password-protected / password-protected.php

password-protected.php in Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content 2.4, at password-protected.php

828 lines 21.1 KB

Raw Download Zip

1	<?php
2
3	/*
4	Plugin Name: Password Protected
5	Plugin URI: https://wordpress.org/plugins/password-protected/
6	Description: A very simple way to quickly password protect your WordPress site with a single password. Please note: This plugin does not restrict access to uploaded files and images and does not work with some caching setups.
7	Version: 2.4
8	Author: Ben Huson
9	Text Domain: password-protected
10	Author URI: http://github.com/benhuson/password-protected/
11	License: GPLv2
12	*/
13
14	/*
15	Copyright 2012 Ben Huson (email : ben@thewhiteroom.net)
16
17	This program is free software; you can redistribute it and/or modify
18	it under the terms of the GNU General Public License, version 2, as
19	published by the Free Software Foundation.
20
21	This program is distributed in the hope that it will be useful,
22	but WITHOUT ANY WARRANTY; without even the implied warranty of
23	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
24	GNU General Public License for more details.
25
26	You should have received a copy of the GNU General Public License
27	along with this program; if not, write to the Free Software
28	Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
29	*/
30
31	/**
32	* @todo Use wp_hash_password() ?
33	* @todo Remember me
34	*/
35
36	define( 'PASSWORD_PROTECTED_SUBDIR', '/' . str_replace( basename( __FILE__ ), '', plugin_basename( __FILE__ ) ) );
37	define( 'PASSWORD_PROTECTED_URL', plugins_url( PASSWORD_PROTECTED_SUBDIR ) );
38	define( 'PASSWORD_PROTECTED_DIR', plugin_dir_path( __FILE__ ) );
39
40	global $Password_Protected;
41	$Password_Protected = new Password_Protected();
42
43	class Password_Protected {
44
45	var $version = '2.3';
46	var $admin = null;
47	var $errors = null;
48
49	/**
50	* Constructor
51	*/
52	public function __construct() {
53
54	$this->errors = new WP_Error();
55
56	register_activation_hook( __FILE__, array( &$this, 'install' ) );
57
58	add_action( 'plugins_loaded', array( $this, 'load_plugin_textdomain' ) );
59
60	add_filter( 'password_protected_is_active', array( $this, 'allow_ip_addresses' ) );
61
62	add_action( 'init', array( $this, 'disable_caching' ), 1 );
63	add_action( 'init', array( $this, 'maybe_process_logout' ), 1 );
64	add_action( 'init', array( $this, 'maybe_process_login' ), 1 );
65	add_action( 'wp', array( $this, 'disable_feeds' ) );
66	add_action( 'template_redirect', array( $this, 'maybe_show_login' ), -1 );
67	add_filter( 'pre_option_password_protected_status', array( $this, 'allow_feeds' ) );
68	add_filter( 'pre_option_password_protected_status', array( $this, 'allow_administrators' ) );
69	add_filter( 'pre_option_password_protected_status', array( $this, 'allow_users' ) );
70	add_filter( 'rest_authentication_errors', array( $this, 'only_allow_logged_in_rest_access' ) );
71	add_action( 'init', array( $this, 'compat' ) );
72	add_action( 'password_protected_login_messages', array( $this, 'login_messages' ) );
73	add_action( 'login_enqueue_scripts', array( $this, 'load_theme_stylesheet' ), 5 );
74
75	// Available from WordPress 4.3+
76	if ( function_exists( 'wp_site_icon' ) ) {
77	add_action( 'password_protected_login_head', 'wp_site_icon' );
78	}
79
80	add_shortcode( 'password_protected_logout_link', array( $this, 'logout_link_shortcode' ) );
81
82	include_once( dirname( __FILE__ ) . '/admin/admin-bar.php' );
83
84	if ( is_admin() ) {
85
86	include_once( dirname( __FILE__ ) . '/admin/admin-caching.php' );
87	include_once( dirname( __FILE__ ) . '/admin/admin.php' );
88
89	$this->admin_caching = new Password_Protected_Admin_Caching( $this );
90	$this->admin = new Password_Protected_Admin();
91
92	}
93
94	}
95
96	/**
97	* I18n
98	*/
99	public function load_plugin_textdomain() {
100
101	load_plugin_textdomain( 'password-protected', false, basename( dirname( __FILE__ ) ) . '/languages' );
102
103	}
104
105	/**
106	* Disable Page Caching
107	*/
108	public function disable_caching() {
109
110	if ( $this->is_active() && ! defined( 'DONOTCACHEPAGE' ) ) {
111	define( 'DONOTCACHEPAGE', true );
112	}
113
114	}
115
116	/**
117	* Is Active?
118	*
119	* @return boolean Is password protection active?
120	*/
121	public function is_active() {
122
123	global $wp_query;
124
125	// Always allow access to robots.txt
126	if ( isset( $wp_query ) && is_robots() ) {
127	return false;
128	}
129
130	if ( (bool) get_option( 'password_protected_status' ) ) {
131	$is_active = true;
132	} else {
133	$is_active = false;
134	}
135
136	$is_active = apply_filters( 'password_protected_is_active', $is_active );
137
138	if ( isset( $_GET['password-protected'] ) ) {
139	$is_active = true;
140	}
141
142	return $is_active;
143
144	}
145
146	/**
147	* Disable Feeds
148	*
149	* @todo An option/filter to prevent disabling of feeds.
150	*/
151	public function disable_feeds() {
152
153	if ( $this->is_active() ) {
154	add_action( 'do_feed', array( $this, 'disable_feed' ), 1 );
155	add_action( 'do_feed_rdf', array( $this, 'disable_feed' ), 1 );
156	add_action( 'do_feed_rss', array( $this, 'disable_feed' ), 1 );
157	add_action( 'do_feed_rss2', array( $this, 'disable_feed' ), 1 );
158	add_action( 'do_feed_atom', array( $this, 'disable_feed' ), 1 );
159	}
160
161	}
162
163	/**
164	* Disable Feed
165	*
166	* @todo Make Translatable
167	*/
168	public function disable_feed() {
169
170	wp_die( sprintf( __( 'Feeds are not available for this site. Please visit the <a href="%s">website</a>.', 'password-protected' ), get_bloginfo( 'url' ) ) );
171
172	}
173
174	/**
175	* Allow Feeds
176	*
177	* @param boolean $bool Allow feeds.
178	* @return boolean True/false.
179	*/
180	public function allow_feeds( $bool ) {
181
182	if ( is_feed() && (bool) get_option( 'password_protected_feeds' ) ) {
183	return 0;
184	}
185
186	return $bool;
187
188	}
189
190	/**
191	* Allow Administrators
192	*
193	* @param boolean $bool Allow administrators.
194	* @return boolean True/false.
195	*/
196	public function allow_administrators( $bool ) {
197
198	if ( ! is_admin() && current_user_can( 'manage_options' ) && (bool) get_option( 'password_protected_administrators' ) ) {
199	return 0;
200	}
201
202	return $bool;
203
204	}
205
206	/**
207	* Allow Users
208	*
209	* @param boolean $bool Allow administrators.
210	* @return boolean True/false.
211	*/
212	public function allow_users( $bool ) {
213
214	if ( ! is_admin() && is_user_logged_in() && (bool) get_option( 'password_protected_users' ) ) {
215	return 0;
216	}
217
218	return $bool;
219
220	}
221
222	/**
223	* Allow IP Addresses
224	*
225	* If user has a valid email address, return false to disable password protection.
226	*
227	* @param boolean $bool Allow IP addresses.
228	* @return boolean True/false.
229	*/
230	public function allow_ip_addresses( $bool ) {
231
232	$ip_addresses = $this->get_allowed_ip_addresses();
233
234	if ( isset( $_SERVER['REMOTE_ADDR'] ) && in_array( $_SERVER['REMOTE_ADDR'], $ip_addresses ) ) {
235	$bool = false;
236	}
237
238	return $bool;
239
240	}
241
242	/**
243	* Get Allowed IP Addresses
244	*
245	* @return array IP addresses.
246	*/
247	public function get_allowed_ip_addresses() {
248
249	return explode( "\n", get_option( 'password_protected_allowed_ip_addresses' ) );
250
251	}
252
253	/**
254	* Allow the remember me function
255	*
256	* @return. boolean
257	*/
258	public function allow_remember_me() {
259
260	return (bool) get_option( 'password_protected_remember_me' );
261
262	}
263
264	/**
265	* Encrypt Password
266	*
267	* @param string $password Password.
268	* @return string Encrypted password.
269	*/
270	public function encrypt_password( $password ) {
271
272	return md5( $password );
273
274	}
275
276	/**
277	* Maybe Process Logout
278	*/
279	public function maybe_process_logout() {
280
281	if ( isset( $_REQUEST['password-protected'] ) && $_REQUEST['password-protected'] == 'logout' ) {
282
283	$this->logout();
284
285	if ( isset( $_REQUEST['redirect_to'] ) ) {
286	$redirect_to = remove_query_arg( 'password-protected', esc_url_raw( $_REQUEST['redirect_to'], array( 'http', 'https' ) ) );
287	} else {
288	$redirect_to = home_url( '/' );
289	}
290
291	$this->safe_redirect( $redirect_to );
292	exit();
293
294	}
295
296	}
297
298	/**
299	* Maybe Process Login
300	*/
301	public function maybe_process_login() {
302
303	if ( $this->is_active() && isset( $_REQUEST['password_protected_pwd'] ) ) {
304	$password_protected_pwd = $_REQUEST['password_protected_pwd'];
305	$pwd = get_option( 'password_protected_password' );
306
307	// If correct password...
308	if ( ( hash_equals( $pwd, $this->encrypt_password( $password_protected_pwd ) ) && $pwd != '' ) \|\| apply_filters( 'password_protected_process_login', false, $password_protected_pwd ) ) {
309
310	$remember = isset( $_REQUEST['password_protected_rememberme'] ) ? boolval( $_REQUEST['password_protected_rememberme'] ) : false;
311
312	if ( ! $this->allow_remember_me() ) {
313	$remember = false;
314	}
315
316	$this->set_auth_cookie( $remember );
317	$redirect_to = isset( $_REQUEST['redirect_to'] ) ? $_REQUEST['redirect_to'] : '';
318	$redirect_to = apply_filters( 'password_protected_login_redirect', $redirect_to );
319
320	if ( ! empty( $redirect_to ) ) {
321	$this->safe_redirect( remove_query_arg( 'password-protected', $redirect_to ) );
322	exit;
323	} elseif ( isset( $_GET['password_protected_pwd'] ) ) {
324	$this->safe_redirect( remove_query_arg( 'password-protected' ) );
325	exit;
326	}
327
328	} else {
329
330	// ... otherwise incorrect password
331	$this->clear_auth_cookie();
332	$this->errors->add( 'incorrect_password', __( 'Incorrect Password', 'password-protected' ) );
333
334	}
335
336	}
337
338	}
339
340	/**
341	* Is User Logged In?
342	*
343	* @return boolean
344	*/
345	public function is_user_logged_in() {
346
347	return $this->is_active() && $this->validate_auth_cookie();
348
349	}
350
351	/**
352	* Maybe Show Login
353	*/
354	public function maybe_show_login() {
355
356	// Filter for adding exceptions.
357	$show_login = apply_filters( 'password_protected_show_login', $this->is_active() );
358
359	// Logged in
360	if ( $this->is_user_logged_in() ) {
361	$show_login = false;
362	}
363
364	if ( ! $show_login ) {
365	return;
366	}
367
368	// Show login form
369	if ( isset( $_REQUEST['password-protected'] ) && 'login' == $_REQUEST['password-protected'] ) {
370
371	$default_theme_file = locate_template( array( 'password-protected-login.php' ) );
372
373	if ( empty( $default_theme_file ) ) {
374	$default_theme_file = dirname( __FILE__ ) . '/theme/password-protected-login.php';
375	}
376
377	$theme_file = apply_filters( 'password_protected_theme_file', $default_theme_file );
378	if ( ! file_exists( $theme_file ) ) {
379	$theme_file = $default_theme_file;
380	}
381
382	load_template( $theme_file );
383	exit();
384
385	} else {
386
387	$redirect_to = add_query_arg( 'password-protected', 'login', home_url() );
388
389	// URL to redirect back to after login
390	$redirect_to_url = apply_filters( 'password_protected_login_redirect_url', ( is_ssl() ? 'https://' : 'http://' ) . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'] );
391	if ( ! empty( $redirect_to_url ) ) {
392	$redirect_to = add_query_arg( 'redirect_to', urlencode( $redirect_to_url ), $redirect_to );
393	}
394
395	nocache_headers();
396	wp_redirect( $redirect_to );
397	exit();
398
399	}
400	}
401
402	/**
403	* Get Site ID
404	*
405	* @return string Site ID.
406	*/
407	public function get_site_id() {
408
409	global $blog_id;
410	return 'bid_' . apply_filters( 'password_protected_blog_id', $blog_id );
411
412	}
413
414	/**
415	* Login URL
416	*
417	* @return string Login URL.
418	*/
419	public function login_url() {
420
421	return add_query_arg( 'password-protected', 'login', home_url( '/' ) );
422
423	}
424
425	/**
426	* Logout
427	*/
428	public function logout() {
429
430	$this->clear_auth_cookie();
431	do_action( 'password_protected_logout' );
432
433	}
434
435	/**
436	* Logout URL
437	*
438	* @param string $redirect_to Optional. Redirect URL.
439	* @return string Logout URL.
440	*/
441	public function logout_url( $redirect_to = '' ) {
442
443	$query = array(
444	'password-protected' => 'logout',
445	'redirect_to' => esc_url_raw( $redirect_to )
446	);
447
448	if ( empty( $query['redirect_to'] ) ) {
449	unset( $query['redirect_to'] );
450	}
451
452	return add_query_arg( $query, home_url() );
453
454	}
455
456	/**
457	* Logout Link
458	*
459	* @param array $args Link args.
460	* @return string HTML link tag.
461	*/
462	public function logout_link( $args = null ) {
463
464	// Only show if user is logged in
465	if ( ! $this->is_user_logged_in() ) {
466	return '';
467	}
468
469	$args = wp_parse_args( $args, array(
470	'redirect_to' => '',
471	'text' => __( 'Logout', 'password-protected' )
472	) );
473
474	if ( empty( $args['text'] ) ) {
475	$args['text'] = __( 'Logout', 'password-protected' );
476	}
477
478	return sprintf( '<a href="%s">%s</a>', esc_url( $this->logout_url( $args['redirect_to'] ) ), esc_html( $args['text'] ) );
479
480	}
481
482	/**
483	* Logout Link Shortcode
484	*
485	* @param array $args Link args.
486	* @return string HTML link tag.
487	*/
488	public function logout_link_shortcode( $atts, $content = null ) {
489
490	$atts = shortcode_atts( array(
491	'redirect_to' => '',
492	'text' => $content
493	), $atts, 'logout_link_shortcode' );
494
495	return $this->logout_link( $atts );
496
497	}
498
499	/**
500	* Get Hashed Password
501	*
502	* @return string Hashed password.
503	*/
504	public function get_hashed_password() {
505
506	return md5( get_option( 'password_protected_password' ) . wp_salt() );
507
508	}
509
510	/**
511	* Validate Auth Cookie
512	*
513	* @param string $cookie Cookie string.
514	* @param string $scheme Cookie scheme.
515	* @return boolean Validation successful?
516	*/
517	public function validate_auth_cookie( $cookie = '', $scheme = '' ) {
518
519	if ( ! $cookie_elements = $this->parse_auth_cookie( $cookie, $scheme ) ) {
520	do_action( 'password_protected_auth_cookie_malformed', $cookie, $scheme );
521	return false;
522	}
523
524	extract( $cookie_elements, EXTR_OVERWRITE );
525
526	$expired = $expiration;
527
528	// Allow a grace period for POST and AJAX requests
529	if ( defined( 'DOING_AJAX' ) \|\| 'POST' == $_SERVER['REQUEST_METHOD'] ) {
530	$expired += 3600;
531	}
532
533	// Quick check to see if an honest cookie has expired
534	if ( $expired < current_time( 'timestamp' ) ) {
535	do_action('password_protected_auth_cookie_expired', $cookie_elements);
536	return false;
537	}
538
539	$key = md5( $this->get_site_id() . $this->get_hashed_password() . '\|' . $expiration );
540	$hash = hash_hmac( 'md5', $this->get_site_id() . '\|' . $expiration, $key);
541
542	if ( $hmac != $hash ) {
543	do_action( 'password_protected_auth_cookie_bad_hash', $cookie_elements );
544	return false;
545	}
546
547	if ( $expiration < current_time( 'timestamp' ) ) { // AJAX/POST grace period set above
548	$GLOBALS['login_grace_period'] = 1;
549	}
550
551	return true;
552
553	}
554
555	/**
556	* Generate Auth Cookie
557	*
558	* @param int $expiration Expiration time in seconds.
559	* @param string $scheme Cookie scheme.
560	* @return string Cookie.
561	*/
562	public function generate_auth_cookie( $expiration, $scheme = 'auth' ) {
563
564	$key = md5( $this->get_site_id() . $this->get_hashed_password() . '\|' . $expiration );
565	$hash = hash_hmac( 'md5', $this->get_site_id() . '\|' . $expiration, $key );
566	$cookie = $this->get_site_id() . '\|' . $expiration . '\|' . $hash;
567
568	return $cookie;
569
570	}
571
572	/**
573	* Parse Auth Cookie
574	*
575	* @param string $cookie Cookie string.
576	* @param string $scheme Cookie scheme.
577	* @return string Cookie string.
578	*/
579	public function parse_auth_cookie( $cookie = '', $scheme = '' ) {
580
581	if ( empty( $cookie ) ) {
582
583	$cookie_name = $this->cookie_name();
584
585	if ( empty( $_COOKIE[ $cookie_name ] ) ) {
586	return false;
587	}
588
589	$cookie = $_COOKIE[ $cookie_name ];
590
591	}
592
593	$cookie_elements = explode( '\|', $cookie );
594
595	if ( count( $cookie_elements ) != 3 ) {
596	return false;
597	}
598
599	list( $site_id, $expiration, $hmac ) = $cookie_elements;
600
601	return compact( 'site_id', 'expiration', 'hmac', 'scheme' );
602
603	}
604
605	/**
606	* Set Auth Cookie
607	*
608	* @todo
609	*
610	* @param boolean $remember Remember logged in.
611	* @param string $secure Secure cookie.
612	*/
613	public function set_auth_cookie( $remember = false, $secure = '') {
614
615	if ( $remember ) {
616	$expiration_time = apply_filters( 'password_protected_auth_cookie_expiration', get_option( 'password_protected_remember_me_lifetime', 14 ) * DAY_IN_SECONDS, $remember );
617	$expiration = $expire = current_time( 'timestamp' ) + $expiration_time;
618	} else {
619	$expiration_time = apply_filters( 'password_protected_auth_cookie_expiration', DAY_IN_SECONDS * 20, $remember );
620	$expiration = current_time( 'timestamp' ) + $expiration_time;
621	$expire = 0;
622	}
623
624	if ( '' === $secure ) {
625	$secure = is_ssl();
626	}
627
628	$secure_password_protected_cookie = apply_filters( 'password_protected_secure_password_protected_cookie', false, $secure );
629	$password_protected_cookie = $this->generate_auth_cookie( $expiration, 'password_protected' );
630
631	setcookie( $this->cookie_name(), $password_protected_cookie, $expire, COOKIEPATH, COOKIE_DOMAIN, $secure_password_protected_cookie, true );
632	if ( COOKIEPATH != SITECOOKIEPATH ) {
633	setcookie( $this->cookie_name(), $password_protected_cookie, $expire, SITECOOKIEPATH, COOKIE_DOMAIN, $secure_password_protected_cookie, true );
634	}
635
636	}
637
638	/**
639	* Clear Auth Cookie
640	*/
641	public function clear_auth_cookie() {
642
643	setcookie( $this->cookie_name(), ' ', current_time( 'timestamp' ) - 31536000, COOKIEPATH, COOKIE_DOMAIN );
644	setcookie( $this->cookie_name(), ' ', current_time( 'timestamp' ) - 31536000, SITECOOKIEPATH, COOKIE_DOMAIN );
645
646	}
647
648	/**
649	* Cookie Name
650	*
651	* @return string Cookie name.
652	*/
653	public function cookie_name() {
654
655	/**
656	* Filters the cookie name
657	*/
658	return apply_filters( 'password_protected_cookie_name', $this->get_site_id() . '_password_protected_auth', $this );
659
660	}
661
662	/**
663	* Install
664	*/
665	public function install() {
666
667	$old_version = get_option( 'password_protected_version' );
668
669	// 1.1 - Upgrade to MD5
670	if ( empty( $old_version ) \|\| version_compare( '1.1', $old_version ) ) {
671	$pwd = get_option( 'password_protected_password' );
672	if ( ! empty( $pwd ) ) {
673	$new_pwd = $this->encrypt_password( $pwd );
674	update_option( 'password_protected_password', $new_pwd );
675	}
676	}
677
678	update_option( 'password_protected_version', $this->version );
679
680	}
681
682	/**
683	* Compat
684	*
685	* Support for 3rd party plugins:
686	*
687	* - Login Logo https://wordpress.org/plugins/login-logo/
688	* - Uber Login Logo https://wordpress.org/plugins/uber-login-logo/
689	*/
690	public function compat() {
691
692	if ( class_exists( 'CWS_Login_Logo_Plugin' ) ) {
693
694	// Add support for Mark Jaquith's Login Logo plugin
695	add_action( 'password_protected_login_head', array( new CWS_Login_Logo_Plugin, 'login_head' ) );
696
697	} elseif ( class_exists( 'UberLoginLogo' ) ) {
698
699	// Add support for Uber Login Logo plugin
700	add_action( 'password_protected_login_head', array( 'UberLoginLogo', 'replaceLoginLogo' ) );
701
702	}
703
704	}
705
706	/**
707	* Login Messages
708	* Outputs messages and errors in the login template.
709	*/
710	public function login_messages() {
711
712	// Add message
713	$message = apply_filters( 'password_protected_login_message', '' );
714	if ( ! empty( $message ) ) {
715	echo $message . "\n";
716	}
717
718	if ( $this->errors->get_error_code() ) {
719
720	$errors = '';
721	$messages = '';
722
723	foreach ( $this->errors->get_error_codes() as $code ) {
724	$severity = $this->errors->get_error_data( $code );
725	foreach ( $this->errors->get_error_messages( $code ) as $error ) {
726	if ( 'message' == $severity ) {
727	$messages .= $error . '<br />';
728	} else {
729	$errors .= $error . '<br />';
730	}
731	}
732	}
733
734	if ( ! empty( $errors ) ) {
735	echo '<div id="login_error">' . apply_filters( 'password_protected_login_errors', $errors ) . "</div>\n";
736	}
737	if ( ! empty( $messages ) ) {
738	echo '<p class="message">' . apply_filters( 'password_protected_login_messages', $messages ) . "</p>\n";
739	}
740
741	}
742
743	}
744
745	/**
746	* Load Theme Stylesheet
747	*
748	* Check wether a 'password-protected-login.css' stylesheet exists in your theme
749	* and if so loads it.
750	*
751	* Works with child themes.
752	*
753	* Possible to specify a different file in the theme folder via the
754	* 'password_protected_stylesheet_file' filter (allows for theme subfolders).
755	*/
756	public function load_theme_stylesheet() {
757
758	$filename = apply_filters( 'password_protected_stylesheet_file', 'password-protected-login.css' );
759
760	$located = locate_template( $filename );
761
762	if ( ! empty( $located ) ) {
763
764	$stylesheet_directory = trailingslashit( get_stylesheet_directory() );
765	$template_directory = trailingslashit( get_template_directory() );
766
767	if ( $stylesheet_directory == substr( $located, 0, strlen( $stylesheet_directory ) ) ) {
768	wp_enqueue_style( 'password-protected-login', get_stylesheet_directory_uri() . '/' . $filename );
769	} else if ( $template_directory == substr( $located, 0, strlen( $template_directory ) ) ) {
770	wp_enqueue_style( 'password-protected-login', get_template_directory_uri() . '/' . $filename );
771	}
772
773	}
774
775	}
776
777	/**
778	* Safe Redirect
779	*
780	* Ensure the redirect is to the same site or pluggable list of allowed domains.
781	* If invalid will redirect to ...
782	* Based on the WordPress wp_safe_redirect() function.
783	*/
784	public function safe_redirect( $location, $status = 302 ) {
785
786	$location = wp_sanitize_redirect( $location );
787	$location = wp_validate_redirect( $location, home_url() );
788
789	wp_redirect( $location, $status );
790
791	}
792
793	/**
794	* Is Plugin Supported?
795	*
796	* Check to see if there are any known reasons why this plugin may not work in
797	* the user's hosting environment.
798	*
799	* @return boolean
800	*/
801	static function is_plugin_supported() {
802
803	return true;
804
805	}
806
807	/**
808	* Check whether a given request has permissions
809	*
810	* Always allow logged in users who require REST API for Gutenberg
811	* and other admin/plugin compatibility.
812	*
813	* @param WP_REST_Request $access Full details about the request.
814	* @return WP_Error\|boolean
815	*/
816	public function only_allow_logged_in_rest_access( $access ) {
817
818	// If user is not logged in
819	if ( $this->is_active() && ! $this->is_user_logged_in() && ! is_user_logged_in() && ! (bool) get_option( 'password_protected_rest' ) ) {
820	return new WP_Error( 'rest_cannot_access', __( 'Only authenticated users can access the REST API.', 'password-protected' ), array( 'status' => rest_authorization_required_code() ) );
821	}
822
823	return $access;
824
825	}
826
827	}
828