charitable / includes / user-management / class-charitable-user-management.php

class-charitable-user-management.php in Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) 1.7.0.2, at includes/user-management/class-charitable-user-management.php

415 lines 10.3 KB

Raw Download Zip

1	<?php
2	/**
3	* Class that manages the hook functions for the forgot password form.
4	*
5	* @package Charitable/User Management/User Management
6	* @author Rafe Colton, David Bisset
7	* @copyright Copyright (c) 2022, WP Charitable LLC
8	* @license http://opensource.org/licenses/gpl-2.0.php GNU Public License
9	* @since 1.4.0
10	* @version 1.6.47
11	*/
12
13	if ( ! defined( 'ABSPATH' ) ) {
14	exit;
15	}
16
17	if ( ! class_exists( 'Charitable_User_Management' ) ) :
18
19	/**
20	* Charitable_User_Management class
21	*
22	* @since 1.4.0
23	*/
24	class Charitable_User_Management {
25
26	/**
27	* The class instance.
28	*
29	* @var Charitable_User_Management
30	*
31	* @since 1.4.0
32	*/
33	private static $instance;
34
35	/**
36	* Returns and/or create the single instance of this class.
37	*
38	* @since 1.4.0
39	*
40	* @return Charitable_User_Management
41	*/
42	public static function get_instance() {
43	if ( is_null( self::$instance ) ) {
44	self::$instance = new self();
45	}
46
47	return self::$instance;
48	}
49
50	/**
51	* Set up the class.
52	*
53	* @since 1.4.0
54	*/
55	private function __construct() {
56	}
57
58	/**
59	* Check whether we have clicked on a password reset link.
60	*
61	* If so, redirect to the password reset page without the query string.
62	*
63	* @since 1.4.0
64	*
65	* @return false\|void False if no redirect takes place.
66	*/
67	public function maybe_redirect_to_password_reset() {
68	if ( ! charitable_is_page( 'reset_password_page' ) ) {
69	return false;
70	}
71
72	if ( ! isset( $_GET['key'] ) \|\| ! isset( $_GET['login'] ) ) {
73	return false;
74	}
75
76	$value = sprintf( '%s:%s', wp_unslash( $_GET['login'] ), wp_unslash( $_GET['key'] ) );
77
78	$this->set_reset_cookie( $value );
79
80	wp_safe_redirect( esc_url_raw( charitable_get_permalink( 'reset_password_page' ) ) );
81
82	exit();
83	}
84
85	/**
86	* Check if user is attempting to access the default reset password page
87	*
88	* If so, and charitable_disable_wp_login is set, redirect them to the custom reset password page
89	*
90	* @since 1.4.0
91	*
92	* @return void
93	*/
94	public function maybe_redirect_to_custom_password_reset_page() {
95	if ( ! apply_filters( 'charitable_disable_wp_login', false ) ) {
96	return;
97	}
98
99	if ( 'wp' == charitable_get_option( 'login_page', 'wp' ) ) {
100	return;
101	}
102
103	$redirect_url = charitable_get_permalink( 'reset_password_page' );
104	$redirect_url = add_query_arg( 'login', esc_attr( $_REQUEST['login'] ), $redirect_url );
105	$redirect_url = add_query_arg( 'key', esc_attr( $_REQUEST['key'] ), $redirect_url );
106
107	wp_safe_redirect( esc_url_raw( $redirect_url ) );
108
109	exit();
110	}
111
112	/**
113	* Check if a failed user login attempt originated from Charitable login form.
114	*
115	* If so redirect user to Charitable login page.
116	*
117	* @since 1.4.0
118	*
119	* @param WP_User\|WP_Error $user_or_error
120	* @param string $username
121	* @return WP_User\|void
122	*/
123	public function maybe_redirect_at_authenticate( $user_or_error, $username ) {
124	if ( 'POST' != $_SERVER['REQUEST_METHOD'] ) {
125	return $user_or_error;
126	}
127
128	if ( ! is_wp_error( $user_or_error ) ) {
129	return $user_or_error;
130	}
131
132	if ( ! isset( $_POST['charitable'] ) \|\| ! $_POST['charitable'] ) {
133	return $user_or_error;
134	}
135
136	foreach ( $user_or_error->errors as $code => $error ) {
137
138	/* Make sure the error messages link to our forgot password page, not WordPress' */
139	switch ( $code ) {
140
141	case 'invalid_email':
142	$error = __( '<strong>ERROR</strong>: Invalid email address.', 'charitable' ) .
143	' <a href="' . esc_url( charitable_get_permalink( 'forgot_password_page' ) ) . '">' .
144	__( 'Lost your password?' ) .
145	'</a>';
146	break;
147
148	case 'incorrect_password':
149	$error = sprintf(
150	/* translators: %s: email address */
151	__( '<strong>ERROR</strong>: The password you entered for %s is incorrect.' ),
152	'<strong>' . $username . '</strong>'
153	) .
154	' <a href="' . esc_url( charitable_get_permalink( 'forgot_password_page' ) ) . '">' .
155	__( 'Lost your password?' ) .
156	'</a>';
157	break;
158
159	default:
160	$error = $error[0];
161	}
162
163	charitable_get_notices()->add_error( $error );
164	}
165
166	charitable_get_session()->add_notices();
167
168	$redirect_url = charitable_get_permalink( 'login_page' );
169
170	if ( strlen( $username ) ) {
171	$redirect_url = add_query_arg( 'username', $username, $redirect_url );
172	}
173
174	wp_safe_redirect( esc_url_raw( $redirect_url ) );
175
176	exit();
177	}
178
179	/**
180	* Check if user is attempting to access the forgot password page
181	*
182	* If so, and charitable_disable_wp_login is set, redirect them to the custom forgot password page
183	*
184	* @since 1.4.0
185	*
186	* @return void
187	*/
188	public function maybe_redirect_to_custom_lostpassword() {
189	/**
190	* Set whether the WP login should be disabled.
191	*
192	* @since 1.4.0
193	*
194	* @param boolean $disable Whether to disable the WP login.
195	*/
196	if ( ! apply_filters( 'charitable_disable_wp_login', false ) ) {
197	return;
198	}
199
200	if ( 'wp' == charitable_get_option( 'login_page', 'wp' ) ) {
201	return;
202	}
203
204	if ( $_SERVER['REQUEST_METHOD'] != 'GET' ) {
205	return;
206	}
207
208	wp_safe_redirect( esc_url_raw( charitable_get_permalink( 'forgot_password_page' ) ) );
209
210	exit();
211	}
212
213	/**
214	* Set the password reset cookie.
215	*
216	* This is based on the WC_Shortcode_My_Account::set_reset_password_cookie()
217	* method in WooCommerce, which in turn is based on the core implementation
218	* in wp-login.php.
219	*
220	* @since 1.4.0
221	*
222	* @param string $value
223	* @return void
224	*/
225	public function set_reset_cookie( $value = '' ) {
226	$rp_cookie = 'wp-resetpass-' . COOKIEHASH;
227	$rp_path = current( explode( '?', wp_unslash( $_SERVER['REQUEST_URI'] ) ) );
228
229	if ( $value ) {
230	setcookie( $rp_cookie, $value, 0, $rp_path, COOKIE_DOMAIN, is_ssl(), true );
231	} else {
232	setcookie( $rp_cookie, ' ', time() - YEAR_IN_SECONDS, $rp_path, COOKIE_DOMAIN, is_ssl(), true );
233	}
234	}
235
236	/**
237	* Hides WP Admin bar if the user is not allowed to see it.
238	*
239	* Uses the builtin show_admin_bar function.
240	*
241	* @see show_admin_bar()
242	*
243	* @since 1.4.0
244	*/
245	public function maybe_remove_admin_bar() {
246	/**
247	* To enable the admin bar for users without admin bar access,
248	* you can use this one-liner:
249	*
250	* add_filter( 'charitable_disable_admin_bar', '__return_true' );
251	*/
252	if ( ! apply_filters( 'charitable_disable_admin_bar', true ) ) {
253	return;
254	}
255
256	if ( ! $this->user_has_admin_access() ) {
257	show_admin_bar( false );
258	}
259	}
260
261	/**
262	* Redirects the user away from /wp-admin if they are not authorized to access it.
263	*
264	* @since 1.4.0
265	*/
266	public function maybe_redirect_away_from_admin() {
267	/* Leave AJAX requests alone. */
268	if ( defined( 'DOING_AJAX' ) && DOING_AJAX ) {
269	return;
270	}
271
272	/**
273	* To enable admin access for users without admin access,
274	* you can use this one-liner:
275	*
276	* add_filter( 'charitable_disable_admin_access', '__return_true' );
277	*/
278	if ( ! apply_filters( 'charitable_disable_admin_access', true ) ) {
279	return;
280	}
281
282	if ( $this->user_has_admin_access() ) {
283	return;
284	}
285
286	/**
287	* Specify a custom URL that users should be redirected to.
288	*
289	* @since 1.4.0
290	*
291	* @param false\|string Return false to use the default. Otherwise this
292	* must return a URL on the same domain.
293	*/
294	$redirect_url = apply_filters( 'charitable_admin_redirect_url', false );
295
296	if ( ! $redirect_url ) {
297	$redirect_url = charitable_get_permalink( 'profile_page' );
298
299	if ( ! $redirect_url ) {
300	$redirect_url = home_url();
301	}
302	}
303
304	wp_safe_redirect( esc_url_raw( $redirect_url ) );
305
306	exit();
307	}
308
309	/**
310	* Redirect the user to the Charitable login page.
311	*
312	* @since 1.4.0
313	*
314	* @return void
315	*/
316	public function maybe_redirect_to_charitable_login() {
317	if ( ! apply_filters( 'charitable_disable_wp_login', false ) ) {
318	return;
319	}
320
321	if ( 'wp' == charitable_get_option( 'login_page', 'wp' ) ) {
322	return;
323	}
324
325	/* Don't prevent logging out. */
326	if ( 'GET' != $_SERVER['REQUEST_METHOD'] ) {
327	return;
328	}
329
330	wp_safe_redirect( esc_url_raw( charitable_get_permalink( 'login_page' ) ) );
331
332	exit();
333	}
334
335	/**
336	* Send the user verification email.
337	*
338	* @since 1.5.0
339	* @since 1.6.32
340	*
341	* @param WP_User $user An instance of `WP_User`.
342	* @param string $redirect_url Where the user should be redirected to after verifying their email.
343	* @param boolean\|null $force_send Whether the link should include an argument to force
344	* resending the email, even if it was sent recently.
345	* @return boolean True if the email is sent. False otherwise.
346	*/
347	public function send_verification_email( $user = '', $redirect_url = '', $force_send = null ) {
348	if ( empty( $user ) && array_key_exists( 'user', $_GET ) ) {
349	$user = wp_get_current_user();
350	}
351
352	if ( ! is_a( $user, 'WP_User' ) ) {
353	return false;
354	}
355
356	if ( is_null( $force_send ) ) {
357	$force_send = array_key_exists( 'force_send', $_GET ) && $_GET['force_send'];
358	}
359
360	if ( empty( $redirect_url ) && array_key_exists( 'redirect_url', $_GET ) ) {
361	$redirect_url = $_GET['redirect_url'];
362	}
363
364	/* Prepare the email. */
365	$email = new Charitable_Email_Email_Verification( array( 'user' => $user ) );
366
367	if ( ! $force_send && $email->sent_recently() ) {
368	return false;
369	}
370
371	if ( ! empty( $redirect_url ) ) {
372	/* Ensure that the redirect URL is encoded, but not double-encoded. */
373	$redirect_url = urlencode( urldecode( $redirect_url ) );
374
375	$email->set_redirect_url( $redirect_url );
376	}
377
378	/* If the confirmation link is generated correctly and the email is sent, set a notice. */
379	if ( is_wp_error( $email->get_confirmation_url() ) ) {
380	return false;
381	}
382
383	return $email->send();
384	}
385
386	/**
387	* Check whether the user has admin access.
388	*
389	* @since 1.4.0
390	*
391	* @return boolean
392	*/
393	private function user_has_admin_access() {
394	if ( ! is_user_logged_in() ) {
395	return false;
396	}
397
398	$has_access = current_user_can( 'edit_posts' )
399	\|\| current_user_can( 'manage_charitable_settings' )
400	\|\| current_user_can( 'edit_products' )
401	\|\| current_user_can( 'translate' );
402
403	/**
404	* Filter whether the user should have access to the WordPress dashboard.
405	*
406	* @since 1.4.0
407	*
408	* @param boolean $has_access Whether the user has access.
409	*/
410	return apply_filters( 'charitable_user_has_admin_access', $has_access );
411	}
412	}
413
414	endif;
415