password-protected / password-protected.php

password-protected.php in Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content 2.8.2, at password-protected.php

1,011 lines 26.6 KB

Raw Download Zip

1	<?php
2	/*
3	Plugin Name: Password Protected
4	Plugin URI: https://wordpress.org/plugins/password-protected/
5	Description: A very simple way to quickly password protect your WordPress site with a single password. Please note: This plugin does not restrict access to uploaded files and images and does not work with some caching setups.
6	Version: 2.8.2
7	Author: Password Protected
8	Text Domain: password-protected
9	Author URI: https://passwordprotectedwp.com/
10	License: GPLv2
11	*/
12	/*
13	This program is free software; you can redistribute it and/or modify
14	it under the terms of the GNU General Public License, version 2, as
15	published by the Free Software Foundation.
16
17	This program is distributed in the hope that it will be useful,
18	but WITHOUT ANY WARRANTY; without even the implied warranty of
19	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20	GNU General Public License for more details.
21
22	You should have received a copy of the GNU General Public License
23	along with this program; if not, write to the Free Software
24	Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
25	*/
26
27	/**
28	* @todo Use wp_hash_password() ?
29	* @todo Remember me
30	*/
31
32
33	define( 'PASSWORD_PROTECTED_SUBDIR', '/' . str_replace( basename( __FILE__ ), '', plugin_basename( __FILE__ ) ) );
34	define( 'PASSWORD_PROTECTED_URL', plugins_url( PASSWORD_PROTECTED_SUBDIR ) );
35	define( 'PASSWORD_PROTECTED_DIR', plugin_dir_path( __FILE__ ) );
36
37	require_once PASSWORD_PROTECTED_DIR . 'includes/freemius.php';
38
39	global $Password_Protected;
40	$Password_Protected = new Password_Protected();
41
42	class Password_Protected {
43
44	var $version = '2.8.2';
45	var $admin = null;
46	var $errors = null;
47	var $admin_caching = null;
48
49	/**
50	* Constructor
51	*/
52	public function __construct() {
53
54	$this->errors = new WP_Error();
55
56	register_activation_hook( __FILE__, array( &$this, 'install' ) );
57
58	add_action( 'plugins_loaded', array( $this, 'load_plugin_textdomain' ) );
59
60	add_filter( 'password_protected_is_active', array( $this, 'allow_ip_addresses' ) );
61	add_filter( 'password_protected_is_active', array( $this, 'elementor_compatibility' ) );
62
63	add_action( 'init', array( $this, 'disable_caching' ), 1 );
64	add_action( 'init', array( $this, 'maybe_process_logout' ), 1 );
65	add_action( 'init', array( $this, 'maybe_process_login' ), 1 );
66	add_action( 'wp', array( $this, 'disable_feeds' ) );
67	add_action( 'template_redirect', array( $this, 'maybe_show_login' ), -10 );
68	add_filter( 'pre_option_password_protected_status', array( $this, 'allow_feeds' ) );
69	add_filter( 'pre_option_password_protected_status', array( $this, 'allow_administrators' ) );
70	add_filter( 'pre_option_password_protected_status', array( $this, 'allow_users' ) );
71	add_filter( 'rest_authentication_errors', array( $this, 'only_allow_logged_in_rest_access' ) );
72	add_action( 'init', array( $this, 'compat' ) );
73	add_action( 'password_protected_login_messages', array( $this, 'login_messages' ) );
74	add_action( 'login_enqueue_scripts', array( $this, 'load_theme_stylesheet' ), 5 );
75
76	add_action('password_protected_above_password_field', array( $this, 'password_protected_above_password_field' ));
77	add_action('password_protected_below_password_field', array( $this, 'password_protected_below_password_field' ));
78
79
80
81
82	// Available from WordPress 4.3+
83	if ( function_exists( 'wp_site_icon' ) ) {
84	add_action( 'password_protected_login_head', 'wp_site_icon' );
85	}
86
87	add_shortcode( 'password_protected_logout_link', array( $this, 'logout_link_shortcode' ) );
88
89	include_once dirname( __FILE__ ) . '/admin/admin-bar.php';
90	include_once dirname( __FILE__ ) . '/includes/compatibility.php';
91	if ( is_admin() ) {
92
93	include_once dirname( __FILE__ ) . '/admin/admin-caching.php';
94	include_once dirname( __FILE__ ) . '/admin/admin.php';
95
96	$this->admin_caching = new Password_Protected_Admin_Caching( $this );
97	$this->admin = new Password_Protected_Admin();
98
99
100	}
101	include_once dirname( __FILE__ ) . '/admin/class-recaptcha.php';
102	new Password_Protected_reCAPTCHA();
103
104	include_once dirname( __FILE__ ) . '/includes/transient-functions.php';
105	include_once dirname( __FILE__ ) . '/includes/activity-report-email/class-password-protected-activity-report-settings.php';
106
107	include_once dirname( __FILE__ ) . '/admin/class-pp-all-captcha-tabs.php';
108	include_once dirname( __FILE__ ) . '/includes/class-customize.php';
109	new Password_Protected_Free_allCaptchas();
110
111	}
112
113	/**
114	* I18n
115	*/
116	public function load_plugin_textdomain() {
117
118	load_plugin_textdomain( 'password-protected', false, basename( dirname( __FILE__ ) ) . '/languages' );
119
120	}
121
122	/**
123	* Disable Page Caching
124	*/
125	public function disable_caching() {
126
127	if ( $this->is_active() && ! defined( 'DONOTCACHEPAGE' ) ) {
128	define( 'DONOTCACHEPAGE', true );
129	}
130
131	}
132
133	/**
134	* Is Active?
135	*
136	* @return boolean Is password protection active?
137	*/
138	public function is_active() {
139
140	global $wp_query;
141
142	// Always allow access to robots.txt
143	if ( isset( $wp_query ) && is_robots() ) {
144	return false;
145	}
146
147	if ( (bool) get_option( 'password_protected_status' ) ) {
148	$is_active = true;
149	} else {
150	$is_active = false;
151	}
152
153	$is_active = apply_filters( 'password_protected_is_active', $is_active );
154
155	if ( isset( $_GET['password-protected'] ) ) {
156	$is_active = true;
157	}
158
159	return $is_active;
160
161	}
162
163	/**
164	* Disable Feeds
165	*
166	* @todo An option/filter to prevent disabling of feeds.
167	*/
168	public function disable_feeds() {
169
170	if ( $this->is_active() ) {
171	add_action( 'do_feed', array( $this, 'disable_feed' ), 1 );
172	add_action( 'do_feed_rdf', array( $this, 'disable_feed' ), 1 );
173	add_action( 'do_feed_rss', array( $this, 'disable_feed' ), 1 );
174	add_action( 'do_feed_rss2', array( $this, 'disable_feed' ), 1 );
175	add_action( 'do_feed_atom', array( $this, 'disable_feed' ), 1 );
176	}
177
178	}
179
180	/**
181	* Disable Feed
182	*
183	* @todo Make Translatable
184	*/
185	public function disable_feed() {
186
187	wp_die( sprintf( __( 'Feeds are not available for this site. Please visit the <a href="%s">website</a>.', 'password-protected' ), get_bloginfo( 'url' ) ) );
188
189	}
190
191	/**
192	* Allow Feeds
193	*
194	* @param boolean $bool Allow feeds.
195	* @return boolean True/false.
196	*/
197	public function allow_feeds( $bool ) {
198
199	if ( is_feed() && (bool) get_option( 'password_protected_feeds' ) ) {
200	return 0;
201	}
202
203	return $bool;
204
205	}
206
207	/**
208	* Allow Administrators
209	*
210	* @param boolean $bool Allow administrators.
211	* @return boolean True/false.
212	*/
213	public function allow_administrators( $bool ) {
214
215	if ( ! is_admin() && current_user_can( 'manage_options' ) && (bool) get_option( 'password_protected_administrators' ) ) {
216	return 0;
217	}
218
219	return $bool;
220
221	}
222
223	/**
224	* Allow Users
225	*
226	* @param boolean $bool Allow administrators.
227	* @return boolean True/false.
228	*/
229	public function allow_users( $bool ) {
230
231	if ( ! is_admin() && is_user_logged_in() && (bool) get_option( 'password_protected_users' ) ) {
232	return 0;
233	}
234
235	return $bool;
236
237	}
238
239	/**
240	* Allow IP Addresses
241	*
242	* If user has a valid email address, return false to disable password protection.
243	*
244	* @param boolean $bool Allow IP addresses.
245	* @return boolean True/false.
246	*/
247	public function allow_ip_addresses( $bool ) {
248
249	$ip_addresses = $this->get_allowed_ip_addresses();
250
251	if ( isset( $_SERVER['REMOTE_ADDR'] ) && in_array( $_SERVER['REMOTE_ADDR'], $ip_addresses ) ) {
252	$bool = false;
253	} else {
254	$bool = apply_filters( 'password_protected__allowed_ip_ranges', $bool, $ip_addresses, isset( $_SERVER['REMOTE_ADDR'] ) ? $_SERVER['REMOTE_ADDR'] : '' );
255	}
256
257	return $bool;
258
259	}
260
261
262	/**
263	* Is protection active.
264	*
265	* @param bool $is_active is active {true\|false}.
266	*
267	* @return bool
268	*/
269	public function elementor_compatibility( $is_active ) {
270	if ( class_exists( '\\Elementor\\plugin' ) ) {
271	if ( \Elementor\Plugin::$instance->preview->is_preview_mode() ) {
272	$is_active = false;
273	}
274	}
275	return $is_active;
276	}
277
278	/**
279	* Get Allowed IP Addresses
280	*
281	* @return array IP addresses.
282	*/
283	public function get_allowed_ip_addresses() {
284	$allowed_ip_address = get_option( 'password_protected_allowed_ip_addresses' );
285	if ( empty( $allowed_ip_address ) ) {
286	return array();
287	}
288	return explode( "\n", $allowed_ip_address );
289
290	}
291
292	/**
293	* Allow the remember me function
294	*
295	* @return. boolean
296	*/
297	public function allow_remember_me() {
298
299	return (bool) get_option( 'password_protected_remember_me' );
300
301	}
302
303	/**
304	* Encrypt Password
305	*
306	* @param string $password Password.
307	* @return string Encrypted password.
308	*/
309	public function encrypt_password( $password ) {
310
311	return md5( $password );
312
313	}
314
315	/**
316	* Maybe Process Logout
317	*/
318	public function maybe_process_logout() {
319
320	if ( isset( $_REQUEST['password-protected'] ) && sanitize_text_field( $_REQUEST['password-protected'] ) == 'logout' ) {
321
322	$this->logout();
323
324	if ( isset( $_REQUEST['redirect_to'] ) ) {
325	$redirect_to = remove_query_arg( 'password-protected', esc_url_raw( $_REQUEST['redirect_to'], array( 'http', 'https' ) ) );
326	} else {
327	$redirect_to = home_url( '/' );
328	}
329
330	$this->safe_redirect( $redirect_to );
331	exit();
332
333	}
334
335	}
336
337	/**
338	* Maybe Process Login
339	*/
340	public function maybe_process_login() {
341
342	if ( $this->is_active() && isset( $_REQUEST['password_protected_pwd'] ) ) {
343
344	$password_protected_pwd = sanitize_text_field( $_REQUEST['password_protected_pwd'] );
345	$default_password = get_option( 'password_protected_password' );
346
347	$auth = false;
348	$p_id = 0;
349
350	if ( empty( $default_password ) ) {
351
352	$authentication = $this->password_protected_check_pro_password( $password_protected_pwd );
353	$auth = $authentication['auth'];
354	$p_id = $authentication['p_id'];
355
356	} else {
357
358	if ( ( hash_equals( $default_password, $this->encrypt_password( $password_protected_pwd ) ) && $default_password != '' ) \|\| apply_filters( 'password_protected_process_login', false, $password_protected_pwd ) ) {
359	$auth = true;
360	}
361
362	if ( ! $auth ) {
363
364	$authentication = $this->password_protected_check_pro_password( $password_protected_pwd );
365	$auth = $authentication['auth'];
366	$p_id = $authentication['p_id'];
367	}
368
369	}
370
371	$this->errors = apply_filters( 'password_protected_verify_recaptcha', $this->errors );
372
373	if( count( @$this->errors->errors ) > 0 ) return;
374
375	$this->password_protected_process_login( $auth, $password_protected_pwd, $p_id );
376
377	}
378
379	}
380
381	public function password_protected_process_login( bool $auth, $requested_password, $password_id ) {
382
383	if( $auth )
384	$throttle = apply_filters( 'password_protected_check_for_throttling', true );
385
386
387	if( $auth && $throttle ) {
388
389	do_action( 'password_protected_success_login_attempt', 'global', $requested_password, $password_id );
390	$remember = isset( $_REQUEST['password_protected_rememberme'] ) ? boolval( $_REQUEST['password_protected_rememberme'] ) : false;
391
392	if ( ! $this->allow_remember_me() ) {
393	$remember = false;
394	}
395	$this->set_auth_cookie( $remember );
396
397	$redirect_to = isset( $_REQUEST['redirect_to'] ) ? sanitize_text_field( $_REQUEST['redirect_to'] ) : '';
398
399	$redirect_to = apply_filters( 'password_protected_login_redirect', $redirect_to, $requested_password );
400
401	if ( ! empty( $redirect_to ) ) {
402	$this->safe_redirect( remove_query_arg( 'password-protected', $redirect_to ) );
403	exit;
404	} elseif ( isset( $_GET['password_protected_pwd'] ) ) {
405	$this->safe_redirect( remove_query_arg( 'password-protected' ) );
406	exit;
407	} else {
408	$this->safe_redirect( site_url() );
409	exit;
410	}
411	} else {
412	do_action( 'password_protected_failure_login_attempt', 'global', $requested_password, $password_id );
413
414	// ... otherwise incorrect password
415	$this->clear_auth_cookie();
416
417	$show_default_error = apply_filters( 'password_protected_throttling_error_messages', true );
418
419	if( $show_default_error )
420	$this->errors->add( 'incorrect_password', __( 'Incorrect Password', 'password-protected' ) );
421	}
422	}
423
424	/**
425	* password_protected_check_pro_password
426	*
427	* @param mixed $requested_password
428	* @return void
429	*/
430	public function password_protected_check_pro_password( $requested_password ) {
431
432	$pro_passwords = apply_filters( 'password_protected_passwords', array() );
433	$pro_passwords = array_filter( $pro_passwords );
434	$auth = false;
435	$p_id = 0;
436
437	if( is_array( $pro_passwords ) && count( $pro_passwords ) > 0 ) {
438
439	foreach( $pro_passwords as $i => $p ) {
440
441	if ( ( hash_equals( $p, $this->encrypt_password( $requested_password ) ) && $pro_passwords != '' ) \|\| apply_filters( 'password_protected_process_login', false, $requested_password ) ) {
442
443	$auth = apply_filters( 'password_protected_login_password_matched', $p, $this->errors );
444	$p_id = $i;
445	break;
446
447	}
448
449	}
450
451	} else {
452
453	$auth = false;
454
455	}
456
457	return array(
458	'auth' => $auth,
459	'p_id' => $p_id,
460	);
461	}
462
463	/**
464	* Is User Logged In?
465	*
466	* @return boolean
467	*/
468	public function is_user_logged_in() {
469
470	return $this->is_active() && $this->validate_auth_cookie();
471
472	}
473
474	/**
475	* Maybe Show Login
476	*/
477	public function maybe_show_login() {
478
479	if ( class_exists( 'Login_designer' ) \|\| class_exists( 'Password_Protected_Pro_Customizer' ) ) {
480	if ( is_customize_preview() ) {
481	return 1;
482	}
483	}
484
485	// Filter for adding exceptions.
486	$show_login = apply_filters( 'password_protected_show_login', $this->is_active() );
487
488	// Logged in
489	if ( $this->is_user_logged_in() ) {
490	$show_login = false;
491	}
492
493	if ( ! $show_login ) {
494	return 1;
495	}
496
497	// Show login form
498	if ( isset( $_REQUEST['password-protected'] ) && 'login' == sanitize_text_field( $_REQUEST['password-protected'] ) ) {
499
500	$default_theme_file = locate_template( array( 'password-protected-login.php' ) );
501
502	if ( empty( $default_theme_file ) ) {
503	$default_theme_file = dirname( __FILE__ ) . '/theme/password-protected-login.php';
504	}
505
506	$theme_file = apply_filters( 'password_protected_theme_file', $default_theme_file );
507	if ( ! file_exists( $theme_file ) ) {
508	$theme_file = $default_theme_file;
509	}
510
511	load_template( $theme_file );
512	exit();
513
514	} else {
515	global $wp;
516
517	$redirect_to = add_query_arg( 'password-protected', 'login', home_url( $wp->request . '?' . $_SERVER['QUERY_STRING'] ) );
518	$redirect_to = pp__add_dynamic_arg( $redirect_to );
519
520	// URL to redirect back to after login
521	$redirect_to_url = apply_filters( 'password_protected_login_redirect_url', ( is_ssl() ? 'https://' : 'http://' ) . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'] );
522	$redirect_to_url = pp__add_dynamic_arg( $redirect_to_url );
523	if ( ! empty( $redirect_to_url ) ) {
524	$redirect_to = add_query_arg( 'redirect_to', urlencode( $redirect_to_url ), $redirect_to );
525	}
526
527	nocache_headers();
528	wp_redirect( $redirect_to );
529	exit();
530
531	}
532	}
533
534	/**
535	* Get Site ID
536	*
537	* @return string Site ID.
538	*/
539	public function get_site_id() {
540
541	global $blog_id;
542	return 'bid_' . apply_filters( 'password_protected_blog_id', $blog_id );
543
544	}
545
546	/**
547	* Login URL
548	*
549	* @return string Login URL.
550	*/
551	public function login_url() {
552	global $wp;
553	return add_query_arg( 'password-protected', 'login', home_url( $wp->request . '?' . $_SERVER['QUERY_STRING'] ) );
554
555	}
556
557	/**
558	* Logout
559	*/
560	public function logout() {
561
562	$this->clear_auth_cookie();
563	do_action( 'password_protected_logout' );
564
565	}
566
567	/**
568	* Logout URL
569	*
570	* @param string $redirect_to Optional. Redirect URL.
571	* @return string Logout URL.
572	*/
573	public function logout_url( $redirect_to = '' ) {
574
575	$query = array(
576	'password-protected' => 'logout',
577	'redirect_to' => esc_url_raw( $redirect_to ),
578	);
579
580	if ( empty( $query['redirect_to'] ) ) {
581	unset( $query['redirect_to'] );
582	}
583
584	return add_query_arg( $query, home_url() );
585
586	}
587
588	/**
589	* Logout Link
590	*
591	* @param array $args Link args.
592	* @return string HTML link tag.
593	*/
594	public function logout_link( $args = null ) {
595
596	// Only show if user is logged in
597	if ( ! $this->is_user_logged_in() ) {
598	return '';
599	}
600
601	$args = wp_parse_args(
602	$args,
603	array(
604	'redirect_to' => '',
605	'text' => __( 'Logout', 'password-protected' ),
606	)
607	);
608
609	if ( empty( $args['text'] ) ) {
610	$args['text'] = __( 'Logout', 'password-protected' );
611	}
612
613	return sprintf( '<a href="%s">%s</a>', esc_url( $this->logout_url( $args['redirect_to'] ) ), esc_html( $args['text'] ) );
614
615	}
616
617	/**
618	* Logout Link Shortcode
619	*
620	* @param array $args Link args.
621	* @return string HTML link tag.
622	*/
623	public function logout_link_shortcode( $atts, $content = null ) {
624
625	$atts = shortcode_atts(
626	array(
627	'redirect_to' => '',
628	'text' => $content,
629	),
630	$atts,
631	'logout_link_shortcode'
632	);
633
634	return $this->logout_link( $atts );
635
636	}
637
638	/**
639	* Get Hashed Password
640	*
641	* @return string Hashed password.
642	*/
643	public function get_hashed_password() {
644
645	return md5( get_option( 'password_protected_password' ) . wp_salt() );
646
647	}
648
649	/**
650	* Validate Auth Cookie
651	*
652	* @param string $cookie Cookie string.
653	* @param string $scheme Cookie scheme.
654	* @return boolean Validation successful?
655	*/
656	public function validate_auth_cookie( $cookie = '', $scheme = '', $hashed_password = '' ) {
657
658	if ( ! $cookie_elements = $this->parse_auth_cookie( $cookie, $scheme ) ) {
659	do_action( 'password_protected_auth_cookie_malformed', $cookie, $scheme );
660	return false;
661	}
662
663	extract( $cookie_elements, EXTR_OVERWRITE );
664
665	$expired = $expiration;
666
667	// Allow a grace period for POST and AJAX requests
668	if ( defined( 'DOING_AJAX' ) \|\| 'POST' == $_SERVER['REQUEST_METHOD'] ) {
669	$expired += 3600;
670	}
671
672	// Quick check to see if an honest cookie has expired
673	if ( $expired < current_time( 'timestamp' ) ) {
674	do_action( 'password_protected_auth_cookie_expired', $cookie_elements );
675	return false;
676	}
677
678	if ( empty( $hashed_password ) ) {
679	$hashed_password = $this->get_hashed_password();
680	}
681	$key = md5( $this->get_site_id() . $hashed_password . '\|' . $expiration ); // need to modify
682	$hash = hash_hmac( 'md5', $this->get_site_id() . '\|' . $expiration, $key );
683
684	if ( $hmac != $hash ) {
685	do_action( 'password_protected_auth_cookie_bad_hash', $cookie_elements );
686	return false;
687	}
688
689	if ( $expiration < current_time( 'timestamp' ) ) { // AJAX/POST grace period set above
690	$GLOBALS['login_grace_period'] = 1;
691	}
692
693	return true;
694
695	}
696
697	/**
698	* Generate Auth Cookie
699	*
700	* @param int $expiration Expiration time in seconds.
701	* @param string $scheme Cookie scheme.
702	* @return string Cookie.
703	*/
704	public function generate_auth_cookie( $expiration, $scheme = 'auth', $hashed_password = '' ) {
705
706	if ( empty( $hashed_password ) ) {
707	$hashed_password = $this->get_hashed_password();
708	}
709	$key = md5( $this->get_site_id() . $hashed_password . '\|' . $expiration ); // need to modify
710	$hash = hash_hmac( 'md5', $this->get_site_id() . '\|' . $expiration, $key );
711	$cookie = $this->get_site_id() . '\|' . $expiration . '\|' . $hash;
712
713	return $cookie;
714
715	}
716
717	/**
718	* Parse Auth Cookie
719	*
720	* @param string $cookie Cookie string.
721	* @param string $scheme Cookie scheme.
722	* @return string Cookie string.
723	*/
724	public function parse_auth_cookie( $cookie = '', $scheme = '' ) {
725	if ( empty( $cookie ) ) {
726
727	$cookie_name = $this->cookie_name();
728	$use_transient = get_option( 'password_protected_use_transient', 'default' );
729
730	$cookie = password_protected_cookie( 'get', array( 'name' => $cookie_name ) );
731
732	if ( empty( $cookie ) ) {
733	return false;
734	}
735	}
736
737	$cookie_elements = explode( '\|', $cookie );
738
739	if ( count( $cookie_elements ) != 3 ) {
740	return false;
741	}
742
743	list( $site_id, $expiration, $hmac ) = $cookie_elements;
744
745	return compact( 'site_id', 'expiration', 'hmac', 'scheme' );
746
747	}
748
749	/**
750	* Set Auth Cookie
751	*
752	* @todo
753	*
754	* @param boolean $remember Remember logged in.
755	* @param string $secure Secure cookie.
756	*/
757	public function set_auth_cookie( $remember = false, $secure = '' ) {
758
759	if ( $remember ) {
760	$expiration_time = apply_filters( 'password_protected_auth_cookie_expiration', get_option( 'password_protected_remember_me_lifetime', 14 ) * DAY_IN_SECONDS, $remember );
761	$expiration = $expire = current_time( 'timestamp' ) + $expiration_time;
762	} else {
763	$expiration_time = apply_filters( 'password_protected_auth_cookie_expiration', DAY_IN_SECONDS * 20, $remember );
764	$expiration = current_time( 'timestamp' ) + $expiration_time;
765	$expire = 0;
766	}
767
768	if ( '' === $secure ) {
769	$secure = is_ssl();
770	}
771
772	$secure_password_protected_cookie = apply_filters( 'password_protected_secure_password_protected_cookie', false, $secure );
773	$password_protected_cookie = $this->generate_auth_cookie( $expiration, 'password_protected' );
774
775	$use_transient = get_option( 'password_protected_use_transient', 'default' );
776
777
778	password_protected_cookie(
779	'set',
780	array(
781	'name' => $this->cookie_name(),
782	'data' => $password_protected_cookie,
783	'secure' => $secure_password_protected_cookie,
784	'expire' => $expire,
785	)
786	);
787
788	}
789
790	/**
791	* Clear Auth Cookie
792	*/
793	public function clear_auth_cookie() {
794	$use_transient = get_option( 'password_protected_use_transient', 'default' );
795	password_protected_cookie( 'delete', array( 'name' => $this->cookie_name() ) );
796	}
797
798	/**
799	* Cookie Name
800	*
801	* @return string Cookie name.
802	*/
803	public function cookie_name() {
804
805	/**
806	* Filters the cookie name
807	*/
808	return apply_filters( 'password_protected_cookie_name', $this->get_site_id() . '_password_protected_auth', $this );
809
810	}
811
812	/**
813	* Install
814	*/
815	public function install() {
816
817	$old_version = get_option( 'password_protected_version' );
818
819	// 1.1 - Upgrade to MD5
820	if ( empty( $old_version ) \|\| $old_version == '1.1' ) {
821	$pwd = get_option( 'password_protected_password' );
822	if ( ! empty( $pwd ) ) {
823	$new_pwd = $this->encrypt_password( $pwd );
824	update_option( 'password_protected_password', $new_pwd );
825	}
826	}
827
828	update_option( 'password_protected_version', $this->version );
829
830	}
831
832	/**
833	* Compat
834	*
835	* Support for 3rd party plugins:
836	*
837	* - Login Logo https://wordpress.org/plugins/login-logo/
838	* - Uber Login Logo https://wordpress.org/plugins/uber-login-logo/
839	*/
840	public function compat() {
841
842	if ( class_exists( 'CWS_Login_Logo_Plugin' ) ) {
843
844	// Add support for Mark Jaquith's Login Logo plugin
845	add_action( 'password_protected_login_head', array( new CWS_Login_Logo_Plugin(), 'login_head' ) );
846
847	} elseif ( class_exists( 'UberLoginLogo' ) ) {
848
849	// Add support for Uber Login Logo plugin
850	add_action( 'password_protected_login_head', array( 'UberLoginLogo', 'replaceLoginLogo' ) );
851
852	}
853
854	}
855
856	/**
857	* Login Messages
858	* Outputs messages and errors in the login template.
859	*/
860	public function login_messages() {
861
862	// Add message
863	$message = apply_filters( 'password_protected_login_message', '' );
864	if ( ! empty( $message ) ) {
865	echo $message . "\n";
866	}
867
868	if ( $this->errors->get_error_code() ) {
869
870	$errors = '';
871	$messages = '';
872
873	foreach ( $this->errors->get_error_codes() as $code ) {
874	$severity = $this->errors->get_error_data( $code );
875	foreach ( $this->errors->get_error_messages( $code ) as $error ) {
876	if ( 'message' == $severity ) {
877	$messages .= $error . '<br />';
878	} else {
879	$errors .= $error . '<br />';
880	}
881	}
882	}
883
884	if ( ! empty( $errors ) ) {
885	echo '<div id="login_error" class="notice notice-error">' . apply_filters( 'password_protected_login_errors', $errors ) . "</div>\n";
886	}
887	if ( ! empty( $messages ) ) {
888	echo '<p class="message">' . apply_filters( 'password_protected_login_messages', $messages ) . "</p>\n";
889	}
890	}
891
892	}
893
894	/**
895	* Load Theme Stylesheet
896	*
897	* Check wether a 'password-protected-login.css' stylesheet exists in your theme
898	* and if so loads it.
899	*
900	* Works with child themes.
901	*
902	* Possible to specify a different file in the theme folder via the
903	* 'password_protected_stylesheet_file' filter (allows for theme subfolders).
904	*/
905	public function load_theme_stylesheet() {
906
907	$filename = apply_filters( 'password_protected_stylesheet_file', 'password-protected-login.css' );
908
909	$located = locate_template( $filename );
910
911	if ( ! empty( $located ) ) {
912
913	$stylesheet_directory = trailingslashit( get_stylesheet_directory() );
914	$template_directory = trailingslashit( get_template_directory() );
915
916	if ( $stylesheet_directory == substr( $located, 0, strlen( $stylesheet_directory ) ) ) {
917	wp_enqueue_style( 'password-protected-login', get_stylesheet_directory_uri() . '/' . $filename );
918	} elseif ( $template_directory == substr( $located, 0, strlen( $template_directory ) ) ) {
919	wp_enqueue_style( 'password-protected-login', get_template_directory_uri() . '/' . $filename );
920	}
921	}
922
923	}
924
925	/**
926	* Safe Redirect
927	*
928	* Ensure the redirect is to the same site or pluggable list of allowed domains.
929	* If invalid will redirect to ...
930	* Based on the WordPress wp_safe_redirect() function.
931	*/
932	public function safe_redirect( $location, $status = 302 ) {
933
934	$location = wp_sanitize_redirect( $location );
935	$location = wp_validate_redirect( $location, home_url() );
936
937	wp_redirect( $location, $status );
938
939	}
940
941	/**
942	* Is Plugin Supported?
943	*
944	* Check to see if there are any known reasons why this plugin may not work in
945	* the user's hosting environment.
946	*
947	* @return boolean
948	*/
949	static function is_plugin_supported() {
950
951	return true;
952
953	}
954
955	/**
956	* Check whether a given request has permissions
957	*
958	* Always allow logged in users who require REST API for Gutenberg
959	* and other admin/plugin compatibility.
960	*
961	* @param WP_REST_Request $access Full details about the request.
962	* @return WP_Error\|boolean
963	*/
964	public function only_allow_logged_in_rest_access( $access ) {
965	if ( $this->is_active() ) {
966	if ( is_user_logged_in() ) {
967	global $current_user;
968	if ( $current_user->has_cap( 'edit_posts' ) \|\| $current_user->has_cap( 'edit_pages' ) ) {
969	return $access;
970	}
971	}
972
973	if ( $this->is_user_logged_in() ) {
974	return $access;
975	}
976
977	if ( get_option( 'password_protected_rest' ) ) {
978	return $access;
979	}
980	return new WP_Error( 'rest_cannot_access', __( 'Only authenticated users can access the REST API.', 'password-protected' ), array( 'status' => rest_authorization_required_code() ) );
981	}
982
983	return $access;
984	}
985
986	/**
987	* Print text above password field
988	* @return void.
989	*/
990	public function password_protected_above_password_field() {
991	$text = get_option('password_protected_text_above_password');
992	if( ! empty( $text ) ) {
993	echo '<div class="password-protected-text-above" style="width:100%;">' . wp_kses_post( $text ) . '</div>';
994	}
995	}
996
997	/**
998	* Print text below password field
999	* @return void.
1000	*/
1001	public function password_protected_below_password_field() {
1002	$text = get_option('password_protected_text_below_password');
1003	if( ! empty( $text ) ) {
1004	echo '<div class="password-protected-text-below" style="width:100%">' . wp_kses_post( $text ) . '</div>';
1005	}
1006	}
1007
1008	}
1009
1010
1011