loginpress / include / template-loginpress.php

template-loginpress.php in LoginPress | wp-login Custom Login Page Customizer trunk, at include/template-loginpress.php

767 lines 26.0 KB

Raw Download Zip

1	<?php
2	/**
3	* LoginPress Template.
4	*
5	* Template Name: LoginPress
6	* Template to display the WordPress login page in the WP-Customizer.
7	* Purpose of this file is to provide a custom template for the login page within the WordPress Customizer.
8	*
9	* @package LoginPress
10	* @since 1.1.3
11	* @version 6.2.0
12	*/
13
14	if ( ! defined( 'ABSPATH' ) ) {
15	exit;
16	}
17
18	// Redirect if viewed from outside the Customizer.
19	global $interim_login;
20
21	if ( ! is_customize_preview() ) {
22
23	$loginpress_obj = new LoginPress();
24	$loginpress_page = $loginpress_obj->get_loginpress_page();
25	$loginpress_page_url = get_permalink( $loginpress_page );
26
27	// Generate the redirect url.
28	$loginpress_redirect_url = add_query_arg(
29	array(
30	'autofocus[panel]' => 'loginpress_panel',
31	'return' => admin_url( 'index.php' ),
32	'url' => rawurlencode( $loginpress_page_url ? $loginpress_page_url : '' ),
33	),
34	admin_url( 'customize.php' )
35	);
36
37	wp_safe_redirect( $loginpress_redirect_url );
38	}
39
40	/**
41	* Make sure that the WordPress bootstrap has run before continuing.
42	*
43	* @phpstan-ignore-next-line
44	*/
45	require ABSPATH . '/wp-load.php';
46
47	// Redirect to https login if forced to use SSL.
48	if ( force_ssl_admin() && ! is_ssl() ) {
49	if ( isset( $_SERVER['REQUEST_URI'] ) && 0 === strpos( sanitize_text_field( wp_unslash( $_SERVER['REQUEST_URI'] ) ), 'http' ) ) {
50	wp_safe_redirect( set_url_scheme( sanitize_text_field( wp_unslash( $_SERVER['REQUEST_URI'] ) ), 'https' ) );
51	exit();
52	} elseif ( isset( $_SERVER['HTTP_HOST'], $_SERVER['REQUEST_URI'] ) ) {
53	wp_safe_redirect( 'https://' . sanitize_text_field( wp_unslash( $_SERVER['HTTP_HOST'] ) ) . sanitize_text_field( wp_unslash( $_SERVER['REQUEST_URI'] ) ) );
54	exit();
55	}
56	}
57
58	/**
59	* Output the login page header.
60	*
61	* @param string $title Optional. WordPress login Page title to display in the `<title>` element.
62	* Default 'Log In'.
63	* @param string $message Optional. Message to display in header. Default empty.
64	* @param WP_Error $wp_error Optional. The error to pass. Default empty.
65	* @return void
66	*/
67	function login_header( $title = 'Log In', $message = '', $wp_error = null ) {
68	global $error, $interim_login, $action;
69
70	// Don't index any of these forms.
71	add_action( 'login_head', 'wp_no_robots' );
72
73	add_action( 'login_head', 'wp_login_viewport_meta' );
74
75	if ( null === $wp_error ) {
76	$wp_error = new WP_Error();
77	}
78
79	$login_title = get_bloginfo( 'name', 'display' );
80
81	/* translators: Login screen title. 1: Login screen name, 2: Network or site name */
82	$login_title = sprintf( __( '%1$s &lsaquo; %2$s — WordPress' ), $title, $login_title ); // @codingStandardsIgnoreLine.
83
84	/**
85	* Filters the title tag content for login page.
86	*
87	* @since 4.9.0
88	*
89	* @param string $login_title The page title, with extra context added.
90	* @param string $title The original page title.
91	*/
92	$login_title = apply_filters( 'login_title', $login_title, $title );
93
94	?><!DOCTYPE html>
95	<!--[if IE 8]>
96	<html xmlns="http://www.w3.org/1999/xhtml" class="ie8" <?php language_attributes(); ?>>
97	<![endif]-->
98	<!--[if !(IE 8) ]><!-->
99	<html xmlns="http://www.w3.org/1999/xhtml" <?php language_attributes(); ?>>
100	<!--<![endif]-->
101	<head>
102	<title><?php echo esc_html( $login_title ); ?></title>
103	<?php
104
105	wp_enqueue_style( 'login' );
106
107	/**
108	* Enqueue scripts and styles for the login page.
109	*
110	* @since 3.0.1
111	*/
112	do_action( 'login_enqueue_scripts' );
113
114	/**
115	* Fires in the login page header after scripts are enqueued.
116	*
117	* @since 2.1.0
118	*/
119	do_action( 'login_head' );
120
121	$classes = array( 'login-action-' . $action, 'wp-core-ui' );
122	if ( is_rtl() ) {
123	$classes[] = 'rtl';
124	}
125
126	if ( $interim_login ) {
127	$classes[] = 'interim-login';
128	?>
129
130	<style type="text/css">html{background-color: transparent;}</style>
131	<?php
132
133	if ( 'success' === $interim_login ) {
134	$classes[] = 'interim-login-success';
135	}
136	}
137	$classes[] = ' locale-' . sanitize_html_class( strtolower( str_replace( '_', '-', get_locale() ) ) );
138
139	/**
140	* Filters the login page body classes.
141	*
142	* @since 3.5.0
143	*
144	* @param array $classes An array of body classes.
145	* @param string $action The action that brought the visitor to the login page.
146	*/
147	$classes = apply_filters( 'login_body_class', $classes, $action );
148	?>
149	</head>
150	<body class="login <?php echo esc_attr( implode( ' ', $classes ) ); ?>">
151	<?php
152	/**
153	* Fires in the login page header after the body tag is opened.
154	*
155	* @since 4.6.0
156	*/
157	do_action( 'login_header' );
158
159	if ( is_multisite() ) {
160	$login_header_url = network_home_url();
161	$network = get_network();
162	$login_header_title = $network ? $network->site_name : '';
163	} else {
164	$login_header_url = __( 'https://wordpress.org/' ); // @codingStandardsIgnoreLine.
165	$login_header_title = __( 'Powered by WordPress' ); // @codingStandardsIgnoreLine.
166	}
167
168	/**
169	* Filters link URL of the header logo above login form.
170	*
171	* @since 2.1.0
172	*
173	* @param string $login_header_url Login header logo URL.
174	*/
175	$login_header_url = apply_filters( 'login_headerurl', $login_header_url );
176
177	/**
178	* Filters the title attribute of the header logo above login form.
179	*
180	* @since 2.1.0
181	*
182	* @param string $login_header_title Login header logo title attribute.
183	*/
184	$login_header_title = apply_filters( 'login_headertitle', $login_header_title );
185
186	/*
187	* To match the URL/title set above, Multisite sites have the blog name,
188	* while single sites get the header title.
189	*/
190	if ( is_multisite() ) {
191	$login_header_text = get_bloginfo( 'name', 'display' );
192	} else {
193	$login_header_text = $login_header_title;
194	}
195
196	?>
197	<div id="login">
198	<h1><a href="<?php echo esc_url( $login_header_url ); ?>" title="<?php echo esc_attr( $login_header_title ); ?>" tabindex="-1"><?php echo esc_html( $login_header_text ); ?></a></h1>
199	<?php
200
201	unset( $login_header_url, $login_header_title );
202
203	/**
204	* Filters the message to display above the login form.
205	*
206	* @since 2.1.0
207	*
208	* @param string $message Login message text.
209	*/
210	$message = apply_filters( 'login_message', $message );
211	if ( ! empty( $message ) ) {
212	echo wp_kses_post( $message ) . "\n";
213	}
214
215	// In case a plugin uses $error rather than the $wp_errors object.
216	if ( ! empty( $error ) ) {
217	$wp_error->add( 'error', $error );
218	unset( $error );
219	}
220
221	if ( $wp_error->get_error_code() ) {
222	$errors = '';
223	$messages = '';
224	foreach ( $wp_error->get_error_codes() as $code ) {
225	$severity = $wp_error->get_error_data( $code );
226	foreach ( $wp_error->get_error_messages( $code ) as $error_message ) {
227	if ( 'message' === $severity ) {
228	$messages .= ' ' . $error_message . "<br />\n";
229	} else {
230	$errors .= ' ' . $error_message . "<br />\n";
231	}
232	}
233	}
234	if ( ! empty( $errors ) ) {
235	/**
236	* Filters the error messages displayed above the login form.
237	*
238	* @since 2.1.0
239	*
240	* @param string $errors Login error message.
241	*/
242	// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Content is escaped by WP_Error.
243	echo '<div id="login_error">' . apply_filters( 'login_errors', $errors ) . "</div>\n";
244	}
245	if ( ! empty( $messages ) ) {
246	/**
247	* Filters instructional messages displayed above the login form.
248	*
249	* @since 2.5.0
250	*
251	* @param string $messages Login messages.
252	*/
253	// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Content is escaped by WP_Error.
254	echo '<p class="message">' . apply_filters( 'login_messages', $messages ) . "</p>\n";
255	}
256	}
257	} // End of login_header()
258
259	/**
260	* Outputs the footer for the login page.
261	*
262	* @since 3.0.5
263	*
264	* @global bool\|string $interim_login Whether interim login modal is being displayed. String 'success'
265	* upon successful login.
266	*
267	* @param string $input_id Which input to auto-focus.
268	* @return void
269	*/
270	function login_footer( $input_id = '' ) {
271	global $interim_login;
272
273	// Don't allow interim logins to navigate away from the page.
274	if ( ! $interim_login ) {
275	?>
276	<p id="backtoblog">
277	<?php
278	$html_link = sprintf(
279	'<a href="%s">%s</a>',
280	esc_url( home_url( '/' ) ),
281	sprintf(
282	/* translators: %s: Site title. */
283	_x( '← Go to %s', 'site' ), // @codingStandardsIgnoreLine.
284	get_bloginfo( 'title', 'display' )
285	)
286	);
287	/**
288	* Filters the "Go to site" link displayed in the login page footer.
289	*
290	* @since 5.7.0
291	*
292	* @param string $link HTML link to the home URL of the current site.
293	*/
294	// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Filter output is escaped.
295	echo apply_filters( 'login_site_html_link', $html_link );
296	?>
297	</p>
298	<?php if ( ! empty( $input_id ) ) : ?>
299	<script type="text/javascript">
300	try{document.getElementById('<?php echo esc_js( $input_id ); ?>').focus();}catch(e){}
301	if(typeof wpOnload=='function')wpOnload();
302	</script>
303	<?php
304	endif;
305
306	the_privacy_policy_link( '<div class="privacy-policy-page-link">', '</div>' );
307	}
308
309	?>
310	</div>
311
312	<?php
313	if (
314	! $interim_login &&
315	/**
316	* Filters whether to display the Language selector on the login screen.
317	*
318	* @since 5.9.0
319	*
320	* @param bool $display Whether to display the Language selector on the login screen.
321	*/
322	apply_filters( 'login_display_language_dropdown', true )
323	) {
324	$languages = get_available_languages();
325
326	if ( ! empty( $languages ) ) {
327	?>
328	<div class="language-switcher">
329	<form id="language-switcher" action="" method="get">
330
331	<label for="language-switcher-locales">
332	<span class="dashicons dashicons-translation" aria-hidden="true"></span>
333	<span class="screen-reader-text">
334	<?php
335	/* translators: Hidden accessibility text. */
336	_e( 'Language' ); // @codingStandardsIgnoreLine.
337	?>
338	</span>
339	</label>
340
341	<?php
342	$args = array(
343	'id' => 'language-switcher-locales',
344	'name' => 'wp_lang',
345	'selected' => determine_locale(),
346	'show_available_translations' => false,
347	'explicit_option_en_us' => true,
348	'languages' => $languages,
349	);
350
351	/**
352	* Filters default arguments for the Languages select input on the login screen.
353	*
354	* The arguments get passed to the wp_dropdown_languages() function.
355	*
356	* @since 5.9.0
357	*
358	* @param array $args Arguments for the Languages select input on the login screen.
359	*/
360	wp_dropdown_languages( apply_filters( 'login_language_dropdown_args', $args ) );
361	?>
362	<?php
363	/**
364	* Handle interim login hidden field.
365	*
366	* @phpstan-ignore-next-line
367	*/
368	if ( $interim_login ) {
369	?>
370	<input type="hidden" name="interim-login" value="1" />
371	<?php
372	}
373	// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- GET parameter for language switcher.
374	if ( isset( $_GET['redirect_to'] ) && '' !== $_GET['redirect_to'] ) {
375	?>
376	<input type="hidden" name="redirect_to" value="<?php echo esc_url( wp_unslash( $_GET['redirect_to'] ) ); // phpcs:ignore ?>" />
377	<?php
378	}
379	// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- GET parameter for language switcher.
380	if ( isset( $_GET['action'] ) && '' !== sanitize_text_field( wp_unslash( $_GET['action'] ) ) ) {
381	?>
382	<input type="hidden" name="action" value="<?php echo esc_attr( sanitize_text_field( wp_unslash( $_GET['action'] ) ) ); // phpcs:ignore ?>" />
383	<?php
384	}
385	?>
386
387	<input type="submit" class="button" value="<?php esc_attr_e( 'Change' ); // @codingStandardsIgnoreLine.?>">
388
389	</form>
390	</div>
391	<?php } ?>
392	<?php } ?>
393	<?php
394
395	if ( ! empty( $input_id ) ) {
396	ob_start();
397	?>
398	<script>
399	try{document.getElementById('<?php echo esc_js( $input_id ); ?>').focus();}catch(e){}
400	if(typeof wpOnload=='function')wpOnload();
401	</script>
402	<?php
403	$script_content = ob_get_clean();
404	wp_print_inline_script_tag( wp_remove_surrounding_empty_script_tags( $script_content ? $script_content : '' ) );
405	}
406
407	/**
408	* Fires in the login page footer.
409	*
410	* @since 3.0.5
411	*/
412	do_action( 'login_footer' );
413
414	?>
415	</body>
416	</html>
417	<?php
418	}
419
420	/**
421	* Output viewport meta tag for login page.
422	*
423	* @since 3.7.0
424	* @version 6.2.0
425	* @return void
426	*/
427	function wp_login_viewport_meta() {
428	?>
429	<meta name="viewport" content="width=device-width" />
430	<?php
431	}
432
433	// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- GET/POST parameter for login action.
434	$loginpress_login_action = isset( $_REQUEST['action'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['action'] ) ) : 'login';
435	$loginpress_login_errors = new WP_Error();
436
437	// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- GET parameter for password reset.
438	if ( isset( $_GET['key'] ) ) {
439	$loginpress_login_action = 'resetpass';
440	}
441
442	// Validate action so as to default to the login screen.
443	if ( ! in_array( $loginpress_login_action, array( 'postpass', 'logout', 'lostpassword', 'retrievepassword', 'resetpass', 'rp', 'register', 'login' ), true ) && false === has_filter( 'login_form_' . $loginpress_login_action ) ) {
444	$loginpress_login_action = 'login';
445	}
446
447	nocache_headers();
448
449
450	if ( ! is_customize_preview() ) {
451	header( 'Content-Type: ' . get_bloginfo( 'html_type' ) . '; charset=' . get_bloginfo( 'charset' ) );
452
453	}
454	if ( defined( 'RELOCATE' ) && RELOCATE ) { // Move flag is set.
455	if ( isset( $_SERVER['PATH_INFO'], $_SERVER['PHP_SELF'] ) && ( sanitize_text_field( wp_unslash( $_SERVER['PATH_INFO'] ) ) !== sanitize_text_field( wp_unslash( $_SERVER['PHP_SELF'] ) ) ) ) {
456	$_SERVER['PHP_SELF'] = str_replace( sanitize_text_field( wp_unslash( $_SERVER['PATH_INFO'] ) ), '', sanitize_text_field( wp_unslash( $_SERVER['PHP_SELF'] ) ) );
457	}
458
459	if ( isset( $_SERVER['HTTP_HOST'], $_SERVER['PHP_SELF'] ) ) {
460	$loginpress_siteurl = dirname( set_url_scheme( 'http://' . sanitize_text_field( wp_unslash( $_SERVER['HTTP_HOST'] ) ) . sanitize_text_field( wp_unslash( $_SERVER['PHP_SELF'] ) ) ) );
461	if ( get_option( 'siteurl' ) !== $loginpress_siteurl ) {
462	update_option( 'siteurl', $loginpress_siteurl );
463	}
464	}
465	}
466
467	// Set a cookie now to see if they are supported by the browser.
468	$loginpress_secure_cookie = ( 'https' === wp_parse_url( wp_login_url(), PHP_URL_SCHEME ) );
469	if ( ! is_customize_preview() ) {
470	/**
471	* Set test cookie.
472	*
473	* @phpstan-ignore-next-line
474	*/
475	setcookie( TEST_COOKIE, 'WP Cookie check', 0, COOKIEPATH, COOKIE_DOMAIN, $loginpress_secure_cookie );
476	/**
477	* Set test cookie for site path if different.
478	*
479	* @phpstan-ignore-next-line
480	*/
481	if ( SITECOOKIEPATH !== COOKIEPATH ) {
482	/**
483	* Set test cookie for site path.
484	*
485	* @phpstan-ignore-next-line
486	*/
487	setcookie( TEST_COOKIE, 'WP Cookie check', 0, SITECOOKIEPATH, COOKIE_DOMAIN, $secure );
488	}
489	}
490
491	// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- GET parameter for language switcher.
492	$loginpress_lang = ! empty( $_GET['wp_lang'] ) ? sanitize_text_field( wp_unslash( $_GET['wp_lang'] ) ) : '';
493	$loginpress_switched_locale = switch_to_locale( $loginpress_lang );
494
495	/**
496	* Fires when the login form is initialized.
497	*
498	* @since 3.2.0
499	*/
500	do_action( 'login_init' );
501
502	/**
503	* Fires before a specified login form action.
504	*
505	* The dynamic portion of the hook name, `$action`, refers to the action
506	* that brought the visitor to the login form. Actions include 'postpass',
507	* 'logout', 'lostpassword', etc.
508	*
509	* @since 2.8.0
510	*/
511	do_action( "login_form_{$loginpress_login_action}" );
512
513	$loginpress_http_post = ( isset( $_SERVER['REQUEST_METHOD'] ) && 'POST' === sanitize_text_field( wp_unslash( $_SERVER['REQUEST_METHOD'] ) ) );
514	// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- GET/POST parameter for interim login.
515	$loginpress_interim_login_request = isset( $_REQUEST['interim-login'] );
516
517	/**
518	* Filters the separator used between login form navigation links.
519	*
520	* @since 4.9.0
521	*
522	* @param string $loginpress_login_link_separator The separator used between login form navigation links.
523	*/
524	$loginpress_login_link_separator = apply_filters( 'login_link_separator', ' \| ' );
525
526	switch ( $loginpress_login_action ) {
527
528	case 'lostpassword':
529	case 'retrievepassword':
530	/**
531	* Filters the URL redirected to after submitting the lostpassword/retrievepassword form.
532	*
533	* @since 3.0.0
534	*
535	* @param string $loginpress_lostpassword_redirect The redirect destination URL.
536	*/
537	$loginpress_lostpassword_redirect = '';
538	$loginpress_redirect_to = apply_filters( 'lostpassword_redirect', $loginpress_lostpassword_redirect );
539
540	/**
541	* Fires before the lost password form.
542	*
543	* @since 1.5.1
544	*/
545	do_action( 'lost_password' );
546
547	login_header( __( 'Lost Password' ), '<p class="message">' . __( 'Please enter your username or email address. You will receive a link to create a new password via email.' ) . '</p>', $loginpress_login_errors ); // @codingStandardsIgnoreLine.
548
549	$loginpress_lostpassword_user_login = '';
550
551	// phpcs:ignore WordPress.Security.NonceVerification.Missing -- This is the lost password form.
552	if ( isset( $_POST['user_login'] ) && is_string( $_POST['user_login'] ) ) {
553	// phpcs:ignore WordPress.Security.NonceVerification.Missing -- This is the lost password form.
554	$loginpress_lostpassword_user_login = sanitize_text_field( wp_unslash( $_POST['user_login'] ) );
555	}
556
557	?>
558
559	<form name="lostpasswordform" id="lostpasswordform" action="<?php echo esc_url( network_site_url( 'wp-login.php?action=lostpassword', 'login_post' ) ); ?>" method="post">
560	<p>
561	<label for="user_login" ><span><?php _e( 'Username or Email Address' ); // @codingStandardsIgnoreLine. ?></span><br />
562	<input type="text" name="user_login" id="user_login" class="input" value="<?php echo esc_attr( $loginpress_lostpassword_user_login ); ?>" size="20" /></label>
563	</p>
564	<?php
565	/**
566	* Fires inside the lostpassword form tags, before the hidden fields.
567	*
568	* @since 2.1.0
569	*/
570	do_action( 'lostpassword_form' );
571	?>
572	<input type="hidden" name="redirect_to" value="<?php echo esc_attr( $loginpress_redirect_to ); ?>" />
573	<p class="submit"><input type="submit" name="wp-submit" id="wp-submit" class="button button-primary button-large" value="<?php esc_attr_e( 'Get New Password' ); // @codingStandardsIgnoreLine.?>" /></p>
574	</form>
575
576	<p id="nav">
577	<a href="<?php echo esc_url( wp_login_url() ); ?>"><?php _e( 'Log in' ); // @codingStandardsIgnoreLine.?></a>
578	<?php
579	if ( get_option( 'users_can_register' ) ) :
580	$registration_url = sprintf( '<a href="%s">%s</a>', esc_url( wp_registration_url() ), __( 'Register' ) ); // @codingStandardsIgnoreLine.
581
582	echo esc_html( $loginpress_login_link_separator );
583
584	/** This filter is documented in wp-includes/general-template.php */
585	// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Filter output is escaped.
586	echo apply_filters( 'register', $registration_url );
587	endif;
588	?>
589	</p>
590
591	<?php
592	login_footer( 'user_login' );
593
594
595
596	break;
597
598	case 'resetpass':
599	case 'register':
600	if ( is_multisite() ) {
601	/**
602	* Filters the Multisite sign up URL.
603	*
604	* @since 3.0.0
605	*
606	* @param string $sign_up_url The sign up URL.
607	*/
608	wp_safe_redirect( apply_filters( 'wp_signup_location', network_site_url( 'wp-signup.php' ) ) );
609	exit;
610	}
611
612	if ( ! get_option( 'users_can_register' ) ) {
613	wp_safe_redirect( site_url( 'wp-login.php?registration=disabled' ) );
614	exit();
615	}
616
617	$loginpress_register_user_login = '';
618	$loginpress_register_user_email = '';
619
620	if ( $loginpress_http_post ) {
621	// phpcs:ignore WordPress.Security.NonceVerification.Missing -- This is the registration form.
622	if ( isset( $_POST['user_login'] ) && is_string( $_POST['user_login'] ) ) {
623	// phpcs:ignore WordPress.Security.NonceVerification.Missing -- This is the registration form.
624	$loginpress_register_user_login = sanitize_text_field( wp_unslash( $_POST['user_login'] ) );
625	}
626
627	// phpcs:ignore WordPress.Security.NonceVerification.Missing -- This is the registration form.
628	if ( isset( $_POST['user_email'] ) && is_string( $_POST['user_email'] ) ) {
629	// phpcs:ignore WordPress.Security.NonceVerification.Missing -- This is the registration form.
630	$loginpress_register_user_email = sanitize_email( wp_unslash( $_POST['user_email'] ) );
631	}
632
633	$loginpress_register_errors = register_new_user( $loginpress_register_user_login, $loginpress_register_user_email );
634	if ( ! is_wp_error( $loginpress_register_errors ) ) {
635	// phpcs:ignore WordPress.Security.NonceVerification.Missing -- This is the registration form.
636	$loginpress_redirect_to = ! empty( $_POST['redirect_to'] ) ? esc_url_raw( wp_unslash( $_POST['redirect_to'] ) ) : 'wp-login.php?checkemail=registered';
637	wp_safe_redirect( $loginpress_redirect_to );
638	exit();
639	}
640	}
641
642	// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- GET/POST parameter for redirect.
643	$loginpress_registration_redirect = ! empty( $_REQUEST['redirect_to'] ) ? esc_url_raw( wp_unslash( $_REQUEST['redirect_to'] ) ) : '';
644	/**
645	* Filters the registration redirect URL.
646	*
647	* @since 3.0.0
648	* @version 6.2.0
649	*
650	* @param string $loginpress_registration_redirect The redirect destination URL.
651	*/
652	$loginpress_redirect_to = apply_filters( 'registration_redirect', $loginpress_registration_redirect );
653	login_header( __( 'Registration Form' ), '<p class="message register">' . __( 'Register For This Site' ) . '</p>', $loginpress_register_errors ); // @codingStandardsIgnoreLine.
654	?>
655	<form name="registerform" id="registerform" action="<?php echo esc_url( site_url( 'wp-login.php?action=register', 'login_post' ) ); ?>" method="post" novalidate="novalidate">
656	<p>
657	<label for="user_login"><?php _e( 'Username' ); // @codingStandardsIgnoreLine.?><br />
658	<input type="text" name="user_login" id="user_login" class="input" value="<?php echo esc_attr( wp_unslash( $loginpress_register_user_login ) ); ?>" size="20" /></label>
659	</p>
660	<p>
661	<label for="user_email"><?php _e( 'Email' ); // @codingStandardsIgnoreLine.?><br />
662	<input type="email" name="user_email" id="user_email" class="input" value="<?php echo esc_attr( wp_unslash( $loginpress_register_user_email ) ); ?>" size="25" /></label>
663	</p>
664	<?php
665	/**
666	* Fires following the 'Email' field in the user registration form.
667	*
668	* @since 2.1.0
669	* @version 6.2.0
670	*/
671	do_action( 'register_form' );
672	?>
673	<p id="reg_passmail"><?php _e( 'Registration confirmation will be emailed to you.' ); // @codingStandardsIgnoreLine.?></p>
674	<br class="clear" />
675	<input type="hidden" name="redirect_to" value="<?php echo esc_attr( $loginpress_redirect_to ); ?>" />
676	<p class="submit">
677	<input type="submit" name="wp-submit" id="wp-submit" class="button button-primary button-large" value="<?php esc_attr_e( 'Register' ); // @codingStandardsIgnoreLine.?>" />
678	</p>
679	</form>
680
681	<p id="nav">
682	<a href="<?php echo esc_url( wp_login_url() ); ?>"><?php _e( 'Log in' ); // @codingStandardsIgnoreLine.?></a>
683	<?php echo esc_html( $loginpress_login_link_separator ); ?>
684	<a href="<?php echo esc_url( wp_lostpassword_url() ); ?>"><?php _e( 'Lost your password?' ); // @codingStandardsIgnoreLine.?></a>
685	</p>
686
687	<?php
688	login_footer( 'user_login' );
689
690	break;
691
692	case 'login':
693	default:
694	$loginpress_secure_cookie_login = '';
695	// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- GET/POST parameter for customizer.
696	$loginpress_customize_login = isset( $_REQUEST['customize-login'] );
697	if ( $loginpress_customize_login ) {
698	wp_enqueue_script( 'customize-base' );
699	}
700
701	$loginpress_login_user_login = '';
702	login_header( __( 'Log In' ), '', $loginpress_login_errors );// @codingStandardsIgnoreLine.
703	$loginpress_aria_describedby_error = '';
704	?>
705
706	<form name="loginform" id="loginform" action="<?php echo esc_url( site_url( 'wp-login.php', 'login_post' ) ); ?>" method="post" autocomplete="off">
707	<p>
708	<label for="user_login"><span><?php _e( 'Username or Email Address' ); // @codingStandardsIgnoreLine.?></span><br />
709	<input type="text" name="log" id="user_login"<?php echo wp_kses_post( $loginpress_aria_describedby_error ); ?> class="input" value="<?php echo esc_attr( $loginpress_login_user_login ); ?>" size="20" autocomplete="off"/></label>
710	</p>
711	<p>
712	<label for="user_pass"><span><?php _e( 'Password' ); // @codingStandardsIgnoreLine.?></span><br />
713	<input type="password" name="pwd" id="user_pass"<?php echo wp_kses_post( $loginpress_aria_describedby_error ); ?> class="input" value="" size="20" autocomplete="off"/></label>
714	</p>
715	<?php
716	/**
717	* Fires following the 'Password' field in the login form.
718	*
719	* @since 2.1.0
720	*/
721	do_action( 'login_form' );
722	/**
723	* Check if rememberme is set.
724	*
725	* @phpstan-ignore-next-line
726	*/
727	// phpcs:ignore WordPress.Security.NonceVerification.Missing -- This is the login form.
728	if ( isset( $_POST ) ) {
729	// phpcs:ignore WordPress.Security.NonceVerification.Missing -- This is the login form.
730	$loginpress_rememberme = ! empty( $_POST['rememberme'] );
731	} else {
732	$loginpress_rememberme = '';
733	}
734	?>
735	<p class="forgetmenot">
736	<label for="rememberme"><input name="rememberme" type="checkbox" id="rememberme" value="forever" <?php checked( $loginpress_rememberme ); ?> /> <?php esc_html_e( 'Remember Me' ); // @codingStandardsIgnoreLine.?></label>
737	</p>
738	<p class="submit">
739	<input type="submit" name="wp-submit" id="wp-submit" class="button button-primary button-large" value="<?php esc_attr_e( 'Log In' ); // @codingStandardsIgnoreLine.?>" />
740	</p>
741	</form>
742
743	<?php if ( ! $loginpress_interim_login_request ) { ?>
744	<p id="nav">
745	<?php
746	// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- GET parameter for display purposes.
747	if ( ! isset( $_GET['checkemail'] ) \|\| ! in_array( sanitize_text_field( wp_unslash( $_GET['checkemail'] ) ), array( 'confirm', 'newpass' ), true ) ) :
748	if ( get_option( 'users_can_register' ) ) :
749	$registration_url = sprintf( '<a href="%s">%s</a>', esc_url( wp_registration_url() ), __( 'Register' ) ); // @codingStandardsIgnoreLine.
750
751	/** This filter is documented in wp-includes/general-template.php */
752	// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Filter output is escaped.
753	echo apply_filters( 'register', $registration_url );
754
755	echo esc_html( $loginpress_login_link_separator );
756	endif;
757	?>
758	<a href="<?php echo esc_url( wp_lostpassword_url() ); ?>"><?php _e( 'Lost your password?' ); // @codingStandardsIgnoreLine.?></a>
759	<?php endif; ?>
760	</p>
761	<?php
762	}
763
764	login_footer();
765	break;
766	} // end action switch
767