| 1 |
<?php |
| 2 |
/** |
| 3 |
* Function that checks if a user is approved before reseting the password |
| 4 |
* |
| 5 |
* @param string $data either the user login or the users email |
| 6 |
* @param string $what what field we query for when getting the user |
| 7 |
*/ |
| 8 |
function wppb_check_for_unapproved_user( $data, $what ){ |
| 9 |
$retMessage = ''; |
| 10 |
$messageNo = ''; |
| 11 |
|
| 12 |
$wppb_generalSettings = get_option( 'wppb_general_settings' ); |
| 13 |
if( $wppb_generalSettings['adminApproval'] == 'yes' ){ |
| 14 |
$user = ( ( $what == 'user_email' ) ? get_user_by( 'email', $data ) : get_user_by( 'login', $data ) ); |
| 15 |
|
| 16 |
if ( wp_get_object_terms( $user->data->ID, 'user_status' ) ){ |
| 17 |
$retMessage = '<strong>'. __('ERROR', 'profilebuilder') . '</strong>: ' . __('Your account has to be confirmed by an administrator before you can use the "Password Reset" feature.', 'profilebuilder'); |
| 18 |
$retMessage = apply_filters('wppb_recover_password_unapporved_user', $retMessage); |
| 19 |
|
| 20 |
$messageNo = '6'; |
| 21 |
} |
| 22 |
} |
| 23 |
|
| 24 |
return array( $retMessage, $messageNo ); |
| 25 |
} |
| 26 |
|
| 27 |
/** |
| 28 |
* Function that retrives the unique user key from the database. If we don't have one we generate one and add it to the database |
| 29 |
* |
| 30 |
* @param string $requested_user_login the user login |
| 31 |
* |
| 32 |
*/ |
| 33 |
function wppb_retrieve_activation_key( $requested_user_login ){ |
| 34 |
global $wpdb; |
| 35 |
|
| 36 |
$key = $wpdb->get_var( $wpdb->prepare( "SELECT user_activation_key FROM $wpdb->users WHERE user_login = %s", $requested_user_login ) ); |
| 37 |
|
| 38 |
if ( empty( $key ) ) { |
| 39 |
|
| 40 |
// Generate something random for a key... |
| 41 |
$key = wp_generate_password( 20, false ); |
| 42 |
do_action('wppb_retrieve_password_key', $requested_user_login, $key); |
| 43 |
|
| 44 |
// Now insert the new md5 key into the db |
| 45 |
$wpdb->update($wpdb->users, array('user_activation_key' => $key), array('user_login' => $requested_user_login)); |
| 46 |
} |
| 47 |
|
| 48 |
return $key; |
| 49 |
} |
| 50 |
|
| 51 |
/** |
| 52 |
* Function that creates a generate new password form |
| 53 |
* |
| 54 |
* @param array $post_data $_POST |
| 55 |
* |
| 56 |
*/ |
| 57 |
function wppb_create_recover_password_form( $user, $post_data ){ |
| 58 |
?> |
| 59 |
<form enctype="multipart/form-data" method="post" id="wppb-recover-password" class="wppb-user-forms" action="<?php echo add_query_arg( 'finalAction', 'yes', wppb_curpageurl() ); ?>"> |
| 60 |
<ul> |
| 61 |
<?php |
| 62 |
|
| 63 |
if( !empty( $post_data['passw1'] ) ) |
| 64 |
$passw_one = $post_data['passw1']; |
| 65 |
else |
| 66 |
$passw_one = ''; |
| 67 |
|
| 68 |
if( !empty( $post_data['passw2'] ) ) |
| 69 |
$passw_two = $post_data['passw2']; |
| 70 |
else |
| 71 |
$passw_two = ''; |
| 72 |
|
| 73 |
$recover_inputPassword = ' |
| 74 |
<li class="wppb-form-field passw1"> |
| 75 |
<label for="passw1">'. __( 'Password', 'profilebuilder' ).'</label> |
| 76 |
<input class="password" name="passw1" type="password" id="passw1" value="'. $passw_one .'" autocomplete="off" title="'. wppb_password_length_text() .'"/> |
| 77 |
</li><!-- .passw1 --> |
| 78 |
<input type="hidden" name="userData" value="'.$user->ID.'"/> |
| 79 |
<li class="wppb-form-field passw2"> |
| 80 |
<label for="passw2">'. __( 'Repeat Password', 'profilebuilder' ).'</label> |
| 81 |
<input class="password" name="passw2" type="password" id="passw2" value="'.$passw_two.'" autocomplete="off" /> |
| 82 |
</li><!-- .passw2 -->'; |
| 83 |
|
| 84 |
/* if we have active the password strength checker */ |
| 85 |
$recover_inputPassword .= wppb_password_strength_checker_html(); |
| 86 |
|
| 87 |
echo apply_filters( 'wppb_recover_password_form_input', $recover_inputPassword, $passw_one, $passw_two, $user->ID ); |
| 88 |
?> |
| 89 |
</ul> |
| 90 |
<p class="form-submit"> |
| 91 |
<?php $button_name = __('Reset Password', 'profilebuilder'); ?> |
| 92 |
<input name="recover_password2" type="submit" id="wppb-recover-password-button" class="submit button" value="<?php echo apply_filters('wppb_recover_password_button_name1', $button_name); ?>" /> |
| 93 |
<input name="action2" type="hidden" id="action2" value="recover_password2" /> |
| 94 |
</p><!-- .form-submit --> |
| 95 |
<?php wp_nonce_field( 'verify_true_password_recovery2_'.$user->ID, 'password_recovery_nonce_field2' ); ?> |
| 96 |
</form><!-- #recover_password --> |
| 97 |
<?php |
| 98 |
} |
| 99 |
|
| 100 |
/** |
| 101 |
* Function that generates the recover password form |
| 102 |
* |
| 103 |
* @param WP_User $user the user object |
| 104 |
* @param array $post_data $_POST |
| 105 |
* |
| 106 |
*/ |
| 107 |
function wppb_create_generate_password_form( $post_data ){ |
| 108 |
?> |
| 109 |
<form enctype="multipart/form-data" method="post" id="wppb-recover-password" class="wppb-user-forms" action="<?php echo add_query_arg( 'submitted', 'yes', wppb_curpageurl() ); ?>"> |
| 110 |
<?php |
| 111 |
$recover_notification = '<p>' . __( 'Please enter your username or email address.', 'profilebuilder' ); |
| 112 |
$recover_notification .= '<br/>'.__( 'You will receive a link to create a new password via email.', 'profilebuilder' ).'</p>'; |
| 113 |
echo apply_filters( 'wppb_recover_password_message1', $recover_notification ); |
| 114 |
|
| 115 |
$username_email = ( isset( $post_data['username_email'] ) ? $post_data['username_email'] : '' ); |
| 116 |
|
| 117 |
$recover_input = '<ul> |
| 118 |
<li class="wppb-form-field wppb-username-email"> |
| 119 |
<label for="username_email">'.__( 'Username or E-mail', 'profilebuilder' ).'</label> |
| 120 |
<input class="text-input" name="username_email" type="text" id="username_email" value="'.trim( $username_email ).'" /> |
| 121 |
</li><!-- .username_email --></ul>'; |
| 122 |
echo apply_filters( 'wppb_recover_password_gemerate_password_input', $recover_input, trim( $username_email ) ); |
| 123 |
?> |
| 124 |
<p class="form-submit"> |
| 125 |
<?php $button_name = __('Get New Password', 'profilebuilder'); ?> |
| 126 |
<input name="recover_password" type="submit" id="wppb-recover-password-button" class="submit button" value="<?php echo apply_filters('wppb_recover_password_button_name3', $button_name); ?>" /> |
| 127 |
<input name="action" type="hidden" id="action" value="recover_password" /> |
| 128 |
</p> |
| 129 |
<?php wp_nonce_field( 'verify_true_password_recovery', 'password_recovery_nonce_field' ); ?> |
| 130 |
</form> |
| 131 |
<?php |
| 132 |
} |
| 133 |
|
| 134 |
/** |
| 135 |
* The function for the recover password shortcode |
| 136 |
* |
| 137 |
*/ |
| 138 |
function wppb_front_end_password_recovery(){ |
| 139 |
global $wppb_shortcode_on_front; |
| 140 |
$wppb_shortcode_on_front = true; |
| 141 |
$message = $messageNo = $message2 = $messageNo2 = $linkLoginName = $linkKey = ''; |
| 142 |
|
| 143 |
global $wpdb; |
| 144 |
|
| 145 |
ob_start(); |
| 146 |
|
| 147 |
|
| 148 |
// If the user entered an email/username, process the request |
| 149 |
if ( 'POST' == $_SERVER['REQUEST_METHOD'] && !empty( $_POST['action'] ) && $_POST['action'] == 'recover_password' && wp_verify_nonce($_POST['password_recovery_nonce_field'],'verify_true_password_recovery') ) { |
| 150 |
|
| 151 |
$postedData = $_POST['username_email']; //we get the raw data |
| 152 |
//check to see if it's an e-mail (and if this is valid/present in the database) or is a username |
| 153 |
|
| 154 |
|
| 155 |
// if we do not have an email in the posted date we try to get the email for that user |
| 156 |
if( !is_email( $postedData ) ){ |
| 157 |
if (username_exists($postedData)){ |
| 158 |
$query = $wpdb->get_results( $wpdb->prepare( "SELECT * FROM $wpdb->users WHERE user_login= %s", $postedData ) ); |
| 159 |
if( !empty( $query[0] ) ){ |
| 160 |
$postedData = $query[0]->user_email; |
| 161 |
} |
| 162 |
} |
| 163 |
else{ |
| 164 |
$message = __( 'The username entered wasn\'t found in the database!', 'profilebuilder').'<br/>'.__('Please check that you entered the correct username.', 'profilebuilder' ); |
| 165 |
$message = apply_filters( 'wppb_recover_password_sent_message4', $message ); |
| 166 |
$messageNo = '4'; |
| 167 |
} |
| 168 |
} |
| 169 |
|
| 170 |
// we should have an email by this point |
| 171 |
if ( is_email( $postedData ) ){ |
| 172 |
if ( email_exists( $postedData ) ){ |
| 173 |
$retVal = wppb_check_for_unapproved_user($postedData, 'user_email'); |
| 174 |
if ($retVal[0] != ''){ |
| 175 |
$message = $retVal[0]; |
| 176 |
$messageNo = $retVal [1]; |
| 177 |
|
| 178 |
}else{ |
| 179 |
$message = sprintf( __( 'Check your e-mail for the confirmation link.', 'profilebuilder'), $postedData ); |
| 180 |
$message = apply_filters( 'wppb_recover_password_sent_message1', $message, $postedData ); |
| 181 |
$messageNo = '1'; |
| 182 |
|
| 183 |
//verify e-mail validity |
| 184 |
$query = $wpdb->get_results( $wpdb->prepare( "SELECT * FROM $wpdb->users WHERE user_email= %s", $postedData ) ); |
| 185 |
if( !empty( $query[0] ) ){ |
| 186 |
$requestedUserID = $query[0]->ID; |
| 187 |
$requestedUserLogin = $query[0]->user_login; |
| 188 |
$requestedUserEmail = $query[0]->user_email; |
| 189 |
|
| 190 |
//search if there is already an activation key present, if not create one |
| 191 |
$key = wppb_retrieve_activation_key( $requestedUserLogin ); |
| 192 |
|
| 193 |
//send primary email message |
| 194 |
$recoveruserMailMessage1 = sprintf( __('Someone requested that the password be reset for the following account: <b>%1$s</b><br/>If this was a mistake, just ignore this email and nothing will happen.<br/>To reset your password, visit the following link:%2$s', 'profilebuilder'), $requestedUserLogin, '<a href="'.add_query_arg( array( 'loginName' => $requestedUserLogin, 'key' => $key ), wppb_curpageurl() ).'">'.add_query_arg( array( 'loginName' => $requestedUserLogin, 'key' => $key ), wppb_curpageurl() ).'</a>'); |
| 195 |
$recoveruserMailMessage1 = apply_filters( 'wppb_recover_password_message_content_sent_to_user1', $recoveruserMailMessage1, $requestedUserID, $requestedUserLogin ); |
| 196 |
|
| 197 |
$recoveruserMailMessageTitle1 = sprintf(__('Password Reset from "%1$s"', 'profilebuilder'), $blogname = wp_specialchars_decode(get_option('blogname'), ENT_QUOTES)); |
| 198 |
$recoveruserMailMessageTitle1 = apply_filters('wppb_recover_password_message_title_sent_to_user1', $recoveruserMailMessageTitle1); |
| 199 |
|
| 200 |
//we add this filter to enable html encoding |
| 201 |
add_filter('wp_mail_content_type',create_function('', 'return "text/html"; ')); |
| 202 |
//send mail to the user notifying him of the reset request |
| 203 |
if (trim($recoveruserMailMessageTitle1) != ''){ |
| 204 |
$sent = wp_mail($requestedUserEmail, $recoveruserMailMessageTitle1, $recoveruserMailMessage1); |
| 205 |
if ($sent === false){ |
| 206 |
$message = '<b>'. __( 'ERROR', 'profilebuilder' ) .': </b>' . sprintf( __( 'There was an error while trying to send the activation link to %1$s!', 'profilebuilder' ), $postedData ); |
| 207 |
$message = apply_filters( 'wppb_recover_password_sent_message_error_sending', $message ); |
| 208 |
$messageNo = '5'; |
| 209 |
} |
| 210 |
} |
| 211 |
} |
| 212 |
} |
| 213 |
|
| 214 |
}elseif ( !email_exists( $postedData ) ){ |
| 215 |
$message = __('The email address entered wasn\'t found in the database!', 'profilebuilder').'<br/>'.__('Please check that you entered the correct email address.', 'profilebuilder'); |
| 216 |
$message = apply_filters('wppb_recover_password_sent_message2', $message); |
| 217 |
$messageNo = '2'; |
| 218 |
} |
| 219 |
} |
| 220 |
|
| 221 |
} |
| 222 |
// If the user used the correct key-code, update his/her password |
| 223 |
elseif ( 'POST' == $_SERVER['REQUEST_METHOD'] && !empty( $_POST['action2'] ) && $_POST['action2'] == 'recover_password2' && wp_verify_nonce( $_POST['password_recovery_nonce_field2'], 'verify_true_password_recovery2_'.$_POST['userData'] ) ) { |
| 224 |
|
| 225 |
$wppb_generalSettings = get_option( 'wppb_general_settings' ); |
| 226 |
|
| 227 |
if( ( $_POST['passw1'] == $_POST['passw2'] ) && ( !empty( $_POST['passw1'] ) && !empty( $_POST['passw2'] ) ) ){ |
| 228 |
if( !empty( $wppb_generalSettings['minimum_password_length'] ) || ( isset( $_POST['wppb_password_strength'] ) && !empty( $wppb_generalSettings['minimum_password_strength'] ) ) ){ |
| 229 |
$message2 = ''; |
| 230 |
if( wppb_check_password_length( $_POST['passw1'] ) ){ |
| 231 |
$message2 .= __( "<br/>The password must have the minimum length of ". $wppb_generalSettings['minimum_password_length'] ." characters<br/>", "profilebuilder" ); |
| 232 |
$messageNo2 = '2'; |
| 233 |
} |
| 234 |
if( wppb_check_password_strength() ){ |
| 235 |
$message2 .= __( "<br/>The password must have a minimum strength of ". wppb_check_password_strength(), "profilebuilder" ); |
| 236 |
$messageNo2 = '2'; |
| 237 |
} |
| 238 |
} |
| 239 |
|
| 240 |
if( $messageNo2 != 2 ){ |
| 241 |
|
| 242 |
$message2 = __( 'Your password has been successfully changed!', 'profilebuilder' ); |
| 243 |
$messageNo2 = '1'; |
| 244 |
|
| 245 |
$userID = $_POST['userData']; |
| 246 |
$new_pass = $_POST['passw1']; |
| 247 |
|
| 248 |
//update the new password and delete the key |
| 249 |
do_action( 'wppb_password_reset', $userID, $new_pass ); |
| 250 |
|
| 251 |
wp_set_password( $new_pass, $userID ); |
| 252 |
|
| 253 |
$user_info = get_userdata( $userID ); |
| 254 |
|
| 255 |
//send secondary mail to the user containing the username and the new password |
| 256 |
$recoveruserMailMessage2 = sprintf( __( 'You have successfully reset your password to: %1$s', 'profilebuilder' ), $new_pass ); |
| 257 |
$recoveruserMailMessage2 = apply_filters( 'wppb_recover_password_message_content_sent_to_user2', $recoveruserMailMessage2, $user_info->user_login ); |
| 258 |
|
| 259 |
$recoveruserMailMessageTitle2 = sprintf( __('Password Successfully Reset for %1$s on "%2$s"', 'profilebuilder' ), $user_info->user_login, $blogname = wp_specialchars_decode( get_option('blogname'), ENT_QUOTES ) ); |
| 260 |
$recoveruserMailMessageTitle2 = apply_filters( 'wppb_recover_password_message_title_sent_to_user2', $recoveruserMailMessageTitle2 ); |
| 261 |
|
| 262 |
//we add this filter to enable html encoding |
| 263 |
add_filter( 'wp_mail_content_type',create_function( '', 'return "text/html"; ') ); |
| 264 |
|
| 265 |
//send mail to the user notifying him of the reset request |
| 266 |
if ( trim( $recoveruserMailMessageTitle2 ) != '' ) |
| 267 |
wp_mail( $user_info->user_email, $recoveruserMailMessageTitle2, $recoveruserMailMessage2 ); |
| 268 |
|
| 269 |
//send email to admin |
| 270 |
$recoveradminMailMessage = sprintf( __( '%1$s has requested a password change via the password reset feature.<br/>His/her new password is:%2$s', 'profilebuilder' ), $user_info->user_login, $_POST['passw1'] ); |
| 271 |
$recoveradminMailMessage = apply_filters( 'wppb_recover_password_message_content_sent_to_admin', $recoveradminMailMessage ); |
| 272 |
|
| 273 |
$recoveradminMailMessageTitle = sprintf( __( 'Password Successfully Reset for %1$s on "%2$s"', 'profilebuilder' ), $user_info->user_login, $blogname = wp_specialchars_decode( get_option('blogname'), ENT_QUOTES ) ); |
| 274 |
$recoveradminMailMessageTitle = apply_filters( 'wppb_recover_password_message_title_sent_to_admin', $recoveradminMailMessageTitle ); |
| 275 |
|
| 276 |
|
| 277 |
//we disable the feature to send the admin a notification mail but can be still used using filters |
| 278 |
$recoveradminMailMessageTitle = ''; |
| 279 |
$recoveradminMailMessageTitle = apply_filters( 'wppb_recover_password_message_title_sent_to_admin', $recoveradminMailMessageTitle ); |
| 280 |
|
| 281 |
//we add this filter to enable html encoding |
| 282 |
add_filter('wp_mail_content_type',create_function('', 'return "text/html"; ')); |
| 283 |
//send mail to the admin notifying him of of a user with a password reset request |
| 284 |
if (trim($recoveradminMailMessageTitle) != '') |
| 285 |
wp_mail(get_option('admin_email'), $recoveradminMailMessageTitle, $recoveradminMailMessage); |
| 286 |
} |
| 287 |
} |
| 288 |
else{ |
| 289 |
$message2 = __( 'The entered passwords don\'t match!', 'profilebuilder' ); |
| 290 |
$messageNo2 = '2'; |
| 291 |
} |
| 292 |
|
| 293 |
} |
| 294 |
|
| 295 |
?> |
| 296 |
|
| 297 |
<div class="wppb_holder" id="wppb-recover-password"> |
| 298 |
|
| 299 |
<?php |
| 300 |
// use this action hook to add extra content before the password recovery form |
| 301 |
do_action( 'wppb_before_recover_password_fields' ); |
| 302 |
|
| 303 |
//this is the part that handles the actual recovery |
| 304 |
if( isset( $_GET['submitted'] ) && isset( $_GET['loginName'] ) && isset( $_GET['key'] ) ){ |
| 305 |
//get the login name and key and verify if they match the ones in the database |
| 306 |
|
| 307 |
$key = $_GET['key']; |
| 308 |
$login = $_GET['loginName']; |
| 309 |
|
| 310 |
$user = $wpdb->get_row( $wpdb->prepare( "SELECT * FROM $wpdb->users WHERE user_activation_key = %s AND user_login = %s", $key, $login ) ); |
| 311 |
|
| 312 |
if( !empty( $user ) ){ |
| 313 |
//check if the "finalAction" variable is not in the address bar, if it is, don't display the form anymore |
| 314 |
if( isset( $_GET['finalAction'] ) && ( $_GET['finalAction'] == 'yes' ) ){ |
| 315 |
if( $messageNo2 == '2' ){ |
| 316 |
echo apply_filters( 'wppb_recover_password_password_changed_message2', '<p class="wppb-error">'.$message2.'</p>', $message2 ); |
| 317 |
|
| 318 |
wppb_create_recover_password_form( $user, $_POST ); |
| 319 |
|
| 320 |
}elseif( $messageNo2 == '1' ) |
| 321 |
echo apply_filters( 'wppb_recover_password_password_changed_message1', '<p class="wppb-success">'.$message2.'</p>', $message2 ); |
| 322 |
|
| 323 |
}else{ |
| 324 |
wppb_create_recover_password_form( $user, $_POST ); |
| 325 |
} |
| 326 |
}else{ |
| 327 |
if( $messageNo2 == '1' ) |
| 328 |
echo apply_filters( 'wppb_recover_password_password_changed_message1', '<p class="wppb-success">'.$message2.'</p>', $message2 ); |
| 329 |
|
| 330 |
elseif( $messageNo2 == '2' ) |
| 331 |
echo apply_filters( 'wppb_recover_password_password_changed_message2', '<p class="wppb-error">'.$message2.'</p>', $message2 ); |
| 332 |
|
| 333 |
else |
| 334 |
echo apply_filters( 'wppb_recover_password_invalid_key_message', '<p class="wppb-warning"><b>'.__( 'ERROR:', 'profilebuilder' ).'</b>'.__( 'Invalid key!', 'profilebuilder' ).'</p>' ); |
| 335 |
} |
| 336 |
|
| 337 |
}else{ |
| 338 |
//display error message and the form |
| 339 |
if (($messageNo == '') || ($messageNo == '2') || ($messageNo == '4')){ |
| 340 |
echo apply_filters( 'wppb_recover_password_displayed_message1', '<p class="wppb-warning">'.$message.'</p>' ); |
| 341 |
|
| 342 |
wppb_create_generate_password_form( $_POST ); |
| 343 |
|
| 344 |
}elseif (($messageNo == '5') || ($messageNo == '6')) |
| 345 |
echo apply_filters( 'wppb_recover_password_displayed_message1', '<p class="wppb-warning">'.$message.'</p>' ); |
| 346 |
|
| 347 |
else |
| 348 |
echo apply_filters( 'wppb_recover_password_displayed_message2', '<p class="wppb-success">'.$message.'</p>' ); //display success message |
| 349 |
} |
| 350 |
|
| 351 |
// use this action hook to add extra content after the password recovery form. |
| 352 |
do_action( 'wppb_after_recover_password_fields' ); |
| 353 |
?> |
| 354 |
</div> |
| 355 |
|
| 356 |
<?php |
| 357 |
$output = ob_get_contents(); |
| 358 |
ob_end_clean(); |
| 359 |
|
| 360 |
return $output; |
| 361 |
} |
