- 'email' => $email,
1213		- 'username' => $username,
1214		- 'first_name' => '',
1215		- 'last_name' => '',
1216		- 'authenticated_by' => 'google',
	1102	+ 'email' => $email,
	1103	+ 'username' => $username,
	1104	+ 'first_name' => '',
	1105	+ 'last_name' => '',
	1106	+ 'authenticated_by' => 'google',
1217	1107	'google_attributes' => $attributes,
1218	1108	);
1219	1109	}
1220	1110
		@@ -1221,47 +1111,40 @@
1221	1111
1222	1112	/**
1223	1113	* Validate this user's credentials against CAS.
1224	1114	*
1225		- * @param array $auth_settings Plugin settings.
1226		- * @return array|WP_Error Array containing 'email' and 'authenticated_by' strings
1227		- * for the successfully authenticated user, or WP_Error()
1228		- * object on failure, or null if not attempting a CAS login.
	1115	+ * @param array $auth_settings Plugin settings
	1116	+ * @return [mixed] Array containing 'email' and 'authenticated_by'
	1117	+ * strings for the successfully authenticated
	1118	+ * user, or WP_Error() object on failure,
	1119	+ * or null if not attempting a CAS login.
1229	1120	*/
1230	1121	private function custom_authenticate_cas( $auth_settings ) {
1231	1122	// Move on if CAS hasn't been requested here.
1232		- // phpcs:ignore WordPress.CSRF.NonceVerification.NoNonceVerification
1233		- if ( empty( $_GET['external'] ) || 'cas' !== $_GET['external'] ) {
	1123	+ if ( empty( $_GET['external'] ) || $_GET['external'] !== 'cas' ) {
1234	1124	return null;
1235	1125	}
1236	1126
1237		- /**
1238		- * Get the CAS server version (default to SAML_VERSION_1_1).
1239		- *
1240		- * @see: https://developer.jasig.org/cas-clients/php/1.3.4/docs/api/group__public.html
1241		- */
	1127	+ // Get the CAS server version (default to SAML_VERSION_1_1).
	1128	+ // See: https://developer.jasig.org/cas-clients/php/1.3.4/docs/api/group__public.html
1242	1129	$cas_version = SAML_VERSION_1_1;
1243		- if ( 'CAS_VERSION_3_0' === $auth_settings['cas_version'] ) {
	1130	+ if ( $auth_settings['cas_version'] === 'CAS_VERSION_3_0' ) {
1244	1131	$cas_version = CAS_VERSION_3_0;
1245		- } elseif ( 'CAS_VERSION_2_0' === $auth_settings['cas_version'] ) {
	1132	+ } elseif ( $auth_settings['cas_version'] === 'CAS_VERSION_2_0' ) {
1246	1133	$cas_version = CAS_VERSION_2_0;
1247		- } elseif ( 'CAS_VERSION_1_0' === $auth_settings['cas_version'] ) {
	1134	+ } elseif ( $auth_settings['cas_version'] === 'CAS_VERSION_1_0' ) {
1248	1135	$cas_version = CAS_VERSION_1_0;
1249	1136	}
1250	1137
1251		- // Set the CAS client configuration.
	1138	+ // Set the CAS client configuration
1252	1139	phpCAS::client( $cas_version, $auth_settings['cas_host'], intval( $auth_settings['cas_port'] ), $auth_settings['cas_path'] );
1253	1140
1254		- // Allow redirects at the CAS server endpoint (e.g., allow connections
1255		- // at an old CAS URL that redirects to a newer CAS URL).
1256		- phpCAS::setExtraCurlOption( CURLOPT_FOLLOWLOCATION, true );
1257		-
1258	1141	// Update server certificate bundle if it doesn't exist or is older
1259	1142	// than 6 months, then use it to ensure CAS server is legitimate.
1260	1143	// Note: only try to update if the system has the php_openssl extension.
1261		- $cacert_url = 'https://curl.haxx.se/ca/cacert.pem';
1262		- $cacert_path = plugin_dir_path( __FILE__ ) . 'vendor/cacert.pem';
1263		- $time_180_days = 180 * 24 * 60 * 60; // days * hours * minutes * seconds.
	1144	+ $cacert_url = 'https://curl.haxx.se/ca/cacert.pem';
	1145	+ $cacert_path = plugin_dir_path( __FILE__ ) . 'vendor/cacert.pem';
	1146	+ $time_180_days = 180 * 24 * 60 * 60; // days * hours * minutes * seconds
1264	1147	$time_180_days_ago = time() - $time_180_days;
1265	1148	if (
1266	1149	extension_loaded( 'openssl' ) &&
1267	1150	( ! file_exists( $cacert_path ) || filemtime( $cacert_path ) < $time_180_days_ago )
		@@ -1277,34 +1160,28 @@
1277	1160	}
1278	1161	$cacert_contents = $response['body'];
1279	1162
1280	1163	// Write out the updated certs to the plugin directory.
1281		- // Note: Don't use WP_Filesystem because we are not in an admin context
1282		- // and don't want to potentially prompt the end user for credentials.
1283		- // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_read_file_put_contents
1284	1164	file_put_contents( $cacert_path, $cacert_contents );
1285	1165	}
1286	1166	phpCAS::setCasServerCACert( $cacert_path );
1287	1167
1288	1168	// Set the CAS service URL (including the redirect URL for WordPress when it comes back from CAS).
1289		- $cas_service_url = site_url( '/wp-login.php?external=cas' );
1290		- $login_querystring = array();
1291		- if ( isset( $_SERVER['QUERY_STRING'] ) ) {
1292		- parse_str( $_SERVER['QUERY_STRING'], $login_querystring ); // phpcs:ignore WordPress.VIP.ValidatedSanitizedInput
1293		- }
	1169	+ $cas_service_url = site_url( '/wp-login.php?external=cas' );
	1170	+ $login_querystring = array(); parse_str( $_SERVER['QUERY_STRING'], $login_querystring );
1294	1171	if ( isset( $login_querystring['redirect_to'] ) ) {
1295		- $cas_service_url .= '&redirect_to=' . rawurlencode( $login_querystring['redirect_to'] );
	1172	+ $cas_service_url .= '&redirect_to=' . urlencode( $login_querystring['redirect_to'] );
1296	1173	}
1297	1174	phpCAS::setFixedServiceURL( $cas_service_url );
1298	1175
1299		- // Authenticate against CAS.
	1176	+ // Authenticate against CAS
1300	1177	try {
1301	1178	phpCAS::forceAuthentication();
1302	1179	} catch ( CAS_AuthenticationException $e ) {
1303	1180	// CAS server threw an error in isAuthenticated(), potentially because
1304	1181	// the cached ticket is outdated. Try renewing the authentication.
1305		- error_log( __( 'CAS server returned an Authentication Exception. Details:', 'authorizer' ) ); // phpcs:ignore
1306		- error_log( print_r( $e, true ) ); // phpcs:ignore
	1182	+ error_log( __( 'CAS server returned an Authentication Exception. Details:', 'authorizer' ) );
	1183	+ error_log( print_r( $e, true ) );
1307	1184
1308	1185	// CAS server is throwing errors on this login, so try logging the
1309	1186	// user out of CAS and redirecting them to the login page.
1310	1187	phpCAS::logoutWithRedirectService( wp_login_url() );
		@@ -1319,9 +1196,9 @@
1319	1196	if ( ! filter_var( $externally_authenticated_email, FILTER_VALIDATE_EMAIL ) ) {
1320	1197	// If we can't get the user's email address from a CAS attribute,
1321	1198	// try to guess the domain from the CAS server hostname. This will only
1322	1199	// be used if we can't discover the email address from CAS attributes.
1323		- $domain_guess = preg_match( '/[^.]*\.[^.]*$/', $auth_settings['cas_host'], $matches ) === 1 ? $matches[0] : '';
	1200	+ $domain_guess = preg_match( '/[^.]*\.[^.]*$/', $auth_settings['cas_host'], $matches ) === 1 ? $matches[0] : '';
1324	1201	$externally_authenticated_email = $this->lowercase( $username ) . '@' . $domain_guess;
1325	1202	}
1326	1203
1327	1204	// Retrieve the user attributes (e.g., email address, first name, last name) from the CAS server.
		@@ -1339,39 +1216,39 @@
1339	1216	// If a CAS attribute has been specified as containing the email address, use that instead.
1340	1217	// Email attribute can be a string or an array of strings.
1341	1218	array_key_exists( $auth_settings['cas_attr_email'], $cas_attributes ) && (
1342	1219	(
1343		- is_array( $cas_attributes[ $auth_settings['cas_attr_email'] ] ) &&
1344		- count( $cas_attributes[ $auth_settings['cas_attr_email'] ] ) > 0
	1220	+ is_array( $cas_attributes[$auth_settings['cas_attr_email']] ) &&
	1221	+ count( $cas_attributes[$auth_settings['cas_attr_email']] ) > 0
1345	1222	) || (
1346		- is_string( $cas_attributes[ $auth_settings['cas_attr_email'] ] ) &&
1347		- strlen( $cas_attributes[ $auth_settings['cas_attr_email'] ] ) > 0
	1223	+ is_string( $cas_attributes[$auth_settings['cas_attr_email']] ) &&
	1224	+ strlen( $cas_attributes[$auth_settings['cas_attr_email']] ) > 0
1348	1225	)
1349	1226	)
1350	1227	) {
1351	1228	// Each of the emails in the array needs to be set to lowercase.
1352		- if ( is_array( $cas_attributes[ $auth_settings['cas_attr_email'] ] ) ) {
	1229	+ if ( is_array( $cas_attributes[$auth_settings['cas_attr_email']] ) ) {
1353	1230	$externally_authenticated_email = array();
1354		- foreach ( $cas_attributes[ $auth_settings['cas_attr_email'] ] as $external_email ) {
	1231	+ foreach ( $cas_attributes[$auth_settings['cas_attr_email']] as $external_email ) {
1355	1232	$externally_authenticated_email[] = $this->lowercase( $external_email );
1356	1233	}
1357	1234	} else {
1358		- $externally_authenticated_email = $this->lowercase( $cas_attributes[ $auth_settings['cas_attr_email'] ] );
	1235	+ $externally_authenticated_email = $this->lowercase( $cas_attributes[$auth_settings['cas_attr_email']] );
1359	1236	}
1360	1237	}
1361	1238	}
1362	1239
1363	1240	// Get user first name and last name.
1364		- $first_name = array_key_exists( 'cas_attr_first_name', $auth_settings ) && strlen( $auth_settings['cas_attr_first_name'] ) > 0 && array_key_exists( $auth_settings['cas_attr_first_name'], $cas_attributes ) && strlen( $cas_attributes[ $auth_settings['cas_attr_first_name'] ] ) > 0 ? $cas_attributes[ $auth_settings['cas_attr_first_name'] ] : '';
1365		- $last_name = array_key_exists( 'cas_attr_last_name', $auth_settings ) && strlen( $auth_settings['cas_attr_last_name'] ) > 0 && array_key_exists( $auth_settings['cas_attr_last_name'], $cas_attributes ) && strlen( $cas_attributes[ $auth_settings['cas_attr_last_name'] ] ) > 0 ? $cas_attributes[ $auth_settings['cas_attr_last_name'] ] : '';
	1241	+ $first_name = array_key_exists( 'cas_attr_first_name', $auth_settings ) && strlen( $auth_settings['cas_attr_first_name'] ) > 0 && array_key_exists( $auth_settings['cas_attr_first_name'], $cas_attributes ) && strlen( $cas_attributes[$auth_settings['cas_attr_first_name']] ) > 0 ? $cas_attributes[$auth_settings['cas_attr_first_name']] : '';
	1242	+ $last_name = array_key_exists( 'cas_attr_last_name', $auth_settings ) && strlen( $auth_settings['cas_attr_last_name'] ) > 0 && array_key_exists( $auth_settings['cas_attr_last_name'], $cas_attributes ) && strlen( $cas_attributes[$auth_settings['cas_attr_last_name']] ) > 0 ? $cas_attributes[$auth_settings['cas_attr_last_name']] : '';
1366	1243
1367	1244	return array(
1368		- 'email' => $externally_authenticated_email,
1369		- 'username' => $username,
1370		- 'first_name' => $first_name,
1371		- 'last_name' => $last_name,
	1245	+ 'email' => $externally_authenticated_email,
	1246	+ 'username' => $username,
	1247	+ 'first_name' => $first_name,
	1248	+ 'last_name' => $last_name,
1372	1249	'authenticated_by' => 'cas',
1373		- 'cas_attributes' => $cas_attributes,
	1250	+ 'cas_attributes' => $cas_attributes,
1374	1251	);
1375	1252	}
1376	1253
1377	1254
		@@ -1377,32 +1254,24 @@
1377	1254
1378	1255	/**
1379	1256	* Validate this user's credentials against LDAP.
1380	1257	*
1381		- * @param array $auth_settings Plugin settings.
1382		- * @param string $username Attempted username from authenticate action.
1383		- * @param string $password Attempted password from authenticate action.
1384		- * @return array|WP_Error Array containing 'email' and 'authenticated_by' strings
1385		- * for the successfully authenticated user, or WP_Error()
1386		- * object on failure, or null if skipping LDAP auth and
1387		- * falling back to WP auth.
	1258	+ * @param array $auth_settings Plugin settings
	1259	+ * @param string $username Attempted username from authenticate action
	1260	+ * @param string $password Attempted password from authenticate action
	1261	+ * @return [mixed] Array containing 'email' and 'authenticated_by'
	1262	+ * strings for the successfully authenticated
	1263	+ * user, or WP_Error() object on failure,
	1264	+ * or null if skipping LDAP auth and falling back to WP auth.
1388	1265	*/
1389	1266	private function custom_authenticate_ldap( $auth_settings, $username, $password ) {
1390		- // Get LDAP search base(s).
1391		- $search_bases = explode( "\n", str_replace( "\r", '', trim( $auth_settings['ldap_search_base'] ) ) );
1392		-
1393		- // Fail silently (fall back to WordPress authentication) if no search base specified.
1394		- if ( count( $search_bases ) < 1 ) {
1395		- return null;
1396		- }
1397		-
1398		- // Get the FQDN from the first LDAP search base domain components (dc). For
1399		- // example, ou=people,dc=example,dc=edu,dc=uk would yield user@example.edu.uk.
1400		- $search_base_components = explode( ',', trim( $search_bases[0] ) );
1401		- $domain = array();
	1267	+ // Get the FQDN from the LDAP search base domain components (dc). For
	1268	+ // example, ou=people,dc=example,dc=edu,dc=uk would yield user@example.edu.uk
	1269	+ $search_base_components = explode( ',', trim( $auth_settings['ldap_search_base'] ) );
	1270	+ $domain = array();
1402	1271	foreach ( $search_base_components as $search_base_component ) {
1403	1272	$component = explode( '=', $search_base_component );
1404		- if ( 2 === count( $component ) && 'dc' === $component[0] ) {
	1273	+ if ( count( $component ) === 2 && $component[0] === 'dc' ) {
1405	1274	$domain[] = $component[1];
1406	1275	}
1407	1276	}
1408	1277	$domain = implode( '.', $domain );
		@@ -1413,9 +1282,9 @@
1413	1282	if ( empty( $domain ) ) {
1414	1283	$domain = preg_match( '/[^.]*\.[^.]*$/', $auth_settings['ldap_host'], $matches ) === 1 ? $matches[0] : '';
1415	1284	}
1416	1285
1417		- // remove @domain if it exists in the username (i.e., if user entered their email).
	1286	+ // remove @domain if it exists in the username (i.e., if user entered their email)
1418	1287	$username = str_replace( '@' . $domain, '', $username );
1419	1288
1420	1289	// Fail silently (fall back to WordPress authentication) if both username
1421	1290	// and password are empty (this will be the case when visiting wp-login.php
		@@ -1438,13 +1307,13 @@
1438	1307	return null;
1439	1308	}
1440	1309
1441	1310	// Authenticate against LDAP using options provided in plugin settings.
1442		- $result = false;
	1311	+ $result = false;
1443	1312	$ldap_user_dn = '';
1444		- $first_name = '';
1445		- $last_name = '';
1446		- $email = '';
	1313	+ $first_name = '';
	1314	+ $last_name = '';
	1315	+ $email = '';
1447	1316
1448	1317	// Construct LDAP connection parameters. ldap_connect() takes either a
1449	1318	// hostname or a full LDAP URI as its first parameter (works with OpenLDAP
1450	1319	// 2.x.x or later). If it's an LDAP URI, the second parameter, $port, is
		@@ -1449,13 +1318,13 @@
1449	1318	// hostname or a full LDAP URI as its first parameter (works with OpenLDAP
1450	1319	// 2.x.x or later). If it's an LDAP URI, the second parameter, $port, is
1451	1320	// ignored, and port must be specified in the full URI. An LDAP URI is of
1452	1321	// the form ldap://hostname:port or ldaps://hostname:port.
1453		- $ldap_host = $auth_settings['ldap_host'];
1454		- $ldap_port = intval( $auth_settings['ldap_port'] );
1455		- $parsed_host = wp_parse_url( $ldap_host );
	1322	+ $ldap_host = $auth_settings['ldap_host'];
	1323	+ $ldap_port = intval( $auth_settings['ldap_port'] );
	1324	+ $parsed_host = parse_url( $ldap_host );
1456	1325	// Fail (fall back to WordPress auth) if invalid host is specified.
1457		- if ( false === $parsed_host ) {
	1326	+ if ( $parsed_host === false ) {
1458	1327	return null;
1459	1328	}
1460	1329	// If a scheme is in the LDAP host, use full LDAP URI instead of just hostname.
1461	1330	if ( array_key_exists( 'scheme', $parsed_host ) ) {
		@@ -1468,24 +1337,24 @@
1468	1337
1469	1338	// Establish LDAP connection.
1470	1339	$ldap = ldap_connect( $ldap_host, $ldap_port );
1471	1340	ldap_set_option( $ldap, LDAP_OPT_PROTOCOL_VERSION, 3 );
1472		- if ( 1 === intval( $auth_settings['ldap_tls'] ) ) {
1473		- if ( ! ldap_start_tls( $ldap ) ) {
	1341	+ if ( $auth_settings['ldap_tls'] == 1 ) {
	1342	+ if( ! ldap_start_tls( $ldap ) ) {
1474	1343	return null;
1475	1344	}
1476	1345	}
1477	1346
1478	1347	// Set bind credentials; attempt an anonymous bind if not provided.
1479		- $bind_rdn = null;
1480		- $bind_password = null;
	1348	+ $bind_rdn = NULL;
	1349	+ $bind_password = NULL;
1481	1350	if ( strlen( $auth_settings['ldap_user'] ) > 0 ) {
1482		- $bind_rdn = $auth_settings['ldap_user'];
	1351	+ $bind_rdn = $auth_settings['ldap_user'];
1483	1352	$bind_password = $this->decrypt( $auth_settings['ldap_password'] );
1484	1353	}
1485	1354
1486	1355	// Attempt LDAP bind.
1487		- $result = @ldap_bind( $ldap, $bind_rdn, stripslashes( $bind_password ) ); // phpcs:ignore
	1356	+ $result = @ldap_bind( $ldap, $bind_rdn, stripslashes( $bind_password ) );
1488	1357	if ( ! $result ) {
1489	1358	// Can't connect to LDAP, so fall back to WordPress authentication.
1490	1359	return null;
1491	1360	}
		@@ -1501,38 +1370,16 @@
1501	1370	}
1502	1371	if ( array_key_exists( 'ldap_attr_email', $auth_settings ) && strlen( $auth_settings['ldap_attr_email'] ) > 0 && substr( $auth_settings['ldap_attr_email'], 0, 1 ) !== '@' ) {
1503	1372	array_push( $ldap_attributes_to_retrieve, $this->lowercase( $auth_settings['ldap_attr_email'] ) );
1504	1373	}
	1374	+ $ldap_search = ldap_search(
	1375	+ $ldap,
	1376	+ $auth_settings['ldap_search_base'],
	1377	+ "(" . $auth_settings['ldap_uid'] . "=" . $username . ")",
	1378	+ $ldap_attributes_to_retrieve
	1379	+ );
	1380	+ $ldap_entries = ldap_get_entries( $ldap, $ldap_search );
1505	1381
1506		- // Create default LDAP search filter (uid=$username).
1507		- $search_filter = '(' . $auth_settings['ldap_uid'] . '=' . $username . ')';
1508		-
1509		- /**
1510		- * Filter LDAP search filter.
1511		- *
1512		- * Allows for custom LDAP authentication rules (e.g., restricting login
1513		- * access to users in multiple groups, or having certain attributes).
1514		- *
1515		- * @param string $search_filter The filter to pass to ldap_search().
1516		- * @param string $ldap_uid The attribute to compare username against (from Authorizer Settings).
1517		- * @param string $username The username attempting to log in.
1518		- */
1519		- $search_filter = apply_filters( 'authorizer_ldap_search_filter', $search_filter, $auth_settings['ldap_uid'], $username );
1520		-
1521		- // Multiple search bases can be provided, so iterate through them until a match is found.
1522		- foreach ( $search_bases as $search_base ) {
1523		- $ldap_search = ldap_search(
1524		- $ldap,
1525		- $search_base,
1526		- $search_filter,
1527		- $ldap_attributes_to_retrieve
1528		- );
1529		- $ldap_entries = ldap_get_entries( $ldap, $ldap_search );
1530		- if ( $ldap_entries['count'] > 0 ) {
1531		- break;
1532		- }
1533		- }
1534		-
1535	1382	// If we didn't find any users in ldap, fall back to WordPress authentication.
1536	1383	if ( $ldap_entries['count'] < 1 ) {
1537	1384	return null;
1538	1385	}
		@@ -1538,18 +1385,18 @@
1538	1385	}
1539	1386
1540	1387	// Get the bind dn and first/last names; if there are multiple results returned, just get the last one.
1541	1388	for ( $i = 0; $i < $ldap_entries['count']; $i++ ) {
1542		- $ldap_user_dn = $ldap_entries[ $i ]['dn'];
	1389	+ $ldap_user_dn = $ldap_entries[$i]['dn'];
1543	1390
1544	1391	// Get user first name and last name.
1545	1392	$ldap_attr_first_name = array_key_exists( 'ldap_attr_first_name', $auth_settings ) ? $this->lowercase( $auth_settings['ldap_attr_first_name'] ) : '';
1546		- if ( strlen( $ldap_attr_first_name ) > 0 && array_key_exists( $ldap_attr_first_name, $ldap_entries[ $i ] ) && $ldap_entries[ $i ][ $ldap_attr_first_name ]['count'] > 0 && strlen( $ldap_entries[ $i ][ $ldap_attr_first_name ][0] ) > 0 ) {
1547		- $first_name = $ldap_entries[ $i ][ $ldap_attr_first_name ][0];
	1393	+ if ( strlen( $ldap_attr_first_name ) > 0 && array_key_exists( $ldap_attr_first_name, $ldap_entries[$i] ) && $ldap_entries[$i][$ldap_attr_first_name]['count'] > 0 && strlen( $ldap_entries[$i][$ldap_attr_first_name][0] ) > 0 ) {
	1394	+ $first_name = $ldap_entries[$i][$ldap_attr_first_name][0];
1548	1395	}
1549	1396	$ldap_attr_last_name = array_key_exists( 'ldap_attr_last_name', $auth_settings ) ? $this->lowercase( $auth_settings['ldap_attr_last_name'] ) : '';
1550		- if ( strlen( $ldap_attr_last_name ) > 0 && array_key_exists( $ldap_attr_last_name, $ldap_entries[ $i ] ) && $ldap_entries[ $i ][ $ldap_attr_last_name ]['count'] > 0 && strlen( $ldap_entries[ $i ][ $ldap_attr_last_name ][0] ) > 0 ) {
1551		- $last_name = $ldap_entries[ $i ][ $ldap_attr_last_name ][0];
	1397	+ if ( strlen( $ldap_attr_last_name ) > 0 && array_key_exists( $ldap_attr_last_name, $ldap_entries[$i] ) && $ldap_entries[$i][$ldap_attr_last_name]['count'] > 0 && strlen( $ldap_entries[$i][$ldap_attr_last_name][0] ) > 0 ) {
	1398	+ $last_name = $ldap_entries[$i][$ldap_attr_last_name][0];
1552	1399	}
1553	1400	// Get user email if it is specified in another field.
1554	1401	$ldap_attr_email = array_key_exists( 'ldap_attr_email', $auth_settings ) ? $this->lowercase( $auth_settings['ldap_attr_email'] ) : '';
1555	1402	if ( strlen( $ldap_attr_email ) > 0 ) {
		@@ -1558,15 +1405,15 @@
1558	1405	// LDAP attribute), and combine that with the username to create the email.
1559	1406	// Otherwise, look up the LDAP attribute for email.
1560	1407	if ( substr( $ldap_attr_email, 0, 1 ) === '@' ) {
1561	1408	$email = $this->lowercase( $username . $ldap_attr_email );
1562		- } elseif ( array_key_exists( $ldap_attr_email, $ldap_entries[ $i ] ) && $ldap_entries[ $i ][ $ldap_attr_email ]['count'] > 0 && strlen( $ldap_entries[ $i ][ $ldap_attr_email ][0] ) > 0 ) {
1563		- $email = $this->lowercase( $ldap_entries[ $i ][ $ldap_attr_email ][0] );
	1409	+ } elseif ( array_key_exists( $ldap_attr_email, $ldap_entries[$i] ) && $ldap_entries[$i][$ldap_attr_email]['count'] > 0 && strlen( $ldap_entries[$i][$ldap_attr_email][0] ) > 0 ) {
	1410	+ $email = $this->lowercase( $ldap_entries[$i][$ldap_attr_email][0] );
1564	1411	}
1565	1412	}
1566	1413	}
1567	1414
1568		- $result = @ldap_bind( $ldap, $ldap_user_dn, stripslashes( $password ) ); // phpcs:ignore
	1415	+ $result = @ldap_bind( $ldap, $ldap_user_dn, stripslashes( $password ) );
1569	1416	if ( ! $result ) {
1570	1417	// We have a real ldap user, but an invalid password. Pass
1571	1418	// through to wp authentication after failing LDAP (since
1572	1419	// this could be a local account that happens to be the
		@@ -1582,14 +1429,14 @@
1582	1429	$externally_authenticated_email = $this->lowercase( $email );
1583	1430	}
1584	1431
1585	1432	return array(
1586		- 'email' => $externally_authenticated_email,
1587		- 'username' => $username,
1588		- 'first_name' => $first_name,
1589		- 'last_name' => $last_name,
	1433	+ 'email' => $externally_authenticated_email,
	1434	+ 'username' => $username,
	1435	+ 'first_name' => $first_name,
	1436	+ 'last_name' => $last_name,
1590	1437	'authenticated_by' => 'ldap',
1591		- 'ldap_attributes' => $ldap_entries,
	1438	+ 'ldap_attributes' => $ldap_entries,
1592	1439	);
1593	1440	}
1594	1441
1595	1442
		@@ -1595,20 +1442,18 @@
1595	1442
1596	1443	/**
1597	1444	* Log out of the attached external service.
1598	1445	*
1599		- * Action: wp_logout
1600		- *
1601	1446	* @return void
1602	1447	*/
1603	1448	public function custom_logout() {
1604	1449	// Grab plugin settings.
1605		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
	1450	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' );
1606	1451
1607	1452	// Reset option containing old error messages.
1608	1453	delete_option( 'auth_settings_advanced_login_error' );
1609	1454
1610		- if ( session_id() === '' ) {
	1455	+ if ( session_id() == '' ) {
1611	1456	session_start();
1612	1457	}
1613	1458
1614	1459	$current_user_authenticated_by = get_user_meta( get_current_user_id(), 'authenticated_by', true );
		@@ -1613,30 +1458,24 @@
1613	1458
1614	1459	$current_user_authenticated_by = get_user_meta( get_current_user_id(), 'authenticated_by', true );
1615	1460
1616	1461	// If logged in to CAS, Log out of CAS.
1617		- if ( 'cas' === $current_user_authenticated_by && '1' === $auth_settings['cas'] ) {
	1462	+ if ( $current_user_authenticated_by === 'cas' && $auth_settings['cas'] === '1' ) {
1618	1463	if ( ! array_key_exists( 'PHPCAS_CLIENT', $GLOBALS ) || ! array_key_exists( 'phpCAS', $_SESSION ) ) {
1619	1464
1620		- /**
1621		- * Get the CAS server version (default to SAML_VERSION_1_1).
1622		- *
1623		- * @see: https://developer.jasig.org/cas-clients/php/1.3.4/docs/api/group__public.html
1624		- */
	1465	+ // Get the CAS server version (default to SAML_VERSION_1_1).
	1466	+ // See: https://developer.jasig.org/cas-clients/php/1.3.4/docs/api/group__public.html
1625	1467	$cas_version = SAML_VERSION_1_1;
1626		- if ( 'CAS_VERSION_3_0' === $auth_settings['cas_version'] ) {
	1468	+ if ( $auth_settings['cas_version'] === 'CAS_VERSION_3_0' ) {
1627	1469	$cas_version = CAS_VERSION_3_0;
1628		- } elseif ( 'CAS_VERSION_2_0' === $auth_settings['cas_version'] ) {
	1470	+ } elseif ( $auth_settings['cas_version'] === 'CAS_VERSION_2_0' ) {
1629	1471	$cas_version = CAS_VERSION_2_0;
1630		- } elseif ( 'CAS_VERSION_1_0' === $auth_settings['cas_version'] ) {
	1472	+ } elseif ( $auth_settings['cas_version'] === 'CAS_VERSION_1_0' ) {
1631	1473	$cas_version = CAS_VERSION_1_0;
1632	1474	}
1633	1475
1634	1476	// Set the CAS client configuration if it hasn't been set already.
1635	1477	phpCAS::client( $cas_version, $auth_settings['cas_host'], intval( $auth_settings['cas_port'] ), $auth_settings['cas_path'] );
1636		- // Allow redirects at the CAS server endpoint (e.g., allow connections
1637		- // at an old CAS URL that redirects to a newer CAS URL).
1638		- phpCAS::setExtraCurlOption( CURLOPT_FOLLOWLOCATION, true );
1639	1478	// Restrict logout request origin to the CAS server only (prevent DDOS).
1640	1479	phpCAS::handleLogoutRequests( true, array( $auth_settings['cas_host'] ) );
1641	1480	}
1642	1481	if ( phpCAS::isAuthenticated() || phpCAS::isInitialized() ) {
		@@ -1641,10 +1480,10 @@
1641	1480	}
1642	1481	if ( phpCAS::isAuthenticated() || phpCAS::isInitialized() ) {
1643	1482	// Redirect to home page, or specified page if it's been provided.
1644	1483	$redirect_to = site_url( '/' );
1645		- if ( ! empty( $_REQUEST['redirect_to'] ) && isset( $_REQUEST['_wpnonce'] ) && wp_verify_nonce( sanitize_key( $_REQUEST['_wpnonce'] ), 'log-out' ) ) {
1646		- $redirect_to = esc_url_raw( wp_unslash( $_REQUEST['redirect_to'] ) );
	1484	+ if ( array_key_exists( 'redirect_to', $_REQUEST ) && filter_var( $_REQUEST['redirect_to'], FILTER_VALIDATE_URL ) !== false ) {
	1485	+ $redirect_to = $_REQUEST['redirect_to'];
1647	1486	}
1648	1487
1649	1488	phpCAS::logoutWithRedirectService( $redirect_to );
1650	1489	}
		@@ -1650,16 +1489,13 @@
1650	1489	}
1651	1490	}
1652	1491
1653	1492	// If session token set, log out of Google.
1654		- if ( 'google' === $current_user_authenticated_by || array_key_exists( 'token', $_SESSION ) ) {
	1493	+ if ( $current_user_authenticated_by === 'google' || array_key_exists( 'token', $_SESSION ) ) {
1655	1494	$token = json_decode( $_SESSION['token'] )->access_token;
1656	1495
1657		- /**
1658		- * Add Google API PHP Client.
1659		- *
1660		- * @see https://github.com/google/google-api-php-client branch:v1-master
1661		- */
	1496	+ // Add Google API PHP Client.
	1497	+ // @see https://github.com/google/google-api-php-client branch:v1-master
1662	1498	require_once dirname( __FILE__ ) . '/vendor/google-api-php-client/src/Google/autoload.php';
1663	1499
1664	1500	// Build the Google Client.
1665	1501	$client = new Google_Client();
		@@ -1667,9 +1503,9 @@
1667	1503	$client->setClientId( $auth_settings['google_clientid'] );
1668	1504	$client->setClientSecret( $auth_settings['google_clientsecret'] );
1669	1505	$client->setRedirectUri( 'postmessage' );
1670	1506
1671		- // Revoke the token.
	1507	+ // Revoke the token
1672	1508	$client->revokeToken( $token );
1673	1509
1674	1510	// Remove the credentials from the user's session.
1675	1511	unset( $_SESSION['token'] );
		@@ -1688,61 +1524,60 @@
1688	1524
1689	1525
1690	1526	/**
1691	1527	* Restrict access to WordPress site based on settings (everyone, logged_in_users).
	1528	+ * Hook: parse_request http://codex.wordpress.org/Plugin_API/Action_Reference/parse_request
1692	1529	*
1693		- * Action: parse_request
	1530	+ * @param array $wp WordPress object.
1694	1531	*
1695		- * @param array $wp WordPress object.
1696		- * @return WP|void WP object when passing through to WordPress authentication, or void.
	1532	+ * @return void
1697	1533	*/
1698	1534	public function restrict_access( $wp ) {
1699	1535	// Grab plugin settings.
1700		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
	1536	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' );
1701	1537
1702	1538	// Grab current user.
1703	1539	$current_user = wp_get_current_user();
1704	1540
1705	1541	$has_access = (
1706		- // Always allow access if WordPress is installing.
1707		- // phpcs:ignore WordPress.CSRF.NonceVerification.NoNonceVerification
	1542	+ // Always allow access if WordPress is installing
1708	1543	( defined( 'WP_INSTALLING' ) && isset( $_GET['key'] ) ) ||
1709		- // Always allow access to admins.
	1544	+ // Always allow access to admins
1710	1545	( current_user_can( 'create_users' ) ) ||
1711		- // Allow access if option is set to 'everyone'.
1712		- ( 'everyone' === $auth_settings['access_who_can_view'] ) ||
1713		- // Allow access to approved external users and logged in users if option is set to 'logged_in_users'.
1714		- ( 'logged_in_users' === $auth_settings['access_who_can_view'] && $this->is_user_logged_in_and_blog_user() && $this->is_email_in_list( $current_user->user_email, 'approved' ) ) ||
1715		- // Allow access for requests to /wp-json/oauth1 so oauth clients can authenticate to use the REST API.
1716		- ( property_exists( $wp, 'matched_query' ) && stripos( $wp->matched_query, 'rest_oauth1=' ) === 0 ) ||
1717		- // Allow access for non-GET requests to /wp-json/*, since REST API authentication already covers them.
1718		- ( property_exists( $wp, 'matched_query' ) && 0 === stripos( $wp->matched_query, 'rest_route=' ) && isset( $_SERVER['REQUEST_METHOD'] ) && 'GET' !== $_SERVER['REQUEST_METHOD'] ) ||
1719		- // Allow access for GET requests to /wp-json/ (root), since REST API discovery calls rely on this.
1720		- ( property_exists( $wp, 'matched_query' ) && 'rest_route=/' === $wp->matched_query )
	1546	+ // Allow access if option is set to 'everyone'
	1547	+ ( $auth_settings['access_who_can_view'] == 'everyone' ) ||
	1548	+ // Allow access to approved external users and logged in users if option is set to 'logged_in_users'
	1549	+ ( $auth_settings['access_who_can_view'] == 'logged_in_users' && $this->is_user_logged_in_and_blog_user() && $this->is_email_in_list( $current_user->user_email, 'approved' ) ) ||
	1550	+ // Allow access for requests to /wp-json/oauth1 so oauth clients can authenticate to use the REST API
	1551	+ ( property_exists( $wp, 'matched_query' ) && stripos( $wp->matched_query, "rest_oauth1=" ) === 0 ) ||
	1552	+ // Allow access for non-GET requests to /wp-json/*, since REST API authentication already covers them
	1553	+ ( property_exists( $wp, 'matched_query' ) && stripos( $wp->matched_query, "rest_route=" ) === 0 && $_SERVER['REQUEST_METHOD'] !== 'GET' ) ||
	1554	+ // Allow access for GET requests to /wp-json/ (root), since REST API discovery calls rely on this
	1555	+ ( property_exists( $wp, 'matched_query' ) && $wp->matched_query === 'rest_route=/' )
1721	1556	// Note that GET requests to a rest endpoint will be restricted by authorizer. In that case, error messages will be returned as JSON.
1722	1557	);
1723	1558
1724	1559	/**
1725		- * Developers can use the `authorizer_has_access` filter to override
1726		- * restricted access on certain pages. Note that the restriction checks
1727		- * happens before WordPress executes any queries, so use the $wp variable
1728		- * to investigate what the visitor is trying to load.
	1560	+ * Developers can use the `authorizer_has_access` filter
	1561	+ * to override restricted access on certain pages. Note that the
	1562	+ * restriction checks happens before WordPress executes any queries, so
	1563	+ * use the global `$wp` variable to investigate what the visitor is
	1564	+ * trying to load.
1729	1565	*
1730	1566	* For example, to unblock an RSS feed, place the following PHP code in
1731	1567	* the theme's functions.php file or in a simple plug-in:
1732	1568	*
1733		- * function my_feed_access_override( $has_access, $wp ) {
1734		- * // Check query variables to see if this is the feed.
1735		- * if ( ! empty( $wp->query_vars['feed'] ) ) {
	1569	+ * function my_rsa_feed_access_override( $has_access ) {
	1570	+ * global $wp;
	1571	+ * // check query variables to see if this is the feed
	1572	+ * if ( ! empty( $wp->query_vars['feed'] ) )
1736	1573	* $has_access = true;
1737		- * }
1738		- *
1739	1574	* return $has_access;
1740	1575	* }
1741		- * add_filter( 'authorizer_has_access', 'my_feed_access_override', 10, 2 );
	1576	+ * add_filter( 'authorizer_has_access', 'my_rsa_feed_access_override' );
1742	1577	*/
1743	1578	if ( apply_filters( 'authorizer_has_access', $has_access, $wp ) === true ) {
1744		- // Turn off the public notice about browsing anonymously.
	1579	+ // Turn off the public notice about browsing anonymously
1745	1580	update_option( 'auth_settings_advanced_public_notice', false );
1746	1581
1747	1582	// We've determined that the current user has access, so simply return to grant access.
1748	1583	return $wp;
		@@ -1748,13 +1583,13 @@
1748	1583	return $wp;
1749	1584	}
1750	1585
1751	1586	// Allow HEAD requests to the root (usually discovery from a REST client).
1752		- if ( 'HEAD' === $_SERVER['REQUEST_METHOD'] && empty( $wp->request ) && empty( $wp->matched_query ) ) {
	1587	+ if ( $_SERVER['REQUEST_METHOD'] === 'HEAD' && empty( $wp->request ) && empty( $wp->matched_query ) ) {
1753	1588	return $wp;
1754	1589	}
1755	1590
1756		- /* We've determined that the current user doesn't have access, so we deal with them now. */
	1591	+ // We've determined that the current user doesn't have access, so we deal with them now.
1757	1592
1758	1593	// Fringe case: In a multisite, a user of a different blog can successfully
1759	1594	// log in, but they aren't on the 'approved' whitelist for this blog.
1760	1595	// If that's the case, add them to the pending list for this blog.
		@@ -1768,16 +1603,16 @@
1768	1603	// Check to see if the requested page is public. If so, show it.
1769	1604	if ( empty( $wp->request ) ) {
1770	1605	$current_page_id = 'home';
1771	1606	} else {
1772		- $request_query = isset( $wp->query_vars ) ? new WP_Query( $wp->query_vars ) : null;
	1607	+ $request_query = isset( $wp->query_vars ) ? new WP_Query( $wp->query_vars ) : null;
1773	1608	$current_page_id = isset( $request_query->post_count ) && $request_query->post_count > 0 ? $request_query->post->ID : '';
1774	1609	}
1775	1610	if ( ! array_key_exists( 'access_public_pages', $auth_settings ) || ! is_array( $auth_settings['access_public_pages'] ) ) {
1776	1611	$auth_settings['access_public_pages'] = array();
1777	1612	}
1778		- if ( in_array( strval( $current_page_id ), $auth_settings['access_public_pages'], true ) ) {
1779		- if ( 'no_warning' === $auth_settings['access_public_warning'] ) {
	1613	+ if ( in_array( $current_page_id, $auth_settings['access_public_pages'] ) ) {
	1614	+ if ( $auth_settings['access_public_warning'] === 'no_warning' ) {
1780	1615	update_option( 'auth_settings_advanced_public_notice', false );
1781	1616	} else {
1782	1617	update_option( 'auth_settings_advanced_public_notice', true );
1783	1618	}
		@@ -1785,11 +1620,11 @@
1785	1620	}
1786	1621
1787	1622	// Check to see if any category assigned to the requested page is public. If so, show it.
1788	1623	$current_page_categories = wp_get_post_categories( $current_page_id, array( 'fields' => 'slugs' ) );
1789		- foreach ( $current_page_categories as $current_page_category ) {
1790		- if ( in_array( 'cat_' . $current_page_category, $auth_settings['access_public_pages'], true ) ) {
1791		- if ( 'no_warning' === $auth_settings['access_public_warning'] ) {
	1624	+ foreach( $current_page_categories as $current_page_category ) {
	1625	+ if ( in_array( 'cat_' . $current_page_category, $auth_settings['access_public_pages'] ) ) {
	1626	+ if ( $auth_settings['access_public_warning'] === 'no_warning' ) {
1792	1627	update_option( 'auth_settings_advanced_public_notice', false );
1793	1628	} else {
1794	1629	update_option( 'auth_settings_advanced_public_notice', true );
1795	1630	}
		@@ -1798,10 +1633,10 @@
1798	1633	}
1799	1634
1800	1635	// Check to see if this page can't be found. If so, allow showing the 404 page.
1801	1636	if ( strlen( $current_page_id ) < 1 ) {
1802		- if ( in_array( 'auth_public_404', $auth_settings['access_public_pages'], true ) ) {
1803		- if ( 'no_warning' === $auth_settings['access_public_warning'] ) {
	1637	+ if ( in_array( 'auth_public_404', $auth_settings['access_public_pages'] ) ) {
	1638	+ if ( $auth_settings['access_public_warning'] === 'no_warning' ) {
1804	1639	update_option( 'auth_settings_advanced_public_notice', false );
1805	1640	} else {
1806	1641	update_option( 'auth_settings_advanced_public_notice', true );
1807	1642	}
		@@ -1812,10 +1647,10 @@
1812	1647	// Check to see if the requested category is public. If so, show it.
1813	1648	$current_category_name = property_exists( $wp, 'query_vars' ) && array_key_exists( 'category_name', $wp->query_vars ) && strlen( $wp->query_vars['category_name'] ) > 0 ? $wp->query_vars['category_name'] : '';
1814	1649	if ( $current_category_name ) {
1815	1650	$current_category_name = end( explode( '/', $current_category_name ) );
1816		- if ( in_array( 'cat_' . $current_category_name, $auth_settings['access_public_pages'], true ) ) {
1817		- if ( 'no_warning' === $auth_settings['access_public_warning'] ) {
	1651	+ if ( in_array( 'cat_' . $current_category_name, $auth_settings['access_public_pages'] ) ) {
	1652	+ if ( $auth_settings['access_public_warning'] === 'no_warning' ) {
1818	1653	update_option( 'auth_settings_advanced_public_notice', false );
1819	1654	} else {
1820	1655	update_option( 'auth_settings_advanced_public_notice', true );
1821	1656	}
		@@ -1825,20 +1660,18 @@
1825	1660
1826	1661	// User is denied access, so show them the error message. Render as JSON
1827	1662	// if this is a REST API call; otherwise, show the error message via
1828	1663	// wp_die() (rendered html), or redirect to the login URL.
1829		- $current_path = ! empty( $_SERVER['REQUEST_URI'] ) ? esc_url_raw( wp_unslash( $_SERVER['REQUEST_URI'] ) ) : home_url();
1830		- if ( property_exists( $wp, 'matched_query' ) && stripos( $wp->matched_query, 'rest_route=' ) === 0 && 'GET' === $_SERVER['REQUEST_METHOD'] ) {
1831		- wp_send_json(
1832		- array(
1833		- 'code' => 'rest_cannot_view',
1834		- 'message' => strip_tags( $auth_settings['access_redirect_to_message'] ),
1835		- 'data' => array(
1836		- 'status' => 401,
1837		- ),
1838		- )
1839		- );
1840		- } elseif ( 'message' === $auth_settings['access_redirect'] ) {
	1664	+ $current_path = empty( $_SERVER['REQUEST_URI'] ) ? home_url() : $_SERVER['REQUEST_URI'];
	1665	+ if ( property_exists( $wp, 'matched_query' ) && stripos( $wp->matched_query, "rest_route=" ) === 0 && $_SERVER['REQUEST_METHOD'] === 'GET' ) {
	1666	+ wp_send_json( array(
	1667	+ 'code' => 'rest_cannot_view',
	1668	+ 'message' => strip_tags( $auth_settings['access_redirect_to_message'] ),
	1669	+ 'data' => array(
	1670	+ 'status' => 401,
	1671	+ ),
	1672	+ ));
	1673	+ } elseif ( $auth_settings['access_redirect'] === 'message' ) {
1841	1674	$page_title = sprintf(
1842	1675	/* TRANSLATORS: %s: Name of blog */
1843	1676	__( '%s - Access Restricted', 'authorizer' ),
1844	1677	get_bloginfo( 'name' )
		@@ -1849,15 +1682,15 @@
1849	1682	'<p style="text-align: center;margin-bottom: -15px;">' .
1850	1683	'<a class="button" href="' . wp_login_url( $current_path ) . '">' .
1851	1684	__( 'Log In', 'authorizer' ) .
1852	1685	'</a></p>';
1853		- wp_die( wp_kses( $error_message, $this->allowed_html ), esc_html( $page_title ) );
1854		- } else {
	1686	+ wp_die( $error_message, $page_title );
	1687	+ } else { // if ( $auth_settings['access_redirect'] === 'login' ) {
1855	1688	wp_redirect( wp_login_url( $current_path ), 302 );
1856	1689	exit;
1857	1690	}
1858	1691
1859		- // Sanity check: we should never get here.
	1692	+ // Sanity check: we should never get here
1860	1693	wp_die( '<p>Access denied.</p>', 'Site Access Restricted' );
1861	1694	}
1862	1695
1863	1696
		@@ -1866,11 +1699,9 @@
1866	1699	* not yet been added to this particular blog in a multisite). Note: we do
1867	1700	* this because check_user_access() runs on the parse_request hook, which
1868	1701	* does not fire on wp-admin pages.
1869	1702	*
1870		- * Action: init
1871		- *
1872		- * @return void
	1703	+ * Hook: admin_menu
1873	1704	*/
1874	1705	public function init__maybe_add_network_approved_user() {
1875	1706	global $current_user;
1876	1707
		@@ -1885,10 +1716,10 @@
1885	1716	) {
1886	1717	// Get all approved users.
1887	1718	$auth_settings_access_users_approved = $this->sanitize_user_list(
1888	1719	array_merge(
1889		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT ),
1890		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT )
	1720	+ $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN ),
	1721	+ $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN )
1891	1722	)
1892	1723	);
1893	1724
1894	1725	// Get user info (we need user role).
		@@ -1900,9 +1731,9 @@
1900	1731	// Add user to blog.
1901	1732	add_user_to_blog( get_current_blog_id(), $current_user->ID, $user_info['role'] );
1902	1733
1903	1734	// Refresh user permissions.
1904		- $current_user = new WP_User( $current_user->ID ); // phpcs:ignore WordPress.Variables.GlobalVariables.OverrideProhibited
	1735	+ $current_user = new WP_User( $current_user->ID );
1905	1736	}
1906	1737	}
1907	1738
1908	1739
		@@ -1916,15 +1747,11 @@
1916	1747
1917	1748
1918	1749	/**
1919	1750	* Add custom error message to login screen.
1920		- *
1921	1751	* Filter: login_errors
1922		- *
1923		- * @param string $errors Error description.
1924		- * @return string Error description with Authorizer errors added.
1925	1752	*/
1926		- public function show_advanced_login_error( $errors ) {
	1753	+ function show_advanced_login_error( $errors ) {
1927	1754	$error = get_option( 'auth_settings_advanced_login_error' );
1928	1755	delete_option( 'auth_settings_advanced_login_error' );
1929	1756	$errors = ' ' . $error . "<br />\n";
1930	1757	return $errors;
		@@ -1932,25 +1759,24 @@
1932	1759
1933	1760
1934	1761	/**
1935	1762	* Load external resources for the public-facing site.
1936		- *
1937		- * Action: wp_enqueue_scripts
1938	1763	*/
1939		- public function auth_public_scripts() {
1940		- // Load (and localize) public scripts.
1941		- $current_path = ! empty( $_SERVER['REQUEST_URI'] ) ? esc_url_raw( wp_unslash( $_SERVER['REQUEST_URI'] ) ) : home_url();
1942		- wp_enqueue_script( 'auth_public_scripts', plugins_url( '/js/authorizer-public.js', __FILE__ ), array( 'jquery' ), '2.8.0' );
	1764	+ function auth_public_scripts() {
	1765	+ // Load (and localize) public scripts
	1766	+ $current_path = empty( $_SERVER['REQUEST_URI'] ) ? home_url() : $_SERVER['REQUEST_URI'];
	1767	+ wp_enqueue_script( 'auth_public_scripts', plugins_url( '/js/authorizer-public.js', __FILE__ ), array( 'jquery' ), '2.3.2' );
1943	1768	$auth_localized = array(
1944		- 'wpLoginUrl' => wp_login_url( $current_path ),
1945		- 'publicWarning' => get_option( 'auth_settings_advanced_public_notice' ),
1946		- 'anonymousNotice' => $this->get_plugin_option( 'access_redirect_to_message' ),
1947		- 'logIn' => esc_html__( 'Log In', 'authorizer' ),
	1769	+ 'wp_login_url' => wp_login_url( $current_path ),
	1770	+ 'public_warning' => get_option( 'auth_settings_advanced_public_notice' ),
	1771	+ 'anonymous_notice' => $this->get_plugin_option( 'access_redirect_to_message' ),
	1772	+ 'log_in' => esc_html__( 'Log In', 'authorizer' ),
1948	1773	);
1949	1774	wp_localize_script( 'auth_public_scripts', 'auth', $auth_localized );
	1775	+ //update_option( 'auth_settings_advanced_public_notice', false);
1950	1776
1951		- // Load public css.
1952		- wp_register_style( 'authorizer-public-css', plugins_url( 'css/authorizer-public.css', __FILE__ ), array(), '2.8.0' );
	1777	+ // Load public css
	1778	+ wp_register_style( 'authorizer-public-css', plugins_url( 'css/authorizer-public.css', __FILE__ ), array(), '2.3.2' );
1953	1779	wp_enqueue_style( 'authorizer-public-css' );
1954	1780	}
1955	1781
1956	1782
		@@ -1956,21 +1782,19 @@
1956	1782
1957	1783	/**
1958	1784	* Enqueue JS scripts and CSS styles appearing on wp-login.php.
1959	1785	*
1960		- * Action: login_enqueue_scripts
1961		- *
1962	1786	* @return void
1963	1787	*/
1964		- public function login_enqueue_scripts_and_styles() {
	1788	+ function login_enqueue_scripts_and_styles() {
1965	1789	// Grab plugin settings.
1966		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
	1790	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' );
1967	1791
1968	1792	// Enqueue scripts appearing on wp-login.php.
1969		- wp_enqueue_script( 'auth_login_scripts', plugins_url( '/js/authorizer-login.js', __FILE__ ), array( 'jquery' ), '2.8.0' );
	1793	+ wp_enqueue_script( 'auth_login_scripts', plugins_url( '/js/authorizer-login.js', __FILE__ ), array( 'jquery' ), '2.3.2' );
1970	1794
1971	1795	// Enqueue styles appearing on wp-login.php.
1972		- wp_register_style( 'authorizer-login-css', plugins_url( '/css/authorizer-login.css', __FILE__ ), array(), '2.8.0' );
	1796	+ wp_register_style( 'authorizer-login-css', plugins_url( '/css/authorizer-login.css', __FILE__ ), array(), '2.3.2' );
1973	1797	wp_enqueue_style( 'authorizer-login-css' );
1974	1798
1975	1799	/**
1976	1800	* Developers can use the `authorizer_add_branding_option` filter
		@@ -1975,8 +1799,9 @@
1975	1799	/**
1976	1800	* Developers can use the `authorizer_add_branding_option` filter
1977	1801	* to add a radio button for "Custom WordPress login branding"
1978	1802	* under the "Advanced" tab in Authorizer options. Example:
	1803	+ *
1979	1804	* function my_authorizer_add_branding_option( $branding_options ) {
1980	1805	* $new_branding_option = array(
1981	1806	* 'value' => 'your_brand'
1982	1807	* 'description' => 'Custom Your Brand Login Screen',
		@@ -1990,23 +1815,23 @@
1990	1815	*/
1991	1816	$branding_options = array();
1992	1817	$branding_options = apply_filters( 'authorizer_add_branding_option', $branding_options );
1993	1818	foreach ( $branding_options as $branding_option ) {
1994		- // Make sure the custom brands have the required values.
	1819	+ // Make sure the custom brands have the required values
1995	1820	if ( ! ( is_array( $branding_option ) && array_key_exists( 'value', $branding_option ) && array_key_exists( 'css_url', $branding_option ) && array_key_exists( 'js_url', $branding_option ) ) ) {
1996	1821	continue;
1997	1822	}
1998	1823	if ( $auth_settings['advanced_branding'] === $branding_option['value'] ) {
1999		- wp_enqueue_script( 'auth_login_custom_scripts-' . sanitize_title( $branding_option['value'] ), $branding_option['js_url'], array( 'jquery' ), '2.8.0' );
2000		- wp_register_style( 'authorizer-login-custom-css-' . sanitize_title( $branding_option['value'] ), $branding_option['css_url'], array(), '2.8.0' );
	1824	+ wp_enqueue_script( 'auth_login_custom_scripts-' . sanitize_title( $branding_option['value'] ), $branding_option['js_url'], array( 'jquery' ), '2.3.2' );
	1825	+ wp_register_style( 'authorizer-login-custom-css-' . sanitize_title( $branding_option['value'] ), $branding_option['css_url'], array(), '2.3.2' );
2001	1826	wp_enqueue_style( 'authorizer-login-custom-css-' . sanitize_title( $branding_option['value'] ) );
2002	1827	}
2003	1828	}
2004	1829
2005	1830	// If we're using Google logins, load those resources.
2006		- if ( '1' === $auth_settings['google'] ) {
2007		- wp_enqueue_script( 'authorizer-login-custom-google', plugins_url( '/js/authorizer-login-custom_google.js', __FILE__ ), array( 'jquery' ), '2.8.0' ); ?>
2008		- <meta name="google-signin-clientid" content="<?php echo esc_attr( $auth_settings['google_clientid'] ); ?>" />
	1831	+ if ( $auth_settings['google'] === '1' ) {
	1832	+ wp_enqueue_script( 'authorizer-login-custom-google', plugins_url( '/js/authorizer-login-custom_google.js', __FILE__ ), array( 'jquery' ), '2.3.2' ); ?>
	1833	+ <meta name="google-signin-clientid" content="<?php echo $auth_settings['google_clientid']; ?>" />
2009	1834	<meta name="google-signin-scope" content="email" />
2010	1835	<meta name="google-signin-cookiepolicy" content="single_host_origin" />
2011	1836	<?php
2012	1837	}
		@@ -2014,127 +1839,110 @@
2014	1839
2015	1840
2016	1841	/**
2017	1842	* Load external resources in the footer of the wp-login.php page.
2018		- *
2019		- * Action: login_footer
	1843	+ * Run on action hook: login_footer
2020	1844	*/
2021		- public function load_login_footer_js() {
	1845	+ function load_login_footer_js() {
2022	1846	// Grab plugin settings.
2023		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
2024		- $ajaxurl = admin_url( 'admin-ajax.php' );
2025		- if ( '1' === $auth_settings['google'] ) :
2026		- ?>
2027		-<script type="text/javascript">
2028		-/* global location, window */
2029		-// Reload login page if reauth querystring param exists,
2030		-// since reauth interrupts external logins (e.g., google).
2031		-if ( location.search.indexOf( 'reauth=1' ) >= 0 ) {
2032		- location.href = location.href.replace( 'reauth=1', '' );
2033		-}
	1847	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' ); ?>
	1848	+ <?php if ( $auth_settings['google'] === '1' ): ?>
	1849	+ <script type="text/javascript">
	1850	+ // Reload login page if reauth querystring param exists,
	1851	+ // since reauth interrupts external logins (e.g., google).
	1852	+ if ( location.search.indexOf( 'reauth=1' ) >= 0 ) {
	1853	+ location.href = location.href.replace( 'reauth=1', '' );
	1854	+ }
2034	1855
2035		-// eslint-disable-next-line no-implicit-globals
2036		-function authUpdateQuerystringParam( uri, key, value ) {
2037		- var re = new RegExp( '([?&])' + key + '=.*?(&|$)', 'i' );
2038		- var separator = uri.indexOf( '?' ) !== -1 ? '&' : '?';
2039		- if ( uri.match( re ) ) {
2040		- return uri.replace( re, '$1' + key + '=' + value + '$2' );
2041		- } else {
2042		- return uri + separator + key + '=' + value;
2043		- }
2044		-}
	1856	+ function auth_update_querystring_param( uri, key, value ) {
	1857	+ var re = new RegExp( '([?&])' + key + '=.*?(&|$)', 'i' );
	1858	+ var separator = uri.indexOf( '?' ) !== -1 ? '&' : '?';
	1859	+ if ( uri.match( re ) ) {
	1860	+ return uri.replace( re, '$1' + key + '=' + value + '$2' );
	1861	+ } else {
	1862	+ return uri + separator + key + '=' + value;
	1863	+ }
	1864	+ }
2045	1865
2046		-// eslint-disable-next-line
2047		-function signInCallback( authResult ) { // jshint ignore:line
2048		- var $ = jQuery;
2049		- if ( authResult.status && authResult.status.signed_in ) {
2050		- // Hide the sign-in button now that the user is authorized, for example:
2051		- $( '#googleplus_button' ).attr( 'style', 'display: none' );
	1866	+ function signInCallback( authResult ) {
	1867	+ var $ = jQuery;
	1868	+ if ( authResult['status'] && authResult['status']['signed_in'] ) {
	1869	+ // Hide the sign-in button now that the user is authorized, for example:
	1870	+ $( '#googleplus_button' ).attr( 'style', 'display: none' );
2052	1871
2053		- // Send the code to the server
2054		- var ajaxurl = '<?php echo esc_attr( $ajaxurl ); ?>';
2055		- $.post(ajaxurl, {
2056		- action: 'process_google_login',
2057		- code: authResult.code,
2058		- nonce: $('#nonce_google_auth-<?php echo esc_attr( $this->get_cookie_value() ); ?>' ).val(),
2059		- }, function() {
2060		- // Handle or verify the server response if necessary.
2061		- // console.log( response );
	1872	+ // Send the code to the server
	1873	+ var ajaxurl = '<?php echo admin_url( "admin-ajax.php" ); ?>';
	1874	+ $.post(ajaxurl, {
	1875	+ action: 'process_google_login',
	1876	+ 'code': authResult['code'],
	1877	+ 'nonce': $('#nonce_google_auth-<?php echo $this->get_cookie_value(); ?>' ).val(),
	1878	+ }, function( response ) {
	1879	+ // Handle or verify the server response if necessary.
	1880	+ //console.log( response );
2062	1881
2063		- // Reload wp-login.php to continue the authentication process.
2064		- var newHref = authUpdateQuerystringParam( location.href, 'external', 'google' );
2065		- if ( location.href === newHref ) {
2066		- location.reload();
2067		- } else {
2068		- location.href = newHref;
2069		- }
2070		- });
2071		- } else {
2072		- // Update the app to reflect a signed out user
2073		- // Possible error values:
2074		- // "user_signed_out" - User is signed-out
2075		- // "access_denied" - User denied access to your app
2076		- // "immediate_failed" - Could not automatically log in the user
2077		- // console.log('Sign-in state: ' + authResult['error']);
	1882	+ // Reload wp-login.php to continue the authentication process.
	1883	+ var new_href = auth_update_querystring_param( location.href, 'external', 'google' );
	1884	+ if ( location.href === new_href ) {
	1885	+ location.reload();
	1886	+ } else {
	1887	+ location.href = new_href;
	1888	+ }
	1889	+ });
	1890	+ } else {
	1891	+ // Update the app to reflect a signed out user
	1892	+ // Possible error values:
	1893	+ // "user_signed_out" - User is signed-out
	1894	+ // "access_denied" - User denied access to your app
	1895	+ // "immediate_failed" - Could not automatically log in the user
	1896	+ //console.log('Sign-in state: ' + authResult['error']);
2078	1897
2079		- // If user denies access, reload the login page.
2080		- if ( authResult.error === 'access_denied' || authResult.error === 'user_signed_out' ) {
2081		- window.location.reload();
	1898	+ // If user denies access, reload the login page.
	1899	+ if ( authResult['error'] === 'access_denied' || authResult['error'] === 'user_signed_out' ) {
	1900	+ window.location.reload();
	1901	+ }
	1902	+ }
	1903	+ }
	1904	+ </script>
	1905	+ <?php endif;
2082	1906	}
2083		- }
2084		-}
2085		-</script>
2086		- <?php
2087		- endif;
2088		- }
2089	1907
2090	1908
2091	1909	/**
2092	1910	* Create links for any external authentication services that are enabled.
2093		- *
2094		- * Action: login_form
2095	1911	*/
2096		- public function login_form_add_external_service_links() {
	1912	+ function login_form_add_external_service_links() {
2097	1913	// Grab plugin settings.
2098		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
2099		- ?>
	1914	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' ); ?>
2100	1915	<div id="auth-external-service-login">
2101		- <?php if ( '1' === $auth_settings['google'] ) : ?>
2102		- <p><a id="googleplus_button" class="button button-primary button-external button-google"><span class="dashicons dashicons-googleplus"></span><span class="label"><?php esc_html_e( 'Sign in with Google', 'authorizer' ); ?></span></a></p>
	1916	+ <?php if ( $auth_settings['google'] === '1' ): ?>
	1917	+ <p><a id="googleplus_button" class="button button-primary button-external button-google"><span class="dashicons dashicons-googleplus"></span><span class="label"><?php _e( 'Sign in with Google', 'authorizer' ); ?></span></a></p>
2103	1918	<?php wp_nonce_field( 'google_csrf_nonce', 'nonce_google_auth-' . $this->get_cookie_value() ); ?>
2104	1919	<?php endif; ?>
2105	1920
2106		- <?php if ( '1' === $auth_settings['cas'] ) : ?>
2107		- <p><a class="button button-primary button-external button-cas" href="<?php echo esc_attr( $this->modify_current_url_for_cas_login() ); ?>">
	1921	+ <?php if ( $auth_settings['cas'] === '1' ): ?>
	1922	+ <p><a class="button button-primary button-external button-cas" href="<?php echo $this->modify_current_url_for_cas_login(); ?>">
2108	1923	<span class="dashicons dashicons-lock"></span>
2109		- <span class="label">
2110		- <?php
2111		- echo esc_html(
2112		- sprintf(
2113		- /* TRANSLATORS: %s: Custom CAS label from authorizer options */
2114		- __( 'Sign in with %s', 'authorizer' ),
2115		- $auth_settings['cas_custom_label']
2116		- )
	1924	+ <span class="label"><?php
	1925	+ printf(
	1926	+ /* TRANSLATORS: %s: Custom CAS label from authorizer options */
	1927	+ __( 'Sign in with %s', 'authorizer' ),
	1928	+ $auth_settings['cas_custom_label']
2117	1929	);
2118		- ?>
2119		- </span>
	1930	+ ?></span>
2120	1931	</a></p>
2121	1932	<?php endif; ?>
2122	1933
2123		- <?php if ( '1' === $auth_settings['advanced_hide_wp_login'] && isset( $_SERVER['QUERY_STRING'] ) && false === strpos( $_SERVER['QUERY_STRING'], 'external=wordpress' ) ) : // phpcs:ignore WordPress.VIP.ValidatedSanitizedInput ?>
	1934	+ <?php if ( $auth_settings['advanced_hide_wp_login'] === '1' && strpos( $_SERVER['QUERY_STRING'], 'external=wordpress' ) === false ): ?>
2124	1935	<style type="text/css">
2125		- body.login-action-login form {
2126		- padding-bottom: 8px;
	1936	+ #loginform {
	1937	+ padding-bottom: 8px !important;
2127	1938	}
2128		- body.login-action-login form p > label,
2129		- body.login-action-login form .forgetmenot,
2130		- body.login-action-login form .submit,
2131		- body.login-action-login #nav { /* csslint allow: ids */
2132		- display: none;
	1939	+ #loginform p>label, #loginform p.forgetmenot, #loginform p.submit, p#nav {
	1940	+ display: none !important;
2133	1941	}
2134	1942	</style>
2135		- <?php elseif ( '1' === $auth_settings['cas'] || '1' === $auth_settings['google'] ) : ?>
2136		- <h3> &mdash; <?php esc_html_e( 'or', 'authorizer' ); ?> &mdash; </h3>
	1943	+ <?php elseif ( $auth_settings['cas'] === '1' || $auth_settings['google'] === '1' ): ?>
	1944	+ <h3> &mdash; <?php _e( 'or', 'authorizer' ); ?> &mdash; </h3>
2137	1945	<?php endif; ?>
2138	1946	</div>
2139	1947	<?php
2140	1948
		@@ -2147,28 +1955,21 @@
2147	1955	* Note: hook into wp_login_errors filter so this fires after the
2148	1956	* authenticate hook (where the redirect to CAS happens), but before html
2149	1957	* output is started (so the redirect header doesn't complain about data
2150	1958	* already being sent).
2151		- *
2152		- * Filter: wp_login_errors
2153		- *
2154		- * @param object $errors WP Error object.
2155		- * @param string $redirect_to Where to redirect on error.
2156		- * @return WP_Error|void WP Error object or void on redirect.
2157	1959	*/
2158		- public function wp_login_errors__maybe_redirect_to_cas( $errors, $redirect_to ) {
	1960	+ function wp_login_errors__maybe_redirect_to_cas( $errors, $redirect_to ) {
2159	1961	// Grab plugin settings.
2160		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
	1962	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' );
2161	1963
2162	1964	// Check whether we should redirect to CAS.
2163	1965	if (
2164		- isset( $_SERVER['QUERY_STRING'] ) &&
2165		- strpos( $_SERVER['QUERY_STRING'], 'external=wordpress' ) === false && // phpcs:ignore WordPress.VIP.ValidatedSanitizedInput
2166		- array_key_exists( 'cas_auto_login', $auth_settings ) && '1' === $auth_settings['cas_auto_login'] &&
2167		- array_key_exists( 'cas', $auth_settings ) && '1' === $auth_settings['cas'] &&
2168		- ( ! array_key_exists( 'ldap', $auth_settings ) || '1' !== $auth_settings['ldap'] ) &&
2169		- ( ! array_key_exists( 'google', $auth_settings ) || '1' !== $auth_settings['google'] ) &&
2170		- array_key_exists( 'advanced_hide_wp_login', $auth_settings ) && '1' === $auth_settings['advanced_hide_wp_login']
	1966	+ strpos( $_SERVER['QUERY_STRING'], 'external=wordpress' ) === false &&
	1967	+ array_key_exists( 'cas_auto_login', $auth_settings ) && $auth_settings['cas_auto_login'] === '1' &&
	1968	+ array_key_exists( 'cas', $auth_settings ) && $auth_settings['cas'] === '1' &&
	1969	+ ( ! array_key_exists( 'ldap', $auth_settings ) || $auth_settings['ldap'] !== '1' ) &&
	1970	+ ( ! array_key_exists( 'google', $auth_settings ) || $auth_settings['google'] !== '1' ) &&
	1971	+ array_key_exists( 'advanced_hide_wp_login', $auth_settings ) && $auth_settings['advanced_hide_wp_login'] === '1'
2171	1972	) {
2172	1973	wp_redirect( $this->modify_current_url_for_cas_login() );
2173	1974	exit;
2174	1975	}
		@@ -2181,22 +1982,18 @@
2181	1982	* Set a unique cookie to add to Google auth nonce to avoid CSRF detection.
2182	1983	* Note: hook into login_init so this fires at the start of the visit to
2183	1984	* wp-login.php, but before any html output is started (so setting the
2184	1985	* cookie header doesn't complain about data already being sent).
2185		- *
2186		- * Action: login_init
2187		- *
2188		- * @return void
2189	1986	*/
2190		- public function login_init__maybe_set_google_nonce_cookie() {
	1987	+ function login_init__maybe_set_google_nonce_cookie() {
2191	1988	// Grab plugin settings.
2192		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
	1989	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' );
2193	1990
2194	1991	// If Google logins are enabled, make sure the cookie is set.
2195		- if ( array_key_exists( 'google', $auth_settings ) && '1' === $auth_settings['google'] ) {
	1992	+ if ( array_key_exists( 'google', $auth_settings ) && $auth_settings['google'] === '1' ) {
2196	1993	if ( ! isset( $_COOKIE['login_unique'] ) ) {
2197	1994	$this->cookie_value = md5( rand() );
2198		- setcookie( 'login_unique', $this->cookie_value, time() + 1800, '/', defined( 'COOKIE_DOMAIN' ) ? COOKIE_DOMAIN : '' );
	1995	+ setcookie( 'login_unique', $this->cookie_value, time()+1800, '/', defined( 'COOKIE_DOMAIN' ) ? COOKIE_DOMAIN : '' );
2199	1996	$_COOKIE['login_unique'] = $this->cookie_value;
2200	1997	}
2201	1998	}
2202	1999	}
		@@ -2205,17 +2002,12 @@
2205	2002	/**
2206	2003	* Implements hook: do_action( 'wp_login_failed', $username );
2207	2004	* Update the user meta for the user that just failed logging in.
2208	2005	* Keep track of time of last failed attempt and number of failed attempts.
2209		- *
2210		- * Action: wp_login_failed
2211		- *
2212		- * @param string $username Username to update login count for.
2213		- * @return void
2214	2006	*/
2215		- public function update_login_failed_count( $username ) {
	2007	+ function update_login_failed_count( $username ) {
2216	2008	// Grab plugin settings.
2217		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
	2009	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' );
2218	2010
2219	2011	// Get user trying to log in.
2220	2012	// If this isn't a real user, update the global failed attempt
2221	2013	// variables. We'll use these global variables to institute the
		@@ -2223,9 +2015,9 @@
2223	2015	// won't be able to determine which accounts are real by which
2224	2016	// accounts get locked out on multiple invalid attempts.
2225	2017	$user = get_user_by( 'login', $username );
2226	2018
2227		- if ( false !== $user ) {
	2019	+ if ( $user !== FALSE ) {
2228	2020	$last_attempt = get_user_meta( $user->ID, 'auth_settings_advanced_lockouts_time_last_failed', true );
2229	2021	$num_attempts = get_user_meta( $user->ID, 'auth_settings_advanced_lockouts_failed_attempts', true );
2230	2022	} else {
2231	2023	$last_attempt = get_option( 'auth_settings_advanced_lockouts_time_last_failed' );
		@@ -2239,15 +2031,15 @@
2239	2031
2240	2032	// Reset the failed attempt count if the time since the last
2241	2033	// failed attempt is greater than the reset duration.
2242	2034	$time_since_last_fail = time() - $last_attempt;
2243		- $reset_duration = $auth_settings['advanced_lockouts']['reset_duration'] * 60; // minutes to seconds.
	2035	+ $reset_duration = $auth_settings['advanced_lockouts']['reset_duration'] * 60; // minutes to seconds
2244	2036	if ( $time_since_last_fail > $reset_duration ) {
2245	2037	$num_attempts = 0;
2246	2038	}
2247	2039
2248	2040	// Set last failed time to now and increment last failed count.
2249		- if ( false !== $user ) {
	2041	+ if ( $user !== FALSE ) {
2250	2042	update_user_meta( $user->ID, 'auth_settings_advanced_lockouts_time_last_failed', time() );
2251	2043	update_user_meta( $user->ID, 'auth_settings_advanced_lockouts_failed_attempts', $num_attempts + 1 );
2252	2044	} else {
2253	2045	update_option( 'auth_settings_advanced_lockouts_time_last_failed', time() );
		@@ -2258,16 +2050,16 @@
2258	2050
2259	2051	/**
2260	2052	* When they successfully log in, make sure WordPress users are in the approved list.
2261	2053	*
2262		- * Action: wp_login
	2054	+ * @action wp_login
2263	2055	*
2264	2056	* @param string $user_login Username of the user logging in.
2265		- * @param object $user WP_User object of the user logging in.
2266		- * @return void
	2057	+ * @param WP_User $user WP_User object of the user logging in.
	2058	+ * @return null
2267	2059	*/
2268		- public function ensure_wordpress_user_in_approved_list_on_login( $user_login, $user ) {
2269		- $this->add_user_to_authorizer_when_created( $user->user_email, $user->user_registered, $user->roles );
	2060	+ function ensure_wordpress_user_in_approved_list_on_login( $user_login, $user ) {
	2061	+ $this->add_user_to_authorizer_when_created( $user->user_email, $user->user_registered, $user->user_roles );
2270	2062	}
2271	2063
2272	2064
2273	2065	/**
		@@ -2273,17 +2065,12 @@
2273	2065	/**
2274	2066	* Overwrite the URL for the lost password link on the login form.
2275	2067	* If we're authenticating against an external service, standard
2276	2068	* WordPress password resets won't work.
2277		- *
2278		- * Filter: lostpassword_url
2279		- *
2280		- * @param string $lostpassword_url URL to reset password.
2281		- * @return string URL to reset password.
2282	2069	*/
2283		- public function custom_lostpassword_url( $lostpassword_url ) {
	2070	+ function custom_lostpassword_url( $lostpassword_url ) {
2284	2071	// Grab plugin settings.
2285		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
	2072	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' );
2286	2073
2287	2074	if (
2288	2075	array_key_exists( 'ldap_lostpassword_url', $auth_settings ) &&
2289	2076	filter_var( $auth_settings['ldap_lostpassword_url'], FILTER_VALIDATE_URL )
		@@ -2306,16 +2093,15 @@
2306	2093	/**
2307	2094	* Add a link to this plugin's settings page from the WordPress Plugins page.
2308	2095	* Called from "plugin_action_links" filter in __construct() above.
2309	2096	*
2310		- * Filter: plugin_action_links_authorizer.php
	2097	+ * @param array $links array of links in the admin sidebar
2311	2098	*
2312		- * @param array $links Admin sidebar links.
2313		- * @return array Admin sidebar links with Authorizer added.
	2099	+ * @return array of links to show in the admin sidebar.
2314	2100	*/
2315	2101	public function plugin_settings_link( $links ) {
2316		- $admin_menu = $this->get_plugin_option( 'advanced_admin_menu' );
2317		- $settings_url = 'settings' === $admin_menu ? admin_url( 'options-general.php?page=authorizer' ) : admin_url( 'admin.php?page=authorizer' );
	2102	+ $admin_menu = $this->get_plugin_option( 'advanced_admin_menu' );
	2103	+ $settings_url = $admin_menu === 'settings' ? admin_url( 'options-general.php?page=authorizer' ) : admin_url( 'admin.php?page=authorizer' );
2318	2104	array_unshift( $links, '<a href="' . $settings_url . '">' . __( 'Settings', 'authorizer' ) . '</a>' );
2319	2105	return $links;
2320	2106	}
2321	2107
		@@ -2323,12 +2109,11 @@
2323	2109	/**
2324	2110	* Add a link to this plugin's network settings page from the WordPress Plugins page.
2325	2111	* Called from "network_admin_plugin_action_links" filter in __construct() above.
2326	2112	*
2327		- * Filter: network_admin_plugin_action_links_authorizer.php
	2113	+ * @param array $links array of links in the network admin sidebar
2328	2114	*
2329		- * @param array $links Network admin sidebar links.
2330		- * @return array Network admin sidebar links with Authorizer added.
	2115	+ * @return array of links to show in the network admin sidebar.
2331	2116	*/
2332	2117	public function network_admin_plugin_settings_link( $links ) {
2333	2118	$settings_link = '<a href="admin.php?page=authorizer">' . __( 'Network Settings', 'authorizer' ) . '</a>';
2334	2119	array_unshift( $links, $settings_link );
		@@ -2336,33 +2121,32 @@
2336	2121	}
2337	2122
2338	2123
2339	2124	/**
2340		- * Create the options page under Dashboard > Settings.
2341		- *
2342		- * Action: admin_menu
	2125	+ * Create the options page under Dashboard > Settings
	2126	+ * Run on action hook: admin_menu
2343	2127	*/
2344	2128	public function add_plugin_page() {
2345	2129	$admin_menu = $this->get_plugin_option( 'advanced_admin_menu' );
2346		- if ( 'settings' === $admin_menu ) {
	2130	+ if ( $admin_menu === 'settings' ) {
2347	2131	// @see http://codex.wordpress.org/Function_Reference/add_options_page
2348	2132	add_options_page(
2349		- 'Authorizer',
2350		- 'Authorizer',
2351		- 'create_users',
2352		- 'authorizer',
2353		- array( $this, 'create_admin_page' )
	2133	+ 'Authorizer', // Page title
	2134	+ 'Authorizer', // Menu title
	2135	+ 'create_users', // Capability
	2136	+ 'authorizer', // Menu slug
	2137	+ array( $this, 'create_admin_page' ) // function
2354	2138	);
2355	2139	} else {
2356	2140	// @see http://codex.wordpress.org/Function_Reference/add_menu_page
2357	2141	add_menu_page(
2358		- 'Authorizer',
2359		- 'Authorizer',
2360		- 'create_users',
2361		- 'authorizer',
2362		- array( $this, 'create_admin_page' ),
2363		- 'dashicons-groups',
2364		- '99.0018465' // position (decimal is to make overlap with other plugins less likely).
	2142	+ 'Authorizer', // Page title
	2143	+ 'Authorizer', // Menu title
	2144	+ 'create_users', // Capability
	2145	+ 'authorizer', // Menu slug
	2146	+ array( $this, 'create_admin_page' ), // callback
	2147	+ 'dashicons-groups', // icon
	2148	+ '99.0018465' // position (decimal is to make overlap with other plugins less likely)
2365	2149	);
2366	2150	}
2367	2151	}
2368	2152
		@@ -2367,61 +2151,54 @@
2367	2151	}
2368	2152
2369	2153
2370	2154	/**
2371		- * Output the HTML for the options page.
	2155	+ * Output the HTML for the options page
2372	2156	*/
2373		- public function create_admin_page() {
2374		- ?>
	2157	+ public function create_admin_page() { ?>
2375	2158	<div class="wrap">
2376		- <h2><?php esc_html_e( 'Authorizer Settings', 'authorizer' ); ?></h2>
2377		- <form method="post" action="options.php" autocomplete="off">
2378		- <?php
2379		- // This prints out all hidden settings fields.
	2159	+ <h2><?php _e( 'Authorizer Settings', 'authorizer' ); ?></h2>
	2160	+ <form method="post" action="options.php" autocomplete="off"><?php
	2161	+ // This prints out all hidden settings fields
	2162	+ // @see http://codex.wordpress.org/Function_Reference/settings_fields
2380	2163	settings_fields( 'auth_settings_group' );
2381		- // This prints out all the sections.
	2164	+ // This prints out all the sections
	2165	+ // @see http://codex.wordpress.org/Function_Reference/do_settings_sections
2382	2166	do_settings_sections( 'authorizer' );
2383		- submit_button();
2384		- ?>
	2167	+ submit_button(); ?>
2385	2168	</form>
2386		- </div>
2387		- <?php
	2169	+ </div><?php
2388	2170	}
2389	2171
2390	2172
2391	2173	/**
2392	2174	* Load external resources on this plugin's options page.
2393		- *
2394		- * Action: load-settings_page_authorizer
2395		- * Action: load-toplevel_page_authorizer
2396		- * Action: admin_head-index.php
	2175	+ * Run on action hooks: load-settings_page_authorizer, load-toplevel_page_authorizer, admin_head-index.php
2397	2176	*/
2398	2177	public function load_options_page() {
2399	2178	wp_enqueue_script(
2400	2179	'authorizer',
2401	2180	plugins_url( 'js/authorizer.js', __FILE__ ),
2402		- array( 'jquery-effects-shake' ), '2.8.6', true
	2181	+ array( 'jquery-effects-shake' ), '2.7.0', true
2403	2182	);
2404		- wp_localize_script(
2405		- 'authorizer', 'authL10n', array(
2406		- 'baseurl' => get_bloginfo( 'url' ),
2407		- 'saved' => esc_html__( 'Saved', 'authorizer' ),
2408		- 'duplicate' => esc_html__( 'Duplicate', 'authorizer' ),
2409		- 'failed' => esc_html__( 'Failed', 'authorizer' ),
2410		- 'local_wordpress_user' => esc_html__( 'Local WordPress user', 'authorizer' ),
2411		- 'block_ban_user' => esc_html__( 'Block/Ban user', 'authorizer' ),
2412		- 'remove_user' => esc_html__( 'Remove user', 'authorizer' ),
2413		- 'no_users_in' => esc_html__( 'No users in', 'authorizer' ),
2414		- 'save_changes' => esc_html__( 'Save Changes', 'authorizer' ),
2415		- 'private_pages' => esc_html__( 'Private Pages', 'authorizer' ),
2416		- 'public_pages' => esc_html__( 'Public Pages', 'authorizer' ),
2417		- 'first_page' => esc_html__( 'First page' ),
2418		- 'previous_page' => esc_html__( 'Previous page' ),
2419		- 'next_page' => esc_html__( 'Next page' ),
2420		- 'last_page' => esc_html__( 'Last page' ),
2421		- 'is_network_admin' => is_network_admin() ? '1' : '0',
2422		- )
2423		- );
	2183	+ wp_localize_script( 'authorizer', 'auth_L10n', array(
	2184	+ 'baseurl' => get_bloginfo( 'url' ),
	2185	+ 'saved' => esc_html__( 'Saved', 'authorizer' ),
	2186	+ 'duplicate' => esc_html__( 'Duplicate', 'authorizer' ),
	2187	+ 'failed' => esc_html__( 'Failed', 'authorizer' ),
	2188	+ 'local_wordpress_user' => esc_html__( 'Local WordPress user', 'authorizer' ),
	2189	+ 'block_ban_user' => esc_html__( 'Block/Ban user', 'authorizer' ),
	2190	+ 'remove_user' => esc_html__( 'Remove user', 'authorizer' ),
	2191	+ 'no_users_in' => esc_html__( 'No users in', 'authorizer' ),
	2192	+ 'save_changes' => esc_html__( 'Save Changes', 'authorizer' ),
	2193	+ 'private_pages' => esc_html__( 'Private Pages', 'authorizer' ),
	2194	+ 'public_pages' => esc_html__( 'Public Pages', 'authorizer' ),
	2195	+ 'first_page' => esc_html__( 'First page' ),
	2196	+ 'previous_page' => esc_html__( 'Previous page' ),
	2197	+ 'next_page' => esc_html__( 'Next page' ),
	2198	+ 'last_page' => esc_html__( 'Last page' ),
	2199	+ 'is_network_admin' => is_network_admin(),
	2200	+ ));
2424	2201
2425	2202	wp_enqueue_script(
2426	2203	'jquery-autogrow-textarea',
2427	2204	plugins_url( 'vendor/jquery.autogrow-textarea/jquery.autogrow-textarea.js', __FILE__ ),
		@@ -2433,9 +2210,9 @@
2433	2210	plugins_url( 'vendor/jquery.multi-select/js/jquery.multi-select.js', __FILE__ ),
2434	2211	array( 'jquery' ), '1.8', true
2435	2212	);
2436	2213
2437		- wp_register_style( 'authorizer-css', plugins_url( 'css/authorizer.css', __FILE__ ), array(), '2.7.3' );
	2214	+ wp_register_style( 'authorizer-css', plugins_url( 'css/authorizer.css', __FILE__ ), array(), '2.7.0' );
2438	2215	wp_enqueue_style( 'authorizer-css' );
2439	2216
2440	2217	wp_register_style( 'jquery-multi-select-css', plugins_url( 'vendor/jquery.multi-select/css/multi-select.css', __FILE__ ), array(), '1.8' );
2441	2218	wp_enqueue_style( 'jquery-multi-select-css' );
		@@ -2446,26 +2223,18 @@
2446	2223
2447	2224
2448	2225	/**
2449	2226	* Show custom admin notice.
2450		- *
2451		- * Note: currently unused, but if anywhere we:
2452		- * add_option( 'auth_settings_advanced_admin_notice, 'Your message.' );
2453		- * It will display and then delete that message on the admin dashboard.
2454		- *
2455		- * Filter: admin_notices
2456		- * filter: network_admin_notices
	2227	+ * Filter: admin_notice
2457	2228	*/
2458		- public function show_advanced_admin_notice() {
	2229	+ function show_advanced_admin_notice() {
2459	2230	$notice = get_option( 'auth_settings_advanced_admin_notice' );
2460	2231	delete_option( 'auth_settings_advanced_admin_notice' );
2461	2232
2462		- if ( $notice && strlen( $notice ) > 0 ) {
2463		- ?>
	2233	+ if ( $notice && strlen( $notice ) > 0 ) { ?>
2464	2234	<div class="error">
2465		- <p><?php echo wp_kses( $notice, $this->allowed_html ); ?></p>
2466		- </div>
2467		- <?php
	2235	+ <p><?php echo $notice; ?></p>
	2236	+ </div><?php
2468	2237	}
2469	2238	}
2470	2239
2471	2240
		@@ -2470,11 +2239,9 @@
2470	2239
2471	2240
2472	2241	/**
2473	2242	* Add notices to the top of the options page.
2474		- *
2475		- * Action: load-settings_page_authorizer > admin_notices
2476		- *
	2243	+ * Run on action hook chain: load-settings_page_authorizer > admin_notices
2477	2244	* Description: Check for invalid settings combinations and show a warning message, e.g.:
2478	2245	* if ( cas url inaccessible ) : ?>
2479	2246	* <div class='updated settings-error'><p>Can't reach CAS server.</p></div>
2480	2247	* <?php endif;
		@@ -2480,23 +2247,20 @@
2480	2247	* <?php endif;
2481	2248	*/
2482	2249	public function admin_notices() {
2483	2250	// Grab plugin settings.
2484		- $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
	2251	+ $auth_settings = $this->get_plugin_options( SINGLE_ADMIN, 'allow override' );
2485	2252
2486		- if ( '1' === $auth_settings['cas'] ) :
	2253	+ if ( $auth_settings['cas'] === '1' ) :
2487	2254	// Check if provided CAS URL is accessible.
2488		- $protocol = in_array( strval( $auth_settings['cas_port'] ), array( '80', '8080' ), true ) ? 'http' : 'https';
2489		- $cas_url = $protocol . '://' . $auth_settings['cas_host'] . ':' . $auth_settings['cas_port'] . $auth_settings['cas_path'];
2490		- $legacy_cas_url = trailingslashit( $cas_url ) . 'login'; // Check the specific CAS login endpoint (old; some servers don't register a ./login endpoint, use serviceValidate instead).
2491		- $cas_url = trailingslashit( $cas_url ) . 'serviceValidate'; // Check the specific CAS login endpoint.
2492		- if ( ! $this->url_is_accessible( $cas_url ) && ! $this->url_is_accessible( $legacy_cas_url ) ) :
2493		- $authorizer_options_url = 'settings' === $auth_settings['advanced_admin_menu'] ? admin_url( 'options-general.php?page=authorizer' ) : admin_url( '?page=authorizer' );
2494		- ?>
2495		- <div class='notice notice-warning is-dismissible'>
2496		- <p><?php esc_html_e( "Can't reach CAS server. Please provide", 'authorizer' ); ?> <a href='<?php echo esc_attr( $authorizer_options_url ); ?>&tab=external'><?php esc_html_e( 'accurate CAS settings', 'authorizer' ); ?></a> <?php esc_html_e( 'if you intend to use it.', 'authorizer' ); ?></p>
2497		- </div>
2498		- <?php
	2255	+ $protocol = in_array( $auth_settings['cas_port'], array( '80', '8080' ) ) ? 'http' : 'https';
	2256	+ $cas_url = $protocol . '://' . $auth_settings['cas_host'] . ':' . $auth_settings['cas_port'] . $auth_settings['cas_path'];
	2257	+ $cas_url = trailingslashit( $cas_url ) . 'login'; // Check the specific CAS login endpoint
	2258	+ if ( ! $this->url_is_accessible( $cas_url ) ) :
	2259	+ $authorizer_options_url = $auth_settings['advanced_admin_menu'] === 'settings' ? admin_url( 'options-general.php?page=authorizer' ) : admin_url( '?page=authorizer' );
	2260	+ ?><div class='notice notice-warning is-dismissible'>
	2261	+ <p><?php _e( "Can't reach CAS server. Please provide", 'authorizer' ); ?> <a href='<?php echo $authorizer_options_url; ?>&tab=external'><?php _e( 'accurate CAS settings', 'authorizer' ); ?></a> <?php _e( 'if you intend to use it.', 'authorizer' ); ?></p>
	2262	+ </div><?php
2499	2263	endif;
2500	2264	endif;
2501	2265	}
2502	2266
		@@ -2501,430 +2265,427 @@
2501	2265	}
2502	2266
2503	2267
2504	2268	/**
2505		- * Create sections and options.
2506		- *
2507		- * Action: admin_init
	2269	+ * Create sections and options
	2270	+ * Run on action hook: admin_init
2508	2271	*/
2509	2272	public function page_init() {
2510		- /**
2511		- * Create one setting that holds all the options (array).
2512		- *
2513		- * @see http://codex.wordpress.org/Function_Reference/register_setting
2514		- * @see http://codex.wordpress.org/Function_Reference/add_settings_section
2515		- * @see http://codex.wordpress.org/Function_Reference/add_settings_field
2516		- */
	2273	+ // Create one setting that holds all the options (array)
	2274	+ // @see http://codex.wordpress.org/Function_Reference/register_setting
	2275	+ // @see http://codex.wordpress.org/Function_Reference/add_settings_section
	2276	+ // @see http://codex.wordpress.org/Function_Reference/add_settings_field
2517	2277	register_setting(
2518		- 'auth_settings_group',
2519		- 'auth_settings',
2520		- array( $this, 'sanitize_options' )
	2278	+ 'auth_settings_group', // Option group
	2279	+ 'auth_settings', // Option name
	2280	+ array( $this, 'sanitize_options' ) // Sanitize callback
2521	2281	);
2522	2282
2523	2283	add_settings_section(
2524		- 'auth_settings_tabs',
2525		- '',
2526		- array( $this, 'print_section_info_tabs' ),
2527		- 'authorizer'
	2284	+ 'auth_settings_tabs', // HTML element ID
	2285	+ '', // HTML element Title
	2286	+ array( $this, 'print_section_info_tabs' ), // Callback (echos section content)
	2287	+ 'authorizer' // Page this section is shown on (slug)
2528	2288	);
2529	2289
2530		- // Create Access Lists section.
	2290	+ // Create Access Lists section
2531	2291	add_settings_section(
2532		- 'auth_settings_lists',
2533		- '',
2534		- array( $this, 'print_section_info_access_lists' ),
2535		- 'authorizer'
	2292	+ 'auth_settings_lists', // HTML element ID
	2293	+ '', // HTML element Title
	2294	+ array( $this, 'print_section_info_access_lists' ), // Callback (echos section content)
	2295	+ 'authorizer' // Page this section is shown on (slug)
2536	2296	);
2537	2297
2538		- // Create Login Access section.
	2298	+ // Create Login Access section
2539	2299	add_settings_section(
2540		- 'auth_settings_access_login',
2541		- '',
2542		- array( $this, 'print_section_info_access_login' ),
2543		- 'authorizer'
	2300	+ 'auth_settings_access_login', // HTML element ID
	2301	+ '', // HTML element Title
	2302	+ array( $this, 'print_section_info_access_login' ), // Callback (echos section content)
	2303	+ 'authorizer' // Page this section is shown on (slug)
2544	2304	);
2545	2305	add_settings_field(
2546		- 'auth_settings_access_who_can_login',
2547		- __( 'Who can log into the site?', 'authorizer' ),
2548		- array( $this, 'print_radio_auth_access_who_can_login' ),
2549		- 'authorizer',
2550		- 'auth_settings_access_login'
	2306	+ 'auth_settings_access_who_can_login', // HTML element ID
	2307	+ __( 'Who can log into the site?', 'authorizer' ), // HTML element Title
	2308	+ array( $this, 'print_radio_auth_access_who_can_login' ), // Callback (echos form element)
	2309	+ 'authorizer', // Page this setting is shown on (slug)
	2310	+ 'auth_settings_access_login' // Section this setting is shown on
2551	2311	);
2552	2312	add_settings_field(
2553		- 'auth_settings_access_role_receive_pending_emails',
2554		- __( 'Which role should receive email notifications about pending users?', 'authorizer' ),
2555		- array( $this, 'print_select_auth_access_role_receive_pending_emails' ),
2556		- 'authorizer',
2557		- 'auth_settings_access_login'
	2313	+ 'auth_settings_access_role_receive_pending_emails', // HTML element ID
	2314	+ __( 'Which role should receive email notifications about pending users?', 'authorizer' ), // HTML element Title
	2315	+ array( $this, 'print_select_auth_access_role_receive_pending_emails' ), // Callback (echos form element)
	2316	+ 'authorizer', // Page this setting is shown on (slug)
	2317	+ 'auth_settings_access_login' // Section this setting is shown on
2558	2318	);
2559	2319	add_settings_field(
2560		- 'auth_settings_access_pending_redirect_to_message',
2561		- __( 'What message should pending users see after attempting to log in?', 'authorizer' ),
2562		- array( $this, 'print_wysiwyg_auth_access_pending_redirect_to_message' ),
2563		- 'authorizer',
2564		- 'auth_settings_access_login'
	2320	+ 'auth_settings_access_pending_redirect_to_message', // HTML element ID
	2321	+ __( 'What message should pending users see after attempting to log in?', 'authorizer' ), // HTML element Title
	2322	+ array( $this, 'print_wysiwyg_auth_access_pending_redirect_to_message' ), // Callback (echos form element)
	2323	+ 'authorizer', // Page this setting is shown on (slug)
	2324	+ 'auth_settings_access_login' // Section this setting is shown on
2565	2325	);
2566	2326	add_settings_field(
2567		- 'auth_settings_access_blocked_redirect_to_message',
2568		- __( 'What message should blocked users see after attempting to log in?', 'authorizer' ),
2569		- array( $this, 'print_wysiwyg_auth_access_blocked_redirect_to_message' ),
2570		- 'authorizer',
2571		- 'auth_settings_access_login'
	2327	+ 'auth_settings_access_blocked_redirect_to_message', // HTML element ID
	2328	+ __( 'What message should blocked users see after attempting to log in?', 'authorizer' ), // HTML element Title
	2329	+ array( $this, 'print_wysiwyg_auth_access_blocked_redirect_to_message' ), // Callback (echos form element)
	2330	+ 'authorizer', // Page this setting is shown on (slug)
	2331	+ 'auth_settings_access_login' // Section this setting is shown on
2572	2332	);
2573	2333	add_settings_field(
2574		- 'auth_settings_access_should_email_approved_users',
2575		- __( 'Send welcome email to new approved users?', 'authorizer' ),
2576		- array( $this, 'print_checkbox_auth_access_should_email_approved_users' ),
2577		- 'authorizer',
2578		- 'auth_settings_access_login'
	2334	+ 'auth_settings_access_should_email_approved_users', // HTML element ID
	2335	+ __( 'Send welcome email to new approved users?', 'authorizer' ), // HTML element Title
	2336	+ array( $this, 'print_checkbox_auth_access_should_email_approved_users' ), // Callback (echos form element)
	2337	+ 'authorizer', // Page this setting is shown on (slug)
	2338	+ 'auth_settings_access_login' // Section this setting is shown on
2579	2339	);
2580	2340	add_settings_field(
2581		- 'auth_settings_access_email_approved_users_subject',
2582		- __( 'Welcome email subject', 'authorizer' ),
2583		- array( $this, 'print_text_auth_access_email_approved_users_subject' ),
2584		- 'authorizer',
2585		- 'auth_settings_access_login'
	2341	+ 'auth_settings_access_email_approved_users_subject', // HTML element ID
	2342	+ __( 'Welcome email subject', 'authorizer' ), // HTML element Title
	2343	+ array( $this, 'print_text_auth_access_email_approved_users_subject' ), // Callback (echos form element)
	2344	+ 'authorizer', // Page this setting is shown on (slug)
	2345	+ 'auth_settings_access_login' // Section this setting is shown on
2586	2346	);
2587	2347	add_settings_field(
2588		- 'auth_settings_access_email_approved_users_body',
2589		- __( 'Welcome email body', 'authorizer' ),
2590		- array( $this, 'print_wysiwyg_auth_access_email_approved_users_body' ),
2591		- 'authorizer',
2592		- 'auth_settings_access_login'
	2348	+ 'auth_settings_access_email_approved_users_body', // HTML element ID
	2349	+ __( 'Welcome email body', 'authorizer' ), // HTML element Title
	2350	+ array( $this, 'print_wysiwyg_auth_access_email_approved_users_body' ), // Callback (echos form element)
	2351	+ 'authorizer', // Page this setting is shown on (slug)
	2352	+ 'auth_settings_access_login' // Section this setting is shown on
2593	2353	);
2594	2354
2595		- // Create Public Access section.
	2355	+
	2356	+ // Create Public Access section
2596	2357	add_settings_section(
2597		- 'auth_settings_access_public',
2598		- '',
2599		- array( $this, 'print_section_info_access_public' ),
2600		- 'authorizer'
	2358	+ 'auth_settings_access_public', // HTML element ID
	2359	+ '', // HTML element Title
	2360	+ array( $this, 'print_section_info_access_public' ), // Callback (echos section content)
	2361	+ 'authorizer' // Page this section is shown on (slug)
2601	2362	);
2602	2363	add_settings_field(
2603		- 'auth_settings_access_who_can_view',
2604		- __( 'Who can view the site?', 'authorizer' ),
2605		- array( $this, 'print_radio_auth_access_who_can_view' ),
2606		- 'authorizer',
2607		- 'auth_settings_access_public'
	2364	+ 'auth_settings_access_who_can_view', // HTML element ID
	2365	+ __( 'Who can view the site?', 'authorizer' ), // HTML element Title
	2366	+ array( $this, 'print_radio_auth_access_who_can_view' ), // Callback (echos form element)
	2367	+ 'authorizer', // Page this setting is shown on (slug)
	2368	+ 'auth_settings_access_public' // Section this setting is shown on
2608	2369	);
2609	2370	add_settings_field(
2610		- 'auth_settings_access_public_pages',
2611		- __( 'What pages (if any) should be available to everyone?', 'authorizer' ),
2612		- array( $this, 'print_multiselect_auth_access_public_pages' ),
2613		- 'authorizer',
2614		- 'auth_settings_access_public'
	2371	+ 'auth_settings_access_public_pages', // HTML element ID
	2372	+ __( 'What pages (if any) should be available to everyone?', 'authorizer' ), // HTML element Title
	2373	+ array( $this, 'print_multiselect_auth_access_public_pages' ), // Callback (echos form element)
	2374	+ 'authorizer', // Page this setting is shown on (slug)
	2375	+ 'auth_settings_access_public' // Section this setting is shown on
2615	2376	);
2616	2377	add_settings_field(
2617		- 'auth_settings_access_redirect',
2618		- __( 'What happens to people without access when they visit a private page?', 'authorizer' ),
2619		- array( $this, 'print_radio_auth_access_redirect' ),
2620		- 'authorizer',
2621		- 'auth_settings_access_public'
	2378	+ 'auth_settings_access_redirect', // HTML element ID
	2379	+ __( 'What happens to people without access when they visit a private page?', 'authorizer' ), // HTML element Title
	2380	+ array( $this, 'print_radio_auth_access_redirect' ), // Callback (echos form element)
	2381	+ 'authorizer', // Page this setting is shown on (slug)
	2382	+ 'auth_settings_access_public' // Section this setting is shown on
2622	2383	);
2623	2384	add_settings_field(
2624		- 'auth_settings_access_public_warning',
2625		- __( 'What happens to people without access when they visit a public page?', 'authorizer' ),
2626		- array( $this, 'print_radio_auth_access_public_warning' ),
2627		- 'authorizer',
2628		- 'auth_settings_access_public'
	2385	+ 'auth_settings_access_public_warning', // HTML element ID
	2386	+ __( 'What happens to people without access when they visit a public page?', 'authorizer' ), // HTML element Title
	2387	+ array( $this, 'print_radio_auth_access_public_warning' ), // Callback (echos form element)
	2388	+ 'authorizer', // Page this setting is shown on (slug)
	2389	+ 'auth_settings_access_public' // Section this setting is shown on
2629	2390	);
2630	2391	add_settings_field(
2631		- 'auth_settings_access_redirect_to_message',
2632		- __( 'What message should people without access see?', 'authorizer' ),
2633		- array( $this, 'print_wysiwyg_auth_access_redirect_to_message' ),
2634		- 'authorizer',
2635		- 'auth_settings_access_public'
	2392	+ 'auth_settings_access_redirect_to_message', // HTML element ID
	2393	+ __( 'What message should people without access see?', 'authorizer' ), // HTML element Title
	2394	+ array( $this, 'print_wysiwyg_auth_access_redirect_to_message' ), // Callback (echos form element)
	2395	+ 'authorizer', // Page this setting is shown on (slug)
	2396	+ 'auth_settings_access_public' // Section this setting is shown on
2636	2397	);
2637	2398
2638		- // Create External Service Settings section.
	2399	+ // Create External Service Settings section
2639	2400	add_settings_section(
2640		- 'auth_settings_external',
2641		- '',
2642		- array( $this, 'print_section_info_external' ),
2643		- 'authorizer'
	2401	+ 'auth_settings_external', // HTML element ID
	2402	+ '', // HTML element Title
	2403	+ array( $this, 'print_section_info_external' ), // Callback (echos section content)
	2404	+ 'authorizer' // Page this section is shown on (slug)
2644	2405	);
2645	2406	add_settings_field(
2646		- 'auth_settings_access_default_role',
2647		- __( 'Default role for new users', 'authorizer' ),
2648		- array( $this, 'print_select_auth_access_default_role' ),
2649		- 'authorizer',
2650		- 'auth_settings_external'
	2407	+ 'auth_settings_access_default_role', // HTML element ID
	2408	+ __( 'Default role for new users', 'authorizer' ), // HTML element Title
	2409	+ array( $this, 'print_select_auth_access_default_role' ), // Callback (echos form element)
	2410	+ 'authorizer', // Page this setting is shown on (slug)
	2411	+ 'auth_settings_external' // Section this setting is shown on
2651	2412	);
2652	2413	add_settings_field(
2653		- 'auth_settings_external_google',
2654		- __( 'Google Logins', 'authorizer' ),
2655		- array( $this, 'print_checkbox_auth_external_google' ),
2656		- 'authorizer',
2657		- 'auth_settings_external'
	2414	+ 'auth_settings_external_google', // HTML element ID
	2415	+ __( 'Google Logins', 'authorizer' ), // HTML element Title
	2416	+ array( $this, 'print_checkbox_auth_external_google' ), // Callback (echos form element)
	2417	+ 'authorizer', // Page this setting is shown on (slug)
	2418	+ 'auth_settings_external' // Section this setting is shown on
2658	2419	);
2659	2420	add_settings_field(
2660		- 'auth_settings_google_clientid',
2661		- __( 'Google Client ID', 'authorizer' ),
2662		- array( $this, 'print_text_google_clientid' ),
2663		- 'authorizer',
2664		- 'auth_settings_external'
	2421	+ 'auth_settings_google_clientid', // HTML element ID
	2422	+ __( 'Google Client ID', 'authorizer' ), // HTML element Title
	2423	+ array( $this, 'print_text_google_clientid' ), // Callback (echos form element)
	2424	+ 'authorizer', // Page this setting is shown on (slug)
	2425	+ 'auth_settings_external' // Section this setting is shown on
2665	2426	);
2666	2427	add_settings_field(
2667		- 'auth_settings_google_clientsecret',
2668		- __( 'Google Client Secret', 'authorizer' ),
2669		- array( $this, 'print_text_google_clientsecret' ),
2670		- 'authorizer',
2671		- 'auth_settings_external'
	2428	+ 'auth_settings_google_clientsecret', // HTML element ID
	2429	+ __( 'Google Client Secret', 'authorizer' ), // HTML element Title
	2430	+ array( $this, 'print_text_google_clientsecret' ), // Callback (echos form element)
	2431	+ 'authorizer', // Page this setting is shown on (slug)
	2432	+ 'auth_settings_external' // Section this setting is shown on
2672	2433	);
2673	2434	add_settings_field(
2674		- 'auth_settings_google_hosteddomain',
2675		- __( 'Google Hosted Domain', 'authorizer' ),
2676		- array( $this, 'print_text_google_hosteddomain' ),
2677		- 'authorizer',
2678		- 'auth_settings_external'
	2435	+ 'auth_settings_google_hosteddomain', // HTML element ID
	2436	+ __( 'Google Hosted Domain', 'authorizer' ), // HTML element Title
	2437	+ array( $this, 'print_text_google_hosteddomain' ), // Callback (echos form element)
	2438	+ 'authorizer', // Page this setting is shown on (slug)
	2439	+ 'auth_settings_external' // Section this setting is shown on
2679	2440	);
2680	2441	add_settings_field(
2681		- 'auth_settings_external_cas',
2682		- __( 'CAS Logins', 'authorizer' ),
2683		- array( $this, 'print_checkbox_auth_external_cas' ),
2684		- 'authorizer',
2685		- 'auth_settings_external'
	2442	+ 'auth_settings_external_cas', // HTML element ID
	2443	+ __( 'CAS Logins', 'authorizer' ), // HTML element Title
	2444	+ array( $this, 'print_checkbox_auth_external_cas' ), // Callback (echos form element)
	2445	+ 'authorizer', // Page this setting is shown on (slug)
	2446	+ 'auth_settings_external' // Section this setting is shown on
2686	2447	);
2687	2448	add_settings_field(
2688		- 'auth_settings_cas_custom_label',
2689		- __( 'CAS custom label', 'authorizer' ),
2690		- array( $this, 'print_text_cas_custom_label' ),
2691		- 'authorizer',
2692		- 'auth_settings_external'
	2449	+ 'auth_settings_cas_custom_label', // HTML element ID
	2450	+ __( 'CAS custom label', 'authorizer' ), // HTML element Title
	2451	+ array( $this, 'print_text_cas_custom_label' ), // Callback (echos form element)
	2452	+ 'authorizer', // Page this setting is shown on (slug)
	2453	+ 'auth_settings_external' // Section this setting is shown on
2693	2454	);
2694	2455	add_settings_field(
2695		- 'auth_settings_cas_host',
2696		- __( 'CAS server hostname', 'authorizer' ),
2697		- array( $this, 'print_text_cas_host' ),
2698		- 'authorizer',
2699		- 'auth_settings_external'
	2456	+ 'auth_settings_cas_host', // HTML element ID
	2457	+ __( 'CAS server hostname', 'authorizer' ), // HTML element Title
	2458	+ array( $this, 'print_text_cas_host' ), // Callback (echos form element)
	2459	+ 'authorizer', // Page this setting is shown on (slug)
	2460	+ 'auth_settings_external' // Section this setting is shown on
2700	2461	);
2701	2462	add_settings_field(
2702		- 'auth_settings_cas_port',
2703		- __( 'CAS server port', 'authorizer' ),
2704		- array( $this, 'print_text_cas_port' ),
2705		- 'authorizer',
2706		- 'auth_settings_external'
	2463	+ 'auth_settings_cas_port', // HTML element ID
	2464	+ __( 'CAS server port', 'authorizer' ), // HTML element Title
	2465	+ array( $this, 'print_text_cas_port' ), // Callback (echos form element)
	2466	+ 'authorizer', // Page this setting is shown on (slug)
	2467	+ 'auth_settings_external' // Section this setting is shown on
2707	2468	);
2708	2469	add_settings_field(
2709		- 'auth_settings_cas_path',
2710		- __( 'CAS server path/context', 'authorizer' ),
2711		- array( $this, 'print_text_cas_path' ),
2712		- 'authorizer',
2713		- 'auth_settings_external'
	2470	+ 'auth_settings_cas_path', // HTML element ID
	2471	+ __( 'CAS server path/context', 'authorizer' ), // HTML element Title
	2472	+ array( $this, 'print_text_cas_path' ), // Callback (echos form element)
	2473	+ 'authorizer', // Page this setting is shown on (slug)
	2474	+ 'auth_settings_external' // Section this setting is shown on
2714	2475	);
2715	2476	add_settings_field(
2716		- 'auth_settings_cas_version',
2717		- 'CAS server version',
2718		- array( $this, 'print_select_cas_version' ),
2719		- 'authorizer',
2720		- 'auth_settings_external'
	2477	+ 'auth_settings_cas_version', // HTML element ID
	2478	+ 'CAS server version', // HTML element Title
	2479	+ array( $this, 'print_select_cas_version' ), // Callback (echos form element)
	2480	+ 'authorizer', // Page this setting is shown on (slug)
	2481	+ 'auth_settings_external' // Section this setting is shown on
2721	2482	);
2722	2483	add_settings_field(
2723		- 'auth_settings_cas_attr_email',
2724		- __( 'CAS attribute containing email address', 'authorizer' ),
2725		- array( $this, 'print_text_cas_attr_email' ),
2726		- 'authorizer',
2727		- 'auth_settings_external'
	2484	+ 'auth_settings_cas_attr_email', // HTML element ID
	2485	+ __( 'CAS attribute containing email address', 'authorizer' ), // HTML element Title
	2486	+ array( $this, 'print_text_cas_attr_email' ), // Callback (echos form element)
	2487	+ 'authorizer', // Page this setting is shown on (slug)
	2488	+ 'auth_settings_external' // Section this setting is shown on
2728	2489	);
2729	2490	add_settings_field(
2730		- 'auth_settings_cas_attr_first_name',
2731		- __( 'CAS attribute containing first name', 'authorizer' ),
2732		- array( $this, 'print_text_cas_attr_first_name' ),
2733		- 'authorizer',
2734		- 'auth_settings_external'
	2491	+ 'auth_settings_cas_attr_first_name', // HTML element ID
	2492	+ __( 'CAS attribute containing first name', 'authorizer' ), // HTML element Title
	2493	+ array( $this, 'print_text_cas_attr_first_name' ), // Callback (echos form element)
	2494	+ 'authorizer', // Page this setting is shown on (slug)
	2495	+ 'auth_settings_external' // Section this setting is shown on
2735	2496	);
2736	2497	add_settings_field(
2737		- 'auth_settings_cas_attr_last_name',
2738		- __( 'CAS attribute containing last name', 'authorizer' ),
2739		- array( $this, 'print_text_cas_attr_last_name' ),
2740		- 'authorizer',
2741		- 'auth_settings_external'
	2498	+ 'auth_settings_cas_attr_last_name', // HTML element ID
	2499	+ __( 'CAS attribute containing last name', 'authorizer' ), // HTML element Title
	2500	+ array( $this, 'print_text_cas_attr_last_name' ), // Callback (echos form element)
	2501	+ 'authorizer', // Page this setting is shown on (slug)
	2502	+ 'auth_settings_external' // Section this setting is shown on
2742	2503	);
2743	2504	add_settings_field(
2744		- 'auth_settings_cas_attr_update_on_login',
2745		- __( 'CAS attribute update', 'authorizer' ),
2746		- array( $this, 'print_checkbox_cas_attr_update_on_login' ),
2747		- 'authorizer',
2748		- 'auth_settings_external'
	2505	+ 'auth_settings_cas_attr_update_on_login', // HTML element ID
	2506	+ __( 'CAS attribute update', 'authorizer' ), // HTML element Title
	2507	+ array( $this, 'print_checkbox_cas_attr_update_on_login' ), // Callback (echos form element)
	2508	+ 'authorizer', // Page this setting is shown on (slug)
	2509	+ 'auth_settings_external' // Section this setting is shown on
2749	2510	);
2750	2511	add_settings_field(
2751		- 'auth_settings_cas_auto_login',
2752		- __( 'CAS automatic login', 'authorizer' ),
2753		- array( $this, 'print_checkbox_cas_auto_login' ),
2754		- 'authorizer',
2755		- 'auth_settings_external'
	2512	+ 'auth_settings_cas_auto_login', // HTML element ID
	2513	+ __( 'CAS automatic login', 'authorizer' ), // HTML element Title
	2514	+ array( $this, 'print_checkbox_cas_auto_login' ), // Callback (echos form element)
	2515	+ 'authorizer', // Page this setting is shown on (slug)
	2516	+ 'auth_settings_external' // Section this setting is shown on
2756	2517	);
2757	2518	add_settings_field(
2758		- 'auth_settings_external_ldap',
2759		- __( 'LDAP Logins', 'authorizer' ),
2760		- array( $this, 'print_checkbox_auth_external_ldap' ),
2761		- 'authorizer',
2762		- 'auth_settings_external'
	2519	+ 'auth_settings_external_ldap', // HTML element ID
	2520	+ __( 'LDAP Logins', 'authorizer' ), // HTML element Title
	2521	+ array( $this, 'print_checkbox_auth_external_ldap' ), // Callback (echos form element)
	2522	+ 'authorizer', // Page this setting is shown on (slug)
	2523	+ 'auth_settings_external' // Section this setting is shown on
2763	2524	);
2764	2525	add_settings_field(
2765		- 'auth_settings_ldap_host',
2766		- __( 'LDAP Host', 'authorizer' ),
2767		- array( $this, 'print_text_ldap_host' ),
2768		- 'authorizer',
2769		- 'auth_settings_external'
	2526	+ 'auth_settings_ldap_host', // HTML element ID
	2527	+ __( 'LDAP Host', 'authorizer' ), // HTML element Title
	2528	+ array( $this, 'print_text_ldap_host' ), // Callback (echos form element)
	2529	+ 'authorizer', // Page this setting is shown on (slug)
	2530	+ 'auth_settings_external' // Section this setting is shown on
2770	2531	);
2771	2532	add_settings_field(
2772		- 'auth_settings_ldap_port',
2773		- __( 'LDAP Port', 'authorizer' ),
2774		- array( $this, 'print_text_ldap_port' ),
2775		- 'authorizer',
2776		- 'auth_settings_external'
	2533	+ 'auth_settings_ldap_port', // HTML element ID
	2534	+ __( 'LDAP Port', 'authorizer' ), // HTML element Title
	2535	+ array( $this, 'print_text_ldap_port' ), // Callback (echos form element)
	2536	+ 'authorizer', // Page this setting is shown on (slug)
	2537	+ 'auth_settings_external' // Section this setting is shown on
2777	2538	);
2778	2539	add_settings_field(
2779		- 'auth_settings_ldap_tls',
2780		- __( 'Use TLS', 'authorizer' ),
2781		- array( $this, 'print_checkbox_ldap_tls' ),
2782		- 'authorizer',
2783		- 'auth_settings_external'
	2540	+ 'auth_settings_ldap_tls', // HTML element ID
	2541	+ __( 'Use TLS', 'authorizer' ), // HTML element Title
	2542	+ array( $this, 'print_checkbox_ldap_tls' ), // Callback (echos form element)
	2543	+ 'authorizer', // Page this setting is shown on (slug)
	2544	+ 'auth_settings_external' // Section this setting is shown on
2784	2545	);
2785	2546	add_settings_field(
2786		- 'auth_settings_ldap_search_base',
2787		- __( 'LDAP Search Base', 'authorizer' ),
2788		- array( $this, 'print_text_ldap_search_base' ),
2789		- 'authorizer',
2790		- 'auth_settings_external'
	2547	+ 'auth_settings_ldap_search_base', // HTML element ID
	2548	+ __( 'LDAP Search Base', 'authorizer' ), // HTML element Title
	2549	+ array( $this, 'print_text_ldap_search_base' ), // Callback (echos form element)
	2550	+ 'authorizer', // Page this setting is shown on (slug)
	2551	+ 'auth_settings_external' // Section this setting is shown on
2791	2552	);
2792	2553	add_settings_field(
2793		- 'auth_settings_ldap_uid',
2794		- __( 'LDAP attribute containing username', 'authorizer' ),
2795		- array( $this, 'print_text_ldap_uid' ),
2796		- 'authorizer',
2797		- 'auth_settings_external'
	2554	+ 'auth_settings_ldap_uid', // HTML element ID
	2555	+ __( 'LDAP attribute containing username', 'authorizer' ), // HTML element Title
	2556	+ array( $this, 'print_text_ldap_uid' ), // Callback (echos form element)
	2557	+ 'authorizer', // Page this setting is shown on (slug)
	2558	+ 'auth_settings_external' // Section this setting is shown on
2798	2559	);
2799	2560	add_settings_field(
2800		- 'auth_settings_ldap_attr_email',
2801		- __( 'LDAP attribute containing email address', 'authorizer' ),
2802		- array( $this, 'print_text_ldap_attr_email' ),
2803		- 'authorizer',
2804		- 'auth_settings_external'
	2561	+ 'auth_settings_ldap_attr_email', // HTML element ID
	2562	+ __( 'LDAP attribute containing email address', 'authorizer' ), // HTML element Title
	2563	+ array( $this, 'print_text_ldap_attr_email' ), // Callback (echos form element)
	2564	+ 'authorizer', // Page this setting is shown on (slug)
	2565	+ 'auth_settings_external' // Section this setting is shown on
2805	2566	);
2806	2567	add_settings_field(
2807		- 'auth_settings_ldap_user',
2808		- __( 'LDAP Directory User', 'authorizer' ),
2809		- array( $this, 'print_text_ldap_user' ),
2810		- 'authorizer',
2811		- 'auth_settings_external'
	2568	+ 'auth_settings_ldap_user', // HTML element ID
	2569	+ __( 'LDAP Directory User', 'authorizer' ), // HTML element Title
	2570	+ array( $this, 'print_text_ldap_user' ), // Callback (echos form element)
	2571	+ 'authorizer', // Page this setting is shown on (slug)
	2572	+ 'auth_settings_external' // Section this setting is shown on
2812	2573	);
2813	2574	add_settings_field(
2814		- 'auth_settings_ldap_password',
2815		- __( 'LDAP Directory User Password', 'authorizer' ),
2816		- array( $this, 'print_password_ldap_password' ),
2817		- 'authorizer',
2818		- 'auth_settings_external'
	2575	+ 'auth_settings_ldap_password', // HTML element ID
	2576	+ __( 'LDAP Directory User Password', 'authorizer' ), // HTML element Title
	2577	+ array( $this, 'print_password_ldap_password' ), // Callback (echos form element)
	2578	+ 'authorizer', // Page this setting is shown on (slug)
	2579	+ 'auth_settings_external' // Section this setting is shown on
2819	2580	);
2820	2581	add_settings_field(
2821		- 'auth_settings_ldap_lostpassword_url',
2822		- __( 'Custom lost password URL', 'authorizer' ),
2823		- array( $this, 'print_text_ldap_lostpassword_url' ),
2824		- 'authorizer',
2825		- 'auth_settings_external'
	2582	+ 'auth_settings_ldap_lostpassword_url', // HTML element ID
	2583	+ __( 'Custom lost password URL', 'authorizer' ), // HTML element Title
	2584	+ array( $this, 'print_text_ldap_lostpassword_url' ), // Callback (echos form element)
	2585	+ 'authorizer', // Page this setting is shown on (slug)
	2586	+ 'auth_settings_external' // Section this setting is shown on
2826	2587	);
2827	2588	add_settings_field(
2828		- 'auth_settings_ldap_attr_first_name',
2829		- __( 'LDAP attribute containing first name', 'authorizer' ),
2830		- array( $this, 'print_text_ldap_attr_first_name' ),
2831		- 'authorizer',
2832		- 'auth_settings_external'
	2589	+ 'auth_settings_ldap_attr_first_name', // HTML element ID
	2590	+ __( 'LDAP attribute containing first name', 'authorizer' ), // HTML element Title
	2591	+ array( $this, 'print_text_ldap_attr_first_name' ), // Callback (echos form element)
	2592	+ 'authorizer', // Page this setting is shown on (slug)
	2593	+ 'auth_settings_external' // Section this setting is shown on
2833	2594	);
2834	2595	add_settings_field(
2835		- 'auth_settings_ldap_attr_last_name',
2836		- __( 'LDAP attribute containing last name', 'authorizer' ),
2837		- array( $this, 'print_text_ldap_attr_last_name' ),
2838		- 'authorizer',
2839		- 'auth_settings_external'
	2596	+ 'auth_settings_ldap_attr_last_name', // HTML element ID
	2597	+ __( 'LDAP attribute containing last name', 'authorizer' ), // HTML element Title
	2598	+ array( $this, 'print_text_ldap_attr_last_name' ), // Callback (echos form element)
	2599	+ 'authorizer', // Page this setting is shown on (slug)
	2600	+ 'auth_settings_external' // Section this setting is shown on
2840	2601	);
2841	2602	add_settings_field(
2842		- 'auth_settings_ldap_attr_update_on_login',
2843		- __( 'LDAP attribute update', 'authorizer' ),
2844		- array( $this, 'print_checkbox_ldap_attr_update_on_login' ),
2845		- 'authorizer',
2846		- 'auth_settings_external'
	2603	+ 'auth_settings_ldap_attr_update_on_login', // HTML element ID
	2604	+ __( 'LDAP attribute update', 'authorizer' ), // HTML element Title
	2605	+ array( $this, 'print_checkbox_ldap_attr_update_on_login' ), // Callback (echos form element)
	2606	+ 'authorizer', // Page this setting is shown on (slug)
	2607	+ 'auth_settings_external' // Section this setting is shown on
2847	2608	);
2848	2609
2849		- // Create Advanced Settings section.
	2610	+ // Create Advanced Settings section
2850	2611	add_settings_section(
2851		- 'auth_settings_advanced',
2852		- '',
2853		- array( $this, 'print_section_info_advanced' ),
2854		- 'authorizer'
	2612	+ 'auth_settings_advanced', // HTML element ID
	2613	+ '', // HTML element Title
	2614	+ array( $this, 'print_section_info_advanced' ), // Callback (echos section content)
	2615	+ 'authorizer' // Page this section is shown on (slug)
2855	2616	);
2856	2617	add_settings_field(
2857		- 'auth_settings_advanced_lockouts',
2858		- __( 'Limit invalid login attempts', 'authorizer' ),
2859		- array( $this, 'print_text_auth_advanced_lockouts' ),
2860		- 'authorizer',
2861		- 'auth_settings_advanced'
	2618	+ 'auth_settings_advanced_lockouts', // HTML element ID
	2619	+ __( 'Limit invalid login attempts', 'authorizer' ), // HTML element Title
	2620	+ array( $this, 'print_text_auth_advanced_lockouts' ), // Callback (echos form element)
	2621	+ 'authorizer', // Page this setting is shown on (slug)
	2622	+ 'auth_settings_advanced' // Section this setting is shown on
2862	2623	);
2863	2624	add_settings_field(
2864		- 'auth_settings_advanced_hide_wp_login',
2865		- __( 'Hide WordPress Login', 'authorizer' ),
2866		- array( $this, 'print_checkbox_auth_advanced_hide_wp_login' ),
2867		- 'authorizer',
2868		- 'auth_settings_advanced'
	2625	+ 'auth_settings_advanced_hide_wp_login', // HTML element ID
	2626	+ __( 'Hide WordPress Login', 'authorizer' ), // HTML element Title
	2627	+ array( $this, 'print_checkbox_auth_advanced_hide_wp_login' ), // Callback (echos form element)
	2628	+ 'authorizer', // Page this setting is shown on (slug)
	2629	+ 'auth_settings_advanced' // Section this setting is shown on
2869	2630	);
2870	2631	add_settings_field(
2871		- 'auth_settings_advanced_branding',
2872		- __( 'Custom WordPress login branding', 'authorizer' ),
2873		- array( $this, 'print_radio_auth_advanced_branding' ),
2874		- 'authorizer',
2875		- 'auth_settings_advanced'
	2632	+ 'auth_settings_advanced_branding', // HTML element ID
	2633	+ __( 'Custom WordPress login branding', 'authorizer' ), // HTML element Title
	2634	+ array( $this, 'print_radio_auth_advanced_branding' ), // Callback (echos form element)
	2635	+ 'authorizer', // Page this setting is shown on (slug)
	2636	+ 'auth_settings_advanced' // Section this setting is shown on
2876	2637	);
2877	2638	add_settings_field(
2878		- 'auth_settings_advanced_admin_menu',
2879		- __( 'Authorizer admin menu item location', 'authorizer' ),
2880		- array( $this, 'print_radio_auth_advanced_admin_menu' ),
2881		- 'authorizer',
2882		- 'auth_settings_advanced'
	2639	+ 'auth_settings_advanced_admin_menu', // HTML element ID
	2640	+ __( 'Authorizer admin menu item location', 'authorizer' ), // HTML element Title
	2641	+ array( $this, 'print_radio_auth_advanced_admin_menu' ), // Callback (echos form element)
	2642	+ 'authorizer', // Page this setting is shown on (slug)
	2643	+ 'auth_settings_advanced' // Section this setting is shown on
2883	2644	);
2884	2645	add_settings_field(
2885		- 'auth_settings_advanced_usermeta',
2886		- __( 'Show custom usermeta in user list', 'authorizer' ),
2887		- array( $this, 'print_select_auth_advanced_usermeta' ),
2888		- 'authorizer',
2889		- 'auth_settings_advanced'
	2646	+ 'auth_settings_advanced_usermeta', // HTML element ID
	2647	+ __( 'Show custom usermeta in user list', 'authorizer' ), // HTML element Title
	2648	+ array( $this, 'print_select_auth_advanced_usermeta' ), // Callback (echos form element)
	2649	+ 'authorizer', // Page this setting is shown on (slug)
	2650	+ 'auth_settings_advanced' // Section this setting is shown on
2890	2651	);
2891	2652	add_settings_field(
2892		- 'auth_settings_advanced_users_per_page',
2893		- __( 'Number of users per page', 'authorizer' ),
2894		- array( $this, 'print_text_auth_advanced_users_per_page' ),
2895		- 'authorizer',
2896		- 'auth_settings_advanced'
	2653	+ 'auth_settings_advanced_users_per_page', // HTML element ID
	2654	+ __( 'Number of users per page', 'authorizer' ), // HTML element Title
	2655	+ array( $this, 'print_text_auth_advanced_users_per_page' ), // Callback (echos form element)
	2656	+ 'authorizer', // Page this setting is shown on (slug)
	2657	+ 'auth_settings_advanced' // Section this setting is shown on
2897	2658	);
2898	2659	add_settings_field(
2899		- 'auth_settings_advanced_users_sort_by',
2900		- __( 'Approved users sort method', 'authorizer' ),
2901		- array( $this, 'print_select_auth_advanced_users_sort_by' ),
2902		- 'authorizer',
2903		- 'auth_settings_advanced'
	2660	+ 'auth_settings_advanced_users_sort_by', // HTML element ID
	2661	+ __( 'Approved users sort method', 'authorizer' ), // HTML element Title
	2662	+ array( $this, 'print_select_auth_advanced_users_sort_by' ), // Callback (echos form element)
	2663	+ 'authorizer', // Page this setting is shown on (slug)
	2664	+ 'auth_settings_advanced' // Section this setting is shown on
2904	2665	);
2905	2666	add_settings_field(
2906		- 'auth_settings_advanced_users_sort_order',
2907		- __( 'Approved users sort order', 'authorizer' ),
2908		- array( $this, 'print_select_auth_advanced_users_sort_order' ),
2909		- 'authorizer',
2910		- 'auth_settings_advanced'
	2667	+ 'auth_settings_advanced_users_sort_order', // HTML element ID
	2668	+ __( 'Approved users sort order', 'authorizer' ), // HTML element Title
	2669	+ array( $this, 'print_select_auth_advanced_users_sort_order' ), // Callback (echos form element)
	2670	+ 'authorizer', // Page this setting is shown on (slug)
	2671	+ 'auth_settings_advanced' // Section this setting is shown on
2911	2672	);
2912	2673	add_settings_field(
2913		- 'auth_settings_advanced_widget_enabled',
2914		- __( 'Show dashboard widget to admin users', 'authorizer' ),
2915		- array( $this, 'print_checkbox_auth_advanced_widget_enabled' ),
2916		- 'authorizer',
2917		- 'auth_settings_advanced'
	2674	+ 'auth_settings_advanced_widget_enabled', // HTML element ID
	2675	+ __( 'Show dashboard widget to admin users', 'authorizer' ), // HTML element Title
	2676	+ array( $this, 'print_checkbox_auth_advanced_widget_enabled' ), // Callback (echos form element)
	2677	+ 'authorizer', // Page this setting is shown on (slug)
	2678	+ 'auth_settings_advanced' // Section this setting is shown on
2918	2679	);
2919	2680	// On multisite installs, add an option to override all multisite settings on individual sites.
2920	2681	if ( is_multisite() ) {
2921	2682	add_settings_field(
2922		- 'auth_settings_advanced_override_multisite',
2923		- __( 'Override multisite options', 'authorizer' ),
2924		- array( $this, 'print_checkbox_auth_advanced_override_multisite' ),
2925		- 'authorizer',
2926		- 'auth_settings_advanced'
	2683	+ 'auth_settings_advanced_override_multisite', // HTML element ID
	2684	+ __( 'Override multisite options', 'authorizer' ), // HTML element Title
	2685	+ array( $this, 'print_checkbox_auth_advanced_override_multisite' ), // Callback (echos form element)
	2686	+ 'authorizer', // Page this setting is shown on (slug)
	2687	+ 'auth_settings_advanced' // Section this setting is shown on
2927	2688	);
2928	2689	}
2929	2690	}
2930	2691
		@@ -2930,30 +2691,29 @@
2930	2691
2931	2692
2932	2693	/**
2933	2694	* Set meaningful defaults for the plugin options.
2934		- *
2935	2695	* Note: This function is called on plugin activation.
2936	2696	*/
2937		- private function set_default_options() {
	2697	+ function set_default_options() {
2938	2698	global $wp_roles;
2939	2699
2940	2700	$auth_settings = get_option( 'auth_settings' );
2941		- if ( false === $auth_settings ) {
	2701	+ if ( $auth_settings === FALSE ) {
2942	2702	$auth_settings = array();
2943	2703	}
2944	2704
2945	2705	// Access Lists Defaults.
2946	2706	$auth_settings_access_users_pending = get_option( 'auth_settings_access_users_pending' );
2947		- if ( false === $auth_settings_access_users_pending ) {
	2707	+ if ( $auth_settings_access_users_pending === FALSE ) {
2948	2708	$auth_settings_access_users_pending = array();
2949	2709	}
2950	2710	$auth_settings_access_users_approved = get_option( 'auth_settings_access_users_approved' );
2951		- if ( false === $auth_settings_access_users_approved ) {
	2711	+ if ( $auth_settings_access_users_approved === FALSE ) {
2952	2712	$auth_settings_access_users_approved = array();
2953	2713	}
2954	2714	$auth_settings_access_users_blocked = get_option( 'auth_settings_access_users_blocked' );
2955		- if ( false === $auth_settings_access_users_blocked ) {
	2715	+ if ( $auth_settings_access_users_blocked === FALSE ) {
2956	2716	$auth_settings_access_users_blocked = array();
2957	2717	}
2958	2718
2959	2719	// Login Access Defaults.
		@@ -3005,12 +2765,13 @@
3005	2765	if ( ! array_key_exists( 'access_redirect_to_message', $auth_settings ) ) {
3006	2766	$auth_settings['access_redirect_to_message'] = '<p>' . __( 'Notice: You are browsing this site anonymously, and only have access to a portion of its content.', 'authorizer' ) . '</p>';
3007	2767	}
3008	2768
	2769	+
3009	2770	// External Service Defaults.
3010	2771	if ( ! array_key_exists( 'access_default_role', $auth_settings ) ) {
3011	2772	// Set default role to 'student' if that role exists, 'subscriber' otherwise.
3012		- $all_roles = $wp_roles->roles;
	2773	+ $all_roles = $wp_roles->roles;
3013	2774	$editable_roles = apply_filters( 'editable_roles', $all_roles );
3014	2775	if ( array_key_exists( 'student', $editable_roles ) ) {
3015	2776	$auth_settings['access_default_role'] = 'student';
3016	2777	} else {
		@@ -3108,12 +2869,12 @@
3108	2869
3109	2870	// Advanced defaults.
3110	2871	if ( ! array_key_exists( 'advanced_lockouts', $auth_settings ) ) {
3111	2872	$auth_settings['advanced_lockouts'] = array(
3112		- 'attempts_1' => 10,
3113		- 'duration_1' => 1,
3114		- 'attempts_2' => 10,
3115		- 'duration_2' => 10,
	2873	+ 'attempts_1' => 10,
	2874	+ 'duration_1' => 1,
	2875	+ 'attempts_2' => 10,
	2876	+ 'duration_2' => 10,
3116	2877	'reset_duration' => 120,
3117	2878	);
3118	2879	}
3119	2880	if ( ! array_key_exists( 'advanced_hide_wp_login', $auth_settings ) ) {
		@@ -3153,9 +2914,9 @@
3153	2914	// Multisite defaults.
3154	2915	if ( is_multisite() ) {
3155	2916	$auth_multisite_settings = get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings', array() );
3156	2917
3157		- if ( false === $auth_multisite_settings ) {
	2918	+ if ( $auth_multisite_settings === FALSE ) {
3158	2919	$auth_multisite_settings = array();
3159	2920	}
3160	2921	// Global switch for enabling multisite options.
3161	2922	if ( ! array_key_exists( 'multisite_override', $auth_multisite_settings ) ) {
		@@ -3162,9 +2923,9 @@
3162	2923	$auth_multisite_settings['multisite_override'] = '';
3163	2924	}
3164	2925	// Access Lists Defaults.
3165	2926	$auth_multisite_settings_access_users_approved = get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved' );
3166		- if ( false === $auth_multisite_settings_access_users_approved ) {
	2927	+ if ( $auth_multisite_settings_access_users_approved === FALSE ) {
3167	2928	$auth_multisite_settings_access_users_approved = array();
3168	2929	}
3169	2930	// Login Access Defaults.
3170	2931	if ( ! array_key_exists( 'access_who_can_login', $auth_multisite_settings ) ) {
		@@ -3176,9 +2937,9 @@
3176	2937	}
3177	2938	// External Service Defaults.
3178	2939	if ( ! array_key_exists( 'access_default_role', $auth_multisite_settings ) ) {
3179	2940	// Set default role to 'student' if that role exists, 'subscriber' otherwise.
3180		- $all_roles = $wp_roles->roles;
	2941	+ $all_roles = $wp_roles->roles;
3181	2942	$editable_roles = apply_filters( 'editable_roles', $all_roles );
3182	2943	if ( array_key_exists( 'student', $editable_roles ) ) {
3183	2944	$auth_multisite_settings['access_default_role'] = 'student';
3184	2945	} else {
		@@ -3271,12 +3032,12 @@
3271	3032	}
3272	3033	// Advanced defaults.
3273	3034	if ( ! array_key_exists( 'advanced_lockouts', $auth_multisite_settings ) ) {
3274	3035	$auth_multisite_settings['advanced_lockouts'] = array(
3275		- 'attempts_1' => 10,
3276		- 'duration_1' => 1,
3277		- 'attempts_2' => 10,
3278		- 'duration_2' => 10,
	3036	+ 'attempts_1' => 10,
	3037	+ 'duration_1' => 1,
	3038	+ 'attempts_2' => 10,
	3039	+ 'duration_2' => 10,
3279	3040	'reset_duration' => 120,
3280	3041	);
3281	3042	}
3282	3043	if ( ! array_key_exists( 'advanced_hide_wp_login', $auth_multisite_settings ) ) {
		@@ -3304,15 +3065,12 @@
3304	3065
3305	3066
3306	3067	/**
3307	3068	* List sanitizer.
3308		- *
3309		- * @param array $list Array of users to sanitize.
3310		- * @param string $side_effect Set to 'update roles' if role syncing should be performed.
3311		- * @param string $multisite_mode Set to 'multisite' to sync roles on all sites the user belongs to.
3312		- * @return array Array of sanitized users.
	3069	+ * $side_effect = 'none' or 'update roles' to make sure WP user roles match
	3070	+ * $multisite_mode = 'single' or 'multisite' to indicate which user roles to change (this site or all sites)
3313	3071	*/
3314		- private function sanitize_user_list( $list, $side_effect = 'none', $multisite_mode = 'single' ) {
	3072	+ function sanitize_user_list( $list, $side_effect = 'none', $multisite_mode = 'single' ) {
3315	3073	// If it's not a list, make it so.
3316	3074	if ( ! is_array( $list ) ) {
3317	3075	$list = array();
3318	3076	}
		@@ -3317,16 +3075,16 @@
3317	3075	$list = array();
3318	3076	}
3319	3077	foreach ( $list as $key => $user_info ) {
3320	3078	if ( strlen( $user_info['email'] ) < 1 ) {
3321		- // Make sure there are no empty entries in the list.
3322		- unset( $list[ $key ] );
3323		- } elseif ( 'update roles' === $side_effect ) {
	3079	+ // Make sure there are no empty entries in the list
	3080	+ unset( $list[$key] );
	3081	+ } elseif ( $side_effect === 'update roles' ) {
3324	3082	// Make sure the WordPress user accounts have the same role
3325	3083	// as that indicated in the list.
3326	3084	$wp_user = get_user_by( 'email', $user_info['email'] );
3327	3085	if ( $wp_user ) {
3328		- if ( is_multisite() && 'multisite' === $multisite_mode ) {
	3086	+ if ( is_multisite() && $multisite_mode === 'multisite' ) {
3329	3087	foreach ( get_blogs_of_user( $wp_user->ID ) as $blog ) {
3330	3088	add_user_to_blog( $blog->userblog_id, $wp_user->ID, $user_info['role'] );
3331	3089	}
3332	3090	} else {
		@@ -3339,21 +3097,18 @@
3339	3097	}
3340	3098
3341	3099
3342	3100	/**
3343		- * Settings sanitizer callback.
3344		- *
3345		- * @param array $auth_settings Authorizer settings array.
3346		- * @return array Sanitized Authorizer settings array.
	3101	+ * Settings sanitizer callback
3347	3102	*/
3348		- public function sanitize_options( $auth_settings ) {
	3103	+ function sanitize_options( $auth_settings ) {
3349	3104	// Default to "Approved Users" login access restriction.
3350		- if ( ! in_array( $auth_settings['access_who_can_login'], array( 'external_users', 'approved_users' ), true ) ) {
	3105	+ if ( ! in_array( $auth_settings['access_who_can_login'], array( 'external_users', 'approved_users' ) ) ) {
3351	3106	$auth_settings['access_who_can_login'] = 'approved_users';
3352	3107	}
3353	3108
3354	3109	// Default to "Everyone" view access restriction.
3355		- if ( ! in_array( $auth_settings['access_who_can_view'], array( 'everyone', 'logged_in_users' ), true ) ) {
	3110	+ if ( ! in_array( $auth_settings['access_who_can_view'], array( 'everyone', 'logged_in_users' ) ) ) {
3356	3111	$auth_settings['access_who_can_view'] = 'everyone';
3357	3112	}
3358	3113
3359	3114	// Default to WordPress login access redirect.
		@@ -3358,9 +3113,9 @@
3358	3113
3359	3114	// Default to WordPress login access redirect.
3360	3115	// Note: this option doesn't exist in multisite options, so we first
3361	3116	// check to see if it exists.
3362		- if ( array_key_exists( 'access_redirect', $auth_settings ) && ! in_array( $auth_settings['access_redirect'], array( 'login', 'page', 'message' ), true ) ) {
	3117	+ if ( array_key_exists( 'access_redirect', $auth_settings ) && ! in_array( $auth_settings['access_redirect'], array( 'login', 'page', 'message' ) ) ) {
3363	3118	$auth_settings['access_redirect'] = 'login';
3364	3119	}
3365	3120
3366	3121	// Default to warning message for anonymous users on public pages.
		@@ -3365,61 +3120,61 @@
3365	3120
3366	3121	// Default to warning message for anonymous users on public pages.
3367	3122	// Note: this option doesn't exist in multisite options, so we first
3368	3123	// check to see if it exists.
3369		- if ( array_key_exists( 'access_public_warning', $auth_settings ) && ! in_array( $auth_settings['access_public_warning'], array( 'no_warning', 'warning' ), true ) ) {
	3124	+ if ( array_key_exists( 'access_public_warning', $auth_settings ) && ! in_array( $auth_settings['access_public_warning'], array( 'no_warning', 'warning' ) ) ) {
3370	3125	$auth_settings['access_public_warning'] = 'no_warning';
3371	3126	}
3372	3127
3373		- // Sanitize Send welcome email (checkbox: value can only be '1' or empty string).
	3128	+ // Sanitize Send welcome email (checkbox: value can only be '1' or empty string)
3374	3129	$auth_settings['access_should_email_approved_users'] = array_key_exists( 'access_should_email_approved_users', $auth_settings ) && strlen( $auth_settings['access_should_email_approved_users'] ) > 0 ? '1' : '';
3375	3130
3376		- // Sanitize Enable Google Logins (checkbox: value can only be '1' or empty string).
	3131	+ // Sanitize Enable Google Logins (checkbox: value can only be '1' or empty string)
3377	3132	$auth_settings['google'] = array_key_exists( 'google', $auth_settings ) && strlen( $auth_settings['google'] ) > 0 ? '1' : '';
3378	3133
3379		- // Sanitize Enable CAS Logins (checkbox: value can only be '1' or empty string).
	3134	+ // Sanitize Enable CAS Logins (checkbox: value can only be '1' or empty string)
3380	3135	$auth_settings['cas'] = array_key_exists( 'cas', $auth_settings ) && strlen( $auth_settings['cas'] ) > 0 ? '1' : '';
3381	3136
3382		- // Sanitize CAS Host setting.
	3137	+ // Sanitize CAS Host setting
3383	3138	$auth_settings['cas_host'] = filter_var( $auth_settings['cas_host'], FILTER_SANITIZE_URL );
3384	3139
3385		- // Sanitize CAS Port (int).
	3140	+ // Sanitize CAS Port (int)
3386	3141	$auth_settings['cas_port'] = filter_var( $auth_settings['cas_port'], FILTER_SANITIZE_NUMBER_INT );
3387	3142
3388		- // Sanitize CAS attribute update (checkbox: value can only be '1' or empty string).
	3143	+ // Sanitize CAS attribute update (checkbox: value can only be '1' or empty string)
3389	3144	$auth_settings['cas_attr_update_on_login'] = array_key_exists( 'cas_attr_update_on_login', $auth_settings ) && strlen( $auth_settings['cas_attr_update_on_login'] ) > 0 ? '1' : '';
3390	3145
3391		- // Sanitize CAS auto-login (checkbox: value can only be '1' or empty string).
	3146	+ // Sanitize CAS auto-login (checkbox: value can only be '1' or empty string)
3392	3147	$auth_settings['cas_auto_login'] = array_key_exists( 'cas_auto_login', $auth_settings ) && strlen( $auth_settings['cas_auto_login'] ) > 0 ? '1' : '';
3393	3148
3394		- // Sanitize Enable LDAP Logins (checkbox: value can only be '1' or empty string).
	3149	+ // Sanitize Enable LDAP Logins (checkbox: value can only be '1' or empty string)
3395	3150	$auth_settings['ldap'] = array_key_exists( 'ldap', $auth_settings ) && strlen( $auth_settings['ldap'] ) > 0 ? '1' : '';
3396	3151
3397		- // Sanitize LDAP Host setting.
	3152	+ // Sanitize LDAP Host setting
3398	3153	$auth_settings['ldap_host'] = filter_var( $auth_settings['ldap_host'], FILTER_SANITIZE_URL );
3399	3154
3400		- // Sanitize LDAP Port (int).
	3155	+ // Sanitize LDAP Port (int)
3401	3156	$auth_settings['ldap_port'] = filter_var( $auth_settings['ldap_port'], FILTER_SANITIZE_NUMBER_INT );
3402	3157
3403		- // Sanitize LDAP TLS (checkbox: value can only be '1' or empty string).
	3158	+ // Sanitize LDAP TLS (checkbox: value can only be '1' or empty string)
3404	3159	$auth_settings['ldap_tls'] = array_key_exists( 'ldap_tls', $auth_settings ) && strlen( $auth_settings['ldap_tls'] ) > 0 ? '1' : '';
3405	3160
3406		- // Sanitize LDAP attributes (basically make sure they don't have any parentheses).
	3161	+ // Sanitize LDAP attributes (basically make sure they don't have any parentheses)
3407	3162	$auth_settings['ldap_uid'] = filter_var( $auth_settings['ldap_uid'], FILTER_SANITIZE_EMAIL );
3408	3163
3409		- // Sanitize LDAP Lost Password URL.
	3164	+ // Sanitize LDAP Lost Password URL
3410	3165	$auth_settings['ldap_lostpassword_url'] = filter_var( $auth_settings['ldap_lostpassword_url'], FILTER_SANITIZE_URL );
3411	3166
3412		- // Obfuscate LDAP directory user password.
	3167	+ // Obfuscate LDAP directory user password
3413	3168	if ( strlen( $auth_settings['ldap_password'] ) > 0 ) {
3414	3169	// encrypt the directory user password for some minor obfuscation in the database.
3415	3170	$auth_settings['ldap_password'] = $this->encrypt( $auth_settings['ldap_password'] );
3416	3171	}
3417	3172
3418		- // Sanitize LDAP attribute update (checkbox: value can only be '1' or empty string).
	3173	+ // Sanitize LDAP attribute update (checkbox: value can only be '1' or empty string)
3419	3174	$auth_settings['ldap_attr_update_on_login'] = array_key_exists( 'ldap_attr_update_on_login', $auth_settings ) && strlen( $auth_settings['ldap_attr_update_on_login'] ) > 0 ? '1' : '';
3420	3175
3421		- // Make sure public pages is an empty array if it's empty.
	3176	+ // Make sure public pages is an empty array if it's empty
3422	3177	// Note: this option doesn't exist in multisite options, so we first
3423	3178	// check to see if it exists.
3424	3179	if ( array_key_exists( 'access_public_pages', $auth_settings ) && ! is_array( $auth_settings['access_public_pages'] ) ) {
3425	3180	$auth_settings['access_public_pages'] = array();
		@@ -3427,31 +3182,31 @@
3427	3182
3428	3183	// Make sure all lockout options are integers (attempts_1,
3429	3184	// duration_1, attempts_2, duration_2, reset_duration).
3430	3185	foreach ( $auth_settings['advanced_lockouts'] as $key => $value ) {
3431		- $auth_settings['advanced_lockouts'][ $key ] = filter_var( $value, FILTER_SANITIZE_NUMBER_INT );
	3186	+ $auth_settings['advanced_lockouts'][$key] = filter_var( $value, FILTER_SANITIZE_NUMBER_INT );
3432	3187	}
3433	3188
3434		- // Sanitize Hide WordPress logins (checkbox: value can only be '1' or empty string).
	3189	+ // Sanitize Hide WordPress logins (checkbox: value can only be '1' or empty string)
3435	3190	$auth_settings['advanced_hide_wp_login'] = array_key_exists( 'advanced_hide_wp_login', $auth_settings ) && strlen( $auth_settings['advanced_hide_wp_login'] ) > 0 ? '1' : '';
3436	3191
3437		- // Sanitize Users per page (text: value can only int from 1 to MAX_INT).
	3192	+ // Sanitize Users per page (text: value can only int from 1 to MAX_INT)
3438	3193	$auth_settings['advanced_users_per_page'] = array_key_exists( 'advanced_users_per_page', $auth_settings ) && intval( $auth_settings['advanced_users_per_page'] ) > 0 ? intval( $auth_settings['advanced_users_per_page'] ) : 1;
3439	3194
3440		- // Sanitize Sort users by (select: value can be 'email', 'role', 'date_added', 'created').
3441		- if ( ! isset( $auth_settings['advanced_users_sort_by'] ) || ! in_array( $auth_settings['advanced_users_sort_by'], array( 'email', 'role', 'date_added', 'created' ), true ) ) {
	3195	+ // Sanitize Sort users by (select: value can be 'email', 'role', 'date_added', 'created')
	3196	+ if ( ! isset( $auth_settings['advanced_users_sort_by'] ) || ! in_array( $auth_settings['advanced_users_sort_by'], array( 'email', 'role', 'date_added', 'created' ) ) ) {
3442	3197	$auth_settings['advanced_users_sort_by'] = 'created';
3443	3198	}
3444	3199
3445		- // Sanitize Sort users order (select: value can be 'asc', 'desc').
3446		- if ( ! isset( $auth_settings['advanced_users_sort_order'] ) || ! in_array( $auth_settings['advanced_users_sort_order'], array( 'asc', 'desc' ), true ) ) {
	3200	+ // Sanitize Sort users order (select: value can be 'asc', 'desc')
	3201	+ if ( ! isset( $auth_settings['advanced_users_sort_order'] ) || ! in_array( $auth_settings['advanced_users_sort_order'], array( 'asc', 'desc' ) ) ) {
3447	3202	$auth_settings['advanced_users_sort_order'] = 'asc';
3448	3203	}
3449	3204
3450		- // Sanitize Show Dashboard Widget (checkbox: value can only be '1' or empty string).
	3205	+ // Sanitize Show Dashboard Widget (checkbox: value can only be '1' or empty string)
3451	3206	$auth_settings['advanced_widget_enabled'] = array_key_exists( 'advanced_widget_enabled', $auth_settings ) && strlen( $auth_settings['advanced_widget_enabled'] ) > 0 ? '1' : '';
3452	3207
3453		- // Sanitize Override multisite options (checkbox: value can only be '1' or empty string).
	3208	+ // Sanitize Override multisite options (checkbox: value can only be '1' or empty string)
3454	3209	$auth_settings['advanced_override_multisite'] = array_key_exists( 'advanced_override_multisite', $auth_settings ) && strlen( $auth_settings['advanced_override_multisite'] ) > 0 ? '1' : '';
3455	3210
3456	3211	return $auth_settings;
3457	3212	}
		@@ -3461,15 +3216,15 @@
3461	3216	* Keep authorizer approved users' roles in sync with WordPress roles
3462	3217	* if someone changes the role via the WordPress Edit User page
3463	3218	* (wp-admin/user-edit.php or wp-admin/profile.php).
3464	3219	*
3465		- * Action: user_profile_update_errors
3466		- *
3467		- * @param WP_Error $errors Errors object to add any custom errors to (passed by reference).
3468		- * @param bool $update True if updating existing user, false if saving a new one.
3469		- * @param stdClass $user Updated WP_User object for user being edited (passed by reference).
	3220	+ * @action user_profile_update_errors
	3221	+ * @ref https://developer.wordpress.org/reference/hooks/user_profile_update_errors/
	3222	+ * @param WP_Error &$errors Errors object to add any custom errors to
	3223	+ * @param bool $update True if updating existing user, false if saving a new one
	3224	+ * @param stdClass &$user Object with changes to WP_User object for user being edited
3470	3225	*/
3471		- public function edit_user_profile_update_role( &$errors, $update, &$user ) {
	3226	+ function edit_user_profile_update_role( &$errors, $update, &$user ) {
3472	3227	// Do nothing if we're not updating role.
3473	3228	if ( ! property_exists( $user, 'role' ) ) {
3474	3229	return;
3475	3230	}
		@@ -3479,10 +3234,9 @@
3479	3234	return;
3480	3235	}
3481	3236
3482	3237	// Don't perform Authorizer updates if we have a WordPress error.
3483		- $errors_on_user_update = $errors->get_error_codes();
3484		- if ( ! empty( $errors_on_user_update ) ) {
	3238	+ if ( ! empty( $errors->get_error_codes() ) ) {
3485	3239	return;
3486	3240	}
3487	3241
3488	3242	// Get original user object (fail if not a real WordPress user).
		@@ -3492,12 +3246,12 @@
3492	3246	}
3493	3247
3494	3248	// If user is in approved list, update his/her associated role.
3495	3249	if ( $this->is_email_in_list( $userdata->user_email, 'approved' ) ) {
3496		- $auth_settings_access_users_approved = $this->sanitize_user_list( $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT ) );
	3250	+ $auth_settings_access_users_approved = $this->sanitize_user_list( $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN ) );
3497	3251	foreach ( $auth_settings_access_users_approved as $key => $check_user ) {
3498	3252	if ( 0 === strcasecmp( $check_user['email'], $userdata->user_email ) ) {
3499		- $auth_settings_access_users_approved[ $key ]['role'] = $user->role;
	3253	+ $auth_settings_access_users_approved[$key]['role'] = $user->role;
3500	3254	}
3501	3255	}
3502	3256	update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved );
3503	3257	}
		@@ -3513,15 +3267,13 @@
3513	3267	* have been performed, so we can simply update the Authorizer approved
3514	3268	* list, changing the email address on the approved entry, and removing any
3515	3269	* existing entries that also have the new email address (duplicates).
3516	3270	*
3517		- * Filter: send_email_change_email
3518		- *
3519	3271	* @param bool $send Whether to send the email.
3520	3272	* @param array $user The original user array.
3521	3273	* @param array $userdata The updated user array.
3522	3274	*/
3523		- public function edit_user_profile_update_email( $send, $user, $userdata ) {
	3275	+ function edit_user_profile_update_email( $send, $user, $userdata ) {
3524	3276	// If we're in multisite, update the email on all sites in the network
3525	3277	// (and remove from any subsites if it's a network-approved user).
3526	3278	if ( is_multisite() ) {
3527	3279	// If it's a multisite approved user, sync the email there.
		@@ -3526,20 +3278,20 @@
3526	3278	if ( is_multisite() ) {
3527	3279	// If it's a multisite approved user, sync the email there.
3528	3280	$changed_user_is_multisite_user = false;
3529	3281	if ( $this->is_email_in_list( $user['user_email'], 'approved', 'multisite' ) ) {
3530		- $changed_user_is_multisite_user = true;
	3282	+ $changed_user_is_multisite_user = true;
3531	3283	$auth_multisite_settings_access_users_approved = $this->sanitize_user_list(
3532		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT )
	3284	+ $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN )
3533	3285	);
3534	3286	foreach ( $auth_multisite_settings_access_users_approved as $key => $check_user ) {
3535	3287	// Update old user email in approved list to the new email.
3536	3288	if ( 0 === strcasecmp( $check_user['email'], $user['user_email'] ) ) {
3537		- $auth_multisite_settings_access_users_approved[ $key ]['email'] = $this->lowercase( $userdata['user_email'] );
	3289	+ $auth_multisite_settings_access_users_approved[$key]['email'] = $this->lowercase( $userdata['user_email'] );
3538	3290	}
3539	3291	// If new user email is already in approved list, remove that entry.
3540	3292	if ( 0 === strcasecmp( $check_user['email'], $userdata['user_email'] ) ) {
3541		- unset( $auth_multisite_settings_access_users_approved[ $key ] );
	3293	+ unset( $auth_multisite_settings_access_users_approved[$key] );
3542	3294	}
3543	3295	}
3544	3296	update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
3545	3297	}
		@@ -3544,13 +3296,12 @@
3544	3296	update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
3545	3297	}
3546	3298
3547	3299	// Go through all approved lists on individual sites and sync this user there.
3548		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
3549	3300	$sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
3550	3301	foreach ( $sites as $site ) {
3551		- $updated = false;
3552		- $blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
	3302	+ $updated = false;
	3303	+ $blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
3553	3304	$auth_settings_access_users_approved = get_blog_option( $blog_id, 'auth_settings_access_users_approved', array() );
3554	3305	foreach ( $auth_settings_access_users_approved as $key => $check_user ) {
3555	3306	// Update old user email in approved list to the new email.
3556	3307	if ( 0 === strcasecmp( $check_user['email'], $user['user_email'] ) ) {
		@@ -3555,17 +3306,17 @@
3555	3306	// Update old user email in approved list to the new email.
3556	3307	if ( 0 === strcasecmp( $check_user['email'], $user['user_email'] ) ) {
3557	3308	// But if the user is already a multisite user, just remove the entry in the subsite.
3558	3309	if ( $changed_user_is_multisite_user ) {
3559		- unset( $auth_settings_access_users_approved[ $key ] );
	3310	+ unset( $auth_settings_access_users_approved[$key] );
3560	3311	} else {
3561		- $auth_settings_access_users_approved[ $key ]['email'] = $this->lowercase( $userdata['user_email'] );
	3312	+ $auth_settings_access_users_approved[$key]['email'] = $this->lowercase( $userdata['user_email'] );
3562	3313	}
3563	3314	$updated = true;
3564	3315	}
3565	3316	// If new user email is already in approved list, remove that entry.
3566	3317	if ( 0 === strcasecmp( $check_user['email'], $userdata['user_email'] ) ) {
3567		- unset( $auth_settings_access_users_approved[ $key ] );
	3318	+ unset( $auth_settings_access_users_approved[$key] );
3568	3319	$updated = true;
3569	3320	}
3570	3321	}
3571	3322	if ( $updated ) {
		@@ -3574,17 +3325,17 @@
3574	3325	}
3575	3326	} else {
3576	3327	// In a single site environment, just find the old user in the approved list and update the email.
3577	3328	if ( $this->is_email_in_list( $user['user_email'], 'approved' ) ) {
3578		- $auth_settings_access_users_approved = $this->sanitize_user_list( $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT ) );
	3329	+ $auth_settings_access_users_approved = $this->sanitize_user_list( $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN ) );
3579	3330	foreach ( $auth_settings_access_users_approved as $key => $check_user ) {
3580	3331	// Update old user email in approved list to the new email.
3581	3332	if ( 0 === strcasecmp( $check_user['email'], $user['user_email'] ) ) {
3582		- $auth_settings_access_users_approved[ $key ]['email'] = $this->lowercase( $userdata['user_email'] );
	3333	+ $auth_settings_access_users_approved[$key]['email'] = $this->lowercase( $userdata['user_email'] );
3583	3334	}
3584	3335	// If new user email is already in approved list, remove that entry.
3585	3336	if ( 0 === strcasecmp( $check_user['email'], $userdata['user_email'] ) ) {
3586		- unset( $auth_settings_access_users_approved[ $key ] );
	3337	+ unset( $auth_settings_access_users_approved[$key] );
3587	3338	}
3588	3339	}
3589	3340	update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved );
3590	3341	}
		@@ -3596,63 +3347,51 @@
3596	3347	}
3597	3348
3598	3349
3599	3350	/**
3600		- * Settings print callback.
3601		- *
3602		- * @param string $args Args (e.g., multisite admin mode).
3603		- * @return void
	3351	+ * Settings print callbacks
3604	3352	*/
3605		- public function print_section_info_tabs( $args = '' ) {
3606		- if ( WP_Plugin_Authorizer::NETWORK_CONTEXT === $this->get_admin_mode( $args ) ) :
3607		- ?>
	3353	+ function print_section_info_tabs( $args = '' ) {
	3354	+ if ( MULTISITE_ADMIN === $this->get_admin_mode( $args )): ?>
3608	3355	<h2 class="nav-tab-wrapper">
3609		- <a class="nav-tab nav-tab-access_lists nav-tab-active" href="javascript:chooseTab('access_lists' );"><?php esc_html_e( 'Access Lists', 'authorizer' ); ?></a>
3610		- <a class="nav-tab nav-tab-external" href="javascript:chooseTab('external' );"><?php esc_html_e( 'External Service', 'authorizer' ); ?></a>
3611		- <a class="nav-tab nav-tab-advanced" href="javascript:chooseTab('advanced' );"><?php esc_html_e( 'Advanced', 'authorizer' ); ?></a>
	3356	+ <a class="nav-tab nav-tab-access_lists nav-tab-active" href="javascript:choose_tab('access_lists' );"><?php _e( 'Access Lists', 'authorizer' ); ?></a>
	3357	+ <a class="nav-tab nav-tab-external" href="javascript:choose_tab('external' );"><?php _e( 'External Service', 'authorizer' ); ?></a>
	3358	+ <a class="nav-tab nav-tab-advanced" href="javascript:choose_tab('advanced' );"><?php _e( 'Advanced', 'authorizer' ); ?></a>
3612	3359	</h2>
3613		- <?php else : ?>
	3360	+ <?php else: ?>
3614	3361	<h2 class="nav-tab-wrapper">
3615		- <a class="nav-tab nav-tab-access_lists nav-tab-active" href="javascript:chooseTab('access_lists' );"><?php esc_html_e( 'Access Lists', 'authorizer' ); ?></a>
3616		- <a class="nav-tab nav-tab-access_login" href="javascript:chooseTab('access_login' );"><?php esc_html_e( 'Login Access', 'authorizer' ); ?></a>
3617		- <a class="nav-tab nav-tab-access_public" href="javascript:chooseTab('access_public' );"><?php esc_html_e( 'Public Access', 'authorizer' ); ?></a>
3618		- <a class="nav-tab nav-tab-external" href="javascript:chooseTab('external' );"><?php esc_html_e( 'External Service', 'authorizer' ); ?></a>
3619		- <a class="nav-tab nav-tab-advanced" href="javascript:chooseTab('advanced' );"><?php esc_html_e( 'Advanced', 'authorizer' ); ?></a>
	3362	+ <a class="nav-tab nav-tab-access_lists nav-tab-active" href="javascript:choose_tab('access_lists' );"><?php _e( 'Access Lists', 'authorizer' ); ?></a>
	3363	+ <a class="nav-tab nav-tab-access_login" href="javascript:choose_tab('access_login' );"><?php _e( 'Login Access', 'authorizer' ); ?></a>
	3364	+ <a class="nav-tab nav-tab-access_public" href="javascript:choose_tab('access_public' );"><?php _e( 'Public Access', 'authorizer' ); ?></a>
	3365	+ <a class="nav-tab nav-tab-external" href="javascript:choose_tab('external' );"><?php _e( 'External Service', 'authorizer' ); ?></a>
	3366	+ <a class="nav-tab nav-tab-advanced" href="javascript:choose_tab('advanced' );"><?php _e( 'Advanced', 'authorizer' ); ?></a>
3620	3367	</h2>
3621		- <?php
3622		- endif;
	3368	+ <?php endif;
3623	3369	}
3624	3370
3625	3371
3626		- /**
3627		- * Settings print callback.
3628		- *
3629		- * @param string $args Args (e.g., multisite admin mode).
3630		- * @return void
3631		- */
3632		- public function print_section_info_access_lists( $args = '' ) {
	3372	+ function print_section_info_access_lists( $args = '' ) {
3633	3373	$admin_mode = $this->get_admin_mode( $args );
3634		- ?>
3635		- <div id="section_info_access_lists" class="section_info">
3636		- <p><?php esc_html_e( 'Manage who has access to this site using these lists.', 'authorizer' ); ?></p>
	3374	+ ?><div id="section_info_access_lists" class="section_info">
	3375	+ <p><?php _e( 'Manage who has access to this site using these lists.', 'authorizer' ); ?></p>
3637	3376	<ol>
3638		- <li><?php echo wp_kses( __( "<strong>Pending</strong> users are users who have successfully logged in to the site, but who haven't yet been approved (or blocked) by you.", 'authorizer' ), $this->allowed_html ); ?></li>
3639		- <li><?php echo wp_kses( __( '<strong>Approved</strong> users have access to the site once they successfully log in.', 'authorizer' ), $this->allowed_html ); ?></li>
3640		- <li><?php echo wp_kses( __( '<strong>Blocked</strong> users will receive an error message when they try to visit the site after authenticating.', 'authorizer' ), $this->allowed_html ); ?><br><?php esc_html_e( 'Note: if you want to block all email addresses from a domain, say anyone@example.com, simply add "@example.com" to the blocked list.', 'authorizer' ); ?></li>
	3377	+ <li><?php _e( "<strong>Pending</strong> users are users who have successfully logged in to the site, but who haven't yet been approved (or blocked) by you.", 'authorizer' ); ?></li>
	3378	+ <li><?php _e( '<strong>Approved</strong> users have access to the site once they successfully log in.', 'authorizer' ); ?></li>
	3379	+ <li><?php _e( '<strong>Blocked</strong> users will receive an error message when they try to visit the site after authenticating.', 'authorizer' ); ?></li>
3641	3380	</ol>
3642	3381	</div>
3643	3382	<table class="form-table">
3644	3383	<tbody>
3645	3384	<tr>
3646		- <th scope="row"><?php esc_html_e( 'Pending Users', 'authorizer' ); ?> <em>(<?php echo esc_html( $this->get_user_count_from_list( 'pending', $admin_mode ) ); ?>)</em></th>
	3385	+ <th scope="row"><?php _e( 'Pending Users', 'authorizer' ); ?> <em>(<?php echo $this->get_user_count_from_list( 'pending', $admin_mode ); ?>)</em></th>
3647	3386	<td><?php $this->print_combo_auth_access_users_pending(); ?></td>
3648	3387	</tr>
3649	3388	<tr>
3650		- <th scope="row"><?php esc_html_e( 'Approved Users', 'authorizer' ); ?> <em>(<?php echo esc_html( $this->get_user_count_from_list( 'approved', $admin_mode ) ); ?>)</em></th>
	3389	+ <th scope="row"><?php _e( 'Approved Users', 'authorizer' ); ?> <em>(<?php echo $this->get_user_count_from_list( 'approved', $admin_mode ); ?>)</em></th>
3651	3390	<td><?php $this->print_combo_auth_access_users_approved(); ?></td>
3652	3391	</tr>
3653	3392	<tr>
3654		- <th scope="row"><?php esc_html_e( 'Blocked Users', 'authorizer' ); ?> <em>(<?php echo esc_html( $this->get_user_count_from_list( 'blocked', $admin_mode ) ); ?>)</em></th>
	3393	+ <th scope="row"><?php _e( 'Blocked Users', 'authorizer' ); ?> <em>(<?php echo $this->get_user_count_from_list( 'blocked', $admin_mode ); ?>)</em></th>
3655	3394	<td><?php $this->print_combo_auth_access_users_blocked(); ?></td>
3656	3395	</tr>
3657	3396	</tbody>
3658	3397	</table>
		@@ -3659,76 +3398,61 @@
3659	3398	<?php
3660	3399	}
3661	3400
3662	3401
3663		- /**
3664		- * Settings print callback.
3665		- *
3666		- * @param string $args Args (e.g., multisite admin mode).
3667		- * @return void
3668		- */
3669		- public function print_combo_auth_access_users_pending( $args = '' ) {
	3402	+ function print_combo_auth_access_users_pending( $args = '' ) {
3670	3403	// Get plugin option.
3671		- $option = 'access_users_pending';
	3404	+ $option = 'access_users_pending';
3672	3405	$auth_settings_option = $this->get_plugin_option( $option );
3673	3406	$auth_settings_option = is_array( $auth_settings_option ) ? $auth_settings_option : array();
3674	3407
3675	3408	// Render wrapper div (for aligning pager to width of content).
3676		- ?>
3677		- <div class="wrapper_<?php echo esc_attr( $option ); ?>">
3678		- <ul id="list_auth_settings_access_users_pending" style="margin:0;">
3679		- <?php
3680		- if ( count( $auth_settings_option ) > 0 ) :
3681		- foreach ( $auth_settings_option as $key => $pending_user ) :
3682		- if ( empty( $pending_user ) || count( $pending_user ) < 1 ) :
3683		- continue;
3684		- endif;
3685		- $pending_user['is_wp_user'] = false;
3686		- ?>
3687		- <li>
3688		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>_<?php echo esc_attr( $key ); ?>" value="<?php echo esc_attr( $pending_user['email'] ); ?>" readonly="true" class="auth-email" />
3689		- <select id="auth_settings_<?php echo esc_attr( $option ); ?>_<?php echo esc_attr( $key ); ?>_role" class="auth-role">
3690		- <?php $this->wp_dropdown_permitted_roles( $pending_user['role'] ); ?>
3691		- </select>
3692		- <a href="javascript:void(0);" class="button-primary" id="approve_user_<?php echo esc_attr( $key ); ?>" onclick="authAddUser( this, 'approved', false ); authIgnoreUser( this, 'pending' );"><span class="glyphicon glyphicon-ok"></span> <?php esc_html_e( 'Approve', 'authorizer' ); ?></a>
3693		- <a href="javascript:void(0);" class="button-primary" id="block_user_<?php echo esc_attr( $key ); ?>" onclick="authAddUser( this, 'blocked', false ); authIgnoreUser( this, 'pending' );"><span class="glyphicon glyphicon-ban-circle"></span> <?php esc_html_e( 'Block', 'authorizer' ); ?></a>
3694		- <a href="javascript:void(0);" class="button button-secondary" id="ignore_user_<?php echo esc_attr( $key ); ?>" onclick="authIgnoreUser( this, 'pending' );" title="<?php esc_html_e( 'Remove user', 'authorizer' ); ?>"><span class="glyphicon glyphicon-remove"></span> <?php esc_html_e( 'Ignore', 'authorizer' ); ?></a>
3695		- </li>
3696		- <?php endforeach; ?>
3697		- <?php else : ?>
3698		- <li class="auth-empty"><em><?php esc_html_e( 'No pending users', 'authorizer' ); ?></em></li>
3699		- <?php endif; ?>
3700		- </ul>
	3409	+ ?><div class="wrapper_<?php echo $option; ?>"><?php
	3410	+
	3411	+ // Print option elements.
	3412	+ ?><ul id="list_auth_settings_access_users_pending" style="margin:0;">
	3413	+ <?php if ( count( $auth_settings_option ) > 0 ) : ?>
	3414	+ <?php foreach ( $auth_settings_option as $key => $pending_user ): ?>
	3415	+ <?php if ( empty( $pending_user ) || count( $pending_user ) < 1 ) continue; ?>
	3416	+ <?php $pending_user['is_wp_user'] = false; ?>
	3417	+ <li>
	3418	+ <input type="text" id="auth_settings_<?php echo $option; ?>_<?php echo $key; ?>" value="<?php echo $pending_user['email']; ?>" readonly="true" class="auth-email" />
	3419	+ <select id="auth_settings_<?php echo $option; ?>_<?php echo $key; ?>_role" class="auth-role">
	3420	+ <?php $this->wp_dropdown_permitted_roles( $pending_user['role'] ); ?>
	3421	+ </select>
	3422	+ <a href="javascript:void(0);" class="button-primary" id="approve_user_<?php echo $key; ?>" onclick="auth_add_user( this, 'approved', false ); auth_ignore_user( this, 'pending' );"><span class="glyphicon glyphicon-ok"></span> <?php _e( 'Approve', 'authorizer' ); ?></a>
	3423	+ <a href="javascript:void(0);" class="button-primary" id="block_user_<?php echo $key; ?>" onclick="auth_add_user( this, 'blocked', false ); auth_ignore_user( this, 'pending' );"><span class="glyphicon glyphicon-ban-circle"></span> <?php _e( 'Block', 'authorizer' ); ?></a>
	3424	+ <a href="javascript:void(0);" class="button button-secondary" id="ignore_user_<?php echo $key; ?>" onclick="auth_ignore_user( this, 'pending' );" title="<?php _e( 'Remove user', 'authorizer' ); ?>"><span class="glyphicon glyphicon-remove"></span> <?php _e( 'Ignore', 'authorizer' ); ?></a>
	3425	+ </li>
	3426	+ <?php endforeach; ?>
	3427	+ <?php else: ?>
	3428	+ <li class="auth-empty"><em><?php _e( 'No pending users', 'authorizer' ); ?></em></li>
	3429	+ <?php endif; ?>
	3430	+ </ul>
3701	3431	</div>
3702	3432	<?php
3703	3433	}
3704	3434
3705	3435
3706		- /**
3707		- * Settings print callback.
3708		- *
3709		- * @param string $args Args (e.g., multisite admin mode).
3710		- * @return void
3711		- */
3712		- public function print_combo_auth_access_users_approved( $args = '' ) {
	3436	+ function print_combo_auth_access_users_approved( $args = '' ) {
3713	3437	// Get plugin option.
3714		- $option = 'access_users_approved';
3715		- $admin_mode = $this->get_admin_mode( $args );
	3438	+ $option = 'access_users_approved';
	3439	+ $admin_mode = $this->get_admin_mode( $args );
3716	3440	$auth_settings_option = $this->get_plugin_option( $option, $admin_mode, 'no override' );
3717	3441	$auth_settings_option = is_array( $auth_settings_option ) ? $auth_settings_option : array();
3718	3442
3719	3443	// Get multisite approved users (will be added to top of list, greyed out).
3720		- $auth_override_multisite = $this->get_plugin_option( 'advanced_override_multisite' );
3721		- $auth_multisite_settings = $this->get_plugin_options( WP_Plugin_Authorizer::NETWORK_CONTEXT );
	3444	+ $auth_override_multisite = $this->get_plugin_option( 'advanced_override_multisite' );
	3445	+ $auth_multisite_settings = $this->get_plugin_options( MULTISITE_ADMIN );
3722	3446	$auth_settings_option_multisite = array();
3723	3447	if (
3724	3448	is_multisite() &&
3725	3449	! is_network_admin() &&
3726		- '1' !== intval( $auth_override_multisite ) &&
	3450	+ $auth_override_multisite != '1' &&
3727	3451	array_key_exists( 'multisite_override', $auth_multisite_settings ) &&
3728		- '1' === $auth_multisite_settings['multisite_override']
	3452	+ $auth_multisite_settings['multisite_override'] === '1'
3729	3453	) {
3730		- $auth_settings_option_multisite = $this->get_plugin_option( $option, WP_Plugin_Authorizer::NETWORK_CONTEXT, 'allow override' );
	3454	+ $auth_settings_option_multisite = $this->get_plugin_option( $option, MULTISITE_ADMIN, 'allow override' );
3731	3455	$auth_settings_option_multisite = is_array( $auth_settings_option_multisite ) ? $auth_settings_option_multisite : array();
3732	3456	// Add multisite users to the beginning of the main user array.
3733	3457	foreach ( array_reverse( $auth_settings_option_multisite ) as $approved_user ) {
3734	3458	$approved_user['multisite_user'] = true;
		@@ -3736,48 +3460,41 @@
3736	3460	}
3737	3461	}
3738	3462
3739	3463	// Get default role for new user dropdown.
3740		- $access_default_role = $this->get_plugin_option( 'access_default_role', WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
	3464	+ $access_default_role = $this->get_plugin_option( 'access_default_role', SINGLE_ADMIN, 'allow override' );
3741	3465
3742	3466	// Get custom usermeta field to show.
3743	3467	$advanced_usermeta = $this->get_plugin_option( 'advanced_usermeta' );
3744	3468
3745	3469	// Adjust javascript function prefixes if multisite.
3746		- $js_function_prefix = WP_Plugin_Authorizer::NETWORK_CONTEXT === $admin_mode ? 'authMultisite' : 'auth';
3747		- $is_multisite_admin_page = WP_Plugin_Authorizer::NETWORK_CONTEXT === $admin_mode;
	3470	+ $js_function_prefix = $admin_mode === MULTISITE_ADMIN ? 'auth_multisite_' : 'auth_';
	3471	+ $is_multisite_admin_page = $admin_mode === MULTISITE_ADMIN;
3748	3472
3749	3473	// Filter user list to search terms.
3750		- // phpcs:ignore WordPress.CSRF.NonceVerification.NoNonceVerification
3751		- if ( isset( $_REQUEST['search'] ) && strlen( sanitize_text_field( wp_unslash( $_REQUEST['search'] ) ) ) > 0 ) {
3752		- // phpcs:ignore WordPress.CSRF.NonceVerification.NoNonceVerification
3753		- $search_term = sanitize_text_field( wp_unslash( $_REQUEST['search'] ) );
3754		- $auth_settings_option = array_filter(
3755		- $auth_settings_option, function ( $user ) use ( $search_term ) {
3756		- return stripos( $user['email'], $search_term ) !== false ||
3757		- stripos( $user['role'], $search_term ) !== false ||
3758		- stripos( $user['date_added'], $search_term ) !== false;
3759		- }
3760		- );
	3474	+ if ( isset( $_REQUEST['search'] ) && strlen( $_REQUEST['search'] ) > 0 ) {
	3475	+ $search_term = $_REQUEST['search'];
	3476	+ $auth_settings_option = array_filter( $auth_settings_option, function ( $user ) use ( $search_term ) {
	3477	+ return stripos( $user['email'], $search_term ) !== FALSE ||
	3478	+ stripos( $user['role'], $search_term ) !== FALSE ||
	3479	+ stripos( $user['date_added'], $search_term ) !== FALSE;
	3480	+ } );
3761	3481	}
3762	3482
3763	3483	// Sort user list.
3764		- $sort_by = $this->get_plugin_option( 'advanced_users_sort_by', WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' ); // email, role, date_added (registered), created (date approved).
3765		- $sort_order = $this->get_plugin_option( 'advanced_users_sort_order', WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' ); // asc or desc.
	3484	+ $sort_by = $this->get_plugin_option( 'advanced_users_sort_by', SINGLE_ADMIN, 'allow override' ); // email, role, date_added (registered), created (date approved)
	3485	+ $sort_order = $this->get_plugin_option( 'advanced_users_sort_order', SINGLE_ADMIN, 'allow override' ); // asc or desc
3766	3486	$sort_dimension = array();
3767		- if ( in_array( $sort_by, array( 'email', 'role', 'date_added' ), true ) ) {
	3487	+ if ( in_array( $sort_by, array( 'email', 'role', 'date_added' ) ) ) {
3768	3488	foreach ( $auth_settings_option as $key => $user ) {
3769		- if ( 'date_added' === $sort_by ) {
3770		- $sort_dimension[ $key ] = date( 'Ymd', strtotime( $user[ $sort_by ] ) );
	3489	+ if ( $sort_by === 'date_added' ) {
	3490	+ $sort_dimension[$key] = date( 'Ymd', strtotime( $user[$sort_by] ) );
3771	3491	} else {
3772		- $sort_dimension[ $key ] = strtolower( $user[ $sort_by ] );
	3492	+ $sort_dimension[$key] = strtolower( $user[$sort_by] );
3773	3493	}
3774	3494	}
3775		- $sort_order = 'asc' === $sort_order ? SORT_ASC : SORT_DESC;
	3495	+ $sort_order = $sort_order == 'asc' ? SORT_ASC : SORT_DESC;
3776	3496	array_multisort( $sort_dimension, $sort_order, $auth_settings_option );
3777		- } elseif ( 'created' === $sort_by && 'asc' !== $sort_order ) {
3778		- // If default sort method and reverse order, just reverse the array.
3779		- $auth_settings_option = array_reverse( $auth_settings_option );
3780	3497	}
3781	3498
3782	3499	// Ensure array keys run from 0..max (keys in database will be the original,
3783	3500	// index, and removing users will not reorder the array keys of other users).
		@@ -3783,13 +3500,12 @@
3783	3500	// index, and removing users will not reorder the array keys of other users).
3784	3501	$auth_settings_option = array_values( $auth_settings_option );
3785	3502
3786	3503	// Get pager params.
3787		- $total_users = count( $auth_settings_option );
3788		- $users_per_page = intval( $this->get_plugin_option( 'advanced_users_per_page', WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' ) );
3789		- // phpcs:ignore WordPress.CSRF.NonceVerification.NoNonceVerification
	3504	+ $total_users = count( $auth_settings_option );
	3505	+ $users_per_page = intval( $this->get_plugin_option( 'advanced_users_per_page', SINGLE_ADMIN, 'allow override' ) );
3790	3506	$current_page = isset( $_REQUEST['paged'] ) ? intval( $_REQUEST['paged'] ) : 1;
3791		- $total_pages = ceil( $total_users / $users_per_page );
	3507	+ $total_pages = ceil( $total_users / $users_per_page );
3792	3508	if ( $total_pages < 1 ) {
3793	3509	$total_pages = 1;
3794	3510	}
3795	3511
		@@ -3795,80 +3511,79 @@
3795	3511
3796	3512	// Make sure current_page is between 1 and max pages.
3797	3513	if ( $current_page < 1 ) {
3798	3514	$current_page = 1;
3799		- } elseif ( $current_page > $total_pages ) {
	3515	+ } else if ( $current_page > $total_pages ) {
3800	3516	$current_page = $total_pages;
3801	3517	}
3802	3518
3803	3519	// Render wrapper div (for aligning pager to width of content).
3804		- ?>
3805		- <div class="wrapper_<?php echo esc_attr( $option ); ?>">
3806		- <?php $this->render_user_pager( $current_page, $users_per_page, $total_users, 'top' ); ?>
3807		- <ul id="list_auth_settings_access_users_approved" class="<?php echo strlen( $advanced_usermeta ) > 0 ? 'has-usermeta' : ''; ?>">
3808		- <?php
3809		- $offset = ( $current_page - 1 ) * $users_per_page;
3810		- $max = min( $offset + $users_per_page, count( $auth_settings_option ) );
3811		- for ( $key = $offset; $key < $max; $key++ ) :
3812		- $approved_user = $auth_settings_option[ $key ];
3813		- if ( empty( $approved_user ) || count( $approved_user ) < 1 ) :
3814		- continue;
3815		- endif;
3816		- $this->render_user_element( $approved_user, $key, $option, $admin_mode, $advanced_usermeta );
3817		- endfor;
3818		- ?>
3819		- </ul>
	3520	+ ?><div class="wrapper_<?php echo $option; ?>"><?php
3820	3521
3821		- <div id="new_auth_settings_<?php echo esc_attr( $option ); ?>">
3822		- <textarea id="new_approved_user_email" placeholder="<?php esc_attr_e( 'email address', 'authorizer' ); ?>" class="auth-email new autogrow-short" rows="1"></textarea>
3823		- <select id="new_approved_user_role" class="auth-role">
3824		- <?php $this->wp_dropdown_permitted_roles( $access_default_role, 'not disabled', $admin_mode ); ?>
3825		- </select>
3826		- <div class="btn-group">
3827		- <a href="javascript:void(0);" class="btn button-primary dropdown-toggle button-add-user" id="approve_user_new" onclick="<?php echo esc_attr( $js_function_prefix ); ?>AddUser(this, 'approved' );"><span class="glyphicon glyphicon-ok"></span> <?php esc_html_e( 'Approve', 'authorizer' ); ?></a>
3828		- <button type="button" class="btn button-primary dropdown-toggle" data-toggle="dropdown">
3829		- <span class="caret"></span>
3830		- <span class="sr-only"><?php esc_html_e( 'Toggle Dropdown', 'authorizer' ); ?></span>
3831		- </button>
3832		- <ul class="dropdown-menu" role="menu">
3833		- <li><a href="javascript:void(0);" onclick="<?php echo esc_attr( $js_function_prefix ); ?>AddUser( document.getElementById( 'approve_user_new' ), 'approved', true);"><?php esc_html_e( 'Create a local WordPress account instead, and email the user their password.', 'authorizer' ); ?></a></li>
3834		- </ul>
3835		- </div>
	3522	+ // Render pager.
	3523	+ $this->render_user_pager( $current_page, $users_per_page, $total_users, 'top' );
	3524	+
	3525	+ // Render user list.
	3526	+ ?><ul id="list_auth_settings_access_users_approved" class="<?php echo strlen( $advanced_usermeta ) > 0 ? 'has-usermeta' : ''; ?>"><?php
	3527	+ $offset = ( $current_page - 1 ) * $users_per_page;
	3528	+ $max = min( $offset + $users_per_page, count( $auth_settings_option ) );
	3529	+ for ( $key = $offset; $key < $max; $key++ ) :
	3530	+ $approved_user = $auth_settings_option[$key];
	3531	+ if ( empty( $approved_user ) || count( $approved_user ) < 1 ) :
	3532	+ continue;
	3533	+ endif;
	3534	+ $this->render_user_element( $approved_user, $key, $option, $admin_mode, $advanced_usermeta );
	3535	+ endfor; ?>
	3536	+ </ul><?php
	3537	+
	3538	+ ?><div id="new_auth_settings_<?php echo $option; ?>">
	3539	+ <textarea id="new_approved_user_email" placeholder="<?php _e( 'email address', 'authorizer' ); ?>" class="auth-email new autogrow-short" rows="1"></textarea>
	3540	+ <select id="new_approved_user_role" class="auth-role">
	3541	+ <?php $this->wp_dropdown_permitted_roles( $access_default_role, 'not disabled', $admin_mode ); ?>
	3542	+ </select>
	3543	+ <div class="btn-group">
	3544	+ <a href="javascript:void(0);" class="btn button-primary dropdown-toggle" id="approve_user_new" onclick="<?php echo $js_function_prefix; ?>add_user(this, 'approved' );"><span class="glyphicon glyphicon-ok"></span> <?php _e( 'Approve', 'authorizer' ); ?></a>
	3545	+ <button type="button" class="btn button-primary dropdown-toggle" data-toggle="dropdown">
	3546	+ <span class="caret"></span>
	3547	+ <span class="sr-only"><?php _e( 'Toggle Dropdown', 'authorizer' ); ?></span>
	3548	+ </button>
	3549	+ <ul class="dropdown-menu" role="menu">
	3550	+ <li><a href="javascript:void(0);" onclick="<?php echo $js_function_prefix; ?>add_user( document.getElementById('approve_user_new' ), 'approved', true);"><?php _e( 'Create a local WordPress <br />account instead, and email <br />the user their password.', 'authorizer' ); ?></a></li>
	3551	+ </ul>
3836	3552	</div>
3837		- <?php $this->render_user_pager( $current_page, $users_per_page, $total_users, 'bottom' ); ?>
3838	3553	</div>
3839	3554	<?php
	3555	+
	3556	+ // Render pager.
	3557	+ $this->render_user_pager( $current_page, $users_per_page, $total_users, 'bottom' );
	3558	+
	3559	+ ?></div><?php
3840	3560	}
3841	3561
3842	3562
3843	3563	/**
3844	3564	* Renders the html elements for the pager above and below the Approved User list.
3845		- *
3846		- * @param integer $current_page Which page we are currently viewing.
	3565	+ * @param integer $current_page Which page we are currently viewing.
3847	3566	* @param integer $users_per_page How many users to show per page.
3848		- * @param integer $total_users Total count of users in list.
3849		- * @param string $which Where to render the pager ('top' or 'bottom').
3850		- * @return void
	3567	+ * @param integer $total_users Total count of users in list.
	3568	+ * @param string $which Where to render the pager ('top' or 'bottom').
	3569	+ * @return null
3851	3570	*/
3852		- private function render_user_pager( $current_page = 1, $users_per_page = 20, $total_users = 0, $which = 'top' ) {
	3571	+ function render_user_pager( $current_page = 1, $users_per_page = 20, $total_users = 0, $which = 'top' ) {
3853	3572	$total_pages = ceil( $total_users / $users_per_page );
3854	3573	if ( $total_pages < 1 ) {
3855	3574	$total_pages = 1;
3856	3575	}
3857	3576
3858		- /* TRANSLATORS: %s: number of users */
3859	3577	$output = ' <span class="displaying-num">' . sprintf( _n( '%s user', '%s users', $total_users, 'authorizer' ), number_format_i18n( $total_users ) ) . '</span>';
3860	3578
3861	3579	$disable_first = $current_page <= 1;
3862		- $disable_prev = $current_page <= 1;
3863		- $disable_next = $current_page >= $total_pages;
3864		- $disable_last = $current_page >= $total_pages;
	3580	+ $disable_prev = $current_page <= 1;
	3581	+ $disable_next = $current_page >= $total_pages;
	3582	+ $disable_last = $current_page >= $total_pages;
3865	3583
3866		- $current_url = '';
3867		- if ( isset( $_SERVER['HTTP_HOST'], $_SERVER['REQUEST_URI'] ) ) {
3868		- $current_url = set_url_scheme( esc_url_raw( wp_unslash( $_SERVER['HTTP_HOST'] ) ) . esc_url_raw( wp_unslash( $_SERVER['REQUEST_URI'] ) ) );
3869		- $current_url = remove_query_arg( wp_removable_query_args(), $current_url );
3870		- }
	3584	+ $current_url = set_url_scheme( 'http://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'] );
	3585	+ $current_url = remove_query_arg( wp_removable_query_args(), $current_url );
3871	3586
3872	3587	$page_links = array();
3873	3588
3874	3589	$total_pages_before = '<span class="paging-input">';
		@@ -3876,10 +3591,9 @@
3876	3591
3877	3592	if ( $disable_first ) {
3878	3593	$page_links[] = '<span class="first-page tablenav-pages-navspan" aria-hidden="true">&laquo;</span>';
3879	3594	} else {
3880		- $page_links[] = sprintf(
3881		- "<a class='first-page' href='%s'><span class='screen-reader-text'>%s</span><span aria-hidden='true'>%s</span></a>",
	3595	+ $page_links[] = sprintf( "<a class='first-page' href='%s'><span class='screen-reader-text'>%s</span><span aria-hidden='true'>%s</span></a>",
3882	3596	esc_url( remove_query_arg( 'paged', $current_url ) ),
3883	3597	__( 'First page' ),
3884	3598	'&laquo;'
3885	3599	);
		@@ -3887,10 +3601,9 @@
3887	3601
3888	3602	if ( $disable_prev ) {
3889	3603	$page_links[] = '<span class="prev-page tablenav-pages-navspan" aria-hidden="true">&lsaquo;</span>';
3890	3604	} else {
3891		- $page_links[] = sprintf(
3892		- "<a class='prev-page' href='%s'><span class='screen-reader-text'>%s</span><span aria-hidden='true'>%s</span></a>",
	3605	+ $page_links[] = sprintf( "<a class='prev-page' href='%s'><span class='screen-reader-text'>%s</span><span aria-hidden='true'>%s</span></a>",
3893	3606	esc_url( add_query_arg( 'paged', max( 1, $current_page - 1 ), $current_url ) ),
3894	3607	__( 'Previous page' ),
3895	3608	'&lsaquo;'
3896	3609	);
		@@ -3899,25 +3612,21 @@
3899	3612	if ( 'bottom' === $which ) {
3900	3613	$html_current_page = '<span class="current-page-text">' . $current_page . '</span>';
3901	3614	$total_pages_before = '<span class="screen-reader-text">' . __( 'Current Page' ) . '</span><span id="table-paging" class="paging-input"><span class="tablenav-paging-text">';
3902	3615	} else {
3903		- $html_current_page = sprintf(
3904		- "%s<input class='current-page' id='current-page-selector' type='text' name='paged' value='%s' size='%d' aria-describedby='table-paging' /><span class='tablenav-paging-text'>",
	3616	+ $html_current_page = sprintf( "%s<input class='current-page' id='current-page-selector' type='text' name='paged' value='%s' size='%d' aria-describedby='table-paging' /><span class='tablenav-paging-text'>",
3905	3617	'<label for="current-page-selector" class="screen-reader-text">' . __( 'Current Page' ) . '</label>',
3906	3618	$current_page,
3907	3619	strlen( $total_pages )
3908	3620	);
3909	3621	}
3910		- /* TRANSLATORS: %s: number of pages */
3911	3622	$html_total_pages = sprintf( "<span class='total-pages'>%s</span>", number_format_i18n( $total_pages ) );
3912		- /* TRANSLATORS: 1: number of current page 2: number of total pages */
3913	3623	$page_links[] = $total_pages_before . sprintf( _x( '%1$s of %2$s', 'paging' ), $html_current_page, $html_total_pages ) . $total_pages_after;
3914	3624
3915	3625	if ( $disable_next ) {
3916	3626	$page_links[] = '<span class="next-page tablenav-pages-navspan" aria-hidden="true">&rsaquo;</span>';
3917	3627	} else {
3918		- $page_links[] = sprintf(
3919		- "<a class='next-page' href='%s'><span class='screen-reader-text'>%s</span><span aria-hidden='true'>%s</span></a>",
	3628	+ $page_links[] = sprintf( "<a class='next-page' href='%s'><span class='screen-reader-text'>%s</span><span aria-hidden='true'>%s</span></a>",
3920	3629	esc_url( add_query_arg( 'paged', min( $total_pages, $current_page + 1 ), $current_url ) ),
3921	3630	__( 'Next page' ),
3922	3631	'&rsaquo;'
3923	3632	);
		@@ -3925,10 +3634,9 @@
3925	3634
3926	3635	if ( $disable_last ) {
3927	3636	$page_links[] = '<span class="last-page tablenav-pages-navspan" aria-hidden="true">&raquo;</span>';
3928	3637	} else {
3929		- $page_links[] = sprintf(
3930		- "<a class='last-page' href='%s'><span class='screen-reader-text'>%s</span><span aria-hidden='true'>%s</span></a>",
	3638	+ $page_links[] = sprintf( "<a class='last-page' href='%s'><span class='screen-reader-text'>%s</span><span aria-hidden='true'>%s</span></a>",
3931	3639	esc_url( add_query_arg( 'paged', $total_pages, $current_url ) ),
3932	3640	__( 'Last page' ),
3933	3641	'&raquo;'
3934	3642	);
		@@ -3934,67 +3642,62 @@
3934	3642	);
3935	3643	}
3936	3644
3937	3645	$pagination_links_class = 'pagination-links';
3938		- $output .= "\n<span class='$pagination_links_class'>" . join( "\n", $page_links ) . '</span>';
	3646	+ $output .= "\n<span class='$pagination_links_class'>" . join( "\n", $page_links ) . '</span>';
3939	3647
3940	3648	$search_form = array();
3941	3649	if ( 'top' === $which ) {
3942		- // phpcs:ignore WordPress.CSRF.NonceVerification.NoNonceVerification
3943		- $search_term = isset( $_REQUEST['search'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['search'] ) ) : '';
	3650	+ $search_term = isset( $_REQUEST['search'] ) ? $_REQUEST['search'] : '';
3944	3651	$search_form[] = '<div class="search-box">';
3945	3652	$search_form[] = '<label class="screen-reader-text" for="user-search-input">' . __( 'Search Users', 'authorizer' ) . '</label>';
3946	3653	$search_form[] = '<input type="search" size="14" id="user-search-input" name="search" value="' . $search_term . '">';
3947		- $search_form[] = '<input type="button" id="search-submit" class="button" value="' . __( 'Search', 'authorizer' ) . '">';
	3654	+ $search_form[] = '<input type="button" id="search-submit" class="button" value="' . __( 'Search', 'authorizer' ) . '">';
3948	3655	$search_form[] = '</div>';
3949	3656	}
3950	3657	$search_form = join( "\n", $search_form );
3951	3658
3952	3659	$output = "<div class='tablenav-pages'>$output</div>";
3953		- ?>
3954		- <div class="tablenav top">
3955		- <?php echo wp_kses( $output, $this->allowed_html ); ?>
3956		- <?php echo wp_kses( $search_form, $this->allowed_html ); ?>
3957		- </div>
3958		- <?php
	3660	+
	3661	+ ?><div class="tablenav top">
	3662	+ <?php echo $output; ?>
	3663	+ <?php echo $search_form; ?>
	3664	+ </div><?php
3959	3665	}
3960	3666
3961	3667
3962	3668	/**
3963	3669	* Renders the html <li> element for a given user in a list.
3964		- *
3965		- * @param array $approved_user User array to render.
3966		- * @param int $key Index of user in list of users.
3967		- * @param string $option List user is in (e.g., 'access_users_approved').
3968		- * @param string $admin_mode Current admin context.
3969		- * @param string $advanced_usermeta Usermeta field to display.
3970		- * @return void
	3670	+ * @param array $approved_user User array to render.
	3671	+ * @param int $key Index of user in list of users.
	3672	+ * @param string $option List user is in (e.g., 'access_users_approved').
	3673	+ * @return null
3971	3674	*/
3972		- private function render_user_element( $approved_user, $key, $option, $admin_mode, $advanced_usermeta ) {
3973		- $is_local_user = array_key_exists( 'local_user', $approved_user ) && 'true' === $approved_user['local_user'];
3974		- $is_multisite_user = array_key_exists( 'multisite_user', $approved_user ) && true === $approved_user['multisite_user'];
3975		- $option_prefix = $is_multisite_user ? 'auth_multisite_settings_' : 'auth_settings_';
3976		- $option_id = $option_prefix . $option . '_' . $key;
3977		- $approved_wp_user = get_user_by( 'email', $approved_user['email'] );
3978		- $is_current_user = $approved_wp_user && get_current_user_id() === $approved_wp_user->ID;
	3675	+ function render_user_element( $approved_user, $key, $option, $admin_mode, $advanced_usermeta ) {
	3676	+ $is_local_user = array_key_exists( 'local_user', $approved_user ) && $approved_user['local_user'] === 'true';
	3677	+ $is_multisite_user = array_key_exists( 'multisite_user', $approved_user ) && $approved_user['multisite_user'] === true;
	3678	+ $option_prefix = $is_multisite_user ? 'auth_multisite_settings_' : 'auth_settings_';
	3679	+ $option_id = $option_prefix . $option . '_' . $key;
	3680	+ $approved_wp_user = get_user_by( 'email', $approved_user['email'] );
	3681	+ $is_current_user = $approved_wp_user && $approved_wp_user->ID === get_current_user_id();
3979	3682
3980	3683	// Adjust javascript function prefixes if multisite.
3981		- $js_function_prefix = WP_Plugin_Authorizer::NETWORK_CONTEXT === $admin_mode ? 'authMultisite' : 'auth';
3982		- $is_multisite_admin_page = WP_Plugin_Authorizer::NETWORK_CONTEXT === $admin_mode;
	3684	+ $js_function_prefix = $admin_mode === MULTISITE_ADMIN ? 'auth_multisite_' : 'auth_';
	3685	+ $is_multisite_admin_page = $admin_mode === MULTISITE_ADMIN;
3983	3686
3984	3687	if ( ! $approved_wp_user ) :
3985	3688	$approved_user['is_wp_user'] = false;
3986	3689	else :
3987	3690	$approved_user['is_wp_user'] = true;
3988		- $approved_user['email'] = $approved_wp_user->user_email;
3989		- $approved_user['role'] = $is_multisite_admin_page || count( $approved_wp_user->roles ) === 0 ? $approved_user['role'] : array_shift( $approved_wp_user->roles );
	3691	+ $approved_user['email'] = $approved_wp_user->user_email;
	3692	+ $approved_user['role'] = $is_multisite_admin_page || count( $approved_wp_user->roles ) === 0 ? $approved_user['role'] : array_shift( $approved_wp_user->roles );
3990	3693	$approved_user['date_added'] = $approved_wp_user->user_registered;
3991	3694
3992	3695	// Get usermeta field from the WordPress user's real usermeta.
3993	3696	if ( strlen( $advanced_usermeta ) > 0 ) :
3994	3697	if ( strpos( $advanced_usermeta, 'acf___' ) === 0 && class_exists( 'acf' ) ) :
3995		- // Get ACF Field value for the user.
3996		- $approved_user['usermeta'] = get_field( str_replace( 'acf___', '', $advanced_usermeta ), 'user_' . $approved_wp_user->ID );
	3698	+ // Get ACF Field value for the user
	3699	+ $approved_user['usermeta'] = get_field( str_replace('acf___', '', $advanced_usermeta ), 'user_' . $approved_wp_user->ID );
3997	3700	else :
3998	3701	// Get regular usermeta value for the user.
3999	3702	$approved_user['usermeta'] = get_user_meta( $approved_wp_user->ID, $advanced_usermeta, true );
4000	3703	endif;
		@@ -4004,22 +3707,21 @@
4004	3707	endif;
4005	3708	endif;
4006	3709	if ( ! array_key_exists( 'usermeta', $approved_user ) ) :
4007	3710	$approved_user['usermeta'] = '';
4008		- endif;
4009		- ?>
	3711	+ endif; ?>
4010	3712	<li>
4011	3713	<input
4012	3714	type="text"
4013		- id="<?php echo esc_attr( $option_id ); ?>"
4014		- value="<?php echo esc_attr( $approved_user['email'] ); ?>"
	3715	+ id="<?php echo $option_id; ?>"
	3716	+ value="<?php echo $approved_user['email']; ?>"
4015	3717	readonly="true"
4016		- class="<?php echo esc_attr( $this->create_class_name( 'email', $is_multisite_user ) ); ?>"
	3718	+ class="<?php echo $this->create_class_name( 'email', $is_multisite_user ); ?>"
4017	3719	/>
4018	3720	<select
4019		- id="<?php echo esc_attr( $option_id ); ?>_role"
4020		- class="<?php echo esc_attr( $this->create_class_name( 'role', $is_multisite_user ) ); ?>"
4021		- onchange="<?php echo esc_attr( $js_function_prefix ); ?>ChangeRole( this );"
	3721	+ id="<?php echo $option_id; ?>_role"
	3722	+ class="<?php echo $this->create_class_name( 'role', $is_multisite_user ); ?>"
	3723	+ onchange="<?php echo $js_function_prefix; ?>change_role( this );"
4022	3724	<?php if ( $is_multisite_user ) : ?>
4023	3725	disabled="disabled"
4024	3726	<?php endif; ?>
4025	3727	>
		@@ -4027,29 +3729,27 @@
4027	3729	<?php $this->wp_dropdown_permitted_roles( $approved_user['role'], $disable_input, $admin_mode ); ?>
4028	3730	</select>
4029	3731	<input
4030	3732	type="text"
4031		- id="<?php echo esc_attr( $option_id ); ?>_date_added"
4032		- value="<?php echo esc_attr( date( 'M Y', strtotime( $approved_user['date_added'] ) ) ); ?>"
	3733	+ id="<?php echo $option_id; ?>_date_added"
	3734	+ value="<?php echo date( 'M Y', strtotime( $approved_user['date_added'] ) ); ?>"
4033	3735	readonly="true"
4034		- class="<?php echo esc_attr( $this->create_class_name( 'date-added', $is_multisite_user ) ); ?>"
	3736	+ class="<?php echo $this->create_class_name( 'date-added', $is_multisite_user ); ?>"
4035	3737	/>
4036		- <?php
4037		- if ( strlen( $advanced_usermeta ) > 0 ) :
	3738	+ <?php if ( strlen( $advanced_usermeta ) > 0 ) :
4038	3739	$should_show_usermeta_in_text_field = true; // Fallback renderer for usermeta; try to use a select first.
4039	3740	if ( strpos( $advanced_usermeta, 'acf___' ) === 0 && class_exists( 'acf' ) ) :
4040		- $field_object = get_field_object( str_replace( 'acf___', '', $advanced_usermeta ) );
4041		- if ( is_array( $field_object ) && array_key_exists( 'type', $field_object ) && 'select' === $field_object['type'] ) :
4042		- $should_show_usermeta_in_text_field = false;
4043		- ?>
	3741	+ $field_object = get_field_object( str_replace('acf___', '', $advanced_usermeta ) );
	3742	+ if ( is_array( $field_object ) && array_key_exists( 'type', $field_object ) && $field_object['type'] === 'select' ) :
	3743	+ $should_show_usermeta_in_text_field = false; ?>
4044	3744	<select
4045		- id="<?php echo esc_attr( $option_id ); ?>_usermeta"
4046		- class="<?php echo esc_attr( $this->create_class_name( 'usermeta', $is_multisite_user ) ); ?>"
4047		- onchange="<?php echo esc_attr( $js_function_prefix ); ?>UpdateUsermeta( this );"
	3745	+ id="<?php echo $option_id; ?>_usermeta"
	3746	+ class="<?php echo $this->create_class_name( 'usermeta', $is_multisite_user ); ?>"
	3747	+ onchange="<?php echo $js_function_prefix; ?>update_usermeta( this );"
4048	3748	>
4049		- <option value=""<?php selected( empty( $approved_user['usermeta'] ) ); ?>><?php esc_html_e( '-- None --', 'authorizer' ); ?></option>
	3749	+ <option value=""<?php if ( empty( $approved_user['usermeta'] ) ) echo ' selected="selected"'; ?>><?php _e( '-- None --', 'authorizer' ); ?></option>
4050	3750	<?php foreach ( $field_object['choices'] as $key => $label ) : ?>
4051		- <option value="<?php echo esc_attr( $key ); ?>"<?php selected( $key === $approved_user['usermeta'] || ( isset( $approved_user['usermeta']['meta_value'] ) && $key === $approved_user['usermeta']['meta_value'] ) ); ?>><?php echo esc_html( $label ); ?></option>
	3751	+ <option value="<?php echo $key; ?>"<?php if ( $key === $approved_user['usermeta'] || ( isset( $approved_user['usermeta']['meta_value'] ) && $key === $approved_user['usermeta']['meta_value'] ) ) echo ' selected="selected"'; ?>><?php echo $label; ?></option>
4052	3752	<?php endforeach; ?>
4053	3753	</select>
4054	3754	<?php endif; ?>
4055	3755	<?php endif; ?>
		@@ -4055,20 +3755,20 @@
4055	3755	<?php endif; ?>
4056	3756	<?php if ( $should_show_usermeta_in_text_field ) : ?>
4057	3757	<input
4058	3758	type="text"
4059		- id="<?php echo esc_attr( $option_id ); ?>_usermeta"
4060		- value="<?php echo esc_attr( $approved_user['usermeta'], ENT_COMPAT ); ?>"
4061		- class="<?php echo esc_attr( $this->create_class_name( 'usermeta', $is_multisite_user ) ); ?>"
	3759	+ id="<?php echo $option_id; ?>_usermeta"
	3760	+ value="<?php echo htmlspecialchars( $approved_user['usermeta'], ENT_COMPAT ); ?>"
	3761	+ class="<?php echo $this->create_class_name( 'usermeta', $is_multisite_user ); ?>"
4062	3762	/>
4063		- <a class="button button-small button-primary update-usermeta" id="update_usermeta_<?php echo esc_attr( $key ); ?>" onclick="<?php echo esc_attr( $js_function_prefix ); ?>UpdateUsermeta( this );" title="Update usermeta"><span class="glyphicon glyphicon-floppy-saved"></span></a>
	3763	+ <a class="button button-small button-primary update-usermeta" id="update_usermeta_<?php echo $key; ?>" onclick="<?php echo $js_function_prefix; ?>update_usermeta( this );" title="Update usermeta"><span class="glyphicon glyphicon-floppy-saved"></span></a>
4064	3764	<?php endif; ?>
4065	3765	<?php endif; ?>
4066		- <?php if ( ! $is_current_user && ! $is_multisite_user ) : ?>
	3766	+ <?php if ( ! $is_current_user && ! $is_multisite_user ): ?>
4067	3767	<?php if ( ! $is_multisite_admin_page ) : ?>
4068		- <a class="button" id="block_user_<?php echo esc_attr( $key ); ?>" onclick="<?php echo esc_attr( $js_function_prefix ); ?>AddUser( this, 'blocked', false ); <?php echo esc_attr( $js_function_prefix ); ?>IgnoreUser( this, 'approved' );" title="<?php esc_attr_e( 'Block/Ban user', 'authorizer' ); ?>"><span class="glyphicon glyphicon-ban-circle"></span></a>
	3768	+ <a class="button" id="block_user_<?php echo $key; ?>" onclick="<?php echo $js_function_prefix; ?>add_user( this, 'blocked', false ); <?php echo $js_function_prefix; ?>ignore_user( this, 'approved' );" title="<?php _e( 'Block/Ban user', 'authorizer' ); ?>"><span class="glyphicon glyphicon-ban-circle"></span></a>
4069	3769	<?php endif; ?>
4070		- <a class="button" id="ignore_user_<?php echo esc_attr( $key ); ?>" onclick="<?php echo esc_attr( $js_function_prefix ); ?>IgnoreUser(this, 'approved' );" title="<?php esc_attr_e( 'Remove user', 'authorizer' ); ?>"><span class="glyphicon glyphicon-remove"></span></a>
	3770	+ <a class="button" id="ignore_user_<?php echo $key; ?>" onclick="<?php echo $js_function_prefix; ?>ignore_user(this, 'approved' );" title="<?php _e( 'Remove user', 'authorizer' ); ?>"><span class="glyphicon glyphicon-remove"></span></a>
4071	3771	<?php endif; ?>
4072	3772	<?php if ( $is_local_user ) : ?>
4073	3773	&nbsp;<a title="Local WordPress user" class="auth-local-user"><span class="glyphicon glyphicon-user"></span></a>
4074	3774	<?php endif; ?>
		@@ -4074,101 +3774,76 @@
4074	3774	<?php endif; ?>
4075	3775	<?php if ( $is_multisite_user ) : ?>
4076	3776	&nbsp;<a title="WordPress Multisite user" class="auth-multisite-user"><span class="glyphicon glyphicon-globe"></span></a>
4077	3777	<?php endif; ?>
4078		- </li>
4079		- <?php
	3778	+ </li><?php
4080	3779	}
4081	3780
4082	3781
4083		- /**
4084		- * Settings print callback.
4085		- *
4086		- * @param string $args Args (e.g., multisite admin mode).
4087		- * @return void
4088		- */
4089		- public function print_combo_auth_access_users_blocked( $args = '' ) {
	3782	+ function print_combo_auth_access_users_blocked( $args = '' ) {
4090	3783	// Get plugin option.
4091		- $option = 'access_users_blocked';
	3784	+ $option = 'access_users_blocked';
4092	3785	$auth_settings_option = $this->get_plugin_option( $option );
4093	3786	$auth_settings_option = is_array( $auth_settings_option ) ? $auth_settings_option : array();
4094	3787
4095	3788	// Get default role for new blocked user dropdown.
4096		- $access_default_role = $this->get_plugin_option( 'access_default_role', WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
	3789	+ $access_default_role = $this->get_plugin_option( 'access_default_role', SINGLE_ADMIN, 'allow override' );
4097	3790
4098	3791	// Render wrapper div (for aligning pager to width of content).
4099		- ?>
4100		- <div class="wrapper_<?php echo esc_attr( $option ); ?>">
4101		- <ul id="list_auth_settings_<?php echo esc_attr( $option ); ?>" style="margin:0;">
4102		- <?php
4103		- foreach ( $auth_settings_option as $key => $blocked_user ) :
4104		- if ( empty( $blocked_user ) || count( $blocked_user ) < 1 ) :
4105		- continue;
4106		- endif;
4107		- $blocked_wp_user = get_user_by( 'email', $blocked_user['email'] );
4108		- if ( $blocked_wp_user ) :
4109		- $blocked_user['email'] = $blocked_wp_user->user_email;
4110		- $blocked_user['role'] = array_shift( $blocked_wp_user->roles );
4111		- $blocked_user['date_added'] = $blocked_wp_user->user_registered;
4112		- $blocked_user['is_wp_user'] = true;
4113		- else :
4114		- $blocked_user['is_wp_user'] = false;
4115		- endif;
4116		- ?>
4117		- <li>
4118		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>_<?php echo esc_attr( $key ); ?>" value="<?php echo esc_attr( $blocked_user['email'] ); ?>" readonly="true" class="auth-email" />
4119		- <select id="auth_settings_<?php echo esc_attr( $option ); ?>_<?php echo esc_attr( $key ); ?>_role" class="auth-role">
4120		- <?php $this->wp_dropdown_permitted_roles( $blocked_user['role'] ); ?>
4121		- </select>
4122		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>_<?php echo esc_attr( $key ); ?>_date_added" value="<?php echo esc_attr( date( 'M Y', strtotime( $blocked_user['date_added'] ) ) ); ?>" readonly="true" class="auth-date-added" />
4123		- <a class="button" id="ignore_user_<?php echo esc_attr( $key ); ?>" onclick="authIgnoreUser( this, 'blocked' );" title="<?php esc_attr_e( 'Remove user', 'authorizer' ); ?>"><span class="glyphicon glyphicon-remove"></span></a>
4124		- </li>
4125		- <?php endforeach; ?>
4126		- </ul>
4127		- <div id="new_auth_settings_<?php echo esc_attr( $option ); ?>">
4128		- <input type="text" id="new_blocked_user_email" placeholder="<?php esc_attr_e( 'email address', 'authorizer' ); ?>" class="auth-email new" />
4129		- <select id="new_blocked_user_role" class="auth-role">
4130		- <option value="<?php echo esc_attr( $access_default_role ); ?>"><?php echo esc_html( ucfirst( $access_default_role ) ); ?></option>
4131		- </select>
4132		- <a href="javascript:void(0);" class="button-primary button-add-user" id="block_user_new" onclick="authAddUser( this, 'blocked' );"><span class="glyphicon glyphicon-ban-circle"></span> <?php esc_html_e( 'Block', 'authorizer' ); ?></a>
4133		- </div>
	3792	+ ?><div class="wrapper_<?php echo $option; ?>"><?php
	3793	+
	3794	+ // Print option elements.
	3795	+ ?><ul id="list_auth_settings_<?php echo $option; ?>" style="margin:0;">
	3796	+ <?php foreach ( $auth_settings_option as $key => $blocked_user ): ?>
	3797	+ <?php if ( empty( $blocked_user ) || count( $blocked_user ) < 1 ) continue; ?>
	3798	+ <?php if ( $blocked_wp_user = get_user_by( 'email', $blocked_user['email'] ) ): ?>
	3799	+ <?php $blocked_user['email'] = $blocked_wp_user->user_email; ?>
	3800	+ <?php $blocked_user['role'] = array_shift( $blocked_wp_user->roles ); ?>
	3801	+ <?php $blocked_user['date_added'] = $blocked_wp_user->user_registered; ?>
	3802	+ <?php $blocked_user['is_wp_user'] = true; ?>
	3803	+ <?php else: ?>
	3804	+ <?php $blocked_user['is_wp_user'] = false; ?>
	3805	+ <?php endif; ?>
	3806	+ <li>
	3807	+ <input type="text" id="auth_settings_<?php echo $option; ?>_<?php echo $key; ?>" value="<?php echo $blocked_user['email']; ?>" readonly="true" class="auth-email" />
	3808	+ <select id="auth_settings_<?php echo $option; ?>_<?php echo $key; ?>_role" class="auth-role">
	3809	+ <?php $this->wp_dropdown_permitted_roles( $blocked_user['role'] ); ?>
	3810	+ </select>
	3811	+ <input type="text" id="auth_settings_<?php echo $option; ?>_<?php echo $key; ?>_date_added" value="<?php echo date( 'M Y', strtotime( $blocked_user['date_added'] ) ); ?>" readonly="true" class="auth-date-added" />
	3812	+ <a class="button" id="ignore_user_<?php echo $key; ?>" onclick="auth_ignore_user(this, 'blocked' );" title="<?php _e( 'Remove user', 'authorizer' ); ?>"><span class="glyphicon glyphicon-remove"></span></a>
	3813	+ </li>
	3814	+ <?php endforeach; ?>
	3815	+ </ul>
	3816	+ <div id="new_auth_settings_<?php echo $option; ?>">
	3817	+ <input type="text" id="new_blocked_user_email" placeholder="<?php _e( 'email address', 'authorizer' ); ?>" class="auth-email new" />
	3818	+ <select id="new_blocked_user_role" class="auth-role">
	3819	+ <option value="<?php echo $access_default_role; ?>"><?php echo ucfirst( $access_default_role ); ?></option>
	3820	+ </select>
	3821	+ <a href="javascript:void(0);" class="button-primary" id="block_user_new" onclick="auth_add_user(this, 'blocked' );"><span class="glyphicon glyphicon-ban-circle"></span> <?php _e( 'Block', 'authorizer' ); ?></a>
4134	3822	</div>
	3823	+ </div>
4135	3824	<?php
4136	3825	}
4137	3826
4138	3827
4139		- /**
4140		- * Settings print callback.
4141		- *
4142		- * @param string $args Args (e.g., multisite admin mode).
4143		- * @return void
4144		- */
4145		- public function print_section_info_access_login( $args = '' ) {
4146		- ?>
4147		- <div id="section_info_access_login" class="section_info">
	3828	+ function print_section_info_access_login( $args = '' ) {
	3829	+ ?><div id="section_info_access_login" class="section_info">
4148	3830	<?php wp_nonce_field( 'save_auth_settings', 'nonce_save_auth_settings' ); ?>
4149		- <p><?php esc_html_e( 'Choose who is able to log into this site below.', 'authorizer' ); ?></p>
4150		- </div>
4151		- <?php
	3831	+ <p><?php _e( 'Choose who is able to log into this site below.', 'authorizer' ); ?></p>
	3832	+ </div><?php
4152	3833	}
4153	3834
4154	3835
4155		- /**
4156		- * Settings print callback.
4157		- *
4158		- * @param string $args Args (e.g., multisite admin mode).
4159		- * @return void
4160		- */
4161		- public function print_radio_auth_access_who_can_login( $args = '' ) {
	3836	+ function print_radio_auth_access_who_can_login( $args = '' ) {
4162	3837	// Get plugin option.
4163		- $option = 'access_who_can_login';
4164		- $admin_mode = $this->get_admin_mode( $args );
	3838	+ $option = 'access_who_can_login';
	3839	+ $admin_mode = $this->get_admin_mode( $args );
4165	3840	$auth_settings_option = $this->get_plugin_option( $option, $admin_mode, 'allow override', 'print overlay' );
4166	3841
4167	3842	// If this site is configured independently of any multisite overrides, make sure we are not grabbing the multisite value; otherwise, grab the multisite value to show behind the disabled overlay.
4168		- if ( is_multisite() && 1 === intval( $this->get_plugin_option( 'advanced_override_multisite' ) ) ) {
	3843	+ if ( is_multisite() && $this->get_plugin_option( 'advanced_override_multisite' ) == '1' ) {
4169	3844	$auth_settings_option = $this->get_plugin_option( $option );
4170		- } elseif ( is_multisite() && WP_Plugin_Authorizer::SINGLE_CONTEXT === $admin_mode && $this->get_plugin_option( 'multisite_override', WP_Plugin_Authorizer::NETWORK_CONTEXT ) === '1' ) {
	3845	+ } elseif ( is_multisite() && $admin_mode === SINGLE_ADMIN && $this->get_plugin_option( 'multisite_override', MULTISITE_ADMIN ) === '1' ) {
4171	3846	// Workaround: javascript code hides/shows other settings based
4172	3847	// on the selection in this option. If this option is overridden
4173	3848	// by a multisite option, it should show that value in order to
4174	3849	// correctly display the other appropriate options.
		@@ -4174,49 +3849,33 @@
4174	3849	// correctly display the other appropriate options.
4175	3850	// Side effect: this site option will be overwritten by the
4176	3851	// multisite option on save. Since this is a 2-item radio, we
4177	3852	// determined this was acceptable.
4178		- $auth_settings_option = $this->get_plugin_option( $option, WP_Plugin_Authorizer::NETWORK_CONTEXT );
	3853	+ $auth_settings_option = $this->get_plugin_option( $option, MULTISITE_ADMIN );
4179	3854	}
4180	3855
4181	3856	// Print option elements.
4182		- ?>
4183		- <input type="radio" id="radio_auth_settings_<?php echo esc_attr( $option ); ?>_external_users" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="external_users"<?php checked( 'external_users' === $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo esc_attr( $option ); ?>_external_users"><?php esc_html_e( 'All authenticated users (All external service users and all WordPress users)', 'authorizer' ); ?></label><br />
4184		- <input type="radio" id="radio_auth_settings_<?php echo esc_attr( $option ); ?>_approved_users" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="approved_users"<?php checked( 'approved_users' === $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo esc_attr( $option ); ?>_approved_users"><?php esc_html_e( 'Only', 'authorizer' ); ?> <a href="javascript:chooseTab('access_lists' );" id="dashboard_link_approved_users"><?php esc_html_e( 'approved users', 'authorizer' ); ?></a> <?php esc_html_e( '(Approved external users and all WordPress users)', 'authorizer' ); ?></label><br />
4185		- <?php
	3857	+ ?><input type="radio" id="radio_auth_settings_<?php echo $option; ?>_external_users" name="auth_settings[<?php echo $option; ?>]" value="external_users"<?php checked( 'external_users' == $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo $option; ?>_external_users"><?php _e( 'All authenticated users (All external service users and all WordPress users)', 'authorizer' ); ?></label><br />
	3858	+ <input type="radio" id="radio_auth_settings_<?php echo $option; ?>_approved_users" name="auth_settings[<?php echo $option; ?>]" value="approved_users"<?php checked( 'approved_users' == $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo $option; ?>_approved_users"><?php _e( 'Only', 'authorizer' ); ?> <a href="javascript:choose_tab('access_lists' );" id="dashboard_link_approved_users"><?php _e( 'approved users', 'authorizer' ); ?></a> <?php _e( '(Approved external users and all WordPress users)', 'authorizer' ); ?></label><br /><?php
4186	3859	}
4187	3860
4188	3861
4189		- /**
4190		- * Settings print callback.
4191		- *
4192		- * @param string $args Args (e.g., multisite admin mode).
4193		- * @return void
4194		- */
4195		- public function print_select_auth_access_role_receive_pending_emails( $args = '' ) {
	3862	+ function print_select_auth_access_role_receive_pending_emails( $args = '' ) {
4196	3863	// Get plugin option.
4197		- $option = 'access_role_receive_pending_emails';
	3864	+ $option = 'access_role_receive_pending_emails';
4198	3865	$auth_settings_option = $this->get_plugin_option( $option );
4199	3866
4200	3867	// Print option elements.
4201		- ?>
4202		- <select id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]">
4203		- <option value="---" <?php selected( $auth_settings_option, '---' ); ?>><?php esc_html_e( "None (Don't send notification emails)", 'authorizer' ); ?></option>
	3868	+ ?><select id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]">
	3869	+ <option value="---" <?php selected( $auth_settings_option, '---' ); ?>><?php _e( "None (Don't send notification emails)", 'authorizer' ); ?></option>
4204	3870	<?php wp_dropdown_roles( $auth_settings_option ); ?>
4205		- </select>
4206		- <?php
	3871	+ </select><?php
4207	3872	}
4208	3873
4209	3874
4210		- /**
4211		- * Settings print callback.
4212		- *
4213		- * @param string $args Args (e.g., multisite admin mode).
4214		- * @return void
4215		- */
4216		- public function print_wysiwyg_auth_access_pending_redirect_to_message( $args = '' ) {
	3875	+ function print_wysiwyg_auth_access_pending_redirect_to_message( $args = '' ) {
4217	3876	// Get plugin option.
4218		- $option = 'access_pending_redirect_to_message';
	3877	+ $option = 'access_pending_redirect_to_message';
4219	3878	$auth_settings_option = $this->get_plugin_option( $option );
4220	3879
4221	3880	// Print option elements.
4222	3881	wp_editor(
		@@ -4225,25 +3884,19 @@
4225	3884	array(
4226	3885	'media_buttons' => false,
4227	3886	'textarea_name' => "auth_settings[$option]",
4228	3887	'textarea_rows' => 5,
4229		- 'tinymce' => true,
4230		- 'teeny' => true,
4231		- 'quicktags' => false,
	3888	+ 'tinymce' => true,
	3889	+ 'teeny' => true,
	3890	+ 'quicktags' => false,
4232	3891	)
4233	3892	);
4234	3893	}
4235	3894
4236	3895
4237		- /**
4238		- * Settings print callback.
4239		- *
4240		- * @param string $args Args (e.g., multisite admin mode).
4241		- * @return void
4242		- */
4243		- public function print_wysiwyg_auth_access_blocked_redirect_to_message( $args = '' ) {
	3896	+ function print_wysiwyg_auth_access_blocked_redirect_to_message( $args = '' ) {
4244	3897	// Get plugin option.
4245		- $option = 'access_blocked_redirect_to_message';
	3898	+ $option = 'access_blocked_redirect_to_message';
4246	3899	$auth_settings_option = $this->get_plugin_option( $option );
4247	3900
4248	3901	// Print option elements.
4249	3902	wp_editor(
		@@ -4252,61 +3905,39 @@
4252	3905	array(
4253	3906	'media_buttons' => false,
4254	3907	'textarea_name' => "auth_settings[$option]",
4255	3908	'textarea_rows' => 5,
4256		- 'tinymce' => true,
4257		- 'teeny' => true,
4258		- 'quicktags' => false,
	3909	+ 'tinymce' => true,
	3910	+ 'teeny' => true,
	3911	+ 'quicktags' => false,
4259	3912	)
4260	3913	);
4261	3914	}
4262	3915
4263	3916
4264		- /**
4265		- * Settings print callback.
4266		- *
4267		- * @param string $args Args (e.g., multisite admin mode).
4268		- * @return void
4269		- */
4270		- public function print_checkbox_auth_access_should_email_approved_users( $args = '' ) {
	3917	+ function print_checkbox_auth_access_should_email_approved_users( $args = '' ) {
4271	3918	// Get plugin option.
4272		- $option = 'access_should_email_approved_users';
	3919	+ $option = 'access_should_email_approved_users';
4273	3920	$auth_settings_option = $this->get_plugin_option( $option );
4274	3921
4275	3922	// Print option elements.
4276		- ?>
4277		- <input type="checkbox" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="1"<?php checked( 1 === intval( $auth_settings_option ) ); ?> /><label for="auth_settings_<?php echo esc_attr( $option ); ?>"><?php esc_html_e( 'Send a welcome email when approving a new user', 'authorizer' ); ?></label>
4278		- <?php
	3923	+ ?><input type="checkbox" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="1"<?php checked( 1 == $auth_settings_option ); ?> /><label for="auth_settings_<?php echo $option; ?>"><?php _e( 'Send a welcome email when approving a new user', 'authorizer' ); ?></label><?php
4279	3924	}
4280	3925
4281	3926
4282		- /**
4283		- * Settings print callback.
4284		- *
4285		- * @param string $args Args (e.g., multisite admin mode).
4286		- * @return void
4287		- */
4288		- public function print_text_auth_access_email_approved_users_subject( $args = '' ) {
	3927	+ function print_text_auth_access_email_approved_users_subject( $args = '' ) {
4289	3928	// Get plugin option.
4290		- $option = 'access_email_approved_users_subject';
	3929	+ $option = 'access_email_approved_users_subject';
4291	3930	$auth_settings_option = $this->get_plugin_option( $option );
4292	3931
4293	3932	// Print option elements.
4294		- ?>
4295		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="Welcome to [site_name]!" style="width:320px;" /><br /><small><?php echo wp_kses( __( 'You can use the <b>[site_name]</b> shortcode.', 'authorizer' ), $this->allowed_html ); ?></small>
4296		- <?php
	3933	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="Welcome to [site_name]!" style="width:320px;" /><br /><small><?php _e( 'You can use the <b>[site_name]</b> shortcode.', 'authorizer' ); ?></small><?php
4297	3934	}
4298	3935
4299	3936
4300		- /**
4301		- * Settings print callback.
4302		- *
4303		- * @param string $args Args (e.g., multisite admin mode).
4304		- * @return void
4305		- */
4306		- public function print_wysiwyg_auth_access_email_approved_users_body( $args = '' ) {
	3937	+ function print_wysiwyg_auth_access_email_approved_users_body( $args = '' ) {
4307	3938	// Get plugin option.
4308		- $option = 'access_email_approved_users_body';
	3939	+ $option = 'access_email_approved_users_body';
4309	3940	$auth_settings_option = $this->get_plugin_option( $option );
4310	3941
4311	3942	// Print option elements.
4312	3943	wp_editor(
		@@ -4315,60 +3946,42 @@
4315	3946	array(
4316	3947	'media_buttons' => false,
4317	3948	'textarea_name' => "auth_settings[$option]",
4318	3949	'textarea_rows' => 9,
4319		- 'tinymce' => true,
4320		- 'teeny' => true,
4321		- 'quicktags' => false,
	3950	+ 'tinymce' => true,
	3951	+ 'teeny' => true,
	3952	+ 'quicktags' => false,
4322	3953	)
4323	3954	);
4324		- ?>
4325		- <small>
4326		- <?php
4327		- printf(
4328		- /* TRANSLATORS: 1: Shortcode for site name 2: Shortcode for site URL 3: Shortcode for user email */
4329		- wp_kses( __( 'You can use %1$s, %2$s, and %3$s shortcodes.', 'authorizer' ), $this->allowed_html ),
4330		- '<b>[site_name]</b>',
4331		- '<b>[site_url]</b>',
4332		- '<b>[user_email]</b>'
4333		- );
4334		- ?>
4335		- </small>
4336		- <?php
	3955	+
	3956	+ ?><small><?php printf(
	3957	+ /* TRANSLATORS: 1: Shortcode for site name 2: Shortcode for site URL 3: Shortcode for user email */
	3958	+ __( 'You can use %1$s, %2$s, and %3$s shortcodes.', 'authorizer' ),
	3959	+ '<b>[site_name]</b>',
	3960	+ '<b>[site_url]</b>',
	3961	+ '<b>[user_email]</b>'
	3962	+ ); ?></small><?php
	3963	+
4337	3964	}
4338	3965
4339	3966
4340		- /**
4341		- * Settings print callback.
4342		- *
4343		- * @param string $args Args (e.g., multisite admin mode).
4344		- * @return void
4345		- */
4346		- public function print_section_info_access_public( $args = '' ) {
4347		- ?>
4348		- <div id="section_info_access_public" class="section_info">
4349		- <p><?php esc_html_e( 'Choose your public access options here.', 'authorizer' ); ?></p>
4350		- </div>
4351		- <?php
	3967	+ function print_section_info_access_public( $args = '' ) {
	3968	+ ?><div id="section_info_access_public" class="section_info">
	3969	+ <p><?php _e( 'Choose your public access options here.', 'authorizer' ); ?></p>
	3970	+ </div><?php
4352	3971	}
4353	3972
4354	3973
4355		- /**
4356		- * Settings print callback.
4357		- *
4358		- * @param string $args Args (e.g., multisite admin mode).
4359		- * @return void
4360		- */
4361		- public function print_radio_auth_access_who_can_view( $args = '' ) {
	3974	+ function print_radio_auth_access_who_can_view( $args = '' ) {
4362	3975	// Get plugin option.
4363		- $option = 'access_who_can_view';
4364		- $admin_mode = $this->get_admin_mode( $args );
	3976	+ $option = 'access_who_can_view';
	3977	+ $admin_mode = $this->get_admin_mode( $args );
4365	3978	$auth_settings_option = $this->get_plugin_option( $option, $admin_mode, 'allow override', 'print overlay' );
4366	3979
4367	3980	// If this site is configured independently of any multisite overrides, make sure we are not grabbing the multisite value; otherwise, grab the multisite value to show behind the disabled overlay.
4368		- if ( is_multisite() && 1 === intval( $this->get_plugin_option( 'advanced_override_multisite' ) ) ) {
	3981	+ if ( is_multisite() && $this->get_plugin_option( 'advanced_override_multisite' ) == '1' ) {
4369	3982	$auth_settings_option = $this->get_plugin_option( $option );
4370		- } elseif ( is_multisite() && WP_Plugin_Authorizer::SINGLE_CONTEXT === $admin_mode && '1' === $this->get_plugin_option( 'multisite_override', WP_Plugin_Authorizer::NETWORK_CONTEXT ) ) {
	3983	+ } elseif ( is_multisite() && $admin_mode === SINGLE_ADMIN && $this->get_plugin_option( 'multisite_override', MULTISITE_ADMIN ) === '1' ) {
4371	3984	// Workaround: javascript code hides/shows other settings based
4372	3985	// on the selection in this option. If this option is overridden
4373	3986	// by a multisite option, it should show that value in order to
4374	3987	// correctly display the other appropriate options.
		@@ -4374,66 +3987,42 @@
4374	3987	// correctly display the other appropriate options.
4375	3988	// Side effect: this site option will be overwritten by the
4376	3989	// multisite option on save. Since this is a 2-item radio, we
4377	3990	// determined this was acceptable.
4378		- $auth_settings_option = $this->get_plugin_option( $option, WP_Plugin_Authorizer::NETWORK_CONTEXT );
	3991	+ $auth_settings_option = $this->get_plugin_option( $option, MULTISITE_ADMIN );
4379	3992	}
4380	3993
4381	3994	// Print option elements.
4382		- ?>
4383		- <input type="radio" id="radio_auth_settings_<?php echo esc_attr( $option ); ?>_everyone" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="everyone"<?php checked( 'everyone' === $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo esc_attr( $option ); ?>_everyone"><?php esc_html_e( 'Everyone can see the site', 'authorizer' ); ?></label><br />
4384		- <input type="radio" id="radio_auth_settings_<?php echo esc_attr( $option ); ?>_logged_in_users" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="logged_in_users"<?php checked( 'logged_in_users' === $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo esc_attr( $option ); ?>_logged_in_users"><?php esc_html_e( 'Only logged in users can see the site', 'authorizer' ); ?></label><br />
4385		- <?php
	3995	+ ?><input type="radio" id="radio_auth_settings_<?php echo $option; ?>_everyone" name="auth_settings[<?php echo $option; ?>]" value="everyone"<?php checked( 'everyone' == $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo $option; ?>_everyone"><?php _e( 'Everyone can see the site', 'authorizer' ); ?></label><br />
	3996	+ <input type="radio" id="radio_auth_settings_<?php echo $option; ?>_logged_in_users" name="auth_settings[<?php echo $option; ?>]" value="logged_in_users"<?php checked( 'logged_in_users' == $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo $option; ?>_logged_in_users"><?php _e( 'Only logged in users can see the site', 'authorizer' ); ?></label><br /><?php
4386	3997	}
4387	3998
4388	3999
4389		- /**
4390		- * Settings print callback.
4391		- *
4392		- * @param string $args Args (e.g., multisite admin mode).
4393		- * @return void
4394		- */
4395		- public function print_radio_auth_access_redirect( $args = '' ) {
	4000	+ function print_radio_auth_access_redirect( $args = '' ) {
4396	4001	// Get plugin option.
4397		- $option = 'access_redirect';
	4002	+ $option = 'access_redirect';
4398	4003	$auth_settings_option = $this->get_plugin_option( $option );
4399	4004
4400	4005	// Print option elements.
4401		- ?>
4402		- <input type="radio" id="radio_auth_settings_<?php echo esc_attr( $option ); ?>_to_login" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="login"<?php checked( 'login' === $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo esc_attr( $option ); ?>_to_login"><?php esc_html_e( 'Send them to the login screen', 'authorizer' ); ?></label><br />
4403		- <input type="radio" id="radio_auth_settings_<?php echo esc_attr( $option ); ?>_to_message" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="message"<?php checked( 'message' === $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo esc_attr( $option ); ?>_to_message"><?php esc_html_e( 'Show them the anonymous access message (below)', 'authorizer' ); ?></label>
4404		- <?php
	4006	+ ?><input type="radio" id="radio_auth_settings_<?php echo $option; ?>_to_login" name="auth_settings[<?php echo $option; ?>]" value="login"<?php checked( 'login' == $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo $option; ?>_to_login"><?php _e( 'Send them to the login screen', 'authorizer' ); ?></label><br />
	4007	+ <input type="radio" id="radio_auth_settings_<?php echo $option; ?>_to_message" name="auth_settings[<?php echo $option; ?>]" value="message"<?php checked( 'message' == $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo $option; ?>_to_message"><?php _e( 'Show them the anonymous access message (below)', 'authorizer' ); ?></label><?php
4405	4008	}
4406	4009
4407	4010
4408		- /**
4409		- * Settings print callback.
4410		- *
4411		- * @param string $args Args (e.g., multisite admin mode).
4412		- * @return void
4413		- */
4414		- public function print_radio_auth_access_public_warning( $args = '' ) {
	4011	+ function print_radio_auth_access_public_warning( $args = '' ) {
4415	4012	// Get plugin option.
4416		- $option = 'access_public_warning';
	4013	+ $option = 'access_public_warning';
4417	4014	$auth_settings_option = $this->get_plugin_option( $option );
4418	4015
4419	4016	// Print option elements.
4420		- ?>
4421		- <input type="radio" id="radio_auth_settings_<?php echo esc_attr( $option ); ?>_no" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="no_warning"<?php checked( 'no_warning' === $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo esc_attr( $option ); ?>_no"><?php echo wp_kses( __( 'Show them the page <strong>without</strong> the anonymous access message', 'authorizer' ), $this->allowed_html ); ?></label><br />
4422		- <input type="radio" id="radio_auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="warning"<?php checked( 'warning' === $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo esc_attr( $option ); ?>"><?php echo wp_kses( __( 'Show them the page <strong>with</strong> the anonymous access message (marked up as a <a href="http://getbootstrap.com/components/#alerts-dismissible" target="_blank">Bootstrap Dismissible Alert</a>)', 'authorizer' ), $this->allowed_html ); ?></label>
4423		- <?php
	4017	+ ?><input type="radio" id="radio_auth_settings_<?php echo $option; ?>_no" name="auth_settings[<?php echo $option; ?>]" value="no_warning"<?php checked( 'no_warning' == $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo $option; ?>_no"><?php _e( 'Show them the page <strong>without</strong> the anonymous access message', 'authorizer' ); ?></label><br />
	4018	+ <input type="radio" id="radio_auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="warning"<?php checked( 'warning' == $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo $option; ?>"><?php _e( 'Show them the page <strong>with</strong> the anonymous access message (marked up as a <a href="http://getbootstrap.com/components/#alerts-dismissible" target="_blank">Bootstrap Dismissible Alert</a>)', 'authorizer' ); ?></label><?php
4424	4019	}
4425	4020
4426	4021
4427		- /**
4428		- * Settings print callback.
4429		- *
4430		- * @param string $args Args (e.g., multisite admin mode).
4431		- * @return void
4432		- */
4433		- public function print_wysiwyg_auth_access_redirect_to_message( $args = '' ) {
	4022	+ function print_wysiwyg_auth_access_redirect_to_message( $args = '' ) {
4434	4023	// Get plugin option.
4435		- $option = 'access_redirect_to_message';
	4024	+ $option = 'access_redirect_to_message';
4436	4025	$auth_settings_option = $this->get_plugin_option( $option );
4437	4026
4438	4027	// Print option elements.
4439	4028	wp_editor(
		@@ -4442,25 +4031,19 @@
4442	4031	array(
4443	4032	'media_buttons' => false,
4444	4033	'textarea_name' => "auth_settings[$option]",
4445	4034	'textarea_rows' => 5,
4446		- 'tinymce' => true,
4447		- 'teeny' => true,
4448		- 'quicktags' => false,
	4035	+ 'tinymce' => true,
	4036	+ 'teeny' => true,
	4037	+ 'quicktags' => false,
4449	4038	)
4450	4039	);
4451	4040	}
4452	4041
4453	4042
4454		- /**
4455		- * Settings print callback.
4456		- *
4457		- * @param string $args Args (e.g., multisite admin mode).
4458		- * @return void
4459		- */
4460		- public function print_multiselect_auth_access_public_pages( $args = '' ) {
	4043	+ function print_multiselect_auth_access_public_pages( $args = '' ) {
4461	4044	// Get plugin option.
4462		- $option = 'access_public_pages';
	4045	+ $option = 'access_public_pages';
4463	4046	$auth_settings_option = $this->get_plugin_option( $option );
4464	4047	$auth_settings_option = is_array( $auth_settings_option ) ? $auth_settings_option : array();
4465	4048
4466	4049	$post_types = array_merge( array( 'page', 'post' ), get_post_types( array( '_builtin' => false ), 'names' ) );
		@@ -4466,31 +4049,23 @@
4466	4049	$post_types = array_merge( array( 'page', 'post' ), get_post_types( array( '_builtin' => false ), 'names' ) );
4467	4050	$post_types = is_array( $post_types ) ? $post_types : array();
4468	4051
4469	4052	// Print option elements.
4470		- ?>
4471		- <select id="auth_settings_<?php echo esc_attr( $option ); ?>" multiple="multiple" name="auth_settings[<?php echo esc_attr( $option ); ?>][]">
4472		- <optgroup label="<?php esc_attr_e( 'Home', 'authorizer' ); ?>">
4473		- <option value="home" <?php selected( in_array( 'home', $auth_settings_option, true ) ); ?>><?php esc_html_e( 'Home Page', 'authorizer' ); ?></option>
4474		- <option value="auth_public_404" <?php selected( in_array( 'auth_public_404', $auth_settings_option, true ) ); ?>><?php esc_html_e( 'Nonexistent (404) Pages', 'authorizer' ); ?></option>
	4053	+ ?><select id="auth_settings_<?php echo $option; ?>" multiple="multiple" name="auth_settings[<?php echo $option; ?>][]">
	4054	+ <optgroup label="<?php _e( 'Home', 'authorizer' ); ?>">
	4055	+ <option value="home" <?php echo in_array( 'home', $auth_settings_option ) ? 'selected="selected"' : ''; ?>><?php _e( 'Home Page', 'authorizer' ); ?></option>
	4056	+ <option value="auth_public_404" <?php echo in_array( 'auth_public_404', $auth_settings_option ) ? 'selected="selected"' : ''; ?>><?php _e( 'Nonexistent (404) Pages', 'authorizer' ); ?></option>
4475	4057	</optgroup>
4476		- <?php foreach ( $post_types as $post_type ) : ?>
4477		- <optgroup label="<?php echo esc_attr( ucfirst( $post_type ) ); ?>">
4478		- <?php
4479		- $pages = get_posts(
4480		- array(
4481		- 'post_type' => $post_type,
4482		- 'posts_per_page' => 1000, // phpcs:ignore WordPress.VIP.PostsPerPage.posts_per_page_posts_per_page
4483		- )
4484		- );
4485		- $pages = is_array( $pages ) ? $pages : array();
4486		- foreach ( $pages as $page ) :
4487		- ?>
4488		- <option value="<?php echo esc_attr( $page->ID ); ?>" <?php selected( in_array( strval( $page->ID ), $auth_settings_option, true ) ); ?>><?php echo esc_html( $page->post_title ); ?></option>
	4058	+ <?php foreach ( $post_types as $post_type ): ?>
	4059	+ <optgroup label="<?php echo ucfirst( $post_type ); ?>">
	4060	+ <?php $pages = get_posts( array( 'post_type' => $post_type, 'posts_per_page' => -1 ) ); ?>
	4061	+ <?php $pages = is_array( $pages ) ? $pages : array(); ?>
	4062	+ <?php foreach ( $pages as $page ): ?>
	4063	+ <option value="<?php echo $page->ID; ?>" <?php echo in_array( $page->ID, $auth_settings_option ) ? 'selected="selected"' : ''; ?>><?php echo $page->post_title; ?></option>
4489	4064	<?php endforeach; ?>
4490	4065	</optgroup>
4491	4066	<?php endforeach; ?>
4492		- <optgroup label="<?php esc_attr_e( 'Categories', 'authorizer' ); ?>">
	4067	+ <optgroup label="<?php _e( 'Categories', 'authorizer' ); ?>">
4493	4068	<?php
4494	4069	// If sitepress-multilingual-cms plugin is enabled, temporarily disable
4495	4070	// its terms_clauses filter since it conflicts with the category handling.
4496	4071	if ( array_key_exists( 'sitepress', $GLOBALS ) && is_object( $GLOBALS['sitepress'] ) ) {
		@@ -4499,155 +4074,107 @@
4499	4074	add_filter( 'terms_clauses', array( $GLOBALS['sitepress'], 'terms_clauses' ) );
4500	4075	} else {
4501	4076	$categories = get_categories( array( 'hide_empty' => false ) );
4502	4077	}
4503		- foreach ( $categories as $category ) :
4504		- ?>
4505		- <option value="<?php echo esc_attr( 'cat_' . $category->slug ); ?>" <?php selected( in_array( 'cat_' . $category->slug, $auth_settings_option, true ) ); ?>><?php echo esc_html( $category->name ); ?></option>
	4078	+ foreach ( $categories as $category ) : ?>
	4079	+ <option value="<?php echo 'cat_' . $category->slug; ?>" <?php echo in_array( 'cat_' . $category->slug, $auth_settings_option ) ? 'selected="selected"' : ''; ?>><?php echo $category->name; ?></option>
4506	4080	<?php endforeach; ?>
4507	4081	</optgroup>
4508		- </select>
4509		- <?php
	4082	+ </select><?php
4510	4083	}
4511	4084
4512	4085
4513		- /**
4514		- * Settings print callback.
4515		- *
4516		- * @param string $args Args (e.g., multisite admin mode).
4517		- * @return void
4518		- */
4519		- public function print_section_info_external( $args = '' ) {
4520		- ?>
4521		- <div id="section_info_external" class="section_info">
4522		- <p><?php esc_html_e( 'Enter your external server settings below.', 'authorizer' ); ?></p>
4523		- </div>
4524		- <?php
	4086	+ function print_section_info_external( $args = '' ) {
	4087	+ ?><div id="section_info_external" class="section_info">
	4088	+ <p><?php _e( 'Enter your external server settings below.', 'authorizer' ); ?></p>
	4089	+ </div><?php
4525	4090	}
4526	4091
4527	4092
4528		- /**
4529		- * Settings print callback.
4530		- *
4531		- * @param string $args Args (e.g., multisite admin mode).
4532		- * @return void
4533		- */
4534		- public function print_select_auth_access_default_role( $args = '' ) {
	4093	+ function get_admin_mode( $args ) {
	4094	+ if ( is_array( $args ) && array_key_exists( MULTISITE_ADMIN, $args ) && $args[MULTISITE_ADMIN] === true ) {
	4095	+ return MULTISITE_ADMIN;
	4096	+ } else {
	4097	+ return SINGLE_ADMIN;
	4098	+ }
	4099	+ }
	4100	+
	4101	+
	4102	+ function print_select_auth_access_default_role( $args = '' ) {
4535	4103	// Get plugin option.
4536		- $option = 'access_default_role';
	4104	+ $option = 'access_default_role';
4537	4105	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4538	4106
4539	4107	// Print option elements.
4540		- ?>
4541		- <select id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]">
	4108	+ ?><select id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]">
4542	4109	<?php wp_dropdown_roles( $auth_settings_option ); ?>
4543		- <option value=""<?php selected( '' === $auth_settings_option ); ?>><?php esc_html_e( '-- None --', 'authorizer' ); ?></option>
4544		- </select>
4545		- <?php
	4110	+ </select><?php
4546	4111	}
4547	4112
4548	4113
4549		- /**
4550		- * Settings print callback.
4551		- *
4552		- * @param string $args Args (e.g., multisite admin mode).
4553		- * @return void
4554		- */
4555		- public function print_checkbox_auth_external_google( $args = '' ) {
	4114	+ function print_checkbox_auth_external_google( $args = '' ) {
4556	4115	// Get plugin option.
4557		- $option = 'google';
	4116	+ $option = 'google';
4558	4117	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4559	4118
4560	4119	// Print option elements.
4561		- ?>
4562		- <input type="checkbox" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="1"<?php checked( 1 === intval( $auth_settings_option ) ); ?> /><label for="auth_settings_<?php echo esc_attr( $option ); ?>"><?php esc_html_e( 'Enable Google Logins', 'authorizer' ); ?></label>
4563		- <?php
	4120	+ ?><input type="checkbox" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="1"<?php checked( 1 == $auth_settings_option ); ?> /><label for="auth_settings_<?php echo $option; ?>"><?php _e( 'Enable Google Logins', 'authorizer' ); ?></label><?php
4564	4121	}
4565	4122
4566	4123
4567		- /**
4568		- * Settings print callback.
4569		- *
4570		- * @param string $args Args (e.g., multisite admin mode).
4571		- * @return void
4572		- */
4573		- public function print_text_google_clientid( $args = '' ) {
	4124	+ function print_text_google_clientid( $args = '' ) {
4574	4125	// Get plugin option.
4575		- $option = 'google_clientid';
	4126	+ $option = 'google_clientid';
4576	4127	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4577	4128
4578	4129	// Print option elements.
4579		- $site_url_parts = wp_parse_url( get_site_url() );
4580		- $site_url_host = $site_url_parts['scheme'] . '://' . $site_url_parts['host'] . '/';
4581		-
4582		- esc_html_e( "If you don't have a Google Client ID and Secret, generate them by following these instructions:", 'authorizer' );
4583		- ?>
	4130	+ $site_url_parts = parse_url( get_site_url() );
	4131	+ $site_url_host = $site_url_parts['scheme'] . '://' . $site_url_parts['host'] . '/';
	4132	+ ?><?php _e( "If you don't have a Google Client ID and Secret, generate them by following these instructions:", 'authorizer' ); ?>
4584	4133	<ol>
4585		- <li><?php echo wp_kses( __( 'Click <strong>Create a Project</strong> on the <a href="https://cloud.google.com/console" target="_blank">Google Developers Console</a>. You can name it whatever you want.', 'authorizer' ), $this->allowed_html ); ?></li>
4586		- <li><?php echo wp_kses( __( 'Within the project, navigate to <em>APIs and Auth</em> &gt; <em>Credentials</em>, then click <strong>Create New Client ID</strong> under OAuth. Use these settings:', 'authorizer' ), $this->allowed_html ); ?>
	4134	+ <li><?php _e( 'Click <strong>Create a Project</strong> on the <a href="https://cloud.google.com/console" target="_blank">Google Developers Console</a>. You can name it whatever you want.', 'authorizer' ); ?></li>
	4135	+ <li><?php _e( 'Within the project, navigate to <em>APIs and Auth</em> &gt; <em>Credentials</em>, then click <strong>Create New Client ID</strong> under OAuth. Use these settings:', 'authorizer' ); ?>
4587	4136	<ul>
4588		- <li><?php echo wp_kses( __( 'Application Type: <strong>Web application</strong>', 'authorizer' ), $this->allowed_html ); ?></li>
4589		- <li><?php esc_html_e( 'Authorized Javascript Origins:', 'authorizer' ); ?> <strong><?php echo esc_html( rtrim( $site_url_host, '/' ) ); ?></strong></li>
4590		- <li><?php echo wp_kses( __( 'Authorized Redirect URI: <em>none</em>', 'authorizer' ), $this->allowed_html ); ?></li>
	4137	+ <li><?php _e( 'Application Type: <strong>Web application</strong>', 'authorizer' ); ?></li>
	4138	+ <li><?php _e( 'Authorized Javascript Origins:', 'authorizer' ); ?> <strong><?php echo rtrim( $site_url_host, '/' ); ?></strong></li>
	4139	+ <li><?php _e( 'Authorized Redirect URI: <em>none</em>', 'authorizer' ); ?></li>
4591	4140	</ul>
4592	4141	</li>
4593		- <li><?php esc_html_e( 'Copy/paste your new Client ID/Secret pair into the fields below.', 'authorizer' ); ?></li>
4594		- <li><?php echo wp_kses( __( '<strong>Note</strong>: Navigate to <em>APIs and Auth</em> &gt; <em>Consent screen</em> to change the way the Google consent screen appears after a user has successfully entered their password, but before they are redirected back to WordPress.', 'authorizer' ), $this->allowed_html ); ?></li>
4595		- <li><?php echo wp_kses( __( 'Note: Google may have a more recent version of these instructions in their <a href="https://developers.google.com/identity/sign-in/web/devconsole-project" target="_blank">developer documentation</a>.', 'authorizer' ), $this->allowed_html ); ?></li>
	4142	+ <li><?php _e( 'Copy/paste your new Client ID/Secret pair into the fields below.', 'authorizer' ); ?></li>
	4143	+ <li><?php _e( '<strong>Note</strong>: Navigate to <em>APIs and Auth</em> &gt; <em>Consent screen</em> to change the way the Google consent screen appears after a user has successfully entered their password, but before they are redirected back to WordPress.', 'authorizer' ); ?></li>
	4144	+ <li><?php _e( 'Note: Google may have a more recent version of these instructions in their <a href="https://developers.google.com/identity/sign-in/web/devconsole-project" target="_blank">developer documentation</a>.', 'authorizer' ); ?></li>
4596	4145	</ol>
4597		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" style="width:560px;" />
4598		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: 1234567890123-kdjr85yt6vjr6d8g7dhr8g7d6durjf7g.apps.googleusercontent.com', 'authorizer' ); ?></label>
4599		- <?php
	4146	+ <input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" style="width:560px;" />
	4147	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: 1234567890123-kdjr85yt6vjr6d8g7dhr8g7d6durjf7g.apps.googleusercontent.com', 'authorizer'); ?></label><?php
4600	4148	}
4601	4149
4602	4150
4603		- /**
4604		- * Settings print callback.
4605		- *
4606		- * @param string $args Args (e.g., multisite admin mode).
4607		- * @return void
4608		- */
4609		- public function print_text_google_clientsecret( $args = '' ) {
	4151	+ function print_text_google_clientsecret( $args = '' ) {
4610	4152	// Get plugin option.
4611		- $option = 'google_clientsecret';
	4153	+ $option = 'google_clientsecret';
4612	4154	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4613	4155
4614	4156	// Print option elements.
4615		- ?>
4616		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" style="width:220px;" />
4617		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: sDNgX5_pr_5bly-frKmvp8jT', 'authorizer' ); ?></label>
4618		- <?php
	4157	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" style="width:220px;" />
	4158	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: sDNgX5_pr_5bly-frKmvp8jT', 'authorizer'); ?></label><?php
4619	4159	}
4620	4160
4621	4161
4622		- /**
4623		- * Settings print callback.
4624		- *
4625		- * @param string $args Args (e.g., multisite admin mode).
4626		- * @return void
4627		- */
4628		- public function print_text_google_hosteddomain( $args = '' ) {
	4162	+ function print_text_google_hosteddomain( $args = '' ) {
4629	4163	// Get plugin option.
4630		- $option = 'google_hosteddomain';
	4164	+ $option = 'google_hosteddomain';
4631	4165	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4632	4166
4633	4167	// Print option elements.
4634		- ?>
4635		- <textarea id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" placeholder="" style="width:220px;"><?php echo esc_html( $auth_settings_option ); ?></textarea>
4636		- <br /><small><?php esc_html_e( 'Restrict Google logins to a specific Google Apps hosted domain (for example, mycollege.edu). Leave blank to allow all Google sign-ins.', 'authorizer' ); ?><br /><?php esc_html_e( 'If restricting to multiple domains, add one domain per line.', 'authorizer' ); ?></small>
	4168	+ ?><textarea id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" placeholder="" style="width:220px;"><?php echo $auth_settings_option; ?></textarea>
	4169	+ <br /><small><?php _e( 'Restrict Google logins to a specific Google Apps hosted domain (for example, mycollege.edu). Leave blank to allow all Google sign-ins.', 'authorizer' ); ?><br /><?php _e( 'If restricting to multiple domains, add one domain per line.', 'authorizer' ); ?></small>
4637	4170	<?php
4638	4171	}
4639	4172
4640	4173
4641		- /**
4642		- * Settings print callback.
4643		- *
4644		- * @param string $args Args (e.g., multisite admin mode).
4645		- * @return void
4646		- */
4647		- public function print_checkbox_auth_external_cas( $args = '' ) {
	4174	+ function print_checkbox_auth_external_cas( $args = '' ) {
4648	4175	// Get plugin option.
4649		- $option = 'cas';
	4176	+ $option = 'cas';
4650	4177	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4651	4178
4652	4179	// Make sure php5-curl extension is installed on server.
4653	4180	$curl_installed_message = ! function_exists( 'curl_init' ) ? __( '<a href="http://www.php.net//manual/en/curl.installation.php" target="_blank" style="color: red;">PHP CURL extension</a> is not installed', 'authorizer' ) : '';
		@@ -4666,217 +4193,128 @@
4666	4193	')</span>';
4667	4194	}
4668	4195
4669	4196	// Print option elements.
4670		- ?>
4671		- <input type="checkbox" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="1"<?php checked( 1 === intval( $auth_settings_option ) ); ?> /><label for="auth_settings_<?php echo esc_attr( $option ); ?>"><?php esc_html_e( 'Enable CAS Logins', 'authorizer' ); ?></label> <?php echo wp_kses( $error_message, $this->allowed_html ); ?>
4672		- <?php
	4197	+ ?><input type="checkbox" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="1"<?php checked( 1 == $auth_settings_option ); ?> /><label for="auth_settings_<?php echo $option; ?>"><?php _e( 'Enable CAS Logins', 'authorizer' ); ?></label> <?php echo $error_message; ?><?php
4673	4198	}
4674	4199
4675	4200
4676		- /**
4677		- * Settings print callback.
4678		- *
4679		- * @param string $args Args (e.g., multisite admin mode).
4680		- * @return void
4681		- */
4682		- public function print_text_cas_custom_label( $args = '' ) {
	4201	+ function print_text_cas_custom_label( $args = '' ) {
4683	4202	// Get plugin option.
4684		- $option = 'cas_custom_label';
	4203	+ $option = 'cas_custom_label';
4685	4204	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4686	4205
4687	4206	// Print option elements.
4688		- esc_html_e( 'The button on the login page will read:', 'authorizer' );
4689		- ?>
4690		- <p><a class="button-primary button-large" style="padding: 3px 16px; height: 36px;"><span class="dashicons dashicons-lock" style="margin: 4px 4px 0 0;"></span> <strong><?php esc_html_e( 'Sign in with', 'authorizer' ); ?> </strong><input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="CAS" style="width: 100px;" /></a></p>
4691		- <?php
	4207	+ ?><?php _e( 'The button on the login page will read:', 'authorizer' ); ?><p><a class="button-primary button-large" style="padding: 3px 16px; height: 36px;"><span class="dashicons dashicons-lock" style="margin: 4px 4px 0 0;"></span> <strong><?php _e( 'Sign in with', 'authorizer' ); ?> </strong><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="CAS" style="width: 100px;" /></a></p><?php
4692	4208	}
4693	4209
4694	4210
4695		- /**
4696		- * Settings print callback.
4697		- *
4698		- * @param string $args Args (e.g., multisite admin mode).
4699		- * @return void
4700		- */
4701		- public function print_text_cas_host( $args = '' ) {
	4211	+ function print_text_cas_host( $args = '' ) {
4702	4212	// Get plugin option.
4703		- $option = 'cas_host';
	4213	+ $option = 'cas_host';
4704	4214	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4705	4215
4706	4216	// Print option elements.
4707		- ?>
4708		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" />
4709		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: authn.example.edu', 'authorizer' ); ?></label>
4710		- <?php
	4217	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" />
	4218	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: authn.example.edu', 'authorizer'); ?></label><?php
4711	4219	}
4712	4220
4713	4221
4714		- /**
4715		- * Settings print callback.
4716		- *
4717		- * @param string $args Args (e.g., multisite admin mode).
4718		- * @return void
4719		- */
4720		- public function print_text_cas_port( $args = '' ) {
	4222	+ function print_text_cas_port( $args = '' ) {
4721	4223	// Get plugin option.
4722		- $option = 'cas_port';
	4224	+ $option = 'cas_port';
4723	4225	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4724	4226
4725	4227	// Print option elements.
4726		- ?>
4727		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" style="width:50px;" />
4728		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: 443', 'authorizer' ); ?></label>
4729		- <?php
	4228	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" style="width:50px;" />
	4229	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: 443', 'authorizer'); ?></label><?php
4730	4230	}
4731	4231
4732	4232
4733		- /**
4734		- * Settings print callback.
4735		- *
4736		- * @param string $args Args (e.g., multisite admin mode).
4737		- * @return void
4738		- */
4739		- public function print_text_cas_path( $args = '' ) {
	4233	+ function print_text_cas_path( $args = '' ) {
4740	4234	// Get plugin option.
4741		- $option = 'cas_path';
	4235	+ $option = 'cas_path';
4742	4236	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4743	4237
4744	4238	// Print option elements.
4745		- ?>
4746		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" />
4747		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: /cas', 'authorizer' ); ?></label>
4748		- <?php
	4239	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" />
	4240	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: /cas', 'authorizer'); ?></label><?php
4749	4241	}
4750	4242
4751	4243
4752		- /**
4753		- * Settings print callback.
4754		- *
4755		- * @param string $args Args (e.g., multisite admin mode).
4756		- * @return void
4757		- */
4758		- public function print_select_cas_version( $args = '' ) {
	4244	+ function print_select_cas_version( $args = '' ) {
4759	4245	// Get plugin option.
4760		- $option = 'cas_version';
	4246	+ $option = 'cas_version';
4761	4247	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4762	4248
4763	4249	// Print option elements.
4764		- ?>
4765		- <select id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]">
	4250	+ ?><select id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]">
4766	4251	<option value="SAML_VERSION_1_1" <?php selected( $auth_settings_option, 'SAML_VERSION_1_1' ); ?>>SAML_VERSION_1_1</option>
4767	4252	<option value="CAS_VERSION_3_0" <?php selected( $auth_settings_option, 'CAS_VERSION_3_0' ); ?>>CAS_VERSION_3_0</option>
4768	4253	<option value="CAS_VERSION_2_0" <?php selected( $auth_settings_option, 'CAS_VERSION_2_0' ); ?>>CAS_VERSION_2_0</option>
4769	4254	<option value="CAS_VERSION_1_0" <?php selected( $auth_settings_option, 'CAS_VERSION_1_0' ); ?>>CAS_VERSION_1_0</option>
4770		- </select>
4771		- <?php
	4255	+ </select><?php
4772	4256	}
4773	4257
4774	4258
4775		- /**
4776		- * Settings print callback.
4777		- *
4778		- * @param string $args Args (e.g., multisite admin mode).
4779		- * @return void
4780		- */
4781		- public function print_text_cas_attr_email( $args = '' ) {
	4259	+ function print_text_cas_attr_email( $args = '' ) {
4782	4260	// Get plugin option.
4783		- $option = 'cas_attr_email';
	4261	+ $option = 'cas_attr_email';
4784	4262	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4785	4263
4786	4264	// Print option elements.
4787		- ?>
4788		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" />
4789		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: mail', 'authorizer' ); ?></label>
4790		- <br /><small><?php echo wp_kses( __( "Note: If your CAS server doesn't return an attribute containing an email, you can specify the @domain portion of the email address here, and the email address will be constructed from it and the username. For example, if user 'bob' logs in and his email address should be bob@example.edu, then enter <strong>@example.edu</strong> in this field.", 'authorizer' ), $this->allowed_html ); ?></small>
4791		- <?php
	4265	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" />
	4266	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: mail', 'authorizer'); ?></label>
	4267	+ <br /><small><?php _e( "Note: If your CAS server doesn't return an attribute containing an email, you can specify the @domain portion of the email address here, and the email address will be constructed from it and the username. For example, if user 'bob' logs in and his email address should be bob@example.edu, then enter <strong>@example.edu</strong> in this field.", 'authorizer' ); ?></small><?php
4792	4268	}
4793	4269
4794	4270
4795		- /**
4796		- * Settings print callback.
4797		- *
4798		- * @param string $args Args (e.g., multisite admin mode).
4799		- * @return void
4800		- */
4801		- public function print_text_cas_attr_first_name( $args = '' ) {
	4271	+ function print_text_cas_attr_first_name( $args = '' ) {
4802	4272	// Get plugin option.
4803		- $option = 'cas_attr_first_name';
	4273	+ $option = 'cas_attr_first_name';
4804	4274	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4805	4275
4806	4276	// Print option elements.
4807		- ?>
4808		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" />
4809		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: givenName', 'authorizer' ); ?></label>
4810		- <?php
	4277	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" />
	4278	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: givenName', 'authorizer'); ?></label><?php
4811	4279	}
4812	4280
4813	4281
4814		- /**
4815		- * Settings print callback.
4816		- *
4817		- * @param string $args Args (e.g., multisite admin mode).
4818		- * @return void
4819		- */
4820		- public function print_text_cas_attr_last_name( $args = '' ) {
	4282	+ function print_text_cas_attr_last_name( $args = '' ) {
4821	4283	// Get plugin option.
4822		- $option = 'cas_attr_last_name';
	4284	+ $option = 'cas_attr_last_name';
4823	4285	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4824	4286
4825	4287	// Print option elements.
4826		- ?>
4827		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" />
4828		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: sn', 'authorizer' ); ?></label>
4829		- <?php
	4288	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" />
	4289	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: sn', 'authorizer'); ?></label><?php
4830	4290	}
4831	4291
4832	4292
4833		- /**
4834		- * Settings print callback.
4835		- *
4836		- * @param string $args Args (e.g., multisite admin mode).
4837		- * @return void
4838		- */
4839		- public function print_checkbox_cas_attr_update_on_login( $args = '' ) {
	4293	+ function print_checkbox_cas_attr_update_on_login( $args = '' ) {
4840	4294	// Get plugin option.
4841		- $option = 'cas_attr_update_on_login';
	4295	+ $option = 'cas_attr_update_on_login';
4842	4296	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4843	4297
4844	4298	// Print option elements.
4845		- ?>
4846		- <input type="checkbox" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="1"<?php checked( 1 === intval( $auth_settings_option ) ); ?> /><label for="auth_settings_<?php echo esc_attr( $option ); ?>"><?php esc_html_e( 'Update first and last name fields on login (will overwrite any name the user has supplied in their profile)', 'authorizer' ); ?></label>
4847		- <?php
	4299	+ ?><input type="checkbox" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="1"<?php checked( 1 == $auth_settings_option ); ?> /><label for="auth_settings_<?php echo $option; ?>"><?php _e( 'Update first and last name fields on login (will overwrite any name the user has supplied in their profile)', 'authorizer' ); ?></label><?php
4848	4300	}
4849	4301
4850	4302
4851		- /**
4852		- * Settings print callback.
4853		- *
4854		- * @param string $args Args (e.g., multisite admin mode).
4855		- * @return void
4856		- */
4857		- public function print_checkbox_cas_auto_login( $args = '' ) {
	4303	+ function print_checkbox_cas_auto_login( $args = '' ) {
4858	4304	// Get plugin option.
4859		- $option = 'cas_auto_login';
	4305	+ $option = 'cas_auto_login';
4860	4306	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4861	4307
4862	4308	// Print option elements.
4863		- ?>
4864		- <input type="checkbox" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="1"<?php checked( 1 === intval( $auth_settings_option ) ); ?> /><label for="auth_settings_<?php echo esc_attr( $option ); ?>"><?php esc_html_e( "Immediately redirect to CAS login form if it's the only enabled external service and WordPress logins are hidden", 'authorizer' ); ?></label>
4865		- <p><small><?php esc_html_e( 'Note: This feature will only work if you have checked "Hide WordPress Logins" in Advanced settings, and if CAS is the only enabled service (i.e., no Google or LDAP). If you have enabled CAS Single Sign-On (SSO), and a user has already logged into CAS elsewhere, enabling this feature will allow automatic logins without any user interaction.', 'authorizer' ); ?></small></p>
4866		- <?php
	4309	+ ?><input type="checkbox" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="1"<?php checked( 1 == $auth_settings_option ); ?> /><label for="auth_settings_<?php echo $option; ?>"><?php _e( "Immediately redirect to CAS login form if it's the only enabled external service and WordPress logins are hidden", 'authorizer' ); ?></label>
	4310	+ <p><small><?php _e( 'Note: This feature will only work if you have checked "Hide WordPress Logins" in Advanced settings, and if CAS is the only enabled service (i.e., no Google or LDAP). If you have enabled CAS Single Sign-On (SSO), and a user has already logged into CAS elsewhere, enabling this feature will allow automatic logins without any user interaction.', 'authorizer' ); ?></small></p><?php
4867	4311	}
4868	4312
4869	4313
4870		- /**
4871		- * Settings print callback.
4872		- *
4873		- * @param string $args Args (e.g., multisite admin mode).
4874		- * @return void
4875		- */
4876		- public function print_checkbox_auth_external_ldap( $args = '' ) {
	4314	+ function print_checkbox_auth_external_ldap( $args = '' ) {
4877	4315	// Get plugin option.
4878		- $option = 'ldap';
	4316	+ $option = 'ldap';
4879	4317	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4880	4318
4881	4319	// Make sure php5-ldap extension is installed on server.
4882	4320	$ldap_installed_message = ! function_exists( 'ldap_connect' ) ? '<span style="color: red;">(' . __( 'Warning: <a href="http://www.php.net/manual/en/ldap.installation.php" target="_blank" style="color: red;">PHP LDAP extension</a> is <strong>not</strong> installed', 'authorizer' ) . ')</span>' : '';
		@@ -4881,324 +4319,194 @@
4881	4319	// Make sure php5-ldap extension is installed on server.
4882	4320	$ldap_installed_message = ! function_exists( 'ldap_connect' ) ? '<span style="color: red;">(' . __( 'Warning: <a href="http://www.php.net/manual/en/ldap.installation.php" target="_blank" style="color: red;">PHP LDAP extension</a> is <strong>not</strong> installed', 'authorizer' ) . ')</span>' : '';
4883	4321
4884	4322	// Print option elements.
4885		- ?>
4886		- <input type="checkbox" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="1"<?php checked( 1 === intval( $auth_settings_option ) ); ?> /><label for="auth_settings_<?php echo esc_attr( $option ); ?>"><?php esc_html_e( 'Enable LDAP Logins', 'authorizer' ); ?></label> <?php echo wp_kses( $ldap_installed_message, $this->allowed_html ); ?>
4887		- <?php
	4323	+ ?><input type="checkbox" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="1"<?php checked( 1 == $auth_settings_option ); ?> /><label for="auth_settings_<?php echo $option; ?>"><?php _e( 'Enable LDAP Logins', 'authorizer' ); ?></label> <?php echo $ldap_installed_message; ?><?php
4888	4324	}
4889	4325
4890	4326
4891		- /**
4892		- * Settings print callback.
4893		- *
4894		- * @param string $args Args (e.g., multisite admin mode).
4895		- * @return void
4896		- */
4897		- public function print_text_ldap_host( $args = '' ) {
	4327	+ function print_text_ldap_host( $args = '' ) {
4898	4328	// Get plugin option.
4899		- $option = 'ldap_host';
	4329	+ $option = 'ldap_host';
4900	4330	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4901	4331
4902	4332	// Print option elements.
4903		- ?>
4904		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" style="width:330px;" />
4905		- <br /><small><?php esc_html_e( 'Specify either a hostname (for example, ldap.example.edu) or a full LDAP URI (for example, ldaps://ldap.example.edu:636).', 'authorizer' ); ?></small>
4906		- <?php
	4333	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" style="width:330px;" />
	4334	+ <br /><small><?php _e( "Specify either a hostname (for example, ldap.example.edu) or a full LDAP URI (for example, ldaps://ldap.example.edu:636).", 'authorizer' ); ?></small><?php
4907	4335	}
4908	4336
4909	4337
4910		- /**
4911		- * Settings print callback.
4912		- *
4913		- * @param string $args Args (e.g., multisite admin mode).
4914		- * @return void
4915		- */
4916		- public function print_text_ldap_port( $args = '' ) {
	4338	+ function print_text_ldap_port( $args = '' ) {
4917	4339	// Get plugin option.
4918		- $option = 'ldap_port';
	4340	+ $option = 'ldap_port';
4919	4341	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4920	4342
4921	4343	// Print option elements.
4922		- ?>
4923		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" style="width:50px;" />
4924		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: 389', 'authorizer' ); ?></label>
4925		- <br /><small><?php esc_html_e( 'If a full LDAP URI (ldaps://hostname:port) is specified above, this field is ignored.', 'authorizer' ); ?></small>
4926		- <?php
	4344	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" style="width:50px;" />
	4345	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: 389', 'authorizer' ); ?></label>
	4346	+ <br /><small><?php _e( "If a full LDAP URI (ldaps://hostname:port) is specified above, this field is ignored.", 'authorizer' ); ?></small><?php
4927	4347	}
4928	4348
4929	4349
4930		- /**
4931		- * Settings print callback.
4932		- *
4933		- * @param string $args Args (e.g., multisite admin mode).
4934		- * @return void
4935		- */
4936		- public function print_checkbox_ldap_tls( $args = '' ) {
	4350	+ function print_checkbox_ldap_tls( $args = '' ) {
4937	4351	// Get plugin option.
4938		- $option = 'ldap_tls';
	4352	+ $option = 'ldap_tls';
4939	4353	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4940	4354
4941	4355	// Print option elements.
4942		- ?>
4943		- <input type="checkbox" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="1"<?php checked( 1 === intval( $auth_settings_option ) ); ?> /><label for="auth_settings_<?php echo esc_attr( $option ); ?>"><?php esc_html_e( 'Use TLS', 'authorizer' ); ?></label>
4944		- <br /><small><?php esc_html_e( 'If ldaps is used, this should be unchecked', 'authorizer' ); ?></small>
4945		- <?php
	4356	+ ?><input type="checkbox" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="1"<?php checked( 1 == $auth_settings_option ); ?> /><label for="auth_settings_<?php echo $option; ?>"><?php _e( 'Use TLS', 'authorizer' ); ?></label>
	4357	+ <br /><small><?php _e( "If ldaps is used, this should be unchecked", 'authorizer' ); ?></small><?php
4946	4358	}
4947	4359
4948	4360
4949		- /**
4950		- * Settings print callback.
4951		- *
4952		- * @param string $args Args (e.g., multisite admin mode).
4953		- * @return void
4954		- */
4955		- public function print_text_ldap_search_base( $args = '' ) {
	4361	+ function print_text_ldap_search_base( $args = '' ) {
4956	4362	// Get plugin option.
4957		- $option = 'ldap_search_base';
	4363	+ $option = 'ldap_search_base';
4958	4364	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4959	4365
4960	4366	// Print option elements.
4961		- ?>
4962		- <textarea id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" placeholder="" style="width:330px;"><?php echo esc_attr( $auth_settings_option ); ?></textarea>
4963		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: ou=people,dc=example,dc=edu', 'authorizer' ); ?></label>
4964		- <br /><small><?php esc_html_e( 'If you have multiple search bases, separate them by newlines (one per line).', 'authorizer' ); ?></small>
4965		- <?php
	4367	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" style="width:330px;" />
	4368	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: ou=people,dc=example,dc=edu', 'authorizer'); ?></label><?php
4966	4369	}
4967	4370
4968	4371
4969		- /**
4970		- * Settings print callback.
4971		- *
4972		- * @param string $args Args (e.g., multisite admin mode).
4973		- * @return void
4974		- */
4975		- public function print_text_ldap_uid( $args = '' ) {
	4372	+ function print_text_ldap_uid( $args = '' ) {
4976	4373	// Get plugin option.
4977		- $option = 'ldap_uid';
	4374	+ $option = 'ldap_uid';
4978	4375	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4979	4376
4980	4377	// Print option elements.
4981		- ?>
4982		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" style="width:80px;" />
4983		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: uid', 'authorizer' ); ?></label>
4984		- <?php
	4378	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" style="width:80px;" />
	4379	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: uid', 'authorizer' ); ?></label><?php
4985	4380	}
4986	4381
4987	4382
4988		- /**
4989		- * Settings print callback.
4990		- *
4991		- * @param string $args Args (e.g., multisite admin mode).
4992		- * @return void
4993		- */
4994		- public function print_text_ldap_attr_email( $args = '' ) {
	4383	+ function print_text_ldap_attr_email( $args = '' ) {
4995	4384	// Get plugin option.
4996		- $option = 'ldap_attr_email';
	4385	+ $option = 'ldap_attr_email';
4997	4386	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
4998	4387
4999	4388	// Print option elements.
5000		- ?>
5001		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" />
5002		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: mail', 'authorizer' ); ?></label>
5003		- <br /><small><?php echo wp_kses( __( "Note: If your LDAP server doesn't return an attribute containing an email, you can specify the @domain portion of the email address here, and the email address will be constructed from it and the username. For example, if user 'bob' logs in and his email address should be bob@example.edu, then enter <strong>@example.edu</strong> in this field.", 'authorizer' ), $this->allowed_html ); ?></small>
5004		- <?php
	4389	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" />
	4390	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: mail', 'authorizer' ); ?></label>
	4391	+ <br /><small><?php _e( "Note: If your LDAP server doesn't return an attribute containing an email, you can specify the @domain portion of the email address here, and the email address will be constructed from it and the username. For example, if user 'bob' logs in and his email address should be bob@example.edu, then enter <strong>@example.edu</strong> in this field.", 'authorizer' ); ?></small><?php
5005	4392	}
5006	4393
5007	4394
5008		- /**
5009		- * Settings print callback.
5010		- *
5011		- * @param string $args Args (e.g., multisite admin mode).
5012		- * @return void
5013		- */
5014		- public function print_text_ldap_user( $args = '' ) {
	4395	+ function print_text_ldap_user( $args = '' ) {
5015	4396	// Get plugin option.
5016		- $option = 'ldap_user';
	4397	+ $option = 'ldap_user';
5017	4398	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5018	4399
5019	4400	// Print option elements.
5020		- ?>
5021		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" style="width:330px;" />
5022		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: cn=directory-user,ou=specials,dc=example,dc=edu', 'authorizer' ); ?></label>
5023		- <?php
	4401	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" style="width:330px;" />
	4402	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: cn=directory-user,ou=specials,dc=example,dc=edu', 'authorizer' ); ?></label><?php
5024	4403	}
5025	4404
5026	4405
5027		- /**
5028		- * Settings print callback.
5029		- *
5030		- * @param string $args Args (e.g., multisite admin mode).
5031		- * @return void
5032		- */
5033		- public function print_password_ldap_password( $args = '' ) {
	4406	+ function print_password_ldap_password( $args = '' ) {
5034	4407	// Get plugin option.
5035		- $option = 'ldap_password';
	4408	+ $option = 'ldap_password';
5036	4409	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5037	4410
5038	4411	// Print option elements.
5039		- ?>
5040		- <input type="password" id="garbage_to_stop_autofill" name="garbage" value="" autocomplete="off" style="display:none;" />
5041		- <input type="password" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $this->decrypt( $auth_settings_option ) ); ?>" autocomplete="off" />
5042		- <?php
	4412	+ ?><input type="password" id="garbage_to_stop_autofill" name="garbage" value="" autocomplete="off" style="display:none;" />
	4413	+ <input type="password" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $this->decrypt( $auth_settings_option ); ?>" autocomplete="off" /><?php
5043	4414	}
5044	4415
5045	4416
5046		- /**
5047		- * Settings print callback.
5048		- *
5049		- * @param string $args Args (e.g., multisite admin mode).
5050		- * @return void
5051		- */
5052		- public function print_text_ldap_lostpassword_url( $args = '' ) {
	4417	+ function print_text_ldap_lostpassword_url( $args = '' ) {
5053	4418	// Get plugin option.
5054		- $option = 'ldap_lostpassword_url';
	4419	+ $option = 'ldap_lostpassword_url';
5055	4420	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5056	4421
5057	4422	// Print option elements.
5058		- ?>
5059		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" style="width: 400px;" />
5060		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: https://myschool.example.edu:8888/am-forgot-password', 'authorizer' ); ?></label>
5061		- <?php
	4423	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" style="width: 400px;" />
	4424	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: https://myschool.example.edu:8888/am-forgot-password', 'authorizer' ); ?></label><?php
5062	4425	}
5063	4426
5064	4427
5065		- /**
5066		- * Settings print callback.
5067		- *
5068		- * @param string $args Args (e.g., multisite admin mode).
5069		- * @return void
5070		- */
5071		- public function print_text_ldap_attr_first_name( $args = '' ) {
	4428	+ function print_text_ldap_attr_first_name( $args = '' ) {
5072	4429	// Get plugin option.
5073		- $option = 'ldap_attr_first_name';
	4430	+ $option = 'ldap_attr_first_name';
5074	4431	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5075	4432
5076	4433	// Print option elements.
5077		- ?>
5078		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" />
5079		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: givenname', 'authorizer' ); ?></label>
5080		- <?php
	4434	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" />
	4435	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: givenname', 'authorizer' ); ?></label><?php
5081	4436	}
5082	4437
5083	4438
5084		- /**
5085		- * Settings print callback.
5086		- *
5087		- * @param string $args Args (e.g., multisite admin mode).
5088		- * @return void
5089		- */
5090		- public function print_text_ldap_attr_last_name( $args = '' ) {
	4439	+ function print_text_ldap_attr_last_name( $args = '' ) {
5091	4440	// Get plugin option.
5092		- $option = 'ldap_attr_last_name';
	4441	+ $option = 'ldap_attr_last_name';
5093	4442	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5094	4443
5095	4444	// Print option elements.
5096		- ?>
5097		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" />
5098		- <br /><label for="auth_settings_<?php echo esc_attr( $option ); ?>" class="helper"><?php esc_html_e( 'Example: sn', 'authorizer' ); ?></label>
5099		- <?php
	4445	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" />
	4446	+ <br /><label for="auth_settings_<?php echo $option; ?>" class="helper"><?php _e( 'Example: sn', 'authorizer' ); ?></label><?php
5100	4447	}
5101	4448
5102	4449
5103		- /**
5104		- * Settings print callback.
5105		- *
5106		- * @param string $args Args (e.g., multisite admin mode).
5107		- * @return void
5108		- */
5109		- public function print_checkbox_ldap_attr_update_on_login( $args = '' ) {
	4450	+ function print_checkbox_ldap_attr_update_on_login( $args = '' ) {
5110	4451	// Get plugin option.
5111		- $option = 'ldap_attr_update_on_login';
	4452	+ $option = 'ldap_attr_update_on_login';
5112	4453	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5113	4454
5114	4455	// Print option elements.
5115		- ?>
5116		- <input type="checkbox" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="1"<?php checked( 1 === intval( $auth_settings_option ) ); ?> /><label for="auth_settings_<?php echo esc_attr( $option ); ?>"><?php esc_html_e( 'Update first and last name fields on login (will overwrite any name the user has supplied in their profile)', 'authorizer' ); ?></label>
5117		- <?php
	4456	+ ?><input type="checkbox" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="1"<?php checked( 1 == $auth_settings_option ); ?> /><label for="auth_settings_<?php echo $option; ?>"><?php _e( 'Update first and last name fields on login (will overwrite any name the user has supplied in their profile)', 'authorizer' ); ?></label><?php
5118	4457	}
5119	4458
5120	4459
5121		- /**
5122		- * Settings print callback.
5123		- *
5124		- * @param string $args Args (e.g., multisite admin mode).
5125		- * @return void
5126		- */
5127		- public function print_section_info_advanced( $args = '' ) {
5128		- ?>
5129		- <div id="section_info_advanced" class="section_info">
5130		- <p><?php esc_html_e( 'You may optionally specify some advanced settings below.', 'authorizer' ); ?></p>
5131		- </div>
5132		- <?php
	4460	+ function print_section_info_advanced( $args = '' ) {
	4461	+ ?><div id="section_info_advanced" class="section_info">
	4462	+ <p><?php _e( 'You may optionally specify some advanced settings below.', 'authorizer' ); ?></p>
	4463	+ </div><?php
5133	4464	}
5134	4465
5135	4466
5136		- /**
5137		- * Settings print callback.
5138		- *
5139		- * @param string $args Args (e.g., multisite admin mode).
5140		- * @return void
5141		- */
5142		- public function print_text_auth_advanced_lockouts( $args = '' ) {
	4467	+ function print_text_auth_advanced_lockouts( $args = '' ) {
5143	4468	// Get plugin option.
5144		- $option = 'advanced_lockouts';
	4469	+ $option = 'advanced_lockouts';
5145	4470	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5146	4471
5147	4472	// Print option elements.
5148		- esc_html_e( 'After', 'authorizer' );
5149		- ?>
5150		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>_attempts_1" name="auth_settings[<?php echo esc_attr( $option ); ?>][attempts_1]" value="<?php echo esc_attr( $auth_settings_option['attempts_1'] ); ?>" placeholder="10" style="width:30px;" />
5151		- <?php esc_html_e( 'invalid password attempts, delay further attempts on that user for', 'authorizer' ); ?>
5152		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>_duration_1" name="auth_settings[<?php echo esc_attr( $option ); ?>][duration_1]" value="<?php echo esc_attr( $auth_settings_option['duration_1'] ); ?>" placeholder="1" style="width:30px;" />
5153		- <?php esc_html_e( 'minute(s).', 'authorizer' ); ?>
	4473	+ ?><?php _e( 'After', 'authorizer' ); ?>
	4474	+ <input type="text" id="auth_settings_<?php echo $option; ?>_attempts_1" name="auth_settings[<?php echo $option; ?>][attempts_1]" value="<?php echo $auth_settings_option['attempts_1']; ?>" placeholder="10" style="width:30px;" />
	4475	+ <?php _e( 'invalid password attempts, delay further attempts on that user for', 'authorizer' ); ?>
	4476	+ <input type="text" id="auth_settings_<?php echo $option; ?>_duration_1" name="auth_settings[<?php echo $option; ?>][duration_1]" value="<?php echo $auth_settings_option['duration_1']; ?>" placeholder="1" style="width:30px;" />
	4477	+ <?php _e( 'minute(s).', 'authorizer' ); ?>
5154	4478	<br />
5155		- <?php esc_html_e( 'After', 'authorizer' ); ?>
5156		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>_attempts_2" name="auth_settings[<?php echo esc_attr( $option ); ?>][attempts_2]" value="<?php echo esc_attr( $auth_settings_option['attempts_2'] ); ?>" placeholder="10" style="width:30px;" />
5157		- <?php esc_html_e( 'more invalid attempts, increase the delay to', 'authorizer' ); ?>
5158		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>_duration_2" name="auth_settings[<?php echo esc_attr( $option ); ?>][duration_2]" value="<?php echo esc_attr( $auth_settings_option['duration_2'] ); ?>" placeholder="10" style="width:30px;" />
5159		- <?php esc_html_e( 'minutes.', 'authorizer' ); ?>
	4479	+ <?php _e( 'After', 'authorizer' ); ?>
	4480	+ <input type="text" id="auth_settings_<?php echo $option; ?>_attempts_2" name="auth_settings[<?php echo $option; ?>][attempts_2]" value="<?php echo $auth_settings_option['attempts_2']; ?>" placeholder="10" style="width:30px;" />
	4481	+ <?php _e( 'more invalid attempts, increase the delay to', 'authorizer' ); ?>
	4482	+ <input type="text" id="auth_settings_<?php echo $option; ?>_duration_2" name="auth_settings[<?php echo $option; ?>][duration_2]" value="<?php echo $auth_settings_option['duration_2']; ?>" placeholder="10" style="width:30px;" />
	4483	+ <?php _e( 'minutes.', 'authorizer' ); ?>
5160	4484	<br />
5161		- <?php esc_html_e( 'Reset the delays after', 'authorizer' ); ?>
5162		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>_reset_duration" name="auth_settings[<?php echo esc_attr( $option ); ?>][reset_duration]" value="<?php echo esc_attr( $auth_settings_option['reset_duration'] ); ?>" placeholder="240" style="width:40px;" />
5163		- <?php esc_html_e( 'minutes with no invalid attempts.', 'authorizer' ); ?>
5164		- <?php
	4485	+ <?php _e( 'Reset the delays after', 'authorizer' ); ?>
	4486	+ <input type="text" id="auth_settings_<?php echo $option; ?>_reset_duration" name="auth_settings[<?php echo $option; ?>][reset_duration]" value="<?php echo $auth_settings_option['reset_duration']; ?>" placeholder="240" style="width:40px;" />
	4487	+ <?php _e( 'minutes with no invalid attempts.', 'authorizer' ); ?><?php
5165	4488	}
5166	4489
5167	4490
5168		- /**
5169		- * Settings print callback.
5170		- *
5171		- * @param string $args Args (e.g., multisite admin mode).
5172		- * @return void
5173		- */
5174		- public function print_checkbox_auth_advanced_hide_wp_login( $args = '' ) {
	4491	+ function print_checkbox_auth_advanced_hide_wp_login( $args = '' ) {
5175	4492	// Get plugin option.
5176		- $option = 'advanced_hide_wp_login';
	4493	+ $option = 'advanced_hide_wp_login';
5177	4494	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5178	4495
5179	4496	// Print option elements.
5180		- ?>
5181		- <input type="checkbox" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="1"<?php checked( 1 === intval( $auth_settings_option ) ); ?> /><label for="auth_settings_<?php echo esc_attr( $option ); ?>"><?php esc_html_e( 'Hide WordPress Logins', 'authorizer' ); ?></label>
5182		- <p><small><?php esc_html_e( 'Note: You can always access the WordPress logins by adding external=wordpress to the wp-login URL, like so:', 'authorizer' ); ?><br /><a href="<?php echo esc_attr( wp_login_url() ); ?>?external=wordpress" target="_blank"><?php echo esc_html( wp_login_url() ); ?>?external=wordpress</a>.</p>
5183		- <?php
	4497	+ ?><input type="checkbox" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="1"<?php checked( 1 == $auth_settings_option ); ?> /><label for="auth_settings_<?php echo $option; ?>"><?php _e( 'Hide WordPress Logins', 'authorizer' ); ?></label>
	4498	+ <p><small><?php _e( 'Note: You can always access the WordPress logins by adding external=wordpress to the wp-login URL, like so:', 'authorizer' ); ?><br /><a href="<?php echo wp_login_url(); ?>?external=wordpress" target="_blank"><?php echo wp_login_url(); ?>?external=wordpress</a>.</p><?php
5184	4499	}
5185	4500
5186	4501
5187		- /**
5188		- * Settings print callback.
5189		- *
5190		- * @param string $args Args (e.g., multisite admin mode).
5191		- * @return void
5192		- */
5193		- public function print_radio_auth_advanced_branding( $args = '' ) {
	4502	+ function print_radio_auth_advanced_branding( $args = '' ) {
5194	4503	// Get plugin option.
5195		- $option = 'advanced_branding';
	4504	+ $option = 'advanced_branding';
5196	4505	$auth_settings_option = $this->get_plugin_option( $option );
5197	4506
5198	4507	// Print option elements.
5199		- ?>
5200		- <input type="radio" id="radio_auth_settings_<?php echo esc_attr( $option ); ?>_default" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="default"<?php checked( 'default' === $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo esc_attr( $option ); ?>_default"><?php esc_html_e( 'Default WordPress login screen', 'authorizer' ); ?></label><br />
	4508	+ ?><input type="radio" id="radio_auth_settings_<?php echo $option; ?>_default" name="auth_settings[<?php echo $option; ?>]" value="default"<?php checked( 'default' == $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo $option; ?>_default"><?php _e( 'Default WordPress login screen', 'authorizer' ); ?></label><br />
5201	4509	<?php
5202	4510
5203	4511	/**
5204	4512	* Developers can use the `authorizer_add_branding_option` filter
		@@ -5203,8 +4511,9 @@
5203	4511	/**
5204	4512	* Developers can use the `authorizer_add_branding_option` filter
5205	4513	* to add a radio button for "Custom WordPress login branding"
5206	4514	* under the "Advanced" tab in Authorizer options. Example:
	4515	+ *
5207	4516	* function my_authorizer_add_branding_option( $branding_options ) {
5208	4517	* $new_branding_option = array(
5209	4518	* 'value' => 'your_brand'
5210	4519	* 'description' => 'Custom Your Brand Login Screen',
		@@ -5218,274 +4527,182 @@
5218	4527	*/
5219	4528	$branding_options = array();
5220	4529	$branding_options = apply_filters( 'authorizer_add_branding_option', $branding_options );
5221	4530	foreach ( $branding_options as $branding_option ) {
5222		- // Make sure the custom brands have the required values.
	4531	+ // Make sure the custom brands have the required values
5223	4532	if ( ! ( is_array( $branding_option ) && array_key_exists( 'value', $branding_option ) && array_key_exists( 'description', $branding_option ) ) ) {
5224	4533	continue;
5225	4534	}
5226		- ?>
5227		- <input type="radio" id="radio_auth_settings_<?php echo esc_attr( $option ); ?>_<?php echo esc_attr( sanitize_title( $branding_option['value'] ) ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $branding_option['value'] ); ?>"<?php checked( $branding_option['value'] === $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo esc_attr( $option ); ?>_<?php echo esc_attr( sanitize_title( $branding_option['value'] ) ); ?>"><?php echo esc_html( $branding_option['description'] ); ?></label><br />
5228		- <?php
	4535	+ ?><input type="radio" id="radio_auth_settings_<?php echo $option; ?>_<?php echo sanitize_title( $branding_option['value'] ); ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $branding_option['value']; ?>"<?php checked( $branding_option['value'] == $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo $option; ?>_<?php echo sanitize_title( $branding_option['value'] ); ?>"><?php echo $branding_option['description']; ?></label><br /><?php
5229	4536	}
5230	4537
5231	4538	// Print message about adding custom brands if there are none.
5232	4539	if ( count( $branding_options ) === 0 ) {
5233		- ?>
5234		- <p><em><?php echo wp_kses( __( '<strong>Note for theme developers</strong>: Add more options here by using the `authorizer_add_branding_option` filter in your theme. You can see an example theme that implements this filter in the plugin directory under sample-theme-add-branding.', 'authorizer' ), $this->allowed_html ); ?></em></p>
5235		- <?php
	4540	+ ?><p><em><?php _e( '<strong>Note for theme developers</strong>: Add more options here by using the `authorizer_add_branding_option` filter in your theme. You can see an example theme that implements this filter in the plugin directory under sample-theme-add-branding.', 'authorizer' ); ?></em></p><?php
5236	4541	}
5237	4542	}
5238	4543
5239	4544
5240		- /**
5241		- * Settings print callback.
5242		- *
5243		- * @param string $args Args (e.g., multisite admin mode).
5244		- * @return void
5245		- */
5246		- public function print_radio_auth_advanced_admin_menu( $args = '' ) {
	4545	+ function print_radio_auth_advanced_admin_menu( $args = '' ) {
5247	4546	// Get plugin option.
5248		- $option = 'advanced_admin_menu';
	4547	+ $option = 'advanced_admin_menu';
5249	4548	$auth_settings_option = $this->get_plugin_option( $option );
5250	4549
5251	4550	// Print option elements.
5252		- ?>
5253		- <input type="radio" id="radio_auth_settings_<?php echo esc_attr( $option ); ?>_settings" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="settings"<?php checked( 'settings' === $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo esc_attr( $option ); ?>_settings"><?php esc_html_e( 'Show in Settings menu', 'authorizer' ); ?></label><br />
5254		- <input type="radio" id="radio_auth_settings_<?php echo esc_attr( $option ); ?>_top" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="top"<?php checked( 'top' === $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo esc_attr( $option ); ?>_top"><?php esc_html_e( 'Show in sidebar (top level)', 'authorizer' ); ?></label><br />
5255		- <?php
	4551	+ ?><input type="radio" id="radio_auth_settings_<?php echo $option; ?>_settings" name="auth_settings[<?php echo $option; ?>]" value="settings"<?php checked( 'settings' == $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo $option; ?>_settings"><?php _e( 'Show in Settings menu', 'authorizer' ); ?></label><br />
	4552	+ <input type="radio" id="radio_auth_settings_<?php echo $option; ?>_top" name="auth_settings[<?php echo $option; ?>]" value="top"<?php checked( 'top' == $auth_settings_option ); ?> /><label for="radio_auth_settings_<?php echo $option; ?>_top"><?php _e( 'Show in sidebar (top level)', 'authorizer' ); ?></label><br /><?php
5256	4553
5257	4554	}
5258	4555
5259	4556
5260		- /**
5261		- * Settings print callback.
5262		- *
5263		- * @param string $args Args (e.g., multisite admin mode).
5264		- * @return void
5265		- */
5266		- public function print_select_auth_advanced_usermeta( $args = '' ) {
	4557	+ function print_select_auth_advanced_usermeta( $args = '' ) {
5267	4558	// Get plugin option.
5268		- $option = 'advanced_usermeta';
	4559	+ $option = 'advanced_usermeta';
5269	4560	$auth_settings_option = $this->get_plugin_option( $option );
5270	4561
5271	4562	// Print option elements.
5272		- ?>
5273		- <select id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]">
5274		- <option value=""><?php esc_html_e( '-- None --', 'authorizer' ); ?></option>
5275		- <?php
5276		- if ( class_exists( 'acf' ) ) :
	4563	+ ?><select id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]">
	4564	+ <option value=""><?php _e( '-- None --', 'authorizer' ); ?></option>
	4565	+ <?php if ( class_exists( 'acf' ) ) :
5277	4566	// Get ACF 5 fields. Note: it would be much easier to use `get_field_objects()`
5278	4567	// or `get_field_objects( 'user_' . get_current_user_id() )`, but neither will
5279	4568	// list fields that have never been given values for users (i.e., new ACF
5280	4569	// fields). Therefore we fall back on finding any ACF fields applied to users
5281	4570	// (user_role or user_form location rules in the field group definition).
5282		- $fields = array();
	4571	+ $fields = array();
5283	4572	$acf_field_group_ids = array();
5284		- $acf_field_groups = new WP_Query(
5285		- array(
5286		- 'post_type' => 'acf-field-group',
5287		- )
5288		- );
	4573	+ $acf_field_groups = new WP_Query( array(
	4574	+ 'post_type' => 'acf-field-group',
	4575	+ ));
5289	4576	while ( $acf_field_groups->have_posts() ) : $acf_field_groups->the_post();
5290	4577	if ( strpos( get_the_content(), 's:5:"param";s:9:"user_role"' ) !== false || strpos( get_the_content(), 's:5:"param";s:9:"user_form"' ) !== false ) :
5291	4578	array_push( $acf_field_group_ids, get_the_ID() );
5292	4579	endif;
5293		- endwhile;
5294		- wp_reset_postdata();
	4580	+ endwhile; wp_reset_postdata();
5295	4581	foreach ( $acf_field_group_ids as $acf_field_group_id ) :
5296		- $acf_fields = new WP_Query(
5297		- array(
5298		- 'post_type' => 'acf-field',
5299		- 'post_parent' => $acf_field_group_id,
5300		- )
5301		- );
	4582	+ $acf_fields = new WP_Query( array(
	4583	+ 'post_type' => 'acf-field',
	4584	+ 'post_parent' => $acf_field_group_id,
	4585	+ ));
5302	4586	while ( $acf_fields->have_posts() ) : $acf_fields->the_post();
5303	4587	global $post;
5304		- $fields[ $post->post_name ] = get_field_object( $post->post_name );
5305		- endwhile;
5306		- wp_reset_postdata();
	4588	+ $fields[$post->post_name] = get_field_object( $post->post_name );
	4589	+ endwhile; wp_reset_postdata();
5307	4590	endforeach;
5308	4591	// Get ACF 4 fields.
5309		- $acf4_field_groups = new WP_Query(
5310		- array(
5311		- 'post_type' => 'acf',
5312		- )
5313		- );
	4592	+ $acf4_field_groups = new WP_Query( array(
	4593	+ 'post_type' => 'acf',
	4594	+ ));
5314	4595	while ( $acf4_field_groups->have_posts() ) : $acf4_field_groups->the_post();
5315	4596	$field_group_rules = get_post_meta( get_the_ID(), 'rule', true );
5316		- if ( is_array( $field_group_rules ) && array_key_exists( 'param', $field_group_rules ) && 'ef_user' === $field_group_rules['param'] ) :
	4597	+ if ( is_array( $field_group_rules ) && array_key_exists( 'param', $field_group_rules ) && $field_group_rules['param'] === 'ef_user' ) :
5317	4598	$acf4_fields = get_post_custom( get_the_ID() );
5318	4599	foreach ( $acf4_fields as $meta_key => $meta_value ) :
5319	4600	if ( strpos( $meta_key, 'field_' ) === 0 ) :
5320		- $meta_value = unserialize( $meta_value[0] );
5321		- $fields[ $meta_key ] = $meta_value;
	4601	+ $meta_value = unserialize( $meta_value[0] );
	4602	+ $fields[$meta_key] = $meta_value;
5322	4603	endif;
5323	4604	endforeach;
5324	4605	endif;
5325		- endwhile;
5326		- wp_reset_postdata();
5327		- ?>
	4606	+ endwhile; wp_reset_postdata(); ?>
5328	4607	<optgroup label="ACF User Fields:">
5329		- <?php foreach ( (array) $fields as $field => $field_object ) : ?>
5330		- <option value="acf___<?php echo esc_attr( $field_object['key'] ); ?>"<?php selected( "acf___{$field_object['key']}" === $auth_settings_option ); ?>><?php echo esc_html( $field_object['label'] ); ?></option>
	4608	+ <?php foreach ( (array)$fields as $field => $field_object ) : ?>
	4609	+ <option value="acf___<?php echo $field_object['key']; ?>"<?php if ( $auth_settings_option === "acf___{$field_object['key']}" ) echo ' selected="selected"'; ?>><?php echo $field_object['label']; ?></option>
5331	4610	<?php endforeach; ?>
5332	4611	</optgroup>
5333	4612	<?php endif; ?>
5334		- <optgroup label="<?php esc_attr_e( 'All Usermeta:', 'authorizer' ); ?>">
5335		- <?php
5336		- foreach ( $this->get_all_usermeta_keys() as $meta_key ) :
5337		- if ( substr( $meta_key, 0, 3 ) === 'wp_' ) :
5338		- continue;
5339		- endif;
5340		- ?>
5341		- <option value="<?php echo esc_attr( $meta_key ); ?>"<?php selected( $auth_settings_option === $meta_key ); ?>><?php echo esc_html( $meta_key ); ?></option>
	4613	+ <optgroup label="<?php _e( 'All Usermeta:', 'authorizer' ); ?>">
	4614	+ <?php foreach ( $this->get_all_usermeta_keys() as $meta_key ) : if ( substr( $meta_key, 0, 3 ) === 'wp_' ) continue; ?>
	4615	+ <option value="<?php echo $meta_key; ?>"<?php if ( $auth_settings_option === $meta_key ) echo ' selected="selected"'; ?>><?php echo $meta_key; ?></option>
5342	4616	<?php endforeach; ?>
5343	4617	</optgroup>
5344		- </select>
5345		- <?php
	4618	+ </select><?php
5346	4619	}
5347	4620
5348	4621
5349		- /**
5350		- * Settings print callback.
5351		- *
5352		- * @param string $args Args (e.g., multisite admin mode).
5353		- * @return void
5354		- */
5355		- public function print_text_auth_advanced_users_per_page( $args = '' ) {
	4622	+ function print_text_auth_advanced_users_per_page( $args = '' ) {
5356	4623	// Get plugin option.
5357		- $option = 'advanced_users_per_page';
	4624	+ $option = 'advanced_users_per_page';
5358	4625	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5359	4626
5360	4627	// Print option elements.
5361		- ?>
5362		- <input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" size="4" />
5363		- <?php
	4628	+ ?><input type="text" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="<?php echo $auth_settings_option; ?>" placeholder="" size="4" /><?php
5364	4629	}
5365	4630
5366	4631
5367		- /**
5368		- * Settings print callback.
5369		- *
5370		- * @param string $args Args (e.g., multisite admin mode).
5371		- * @return void
5372		- */
5373		- public function print_select_auth_advanced_users_sort_by( $args = '' ) {
	4632	+ function print_select_auth_advanced_users_sort_by( $args = '' ) {
5374	4633	// Get plugin option.
5375		- $option = 'advanced_users_sort_by';
	4634	+ $option = 'advanced_users_sort_by';
5376	4635	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5377	4636
5378	4637	// Print option elements.
5379		- ?>
5380		- <select id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]">
5381		- <option value="created" <?php selected( $auth_settings_option, 'created' ); ?>><?php esc_html_e( 'Date approved', 'authorizer' ); ?></option>
5382		- <option value="email" <?php selected( $auth_settings_option, 'email' ); ?>><?php esc_html_e( 'Email', 'authorizer' ); ?></option>
5383		- <option value="role" <?php selected( $auth_settings_option, 'role' ); ?>><?php esc_html_e( 'Role', 'authorizer' ); ?></option>
5384		- <option value="date_added" <?php selected( $auth_settings_option, 'date_added' ); ?>><?php esc_html_e( 'Date registered', 'authorizer' ); ?></option>
5385		- </select>
5386		- <?php
	4638	+ ?><select id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]">
	4639	+ <option value="created" <?php selected( $auth_settings_option, 'created' ); ?>><?php _e( 'Date approved', 'authorizer' ); ?></option>
	4640	+ <option value="email" <?php selected( $auth_settings_option, 'email' ); ?>><?php _e( 'Email', 'authorizer' ); ?></option>
	4641	+ <option value="role" <?php selected( $auth_settings_option, 'role' ); ?>><?php _e( 'Role', 'authorizer' ); ?></option>
	4642	+ <option value="date_added" <?php selected( $auth_settings_option, 'date_added' ); ?>><?php _e( 'Date registered', 'authorizer' ); ?></option>
	4643	+ </select><?php
5387	4644	}
5388	4645
5389	4646
5390		- /**
5391		- * Settings print callback.
5392		- *
5393		- * @param string $args Args (e.g., multisite admin mode).
5394		- * @return void
5395		- */
5396		- public function print_select_auth_advanced_users_sort_order( $args = '' ) {
	4647	+ function print_select_auth_advanced_users_sort_order( $args = '' ) {
5397	4648	// Get plugin option.
5398		- $option = 'advanced_users_sort_order';
	4649	+ $option = 'advanced_users_sort_order';
5399	4650	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5400	4651
5401	4652	// Print option elements.
5402		- ?>
5403		- <select id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]">
5404		- <option value="asc" <?php selected( $auth_settings_option, 'asc' ); ?>><?php esc_html_e( 'Ascending', 'authorizer' ); ?></option>
5405		- <option value="desc" <?php selected( $auth_settings_option, 'desc' ); ?>><?php esc_html_e( 'Descending', 'authorizer' ); ?></option>
5406		- </select>
5407		- <?php
	4653	+ ?><select id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]">
	4654	+ <option value="asc" <?php selected( $auth_settings_option, 'asc' ); ?>><?php _e( 'Ascending', 'authorizer' ); ?></option>
	4655	+ <option value="desc" <?php selected( $auth_settings_option, 'desc' ); ?>><?php _e( 'Descending', 'authorizer' ); ?></option>
	4656	+ </select><?php
5408	4657	}
5409	4658
5410	4659
5411		- /**
5412		- * Settings print callback.
5413		- *
5414		- * @param string $args Args (e.g., multisite admin mode).
5415		- * @return void
5416		- */
5417		- public function print_checkbox_auth_advanced_widget_enabled( $args = '' ) {
	4660	+ function print_checkbox_auth_advanced_widget_enabled( $args = '' ) {
5418	4661	// Get plugin option.
5419		- $option = 'advanced_widget_enabled';
	4662	+ $option = 'advanced_widget_enabled';
5420	4663	$auth_settings_option = $this->get_plugin_option( $option, $this->get_admin_mode( $args ), 'allow override', 'print overlay' );
5421	4664
5422	4665	// Print option elements.
5423		- ?>
5424		- <input type="checkbox" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="1"<?php checked( 1 === intval( $auth_settings_option ) ); ?> /><label for="auth_settings_<?php echo esc_attr( $option ); ?>"><?php esc_html_e( 'Show Dashboard Widget', 'authorizer' ); ?></label>
5425		- <p><small><?php esc_html_e( 'Note: Only users with the create_users capability will be able to see the dashboard widget.', 'authorizer' ); ?></small></p>
5426		- <?php
	4666	+ ?><input type="checkbox" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="1"<?php checked( 1 == $auth_settings_option ); ?> /><label for="auth_settings_<?php echo $option; ?>"><?php _e( 'Show Dashboard Widget', 'authorizer' ); ?></label>
	4667	+ <p><small><?php _e( 'Note: Only users with the create_users capability will be able to see the dashboard widget.', 'authorizer' ) ?></small></p><?php
5427	4668	}
5428	4669
5429	4670
5430		- /**
5431		- * Settings print callback.
5432		- *
5433		- * @param string $args Args (e.g., multisite admin mode).
5434		- * @return void
5435		- */
5436		- public function print_checkbox_auth_advanced_override_multisite( $args = '' ) {
	4671	+ function print_checkbox_auth_advanced_override_multisite( $args = '' ) {
5437	4672	// Get plugin option.
5438		- $option = 'advanced_override_multisite';
	4673	+ $option = 'advanced_override_multisite';
5439	4674	$auth_settings_option = $this->get_plugin_option( $option );
5440	4675
5441	4676	// Print option elements.
5442		- ?>
5443		- <input type="checkbox" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="1"<?php checked( 1 === intval( $auth_settings_option ) ); ?> /><label for="auth_settings_<?php echo esc_attr( $option ); ?>"><?php esc_html_e( "Configure this site independently (don't inherit any multisite settings)", 'authorizer' ); ?></label>
5444		- <?php
	4677	+ ?><input type="checkbox" id="auth_settings_<?php echo $option; ?>" name="auth_settings[<?php echo $option; ?>]" value="1"<?php checked( 1 == $auth_settings_option ); ?> /><label for="auth_settings_<?php echo $option; ?>"><?php _e( "Configure this site independently (don't inherit any multisite settings)", 'authorizer' ); ?></label><?php
5445	4678	}
5446	4679
5447	4680
5448	4681
5449	4682	/**
5450		- * Determines whether we are in single site or multisite admin context.
5451		- *
5452		- * @param string $args Args (e.g., multisite admin mode).
5453		- * @return int Current mode.
5454		- */
5455		- private function get_admin_mode( $args ) {
5456		- if ( is_array( $args ) && array_key_exists( WP_Plugin_Authorizer::NETWORK_CONTEXT, $args ) && true === $args[ WP_Plugin_Authorizer::NETWORK_CONTEXT ] ) {
5457		- return WP_Plugin_Authorizer::NETWORK_CONTEXT;
5458		- } else {
5459		- return WP_Plugin_Authorizer::SINGLE_CONTEXT;
5460		- }
5461		- }
5462		-
5463		-
5464		- /**
5465	4683	* Add help documentation to the options page.
5466		- *
5467		- * Action: load-settings_page_authorizer > admin_head
	4684	+ * Run on action hook chain: load-settings_page_authorizer > admin_head
5468	4685	*/
5469	4686	public function admin_head() {
5470	4687	$screen = get_current_screen();
5471	4688
5472		- // Add help tab for Access Lists Settings.
	4689	+ // Add help tab for Access Lists Settings
5473	4690	$help_auth_settings_access_lists_content = '
5474		- <p>' . __( "<strong>Pending Users</strong>: Pending users are users who have successfully logged in to the site, but who haven't yet been approved (or blocked) by you.", 'authorizer' ) . '</p>
5475		- <p>' . __( '<strong>Approved Users</strong>: Approved users have access to the site once they successfully log in.', 'authorizer' ) . '</p>
5476		- <p>' . __( '<strong>Blocked Users</strong>: Blocked users will receive an error message when they try to visit the site after authenticating.', 'authorizer' ) . '</p>
5477		- <p>' . __( 'Users in the <strong>Pending</strong> list appear automatically after a new user tries to log in from the configured external authentication service. You can add users to the <strong>Approved</strong> or <strong>Blocked</strong> lists by typing them in manually, or by clicking the <em>Approve</em> or <em>Block</em> buttons next to a user in the <strong>Pending</strong> list.', 'authorizer' ) . '</p>
	4691	+ <p>' . __( "<strong>Pending Users</strong>: Pending users are users who have successfully logged in to the site, but who haven't yet been approved (or blocked) by you.", 'authorizer' ) .'</p>
	4692	+ <p>' . __( "<strong>Approved Users</strong>: Approved users have access to the site once they successfully log in.", 'authorizer' ) . '</p>
	4693	+ <p>' . __( "<strong>Blocked Users</strong>: Blocked users will receive an error message when they try to visit the site after authenticating.", 'authorizer' ) . '</p>
	4694	+ <p>' . __( "Users in the <strong>Pending</strong> list appear automatically after a new user tries to log in from the configured external authentication service. You can add users to the <strong>Approved</strong> or <strong>Blocked</strong> lists by typing them in manually, or by clicking the <em>Approve</em> or <em>Block</em> buttons next to a user in the <strong>Pending</strong> list.", 'authorizer' ) . '</p>
5478	4695	';
5479	4696	$screen->add_help_tab(
5480	4697	array(
5481		- 'id' => 'help_auth_settings_access_lists_content',
5482		- 'title' => __( 'Access Lists', 'authorizer' ),
	4698	+ 'id' => 'help_auth_settings_access_lists_content',
	4699	+ 'title' => __( 'Access Lists', 'authorizer' ),
5483	4700	'content' => $help_auth_settings_access_lists_content,
5484	4701	)
5485	4702	);
5486	4703
5487		- // Add help tab for Login Access Settings.
	4704	+ // Add help tab for Login Access Settings
5488	4705	$help_auth_settings_access_login_content = '
5489	4706	<p>' . __( "<strong>Who can log in to the site?</strong>: Choose the level of access restriction you'd like to use on your site here. You can leave the site open to anyone with a WordPress account or an account on an external service like Google, CAS, or LDAP, or restrict it to WordPress users and only the external users that you specify via the <em>Access Lists</em>.", 'authorizer' ) . '</p>
5490	4707	<p>' . __( "<strong>Which role should receive email notifications about pending users?</strong>: If you've restricted access to <strong>approved users</strong>, you can determine which WordPress users will receive a notification email everytime a new external user successfully logs in and is added to the pending list. All users of the specified role will receive an email, and the external user will get a message (specified below) telling them their access is pending approval.", 'authorizer' ) . '</p>
5491	4708	<p>' . __( '<strong>What message should pending users see after attempting to log in?</strong>: Here you can specify the exact message a new external user will see once they try to log in to the site for the first time.', 'authorizer' ) . '</p>
		@@ -5491,84 +4708,84 @@
5491	4708	<p>' . __( '<strong>What message should pending users see after attempting to log in?</strong>: Here you can specify the exact message a new external user will see once they try to log in to the site for the first time.', 'authorizer' ) . '</p>
5492	4709	';
5493	4710	$screen->add_help_tab(
5494	4711	array(
5495		- 'id' => 'help_auth_settings_access_login_content',
5496		- 'title' => __( 'Login Access', 'authorizer' ),
	4712	+ 'id' => 'help_auth_settings_access_login_content',
	4713	+ 'title' => __( 'Login Access', 'authorizer' ),
5497	4714	'content' => $help_auth_settings_access_login_content,
5498	4715	)
5499	4716	);
5500	4717
5501		- // Add help tab for Public Access Settings.
	4718	+ // Add help tab for Public Access Settings
5502	4719	$help_auth_settings_access_public_content = '
5503	4720	<p>' . __( "<strong>Who can view the site?</strong>: You can restrict the site's visibility by only allowing logged in users to see pages. If you do so, you can customize the specifics about the site's privacy using the settings below.", 'authorizer' ) . '</p>
5504	4721	<p>' . __( "<strong>What pages (if any) should be available to everyone?</strong>: If you'd like to declare certain pages on your site as always public (such as the course syllabus, introduction, or calendar), specify those pages here. These pages will always be available no matter what access restrictions exist.", 'authorizer' ) . '</p>
5505		- <p>' . __( '<strong>What happens to people without access when they visit a <em>private</em> page?</strong>: Choose the response anonymous users receive when visiting the site. You can choose between immediately taking them to the <strong>login screen</strong>, or simply showing them a <strong>message</strong>.', 'authorizer' ) . '</p>
5506		- <p>' . __( '<strong>What happens to people without access when they visit a <em>public</em> page?</strong>: Choose the response anonymous users receive when visiting a page on the site marked as public. You can choose between showing them the page without any message, or showing them a the page with a message above the content.', 'authorizer' ) . '</p>
5507		- <p>' . __( '<strong>What message should people without access see?</strong>: If you chose to show new users a <strong>message</strong> above, type that message here.', 'authorizer' ) . '</p>
	4722	+ <p>' . __( "<strong>What happens to people without access when they visit a <em>private</em> page?</strong>: Choose the response anonymous users receive when visiting the site. You can choose between immediately taking them to the <strong>login screen</strong>, or simply showing them a <strong>message</strong>.", 'authorizer' ) . '</p>
	4723	+ <p>' . __( "<strong>What happens to people without access when they visit a <em>public</em> page?</strong>: Choose the response anonymous users receive when visiting a page on the site marked as public. You can choose between showing them the page without any message, or showing them a the page with a message above the content.", 'authorizer' ) . '</p>
	4724	+ <p>' . __( "<strong>What message should people without access see?</strong>: If you chose to show new users a <strong>message</strong> above, type that message here.", 'authorizer' ) . '</p>
5508	4725	';
5509	4726	$screen->add_help_tab(
5510	4727	array(
5511		- 'id' => 'help_auth_settings_access_public_content',
5512		- 'title' => __( 'Public Access', 'authorizer' ),
	4728	+ 'id' => 'help_auth_settings_access_public_content',
	4729	+ 'title' => __( 'Public Access', 'authorizer' ),
5513	4730	'content' => $help_auth_settings_access_public_content,
5514	4731	)
5515	4732	);
5516	4733
5517		- // Add help tab for External Service (CAS, LDAP) Settings.
	4734	+ // Add help tab for External Service (CAS, LDAP) Settings
5518	4735	$help_auth_settings_external_content = '
5519	4736	<p>' . __( "<strong>Type of external service to authenticate against</strong>: Choose which authentication service type you will be using. You'll have to fill out different fields below depending on which service you choose.", 'authorizer' ) . '</p>
5520		- <p>' . __( '<strong>Enable Google Logins</strong>: Choose if you want to allow users to log in with their Google Account credentials. You will need to enter your API Client ID and Secret to enable Google Logins.', 'authorizer' ) . '</p>
5521		- <p>' . __( '<strong>Enable CAS Logins</strong>: Choose if you want to allow users to log in with via CAS (Central Authentication Service). You will need to enter details about your CAS server (host, port, and path) to enable CAS Logins.', 'authorizer' ) . '</p>
5522		- <p>' . __( '<strong>Enable LDAP Logins</strong>: Choose if you want to allow users to log in with their LDAP (Lightweight Directory Access Protocol) credentials. You will need to enter details about your LDAP server (host, port, search base, uid attribute, directory user, directory user password, and whether to use TLS) to enable Google Logins.', 'authorizer' ) . '</p>
5523		- <p>' . __( '<strong>Default role for new CAS users</strong>: Specify which role new external users will get by default. Be sure to choose a role with limited permissions!', 'authorizer' ) . '</p>
5524		- <p><strong><em>' . __( 'If you enable Google logins:', 'authorizer' ) . '</em></strong></p>
	4737	+ <p>' . __( "<strong>Enable Google Logins</strong>: Choose if you want to allow users to log in with their Google Account credentials. You will need to enter your API Client ID and Secret to enable Google Logins.", 'authorizer' ) . '</p>
	4738	+ <p>' . __( "<strong>Enable CAS Logins</strong>: Choose if you want to allow users to log in with via CAS (Central Authentication Service). You will need to enter details about your CAS server (host, port, and path) to enable CAS Logins.", 'authorizer' ) . '</p>
	4739	+ <p>' . __( "<strong>Enable LDAP Logins</strong>: Choose if you want to allow users to log in with their LDAP (Lightweight Directory Access Protocol) credentials. You will need to enter details about your LDAP server (host, port, search base, uid attribute, directory user, directory user password, and whether to use TLS) to enable Google Logins.", 'authorizer' ) . '</p>
	4740	+ <p>' . __( "<strong>Default role for new CAS users</strong>: Specify which role new external users will get by default. Be sure to choose a role with limited permissions!", 'authorizer' ) . '</p>
	4741	+ <p><strong><em>' . __( "If you enable Google logins:", 'authorizer' ) . '</em></strong></p>
5525	4742	<ul>
5526	4743	<li>' . __( "<strong>Google Client ID</strong>: You can generate this ID by creating a new Project in the <a href='https://cloud.google.com/console'>Google Developers Console</a>. A Client ID typically looks something like this: 1234567890123-kdjr85yt6vjr6d8g7dhr8g7d6durjf7g.apps.googleusercontent.com", 'authorizer' ) . '</li>
5527	4744	<li>' . __( "<strong>Google Client Secret</strong>: You can generate this secret by creating a new Project in the <a href='https://cloud.google.com/console'>Google Developers Console</a>. A Client Secret typically looks something like this: sDNgX5_pr_5bly-frKmvp8jT", 'authorizer' ) . '</li>
5528	4745	</ul>
5529		- <p><strong><em>' . __( 'If you enable CAS logins:', 'authorizer' ) . '</em></strong></p>
	4746	+ <p><strong><em>' . __( "If you enable CAS logins:", 'authorizer' ) . '</em></strong></p>
5530	4747	<ul>
5531		- <li>' . __( '<strong>CAS server hostname</strong>: Enter the hostname of the CAS server you authenticate against (e.g., authn.example.edu).', 'authorizer' ) . '</li>
5532		- <li>' . __( '<strong>CAS server port</strong>: Enter the port on the CAS server to connect to (e.g., 443).', 'authorizer' ) . '</li>
5533		- <li>' . __( '<strong>CAS server path/context</strong>: Enter the path to the login endpoint on the CAS server (e.g., /cas).', 'authorizer' ) . '</li>
	4748	+ <li>' . __( "<strong>CAS server hostname</strong>: Enter the hostname of the CAS server you authenticate against (e.g., authn.example.edu).", 'authorizer' ) . '</li>
	4749	+ <li>' . __( "<strong>CAS server port</strong>: Enter the port on the CAS server to connect to (e.g., 443).", 'authorizer' ) . '</li>
	4750	+ <li>' . __( "<strong>CAS server path/context</strong>: Enter the path to the login endpoint on the CAS server (e.g., /cas).", 'authorizer' ) . '</li>
5534	4751	<li>' . __( "<strong>CAS attribute containing first name</strong>: Enter the CAS attribute that has the user's first name. When this user first logs in, their WordPress account will have their first name retrieved from CAS and added to their WordPress profile.", 'authorizer' ) . '</li>
5535	4752	<li>' . __( "<strong>CAS attribute containing last name</strong>: Enter the CAS attribute that has the user's last name. When this user first logs in, their WordPress account will have their last name retrieved from CAS and added to their WordPress profile.", 'authorizer' ) . '</li>
5536		- <li>' . __( '<strong>CAS attribute update</strong>: Select whether the first and last names retrieved from CAS should overwrite any value the user has entered in the first and last name fields in their WordPress profile. If this is not set, this only happens the first time they log in.', 'authorizer' ) . '</li>
	4753	+ <li>' . __( "<strong>CAS attribute update</strong>: Select whether the first and last names retrieved from CAS should overwrite any value the user has entered in the first and last name fields in their WordPress profile. If this is not set, this only happens the first time they log in.", 'authorizer' ) . '</li>
5537	4754	</ul>
5538		- <p><strong><em>' . __( 'If you enable LDAP logins:', 'authorizer' ) . '</em></strong></p>
	4755	+ <p><strong><em>' . __( "If you enable LDAP logins:", 'authorizer' ) . '</em></strong></p>
5539	4756	<ul>
5540		- <li>' . __( '<strong>LDAP Host</strong>: Enter the URL of the LDAP server you authenticate against.', 'authorizer' ) . '</li>
5541		- <li>' . __( '<strong>LDAP Port</strong>: Enter the port number that the LDAP server listens on.', 'authorizer' ) . '</li>
5542		- <li>' . __( '<strong>LDAP Search Base</strong>: Enter the LDAP string that represents the search base, e.g., ou=people,dc=example,dc=edu', 'authorizer' ) . '</li>
5543		- <li>' . __( '<strong>LDAP attribute containing username</strong>: Enter the name of the LDAP attribute that contains the usernames used by those attempting to log in. The plugin will search on this attribute to find the cn to bind against for login attempts.', 'authorizer' ) . '</li>
5544		- <li>' . __( '<strong>LDAP Directory User</strong>: Enter the name of the LDAP user that has permissions to browse the directory.', 'authorizer' ) . '</li>
5545		- <li>' . __( '<strong>LDAP Directory User Password</strong>: Enter the password for the LDAP user that has permission to browse the directory.', 'authorizer' ) . '</li>
5546		- <li>' . __( '<strong>Use TLS</strong>: Select whether all communication with the LDAP server should be performed over a TLS-secured connection.', 'authorizer' ) . '</li>
	4757	+ <li>' . __( "<strong>LDAP Host</strong>: Enter the URL of the LDAP server you authenticate against.", 'authorizer' ) . '</li>
	4758	+ <li>' . __( "<strong>LDAP Port</strong>: Enter the port number that the LDAP server listens on.", 'authorizer' ) . '</li>
	4759	+ <li>' . __( "<strong>LDAP Search Base</strong>: Enter the LDAP string that represents the search base, e.g., ou=people,dc=example,dc=edu", 'authorizer' ) . '</li>
	4760	+ <li>' . __( "<strong>LDAP attribute containing username</strong>: Enter the name of the LDAP attribute that contains the usernames used by those attempting to log in. The plugin will search on this attribute to find the cn to bind against for login attempts.", 'authorizer' ) . '</li>
	4761	+ <li>' . __( "<strong>LDAP Directory User</strong>: Enter the name of the LDAP user that has permissions to browse the directory.", 'authorizer' ) . '</li>
	4762	+ <li>' . __( "<strong>LDAP Directory User Password</strong>: Enter the password for the LDAP user that has permission to browse the directory.", 'authorizer' ) . '</li>
	4763	+ <li>' . __( "<strong>Use TLS</strong>: Select whether all communication with the LDAP server should be performed over a TLS-secured connection.", 'authorizer' ) . '</li>
5547	4764	<li>' . __( "<strong>Custom lost password URL</strong>: The WordPress login page contains a link to recover a lost password. If you have external users who shouldn't change the password on their WordPress account, point them to the appropriate location to change the password on their external authentication service here.", 'authorizer' ) . '</li>
5548	4765	<li>' . __( "<strong>LDAP attribute containing first name</strong>: Enter the LDAP attribute that has the user's first name. When this user first logs in, their WordPress account will have their first name retrieved from LDAP and added to their WordPress profile.", 'authorizer' ) . '</li>
5549	4766	<li>' . __( "<strong>LDAP attribute containing last name</strong>: Enter the LDAP attribute that has the user's last name. When this user first logs in, their WordPress account will have their last name retrieved from LDAP and added to their WordPress profile.", 'authorizer' ) . '</li>
5550		- <li>' . __( '<strong>LDAP attribute update</strong>: Select whether the first and last names retrieved from LDAP should overwrite any value the user has entered in the first and last name fields in their WordPress profile. If this is not set, this only happens the first time they log in.', 'authorizer' ) . '</li>
	4767	+ <li>' . __( "<strong>LDAP attribute update</strong>: Select whether the first and last names retrieved from LDAP should overwrite any value the user has entered in the first and last name fields in their WordPress profile. If this is not set, this only happens the first time they log in.", 'authorizer' ) . '</li>
5551	4768	</ul>
5552	4769	';
5553	4770	$screen->add_help_tab(
5554	4771	array(
5555		- 'id' => 'help_auth_settings_external_content',
5556		- 'title' => __( 'External Service', 'authorizer' ),
	4772	+ 'id' => 'help_auth_settings_external_content',
	4773	+ 'title' => __( 'External Service', 'authorizer' ),
5557	4774	'content' => $help_auth_settings_external_content,
5558	4775	)
5559	4776	);
5560	4777
5561		- // Add help tab for Advanced Settings.
	4778	+ // Add help tab for Advanced Settings
5562	4779	$help_auth_settings_advanced_content = '
5563		- <p>' . __( '<strong>Limit invalid login attempts</strong>: Choose how soon (and for how long) to restrict access to individuals (or bots) making repeated invalid login attempts. You may set a shorter delay first, and then a longer delay after repeated invalid attempts; you may also set how much time must pass before the delays will be reset to normal.', 'authorizer' ) . '</p>
5564		- <p>' . __( '<strong>Hide WordPress Logins</strong>: If you want to hide the WordPress username and password fields and the Log In button on the wp-login screen, enable this option. Note: You can always access the WordPress logins by adding external=wordpress to the wp-login URL, like so:', 'authorizer' ) . ' <a href="' . wp_login_url() . '?external=wordpress" target="_blank">' . wp_login_url() . '?external=wordpress</a>.</p>
	4780	+ <p>' . __( "<strong>Limit invalid login attempts</strong>: Choose how soon (and for how long) to restrict access to individuals (or bots) making repeated invalid login attempts. You may set a shorter delay first, and then a longer delay after repeated invalid attempts; you may also set how much time must pass before the delays will be reset to normal.", 'authorizer' ) . '</p>
	4781	+ <p>' . __( "<strong>Hide WordPress Logins</strong>: If you want to hide the WordPress username and password fields and the Log In button on the wp-login screen, enable this option. Note: You can always access the WordPress logins by adding external=wordpress to the wp-login URL, like so:", 'authorizer' ) . ' <a href="' . wp_login_url() . '?external=wordpress" target="_blank">' . wp_login_url() . '?external=wordpress</a>.</p>
5565	4782	<p>' . __( "<strong>Custom WordPress login branding</strong>: If you'd like to use custom branding on the WordPress login page, select that here. You will need to use the `authorizer_add_branding_option` filter in your theme to add it. You can see an example theme that implements this filter in the plugin directory under sample-theme-add-branding.", 'authorizer' ) . '</p>
5566	4783	';
5567	4784	$screen->add_help_tab(
5568	4785	array(
5569		- 'id' => 'help_auth_settings_advanced_content',
5570		- 'title' => __( 'Advanced', 'authorizer' ),
	4786	+ 'id' => 'help_auth_settings_advanced_content',
	4787	+ 'title' => __( 'Advanced', 'authorizer' ),
5571	4788	'content' => $help_auth_settings_advanced_content,
5572	4789	)
5573	4790	);
5574	4791	}
		@@ -5583,66 +4800,65 @@
5583	4800
5584	4801
5585	4802	/**
5586	4803	* Network Admin menu item
	4804	+ * Hook: network_admin_menu
5587	4805	*
5588		- * Action: network_admin_menu
5589		- *
	4806	+ * @param none
5590	4807	* @return void
5591	4808	*/
5592	4809	public function network_admin_menu() {
5593	4810	// @see http://codex.wordpress.org/Function_Reference/add_menu_page
5594	4811	add_menu_page(
5595		- 'Authorizer',
5596		- 'Authorizer',
5597		- 'manage_network_options',
5598		- 'authorizer',
	4812	+ 'Authorizer', // Page title
	4813	+ 'Authorizer', // Menu title
	4814	+ 'manage_network_options', // Capability
	4815	+ 'authorizer', // Menu slug
5599	4816	array( $this, 'create_network_admin_page' ),
5600		- 'dashicons-groups',
5601		- 89 // Position.
	4817	+ 'dashicons-groups', // Icon URL
	4818	+ 89 // Position
5602	4819	);
5603	4820	}
5604	4821
5605	4822
5606	4823	/**
5607		- * Output the HTML for the options page.
	4824	+ * Output the HTML for the options page
5608	4825	*/
5609	4826	public function create_network_admin_page() {
5610	4827	if ( ! current_user_can( 'manage_network_options' ) ) {
5611		- wp_die( wp_kses( __( 'You do not have sufficient permissions to access this page.', 'authorizer' ), $this->allowed_html ) );
	4828	+ wp_die( __( 'You do not have sufficient permissions to access this page.', 'authorizer' ) );
5612	4829	}
5613		- $auth_settings = get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings', array() );
5614		- ?>
	4830	+ $auth_settings = get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings', array() ); ?>
5615	4831	<div class="wrap">
5616	4832	<form method="post" action="" autocomplete="off">
5617		- <h2><?php esc_html_e( 'Authorizer Settings', 'authorizer' ); ?></h2>
5618		- <p><?php echo wp_kses( __( 'Most <strong>Authorizer</strong> settings are set in the individual sites, but you can specify a few options here that apply to <strong>all sites in the network</strong>. These settings will override settings in the individual sites.', 'authorizer' ), $this->allowed_html ); ?></p>
	4833	+ <h2><?php _e( 'Authorizer Settings', 'authorizer' ); ?></h2>
	4834	+ <p><?php _e( 'Most <strong>Authorizer</strong> settings are set in the individual sites, but you can specify a few options here that apply to <strong>all sites in the network</strong>. These settings will override settings in the individual sites.', 'authorizer' ); ?></p>
5619	4835
5620		- <input type="checkbox" id="auth_settings_multisite_override" name="auth_settings[multisite_override]" value="1"<?php checked( 1 === intval( $auth_settings['multisite_override'] ) ); ?> /><label for="auth_settings_multisite_override"><?php esc_html_e( 'Override individual site settings with the settings below', 'authorizer' ); ?></label>
	4836	+ <input type="checkbox" id="auth_settings_multisite_override" name="auth_settings[multisite_override]" value="1"<?php checked( 1 == $auth_settings['multisite_override'] ); ?> /><label for="auth_settings_multisite_override"><?php _e( 'Override individual site settings with the settings below', 'authorizer' ); ?></label>
5621	4837
5622	4838	<div id="auth_multisite_settings_disabled_overlay" style="display: none;"></div>
5623	4839
5624	4840	<div class="wrap" id="auth_multisite_settings">
5625		- <?php $this->print_section_info_tabs( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?>
	4841	+ <?php $this->print_section_info_tabs( array( MULTISITE_ADMIN => true ) ); ?>
5626	4842
5627	4843	<?php wp_nonce_field( 'save_auth_settings', 'nonce_save_auth_settings' ); ?>
5628	4844
5629		- <?php // Custom access lists (for network, we only really want approved list, not pending or blocked). ?>
	4845	+ <?php // Custom access lists (for network, we only really want approved list, not pending or blocked) ?>
5630	4846	<div id="section_info_access_lists" class="section_info">
5631		- <p><?php esc_html_e( 'Manage who has access to all sites in the network.', 'authorizer' ); ?></p>
	4847	+ <p><?php _e( 'Manage who has access to all sites in the network.', 'authorizer' ); ?></p>
5632	4848	</div>
5633	4849	<table class="form-table"><tbody>
5634	4850	<tr>
5635		- <th scope="row"><?php esc_html_e( 'Who can log in to sites in this network?', 'authorizer' ); ?></th>
5636		- <td><?php $this->print_radio_auth_access_who_can_login( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4851	+ <th scope="row"><?php _e( 'Who can log in to sites in this network?', 'authorizer' ); ?></th>
	4852	+ <td><?php $this->print_radio_auth_access_who_can_login( array( MULTISITE_ADMIN => true ) ); ?></td>
5637	4853	</tr>
5638	4854	<tr>
5639		- <th scope="row"><?php esc_html_e( 'Who can view sites in this network?', 'authorizer' ); ?></th>
5640		- <td><?php $this->print_radio_auth_access_who_can_view( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4855	+ <th scope="row"><?php _e( 'Who can view sites in this network?', 'authorizer' ); ?></th>
	4856	+ <td><?php $this->print_radio_auth_access_who_can_view( array( MULTISITE_ADMIN => true ) ); ?></td>
5641	4857	</tr>
5642	4858	<tr>
5643		- <th scope="row"><?php esc_html_e( 'Approved Users (All Sites)', 'authorizer' ); ?><br /><small><em><?php echo wp_kses( __( 'Note: these users will <strong>not</strong> receive welcome emails when approved. Only users approved from individual sites can receive these messages.', 'authorizer' ), $this->allowed_html ); ?></em></small></th>
5644		- <td><?php $this->print_combo_auth_access_users_approved( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4859	+ <th scope="row"><?php _e( 'Approved Users (All Sites)', 'authorizer' ); ?><br /><small><em><?php _e( 'Note: these users will <strong>not</strong> receive welcome emails when approved. Only users approved from individual sites can receive these messages.', 'authorizer' ); ?></em></small></th>
	4860	+ <td><?php $this->print_combo_auth_access_users_approved( array( MULTISITE_ADMIN => true ) ); ?></td>
5645	4861	</tr>
5646	4862	</tbody></table>
5647	4863
5648	4864	<?php $this->print_section_info_external(); ?>
		@@ -5647,122 +4863,122 @@
5647	4863
5648	4864	<?php $this->print_section_info_external(); ?>
5649	4865	<table class="form-table"><tbody>
5650	4866	<tr>
5651		- <th scope="row"><?php esc_html_e( 'Default role for new users', 'authorizer' ); ?></th>
5652		- <td><?php $this->print_select_auth_access_default_role( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4867	+ <th scope="row"><?php _e( 'Default role for new users', 'authorizer' ); ?></th>
	4868	+ <td><?php $this->print_select_auth_access_default_role( array( MULTISITE_ADMIN => true ) ); ?></td>
5653	4869	</tr>
5654	4870	<tr>
5655		- <th scope="row"><?php esc_html_e( 'Google Logins', 'authorizer' ); ?></th>
5656		- <td><?php $this->print_checkbox_auth_external_google( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4871	+ <th scope="row"><?php _e( 'Google Logins', 'authorizer' ); ?></th>
	4872	+ <td><?php $this->print_checkbox_auth_external_google( array( MULTISITE_ADMIN => true ) ); ?></td>
5657	4873	</tr>
5658	4874	<tr>
5659		- <th scope="row"><?php esc_html_e( 'Google Client ID', 'authorizer' ); ?></th>
5660		- <td><?php $this->print_text_google_clientid( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4875	+ <th scope="row"><?php _e( 'Google Client ID', 'authorizer' ); ?></th>
	4876	+ <td><?php $this->print_text_google_clientid( array( MULTISITE_ADMIN => true ) ); ?></td>
5661	4877	</tr>
5662	4878	<tr>
5663		- <th scope="row"><?php esc_html_e( 'Google Client Secret', 'authorizer' ); ?></th>
5664		- <td><?php $this->print_text_google_clientsecret( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4879	+ <th scope="row"><?php _e( 'Google Client Secret', 'authorizer' ); ?></th>
	4880	+ <td><?php $this->print_text_google_clientsecret( array( MULTISITE_ADMIN => true ) ); ?></td>
5665	4881	</tr>
5666	4882	<tr>
5667		- <th scope="row"><?php esc_html_e( 'Google Hosted Domain', 'authorizer' ); ?></th>
5668		- <td><?php $this->print_text_google_hosteddomain( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4883	+ <th scope="row"><?php _e( 'Google Hosted Domain', 'authorizer' ); ?></th>
	4884	+ <td><?php $this->print_text_google_hosteddomain( array( MULTISITE_ADMIN => true ) ); ?></td>
5669	4885	</tr>
5670	4886	<tr>
5671		- <th scope="row"><?php esc_html_e( 'CAS Logins', 'authorizer' ); ?></th>
5672		- <td><?php $this->print_checkbox_auth_external_cas( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4887	+ <th scope="row"><?php _e( 'CAS Logins', 'authorizer' ); ?></th>
	4888	+ <td><?php $this->print_checkbox_auth_external_cas( array( MULTISITE_ADMIN => true ) ); ?></td>
5673	4889	</tr>
5674	4890	<tr>
5675		- <th scope="row"><?php esc_html_e( 'CAS Custom Label', 'authorizer' ); ?></th>
5676		- <td><?php $this->print_text_cas_custom_label( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4891	+ <th scope="row"><?php _e( 'CAS Custom Label', 'authorizer' ); ?></th>
	4892	+ <td><?php $this->print_text_cas_custom_label( array( MULTISITE_ADMIN => true ) ); ?></td>
5677	4893	</tr>
5678	4894	<tr>
5679		- <th scope="row"><?php esc_html_e( 'CAS server hostname', 'authorizer' ); ?></th>
5680		- <td><?php $this->print_text_cas_host( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4895	+ <th scope="row"><?php _e( 'CAS server hostname', 'authorizer' ); ?></th>
	4896	+ <td><?php $this->print_text_cas_host( array( MULTISITE_ADMIN => true ) ); ?></td>
5681	4897	</tr>
5682	4898	<tr>
5683		- <th scope="row"><?php esc_html_e( 'CAS server port', 'authorizer' ); ?></th>
5684		- <td><?php $this->print_text_cas_port( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4899	+ <th scope="row"><?php _e( 'CAS server port', 'authorizer' ); ?></th>
	4900	+ <td><?php $this->print_text_cas_port( array( MULTISITE_ADMIN => true ) ); ?></td>
5685	4901	</tr>
5686	4902	<tr>
5687		- <th scope="row"><?php esc_html_e( 'CAS server path/context', 'authorizer' ); ?></th>
5688		- <td><?php $this->print_text_cas_path( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4903	+ <th scope="row"><?php _e( 'CAS server path/context', 'authorizer' ); ?></th>
	4904	+ <td><?php $this->print_text_cas_path( array( MULTISITE_ADMIN => true ) ); ?></td>
5689	4905	</tr>
5690	4906	<tr>
5691		- <th scope="row"><?php esc_html_e( 'CAS server version', 'authorizer' ); ?></th>
5692		- <td><?php $this->print_select_cas_version( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4907	+ <th scope="row"><?php _e( 'CAS server version', 'authorizer' ); ?></th>
	4908	+ <td><?php $this->print_select_cas_version( array( MULTISITE_ADMIN => true ) ); ?></td>
5693	4909	</tr>
5694	4910	<tr>
5695		- <th scope="row"><?php esc_html_e( 'CAS attribute containing email', 'authorizer' ); ?></th>
5696		- <td><?php $this->print_text_cas_attr_email( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4911	+ <th scope="row"><?php _e( 'CAS attribute containing email', 'authorizer' ); ?></th>
	4912	+ <td><?php $this->print_text_cas_attr_email( array( MULTISITE_ADMIN => true ) ); ?></td>
5697	4913	</tr>
5698	4914	<tr>
5699		- <th scope="row"><?php esc_html_e( 'CAS attribute containing first name', 'authorizer' ); ?></th>
5700		- <td><?php $this->print_text_cas_attr_first_name( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4915	+ <th scope="row"><?php _e( 'CAS attribute containing first name', 'authorizer' ); ?></th>
	4916	+ <td><?php $this->print_text_cas_attr_first_name( array( MULTISITE_ADMIN => true ) ); ?></td>
5701	4917	</tr>
5702	4918	<tr>
5703		- <th scope="row"><?php esc_html_e( 'CAS attribute containing last name', 'authorizer' ); ?></th>
5704		- <td><?php $this->print_text_cas_attr_last_name( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4919	+ <th scope="row"><?php _e( 'CAS attribute containing last name', 'authorizer' ); ?></th>
	4920	+ <td><?php $this->print_text_cas_attr_last_name( array( MULTISITE_ADMIN => true ) ); ?></td>
5705	4921	</tr>
5706	4922	<tr>
5707		- <th scope="row"><?php esc_html_e( 'CAS attribute update', 'authorizer' ); ?></th>
5708		- <td><?php $this->print_checkbox_cas_attr_update_on_login( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4923	+ <th scope="row"><?php _e( 'CAS attribute update', 'authorizer' ); ?></th>
	4924	+ <td><?php $this->print_checkbox_cas_attr_update_on_login( array( MULTISITE_ADMIN => true ) ); ?></td>
5709	4925	</tr>
5710	4926	<tr>
5711		- <th scope="row"><?php esc_html_e( 'CAS automatic login', 'authorizer' ); ?></th>
5712		- <td><?php $this->print_checkbox_cas_auto_login( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4927	+ <th scope="row"><?php _e( 'CAS automatic login', 'authorizer' ); ?></th>
	4928	+ <td><?php $this->print_checkbox_cas_auto_login( array( MULTISITE_ADMIN => true ) ); ?></td>
5713	4929	</tr>
5714	4930	<tr>
5715		- <th scope="row"><?php esc_html_e( 'LDAP Logins', 'authorizer' ); ?></th>
5716		- <td><?php $this->print_checkbox_auth_external_ldap( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4931	+ <th scope="row"><?php _e( 'LDAP Logins', 'authorizer' ); ?></th>
	4932	+ <td><?php $this->print_checkbox_auth_external_ldap( array( MULTISITE_ADMIN => true ) ); ?></td>
5717	4933	</tr>
5718	4934	<tr>
5719		- <th scope="row"><?php esc_html_e( 'LDAP Host', 'authorizer' ); ?></th>
5720		- <td><?php $this->print_text_ldap_host( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4935	+ <th scope="row"><?php _e( 'LDAP Host', 'authorizer' ); ?></th>
	4936	+ <td><?php $this->print_text_ldap_host( array( MULTISITE_ADMIN => true ) ); ?></td>
5721	4937	</tr>
5722	4938	<tr>
5723		- <th scope="row"><?php esc_html_e( 'LDAP Port', 'authorizer' ); ?></th>
5724		- <td><?php $this->print_text_ldap_port( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4939	+ <th scope="row"><?php _e( 'LDAP Port', 'authorizer' ); ?></th>
	4940	+ <td><?php $this->print_text_ldap_port( array( MULTISITE_ADMIN => true ) ); ?></td>
5725	4941	</tr>
5726	4942	<tr>
5727		- <th scope="row"><?php esc_html_e( 'Use TLS', 'authorizer' ); ?></th>
5728		- <td><?php $this->print_checkbox_ldap_tls( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4943	+ <th scope="row"><?php _e( 'Use TLS', 'authorizer' ); ?></th>
	4944	+ <td><?php $this->print_checkbox_ldap_tls( array( MULTISITE_ADMIN => true ) ); ?></td>
5729	4945	</tr>
5730	4946	<tr>
5731		- <th scope="row"><?php esc_html_e( 'LDAP Search Base', 'authorizer' ); ?></th>
5732		- <td><?php $this->print_text_ldap_search_base( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4947	+ <th scope="row"><?php _e( 'LDAP Search Base', 'authorizer' ); ?></th>
	4948	+ <td><?php $this->print_text_ldap_search_base( array( MULTISITE_ADMIN => true ) ); ?></td>
5733	4949	</tr>
5734	4950	<tr>
5735		- <th scope="row"><?php esc_html_e( 'LDAP attribute containing username', 'authorizer' ); ?></th>
5736		- <td><?php $this->print_text_ldap_uid( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4951	+ <th scope="row"><?php _e( 'LDAP attribute containing username', 'authorizer' ); ?></th>
	4952	+ <td><?php $this->print_text_ldap_uid( array( MULTISITE_ADMIN => true ) ); ?></td>
5737	4953	</tr>
5738	4954	<tr>
5739		- <th scope="row"><?php esc_html_e( 'LDAP attribute containing email', 'authorizer' ); ?></th>
5740		- <td><?php $this->print_text_ldap_attr_email( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4955	+ <th scope="row"><?php _e( 'LDAP attribute containing email', 'authorizer' ); ?></th>
	4956	+ <td><?php $this->print_text_ldap_attr_email( array( MULTISITE_ADMIN => true ) ); ?></td>
5741	4957	</tr>
5742	4958	<tr>
5743		- <th scope="row"><?php esc_html_e( 'LDAP Directory User', 'authorizer' ); ?></th>
5744		- <td><?php $this->print_text_ldap_user( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4959	+ <th scope="row"><?php _e( 'LDAP Directory User', 'authorizer' ); ?></th>
	4960	+ <td><?php $this->print_text_ldap_user( array( MULTISITE_ADMIN => true ) ); ?></td>
5745	4961	</tr>
5746	4962	<tr>
5747		- <th scope="row"><?php esc_html_e( 'LDAP Directory User Password', 'authorizer' ); ?></th>
5748		- <td><?php $this->print_password_ldap_password( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4963	+ <th scope="row"><?php _e( 'LDAP Directory User Password', 'authorizer' ); ?></th>
	4964	+ <td><?php $this->print_password_ldap_password( array( MULTISITE_ADMIN => true ) ); ?></td>
5749	4965	</tr>
5750	4966	<tr>
5751		- <th scope="row"><?php esc_html_e( 'Custom lost password URL', 'authorizer' ); ?></th>
5752		- <td><?php $this->print_text_ldap_lostpassword_url( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4967	+ <th scope="row"><?php _e( 'Custom lost password URL', 'authorizer' ); ?></th>
	4968	+ <td><?php $this->print_text_ldap_lostpassword_url( array( MULTISITE_ADMIN => true ) ); ?></td>
5753	4969	</tr>
5754	4970	<tr>
5755		- <th scope="row"><?php esc_html_e( 'LDAP attribute containing first name', 'authorizer' ); ?></th>
5756		- <td><?php $this->print_text_ldap_attr_first_name( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4971	+ <th scope="row"><?php _e( 'LDAP attribute containing first name', 'authorizer' ); ?></th>
	4972	+ <td><?php $this->print_text_ldap_attr_first_name( array( MULTISITE_ADMIN => true ) ); ?></td>
5757	4973	</tr>
5758	4974	<tr>
5759		- <th scope="row"><?php esc_html_e( 'LDAP attribute containing last name', 'authorizer' ); ?></th>
5760		- <td><?php $this->print_text_ldap_attr_last_name( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4975	+ <th scope="row"><?php _e( 'LDAP attribute containing last name', 'authorizer' ); ?></th>
	4976	+ <td><?php $this->print_text_ldap_attr_last_name( array( MULTISITE_ADMIN => true ) ); ?></td>
5761	4977	</tr>
5762	4978	<tr>
5763		- <th scope="row"><?php esc_html_e( 'LDAP attribute update', 'authorizer' ); ?></th>
5764		- <td><?php $this->print_checkbox_ldap_attr_update_on_login( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4979	+ <th scope="row"><?php _e( 'LDAP attribute update', 'authorizer' ); ?></th>
	4980	+ <td><?php $this->print_checkbox_ldap_attr_update_on_login( array( MULTISITE_ADMIN => true ) ); ?></td>
5765	4981	</tr>
5766	4982	</tbody></table>
5767	4983
5768	4984	<?php $this->print_section_info_advanced(); ?>
		@@ -5767,36 +4983,36 @@
5767	4983
5768	4984	<?php $this->print_section_info_advanced(); ?>
5769	4985	<table class="form-table"><tbody>
5770	4986	<tr>
5771		- <th scope="row"><?php esc_html_e( 'Limit invalid login attempts', 'authorizer' ); ?></th>
5772		- <td><?php $this->print_text_auth_advanced_lockouts( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4987	+ <th scope="row"><?php _e( 'Limit invalid login attempts', 'authorizer' ); ?></th>
	4988	+ <td><?php $this->print_text_auth_advanced_lockouts( array( MULTISITE_ADMIN => true ) ); ?></td>
5773	4989	</tr>
5774	4990	<tr>
5775		- <th scope="row"><?php esc_html_e( 'Hide WordPress Logins', 'authorizer' ); ?></th>
5776		- <td><?php $this->print_checkbox_auth_advanced_hide_wp_login( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4991	+ <th scope="row"><?php _e( 'Hide WordPress Logins', 'authorizer' ); ?></th>
	4992	+ <td><?php $this->print_checkbox_auth_advanced_hide_wp_login( array( MULTISITE_ADMIN => true ) ); ?></td>
5777	4993	</tr>
5778	4994	<tr>
5779		- <th scope="row"><?php esc_html_e( 'Number of users per page', 'authorizer' ); ?></th>
5780		- <td><?php $this->print_text_auth_advanced_users_per_page( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4995	+ <th scope="row"><?php _e( 'Number of users per page', 'authorizer' ); ?></th>
	4996	+ <td><?php $this->print_text_auth_advanced_users_per_page( array( MULTISITE_ADMIN => true ) ); ?></td>
5781	4997	</tr>
5782	4998	<tr>
5783		- <th scope="row"><?php esc_html_e( 'Approved users sort method', 'authorizer' ); ?></th>
5784		- <td><?php $this->print_select_auth_advanced_users_sort_by( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	4999	+ <th scope="row"><?php _e( 'Approved users sort method', 'authorizer' ); ?></th>
	5000	+ <td><?php $this->print_select_auth_advanced_users_sort_by( array( MULTISITE_ADMIN => true ) ); ?></td>
5785	5001	</tr>
5786	5002	<tr>
5787		- <th scope="row"><?php esc_html_e( 'Approved users sort order', 'authorizer' ); ?></th>
5788		- <td><?php $this->print_select_auth_advanced_users_sort_order( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	5003	+ <th scope="row"><?php _e( 'Approved users sort order', 'authorizer' ); ?></th>
	5004	+ <td><?php $this->print_select_auth_advanced_users_sort_order( array( MULTISITE_ADMIN => true ) ); ?></td>
5789	5005	</tr>
5790	5006	<tr>
5791		- <th scope="row"><?php esc_html_e( 'Show Dashboard Widget', 'authorizer' ); ?></th>
5792		- <td><?php $this->print_checkbox_auth_advanced_widget_enabled( array( WP_Plugin_Authorizer::NETWORK_CONTEXT => true ) ); ?></td>
	5007	+ <th scope="row"><?php _e( 'Show Dashboard Widget', 'authorizer' ); ?></th>
	5008	+ <td><?php $this->print_checkbox_auth_advanced_widget_enabled( array( MULTISITE_ADMIN => true ) ); ?></td>
5793	5009	</tr>
5794	5010	</tbody></table>
5795	5011
5796	5012	<br class="clear" />
5797	5013	</div>
5798		- <input type="button" name="submit" id="submit" class="button button-primary" value="<?php esc_attr_e( 'Save Changes', 'authorizer' ); ?>" onclick="saveAuthMultisiteSettings(this);" />
	5014	+ <input type="button" name="submit" id="submit" class="button button-primary" value="<?php _e( 'Save Changes', 'authorizer' ); ?>" onclick="save_auth_multisite_settings(this);" />
5799	5015	</form>
5800	5016	</div>
5801	5017	<?php
5802	5018	}
		@@ -5803,12 +5019,10 @@
5803	5019
5804	5020
5805	5021	/**
5806	5022	* Save multisite settings (ajax call).
5807		- *
5808		- * Action: wp_ajax_save_auth_multisite_settings
5809	5023	*/
5810		- public function ajax_save_auth_multisite_settings() {
	5024	+ function ajax_save_auth_multisite_settings() {
5811	5025	// Fail silently if current user doesn't have permissions.
5812	5026	if ( ! current_user_can( 'manage_network_options' ) ) {
5813	5027	die( '' );
5814	5028	}
		@@ -5813,14 +5027,14 @@
5813	5027	die( '' );
5814	5028	}
5815	5029
5816	5030	// Make sure nonce exists.
5817		- if ( empty( $_POST['nonce'] ) ) {
	5031	+ if ( empty( $_POST['nonce_save_auth_settings'] ) ) {
5818	5032	die( '' );
5819	5033	}
5820	5034
5821	5035	// Nonce check.
5822		- if ( ! wp_verify_nonce( sanitize_key( $_POST['nonce'] ), 'save_auth_settings' ) ) {
	5036	+ if ( ! wp_verify_nonce( $_POST['nonce_save_auth_settings'], 'save_auth_settings' ) ) {
5823	5037	die( '' );
5824	5038	}
5825	5039
5826	5040	// Assert multisite.
		@@ -5830,13 +5044,13 @@
5830	5044
5831	5045	// Get multisite settings.
5832	5046	$auth_multisite_settings = get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings', array() );
5833	5047
5834		- // Sanitize settings.
	5048	+ // Sanitize settings
5835	5049	$auth_multisite_settings = $this->sanitize_options( $_POST );
5836	5050
5837		- // Filter options to only the allowed values (multisite options are a subset of all options).
5838		- $allowed = array(
	5051	+ // Filter options to only the allowed values (multisite options are a subset of all options)
	5052	+ $allowed = array(
5839	5053	'multisite_override',
5840	5054	'access_who_can_login',
5841	5055	'access_who_can_view',
5842	5056	'access_default_role',
		@@ -5893,46 +5107,36 @@
5893	5107	*/
5894	5108
5895	5109
5896	5110
5897		- /**
5898		- * Load Authorizer dashboard widget if it's enabled.
5899		- *
5900		- * Action: wp_dashboard_setup
5901		- */
5902		- public function add_dashboard_widgets() {
5903		- $widget_enabled = $this->get_plugin_option( 'advanced_widget_enabled', WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' ) === '1';
	5111	+ function add_dashboard_widgets() {
	5112	+ $widget_enabled = $this->get_plugin_option( 'advanced_widget_enabled', SINGLE_ADMIN, 'allow override' ) === '1';
5904	5113
5905	5114	// Load authorizer dashboard widget if it's enabled and user has permission.
5906	5115	if ( current_user_can( 'create_users' ) && $widget_enabled ) {
5907		- // Add dashboard widget for adding/editing users with access.
	5116	+ // Add dashboard widget for adding/editing users with access
5908	5117	wp_add_dashboard_widget( 'auth_dashboard_widget', __( 'Authorizer Settings', 'authorizer' ), array( $this, 'add_auth_dashboard_widget' ) );
5909	5118	}
5910	5119	}
5911	5120
5912	5121
5913		- /**
5914		- * Render Authorizer dashboard widget (callback).
5915		- */
5916		- public function add_auth_dashboard_widget() {
5917		- ?>
5918		- <form method="post" id="auth_settings_access_form" action="">
	5122	+ function add_auth_dashboard_widget() {
	5123	+ ?><form method="post" id="auth_settings_access_form" action="">
5919	5124	<?php $this->print_section_info_access_login(); ?>
5920	5125	<div>
5921		- <h2><?php esc_html_e( 'Pending Users', 'authorizer' ); ?></h2>
	5126	+ <h2><?php _e( 'Pending Users', 'authorizer' ); ?></h2>
5922	5127	<?php $this->print_combo_auth_access_users_pending(); ?>
5923	5128	</div>
5924	5129	<div>
5925		- <h2><?php esc_html_e( 'Approved Users', 'authorizer' ); ?></h2>
	5130	+ <h2><?php _e( 'Approved Users', 'authorizer' ); ?></h2>
5926	5131	<?php $this->print_combo_auth_access_users_approved(); ?>
5927	5132	</div>
5928	5133	<div>
5929		- <h2><?php esc_html_e( 'Blocked Users', 'authorizer' ); ?></h2>
	5134	+ <h2><?php _e( 'Blocked Users', 'authorizer' ); ?></h2>
5930	5135	<?php $this->print_combo_auth_access_users_blocked(); ?>
5931	5136	</div>
5932	5137	<br class="clear" />
5933		- </form>
5934		- <?php
	5138	+ </form><?php
5935	5139	}
5936	5140
5937	5141
5938	5142
		@@ -5943,17 +5147,11 @@
5943	5147	*/
5944	5148
5945	5149
5946	5150
5947		- /**
5948		- * Re-render the Approved User list (usually triggered if pager params have
5949		- * changed, e.g., current page, search term, sort order).
5950		- *
5951		- * Action: wp_ajax_refresh_approved_user_list
5952		- *
5953		- * @return void
5954		- */
5955		- public function ajax_refresh_approved_user_list() {
	5151	+ // Re-render the Approved User list (usually triggered if pager params have
	5152	+ // changed, e.g., current page, search term, sort order).
	5153	+ function ajax_refresh_approved_user_list() {
5956	5154	// Fail silently if current user doesn't have permissions.
5957	5155	if ( ! current_user_can( 'create_users' ) ) {
5958	5156	die( '' );
5959	5157	}
		@@ -5958,9 +5156,9 @@
5958	5156	die( '' );
5959	5157	}
5960	5158
5961	5159	// Nonce check.
5962		- if ( empty( $_POST['nonce'] ) || ! wp_verify_nonce( sanitize_key( $_POST['nonce'] ), 'save_auth_settings' ) ) {
	5160	+ if ( empty( $_POST['nonce_save_auth_settings'] ) || ! wp_verify_nonce( $_POST['nonce_save_auth_settings'], 'save_auth_settings' ) ) {
5963	5161	die( '' );
5964	5162	}
5965	5163
5966	5164	// Fail if required post data doesn't exist.
		@@ -5968,30 +5166,30 @@
5968	5166	die( '' );
5969	5167	}
5970	5168
5971	5169	// Get defaults.
5972		- $success = true;
5973		- $message = '';
5974		- $is_network_admin = isset( $_REQUEST['is_network_admin'] ) && '1' === $_REQUEST['is_network_admin'];
	5170	+ $success = true;
	5171	+ $message = '';
	5172	+ $is_network_admin = isset( $_REQUEST['is_network_admin'] ) && $_REQUEST['is_network_admin'];
5975	5173
5976	5174	// Get user list.
5977		- $option = 'access_users_approved';
5978		- $admin_mode = is_multisite() && $is_network_admin ? WP_Plugin_Authorizer::NETWORK_CONTEXT : WP_Plugin_Authorizer::SINGLE_CONTEXT;
	5175	+ $option = 'access_users_approved';
	5176	+ $admin_mode = SINGLE_ADMIN;
5979	5177	$auth_settings_option = $this->get_plugin_option( $option, $admin_mode, 'no override' );
5980	5178	$auth_settings_option = is_array( $auth_settings_option ) ? $auth_settings_option : array();
5981	5179
5982	5180	// Get multisite approved users (will be added to top of list, greyed out).
5983		- $auth_override_multisite = $this->get_plugin_option( 'advanced_override_multisite' );
5984		- $auth_multisite_settings = $this->get_plugin_options( WP_Plugin_Authorizer::NETWORK_CONTEXT );
	5181	+ $auth_override_multisite = $this->get_plugin_option( 'advanced_override_multisite' );
	5182	+ $auth_multisite_settings = $this->get_plugin_options( MULTISITE_ADMIN );
5985	5183	$auth_settings_option_multisite = array();
5986	5184	if (
5987	5185	is_multisite() &&
5988	5186	! $is_network_admin &&
5989		- 1 !== intval( $auth_override_multisite ) &&
	5187	+ $auth_override_multisite != '1' &&
5990	5188	array_key_exists( 'multisite_override', $auth_multisite_settings ) &&
5991		- '1' === $auth_multisite_settings['multisite_override']
	5189	+ $auth_multisite_settings['multisite_override'] === '1'
5992	5190	) {
5993		- $auth_settings_option_multisite = $this->get_plugin_option( $option, WP_Plugin_Authorizer::NETWORK_CONTEXT, 'allow override' );
	5191	+ $auth_settings_option_multisite = $this->get_plugin_option( $option, MULTISITE_ADMIN, 'allow override' );
5994	5192	$auth_settings_option_multisite = is_array( $auth_settings_option_multisite ) ? $auth_settings_option_multisite : array();
5995	5193	// Add multisite users to the beginning of the main user array.
5996	5194	foreach ( array_reverse( $auth_settings_option_multisite ) as $approved_user ) {
5997	5195	$approved_user['multisite_user'] = true;
		@@ -6002,36 +5200,31 @@
6002	5200	// Get custom usermeta field to show.
6003	5201	$advanced_usermeta = $this->get_plugin_option( 'advanced_usermeta' );
6004	5202
6005	5203	// Filter user list to search terms.
6006		- if ( ! empty( $_REQUEST['search'] ) ) {
6007		- $search_term = sanitize_text_field( wp_unslash( $_REQUEST['search'] ) );
6008		- $auth_settings_option = array_filter(
6009		- $auth_settings_option, function ( $user ) use ( $search_term ) {
6010		- return stripos( $user['email'], $search_term ) !== false ||
6011		- stripos( $user['role'], $search_term ) !== false ||
6012		- stripos( $user['date_added'], $search_term ) !== false;
6013		- }
6014		- );
	5204	+ if ( isset( $_REQUEST['search'] ) && strlen( $_REQUEST['search'] ) > 0 ) {
	5205	+ $search_term = $_REQUEST['search'];
	5206	+ $auth_settings_option = array_filter( $auth_settings_option, function ( $user ) use ( $search_term ) {
	5207	+ return stripos( $user['email'], $search_term ) !== FALSE ||
	5208	+ stripos( $user['role'], $search_term ) !== FALSE ||
	5209	+ stripos( $user['date_added'], $search_term ) !== FALSE;
	5210	+ } );
6015	5211	}
6016	5212
6017	5213	// Sort user list.
6018		- $sort_by = $this->get_plugin_option( 'advanced_users_sort_by', WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' ); // email, role, date_added (registered), created (date approved).
6019		- $sort_order = $this->get_plugin_option( 'advanced_users_sort_order', WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' ); // asc or desc.
	5214	+ $sort_by = $this->get_plugin_option( 'advanced_users_sort_by', SINGLE_ADMIN, 'allow override' ); // email, role, date_added (registered), created (date approved)
	5215	+ $sort_order = $this->get_plugin_option( 'advanced_users_sort_order', SINGLE_ADMIN, 'allow override' ); // asc or desc
6020	5216	$sort_dimension = array();
6021		- if ( in_array( $sort_by, array( 'email', 'role', 'date_added' ), true ) ) {
	5217	+ if ( in_array( $sort_by, array( 'email', 'role', 'date_added' ) ) ) {
6022	5218	foreach ( $auth_settings_option as $key => $user ) {
6023		- if ( 'date_added' === $sort_by ) {
6024		- $sort_dimension[ $key ] = date( 'Ymd', strtotime( $user[ $sort_by ] ) );
	5219	+ if ( $sort_by === 'date_added' ) {
	5220	+ $sort_dimension[$key] = date( 'Ymd', strtotime( $user[$sort_by] ) );
6025	5221	} else {
6026		- $sort_dimension[ $key ] = strtolower( $user[ $sort_by ] );
	5222	+ $sort_dimension[$key] = strtolower( $user[$sort_by] );
6027	5223	}
6028	5224	}
6029		- $sort_order = 'asc' === $sort_order ? SORT_ASC : SORT_DESC;
	5225	+ $sort_order = $sort_order == 'asc' ? SORT_ASC : SORT_DESC;
6030	5226	array_multisort( $sort_dimension, $sort_order, $auth_settings_option );
6031		- } elseif ( 'created' === $sort_by && 'asc' !== $sort_order ) {
6032		- // If default sort method and reverse order, just reverse the array.
6033		- $auth_settings_option = array_reverse( $auth_settings_option );
6034	5227	}
6035	5228
6036	5229	// Ensure array keys run from 0..max (keys in database will be the original,
6037	5230	// index, and removing users will not reorder the array keys of other users).
		@@ -6037,12 +5230,12 @@
6037	5230	// index, and removing users will not reorder the array keys of other users).
6038	5231	$auth_settings_option = array_values( $auth_settings_option );
6039	5232
6040	5233	// Get pager params.
6041		- $total_users = count( $auth_settings_option );
6042		- $users_per_page = intval( $this->get_plugin_option( 'advanced_users_per_page', WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' ) );
6043		- $current_page = isset( $_REQUEST['paged'] ) ? intval( $_REQUEST['paged'] ) : 1;
6044		- $total_pages = ceil( $total_users / $users_per_page );
	5234	+ $total_users = count( $auth_settings_option );
	5235	+ $users_per_page = intval( $this->get_plugin_option( 'advanced_users_per_page', SINGLE_ADMIN, 'allow override' ) );
	5236	+ $current_page = isset( $_REQUEST['paged'] ) ? intval( $_REQUEST['paged'] ) : 1;
	5237	+ $total_pages = ceil( $total_users / $users_per_page );
6045	5238	if ( $total_pages < 1 ) {
6046	5239	$total_pages = 1;
6047	5240	}
6048	5241
		@@ -6048,9 +5241,9 @@
6048	5241
6049	5242	// Make sure current_page is between 1 and max pages.
6050	5243	if ( $current_page < 1 ) {
6051	5244	$current_page = 1;
6052		- } elseif ( $current_page > $total_pages ) {
	5245	+ } else if ( $current_page > $total_pages ) {
6053	5246	$current_page = $total_pages;
6054	5247	}
6055	5248
6056	5249	// Render user list.
		@@ -6055,11 +5248,11 @@
6055	5248
6056	5249	// Render user list.
6057	5250	ob_start();
6058	5251	$offset = ( $current_page - 1 ) * $users_per_page;
6059		- $max = min( $offset + $users_per_page, count( $auth_settings_option ) );
	5252	+ $max = min( $offset + $users_per_page, count( $auth_settings_option ) );
6060	5253	for ( $key = $offset; $key < $max; $key++ ) :
6061		- $approved_user = $auth_settings_option[ $key ];
	5254	+ $approved_user = $auth_settings_option[$key];
6062	5255	if ( empty( $approved_user ) || count( $approved_user ) < 1 ) :
6063	5256	continue;
6064	5257	endif;
6065	5258	$this->render_user_element( $approved_user, $key, $option, $admin_mode, $advanced_usermeta );
		@@ -6066,33 +5259,26 @@
6066	5259	endfor;
6067	5260
6068	5261	// Send response to client.
6069	5262	$response = array(
6070		- 'success' => $success,
6071		- 'message' => $message,
6072		- 'html' => ob_get_clean(),
6073		- /* TRANSLATORS: %s: number of users */
	5263	+ 'success' => $success,
	5264	+ 'message' => $message,
	5265	+ 'html' => ob_get_clean(),
6074	5266	'total_users_html' => sprintf( _n( '%s user', '%s users', $total_users, 'authorizer' ), number_format_i18n( $total_users ) ),
6075	5267	'total_pages_html' => number_format_i18n( $total_pages ),
6076		- 'total_pages' => $total_pages,
	5268	+ 'total_pages' => $total_pages,
6077	5269	);
6078	5270	header( 'content-type: application/json' );
6079		- echo wp_json_encode( $response );
	5271	+ echo json_encode( $response );
6080	5272	exit;
6081	5273	}
6082	5274
6083	5275
6084		- /**
6085		- * Fired on a change event from the optional usermeta field in the approved
6086		- * user list. Updates the selected usermeta value, or saves it in the user's
6087		- * approved list entry if the user hasn't logged in yet and created a
6088		- * WordPress account.
6089		- *
6090		- * Action: wp_ajax_update_auth_usermeta
6091		- *
6092		- * @return void
6093		- */
6094		- public function ajax_update_auth_usermeta() {
	5276	+ // Fired on a change event from the optional usermeta field in the
	5277	+ // approved user list. Updates the selected usermeta value, or saves it
	5278	+ // in the user's approved list entry if the user hasn't logged in yet
	5279	+ // and created a WordPress account.
	5280	+ function ajax_update_auth_usermeta() {
6095	5281	// Fail silently if current user doesn't have permissions.
6096	5282	if ( ! current_user_can( 'create_users' ) ) {
6097	5283	die( '' );
6098	5284	}
		@@ -6097,36 +5283,35 @@
6097	5283	die( '' );
6098	5284	}
6099	5285
6100	5286	// Nonce check.
6101		- if ( empty( $_POST['nonce'] ) || ! wp_verify_nonce( sanitize_key( $_POST['nonce'] ), 'save_auth_settings' ) ) {
	5287	+ if ( empty( $_POST['nonce_save_auth_settings'] ) || ! wp_verify_nonce( $_POST['nonce_save_auth_settings'], 'save_auth_settings' ) ) {
6102	5288	die( '' );
6103	5289	}
6104	5290
6105	5291	// Fail if required post data doesn't exist.
6106		- if ( ! isset( $_REQUEST['email'], $_REQUEST['usermeta'] ) ) {
	5292	+ if ( ! array_key_exists( 'email', $_REQUEST ) || ! array_key_exists( 'usermeta', $_REQUEST ) ) {
6107	5293	die( '' );
6108	5294	}
6109	5295
6110	5296	// Get values to update from post data.
6111		- $email = sanitize_email( wp_unslash( $_REQUEST['email'] ) );
6112		- $meta_value = sanitize_meta( 'authorizer-usermeta', wp_unslash( $_REQUEST['usermeta'] ), 'user' );
6113		- $meta_key = $this->get_plugin_option( 'advanced_usermeta' );
	5297	+ $email = $_REQUEST['email'];
	5298	+ $meta_value = $_REQUEST['usermeta'];
	5299	+ $meta_key = $this->get_plugin_option( 'advanced_usermeta' );
6114	5300
6115	5301	// If user doesn't exist, save usermeta selection to authorizer
6116	5302	// list. This value will get saved to usermeta when the user first
6117	5303	// logs in (i.e., when their WordPress account is created).
6118		- $wp_user = get_user_by( 'email', $email );
6119		- if ( ! $wp_user ) {
	5304	+ if ( ! ( $wp_user = get_user_by( 'email', $email ) ) ) {
6120	5305	// Look through multisite approved users and add a usermeta
6121	5306	// reference for the current blog if the user is found.
6122		- $auth_multisite_settings_access_users_approved = is_multisite() ? get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', array() ) : array();
	5307	+ $auth_multisite_settings_access_users_approved = is_multisite() ? get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', array() ) : array();
6123	5308	$should_update_auth_multisite_settings_access_users_approved = false;
6124	5309	foreach ( $auth_multisite_settings_access_users_approved as $index => $approved_user ) {
6125	5310	if ( 0 === strcasecmp( $email, $approved_user['email'] ) ) {
6126		- if ( ! is_array( $auth_multisite_settings_access_users_approved[ $index ]['usermeta'] ) ) {
	5311	+ if ( ! is_array( $auth_multisite_settings_access_users_approved[$index]['usermeta'] ) ) {
6127	5312	// Initialize the array of usermeta for each blog this user belongs to.
6128		- $auth_multisite_settings_access_users_approved[ $index ]['usermeta'] = array();
	5313	+ $auth_multisite_settings_access_users_approved[$index]['usermeta'] = array();
6129	5314	} else {
6130	5315	// There is already usermeta associated with this
6131	5316	// preapproved user; iterate through it and make
6132	5317	// sure it's not for old meta_keys (delete it if
		@@ -6132,21 +5317,21 @@
6132	5317	// sure it's not for old meta_keys (delete it if
6133	5318	// so). This can happen if someone changes the
6134	5319	// usermeta key in authorizer options, and we don't
6135	5320	// want to hang on to old data.
6136		- foreach ( $auth_multisite_settings_access_users_approved[ $index ]['usermeta'] as $blog_id => $usermeta ) {
	5321	+ foreach ( $auth_multisite_settings_access_users_approved[$index]['usermeta'] as $blog_id => $usermeta ) {
6137	5322	if ( array_key_exists( 'meta_key', $usermeta ) && $usermeta['meta_key'] === $meta_key ) {
6138	5323	continue;
6139	5324	} else {
6140		- unset( $auth_multisite_settings_access_users_approved[ $index ]['usermeta'][ $blog_id ] );
	5325	+ unset( $auth_multisite_settings_access_users_approved[$index]['usermeta'][$blog_id] );
6141	5326	}
6142	5327	}
6143	5328	}
6144		- $auth_multisite_settings_access_users_approved[ $index ]['usermeta'][ get_current_blog_id() ] = array(
6145		- 'meta_key' => $meta_key,
	5329	+ $auth_multisite_settings_access_users_approved[$index]['usermeta'][get_current_blog_id()] = array(
	5330	+ 'meta_key' => $meta_key,
6146	5331	'meta_value' => $meta_value,
6147	5332	);
6148		- $should_update_auth_multisite_settings_access_users_approved = true;
	5333	+ $should_update_auth_multisite_settings_access_users_approved = true;
6149	5334	}
6150	5335	}
6151	5336	if ( $should_update_auth_multisite_settings_access_users_approved ) {
6152	5337	update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
		@@ -6154,31 +5339,33 @@
6154	5339
6155	5340	// Look through the approved users (of the current blog in a
6156	5341	// multisite install, or just of the single site) and add a
6157	5342	// usermeta reference if the user is found.
6158		- $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT );
	5343	+ $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN );
6159	5344	$should_update_auth_settings_access_users_approved = false;
6160	5345	foreach ( $auth_settings_access_users_approved as $index => $approved_user ) {
6161	5346	if ( 0 === strcasecmp( $email, $approved_user['email'] ) ) {
6162		- $auth_settings_access_users_approved[ $index ]['usermeta'] = array(
6163		- 'meta_key' => $meta_key,
	5347	+ $auth_settings_access_users_approved[$index]['usermeta'] = array(
	5348	+ 'meta_key' => $meta_key,
6164	5349	'meta_value' => $meta_value,
6165	5350	);
6166		- $should_update_auth_settings_access_users_approved = true;
	5351	+ $should_update_auth_settings_access_users_approved = true;
6167	5352	}
6168	5353	}
6169	5354	if ( $should_update_auth_settings_access_users_approved ) {
6170	5355	update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved );
6171	5356	}
	5357	+
6172	5358	} else {
6173	5359	// Update user's usermeta value for usermeta key stored in authorizer options.
6174	5360	if ( strpos( $meta_key, 'acf___' ) === 0 && class_exists( 'acf' ) ) {
6175	5361	// We have an ACF field value, so use the ACF function to update it.
6176		- update_field( str_replace( 'acf___', '', $meta_key ), $meta_value, 'user_' . $wp_user->ID );
	5362	+ update_field( str_replace('acf___', '', $meta_key ), $meta_value, 'user_' . $wp_user->ID );
6177	5363	} else {
6178	5364	// We have a normal usermeta value, so just update it via the WordPress function.
6179	5365	update_user_meta( $wp_user->ID, $meta_key, $meta_value );
6180	5366	}
	5367	+
6181	5368	}
6182	5369
6183	5370	// Return 'success' value to AJAX call.
6184	5371	die( 'success' );
		@@ -6184,17 +5371,9 @@
6184	5371	die( 'success' );
6185	5372	}
6186	5373
6187	5374
6188		- /**
6189		- * Fired on a change event from the user fields in the user lists. Updates
6190		- * the selected user value.
6191		- *
6192		- * Action: wp_ajax_update_auth_user
6193		- *
6194		- * @return void
6195		- */
6196		- public function ajax_update_auth_user() {
	5375	+ function ajax_update_auth_user() {
6197	5376	// Fail silently if current user doesn't have permissions.
6198	5377	if ( ! current_user_can( 'create_users' ) ) {
6199	5378	die( '' );
6200	5379	}
		@@ -6199,14 +5378,14 @@
6199	5378	die( '' );
6200	5379	}
6201	5380
6202	5381	// Nonce check.
6203		- if ( empty( $_POST['nonce'] ) || ! wp_verify_nonce( sanitize_key( $_POST['nonce'] ), 'save_auth_settings' ) ) {
	5382	+ if ( empty( $_POST['nonce_save_auth_settings'] ) || ! wp_verify_nonce( $_POST['nonce_save_auth_settings'], 'save_auth_settings' ) ) {
6204	5383	die( '' );
6205	5384	}
6206	5385
6207	5386	// Fail if requesting a change to an invalid setting.
6208		- if ( ! isset( $_POST['setting'] ) || ! in_array( wp_unslash( $_POST['setting'] ), array( 'access_users_pending', 'access_users_approved', 'access_users_blocked' ), true ) ) {
	5387	+ if ( ! in_array( $_POST['setting'], array( 'access_users_pending', 'access_users_approved', 'access_users_blocked' ) ) ) {
6209	5388	die( '' );
6210	5389	}
6211	5390
6212	5391	// Track any emails that couldn't be added (used when adding users).
		@@ -6212,54 +5391,58 @@
6212	5391	// Track any emails that couldn't be added (used when adding users).
6213	5392	$invalid_emails = array();
6214	5393
6215	5394	// Editing a pending list entry.
6216		- if ( 'access_users_pending' === $_POST['setting'] ) {
6217		- // Sanitize posted data.
6218		- $access_users_pending = array();
6219		- if ( isset( $_POST['access_users_pending'] ) && is_array( $_POST['access_users_pending'] ) ) {
6220		- $access_users_pending = $this->sanitize_update_auth_users( wp_unslash( $_POST['access_users_pending'] ) );
	5395	+ if ( $_POST['setting'] === 'access_users_pending' ) {
	5396	+ // Initialize posted data if empty.
	5397	+ if ( ! ( array_key_exists( 'access_users_pending', $_POST ) && is_array( $_POST['access_users_pending'] ) ) ) {
	5398	+ $_POST['access_users_pending'] = array();
6221	5399	}
6222	5400
6223	5401	// Deal with each modified user (add or remove).
6224		- foreach ( $access_users_pending as $pending_user ) {
	5402	+ foreach ( $_POST['access_users_pending'] as $pending_user ) {
6225	5403
6226		- if ( 'add' === $pending_user['edit_action'] ) {
	5404	+ if ( $pending_user['edit_action'] === 'add' ) {
6227	5405
6228	5406	// Add new user to pending list and save (skip if it's
6229	5407	// already there--someone else might have just done it).
6230	5408	if ( ! $this->is_email_in_list( $pending_user['email'], 'pending' ) ) {
6231	5409	$auth_settings_access_users_pending = $this->sanitize_user_list(
6232		- $this->get_plugin_option( 'access_users_pending', WP_Plugin_Authorizer::SINGLE_CONTEXT )
	5410	+ $this->get_plugin_option( 'access_users_pending', SINGLE_ADMIN )
6233	5411	);
6234	5412	array_push( $auth_settings_access_users_pending, $pending_user );
6235	5413	update_option( 'auth_settings_access_users_pending', $auth_settings_access_users_pending );
6236	5414	}
6237		- } elseif ( 'remove' === $pending_user['edit_action'] ) {
6238	5415
6239		- // Remove user from pending list and save.
6240		- $auth_settings_access_users_pending = $this->get_plugin_option( 'access_users_pending', WP_Plugin_Authorizer::SINGLE_CONTEXT );
6241		- foreach ( $auth_settings_access_users_pending as $key => $existing_user ) {
6242		- if ( 0 === strcasecmp( $pending_user['email'], $existing_user['email'] ) ) {
6243		- unset( $auth_settings_access_users_pending[ $key ] );
6244		- update_option( 'auth_settings_access_users_pending', $auth_settings_access_users_pending );
6245		- break;
	5416	+ } elseif ( $pending_user['edit_action'] === 'remove' ) {
	5417	+
	5418	+ // Remove user from pending list and save
	5419	+ if ( $this->is_email_in_list( $pending_user['email'], 'pending' ) ) {
	5420	+ $auth_settings_access_users_pending = $this->sanitize_user_list(
	5421	+ $this->get_plugin_option( 'access_users_pending', SINGLE_ADMIN )
	5422	+ );
	5423	+ foreach ( $auth_settings_access_users_pending as $key => $existing_user ) {
	5424	+ if ( 0 === strcasecmp( $pending_user['email'], $existing_user['email'] ) ) {
	5425	+ unset( $auth_settings_access_users_pending[$key] );
	5426	+ break;
	5427	+ }
6246	5428	}
	5429	+ update_option( 'auth_settings_access_users_pending', $auth_settings_access_users_pending );
6247	5430	}
	5431	+
6248	5432	}
6249	5433	}
6250	5434	}
6251	5435
6252	5436	// Editing an approved list entry.
6253		- if ( 'access_users_approved' === $_POST['setting'] ) {
6254		- // Sanitize posted data.
6255		- $access_users_approved = array();
6256		- if ( isset( $_POST['access_users_approved'] ) && is_array( $_POST['access_users_approved'] ) ) {
6257		- $access_users_approved = $this->sanitize_update_auth_users( wp_unslash( $_POST['access_users_approved'] ) );
	5437	+ if ( $_POST['setting'] === 'access_users_approved' ) {
	5438	+ // Initialize posted data if empty.
	5439	+ if ( ! ( array_key_exists( 'access_users_approved', $_POST ) && is_array( $_POST['access_users_approved'] ) ) ) {
	5440	+ $_POST['access_users_approved'] = array();
6258	5441	}
6259	5442
6260	5443	// Deal with each modified user (add, remove, or change_role).
6261		- foreach ( $access_users_approved as $approved_user ) {
	5444	+ foreach ( $_POST['access_users_approved'] as $approved_user ) {
6262	5445	// Skip blank entries.
6263	5446	if ( strlen( $approved_user['email'] ) < 1 ) {
6264	5447	continue;
6265	5448	}
		@@ -6264,14 +5447,14 @@
6264	5447	continue;
6265	5448	}
6266	5449
6267	5450	// New user (create user, or add existing user to current site in multisite).
6268		- if ( 'add' === $approved_user['edit_action'] ) {
	5451	+ if ( $approved_user['edit_action'] === 'add' ) {
6269	5452	$new_user = get_user_by( 'email', $approved_user['email'] );
6270		- if ( false !== $new_user ) {
	5453	+ if ( $new_user !== false ) {
6271	5454	// If we're adding an existing multisite user, make sure their
6272	5455	// newly-assigned role is updated on all sites they are already in.
6273		- if ( is_multisite() && 'false' !== $approved_user['multisite_user'] ) {
	5456	+ if ( is_multisite() && $approved_user['multisite_user'] !== 'false' ) {
6274	5457	foreach ( get_blogs_of_user( $new_user->ID ) as $blog ) {
6275	5458	add_user_to_blog( $blog->userblog_id, $new_user->ID, $approved_user['role'] );
6276	5459	}
6277	5460	}
		@@ -6278,9 +5461,9 @@
6278	5461	// If this user already has an account on another site in the network, add them to this site.
6279	5462	if ( is_multisite() ) {
6280	5463	add_user_to_blog( get_current_blog_id(), $new_user->ID, $approved_user['role'] );
6281	5464	}
6282		- } elseif ( $approved_user['local_user'] && 'false' !== $approved_user['local_user'] ) {
	5465	+ } elseif ( $approved_user['local_user'] && $approved_user['local_user'] !== 'false' ) {
6283	5466	// Create a WP account for this new *local* user and email the password.
6284	5467	$plaintext_password = wp_generate_password(); // random password
6285	5468	// If there's already a user with this username (e.g.,
6286	5469	// johndoe/johndoe@gmail.com exists, and we're trying to add
		@@ -6290,9 +5473,9 @@
6290	5473	$username = $username[0];
6291	5474	if ( get_user_by( 'login', $username ) !== false ) {
6292	5475	$username = $this->lowercase( $approved_user['email'] );
6293	5476	}
6294		- if ( 'false' !== $approved_user['multisite_user'] ) {
	5477	+ if ( $approved_user['multisite_user'] !== 'false' ) {
6295	5478	$result = wpmu_create_user(
6296	5479	strtolower( $username ),
6297	5480	$plaintext_password,
6298	5481	$this->lowercase( $approved_user['email'] )
		@@ -6299,15 +5482,15 @@
6299	5482	);
6300	5483	} else {
6301	5484	$result = wp_insert_user(
6302	5485	array(
6303		- 'user_login' => strtolower( $username ),
6304		- 'user_pass' => $plaintext_password,
6305		- 'first_name' => '',
6306		- 'last_name' => '',
6307		- 'user_email' => $this->lowercase( $approved_user['email'] ),
	5486	+ 'user_login' => strtolower( $username ),
	5487	+ 'user_pass' => $plaintext_password,
	5488	+ 'first_name' => '',
	5489	+ 'last_name' => '',
	5490	+ 'user_email' => $this->lowercase( $approved_user['email'] ),
6308	5491	'user_registered' => date( 'Y-m-d H:i:s' ),
6309		- 'role' => $approved_user['role'],
	5492	+ 'role' => $approved_user['role'],
6310	5493	)
6311	5494	);
6312	5495	}
6313	5496	if ( ! is_wp_error( $result ) ) {
		@@ -6313,8 +5496,9 @@
6313	5496	if ( ! is_wp_error( $result ) ) {
6314	5497	// Email login credentials to new user.
6315	5498	wp_new_user_notification( $result, null, 'both' );
6316	5499	}
	5500	+
6317	5501	}
6318	5502
6319	5503	// Email new user welcome message if plugin option is set.
6320	5504	$this->maybe_email_welcome_message( $approved_user['email'] );
		@@ -6320,14 +5504,14 @@
6320	5504	$this->maybe_email_welcome_message( $approved_user['email'] );
6321	5505
6322	5506	// Add new user to approved list and save (skip if it's
6323	5507	// already there--someone else might have just done it).
6324		- if ( 'false' !== $approved_user['multisite_user'] ) {
	5508	+ if ( $approved_user['multisite_user'] !== 'false' ) {
6325	5509	if ( ! $this->is_email_in_list( $approved_user['email'], 'approved', 'multisite' ) ) {
6326	5510	$auth_multisite_settings_access_users_approved = $this->sanitize_user_list(
6327		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT )
	5511	+ $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN )
6328	5512	);
6329		- $approved_user['date_added'] = date( 'M Y' );
	5513	+ $approved_user['date_added'] = date( 'M Y' );
6330	5514	array_push( $auth_multisite_settings_access_users_approved, $approved_user );
6331	5515	update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
6332	5516	} else {
6333	5517	$invalid_emails[] = $approved_user['email'];
		@@ -6334,11 +5518,11 @@
6334	5518	}
6335	5519	} else {
6336	5520	if ( ! $this->is_email_in_list( $approved_user['email'], 'approved' ) ) {
6337	5521	$auth_settings_access_users_approved = $this->sanitize_user_list(
6338		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT )
	5522	+ $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN )
6339	5523	);
6340		- $approved_user['date_added'] = date( 'M Y' );
	5524	+ $approved_user['date_added'] = date( 'M Y' );
6341	5525	array_push( $auth_settings_access_users_approved, $approved_user );
6342	5526	update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved );
6343	5527	} else {
6344	5528	$invalid_emails[] = $approved_user['email'];
		@@ -6346,20 +5530,19 @@
6346	5530	}
6347	5531
6348	5532	// If we've added a new multisite user, go through all pending/approved/blocked lists
6349	5533	// on individual sites and remove this user from them (to prevent duplicate entries).
6350		- if ( 'false' !== $approved_user['multisite_user'] && is_multisite() ) {
	5534	+ if ( $approved_user['multisite_user'] !== 'false' && is_multisite() ) {
6351	5535	$list_names = array( 'access_users_pending', 'access_users_approved', 'access_users_blocked' );
6352		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
6353	5536	$sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
6354	5537	foreach ( $sites as $site ) {
6355	5538	$blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
6356	5539	foreach ( $list_names as $list_name ) {
6357		- $user_list = get_blog_option( $blog_id, 'auth_settings_' . $list_name, array() );
	5540	+ $user_list = get_blog_option( $blog_id, 'auth_settings_' . $list_name, array() );
6358	5541	$list_changed = false;
6359	5542	foreach ( $user_list as $key => $user ) {
6360	5543	if ( 0 === strcasecmp( $user['email'], $approved_user['email'] ) ) {
6361		- unset( $user_list[ $key ] );
	5544	+ unset( $user_list[$key] );
6362	5545	$list_changed = true;
6363	5546	}
6364	5547	}
6365	5548	if ( $list_changed ) {
		@@ -6367,47 +5550,59 @@
6367	5550	}
6368	5551	}
6369	5552	}
6370	5553	}
6371		- } elseif ( 'remove' === $approved_user['edit_action'] ) { // Remove user from approved list and save (also remove their role if they have a WordPress account).
6372		- if ( 'false' !== $approved_user['multisite_user'] ) {
6373		- $auth_multisite_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT );
6374		- foreach ( $auth_multisite_settings_access_users_approved as $key => $existing_user ) {
6375		- if ( 0 === strcasecmp( $approved_user['email'], $existing_user['email'] ) ) {
6376		- // Remove role of the associated WordPress user from all blogs (but don't delete the user).
6377		- $user = get_user_by( 'email', $approved_user['email'] );
6378		- if ( false !== $user ) {
6379		- // Loop through all of the blogs this user is a member of and remove their capabilities.
6380		- foreach ( get_blogs_of_user( $user->ID ) as $blog ) {
6381		- remove_user_from_blog( $user->ID, $blog->userblog_id, '' );
	5554	+
	5555	+ // Remove user from approved list and save (also remove their role if they have a WordPress account)
	5556	+ } elseif ( $approved_user['edit_action'] === 'remove' ) {
	5557	+ if ( $approved_user['multisite_user'] !== 'false' ) {
	5558	+ if ( $this->is_email_in_list( $approved_user['email'], 'approved', 'multisite' ) ) {
	5559	+ $auth_multisite_settings_access_users_approved = $this->sanitize_user_list(
	5560	+ $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN )
	5561	+ );
	5562	+ foreach ( $auth_multisite_settings_access_users_approved as $key => $existing_user ) {
	5563	+ if ( 0 === strcasecmp( $approved_user['email'], $existing_user['email'] ) ) {
	5564	+ // Remove role of the associated WordPress user from all blogs (but don't delete the user).
	5565	+ $user = get_user_by( 'email', $approved_user['email'] );
	5566	+ if ( $user !== false ) {
	5567	+ // Loop through all of the blogs this user is a member of and remove their capabilities.
	5568	+ foreach ( get_blogs_of_user( $user->ID ) as $blog ) {
	5569	+ remove_user_from_blog( $user->ID, $blog->userblog_id, '' );
	5570	+ }
6382	5571	}
	5572	+ // Remove entry from Approved Users list.
	5573	+ unset( $auth_multisite_settings_access_users_approved[$key] );
	5574	+ break;
6383	5575	}
6384		- // Remove entry from Approved Users list.
6385		- unset( $auth_multisite_settings_access_users_approved[ $key ] );
6386		- update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
6387		- break;
6388	5576	}
	5577	+ update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
6389	5578	}
6390	5579	} else {
6391		- $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT );
6392		- foreach ( $auth_settings_access_users_approved as $key => $existing_user ) {
6393		- if ( 0 === strcasecmp( $approved_user['email'], $existing_user['email'] ) ) {
6394		- // Remove role of the associated WordPress user (but don't delete the user).
6395		- $user = get_user_by( 'email', $approved_user['email'] );
6396		- if ( false !== $user ) {
6397		- $user->set_role( '' );
	5580	+ if ( $this->is_email_in_list( $approved_user['email'], 'approved' ) ) {
	5581	+ $auth_settings_access_users_approved = $this->sanitize_user_list(
	5582	+ $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN )
	5583	+ );
	5584	+ foreach ( $auth_settings_access_users_approved as $key => $existing_user ) {
	5585	+ if ( 0 === strcasecmp( $approved_user['email'], $existing_user['email'] ) ) {
	5586	+ // Remove role of the associated WordPress user (but don't delete the user).
	5587	+ $user = get_user_by( 'email', $approved_user['email'] );
	5588	+ if ( $user !== false ) {
	5589	+ $user->set_role( '' );
	5590	+ }
	5591	+ // Remove entry from Approved Users list.
	5592	+ unset( $auth_settings_access_users_approved[$key] );
	5593	+ break;
6398	5594	}
6399		- // Remove entry from Approved Users list.
6400		- unset( $auth_settings_access_users_approved[ $key ] );
6401		- update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved );
6402		- break;
6403	5595	}
	5596	+ update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved );
6404	5597	}
6405	5598	}
6406		- } elseif ( 'change_role' === $approved_user['edit_action'] ) { // Update user's role in WordPress.
	5599	+
	5600	+ // Update user's role in WordPress
	5601	+ } elseif ( $approved_user['edit_action'] === 'change_role' ) {
6407	5602	$changed_user = get_user_by( 'email', $approved_user['email'] );
6408	5603	if ( $changed_user ) {
6409		- if ( is_multisite() && 'false' !== $approved_user['multisite_user'] ) {
	5604	+ if ( is_multisite() && $approved_user['multisite_user'] !== 'false' ) {
6410	5605	foreach ( get_blogs_of_user( $changed_user->ID ) as $blog ) {
6411	5606	add_user_to_blog( $blog->userblog_id, $changed_user->ID, $approved_user['role'] );
6412	5607	}
6413	5608	} else {
		@@ -6414,16 +5609,16 @@
6414	5609	$changed_user->set_role( $approved_user['role'] );
6415	5610	}
6416	5611	}
6417	5612
6418		- if ( 'false' !== $approved_user['multisite_user'] ) {
	5613	+ if ( $approved_user['multisite_user'] !== 'false' ) {
6419	5614	if ( $this->is_email_in_list( $approved_user['email'], 'approved', 'multisite' ) ) {
6420	5615	$auth_multisite_settings_access_users_approved = $this->sanitize_user_list(
6421		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT )
	5616	+ $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN )
6422	5617	);
6423	5618	foreach ( $auth_multisite_settings_access_users_approved as $key => $existing_user ) {
6424	5619	if ( 0 === strcasecmp( $approved_user['email'], $existing_user['email'] ) ) {
6425		- $auth_multisite_settings_access_users_approved[ $key ]['role'] = $approved_user['role'];
	5620	+ $auth_multisite_settings_access_users_approved[$key]['role'] = $approved_user['role'];
6426	5621	break;
6427	5622	}
6428	5623	}
6429	5624	update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
		@@ -6431,13 +5626,13 @@
6431	5626	} else {
6432	5627	// Update user's role in approved list and save.
6433	5628	if ( $this->is_email_in_list( $approved_user['email'], 'approved' ) ) {
6434	5629	$auth_settings_access_users_approved = $this->sanitize_user_list(
6435		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT )
	5630	+ $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN )
6436	5631	);
6437	5632	foreach ( $auth_settings_access_users_approved as $key => $existing_user ) {
6438		- if ( 0 === strcasecmp( $approved_user['email'], $existing_user['email'] ) ) {
6439		- $auth_settings_access_users_approved[ $key ]['role'] = $approved_user['role'];
	5633	+ if ( 0 === strcasecmp( $approved_user['email'], $existing_user['email'] ) ) {
	5634	+ $auth_settings_access_users_approved[$key]['role'] = $approved_user['role'];
6440	5635	break;
6441	5636	}
6442	5637	}
6443	5638	update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved );
		@@ -6442,33 +5637,28 @@
6442	5637	}
6443	5638	update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved );
6444	5639	}
6445	5640	}
	5641	+
6446	5642	}
6447	5643	}
6448	5644	}
6449	5645
6450	5646	// Editing a blocked list entry.
6451		- if ( 'access_users_blocked' === $_POST['setting'] ) {
6452		- // Sanitize post data.
6453		- $access_users_blocked = array();
6454		- if ( isset( $_POST['access_users_blocked'] ) && is_array( $_POST['access_users_blocked'] ) ) {
6455		- $access_users_blocked = $this->sanitize_update_auth_users(
6456		- wp_unslash( $_POST['access_users_blocked'] ),
6457		- array(
6458		- 'allow_wildcard_email' => true,
6459		- )
6460		- );
	5647	+ if ( $_POST['setting'] === 'access_users_blocked' ) {
	5648	+ // Initialize posted data if empty.
	5649	+ if ( ! ( array_key_exists( 'access_users_blocked', $_POST ) && is_array( $_POST['access_users_blocked'] ) ) ) {
	5650	+ $_POST['access_users_blocked'] = array();
6461	5651	}
6462	5652
6463	5653	// Deal with each modified user (add or remove).
6464		- foreach ( $access_users_blocked as $blocked_user ) {
	5654	+ foreach ( $_POST['access_users_blocked'] as $blocked_user ) {
6465	5655
6466		- if ( 'add' === $blocked_user['edit_action'] ) {
	5656	+ if ( $blocked_user['edit_action'] === 'add' ) {
6467	5657
6468	5658	// Add auth_blocked usermeta for the user.
6469	5659	$blocked_wp_user = get_user_by( 'email', $blocked_user['email'] );
6470		- if ( false !== $blocked_wp_user ) {
	5660	+ if ( $blocked_wp_user !== false ) {
6471	5661	update_user_meta( $blocked_wp_user->ID, 'auth_blocked', 'yes' );
6472	5662	}
6473	5663
6474	5664	// Add new user to blocked list and save (skip if it's
		@@ -6474,33 +5664,39 @@
6474	5664	// Add new user to blocked list and save (skip if it's
6475	5665	// already there--someone else might have just done it).
6476	5666	if ( ! $this->is_email_in_list( $blocked_user['email'], 'blocked' ) ) {
6477	5667	$auth_settings_access_users_blocked = $this->sanitize_user_list(
6478		- $this->get_plugin_option( 'access_users_blocked', WP_Plugin_Authorizer::SINGLE_CONTEXT )
	5668	+ $this->get_plugin_option( 'access_users_blocked', SINGLE_ADMIN )
6479	5669	);
6480		- $blocked_user['date_added'] = date( 'M Y' );
	5670	+ $blocked_user['date_added'] = date( 'M Y' );
6481	5671	array_push( $auth_settings_access_users_blocked, $blocked_user );
6482	5672	update_option( 'auth_settings_access_users_blocked', $auth_settings_access_users_blocked );
6483	5673	} else {
6484	5674	$invalid_emails[] = $blocked_user['email'];
6485	5675	}
6486		- } elseif ( 'remove' === $blocked_user['edit_action'] ) {
6487	5676
	5677	+ } elseif ( $blocked_user['edit_action'] === 'remove' ) {
	5678	+
6488	5679	// Remove auth_blocked usermeta for the user.
6489	5680	$unblocked_user = get_user_by( 'email', $blocked_user['email'] );
6490		- if ( false !== $unblocked_user ) {
	5681	+ if ( $unblocked_user !== false ) {
6491	5682	delete_user_meta( $unblocked_user->ID, 'auth_blocked', 'yes' );
6492	5683	}
6493	5684
6494		- // Remove user from blocked list and save.
6495		- $auth_settings_access_users_blocked = $this->get_plugin_option( 'access_users_blocked', WP_Plugin_Authorizer::SINGLE_CONTEXT );
6496		- foreach ( $auth_settings_access_users_blocked as $key => $existing_user ) {
6497		- if ( 0 === strcasecmp( $blocked_user['email'], $existing_user['email'] ) ) {
6498		- unset( $auth_settings_access_users_blocked[ $key ] );
6499		- update_option( 'auth_settings_access_users_blocked', $auth_settings_access_users_blocked );
6500		- break;
	5685	+ // Remove user from blocked list and save
	5686	+ if ( $this->is_email_in_list( $blocked_user['email'], 'blocked' ) ) {
	5687	+ $auth_settings_access_users_blocked = $this->sanitize_user_list(
	5688	+ $this->get_plugin_option( 'access_users_blocked', SINGLE_ADMIN )
	5689	+ );
	5690	+ foreach ( $auth_settings_access_users_blocked as $key => $existing_user ) {
	5691	+ if ( 0 === strcasecmp( $blocked_user['email'], $existing_user['email'] ) ) {
	5692	+ unset( $auth_settings_access_users_blocked[$key] );
	5693	+ break;
	5694	+ }
6501	5695	}
	5696	+ update_option( 'auth_settings_access_users_blocked', $auth_settings_access_users_blocked );
6502	5697	}
	5698	+
6503	5699	}
6504	5700	}
6505	5701	}
6506	5702
		@@ -6505,131 +5701,19 @@
6505	5701	}
6506	5702
6507	5703	// Send response to client.
6508	5704	$response = array(
6509		- 'success' => true,
	5705	+ 'success' => true,
6510	5706	'invalid_emails' => $invalid_emails,
6511	5707	);
6512	5708	header( 'content-type: application/json' );
6513		- echo wp_json_encode( $response );
	5709	+ echo json_encode( $response );
6514	5710	exit;
6515	5711	}
6516	5712
6517	5713
6518		- /**
6519		- * Sanitizes an array of user update commands coming from the AJAX handler in Authorizer Settings.
6520		- *
6521		- * Example $users array:
6522		- * array(
6523		- * array(
6524		- * edit_action: 'add' or 'remove' or 'change_role',
6525		- * email: 'johndoe@example.com',
6526		- * role: 'subscriber',
6527		- * date_added: 'Jun 2014',
6528		- * local_user: 'true' or 'false',
6529		- * multisite_user: 'true' or 'false',
6530		- * ),
6531		- * ...
6532		- * )
6533		- *
6534		- * @param array $users Users to edit.
6535		- * @param array $args Options (e.g., 'allow_wildcard_email' => true).
6536		- * @return array Sanitized users to edit.
6537		- */
6538		- private function sanitize_update_auth_users( $users = array(), $args = array() ) {
6539		- if ( ! is_array( $users ) ) {
6540		- $users = array();
6541		- }
6542		- if ( isset( $args['allow_wildcard_email'] ) && $args['allow_wildcard_email'] ) {
6543		- $users = array_map( array( $this, 'sanitize_update_auth_user_allow_wildcard_email' ), $users );
6544		- } else {
6545		- $users = array_map( array( $this, 'sanitize_update_auth_user' ), $users );
6546		- }
6547	5714
6548		- // Remove any entries that failed email address validation.
6549		- $users = array_filter( $users, array( $this, 'remove_invalid_auth_users' ) );
6550		-
6551		- return $users;
6552		- }
6553		-
6554		-
6555	5715	/**
6556		- * This array filter will remove any users who failed email address validation
6557		- * (which would set their email to a blank string).
6558		- * @param array $user User data to check for a valid email.
6559		- * @return bool Whether to filter out the user.
6560		- */
6561		- private function remove_invalid_auth_users( $user ) {
6562		- return isset( $user['email'] ) && strlen( $user['email'] ) > 0;
6563		- }
6564		-
6565		- /**
6566		- * Callback for array_map in sanitize_update_auth_users().
6567		- *
6568		- * @param array $user User data to sanitize.
6569		- * @return array Sanitized user data.
6570		- */
6571		- private function sanitize_update_auth_user( $user ) {
6572		- if ( array_key_exists( 'edit_action', $user ) ) {
6573		- $user['edit_action'] = sanitize_text_field( $user['edit_action'] );
6574		- }
6575		- if ( isset( $user['email'] ) ) {
6576		- $user['email'] = sanitize_email( $user['email'] );
6577		- }
6578		- if ( isset( $user['role'] ) ) {
6579		- $user['role'] = sanitize_text_field( $user['role'] );
6580		- }
6581		- if ( isset( $user['date_added'] ) ) {
6582		- $user['date_added'] = sanitize_text_field( $user['date_added'] );
6583		- }
6584		- if ( isset( $user['local_user'] ) ) {
6585		- $user['local_user'] = 'true' === $user['local_user'] ? 'true' : 'false';
6586		- }
6587		- if ( isset( $user['multisite_user'] ) ) {
6588		- $user['multisite_user'] = 'true' === $user['multisite_user'] ? 'true' : 'false';
6589		- }
6590		-
6591		- return $user;
6592		- }
6593		-
6594		-
6595		-
6596		- /**
6597		- * Callback for array_map in sanitize_update_auth_users().
6598		- *
6599		- * @param array $user User data to sanitize.
6600		- * @return array Sanitized user data.
6601		- */
6602		- private function sanitize_update_auth_user_allow_wildcard_email( $user ) {
6603		- if ( array_key_exists( 'edit_action', $user ) ) {
6604		- $user['edit_action'] = sanitize_text_field( $user['edit_action'] );
6605		- }
6606		- if ( isset( $user['email'] ) ) {
6607		- if ( strpos( $user['email'], '@' ) === 0 ) {
6608		- $user['email'] = sanitize_text_field( $user['email'] );
6609		- } else {
6610		- $user['email'] = sanitize_email( $user['email'] );
6611		- }
6612		- }
6613		- if ( isset( $user['role'] ) ) {
6614		- $user['role'] = sanitize_text_field( $user['role'] );
6615		- }
6616		- if ( isset( $user['date_added'] ) ) {
6617		- $user['date_added'] = sanitize_text_field( $user['date_added'] );
6618		- }
6619		- if ( isset( $user['local_user'] ) ) {
6620		- $user['local_user'] = 'true' === $user['local_user'] ? 'true' : 'false';
6621		- }
6622		- if ( isset( $user['multisite_user'] ) ) {
6623		- $user['multisite_user'] = 'true' === $user['multisite_user'] ? 'true' : 'false';
6624		- }
6625		-
6626		- return $user;
6627		- }
6628		-
6629		-
6630		-
6631		- /**
6632	5716	* ***************************
6633	5717	* Helper functions
6634	5718	* ***************************
6635	5719	*/
		@@ -6637,19 +5721,19 @@
6637	5721
6638	5722	/**
6639	5723	* Retrieves a specific plugin option from db. Multisite enabled.
6640	5724	*
6641		- * @param string $option Option name.
6642		- * @param string $admin_mode WP_Plugin_Authorizer::NETWORK_CONTEXT will retrieve the multisite value.
6643		- * @param string $override_mode 'allow override' will retrieve the multisite value if it exists.
6644		- * @param string $print_mode 'print overlay' will output overlay that hides this option on the settings page.
6645		- * @return mixed Option value, or null on failure.
	5725	+ * @param string $option Option name
	5726	+ * @param string $admin_mode MULTISITE_ADMIN will retrieve the multisite value
	5727	+ * @param string $override_mode 'allow override' will retrieve the multisite value if it exists
	5728	+ * @param string $print_mode 'print overlay' will output overlay that hides this option on the settings page
	5729	+ * @return mixed Option value, or null on failure
6646	5730	*/
6647		- private function get_plugin_option( $option, $admin_mode = WP_Plugin_Authorizer::SINGLE_CONTEXT, $override_mode = 'no override', $print_mode = 'no overlay' ) {
	5731	+ private function get_plugin_option( $option, $admin_mode = SINGLE_ADMIN, $override_mode = 'no override', $print_mode = 'no overlay' ) {
6648	5732	// Special case for user lists (they are saved seperately to prevent concurrency issues).
6649		- if ( in_array( $option, array( 'access_users_pending', 'access_users_approved', 'access_users_blocked' ), true ) ) {
6650		- $list = WP_Plugin_Authorizer::NETWORK_CONTEXT === $admin_mode ? array() : get_option( 'auth_settings_' . $option );
6651		- if ( is_multisite() && WP_Plugin_Authorizer::NETWORK_CONTEXT === $admin_mode ) {
	5733	+ if ( in_array( $option, array( 'access_users_pending', 'access_users_approved', 'access_users_blocked' ) ) ) {
	5734	+ $list = $admin_mode === MULTISITE_ADMIN ? array() : get_option( 'auth_settings_' . $option );
	5735	+ if ( is_multisite() && $admin_mode === MULTISITE_ADMIN ) {
6652	5736	$list = get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_' . $option, array() );
6653	5737	}
6654	5738	return $list;
6655	5739	}
		@@ -6664,26 +5748,24 @@
6664	5748
6665	5749	// If requested and appropriate, print the overlay hiding the
6666	5750	// single site option that is overridden by a multisite option.
6667	5751	if (
6668		- WP_Plugin_Authorizer::NETWORK_CONTEXT !== $admin_mode &&
6669		- 'allow override' === $override_mode &&
6670		- 'print overlay' === $print_mode &&
	5752	+ $admin_mode !== MULTISITE_ADMIN &&
	5753	+ $override_mode === 'allow override' &&
	5754	+ $print_mode === 'print overlay' &&
6671	5755	array_key_exists( 'multisite_override', $auth_settings ) &&
6672		- '1' === $auth_settings['multisite_override'] &&
6673		- ( ! array_key_exists( 'advanced_override_multisite', $auth_settings ) || 1 !== intval( $auth_settings['advanced_override_multisite'] ) )
	5756	+ $auth_settings['multisite_override'] === '1' &&
	5757	+ ( ! array_key_exists( 'advanced_override_multisite', $auth_settings ) || $auth_settings['advanced_override_multisite'] != '1' )
6674	5758	) {
6675	5759	// Get original plugin options (not overridden value). We'll
6676	5760	// show this old value behind the disabled overlay.
6677		- // $auth_settings = $this->get_plugin_options( $admin_mode, 'no override' );
6678		- // (This feature is disabled).
6679		- //
	5761	+ //$auth_settings = $this->get_plugin_options( $admin_mode, 'no override' );
	5762	+
6680	5763	$name = "auth_settings[$option]";
6681		- $id = "auth_settings_$option";
6682		- ?>
6683		- <div id="overlay-hide-auth_settings_<?php echo esc_attr( $option ); ?>" class="auth_multisite_override_overlay">
	5764	+ $id = "auth_settings_$option"; ?>
	5765	+ <div id="overlay-hide-auth_settings_<?php echo $option; ?>" class="auth_multisite_override_overlay">
6684	5766	<span class="overlay-note">
6685		- <?php esc_html_e( 'This setting is overridden by a', 'authorizer' ); ?> <a href="<?php echo esc_attr( network_admin_url( 'admin.php?page=authorizer' ) ); ?>"><?php esc_html_e( 'multisite option', 'authorizer' ); ?></a>.
	5767	+ <?php _e( 'This setting is overridden by a', 'authorizer' ); ?> <a href="<?php echo network_admin_url( 'admin.php?page=authorizer' ); ?>"><?php _e( 'multisite option', 'authorizer' ); ?></a>.
6686	5768	</span>
6687	5769	</div>
6688	5770	<?php
6689	5771	}
		@@ -6689,9 +5771,9 @@
6689	5771	}
6690	5772
6691	5773	// If we're getting an option in a site that has overridden the multisite override, make
6692	5774	// sure we are returning the option value from that site (not the multisite value).
6693		- if ( array_key_exists( 'advanced_override_multisite', $auth_settings ) && 1 === intval( $auth_settings['advanced_override_multisite'] ) ) {
	5775	+ if ( array_key_exists( 'advanced_override_multisite', $auth_settings ) && $auth_settings['advanced_override_multisite'] == '1' ) {
6694	5776	$auth_settings = $this->get_plugin_options( $admin_mode, 'no override' );
6695	5777	}
6696	5778
6697	5779	// Set option to null if it wasn't found.
		@@ -6698,114 +5780,109 @@
6698	5780	if ( ! array_key_exists( $option, $auth_settings ) ) {
6699	5781	return null;
6700	5782	}
6701	5783
6702		- return $auth_settings[ $option ];
	5784	+ return $auth_settings[$option];
6703	5785	}
6704	5786
6705	5787	/**
6706	5788	* Retrieves all plugin options from db. Multisite enabled.
6707	5789	*
6708		- * @param string $admin_mode WP_Plugin_Authorizer::NETWORK_CONTEXT will retrieve the multisite value.
6709		- * @param string $override_mode 'allow override' will retrieve the multisite value if it exists.
6710		- * @return mixed Option value, or null on failure.
	5790	+ * @param string $admin_mode MULTISITE_ADMIN will retrieve the multisite value
	5791	+ * @param string $override_mode 'allow override' will retrieve the multisite value if it exists
	5792	+ * @return mixed Option value, or null on failure
6711	5793	*/
6712		- private function get_plugin_options( $admin_mode = WP_Plugin_Authorizer::SINGLE_CONTEXT, $override_mode = 'no override' ) {
6713		- // Grab plugin settings (skip if in WP_Plugin_Authorizer::NETWORK_CONTEXT mode).
6714		- $auth_settings = WP_Plugin_Authorizer::NETWORK_CONTEXT === $admin_mode ? array() : get_option( 'auth_settings' );
	5794	+ private function get_plugin_options( $admin_mode = SINGLE_ADMIN, $override_mode = 'no override' ) {
	5795	+ // Grab plugin settings (skip if in MULTISITE_ADMIN mode).
	5796	+ $auth_settings = $admin_mode === MULTISITE_ADMIN ? array() : get_option( 'auth_settings' );
6715	5797
6716	5798	// Initialize to default values if the plugin option doesn't exist.
6717		- if ( false === $auth_settings ) {
	5799	+ if ( $auth_settings === FALSE ) {
6718	5800	$auth_settings = $this->set_default_options();
6719	5801	}
6720	5802
6721	5803	// Merge multisite options if we're in a network and the current site hasn't overridden multisite settings.
6722		- if ( is_multisite() && ( ! array_key_exists( 'advanced_override_multisite', $auth_settings ) || 1 !== intval( $auth_settings['advanced_override_multisite'] ) ) ) {
	5804	+ if ( is_multisite() && ( ! array_key_exists( 'advanced_override_multisite', $auth_settings ) || $auth_settings['advanced_override_multisite'] != '1' ) ) {
6723	5805	// Get multisite options.
6724	5806	$auth_multisite_settings = get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings', array() );
6725	5807
6726	5808	// Return the multisite options if we're viewing the network admin options page.
6727	5809	// Otherwise override options with their multisite equivalents.
6728		- if ( WP_Plugin_Authorizer::NETWORK_CONTEXT === $admin_mode ) {
	5810	+ if ( $admin_mode === MULTISITE_ADMIN ) {
6729	5811	$auth_settings = $auth_multisite_settings;
6730	5812	} elseif (
6731		- 'allow override' === $override_mode &&
	5813	+ $override_mode === 'allow override' &&
6732	5814	array_key_exists( 'multisite_override', $auth_multisite_settings ) &&
6733		- '1' === $auth_multisite_settings['multisite_override']
	5815	+ $auth_multisite_settings['multisite_override'] === '1'
6734	5816	) {
6735	5817	// Keep track of the multisite override selection.
6736	5818	$auth_settings['multisite_override'] = $auth_multisite_settings['multisite_override'];
6737	5819
6738		- /**
6739		- * Note: the options below should be the complete list of overridden
6740		- * options. It is *not* the complete list of all options (some options
6741		- * don't have a multisite equivalent).
6742		- */
	5820	+ // Note: the options below should be the complete list of
	5821	+ // overridden options. It is *not* the complete list of all
	5822	+ // options (some options don't have a multisite equivalent)
6743	5823
6744		- /**
6745		- * Note: access_users_approved, access_users_pending, and
6746		- * access_users_blocked do not get overridden. However, since
6747		- * access_users_approved has a multisite equivalent, you must retrieve
6748		- * them both seperately. This is done because the two lists should be
6749		- * treated differently.
6750		- *
6751		- * $approved_users = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT );
6752		- * $ms_approved_users = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT );
6753		- */
	5824	+ // Note: access_users_approved, access_users_pending, and
	5825	+ // access_users_blocked do not get overridden. However,
	5826	+ // since access_users_approved has a multisite equivalent,
	5827	+ // you must retrieve them both seperately. This is done
	5828	+ // because the two lists should be treated differently.
	5829	+ // $approved_users = $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN );
	5830	+ // $ms_approved_users = $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN );
6754	5831
6755		- // Override external services (google, cas, or ldap) and associated options.
6756		- $auth_settings['google'] = $auth_multisite_settings['google'];
6757		- $auth_settings['google_clientid'] = $auth_multisite_settings['google_clientid'];
6758		- $auth_settings['google_clientsecret'] = $auth_multisite_settings['google_clientsecret'];
6759		- $auth_settings['google_hosteddomain'] = $auth_multisite_settings['google_hosteddomain'];
6760		- $auth_settings['cas'] = $auth_multisite_settings['cas'];
6761		- $auth_settings['cas_custom_label'] = $auth_multisite_settings['cas_custom_label'];
6762		- $auth_settings['cas_host'] = $auth_multisite_settings['cas_host'];
6763		- $auth_settings['cas_port'] = $auth_multisite_settings['cas_port'];
6764		- $auth_settings['cas_path'] = $auth_multisite_settings['cas_path'];
6765		- $auth_settings['cas_version'] = $auth_multisite_settings['cas_version'];
6766		- $auth_settings['cas_attr_email'] = $auth_multisite_settings['cas_attr_email'];
6767		- $auth_settings['cas_attr_first_name'] = $auth_multisite_settings['cas_attr_first_name'];
6768		- $auth_settings['cas_attr_last_name'] = $auth_multisite_settings['cas_attr_last_name'];
6769		- $auth_settings['cas_attr_update_on_login'] = $auth_multisite_settings['cas_attr_update_on_login'];
6770		- $auth_settings['cas_auto_login'] = $auth_multisite_settings['cas_auto_login'];
6771		- $auth_settings['ldap'] = $auth_multisite_settings['ldap'];
6772		- $auth_settings['ldap_host'] = $auth_multisite_settings['ldap_host'];
6773		- $auth_settings['ldap_port'] = $auth_multisite_settings['ldap_port'];
6774		- $auth_settings['ldap_tls'] = $auth_multisite_settings['ldap_tls'];
6775		- $auth_settings['ldap_search_base'] = $auth_multisite_settings['ldap_search_base'];
6776		- $auth_settings['ldap_uid'] = $auth_multisite_settings['ldap_uid'];
6777		- $auth_settings['ldap_attr_email'] = $auth_multisite_settings['ldap_attr_email'];
6778		- $auth_settings['ldap_user'] = $auth_multisite_settings['ldap_user'];
6779		- $auth_settings['ldap_password'] = $auth_multisite_settings['ldap_password'];
6780		- $auth_settings['ldap_lostpassword_url'] = $auth_multisite_settings['ldap_lostpassword_url'];
6781		- $auth_settings['ldap_attr_first_name'] = $auth_multisite_settings['ldap_attr_first_name'];
6782		- $auth_settings['ldap_attr_last_name'] = $auth_multisite_settings['ldap_attr_last_name'];
	5832	+ // Override external services (google, cas, or ldap) and associated options
	5833	+ $auth_settings['google'] = $auth_multisite_settings['google'];
	5834	+ $auth_settings['google_clientid'] = $auth_multisite_settings['google_clientid'];
	5835	+ $auth_settings['google_clientsecret'] = $auth_multisite_settings['google_clientsecret'];
	5836	+ $auth_settings['google_hosteddomain'] = $auth_multisite_settings['google_hosteddomain'];
	5837	+ $auth_settings['cas'] = $auth_multisite_settings['cas'];
	5838	+ $auth_settings['cas_custom_label'] = $auth_multisite_settings['cas_custom_label'];
	5839	+ $auth_settings['cas_host'] = $auth_multisite_settings['cas_host'];
	5840	+ $auth_settings['cas_port'] = $auth_multisite_settings['cas_port'];
	5841	+ $auth_settings['cas_path'] = $auth_multisite_settings['cas_path'];
	5842	+ $auth_settings['cas_version'] = $auth_multisite_settings['cas_version'];
	5843	+ $auth_settings['cas_attr_email'] = $auth_multisite_settings['cas_attr_email'];
	5844	+ $auth_settings['cas_attr_first_name'] = $auth_multisite_settings['cas_attr_first_name'];
	5845	+ $auth_settings['cas_attr_last_name'] = $auth_multisite_settings['cas_attr_last_name'];
	5846	+ $auth_settings['cas_attr_update_on_login'] = $auth_multisite_settings['cas_attr_update_on_login'];
	5847	+ $auth_settings['cas_auto_login'] = $auth_multisite_settings['cas_auto_login'];
	5848	+ $auth_settings['ldap'] = $auth_multisite_settings['ldap'];
	5849	+ $auth_settings['ldap_host'] = $auth_multisite_settings['ldap_host'];
	5850	+ $auth_settings['ldap_port'] = $auth_multisite_settings['ldap_port'];
	5851	+ $auth_settings['ldap_tls'] = $auth_multisite_settings['ldap_tls'];
	5852	+ $auth_settings['ldap_search_base'] = $auth_multisite_settings['ldap_search_base'];
	5853	+ $auth_settings['ldap_uid'] = $auth_multisite_settings['ldap_uid'];
	5854	+ $auth_settings['ldap_attr_email'] = $auth_multisite_settings['ldap_attr_email'];
	5855	+ $auth_settings['ldap_user'] = $auth_multisite_settings['ldap_user'];
	5856	+ $auth_settings['ldap_password'] = $auth_multisite_settings['ldap_password'];
	5857	+ $auth_settings['ldap_lostpassword_url'] = $auth_multisite_settings['ldap_lostpassword_url'];
	5858	+ $auth_settings['ldap_attr_first_name'] = $auth_multisite_settings['ldap_attr_first_name'];
	5859	+ $auth_settings['ldap_attr_last_name'] = $auth_multisite_settings['ldap_attr_last_name'];
6783	5860	$auth_settings['ldap_attr_update_on_login'] = $auth_multisite_settings['ldap_attr_update_on_login'];
6784	5861
6785		- // Override access_who_can_login and access_who_can_view.
	5862	+ // Override access_who_can_login and access_who_can_view
6786	5863	$auth_settings['access_who_can_login'] = $auth_multisite_settings['access_who_can_login'];
6787		- $auth_settings['access_who_can_view'] = $auth_multisite_settings['access_who_can_view'];
	5864	+ $auth_settings['access_who_can_view'] = $auth_multisite_settings['access_who_can_view'];
6788	5865
6789		- // Override access_default_role.
	5866	+ // Override access_default_role
6790	5867	$auth_settings['access_default_role'] = $auth_multisite_settings['access_default_role'];
6791	5868
6792		- // Override lockouts.
	5869	+ // Override lockouts
6793	5870	$auth_settings['advanced_lockouts'] = $auth_multisite_settings['advanced_lockouts'];
6794	5871
6795		- // Override Hide WordPress login.
	5872	+ // Override Hide WordPress login
6796	5873	$auth_settings['advanced_hide_wp_login'] = $auth_multisite_settings['advanced_hide_wp_login'];
6797	5874
6798		- // Override Users per page.
	5875	+ // Override Users per page
6799	5876	$auth_settings['advanced_users_per_page'] = $auth_multisite_settings['advanced_users_per_page'];
6800	5877
6801		- // Override Sort users by.
	5878	+ // Override Sort users by
6802	5879	$auth_settings['advanced_users_sort_by'] = $auth_multisite_settings['advanced_users_sort_by'];
6803	5880
6804		- // Override Sort users order.
	5881	+ // Override Sort users order
6805	5882	$auth_settings['advanced_users_sort_order'] = $auth_multisite_settings['advanced_users_sort_order'];
6806	5883
6807		- // Override Show Dashboard Widget.
	5884	+ // Override Show Dashboard Widget
6808	5885	$auth_settings['advanced_widget_enabled'] = $auth_multisite_settings['advanced_widget_enabled'];
6809	5886	}
6810	5887	}
6811	5888	return $auth_settings;
		@@ -6813,27 +5890,23 @@
6813	5890
6814	5891
6815	5892	/**
6816	5893	* Remove user from authorizer lists when that user is deleted in WordPress.
6817		- *
6818		- * Action: delete_user
6819		- *
6820		- * @param int $user_id User ID to remove.
6821		- * @return void
	5894	+ * Run on action hook: delete_user
6822	5895	*/
6823		- public function remove_user_from_authorizer_when_deleted( $user_id ) {
6824		- $user = get_user_by( 'id', $user_id );
	5896	+ function remove_user_from_authorizer_when_deleted( $user_id ) {
	5897	+ $user = get_user_by( 'id', $user_id );
6825	5898	$deleted_email = $user->user_email;
6826	5899
6827	5900	// Remove user from pending/approved lists and save.
6828	5901	$list_names = array( 'access_users_pending', 'access_users_approved' );
6829	5902	foreach ( $list_names as $list_name ) {
6830		- $user_list = $this->sanitize_user_list( $this->get_plugin_option( $list_name, WP_Plugin_Authorizer::SINGLE_CONTEXT ) );
	5903	+ $user_list = $this->sanitize_user_list( $this->get_plugin_option( $list_name, SINGLE_ADMIN ) );
6831	5904	$list_changed = false;
6832	5905	foreach ( $user_list as $key => $existing_user ) {
6833	5906	if ( 0 === strcasecmp( $deleted_email, $existing_user['email'] ) ) {
6834	5907	$list_changed = true;
6835		- unset( $user_list[ $key ] );
	5908	+ unset( $user_list[$key] );
6836	5909	}
6837	5910	}
6838	5911	if ( $list_changed ) {
6839	5912	update_option( 'auth_settings_' . $list_name, $user_list );
		@@ -6843,27 +5916,23 @@
6843	5916
6844	5917
6845	5918	/**
6846	5919	* Remove multisite user from authorizer lists when that user is deleted from Network Users.
6847		- *
6848		- * Action: wpmu_delete_user
6849		- *
6850		- * @param int $user_id User ID to remove.
6851		- * @return void
	5920	+ * Run on action hook: wpmu_delete_user
6852	5921	*/
6853		- public function remove_network_user_from_authorizer_when_deleted( $user_id ) {
6854		- $user = get_user_by( 'id', $user_id );
	5922	+ function remove_network_user_from_authorizer_when_deleted( $user_id ) {
	5923	+ $user = get_user_by( 'id', $user_id );
6855	5924	$deleted_email = $user->user_email;
6856	5925
6857	5926	// Go through multisite approved user list and remove this user.
6858	5927	$auth_multisite_settings_access_users_approved = $this->sanitize_user_list(
6859		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT )
	5928	+ $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN )
6860	5929	);
6861		- $list_changed = false;
	5930	+ $list_changed = false;
6862	5931	foreach ( $auth_multisite_settings_access_users_approved as $key => $existing_user ) {
6863	5932	if ( 0 === strcasecmp( $deleted_email, $existing_user['email'] ) ) {
6864	5933	$list_changed = true;
6865		- unset( $auth_multisite_settings_access_users_approved[ $key ] );
	5934	+ unset( $auth_multisite_settings_access_users_approved[$key] );
6866	5935	}
6867	5936	}
6868	5937	if ( $list_changed ) {
6869	5938	update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
		@@ -6869,9 +5938,8 @@
6869	5938	update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
6870	5939	}
6871	5940
6872	5941	// Go through all pending/approved lists on individual sites and remove this user from them.
6873		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
6874	5942	$sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
6875	5943	foreach ( $sites as $site ) {
6876	5944	$blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
6877	5945	$this->remove_network_user_from_site_when_removed( $user_id, $blog_id );
		@@ -6881,27 +5949,22 @@
6881	5949
6882	5950
6883	5951	/**
6884	5952	* Remove multisite user from a specific site's lists when that user is removed from the site.
6885		- *
6886		- * Action: remove_user_from_blog
6887		- *
6888		- * @param int $user_id User ID to remove.
6889		- * @param int $blog_id Blog ID to remove from.
6890		- * @return void
	5953	+ * Run on action hook: remove_user_from_blog
6891	5954	*/
6892		- public function remove_network_user_from_site_when_removed( $user_id, $blog_id ) {
6893		- $user = get_user_by( 'id', $user_id );
	5955	+ function remove_network_user_from_site_when_removed( $user_id, $blog_id ) {
	5956	+ $user = get_user_by( 'id', $user_id );
6894	5957	$deleted_email = $user->user_email;
6895	5958
6896	5959	$list_names = array( 'access_users_pending', 'access_users_approved' );
6897	5960	foreach ( $list_names as $list_name ) {
6898		- $user_list = get_blog_option( $blog_id, 'auth_settings_' . $list_name, array() );
	5961	+ $user_list = get_blog_option( $blog_id, 'auth_settings_' . $list_name, array() );
6899	5962	$list_changed = false;
6900	5963	foreach ( $user_list as $key => $existing_user ) {
6901	5964	if ( 0 === strcasecmp( $deleted_email, $existing_user['email'] ) ) {
6902	5965	$list_changed = true;
6903		- unset( $user_list[ $key ] );
	5966	+ unset( $user_list[$key] );
6904	5967	}
6905	5968	}
6906	5969	if ( $list_changed ) {
6907	5970	update_blog_option( $blog_id, 'auth_settings_' . $list_name, $user_list );
		@@ -6911,30 +5974,26 @@
6911	5974
6912	5975
6913	5976	/**
6914	5977	* Helper: Add multisite user to a specific site's approved list.
6915		- *
6916		- * @param int $user_id User ID to add.
6917		- * @param int $blog_id Blog ID to add to.
6918		- * @return void
6919	5978	*/
6920		- private function add_network_user_to_site( $user_id, $blog_id ) {
	5979	+ function add_network_user_to_site( $user_id, $blog_id ) {
6921	5980	// Switch to blog.
6922	5981	switch_to_blog( $blog_id );
6923	5982
6924	5983	// Get user details and role.
6925		- $access_default_role = $this->get_plugin_option( 'access_default_role', WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
6926		- $user = get_user_by( 'id', $user_id );
6927		- $user_email = $user->user_email;
6928		- $user_role = $user && is_array( $user->roles ) && count( $user->roles ) > 0 ? $user->roles[0] : $access_default_role;
	5984	+ $access_default_role = $this->get_plugin_option( 'access_default_role', SINGLE_ADMIN, 'allow override' );
	5985	+ $user = get_user_by( 'id', $user_id );
	5986	+ $user_email = $user->user_email;
	5987	+ $user_role = $user && is_array( $user->roles ) && count( $user->roles ) > 0 ? $user->roles[0] : $access_default_role;
6929	5988
6930	5989	// Add user to approved list if not already there and not in blocked list.
6931		- $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT );
6932		- $auth_settings_access_users_blocked = $this->get_plugin_option( 'access_users_blocked', WP_Plugin_Authorizer::SINGLE_CONTEXT );
	5990	+ $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN );
	5991	+ $auth_settings_access_users_blocked = $this->get_plugin_option( 'access_users_blocked', SINGLE_ADMIN );
6933	5992	if ( ! $this->in_multi_array( $user_email, $auth_settings_access_users_approved ) && ! $this->in_multi_array( $user_email, $auth_settings_access_users_blocked ) ) {
6934	5993	$approved_user = array(
6935		- 'email' => $this->lowercase( $user_email ),
6936		- 'role' => $user_role,
	5994	+ 'email' => $this->lowercase( $user_email ),
	5995	+ 'role' => $user_role,
6937	5996	'date_added' => date( 'M Y', strtotime( $user->user_registered ) ),
6938	5997	'local_user' => true,
6939	5998	);
6940	5999	array_push( $auth_settings_access_users_approved, $approved_user );
		@@ -6951,17 +6010,17 @@
6951	6010	* When an existing user is invited to the current site (or a new user is created),
6952	6011	* add them to the authorizer approved list. This action fires when the admin
6953	6012	* doesn't select the "Skip Confirmation Email" option.
6954	6013	*
6955		- * Action: invite_user
	6014	+ * @action invite_user
6956	6015	*
6957		- * @param int $user_id The invited user's ID.
6958		- * @param array $role The role of the invited user (or none if a new user creation).
	6016	+ * @param int $user_id The invited user's ID.
	6017	+ * @param array $role The role of the invited user (or none if a new user creation).
6959	6018	* @param string $newuser_key The key of the invitation.
6960	6019	*/
6961		- public function add_existing_user_to_authorizer_when_created( $user_id, $role = array(), $newuser_key = '' ) {
	6020	+ function add_existing_user_to_authorizer_when_created( $user_id, $role = array(), $newuser_key = '' ) {
6962	6021	$user = get_user_by( 'id', $user_id );
6963		- $this->add_user_to_authorizer_when_created( $user->user_email, $user->user_registered, $user->roles, $role );
	6022	+ $this->add_user_to_authorizer_when_created( $user->user_email, $user->user_registered, $user->user_roles, $role );
6964	6023	}
6965	6024
6966	6025
6967	6026	/**
		@@ -6969,16 +6028,16 @@
6969	6028	* When an existing user is invited to the current site (or a new user is created),
6970	6029	* add them to the authorizer approved list. This action fires when the admin
6971	6030	* selects the "Skip Confirmation Email" option.
6972	6031	*
6973		- * Action: added_existing_user
	6032	+ * @action added_existing_user
6974	6033	*
6975		- * @param int $user_id The invited user's ID.
6976		- * @param mixed $result True on success or a WP_Error object if the user doesn't exist.
	6034	+ * @param int $user_id The invited user's ID.
	6035	+ * @param mixed $result True on success or a WP_Error object if the user doesn't exist.
6977	6036	*/
6978		- public function add_existing_user_to_authorizer_when_created_noconfirmation( $user_id, $result ) {
	6037	+ function add_existing_user_to_authorizer_when_created_noconfirmation( $user_id, $result ) {
6979	6038	$user = get_user_by( 'id', $user_id );
6980		- $this->add_user_to_authorizer_when_created( $user->user_email, $user->user_registered, $user->roles );
	6039	+ $this->add_user_to_authorizer_when_created( $user->user_email, $user->user_registered, $user->user_roles );
6981	6040	}
6982	6041
6983	6042
6984	6043	/**
		@@ -6985,16 +6044,16 @@
6985	6044	* Multisite:
6986	6045	* When a new user is invited to the current site (or a new user is created),
6987	6046	* add them to the authorizer approved list.
6988	6047	*
6989		- * Action: after_signup_user
	6048	+ * @action after_signup_user
6990	6049	*
6991		- * @param string $user User's requested login name.
	6050	+ * @param string $user User's requested login name.
6992	6051	* @param string $user_email User's email address.
6993		- * @param string $key User's activation key.
6994		- * @param array $meta Additional signup meta, including initially set roles.
	6052	+ * @param string $key User's activation key.
	6053	+ * @param array $meta Additional signup meta, including initially set roles.
6995	6054	*/
6996		- public function add_new_user_to_authorizer_when_created( $user, $user_email, $key, $meta ) {
	6055	+ function add_new_user_to_authorizer_when_created( $user, $user_email, $key, $meta ) {
6997	6056	$user_roles = isset( $meta['new_role'] ) ? array( $meta['new_role'] ) : array();
6998	6057	$this->add_user_to_authorizer_when_created( $user_email, time(), $user_roles );
6999	6058	}
7000	6059
		@@ -7003,18 +6062,17 @@
7003	6062	* Single site:
7004	6063	* When a new user is added in single site mode, add them to the authorizer
7005	6064	* approved list.
7006	6065	*
7007		- * Action: edit_user_created_user
	6066	+ * @action edit_user_created_user
7008	6067	*
7009		- * @param int $user_id ID of the newly created user.
7010		- * @param string $notify Type of notification that should happen. See
7011		- * wp_send_new_user_notifications() for more
7012		- * information on possible values.
	6068	+ * @param int $user_id ID of the newly created user.
	6069	+ * @param string $notify Type of notification that should happen. See wp_send_new_user_notifications()
	6070	+ * for more information on possible values.
7013	6071	*/
7014		- public function add_new_user_to_authorizer_when_created_single_site( $user_id, $notify ) {
	6072	+ function add_new_user_to_authorizer_when_created_single_site( $user_id, $notify ) {
7015	6073	$user = get_user_by( 'id', $user_id );
7016		- $this->add_user_to_authorizer_when_created( $user->user_email, $user->user_registered, $user->roles );
	6074	+ $this->add_user_to_authorizer_when_created( $user->user_email, $user->user_registered, $user->user_roles );
7017	6075	}
7018	6076
7019	6077
7020	6078	/**
		@@ -7019,36 +6077,20 @@
7019	6077
7020	6078	/**
7021	6079	* Helper: When a new user is added/invited to the current site (or a new
7022	6080	* user is created), add them to the authorizer approved list.
7023		- *
7024		- * @param string $user_email Email address of user to add.
7025		- * @param string $date_registered Date user registered.
7026		- * @param array $user_roles Role to add for user.
7027		- * @param array $default_role Default role, if no role specified.
7028	6081	*/
7029	6082	private function add_user_to_authorizer_when_created( $user_email, $date_registered, $user_roles = array(), $default_role = array() ) {
7030	6083	$auth_multisite_settings_access_users_approved = is_multisite() ? get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', array() ) : array();
7031		- $auth_settings_access_users_pending = $this->get_plugin_option( 'access_users_pending', WP_Plugin_Authorizer::SINGLE_CONTEXT );
7032		- $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT );
7033		- $auth_settings_access_users_blocked = $this->get_plugin_option( 'access_users_blocked', WP_Plugin_Authorizer::SINGLE_CONTEXT );
	6084	+ $auth_settings_access_users_pending = $this->get_plugin_option( 'access_users_pending', SINGLE_ADMIN );
	6085	+ $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN );
	6086	+ $auth_settings_access_users_blocked = $this->get_plugin_option( 'access_users_blocked', SINGLE_ADMIN );
7034	6087
7035	6088	// Get default role if one isn't specified.
7036	6089	if ( count( $default_role ) < 1 ) {
7037	6090	$default_role = '';
7038	6091	} else {
7039		- // If default role was provided, it came from the invite_user hook, and
7040		- // only contains the role's display name. Here we look up the actual role
7041		- // name to save (and default to no role if the display name isn't found).
7042		- global $wp_roles;
7043		- $default_role_display_name = $default_role['name'];
7044		- $default_role = '';
7045		- foreach ( $wp_roles->role_names as $role_name => $display_name ) {
7046		- if ( $default_role_display_name === $display_name ) {
7047		- $default_role = $role_name;
7048		- break;
7049		- }
7050		- }
	6092	+ $default_role = strtolower( $default_role['name'] );
7051	6093	}
7052	6094
7053	6095	$updated = false;
7054	6096
		@@ -7058,9 +6100,9 @@
7058	6100	}
7059	6101	// Remove from pending list if there.
7060	6102	foreach ( $auth_settings_access_users_pending as $key => $pending_user ) {
7061	6103	if ( 0 === strcasecmp( $pending_user['email'], $user_email ) ) {
7062		- unset( $auth_settings_access_users_pending[ $key ] );
	6104	+ unset( $auth_settings_access_users_pending[$key] );
7063	6105	$updated = true;
7064	6106	}
7065	6107	}
7066	6108	// Skip if user is in multisite approved list.
		@@ -7069,10 +6111,10 @@
7069	6111	}
7070	6112	// Add to approved list if not there.
7071	6113	if ( ! $this->in_multi_array( $user_email, $auth_settings_access_users_approved ) ) {
7072	6114	$approved_user = array(
7073		- 'email' => $this->lowercase( $user_email ),
7074		- 'role' => is_array( $user_roles ) && count( $user_roles ) > 0 ? $user_roles[0] : $default_role,
	6115	+ 'email' => $this->lowercase( $user_email ),
	6116	+ 'role' => is_array( $user_roles ) && count( $user_roles ) > 0 ? $user_roles[0] : $default_role,
7075	6117	'date_added' => date( 'M Y', strtotime( $date_registered ) ),
7076	6118	'local_user' => true,
7077	6119	);
7078	6120	array_push( $auth_settings_access_users_approved, $approved_user );
		@@ -7091,24 +6133,24 @@
7091	6133	* When a user is granted super admin status (checkbox on network user edit
7092	6134	* screen), add them to the authorizer network approved list. Also remove
7093	6135	* them from pending/approved list on any individual sites.
7094	6136	*
7095		- * Action: grant_super_admin
	6137	+ * @action grant_super_admin
7096	6138	*
7097	6139	* @param int $user_id The user's ID.
7098	6140	*/
7099		- public function grant_super_admin__add_to_network_approved( $user_id ) {
7100		- $user = get_user_by( 'id', $user_id );
	6141	+ function grant_super_admin__add_to_network_approved( $user_id ) {
	6142	+ $user = get_user_by( 'id', $user_id );
7101	6143	$user_email = $user->user_email;
7102	6144
7103	6145	// Add user to multisite approved user list (if not already there).
7104	6146	$auth_multisite_settings_access_users_approved = $this->sanitize_user_list(
7105		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT )
	6147	+ $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN )
7106	6148	);
7107	6149	if ( ! $this->in_multi_array( $user_email, $auth_multisite_settings_access_users_approved ) ) {
7108	6150	$multisite_approved_user = array(
7109		- 'email' => $this->lowercase( $user_email ),
7110		- 'role' => count( $user->roles ) > 0 ? $user->roles[0] : 'administrator',
	6151	+ 'email' => $this->lowercase( $user_email ),
	6152	+ 'role' => count( $user->roles ) > 0 ? $user->roles[0] : 'administrator',
7111	6153	'date_added' => date( 'M Y', strtotime( $user->user_registered ) ),
7112	6154	'local_user' => true,
7113	6155	);
7114	6156	array_push( $auth_multisite_settings_access_users_approved, $multisite_approved_user );
		@@ -7115,9 +6157,8 @@
7115	6157	update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
7116	6158	}
7117	6159
7118	6160	// Go through all pending/approved lists on individual sites and remove this user from them.
7119		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
7120	6161	$sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
7121	6162	foreach ( $sites as $site ) {
7122	6163	$blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
7123	6164	$this->remove_network_user_from_site_when_removed( $user_id, $blog_id );
		@@ -7130,25 +6171,25 @@
7130	6171	* When a user's super admin status is revoked (checkbox on network user edit
7131	6172	* screen), remove them from the authorizer network approved list. Also add
7132	6173	* them to approved list on any individual sites they are already a part of.
7133	6174	*
7134		- * Action: revoke_super_admin
	6175	+ * @action revoke_super_admin
7135	6176	*
7136	6177	* @param int $user_id The user's ID.
7137	6178	*/
7138		- public function revoke_super_admin__remove_from_network_approved( $user_id ) {
7139		- $user = get_user_by( 'id', $user_id );
	6179	+ function revoke_super_admin__remove_from_network_approved( $user_id ) {
	6180	+ $user = get_user_by( 'id', $user_id );
7140	6181	$revoked_email = $user->user_email;
7141	6182
7142	6183	// Go through multisite approved user list and remove this user.
7143	6184	$auth_multisite_settings_access_users_approved = $this->sanitize_user_list(
7144		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT )
	6185	+ $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN )
7145	6186	);
7146		- $list_changed = false;
	6187	+ $list_changed = false;
7147	6188	foreach ( $auth_multisite_settings_access_users_approved as $key => $existing_user ) {
7148	6189	if ( 0 === strcasecmp( $revoked_email, $existing_user['email'] ) ) {
7149	6190	$list_changed = true;
7150		- unset( $auth_multisite_settings_access_users_approved[ $key ] );
	6191	+ unset( $auth_multisite_settings_access_users_approved[$key] );
7151	6192	}
7152	6193	}
7153	6194	if ( $list_changed ) {
7154	6195	update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
		@@ -7163,21 +6204,14 @@
7163	6204	}
7164	6205
7165	6206	}
7166	6207
7167		- /**
7168		- * Send a welcome email message to a newly approved user (if the "Should
7169		- * email approved users" setting is enabled).
7170		- *
7171		- * @param string $email Email address to send welcome email to.
7172		- * @return bool Whether the email was sent.
7173		- */
7174	6208	private function maybe_email_welcome_message( $email ) {
7175	6209	// Get option for whether to email welcome messages.
7176	6210	$should_email_new_approved_users = $this->get_plugin_option( 'access_should_email_approved_users' );
7177	6211
7178	6212	// Do not send welcome email if option not enabled.
7179		- if ( '1' !== $should_email_new_approved_users ) {
	6213	+ if ( $should_email_new_approved_users !== '1' ) {
7180	6214	return false;
7181	6215	}
7182	6216
7183	6217	// Make sure we didn't just email this user (can happen with
		@@ -7183,15 +6217,15 @@
7183	6217	// Make sure we didn't just email this user (can happen with
7184	6218	// multiple admins saving at the same time, or by clicking
7185	6219	// Approve button too rapidly).
7186	6220	$recently_sent_emails = get_option( 'auth_settings_recently_sent_emails' );
7187		- if ( false === $recently_sent_emails ) {
	6221	+ if ( $recently_sent_emails === FALSE ) {
7188	6222	$recently_sent_emails = array();
7189	6223	}
7190	6224	foreach ( $recently_sent_emails as $key => $recently_sent_email ) {
7191	6225	if ( $recently_sent_email['time'] < strtotime( 'now -1 minutes' ) ) {
7192	6226	// Remove emails sent more than 1 minute ago.
7193		- unset( $recently_sent_emails[ $key ] );
	6227	+ unset( $recently_sent_emails[$key] );
7194	6228	} elseif ( $recently_sent_email['email'] === $email ) {
7195	6229	// Sent an email to this user within the last 1 minute, so
7196	6230	// quit without sending.
7197	6231	return false;
		@@ -7199,15 +6233,15 @@
7199	6233	}
7200	6234	// Add the email we're about to send to the list.
7201	6235	$recently_sent_emails[] = array(
7202	6236	'email' => $email,
7203		- 'time' => time(),
	6237	+ 'time' => time(),
7204	6238	);
7205	6239	update_option( 'auth_settings_recently_sent_emails', $recently_sent_emails );
7206	6240
7207		- // Get welcome email subject and body text.
	6241	+ // Get welcome email subject and body text
7208	6242	$subject = $this->get_plugin_option( 'access_email_approved_users_subject' );
7209		- $body = apply_filters( 'the_content', $this->get_plugin_option( 'access_email_approved_users_body' ) );
	6243	+ $body = apply_filters( 'the_content', $this->get_plugin_option( 'access_email_approved_users_body' ) );
7210	6244
7211	6245	// Fail if the subject/body options don't exist or are empty.
7212	6246	if ( is_null( $subject ) || is_null( $body ) || strlen( $subject ) === 0 || strlen( $body ) === 0 ) {
7213	6247	return false;
		@@ -7214,14 +6248,14 @@
7214	6248	}
7215	6249
7216	6250	// Replace approved shortcode patterns in subject and body.
7217	6251	$site_name = get_bloginfo( 'name' );
7218		- $site_url = get_site_url();
7219		- $subject = str_replace( '[site_name]', $site_name, $subject );
7220		- $body = str_replace( '[site_name]', $site_name, $body );
7221		- $body = str_replace( '[site_url]', $site_url, $body );
7222		- $body = str_replace( '[user_email]', $email, $body );
7223		- $headers = 'Content-type: text/html' . "\r\n";
	6252	+ $site_url = get_site_url();
	6253	+ $subject = str_replace( '[site_name]', $site_name, $subject );
	6254	+ $body = str_replace( '[site_name]', $site_name, $body );
	6255	+ $body = str_replace( '[site_url]', $site_url, $body );
	6256	+ $body = str_replace( '[user_email]', $email, $body );
	6257	+ $headers = 'Content-type: text/html' . "\r\n";
7224	6258
7225	6259	// Send email.
7226	6260	wp_mail( $email, $subject, $body, $headers );
7227	6261
		@@ -7231,22 +6265,14 @@
7231	6265
7232	6266
7233	6267	/**
7234	6268	* Generate a unique cookie to add to nonces to prevent CSRF.
7235		- *
7236		- * @var string
7237	6269	*/
7238		- private $cookie_value = null;
7239		-
7240		- /**
7241		- * Retrieve the unique login cookie.
7242		- *
7243		- * @return string Login cookie value.
7244		- */
7245		- private function get_cookie_value() {
	6270	+ protected $cookie_value = null;
	6271	+ function get_cookie_value() {
7246	6272	if ( ! $this->cookie_value ) {
7247	6273	if ( isset( $_COOKIE['login_unique'] ) ) {
7248		- $this->cookie_value = sanitize_key( wp_unslash( $_COOKIE['login_unique'] ) );
	6274	+ $this->cookie_value = $_COOKIE['login_unique'];
7249	6275	} else {
7250	6276	$this->cookie_value = md5( rand() );
7251	6277	}
7252	6278	}
		@@ -7254,51 +6280,37 @@
7254	6280	}
7255	6281
7256	6282
7257	6283	/**
7258		- * Encryption key (not secret!).
7259		- *
7260		- * @var string
7261		- */
7262		- private static $key = "8QxnrvjdtweisvCBKEY!+0\0\0";
7263		-
7264		- /**
7265		- * Encryption salt (not secret!).
7266		- *
7267		- * @var string
7268		- */
7269		- private static $iv = 'R_O2D]jPn]1[fhJl!-P1.oe';
7270		-
7271		- /**
7272	6284	* Basic encryption using a public (not secret!) key. Used for general
7273	6285	* database obfuscation of passwords.
7274		- *
7275		- * @param string $text String to encrypt.
7276		- * @param string $library Encryption library to use (openssl).
7277		- * @return string Encrypted string.
	6286	+ * @param $text String to encrypt.
	6287	+ * @param $library Encryption lib to use (openssl).
	6288	+ * @return Encrypted string
7278	6289	*/
7279		- private function encrypt( $text, $library = 'openssl' ) {
	6290	+ private static $key = "8QxnrvjdtweisvCBKEY!+0\0\0";
	6291	+ private static $iv = "R_O2D]jPn]1[fhJl!-P1.oe";
	6292	+ function encrypt( $text, $library = 'openssl' ) {
7280	6293	$result = '';
7281	6294
7282	6295	// Use openssl library (better) if it is enabled.
7283		- if ( function_exists( 'openssl_encrypt' ) && 'openssl' === $library ) {
7284		- $result = base64_encode(
7285		- openssl_encrypt(
7286		- $text,
7287		- 'AES-256-CBC',
7288		- hash( 'sha256', self::$key ),
7289		- 0,
7290		- substr( hash( 'sha256', self::$iv ), 0, 16 )
7291		- )
7292		- );
7293		- } elseif ( function_exists( 'mcrypt_encrypt' ) ) { // Use mcrypt library (deprecated in PHP 7.1) if php5-mcrypt extension is enabled.
	6296	+ if ( function_exists( 'openssl_encrypt' ) && $library === 'openssl' ) {
	6297	+ $result = base64_encode( openssl_encrypt(
	6298	+ $text,
	6299	+ 'AES-256-CBC',
	6300	+ hash( 'sha256', self::$key ),
	6301	+ 0,
	6302	+ substr( hash( 'sha256', self::$iv ), 0, 16 )
	6303	+ ) );
	6304	+ // Use mcrypt library (deprecated in PHP 7.1) if php5-mcrypt extension is enabled.
	6305	+ } else if ( function_exists( 'mcrypt_encrypt' ) ) {
7294	6306	$result = base64_encode( mcrypt_encrypt( MCRYPT_RIJNDAEL_256, self::$key, $text, MCRYPT_MODE_ECB, 'abcdefghijklmnopqrstuvwxyz012345' ) );
7295		- } else { // Fall back to basic obfuscation.
7296		- $length = strlen( $text );
7297		- for ( $i = 0; $i < $length; $i++ ) {
7298		- $char = substr( $text, $i, 1 );
	6307	+ // Fall back to basic obfuscation.
	6308	+ } else {
	6309	+ for ( $i = 0; $i < strlen( $text ); $i++ ) {
	6310	+ $char = substr( $text, $i, 1 );
7299	6311	$keychar = substr( self::$key, ( $i % strlen( self::$key ) ) - 1, 1 );
7300		- $char = chr( ord( $char ) + ord( $keychar ) );
	6312	+ $char = chr( ord( $char ) + ord( $keychar ) );
7301	6313	$result .= $char;
7302	6314	}
7303	6315	$result = base64_encode( $result );
7304	6316	}
		@@ -7309,18 +6321,17 @@
7309	6321
7310	6322	/**
7311	6323	* Basic decryption using a public (not secret!) key. Used for general
7312	6324	* database obfuscation of passwords.
7313		- *
7314		- * @param string $secret String to encrypt.
7315		- * @param string $library Encryption lib to use (openssl).
7316		- * @return string Decrypted string
	6325	+ * @param $text String to encrypt.
	6326	+ * @param $library Encryption lib to use (openssl).
	6327	+ * @return Decrypted string
7317	6328	*/
7318		- private function decrypt( $secret, $library = 'openssl' ) {
	6329	+ function decrypt( $secret, $library = 'openssl' ) {
7319	6330	$result = '';
7320	6331
7321	6332	// Use openssl library (better) if it is enabled.
7322		- if ( function_exists( 'openssl_decrypt' ) && 'openssl' === $library ) {
	6333	+ if ( function_exists( 'openssl_decrypt' ) && $library === 'openssl' ) {
7323	6334	$result = openssl_decrypt(
7324	6335	base64_decode( $secret ),
7325	6336	'AES-256-CBC',
7326	6337	hash( 'sha256', self::$key ),
		@@ -7326,18 +6337,19 @@
7326	6337	hash( 'sha256', self::$key ),
7327	6338	0,
7328	6339	substr( hash( 'sha256', self::$iv ), 0, 16 )
7329	6340	);
7330		- } elseif ( function_exists( 'mcrypt_decrypt' ) ) { // Use mcrypt library (deprecated in PHP 7.1) if php5-mcrypt extension is enabled.
	6341	+ // Use mcrypt library (deprecated in PHP 7.1) if php5-mcrypt extension is enabled.
	6342	+ } else if ( function_exists( 'mcrypt_decrypt' ) ) {
7331	6343	$secret = base64_decode( $secret );
7332	6344	$result = rtrim( mcrypt_decrypt( MCRYPT_RIJNDAEL_256, self::$key, $secret, MCRYPT_MODE_ECB, 'abcdefghijklmnopqrstuvwxyz012345' ), "\0$result" );
7333		- } else { // Fall back to basic obfuscation.
	6345	+ // Fall back to basic obfuscation.
	6346	+ } else {
7334	6347	$secret = base64_decode( $secret );
7335		- $length = strlen( $secret );
7336		- for ( $i = 0; $i < $length; $i++ ) {
7337		- $char = substr( $secret, $i, 1 );
	6348	+ for ( $i = 0; $i < strlen( $secret ); $i++ ) {
	6349	+ $char = substr( $secret, $i, 1 );
7338	6350	$keychar = substr( self::$key, ( $i % strlen( self::$key ) ) - 1, 1 );
7339		- $char = chr( ord( $char ) - ord( $keychar ) );
	6351	+ $char = chr( ord( $char ) - ord( $keychar ) );
7340	6352	$result .= $char;
7341	6353	}
7342	6354	}
7343	6355
		@@ -7348,12 +6360,10 @@
7348	6360	/**
7349	6361	* In a multisite environment, returns true if the current user is logged
7350	6362	* in and a user of the current blog. In single site mode, simply returns
7351	6363	* true if the current user is logged in.
7352		- *
7353		- * @return bool Whether current user is logged in and a user of the current blog.
7354	6364	*/
7355		- protected function is_user_logged_in_and_blog_user() {
	6365	+ function is_user_logged_in_and_blog_user() {
7356	6366	$is_user_logged_in_and_blog_user = false;
7357	6367	if ( is_multisite() ) {
7358	6368	$is_user_logged_in_and_blog_user = is_user_logged_in() && is_user_member_of_blog( get_current_user_id() );
7359	6369	} else {
		@@ -7366,57 +6376,39 @@
7366	6376	/**
7367	6377	* Helper function to determine whether a given email is in one of
7368	6378	* the lists (pending, approved, blocked). Defaults to the list of
7369	6379	* approved users.
7370		- *
7371		- * @param string $email Email to check existent of.
7372		- * @param string $list List to look for email in.
7373		- * @param string $multisite_mode Admin context.
7374		- * @return boolean Whether email was found.
7375	6380	*/
7376		- protected function is_email_in_list( $email = '', $list = 'approved', $multisite_mode = 'single' ) {
7377		- if ( empty( $email ) ) {
	6381	+ function is_email_in_list( $email = '', $list = 'approved', $multisite_mode = 'single' ) {
	6382	+ if ( empty( $email ) )
7378	6383	return false;
7379		- }
7380	6384
7381	6385	switch ( $list ) {
7382		- case 'pending':
7383		- $auth_settings_access_users_pending = $this->get_plugin_option( 'access_users_pending', WP_Plugin_Authorizer::SINGLE_CONTEXT );
7384		- return $this->in_multi_array( $email, $auth_settings_access_users_pending );
7385		- case 'blocked':
7386		- $auth_settings_access_users_blocked = $this->get_plugin_option( 'access_users_blocked', WP_Plugin_Authorizer::SINGLE_CONTEXT );
7387		- // Blocked list can have wildcard matches, e.g., @baddomain.com, which
7388		- // should match any email address at that domain. Check if any wildcards
7389		- // exist, and if the email address has that domain.
7390		- $email_in_blocked_domain = false;
7391		- $blocked_domains = preg_grep( '/^@.*/', array_map(
7392		- function ( $blocked_item ) { return $blocked_item['email']; },
7393		- $auth_settings_access_users_blocked
7394		- ) );
7395		- foreach ( $blocked_domains as $blocked_domain ) {
7396		- $email_domain = substr( $email, strrpos( $email, '@' ) );
7397		- if ( $email_domain === $blocked_domain ) {
7398		- $email_in_blocked_domain = true;
7399		- break;
7400		- }
7401		- }
7402		- return $email_in_blocked_domain || $this->in_multi_array( $email, $auth_settings_access_users_blocked );
7403		- case 'approved':
7404		- default:
7405		- if ( 'single' !== $multisite_mode ) {
7406		- // Get multisite users only.
7407		- $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT );
7408		- } elseif ( is_multisite() && 1 === intval( $this->get_plugin_option( 'advanced_override_multisite' ) ) ) {
7409		- // This site has overridden any multisite settings, so only get its users.
7410		- $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT );
7411		- } else {
7412		- // Get all site users and all multisite users.
7413		- $auth_settings_access_users_approved = array_merge(
7414		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT ),
7415		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT )
7416		- );
7417		- }
7418		- return $this->in_multi_array( $email, $auth_settings_access_users_approved );
	6386	+ case 'pending':
	6387	+ $auth_settings_access_users_pending = $this->get_plugin_option( 'access_users_pending', SINGLE_ADMIN );
	6388	+ return $this->in_multi_array( $email, $auth_settings_access_users_pending );
	6389	+ break;
	6390	+ case 'blocked':
	6391	+ $auth_settings_access_users_blocked = $this->get_plugin_option( 'access_users_blocked', SINGLE_ADMIN );
	6392	+ return $this->in_multi_array( $email, $auth_settings_access_users_blocked );
	6393	+ break;
	6394	+ case 'approved':
	6395	+ default:
	6396	+ if ( $multisite_mode !== 'single' ) {
	6397	+ // Get multisite users only.
	6398	+ $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN );
	6399	+ } elseif ( is_multisite() && $this->get_plugin_option( 'advanced_override_multisite' ) == '1' ) {
	6400	+ // This site has overridden any multisite settings, so only get its users.
	6401	+ $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN );
	6402	+ } else {
	6403	+ // Get all site users and all multisite users.
	6404	+ $auth_settings_access_users_approved = array_merge(
	6405	+ $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN ),
	6406	+ $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN )
	6407	+ );
	6408	+ }
	6409	+ return $this->in_multi_array( $email, $auth_settings_access_users_approved );
	6410	+ break;
7419	6411	}
7420	6412	}
7421	6413
7422	6414
		@@ -7422,37 +6414,36 @@
7422	6414
7423	6415	/**
7424	6416	* Helper function to get number of users (including multisite users)
7425	6417	* in a given list (pending, approved, or blocked).
7426		- *
7427		- * @param string $list List to get count of.
7428		- * @param string $admin_mode WP_Plugin_Authorizer::SINGLE_CONTEXT or WP_Plugin_Authorizer::NETWORK_CONTEXT determines whether to include multisite users.
7429		- * @return int Number of users in list.
	6418	+ * @param string $list
	6419	+ * @param string $admin_mode SINGLE_ADMIN or MULTISITE_ADMIN determines whether to include multisite users
	6420	+ * @return int number of users in list
7430	6421	*/
7431		- protected function get_user_count_from_list( $list, $admin_mode = WP_Plugin_Authorizer::SINGLE_CONTEXT ) {
	6422	+ function get_user_count_from_list( $list, $admin_mode = SINGLE_ADMIN ) {
7432	6423	$auth_settings_access_users = array();
7433	6424
7434	6425	switch ( $list ) {
7435		- case 'pending':
7436		- $auth_settings_access_users = $this->get_plugin_option( 'access_users_pending', WP_Plugin_Authorizer::SINGLE_CONTEXT );
7437		- break;
7438		- case 'blocked':
7439		- $auth_settings_access_users = $this->get_plugin_option( 'access_users_blocked', WP_Plugin_Authorizer::SINGLE_CONTEXT );
7440		- break;
7441		- case 'approved':
7442		- if ( WP_Plugin_Authorizer::SINGLE_CONTEXT !== $admin_mode ) {
7443		- // Get multisite users only.
7444		- $auth_settings_access_users = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT );
7445		- } elseif ( is_multisite() && 1 === intval( $this->get_plugin_option( 'advanced_override_multisite' ) ) ) {
7446		- // This site has overridden any multisite settings, so only get its users.
7447		- $auth_settings_access_users = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT );
7448		- } else {
7449		- // Get all site users and all multisite users.
7450		- $auth_settings_access_users = array_merge(
7451		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT ),
7452		- $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT )
7453		- );
7454		- }
	6426	+ case 'pending':
	6427	+ $auth_settings_access_users = $this->get_plugin_option( 'access_users_pending', SINGLE_ADMIN );
	6428	+ break;
	6429	+ case 'blocked':
	6430	+ $auth_settings_access_users = $this->get_plugin_option( 'access_users_blocked', SINGLE_ADMIN );
	6431	+ break;
	6432	+ case 'approved':
	6433	+ if ( $admin_mode !== SINGLE_ADMIN ) {
	6434	+ // Get multisite users only.
	6435	+ $auth_settings_access_users = $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN );
	6436	+ } elseif ( is_multisite() && $this->get_plugin_option( 'advanced_override_multisite' ) == '1' ) {
	6437	+ // This site has overridden any multisite settings, so only get its users.
	6438	+ $auth_settings_access_users = $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN );
	6439	+ } else {
	6440	+ // Get all site users and all multisite users.
	6441	+ $auth_settings_access_users = array_merge(
	6442	+ $this->get_plugin_option( 'access_users_approved', SINGLE_ADMIN ),
	6443	+ $this->get_plugin_option( 'access_users_approved', MULTISITE_ADMIN )
	6444	+ );
	6445	+ }
7455	6446	}
7456	6447
7457	6448	return count( $auth_settings_access_users );
7458	6449	}
		@@ -7459,27 +6450,21 @@
7459	6450
7460	6451
7461	6452	/**
7462	6453	* Helper function to search a multidimensional array for a value.
7463		- *
7464		- * @param string $needle Value to search for.
7465		- * @param array $haystack Multidimensional array to search.
7466		- * @param string $strict_mode 'strict' if strict comparisons should be used.
7467		- * @param string $case_sensitivity 'case sensitive' if comparisons should respect case.
7468		- * @return bool Whether needle was found.
7469	6454	*/
7470		- protected function in_multi_array( $needle = '', $haystack = array(), $strict_mode = 'not strict', $case_sensitivity = 'case insensitive' ) {
	6455	+ function in_multi_array( $needle = '', $haystack = array(), $strict_mode = 'not strict', $case_sensitivity = 'case insensitive' ) {
7471	6456	if ( ! is_array( $haystack ) ) {
7472	6457	return false;
7473	6458	}
7474		- if ( 'case insensitive' === $case_sensitivity ) {
	6459	+ if ( $case_sensitivity === 'case insensitive' ) {
7475	6460	$needle = strtolower( $needle );
7476	6461	}
7477	6462	foreach ( $haystack as $item ) {
7478		- if ( 'case insensitive' === $case_sensitivity && ! is_array( $item ) ) {
	6463	+ if ( $case_sensitivity === 'case insensitive' && ! is_array( $item ) ) {
7479	6464	$item = strtolower( $item );
7480	6465	}
7481		- if ( ( 'strict' === $strict_mode ? $item === $needle : $item == $needle ) || ( is_array( $item ) && $this->in_multi_array( $needle, $item, $strict_mode, $case_sensitivity ) ) ) { // phpcs:ignore WordPress.PHP.StrictComparisons.LooseComparison
	6466	+ if ( ( $strict_mode === 'strict' ? $item === $needle : $item == $needle ) || ( is_array( $item ) && $this->in_multi_array( $needle, $item, $strict_mode, $case_sensitivity ) ) ) {
7482	6467	return true;
7483	6468	}
7484	6469	}
7485	6470	return false;
		@@ -7488,17 +6473,17 @@
7488	6473
7489	6474	/**
7490	6475	* Helper function to determine if an URL is accessible.
7491	6476	*
7492		- * @param string $url URL that should be publicly reachable.
7493		- * @return boolean Whether the URL is publicly reachable.
	6477	+ * @param string $url URL that should be publicly reachable
	6478	+ * @return boolean Whether the URL is publicly reachable
7494	6479	*/
7495		- protected function url_is_accessible( $url ) {
	6480	+ function url_is_accessible( $url ) {
7496	6481	// Use wp_remote_retrieve_response_code() to retrieve the URL.
7497		- $response = wp_remote_get( $url );
	6482	+ $response = wp_remote_get( $url );
7498	6483	$response_code = wp_remote_retrieve_response_code( $response );
7499	6484
7500		- // Return true if the document has loaded successfully without any redirection or error.
	6485	+ // Return true if the document has loaded successfully without any redirection or error
7501	6486	return $response_code >= 200 && $response_code < 400;
7502	6487	}
7503	6488
7504	6489
		@@ -7503,14 +6488,13 @@
7503	6488
7504	6489
7505	6490	/**
7506	6491	* Helper function to reconstruct a URL split using parse_url().
7507		- *
7508		- * @param array $parts Array returned from parse_url().
7509		- * @return string URL.
	6492	+ * @param array $parts Array returned from parse_url().
	6493	+ * @return string URL.
7510	6494	*/
7511		- protected function build_url( $parts = array() ) {
7512		- return (
	6495	+ function build_url( $parts = array() ) {
	6496	+ return
7513	6497	( isset( $parts['scheme'] ) ? "{$parts['scheme']}:" : '' ) .
7514	6498	( ( isset( $parts['user'] ) || isset( $parts['host'] ) ) ? '//' : '' ) .
7515	6499	( isset( $parts['user'] ) ? "{$parts['user']}" : '' ) .
7516	6500	( isset( $parts['pass'] ) ? ":{$parts['pass']}" : '' ) .
		@@ -7518,30 +6502,21 @@
7518	6502	( isset( $parts['host'] ) ? "{$parts['host']}" : '' ) .
7519	6503	( isset( $parts['port'] ) ? ":{$parts['port']}" : '' ) .
7520	6504	( isset( $parts['path'] ) ? "{$parts['path']}" : '' ) .
7521	6505	( isset( $parts['query'] ) ? "?{$parts['query']}" : '' ) .
7522		- ( isset( $parts['fragment'] ) ? "#{$parts['fragment']}" : '' )
7523		- );
	6506	+ ( isset( $parts['fragment'] ) ? "#{$parts['fragment']}" : '' );
7524	6507	}
7525	6508
7526	6509
7527		- /**
7528		- * Helper function that prints option tags for a select element for all
7529		- * roles the current user has permission to assign.
7530		- *
7531		- * @param string $selected_role Which role should be selected in the dropdown.
7532		- * @param string $disable_input 'disabled' if select element should be disabled.
7533		- * @param int $admin_mode WP_Plugin_Authorizer::NETWORK_CONTEXT if we are in that context.
7534		- * @return void
7535		- */
7536		- protected function wp_dropdown_permitted_roles( $selected_role = 'subscriber', $disable_input = 'not disabled', $admin_mode = WP_Plugin_Authorizer::SINGLE_CONTEXT ) {
7537		- $roles = get_editable_roles();
	6510	+ // Helper function that builds option tags for a select element for all
	6511	+ // roles the current user has permission to assign.
	6512	+ function wp_dropdown_permitted_roles( $selected_role = 'subscriber', $disable_input = 'not disabled', $admin_mode = SINGLE_ADMIN ) {
	6513	+ $roles = get_editable_roles();
7538	6514	$current_user = wp_get_current_user();
7539	6515
7540	6516	// If we're in network admin, also show any roles that might exist only on
7541	6517	// specific sites in the network (themes can add their own roles).
7542		- if ( WP_Plugin_Authorizer::NETWORK_CONTEXT === $admin_mode ) {
7543		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
	6518	+ if ( $admin_mode === MULTISITE_ADMIN ) {
7544	6519	$sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
7545	6520	foreach ( $sites as $site ) {
7546	6521	$blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
7547	6522	switch_to_blog( $blog_id );
		@@ -7550,11 +6525,11 @@
7550	6525	}
7551	6526	$unique_role_names = array();
7552	6527	foreach ( $roles as $role_name => $role_info ) {
7553	6528	if ( array_key_exists( $role_name, $unique_role_names ) ) {
7554		- unset( $roles[ $role_name ] );
	6529	+ unset( $roles[$role_name] );
7555	6530	} else {
7556		- $unique_role_names[ $role_name ] = true;
	6531	+ $unique_role_names[$role_name] = true;
7557	6532	}
7558	6533	}
7559	6534	}
7560	6535
		@@ -7566,41 +6541,37 @@
7566	6541	}
7567	6542
7568	6543	// Print an option element for each permitted role.
7569	6544	foreach ( $roles as $name => $role ) {
7570		- $is_selected = $selected_role === $name;
	6545	+ $selected = $selected_role === $name ? ' selected="selected"' : '';
7571	6546
7572		- // Don't let a user change their own role (but network admins always can).
7573		- $is_disabled = $selected_role !== $name && 'disabled' === $disable_input && ! ( is_multisite() && current_user_can( 'manage_network' ) );
7574		- ?>
7575		- <option value="<?php echo esc_attr( $name ); ?>"<?php selected( $is_selected ); ?><?php disabled( $is_disabled ); ?>><?php echo esc_html( $role['name'] ); ?></option>
7576		- <?php
	6547	+ // Don't let a user change their own role
	6548	+ $disabled = $selected_role !== $name && $disable_input === 'disabled' ? ' disabled="disabled"' : '';
	6549	+
	6550	+ // But network admins can always change their role.
	6551	+ if ( is_multisite() && current_user_can( 'manage_network' ) ) {
	6552	+ $disabled = '';
	6553	+ }
	6554	+
	6555	+ ?><option value="<?php echo $name; ?>"<?php echo $selected . $disabled; ?>><?php echo $role['name']; ?></option><?php
7577	6556	}
7578	6557
7579	6558	// Print default role (no role).
7580		- $is_selected = strlen( $selected_role ) === 0 || ! array_key_exists( $selected_role, $roles );
7581		- $is_disabled = strlen( $selected_role ) > 0 && 'disabled' === $disable_input && ! ( is_multisite() && current_user_can( 'manage_network' ) );
7582		- ?>
7583		- <option value=""<?php selected( $is_selected ); ?><?php disabled( $is_disabled ); ?>><?php esc_html_e( '&mdash; No role for this site &mdash;', 'authorizer' ); ?></option>
7584		- <?php
	6559	+ $selected = strlen( $selected_role ) == 0 || ! array_key_exists( $selected_role, $roles ) ? ' selected="selected"' : '';
	6560	+ $disabled = strlen( $selected_role ) > 0 && $disable_input === 'disabled' ? ' disabled="disabled"' : '';
	6561	+ if ( is_multisite() && current_user_can( 'manage_network' ) ) {
	6562	+ $disabled = '';
	6563	+ }
	6564	+ ?><option value=""<?php echo $selected . $disabled; ?>><?php _e( '&mdash; No role for this site &mdash;', 'authorizer' ); ?></option><?php
7585	6565
7586	6566	}
7587	6567
7588	6568
7589		- /**
7590		- * Helper function to get a single user info array from one of the access
7591		- * control lists (pending, approved, or blocked).
7592		- *
7593		- * @param string $email Email address to retrieve info for.
7594		- * @param string $list List to get info from.
7595		- * @return mixed false if not found, otherwise: array(
7596		- * 'email' => '',
7597		- * 'role' => '',
7598		- * 'date_added' => '',
7599		- * ['usermeta' => [''|array()]]
7600		- * );
7601		- */
7602		- protected function get_user_info_from_list( $email, $list ) {
	6569	+ // Helper function to get a single user info array from one of the
	6570	+ // access control lists (pending, approved, or blocked).
	6571	+ // Returns: false if not found; otherwise
	6572	+ // array( 'email' => '', 'role' => '', 'date_added' => '', ['usermeta' => [''|array()]] );
	6573	+ function get_user_info_from_list( $email, $list ) {
7603	6574	foreach ( $list as $user_info ) {
7604	6575	if ( 0 === strcasecmp( $user_info['email'], $email ) ) {
7605	6576	return $user_info;
7606	6577	}
		@@ -7607,49 +6578,36 @@
7607	6578	}
7608	6579	return false;
7609	6580	}
7610	6581
7611		- /**
7612		- * Helper function to convert a string to lowercase. Prefers to use mb_strtolower,
7613		- * but will fall back to strtolower if the former is not available.
7614		- *
7615		- * @param string $string String to convert to lowercase.
7616		- * @return string Input in lowercase.
7617		- */
7618		- protected function lowercase( $string ) {
7619		- return function_exists( 'mb_strtolower' ) ? mb_strtolower( $string ) : strtolower( $string );
	6582	+ // Helper function to convert a string to lowercase. Prefers to use mb_strtolower,
	6583	+ // but will fall back to strtolower if the former is not available.
	6584	+ // Returns: string in lowercase
	6585	+ function lowercase( $string ) {
	6586	+ return function_exists( "mb_strtolower" ) ? mb_strtolower( $string ) : strtolower( $string );
7620	6587	}
7621	6588
7622	6589
7623		- /**
7624		- * Helper function to convert seconds to human readable text.
7625		- *
7626		- * @see: http://csl.name/php-secs-to-human-text/
7627		- *
7628		- * @param int $secs Seconds to display as readable text.
7629		- * @return string Readable version of number of seconds.
7630		- */
7631		- protected function seconds_as_sentence( $secs ) {
	6590	+ // Helper function to convert seconds to human readable text.
	6591	+ // Source: http://csl.name/php-secs-to-human-text/
	6592	+ function seconds_as_sentence( $secs ) {
7632	6593	$units = array(
7633		- 'week' => 3600 * 24 * 7,
7634		- 'day' => 3600 * 24,
7635		- 'hour' => 3600,
7636		- 'minute' => 60,
7637		- 'second' => 1,
	6594	+ "week" => 7 * 24 * 3600,
	6595	+ "day" => 24 * 3600,
	6596	+ "hour" => 3600,
	6597	+ "minute" => 60,
	6598	+ "second" => 1,
7638	6599	);
7639	6600
7640		- // Specifically handle zero.
7641		- if ( 0 === intval( $secs ) ) {
7642		- return '0 seconds';
7643		- }
	6601	+ // specifically handle zero
	6602	+ if ( $secs == 0 ) return "0 seconds";
7644	6603
7645		- $s = '';
	6604	+ $s = "";
7646	6605
7647	6606	foreach ( $units as $name => $divisor ) {
7648		- $quot = intval( $secs / $divisor );
7649		- if ( $quot ) {
7650		- $s .= "$quot $name";
7651		- $s .= ( abs( $quot ) > 1 ? 's' : '' ) . ', ';
	6607	+ if ( $quot = intval( $secs / $divisor ) ) {
	6608	+ $s .= "$quot $name";
	6609	+ $s .= ( abs( $quot ) > 1 ? "s" : "" ) . ", ";
7652	6610	$secs -= $quot * $divisor;
7653	6611	}
7654	6612	}
7655	6613
		@@ -7655,14 +6613,10 @@
7655	6613
7656	6614	return substr( $s, 0, -2 );
7657	6615	}
7658	6616
7659		- /**
7660		- * Helper function to get all available usermeta keys as an array.
7661		- *
7662		- * @return array All usermeta keys for user.
7663		- */
7664		- protected function get_all_usermeta_keys() {
	6617	+ // Helper function to get all available usermeta keys as an array.
	6618	+ function get_all_usermeta_keys() {
7665	6619	global $wpdb;
7666	6620	$usermeta_keys = $wpdb->get_col( "SELECT DISTINCT $wpdb->usermeta.meta_key FROM $wpdb->usermeta" );
7667	6621	return $usermeta_keys;
7668	6622	}
		@@ -7669,12 +6623,10 @@
7669	6623
7670	6624
7671	6625	/**
7672	6626	* Load translated strings from *.mo files in /languages.
7673		- *
7674		- * Action: plugins_loaded
7675	6627	*/
7676		- public function load_textdomain() {
	6628	+ function load_textdomain() {
7677	6629	load_plugin_textdomain(
7678	6630	'authorizer',
7679	6631	false,
7680	6632	plugin_basename( dirname( __FILE__ ) ) . '/languages'
		@@ -7685,17 +6637,14 @@
7685	6637	/**
7686	6638	* Generate CAS authentication URL (wp-login.php URL with reauth=1 removed
7687	6639	* and external=cas added).
7688	6640	*/
7689		- private function modify_current_url_for_cas_login() {
	6641	+ function modify_current_url_for_cas_login() {
7690	6642	// Construct the URL of the current page (wp-login.php).
7691		- $url = '';
7692		- if ( isset( $_SERVER['HTTP_HOST'], $_SERVER['REQUEST_URI'] ) ) {
7693		- $url = set_url_scheme( esc_url_raw( wp_unslash( $_SERVER['HTTP_HOST'] ) ) . esc_url_raw( wp_unslash( $_SERVER['REQUEST_URI'] ) ) );
7694		- }
	6643	+ $url = 'http' . ( isset( $_SERVER['HTTPS'] ) ? 's' : '' ) . '://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
7695	6644
7696	6645	// Parse the URL into its components.
7697		- $parsed_url = wp_parse_url( $url );
	6646	+ $parsed_url = parse_url( $url );
7698	6647
7699	6648	// Fix up the querystring values (remove reauth, make sure external=cas).
7700	6649	$querystring = array();
7701	6650	if ( array_key_exists( 'query', $parsed_url ) ) {
		@@ -7702,9 +6651,9 @@
7702	6651	parse_str( $parsed_url['query'], $querystring );
7703	6652	}
7704	6653	unset( $querystring['reauth'] );
7705	6654	$querystring['external'] = 'cas';
7706		- $parsed_url['query'] = http_build_query( $querystring );
	6655	+ $parsed_url['query'] = http_build_query( $querystring );
7707	6656
7708	6657	// Return the URL as a string.
7709	6658	return $this->unparse_url( $parsed_url );
7710	6659	}
		@@ -7711,21 +6660,20 @@
7711	6660
7712	6661
7713	6662	/**
7714	6663	* Reconstruct a URL after it has been deconstructed with parse_url().
7715		- *
7716		- * @param array $parsed_url Keys from parse_url().
7717		- * @return string URL constructed from the components in $parsed_url.
	6664	+ * @param $parsed_url array() with keys from parse_url().
	6665	+ * @return string URL constructed from the components in $parsed_url.
7718	6666	*/
7719		- protected function unparse_url( $parsed_url = array() ) {
7720		- $scheme = isset( $parsed_url['scheme'] ) ? $parsed_url['scheme'] . '://' : '';
7721		- $host = isset( $parsed_url['host'] ) ? $parsed_url['host'] : '';
7722		- $port = isset( $parsed_url['port'] ) ? ':' . $parsed_url['port'] : '';
7723		- $user = isset( $parsed_url['user'] ) ? $parsed_url['user'] : '';
7724		- $pass = isset( $parsed_url['pass'] ) ? ':' . $parsed_url['pass'] : '';
7725		- $pass = $user || $pass ? "$pass@" : '';
7726		- $path = isset( $parsed_url['path'] ) ? $parsed_url['path'] : '';
7727		- $query = isset( $parsed_url['query'] ) ? '?' . $parsed_url['query'] : '';
	6667	+ function unparse_url( $parsed_url = array() ) {
	6668	+ $scheme = isset( $parsed_url['scheme'] ) ? $parsed_url['scheme'] . '://' : '';
	6669	+ $host = isset( $parsed_url['host'] ) ? $parsed_url['host'] : '';
	6670	+ $port = isset( $parsed_url['port'] ) ? ':' . $parsed_url['port'] : '';
	6671	+ $user = isset( $parsed_url['user'] ) ? $parsed_url['user'] : '';
	6672	+ $pass = isset( $parsed_url['pass'] ) ? ':' . $parsed_url['pass'] : '';
	6673	+ $pass = $user || $pass ? "$pass@" : '';
	6674	+ $path = isset( $parsed_url['path'] ) ? $parsed_url['path'] : '';
	6675	+ $query = isset( $parsed_url['query'] ) ? '?' . $parsed_url['query'] : '';
7728	6676	$fragment = isset( $parsed_url['fragment'] ) ? '#' . $parsed_url['fragment'] : '';
7729	6677	return "$scheme$user$pass$host$port$path$query$fragment";
7730	6678	}
7731	6679
		@@ -7732,24 +6680,20 @@
7732	6680
7733	6681	/**
7734	6682	* Helper function to generate an HTML class name for an option (used in
7735	6683	* Authorizer Settings in the Approved User list).
7736		- *
7737		- * @param string $suffix Unique part of class name.
7738		- * @param boolean $is_multisite_user Whether the class name should indicate it's a multisite user.
7739		- * @return string Class name, e.g., "auth-email auth-multisite-email".
	6684	+ * @param string $suffix Unique part of class name
	6685	+ * @param boolean $is_multisite_user Whether the class name should indicate it's a multisite user
	6686	+ * @return string Class name, e.g., "auth-email auth-multisite-email"
7740	6687	*/
7741		- private function create_class_name( $suffix = '', $is_multisite_user = false ) {
	6688	+ function create_class_name( $suffix = '', $is_multisite_user = false ) {
7742	6689	return $is_multisite_user ? "auth-$suffix auth-multisite-$suffix" : "auth-$suffix";
7743	6690	}
7744	6691
7745		-
7746	6692	/**
7747	6693	* Plugin Update Routines.
7748		- *
7749		- * Action: plugins_loaded
7750	6694	*/
7751		- public function auth_update_check() {
	6695	+ function auth_update_check() {
7752	6696	// Get current version.
7753	6697	$needs_updating = false;
7754	6698	if ( is_multisite() ) {
7755	6699	$auth_version = get_blog_option( $this->current_site_blog_id, 'auth_version' );
		@@ -7765,9 +6709,9 @@
7765	6709	// log in; approved and blocked lists are changed whenever an admin
7766	6710	// changes them from the multisite panel, the dashboard widget, or
7767	6711	// the plugin options page.
7768	6712	$update_if_older_than = 20140709;
7769		- if ( false === $auth_version || intval( $auth_version ) < $update_if_older_than ) {
	6713	+ if ( $auth_version === false || intval( $auth_version ) < $update_if_older_than ) {
7770	6714	// Copy single site user lists to new options (if they exist).
7771	6715	$auth_settings = get_option( 'auth_settings' );
7772	6716	if ( is_array( $auth_settings ) && array_key_exists( 'access_users_pending', $auth_settings ) ) {
7773	6717	update_option( 'auth_settings_access_users_pending', $auth_settings['access_users_pending'] );
		@@ -7803,9 +6747,9 @@
7803	6747	update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings', $auth_multisite_settings );
7804	6748	}
7805	6749	}
7806	6750	// Update version to reflect this change has been made.
7807		- $auth_version = $update_if_older_than;
	6751	+ $auth_version = $update_if_older_than;
7808	6752	$needs_updating = true;
7809	6753	}
7810	6754
7811	6755	// Update: Set default values for newly added options (forgot to do
		@@ -7811,13 +6755,12 @@
7811	6755	// Update: Set default values for newly added options (forgot to do
7812	6756	// this, so some users are getting debug log notices about undefined
7813	6757	// indexes in $auth_settings).
7814	6758	$update_if_older_than = 20160831;
7815		- if ( false === $auth_version || intval( $auth_version ) < $update_if_older_than ) {
	6759	+ if ( $auth_version === false || intval( $auth_version ) < $update_if_older_than ) {
7816	6760	// Provide default values for any $auth_settings options that don't exist.
7817	6761	if ( is_multisite() ) {
7818		- // Get all blog ids.
7819		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
	6762	+ // Get all blog ids
7820	6763	$sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
7821	6764	foreach ( $sites as $site ) {
7822	6765	$blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
7823	6766	switch_to_blog( $blog_id );
		@@ -7822,9 +6765,9 @@
7822	6765	$blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
7823	6766	switch_to_blog( $blog_id );
7824	6767	// Set meaningful defaults for other sites in the network.
7825	6768	$this->set_default_options();
7826		- // Switch back to original blog.
	6769	+ // Switch back to original blog. See: https://codex.wordpress.org/Function_Reference/restore_current_blog
7827	6770	restore_current_blog();
7828	6771	}
7829	6772	} else {
7830	6773	// Set meaningful defaults for this site.
		@@ -7830,9 +6773,9 @@
7830	6773	// Set meaningful defaults for this site.
7831	6774	$this->set_default_options();
7832	6775	}
7833	6776	// Update version to reflect this change has been made.
7834		- $auth_version = $update_if_older_than;
	6777	+ $auth_version = $update_if_older_than;
7835	6778	$needs_updating = true;
7836	6779	}
7837	6780
7838	6781	// Update: Migrate LDAP passwords encrypted with mcrypt since mcrypt is
		@@ -7837,18 +6780,17 @@
7837	6780
7838	6781	// Update: Migrate LDAP passwords encrypted with mcrypt since mcrypt is
7839	6782	// deprecated as of PHP 7.1. Use openssl library instead.
7840	6783	$update_if_older_than = 20170510;
7841		- if ( false === $auth_version || intval( $auth_version ) < $update_if_older_than ) {
	6784	+ if ( $auth_version === false || intval( $auth_version ) < $update_if_older_than ) {
7842	6785	if ( is_multisite() ) {
7843	6786	// Reencrypt LDAP passwords in each site in the network.
7844		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
7845	6787	$sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
7846	6788	foreach ( $sites as $site ) {
7847		- $blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
	6789	+ $blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
7848	6790	$auth_settings = get_blog_option( $blog_id, 'auth_settings', array() );
7849	6791	if ( array_key_exists( 'ldap_password', $auth_settings ) && strlen( $auth_settings['ldap_password'] ) > 0 ) {
7850		- $plaintext_ldap_password = $this->decrypt( $auth_settings['ldap_password'], 'mcrypt' );
	6792	+ $plaintext_ldap_password = $this->decrypt( $auth_settings['ldap_password'], 'mcrypt' );
7851	6793	$auth_settings['ldap_password'] = $this->encrypt( $plaintext_ldap_password );
7852	6794	update_blog_option( $blog_id, 'auth_settings', $auth_settings );
7853	6795	}
7854	6796	}
		@@ -7855,15 +6797,15 @@
7855	6797	} else {
7856	6798	// Reencrypt LDAP password on this single-site install.
7857	6799	$auth_settings = get_option( 'auth_settings', array() );
7858	6800	if ( array_key_exists( 'ldap_password', $auth_settings ) && strlen( $auth_settings['ldap_password'] ) > 0 ) {
7859		- $plaintext_ldap_password = $this->decrypt( $auth_settings['ldap_password'], 'mcrypt' );
	6801	+ $plaintext_ldap_password = $this->decrypt( $auth_settings['ldap_password'], 'mcrypt' );
7860	6802	$auth_settings['ldap_password'] = $this->encrypt( $plaintext_ldap_password );
7861	6803	update_option( 'auth_settings', $auth_settings );
7862	6804	}
7863	6805	}
7864	6806	// Update version to reflect this change has been made.
7865		- $auth_version = $update_if_older_than;
	6807	+ $auth_version = $update_if_older_than;
7866	6808	$needs_updating = true;
7867	6809	}
7868	6810
7869	6811	// Update: Migrate LDAP passwords encrypted with mcrypt since mcrypt is
		@@ -7869,20 +6811,20 @@
7869	6811	// Update: Migrate LDAP passwords encrypted with mcrypt since mcrypt is
7870	6812	// deprecated as of PHP 7.1. Use openssl library instead.
7871	6813	// Note: Forgot to update the auth_multisite_settings ldap password! Do it here.
7872	6814	$update_if_older_than = 20170511;
7873		- if ( false === $auth_version || intval( $auth_version ) < $update_if_older_than ) {
	6815	+ if ( $auth_version === false || intval( $auth_version ) < $update_if_older_than ) {
7874	6816	if ( is_multisite() ) {
7875	6817	// Reencrypt LDAP password in network (multisite) options.
7876	6818	$auth_multisite_settings = get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings', array() );
7877	6819	if ( array_key_exists( 'ldap_password', $auth_multisite_settings ) && strlen( $auth_multisite_settings['ldap_password'] ) > 0 ) {
7878		- $plaintext_ldap_password = $this->decrypt( $auth_multisite_settings['ldap_password'], 'mcrypt' );
	6820	+ $plaintext_ldap_password = $this->decrypt( $auth_multisite_settings['ldap_password'], 'mcrypt' );
7879	6821	$auth_multisite_settings['ldap_password'] = $this->encrypt( $plaintext_ldap_password );
7880	6822	update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings', $auth_multisite_settings );
7881	6823	}
7882	6824	}
7883	6825	// Update version to reflect this change has been made.
7884		- $auth_version = $update_if_older_than;
	6826	+ $auth_version = $update_if_older_than;
7885	6827	$needs_updating = true;
7886	6828	}
7887	6829
7888	6830	// Update: Remove duplicates from approved list caused by authorizer_automatically_approve_login
		@@ -7888,24 +6830,23 @@
7888	6830	// Update: Remove duplicates from approved list caused by authorizer_automatically_approve_login
7889	6831	// filter not respecting users who are already in the approved list
7890	6832	// (causing them to get re-added each time they logged in).
7891	6833	$update_if_older_than = 20170711;
7892		- if ( false === $auth_version || intval( $auth_version ) < $update_if_older_than ) {
	6834	+ if ( $auth_version === false || intval( $auth_version ) < $update_if_older_than ) {
7893	6835	// Remove duplicates from approved user lists.
7894	6836	if ( is_multisite() ) {
7895		- // Remove duplicates from each site in the multisite.
7896		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
	6837	+ // Remove duplicates from each site in the multisite
7897	6838	$sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
7898	6839	foreach ( $sites as $site ) {
7899		- $blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
	6840	+ $blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
7900	6841	$auth_settings_access_users_approved = get_blog_option( $blog_id, 'auth_settings_access_users_approved', array() );
7901	6842	if ( is_array( $auth_settings_access_users_approved ) ) {
7902		- $should_update = false;
	6843	+ $should_update = false;
7903	6844	$distinct_emails = array();
7904	6845	foreach ( $auth_settings_access_users_approved as $key => $user ) {
7905		- if ( in_array( $user['email'], $distinct_emails, true ) ) {
	6846	+ if ( in_array( $user['email'], $distinct_emails ) ) {
7906	6847	$should_update = true;
7907		- unset( $auth_settings_access_users_approved[ $key ] );
	6848	+ unset( $auth_settings_access_users_approved[$key] );
7908	6849	} else {
7909	6850	$distinct_emails[] = $user['email'];
7910	6851	}
7911	6852	}
		@@ -7916,14 +6857,14 @@
7916	6857	}
7917	6858	// Remove duplicates from multisite approved user list.
7918	6859	$auth_multisite_settings_access_users_approved = get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', array() );
7919	6860	if ( is_array( $auth_multisite_settings_access_users_approved ) ) {
7920		- $should_update = false;
	6861	+ $should_update = false;
7921	6862	$distinct_emails = array();
7922	6863	foreach ( $auth_multisite_settings_access_users_approved as $key => $user ) {
7923		- if ( in_array( $user['email'], $distinct_emails, true ) ) {
	6864	+ if ( in_array( $user['email'], $distinct_emails ) ) {
7924	6865	$should_update = true;
7925		- unset( $auth_multisite_settings_access_users_approved[ $key ] );
	6866	+ unset( $auth_multisite_settings_access_users_approved[$key] );
7926	6867	} else {
7927	6868	$distinct_emails[] = $user['email'];
7928	6869	}
7929	6870	}
		@@ -7934,14 +6875,14 @@
7934	6875	} else {
7935	6876	// Remove duplicates from single site approved user list.
7936	6877	$auth_settings_access_users_approved = get_option( 'auth_settings_access_users_approved' );
7937	6878	if ( is_array( $auth_settings_access_users_approved ) ) {
7938		- $should_update = false;
	6879	+ $should_update = false;
7939	6880	$distinct_emails = array();
7940	6881	foreach ( $auth_settings_access_users_approved as $key => $user ) {
7941		- if ( in_array( $user['email'], $distinct_emails, true ) ) {
	6882	+ if ( in_array( $user['email'], $distinct_emails ) ) {
7942	6883	$should_update = true;
7943		- unset( $auth_settings_access_users_approved[ $key ] );
	6884	+ unset( $auth_settings_access_users_approved[$key] );
7944	6885	} else {
7945	6886	$distinct_emails[] = $user['email'];
7946	6887	}
7947	6888	}
		@@ -7950,18 +6891,17 @@
7950	6891	}
7951	6892	}
7952	6893	}
7953	6894	// Update version to reflect this change has been made.
7954		- $auth_version = $update_if_older_than;
	6895	+ $auth_version = $update_if_older_than;
7955	6896	$needs_updating = true;
7956	6897	}
7957	6898
7958	6899	// Update: Set default value for newly added option advanced_widget_enabled.
7959	6900	$update_if_older_than = 20171023;
7960		- if ( false === $auth_version || intval( $auth_version ) < $update_if_older_than ) {
	6901	+ if ( $auth_version === false || intval( $auth_version ) < $update_if_older_than ) {
7961	6902	// Provide default values for any $auth_settings options that don't exist.
7962	6903	if ( is_multisite() ) {
7963		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
7964	6904	$sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
7965	6905	foreach ( $sites as $site ) {
7966	6906	$blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
7967	6907	switch_to_blog( $blog_id );
		@@ -7971,18 +6911,17 @@
7971	6911	} else {
7972	6912	$this->set_default_options();
7973	6913	}
7974	6914	// Update version to reflect this change has been made.
7975		- $auth_version = $update_if_older_than;
	6915	+ $auth_version = $update_if_older_than;
7976	6916	$needs_updating = true;
7977	6917	}
7978	6918
7979	6919	// Update: Set default value for newly added option advanced_users_per_page.
7980	6920	$update_if_older_than = 20171215;
7981		- if ( false === $auth_version || intval( $auth_version ) < $update_if_older_than ) {
	6921	+ if ( $auth_version === false || intval( $auth_version ) < $update_if_older_than ) {
7982	6922	// Provide default values for any $auth_settings options that don't exist.
7983	6923	if ( is_multisite() ) {
7984		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
7985	6924	$sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
7986	6925	foreach ( $sites as $site ) {
7987	6926	$blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
7988	6927	switch_to_blog( $blog_id );
		@@ -7992,18 +6931,17 @@
7992	6931	} else {
7993	6932	$this->set_default_options();
7994	6933	}
7995	6934	// Update version to reflect this change has been made.
7996		- $auth_version = $update_if_older_than;
	6935	+ $auth_version = $update_if_older_than;
7997	6936	$needs_updating = true;
7998	6937	}
7999	6938
8000	6939	// Update: Set default value for newly added options advanced_users_sort_by and advanced_users_sort_order.
8001	6940	$update_if_older_than = 20171219;
8002		- if ( false === $auth_version || intval( $auth_version ) < $update_if_older_than ) {
	6941	+ if ( $auth_version === false || intval( $auth_version ) < $update_if_older_than ) {
8003	6942	// Provide default values for any $auth_settings options that don't exist.
8004	6943	if ( is_multisite() ) {
8005		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
8006	6944	$sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
8007	6945	foreach ( $sites as $site ) {
8008	6946	$blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
8009	6947	switch_to_blog( $blog_id );
		@@ -8013,27 +6951,24 @@
8013	6951	} else {
8014	6952	$this->set_default_options();
8015	6953	}
8016	6954	// Update version to reflect this change has been made.
8017		- $auth_version = $update_if_older_than;
	6955	+ $auth_version = $update_if_older_than;
8018	6956	$needs_updating = true;
8019	6957	}
8020	6958
8021		- /*
8022		- // Update: TEMPLATE
8023		- $update_if_older_than = YYYYMMDD;
8024		- if ( $auth_version === false || intval( $auth_version ) < $update_if_older_than ) {
8025		- UPDATE CODE HERE
8026		- // Update version to reflect this change has been made.
8027		- $auth_version = $update_if_older_than;
8028		- $needs_updating = true;
8029		- }
8030		- */
	6959	+ // // Update: TEMPLATE
	6960	+ // $update_if_older_than = YYYYMMDD;
	6961	+ // if ( $auth_version === false || intval( $auth_version ) < $update_if_older_than ) {
	6962	+ // UPDATE CODE HERE
	6963	+ // // Update version to reflect this change has been made.
	6964	+ // $auth_version = $update_if_older_than;
	6965	+ // $needs_updating = true;
	6966	+ // }
8031	6967
8032	6968	// Save new version number if we performed any updates.
8033	6969	if ( $needs_updating ) {
8034	6970	if ( is_multisite() ) {
8035		- // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
8036	6971	$sites = function_exists( 'get_sites' ) ? get_sites() : wp_get_sites( array( 'limit' => PHP_INT_MAX ) );
8037	6972	foreach ( $sites as $site ) {
8038	6973	$blog_id = function_exists( 'get_sites' ) ? $site->blog_id : $site['blog_id'];
8039	6974	update_blog_option( $blog_id, 'auth_version', $auth_version );