← All changes | includes/login-register.php +33 -20 2.3.0 → 4.16.9 View file →

		@@ -3,9 +3,9 @@
3	3	* Login / Register Functions
4	4	*
5	5	* @package Give
6	6	* @subpackage Functions/Login
7		- * @copyright Copyright (c) 2016, WordImpress
	7	+ * @copyright Copyright (c) 2016, GiveWP
8	8	* @license https://opensource.org/licenses/gpl-license GNU Public License
9	9	* @since 1.0
10	10	*/
11	11
		@@ -97,23 +97,27 @@
97	97	*
98	98	* @return void
99	99	*/
100	100	function give_process_login_form( $data ) {
	101	+
101	102	if ( wp_verify_nonce( $data['give_login_nonce'], 'give-login-nonce' ) ) {
102	103
103	104	// Set Receipt Access Session.
104		- if ( ! empty( $_GET['payment_key'] ) ) {
	105	+ if ( ! empty( $_GET['donation_id'] ) ) {
105	106	Give()->session->set( 'receipt_access', true );
106	107	}
107	108
108	109	$user_data = get_user_by( 'login', $data['give_user_login'] );
	110	+
109	111	if ( ! $user_data ) {
110	112	$user_data = get_user_by( 'email', $data['give_user_login'] );
111	113	}
	114	+
112	115	if ( $user_data ) {
113		- $user_ID = $user_data->ID;
114		- $user_email = $user_data->user_email;
115		- if ( wp_check_password( $data['give_user_pass'], $user_data->user_pass, $user_ID ) ) {
	116	+
	117	+ $user_id = $user_data->ID;
	118	+
	119	+ if ( wp_check_password( $data['give_user_pass'], $user_data->user_pass, $user_id ) ) {
116	120	give_log_user_in( $user_data->ID, $data['give_user_login'], $data['give_user_pass'] );
117	121	} else {
118	122	give_set_error( 'password_incorrect', __( 'The password you entered is incorrect.', 'give' ) );
119	123	}
		@@ -119,12 +123,14 @@
119	123	}
120	124	} else {
121	125	give_set_error( 'username_incorrect', __( 'The username you entered does not exist.', 'give' ) );
122	126	}
123		- // Check for errors and redirect if none present
	127	+
	128	+ // Check for errors and redirect if none present.
124	129	$errors = give_get_errors();
	130	+
125	131	if ( ! $errors ) {
126		- $redirect = apply_filters( 'give_login_redirect', $data['give_login_redirect'], $user_ID );
	132	+ $redirect = apply_filters( 'give_login_redirect', $data['give_login_redirect'], $user_id );
127	133	wp_redirect( $redirect );
128	134	give_die();
129	135	}
130	136	}
		@@ -217,8 +223,9 @@
217	223
218	224	/**
219	225	* Process Register Form
220	226	*
	227	+ * @since 4.16.6 Require a valid nonce before processing registration.
221	228	* @since 2.0
222	229	*
223	230	* @param array $data Data sent from the register form
224	231	*
		@@ -233,8 +240,12 @@
233	240	if ( empty( $_POST['give_register_submit'] ) ) {
234	241	return false;
235	242	}
236	243
	244	+ if ( empty( $data['give_register_nonce'] ) || ! wp_verify_nonce( $data['give_register_nonce'], 'give-register-nonce' ) ) {
	245	+ return false;
	246	+ }
	247	+
237	248	/**
238	249	* Fires before processing user registration.
239	250	*
240	251	* @since 1.0
		@@ -286,15 +297,17 @@
286	297	if ( empty( $errors ) ) {
287	298
288	299	$redirect = apply_filters( 'give_register_redirect', $data['give_redirect'] );
289	300
290		- give_register_and_login_new_user( array(
291		- 'user_login' => $data['give_user_login'],
292		- 'user_pass' => $data['give_user_pass'],
293		- 'user_email' => $data['give_user_email'],
294		- 'user_registered' => date( 'Y-m-d H:i:s' ),
295		- 'role' => get_option( 'default_role' ),
296		- ) );
	301	+ give_register_and_login_new_user(
	302	+ array(
	303	+ 'user_login' => $data['give_user_login'],
	304	+ 'user_pass' => $data['give_user_pass'],
	305	+ 'user_email' => $data['give_user_email'],
	306	+ 'user_registered' => date( 'Y-m-d H:i:s' ),
	307	+ 'role' => get_option( 'default_role' ),
	308	+ )
	309	+ );
297	310
298	311	wp_redirect( $redirect );
299	312	give_die();
300	313	}
		@@ -324,11 +337,9 @@
324	337	}
325	338
326	339	$recaptcha_key = give_get_option( 'recaptcha_key' );
327	340	$recaptcha_secret = give_get_option( 'recaptcha_secret' );
328		-
329	341	$enable_recaptcha = ( give_is_setting_enabled( give_get_option( 'enable_recaptcha' ) ) ) && ! empty( $recaptcha_key ) && ! empty( $recaptcha_secret ) ? true : false;
330		- $access_token = ! empty( $_GET['payment_key'] ) ? $_GET['payment_key'] : '';
331	342
332	343	// Use reCAPTCHA.
333	344	if ( $enable_recaptcha ) {
334	345
		@@ -338,11 +349,14 @@
338	349	'remoteip' => $_POST['give_ip'],
339	350	);
340	351
341	352	if ( ! empty( $args['response'] ) ) {
342		- $request = wp_remote_post( 'https://www.google.com/recaptcha/api/siteverify', array(
343		- 'body' => $args,
344		- ) );
	353	+ $request = wp_remote_post(
	354	+ 'https://www.google.com/recaptcha/api/siteverify',
	355	+ array(
	356	+ 'body' => $args,
	357	+ )
	358	+ );
345	359	if ( ! is_wp_error( $request ) || 200 == wp_remote_retrieve_response_code( $request ) ) {
346	360
347	361	$response = json_decode( $request['body'], true );
348	362
		@@ -366,9 +380,8 @@
366	380	// If no errors or only expired token key error - then send email.
367	381	if ( ! give_get_errors() ) {
368	382
369	383	$donor = Give()->donors->get_donor_by( 'email', $email );
370		-
371	384	Give()->email_access->init();
372	385
373	386	// Verify that donor object is present and donor is connected with its user profile or not.
374	387	if ( is_object( $donor ) ) {