| @@ -22,15 +22,11 @@ | ||
| 22 | 22 | * don't have access. |
| 23 | 23 | * |
| 24 | 24 | * @param WP_User $user User to check. |
| 25 | 25 | * @param array $user_emails Array of user's plaintext emails (in case current user doesn't have a WP account). |
| 26 | - * @param array $user_data Array of keys for email, username, first_name, last_name, authenticated_by, | |
| 27 | - * and any of the following based on authentication method: | |
| 28 | - * google_attributes, | |
| 29 | - * cas_attributes, cas_server_id, | |
| 30 | - * ldap_attributes, | |
| 31 | - * oauth2_attributes, oauth2_provider, oauth2_server_id, | |
| 32 | - * oidc_attributes, oidc_server_id. | |
| 26 | + * @param array $user_data Array of keys for email, username, first_name, last_name, | |
| 27 | + * authenticated_by, google_attributes, cas_attributes, ldap_attributes, | |
| 28 | + * oauth2_attributes. | |
| 33 | 29 | * @return WP_Error|WP_User |
| 34 | 30 | * WP_Error if there was an error on user creation / adding user to blog. |
| 35 | 31 | * WP_Error / wp_die() if user does not have access. |
| 36 | 32 | * WP_User if user has access. |
| @@ -50,44 +46,39 @@ | ||
| 50 | 46 | $auth_settings_access_users_approved_multi |
| 51 | 47 | ) |
| 52 | 48 | ); |
| 53 | 49 | |
| 54 | - // If this is an existing user, update which external service authenticated | |
| 55 | - // them. | |
| 56 | - if ( $user && ! empty( $user_data['authenticated_by'] ) ) { | |
| 57 | - update_user_meta( $user->ID, 'authenticated_by', $user_data['authenticated_by'] ); | |
| 58 | - } | |
| 59 | - | |
| 60 | - // Get whether to update first/last name on login from the external service | |
| 61 | - // used to authenticate this user. | |
| 62 | - $attr_update_on_login = ''; | |
| 63 | - if ( ! empty( $user_data['authenticated_by'] ) ) { | |
| 64 | - $attr_update_on_login_key = ''; | |
| 65 | - if ( 'cas' === $user_data['authenticated_by'] ) { | |
| 66 | - $attr_update_on_login_key = empty( $user_data['cas_server_id'] ) || 1 === intval( $user_data['cas_server_id'] ) ? 'cas_attr_update_on_login' : 'cas_attr_update_on_login_' . $user_data['cas_server_id']; | |
| 67 | - } elseif ( 'ldap' === $user_data['authenticated_by'] ) { | |
| 68 | - $attr_update_on_login_key = 'ldap_attr_update_on_login'; | |
| 69 | - } elseif ( 'oauth2' === $user_data['authenticated_by'] ) { | |
| 70 | - $attr_update_on_login_key = empty( $user_data['oauth2_server_id'] ) || 1 === intval( $user_data['oauth2_server_id'] ) ? 'oauth2_attr_update_on_login' : 'oauth2_attr_update_on_login_' . $user_data['oauth2_server_id']; | |
| 71 | - } elseif ( 'oidc' === $user_data['authenticated_by'] ) { | |
| 72 | - $attr_update_on_login_key = empty( $user_data['oidc_server_id'] ) || 1 === intval( $user_data['oidc_server_id'] ) ? 'oidc_attr_update_on_login' : 'oidc_attr_update_on_login_' . $user_data['oidc_server_id']; | |
| 73 | - } | |
| 74 | - if ( ! empty( $attr_update_on_login_key ) ) { | |
| 75 | - $attr_update_on_login = ! empty( $auth_settings[ $attr_update_on_login_key ] ) ? $auth_settings[ $attr_update_on_login_key ] : ''; | |
| 76 | - } | |
| 77 | - } | |
| 78 | - | |
| 79 | 50 | // Detect whether this user's first and last name should be updated below |
| 80 | - // (if the external service provides a different value, the option is set to | |
| 81 | - // update it, and it's empty if the option to only set it if empty is | |
| 82 | - // enabled). | |
| 51 | + // (if the external CAS/LDAP service provides a different value, the option | |
| 52 | + // is set to update it, and it's empty if the option to only set it if empty | |
| 53 | + // is enabled). | |
| 83 | 54 | $should_update_first_name = |
| 84 | 55 | $user && ! empty( $user_data['first_name'] ) && $user_data['first_name'] !== $user->first_name && |
| 85 | - ( '1' === $attr_update_on_login || ( 'update-if-empty' === $attr_update_on_login && empty( $user->first_name ) ) ); | |
| 56 | + ( | |
| 57 | + ( | |
| 58 | + ! empty( $user_data['authenticated_by'] ) && 'cas' === $user_data['authenticated_by'] && | |
| 59 | + ! empty( $auth_settings['cas_attr_update_on_login'] ) && | |
| 60 | + ( '1' === $auth_settings['cas_attr_update_on_login'] || ( 'update-if-empty' === $auth_settings['cas_attr_update_on_login'] && empty( $user->first_name ) ) ) | |
| 61 | + ) || ( | |
| 62 | + ! empty( $user_data['authenticated_by'] ) && 'ldap' === $user_data['authenticated_by'] && | |
| 63 | + ! empty( $auth_settings['ldap_attr_update_on_login'] ) && | |
| 64 | + ( '1' === $auth_settings['ldap_attr_update_on_login'] || ( 'update-if-empty' === $auth_settings['ldap_attr_update_on_login'] && empty( $user->first_name ) ) ) | |
| 65 | + ) | |
| 66 | + ); | |
| 86 | 67 | |
| 87 | 68 | $should_update_last_name = |
| 88 | 69 | $user && ! empty( $user_data['last_name'] ) && $user_data['last_name'] !== $user->last_name && |
| 89 | - ( '1' === $attr_update_on_login || ( 'update-if-empty' === $attr_update_on_login && empty( $user->last_name ) ) ); | |
| 70 | + ( | |
| 71 | + ( | |
| 72 | + ! empty( $user_data['authenticated_by'] ) && 'cas' === $user_data['authenticated_by'] && | |
| 73 | + ! empty( $auth_settings['cas_attr_update_on_login'] ) && | |
| 74 | + ( '1' === $auth_settings['cas_attr_update_on_login'] || ( 'update-if-empty' === $auth_settings['cas_attr_update_on_login'] && empty( $user->last_name ) ) ) | |
| 75 | + ) || ( | |
| 76 | + ! empty( $user_data['authenticated_by'] ) && 'ldap' === $user_data['authenticated_by'] && | |
| 77 | + ! empty( $auth_settings['ldap_attr_update_on_login'] ) && | |
| 78 | + ( '1' === $auth_settings['ldap_attr_update_on_login'] || ( 'update-if-empty' === $auth_settings['ldap_attr_update_on_login'] && empty( $user->last_name ) ) ) | |
| 79 | + ) | |
| 80 | + ); | |
| 90 | 81 | |
| 91 | 82 | /** |
| 92 | 83 | * Filter whether to block the currently logging in user based on any of |
| 93 | 84 | * their user attributes. |
| @@ -115,9 +106,9 @@ | ||
| 115 | 106 | 'email' => Helper::lowercase( $user_email ), |
| 116 | 107 | 'date_added' => wp_date( 'M Y' ), |
| 117 | 108 | ) |
| 118 | 109 | ); |
| 119 | - update_option( 'auth_settings_access_users_blocked', $auth_settings_access_users_blocked, false ); | |
| 110 | + update_option( 'auth_settings_access_users_blocked', $auth_settings_access_users_blocked ); | |
| 120 | 111 | } |
| 121 | 112 | |
| 122 | 113 | // If the blocked external user has a WordPress account, mark it as |
| 123 | 114 | // blocked (enforce block in this->authenticate()). |
| @@ -124,21 +115,8 @@ | ||
| 124 | 115 | if ( $user ) { |
| 125 | 116 | update_user_meta( $user->ID, 'auth_blocked', 'yes' ); |
| 126 | 117 | } |
| 127 | 118 | |
| 128 | - // Allow overriding the message blocked users see after logging in. | |
| 129 | - if ( defined( 'AUTHORIZER_LOGIN_MESSAGE_BLOCKED_USERS' ) ) { | |
| 130 | - $auth_settings['access_blocked_redirect_to_message'] = \AUTHORIZER_LOGIN_MESSAGE_BLOCKED_USERS; | |
| 131 | - } | |
| 132 | - /** | |
| 133 | - * Filters the message blocked users see after logging in. | |
| 134 | - * | |
| 135 | - * @since 3.12.0 | |
| 136 | - * | |
| 137 | - * @param string $message The message content. | |
| 138 | - */ | |
| 139 | - $auth_settings['access_blocked_redirect_to_message'] = apply_filters( 'authorizer_login_message_blocked_users', $auth_settings['access_blocked_redirect_to_message'] ); | |
| 140 | - | |
| 141 | 119 | // Notify user about blocked status and return without authenticating them. |
| 142 | 120 | // phpcs:ignore WordPress.Security.NonceVerification |
| 143 | 121 | $redirect_to = ! empty( $_REQUEST['redirect_to'] ) ? esc_url_raw( wp_unslash( $_REQUEST['redirect_to'] ) ) : home_url(); |
| 144 | 122 | $page_title = sprintf( |
| @@ -152,14 +130,28 @@ | ||
| 152 | 130 | '<p style="text-align: center;">' . |
| 153 | 131 | '<a class="button" href="' . wp_logout_url( $redirect_to ) . '">' . |
| 154 | 132 | __( 'Back', 'authorizer' ) . |
| 155 | 133 | '</a></p>'; |
| 156 | - update_option( 'auth_settings_advanced_login_error', $error_message, false ); | |
| 134 | + update_option( 'auth_settings_advanced_login_error', $error_message ); | |
| 157 | 135 | wp_die( wp_kses( $error_message, Helper::$allowed_html ), esc_html( $page_title ) ); |
| 158 | 136 | return new \WP_Error( 'invalid_login', __( 'Invalid login attempted.', 'authorizer' ) ); |
| 159 | 137 | } |
| 160 | 138 | } |
| 161 | 139 | |
| 140 | + // If this externally-authenticated user is an existing administrator (admin | |
| 141 | + // in single site mode, or super admin in network mode), and isn't blocked, | |
| 142 | + // let them in. Update their first/last name if needed (CAS/LDAP). | |
| 143 | + if ( $user && is_super_admin( $user->ID ) ) { | |
| 144 | + if ( $should_update_first_name ) { | |
| 145 | + update_user_meta( $user->ID, 'first_name', $user_data['first_name'] ); | |
| 146 | + } | |
| 147 | + if ( $should_update_last_name ) { | |
| 148 | + update_user_meta( $user->ID, 'last_name', $user_data['last_name'] ); | |
| 149 | + } | |
| 150 | + | |
| 151 | + return $user; | |
| 152 | + } | |
| 153 | + | |
| 162 | 154 | // Get the default role for this user (or their current role, if they |
| 163 | 155 | // already have an account). |
| 164 | 156 | $default_role = $user && is_array( $user->roles ) && count( $user->roles ) > 0 ? $user->roles[0] : $auth_settings['access_default_role']; |
| 165 | 157 | /** |
| @@ -167,50 +159,23 @@ | ||
| 167 | 159 | * set to the default (specified in Authorizer options) for new users, |
| 168 | 160 | * or the user's current role for existing users. This filter allows |
| 169 | 161 | * changing user roles based on custom CAS/LDAP attributes. |
| 170 | 162 | * |
| 171 | - * @param string $role Role of the user currently logging in. | |
| 172 | - * @param array $user_data User data returned from external service. | |
| 173 | - * @param WP_User|false|null|WP_Error $user User object if logging in user exists. | |
| 174 | - * | |
| 175 | - * @return string|array Role of the user currently logging in, or an array with keys 'default_role' (string), 'roles_to_add' (array), and 'roles_to_remove' (array) if support for multiple roles is desired. | |
| 163 | + * @param bool $role Role of the user currently logging in. | |
| 164 | + * @param array $user_data User data returned from external service. | |
| 176 | 165 | */ |
| 177 | - $approved_role = apply_filters( 'authorizer_custom_role', $default_role, $user_data, $user ); | |
| 166 | + $approved_role = apply_filters( 'authorizer_custom_role', $default_role, $user_data ); | |
| 178 | 167 | |
| 179 | - // Support for multiple roles if supplied in the filter above. Note: this | |
| 180 | - // only has partial support for multisite (it will only add/remove roles | |
| 181 | - // to the current blog, not all blogs). | |
| 182 | - $roles_to_add = empty( $approved_role['roles_to_add'] ) ? array() : $approved_role['roles_to_add']; | |
| 183 | - $roles_to_remove = empty( $approved_role['roles_to_remove'] ) ? array() : $approved_role['roles_to_remove']; | |
| 184 | - if ( ! empty( $approved_role['default_role'] ) ) { | |
| 185 | - $approved_role = $approved_role['default_role']; | |
| 186 | - } | |
| 187 | - | |
| 188 | 168 | /** |
| 189 | 169 | * Filter whether to automatically approve the currently logging in user |
| 190 | 170 | * based on any of their user attributes. |
| 191 | 171 | * |
| 192 | - * @param bool $automatically_approve_login | |
| 172 | + * @param bool $automatically_approve_login | |
| 193 | 173 | * Whether to automatically approve the currently logging in user. |
| 194 | - * @param array $user_data User data returned from external service. | |
| 195 | - * @param WP_User|false|null|WP_Error $user User object if logging in user exists. | |
| 174 | + * @param array $user_data User data returned from external service. | |
| 196 | 175 | */ |
| 197 | - $automatically_approve_login = apply_filters( 'authorizer_automatically_approve_login', false, $user_data, $user ); | |
| 176 | + $automatically_approve_login = apply_filters( 'authorizer_automatically_approve_login', false, $user_data ); | |
| 198 | 177 | |
| 199 | - // If this externally-authenticated user is an existing administrator (admin | |
| 200 | - // in single site mode, or super admin in network mode), and isn't blocked, | |
| 201 | - // let them in. Update their first/last name if needed. | |
| 202 | - if ( $user && is_super_admin( $user->ID ) ) { | |
| 203 | - if ( $should_update_first_name ) { | |
| 204 | - update_user_meta( $user->ID, 'first_name', $user_data['first_name'] ); | |
| 205 | - } | |
| 206 | - if ( $should_update_last_name ) { | |
| 207 | - update_user_meta( $user->ID, 'last_name', $user_data['last_name'] ); | |
| 208 | - } | |
| 209 | - | |
| 210 | - return $user; | |
| 211 | - } | |
| 212 | - | |
| 213 | 178 | // Iterate through each of the email addresses provided by the external |
| 214 | 179 | // service and determine if any of them have access. |
| 215 | 180 | $last_email = end( $user_emails ); |
| 216 | 181 | reset( $user_emails ); |
| @@ -233,9 +198,9 @@ | ||
| 233 | 198 | if ( $this->is_email_in_list( $user_email, 'pending' ) ) { |
| 234 | 199 | foreach ( $auth_settings_access_users_pending as $key => $pending_user ) { |
| 235 | 200 | if ( 0 === strcasecmp( $pending_user['email'], $user_email ) ) { |
| 236 | 201 | unset( $auth_settings_access_users_pending[ $key ] ); |
| 237 | - update_option( 'auth_settings_access_users_pending', $auth_settings_access_users_pending, false ); | |
| 202 | + update_option( 'auth_settings_access_users_pending', $auth_settings_access_users_pending ); | |
| 238 | 203 | break; |
| 239 | 204 | } |
| 240 | 205 | } |
| 241 | 206 | } |
| @@ -247,9 +212,9 @@ | ||
| 247 | 212 | 'date_added' => wp_date( 'Y-m-d H:i:s' ), |
| 248 | 213 | ); |
| 249 | 214 | array_push( $auth_settings_access_users_approved, $approved_user ); |
| 250 | 215 | array_push( $auth_settings_access_users_approved_single, $approved_user ); |
| 251 | - update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved_single, false ); | |
| 216 | + update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved_single ); | |
| 252 | 217 | } |
| 253 | 218 | |
| 254 | 219 | // Check our externally authenticated user against the approved |
| 255 | 220 | // list. If they are approved, log them in (and create their account |
| @@ -256,37 +221,13 @@ | ||
| 256 | 221 | // if necessary). |
| 257 | 222 | if ( $is_newly_approved_user || $this->is_email_in_list( $user_email, 'approved' ) ) { |
| 258 | 223 | $user_info = $is_newly_approved_user ? $approved_user : Helper::get_user_info_from_list( $user_email, $auth_settings_access_users_approved ); |
| 259 | 224 | |
| 260 | - // If this user's role was modified above (in the authorizer_custom_role | |
| 261 | - // filter), update the role in the approved list and use that role | |
| 262 | - // (i.e., if the roles are out of sync, use the authorizer_custom_role | |
| 263 | - // value instead of the role in the approved list). | |
| 264 | - if ( has_filter( 'authorizer_custom_role' ) ) { | |
| 225 | + // If this user's role was modified above (in the | |
| 226 | + // authorizer_custom_role filter), use that value instead of | |
| 227 | + // whatever is specified in the approved list. | |
| 228 | + if ( $default_role !== $approved_role ) { | |
| 265 | 229 | $user_info['role'] = $approved_role; |
| 266 | - | |
| 267 | - // Find the user in either the single site or multisite approved list | |
| 268 | - // and update their role there if different. | |
| 269 | - foreach ( $auth_settings_access_users_approved_single as $index => $auth_settings_access_user_approved_single ) { | |
| 270 | - if ( $user_info['email'] === $auth_settings_access_user_approved_single['email'] ) { | |
| 271 | - if ( $auth_settings_access_users_approved_single[ $index ]['role'] !== $approved_role ) { | |
| 272 | - $auth_settings_access_users_approved_single[ $index ]['role'] = $approved_role; | |
| 273 | - update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved_single, false ); | |
| 274 | - } | |
| 275 | - break; | |
| 276 | - } | |
| 277 | - } | |
| 278 | - if ( is_multisite() ) { | |
| 279 | - foreach ( $auth_settings_access_users_approved_multi as $index => $auth_settings_access_user_approved_multi ) { | |
| 280 | - if ( $user_info['email'] === $auth_settings_access_user_approved_multi['email'] ) { | |
| 281 | - if ( $auth_settings_access_users_approved_multi[ $index ]['role'] !== $approved_role ) { | |
| 282 | - $auth_settings_access_users_approved_multi[ $index ]['role'] = $approved_role; | |
| 283 | - update_blog_option( get_main_site_id( get_main_network_id() ), 'auth_multisite_settings_access_users_approved', $auth_settings_access_users_approved_multi ); | |
| 284 | - } | |
| 285 | - break; | |
| 286 | - } | |
| 287 | - } | |
| 288 | - } | |
| 289 | 230 | } |
| 290 | 231 | |
| 291 | 232 | // If the approved external user does not have a WordPress account, create it. |
| 292 | 233 | if ( ! $user ) { |
| @@ -297,11 +238,13 @@ | ||
| 297 | 238 | $username = $username[0]; |
| 298 | 239 | } |
| 299 | 240 | // If there's already a user with this username (e.g., |
| 300 | 241 | // johndoe/johndoe@gmail.com exists, and we're trying to add |
| 301 | - // johndoe/johndoe@example.com), try appending digits to the end until | |
| 302 | - // a free username is found (e.g., johndoe2). | |
| 303 | - $username = Helper::ensure_unique_username( $username ); | |
| 242 | + // johndoe/johndoe@example.com), use the full email address | |
| 243 | + // as the username. | |
| 244 | + if ( get_user_by( 'login', $username ) !== false ) { | |
| 245 | + $username = $user_info['email']; | |
| 246 | + } | |
| 304 | 247 | $result = wp_insert_user( |
| 305 | 248 | array( |
| 306 | 249 | 'user_login' => strtolower( $username ), |
| 307 | 250 | 'user_pass' => wp_generate_password(), // random password. |
| @@ -341,13 +284,8 @@ | ||
| 341 | 284 | * ); |
| 342 | 285 | */ |
| 343 | 286 | do_action( 'authorizer_user_register', $user, $user_data ); |
| 344 | 287 | |
| 345 | - // Save which external service authenticated this new user to user meta. | |
| 346 | - if ( $user && ! empty( $user_data['authenticated_by'] ) ) { | |
| 347 | - update_user_meta( $user->ID, 'authenticated_by', $user_data['authenticated_by'] ); | |
| 348 | - } | |
| 349 | - | |
| 350 | 288 | // If multisite, iterate through all sites in the network and add the user |
| 351 | 289 | // currently logging in to any of them that have the user on the approved list. |
| 352 | 290 | // Note: this is useful for first-time logins--some users will have access |
| 353 | 291 | // to multiple sites, and this prevents them from having to log into each |
| @@ -429,8 +367,16 @@ | ||
| 429 | 367 | } |
| 430 | 368 | if ( $should_update_last_name ) { |
| 431 | 369 | update_user_meta( $user->ID, 'last_name', $user_data['last_name'] ); |
| 432 | 370 | } |
| 371 | + | |
| 372 | + // Update this user's role if it was modified in the | |
| 373 | + // authorizer_custom_role filter. | |
| 374 | + if ( $default_role !== $approved_role ) { | |
| 375 | + // Update user's role in WordPress. Note: User's role will be changed | |
| 376 | + // in the approved list via hook `set_user_role` in WP_User::set_role(). | |
| 377 | + $user->set_role( $approved_role ); | |
| 378 | + } | |
| 433 | 379 | } |
| 434 | 380 | |
| 435 | 381 | // If this is multisite, add new user to current blog. |
| 436 | 382 | if ( is_multisite() && ! is_user_member_of_blog( $user->ID ) ) { |
| @@ -442,54 +388,12 @@ | ||
| 442 | 388 | } |
| 443 | 389 | } |
| 444 | 390 | |
| 445 | 391 | // Ensure user has the same role as their entry in the approved list. |
| 446 | - // Note: if any additional roles are defined to be added or removed, | |
| 447 | - // use add_role() instead of set_role() so we retain existing roles. | |
| 448 | 392 | if ( $user_info && ! in_array( $user_info['role'], $user->roles, true ) ) { |
| 449 | - if ( empty( $roles_to_add ) && empty( $roles_to_remove ) ) { | |
| 450 | - $user->set_role( $user_info['role'] ); | |
| 451 | - } else { | |
| 452 | - $user->add_role( $user_info['role'] ); | |
| 453 | - } | |
| 393 | + $user->set_role( $user_info['role'] ); | |
| 454 | 394 | } |
| 455 | 395 | |
| 456 | - /** | |
| 457 | - * Filter additional roles to add to the user currently logging in. This | |
| 458 | - * filter allows changing user roles based on custom CAS/LDAP attributes. | |
| 459 | - * | |
| 460 | - * @param array $roles_to_add Roles to add to the user currently logging in. | |
| 461 | - * @param array $user_data User data returned from external service. | |
| 462 | - * @param WP_User|false|null|WP_Error $user User object if logging in user exists. | |
| 463 | - */ | |
| 464 | - $roles_to_add = apply_filters( 'authorizer_custom_roles_to_add', $roles_to_add, $user_data, $user ); | |
| 465 | - | |
| 466 | - // Add additional roles to the user. Note: this only has partial support | |
| 467 | - // for multisite (it will only add roles to the current blog, not all blogs). | |
| 468 | - if ( ! empty( $roles_to_add ) ) { | |
| 469 | - foreach ( $roles_to_add as $role_to_add ) { | |
| 470 | - $user->add_role( $role_to_add ); | |
| 471 | - } | |
| 472 | - } | |
| 473 | - | |
| 474 | - /** | |
| 475 | - * Filter additional roles to remove from the user currently logging in. This | |
| 476 | - * filter allows changing user roles based on custom CAS/LDAP attributes. | |
| 477 | - * | |
| 478 | - * @param array $roles_to_remove Roles to remove from the user currently logging in. | |
| 479 | - * @param array $user_data User data returned from external service. | |
| 480 | - * @param WP_User|false|null|WP_Error $user User object if logging in user exists. | |
| 481 | - */ | |
| 482 | - $roles_to_remove = apply_filters( 'authorizer_custom_roles_to_remove', $roles_to_remove, $user_data, $user ); | |
| 483 | - | |
| 484 | - // Remove roles from the user. Note: this only has partial support for | |
| 485 | - // multisite (it will only remove roles from the current blog, not all blogs). | |
| 486 | - if ( ! empty( $roles_to_remove ) ) { | |
| 487 | - foreach ( $roles_to_remove as $role_to_remove ) { | |
| 488 | - $user->remove_role( $role_to_remove ); | |
| 489 | - } | |
| 490 | - } | |
| 491 | - | |
| 492 | 396 | return $user; |
| 493 | 397 | |
| 494 | 398 | } elseif ( 0 === strcasecmp( $user_email, $last_email ) ) { |
| 495 | 399 | /** |
| @@ -504,9 +408,9 @@ | ||
| 504 | 408 | $pending_user['email'] = Helper::lowercase( $user_email ); |
| 505 | 409 | $pending_user['role'] = $approved_role; |
| 506 | 410 | $pending_user['date_added'] = ''; |
| 507 | 411 | array_push( $auth_settings_access_users_pending, $pending_user ); |
| 508 | - update_option( 'auth_settings_access_users_pending', $auth_settings_access_users_pending, false ); | |
| 412 | + update_option( 'auth_settings_access_users_pending', $auth_settings_access_users_pending ); | |
| 509 | 413 | |
| 510 | 414 | // Create strings used in the email notification. |
| 511 | 415 | $site_name = get_bloginfo( 'name' ); |
| 512 | 416 | $site_url = get_bloginfo( 'url' ); |
| @@ -512,54 +416,28 @@ | ||
| 512 | 416 | $site_url = get_bloginfo( 'url' ); |
| 513 | 417 | $authorizer_options_url = 'settings' === $auth_settings['advanced_admin_menu'] ? admin_url( 'options-general.php?page=authorizer' ) : admin_url( '?page=authorizer' ); |
| 514 | 418 | |
| 515 | 419 | // Notify users with the role specified in "Which role should |
| 516 | - // receive email notifications about pending users?" and any | |
| 517 | - // individual users specified in "Which users should receive email | |
| 518 | - // notifications about pending users?". | |
| 519 | - if ( strlen( $auth_settings['access_role_receive_pending_emails'] ) > 0 || ! empty( $auth_settings['access_users_receive_pending_emails'] ) ) { | |
| 520 | - $emails_to_notify = array(); | |
| 521 | - // Add users with specified role (if any). | |
| 522 | - if ( strlen( $auth_settings['access_role_receive_pending_emails'] ) > 0 ) { | |
| 523 | - foreach ( get_users( array( 'role' => $auth_settings['access_role_receive_pending_emails'] ) ) as $user_recipient ) { | |
| 524 | - if ( ! empty( $user_recipient->user_email ) ) { | |
| 525 | - $emails_to_notify[] = $user_recipient->user_email; | |
| 526 | - } | |
| 527 | - } | |
| 420 | + // receive email notifications about pending users?". | |
| 421 | + if ( strlen( $auth_settings['access_role_receive_pending_emails'] ) > 0 ) { | |
| 422 | + foreach ( get_users( array( 'role' => $auth_settings['access_role_receive_pending_emails'] ) ) as $user_recipient ) { | |
| 423 | + wp_mail( | |
| 424 | + $user_recipient->user_email, | |
| 425 | + sprintf( | |
| 426 | + /* TRANSLATORS: 1: User email 2: Name of site */ | |
| 427 | + __( 'Action required: Pending user %1$s at %2$s', 'authorizer' ), | |
| 428 | + $pending_user['email'], | |
| 429 | + $site_name | |
| 430 | + ), | |
| 431 | + sprintf( | |
| 432 | + /* TRANSLATORS: 1: Name of site 2: URL of site 3: URL of authorizer */ | |
| 433 | + __( "A new user has tried to access the %1\$s site you manage at:\n%2\$s\n\nPlease log in to approve or deny their request:\n%3\$s\n", 'authorizer' ), | |
| 434 | + $site_name, | |
| 435 | + $site_url, | |
| 436 | + $authorizer_options_url | |
| 437 | + ) | |
| 438 | + ); | |
| 528 | 439 | } |
| 529 | - // Add individual users (if any). | |
| 530 | - if ( ! empty( $auth_settings['access_users_receive_pending_emails'] ) ) { | |
| 531 | - foreach ( $auth_settings['access_users_receive_pending_emails'] as $username ) { | |
| 532 | - $user_recipient = get_user_by( 'login', $username ); | |
| 533 | - if ( ! empty( $user_recipient->user_email ) ) { | |
| 534 | - $emails_to_notify[] = $user_recipient->user_email; | |
| 535 | - } | |
| 536 | - } | |
| 537 | - } | |
| 538 | - // Remove any duplicate email addresses (a user could potentially be | |
| 539 | - // added via their role and again via their username). | |
| 540 | - $emails_to_notify = array_unique( $emails_to_notify ); | |
| 541 | - // Email each recipient. | |
| 542 | - if ( count( $emails_to_notify ) > 0 ) { | |
| 543 | - foreach ( $emails_to_notify as $email ) { | |
| 544 | - wp_mail( | |
| 545 | - $email, | |
| 546 | - sprintf( | |
| 547 | - /* TRANSLATORS: 1: User email 2: Name of site */ | |
| 548 | - __( 'Action required: Pending user %1$s at %2$s', 'authorizer' ), | |
| 549 | - $pending_user['email'], | |
| 550 | - $site_name | |
| 551 | - ), | |
| 552 | - sprintf( | |
| 553 | - /* TRANSLATORS: 1: Name of site 2: URL of site 3: URL of authorizer */ | |
| 554 | - __( "A new user has tried to access the %1\$s site you manage at:\n%2\$s\n\nPlease log in to approve or deny their request:\n%3\$s\n", 'authorizer' ), | |
| 555 | - $site_name, | |
| 556 | - $site_url, | |
| 557 | - $authorizer_options_url | |
| 558 | - ) | |
| 559 | - ); | |
| 560 | - } | |
| 561 | - } | |
| 562 | 440 | } |
| 563 | 441 | } |
| 564 | 442 | |
| 565 | 443 | // Fetch the external service this user authenticated with, and append |
| @@ -568,21 +446,8 @@ | ||
| 568 | 446 | // because a pending user does not have a WP_User, and thus no |
| 569 | 447 | // "authenticated_by" usermeta that is normally used to do this. |
| 570 | 448 | $external_param = isset( $user_data['authenticated_by'] ) ? '&external=' . $user_data['authenticated_by'] : ''; |
| 571 | 449 | |
| 572 | - // Allow overriding the message pending users see after logging in. | |
| 573 | - if ( defined( 'AUTHORIZER_LOGIN_MESSAGE_PENDING_USERS' ) ) { | |
| 574 | - $auth_settings['access_pending_redirect_to_message'] = \AUTHORIZER_LOGIN_MESSAGE_PENDING_USERS; | |
| 575 | - } | |
| 576 | - /** | |
| 577 | - * Filters the message pending users see after logging in. | |
| 578 | - * | |
| 579 | - * @since 3.12.0 | |
| 580 | - * | |
| 581 | - * @param string $message The message content. | |
| 582 | - */ | |
| 583 | - $auth_settings['access_pending_redirect_to_message'] = apply_filters( 'authorizer_login_message_pending_users', $auth_settings['access_pending_redirect_to_message'] ); | |
| 584 | - | |
| 585 | 450 | // Notify user about pending status and return without authenticating them. |
| 586 | 451 | // phpcs:ignore WordPress.Security.NonceVerification |
| 587 | 452 | $redirect_to = ! empty( $_REQUEST['redirect_to'] ) ? esc_url_raw( wp_unslash( $_REQUEST['redirect_to'] ) ) : home_url(); |
| 588 | 453 | $page_title = get_bloginfo( 'name' ) . ' - Access Pending'; |
| @@ -592,9 +457,9 @@ | ||
| 592 | 457 | '<p style="text-align: center;">' . |
| 593 | 458 | '<a class="button" href="' . wp_logout_url( $redirect_to ) . $external_param . '">' . |
| 594 | 459 | __( 'Back', 'authorizer' ) . |
| 595 | 460 | '</a></p>'; |
| 596 | - update_option( 'auth_settings_advanced_login_error', $error_message, false ); | |
| 461 | + update_option( 'auth_settings_advanced_login_error', $error_message ); | |
| 597 | 462 | wp_die( wp_kses( $error_message, Helper::$allowed_html ), esc_html( $page_title ) ); |
| 598 | 463 | } |
| 599 | 464 | } |
| 600 | 465 | |
| @@ -599,8 +464,9 @@ | ||
| 599 | 464 | } |
| 600 | 465 | |
| 601 | 466 | // Sanity check: if we made it here without returning, something has gone wrong. |
| 602 | 467 | return new \WP_Error( 'invalid_login', __( 'Invalid login attempted.', 'authorizer' ) ); |
| 468 | + | |
| 603 | 469 | } |
| 604 | 470 | |
| 605 | 471 | |
| 606 | 472 | /** |
| @@ -654,9 +520,9 @@ | ||
| 654 | 520 | * add_filter( 'authorizer_has_access', 'my_feed_access_override', 10, 2 ); |
| 655 | 521 | */ |
| 656 | 522 | if ( apply_filters( 'authorizer_has_access', $has_access, $wp ) === true ) { |
| 657 | 523 | // Turn off the public notice about browsing anonymously. |
| 658 | - update_option( 'auth_settings_advanced_public_notice', false, true ); | |
| 524 | + update_option( 'auth_settings_advanced_public_notice', false ); | |
| 659 | 525 | |
| 660 | 526 | // We've determined that the current user has access, so simply return to grant access. |
| 661 | 527 | return $wp; |
| 662 | 528 | } |
| @@ -689,11 +555,11 @@ | ||
| 689 | 555 | $auth_settings['access_public_pages'] = array(); |
| 690 | 556 | } |
| 691 | 557 | if ( in_array( strval( $current_page_id ), $auth_settings['access_public_pages'], true ) ) { |
| 692 | 558 | if ( 'no_warning' === $auth_settings['access_public_warning'] ) { |
| 693 | - update_option( 'auth_settings_advanced_public_notice', false, true ); | |
| 559 | + update_option( 'auth_settings_advanced_public_notice', false ); | |
| 694 | 560 | } else { |
| 695 | - update_option( 'auth_settings_advanced_public_notice', true, true ); | |
| 561 | + update_option( 'auth_settings_advanced_public_notice', true ); | |
| 696 | 562 | } |
| 697 | 563 | return $wp; |
| 698 | 564 | } |
| 699 | 565 | |
| @@ -701,11 +567,11 @@ | ||
| 701 | 567 | $current_page_categories = wp_get_post_categories( $current_page_id, array( 'fields' => 'slugs' ) ); |
| 702 | 568 | foreach ( $current_page_categories as $current_page_category ) { |
| 703 | 569 | if ( in_array( 'cat_' . $current_page_category, $auth_settings['access_public_pages'], true ) ) { |
| 704 | 570 | if ( 'no_warning' === $auth_settings['access_public_warning'] ) { |
| 705 | - update_option( 'auth_settings_advanced_public_notice', false, true ); | |
| 571 | + update_option( 'auth_settings_advanced_public_notice', false ); | |
| 706 | 572 | } else { |
| 707 | - update_option( 'auth_settings_advanced_public_notice', true, true ); | |
| 573 | + update_option( 'auth_settings_advanced_public_notice', true ); | |
| 708 | 574 | } |
| 709 | 575 | return $wp; |
| 710 | 576 | } |
| 711 | 577 | } |
| @@ -713,11 +579,11 @@ | ||
| 713 | 579 | // Check to see if this page can't be found. If so, allow showing the 404 page. |
| 714 | 580 | if ( strlen( $current_page_id ) < 1 ) { |
| 715 | 581 | if ( in_array( 'auth_public_404', $auth_settings['access_public_pages'], true ) ) { |
| 716 | 582 | if ( 'no_warning' === $auth_settings['access_public_warning'] ) { |
| 717 | - update_option( 'auth_settings_advanced_public_notice', false, true ); | |
| 583 | + update_option( 'auth_settings_advanced_public_notice', false ); | |
| 718 | 584 | } else { |
| 719 | - update_option( 'auth_settings_advanced_public_notice', true, true ); | |
| 585 | + update_option( 'auth_settings_advanced_public_notice', true ); | |
| 720 | 586 | } |
| 721 | 587 | return $wp; |
| 722 | 588 | } |
| 723 | 589 | } |
| @@ -728,29 +594,16 @@ | ||
| 728 | 594 | $current_category_name_pieces = explode( '/', $current_category_name ); |
| 729 | 595 | $current_category_name = end( $current_category_name_pieces ); |
| 730 | 596 | if ( in_array( 'cat_' . $current_category_name, $auth_settings['access_public_pages'], true ) ) { |
| 731 | 597 | if ( 'no_warning' === $auth_settings['access_public_warning'] ) { |
| 732 | - update_option( 'auth_settings_advanced_public_notice', false, true ); | |
| 598 | + update_option( 'auth_settings_advanced_public_notice', false ); | |
| 733 | 599 | } else { |
| 734 | - update_option( 'auth_settings_advanced_public_notice', true, true ); | |
| 600 | + update_option( 'auth_settings_advanced_public_notice', true ); | |
| 735 | 601 | } |
| 736 | 602 | return $wp; |
| 737 | 603 | } |
| 738 | 604 | } |
| 739 | 605 | |
| 740 | - // Allow overriding the message anonymous users see. | |
| 741 | - if ( defined( 'AUTHORIZER_MESSAGE_ANONYMOUS_USERS' ) ) { | |
| 742 | - $auth_settings['access_redirect_to_message'] = \AUTHORIZER_MESSAGE_ANONYMOUS_USERS; | |
| 743 | - } | |
| 744 | - /** | |
| 745 | - * Filters the message anonymous users see when visiting public pages on a private site. | |
| 746 | - * | |
| 747 | - * @since 3.12.0 | |
| 748 | - * | |
| 749 | - * @param string $message The message content. | |
| 750 | - */ | |
| 751 | - $auth_settings['access_redirect_to_message'] = apply_filters( 'authorizer_message_anonymous_users', $auth_settings['access_redirect_to_message'] ); | |
| 752 | - | |
| 753 | 606 | // User is denied access, so show them the error message. Render as JSON |
| 754 | 607 | // if this is a REST API call; otherwise, show the error message via |
| 755 | 608 | // wp_die() (rendered html), or redirect to the login URL. |
| 756 | 609 | $current_path = ! empty( $_SERVER['REQUEST_URI'] ) ? esc_url_raw( wp_unslash( $_SERVER['REQUEST_URI'] ) ) : home_url(); |
| @@ -786,73 +639,9 @@ | ||
| 786 | 639 | // Sanity check: we should never get here. |
| 787 | 640 | wp_die( '<p>Access denied.</p>', 'Site Access Restricted' ); |
| 788 | 641 | } |
| 789 | 642 | |
| 790 | - /** | |
| 791 | - * If we're showing search results or a post listing (home or archive page) to | |
| 792 | - * an anonymous user, and Authorizer is configured to only allow logged in | |
| 793 | - * users to see the site, filter the query to only posts marked public. | |
| 794 | - * | |
| 795 | - * Action: pre_get_posts | |
| 796 | - * | |
| 797 | - * @param WP_Query $query The WP_Query instance (passed by reference). | |
| 798 | - * @return void | |
| 799 | - */ | |
| 800 | - public function remove_private_pages_from_search_and_archives( $query ) { | |
| 801 | - // It's possible for pre_get_posts to fire before wp-includes/pluggable.php | |
| 802 | - // is loaded, so verify before using the is_user_logged_in() function. | |
| 803 | - if ( ! function_exists( 'is_user_logged_in' ) ) { | |
| 804 | - require ABSPATH . WPINC . '/pluggable.php'; | |
| 805 | - } | |
| 806 | 643 | |
| 807 | - // Fix for edge case when viewing admin pages in Pressbooks (Undefined | |
| 808 | - // constant "SECURE_AUTH_COOKIE"). | |
| 809 | - if ( ! defined( 'SECURE_AUTH_COOKIE' ) ) { | |
| 810 | - wp_cookie_constants(); | |
| 811 | - } | |
| 812 | - | |
| 813 | - // Do nothing if user is logged in, this isn't the main query, or we're not | |
| 814 | - // showing search results, home page, or an archive page. | |
| 815 | - if ( | |
| 816 | - is_user_logged_in() || ! $query->is_main_query() || | |
| 817 | - ! ( $query->is_search() || $query->is_home() || $query->is_archive() ) | |
| 818 | - ) { | |
| 819 | - return; | |
| 820 | - } | |
| 821 | - | |
| 822 | - $options = Options::get_instance(); | |
| 823 | - $who_can_view = $options->get( 'access_who_can_view' ); | |
| 824 | - $public_pages = $options->get( 'access_public_pages' ); | |
| 825 | - $public_pages = is_array( $public_pages ) ? $public_pages : array(); | |
| 826 | - | |
| 827 | - // Do nothing if this site isn't restricted to logged in users only. | |
| 828 | - if ( 'logged_in_users' !== $who_can_view ) { | |
| 829 | - return; | |
| 830 | - } | |
| 831 | - | |
| 832 | - // Check for special public types (home, 404, categories). | |
| 833 | - $public_category_ids = array(); | |
| 834 | - foreach ( $public_pages as $index => $public_page ) { | |
| 835 | - if ( 'home' === $public_page || 'auth_public_404' === $public_page ) { | |
| 836 | - unset( $public_pages[ $index ] ); | |
| 837 | - } elseif ( 'cat_' === substr( $public_page, 0, 4 ) ) { | |
| 838 | - $public_category_name = substr( $public_page, 4 ); | |
| 839 | - unset( $public_pages[ $index ] ); | |
| 840 | - $public_category_ids[] = get_cat_ID( $public_category_name ); | |
| 841 | - } | |
| 842 | - } | |
| 843 | - if ( ! empty( $public_category_ids ) ) { | |
| 844 | - $pages_in_public_categories = get_posts( array( | |
| 845 | - 'posts_per_page' => -1, | |
| 846 | - 'fields' => 'ids', | |
| 847 | - 'category__in' => $public_category_ids, | |
| 848 | - ) ); | |
| 849 | - $public_pages = array_merge( $public_pages, $pages_in_public_categories ); | |
| 850 | - } | |
| 851 | - | |
| 852 | - $query->set( 'post__in', $public_pages ); | |
| 853 | - } | |
| 854 | - | |
| 855 | 644 | /** |
| 856 | 645 | * Prevent REST API access if user isn't authenticated and "only logged in |
| 857 | 646 | * users can see the site" is enabled. |
| 858 | 647 | * |
| @@ -876,21 +665,8 @@ | ||
| 876 | 665 | if ( |
| 877 | 666 | 'logged_in_users' === $auth_settings['access_who_can_view'] && |
| 878 | 667 | false === apply_filters( 'authorizer_has_access', false, $GLOBALS['wp'] ) |
| 879 | 668 | ) { |
| 880 | - // Allow overriding the message anonymous users see. | |
| 881 | - if ( defined( 'AUTHORIZER_MESSAGE_ANONYMOUS_USERS' ) ) { | |
| 882 | - $auth_settings['access_redirect_to_message'] = \AUTHORIZER_MESSAGE_ANONYMOUS_USERS; | |
| 883 | - } | |
| 884 | - /** | |
| 885 | - * Filters the message anonymous users see when visiting public pages on a private site. | |
| 886 | - * | |
| 887 | - * @since 3.12.0 | |
| 888 | - * | |
| 889 | - * @param string $message The message content. | |
| 890 | - */ | |
| 891 | - $auth_settings['access_redirect_to_message'] = apply_filters( 'authorizer_message_anonymous_users', $auth_settings['access_redirect_to_message'] ); | |
| 892 | - | |
| 893 | 669 | return new \WP_Error( |
| 894 | 670 | 'rest_cannot_view', |
| 895 | 671 | wp_strip_all_tags( $auth_settings['access_redirect_to_message'] ), |
| 896 | 672 | array( |
| @@ -909,13 +685,13 @@ | ||
| 909 | 685 | * the lists (pending, approved, blocked). Defaults to the list of |
| 910 | 686 | * approved users. |
| 911 | 687 | * |
| 912 | 688 | * @param string $email Email to check existent of. |
| 913 | - * @param string $user_list List to look for email in. | |
| 689 | + * @param string $list List to look for email in. | |
| 914 | 690 | * @param string $multisite_mode Admin context. |
| 915 | 691 | * @return boolean Whether email was found. |
| 916 | 692 | */ |
| 917 | - public function is_email_in_list( $email = '', $user_list = 'approved', $multisite_mode = 'single' ) { | |
| 693 | + public function is_email_in_list( $email = '', $list = 'approved', $multisite_mode = 'single' ) { | |
| 918 | 694 | if ( empty( $email ) ) { |
| 919 | 695 | return false; |
| 920 | 696 | } |
| 921 | 697 | |
| @@ -920,9 +696,9 @@ | ||
| 920 | 696 | } |
| 921 | 697 | |
| 922 | 698 | $options = Options::get_instance(); |
| 923 | 699 | |
| 924 | - switch ( $user_list ) { | |
| 700 | + switch ( $list ) { | |
| 925 | 701 | case 'pending': |
| 926 | 702 | $auth_settings_access_users_pending = $options->get( 'access_users_pending', Helper::SINGLE_CONTEXT ); |
| 927 | 703 | return Helper::in_multi_array( $email, $auth_settings_access_users_pending ); |
| 928 | 704 | case 'blocked': |
| @@ -964,5 +740,6 @@ | ||
| 964 | 740 | } |
| 965 | 741 | return Helper::in_multi_array( $email, $auth_settings_access_users_approved ); |
| 966 | 742 | } |
| 967 | 743 | } |
| 744 | + | |
| 968 | 745 | } |
