| 1 |
<?php |
| 2 |
// add hidden input to our form to identify that is a profile builder form |
| 3 |
function wppb_login_form_bottom( $form_part, $args ){ |
| 4 |
// we set this id in the wp_login_form() function |
| 5 |
if( $args['id_submit'] == 'wppb-submit' ){ |
| 6 |
if( in_the_loop() ) |
| 7 |
$form_location = 'page'; |
| 8 |
else |
| 9 |
$form_location = 'widget'; |
| 10 |
|
| 11 |
$form_part = '<input type="hidden" name="wppb_login" value="true"/>'; |
| 12 |
$form_part .= '<input type="hidden" name="wppb_form_location" value="'. $form_location .'"/>'; |
| 13 |
|
| 14 |
$form_part .= '<input type="hidden" name="wppb_request_url" value="'. esc_url( wppb_curpageurl() ).'"/>'; |
| 15 |
$form_part .= '<input type="hidden" name="wppb_lostpassword_url" value="'.esc_url( $args['lostpassword_url'] ).'"/>'; |
| 16 |
$form_part .= '<input type="hidden" name="wppb_redirect_priority" value="'. esc_attr( isset( $args['redirect_priority'] ) ? $args['redirect_priority'] : '' ) .'"/>'; |
| 17 |
$form_part .= '<input type="hidden" name="wppb_referer_url" value="'.esc_url( isset( $_SERVER['HTTP_REFERER'] ) ? $_SERVER['HTTP_REFERER'] : '' ).'"/>'; |
| 18 |
$form_part .= wp_nonce_field( 'wppb_login', 'CSRFToken' ); |
| 19 |
} |
| 20 |
|
| 21 |
$form_part .= '<input type="hidden" name="wppb_redirect_check" value="true"/>'; |
| 22 |
|
| 23 |
return $form_part; |
| 24 |
} |
| 25 |
add_filter( 'login_form_bottom', 'wppb_login_form_bottom', 10, 2 ); |
| 26 |
|
| 27 |
// when email login is enabled we need to change the post data for the username |
| 28 |
function wppb_change_login_with_email(){ |
| 29 |
if( !empty( $_POST['log'] ) ){ |
| 30 |
// only do this for our form |
| 31 |
if( isset( $_POST['wppb_login'] ) ){ |
| 32 |
global $wpdb, $_POST, $wp_version; |
| 33 |
// apply filter to allow stripping slashes if necessary |
| 34 |
$_POST['log'] = apply_filters( 'wppb_before_processing_email_from_forms', $_POST['log'] ); |
| 35 |
|
| 36 |
/* since version 4.5 there is in the core the option to login with email so we don't need the bellow code but for backward compatibility we will keep it */ |
| 37 |
if( version_compare( $wp_version, '4.5.0' ) >= 0 ) |
| 38 |
return; |
| 39 |
|
| 40 |
$wppb_generalSettings = get_option( 'wppb_general_settings' ); |
| 41 |
|
| 42 |
// if this setting is active, the posted username is, in fact the user's email |
| 43 |
if( isset( $wppb_generalSettings['loginWith'] ) && ( $wppb_generalSettings['loginWith'] == 'email' ) ){ |
| 44 |
$username = $wpdb->get_var( $wpdb->prepare( "SELECT user_login FROM $wpdb->users WHERE user_email= %s LIMIT 1", sanitize_email( $_POST['log'] ) ) ); |
| 45 |
|
| 46 |
if( !empty( $username ) ) |
| 47 |
$_POST['log'] = $username; |
| 48 |
|
| 49 |
else { |
| 50 |
// if we don't have a username for the email entered we can't have an empty username because we will receive a field empty error |
| 51 |
$_POST['log'] = 'this_is_an_invalid_email'.time(); |
| 52 |
} |
| 53 |
} |
| 54 |
|
| 55 |
// if this setting is active, the posted username is, in fact the user's email or username |
| 56 |
if( isset( $wppb_generalSettings['loginWith'] ) && ( $wppb_generalSettings['loginWith'] == 'usernameemail' ) ) { |
| 57 |
if( is_email( $_POST['log'] ) ) { |
| 58 |
$username = $wpdb->get_var( $wpdb->prepare( "SELECT user_login FROM $wpdb->users WHERE user_email= %s LIMIT 1", sanitize_email( $_POST['log'] ) ) ); |
| 59 |
} else { |
| 60 |
$username = $_POST['log']; |
| 61 |
} |
| 62 |
|
| 63 |
if( !empty( $username ) ) |
| 64 |
$_POST['log'] = $username; |
| 65 |
|
| 66 |
else { |
| 67 |
// if we don't have a username for the email entered we can't have an empty username because we will receive a field empty error |
| 68 |
$_POST['log'] = 'this_is_an_invalid_email'.time(); |
| 69 |
} |
| 70 |
} |
| 71 |
} |
| 72 |
} |
| 73 |
} |
| 74 |
add_action( 'login_init', 'wppb_change_login_with_email' ); |
| 75 |
|
| 76 |
/** |
| 77 |
* Remove email login when username login is selected |
| 78 |
* inspiration from https://wordpress.org/plugins/no-login-by-email-address/ |
| 79 |
*/ |
| 80 |
$wppb_generalSettings = get_option( 'wppb_general_settings' ); |
| 81 |
if( isset( $wppb_generalSettings['loginWith'] ) && ( $wppb_generalSettings['loginWith'] == 'username' ) ) { |
| 82 |
function wppb_login_username_label() |
| 83 |
{ |
| 84 |
add_filter('gettext', 'wppb_login_username_label_change', 20, 3); |
| 85 |
function wppb_login_username_label_change($translated_text, $text, $domain) |
| 86 |
{ |
| 87 |
if ($text === 'Username or Email') { |
| 88 |
$translated_text = __( 'Username', 'profile-builder' ); |
| 89 |
} |
| 90 |
return $translated_text; |
| 91 |
} |
| 92 |
} |
| 93 |
|
| 94 |
add_action('login_head', 'wppb_login_username_label'); |
| 95 |
|
| 96 |
/** |
| 97 |
* Filter wp_login_form username default |
| 98 |
* |
| 99 |
*/ |
| 100 |
function wppb_change_login_username_label($defaults) |
| 101 |
{ |
| 102 |
$defaults['label_username'] = __( 'Username', 'profile-builder' ); |
| 103 |
return $defaults; |
| 104 |
} |
| 105 |
|
| 106 |
add_filter('login_form_defaults', 'wppb_change_login_username_label'); |
| 107 |
|
| 108 |
/** |
| 109 |
* Remove email/password authentication |
| 110 |
* |
| 111 |
*/ |
| 112 |
remove_filter('authenticate', 'wp_authenticate_email_password', 20); |
| 113 |
} |
| 114 |
|
| 115 |
// login redirect filter. used to redirect from wp-login.php if it errors out |
| 116 |
function wppb_login_redirect( $redirect_to, $requested_redirect_to, $user ){ |
| 117 |
// custom redirect after login on default wp login form |
| 118 |
if( ! isset( $_POST['wppb_login'] ) && ! is_wp_error( $user ) ) { |
| 119 |
// we don't have an error make sure to remove the error from the query arg |
| 120 |
$redirect_to = remove_query_arg( 'loginerror', $redirect_to ); |
| 121 |
|
| 122 |
// CHECK FOR REDIRECT |
| 123 |
$redirect_to = wppb_get_redirect_url( 'normal', 'after_login', $redirect_to, $user ); |
| 124 |
$redirect_to = apply_filters( 'wppb_after_login_redirect_url', $redirect_to ); |
| 125 |
} |
| 126 |
|
| 127 |
// if login action initialized by our form |
| 128 |
if( isset( $_POST['wppb_login'] ) ){ |
| 129 |
if( is_wp_error( $user ) ) { |
| 130 |
// if we don't have a successful login we must redirect to the url of the form, so make sure this happens |
| 131 |
$redirect_to = esc_url_raw( $_POST['wppb_request_url'] ); |
| 132 |
$request_form_location = sanitize_text_field( $_POST['wppb_form_location'] ); |
| 133 |
$error_string = $user->get_error_message(); |
| 134 |
|
| 135 |
$wppb_generalSettings = get_option('wppb_general_settings'); |
| 136 |
|
| 137 |
if (isset($wppb_generalSettings['loginWith'])) { |
| 138 |
$LostPassURL = site_url('/wp-login.php?action=lostpassword'); |
| 139 |
|
| 140 |
// if the Login shortcode has a lostpassword argument set, give the lost password error link that value |
| 141 |
if (!empty($_POST['wppb_lostpassword_url'])) { |
| 142 |
if ( wppb_check_missing_http( $_POST['wppb_lostpassword_url'] ) ) $LostPassURL = "http://" . $_POST['wppb_lostpassword_url']; |
| 143 |
else $LostPassURL = $_POST['wppb_lostpassword_url']; |
| 144 |
} |
| 145 |
|
| 146 |
//apply filter to allow changing Lost your Password link |
| 147 |
$LostPassURL = apply_filters('wppb_pre_login_url_filter', $LostPassURL); |
| 148 |
|
| 149 |
if ($user->get_error_code() == 'incorrect_password') { |
| 150 |
$error_string = '<strong>' . __('ERROR', 'profile-builder') . '</strong>: ' . __('The password you entered is incorrect.', 'profile-builder') . ' '; |
| 151 |
$error_string .= '<a href="' . esc_url( $LostPassURL ) . '" title="' . __('Password Lost and Found.', 'profile-builder') . '">' . __('Lost your password', 'profile-builder') . '</a>?'; |
| 152 |
|
| 153 |
// change the recover password link |
| 154 |
$error_string = str_replace(site_url('/wp-login.php?action=lostpassword'), $LostPassURL, $error_string); |
| 155 |
} |
| 156 |
if ($user->get_error_code() == 'invalid_username') { |
| 157 |
$error_string = '<strong>' . __('ERROR', 'profile-builder') . '</strong>: ' . __('Invalid username.', 'profile-builder') . ' '; |
| 158 |
$error_string .= '<a href="' . esc_url( $LostPassURL ) . '" title="' . __('Password Lost and Found.', 'profile-builder') . '">' . __('Lost your password', 'profile-builder') . '</a>?'; |
| 159 |
} |
| 160 |
// if login with email is enabled change the word username with email |
| 161 |
if ($wppb_generalSettings['loginWith'] == 'email') |
| 162 |
$error_string = str_replace( __('username','profile-builder'), __('email','profile-builder'), $error_string); |
| 163 |
|
| 164 |
// if login with username and email is enabled change the word username with username or email |
| 165 |
if ($wppb_generalSettings['loginWith'] == 'usernameemail') |
| 166 |
$error_string = str_replace( __('username','profile-builder'), __('username or email','profile-builder'), $error_string); |
| 167 |
|
| 168 |
} |
| 169 |
// if the error string is empty it means that none of the fields were completed |
| 170 |
if (empty($error_string)) { |
| 171 |
$error_string = '<strong>' . __('ERROR', 'profile-builder') . '</strong>: ' . __('Both fields are empty.', 'profile-builder') . ' '; |
| 172 |
$error_string = apply_filters('wppb_login_empty_fields_error_message', $error_string); |
| 173 |
} |
| 174 |
|
| 175 |
$error_string = apply_filters('wppb_login_wp_error_message', $error_string, $user); |
| 176 |
|
| 177 |
// encode the error string and send it as a GET parameter |
| 178 |
$arr_params = array('loginerror' => urlencode(base64_encode($error_string)), 'request_form_location' => $request_form_location); |
| 179 |
$redirect_to = add_query_arg($arr_params, $redirect_to); |
| 180 |
wp_safe_redirect($redirect_to); |
| 181 |
} |
| 182 |
else{ |
| 183 |
// we don't have an error make sure to remove the error from the query arg |
| 184 |
$redirect_to = remove_query_arg( 'loginerror', $redirect_to ); |
| 185 |
|
| 186 |
// CHECK FOR REDIRECT |
| 187 |
$redirect_to = wppb_get_redirect_url( sanitize_text_field( $_POST['wppb_redirect_priority'] ), 'after_login', $redirect_to, $user ); |
| 188 |
$redirect_to = apply_filters( 'wppb_after_login_redirect_url', $redirect_to ); |
| 189 |
} |
| 190 |
} |
| 191 |
|
| 192 |
return $redirect_to; |
| 193 |
} |
| 194 |
add_filter( 'login_redirect', 'wppb_login_redirect', 10, 3 ); |
| 195 |
|
| 196 |
|
| 197 |
/* shortcode function */ |
| 198 |
function wppb_front_end_login( $atts ){ |
| 199 |
/* define a global so we now we have the shortcode login present */ |
| 200 |
global $wppb_login_shortcode; |
| 201 |
$wppb_login_shortcode = true; |
| 202 |
|
| 203 |
extract( shortcode_atts( array( 'display' => true, 'redirect' => '', 'redirect_url' => '', 'logout_redirect_url' => wppb_curpageurl(), 'register_url' => '', 'lostpassword_url' => '', 'redirect_priority' => 'normal' ), $atts ) ); |
| 204 |
|
| 205 |
$wppb_generalSettings = get_option('wppb_general_settings'); |
| 206 |
|
| 207 |
if( !is_user_logged_in() ){ |
| 208 |
// set up the form arguments |
| 209 |
$form_args = array( 'echo' => false, 'id_submit' => 'wppb-submit' ); |
| 210 |
|
| 211 |
// maybe set up the redirect argument |
| 212 |
if( ! empty( $redirect ) ) { |
| 213 |
$redirect_url = $redirect; |
| 214 |
} |
| 215 |
|
| 216 |
if ( ! empty( $redirect_url ) ) { |
| 217 |
if( $redirect_priority == 'top' ) { |
| 218 |
$form_args['redirect_priority'] = 'top'; |
| 219 |
} else { |
| 220 |
$form_args['redirect_priority'] = 'normal'; |
| 221 |
} |
| 222 |
|
| 223 |
$form_args['redirect'] = trim( $redirect_url ); |
| 224 |
} |
| 225 |
|
| 226 |
// change the label argument for username is login with email is enabled |
| 227 |
if ( isset( $wppb_generalSettings['loginWith'] ) && ( $wppb_generalSettings['loginWith'] == 'email' ) ) |
| 228 |
$form_args['label_username'] = __( 'Email', 'profile-builder' ); |
| 229 |
|
| 230 |
if ( isset( $wppb_generalSettings['loginWith'] ) && ( $wppb_generalSettings['loginWith'] == 'username' ) ) |
| 231 |
$form_args['label_username'] = __( 'Username', 'profile-builder' ); |
| 232 |
|
| 233 |
// change the label argument for username on login with username or email when Username and Email is enabled |
| 234 |
if ( isset( $wppb_generalSettings['loginWith'] ) && ( $wppb_generalSettings['loginWith'] == 'usernameemail' ) ) |
| 235 |
$form_args['label_username'] = __( 'Username or Email', 'profile-builder' ); |
| 236 |
|
| 237 |
// initialize our form variable |
| 238 |
$login_form = ''; |
| 239 |
|
| 240 |
// display our login errors |
| 241 |
if( isset( $_GET['loginerror'] ) || isset( $_POST['loginerror'] ) ){ |
| 242 |
$loginerror = isset( $_GET['loginerror'] ) ? $_GET['loginerror'] : $_POST['loginerror']; |
| 243 |
$loginerror = '<p class="wppb-error">'. wp_kses_post( urldecode( base64_decode( $loginerror ) ) ) .'</p><!-- .error -->'; |
| 244 |
if( isset( $_GET['request_form_location'] ) ){ |
| 245 |
if( $_GET['request_form_location'] == 'widget' && !in_the_loop() ){ |
| 246 |
$login_form .= $loginerror; |
| 247 |
} |
| 248 |
elseif( $_GET['request_form_location'] == 'page' && in_the_loop() ){ |
| 249 |
$login_form .= $loginerror; |
| 250 |
} |
| 251 |
} |
| 252 |
} |
| 253 |
// build our form |
| 254 |
$login_form .= '<div id="wppb-login-wrap" class="wppb-user-forms">'; |
| 255 |
$form_args['lostpassword_url'] = $lostpassword_url; |
| 256 |
$login_form .= wp_login_form( apply_filters( 'wppb_login_form_args', $form_args ) ); |
| 257 |
|
| 258 |
if ((!empty($register_url)) || (!empty($lostpassword_url))) { |
| 259 |
$login_form .= '<p class="login-register-lost-password">'; |
| 260 |
$i = 0; |
| 261 |
if (!empty($register_url)) { |
| 262 |
if ( wppb_check_missing_http( $register_url ) ) $register_url = "http://" . $register_url; |
| 263 |
$login_form .= '<a href="' . esc_url($register_url) . '">'. apply_filters('wppb_login_register_text', __('Register','profile-builder')) .'</a>'; |
| 264 |
$i++; |
| 265 |
} |
| 266 |
if (!empty($lostpassword_url)) { |
| 267 |
if ($i != 0) $login_form .= ' | '; |
| 268 |
if ( wppb_check_missing_http( $lostpassword_url ) ) $lostpassword_url = "http://" . $lostpassword_url; |
| 269 |
$login_form .= '<a href="'. esc_url($lostpassword_url) .'">'. apply_filters('wppb_login_lostpass_text', __('Lost your password?','profile-builder')) .'</a>'; |
| 270 |
} |
| 271 |
$login_form .= '</p>'; |
| 272 |
} |
| 273 |
|
| 274 |
$login_form .= apply_filters( 'wppb_login_form_bottom', '', $form_args ); |
| 275 |
|
| 276 |
$login_form .= '</div>'; |
| 277 |
return $login_form; |
| 278 |
|
| 279 |
}else{ |
| 280 |
$user_ID = get_current_user_id(); |
| 281 |
$wppb_user = get_userdata( $user_ID ); |
| 282 |
|
| 283 |
if( isset( $wppb_generalSettings['loginWith'] ) && ( $wppb_generalSettings['loginWith'] == 'email' ) ) |
| 284 |
$display_name = $wppb_user->user_email; |
| 285 |
|
| 286 |
elseif($wppb_user->display_name !== '') |
| 287 |
$display_name = $wppb_user->user_login; |
| 288 |
|
| 289 |
else |
| 290 |
$display_name = $wppb_user->display_name; |
| 291 |
|
| 292 |
if( isset( $wppb_generalSettings['loginWith'] ) && ( $wppb_generalSettings['loginWith'] == 'usernameemail' ) ) |
| 293 |
if( $wppb_user->user_login == Wordpress_Creation_Kit_PB::wck_generate_slug( trim( $wppb_user->user_email ) ) ) |
| 294 |
$display_name = $wppb_user->user_email; |
| 295 |
|
| 296 |
elseif($wppb_user->display_name !== '') |
| 297 |
$display_name = $wppb_user->user_login; |
| 298 |
|
| 299 |
else |
| 300 |
$display_name = $wppb_user->display_name; |
| 301 |
|
| 302 |
$logged_in_message = '<p class="wppb-alert">'; |
| 303 |
|
| 304 |
// CHECK FOR REDIRECT |
| 305 |
$logout_redirect_url = wppb_get_redirect_url( $redirect_priority, 'after_logout', $logout_redirect_url, $wppb_user ); |
| 306 |
$logout_redirect_url = apply_filters( 'wppb_after_logout_redirect_url', $logout_redirect_url ); |
| 307 |
|
| 308 |
$logout_url = '<a href="'.wp_logout_url( $logout_redirect_url ).'" class="wppb-logout-url" title="'.__( 'Log out of this account', 'profile-builder' ).'">'. __( 'Log out', 'profile-builder').' »</a>'; |
| 309 |
$logged_in_message .= sprintf(__( 'You are currently logged in as %1$s. %2$s', 'profile-builder' ), $display_name, $logout_url ); |
| 310 |
|
| 311 |
$logged_in_message .= '</p><!-- .wppb-alert-->'; |
| 312 |
|
| 313 |
return apply_filters( 'wppb_login_message', $logged_in_message, $wppb_user->ID, $display_name ); |
| 314 |
} |
| 315 |
} |
| 316 |
|
| 317 |
function wppb_login_security_check( $user, $password ) { |
| 318 |
|
| 319 |
if( isset( $_POST['wppb_login'] ) ) { |
| 320 |
if( ! isset( $_POST['CSRFToken'] ) || ! wp_verify_nonce( $_POST['CSRFToken'], 'wppb_login' ) ) { |
| 321 |
$errorMessage = __( 'You are not allowed to do this.', 'profile-builder' ); |
| 322 |
|
| 323 |
return new WP_Error( 'wppb_login_csrf_token_error', $errorMessage ); |
| 324 |
} |
| 325 |
} |
| 326 |
|
| 327 |
return $user; |
| 328 |
|
| 329 |
} |
| 330 |
add_filter( 'wp_authenticate_user', 'wppb_login_security_check', 10, 2 ); |
