| @@ -63,9 +63,9 @@ | ||
| 63 | 63 | public function get_submitted_password() { |
| 64 | 64 | $password = ''; |
| 65 | 65 | foreach ( array( 'pwd', 'pass1', 'password', 'edd_user_pass', 'password_1', 'account_password' ) as $key ) { |
| 66 | 66 | $submitted_pass = HTTP::post( $key ); |
| 67 | - if ( ! empty( $submitted_pass ) ) { | |
| 67 | + if ( '' !== $submitted_pass ) { | |
| 68 | 68 | $password = $submitted_pass; |
| 69 | 69 | break; |
| 70 | 70 | } |
| 71 | 71 | } |
| @@ -124,14 +124,14 @@ | ||
| 124 | 124 | if ( is_multisite() && is_super_admin( $user->ID ) ) { |
| 125 | 125 | return false; |
| 126 | 126 | } |
| 127 | 127 | |
| 128 | - if ( empty( $user->roles ) ) { | |
| 128 | + if ( ! isset( $user->roles ) || array() === $user->roles ) { | |
| 129 | 129 | // WP_User does have data about roles sometimes, e.g. on the Profile page, so we get it from userdata. |
| 130 | 130 | $user_id = $user->ID; |
| 131 | 131 | if ( ! is_multisite() ) { |
| 132 | 132 | $user_meta = get_userdata( $user_id ); |
| 133 | - if ( empty( $user_meta->roles ) ) { | |
| 133 | + if ( ! isset( $user_meta->roles ) || array() === $user_meta->roles ) { | |
| 134 | 134 | // User should have roles. |
| 135 | 135 | $this->log( sprintf( "User ID: %d doesn't have roles.", $user_id ), self::PASSWORD_LOG ); |
| 136 | 136 | |
| 137 | 137 | return false; |
| @@ -138,9 +138,9 @@ | ||
| 138 | 138 | } |
| 139 | 139 | $user_roles = $user_meta->roles; |
| 140 | 140 | } else { |
| 141 | 141 | $arr_user_blogs = get_blogs_of_user( $user_id ); |
| 142 | - if ( empty( $arr_user_blogs ) ) { | |
| 142 | + if ( ! is_array( $arr_user_blogs ) || array() === $arr_user_blogs ) { | |
| 143 | 143 | // User should be associated with some site. |
| 144 | 144 | $this->log( sprintf( 'User ID: %d is not associated with any site.', $user_id ), self::PASSWORD_LOG ); |
| 145 | 145 | |
| 146 | 146 | return false; |
| @@ -146,9 +146,9 @@ | ||
| 146 | 146 | return false; |
| 147 | 147 | } |
| 148 | 148 | $user_blog_id = array_key_first( $arr_user_blogs ); |
| 149 | 149 | $user = new WP_User( $user_id, '', $user_blog_id ); |
| 150 | - if ( empty( $user->roles ) ) { | |
| 150 | + if ( ! isset( $user->roles ) || array() === $user->roles ) { | |
| 151 | 151 | $this->log( sprintf( "User ID: %d doesn't have roles on MU.", $user->ID ), self::PASSWORD_LOG ); |
| 152 | 152 | |
| 153 | 153 | return false; |
| 154 | 154 | } |
| @@ -157,9 +157,10 @@ | ||
| 157 | 157 | } else { |
| 158 | 158 | $user_roles = $user->roles; |
| 159 | 159 | } |
| 160 | 160 | |
| 161 | - return ! empty( array_intersect( $selected_user_roles, $user_roles ) ); | |
| 161 | + $common_roles = array_intersect( $selected_user_roles, $user_roles ); | |
| 162 | + return array() !== $common_roles; | |
| 162 | 163 | } |
| 163 | 164 | |
| 164 | 165 | /** |
| 165 | 166 | * Get reset password redirect URL. |
| @@ -204,9 +205,19 @@ | ||
| 204 | 205 | * @param int $time The expiration time of the cookie. |
| 205 | 206 | */ |
| 206 | 207 | public function set_cookie_notice( $name, $value, $time ) { |
| 207 | 208 | if ( ! isset( $_COOKIE[ $name ] ) ) { |
| 208 | - setcookie( $name, $value, $time, '/' ); | |
| 209 | + setcookie( | |
| 210 | + $name, | |
| 211 | + $value, | |
| 212 | + array( | |
| 213 | + 'expires' => $time, | |
| 214 | + 'path' => '/', | |
| 215 | + 'secure' => is_ssl(), | |
| 216 | + 'httponly' => true, | |
| 217 | + 'samesite' => 'Lax', | |
| 218 | + ) | |
| 219 | + ); | |
| 209 | 220 | } |
| 210 | 221 | } |
| 211 | 222 | |
| 212 | 223 | /** |
| @@ -220,9 +231,19 @@ | ||
| 220 | 231 | * @since 4.3.0 Removed the $time parameter. |
| 221 | 232 | */ |
| 222 | 233 | public function remove_cookie_notice( string $name ): void { |
| 223 | 234 | if ( isset( $_COOKIE[ $name ] ) && ! headers_sent() ) { |
| 224 | - setcookie( $name, '', time() - YEAR_IN_SECONDS, '/' ); | |
| 235 | + setcookie( | |
| 236 | + $name, | |
| 237 | + '', | |
| 238 | + array( | |
| 239 | + 'expires' => time() - YEAR_IN_SECONDS, | |
| 240 | + 'path' => '/', | |
| 241 | + 'secure' => is_ssl(), | |
| 242 | + 'httponly' => true, | |
| 243 | + 'samesite' => 'Lax', | |
| 244 | + ) | |
| 245 | + ); | |
| 225 | 246 | } |
| 226 | 247 | $this->remove_extra_cookies(); |
| 227 | 248 | } |
| 228 | 249 | |
| @@ -240,9 +261,10 @@ | ||
| 240 | 261 | |
| 241 | 262 | $changed = (int) get_user_meta( $user->ID, 'wd_last_password_change', true ); |
| 242 | 263 | |
| 243 | 264 | if ( ! $changed ) { |
| 244 | - return (int) strtotime( $user->user_registered ); | |
| 265 | + $changed = strtotime( $user->user_registered ); | |
| 266 | + $changed = ! is_int( $changed ) ? (int) $changed : $changed; | |
| 245 | 267 | } |
| 246 | 268 | |
| 247 | 269 | return $changed; |
| 248 | 270 | } |
