| 1 |
<?php |
| 2 |
if ( ! defined( 'ABSPATH' ) ) exit; // Exit if accessed directly |
| 3 |
|
| 4 |
/* |
| 5 |
wp_update_user only attempts to clear and reset cookies if it's updating the password. |
| 6 |
The php function setcookie(), used in both the cookie-clearing and cookie-resetting functions, |
| 7 |
adds to the page headers and therefore must be called within the first php tag on the page, |
| 8 |
and before the WordPress get_header() function. Since wp_update_user needs this, it must be at the beginning of the page as well. |
| 9 |
*/ |
| 10 |
/* set action to login user after password changed in edit profile */ |
| 11 |
add_action( 'init', 'wppb_autologin_after_password_changed' ); |
| 12 |
function wppb_autologin_after_password_changed(){ |
| 13 |
if( isset( $_POST['action'] ) && $_POST['action'] === 'edit_profile' ){ |
| 14 |
if( isset( $_POST['passw1'] ) && !empty( $_POST['passw1'] ) && !empty( $_POST['form_name'] ) && isset( $_POST['edit_profile_'. $_POST['form_name'] .'_nonce_field'] ) && wp_verify_nonce( sanitize_text_field( $_POST['edit_profile_'. $_POST['form_name'] .'_nonce_field'] ), 'wppb_verify_form_submission' ) ){ |
| 15 |
|
| 16 |
/* all the error checking filters are defined in each field file so we need them here */ |
| 17 |
if ( file_exists ( WPPB_PLUGIN_DIR.'/front-end/default-fields/default-fields.php' ) ) |
| 18 |
require_once( WPPB_PLUGIN_DIR.'/front-end/default-fields/default-fields.php' ); |
| 19 |
|
| 20 |
if ( defined( 'WPPB_PAID_PLUGIN_DIR' ) && file_exists ( WPPB_PAID_PLUGIN_DIR.'/front-end/extra-fields/extra-fields.php' ) ) |
| 21 |
require_once( WPPB_PAID_PLUGIN_DIR.'/front-end/extra-fields/extra-fields.php' ); |
| 22 |
|
| 23 |
/* we get the form_name through $_POST so we can apply correctly the filter so we generate the correct fields in the current form */ |
| 24 |
$form_fields = apply_filters( 'wppb_change_form_fields', get_option( 'wppb_manage_fields' ), array( 'form_type'=> 'edit_profile', 'form_fields' => array(), 'form_name' => sanitize_text_field( $_POST['form_name'] ), 'role' => '', 'ID' => Profile_Builder_Form_Creator::wppb_get_form_id_from_form_name( sanitize_text_field( $_POST['form_name'] ), 'edit_profile' ), 'context' => 'edit_profile_auto_login_after_password_change' ) ); |
| 25 |
if( !empty( $form_fields ) ){ |
| 26 |
|
| 27 |
$edited_user_id = get_current_user_id(); |
| 28 |
if( ( !is_multisite() && current_user_can( 'edit_users' ) ) || ( is_multisite() && current_user_can( 'manage_network' ) ) ) { |
| 29 |
if( isset( $_GET['edit_user'] ) && ! empty( $_GET['edit_user'] ) ){ |
| 30 |
$edited_user_id = absint( $_GET['edit_user'] ); |
| 31 |
} |
| 32 |
} |
| 33 |
|
| 34 |
/* check for errors in the form through the filters */ |
| 35 |
$output_field_errors = array(); |
| 36 |
foreach( $form_fields as $field ){ |
| 37 |
//this is not perfect because we don't know the role attribute for the form here so we send it as '' in the filter, but as of v 2.9.0 it is not needed anywhere so we're good |
| 38 |
$error_for_field = apply_filters( 'wppb_check_form_field_'.Wordpress_Creation_Kit_PB::wck_generate_slug( $field['field'] ), '', $field, $_POST, 'edit_profile', '', $edited_user_id ); |
| 39 |
if( !empty( $error_for_field ) ) |
| 40 |
$output_field_errors[$field['id']] = '<span class="wppb-form-error">' . $error_for_field . '</span>'; |
| 41 |
} |
| 42 |
|
| 43 |
/* if we have no errors change the password */ |
| 44 |
if( empty( $output_field_errors ) ) { |
| 45 |
|
| 46 |
$user_id = get_current_user_id(); |
| 47 |
if( ( !is_multisite() && current_user_can( 'edit_users' ) ) || ( is_multisite() && current_user_can( 'manage_network' ) ) ) { |
| 48 |
if( isset( $_GET['edit_user'] ) && ! empty( $_GET['edit_user'] ) ){ |
| 49 |
$user_id = absint( $_GET['edit_user'] ); |
| 50 |
} |
| 51 |
} |
| 52 |
|
| 53 |
$session_token = ''; |
| 54 |
|
| 55 |
if( !isset( $_GET['edit_user'] ) ) { |
| 56 |
// Keep the current session token before clearing auth cookies. Some plugins remove the logged-in |
| 57 |
// - cookie from $_COOKIE on clear_auth_cookie, so wp_get_session_token() can be empty later in this request |
| 58 |
$logged_in_cookie = wp_parse_auth_cookie('', 'logged_in'); |
| 59 |
/** This filter is documented in wp-includes/pluggable.php */ |
| 60 |
$default_cookie_life = apply_filters('auth_cookie_expiration', (2 * DAY_IN_SECONDS), $user_id, false); |
| 61 |
$remember = false; |
| 62 |
if ( is_array( $logged_in_cookie ) ) { |
| 63 |
if ( isset( $logged_in_cookie['token'] ) ) { |
| 64 |
$session_token = $logged_in_cookie['token']; |
| 65 |
} |
| 66 |
|
| 67 |
if ( isset( $logged_in_cookie['expiration'] ) ) { |
| 68 |
// If expiration is greater than the default, the user checked 'Remember Me' when they logged in |
| 69 |
$remember = ( ( $logged_in_cookie['expiration'] - time() ) > $default_cookie_life ); |
| 70 |
} |
| 71 |
} |
| 72 |
|
| 73 |
wp_clear_auth_cookie(); |
| 74 |
/* set the new password for the user */ |
| 75 |
wp_set_password($_POST['passw1'], $user_id);//phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized |
| 76 |
|
| 77 |
wp_set_auth_cookie($user_id, $remember, '', $session_token ); |
| 78 |
if ( ! empty( $session_token ) ) { |
| 79 |
$cookie_life = $remember ? 14 * DAY_IN_SECONDS : 2 * DAY_IN_SECONDS; |
| 80 |
/** This filter is documented in wp-includes/pluggable.php */ |
| 81 |
$cookie_expiration = time() + apply_filters( 'auth_cookie_expiration', $cookie_life, $user_id, $remember ); |
| 82 |
|
| 83 |
// wp_set_auth_cookie() sends the new browser cookie, but it does not repopulate $_COOKIE |
| 84 |
// - restore it for the remaining form processing, including the second nonce verification |
| 85 |
$_COOKIE[ LOGGED_IN_COOKIE ] = wp_generate_auth_cookie( $user_id, $cookie_expiration, 'logged_in', $session_token ); |
| 86 |
} |
| 87 |
|
| 88 |
wp_set_current_user( $user_id ); |
| 89 |
do_action( 'wppb_edit_profile_password_changed', $user_id ); |
| 90 |
} |
| 91 |
else{ |
| 92 |
wp_set_password($_POST['passw1'], $user_id); //phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized |
| 93 |
do_action( 'wppb_edit_profile_password_changed', $user_id ); |
| 94 |
} |
| 95 |
|
| 96 |
/* log out of other sessions or all sessions if the admin is editing the profile */ |
| 97 |
$sessions = WP_Session_Tokens::get_instance( $user_id ); |
| 98 |
if ( $user_id === get_current_user_id() ) { |
| 99 |
// Reuse the captured token so destroying other sessions does not depend on the current $_COOKIE state |
| 100 |
$current_session_token = ! empty( $session_token ) ? $session_token : wp_get_session_token(); |
| 101 |
$sessions->destroy_others( $current_session_token ); |
| 102 |
} else { |
| 103 |
$sessions->destroy_all(); |
| 104 |
} |
| 105 |
|
| 106 |
} |
| 107 |
} |
| 108 |
} |
| 109 |
} |
| 110 |
} |
| 111 |
|
| 112 |
|
| 113 |
function wppb_front_end_profile_info( $atts ){ |
| 114 |
|
| 115 |
$atts = shortcode_atts( array( |
| 116 |
'form_name' => 'unspecified', |
| 117 |
'redirect_url' => '', |
| 118 |
'redirect_priority' => 'normal', |
| 119 |
'ajax' => false, |
| 120 |
'admin_edit_roles' => '' |
| 121 |
), $atts, 'wppb-edit-profile' ); |
| 122 |
|
| 123 |
$form = new Profile_Builder_Form_Creator( |
| 124 |
array( 'form_type' => 'edit_profile', 'form_name' => $atts['form_name'], 'redirect_url' => $atts['redirect_url'], 'redirect_priority' => $atts['redirect_priority'], 'ajax' => $atts['ajax'], 'admin_edit_roles' => $atts['admin_edit_roles'] ) |
| 125 |
); |
| 126 |
|
| 127 |
return $form; |
| 128 |
} |
| 129 |
|
