| @@ -36,8 +36,9 @@ | ||
| 36 | 36 | 'title' => array(), |
| 37 | 37 | ), |
| 38 | 38 | 'b' => array(), |
| 39 | 39 | 'br' => array(), |
| 40 | + 'code' => array(), | |
| 40 | 41 | 'div' => array( |
| 41 | 42 | 'class' => array(), |
| 42 | 43 | ), |
| 43 | 44 | 'em' => array(), |
| @@ -68,15 +69,8 @@ | ||
| 68 | 69 | 'strong' => array(), |
| 69 | 70 | ); |
| 70 | 71 | |
| 71 | 72 | /** |
| 72 | - * Generate a unique cookie to add to nonces to prevent CSRF. | |
| 73 | - * | |
| 74 | - * @var string | |
| 75 | - */ | |
| 76 | - protected static $cookie_value = null; | |
| 77 | - | |
| 78 | - /** | |
| 79 | 73 | * Encryption key (not secret!). |
| 80 | 74 | * |
| 81 | 75 | * @var string |
| 82 | 76 | */ |
| @@ -110,25 +104,8 @@ | ||
| 110 | 104 | } |
| 111 | 105 | |
| 112 | 106 | |
| 113 | 107 | /** |
| 114 | - * Retrieve the unique login cookie. | |
| 115 | - * | |
| 116 | - * @return string Login cookie value. | |
| 117 | - */ | |
| 118 | - public static function get_cookie_value() { | |
| 119 | - if ( ! self::$cookie_value ) { | |
| 120 | - if ( isset( $_COOKIE['login_unique'] ) ) { | |
| 121 | - self::$cookie_value = sanitize_key( wp_unslash( $_COOKIE['login_unique'] ) ); | |
| 122 | - } else { | |
| 123 | - self::$cookie_value = md5( wp_rand() ); | |
| 124 | - } | |
| 125 | - } | |
| 126 | - return self::$cookie_value; | |
| 127 | - } | |
| 128 | - | |
| 129 | - | |
| 130 | - /** | |
| 131 | 108 | * Helper function to generate an HTML class name for an option (used in |
| 132 | 109 | * Authorizer Settings in the Approved User list). |
| 133 | 110 | * |
| 134 | 111 | * @param string $suffix Unique part of class name. |
| @@ -310,9 +287,8 @@ | ||
| 310 | 287 | $is_disabled = strlen( $selected_role ) > 0 && 'disabled' === $disable_input && ! ( is_multisite() && current_user_can( 'manage_network' ) ); |
| 311 | 288 | ?> |
| 312 | 289 | <option value=""<?php selected( $is_selected ); ?><?php disabled( $is_disabled ); ?>><?php esc_html_e( '— No role for this site —', 'authorizer' ); ?></option> |
| 313 | 290 | <?php |
| 314 | - | |
| 315 | 291 | } |
| 316 | 292 | |
| 317 | 293 | |
| 318 | 294 | /** |
| @@ -334,9 +310,9 @@ | ||
| 334 | 310 | foreach ( $haystack as $item ) { |
| 335 | 311 | if ( 'case insensitive' === $case_sensitivity && ! is_array( $item ) ) { |
| 336 | 312 | $item = strtolower( $item ); |
| 337 | 313 | } |
| 338 | - if ( ( 'strict' === $strict_mode ? $item === $needle : $item == $needle ) || ( is_array( $item ) && self::in_multi_array( $needle, $item, $strict_mode, $case_sensitivity ) ) ) { // phpcs:ignore WordPress.PHP.StrictComparisons.LooseComparison | |
| 314 | + if ( ( 'strict' === $strict_mode ? $item === $needle : $item == $needle ) || ( is_array( $item ) && self::in_multi_array( $needle, $item, $strict_mode, $case_sensitivity ) ) ) { // phpcs:ignore Universal.Operators.StrictComparisons.LooseEqual | |
| 339 | 315 | return true; |
| 340 | 316 | } |
| 341 | 317 | } |
| 342 | 318 | return false; |
| @@ -343,8 +319,29 @@ | ||
| 343 | 319 | } |
| 344 | 320 | |
| 345 | 321 | |
| 346 | 322 | /** |
| 323 | + * Helper function to discover the email addresses in a value in a | |
| 324 | + * multidimensional array. | |
| 325 | + * | |
| 326 | + * @param array $haystack Multidimensional array, possibly containing an email. | |
| 327 | + * @param array $emails Array of email addresses found. | |
| 328 | + * @return array Array of Discovered emails, or empty array. | |
| 329 | + */ | |
| 330 | + public static function find_emails_in_multi_array( $haystack, &$emails = array() ) { | |
| 331 | + if ( is_array( $haystack ) ) { | |
| 332 | + foreach ( $haystack as $key => $value ) { | |
| 333 | + self::find_emails_in_multi_array( $value, $emails ); | |
| 334 | + } | |
| 335 | + } elseif ( filter_var( $haystack, FILTER_VALIDATE_EMAIL ) ) { | |
| 336 | + $emails[] = $haystack; | |
| 337 | + } | |
| 338 | + | |
| 339 | + return $emails; | |
| 340 | + } | |
| 341 | + | |
| 342 | + | |
| 343 | + /** | |
| 347 | 344 | * Helper function to determine if an URL is accessible. |
| 348 | 345 | * |
| 349 | 346 | * @param string $url URL that should be publicly reachable. |
| 350 | 347 | * @return boolean Whether the URL is publicly reachable. |
| @@ -384,19 +381,19 @@ | ||
| 384 | 381 | /** |
| 385 | 382 | * Helper function to get a single user info array from one of the access |
| 386 | 383 | * control lists (pending, approved, or blocked). |
| 387 | 384 | * |
| 388 | - * @param string $email Email address to retrieve info for. | |
| 389 | - * @param string $list List to get info from. | |
| 390 | - * @return mixed false if not found, otherwise: array( | |
| 391 | - * 'email' => '', | |
| 392 | - * 'role' => '', | |
| 393 | - * 'date_added' => '', | |
| 394 | - * ['usermeta' => [''|array()]] | |
| 395 | - * ); | |
| 385 | + * @param string $email Email address to retrieve info for. | |
| 386 | + * @param array $user_info_list List to get info from. | |
| 387 | + * @return mixed false if not found, otherwise: array( | |
| 388 | + * 'email' => '', | |
| 389 | + * 'role' => '', | |
| 390 | + * 'date_added' => '', | |
| 391 | + * ['usermeta' => [''|array()]] | |
| 392 | + * ); | |
| 396 | 393 | */ |
| 397 | - public static function get_user_info_from_list( $email, $list ) { | |
| 398 | - foreach ( $list as $user_info ) { | |
| 394 | + public static function get_user_info_from_list( $email, $user_info_list ) { | |
| 395 | + foreach ( $user_info_list as $user_info ) { | |
| 399 | 396 | if ( 0 === strcasecmp( $user_info['email'], $email ) ) { |
| 400 | 397 | return $user_info; |
| 401 | 398 | } |
| 402 | 399 | } |
| @@ -406,13 +403,13 @@ | ||
| 406 | 403 | /** |
| 407 | 404 | * Helper function to convert a string to lowercase. Prefers to use mb_strtolower, |
| 408 | 405 | * but will fall back to strtolower if the former is not available. |
| 409 | 406 | * |
| 410 | - * @param string $string String to convert to lowercase. | |
| 411 | - * @return string Input in lowercase. | |
| 407 | + * @param string $str String to convert to lowercase. | |
| 408 | + * @return string Input in lowercase. | |
| 412 | 409 | */ |
| 413 | - public static function lowercase( $string ) { | |
| 414 | - return function_exists( 'mb_strtolower' ) ? mb_strtolower( $string ) : strtolower( $string ); | |
| 410 | + public static function lowercase( $str ) { | |
| 411 | + return function_exists( 'mb_strtolower' ) ? mb_strtolower( $str ) : strtolower( $str ); | |
| 415 | 412 | } |
| 416 | 413 | |
| 417 | 414 | |
| 418 | 415 | /** |
| @@ -452,12 +449,33 @@ | ||
| 452 | 449 | } |
| 453 | 450 | |
| 454 | 451 | |
| 455 | 452 | /** |
| 456 | - * Generate CAS authentication URL (wp-login.php URL with reauth=1 removed | |
| 457 | - * and external=cas added). | |
| 453 | + * Helper function to show a number as an ordinal (e.g., 5 as 5th). | |
| 454 | + * | |
| 455 | + * @see: https://stackoverflow.com/questions/3109978/display-numbers-with-ordinal-suffix-in-php | |
| 456 | + * | |
| 457 | + * @param int $number Number to show as an ordinal. | |
| 458 | + * @return string Number as an ordinal string. | |
| 458 | 459 | */ |
| 459 | - public static function modify_current_url_for_cas_login() { | |
| 460 | + public static function ordinal( $number = 0 ) { | |
| 461 | + $ends = array( 'th', 'st', 'nd', 'rd', 'th', 'th', 'th', 'th', 'th', 'th' ); | |
| 462 | + if ( $number % 100 >= 11 && $number % 100 <= 13 ) { | |
| 463 | + return $number . 'th'; | |
| 464 | + } else { | |
| 465 | + return $number . $ends[ $number % 10 ]; | |
| 466 | + } | |
| 467 | + } | |
| 468 | + | |
| 469 | + | |
| 470 | + /** | |
| 471 | + * Generate CAS/OAuth2/OIDC authentication URL (wp-login.php URL with reauth=1 | |
| 472 | + * removed and external=cas, external=oauth2, or external=oidc added). | |
| 473 | + * | |
| 474 | + * @param string $provider External service provider type (e.g., 'cas', 'oauth2', or 'oidc'). | |
| 475 | + * @param int $id CAS/OAuth2/OIDC server number (e.g., 1). | |
| 476 | + */ | |
| 477 | + public static function modify_current_url_for_external_login( $provider = 'cas', $id = 1 ) { | |
| 460 | 478 | // Construct the URL of the current page (wp-login.php). |
| 461 | 479 | $url = ''; |
| 462 | 480 | if ( isset( $_SERVER['HTTP_HOST'], $_SERVER['REQUEST_URI'] ) ) { |
| 463 | 481 | $url = set_url_scheme( esc_url_raw( wp_unslash( $_SERVER['HTTP_HOST'] ) ) . esc_url_raw( wp_unslash( $_SERVER['REQUEST_URI'] ) ) ); |
| @@ -462,19 +480,41 @@ | ||
| 462 | 480 | if ( isset( $_SERVER['HTTP_HOST'], $_SERVER['REQUEST_URI'] ) ) { |
| 463 | 481 | $url = set_url_scheme( esc_url_raw( wp_unslash( $_SERVER['HTTP_HOST'] ) ) . esc_url_raw( wp_unslash( $_SERVER['REQUEST_URI'] ) ) ); |
| 464 | 482 | } |
| 465 | 483 | |
| 484 | + // If we have a login form embedded elsewhere than wp-login.php, alter the | |
| 485 | + // URL to point to wp-login.php with a redirect to the current page. This | |
| 486 | + // will happen if the [authorizer_login_form] shortcode is used. | |
| 487 | + if ( false === strpos( $url, 'wp-login.php' ) ) { | |
| 488 | + $url = wp_login_url( $url ); | |
| 489 | + } | |
| 490 | + | |
| 491 | + // Edge case: If the WPS Hide Login plugin is installed, redirect to home | |
| 492 | + // page after logging in instead of the plugin's login endpoint, which will | |
| 493 | + // redirect to /wp-admin. | |
| 494 | + if ( class_exists( '\WPS\WPS_Hide_Login\Plugin' ) ) { | |
| 495 | + $url = wp_login_url( home_url() ); | |
| 496 | + } | |
| 497 | + | |
| 466 | 498 | // Parse the URL into its components. |
| 467 | 499 | $parsed_url = wp_parse_url( $url ); |
| 468 | 500 | |
| 469 | - // Fix up the querystring values (remove reauth, make sure external=cas). | |
| 501 | + // Fix up the querystring values (remove reauth; remove any code or state | |
| 502 | + // params from a previous oauth2 or oidc authentication attempt; set | |
| 503 | + // external={cas|oauth2|oidc}). | |
| 470 | 504 | $querystring = array(); |
| 471 | 505 | if ( array_key_exists( 'query', $parsed_url ) ) { |
| 472 | 506 | parse_str( $parsed_url['query'], $querystring ); |
| 473 | 507 | } |
| 474 | 508 | unset( $querystring['reauth'] ); |
| 475 | - $querystring['external'] = 'cas'; | |
| 476 | - $parsed_url['query'] = http_build_query( $querystring ); | |
| 509 | + unset( $querystring['code'] ); | |
| 510 | + unset( $querystring['state'] ); | |
| 511 | + $querystring['external'] = $provider; | |
| 512 | + // Use id parameter only for servers > 1. | |
| 513 | + if ( $id > 1 ) { | |
| 514 | + $querystring['id'] = $id; | |
| 515 | + } | |
| 516 | + $parsed_url['query'] = http_build_query( $querystring ); | |
| 477 | 517 | |
| 478 | 518 | // Return the URL as a string. |
| 479 | 519 | return self::unparse_url( $parsed_url ); |
| 480 | 520 | } |
| @@ -498,6 +538,5 @@ | ||
| 498 | 538 | $fragment = isset( $parsed_url['fragment'] ) ? '#' . $parsed_url['fragment'] : ''; |
| 499 | 539 | |
| 500 | 540 | return "$scheme$user$pass$host$port$path$query$fragment"; |
| 501 | 541 | } |
| 502 | - | |
| 503 | 542 | } |
