charitable / includes / forms / class-charitable-reset-password-form.php

class-charitable-reset-password-form.php in Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) 1.6.22, at includes/forms/class-charitable-reset-password-form.php

253 lines 6.0 KB

Raw Download Zip

1	<?php
2	/**
3	* Class that manages the display and processing of the reset password form.
4	*
5	* @package Charitable/Classes/Charitable_Reset_Password_Form
6	* @version 1.5.1
7	* @author Rafe Colton, Eric Daams
8	* @copyright Copyright (c) 2019, Studio 164a
9	* @license http://opensource.org/licenses/gpl-2.0.php GNU Public License
10	*/
11	if ( ! defined( 'ABSPATH' ) ) { exit; }
12
13	if ( ! class_exists( 'Charitable_Reset_Password_Form' ) ) :
14
15	/**
16	* Charitable_Reset_Password_Form
17	*
18	* @since 1.4.0
19	*/
20	class Charitable_Reset_Password_Form extends Charitable_Form {
21
22	/**
23	* @since 1.4.0
24	*
25	* @var string
26	*/
27	protected $nonce_action = 'charitable_reset_password';
28
29	/**
30	* @since 1.4.0
31	*
32	* @var string
33	*/
34	protected $nonce_name = '_charitable_reset_password_nonce';
35
36	/**
37	* Form action.
38	*
39	* @since 1.4.0
40	*
41	* @var string
42	*/
43	protected $form_action = 'reset_password';
44
45	/**
46	* Reset key.
47	*
48	* @since 1.4.0
49	*
50	* @var string\|null
51	*/
52	protected $key;
53
54	/**
55	* Form action.
56	*
57	* @since 1.4.0
58	*
59	* @var string\|null
60	*/
61	protected $login;
62
63	/**
64	* Whether the reset key is available.
65	*
66	* @since 1.5.0
67	*
68	* @var boolean
69	*/
70	protected $has_key;
71
72	/**
73	* Create class object.
74	*
75	* @since 1.4.0
76	*
77	* @param array $args User-defined shortcode attributes.
78	*/
79	public function __construct( $args = array() ) {
80	$this->id = uniqid();
81	$this->has_key = $this->parse_reset_key();
82
83	/* For backwards-compatibility */
84	add_action( 'charitable_form_field', array( $this, 'render_field' ), 10, 6 );
85	}
86
87	/**
88	* Return whether the reset key is set correctly.
89	*
90	* If this returns false, the password reset will always fail so we avoid
91	* displaying the form at all.
92	*
93	* @since 1.5.0
94	*
95	* @return boolean
96	*/
97	public function has_key() {
98	return $this->has_key;
99	}
100
101	/**
102	* Retrieve hidden fields.
103	*
104	* @since 1.5.0
105	*
106	* @return array
107	*/
108	public function get_hidden_fields() {
109	$fields = parent::get_hidden_fields();
110	$fields['key'] = $this->key;
111	$fields['login'] = array(
112	'value' => $this->login,
113	'autocomplete' => 'off',
114	);
115	return $fields;
116	}
117
118	/**
119	* Reset password fields to be displayed.
120	*
121	* @since 1.4.0
122	*
123	* @return array
124	*/
125	public function get_fields() {
126	if ( ! $this->has_key ) {
127	return array();
128	}
129
130	$fields = apply_filters( 'charitable_reset_password_fields', array(
131	'pass1' => array(
132	'label' => __( 'New Password', 'charitable' ),
133	'type' => 'password',
134	'required' => true,
135	'priority' => 10,
136	'attrs' => array(
137	'size' => 20,
138	'autocomplete' => 'off',
139	),
140	),
141	'pass2' => array(
142	'label' => __( 'Repeat New Password', 'charitable' ),
143	'type' => 'password',
144	'required' => true,
145	'priority' => 11,
146	'attrs' => array(
147	'size' => 20,
148	'autocomplete' => 'off',
149	),
150	),
151	) );
152
153	uasort( $fields, 'charitable_priority_sort' );
154
155	return $fields;
156	}
157
158	/**
159	* Reset the password.
160	*
161	* @since 1.4.0
162	*
163	* @return bool\|WP_Error True: when finish. WP_Error on error
164	*/
165	public static function reset_password() {
166	$form = new Charitable_Reset_Password_Form();
167
168	if ( ! $form->validate_nonce() \|\| ! $form->validate_honeypot() ) {
169	charitable_get_notices()->add_error( __( 'There was an error with processing your form submission. Please reload the page and try again.', 'charitable' ) );
170	return;
171	}
172
173	/* The key and login must be set. */
174	if ( ! isset( $_POST['key'] ) \|\| ! isset( $_POST['login'] ) ) {
175	charitable_get_notices()->add_error( '<strong>ERROR:</strong> Invalid reset key.', 'charitable' );
176	return;
177	}
178
179	$user = check_password_reset_key( $_POST['key'], $_POST['login'] );
180
181	if ( is_wp_error( $user ) ) {
182	charitable_get_notices()->add_errors_from_wp_error( $user );
183	return;
184	}
185
186	/* One of the passwords was not set. */
187	if ( ! isset( $_POST['pass1'] ) \|\| ! isset( $_POST['pass2'] ) ) {
188	charitable_get_notices()->add_error( '<strong>ERROR:</strong> You must enter both passwords.', 'charitable' );
189	return;
190	}
191
192	/* The passwords do not match. */
193	if ( $_POST['pass1'] != $_POST['pass2'] ) {
194	charitable_get_notices()->add_error( __( '<strong>ERROR:</strong> The two passwords you entered don\'t match.', 'charitable' ) );
195	return;
196	}
197
198	/* Parameter checks OK, reset password */
199	reset_password( $user, $_POST['pass1'] );
200
201	charitable_get_notices()->add_success( __( 'Your password was successfully changed.', 'charitable' ) );
202
203	charitable_get_session()->add_notices();
204
205	wp_safe_redirect( charitable_get_permalink( 'login_page' ) );
206
207	exit();
208	}
209
210	/**
211	* Get the reset key and login from the cookie.
212	*
213	* @since 1.4.0
214	* @since 1.5.0 Returns a boolean to indicate whether the key and login are available.
215	*
216	* @return boolean True if the reset key is found. False otherwise.
217	*/
218	protected function parse_reset_key() {
219	$this->key = null;
220	$this->login = null;
221
222	if ( ! isset( $_COOKIE[ 'wp-resetpass-' . COOKIEHASH ] ) ) {
223	charitable_get_notices()->add_error( __( 'Missing password reset key.', 'charitable' ) );
224	return false;
225	}
226
227	$cookie = $_COOKIE[ 'wp-resetpass-' . COOKIEHASH ];
228
229	if ( ! strpos( $cookie, ':' ) ) {
230	charitable_get_notices()->add_error( __( 'Missing password reset key.', 'charitable' ) );
231	return false;
232	}
233
234	$cookie_parts = explode( ':', wp_unslash( $cookie ), 2 );
235	list( $login, $key ) = array_map( 'sanitize_text_field', $cookie_parts );
236	$user = check_password_reset_key( $key, $login );
237
238	if ( is_wp_error( $user ) ) {
239	charitable_get_notices()->add_errors_from_wp_error( $user );
240	Charitable_User_Management::get_instance()->set_reset_cookie();
241	return false;
242	}
243
244	/* Reset key / login is correct, display reset password form with hidden key / login values */
245	$this->key = $key;
246	$this->login = $login;
247
248	return true;
249	}
250	}
251
252	endif;
253