| @@ -22,9 +22,9 @@ | ||
| 22 | 22 | |
| 23 | 23 | /** |
| 24 | 24 | * Main plugin class. Activates/deactivates the plugin, and registers all hooks. |
| 25 | 25 | */ |
| 26 | -class WP_Plugin_Authorizer extends Static_Instance { | |
| 26 | +class WP_Plugin_Authorizer extends Singleton { | |
| 27 | 27 | |
| 28 | 28 | /** |
| 29 | 29 | * Constructor. |
| 30 | 30 | */ |
| @@ -40,8 +40,9 @@ | ||
| 40 | 40 | // Custom wp authentication routine using external service. |
| 41 | 41 | add_filter( 'authenticate', array( Authentication::get_instance(), 'custom_authenticate' ), 1, 3 ); |
| 42 | 42 | |
| 43 | 43 | // Custom logout action using external service. |
| 44 | + add_action( 'clear_auth_cookie', array( Authentication::get_instance(), 'pre_logout' ) ); | |
| 44 | 45 | add_action( 'wp_logout', array( Authentication::get_instance(), 'custom_logout' ) ); |
| 45 | 46 | |
| 46 | 47 | // Create settings link on Plugins page. |
| 47 | 48 | add_filter( 'plugin_action_links_' . plugin_basename( plugin_root() ), array( Admin_Page::get_instance(), 'plugin_settings_link' ) ); |
| @@ -49,8 +50,11 @@ | ||
| 49 | 50 | |
| 50 | 51 | // Modify login page with a custom password url (if option is set). |
| 51 | 52 | add_filter( 'lostpassword_url', array( Login_Form::get_instance(), 'custom_lostpassword_url' ) ); |
| 52 | 53 | |
| 54 | + // Modify the log in URL (if applicable options are set). | |
| 55 | + add_filter( 'login_url', array( Login_Form::get_instance(), 'maybe_add_external_wordpress_to_log_in_links' ) ); | |
| 56 | + | |
| 53 | 57 | // If we have a custom login error, add the filter to show it. |
| 54 | 58 | $error = get_option( 'auth_settings_advanced_login_error' ); |
| 55 | 59 | if ( $error && strlen( $error ) > 0 ) { |
| 56 | 60 | add_filter( 'login_errors', array( Login_Form::get_instance(), 'show_advanced_login_error' ) ); |
| @@ -55,8 +59,11 @@ | ||
| 55 | 59 | if ( $error && strlen( $error ) > 0 ) { |
| 56 | 60 | add_filter( 'login_errors', array( Login_Form::get_instance(), 'show_advanced_login_error' ) ); |
| 57 | 61 | } |
| 58 | 62 | |
| 63 | + // Redirect to wp-login.php?redirect_to=? destination after an Azure login. | |
| 64 | + add_filter( 'login_redirect', array( Options\External\OAuth2::get_instance(), 'maybe_redirect_after_azure_login' ), 10, 2 ); | |
| 65 | + | |
| 59 | 66 | // Enable localization. Translation files stored in /languages. |
| 60 | 67 | add_action( 'plugins_loaded', array( $this, 'load_textdomain' ) ); |
| 61 | 68 | |
| 62 | 69 | // Perform plugin updates if newer version installed. |
| @@ -73,10 +80,11 @@ | ||
| 73 | 80 | |
| 74 | 81 | // Create options page. |
| 75 | 82 | add_action( 'admin_init', array( Admin_Page::get_instance(), 'page_init' ) ); |
| 76 | 83 | |
| 77 | - // Update user role in approved list if it's changed in the WordPress edit user page. | |
| 78 | - add_action( 'user_profile_update_errors', array( Sync_Userdata::get_instance(), 'edit_user_profile_update_role' ), 10, 3 ); | |
| 84 | + // Update user role in approved list if it's changed via bulk action on the | |
| 85 | + // WordPress list users page (and anywhere else WP_User::set_role() is called). | |
| 86 | + add_action( 'set_user_role', array( Sync_Userdata::get_instance(), 'set_user_role_sync_role' ), 10, 3 ); | |
| 79 | 87 | |
| 80 | 88 | // Update user email in approved list if it's changed in the WordPress edit user page. |
| 81 | 89 | add_filter( 'send_email_change_email', array( Sync_Userdata::get_instance(), 'edit_user_profile_update_email' ), 10, 3 ); |
| 82 | 90 | |
| @@ -82,18 +90,16 @@ | ||
| 82 | 90 | |
| 83 | 91 | // Enqueue javascript and css on the plugin's options page, the |
| 84 | 92 | // dashboard (for the widget), and the network admin. |
| 85 | 93 | add_action( 'load-settings_page_authorizer', array( Admin_Page::get_instance(), 'load_options_page' ) ); |
| 94 | + add_action( 'load-toplevel_page_authorizer', array( Admin_Page::get_instance(), 'load_options_page' ) ); | |
| 86 | 95 | add_action( 'admin_head-index.php', array( Admin_Page::get_instance(), 'load_options_page' ) ); |
| 87 | - add_action( 'load-toplevel_page_authorizer', array( Admin_Page::get_instance(), 'load_options_page' ) ); | |
| 96 | + add_action( 'admin_head-index.php', array( Dashboard_Widget::get_instance(), 'widget_scripts' ) ); | |
| 88 | 97 | |
| 89 | 98 | // Add custom css and js to wp-login.php. |
| 90 | 99 | add_action( 'login_enqueue_scripts', array( Login_Form::get_instance(), 'login_enqueue_scripts_and_styles' ) ); |
| 91 | 100 | add_action( 'login_footer', array( Login_Form::get_instance(), 'load_login_footer_js' ) ); |
| 92 | 101 | |
| 93 | - // Create google nonce cookie when loading wp-login.php if Google is enabled. | |
| 94 | - add_action( 'login_init', array( Login_Form::get_instance(), 'login_init__maybe_set_google_nonce_cookie' ) ); | |
| 95 | - | |
| 96 | 102 | // Modify login page with external auth links (if enabled; e.g., google or cas). |
| 97 | 103 | add_action( 'login_form', array( Login_Form::get_instance(), 'login_form_add_external_service_links' ) ); |
| 98 | 104 | |
| 99 | 105 | // Redirect to CAS login when visiting login page (only if option is |
| @@ -103,12 +109,33 @@ | ||
| 103 | 109 | // output is started (so the redirect header doesn't complain about data |
| 104 | 110 | // already being sent). |
| 105 | 111 | add_filter( 'wp_login_errors', array( Login_Form::get_instance(), 'wp_login_errors__maybe_redirect_to_cas' ), 10, 2 ); |
| 106 | 112 | |
| 113 | + // Redirect to OAuth2 login when visiting login page (only if option is | |
| 114 | + // enabled, OAuth2 is the only service, and WordPress logins are hidden). | |
| 115 | + // Note: hook into wp_login_errors filter so this fires after the | |
| 116 | + // authenticate hook (where the redirect to OAuth2 happens), but before html | |
| 117 | + // output is started (so the redirect header doesn't complain about data | |
| 118 | + // already being sent). | |
| 119 | + add_filter( 'wp_login_errors', array( Login_Form::get_instance(), 'wp_login_errors__maybe_redirect_to_oauth2' ), 10, 2 ); | |
| 120 | + | |
| 121 | + // Prevent access to password reset if WordPress logins are disabled. | |
| 122 | + add_filter( 'lost_password_html_link', array( Login_Form::get_instance(), 'maybe_hide_lost_password_link' ), PHP_INT_MAX, 1 ); | |
| 123 | + add_action( 'lost_password', array( Login_Form::get_instance(), 'maybe_hide_lost_password_form' ), PHP_INT_MAX, 1 ); | |
| 124 | + add_filter( 'lostpassword_errors', array( Login_Form::get_instance(), 'maybe_prevent_password_reset' ), PHP_INT_MAX, 1 ); | |
| 125 | + | |
| 107 | 126 | // Verify current user has access to page they are visiting. |
| 108 | 127 | add_action( 'parse_request', array( Authorization::get_instance(), 'restrict_access' ), 9 ); |
| 109 | 128 | add_action( 'init', array( Sync_Userdata::get_instance(), 'init__maybe_add_network_approved_user' ) ); |
| 110 | 129 | |
| 130 | + // Hide private pages in search and archives for anonymous users if "only | |
| 131 | + // logged in users can see the site" is enabled. | |
| 132 | + add_action( 'pre_get_posts', array( Authorization::get_instance(), 'remove_private_pages_from_search_and_archives' ), 10, 1 ); | |
| 133 | + | |
| 134 | + // Prevent REST API access if user isn't authenticated and "only logged in | |
| 135 | + // users can see the site" is enabled. | |
| 136 | + add_action( 'rest_authentication_errors', array( Authorization::get_instance(), 'restrict_rest_api' ), 10, 1 ); | |
| 137 | + | |
| 111 | 138 | // AJAX: Save options from dashboard widget. |
| 112 | 139 | add_action( 'wp_ajax_update_auth_user', array( Ajax_Endpoints::get_instance(), 'ajax_update_auth_user' ) ); |
| 113 | 140 | |
| 114 | 141 | // AJAX: Save options from multisite options page. |
| @@ -123,8 +150,11 @@ | ||
| 123 | 150 | |
| 124 | 151 | // AJAX: Refresh approved user list. |
| 125 | 152 | add_action( 'wp_ajax_refresh_approved_user_list', array( Ajax_Endpoints::get_instance(), 'ajax_refresh_approved_user_list' ) ); |
| 126 | 153 | |
| 154 | + // AJAX: Test LDAP user. | |
| 155 | + add_action( 'wp_ajax_auth_settings_ldap_test_user', array( Ajax_Endpoints::get_instance(), 'ajax_auth_settings_ldap_test_user' ) ); | |
| 156 | + | |
| 127 | 157 | // Add dashboard widget so instructors can add/edit users with access. |
| 128 | 158 | // Hint: For Multisite Network Admin Dashboard use wp_network_dashboard_setup instead of wp_dashboard_setup. |
| 129 | 159 | add_action( 'wp_dashboard_setup', array( Dashboard_Widget::get_instance(), 'add_dashboard_widgets' ) ); |
| 130 | 160 | |
| @@ -134,8 +164,11 @@ | ||
| 134 | 164 | add_action( 'admin_notices', array( Admin_Page::get_instance(), 'show_advanced_admin_notice' ) ); |
| 135 | 165 | add_action( 'network_admin_notices', array( Admin_Page::get_instance(), 'show_advanced_admin_notice' ) ); |
| 136 | 166 | } |
| 137 | 167 | |
| 168 | + // Add [authorizer_login_form] shortcode to render the login form. | |
| 169 | + add_shortcode( 'authorizer_login_form', array( Login_Form::get_instance(), 'shortcode_authorizer_login_form' ) ); | |
| 170 | + | |
| 138 | 171 | // Load custom javascript for the main site (e.g., for displaying alerts). |
| 139 | 172 | add_action( 'wp_enqueue_scripts', array( Login_Form::get_instance(), 'auth_public_scripts' ), 20 ); |
| 140 | 173 | |
| 141 | 174 | // Multisite-specific actions. |
| @@ -167,9 +200,8 @@ | ||
| 167 | 200 | add_action( 'grant_super_admin', array( Sync_Userdata::get_instance(), 'grant_super_admin__add_to_network_approved' ) ); |
| 168 | 201 | // Remove user from network approved users (and add them to the approved |
| 169 | 202 | // list on sites they are already on) when super admin status is removed. |
| 170 | 203 | add_action( 'revoke_super_admin', array( Sync_Userdata::get_instance(), 'revoke_super_admin__remove_from_network_approved' ) ); |
| 171 | - | |
| 172 | 204 | } |
| 173 | 205 | |
| 174 | 206 | |
| 175 | 207 | /** |
| @@ -191,18 +223,22 @@ | ||
| 191 | 223 | // phpcs:ignore WordPress.CSRF.NonceVerification.NoNonceVerification |
| 192 | 224 | if ( is_multisite() && $network_wide ) { |
| 193 | 225 | |
| 194 | 226 | // Add super admins to the multisite approved list. |
| 195 | - $auth_multisite_settings_access_users_approved = get_blog_option( get_network()->blog_id, 'auth_multisite_settings_access_users_approved', array() ); | |
| 227 | + $auth_multisite_settings_access_users_approved = get_blog_option( get_main_site_id( get_main_network_id() ), 'auth_multisite_settings_access_users_approved', array() ); | |
| 196 | 228 | $should_update_auth_multisite_settings_access_users_approved = false; |
| 197 | 229 | foreach ( get_super_admins() as $super_admin ) { |
| 198 | 230 | $user = get_user_by( 'login', $super_admin ); |
| 231 | + // Skip if user wasn't found (edge case). | |
| 232 | + if ( empty( $user ) ) { | |
| 233 | + continue; | |
| 234 | + } | |
| 199 | 235 | // Add to approved list if not there. |
| 200 | 236 | if ( ! Helper::in_multi_array( $user->user_email, $auth_multisite_settings_access_users_approved ) ) { |
| 201 | 237 | $approved_user = array( |
| 202 | 238 | 'email' => Helper::lowercase( $user->user_email ), |
| 203 | - 'role' => count( $user->roles ) > 0 ? $user->roles[0] : 'administrator', | |
| 204 | - 'date_added' => date( 'M Y', strtotime( $user->user_registered ) ), | |
| 239 | + 'role' => is_array( $user->roles ) && count( $user->roles ) > 0 ? $user->roles[0] : 'administrator', | |
| 240 | + 'date_added' => wp_date( 'M Y', strtotime( $user->user_registered ) ), | |
| 205 | 241 | 'local_user' => true, |
| 206 | 242 | ); |
| 207 | 243 | array_push( $auth_multisite_settings_access_users_approved, $approved_user ); |
| 208 | 244 | $should_update_auth_multisite_settings_access_users_approved = true; |
| @@ -208,9 +244,9 @@ | ||
| 208 | 244 | $should_update_auth_multisite_settings_access_users_approved = true; |
| 209 | 245 | } |
| 210 | 246 | } |
| 211 | 247 | if ( $should_update_auth_multisite_settings_access_users_approved ) { |
| 212 | - update_blog_option( get_network()->blog_id, 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved ); | |
| 248 | + update_blog_option( get_main_site_id( get_main_network_id() ), 'auth_multisite_settings_access_users_approved', $auth_multisite_settings_access_users_approved ); | |
| 213 | 249 | } |
| 214 | 250 | |
| 215 | 251 | // Run plugin activation on each site in the network. |
| 216 | 252 | $current_blog_id = $wpdb->blogid; |
| @@ -229,9 +265,8 @@ | ||
| 229 | 265 | // Set default plugin options and add current users to approved list. |
| 230 | 266 | $options->set_default_options(); |
| 231 | 267 | $sync_userdata->add_wp_users_to_approved_list(); |
| 232 | 268 | } |
| 233 | - | |
| 234 | 269 | } |
| 235 | 270 | |
| 236 | 271 | |
| 237 | 272 | /** |
| @@ -255,6 +290,5 @@ | ||
| 255 | 290 | false, |
| 256 | 291 | basename( dirname( plugin_root() ) ) . '/languages' |
| 257 | 292 | ); |
| 258 | 293 | } |
| 259 | - | |
| 260 | 294 | } |
