PluginProbe
Authorizer / 2.8.0
Authorizer v2.8.0
3.15.3 3.15.2 3.15.1 3.15.0 3.14.3 3.14.4 3.14.2 3.14.1 2.8.1 2.8.2 2.8.3 2.8.4 2.8.5 2.8.6 2.8.7 2.8.8 2.9.0 2.9.1 2.9.10 2.9.11 2.9.12 2.9.13 2.9.2 2.9.3 2.9.6 All 126 releases
← All changes | authorizer.php +101 -164 2.8.6 → 2.8.0 View file →
@@ -6,9 +6,9 @@
6 6 * Plugin URI: https://github.com/uhm-coe/authorizer
7 7 * Text Domain: authorizer
8 8 * Domain Path: /languages
9 9 * License: GPL2
10 - * Version: 2.8.6
10 + * Version: 2.8.0
11 11 *
12 12 * @package authorizer
13 13 */
14 14
@@ -23,9 +23,9 @@
23 23 *
24 24 * @see https://wiki.jasig.org/display/CASC/phpCAS+installation+guide
25 25 */
26 26 if ( ! defined( 'PHPCAS_VERSION' ) ) {
27 - require_once dirname( __FILE__ ) . '/vendor/phpCAS-1.3.6/CAS.php';
27 + require_once dirname( __FILE__ ) . '/vendor/CAS-1.3.5/CAS.php';
28 28 }
29 29
30 30
31 31 if ( ! class_exists( 'WP_Plugin_Authorizer' ) ) {
@@ -43,9 +43,9 @@
43 43 /**
44 44 * Constants for determining our admin context (network or individual site).
45 45 */
46 46 const NETWORK_CONTEXT = 'multisite_admin';
47 - const SINGLE_CONTEXT = 'single_admin';
47 + const SINGLE_CONTEXT = 'single_admin';
48 48
49 49 /**
50 50 * Current site ID (Multisite).
51 51 *
@@ -264,18 +264,22 @@
264 264 * Will also activate the plugin for all sites/blogs if this is a "Network enable."
265 265 *
266 266 * @return void
267 267 */
268 - public function activate( $network_wide ) {
268 + public function activate() {
269 269 global $wpdb;
270 270
271 - // If we're in a multisite environment, run the plugin activation for each
272 - // site when network enabling.
273 - // Note: wp-cli does not use nonces, so we skip the nonce check here to
274 - // allow the "wp plugin activate authorizer" command.
275 - // phpcs:ignore WordPress.CSRF.NonceVerification.NoNonceVerification
276 - if ( is_multisite() && $network_wide ) {
271 + // Nonce check.
272 + if (
273 + ! isset( $_REQUEST['_wpnonce'], $_REQUEST['plugin'] ) ||
274 + ! wp_verify_nonce( sanitize_key( $_REQUEST['_wpnonce'] ), 'activate-plugin_' . sanitize_text_field( wp_unslash( $_REQUEST['plugin'] ) ) )
275 + ) {
276 + die( '' );
277 + }
277 278
279 + // If we're in a multisite environment, run the plugin activation for each site when network enabling.
280 + if ( is_multisite() && isset( $_GET['networkwide'] ) && 1 === intval( $_GET['networkwide'] ) ) {
281 +
278 282 // Add super admins to the multisite approved list.
279 283 $auth_multisite_settings_access_users_approved = get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', array() );
280 284 $should_update_auth_multisite_settings_access_users_approved = false;
281 285 foreach ( get_super_admins() as $super_admin ) {
@@ -586,9 +590,9 @@
586 590 if ( is_wp_error( $result ) || 0 === $result ) {
587 591 return $result;
588 592 }
589 593
590 - // If we have a valid user from check_user_access(), log that user in.
594 + // If we created a new user in check_user_access(), log that user in.
591 595 if ( get_class( $result ) === 'WP_User' ) {
592 596 $user = $result;
593 597 }
594 598
@@ -609,12 +613,13 @@
609 613 * @param WP_User $user User to check.
610 614 * @param array $user_emails Array of user's plaintext emails (in case current user doesn't have a WP account).
611 615 * @param array $user_data Array of keys for email, username, first_name, last_name,
612 616 * authenticated_by, google_attributes, cas_attributes, ldap_attributes.
613 - * @return WP_Error|void|WP_User
617 + * @return WP_Error|void|null|WP_User
614 618 * WP_Error if there was an error on user creation / adding user to blog.
615 619 * wp_die() if user does not have access.
616 - * WP_User if user has access.
620 + * null if user has access (success).
621 + * WP_User if user has access and a new account was created for them.
617 622 */
618 623 private function check_user_access( $user, $user_emails, $user_data = array() ) {
619 624 // Grab plugin settings.
620 625 $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
@@ -720,9 +725,9 @@
720 725 // If this externally authenticated user is an existing administrator
721 726 // (administrator in single site mode, or super admin in network mode),
722 727 // and is not in the blocked list, let them in.
723 728 if ( $user && is_super_admin( $user->ID ) ) {
724 - return $user;
729 + return;
725 730 }
726 731
727 732 // If this externally authenticated user isn't in the approved list
728 733 // and login access is set to "All authenticated users," or if they were
@@ -1288,9 +1293,9 @@
1288 1293 // Set the CAS service URL (including the redirect URL for WordPress when it comes back from CAS).
1289 1294 $cas_service_url = site_url( '/wp-login.php?external=cas' );
1290 1295 $login_querystring = array();
1291 1296 if ( isset( $_SERVER['QUERY_STRING'] ) ) {
1292 - parse_str( $_SERVER['QUERY_STRING'], $login_querystring ); // phpcs:ignore WordPress.VIP.ValidatedSanitizedInput
1297 + parse_str( wp_parse_url( esc_url_raw( wp_unslash( $_SERVER['QUERY_STRING'] ) ), PHP_URL_HOST ), $login_querystring );
1293 1298 }
1294 1299 if ( isset( $login_querystring['redirect_to'] ) ) {
1295 1300 $cas_service_url .= '&redirect_to=' . rawurlencode( $login_querystring['redirect_to'] );
1296 1301 }
@@ -1721,25 +1726,25 @@
1721 1726 // Note that GET requests to a rest endpoint will be restricted by authorizer. In that case, error messages will be returned as JSON.
1722 1727 );
1723 1728
1724 1729 /**
1725 - * Developers can use the `authorizer_has_access` filter to override
1726 - * restricted access on certain pages. Note that the restriction checks
1727 - * happens before WordPress executes any queries, so use the $wp variable
1728 - * to investigate what the visitor is trying to load.
1730 + * Developers can use the `authorizer_has_access` filter
1731 + * to override restricted access on certain pages. Note that the
1732 + * restriction checks happens before WordPress executes any queries, so
1733 + * use the global `$wp` variable to investigate what the visitor is
1734 + * trying to load.
1729 1735 *
1730 1736 * For example, to unblock an RSS feed, place the following PHP code in
1731 1737 * the theme's functions.php file or in a simple plug-in:
1732 1738 *
1733 - * function my_feed_access_override( $has_access, $wp ) {
1734 - * // Check query variables to see if this is the feed.
1735 - * if ( ! empty( $wp->query_vars['feed'] ) ) {
1739 + * function my_rsa_feed_access_override( $has_access ) {
1740 + * global $wp;
1741 + * // check query variables to see if this is the feed
1742 + * if ( ! empty( $wp->query_vars['feed'] ) )
1736 1743 * $has_access = true;
1737 - * }
1738 - *
1739 1744 * return $has_access;
1740 1745 * }
1741 - * add_filter( 'authorizer_has_access', 'my_feed_access_override', 10, 2 );
1746 + * add_filter( 'authorizer_has_access', 'my_rsa_feed_access_override' );
1742 1747 */
1743 1748 if ( apply_filters( 'authorizer_has_access', $has_access, $wp ) === true ) {
1744 1749 // Turn off the public notice about browsing anonymously.
1745 1750 update_option( 'auth_settings_advanced_public_notice', false );
@@ -1938,9 +1943,9 @@
1938 1943 */
1939 1944 public function auth_public_scripts() {
1940 1945 // Load (and localize) public scripts.
1941 1946 $current_path = ! empty( $_SERVER['REQUEST_URI'] ) ? esc_url_raw( wp_unslash( $_SERVER['REQUEST_URI'] ) ) : home_url();
1942 - wp_enqueue_script( 'auth_public_scripts', plugins_url( '/js/authorizer-public.js', __FILE__ ), array( 'jquery' ), '2.8.0' );
1947 + wp_enqueue_script( 'auth_public_scripts', plugins_url( '/js/authorizer-public.js', __FILE__ ), array( 'jquery' ), '2.3.2' );
1943 1948 $auth_localized = array(
1944 1949 'wpLoginUrl' => wp_login_url( $current_path ),
1945 1950 'publicWarning' => get_option( 'auth_settings_advanced_public_notice' ),
1946 1951 'anonymousNotice' => $this->get_plugin_option( 'access_redirect_to_message' ),
@@ -1948,9 +1953,9 @@
1948 1953 );
1949 1954 wp_localize_script( 'auth_public_scripts', 'auth', $auth_localized );
1950 1955
1951 1956 // Load public css.
1952 - wp_register_style( 'authorizer-public-css', plugins_url( 'css/authorizer-public.css', __FILE__ ), array(), '2.8.0' );
1957 + wp_register_style( 'authorizer-public-css', plugins_url( 'css/authorizer-public.css', __FILE__ ), array(), '2.3.2' );
1953 1958 wp_enqueue_style( 'authorizer-public-css' );
1954 1959 }
1955 1960
1956 1961
@@ -1965,12 +1970,12 @@
1965 1970 // Grab plugin settings.
1966 1971 $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
1967 1972
1968 1973 // Enqueue scripts appearing on wp-login.php.
1969 - wp_enqueue_script( 'auth_login_scripts', plugins_url( '/js/authorizer-login.js', __FILE__ ), array( 'jquery' ), '2.8.0' );
1974 + wp_enqueue_script( 'auth_login_scripts', plugins_url( '/js/authorizer-login.js', __FILE__ ), array( 'jquery' ), '2.3.2' );
1970 1975
1971 1976 // Enqueue styles appearing on wp-login.php.
1972 - wp_register_style( 'authorizer-login-css', plugins_url( '/css/authorizer-login.css', __FILE__ ), array(), '2.8.0' );
1977 + wp_register_style( 'authorizer-login-css', plugins_url( '/css/authorizer-login.css', __FILE__ ), array(), '2.3.2' );
1973 1978 wp_enqueue_style( 'authorizer-login-css' );
1974 1979
1975 1980 /**
1976 1981 * Developers can use the `authorizer_add_branding_option` filter
@@ -1995,10 +2000,10 @@
1995 2000 if ( ! ( is_array( $branding_option ) && array_key_exists( 'value', $branding_option ) && array_key_exists( 'css_url', $branding_option ) && array_key_exists( 'js_url', $branding_option ) ) ) {
1996 2001 continue;
1997 2002 }
1998 2003 if ( $auth_settings['advanced_branding'] === $branding_option['value'] ) {
1999 - wp_enqueue_script( 'auth_login_custom_scripts-' . sanitize_title( $branding_option['value'] ), $branding_option['js_url'], array( 'jquery' ), '2.8.0' );
2000 - wp_register_style( 'authorizer-login-custom-css-' . sanitize_title( $branding_option['value'] ), $branding_option['css_url'], array(), '2.8.0' );
2004 + wp_enqueue_script( 'auth_login_custom_scripts-' . sanitize_title( $branding_option['value'] ), $branding_option['js_url'], array( 'jquery' ), '2.3.2' );
2005 + wp_register_style( 'authorizer-login-custom-css-' . sanitize_title( $branding_option['value'] ), $branding_option['css_url'], array(), '2.3.2' );
2001 2006 wp_enqueue_style( 'authorizer-login-custom-css-' . sanitize_title( $branding_option['value'] ) );
2002 2007 }
2003 2008 }
2004 2009
@@ -2003,9 +2008,9 @@
2003 2008 }
2004 2009
2005 2010 // If we're using Google logins, load those resources.
2006 2011 if ( '1' === $auth_settings['google'] ) {
2007 - wp_enqueue_script( 'authorizer-login-custom-google', plugins_url( '/js/authorizer-login-custom_google.js', __FILE__ ), array( 'jquery' ), '2.8.0' ); ?>
2012 + wp_enqueue_script( 'authorizer-login-custom-google', plugins_url( '/js/authorizer-login-custom_google.js', __FILE__ ), array( 'jquery' ), '2.3.2' ); ?>
2008 2013 <meta name="google-signin-clientid" content="<?php echo esc_attr( $auth_settings['google_clientid'] ); ?>" />
2009 2014 <meta name="google-signin-scope" content="email" />
2010 2015 <meta name="google-signin-cookiepolicy" content="single_host_origin" />
2011 2016 <?php
@@ -2119,9 +2124,9 @@
2119 2124 </span>
2120 2125 </a></p>
2121 2126 <?php endif; ?>
2122 2127
2123 - <?php if ( '1' === $auth_settings['advanced_hide_wp_login'] && isset( $_SERVER['QUERY_STRING'] ) && false === strpos( $_SERVER['QUERY_STRING'], 'external=wordpress' ) ) : // phpcs:ignore WordPress.VIP.ValidatedSanitizedInput ?>
2128 + <?php if ( '1' === $auth_settings['advanced_hide_wp_login'] && isset( $_SERVER['QUERY_STRING'] ) && false === strpos( wp_parse_url( esc_url_raw( wp_unslash( $_SERVER['QUERY_STRING'] ) ), PHP_URL_HOST ), 'external=wordpress' ) ) : ?>
2124 2129 <style type="text/css">
2125 2130 body.login-action-login form {
2126 2131 padding-bottom: 8px;
2127 2132 }
@@ -2161,9 +2166,9 @@
2161 2166
2162 2167 // Check whether we should redirect to CAS.
2163 2168 if (
2164 2169 isset( $_SERVER['QUERY_STRING'] ) &&
2165 - strpos( $_SERVER['QUERY_STRING'], 'external=wordpress' ) === false && // phpcs:ignore WordPress.VIP.ValidatedSanitizedInput
2170 + strpos( wp_parse_url( esc_url_raw( wp_unslash( $_SERVER['QUERY_STRING'] ) ), PHP_URL_HOST ), 'external=wordpress' ) === false &&
2166 2171 array_key_exists( 'cas_auto_login', $auth_settings ) && '1' === $auth_settings['cas_auto_login'] &&
2167 2172 array_key_exists( 'cas', $auth_settings ) && '1' === $auth_settings['cas'] &&
2168 2173 ( ! array_key_exists( 'ldap', $auth_settings ) || '1' !== $auth_settings['ldap'] ) &&
2169 2174 ( ! array_key_exists( 'google', $auth_settings ) || '1' !== $auth_settings['google'] ) &&
@@ -2398,9 +2403,9 @@
2398 2403 public function load_options_page() {
2399 2404 wp_enqueue_script(
2400 2405 'authorizer',
2401 2406 plugins_url( 'js/authorizer.js', __FILE__ ),
2402 - array( 'jquery-effects-shake' ), '2.8.6', true
2407 + array( 'jquery-effects-shake' ), '2.7.2', true
2403 2408 );
2404 2409 wp_localize_script(
2405 2410 'authorizer', 'authL10n', array(
2406 2411 'baseurl' => get_bloginfo( 'url' ),
@@ -2484,12 +2489,12 @@
2484 2489 $auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
2485 2490
2486 2491 if ( '1' === $auth_settings['cas'] ) :
2487 2492 // Check if provided CAS URL is accessible.
2488 - $protocol = in_array( strval( $auth_settings['cas_port'] ), array( '80', '8080' ), true ) ? 'http' : 'https';
2489 - $cas_url = $protocol . '://' . $auth_settings['cas_host'] . ':' . $auth_settings['cas_port'] . $auth_settings['cas_path'];
2493 + $protocol = in_array( strval( $auth_settings['cas_port'] ), array( '80', '8080' ), true ) ? 'http' : 'https';
2494 + $cas_url = $protocol . '://' . $auth_settings['cas_host'] . ':' . $auth_settings['cas_port'] . $auth_settings['cas_path'];
2490 2495 $legacy_cas_url = trailingslashit( $cas_url ) . 'login'; // Check the specific CAS login endpoint (old; some servers don't register a ./login endpoint, use serviceValidate instead).
2491 - $cas_url = trailingslashit( $cas_url ) . 'serviceValidate'; // Check the specific CAS login endpoint.
2496 + $cas_url = trailingslashit( $cas_url ) . 'serviceValidate'; // Check the specific CAS login endpoint.
2492 2497 if ( ! $this->url_is_accessible( $cas_url ) && ! $this->url_is_accessible( $legacy_cas_url ) ) :
2493 2498 $authorizer_options_url = 'settings' === $auth_settings['advanced_admin_menu'] ? admin_url( 'options-general.php?page=authorizer' ) : admin_url( '?page=authorizer' );
2494 2499 ?>
2495 2500 <div class='notice notice-warning is-dismissible'>
@@ -3636,9 +3641,9 @@
3636 3641 <p><?php esc_html_e( 'Manage who has access to this site using these lists.', 'authorizer' ); ?></p>
3637 3642 <ol>
3638 3643 <li><?php echo wp_kses( __( "<strong>Pending</strong> users are users who have successfully logged in to the site, but who haven't yet been approved (or blocked) by you.", 'authorizer' ), $this->allowed_html ); ?></li>
3639 3644 <li><?php echo wp_kses( __( '<strong>Approved</strong> users have access to the site once they successfully log in.', 'authorizer' ), $this->allowed_html ); ?></li>
3640 - <li><?php echo wp_kses( __( '<strong>Blocked</strong> users will receive an error message when they try to visit the site after authenticating.', 'authorizer' ), $this->allowed_html ); ?><br><?php esc_html_e( 'Note: if you want to block all email addresses from a domain, say anyone@example.com, simply add "@example.com" to the blocked list.', 'authorizer' ); ?></li>
3645 + <li><?php echo wp_kses( __( '<strong>Blocked</strong> users will receive an error message when they try to visit the site after authenticating.', 'authorizer' ), $this->allowed_html ); ?></li>
3641 3646 </ol>
3642 3647 </div>
3643 3648 <table class="form-table">
3644 3649 <tbody>
@@ -6236,15 +6241,19 @@
6236 6241 }
6237 6242 } elseif ( 'remove' === $pending_user['edit_action'] ) {
6238 6243
6239 6244 // Remove user from pending list and save.
6240 - $auth_settings_access_users_pending = $this->get_plugin_option( 'access_users_pending', WP_Plugin_Authorizer::SINGLE_CONTEXT );
6241 - foreach ( $auth_settings_access_users_pending as $key => $existing_user ) {
6242 - if ( 0 === strcasecmp( $pending_user['email'], $existing_user['email'] ) ) {
6243 - unset( $auth_settings_access_users_pending[ $key ] );
6244 - update_option( 'auth_settings_access_users_pending', $auth_settings_access_users_pending );
6245 - break;
6245 + if ( $this->is_email_in_list( $pending_user['email'], 'pending' ) ) {
6246 + $auth_settings_access_users_pending = $this->sanitize_user_list(
6247 + $this->get_plugin_option( 'access_users_pending', WP_Plugin_Authorizer::SINGLE_CONTEXT )
6248 + );
6249 + foreach ( $auth_settings_access_users_pending as $key => $existing_user ) {
6250 + if ( 0 === strcasecmp( $pending_user['email'], $existing_user['email'] ) ) {
6251 + unset( $auth_settings_access_users_pending[ $key ] );
6252 + break;
6253 + }
6246 6254 }
6255 + update_option( 'auth_settings_access_users_pending', $auth_settings_access_users_pending );
6247 6256 }
6248 6257 }
6249 6258 }
6250 6259 }
@@ -6369,39 +6378,47 @@
6369 6378 }
6370 6379 }
6371 6380 } elseif ( 'remove' === $approved_user['edit_action'] ) { // Remove user from approved list and save (also remove their role if they have a WordPress account).
6372 6381 if ( 'false' !== $approved_user['multisite_user'] ) {
6373 - $auth_multisite_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT );
6374 - foreach ( $auth_multisite_settings_access_users_approved as $key => $existing_user ) {
6375 - if ( 0 === strcasecmp( $approved_user['email'], $existing_user['email'] ) ) {
6376 - // Remove role of the associated WordPress user from all blogs (but don't delete the user).
6377 - $user = get_user_by( 'email', $approved_user['email'] );
6378 - if ( false !== $user ) {
6379 - // Loop through all of the blogs this user is a member of and remove their capabilities.
6380 - foreach ( get_blogs_of_user( $user->ID ) as $blog ) {
6381 - remove_user_from_blog( $user->ID, $blog->userblog_id, '' );
6382 + if ( $this->is_email_in_list( $approved_user['email'], 'approved', 'multisite' ) ) {
6383 + $auth_multisite_settings_access_users_approved = $this->sanitize_user_list(
6384 + $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::NETWORK_CONTEXT )
6385 + );
6386 + foreach ( $auth_multisite_settings_access_users_approved as $key => $existing_user ) {
6387 + if ( 0 === strcasecmp( $approved_user['email'], $existing_user['email'] ) ) {
6388 + // Remove role of the associated WordPress user from all blogs (but don't delete the user).
6389 + $user = get_user_by( 'email', $approved_user['email'] );
6390 + if ( false !== $user ) {
6391 + // Loop through all of the blogs this user is a member of and remove their capabilities.
6392 + foreach ( get_blogs_of_user( $user->ID ) as $blog ) {
6393 + remove_user_from_blog( $user->ID, $blog->userblog_id, '' );
6394 + }
6382 6395 }
6396 + // Remove entry from Approved Users list.
6397 + unset( $auth_multisite_settings_access_users_approved[ $key ] );
6398 + break;
6383 6399 }
6384 - // Remove entry from Approved Users list.
6385 - unset( $auth_multisite_settings_access_users_approved[ $key ] );
6386 - update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
6387 - break;
6388 6400 }
6401 + update_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved );
6389 6402 }
6390 6403 } else {
6391 - $auth_settings_access_users_approved = $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT );
6392 - foreach ( $auth_settings_access_users_approved as $key => $existing_user ) {
6393 - if ( 0 === strcasecmp( $approved_user['email'], $existing_user['email'] ) ) {
6394 - // Remove role of the associated WordPress user (but don't delete the user).
6395 - $user = get_user_by( 'email', $approved_user['email'] );
6396 - if ( false !== $user ) {
6397 - $user->set_role( '' );
6404 + if ( $this->is_email_in_list( $approved_user['email'], 'approved' ) ) {
6405 + $auth_settings_access_users_approved = $this->sanitize_user_list(
6406 + $this->get_plugin_option( 'access_users_approved', WP_Plugin_Authorizer::SINGLE_CONTEXT )
6407 + );
6408 + foreach ( $auth_settings_access_users_approved as $key => $existing_user ) {
6409 + if ( 0 === strcasecmp( $approved_user['email'], $existing_user['email'] ) ) {
6410 + // Remove role of the associated WordPress user (but don't delete the user).
6411 + $user = get_user_by( 'email', $approved_user['email'] );
6412 + if ( false !== $user ) {
6413 + $user->set_role( '' );
6414 + }
6415 + // Remove entry from Approved Users list.
6416 + unset( $auth_settings_access_users_approved[ $key ] );
6417 + break;
6398 6418 }
6399 - // Remove entry from Approved Users list.
6400 - unset( $auth_settings_access_users_approved[ $key ] );
6401 - update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved );
6402 - break;
6403 6419 }
6420 + update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved );
6404 6421 }
6405 6422 }
6406 6423 } elseif ( 'change_role' === $approved_user['edit_action'] ) { // Update user's role in WordPress.
6407 6424 $changed_user = get_user_by( 'email', $approved_user['email'] );
@@ -6451,14 +6468,9 @@
6451 6468 if ( 'access_users_blocked' === $_POST['setting'] ) {
6452 6469 // Sanitize post data.
6453 6470 $access_users_blocked = array();
6454 6471 if ( isset( $_POST['access_users_blocked'] ) && is_array( $_POST['access_users_blocked'] ) ) {
6455 - $access_users_blocked = $this->sanitize_update_auth_users(
6456 - wp_unslash( $_POST['access_users_blocked'] ),
6457 - array(
6458 - 'allow_wildcard_email' => true,
6459 - )
6460 - );
6472 + $access_users_blocked = $this->sanitize_update_auth_users( wp_unslash( $_POST['access_users_blocked'] ) );
6461 6473 }
6462 6474
6463 6475 // Deal with each modified user (add or remove).
6464 6476 foreach ( $access_users_blocked as $blocked_user ) {
@@ -6491,15 +6503,19 @@
6491 6503 delete_user_meta( $unblocked_user->ID, 'auth_blocked', 'yes' );
6492 6504 }
6493 6505
6494 6506 // Remove user from blocked list and save.
6495 - $auth_settings_access_users_blocked = $this->get_plugin_option( 'access_users_blocked', WP_Plugin_Authorizer::SINGLE_CONTEXT );
6496 - foreach ( $auth_settings_access_users_blocked as $key => $existing_user ) {
6497 - if ( 0 === strcasecmp( $blocked_user['email'], $existing_user['email'] ) ) {
6498 - unset( $auth_settings_access_users_blocked[ $key ] );
6499 - update_option( 'auth_settings_access_users_blocked', $auth_settings_access_users_blocked );
6500 - break;
6507 + if ( $this->is_email_in_list( $blocked_user['email'], 'blocked' ) ) {
6508 + $auth_settings_access_users_blocked = $this->sanitize_user_list(
6509 + $this->get_plugin_option( 'access_users_blocked', WP_Plugin_Authorizer::SINGLE_CONTEXT )
6510 + );
6511 + foreach ( $auth_settings_access_users_blocked as $key => $existing_user ) {
6512 + if ( 0 === strcasecmp( $blocked_user['email'], $existing_user['email'] ) ) {
6513 + unset( $auth_settings_access_users_blocked[ $key ] );
6514 + break;
6515 + }
6501 6516 }
6517 + update_option( 'auth_settings_access_users_blocked', $auth_settings_access_users_blocked );
6502 6518 }
6503 6519 }
6504 6520 }
6505 6521 }
@@ -6531,39 +6547,21 @@
6531 6547 * ...
6532 6548 * )
6533 6549 *
6534 6550 * @param array $users Users to edit.
6535 - * @param array $args Options (e.g., 'allow_wildcard_email' => true).
6536 6551 * @return array Sanitized users to edit.
6537 6552 */
6538 - private function sanitize_update_auth_users( $users = array(), $args = array() ) {
6553 + private function sanitize_update_auth_users( $users = array() ) {
6539 6554 if ( ! is_array( $users ) ) {
6540 6555 $users = array();
6541 6556 }
6542 - if ( isset( $args['allow_wildcard_email'] ) && $args['allow_wildcard_email'] ) {
6543 - $users = array_map( array( $this, 'sanitize_update_auth_user_allow_wildcard_email' ), $users );
6544 - } else {
6545 - $users = array_map( array( $this, 'sanitize_update_auth_user' ), $users );
6546 - }
6557 + $users = array_map( array( $this, 'sanitize_update_auth_user' ), $users );
6547 6558
6548 - // Remove any entries that failed email address validation.
6549 - $users = array_filter( $users, array( $this, 'remove_invalid_auth_users' ) );
6550 -
6551 6559 return $users;
6552 6560 }
6553 6561
6554 6562
6555 6563 /**
6556 - * This array filter will remove any users who failed email address validation
6557 - * (which would set their email to a blank string).
6558 - * @param array $user User data to check for a valid email.
6559 - * @return bool Whether to filter out the user.
6560 - */
6561 - private function remove_invalid_auth_users( $user ) {
6562 - return isset( $user['email'] ) && strlen( $user['email'] ) > 0;
6563 - }
6564 -
6565 - /**
6566 6564 * Callback for array_map in sanitize_update_auth_users().
6567 6565 *
6568 6566 * @param array $user User data to sanitize.
6569 6567 * @return array Sanitized user data.
@@ -6593,43 +6591,8 @@
6593 6591
6594 6592
6595 6593
6596 6594 /**
6597 - * Callback for array_map in sanitize_update_auth_users().
6598 - *
6599 - * @param array $user User data to sanitize.
6600 - * @return array Sanitized user data.
6601 - */
6602 - private function sanitize_update_auth_user_allow_wildcard_email( $user ) {
6603 - if ( array_key_exists( 'edit_action', $user ) ) {
6604 - $user['edit_action'] = sanitize_text_field( $user['edit_action'] );
6605 - }
6606 - if ( isset( $user['email'] ) ) {
6607 - if ( strpos( $user['email'], '@' ) === 0 ) {
6608 - $user['email'] = sanitize_text_field( $user['email'] );
6609 - } else {
6610 - $user['email'] = sanitize_email( $user['email'] );
6611 - }
6612 - }
6613 - if ( isset( $user['role'] ) ) {
6614 - $user['role'] = sanitize_text_field( $user['role'] );
6615 - }
6616 - if ( isset( $user['date_added'] ) ) {
6617 - $user['date_added'] = sanitize_text_field( $user['date_added'] );
6618 - }
6619 - if ( isset( $user['local_user'] ) ) {
6620 - $user['local_user'] = 'true' === $user['local_user'] ? 'true' : 'false';
6621 - }
6622 - if ( isset( $user['multisite_user'] ) ) {
6623 - $user['multisite_user'] = 'true' === $user['multisite_user'] ? 'true' : 'false';
6624 - }
6625 -
6626 - return $user;
6627 - }
6628 -
6629 -
6630 -
6631 - /**
6632 6595 * ***************************
6633 6596 * Helper functions
6634 6597 * ***************************
6635 6598 */
@@ -7035,20 +6998,9 @@
7035 6998 // Get default role if one isn't specified.
7036 6999 if ( count( $default_role ) < 1 ) {
7037 7000 $default_role = '';
7038 7001 } else {
7039 - // If default role was provided, it came from the invite_user hook, and
7040 - // only contains the role's display name. Here we look up the actual role
7041 - // name to save (and default to no role if the display name isn't found).
7042 - global $wp_roles;
7043 - $default_role_display_name = $default_role['name'];
7044 - $default_role = '';
7045 - foreach ( $wp_roles->role_names as $role_name => $display_name ) {
7046 - if ( $default_role_display_name === $display_name ) {
7047 - $default_role = $role_name;
7048 - break;
7049 - }
7050 - }
7002 + $default_role = strtolower( $default_role['name'] );
7051 7003 }
7052 7004
7053 7005 $updated = false;
7054 7006
@@ -7383,24 +7335,9 @@
7383 7335 $auth_settings_access_users_pending = $this->get_plugin_option( 'access_users_pending', WP_Plugin_Authorizer::SINGLE_CONTEXT );
7384 7336 return $this->in_multi_array( $email, $auth_settings_access_users_pending );
7385 7337 case 'blocked':
7386 7338 $auth_settings_access_users_blocked = $this->get_plugin_option( 'access_users_blocked', WP_Plugin_Authorizer::SINGLE_CONTEXT );
7387 - // Blocked list can have wildcard matches, e.g., @baddomain.com, which
7388 - // should match any email address at that domain. Check if any wildcards
7389 - // exist, and if the email address has that domain.
7390 - $email_in_blocked_domain = false;
7391 - $blocked_domains = preg_grep( '/^@.*/', array_map(
7392 - function ( $blocked_item ) { return $blocked_item['email']; },
7393 - $auth_settings_access_users_blocked
7394 - ) );
7395 - foreach ( $blocked_domains as $blocked_domain ) {
7396 - $email_domain = substr( $email, strrpos( $email, '@' ) );
7397 - if ( $email_domain === $blocked_domain ) {
7398 - $email_in_blocked_domain = true;
7399 - break;
7400 - }
7401 - }
7402 - return $email_in_blocked_domain || $this->in_multi_array( $email, $auth_settings_access_users_blocked );
7339 + return $this->in_multi_array( $email, $auth_settings_access_users_blocked );
7403 7340 case 'approved':
7404 7341 default:
7405 7342 if ( 'single' !== $multisite_mode ) {
7406 7343 // Get multisite users only.