password-protected / password-protected.php

password-protected.php in Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content 2.2.2, at password-protected.php

814 lines 20.5 KB

Raw Download Zip

1	<?php
2
3	/*
4	Plugin Name: Password Protected
5	Plugin URI: https://wordpress.org/plugins/password-protected/
6	Description: A very simple way to quickly password protect your WordPress site with a single password. Please note: This plugin does not restrict access to uploaded files and images and does not work with some caching setups.
7	Version: 2.2.2
8	Author: Ben Huson
9	Text Domain: password-protected
10	Author URI: http://github.com/benhuson/password-protected/
11	License: GPLv2
12	*/
13
14	/*
15	Copyright 2012 Ben Huson (email : ben@thewhiteroom.net)
16
17	This program is free software; you can redistribute it and/or modify
18	it under the terms of the GNU General Public License, version 2, as
19	published by the Free Software Foundation.
20
21	This program is distributed in the hope that it will be useful,
22	but WITHOUT ANY WARRANTY; without even the implied warranty of
23	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
24	GNU General Public License for more details.
25
26	You should have received a copy of the GNU General Public License
27	along with this program; if not, write to the Free Software
28	Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
29	*/
30
31	/**
32	* @todo Use wp_hash_password() ?
33	* @todo Remember me
34	*/
35
36	define( 'PASSWORD_PROTECTED_SUBDIR', '/' . str_replace( basename( __FILE__ ), '', plugin_basename( __FILE__ ) ) );
37	define( 'PASSWORD_PROTECTED_URL', plugins_url( PASSWORD_PROTECTED_SUBDIR ) );
38	define( 'PASSWORD_PROTECTED_DIR', plugin_dir_path( __FILE__ ) );
39
40	global $Password_Protected;
41	$Password_Protected = new Password_Protected();
42
43	class Password_Protected {
44
45	var $version = '2.2.2';
46	var $admin = null;
47	var $errors = null;
48
49	/**
50	* Constructor
51	*/
52	public function __construct() {
53
54	$this->errors = new WP_Error();
55
56	register_activation_hook( __FILE__, array( &$this, 'install' ) );
57
58	add_action( 'plugins_loaded', array( $this, 'load_plugin_textdomain' ) );
59
60	add_filter( 'password_protected_is_active', array( $this, 'allow_ip_addresses' ) );
61
62	add_action( 'init', array( $this, 'disable_caching' ), 1 );
63	add_action( 'init', array( $this, 'maybe_process_logout' ), 1 );
64	add_action( 'init', array( $this, 'maybe_process_login' ), 1 );
65	add_action( 'wp', array( $this, 'disable_feeds' ) );
66	add_action( 'template_redirect', array( $this, 'maybe_show_login' ), -1 );
67	add_filter( 'pre_option_password_protected_status', array( $this, 'allow_feeds' ) );
68	add_filter( 'pre_option_password_protected_status', array( $this, 'allow_administrators' ) );
69	add_filter( 'pre_option_password_protected_status', array( $this, 'allow_users' ) );
70	add_filter( 'rest_authentication_errors', array( $this, 'only_allow_logged_in_rest_access' ) );
71	add_action( 'init', array( $this, 'compat' ) );
72	add_action( 'password_protected_login_messages', array( $this, 'login_messages' ) );
73	add_action( 'login_enqueue_scripts', array( $this, 'load_theme_stylesheet' ), 5 );
74
75	add_shortcode( 'password_protected_logout_link', array( $this, 'logout_link_shortcode' ) );
76
77	include_once( dirname( __FILE__ ) . '/admin/admin-bar.php' );
78
79	if ( is_admin() ) {
80
81	include_once( dirname( __FILE__ ) . '/admin/admin-caching.php' );
82	include_once( dirname( __FILE__ ) . '/admin/admin.php' );
83
84	$this->admin_caching = new Password_Protected_Admin_Caching( $this );
85	$this->admin = new Password_Protected_Admin();
86
87	}
88
89	}
90
91	/**
92	* I18n
93	*/
94	public function load_plugin_textdomain() {
95
96	load_plugin_textdomain( 'password-protected', false, basename( dirname( __FILE__ ) ) . '/languages' );
97
98	}
99
100	/**
101	* Disable Page Caching
102	*/
103	public function disable_caching() {
104
105	if ( $this->is_active() && ! defined( 'DONOTCACHEPAGE' ) ) {
106	define( 'DONOTCACHEPAGE', true );
107	}
108
109	}
110
111	/**
112	* Is Active?
113	*
114	* @return boolean Is password protection active?
115	*/
116	public function is_active() {
117
118	global $wp_query;
119
120	// Always allow access to robots.txt
121	if ( isset( $wp_query ) && is_robots() ) {
122	return false;
123	}
124
125	if ( (bool) get_option( 'password_protected_status' ) ) {
126	$is_active = true;
127	} else {
128	$is_active = false;
129	}
130
131	$is_active = apply_filters( 'password_protected_is_active', $is_active );
132
133	if ( isset( $_GET['password-protected'] ) ) {
134	$is_active = true;
135	}
136
137	return $is_active;
138
139	}
140
141	/**
142	* Disable Feeds
143	*
144	* @todo An option/filter to prevent disabling of feeds.
145	*/
146	public function disable_feeds() {
147
148	if ( $this->is_active() ) {
149	add_action( 'do_feed', array( $this, 'disable_feed' ), 1 );
150	add_action( 'do_feed_rdf', array( $this, 'disable_feed' ), 1 );
151	add_action( 'do_feed_rss', array( $this, 'disable_feed' ), 1 );
152	add_action( 'do_feed_rss2', array( $this, 'disable_feed' ), 1 );
153	add_action( 'do_feed_atom', array( $this, 'disable_feed' ), 1 );
154	}
155
156	}
157
158	/**
159	* Disable Feed
160	*
161	* @todo Make Translatable
162	*/
163	public function disable_feed() {
164
165	wp_die( sprintf( __( 'Feeds are not available for this site. Please visit the <a href="%s">website</a>.', 'password-protected' ), get_bloginfo( 'url' ) ) );
166
167	}
168
169	/**
170	* Allow Feeds
171	*
172	* @param boolean $bool Allow feeds.
173	* @return boolean True/false.
174	*/
175	public function allow_feeds( $bool ) {
176
177	if ( is_feed() && (bool) get_option( 'password_protected_feeds' ) ) {
178	return 0;
179	}
180
181	return $bool;
182
183	}
184
185	/**
186	* Allow Administrators
187	*
188	* @param boolean $bool Allow administrators.
189	* @return boolean True/false.
190	*/
191	public function allow_administrators( $bool ) {
192
193	if ( ! is_admin() && current_user_can( 'manage_options' ) && (bool) get_option( 'password_protected_administrators' ) ) {
194	return 0;
195	}
196
197	return $bool;
198
199	}
200
201	/**
202	* Allow Users
203	*
204	* @param boolean $bool Allow administrators.
205	* @return boolean True/false.
206	*/
207	public function allow_users( $bool ) {
208
209	if ( ! is_admin() && is_user_logged_in() && (bool) get_option( 'password_protected_users' ) ) {
210	return 0;
211	}
212
213	return $bool;
214
215	}
216
217	/**
218	* Allow IP Addresses
219	*
220	* If user has a valid email address, return false to disable password protection.
221	*
222	* @param boolean $bool Allow IP addresses.
223	* @return boolean True/false.
224	*/
225	public function allow_ip_addresses( $bool ) {
226
227	$ip_addresses = $this->get_allowed_ip_addresses();
228
229	if ( in_array( $_SERVER['REMOTE_ADDR'], $ip_addresses ) ) {
230	$bool = false;
231	}
232
233	return $bool;
234
235	}
236
237	/**
238	* Get Allowed IP Addresses
239	*
240	* @return array IP addresses.
241	*/
242	public function get_allowed_ip_addresses() {
243
244	return explode( "\n", get_option( 'password_protected_allowed_ip_addresses' ) );
245
246	}
247
248	/**
249	* Allow the remember me function
250	*
251	* @return. boolean
252	*/
253	public function allow_remember_me() {
254
255	return (bool) get_option( 'password_protected_remember_me' );
256
257	}
258
259	/**
260	* Encrypt Password
261	*
262	* @param string $password Password.
263	* @return string Encrypted password.
264	*/
265	public function encrypt_password( $password ) {
266
267	return md5( $password );
268
269	}
270
271	/**
272	* Maybe Process Logout
273	*/
274	public function maybe_process_logout() {
275
276	if ( isset( $_REQUEST['password-protected'] ) && $_REQUEST['password-protected'] == 'logout' ) {
277
278	$this->logout();
279
280	if ( isset( $_REQUEST['redirect_to'] ) ) {
281	$redirect_to = esc_url_raw( $_REQUEST['redirect_to'], array( 'http', 'https' ) );
282	} else {
283	$redirect_to = home_url( '/' );
284	}
285
286	$this->safe_redirect( $redirect_to );
287	exit();
288
289	}
290
291	}
292
293	/**
294	* Maybe Process Login
295	*/
296	public function maybe_process_login() {
297
298	if ( $this->is_active() && isset( $_REQUEST['password_protected_pwd'] ) ) {
299	$password_protected_pwd = $_REQUEST['password_protected_pwd'];
300	$pwd = get_option( 'password_protected_password' );
301
302	// If correct password...
303	if ( ( hash_equals( $pwd, $this->encrypt_password( $password_protected_pwd ) ) && $pwd != '' ) \|\| apply_filters( 'password_protected_process_login', false, $password_protected_pwd ) ) {
304
305	$remember = isset( $_REQUEST['password_protected_rememberme'] ) ? boolval( $_REQUEST['password_protected_rememberme'] ) : false;
306
307	if ( ! $this->allow_remember_me() ) {
308	$remember = false;
309	}
310
311	$this->set_auth_cookie( $remember );
312	$redirect_to = isset( $_REQUEST['redirect_to'] ) ? $_REQUEST['redirect_to'] : '';
313	$redirect_to = apply_filters( 'password_protected_login_redirect', $redirect_to );
314
315	if ( ! empty( $redirect_to ) ) {
316	$this->safe_redirect( $redirect_to );
317	exit;
318	}
319
320	} else {
321
322	// ... otherwise incorrect password
323	$this->clear_auth_cookie();
324	$this->errors->add( 'incorrect_password', __( 'Incorrect Password', 'password-protected' ) );
325
326	}
327
328	}
329
330	}
331
332	/**
333	* Is User Logged In?
334	*
335	* @return boolean
336	*/
337	public function is_user_logged_in() {
338
339	return $this->is_active() && $this->validate_auth_cookie();
340
341	}
342
343	/**
344	* Maybe Show Login
345	*/
346	public function maybe_show_login() {
347
348	// Don't show login if not enabled
349	if ( ! $this->is_active() ) {
350	return;
351	}
352
353	// Logged in
354	if ( $this->is_user_logged_in() ) {
355	return;
356	}
357
358	// Show login form
359	if ( isset( $_REQUEST['password-protected'] ) && 'login' == $_REQUEST['password-protected'] ) {
360
361	$default_theme_file = locate_template( array( 'password-protected-login.php' ) );
362
363	if ( empty( $default_theme_file ) ) {
364	$default_theme_file = dirname( __FILE__ ) . '/theme/password-protected-login.php';
365	}
366
367	$theme_file = apply_filters( 'password_protected_theme_file', $default_theme_file );
368	if ( ! file_exists( $theme_file ) ) {
369	$theme_file = $default_theme_file;
370	}
371
372	load_template( $theme_file );
373	exit();
374
375	} else {
376
377	$redirect_to = add_query_arg( 'password-protected', 'login', home_url() );
378
379	// URL to redirect back to after login
380	$redirect_to_url = apply_filters( 'password_protected_login_redirect_url', ( is_ssl() ? 'https://' : 'http://' ) . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'] );
381	if ( ! empty( $redirect_to_url ) ) {
382	$redirect_to = add_query_arg( 'redirect_to', urlencode( $redirect_to_url ), $redirect_to );
383	}
384
385	wp_redirect( $redirect_to );
386	exit();
387
388	}
389	}
390
391	/**
392	* Get Site ID
393	*
394	* @return string Site ID.
395	*/
396	public function get_site_id() {
397
398	global $blog_id;
399	return 'bid_' . apply_filters( 'password_protected_blog_id', $blog_id );
400
401	}
402
403	/**
404	* Login URL
405	*
406	* @return string Login URL.
407	*/
408	public function login_url() {
409
410	return add_query_arg( 'password-protected', 'login', home_url( '/' ) );
411
412	}
413
414	/**
415	* Logout
416	*/
417	public function logout() {
418
419	$this->clear_auth_cookie();
420	do_action( 'password_protected_logout' );
421
422	}
423
424	/**
425	* Logout URL
426	*
427	* @param string $redirect_to Optional. Redirect URL.
428	* @return string Logout URL.
429	*/
430	public function logout_url( $redirect_to = '' ) {
431
432	$query = array(
433	'password-protected' => 'logout',
434	'redirect_to' => esc_url_raw( $redirect_to )
435	);
436
437	if ( empty( $query['redirect_to'] ) ) {
438	unset( $query['redirect_to'] );
439	}
440
441	return add_query_arg( $query, home_url() );
442
443	}
444
445	/**
446	* Logout Link
447	*
448	* @param array $args Link args.
449	* @return string HTML link tag.
450	*/
451	public function logout_link( $args = null ) {
452
453	// Only show if user is logged in
454	if ( ! $this->is_user_logged_in() ) {
455	return '';
456	}
457
458	$args = wp_parse_args( $args, array(
459	'redirect_to' => '',
460	'text' => __( 'Logout', 'password-protected' )
461	) );
462
463	if ( empty( $args['text'] ) ) {
464	$args['text'] = __( 'Logout', 'password-protected' );
465	}
466
467	return sprintf( '<a href="%s">%s</a>', esc_url( $this->logout_url( $args['redirect_to'] ) ), esc_html( $args['text'] ) );
468
469	}
470
471	/**
472	* Logout Link Shortcode
473	*
474	* @param array $args Link args.
475	* @return string HTML link tag.
476	*/
477	public function logout_link_shortcode( $atts, $content = null ) {
478
479	$atts = shortcode_atts( array(
480	'redirect_to' => '',
481	'text' => $content
482	), $atts, 'logout_link_shortcode' );
483
484	return $this->logout_link( $atts );
485
486	}
487
488	/**
489	* Get Hashed Password
490	*
491	* @return string Hashed password.
492	*/
493	public function get_hashed_password() {
494
495	return md5( get_option( 'password_protected_password' ) . wp_salt() );
496
497	}
498
499	/**
500	* Validate Auth Cookie
501	*
502	* @param string $cookie Cookie string.
503	* @param string $scheme Cookie scheme.
504	* @return boolean Validation successful?
505	*/
506	public function validate_auth_cookie( $cookie = '', $scheme = '' ) {
507
508	if ( ! $cookie_elements = $this->parse_auth_cookie( $cookie, $scheme ) ) {
509	do_action( 'password_protected_auth_cookie_malformed', $cookie, $scheme );
510	return false;
511	}
512
513	extract( $cookie_elements, EXTR_OVERWRITE );
514
515	$expired = $expiration;
516
517	// Allow a grace period for POST and AJAX requests
518	if ( defined( 'DOING_AJAX' ) \|\| 'POST' == $_SERVER['REQUEST_METHOD'] ) {
519	$expired += 3600;
520	}
521
522	// Quick check to see if an honest cookie has expired
523	if ( $expired < current_time( 'timestamp' ) ) {
524	do_action('password_protected_auth_cookie_expired', $cookie_elements);
525	return false;
526	}
527
528	$key = md5( $this->get_site_id() . $this->get_hashed_password() . '\|' . $expiration );
529	$hash = hash_hmac( 'md5', $this->get_site_id() . '\|' . $expiration, $key);
530
531	if ( $hmac != $hash ) {
532	do_action( 'password_protected_auth_cookie_bad_hash', $cookie_elements );
533	return false;
534	}
535
536	if ( $expiration < current_time( 'timestamp' ) ) { // AJAX/POST grace period set above
537	$GLOBALS['login_grace_period'] = 1;
538	}
539
540	return true;
541
542	}
543
544	/**
545	* Generate Auth Cookie
546	*
547	* @param int $expiration Expiration time in seconds.
548	* @param string $scheme Cookie scheme.
549	* @return string Cookie.
550	*/
551	public function generate_auth_cookie( $expiration, $scheme = 'auth' ) {
552
553	$key = md5( $this->get_site_id() . $this->get_hashed_password() . '\|' . $expiration );
554	$hash = hash_hmac( 'md5', $this->get_site_id() . '\|' . $expiration, $key );
555	$cookie = $this->get_site_id() . '\|' . $expiration . '\|' . $hash;
556
557	return $cookie;
558
559	}
560
561	/**
562	* Parse Auth Cookie
563	*
564	* @param string $cookie Cookie string.
565	* @param string $scheme Cookie scheme.
566	* @return string Cookie string.
567	*/
568	public function parse_auth_cookie( $cookie = '', $scheme = '' ) {
569
570	if ( empty( $cookie ) ) {
571
572	$cookie_name = $this->cookie_name();
573
574	if ( empty( $_COOKIE[ $cookie_name ] ) ) {
575	return false;
576	}
577
578	$cookie = $_COOKIE[ $cookie_name ];
579
580	}
581
582	$cookie_elements = explode( '\|', $cookie );
583
584	if ( count( $cookie_elements ) != 3 ) {
585	return false;
586	}
587
588	list( $site_id, $expiration, $hmac ) = $cookie_elements;
589
590	return compact( 'site_id', 'expiration', 'hmac', 'scheme' );
591
592	}
593
594	/**
595	* Set Auth Cookie
596	*
597	* @todo
598	*
599	* @param boolean $remember Remember logged in.
600	* @param string $secure Secure cookie.
601	*/
602	public function set_auth_cookie( $remember = false, $secure = '') {
603
604	if ( $remember ) {
605	$expiration_time = apply_filters( 'password_protected_auth_cookie_expiration', get_option( 'password_protected_remember_me_lifetime', 14 ) * DAY_IN_SECONDS, $remember );
606	$expiration = $expire = current_time( 'timestamp' ) + $expiration_time;
607	} else {
608	$expiration_time = apply_filters( 'password_protected_auth_cookie_expiration', DAY_IN_SECONDS * 20, $remember );
609	$expiration = current_time( 'timestamp' ) + $expiration_time;
610	$expire = 0;
611	}
612
613	if ( '' === $secure ) {
614	$secure = is_ssl();
615	}
616
617	$secure_password_protected_cookie = apply_filters( 'password_protected_secure_password_protected_cookie', false, $secure );
618	$password_protected_cookie = $this->generate_auth_cookie( $expiration, 'password_protected' );
619
620	setcookie( $this->cookie_name(), $password_protected_cookie, $expire, COOKIEPATH, COOKIE_DOMAIN, $secure_password_protected_cookie, true );
621	if ( COOKIEPATH != SITECOOKIEPATH ) {
622	setcookie( $this->cookie_name(), $password_protected_cookie, $expire, SITECOOKIEPATH, COOKIE_DOMAIN, $secure_password_protected_cookie, true );
623	}
624
625	}
626
627	/**
628	* Clear Auth Cookie
629	*/
630	public function clear_auth_cookie() {
631
632	setcookie( $this->cookie_name(), ' ', current_time( 'timestamp' ) - 31536000, COOKIEPATH, COOKIE_DOMAIN );
633	setcookie( $this->cookie_name(), ' ', current_time( 'timestamp' ) - 31536000, SITECOOKIEPATH, COOKIE_DOMAIN );
634
635	}
636
637	/**
638	* Cookie Name
639	*
640	* @return string Cookie name.
641	*/
642	public function cookie_name() {
643
644	return $this->get_site_id() . '_password_protected_auth';
645
646	}
647
648	/**
649	* Install
650	*/
651	public function install() {
652
653	$old_version = get_option( 'password_protected_version' );
654
655	// 1.1 - Upgrade to MD5
656	if ( empty( $old_version ) \|\| version_compare( '1.1', $old_version ) ) {
657	$pwd = get_option( 'password_protected_password' );
658	if ( ! empty( $pwd ) ) {
659	$new_pwd = $this->encrypt_password( $pwd );
660	update_option( 'password_protected_password', $new_pwd );
661	}
662	}
663
664	update_option( 'password_protected_version', $this->version );
665
666	}
667
668	/**
669	* Compat
670	*
671	* Support for 3rd party plugins:
672	*
673	* - Login Logo http://wordpress.org/extend/plugins/login-logo/
674	* - Uber Login Logo http://wordpress.org/plugins/uber-login-logo/
675	*/
676	public function compat() {
677
678	if ( class_exists( 'CWS_Login_Logo_Plugin' ) ) {
679
680	// Add support for Mark Jaquith's Login Logo plugin
681	add_action( 'password_protected_login_head', array( new CWS_Login_Logo_Plugin, 'login_head' ) );
682
683	} elseif ( class_exists( 'UberLoginLogo' ) ) {
684
685	// Add support for Uber Login Logo plugin
686	add_action( 'password_protected_login_head', array( 'UberLoginLogo', 'replaceLoginLogo' ) );
687
688	}
689
690	}
691
692	/**
693	* Login Messages
694	* Outputs messages and errors in the login template.
695	*/
696	public function login_messages() {
697
698	// Add message
699	$message = apply_filters( 'password_protected_login_message', '' );
700	if ( ! empty( $message ) ) {
701	echo $message . "\n";
702	}
703
704	if ( $this->errors->get_error_code() ) {
705
706	$errors = '';
707	$messages = '';
708
709	foreach ( $this->errors->get_error_codes() as $code ) {
710	$severity = $this->errors->get_error_data( $code );
711	foreach ( $this->errors->get_error_messages( $code ) as $error ) {
712	if ( 'message' == $severity ) {
713	$messages .= $error . '<br />';
714	} else {
715	$errors .= $error . '<br />';
716	}
717	}
718	}
719
720	if ( ! empty( $errors ) ) {
721	echo '<div id="login_error">' . apply_filters( 'password_protected_login_errors', $errors ) . "</div>\n";
722	}
723	if ( ! empty( $messages ) ) {
724	echo '<p class="message">' . apply_filters( 'password_protected_login_messages', $messages ) . "</p>\n";
725	}
726
727	}
728
729	}
730
731	/**
732	* Load Theme Stylesheet
733	*
734	* Check wether a 'password-protected-login.css' stylesheet exists in your theme
735	* and if so loads it.
736	*
737	* Works with child themes.
738	*
739	* Possible to specify a different file in the theme folder via the
740	* 'password_protected_stylesheet_file' filter (allows for theme subfolders).
741	*/
742	public function load_theme_stylesheet() {
743
744	$filename = apply_filters( 'password_protected_stylesheet_file', 'password-protected-login.css' );
745
746	$located = locate_template( $filename );
747
748	if ( ! empty( $located ) ) {
749
750	$stylesheet_directory = trailingslashit( get_stylesheet_directory() );
751	$template_directory = trailingslashit( get_template_directory() );
752
753	if ( $stylesheet_directory == substr( $located, 0, strlen( $stylesheet_directory ) ) ) {
754	wp_enqueue_style( 'password-protected-login', get_stylesheet_directory_uri() . '/' . $filename );
755	} else if ( $template_directory == substr( $located, 0, strlen( $template_directory ) ) ) {
756	wp_enqueue_style( 'password-protected-login', get_template_directory_uri() . '/' . $filename );
757	}
758
759	}
760
761	}
762
763	/**
764	* Safe Redirect
765	*
766	* Ensure the redirect is to the same site or pluggable list of allowed domains.
767	* If invalid will redirect to ...
768	* Based on the WordPress wp_safe_redirect() function.
769	*/
770	public function safe_redirect( $location, $status = 302 ) {
771
772	$location = wp_sanitize_redirect( $location );
773	$location = wp_validate_redirect( $location, home_url() );
774
775	wp_redirect( $location, $status );
776
777	}
778
779	/**
780	* Is Plugin Supported?
781	*
782	* Check to see if there are any known reasons why this plugin may not work in
783	* the user's hosting environment.
784	*
785	* @return boolean
786	*/
787	static function is_plugin_supported() {
788
789	return true;
790
791	}
792
793	/**
794	* Check whether a given request has permissions
795	*
796	* Always allow logged in users who require REST API for Gutenberg
797	* and other admin/plugin compatibility.
798	*
799	* @param WP_REST_Request $access Full details about the request.
800	* @return WP_Error\|boolean
801	*/
802	public function only_allow_logged_in_rest_access( $access ) {
803
804	// If user is not logged in
805	if ( ! $this->is_user_logged_in() && ! is_user_logged_in() && ! (bool) get_option( 'password_protected_rest' ) ) {
806	return new WP_Error( 'rest_cannot_access', __( 'Only authenticated users can access the REST API.', 'password-protected' ), array( 'status' => rest_authorization_required_code() ) );
807	}
808
809	return $access;
810
811	}
812
813	}
814