password-protected / password-protected.php

password-protected.php in Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content 2.7.9, at password-protected.php

1,002 lines 26.2 KB

Raw Download Zip

1	<?php
2	/*
3	Plugin Name: Password Protected
4	Plugin URI: https://wordpress.org/plugins/password-protected/
5	Description: A very simple way to quickly password protect your WordPress site with a single password. Please note: This plugin does not restrict access to uploaded files and images and does not work with some caching setups.
6	Version: 2.7.9
7	Author: Password Protected
8	Text Domain: password-protected
9	Author URI: https://passwordprotectedwp.com/
10	License: GPLv2
11	*/
12	/*
13	This program is free software; you can redistribute it and/or modify
14	it under the terms of the GNU General Public License, version 2, as
15	published by the Free Software Foundation.
16
17	This program is distributed in the hope that it will be useful,
18	but WITHOUT ANY WARRANTY; without even the implied warranty of
19	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20	GNU General Public License for more details.
21
22	You should have received a copy of the GNU General Public License
23	along with this program; if not, write to the Free Software
24	Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
25	*/
26
27	/**
28	* @todo Use wp_hash_password() ?
29	* @todo Remember me
30	*/
31
32
33	define( 'PASSWORD_PROTECTED_SUBDIR', '/' . str_replace( basename( __FILE__ ), '', plugin_basename( __FILE__ ) ) );
34	define( 'PASSWORD_PROTECTED_URL', plugins_url( PASSWORD_PROTECTED_SUBDIR ) );
35	define( 'PASSWORD_PROTECTED_DIR', plugin_dir_path( __FILE__ ) );
36
37	require_once PASSWORD_PROTECTED_DIR . 'includes/freemius.php';
38
39	global $Password_Protected;
40	$Password_Protected = new Password_Protected();
41
42	class Password_Protected {
43
44	var $version = '2.7.9';
45	var $admin = null;
46	var $errors = null;
47	var $admin_caching = null;
48
49	/**
50	* Constructor
51	*/
52	public function __construct() {
53
54	$this->errors = new WP_Error();
55
56	register_activation_hook( __FILE__, array( &$this, 'install' ) );
57
58	add_action( 'plugins_loaded', array( $this, 'load_plugin_textdomain' ) );
59
60	add_filter( 'password_protected_is_active', array( $this, 'allow_ip_addresses' ) );
61	add_filter( 'password_protected_is_active', array( $this, 'elementor_compatibility' ) );
62
63	add_action( 'init', array( $this, 'disable_caching' ), 1 );
64	add_action( 'init', array( $this, 'maybe_process_logout' ), 1 );
65	add_action( 'init', array( $this, 'maybe_process_login' ), 1 );
66	add_action( 'wp', array( $this, 'disable_feeds' ) );
67	add_action( 'template_redirect', array( $this, 'maybe_show_login' ), -10 );
68	add_filter( 'pre_option_password_protected_status', array( $this, 'allow_feeds' ) );
69	add_filter( 'pre_option_password_protected_status', array( $this, 'allow_administrators' ) );
70	add_filter( 'pre_option_password_protected_status', array( $this, 'allow_users' ) );
71	add_filter( 'rest_authentication_errors', array( $this, 'only_allow_logged_in_rest_access' ) );
72	add_action( 'init', array( $this, 'compat' ) );
73	add_action( 'password_protected_login_messages', array( $this, 'login_messages' ) );
74	add_action( 'login_enqueue_scripts', array( $this, 'load_theme_stylesheet' ), 5 );
75
76	add_action('password_protected_above_password_field', array( $this, 'password_protected_above_password_field' ));
77	add_action('password_protected_below_password_field', array( $this, 'password_protected_below_password_field' ));
78
79
80	// Available from WordPress 4.3+
81	if ( function_exists( 'wp_site_icon' ) ) {
82	add_action( 'password_protected_login_head', 'wp_site_icon' );
83	}
84
85	add_shortcode( 'password_protected_logout_link', array( $this, 'logout_link_shortcode' ) );
86
87	include_once dirname( __FILE__ ) . '/admin/admin-bar.php';
88	include_once dirname( __FILE__ ) . '/includes/compatibility.php';
89	if ( is_admin() ) {
90
91	include_once dirname( __FILE__ ) . '/admin/admin-caching.php';
92	include_once dirname( __FILE__ ) . '/admin/admin.php';
93
94	$this->admin_caching = new Password_Protected_Admin_Caching( $this );
95	$this->admin = new Password_Protected_Admin();
96
97
98	}
99	include_once dirname( __FILE__ ) . '/admin/class-recaptcha.php';
100	new Password_Protected_reCAPTCHA();
101
102	include_once dirname( __FILE__ ) . '/includes/transient-functions.php';
103	include_once dirname( __FILE__ ) . '/includes/activity-report-email/class-password-protected-activity-report-settings.php';
104	}
105
106	/**
107	* I18n
108	*/
109	public function load_plugin_textdomain() {
110
111	load_plugin_textdomain( 'password-protected', false, basename( dirname( __FILE__ ) ) . '/languages' );
112
113	}
114
115	/**
116	* Disable Page Caching
117	*/
118	public function disable_caching() {
119
120	if ( $this->is_active() && ! defined( 'DONOTCACHEPAGE' ) ) {
121	define( 'DONOTCACHEPAGE', true );
122	}
123
124	}
125
126	/**
127	* Is Active?
128	*
129	* @return boolean Is password protection active?
130	*/
131	public function is_active() {
132
133	global $wp_query;
134
135	// Always allow access to robots.txt
136	if ( isset( $wp_query ) && is_robots() ) {
137	return false;
138	}
139
140	if ( (bool) get_option( 'password_protected_status' ) ) {
141	$is_active = true;
142	} else {
143	$is_active = false;
144	}
145
146	$is_active = apply_filters( 'password_protected_is_active', $is_active );
147
148	if ( isset( $_GET['password-protected'] ) ) {
149	$is_active = true;
150	}
151
152	return $is_active;
153
154	}
155
156	/**
157	* Disable Feeds
158	*
159	* @todo An option/filter to prevent disabling of feeds.
160	*/
161	public function disable_feeds() {
162
163	if ( $this->is_active() ) {
164	add_action( 'do_feed', array( $this, 'disable_feed' ), 1 );
165	add_action( 'do_feed_rdf', array( $this, 'disable_feed' ), 1 );
166	add_action( 'do_feed_rss', array( $this, 'disable_feed' ), 1 );
167	add_action( 'do_feed_rss2', array( $this, 'disable_feed' ), 1 );
168	add_action( 'do_feed_atom', array( $this, 'disable_feed' ), 1 );
169	}
170
171	}
172
173	/**
174	* Disable Feed
175	*
176	* @todo Make Translatable
177	*/
178	public function disable_feed() {
179
180	wp_die( sprintf( __( 'Feeds are not available for this site. Please visit the <a href="%s">website</a>.', 'password-protected' ), get_bloginfo( 'url' ) ) );
181
182	}
183
184	/**
185	* Allow Feeds
186	*
187	* @param boolean $bool Allow feeds.
188	* @return boolean True/false.
189	*/
190	public function allow_feeds( $bool ) {
191
192	if ( is_feed() && (bool) get_option( 'password_protected_feeds' ) ) {
193	return 0;
194	}
195
196	return $bool;
197
198	}
199
200	/**
201	* Allow Administrators
202	*
203	* @param boolean $bool Allow administrators.
204	* @return boolean True/false.
205	*/
206	public function allow_administrators( $bool ) {
207
208	if ( ! is_admin() && current_user_can( 'manage_options' ) && (bool) get_option( 'password_protected_administrators' ) ) {
209	return 0;
210	}
211
212	return $bool;
213
214	}
215
216	/**
217	* Allow Users
218	*
219	* @param boolean $bool Allow administrators.
220	* @return boolean True/false.
221	*/
222	public function allow_users( $bool ) {
223
224	if ( ! is_admin() && is_user_logged_in() && (bool) get_option( 'password_protected_users' ) ) {
225	return 0;
226	}
227
228	return $bool;
229
230	}
231
232	/**
233	* Allow IP Addresses
234	*
235	* If user has a valid email address, return false to disable password protection.
236	*
237	* @param boolean $bool Allow IP addresses.
238	* @return boolean True/false.
239	*/
240	public function allow_ip_addresses( $bool ) {
241
242	$ip_addresses = $this->get_allowed_ip_addresses();
243
244	if ( isset( $_SERVER['REMOTE_ADDR'] ) && in_array( $_SERVER['REMOTE_ADDR'], $ip_addresses ) ) {
245	$bool = false;
246	} else {
247	$bool = apply_filters( 'password_protected__allowed_ip_ranges', $bool, $ip_addresses, isset( $_SERVER['REMOTE_ADDR'] ) ? $_SERVER['REMOTE_ADDR'] : '' );
248	}
249
250	return $bool;
251
252	}
253
254
255	/**
256	* Is protection active.
257	*
258	* @param bool $is_active is active {true\|false}.
259	*
260	* @return bool
261	*/
262	public function elementor_compatibility( $is_active ) {
263	if ( class_exists( '\\Elementor\\plugin' ) ) {
264	if ( \Elementor\Plugin::$instance->preview->is_preview_mode() ) {
265	$is_active = false;
266	}
267	}
268	return $is_active;
269	}
270
271	/**
272	* Get Allowed IP Addresses
273	*
274	* @return array IP addresses.
275	*/
276	public function get_allowed_ip_addresses() {
277	$allowed_ip_address = get_option( 'password_protected_allowed_ip_addresses' );
278	if ( empty( $allowed_ip_address ) ) {
279	return array();
280	}
281	return explode( "\n", $allowed_ip_address );
282
283	}
284
285	/**
286	* Allow the remember me function
287	*
288	* @return. boolean
289	*/
290	public function allow_remember_me() {
291
292	return (bool) get_option( 'password_protected_remember_me' );
293
294	}
295
296	/**
297	* Encrypt Password
298	*
299	* @param string $password Password.
300	* @return string Encrypted password.
301	*/
302	public function encrypt_password( $password ) {
303
304	return md5( $password );
305
306	}
307
308	/**
309	* Maybe Process Logout
310	*/
311	public function maybe_process_logout() {
312
313	if ( isset( $_REQUEST['password-protected'] ) && sanitize_text_field( $_REQUEST['password-protected'] ) == 'logout' ) {
314
315	$this->logout();
316
317	if ( isset( $_REQUEST['redirect_to'] ) ) {
318	$redirect_to = remove_query_arg( 'password-protected', esc_url_raw( $_REQUEST['redirect_to'], array( 'http', 'https' ) ) );
319	} else {
320	$redirect_to = home_url( '/' );
321	}
322
323	$this->safe_redirect( $redirect_to );
324	exit();
325
326	}
327
328	}
329
330	/**
331	* Maybe Process Login
332	*/
333	public function maybe_process_login() {
334
335	if ( $this->is_active() && isset( $_REQUEST['password_protected_pwd'] ) ) {
336
337	$password_protected_pwd = sanitize_text_field( $_REQUEST['password_protected_pwd'] );
338	$default_password = get_option( 'password_protected_password' );
339
340	$auth = false;
341	$p_id = 0;
342
343	if ( empty( $default_password ) ) {
344
345	$authentication = $this->password_protected_check_pro_password( $password_protected_pwd );
346	$auth = $authentication['auth'];
347	$p_id = $authentication['p_id'];
348
349	} else {
350
351	if ( ( hash_equals( $default_password, $this->encrypt_password( $password_protected_pwd ) ) && $default_password != '' ) \|\| apply_filters( 'password_protected_process_login', false, $password_protected_pwd ) ) {
352	$auth = true;
353	}
354
355	if ( ! $auth ) {
356
357	$authentication = $this->password_protected_check_pro_password( $password_protected_pwd );
358	$auth = $authentication['auth'];
359	$p_id = $authentication['p_id'];
360	}
361
362	}
363
364	$this->errors = apply_filters( 'password_protected_verify_recaptcha', $this->errors );
365
366	if( count( @$this->errors->errors ) > 0 ) return;
367
368	$this->password_protected_process_login( $auth, $password_protected_pwd, $p_id );
369
370	}
371
372	}
373
374	public function password_protected_process_login( bool $auth, $requested_password, $password_id ) {
375
376	if( $auth )
377	$throttle = apply_filters( 'password_protected_check_for_throttling', true );
378
379
380	if( $auth && $throttle ) {
381
382	do_action( 'password_protected_success_login_attempt', 'global', $requested_password, $password_id );
383	$remember = isset( $_REQUEST['password_protected_rememberme'] ) ? boolval( $_REQUEST['password_protected_rememberme'] ) : false;
384
385	if ( ! $this->allow_remember_me() ) {
386	$remember = false;
387	}
388	$this->set_auth_cookie( $remember );
389
390	$redirect_to = isset( $_REQUEST['redirect_to'] ) ? sanitize_text_field( $_REQUEST['redirect_to'] ) : '';
391
392	$redirect_to = apply_filters( 'password_protected_login_redirect', $redirect_to, $requested_password );
393
394	if ( ! empty( $redirect_to ) ) {
395	$this->safe_redirect( remove_query_arg( 'password-protected', $redirect_to ) );
396	exit;
397	} elseif ( isset( $_GET['password_protected_pwd'] ) ) {
398	$this->safe_redirect( remove_query_arg( 'password-protected' ) );
399	exit;
400	} else {
401	$this->safe_redirect( site_url() );
402	exit;
403	}
404	} else {
405	do_action( 'password_protected_failure_login_attempt', 'global', $requested_password, $password_id );
406
407	// ... otherwise incorrect password
408	$this->clear_auth_cookie();
409
410	$show_default_error = apply_filters( 'password_protected_throttling_error_messages', true );
411
412	if( $show_default_error )
413	$this->errors->add( 'incorrect_password', __( 'Incorrect Password', 'password-protected' ) );
414	}
415	}
416
417	/**
418	* password_protected_check_pro_password
419	*
420	* @param mixed $requested_password
421	* @return void
422	*/
423	public function password_protected_check_pro_password( $requested_password ) {
424
425	$pro_passwords = apply_filters( 'password_protected_passwords', array() );
426	$pro_passwords = array_filter( $pro_passwords );
427	$auth = false;
428	$p_id = 0;
429
430	if( is_array( $pro_passwords ) && count( $pro_passwords ) > 0 ) {
431
432	foreach( $pro_passwords as $i => $p ) {
433
434	if ( ( hash_equals( $p, $this->encrypt_password( $requested_password ) ) && $pro_passwords != '' ) \|\| apply_filters( 'password_protected_process_login', false, $requested_password ) ) {
435
436	$auth = apply_filters( 'password_protected_login_password_matched', $p, $this->errors );
437	$p_id = $i;
438	break;
439
440	}
441
442	}
443
444	} else {
445
446	$auth = false;
447
448	}
449
450	return array(
451	'auth' => $auth,
452	'p_id' => $p_id,
453	);
454	}
455
456	/**
457	* Is User Logged In?
458	*
459	* @return boolean
460	*/
461	public function is_user_logged_in() {
462
463	return $this->is_active() && $this->validate_auth_cookie();
464
465	}
466
467	/**
468	* Maybe Show Login
469	*/
470	public function maybe_show_login() {
471
472	if ( class_exists( 'Login_designer' ) ) {
473	if ( is_customize_preview() ) {
474	return 1;
475	}
476	}
477
478	// Filter for adding exceptions.
479	$show_login = apply_filters( 'password_protected_show_login', $this->is_active() );
480
481	// Logged in
482	if ( $this->is_user_logged_in() ) {
483	$show_login = false;
484	}
485
486	if ( ! $show_login ) {
487	return 1;
488	}
489
490	// Show login form
491	if ( isset( $_REQUEST['password-protected'] ) && 'login' == sanitize_text_field( $_REQUEST['password-protected'] ) ) {
492
493	$default_theme_file = locate_template( array( 'password-protected-login.php' ) );
494
495	if ( empty( $default_theme_file ) ) {
496	$default_theme_file = dirname( __FILE__ ) . '/theme/password-protected-login.php';
497	}
498
499	$theme_file = apply_filters( 'password_protected_theme_file', $default_theme_file );
500	if ( ! file_exists( $theme_file ) ) {
501	$theme_file = $default_theme_file;
502	}
503
504	load_template( $theme_file );
505	exit();
506
507	} else {
508	global $wp;
509
510	$redirect_to = add_query_arg( 'password-protected', 'login', home_url( $wp->request . '?' . $_SERVER['QUERY_STRING'] ) );
511
512	// URL to redirect back to after login
513	$redirect_to_url = apply_filters( 'password_protected_login_redirect_url', ( is_ssl() ? 'https://' : 'http://' ) . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'] );
514	if ( ! empty( $redirect_to_url ) ) {
515	$redirect_to = add_query_arg( 'redirect_to', urlencode( $redirect_to_url ), $redirect_to );
516	}
517
518	nocache_headers();
519	wp_redirect( $redirect_to );
520	exit();
521
522	}
523	}
524
525	/**
526	* Get Site ID
527	*
528	* @return string Site ID.
529	*/
530	public function get_site_id() {
531
532	global $blog_id;
533	return 'bid_' . apply_filters( 'password_protected_blog_id', $blog_id );
534
535	}
536
537	/**
538	* Login URL
539	*
540	* @return string Login URL.
541	*/
542	public function login_url() {
543	global $wp;
544	return add_query_arg( 'password-protected', 'login', home_url( $wp->request . '?' . $_SERVER['QUERY_STRING'] ) );
545
546	}
547
548	/**
549	* Logout
550	*/
551	public function logout() {
552
553	$this->clear_auth_cookie();
554	do_action( 'password_protected_logout' );
555
556	}
557
558	/**
559	* Logout URL
560	*
561	* @param string $redirect_to Optional. Redirect URL.
562	* @return string Logout URL.
563	*/
564	public function logout_url( $redirect_to = '' ) {
565
566	$query = array(
567	'password-protected' => 'logout',
568	'redirect_to' => esc_url_raw( $redirect_to ),
569	);
570
571	if ( empty( $query['redirect_to'] ) ) {
572	unset( $query['redirect_to'] );
573	}
574
575	return add_query_arg( $query, home_url() );
576
577	}
578
579	/**
580	* Logout Link
581	*
582	* @param array $args Link args.
583	* @return string HTML link tag.
584	*/
585	public function logout_link( $args = null ) {
586
587	// Only show if user is logged in
588	if ( ! $this->is_user_logged_in() ) {
589	return '';
590	}
591
592	$args = wp_parse_args(
593	$args,
594	array(
595	'redirect_to' => '',
596	'text' => __( 'Logout', 'password-protected' ),
597	)
598	);
599
600	if ( empty( $args['text'] ) ) {
601	$args['text'] = __( 'Logout', 'password-protected' );
602	}
603
604	return sprintf( '<a href="%s">%s</a>', esc_url( $this->logout_url( $args['redirect_to'] ) ), esc_html( $args['text'] ) );
605
606	}
607
608	/**
609	* Logout Link Shortcode
610	*
611	* @param array $args Link args.
612	* @return string HTML link tag.
613	*/
614	public function logout_link_shortcode( $atts, $content = null ) {
615
616	$atts = shortcode_atts(
617	array(
618	'redirect_to' => '',
619	'text' => $content,
620	),
621	$atts,
622	'logout_link_shortcode'
623	);
624
625	return $this->logout_link( $atts );
626
627	}
628
629	/**
630	* Get Hashed Password
631	*
632	* @return string Hashed password.
633	*/
634	public function get_hashed_password() {
635
636	return md5( get_option( 'password_protected_password' ) . wp_salt() );
637
638	}
639
640	/**
641	* Validate Auth Cookie
642	*
643	* @param string $cookie Cookie string.
644	* @param string $scheme Cookie scheme.
645	* @return boolean Validation successful?
646	*/
647	public function validate_auth_cookie( $cookie = '', $scheme = '', $hashed_password = '' ) {
648
649	if ( ! $cookie_elements = $this->parse_auth_cookie( $cookie, $scheme ) ) {
650	do_action( 'password_protected_auth_cookie_malformed', $cookie, $scheme );
651	return false;
652	}
653
654	extract( $cookie_elements, EXTR_OVERWRITE );
655
656	$expired = $expiration;
657
658	// Allow a grace period for POST and AJAX requests
659	if ( defined( 'DOING_AJAX' ) \|\| 'POST' == $_SERVER['REQUEST_METHOD'] ) {
660	$expired += 3600;
661	}
662
663	// Quick check to see if an honest cookie has expired
664	if ( $expired < current_time( 'timestamp' ) ) {
665	do_action( 'password_protected_auth_cookie_expired', $cookie_elements );
666	return false;
667	}
668
669	if ( empty( $hashed_password ) ) {
670	$hashed_password = $this->get_hashed_password();
671	}
672	$key = md5( $this->get_site_id() . $hashed_password . '\|' . $expiration ); // need to modify
673	$hash = hash_hmac( 'md5', $this->get_site_id() . '\|' . $expiration, $key );
674
675	if ( $hmac != $hash ) {
676	do_action( 'password_protected_auth_cookie_bad_hash', $cookie_elements );
677	return false;
678	}
679
680	if ( $expiration < current_time( 'timestamp' ) ) { // AJAX/POST grace period set above
681	$GLOBALS['login_grace_period'] = 1;
682	}
683
684	return true;
685
686	}
687
688	/**
689	* Generate Auth Cookie
690	*
691	* @param int $expiration Expiration time in seconds.
692	* @param string $scheme Cookie scheme.
693	* @return string Cookie.
694	*/
695	public function generate_auth_cookie( $expiration, $scheme = 'auth', $hashed_password = '' ) {
696
697	if ( empty( $hashed_password ) ) {
698	$hashed_password = $this->get_hashed_password();
699	}
700	$key = md5( $this->get_site_id() . $hashed_password . '\|' . $expiration ); // need to modify
701	$hash = hash_hmac( 'md5', $this->get_site_id() . '\|' . $expiration, $key );
702	$cookie = $this->get_site_id() . '\|' . $expiration . '\|' . $hash;
703
704	return $cookie;
705
706	}
707
708	/**
709	* Parse Auth Cookie
710	*
711	* @param string $cookie Cookie string.
712	* @param string $scheme Cookie scheme.
713	* @return string Cookie string.
714	*/
715	public function parse_auth_cookie( $cookie = '', $scheme = '' ) {
716	if ( empty( $cookie ) ) {
717
718	$cookie_name = $this->cookie_name();
719	$use_transient = get_option( 'password_protected_use_transient', 'default' );
720
721	$cookie = password_protected_cookie( 'get', array( 'name' => $cookie_name ) );
722
723	if ( empty( $cookie ) ) {
724	return false;
725	}
726	}
727
728	$cookie_elements = explode( '\|', $cookie );
729
730	if ( count( $cookie_elements ) != 3 ) {
731	return false;
732	}
733
734	list( $site_id, $expiration, $hmac ) = $cookie_elements;
735
736	return compact( 'site_id', 'expiration', 'hmac', 'scheme' );
737
738	}
739
740	/**
741	* Set Auth Cookie
742	*
743	* @todo
744	*
745	* @param boolean $remember Remember logged in.
746	* @param string $secure Secure cookie.
747	*/
748	public function set_auth_cookie( $remember = false, $secure = '' ) {
749
750	if ( $remember ) {
751	$expiration_time = apply_filters( 'password_protected_auth_cookie_expiration', get_option( 'password_protected_remember_me_lifetime', 14 ) * DAY_IN_SECONDS, $remember );
752	$expiration = $expire = current_time( 'timestamp' ) + $expiration_time;
753	} else {
754	$expiration_time = apply_filters( 'password_protected_auth_cookie_expiration', DAY_IN_SECONDS * 20, $remember );
755	$expiration = current_time( 'timestamp' ) + $expiration_time;
756	$expire = 0;
757	}
758
759	if ( '' === $secure ) {
760	$secure = is_ssl();
761	}
762
763	$secure_password_protected_cookie = apply_filters( 'password_protected_secure_password_protected_cookie', false, $secure );
764	$password_protected_cookie = $this->generate_auth_cookie( $expiration, 'password_protected' );
765
766	$use_transient = get_option( 'password_protected_use_transient', 'default' );
767
768
769	password_protected_cookie(
770	'set',
771	array(
772	'name' => $this->cookie_name(),
773	'data' => $password_protected_cookie,
774	'secure' => $secure_password_protected_cookie,
775	'expire' => $expire,
776	)
777	);
778
779	}
780
781	/**
782	* Clear Auth Cookie
783	*/
784	public function clear_auth_cookie() {
785	$use_transient = get_option( 'password_protected_use_transient', 'default' );
786	password_protected_cookie( 'delete', array( 'name' => $this->cookie_name() ) );
787	}
788
789	/**
790	* Cookie Name
791	*
792	* @return string Cookie name.
793	*/
794	public function cookie_name() {
795
796	/**
797	* Filters the cookie name
798	*/
799	return apply_filters( 'password_protected_cookie_name', $this->get_site_id() . '_password_protected_auth', $this );
800
801	}
802
803	/**
804	* Install
805	*/
806	public function install() {
807
808	$old_version = get_option( 'password_protected_version' );
809
810	// 1.1 - Upgrade to MD5
811	if ( empty( $old_version ) \|\| $old_version == '1.1' ) {
812	$pwd = get_option( 'password_protected_password' );
813	if ( ! empty( $pwd ) ) {
814	$new_pwd = $this->encrypt_password( $pwd );
815	update_option( 'password_protected_password', $new_pwd );
816	}
817	}
818
819	update_option( 'password_protected_version', $this->version );
820
821	}
822
823	/**
824	* Compat
825	*
826	* Support for 3rd party plugins:
827	*
828	* - Login Logo https://wordpress.org/plugins/login-logo/
829	* - Uber Login Logo https://wordpress.org/plugins/uber-login-logo/
830	*/
831	public function compat() {
832
833	if ( class_exists( 'CWS_Login_Logo_Plugin' ) ) {
834
835	// Add support for Mark Jaquith's Login Logo plugin
836	add_action( 'password_protected_login_head', array( new CWS_Login_Logo_Plugin(), 'login_head' ) );
837
838	} elseif ( class_exists( 'UberLoginLogo' ) ) {
839
840	// Add support for Uber Login Logo plugin
841	add_action( 'password_protected_login_head', array( 'UberLoginLogo', 'replaceLoginLogo' ) );
842
843	}
844
845	}
846
847	/**
848	* Login Messages
849	* Outputs messages and errors in the login template.
850	*/
851	public function login_messages() {
852
853	// Add message
854	$message = apply_filters( 'password_protected_login_message', '' );
855	if ( ! empty( $message ) ) {
856	echo $message . "\n";
857	}
858
859	if ( $this->errors->get_error_code() ) {
860
861	$errors = '';
862	$messages = '';
863
864	foreach ( $this->errors->get_error_codes() as $code ) {
865	$severity = $this->errors->get_error_data( $code );
866	foreach ( $this->errors->get_error_messages( $code ) as $error ) {
867	if ( 'message' == $severity ) {
868	$messages .= $error . '<br />';
869	} else {
870	$errors .= $error . '<br />';
871	}
872	}
873	}
874
875	if ( ! empty( $errors ) ) {
876	echo '<div id="login_error" class="notice notice-error">' . apply_filters( 'password_protected_login_errors', $errors ) . "</div>\n";
877	}
878	if ( ! empty( $messages ) ) {
879	echo '<p class="message">' . apply_filters( 'password_protected_login_messages', $messages ) . "</p>\n";
880	}
881	}
882
883	}
884
885	/**
886	* Load Theme Stylesheet
887	*
888	* Check wether a 'password-protected-login.css' stylesheet exists in your theme
889	* and if so loads it.
890	*
891	* Works with child themes.
892	*
893	* Possible to specify a different file in the theme folder via the
894	* 'password_protected_stylesheet_file' filter (allows for theme subfolders).
895	*/
896	public function load_theme_stylesheet() {
897
898	$filename = apply_filters( 'password_protected_stylesheet_file', 'password-protected-login.css' );
899
900	$located = locate_template( $filename );
901
902	if ( ! empty( $located ) ) {
903
904	$stylesheet_directory = trailingslashit( get_stylesheet_directory() );
905	$template_directory = trailingslashit( get_template_directory() );
906
907	if ( $stylesheet_directory == substr( $located, 0, strlen( $stylesheet_directory ) ) ) {
908	wp_enqueue_style( 'password-protected-login', get_stylesheet_directory_uri() . '/' . $filename );
909	} elseif ( $template_directory == substr( $located, 0, strlen( $template_directory ) ) ) {
910	wp_enqueue_style( 'password-protected-login', get_template_directory_uri() . '/' . $filename );
911	}
912	}
913
914	}
915
916	/**
917	* Safe Redirect
918	*
919	* Ensure the redirect is to the same site or pluggable list of allowed domains.
920	* If invalid will redirect to ...
921	* Based on the WordPress wp_safe_redirect() function.
922	*/
923	public function safe_redirect( $location, $status = 302 ) {
924
925	$location = wp_sanitize_redirect( $location );
926	$location = wp_validate_redirect( $location, home_url() );
927
928	wp_redirect( $location, $status );
929
930	}
931
932	/**
933	* Is Plugin Supported?
934	*
935	* Check to see if there are any known reasons why this plugin may not work in
936	* the user's hosting environment.
937	*
938	* @return boolean
939	*/
940	static function is_plugin_supported() {
941
942	return true;
943
944	}
945
946	/**
947	* Check whether a given request has permissions
948	*
949	* Always allow logged in users who require REST API for Gutenberg
950	* and other admin/plugin compatibility.
951	*
952	* @param WP_REST_Request $access Full details about the request.
953	* @return WP_Error\|boolean
954	*/
955	public function only_allow_logged_in_rest_access( $access ) {
956	if ( $this->is_active() ) {
957	if ( is_user_logged_in() ) {
958	global $current_user;
959	if ( $current_user->has_cap( 'edit_posts' ) \|\| $current_user->has_cap( 'edit_pages' ) ) {
960	return $access;
961	}
962	}
963
964	if ( $this->is_user_logged_in() ) {
965	return $access;
966	}
967
968	if ( get_option( 'password_protected_rest' ) ) {
969	return $access;
970	}
971	return new WP_Error( 'rest_cannot_access', __( 'Only authenticated users can access the REST API.', 'password-protected' ), array( 'status' => rest_authorization_required_code() ) );
972	}
973
974	return $access;
975	}
976
977	/**
978	* Print text above password field
979	* @return void.
980	*/
981	public function password_protected_above_password_field() {
982	$text = get_option('password_protected_text_above_password');
983	if( ! empty( $text ) ) {
984	echo '<div class="password-protected-text-above" style="width:100%;">' . wp_kses_post( $text ) . '</div>';
985	}
986	}
987
988	/**
989	* Print text below password field
990	* @return void.
991	*/
992	public function password_protected_below_password_field() {
993	$text = get_option('password_protected_text_below_password');
994	if( ! empty( $text ) ) {
995	echo '<div class="password-protected-text-below" style="width:100%">' . wp_kses_post( $text ) . '</div>';
996	}
997	}
998
999	}
1000
1001
1002