password-protected / password-protected.php

password-protected.php in Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content 2.7.6, at password-protected.php

1,001 lines 27.2 KB

Raw Download Zip

1	<?php
2	/*
3	Plugin Name: Password Protected
4	Plugin URI: https://wordpress.org/plugins/password-protected/
5	Description: A very simple way to quickly password protect your WordPress site with a single password. Please note: This plugin does not restrict access to uploaded files and images and does not work with some caching setups.
6	Version: 2.7.6
7	Author: Password Protected
8	Text Domain: password-protected
9	Author URI: https://passwordprotectedwp.com/
10	License: GPLv2
11	*/
12	/*
13	This program is free software; you can redistribute it and/or modify
14	it under the terms of the GNU General Public License, version 2, as
15	published by the Free Software Foundation.
16
17	This program is distributed in the hope that it will be useful,
18	but WITHOUT ANY WARRANTY; without even the implied warranty of
19	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20	GNU General Public License for more details.
21
22	You should have received a copy of the GNU General Public License
23	along with this program; if not, write to the Free Software
24	Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
25	*/
26
27	/**
28	* @todo Use wp_hash_password() ?
29	* @todo Remember me
30	*/
31
32
33	define( 'PASSWORD_PROTECTED_SUBDIR', '/' . str_replace( basename( __FILE__ ), '', plugin_basename( __FILE__ ) ) );
34	define( 'PASSWORD_PROTECTED_URL', plugins_url( PASSWORD_PROTECTED_SUBDIR ) );
35	define( 'PASSWORD_PROTECTED_DIR', plugin_dir_path( __FILE__ ) );
36
37	require_once PASSWORD_PROTECTED_DIR . 'includes/freemius.php';
38
39	global $Password_Protected;
40	$Password_Protected = new Password_Protected();
41
42	class Password_Protected {
43
44	var $version = '2.7.6';
45	var $admin = null;
46	var $errors = null;
47	var $admin_caching = null;
48
49	/**
50	* Constructor
51	*/
52	public function __construct() {
53
54	$this->errors = new WP_Error();
55
56	register_activation_hook( __FILE__, array( &$this, 'install' ) );
57
58	add_action( 'plugins_loaded', array( $this, 'load_plugin_textdomain' ) );
59
60	add_filter( 'password_protected_is_active', array( $this, 'allow_ip_addresses' ) );
61	add_filter( 'password_protected_is_active', array( $this, 'elementor_compatibility' ) );
62
63	add_action( 'init', array( $this, 'disable_caching' ), 1 );
64	add_action( 'init', array( $this, 'maybe_process_logout' ), 1 );
65	add_action( 'init', array( $this, 'maybe_process_login' ), 1 );
66	add_action( 'wp', array( $this, 'disable_feeds' ) );
67	add_action( 'template_redirect', array( $this, 'maybe_show_login' ), -10 );
68	add_filter( 'pre_option_password_protected_status', array( $this, 'allow_feeds' ) );
69	add_filter( 'pre_option_password_protected_status', array( $this, 'allow_administrators' ) );
70	add_filter( 'pre_option_password_protected_status', array( $this, 'allow_users' ) );
71	add_filter( 'rest_authentication_errors', array( $this, 'only_allow_logged_in_rest_access' ) );
72	add_action( 'init', array( $this, 'compat' ) );
73	add_action( 'password_protected_login_messages', array( $this, 'login_messages' ) );
74	add_action( 'login_enqueue_scripts', array( $this, 'load_theme_stylesheet' ), 5 );
75
76	add_action('password_protected_above_password_field', array( $this, 'password_protected_above_password_field' ));
77	add_action('password_protected_below_password_field', array( $this, 'password_protected_below_password_field' ));
78
79
80	// Available from WordPress 4.3+
81	if ( function_exists( 'wp_site_icon' ) ) {
82	add_action( 'password_protected_login_head', 'wp_site_icon' );
83	}
84
85	add_shortcode( 'password_protected_logout_link', array( $this, 'logout_link_shortcode' ) );
86
87	include_once dirname( __FILE__ ) . '/admin/admin-bar.php';
88	include_once dirname( __FILE__ ) . '/includes/compatibility.php';
89	if ( is_admin() ) {
90
91	include_once dirname( __FILE__ ) . '/admin/admin-caching.php';
92	include_once dirname( __FILE__ ) . '/admin/admin.php';
93
94	$this->admin_caching = new Password_Protected_Admin_Caching( $this );
95	$this->admin = new Password_Protected_Admin();
96
97
98	}
99	include_once dirname( __FILE__ ) . '/admin/class-recaptcha.php';
100	new Password_Protected_reCAPTCHA();
101
102	include_once dirname( __FILE__ ) . '/includes/transient-functions.php';
103	include_once dirname( __FILE__ ) . '/includes/activity-report-email/class-password-protected-activity-report-settings.php';
104	}
105
106	/**
107	* I18n
108	*/
109	public function load_plugin_textdomain() {
110
111	load_plugin_textdomain( 'password-protected', false, basename( dirname( __FILE__ ) ) . '/languages' );
112
113	}
114
115	/**
116	* Disable Page Caching
117	*/
118	public function disable_caching() {
119
120	if ( $this->is_active() && ! defined( 'DONOTCACHEPAGE' ) ) {
121	define( 'DONOTCACHEPAGE', true );
122	}
123
124	}
125
126	/**
127	* Is Active?
128	*
129	* @return boolean Is password protection active?
130	*/
131	public function is_active() {
132
133	global $wp_query;
134
135	// Always allow access to robots.txt
136	if ( isset( $wp_query ) && is_robots() ) {
137	return false;
138	}
139
140	if ( (bool) get_option( 'password_protected_status' ) ) {
141	$is_active = true;
142	} else {
143	$is_active = false;
144	}
145
146	$is_active = apply_filters( 'password_protected_is_active', $is_active );
147
148	if ( isset( $_GET['password-protected'] ) ) {
149	$is_active = true;
150	}
151
152	return $is_active;
153
154	}
155
156	/**
157	* Disable Feeds
158	*
159	* @todo An option/filter to prevent disabling of feeds.
160	*/
161	public function disable_feeds() {
162
163	if ( $this->is_active() ) {
164	add_action( 'do_feed', array( $this, 'disable_feed' ), 1 );
165	add_action( 'do_feed_rdf', array( $this, 'disable_feed' ), 1 );
166	add_action( 'do_feed_rss', array( $this, 'disable_feed' ), 1 );
167	add_action( 'do_feed_rss2', array( $this, 'disable_feed' ), 1 );
168	add_action( 'do_feed_atom', array( $this, 'disable_feed' ), 1 );
169	}
170
171	}
172
173	/**
174	* Disable Feed
175	*
176	* @todo Make Translatable
177	*/
178	public function disable_feed() {
179
180	wp_die( sprintf( __( 'Feeds are not available for this site. Please visit the <a href="%s">website</a>.', 'password-protected' ), get_bloginfo( 'url' ) ) );
181
182	}
183
184	/**
185	* Allow Feeds
186	*
187	* @param boolean $bool Allow feeds.
188	* @return boolean True/false.
189	*/
190	public function allow_feeds( $bool ) {
191
192	if ( is_feed() && (bool) get_option( 'password_protected_feeds' ) ) {
193	return 0;
194	}
195
196	return $bool;
197
198	}
199
200	/**
201	* Allow Administrators
202	*
203	* @param boolean $bool Allow administrators.
204	* @return boolean True/false.
205	*/
206	public function allow_administrators( $bool ) {
207
208	if ( ! is_admin() && current_user_can( 'manage_options' ) && (bool) get_option( 'password_protected_administrators' ) ) {
209	return 0;
210	}
211
212	return $bool;
213
214	}
215
216	/**
217	* Allow Users
218	*
219	* @param boolean $bool Allow administrators.
220	* @return boolean True/false.
221	*/
222	public function allow_users( $bool ) {
223
224	if ( ! is_admin() && is_user_logged_in() && (bool) get_option( 'password_protected_users' ) ) {
225	return 0;
226	}
227
228	return $bool;
229
230	}
231
232	/**
233	* Allow IP Addresses
234	*
235	* If user has a valid email address, return false to disable password protection.
236	*
237	* @param boolean $bool Allow IP addresses.
238	* @return boolean True/false.
239	*/
240	public function allow_ip_addresses( $bool ) {
241
242	$ip_addresses = $this->get_allowed_ip_addresses();
243
244	if ( isset( $_SERVER['REMOTE_ADDR'] ) && in_array( $_SERVER['REMOTE_ADDR'], $ip_addresses ) ) {
245	$bool = false;
246	} else {
247	$bool = apply_filters( 'password_protected__allowed_ip_ranges', $bool, $ip_addresses, isset( $_SERVER['REMOTE_ADDR'] ) ? $_SERVER['REMOTE_ADDR'] : '' );
248	}
249
250	return $bool;
251
252	}
253
254	/**
255	* Is protection active.
256	*
257	* @param bool $is_active is active {true\|false}.
258	*
259	* @return bool
260	*/
261	public function elementor_compatibility( $is_active ) {
262	if ( class_exists( '\\Elementor\\plugin' ) ) {
263	if ( \Elementor\Plugin::$instance->preview->is_preview_mode() ) {
264	$is_active = false;
265	}
266	}
267	return $is_active;
268	}
269
270	/**
271	* Get Allowed IP Addresses
272	*
273	* @return array IP addresses.
274	*/
275	public function get_allowed_ip_addresses() {
276	$allowed_ip_address = get_option( 'password_protected_allowed_ip_addresses' );
277	if ( empty( $allowed_ip_address ) ) {
278	return array();
279	}
280	return explode( "\n", $allowed_ip_address );
281
282	}
283
284	/**
285	* Allow the remember me function
286	*
287	* @return. boolean
288	*/
289	public function allow_remember_me() {
290
291	return (bool) get_option( 'password_protected_remember_me' );
292
293	}
294
295	/**
296	* Encrypt Password
297	*
298	* @param string $password Password.
299	* @return string Encrypted password.
300	*/
301	public function encrypt_password( $password ) {
302
303	return md5( $password );
304
305	}
306
307	/**
308	* Maybe Process Logout
309	*/
310	public function maybe_process_logout() {
311
312	if ( isset( $_REQUEST['password-protected'] ) && sanitize_text_field( $_REQUEST['password-protected'] ) == 'logout' ) {
313
314	$this->logout();
315
316	if ( isset( $_REQUEST['redirect_to'] ) ) {
317	$redirect_to = remove_query_arg( 'password-protected', esc_url_raw( $_REQUEST['redirect_to'], array( 'http', 'https' ) ) );
318	} else {
319	$redirect_to = home_url( '/' );
320	}
321
322	$this->safe_redirect( $redirect_to );
323	exit();
324
325	}
326
327	}
328
329	/**
330	* Maybe Process Login
331	*/
332	public function maybe_process_login() {
333
334	if ( $this->is_active() && isset( $_REQUEST['password_protected_pwd'] ) ) {
335
336	$password_protected_pwd = sanitize_text_field( $_REQUEST['password_protected_pwd'] );
337	$default_password = get_option( 'password_protected_password' );
338
339	$auth = false;
340	$p_id = 0;
341
342	if ( empty( $default_password ) ) {
343
344	$authentication = $this->password_protected_check_pro_password( $password_protected_pwd );
345	$auth = $authentication['auth'];
346	$p_id = $authentication['p_id'];
347
348	} else {
349
350	if ( ( hash_equals( $default_password, $this->encrypt_password( $password_protected_pwd ) ) && $default_password != '' ) \|\| apply_filters( 'password_protected_process_login', false, $password_protected_pwd ) ) {
351	$auth = true;
352	}
353
354	if ( ! $auth ) {
355
356	$authentication = $this->password_protected_check_pro_password( $password_protected_pwd );
357	$auth = $authentication['auth'];
358	$p_id = $authentication['p_id'];
359	}
360
361	}
362
363	$this->errors = apply_filters( 'password_protected_verify_recaptcha', $this->errors );
364
365	if( count( @$this->errors->errors ) > 0 ) return;
366
367	$this->password_protected_process_login( $auth, $password_protected_pwd, $p_id );
368
369	}
370
371	}
372
373	public function password_protected_process_login( bool $auth, $requested_password, $password_id ) {
374
375	if( $auth )
376	$throttle = apply_filters( 'password_protected_check_for_throttling', true );
377
378
379	if( $auth && $throttle ) {
380
381	do_action( 'password_protected_success_login_attempt', 'global', $requested_password, $password_id );
382	$remember = isset( $_REQUEST['password_protected_rememberme'] ) ? boolval( $_REQUEST['password_protected_rememberme'] ) : false;
383
384	if ( ! $this->allow_remember_me() ) {
385	$remember = false;
386	}
387	$this->set_auth_cookie( $remember );
388
389	$redirect_to = isset( $_REQUEST['redirect_to'] ) ? sanitize_text_field( $_REQUEST['redirect_to'] ) : '';
390
391	$redirect_to = apply_filters( 'password_protected_login_redirect', $redirect_to, $requested_password );
392
393	if ( ! empty( $redirect_to ) ) {
394	$this->safe_redirect( remove_query_arg( 'password-protected', $redirect_to ) );
395	exit;
396	} elseif ( isset( $_GET['password_protected_pwd'] ) ) {
397	$this->safe_redirect( remove_query_arg( 'password-protected' ) );
398	exit;
399	} else {
400	$this->safe_redirect( site_url() );
401	exit;
402	}
403	} else {
404	do_action( 'password_protected_failure_login_attempt', 'global', $requested_password, $password_id );
405
406	// ... otherwise incorrect password
407	$this->clear_auth_cookie();
408
409	$show_default_error = apply_filters( 'password_protected_throttling_error_messages', true );
410
411	if( $show_default_error )
412	$this->errors->add( 'incorrect_password', __( 'Incorrect Password', 'password-protected' ) );
413	}
414	}
415
416	/**
417	* password_protected_check_pro_password
418	*
419	* @param mixed $requested_password
420	* @return void
421	*/
422	public function password_protected_check_pro_password( $requested_password ) {
423
424	$pro_passwords = apply_filters( 'password_protected_passwords', array() );
425	$pro_passwords = array_filter( $pro_passwords );
426	$auth = false;
427	$p_id = 0;
428
429	if( is_array( $pro_passwords ) && count( $pro_passwords ) > 0 ) {
430
431	foreach( $pro_passwords as $i => $p ) {
432
433	if ( ( hash_equals( $p, $this->encrypt_password( $requested_password ) ) && $pro_passwords != '' ) \|\| apply_filters( 'password_protected_process_login', false, $requested_password ) ) {
434
435	$auth = apply_filters( 'password_protected_login_password_matched', $p, $this->errors );
436	$p_id = $i;
437	break;
438
439	}
440
441	}
442
443	} else {
444
445	$auth = false;
446
447	}
448
449	return array(
450	'auth' => $auth,
451	'p_id' => $p_id,
452	);
453	}
454
455	/**
456	* Is User Logged In?
457	*
458	* @return boolean
459	*/
460	public function is_user_logged_in() {
461
462	return $this->is_active() && $this->validate_auth_cookie();
463
464	}
465
466	/**
467	* Maybe Show Login
468	*/
469	public function maybe_show_login() {
470
471	if ( class_exists( 'Login_designer' ) ) {
472	if ( is_customize_preview() ) {
473	return 1;
474	}
475	}
476
477	// Filter for adding exceptions.
478	$show_login = apply_filters( 'password_protected_show_login', $this->is_active() );
479
480	// Logged in
481	if ( $this->is_user_logged_in() ) {
482	$show_login = false;
483	}
484
485	if ( ! $show_login ) {
486	return 1;
487	}
488
489	// Show login form
490	if ( isset( $_REQUEST['password-protected'] ) && 'login' == sanitize_text_field( $_REQUEST['password-protected'] ) ) {
491
492	$default_theme_file = locate_template( array( 'password-protected-login.php' ) );
493
494	if ( empty( $default_theme_file ) ) {
495	$default_theme_file = dirname( __FILE__ ) . '/theme/password-protected-login.php';
496	}
497
498	$theme_file = apply_filters( 'password_protected_theme_file', $default_theme_file );
499	if ( ! file_exists( $theme_file ) ) {
500	$theme_file = $default_theme_file;
501	}
502
503	load_template( $theme_file );
504	exit();
505
506	} else {
507	global $wp;
508
509	$redirect_to = add_query_arg( 'password-protected', 'login', home_url( $wp->request . '?' . $_SERVER['QUERY_STRING'] ) );
510
511	// URL to redirect back to after login
512	$redirect_to_url = apply_filters( 'password_protected_login_redirect_url', ( is_ssl() ? 'https://' : 'http://' ) . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'] );
513	if ( ! empty( $redirect_to_url ) ) {
514	$redirect_to = add_query_arg( 'redirect_to', urlencode( $redirect_to_url ), $redirect_to );
515	}
516
517	nocache_headers();
518	wp_redirect( $redirect_to );
519	exit();
520
521	}
522	}
523
524	/**
525	* Get Site ID
526	*
527	* @return string Site ID.
528	*/
529	public function get_site_id() {
530
531	global $blog_id;
532	return 'bid_' . apply_filters( 'password_protected_blog_id', $blog_id );
533
534	}
535
536	/**
537	* Login URL
538	*
539	* @return string Login URL.
540	*/
541	public function login_url() {
542	global $wp;
543	return add_query_arg( 'password-protected', 'login', home_url( $wp->request . '?' . $_SERVER['QUERY_STRING'] ) );
544
545	}
546
547	/**
548	* Logout
549	*/
550	public function logout() {
551
552	$this->clear_auth_cookie();
553	do_action( 'password_protected_logout' );
554
555	}
556
557	/**
558	* Logout URL
559	*
560	* @param string $redirect_to Optional. Redirect URL.
561	* @return string Logout URL.
562	*/
563	public function logout_url( $redirect_to = '' ) {
564
565	$query = array(
566	'password-protected' => 'logout',
567	'redirect_to' => esc_url_raw( $redirect_to ),
568	);
569
570	if ( empty( $query['redirect_to'] ) ) {
571	unset( $query['redirect_to'] );
572	}
573
574	return add_query_arg( $query, home_url() );
575
576	}
577
578	/**
579	* Logout Link
580	*
581	* @param array $args Link args.
582	* @return string HTML link tag.
583	*/
584	public function logout_link( $args = null ) {
585
586	// Only show if user is logged in
587	if ( ! $this->is_user_logged_in() ) {
588	return '';
589	}
590
591	$args = wp_parse_args(
592	$args,
593	array(
594	'redirect_to' => '',
595	'text' => __( 'Logout', 'password-protected' ),
596	)
597	);
598
599	if ( empty( $args['text'] ) ) {
600	$args['text'] = __( 'Logout', 'password-protected' );
601	}
602
603	return sprintf( '<a href="%s">%s</a>', esc_url( $this->logout_url( $args['redirect_to'] ) ), esc_html( $args['text'] ) );
604
605	}
606
607	/**
608	* Logout Link Shortcode
609	*
610	* @param array $args Link args.
611	* @return string HTML link tag.
612	*/
613	public function logout_link_shortcode( $atts, $content = null ) {
614
615	$atts = shortcode_atts(
616	array(
617	'redirect_to' => '',
618	'text' => $content,
619	),
620	$atts,
621	'logout_link_shortcode'
622	);
623
624	return $this->logout_link( $atts );
625
626	}
627
628	/**
629	* Get Hashed Password
630	*
631	* @return string Hashed password.
632	*/
633	public function get_hashed_password() {
634
635	return md5( get_option( 'password_protected_password' ) . wp_salt() );
636
637	}
638
639	/**
640	* Validate Auth Cookie
641	*
642	* @param string $cookie Cookie string.
643	* @param string $scheme Cookie scheme.
644	* @return boolean Validation successful?
645	*/
646	public function validate_auth_cookie( $cookie = '', $scheme = '', $hashed_password = '' ) {
647
648	if ( ! $cookie_elements = $this->parse_auth_cookie( $cookie, $scheme ) ) {
649	do_action( 'password_protected_auth_cookie_malformed', $cookie, $scheme );
650	return false;
651	}
652
653	extract( $cookie_elements, EXTR_OVERWRITE );
654
655	$expired = $expiration;
656
657	// Allow a grace period for POST and AJAX requests
658	if ( defined( 'DOING_AJAX' ) \|\| 'POST' == $_SERVER['REQUEST_METHOD'] ) {
659	$expired += 3600;
660	}
661
662	// Quick check to see if an honest cookie has expired
663	if ( $expired < current_time( 'timestamp' ) ) {
664	do_action( 'password_protected_auth_cookie_expired', $cookie_elements );
665	return false;
666	}
667
668	if ( empty( $hashed_password ) ) {
669	$hashed_password = $this->get_hashed_password();
670	}
671	$key = md5( $this->get_site_id() . $hashed_password . '\|' . $expiration ); // need to modify
672	$hash = hash_hmac( 'md5', $this->get_site_id() . '\|' . $expiration, $key );
673
674	if ( $hmac != $hash ) {
675	do_action( 'password_protected_auth_cookie_bad_hash', $cookie_elements );
676	return false;
677	}
678
679	if ( $expiration < current_time( 'timestamp' ) ) { // AJAX/POST grace period set above
680	$GLOBALS['login_grace_period'] = 1;
681	}
682
683	return true;
684
685	}
686
687	/**
688	* Generate Auth Cookie
689	*
690	* @param int $expiration Expiration time in seconds.
691	* @param string $scheme Cookie scheme.
692	* @return string Cookie.
693	*/
694	public function generate_auth_cookie( $expiration, $scheme = 'auth', $hashed_password = '' ) {
695
696	if ( empty( $hashed_password ) ) {
697	$hashed_password = $this->get_hashed_password();
698	}
699	$key = md5( $this->get_site_id() . $hashed_password . '\|' . $expiration ); // need to modify
700	$hash = hash_hmac( 'md5', $this->get_site_id() . '\|' . $expiration, $key );
701	$cookie = $this->get_site_id() . '\|' . $expiration . '\|' . $hash;
702
703	return $cookie;
704
705	}
706
707	/**
708	* Parse Auth Cookie
709	*
710	* @param string $cookie Cookie string.
711	* @param string $scheme Cookie scheme.
712	* @return string Cookie string.
713	*/
714	public function parse_auth_cookie( $cookie = '', $scheme = '' ) {
715	if ( empty( $cookie ) ) {
716
717	$cookie_name = $this->cookie_name();
718	$use_transient = get_option( 'password_protected_use_transient', 'default' );
719
720	$cookie = password_protected_cookie( 'get', array( 'name' => $cookie_name ) );
721
722	if ( empty( $cookie ) ) {
723	return false;
724	}
725	}
726
727	$cookie_elements = explode( '\|', $cookie );
728
729	if ( count( $cookie_elements ) != 3 ) {
730	return false;
731	}
732
733	list( $site_id, $expiration, $hmac ) = $cookie_elements;
734
735	return compact( 'site_id', 'expiration', 'hmac', 'scheme' );
736
737	}
738
739	/**
740	* Set Auth Cookie
741	*
742	* @todo
743	*
744	* @param boolean $remember Remember logged in.
745	* @param string $secure Secure cookie.
746	*/
747	public function set_auth_cookie( $remember = false, $secure = '' ) {
748
749	if ( $remember ) {
750	$expiration_time = apply_filters( 'password_protected_auth_cookie_expiration', get_option( 'password_protected_remember_me_lifetime', 14 ) * DAY_IN_SECONDS, $remember );
751	$expiration = $expire = current_time( 'timestamp' ) + $expiration_time;
752	} else {
753	$expiration_time = apply_filters( 'password_protected_auth_cookie_expiration', DAY_IN_SECONDS * 20, $remember );
754	$expiration = current_time( 'timestamp' ) + $expiration_time;
755	$expire = 0;
756	}
757
758	if ( '' === $secure ) {
759	$secure = is_ssl();
760	}
761
762	$secure_password_protected_cookie = apply_filters( 'password_protected_secure_password_protected_cookie', false, $secure );
763	$password_protected_cookie = $this->generate_auth_cookie( $expiration, 'password_protected' );
764
765	$use_transient = get_option( 'password_protected_use_transient', 'default' );
766
767
768	password_protected_cookie(
769	'set',
770	array(
771	'name' => $this->cookie_name(),
772	'data' => $password_protected_cookie,
773	'secure' => $secure_password_protected_cookie,
774	'expire' => $expire,
775	)
776	);
777
778	}
779
780	/**
781	* Clear Auth Cookie
782	*/
783	public function clear_auth_cookie() {
784	$use_transient = get_option( 'password_protected_use_transient', 'default' );
785	password_protected_cookie( 'delete', array( 'name' => $this->cookie_name() ) );
786	}
787
788	/**
789	* Cookie Name
790	*
791	* @return string Cookie name.
792	*/
793	public function cookie_name() {
794
795	/**
796	* Filters the cookie name
797	*/
798	return apply_filters( 'password_protected_cookie_name', $this->get_site_id() . '_password_protected_auth', $this );
799
800	}
801
802	/**
803	* Install
804	*/
805	public function install() {
806
807	$old_version = get_option( 'password_protected_version' );
808
809	// 1.1 - Upgrade to MD5
810	if ( empty( $old_version ) \|\| $old_version == '1.1' ) {
811	$pwd = get_option( 'password_protected_password' );
812	if ( ! empty( $pwd ) ) {
813	$new_pwd = $this->encrypt_password( $pwd );
814	update_option( 'password_protected_password', $new_pwd );
815	}
816	}
817
818	update_option( 'password_protected_version', $this->version );
819
820	}
821
822	/**
823	* Compat
824	*
825	* Support for 3rd party plugins:
826	*
827	* - Login Logo https://wordpress.org/plugins/login-logo/
828	* - Uber Login Logo https://wordpress.org/plugins/uber-login-logo/
829	*/
830	public function compat() {
831
832	if ( class_exists( 'CWS_Login_Logo_Plugin' ) ) {
833
834	// Add support for Mark Jaquith's Login Logo plugin
835	add_action( 'password_protected_login_head', array( new CWS_Login_Logo_Plugin(), 'login_head' ) );
836
837	} elseif ( class_exists( 'UberLoginLogo' ) ) {
838
839	// Add support for Uber Login Logo plugin
840	add_action( 'password_protected_login_head', array( 'UberLoginLogo', 'replaceLoginLogo' ) );
841
842	}
843
844	}
845
846	/**
847	* Login Messages
848	* Outputs messages and errors in the login template.
849	*/
850	public function login_messages() {
851
852	// Add message
853	$message = apply_filters( 'password_protected_login_message', '' );
854	if ( ! empty( $message ) ) {
855	echo $message . "\n";
856	}
857
858	if ( $this->errors->get_error_code() ) {
859
860	$errors = '';
861	$messages = '';
862
863	foreach ( $this->errors->get_error_codes() as $code ) {
864	$severity = $this->errors->get_error_data( $code );
865	foreach ( $this->errors->get_error_messages( $code ) as $error ) {
866	if ( 'message' == $severity ) {
867	$messages .= $error . '<br />';
868	} else {
869	$errors .= $error . '<br />';
870	}
871	}
872	}
873
874	if ( ! empty( $errors ) ) {
875	echo '<div id="login_error" class="notice notice-error">' . apply_filters( 'password_protected_login_errors', $errors ) . "</div>\n";
876	}
877	if ( ! empty( $messages ) ) {
878	echo '<p class="message">' . apply_filters( 'password_protected_login_messages', $messages ) . "</p>\n";
879	}
880	}
881
882	}
883
884	/**
885	* Load Theme Stylesheet
886	*
887	* Check wether a 'password-protected-login.css' stylesheet exists in your theme
888	* and if so loads it.
889	*
890	* Works with child themes.
891	*
892	* Possible to specify a different file in the theme folder via the
893	* 'password_protected_stylesheet_file' filter (allows for theme subfolders).
894	*/
895	public function load_theme_stylesheet() {
896
897	$filename = apply_filters( 'password_protected_stylesheet_file', 'password-protected-login.css' );
898
899	$located = locate_template( $filename );
900
901	if ( ! empty( $located ) ) {
902
903	$stylesheet_directory = trailingslashit( get_stylesheet_directory() );
904	$template_directory = trailingslashit( get_template_directory() );
905
906	if ( $stylesheet_directory == substr( $located, 0, strlen( $stylesheet_directory ) ) ) {
907	wp_enqueue_style( 'password-protected-login', get_stylesheet_directory_uri() . '/' . $filename );
908	} elseif ( $template_directory == substr( $located, 0, strlen( $template_directory ) ) ) {
909	wp_enqueue_style( 'password-protected-login', get_template_directory_uri() . '/' . $filename );
910	}
911	}
912
913	}
914
915	/**
916	* Safe Redirect
917	*
918	* Ensure the redirect is to the same site or pluggable list of allowed domains.
919	* If invalid will redirect to ...
920	* Based on the WordPress wp_safe_redirect() function.
921	*/
922	public function safe_redirect( $location, $status = 302 ) {
923
924	$location = wp_sanitize_redirect( $location );
925	$location = wp_validate_redirect( $location, home_url() );
926
927	wp_redirect( $location, $status );
928
929	}
930
931	/**
932	* Is Plugin Supported?
933	*
934	* Check to see if there are any known reasons why this plugin may not work in
935	* the user's hosting environment.
936	*
937	* @return boolean
938	*/
939	static function is_plugin_supported() {
940
941	return true;
942
943	}
944
945	/**
946	* Check whether a given request has permissions
947	*
948	* Always allow logged in users who require REST API for Gutenberg
949	* and other admin/plugin compatibility.
950	*
951	* @param WP_REST_Request $access Full details about the request.
952	* @return WP_Error\|boolean
953	*/
954	public function only_allow_logged_in_rest_access( $access ) {
955	if ( $this->is_active() ) {
956	if ( is_user_logged_in() ) {
957	global $current_user;
958	if ( $current_user->has_cap( 'edit_posts' ) \|\| $current_user->has_cap( 'edit_pages' ) ) {
959	return $access;
960	}
961	}
962
963	if ( $this->is_user_logged_in() ) {
964	return $access;
965	}
966
967	if ( get_option( 'password_protected_rest' ) ) {
968	return $access;
969	}
970	return new WP_Error( 'rest_cannot_access', __( 'Only authenticated users can access the REST API.', 'password-protected' ), array( 'status' => rest_authorization_required_code() ) );
971	}
972
973	return $access;
974	}
975
976	/**
977	* Print text above password field
978	* @return void.
979	*/
980	public function password_protected_above_password_field() {
981	$text = get_option('password_protected_text_above_password');
982	if( ! empty( $text ) ) {
983	echo '<div class="password-protected-text-above" style="width:100%;">' . wp_kses_post( $text ) . '</div>';
984	}
985	}
986
987	/**
988	* Print text below password field
989	* @return void.
990	*/
991	public function password_protected_below_password_field() {
992	$text = get_option('password_protected_text_below_password');
993	if( ! empty( $text ) ) {
994	echo '<div class="password-protected-text-below" style="width:100%">' . wp_kses_post( $text ) . '</div>';
995	}
996	}
997
998	}
999
1000
1001