| @@ -11,11 +11,8 @@ | ||
| 11 | 11 | |
| 12 | 12 | use Authorizer\Helper; |
| 13 | 13 | use Authorizer\Options; |
| 14 | 14 | |
| 15 | -// Prevent direct access. | |
| 16 | -defined( 'ABSPATH' ) || exit; | |
| 17 | - | |
| 18 | 15 | /** |
| 19 | 16 | * Implements the authorization (roles and permissions) features of the plugin. |
| 20 | 17 | */ |
| 21 | 18 | class Authorization extends Singleton { |
| @@ -25,15 +22,11 @@ | ||
| 25 | 22 | * don't have access. |
| 26 | 23 | * |
| 27 | 24 | * @param WP_User $user User to check. |
| 28 | 25 | * @param array $user_emails Array of user's plaintext emails (in case current user doesn't have a WP account). |
| 29 | - * @param array $user_data Array of keys for email, username, first_name, last_name, authenticated_by, | |
| 30 | - * and any of the following based on authentication method: | |
| 31 | - * google_attributes, | |
| 32 | - * cas_attributes, cas_server_id, | |
| 33 | - * ldap_attributes, | |
| 34 | - * oauth2_attributes, oauth2_provider, oauth2_server_id, | |
| 35 | - * oidc_attributes, oidc_server_id. | |
| 26 | + * @param array $user_data Array of keys for email, username, first_name, last_name, | |
| 27 | + * authenticated_by, google_attributes, cas_attributes, ldap_attributes, | |
| 28 | + * oauth2_attributes. | |
| 36 | 29 | * @return WP_Error|WP_User |
| 37 | 30 | * WP_Error if there was an error on user creation / adding user to blog. |
| 38 | 31 | * WP_Error / wp_die() if user does not have access. |
| 39 | 32 | * WP_User if user has access. |
| @@ -53,44 +46,39 @@ | ||
| 53 | 46 | $auth_settings_access_users_approved_multi |
| 54 | 47 | ) |
| 55 | 48 | ); |
| 56 | 49 | |
| 57 | - // If this is an existing user, update which external service authenticated | |
| 58 | - // them. | |
| 59 | - if ( $user && ! empty( $user_data['authenticated_by'] ) ) { | |
| 60 | - update_user_meta( $user->ID, 'authenticated_by', $user_data['authenticated_by'] ); | |
| 61 | - } | |
| 62 | - | |
| 63 | - // Get whether to update first/last name on login from the external service | |
| 64 | - // used to authenticate this user. | |
| 65 | - $attr_update_on_login = ''; | |
| 66 | - if ( ! empty( $user_data['authenticated_by'] ) ) { | |
| 67 | - $attr_update_on_login_key = ''; | |
| 68 | - if ( 'cas' === $user_data['authenticated_by'] ) { | |
| 69 | - $attr_update_on_login_key = empty( $user_data['cas_server_id'] ) || 1 === intval( $user_data['cas_server_id'] ) ? 'cas_attr_update_on_login' : 'cas_attr_update_on_login_' . $user_data['cas_server_id']; | |
| 70 | - } elseif ( 'ldap' === $user_data['authenticated_by'] ) { | |
| 71 | - $attr_update_on_login_key = 'ldap_attr_update_on_login'; | |
| 72 | - } elseif ( 'oauth2' === $user_data['authenticated_by'] ) { | |
| 73 | - $attr_update_on_login_key = empty( $user_data['oauth2_server_id'] ) || 1 === intval( $user_data['oauth2_server_id'] ) ? 'oauth2_attr_update_on_login' : 'oauth2_attr_update_on_login_' . $user_data['oauth2_server_id']; | |
| 74 | - } elseif ( 'oidc' === $user_data['authenticated_by'] ) { | |
| 75 | - $attr_update_on_login_key = empty( $user_data['oidc_server_id'] ) || 1 === intval( $user_data['oidc_server_id'] ) ? 'oidc_attr_update_on_login' : 'oidc_attr_update_on_login_' . $user_data['oidc_server_id']; | |
| 76 | - } | |
| 77 | - if ( ! empty( $attr_update_on_login_key ) ) { | |
| 78 | - $attr_update_on_login = ! empty( $auth_settings[ $attr_update_on_login_key ] ) ? $auth_settings[ $attr_update_on_login_key ] : ''; | |
| 79 | - } | |
| 80 | - } | |
| 81 | - | |
| 82 | 50 | // Detect whether this user's first and last name should be updated below |
| 83 | - // (if the external service provides a different value, the option is set to | |
| 84 | - // update it, and it's empty if the option to only set it if empty is | |
| 85 | - // enabled). | |
| 51 | + // (if the external CAS/LDAP service provides a different value, the option | |
| 52 | + // is set to update it, and it's empty if the option to only set it if empty | |
| 53 | + // is enabled). | |
| 86 | 54 | $should_update_first_name = |
| 87 | 55 | $user && ! empty( $user_data['first_name'] ) && $user_data['first_name'] !== $user->first_name && |
| 88 | - ( '1' === $attr_update_on_login || ( 'update-if-empty' === $attr_update_on_login && empty( $user->first_name ) ) ); | |
| 56 | + ( | |
| 57 | + ( | |
| 58 | + ! empty( $user_data['authenticated_by'] ) && 'cas' === $user_data['authenticated_by'] && | |
| 59 | + ! empty( $auth_settings['cas_attr_update_on_login'] ) && | |
| 60 | + ( '1' === $auth_settings['cas_attr_update_on_login'] || ( 'update-if-empty' === $auth_settings['cas_attr_update_on_login'] && empty( $user->first_name ) ) ) | |
| 61 | + ) || ( | |
| 62 | + ! empty( $user_data['authenticated_by'] ) && 'ldap' === $user_data['authenticated_by'] && | |
| 63 | + ! empty( $auth_settings['ldap_attr_update_on_login'] ) && | |
| 64 | + ( '1' === $auth_settings['ldap_attr_update_on_login'] || ( 'update-if-empty' === $auth_settings['ldap_attr_update_on_login'] && empty( $user->first_name ) ) ) | |
| 65 | + ) | |
| 66 | + ); | |
| 89 | 67 | |
| 90 | 68 | $should_update_last_name = |
| 91 | 69 | $user && ! empty( $user_data['last_name'] ) && $user_data['last_name'] !== $user->last_name && |
| 92 | - ( '1' === $attr_update_on_login || ( 'update-if-empty' === $attr_update_on_login && empty( $user->last_name ) ) ); | |
| 70 | + ( | |
| 71 | + ( | |
| 72 | + ! empty( $user_data['authenticated_by'] ) && 'cas' === $user_data['authenticated_by'] && | |
| 73 | + ! empty( $auth_settings['cas_attr_update_on_login'] ) && | |
| 74 | + ( '1' === $auth_settings['cas_attr_update_on_login'] || ( 'update-if-empty' === $auth_settings['cas_attr_update_on_login'] && empty( $user->last_name ) ) ) | |
| 75 | + ) || ( | |
| 76 | + ! empty( $user_data['authenticated_by'] ) && 'ldap' === $user_data['authenticated_by'] && | |
| 77 | + ! empty( $auth_settings['ldap_attr_update_on_login'] ) && | |
| 78 | + ( '1' === $auth_settings['ldap_attr_update_on_login'] || ( 'update-if-empty' === $auth_settings['ldap_attr_update_on_login'] && empty( $user->last_name ) ) ) | |
| 79 | + ) | |
| 80 | + ); | |
| 93 | 81 | |
| 94 | 82 | /** |
| 95 | 83 | * Filter whether to block the currently logging in user based on any of |
| 96 | 84 | * their user attributes. |
| @@ -118,9 +106,9 @@ | ||
| 118 | 106 | 'email' => Helper::lowercase( $user_email ), |
| 119 | 107 | 'date_added' => wp_date( 'M Y' ), |
| 120 | 108 | ) |
| 121 | 109 | ); |
| 122 | - update_option( 'auth_settings_access_users_blocked', $auth_settings_access_users_blocked, false ); | |
| 110 | + update_option( 'auth_settings_access_users_blocked', $auth_settings_access_users_blocked ); | |
| 123 | 111 | } |
| 124 | 112 | |
| 125 | 113 | // If the blocked external user has a WordPress account, mark it as |
| 126 | 114 | // blocked (enforce block in this->authenticate()). |
| @@ -127,21 +115,8 @@ | ||
| 127 | 115 | if ( $user ) { |
| 128 | 116 | update_user_meta( $user->ID, 'auth_blocked', 'yes' ); |
| 129 | 117 | } |
| 130 | 118 | |
| 131 | - // Allow overriding the message blocked users see after logging in. | |
| 132 | - if ( defined( 'AUTHORIZER_LOGIN_MESSAGE_BLOCKED_USERS' ) ) { | |
| 133 | - $auth_settings['access_blocked_redirect_to_message'] = \AUTHORIZER_LOGIN_MESSAGE_BLOCKED_USERS; | |
| 134 | - } | |
| 135 | - /** | |
| 136 | - * Filters the message blocked users see after logging in. | |
| 137 | - * | |
| 138 | - * @since 3.12.0 | |
| 139 | - * | |
| 140 | - * @param string $message The message content. | |
| 141 | - */ | |
| 142 | - $auth_settings['access_blocked_redirect_to_message'] = apply_filters( 'authorizer_login_message_blocked_users', $auth_settings['access_blocked_redirect_to_message'] ); | |
| 143 | - | |
| 144 | 119 | // Notify user about blocked status and return without authenticating them. |
| 145 | 120 | // phpcs:ignore WordPress.Security.NonceVerification |
| 146 | 121 | $redirect_to = ! empty( $_REQUEST['redirect_to'] ) ? esc_url_raw( wp_unslash( $_REQUEST['redirect_to'] ) ) : home_url(); |
| 147 | 122 | $page_title = sprintf( |
| @@ -155,14 +130,28 @@ | ||
| 155 | 130 | '<p style="text-align: center;">' . |
| 156 | 131 | '<a class="button" href="' . wp_logout_url( $redirect_to ) . '">' . |
| 157 | 132 | __( 'Back', 'authorizer' ) . |
| 158 | 133 | '</a></p>'; |
| 159 | - update_option( 'auth_settings_advanced_login_error', $error_message, false ); | |
| 134 | + update_option( 'auth_settings_advanced_login_error', $error_message ); | |
| 160 | 135 | wp_die( wp_kses( $error_message, Helper::$allowed_html ), esc_html( $page_title ) ); |
| 161 | 136 | return new \WP_Error( 'invalid_login', __( 'Invalid login attempted.', 'authorizer' ) ); |
| 162 | 137 | } |
| 163 | 138 | } |
| 164 | 139 | |
| 140 | + // If this externally-authenticated user is an existing administrator (admin | |
| 141 | + // in single site mode, or super admin in network mode), and isn't blocked, | |
| 142 | + // let them in. Update their first/last name if needed (CAS/LDAP). | |
| 143 | + if ( $user && is_super_admin( $user->ID ) ) { | |
| 144 | + if ( $should_update_first_name ) { | |
| 145 | + update_user_meta( $user->ID, 'first_name', $user_data['first_name'] ); | |
| 146 | + } | |
| 147 | + if ( $should_update_last_name ) { | |
| 148 | + update_user_meta( $user->ID, 'last_name', $user_data['last_name'] ); | |
| 149 | + } | |
| 150 | + | |
| 151 | + return $user; | |
| 152 | + } | |
| 153 | + | |
| 165 | 154 | // Get the default role for this user (or their current role, if they |
| 166 | 155 | // already have an account). |
| 167 | 156 | $default_role = $user && is_array( $user->roles ) && count( $user->roles ) > 0 ? $user->roles[0] : $auth_settings['access_default_role']; |
| 168 | 157 | /** |
| @@ -170,35 +159,22 @@ | ||
| 170 | 159 | * set to the default (specified in Authorizer options) for new users, |
| 171 | 160 | * or the user's current role for existing users. This filter allows |
| 172 | 161 | * changing user roles based on custom CAS/LDAP attributes. |
| 173 | 162 | * |
| 174 | - * @param string $role Role of the user currently logging in. | |
| 175 | - * @param array $user_data User data returned from external service. | |
| 176 | - * @param WP_User|false|null|WP_Error $user User object if logging in user exists. | |
| 177 | - * | |
| 178 | - * @return string|array Role of the user currently logging in, or an array with keys 'default_role' (string), 'roles_to_add' (array), and 'roles_to_remove' (array) if support for multiple roles is desired. | |
| 163 | + * @param bool $role Role of the user currently logging in. | |
| 164 | + * @param array $user_data User data returned from external service. | |
| 179 | 165 | */ |
| 180 | - $approved_role = apply_filters( 'authorizer_custom_role', $default_role, $user_data, $user ); | |
| 166 | + $approved_role = apply_filters( 'authorizer_custom_role', $default_role, $user_data ); | |
| 181 | 167 | |
| 182 | - // Support for multiple roles if supplied in the filter above. Note: this | |
| 183 | - // only has partial support for multisite (it will only add/remove roles | |
| 184 | - // to the current blog, not all blogs). | |
| 185 | - $roles_to_add = empty( $approved_role['roles_to_add'] ) ? array() : $approved_role['roles_to_add']; | |
| 186 | - $roles_to_remove = empty( $approved_role['roles_to_remove'] ) ? array() : $approved_role['roles_to_remove']; | |
| 187 | - if ( ! empty( $approved_role['default_role'] ) ) { | |
| 188 | - $approved_role = $approved_role['default_role']; | |
| 189 | - } | |
| 190 | - | |
| 191 | 168 | /** |
| 192 | 169 | * Filter whether to automatically approve the currently logging in user |
| 193 | 170 | * based on any of their user attributes. |
| 194 | 171 | * |
| 195 | - * @param bool $automatically_approve_login | |
| 172 | + * @param bool $automatically_approve_login | |
| 196 | 173 | * Whether to automatically approve the currently logging in user. |
| 197 | - * @param array $user_data User data returned from external service. | |
| 198 | - * @param WP_User|false|null|WP_Error $user User object if logging in user exists. | |
| 174 | + * @param array $user_data User data returned from external service. | |
| 199 | 175 | */ |
| 200 | - $automatically_approve_login = apply_filters( 'authorizer_automatically_approve_login', false, $user_data, $user ); | |
| 176 | + $automatically_approve_login = apply_filters( 'authorizer_automatically_approve_login', false, $user_data ); | |
| 201 | 177 | |
| 202 | 178 | // Iterate through each of the email addresses provided by the external |
| 203 | 179 | // service and determine if any of them have access. |
| 204 | 180 | $last_email = end( $user_emails ); |
| @@ -222,9 +198,9 @@ | ||
| 222 | 198 | if ( $this->is_email_in_list( $user_email, 'pending' ) ) { |
| 223 | 199 | foreach ( $auth_settings_access_users_pending as $key => $pending_user ) { |
| 224 | 200 | if ( 0 === strcasecmp( $pending_user['email'], $user_email ) ) { |
| 225 | 201 | unset( $auth_settings_access_users_pending[ $key ] ); |
| 226 | - update_option( 'auth_settings_access_users_pending', $auth_settings_access_users_pending, false ); | |
| 202 | + update_option( 'auth_settings_access_users_pending', $auth_settings_access_users_pending ); | |
| 227 | 203 | break; |
| 228 | 204 | } |
| 229 | 205 | } |
| 230 | 206 | } |
| @@ -236,9 +212,9 @@ | ||
| 236 | 212 | 'date_added' => wp_date( 'Y-m-d H:i:s' ), |
| 237 | 213 | ); |
| 238 | 214 | array_push( $auth_settings_access_users_approved, $approved_user ); |
| 239 | 215 | array_push( $auth_settings_access_users_approved_single, $approved_user ); |
| 240 | - update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved_single, false ); | |
| 216 | + update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved_single ); | |
| 241 | 217 | } |
| 242 | 218 | |
| 243 | 219 | // Check our externally authenticated user against the approved |
| 244 | 220 | // list. If they are approved, log them in (and create their account |
| @@ -245,37 +221,13 @@ | ||
| 245 | 221 | // if necessary). |
| 246 | 222 | if ( $is_newly_approved_user || $this->is_email_in_list( $user_email, 'approved' ) ) { |
| 247 | 223 | $user_info = $is_newly_approved_user ? $approved_user : Helper::get_user_info_from_list( $user_email, $auth_settings_access_users_approved ); |
| 248 | 224 | |
| 249 | - // If this user's role was modified above (in the authorizer_custom_role | |
| 250 | - // filter), update the role in the approved list and use that role | |
| 251 | - // (i.e., if the roles are out of sync, use the authorizer_custom_role | |
| 252 | - // value instead of the role in the approved list). | |
| 253 | - if ( has_filter( 'authorizer_custom_role' ) ) { | |
| 225 | + // If this user's role was modified above (in the | |
| 226 | + // authorizer_custom_role filter), use that value instead of | |
| 227 | + // whatever is specified in the approved list. | |
| 228 | + if ( $default_role !== $approved_role ) { | |
| 254 | 229 | $user_info['role'] = $approved_role; |
| 255 | - | |
| 256 | - // Find the user in either the single site or multisite approved list | |
| 257 | - // and update their role there if different. | |
| 258 | - foreach ( $auth_settings_access_users_approved_single as $index => $auth_settings_access_user_approved_single ) { | |
| 259 | - if ( $user_info['email'] === $auth_settings_access_user_approved_single['email'] ) { | |
| 260 | - if ( $auth_settings_access_users_approved_single[ $index ]['role'] !== $approved_role ) { | |
| 261 | - $auth_settings_access_users_approved_single[ $index ]['role'] = $approved_role; | |
| 262 | - update_option( 'auth_settings_access_users_approved', $auth_settings_access_users_approved_single, false ); | |
| 263 | - } | |
| 264 | - break; | |
| 265 | - } | |
| 266 | - } | |
| 267 | - if ( is_multisite() ) { | |
| 268 | - foreach ( $auth_settings_access_users_approved_multi as $index => $auth_settings_access_user_approved_multi ) { | |
| 269 | - if ( $user_info['email'] === $auth_settings_access_user_approved_multi['email'] ) { | |
| 270 | - if ( $auth_settings_access_users_approved_multi[ $index ]['role'] !== $approved_role ) { | |
| 271 | - $auth_settings_access_users_approved_multi[ $index ]['role'] = $approved_role; | |
| 272 | - update_blog_option( get_main_site_id( get_main_network_id() ), 'auth_multisite_settings_access_users_approved', $auth_settings_access_users_approved_multi ); | |
| 273 | - } | |
| 274 | - break; | |
| 275 | - } | |
| 276 | - } | |
| 277 | - } | |
| 278 | 230 | } |
| 279 | 231 | |
| 280 | 232 | // If the approved external user does not have a WordPress account, create it. |
| 281 | 233 | if ( ! $user ) { |
| @@ -286,11 +238,13 @@ | ||
| 286 | 238 | $username = $username[0]; |
| 287 | 239 | } |
| 288 | 240 | // If there's already a user with this username (e.g., |
| 289 | 241 | // johndoe/johndoe@gmail.com exists, and we're trying to add |
| 290 | - // johndoe/johndoe@example.com), try appending digits to the end until | |
| 291 | - // a free username is found (e.g., johndoe2). | |
| 292 | - $username = Helper::ensure_unique_username( $username ); | |
| 242 | + // johndoe/johndoe@example.com), use the full email address | |
| 243 | + // as the username. | |
| 244 | + if ( get_user_by( 'login', $username ) !== false ) { | |
| 245 | + $username = $user_info['email']; | |
| 246 | + } | |
| 293 | 247 | $result = wp_insert_user( |
| 294 | 248 | array( |
| 295 | 249 | 'user_login' => strtolower( $username ), |
| 296 | 250 | 'user_pass' => wp_generate_password(), // random password. |
| @@ -330,13 +284,8 @@ | ||
| 330 | 284 | * ); |
| 331 | 285 | */ |
| 332 | 286 | do_action( 'authorizer_user_register', $user, $user_data ); |
| 333 | 287 | |
| 334 | - // Save which external service authenticated this new user to user meta. | |
| 335 | - if ( $user && ! empty( $user_data['authenticated_by'] ) ) { | |
| 336 | - update_user_meta( $user->ID, 'authenticated_by', $user_data['authenticated_by'] ); | |
| 337 | - } | |
| 338 | - | |
| 339 | 288 | // If multisite, iterate through all sites in the network and add the user |
| 340 | 289 | // currently logging in to any of them that have the user on the approved list. |
| 341 | 290 | // Note: this is useful for first-time logins--some users will have access |
| 342 | 291 | // to multiple sites, and this prevents them from having to log into each |
| @@ -418,8 +367,16 @@ | ||
| 418 | 367 | } |
| 419 | 368 | if ( $should_update_last_name ) { |
| 420 | 369 | update_user_meta( $user->ID, 'last_name', $user_data['last_name'] ); |
| 421 | 370 | } |
| 371 | + | |
| 372 | + // Update this user's role if it was modified in the | |
| 373 | + // authorizer_custom_role filter. | |
| 374 | + if ( $default_role !== $approved_role ) { | |
| 375 | + // Update user's role in WordPress. Note: User's role will be changed | |
| 376 | + // in the approved list via hook `set_user_role` in WP_User::set_role(). | |
| 377 | + $user->set_role( $approved_role ); | |
| 378 | + } | |
| 422 | 379 | } |
| 423 | 380 | |
| 424 | 381 | // If this is multisite, add new user to current blog. |
| 425 | 382 | if ( is_multisite() && ! is_user_member_of_blog( $user->ID ) ) { |
| @@ -431,54 +388,12 @@ | ||
| 431 | 388 | } |
| 432 | 389 | } |
| 433 | 390 | |
| 434 | 391 | // Ensure user has the same role as their entry in the approved list. |
| 435 | - // Note: if any additional roles are defined to be added or removed, | |
| 436 | - // use add_role() instead of set_role() so we retain existing roles. | |
| 437 | 392 | if ( $user_info && ! in_array( $user_info['role'], $user->roles, true ) ) { |
| 438 | - if ( empty( $roles_to_add ) && empty( $roles_to_remove ) ) { | |
| 439 | - $user->set_role( $user_info['role'] ); | |
| 440 | - } else { | |
| 441 | - $user->add_role( $user_info['role'] ); | |
| 442 | - } | |
| 393 | + $user->set_role( $user_info['role'] ); | |
| 443 | 394 | } |
| 444 | 395 | |
| 445 | - /** | |
| 446 | - * Filter additional roles to add to the user currently logging in. This | |
| 447 | - * filter allows changing user roles based on custom CAS/LDAP attributes. | |
| 448 | - * | |
| 449 | - * @param array $roles_to_add Roles to add to the user currently logging in. | |
| 450 | - * @param array $user_data User data returned from external service. | |
| 451 | - * @param WP_User|false|null|WP_Error $user User object if logging in user exists. | |
| 452 | - */ | |
| 453 | - $roles_to_add = apply_filters( 'authorizer_custom_roles_to_add', $roles_to_add, $user_data, $user ); | |
| 454 | - | |
| 455 | - // Add additional roles to the user. Note: this only has partial support | |
| 456 | - // for multisite (it will only add roles to the current blog, not all blogs). | |
| 457 | - if ( ! empty( $roles_to_add ) ) { | |
| 458 | - foreach ( $roles_to_add as $role_to_add ) { | |
| 459 | - $user->add_role( $role_to_add ); | |
| 460 | - } | |
| 461 | - } | |
| 462 | - | |
| 463 | - /** | |
| 464 | - * Filter additional roles to remove from the user currently logging in. This | |
| 465 | - * filter allows changing user roles based on custom CAS/LDAP attributes. | |
| 466 | - * | |
| 467 | - * @param array $roles_to_remove Roles to remove from the user currently logging in. | |
| 468 | - * @param array $user_data User data returned from external service. | |
| 469 | - * @param WP_User|false|null|WP_Error $user User object if logging in user exists. | |
| 470 | - */ | |
| 471 | - $roles_to_remove = apply_filters( 'authorizer_custom_roles_to_remove', $roles_to_remove, $user_data, $user ); | |
| 472 | - | |
| 473 | - // Remove roles from the user. Note: this only has partial support for | |
| 474 | - // multisite (it will only remove roles from the current blog, not all blogs). | |
| 475 | - if ( ! empty( $roles_to_remove ) ) { | |
| 476 | - foreach ( $roles_to_remove as $role_to_remove ) { | |
| 477 | - $user->remove_role( $role_to_remove ); | |
| 478 | - } | |
| 479 | - } | |
| 480 | - | |
| 481 | 396 | return $user; |
| 482 | 397 | |
| 483 | 398 | } elseif ( 0 === strcasecmp( $user_email, $last_email ) ) { |
| 484 | 399 | /** |
| @@ -493,9 +408,9 @@ | ||
| 493 | 408 | $pending_user['email'] = Helper::lowercase( $user_email ); |
| 494 | 409 | $pending_user['role'] = $approved_role; |
| 495 | 410 | $pending_user['date_added'] = ''; |
| 496 | 411 | array_push( $auth_settings_access_users_pending, $pending_user ); |
| 497 | - update_option( 'auth_settings_access_users_pending', $auth_settings_access_users_pending, false ); | |
| 412 | + update_option( 'auth_settings_access_users_pending', $auth_settings_access_users_pending ); | |
| 498 | 413 | |
| 499 | 414 | // Create strings used in the email notification. |
| 500 | 415 | $site_name = get_bloginfo( 'name' ); |
| 501 | 416 | $site_url = get_bloginfo( 'url' ); |
| @@ -501,54 +416,28 @@ | ||
| 501 | 416 | $site_url = get_bloginfo( 'url' ); |
| 502 | 417 | $authorizer_options_url = 'settings' === $auth_settings['advanced_admin_menu'] ? admin_url( 'options-general.php?page=authorizer' ) : admin_url( '?page=authorizer' ); |
| 503 | 418 | |
| 504 | 419 | // Notify users with the role specified in "Which role should |
| 505 | - // receive email notifications about pending users?" and any | |
| 506 | - // individual users specified in "Which users should receive email | |
| 507 | - // notifications about pending users?". | |
| 508 | - if ( strlen( $auth_settings['access_role_receive_pending_emails'] ) > 0 || ! empty( $auth_settings['access_users_receive_pending_emails'] ) ) { | |
| 509 | - $emails_to_notify = array(); | |
| 510 | - // Add users with specified role (if any). | |
| 511 | - if ( strlen( $auth_settings['access_role_receive_pending_emails'] ) > 0 ) { | |
| 512 | - foreach ( get_users( array( 'role' => $auth_settings['access_role_receive_pending_emails'] ) ) as $user_recipient ) { | |
| 513 | - if ( ! empty( $user_recipient->user_email ) ) { | |
| 514 | - $emails_to_notify[] = $user_recipient->user_email; | |
| 515 | - } | |
| 516 | - } | |
| 420 | + // receive email notifications about pending users?". | |
| 421 | + if ( strlen( $auth_settings['access_role_receive_pending_emails'] ) > 0 ) { | |
| 422 | + foreach ( get_users( array( 'role' => $auth_settings['access_role_receive_pending_emails'] ) ) as $user_recipient ) { | |
| 423 | + wp_mail( | |
| 424 | + $user_recipient->user_email, | |
| 425 | + sprintf( | |
| 426 | + /* TRANSLATORS: 1: User email 2: Name of site */ | |
| 427 | + __( 'Action required: Pending user %1$s at %2$s', 'authorizer' ), | |
| 428 | + $pending_user['email'], | |
| 429 | + $site_name | |
| 430 | + ), | |
| 431 | + sprintf( | |
| 432 | + /* TRANSLATORS: 1: Name of site 2: URL of site 3: URL of authorizer */ | |
| 433 | + __( "A new user has tried to access the %1\$s site you manage at:\n%2\$s\n\nPlease log in to approve or deny their request:\n%3\$s\n", 'authorizer' ), | |
| 434 | + $site_name, | |
| 435 | + $site_url, | |
| 436 | + $authorizer_options_url | |
| 437 | + ) | |
| 438 | + ); | |
| 517 | 439 | } |
| 518 | - // Add individual users (if any). | |
| 519 | - if ( ! empty( $auth_settings['access_users_receive_pending_emails'] ) ) { | |
| 520 | - foreach ( $auth_settings['access_users_receive_pending_emails'] as $username ) { | |
| 521 | - $user_recipient = get_user_by( 'login', $username ); | |
| 522 | - if ( ! empty( $user_recipient->user_email ) ) { | |
| 523 | - $emails_to_notify[] = $user_recipient->user_email; | |
| 524 | - } | |
| 525 | - } | |
| 526 | - } | |
| 527 | - // Remove any duplicate email addresses (a user could potentially be | |
| 528 | - // added via their role and again via their username). | |
| 529 | - $emails_to_notify = array_unique( $emails_to_notify ); | |
| 530 | - // Email each recipient. | |
| 531 | - if ( count( $emails_to_notify ) > 0 ) { | |
| 532 | - foreach ( $emails_to_notify as $email ) { | |
| 533 | - wp_mail( | |
| 534 | - $email, | |
| 535 | - sprintf( | |
| 536 | - /* TRANSLATORS: 1: User email 2: Name of site */ | |
| 537 | - __( 'Action required: Pending user %1$s at %2$s', 'authorizer' ), | |
| 538 | - $pending_user['email'], | |
| 539 | - $site_name | |
| 540 | - ), | |
| 541 | - sprintf( | |
| 542 | - /* TRANSLATORS: 1: Name of site 2: URL of site 3: URL of authorizer */ | |
| 543 | - __( "A new user has tried to access the %1\$s site you manage at:\n%2\$s\n\nPlease log in to approve or deny their request:\n%3\$s\n", 'authorizer' ), | |
| 544 | - $site_name, | |
| 545 | - $site_url, | |
| 546 | - $authorizer_options_url | |
| 547 | - ) | |
| 548 | - ); | |
| 549 | - } | |
| 550 | - } | |
| 551 | 440 | } |
| 552 | 441 | } |
| 553 | 442 | |
| 554 | 443 | // Fetch the external service this user authenticated with, and append |
| @@ -557,21 +446,8 @@ | ||
| 557 | 446 | // because a pending user does not have a WP_User, and thus no |
| 558 | 447 | // "authenticated_by" usermeta that is normally used to do this. |
| 559 | 448 | $external_param = isset( $user_data['authenticated_by'] ) ? '&external=' . $user_data['authenticated_by'] : ''; |
| 560 | 449 | |
| 561 | - // Allow overriding the message pending users see after logging in. | |
| 562 | - if ( defined( 'AUTHORIZER_LOGIN_MESSAGE_PENDING_USERS' ) ) { | |
| 563 | - $auth_settings['access_pending_redirect_to_message'] = \AUTHORIZER_LOGIN_MESSAGE_PENDING_USERS; | |
| 564 | - } | |
| 565 | - /** | |
| 566 | - * Filters the message pending users see after logging in. | |
| 567 | - * | |
| 568 | - * @since 3.12.0 | |
| 569 | - * | |
| 570 | - * @param string $message The message content. | |
| 571 | - */ | |
| 572 | - $auth_settings['access_pending_redirect_to_message'] = apply_filters( 'authorizer_login_message_pending_users', $auth_settings['access_pending_redirect_to_message'] ); | |
| 573 | - | |
| 574 | 450 | // Notify user about pending status and return without authenticating them. |
| 575 | 451 | // phpcs:ignore WordPress.Security.NonceVerification |
| 576 | 452 | $redirect_to = ! empty( $_REQUEST['redirect_to'] ) ? esc_url_raw( wp_unslash( $_REQUEST['redirect_to'] ) ) : home_url(); |
| 577 | 453 | $page_title = get_bloginfo( 'name' ) . ' - Access Pending'; |
| @@ -581,9 +457,9 @@ | ||
| 581 | 457 | '<p style="text-align: center;">' . |
| 582 | 458 | '<a class="button" href="' . wp_logout_url( $redirect_to ) . $external_param . '">' . |
| 583 | 459 | __( 'Back', 'authorizer' ) . |
| 584 | 460 | '</a></p>'; |
| 585 | - update_option( 'auth_settings_advanced_login_error', $error_message, false ); | |
| 461 | + update_option( 'auth_settings_advanced_login_error', $error_message ); | |
| 586 | 462 | wp_die( wp_kses( $error_message, Helper::$allowed_html ), esc_html( $page_title ) ); |
| 587 | 463 | } |
| 588 | 464 | } |
| 589 | 465 | |
| @@ -588,8 +464,9 @@ | ||
| 588 | 464 | } |
| 589 | 465 | |
| 590 | 466 | // Sanity check: if we made it here without returning, something has gone wrong. |
| 591 | 467 | return new \WP_Error( 'invalid_login', __( 'Invalid login attempted.', 'authorizer' ) ); |
| 468 | + | |
| 592 | 469 | } |
| 593 | 470 | |
| 594 | 471 | |
| 595 | 472 | /** |
| @@ -643,9 +520,9 @@ | ||
| 643 | 520 | * add_filter( 'authorizer_has_access', 'my_feed_access_override', 10, 2 ); |
| 644 | 521 | */ |
| 645 | 522 | if ( apply_filters( 'authorizer_has_access', $has_access, $wp ) === true ) { |
| 646 | 523 | // Turn off the public notice about browsing anonymously. |
| 647 | - update_option( 'auth_settings_advanced_public_notice', false, true ); | |
| 524 | + update_option( 'auth_settings_advanced_public_notice', false ); | |
| 648 | 525 | |
| 649 | 526 | // We've determined that the current user has access, so simply return to grant access. |
| 650 | 527 | return $wp; |
| 651 | 528 | } |
| @@ -678,11 +555,11 @@ | ||
| 678 | 555 | $auth_settings['access_public_pages'] = array(); |
| 679 | 556 | } |
| 680 | 557 | if ( in_array( strval( $current_page_id ), $auth_settings['access_public_pages'], true ) ) { |
| 681 | 558 | if ( 'no_warning' === $auth_settings['access_public_warning'] ) { |
| 682 | - update_option( 'auth_settings_advanced_public_notice', false, true ); | |
| 559 | + update_option( 'auth_settings_advanced_public_notice', false ); | |
| 683 | 560 | } else { |
| 684 | - update_option( 'auth_settings_advanced_public_notice', true, true ); | |
| 561 | + update_option( 'auth_settings_advanced_public_notice', true ); | |
| 685 | 562 | } |
| 686 | 563 | return $wp; |
| 687 | 564 | } |
| 688 | 565 | |
| @@ -690,11 +567,11 @@ | ||
| 690 | 567 | $current_page_categories = wp_get_post_categories( $current_page_id, array( 'fields' => 'slugs' ) ); |
| 691 | 568 | foreach ( $current_page_categories as $current_page_category ) { |
| 692 | 569 | if ( in_array( 'cat_' . $current_page_category, $auth_settings['access_public_pages'], true ) ) { |
| 693 | 570 | if ( 'no_warning' === $auth_settings['access_public_warning'] ) { |
| 694 | - update_option( 'auth_settings_advanced_public_notice', false, true ); | |
| 571 | + update_option( 'auth_settings_advanced_public_notice', false ); | |
| 695 | 572 | } else { |
| 696 | - update_option( 'auth_settings_advanced_public_notice', true, true ); | |
| 573 | + update_option( 'auth_settings_advanced_public_notice', true ); | |
| 697 | 574 | } |
| 698 | 575 | return $wp; |
| 699 | 576 | } |
| 700 | 577 | } |
| @@ -702,11 +579,11 @@ | ||
| 702 | 579 | // Check to see if this page can't be found. If so, allow showing the 404 page. |
| 703 | 580 | if ( strlen( $current_page_id ) < 1 ) { |
| 704 | 581 | if ( in_array( 'auth_public_404', $auth_settings['access_public_pages'], true ) ) { |
| 705 | 582 | if ( 'no_warning' === $auth_settings['access_public_warning'] ) { |
| 706 | - update_option( 'auth_settings_advanced_public_notice', false, true ); | |
| 583 | + update_option( 'auth_settings_advanced_public_notice', false ); | |
| 707 | 584 | } else { |
| 708 | - update_option( 'auth_settings_advanced_public_notice', true, true ); | |
| 585 | + update_option( 'auth_settings_advanced_public_notice', true ); | |
| 709 | 586 | } |
| 710 | 587 | return $wp; |
| 711 | 588 | } |
| 712 | 589 | } |
| @@ -717,29 +594,16 @@ | ||
| 717 | 594 | $current_category_name_pieces = explode( '/', $current_category_name ); |
| 718 | 595 | $current_category_name = end( $current_category_name_pieces ); |
| 719 | 596 | if ( in_array( 'cat_' . $current_category_name, $auth_settings['access_public_pages'], true ) ) { |
| 720 | 597 | if ( 'no_warning' === $auth_settings['access_public_warning'] ) { |
| 721 | - update_option( 'auth_settings_advanced_public_notice', false, true ); | |
| 598 | + update_option( 'auth_settings_advanced_public_notice', false ); | |
| 722 | 599 | } else { |
| 723 | - update_option( 'auth_settings_advanced_public_notice', true, true ); | |
| 600 | + update_option( 'auth_settings_advanced_public_notice', true ); | |
| 724 | 601 | } |
| 725 | 602 | return $wp; |
| 726 | 603 | } |
| 727 | 604 | } |
| 728 | 605 | |
| 729 | - // Allow overriding the message anonymous users see. | |
| 730 | - if ( defined( 'AUTHORIZER_MESSAGE_ANONYMOUS_USERS' ) ) { | |
| 731 | - $auth_settings['access_redirect_to_message'] = \AUTHORIZER_MESSAGE_ANONYMOUS_USERS; | |
| 732 | - } | |
| 733 | - /** | |
| 734 | - * Filters the message anonymous users see when visiting public pages on a private site. | |
| 735 | - * | |
| 736 | - * @since 3.12.0 | |
| 737 | - * | |
| 738 | - * @param string $message The message content. | |
| 739 | - */ | |
| 740 | - $auth_settings['access_redirect_to_message'] = apply_filters( 'authorizer_message_anonymous_users', $auth_settings['access_redirect_to_message'] ); | |
| 741 | - | |
| 742 | 606 | // User is denied access, so show them the error message. Render as JSON |
| 743 | 607 | // if this is a REST API call; otherwise, show the error message via |
| 744 | 608 | // wp_die() (rendered html), or redirect to the login URL. |
| 745 | 609 | $current_path = ! empty( $_SERVER['REQUEST_URI'] ) ? esc_url_raw( wp_unslash( $_SERVER['REQUEST_URI'] ) ) : home_url(); |
| @@ -775,73 +639,9 @@ | ||
| 775 | 639 | // Sanity check: we should never get here. |
| 776 | 640 | wp_die( '<p>Access denied.</p>', 'Site Access Restricted' ); |
| 777 | 641 | } |
| 778 | 642 | |
| 779 | - /** | |
| 780 | - * If we're showing search results or a post listing (home or archive page) to | |
| 781 | - * an anonymous user, and Authorizer is configured to only allow logged in | |
| 782 | - * users to see the site, filter the query to only posts marked public. | |
| 783 | - * | |
| 784 | - * Action: pre_get_posts | |
| 785 | - * | |
| 786 | - * @param WP_Query $query The WP_Query instance (passed by reference). | |
| 787 | - * @return void | |
| 788 | - */ | |
| 789 | - public function remove_private_pages_from_search_and_archives( $query ) { | |
| 790 | - // It's possible for pre_get_posts to fire before wp-includes/pluggable.php | |
| 791 | - // is loaded, so verify before using the is_user_logged_in() function. | |
| 792 | - if ( ! function_exists( 'is_user_logged_in' ) ) { | |
| 793 | - require ABSPATH . WPINC . '/pluggable.php'; | |
| 794 | - } | |
| 795 | 643 | |
| 796 | - // Fix for edge case when viewing admin pages in Pressbooks (Undefined | |
| 797 | - // constant "SECURE_AUTH_COOKIE"). | |
| 798 | - if ( ! defined( 'SECURE_AUTH_COOKIE' ) ) { | |
| 799 | - wp_cookie_constants(); | |
| 800 | - } | |
| 801 | - | |
| 802 | - // Do nothing if user is logged in, this isn't the main query, or we're not | |
| 803 | - // showing search results, home page, or an archive page. | |
| 804 | - if ( | |
| 805 | - is_user_logged_in() || ! $query->is_main_query() || | |
| 806 | - ! ( $query->is_search() || $query->is_home() || $query->is_archive() ) | |
| 807 | - ) { | |
| 808 | - return; | |
| 809 | - } | |
| 810 | - | |
| 811 | - $options = Options::get_instance(); | |
| 812 | - $who_can_view = $options->get( 'access_who_can_view' ); | |
| 813 | - $public_pages = $options->get( 'access_public_pages' ); | |
| 814 | - $public_pages = is_array( $public_pages ) ? $public_pages : array(); | |
| 815 | - | |
| 816 | - // Do nothing if this site isn't restricted to logged in users only. | |
| 817 | - if ( 'logged_in_users' !== $who_can_view ) { | |
| 818 | - return; | |
| 819 | - } | |
| 820 | - | |
| 821 | - // Check for special public types (home, 404, categories). | |
| 822 | - $public_category_ids = array(); | |
| 823 | - foreach ( $public_pages as $index => $public_page ) { | |
| 824 | - if ( 'home' === $public_page || 'auth_public_404' === $public_page ) { | |
| 825 | - unset( $public_pages[ $index ] ); | |
| 826 | - } elseif ( 'cat_' === substr( $public_page, 0, 4 ) ) { | |
| 827 | - $public_category_name = substr( $public_page, 4 ); | |
| 828 | - unset( $public_pages[ $index ] ); | |
| 829 | - $public_category_ids[] = get_cat_ID( $public_category_name ); | |
| 830 | - } | |
| 831 | - } | |
| 832 | - if ( ! empty( $public_category_ids ) ) { | |
| 833 | - $pages_in_public_categories = get_posts( array( | |
| 834 | - 'posts_per_page' => -1, | |
| 835 | - 'fields' => 'ids', | |
| 836 | - 'category__in' => $public_category_ids, | |
| 837 | - ) ); | |
| 838 | - $public_pages = array_merge( $public_pages, $pages_in_public_categories ); | |
| 839 | - } | |
| 840 | - | |
| 841 | - $query->set( 'post__in', $public_pages ); | |
| 842 | - } | |
| 843 | - | |
| 844 | 644 | /** |
| 845 | 645 | * Prevent REST API access if user isn't authenticated and "only logged in |
| 846 | 646 | * users can see the site" is enabled. |
| 847 | 647 | * |
| @@ -865,21 +665,8 @@ | ||
| 865 | 665 | if ( |
| 866 | 666 | 'logged_in_users' === $auth_settings['access_who_can_view'] && |
| 867 | 667 | false === apply_filters( 'authorizer_has_access', false, $GLOBALS['wp'] ) |
| 868 | 668 | ) { |
| 869 | - // Allow overriding the message anonymous users see. | |
| 870 | - if ( defined( 'AUTHORIZER_MESSAGE_ANONYMOUS_USERS' ) ) { | |
| 871 | - $auth_settings['access_redirect_to_message'] = \AUTHORIZER_MESSAGE_ANONYMOUS_USERS; | |
| 872 | - } | |
| 873 | - /** | |
| 874 | - * Filters the message anonymous users see when visiting public pages on a private site. | |
| 875 | - * | |
| 876 | - * @since 3.12.0 | |
| 877 | - * | |
| 878 | - * @param string $message The message content. | |
| 879 | - */ | |
| 880 | - $auth_settings['access_redirect_to_message'] = apply_filters( 'authorizer_message_anonymous_users', $auth_settings['access_redirect_to_message'] ); | |
| 881 | - | |
| 882 | 669 | return new \WP_Error( |
| 883 | 670 | 'rest_cannot_view', |
| 884 | 671 | wp_strip_all_tags( $auth_settings['access_redirect_to_message'] ), |
| 885 | 672 | array( |
| @@ -898,13 +685,13 @@ | ||
| 898 | 685 | * the lists (pending, approved, blocked). Defaults to the list of |
| 899 | 686 | * approved users. |
| 900 | 687 | * |
| 901 | 688 | * @param string $email Email to check existent of. |
| 902 | - * @param string $user_list List to look for email in. | |
| 689 | + * @param string $list List to look for email in. | |
| 903 | 690 | * @param string $multisite_mode Admin context. |
| 904 | 691 | * @return boolean Whether email was found. |
| 905 | 692 | */ |
| 906 | - public function is_email_in_list( $email = '', $user_list = 'approved', $multisite_mode = 'single' ) { | |
| 693 | + public function is_email_in_list( $email = '', $list = 'approved', $multisite_mode = 'single' ) { | |
| 907 | 694 | if ( empty( $email ) ) { |
| 908 | 695 | return false; |
| 909 | 696 | } |
| 910 | 697 | |
| @@ -909,9 +696,9 @@ | ||
| 909 | 696 | } |
| 910 | 697 | |
| 911 | 698 | $options = Options::get_instance(); |
| 912 | 699 | |
| 913 | - switch ( $user_list ) { | |
| 700 | + switch ( $list ) { | |
| 914 | 701 | case 'pending': |
| 915 | 702 | $auth_settings_access_users_pending = $options->get( 'access_users_pending', Helper::SINGLE_CONTEXT ); |
| 916 | 703 | return Helper::in_multi_array( $email, $auth_settings_access_users_pending ); |
| 917 | 704 | case 'blocked': |
| @@ -953,5 +740,6 @@ | ||
| 953 | 740 | } |
| 954 | 741 | return Helper::in_multi_array( $email, $auth_settings_access_users_approved ); |
| 955 | 742 | } |
| 956 | 743 | } |
| 744 | + | |
| 957 | 745 | } |
