| 1 |
<?php |
| 2 |
if ( ! defined( 'ABSPATH' ) ) exit; // Exit if accessed directly |
| 3 |
|
| 4 |
add_action( 'init', 'wppb_process_login' ); |
| 5 |
function wppb_process_login(){ |
| 6 |
|
| 7 |
if( !isset($_REQUEST['wppb_login']) ) |
| 8 |
return; |
| 9 |
|
| 10 |
do_action( 'login_init' ); |
| 11 |
do_action( "login_form_login" ); |
| 12 |
do_action( 'wppb_process_login_start' ); |
| 13 |
|
| 14 |
if( !isset( $_POST['CSRFToken-wppb'] ) || ! wp_verify_nonce( sanitize_text_field( $_POST['CSRFToken-wppb'] ), 'wppb_login' ) ) |
| 15 |
return; |
| 16 |
|
| 17 |
$secure_cookie = ''; |
| 18 |
// If the user wants ssl but the session is not ssl, force a secure cookie. |
| 19 |
if ( !empty($_POST['log']) && !force_ssl_admin() ) { |
| 20 |
$user_name = sanitize_user($_POST['log']); |
| 21 |
$user = get_user_by( 'login', $user_name ); |
| 22 |
|
| 23 |
if ( ! $user && strpos( $user_name, '@' ) ) { |
| 24 |
$user = get_user_by( 'email', $user_name ); |
| 25 |
} |
| 26 |
|
| 27 |
if ( $user ) { |
| 28 |
if ( get_user_option('use_ssl', $user->ID) ) { |
| 29 |
$secure_cookie = true; |
| 30 |
force_ssl_admin(true); |
| 31 |
} |
| 32 |
} |
| 33 |
} |
| 34 |
|
| 35 |
if ( isset( $_REQUEST['redirect_to'] ) ) { |
| 36 |
$redirect_to = esc_url_raw( $_REQUEST['redirect_to'] ); |
| 37 |
} |
| 38 |
|
| 39 |
$user = wp_signon( array(), $secure_cookie ); |
| 40 |
|
| 41 |
if ( empty( $_COOKIE[ LOGGED_IN_COOKIE ] ) ) { |
| 42 |
if ( headers_sent() ) { |
| 43 |
/* translators: 1: Browser cookie documentation URL, 2: Support forums URL */ |
| 44 |
$user = new WP_Error( 'test_cookie', sprintf( __( '<strong>ERROR:</strong> Cookies are blocked due to unexpected output. For help, please see <a href="%1$s">this documentation</a> or try the <a href="%2$s">support forums</a>.', 'profile-builder' ), |
| 45 |
'https://codex.wordpress.org/Cookies', 'https://wordpress.org/support/' ) ); |
| 46 |
} |
| 47 |
} |
| 48 |
|
| 49 |
$requested_redirect_to = isset( $_REQUEST['redirect_to'] ) ? esc_url_raw( $_REQUEST['redirect_to'] ) : ''; |
| 50 |
/** |
| 51 |
* Filters the login redirect URL. |
| 52 |
*/ |
| 53 |
$redirect_to = apply_filters( 'login_redirect', $redirect_to, $requested_redirect_to, $user ); |
| 54 |
|
| 55 |
do_action( 'wppb_process_login_end' ); |
| 56 |
|
| 57 |
if ( !is_wp_error($user) ) { |
| 58 |
if ( $redirect_to == 'wp-admin/' || $redirect_to == admin_url() ) { |
| 59 |
// If the user doesn't belong to a blog, send them to user admin. If the user can't edit posts, send them to their profile. |
| 60 |
if ( is_multisite() && !get_active_blog_for_user($user->ID) && !is_super_admin( $user->ID ) ) |
| 61 |
$redirect_to = user_admin_url(); |
| 62 |
elseif ( is_multisite() && !$user->has_cap('read') ) |
| 63 |
$redirect_to = get_dashboard_url( $user->ID ); |
| 64 |
elseif ( !$user->has_cap('edit_posts') ) |
| 65 |
$redirect_to = $user->has_cap( 'read' ) ? admin_url( 'profile.php' ) : home_url(); |
| 66 |
|
| 67 |
wp_redirect( $redirect_to ); |
| 68 |
exit(); |
| 69 |
} |
| 70 |
wp_safe_redirect($redirect_to); |
| 71 |
exit(); |
| 72 |
} |
| 73 |
else{ |
| 74 |
wp_safe_redirect($redirect_to); |
| 75 |
exit(); |
| 76 |
} |
| 77 |
} |
| 78 |
/** |
| 79 |
* Provides a simple login form |
| 80 |
* |
| 81 |
* The login format HTML is echoed by default. Pass a false value for `$echo` to return it instead. |
| 82 |
* |
| 83 |
* @param array $args { |
| 84 |
* Optional. Array of options to control the form output. Default empty array. |
| 85 |
* |
| 86 |
* @type bool $echo Whether to display the login form or return the form HTML code. |
| 87 |
* Default true (echo). |
| 88 |
* @type string $redirect URL to redirect to. Must be absolute, as in "https://example.com/mypage/". |
| 89 |
* Default is to redirect back to the request URI. |
| 90 |
* @type string $form_id ID attribute value for the form. Default 'loginform'. |
| 91 |
* @type string $label_username Label for the username or email address field. Default 'Username or Email Address'. |
| 92 |
* @type string $label_username Label for the username or email address field. Default 'Username or Email Address'. |
| 93 |
* @type string $login_username_input_type Type of input field for the username or email address. |
| 94 |
* @type string $label_remember Label for the remember field. Default 'Remember Me'. |
| 95 |
* @type string $label_log_in Label for the submit button. Default 'Log In'. |
| 96 |
* @type string $id_username ID attribute value for the username field. Default 'user_login'. |
| 97 |
* @type string $id_password ID attribute value for the password field. Default 'user_pass'. |
| 98 |
* @type string $id_remember ID attribute value for the remember field. Default 'rememberme'. |
| 99 |
* @type string $id_submit ID attribute value for the submit button. Default 'wp-submit'. |
| 100 |
* @type bool $remember Whether to display the "rememberme" checkbox in the form. |
| 101 |
* @type string $value_username Default value for the username field. Default empty. |
| 102 |
* @type bool $value_remember Whether the "Remember Me" checkbox should be checked by default. |
| 103 |
* Default false (unchecked). |
| 104 |
* |
| 105 |
* } |
| 106 |
* @return string|void String when retrieving. |
| 107 |
*/ |
| 108 |
function wppb_login_form( $args = array() ) { |
| 109 |
|
| 110 |
$default_redirect = ''; |
| 111 |
if( isset( $_SERVER['HTTP_HOST'] ) && isset( $_SERVER['REQUEST_URI'] ) ) |
| 112 |
$default_redirect = esc_url_raw( ( is_ssl() ? 'https://' : 'http://' ) . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'] ); |
| 113 |
|
| 114 |
$defaults = array( |
| 115 |
'echo' => true, |
| 116 |
// Default 'redirect' value takes the user back to the request URI. |
| 117 |
'redirect' => $default_redirect, |
| 118 |
'form_id' => 'wppb-loginform', |
| 119 |
'label_username' => __( 'Username or Email Address', 'profile-builder' ), |
| 120 |
'login_username_input_type' => 'text', |
| 121 |
'label_password' => __( 'Password', 'profile-builder' ), |
| 122 |
'label_remember' => __( 'Remember Me', 'profile-builder' ), |
| 123 |
'label_log_in' => __( 'Log In', 'profile-builder' ), |
| 124 |
'id_username' => 'user_login', |
| 125 |
'id_password' => 'user_pass', |
| 126 |
'id_remember' => 'rememberme', |
| 127 |
'id_submit' => 'wp-submit', |
| 128 |
'remember' => true, |
| 129 |
'value_username' => '', |
| 130 |
// Set 'value_remember' to true to default the "Remember me" checkbox to checked. |
| 131 |
'value_remember' => false, |
| 132 |
); |
| 133 |
|
| 134 |
/** |
| 135 |
* Filters the default login form output arguments. |
| 136 |
*/ |
| 137 |
$args = wp_parse_args( $args, apply_filters( 'login_form_defaults', $defaults ) ); |
| 138 |
|
| 139 |
/** |
| 140 |
* Filters content to display at the top of the login form. |
| 141 |
*/ |
| 142 |
$login_form_top = apply_filters( 'login_form_top', '', $args ); |
| 143 |
|
| 144 |
/** |
| 145 |
* Filters content to display in the middle of the login form. |
| 146 |
*/ |
| 147 |
$login_form_middle = apply_filters( 'login_form_middle', '', $args ); |
| 148 |
|
| 149 |
/** |
| 150 |
* Filters content to display at the bottom of the login form. |
| 151 |
*/ |
| 152 |
$login_form_bottom = apply_filters( 'login_form_bottom', '', $args ); |
| 153 |
|
| 154 |
if( in_the_loop() ) |
| 155 |
$form_location = 'page'; |
| 156 |
else |
| 157 |
$form_location = 'widget'; |
| 158 |
|
| 159 |
// if an error is being shown pass the original referer forward |
| 160 |
if( isset( $_GET['wppb_referer_url'] ) ){ |
| 161 |
$wppb_referer_url = esc_url_raw ( $_GET['wppb_referer_url'] ); |
| 162 |
} else { |
| 163 |
$wppb_referer_url = esc_url_raw ( isset( $_SERVER['HTTP_REFERER'] ) ? $_SERVER['HTTP_REFERER'] : '' ); |
| 164 |
} |
| 165 |
|
| 166 |
$form = ' |
| 167 |
<form name="' . $args['form_id'] . '" id="' . $args['form_id'] . '" action="'. esc_url( wppb_curpageurl() ) .'" method="post"> |
| 168 |
' . $login_form_top . ' |
| 169 |
<p class="wppb-form-field login-username'. apply_filters( 'wppb_login_field_extra_css_class', '', $args['id_username']) .'"> |
| 170 |
<label for="' . esc_attr( $args['id_username'] ) . '">' . esc_html( $args['label_username'] ) . '</label> |
| 171 |
<input type="' . esc_attr( $args['login_username_input_type'] ) . '" name="log" id="' . esc_attr( $args['id_username'] ) . '" class="input" value="' . esc_attr( $args['value_username'] ) . '" size="20" /> |
| 172 |
</p> |
| 173 |
<p class="wppb-form-field login-password'. apply_filters( 'wppb_login_field_extra_css_class', '', $args['id_password']) .'"> |
| 174 |
<label for="' . esc_attr( $args['id_password'] ) . '">' . esc_html( $args['label_password'] ) . '</label> |
| 175 |
<input type="password" name="pwd" id="' . esc_attr( $args['id_password'] ) . '" class="input" value="" size="20" '. apply_filters( 'wppb_login_password_extra_attributes', '' ) .'/>'; |
| 176 |
|
| 177 |
/* add the HTML for the visibility toggle */ |
| 178 |
$form .= wppb_password_visibility_toggle_html(); |
| 179 |
|
| 180 |
$form .=' |
| 181 |
</p> |
| 182 |
' . $login_form_middle . ' |
| 183 |
' . ( $args['remember'] ? '<p class="wppb-form-field login-remember"><input name="rememberme" type="checkbox" id="' . esc_attr( $args['id_remember'] ) . '" value="forever"' . ( $args['value_remember'] ? ' checked="checked"' : '' ) . ' /><label for="' . esc_attr( $args['id_remember'] ) . '">' . esc_html( $args['label_remember'] ) . '</label></p>' : '' ) . ' |
| 184 |
<p class="login-submit"> |
| 185 |
<input type="submit" name="wp-submit" id="' . esc_attr( $args['id_submit'] ) . '" class="'. esc_attr( apply_filters( 'wppb_login_submit_class', "button button-primary" ) ) . '" value="' . esc_attr( $args['label_log_in'] ) . '" /> |
| 186 |
<input type="hidden" name="redirect_to" value="' . esc_url( $args['redirect'] ) . '" /> |
| 187 |
</p> |
| 188 |
<input type="hidden" name="wppb_login" value="true"/> |
| 189 |
<input type="hidden" name="wppb_form_location" value="'. esc_attr( $form_location ) .'"/> |
| 190 |
<input type="hidden" name="wppb_request_url" value="'. esc_url( wppb_curpageurl() ).'"/> |
| 191 |
<input type="hidden" name="wppb_lostpassword_url" value="'.esc_url( $args['lostpassword_url'] ).'"/> |
| 192 |
<input type="hidden" name="wppb_redirect_priority" value="'. esc_attr( isset( $args['redirect_priority'] ) ? $args['redirect_priority'] : '' ) .'"/> |
| 193 |
<input type="hidden" name="wppb_referer_url" value="'. esc_url( $wppb_referer_url ) .'"/> |
| 194 |
'. wp_nonce_field( 'wppb_login', 'CSRFToken-wppb', true, false ) .' |
| 195 |
<input type="hidden" name="wppb_redirect_check" value="true"/> |
| 196 |
' . $login_form_bottom . ' |
| 197 |
</form>'; |
| 198 |
|
| 199 |
if ( $args['echo'] ) |
| 200 |
echo $form; /* phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped */ /* escaped above */ |
| 201 |
else |
| 202 |
return $form; |
| 203 |
} |
| 204 |
|
| 205 |
// when email login is enabled we need to change the post data for the username |
| 206 |
function wppb_change_login_with_email(){ |
| 207 |
if( !empty( $_POST['log'] ) ){ |
| 208 |
// only do this for our form |
| 209 |
if( isset( $_POST['wppb_login'] ) ){ |
| 210 |
global $wpdb, $_POST, $wp_version; |
| 211 |
// apply filter to allow stripping slashes if necessary |
| 212 |
$_POST['log'] = apply_filters( 'wppb_before_processing_email_from_forms', sanitize_text_field( $_POST['log'] ) ); |
| 213 |
|
| 214 |
/* since version 4.5 there is in the core the option to login with email so we don't need the bellow code but for backward compatibility we will keep it */ |
| 215 |
if( version_compare( $wp_version, '4.5.0' ) >= 0 && apply_filters( 'wppb_allow_login_with_username_when_is_set_to_email', false ) ) |
| 216 |
return; |
| 217 |
|
| 218 |
$wppb_generalSettings = get_option( 'wppb_general_settings' ); |
| 219 |
|
| 220 |
// if this setting is active, the posted username is, in fact the user's email |
| 221 |
if( isset( $wppb_generalSettings['loginWith'] ) && ( $wppb_generalSettings['loginWith'] == 'email' ) ){ |
| 222 |
if( !is_email( $_POST['log'] ) && !apply_filters( 'wppb_allow_login_with_username_when_is_set_to_email', false ) ){ |
| 223 |
$_POST['log'] = 'this_is_an_invalid_email' . time(); |
| 224 |
} |
| 225 |
else { |
| 226 |
$username = $wpdb->get_var($wpdb->prepare("SELECT user_login FROM $wpdb->users WHERE user_email= %s LIMIT 1", sanitize_email($_POST['log']))); |
| 227 |
|
| 228 |
if (!empty($username)) |
| 229 |
$_POST['log'] = $username; |
| 230 |
|
| 231 |
else { |
| 232 |
// if we don't have a username for the email entered we can't have an empty username because we will receive a field empty error |
| 233 |
$_POST['log'] = 'this_is_an_invalid_email' . time(); |
| 234 |
} |
| 235 |
} |
| 236 |
} |
| 237 |
|
| 238 |
// if this setting is active, the posted username is, in fact the user's email or username |
| 239 |
if( isset( $wppb_generalSettings['loginWith'] ) && ( $wppb_generalSettings['loginWith'] == 'usernameemail' ) ) { |
| 240 |
if( is_email( $_POST['log'] ) ) { |
| 241 |
$username = $wpdb->get_var( $wpdb->prepare( "SELECT user_login FROM $wpdb->users WHERE user_email= %s LIMIT 1", sanitize_email( $_POST['log'] ) ) ); |
| 242 |
} else { |
| 243 |
$username = sanitize_user( $_POST['log'] ); |
| 244 |
} |
| 245 |
|
| 246 |
if( !empty( $username ) ) |
| 247 |
$_POST['log'] = $username; |
| 248 |
|
| 249 |
else { |
| 250 |
// if we don't have a username for the email entered we can't have an empty username because we will receive a field empty error |
| 251 |
$_POST['log'] = 'this_is_an_invalid_email'.time(); |
| 252 |
} |
| 253 |
} |
| 254 |
} |
| 255 |
} |
| 256 |
} |
| 257 |
add_action( 'login_init', 'wppb_change_login_with_email' ); |
| 258 |
|
| 259 |
function wppb_resend_confirmation_email() { |
| 260 |
if( !isset( $_GET['wppb-action'] ) || $_GET['wppb-action'] != 'resend_email_confirmation' || !isset( $_GET['email'] )) |
| 261 |
return; |
| 262 |
|
| 263 |
$user_email = base64_decode( sanitize_text_field( $_GET['email'] )); |
| 264 |
|
| 265 |
$transient_check_key = Wordpress_Creation_Kit_PB::wck_generate_slug( $user_email ); |
| 266 |
$transient_check = get_transient('wppb_confirmation_email_already_sent_'.$transient_check_key); |
| 267 |
|
| 268 |
if ( $transient_check === false ) { |
| 269 |
|
| 270 |
if ( !isset( $_GET['_wpnonce'] ) || !wp_verify_nonce(sanitize_text_field( $_GET['_wpnonce'] ), 'wppb_confirmation_url_nonce' )) |
| 271 |
return; |
| 272 |
|
| 273 |
include_once(plugin_dir_path(__FILE__) . '../features/email-confirmation/email-confirmation.php'); |
| 274 |
|
| 275 |
if ( file_exists( WPPB_PLUGIN_DIR . '/assets/lib/class-mustache-templates/class-mustache-templates.php' ) ) |
| 276 |
include_once( WPPB_PLUGIN_DIR . '/assets/lib/class-mustache-templates/class-mustache-templates.php' ); |
| 277 |
|
| 278 |
global $wpdb; |
| 279 |
$sql_result = $wpdb->get_row( $wpdb->prepare("SELECT * FROM " . $wpdb->base_prefix . "signups WHERE user_email = %s", $user_email ), ARRAY_A ); |
| 280 |
|
| 281 |
// if the email address exists in wp_signups table, resend Confirmation Email and redirect to display notification |
| 282 |
if ( $sql_result ) { |
| 283 |
wppb_signup_user_notification( sanitize_text_field( $sql_result['user_login'] ), sanitize_email( $sql_result['user_email'] ), $sql_result['activation_key'], $sql_result['meta'] ); |
| 284 |
$transient_key = Wordpress_Creation_Kit_PB::wck_generate_slug( $user_email ); |
| 285 |
set_transient('wppb_confirmation_email_already_sent_' . $transient_key, true, 900 ); |
| 286 |
$error_string = '<strong>' . __('SUCCESS: ', 'profile-builder') . '</strong>' . sprintf( __( 'Activation email sent to %s', 'profile-builder' ), sanitize_email( $_GET['email'] )); |
| 287 |
$wppb_success_message_nonce = wp_create_nonce( 'wppb_login_error_'.$error_string); |
| 288 |
$current_url = wppb_curpageurl(); |
| 289 |
$arr_params = array('loginerror' => urlencode(base64_encode($error_string)), '_wpnonce' => $wppb_success_message_nonce, 'request_form_location' => 'page', 'wppb_message_type' => 'success'); |
| 290 |
$redirect_to = add_query_arg($arr_params, $current_url); |
| 291 |
wp_safe_redirect($redirect_to); |
| 292 |
exit(); |
| 293 |
} |
| 294 |
|
| 295 |
} |
| 296 |
} |
| 297 |
add_action('init', 'wppb_resend_confirmation_email'); |
| 298 |
|
| 299 |
function wppb_change_error_message($error_message) { |
| 300 |
|
| 301 |
$wppb_generalSettings = get_option( 'wppb_general_settings' ); |
| 302 |
|
| 303 |
if (empty( $wppb_generalSettings['emailConfirmation'] ) || $wppb_generalSettings['emailConfirmation'] !== 'yes') |
| 304 |
return $error_message; |
| 305 |
|
| 306 |
if( isset( $_REQUEST['log'] ) ){ |
| 307 |
global $wpdb; |
| 308 |
$check_user = sanitize_text_field( $_REQUEST['log'] ); |
| 309 |
|
| 310 |
if ( is_email( $check_user )) |
| 311 |
$sql_result = $wpdb->get_row( $wpdb->prepare("SELECT * FROM " . $wpdb->base_prefix . "signups WHERE user_email = %s", sanitize_email( $check_user )), ARRAY_A ); |
| 312 |
else { |
| 313 |
$sql_result = $wpdb->get_row( $wpdb->prepare("SELECT * FROM " . $wpdb->base_prefix . "signups WHERE user_login = %s", sanitize_user( $check_user )), ARRAY_A ); |
| 314 |
if ( $sql_result ) |
| 315 |
$check_user = $sql_result['user_email']; |
| 316 |
} |
| 317 |
|
| 318 |
// if the email address exists in wp_signups table, display message and link to resend Confirmation Email |
| 319 |
if ( isset($sql_result) ) { |
| 320 |
$confirmation_url_nonce = wp_create_nonce( 'wppb_confirmation_url_nonce' ); |
| 321 |
$current_url = strtok( wppb_curpageurl(), '?' ); |
| 322 |
$arr_params = array('email' => base64_encode( $check_user ), 'wppb-action' => 'resend_email_confirmation', '_wpnonce' => $confirmation_url_nonce); |
| 323 |
$confirmation_url = add_query_arg($arr_params, $current_url); |
| 324 |
$error_message = '<strong>' . __('ERROR: ', 'profile-builder') . '</strong>' . sprintf( __( 'You need to confirm your Email Address before logging in! </br>To resend the Confirmation Email %1$sclick here%2$s.', 'profile-builder' ), '<a href="' . esc_url( $confirmation_url ) . '" title="Resend Confirmation Email">', '</a>' ); |
| 325 |
} |
| 326 |
} |
| 327 |
|
| 328 |
return $error_message; |
| 329 |
|
| 330 |
} |
| 331 |
add_filter('wppb_login_invalid_username_error_message', 'wppb_change_error_message'); |
| 332 |
|
| 333 |
/** |
| 334 |
* Remove email login when username login is selected |
| 335 |
* inspiration from https://wordpress.org/plugins/no-login-by-email-address/ |
| 336 |
*/ |
| 337 |
$wppb_generalSettings = get_option( 'wppb_general_settings' ); |
| 338 |
if( isset( $wppb_generalSettings['loginWith'] ) && ( $wppb_generalSettings['loginWith'] == 'username' ) ) { |
| 339 |
function wppb_login_username_label() |
| 340 |
{ |
| 341 |
add_filter('gettext', 'wppb_login_username_label_change', 20, 3); |
| 342 |
function wppb_login_username_label_change($translated_text, $text, $domain) |
| 343 |
{ |
| 344 |
if ($text === 'Username or Email') { |
| 345 |
$translated_text = __( 'Username', 'profile-builder' ); |
| 346 |
} |
| 347 |
return $translated_text; |
| 348 |
} |
| 349 |
} |
| 350 |
|
| 351 |
add_action('login_head', 'wppb_login_username_label'); |
| 352 |
|
| 353 |
/** |
| 354 |
* Filter wp_login_form username default |
| 355 |
* |
| 356 |
*/ |
| 357 |
function wppb_change_login_username_label($defaults) |
| 358 |
{ |
| 359 |
$defaults['label_username'] = __( 'Username', 'profile-builder' ); |
| 360 |
return $defaults; |
| 361 |
} |
| 362 |
|
| 363 |
add_filter('login_form_defaults', 'wppb_change_login_username_label'); |
| 364 |
|
| 365 |
/** |
| 366 |
* Remove email/password authentication |
| 367 |
* |
| 368 |
*/ |
| 369 |
remove_filter('authenticate', 'wp_authenticate_email_password', 20); |
| 370 |
} |
| 371 |
|
| 372 |
// login redirect filter. used to redirect from wp-login.php if it errors out |
| 373 |
function wppb_login_redirect( $redirect_to, $requested_redirect_to, $user ){ |
| 374 |
// custom redirect after login on default wp login form |
| 375 |
if( ! isset( $_POST['wppb_login'] ) && ! is_wp_error( $user ) ) { |
| 376 |
$original_redirect_to = $redirect_to; |
| 377 |
|
| 378 |
// we don't have an error make sure to remove the error from the query arg |
| 379 |
$redirect_to = remove_query_arg( 'loginerror', $redirect_to ); |
| 380 |
|
| 381 |
// CHECK FOR REDIRECT |
| 382 |
$redirect_to = wppb_get_redirect_url( 'normal', 'after_login', $redirect_to, $user ); |
| 383 |
$redirect_to = apply_filters( 'wppb_after_login_redirect_url', $redirect_to ); |
| 384 |
|
| 385 |
if ( $redirect_to === '' ){ |
| 386 |
$redirect_to = $original_redirect_to; |
| 387 |
} |
| 388 |
} |
| 389 |
|
| 390 |
// if login action initialized by our form |
| 391 |
if( isset( $_POST['wppb_login'] ) ){ |
| 392 |
if( is_wp_error( $user ) ) { |
| 393 |
// if we don't have a successful login we must redirect to the url of the form, so make sure this happens |
| 394 |
if( isset( $_POST['wppb_request_url'] ) ) |
| 395 |
$redirect_to = esc_url_raw( $_POST['wppb_request_url'] ); |
| 396 |
if( isset( $_POST['wppb_form_location'] ) ) |
| 397 |
$request_form_location = sanitize_text_field( $_POST['wppb_form_location'] ); |
| 398 |
$error_string = $user->get_error_message(); |
| 399 |
|
| 400 |
$wppb_generalSettings = get_option('wppb_general_settings'); |
| 401 |
|
| 402 |
if (isset($wppb_generalSettings['loginWith'])) { |
| 403 |
|
| 404 |
$lost_pass_url = site_url('/wp-login.php?action=lostpassword'); |
| 405 |
// if the Login shortcode has a lostpassword argument set, give the lost password error link that value |
| 406 |
if (!empty($_POST['wppb_lostpassword_url'])) { |
| 407 |
$lost_pass_url = esc_url_raw( $_POST['wppb_lostpassword_url'] ); |
| 408 |
if ( wppb_check_missing_http( $lost_pass_url ) ) |
| 409 |
$lost_pass_url = "http://" . $lost_pass_url; |
| 410 |
} |
| 411 |
//apply filter to allow changing Lost your Password link |
| 412 |
$lost_pass_url = apply_filters('wppb_pre_login_url_filter', $lost_pass_url); |
| 413 |
|
| 414 |
/* start building the error string */ |
| 415 |
if( in_array( $user->get_error_code(), array( 'empty_username', 'empty_password', 'invalid_username', 'incorrect_password' ) ) ) |
| 416 |
$error_string = '<strong>' . __('ERROR: ', 'profile-builder') . '</strong>'; |
| 417 |
|
| 418 |
|
| 419 |
if ( $user->get_error_code() == 'empty_password' ) { |
| 420 |
$error_string .= __( 'The password field is empty.', 'profile-builder' ) . ' '; |
| 421 |
} |
| 422 |
|
| 423 |
if ($user->get_error_code() == 'incorrect_password') { |
| 424 |
$error_string .= __('The password you entered is incorrect.', 'profile-builder') . ' '; |
| 425 |
} |
| 426 |
|
| 427 |
if ( $user->get_error_code() == 'empty_username' ) { |
| 428 |
if ($wppb_generalSettings['loginWith'] == 'email')// if login with email is enabled change the word username with email |
| 429 |
$error_string .= __('The email field is empty.', 'profile-builder') . ' '; |
| 430 |
else if( $wppb_generalSettings['loginWith'] == 'usernameemail' )// if login with username and email is enabled change the word username with username or email |
| 431 |
$error_string .= __('The username/email field is empty', 'profile-builder') . ' '; |
| 432 |
else |
| 433 |
$error_string .= __('The username field is empty', 'profile-builder') . ' '; |
| 434 |
} |
| 435 |
|
| 436 |
if ($user->get_error_code() == 'invalid_username') { |
| 437 |
if ($wppb_generalSettings['loginWith'] == 'email')// if login with email is enabled change the word username with email |
| 438 |
$error_string .= __('Invalid email.', 'profile-builder') . ' '; |
| 439 |
else if( $wppb_generalSettings['loginWith'] == 'usernameemail' )// if login with username and email is enabled change the word username with username or email |
| 440 |
$error_string .= __('Invalid username or email.', 'profile-builder') . ' '; |
| 441 |
else |
| 442 |
$error_string .= __('Invalid username.', 'profile-builder') . ' '; |
| 443 |
|
| 444 |
$error_string = apply_filters('wppb_login_invalid_username_error_message', $error_string); |
| 445 |
} |
| 446 |
|
| 447 |
if( $user->get_error_code() == 'incorrect_password' || $user->get_error_code() == 'invalid_username' && empty( $message_check = apply_filters('wppb_login_invalid_username_error_message', '' ))) |
| 448 |
$error_string .= '<a href="' . esc_url( $lost_pass_url ) . '" title="' . __('Password Lost and Found.', 'profile-builder') . '">' . __('Lost your password?', 'profile-builder') . '</a>'; |
| 449 |
|
| 450 |
} |
| 451 |
|
| 452 |
// if the error string is empty it means that none of the fields were completed |
| 453 |
if (empty($error_string) || ( in_array( 'empty_username', $user->get_error_codes() ) && in_array( 'empty_password', $user->get_error_codes() ) ) ) { |
| 454 |
$error_string = '<strong>' . __('ERROR: ', 'profile-builder') . '</strong>' . __('Both fields are empty.', 'profile-builder') . ' '; |
| 455 |
$error_string = apply_filters('wppb_login_empty_fields_error_message', $error_string); |
| 456 |
} |
| 457 |
|
| 458 |
$error_string = apply_filters('wppb_login_wp_error_message', $error_string, $user); |
| 459 |
$wppb_error_string_nonce = wp_create_nonce( 'wppb_login_error_'.$error_string ); |
| 460 |
|
| 461 |
// encode the error string and send it as a GET parameter |
| 462 |
if ( isset($_POST['wppb_referer_url']) && $_POST['wppb_referer_url'] !== '' ) { |
| 463 |
$arr_params = array('loginerror' => urlencode(base64_encode($error_string)), '_wpnonce' => $wppb_error_string_nonce, 'request_form_location' => $request_form_location, 'wppb_referer_url' => urlencode(esc_url_raw( $_POST['wppb_referer_url'] ))); |
| 464 |
} else { |
| 465 |
$arr_params = array('loginerror' => urlencode(base64_encode($error_string)), '_wpnonce' => $wppb_error_string_nonce, 'request_form_location' => $request_form_location); |
| 466 |
} |
| 467 |
|
| 468 |
if ($user->get_error_code() == 'wppb_login_auth') { |
| 469 |
$arr_params['login_auth'] = 'true'; |
| 470 |
} |
| 471 |
|
| 472 |
$redirect_to = add_query_arg($arr_params, $redirect_to); |
| 473 |
} |
| 474 |
else{ |
| 475 |
// we don't have an error make sure to remove the error from the query arg |
| 476 |
$redirect_to = remove_query_arg( 'loginerror', $redirect_to ); |
| 477 |
|
| 478 |
// CHECK FOR REDIRECT |
| 479 |
if( isset( $_POST['wppb_redirect_priority'] ) ) |
| 480 |
$redirect_to = wppb_get_redirect_url( sanitize_text_field( $_POST['wppb_redirect_priority'] ), 'after_login', $redirect_to, $user ); |
| 481 |
|
| 482 |
$redirect_to = apply_filters( 'wppb_after_login_redirect_url', $redirect_to ); |
| 483 |
|
| 484 |
// This should not be empty, if we don't have a redirect, set it to the current page URL |
| 485 |
if( empty( $redirect_to ) ) |
| 486 |
$redirect_to = wppb_curpageurl(); |
| 487 |
} |
| 488 |
} |
| 489 |
|
| 490 |
// if "wppb_message_type = success" is present the message will show up in a green box instead of red |
| 491 |
if ( isset( $_GET['wppb_message_type'] ) && $_GET['wppb_message_type'] == 'success' ) |
| 492 |
$redirect_to = remove_query_arg( 'wppb_message_type', $redirect_to ); |
| 493 |
|
| 494 |
return $redirect_to; |
| 495 |
} |
| 496 |
add_filter( 'login_redirect', 'wppb_login_redirect', 20, 3 ); |
| 497 |
|
| 498 |
|
| 499 |
/* shortcode function */ |
| 500 |
function wppb_front_end_login( $atts ){ |
| 501 |
global $wppb_shortcode_on_front; |
| 502 |
$wppb_shortcode_on_front = true; |
| 503 |
global $wppb_login_shortcode_on_front; |
| 504 |
$wppb_login_shortcode_on_front = true; |
| 505 |
/* define a global so we now we have the shortcode login present */ |
| 506 |
global $wppb_login_shortcode; |
| 507 |
$wppb_login_shortcode = true; |
| 508 |
|
| 509 |
extract( shortcode_atts( array( 'display' => true, 'redirect' => '', 'redirect_url' => '', 'logout_redirect_url' => wppb_curpageurl(), 'register_url' => '', 'lostpassword_url' => '', 'redirect_priority' => 'normal', 'show_2fa_field' => '', 'block' => false ), $atts ) ); |
| 510 |
|
| 511 |
$wppb_generalSettings = get_option('wppb_general_settings'); |
| 512 |
|
| 513 |
// check if the form is being displayed in the Elementor editor |
| 514 |
$is_elementor_edit_mode = false; |
| 515 |
if( class_exists ( '\Elementor\Plugin' ) ){ |
| 516 |
$is_elementor_edit_mode = \Elementor\Plugin::$instance->editor->is_edit_mode(); |
| 517 |
} |
| 518 |
|
| 519 |
if( !is_user_logged_in() || $is_elementor_edit_mode || $block === 'true' ){ |
| 520 |
// set up the form arguments |
| 521 |
$form_args = array( 'echo' => false, 'id_submit' => 'wppb-submit' ); |
| 522 |
|
| 523 |
// maybe set up the redirect argument |
| 524 |
if( ! empty( $redirect ) ) { |
| 525 |
$redirect_url = $redirect; |
| 526 |
} |
| 527 |
|
| 528 |
if ( ! empty( $redirect_url ) ) { |
| 529 |
if( $redirect_priority == 'top' ) { |
| 530 |
$form_args['redirect_priority'] = 'top'; |
| 531 |
} else { |
| 532 |
$form_args['redirect_priority'] = 'normal'; |
| 533 |
} |
| 534 |
|
| 535 |
$form_args['redirect'] = trim( $redirect_url ); |
| 536 |
} |
| 537 |
|
| 538 |
$form_args['login_username_input_type'] = 'text'; |
| 539 |
|
| 540 |
// change the label argument for username is login with email is enabled |
| 541 |
if ( isset( $wppb_generalSettings['loginWith'] ) && ( $wppb_generalSettings['loginWith'] == 'email' ) ) { |
| 542 |
$form_args['label_username'] = __('Email', 'profile-builder'); |
| 543 |
$form_args['login_username_input_type'] = 'email'; |
| 544 |
} |
| 545 |
|
| 546 |
if ( isset( $wppb_generalSettings['loginWith'] ) && ( $wppb_generalSettings['loginWith'] == 'username' ) ) { |
| 547 |
$form_args['label_username'] = __('Username', 'profile-builder'); |
| 548 |
} |
| 549 |
|
| 550 |
// change the label argument for username on login with username or email when Username and Email is enabled |
| 551 |
if ( isset( $wppb_generalSettings['loginWith'] ) && ( $wppb_generalSettings['loginWith'] == 'usernameemail' ) ) |
| 552 |
$form_args['label_username'] = __( 'Username or Email', 'profile-builder' ); |
| 553 |
|
| 554 |
// Check if 2fa is required |
| 555 |
if( class_exists( 'WPPB_Two_Factor_Authenticator' ) ){ |
| 556 |
$wppb_auth = new WPPB_Two_Factor_Authenticator; |
| 557 |
$wppb_two_factor_authentication_settings = get_option( 'wppb_two_factor_authentication_settings', 'not_found' ); |
| 558 |
if ( ( isset( $_GET['login_auth'] ) && $_GET['login_auth'] === 'true' ) || |
| 559 |
( ( isset($wppb_two_factor_authentication_settings['enabled']) && $wppb_two_factor_authentication_settings['enabled'] === 'yes' ) && $show_2fa_field === 'yes' ) ){ |
| 560 |
add_action( 'login_form_middle', array( $wppb_auth, 'auth_code_field') ); |
| 561 |
} |
| 562 |
} |
| 563 |
|
| 564 |
// initialize our form variable |
| 565 |
$login_form = ''; |
| 566 |
|
| 567 |
// display our login errors |
| 568 |
if( ( isset( $_GET['loginerror'] ) || isset( $_POST['loginerror'] ) ) && isset( $_GET['_wpnonce'] ) ){ |
| 569 |
$error_string = urldecode( base64_decode( isset( $_GET['loginerror'] ) ? sanitize_text_field( $_GET['loginerror'] ) : sanitize_text_field( $_POST['loginerror'] ) ) ); |
| 570 |
if( wp_verify_nonce( sanitize_text_field( $_GET['_wpnonce'] ), 'wppb_login_error_'. $error_string ) ) { |
| 571 |
if ( isset( $_GET['wppb_message_type'] ) && $_GET['wppb_message_type'] == 'success' ) |
| 572 |
$message_type = 'wppb-success'; |
| 573 |
else $message_type = 'wppb-error'; |
| 574 |
$loginerror = '<p class="'. $message_type .'">' . wp_kses_post(str_replace( '-wppb-plus-', '+', $error_string)) . '</p><!-- .error -->'; |
| 575 |
if (isset($_GET['request_form_location'])) { |
| 576 |
if ($_GET['request_form_location'] === 'widget' && !in_the_loop()) { |
| 577 |
$login_form .= $loginerror; |
| 578 |
} elseif ($_GET['request_form_location'] === 'page' && in_the_loop()) { |
| 579 |
$login_form .= $loginerror; |
| 580 |
} |
| 581 |
} |
| 582 |
} |
| 583 |
} |
| 584 |
// build our form |
| 585 |
$login_form .= '<div id="wppb-login-wrap" class="wppb-user-forms">'; |
| 586 |
|
| 587 |
if ( empty( $lostpassword_url ) ) |
| 588 |
$lostpassword_url = ( !empty( $wppb_generalSettings['lost_password_page'] ) ) ? $wppb_generalSettings['lost_password_page'] : ''; |
| 589 |
|
| 590 |
$form_args['lostpassword_url'] = $lostpassword_url; |
| 591 |
$login_form .= wppb_login_form( apply_filters( 'wppb_login_form_args', $form_args ) ); |
| 592 |
|
| 593 |
if ((!empty($register_url)) || (!empty($lostpassword_url))) { |
| 594 |
$login_form .= '<p class="login-register-lost-password">'; |
| 595 |
$i = 0; |
| 596 |
if (!empty($register_url)) { |
| 597 |
if ( wppb_check_missing_http( $register_url ) ) $register_url = "http://" . $register_url; |
| 598 |
$login_form .= '<a class="login-register" href="' . esc_url($register_url) . '">'. apply_filters('wppb_login_register_text', __('Register','profile-builder')) .'</a>'; |
| 599 |
$i++; |
| 600 |
} |
| 601 |
if (!empty($lostpassword_url)) { |
| 602 |
if ($i != 0) $login_form .= '<span class="login-separator"> | </span>'; |
| 603 |
if ( wppb_check_missing_http( $lostpassword_url ) ) $lostpassword_url = "http://" . $lostpassword_url; |
| 604 |
$login_form .= '<a class="login-lost-password" href="'. esc_url($lostpassword_url) .'">'. apply_filters('wppb_login_lostpass_text', __('Lost your password?','profile-builder')) .'</a>'; |
| 605 |
} |
| 606 |
$login_form .= '</p>'; |
| 607 |
} |
| 608 |
|
| 609 |
$login_form .= apply_filters( 'wppb_login_form_bottom', '', $form_args ); |
| 610 |
|
| 611 |
$login_form .= '</div>'; |
| 612 |
return apply_filters('wppb_login_form_before_content_output', $login_form, $form_args); |
| 613 |
|
| 614 |
}else{ |
| 615 |
$user_ID = get_current_user_id(); |
| 616 |
$wppb_user = get_userdata( $user_ID ); |
| 617 |
|
| 618 |
if( isset( $wppb_generalSettings['loginWith'] ) && ( $wppb_generalSettings['loginWith'] == 'email' ) ) |
| 619 |
$display_name = $wppb_user->user_email; |
| 620 |
|
| 621 |
elseif($wppb_user->display_name !== '') |
| 622 |
$display_name = $wppb_user->user_login; |
| 623 |
|
| 624 |
else |
| 625 |
$display_name = $wppb_user->display_name; |
| 626 |
|
| 627 |
if( isset( $wppb_generalSettings['loginWith'] ) && ( $wppb_generalSettings['loginWith'] == 'usernameemail' ) ) |
| 628 |
if( $wppb_user->user_login == Wordpress_Creation_Kit_PB::wck_generate_slug( trim( $wppb_user->user_email ) ) ) |
| 629 |
$display_name = $wppb_user->user_email; |
| 630 |
|
| 631 |
elseif($wppb_user->display_name !== '') |
| 632 |
$display_name = $wppb_user->user_login; |
| 633 |
|
| 634 |
else |
| 635 |
$display_name = $wppb_user->display_name; |
| 636 |
|
| 637 |
$logged_in_message = '<p class="wppb-alert">'; |
| 638 |
|
| 639 |
// CHECK FOR REDIRECT |
| 640 |
$logout_redirect_url = wppb_get_redirect_url( $redirect_priority, 'after_logout', $logout_redirect_url, $wppb_user ); |
| 641 |
$logout_redirect_url = apply_filters( 'wppb_after_logout_redirect_url', $logout_redirect_url ); |
| 642 |
|
| 643 |
$logout_url = '<a href="'.wp_logout_url( $logout_redirect_url ).'" class="wppb-logout-url" title="'.__( 'Log out of this account', 'profile-builder' ).'">'. __('Log out »','profile-builder').'</a>'; |
| 644 |
$logged_in_message .= sprintf(__( 'You are currently logged in as %1$s. %2$s', 'profile-builder' ), $display_name, $logout_url ); |
| 645 |
|
| 646 |
$logged_in_message .= '</p><!-- .wppb-alert-->'; |
| 647 |
|
| 648 |
return apply_filters( 'wppb_login_message', $logged_in_message, $wppb_user->ID, $display_name ); |
| 649 |
} |
| 650 |
} |
| 651 |
|
| 652 |
function wppb_login_security_check( $user, $password ) { |
| 653 |
if( apply_filters( 'wppb_enable_csrf_token_login_form', false ) ){ |
| 654 |
if (isset($_POST['wppb_login'])) { |
| 655 |
if (!isset($_POST['CSRFToken-wppb']) || !wp_verify_nonce( sanitize_text_field( $_POST['CSRFToken-wppb'] ), 'wppb_login')) { |
| 656 |
$errorMessage = __('You are not allowed to do this.', 'profile-builder'); |
| 657 |
return new WP_Error('wppb_login_csrf_token_error', $errorMessage); |
| 658 |
} |
| 659 |
} |
| 660 |
} |
| 661 |
|
| 662 |
return $user; |
| 663 |
} |
| 664 |
add_filter( 'wp_authenticate_user', 'wppb_login_security_check', 10, 2 ); |
| 665 |
|
