password-protected / password-protected.php

password-protected.php in Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content 2.2.3, at password-protected.php

816 lines 20.6 KB

Raw Download Zip

1	<?php
2
3	/*
4	Plugin Name: Password Protected
5	Plugin URI: https://wordpress.org/plugins/password-protected/
6	Description: A very simple way to quickly password protect your WordPress site with a single password. Please note: This plugin does not restrict access to uploaded files and images and does not work with some caching setups.
7	Version: 2.2.3
8	Author: Ben Huson
9	Text Domain: password-protected
10	Author URI: http://github.com/benhuson/password-protected/
11	License: GPLv2
12	*/
13
14	/*
15	Copyright 2012 Ben Huson (email : ben@thewhiteroom.net)
16
17	This program is free software; you can redistribute it and/or modify
18	it under the terms of the GNU General Public License, version 2, as
19	published by the Free Software Foundation.
20
21	This program is distributed in the hope that it will be useful,
22	but WITHOUT ANY WARRANTY; without even the implied warranty of
23	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
24	GNU General Public License for more details.
25
26	You should have received a copy of the GNU General Public License
27	along with this program; if not, write to the Free Software
28	Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
29	*/
30
31	/**
32	* @todo Use wp_hash_password() ?
33	* @todo Remember me
34	*/
35
36	define( 'PASSWORD_PROTECTED_SUBDIR', '/' . str_replace( basename( __FILE__ ), '', plugin_basename( __FILE__ ) ) );
37	define( 'PASSWORD_PROTECTED_URL', plugins_url( PASSWORD_PROTECTED_SUBDIR ) );
38	define( 'PASSWORD_PROTECTED_DIR', plugin_dir_path( __FILE__ ) );
39
40	global $Password_Protected;
41	$Password_Protected = new Password_Protected();
42
43	class Password_Protected {
44
45	var $version = '2.2.3';
46	var $admin = null;
47	var $errors = null;
48
49	/**
50	* Constructor
51	*/
52	public function __construct() {
53
54	$this->errors = new WP_Error();
55
56	register_activation_hook( __FILE__, array( &$this, 'install' ) );
57
58	add_action( 'plugins_loaded', array( $this, 'load_plugin_textdomain' ) );
59
60	add_filter( 'password_protected_is_active', array( $this, 'allow_ip_addresses' ) );
61
62	add_action( 'init', array( $this, 'disable_caching' ), 1 );
63	add_action( 'init', array( $this, 'maybe_process_logout' ), 1 );
64	add_action( 'init', array( $this, 'maybe_process_login' ), 1 );
65	add_action( 'wp', array( $this, 'disable_feeds' ) );
66	add_action( 'template_redirect', array( $this, 'maybe_show_login' ), -1 );
67	add_filter( 'pre_option_password_protected_status', array( $this, 'allow_feeds' ) );
68	add_filter( 'pre_option_password_protected_status', array( $this, 'allow_administrators' ) );
69	add_filter( 'pre_option_password_protected_status', array( $this, 'allow_users' ) );
70	add_filter( 'rest_authentication_errors', array( $this, 'only_allow_logged_in_rest_access' ) );
71	add_action( 'init', array( $this, 'compat' ) );
72	add_action( 'password_protected_login_messages', array( $this, 'login_messages' ) );
73	add_action( 'login_enqueue_scripts', array( $this, 'load_theme_stylesheet' ), 5 );
74
75	add_shortcode( 'password_protected_logout_link', array( $this, 'logout_link_shortcode' ) );
76
77	include_once( dirname( __FILE__ ) . '/admin/admin-bar.php' );
78
79	if ( is_admin() ) {
80
81	include_once( dirname( __FILE__ ) . '/admin/admin-caching.php' );
82	include_once( dirname( __FILE__ ) . '/admin/admin.php' );
83
84	$this->admin_caching = new Password_Protected_Admin_Caching( $this );
85	$this->admin = new Password_Protected_Admin();
86
87	}
88
89	}
90
91	/**
92	* I18n
93	*/
94	public function load_plugin_textdomain() {
95
96	load_plugin_textdomain( 'password-protected', false, basename( dirname( __FILE__ ) ) . '/languages' );
97
98	}
99
100	/**
101	* Disable Page Caching
102	*/
103	public function disable_caching() {
104
105	if ( $this->is_active() && ! defined( 'DONOTCACHEPAGE' ) ) {
106	define( 'DONOTCACHEPAGE', true );
107	}
108
109	}
110
111	/**
112	* Is Active?
113	*
114	* @return boolean Is password protection active?
115	*/
116	public function is_active() {
117
118	global $wp_query;
119
120	// Always allow access to robots.txt
121	if ( isset( $wp_query ) && is_robots() ) {
122	return false;
123	}
124
125	if ( (bool) get_option( 'password_protected_status' ) ) {
126	$is_active = true;
127	} else {
128	$is_active = false;
129	}
130
131	$is_active = apply_filters( 'password_protected_is_active', $is_active );
132
133	if ( isset( $_GET['password-protected'] ) ) {
134	$is_active = true;
135	}
136
137	return $is_active;
138
139	}
140
141	/**
142	* Disable Feeds
143	*
144	* @todo An option/filter to prevent disabling of feeds.
145	*/
146	public function disable_feeds() {
147
148	if ( $this->is_active() ) {
149	add_action( 'do_feed', array( $this, 'disable_feed' ), 1 );
150	add_action( 'do_feed_rdf', array( $this, 'disable_feed' ), 1 );
151	add_action( 'do_feed_rss', array( $this, 'disable_feed' ), 1 );
152	add_action( 'do_feed_rss2', array( $this, 'disable_feed' ), 1 );
153	add_action( 'do_feed_atom', array( $this, 'disable_feed' ), 1 );
154	}
155
156	}
157
158	/**
159	* Disable Feed
160	*
161	* @todo Make Translatable
162	*/
163	public function disable_feed() {
164
165	wp_die( sprintf( __( 'Feeds are not available for this site. Please visit the <a href="%s">website</a>.', 'password-protected' ), get_bloginfo( 'url' ) ) );
166
167	}
168
169	/**
170	* Allow Feeds
171	*
172	* @param boolean $bool Allow feeds.
173	* @return boolean True/false.
174	*/
175	public function allow_feeds( $bool ) {
176
177	if ( is_feed() && (bool) get_option( 'password_protected_feeds' ) ) {
178	return 0;
179	}
180
181	return $bool;
182
183	}
184
185	/**
186	* Allow Administrators
187	*
188	* @param boolean $bool Allow administrators.
189	* @return boolean True/false.
190	*/
191	public function allow_administrators( $bool ) {
192
193	if ( ! is_admin() && current_user_can( 'manage_options' ) && (bool) get_option( 'password_protected_administrators' ) ) {
194	return 0;
195	}
196
197	return $bool;
198
199	}
200
201	/**
202	* Allow Users
203	*
204	* @param boolean $bool Allow administrators.
205	* @return boolean True/false.
206	*/
207	public function allow_users( $bool ) {
208
209	if ( ! is_admin() && is_user_logged_in() && (bool) get_option( 'password_protected_users' ) ) {
210	return 0;
211	}
212
213	return $bool;
214
215	}
216
217	/**
218	* Allow IP Addresses
219	*
220	* If user has a valid email address, return false to disable password protection.
221	*
222	* @param boolean $bool Allow IP addresses.
223	* @return boolean True/false.
224	*/
225	public function allow_ip_addresses( $bool ) {
226
227	$ip_addresses = $this->get_allowed_ip_addresses();
228
229	if ( in_array( $_SERVER['REMOTE_ADDR'], $ip_addresses ) ) {
230	$bool = false;
231	}
232
233	return $bool;
234
235	}
236
237	/**
238	* Get Allowed IP Addresses
239	*
240	* @return array IP addresses.
241	*/
242	public function get_allowed_ip_addresses() {
243
244	return explode( "\n", get_option( 'password_protected_allowed_ip_addresses' ) );
245
246	}
247
248	/**
249	* Allow the remember me function
250	*
251	* @return. boolean
252	*/
253	public function allow_remember_me() {
254
255	return (bool) get_option( 'password_protected_remember_me' );
256
257	}
258
259	/**
260	* Encrypt Password
261	*
262	* @param string $password Password.
263	* @return string Encrypted password.
264	*/
265	public function encrypt_password( $password ) {
266
267	return md5( $password );
268
269	}
270
271	/**
272	* Maybe Process Logout
273	*/
274	public function maybe_process_logout() {
275
276	if ( isset( $_REQUEST['password-protected'] ) && $_REQUEST['password-protected'] == 'logout' ) {
277
278	$this->logout();
279
280	if ( isset( $_REQUEST['redirect_to'] ) ) {
281	$redirect_to = esc_url_raw( $_REQUEST['redirect_to'], array( 'http', 'https' ) );
282	} else {
283	$redirect_to = home_url( '/' );
284	}
285
286	$this->safe_redirect( $redirect_to );
287	exit();
288
289	}
290
291	}
292
293	/**
294	* Maybe Process Login
295	*/
296	public function maybe_process_login() {
297
298	if ( $this->is_active() && isset( $_REQUEST['password_protected_pwd'] ) ) {
299	$password_protected_pwd = $_REQUEST['password_protected_pwd'];
300	$pwd = get_option( 'password_protected_password' );
301
302	// If correct password...
303	if ( ( hash_equals( $pwd, $this->encrypt_password( $password_protected_pwd ) ) && $pwd != '' ) \|\| apply_filters( 'password_protected_process_login', false, $password_protected_pwd ) ) {
304
305	$remember = isset( $_REQUEST['password_protected_rememberme'] ) ? boolval( $_REQUEST['password_protected_rememberme'] ) : false;
306
307	if ( ! $this->allow_remember_me() ) {
308	$remember = false;
309	}
310
311	$this->set_auth_cookie( $remember );
312	$redirect_to = isset( $_REQUEST['redirect_to'] ) ? $_REQUEST['redirect_to'] : '';
313	$redirect_to = apply_filters( 'password_protected_login_redirect', $redirect_to );
314
315	if ( ! empty( $redirect_to ) ) {
316	$this->safe_redirect( $redirect_to );
317	exit;
318	}
319
320	} else {
321
322	// ... otherwise incorrect password
323	$this->clear_auth_cookie();
324	$this->errors->add( 'incorrect_password', __( 'Incorrect Password', 'password-protected' ) );
325
326	}
327
328	}
329
330	}
331
332	/**
333	* Is User Logged In?
334	*
335	* @return boolean
336	*/
337	public function is_user_logged_in() {
338
339	return $this->is_active() && $this->validate_auth_cookie();
340
341	}
342
343	/**
344	* Maybe Show Login
345	*/
346	public function maybe_show_login() {
347
348	// Filter for adding exceptions.
349	$show_login = apply_filters( 'password_protected_show_login', $this->is_active() );
350
351	// Logged in
352	if ( $this->is_user_logged_in() ) {
353	$show_login = false;
354	}
355
356	if ( ! $show_login ) {
357	return;
358	}
359
360	// Show login form
361	if ( isset( $_REQUEST['password-protected'] ) && 'login' == $_REQUEST['password-protected'] ) {
362
363	$default_theme_file = locate_template( array( 'password-protected-login.php' ) );
364
365	if ( empty( $default_theme_file ) ) {
366	$default_theme_file = dirname( __FILE__ ) . '/theme/password-protected-login.php';
367	}
368
369	$theme_file = apply_filters( 'password_protected_theme_file', $default_theme_file );
370	if ( ! file_exists( $theme_file ) ) {
371	$theme_file = $default_theme_file;
372	}
373
374	load_template( $theme_file );
375	exit();
376
377	} else {
378
379	$redirect_to = add_query_arg( 'password-protected', 'login', home_url() );
380
381	// URL to redirect back to after login
382	$redirect_to_url = apply_filters( 'password_protected_login_redirect_url', ( is_ssl() ? 'https://' : 'http://' ) . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'] );
383	if ( ! empty( $redirect_to_url ) ) {
384	$redirect_to = add_query_arg( 'redirect_to', urlencode( $redirect_to_url ), $redirect_to );
385	}
386
387	wp_redirect( $redirect_to );
388	exit();
389
390	}
391	}
392
393	/**
394	* Get Site ID
395	*
396	* @return string Site ID.
397	*/
398	public function get_site_id() {
399
400	global $blog_id;
401	return 'bid_' . apply_filters( 'password_protected_blog_id', $blog_id );
402
403	}
404
405	/**
406	* Login URL
407	*
408	* @return string Login URL.
409	*/
410	public function login_url() {
411
412	return add_query_arg( 'password-protected', 'login', home_url( '/' ) );
413
414	}
415
416	/**
417	* Logout
418	*/
419	public function logout() {
420
421	$this->clear_auth_cookie();
422	do_action( 'password_protected_logout' );
423
424	}
425
426	/**
427	* Logout URL
428	*
429	* @param string $redirect_to Optional. Redirect URL.
430	* @return string Logout URL.
431	*/
432	public function logout_url( $redirect_to = '' ) {
433
434	$query = array(
435	'password-protected' => 'logout',
436	'redirect_to' => esc_url_raw( $redirect_to )
437	);
438
439	if ( empty( $query['redirect_to'] ) ) {
440	unset( $query['redirect_to'] );
441	}
442
443	return add_query_arg( $query, home_url() );
444
445	}
446
447	/**
448	* Logout Link
449	*
450	* @param array $args Link args.
451	* @return string HTML link tag.
452	*/
453	public function logout_link( $args = null ) {
454
455	// Only show if user is logged in
456	if ( ! $this->is_user_logged_in() ) {
457	return '';
458	}
459
460	$args = wp_parse_args( $args, array(
461	'redirect_to' => '',
462	'text' => __( 'Logout', 'password-protected' )
463	) );
464
465	if ( empty( $args['text'] ) ) {
466	$args['text'] = __( 'Logout', 'password-protected' );
467	}
468
469	return sprintf( '<a href="%s">%s</a>', esc_url( $this->logout_url( $args['redirect_to'] ) ), esc_html( $args['text'] ) );
470
471	}
472
473	/**
474	* Logout Link Shortcode
475	*
476	* @param array $args Link args.
477	* @return string HTML link tag.
478	*/
479	public function logout_link_shortcode( $atts, $content = null ) {
480
481	$atts = shortcode_atts( array(
482	'redirect_to' => '',
483	'text' => $content
484	), $atts, 'logout_link_shortcode' );
485
486	return $this->logout_link( $atts );
487
488	}
489
490	/**
491	* Get Hashed Password
492	*
493	* @return string Hashed password.
494	*/
495	public function get_hashed_password() {
496
497	return md5( get_option( 'password_protected_password' ) . wp_salt() );
498
499	}
500
501	/**
502	* Validate Auth Cookie
503	*
504	* @param string $cookie Cookie string.
505	* @param string $scheme Cookie scheme.
506	* @return boolean Validation successful?
507	*/
508	public function validate_auth_cookie( $cookie = '', $scheme = '' ) {
509
510	if ( ! $cookie_elements = $this->parse_auth_cookie( $cookie, $scheme ) ) {
511	do_action( 'password_protected_auth_cookie_malformed', $cookie, $scheme );
512	return false;
513	}
514
515	extract( $cookie_elements, EXTR_OVERWRITE );
516
517	$expired = $expiration;
518
519	// Allow a grace period for POST and AJAX requests
520	if ( defined( 'DOING_AJAX' ) \|\| 'POST' == $_SERVER['REQUEST_METHOD'] ) {
521	$expired += 3600;
522	}
523
524	// Quick check to see if an honest cookie has expired
525	if ( $expired < current_time( 'timestamp' ) ) {
526	do_action('password_protected_auth_cookie_expired', $cookie_elements);
527	return false;
528	}
529
530	$key = md5( $this->get_site_id() . $this->get_hashed_password() . '\|' . $expiration );
531	$hash = hash_hmac( 'md5', $this->get_site_id() . '\|' . $expiration, $key);
532
533	if ( $hmac != $hash ) {
534	do_action( 'password_protected_auth_cookie_bad_hash', $cookie_elements );
535	return false;
536	}
537
538	if ( $expiration < current_time( 'timestamp' ) ) { // AJAX/POST grace period set above
539	$GLOBALS['login_grace_period'] = 1;
540	}
541
542	return true;
543
544	}
545
546	/**
547	* Generate Auth Cookie
548	*
549	* @param int $expiration Expiration time in seconds.
550	* @param string $scheme Cookie scheme.
551	* @return string Cookie.
552	*/
553	public function generate_auth_cookie( $expiration, $scheme = 'auth' ) {
554
555	$key = md5( $this->get_site_id() . $this->get_hashed_password() . '\|' . $expiration );
556	$hash = hash_hmac( 'md5', $this->get_site_id() . '\|' . $expiration, $key );
557	$cookie = $this->get_site_id() . '\|' . $expiration . '\|' . $hash;
558
559	return $cookie;
560
561	}
562
563	/**
564	* Parse Auth Cookie
565	*
566	* @param string $cookie Cookie string.
567	* @param string $scheme Cookie scheme.
568	* @return string Cookie string.
569	*/
570	public function parse_auth_cookie( $cookie = '', $scheme = '' ) {
571
572	if ( empty( $cookie ) ) {
573
574	$cookie_name = $this->cookie_name();
575
576	if ( empty( $_COOKIE[ $cookie_name ] ) ) {
577	return false;
578	}
579
580	$cookie = $_COOKIE[ $cookie_name ];
581
582	}
583
584	$cookie_elements = explode( '\|', $cookie );
585
586	if ( count( $cookie_elements ) != 3 ) {
587	return false;
588	}
589
590	list( $site_id, $expiration, $hmac ) = $cookie_elements;
591
592	return compact( 'site_id', 'expiration', 'hmac', 'scheme' );
593
594	}
595
596	/**
597	* Set Auth Cookie
598	*
599	* @todo
600	*
601	* @param boolean $remember Remember logged in.
602	* @param string $secure Secure cookie.
603	*/
604	public function set_auth_cookie( $remember = false, $secure = '') {
605
606	if ( $remember ) {
607	$expiration_time = apply_filters( 'password_protected_auth_cookie_expiration', get_option( 'password_protected_remember_me_lifetime', 14 ) * DAY_IN_SECONDS, $remember );
608	$expiration = $expire = current_time( 'timestamp' ) + $expiration_time;
609	} else {
610	$expiration_time = apply_filters( 'password_protected_auth_cookie_expiration', DAY_IN_SECONDS * 20, $remember );
611	$expiration = current_time( 'timestamp' ) + $expiration_time;
612	$expire = 0;
613	}
614
615	if ( '' === $secure ) {
616	$secure = is_ssl();
617	}
618
619	$secure_password_protected_cookie = apply_filters( 'password_protected_secure_password_protected_cookie', false, $secure );
620	$password_protected_cookie = $this->generate_auth_cookie( $expiration, 'password_protected' );
621
622	setcookie( $this->cookie_name(), $password_protected_cookie, $expire, COOKIEPATH, COOKIE_DOMAIN, $secure_password_protected_cookie, true );
623	if ( COOKIEPATH != SITECOOKIEPATH ) {
624	setcookie( $this->cookie_name(), $password_protected_cookie, $expire, SITECOOKIEPATH, COOKIE_DOMAIN, $secure_password_protected_cookie, true );
625	}
626
627	}
628
629	/**
630	* Clear Auth Cookie
631	*/
632	public function clear_auth_cookie() {
633
634	setcookie( $this->cookie_name(), ' ', current_time( 'timestamp' ) - 31536000, COOKIEPATH, COOKIE_DOMAIN );
635	setcookie( $this->cookie_name(), ' ', current_time( 'timestamp' ) - 31536000, SITECOOKIEPATH, COOKIE_DOMAIN );
636
637	}
638
639	/**
640	* Cookie Name
641	*
642	* @return string Cookie name.
643	*/
644	public function cookie_name() {
645
646	return $this->get_site_id() . '_password_protected_auth';
647
648	}
649
650	/**
651	* Install
652	*/
653	public function install() {
654
655	$old_version = get_option( 'password_protected_version' );
656
657	// 1.1 - Upgrade to MD5
658	if ( empty( $old_version ) \|\| version_compare( '1.1', $old_version ) ) {
659	$pwd = get_option( 'password_protected_password' );
660	if ( ! empty( $pwd ) ) {
661	$new_pwd = $this->encrypt_password( $pwd );
662	update_option( 'password_protected_password', $new_pwd );
663	}
664	}
665
666	update_option( 'password_protected_version', $this->version );
667
668	}
669
670	/**
671	* Compat
672	*
673	* Support for 3rd party plugins:
674	*
675	* - Login Logo http://wordpress.org/extend/plugins/login-logo/
676	* - Uber Login Logo http://wordpress.org/plugins/uber-login-logo/
677	*/
678	public function compat() {
679
680	if ( class_exists( 'CWS_Login_Logo_Plugin' ) ) {
681
682	// Add support for Mark Jaquith's Login Logo plugin
683	add_action( 'password_protected_login_head', array( new CWS_Login_Logo_Plugin, 'login_head' ) );
684
685	} elseif ( class_exists( 'UberLoginLogo' ) ) {
686
687	// Add support for Uber Login Logo plugin
688	add_action( 'password_protected_login_head', array( 'UberLoginLogo', 'replaceLoginLogo' ) );
689
690	}
691
692	}
693
694	/**
695	* Login Messages
696	* Outputs messages and errors in the login template.
697	*/
698	public function login_messages() {
699
700	// Add message
701	$message = apply_filters( 'password_protected_login_message', '' );
702	if ( ! empty( $message ) ) {
703	echo $message . "\n";
704	}
705
706	if ( $this->errors->get_error_code() ) {
707
708	$errors = '';
709	$messages = '';
710
711	foreach ( $this->errors->get_error_codes() as $code ) {
712	$severity = $this->errors->get_error_data( $code );
713	foreach ( $this->errors->get_error_messages( $code ) as $error ) {
714	if ( 'message' == $severity ) {
715	$messages .= $error . '<br />';
716	} else {
717	$errors .= $error . '<br />';
718	}
719	}
720	}
721
722	if ( ! empty( $errors ) ) {
723	echo '<div id="login_error">' . apply_filters( 'password_protected_login_errors', $errors ) . "</div>\n";
724	}
725	if ( ! empty( $messages ) ) {
726	echo '<p class="message">' . apply_filters( 'password_protected_login_messages', $messages ) . "</p>\n";
727	}
728
729	}
730
731	}
732
733	/**
734	* Load Theme Stylesheet
735	*
736	* Check wether a 'password-protected-login.css' stylesheet exists in your theme
737	* and if so loads it.
738	*
739	* Works with child themes.
740	*
741	* Possible to specify a different file in the theme folder via the
742	* 'password_protected_stylesheet_file' filter (allows for theme subfolders).
743	*/
744	public function load_theme_stylesheet() {
745
746	$filename = apply_filters( 'password_protected_stylesheet_file', 'password-protected-login.css' );
747
748	$located = locate_template( $filename );
749
750	if ( ! empty( $located ) ) {
751
752	$stylesheet_directory = trailingslashit( get_stylesheet_directory() );
753	$template_directory = trailingslashit( get_template_directory() );
754
755	if ( $stylesheet_directory == substr( $located, 0, strlen( $stylesheet_directory ) ) ) {
756	wp_enqueue_style( 'password-protected-login', get_stylesheet_directory_uri() . '/' . $filename );
757	} else if ( $template_directory == substr( $located, 0, strlen( $template_directory ) ) ) {
758	wp_enqueue_style( 'password-protected-login', get_template_directory_uri() . '/' . $filename );
759	}
760
761	}
762
763	}
764
765	/**
766	* Safe Redirect
767	*
768	* Ensure the redirect is to the same site or pluggable list of allowed domains.
769	* If invalid will redirect to ...
770	* Based on the WordPress wp_safe_redirect() function.
771	*/
772	public function safe_redirect( $location, $status = 302 ) {
773
774	$location = wp_sanitize_redirect( $location );
775	$location = wp_validate_redirect( $location, home_url() );
776
777	wp_redirect( $location, $status );
778
779	}
780
781	/**
782	* Is Plugin Supported?
783	*
784	* Check to see if there are any known reasons why this plugin may not work in
785	* the user's hosting environment.
786	*
787	* @return boolean
788	*/
789	static function is_plugin_supported() {
790
791	return true;
792
793	}
794
795	/**
796	* Check whether a given request has permissions
797	*
798	* Always allow logged in users who require REST API for Gutenberg
799	* and other admin/plugin compatibility.
800	*
801	* @param WP_REST_Request $access Full details about the request.
802	* @return WP_Error\|boolean
803	*/
804	public function only_allow_logged_in_rest_access( $access ) {
805
806	// If user is not logged in
807	if ( $this->is_active() && ! $this->is_user_logged_in() && ! is_user_logged_in() && ! (bool) get_option( 'password_protected_rest' ) ) {
808	return new WP_Error( 'rest_cannot_access', __( 'Only authenticated users can access the REST API.', 'password-protected' ), array( 'status' => rest_authorization_required_code() ) );
809	}
810
811	return $access;
812
813	}
814
815	}
816