← All changes | front-end/edit-profile.php +128 -60 2.0.2 → 4.0.3 View file →

		@@ -1,60 +1,128 @@
1		-<?php
2		-/*
3		- wp_update_user only attempts to clear and reset cookies if it's updating the password.
4		- The php function setcookie(), used in both the cookie-clearing and cookie-resetting functions,
5		- adds to the page headers and therefore must be called within the first php tag on the page,
6		- and before the WordPress get_header() function. Since wp_update_user needs this, it must be at the beginning of the page as well.
7		-*/
8		-/* set action to login user after password changed in edit profile */
9		-add_action( 'init', 'wppb_autologin_after_password_changed' );
10		-function wppb_autologin_after_password_changed(){
11		- if( isset( $_POST['action'] ) && $_POST['action'] == 'edit_profile' ){
12		- if( isset( $_POST['passw1'] ) && !empty( $_POST['passw1'] ) && !empty( $_POST['form_name'] ) ){
13		-
14		- /* all the error checking filters are defined in each field file so we need them here */
15		- if ( file_exists ( WPPB_PLUGIN_DIR.'/front-end/default-fields/default-fields.php' ) )
16		- require_once( WPPB_PLUGIN_DIR.'/front-end/default-fields/default-fields.php' );
17		- if ( file_exists ( WPPB_PLUGIN_DIR.'/front-end/extra-fields/extra-fields.php' ) )
18		- require_once( WPPB_PLUGIN_DIR.'/front-end/extra-fields/extra-fields.php' );
19		-
20		- /* we get the form_name through $_POST so we can apply correctly the filter so we generate the correct fields in the current form */
21		- $form_fields = apply_filters( 'wppb_change_form_fields', get_option( 'wppb_manage_fields' ), array( 'form_type'=> 'edit_profile', 'form_fields' => array(), 'form_name' => $_POST['form_name'], 'role' => '' ) );
22		- if( !empty( $form_fields ) ){
23		-
24		- /* check for errors in the form through the filters */
25		- $output_field_errors = array();
26		- foreach( $form_fields as $field ){
27		- $error_for_field = apply_filters( 'wppb_check_form_field_'.Wordpress_Creation_Kit_PB::wck_generate_slug( $field['field'] ), '', $field, $_POST, 'edit_profile' );
28		- if( !empty( $error_for_field ) )
29		- $output_field_errors[$field['id']] = '<span class="wppb-form-error">' . $error_for_field . '</span>';
30		- }
31		-
32		- /* if we have no errors change the password */
33		- if( empty( $output_field_errors ) ) {
34		- $user_id = get_current_user_id();
35		- wp_clear_auth_cookie();
36		- /* set the new password for the user */
37		- wp_set_password( $_POST['passw1'], $user_id );
38		- // Here we calculate the expiration length of the current auth cookie and compare it to the default expiration.
39		- // If it's greater than this, then we know the user checked 'Remember Me' when they logged in.
40		- $logged_in_cookie = wp_parse_auth_cookie('', 'logged_in');
41		- /** This filter is documented in wp-includes/pluggable.php */
42		- $default_cookie_life = apply_filters('auth_cookie_expiration', (2 * DAY_IN_SECONDS), $user_id, false);
43		- $remember = (($logged_in_cookie['expiration'] - time()) > $default_cookie_life);
44		-
45		- wp_set_auth_cookie($user_id, $remember);
46		- }
47		- }
48		- }
49		- }
50		-}
51		-
52		-
53		-function wppb_front_end_profile_info( $atts ){
54		- // get value set in the shortcode as parameter, still need to default to something else than empty string
55		- extract( shortcode_atts( array( 'form_name' => 'unspecified' ), $atts, 'wppb-edit-profile' ) );
56		- global $$form_name;
57		- $$form_name = new Profile_Builder_Form_Creator( array( 'form_type' => 'edit_profile', 'form_name' => $form_name ) );
58		-
59		- return $$form_name;
60		-}
	1	+<?php
	2	+if ( ! defined( 'ABSPATH' ) ) exit; // Exit if accessed directly
	3	+
	4	+/*
	5	+ wp_update_user only attempts to clear and reset cookies if it's updating the password.
	6	+ The php function setcookie(), used in both the cookie-clearing and cookie-resetting functions,
	7	+ adds to the page headers and therefore must be called within the first php tag on the page,
	8	+ and before the WordPress get_header() function. Since wp_update_user needs this, it must be at the beginning of the page as well.
	9	+*/
	10	+/* set action to login user after password changed in edit profile */
	11	+add_action( 'init', 'wppb_autologin_after_password_changed' );
	12	+function wppb_autologin_after_password_changed(){
	13	+ if( isset( $_POST['action'] ) && $_POST['action'] === 'edit_profile' ){
	14	+ if( isset( $_POST['passw1'] ) && !empty( $_POST['passw1'] ) && !empty( $_POST['form_name'] ) && isset( $_POST['edit_profile_'. $_POST['form_name'] .'_nonce_field'] ) && wp_verify_nonce( sanitize_text_field( $_POST['edit_profile_'. $_POST['form_name'] .'_nonce_field'] ), 'wppb_verify_form_submission' ) ){
	15	+
	16	+ /* all the error checking filters are defined in each field file so we need them here */
	17	+ if ( file_exists ( WPPB_PLUGIN_DIR.'/front-end/default-fields/default-fields.php' ) )
	18	+ require_once( WPPB_PLUGIN_DIR.'/front-end/default-fields/default-fields.php' );
	19	+
	20	+ if ( defined( 'WPPB_PAID_PLUGIN_DIR' ) && file_exists ( WPPB_PAID_PLUGIN_DIR.'/front-end/extra-fields/extra-fields.php' ) )
	21	+ require_once( WPPB_PAID_PLUGIN_DIR.'/front-end/extra-fields/extra-fields.php' );
	22	+
	23	+ /* we get the form_name through $_POST so we can apply correctly the filter so we generate the correct fields in the current form */
	24	+ $form_fields = apply_filters( 'wppb_change_form_fields', get_option( 'wppb_manage_fields' ), array( 'form_type'=> 'edit_profile', 'form_fields' => array(), 'form_name' => sanitize_text_field( $_POST['form_name'] ), 'role' => '', 'ID' => Profile_Builder_Form_Creator::wppb_get_form_id_from_form_name( sanitize_text_field( $_POST['form_name'] ), 'edit_profile' ), 'context' => 'edit_profile_auto_login_after_password_change' ) );
	25	+ if( !empty( $form_fields ) ){
	26	+
	27	+ $edited_user_id = get_current_user_id();
	28	+ if( ( !is_multisite() && current_user_can( 'edit_users' ) ) || ( is_multisite() && current_user_can( 'manage_network' ) ) ) {
	29	+ if( isset( $_GET['edit_user'] ) && ! empty( $_GET['edit_user'] ) ){
	30	+ $edited_user_id = absint( $_GET['edit_user'] );
	31	+ }
	32	+ }
	33	+
	34	+ /* check for errors in the form through the filters */
	35	+ $output_field_errors = array();
	36	+ foreach( $form_fields as $field ){
	37	+ //this is not perfect because we don't know the role attribute for the form here so we send it as '' in the filter, but as of v 2.9.0 it is not needed anywhere so we're good
	38	+ $error_for_field = apply_filters( 'wppb_check_form_field_'.Wordpress_Creation_Kit_PB::wck_generate_slug( $field['field'] ), '', $field, $_POST, 'edit_profile', '', $edited_user_id );
	39	+ if( !empty( $error_for_field ) )
	40	+ $output_field_errors[$field['id']] = '<span class="wppb-form-error">' . $error_for_field . '</span>';
	41	+ }
	42	+
	43	+ /* if we have no errors change the password */
	44	+ if( empty( $output_field_errors ) ) {
	45	+
	46	+ $user_id = get_current_user_id();
	47	+ if( ( !is_multisite() && current_user_can( 'edit_users' ) ) || ( is_multisite() && current_user_can( 'manage_network' ) ) ) {
	48	+ if( isset( $_GET['edit_user'] ) && ! empty( $_GET['edit_user'] ) ){
	49	+ $user_id = absint( $_GET['edit_user'] );
	50	+ }
	51	+ }
	52	+
	53	+ $session_token = '';
	54	+
	55	+ if( !isset( $_GET['edit_user'] ) ) {
	56	+ // Keep the current session token before clearing auth cookies. Some plugins remove the logged-in
	57	+ // - cookie from $_COOKIE on clear_auth_cookie, so wp_get_session_token() can be empty later in this request
	58	+ $logged_in_cookie = wp_parse_auth_cookie('', 'logged_in');
	59	+ /** This filter is documented in wp-includes/pluggable.php */
	60	+ $default_cookie_life = apply_filters('auth_cookie_expiration', (2 * DAY_IN_SECONDS), $user_id, false);
	61	+ $remember = false;
	62	+ if ( is_array( $logged_in_cookie ) ) {
	63	+ if ( isset( $logged_in_cookie['token'] ) ) {
	64	+ $session_token = $logged_in_cookie['token'];
	65	+ }
	66	+
	67	+ if ( isset( $logged_in_cookie['expiration'] ) ) {
	68	+ // If expiration is greater than the default, the user checked 'Remember Me' when they logged in
	69	+ $remember = ( ( $logged_in_cookie['expiration'] - time() ) > $default_cookie_life );
	70	+ }
	71	+ }
	72	+
	73	+ wp_clear_auth_cookie();
	74	+ /* set the new password for the user */
	75	+ wp_set_password($_POST['passw1'], $user_id);//phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
	76	+
	77	+ wp_set_auth_cookie($user_id, $remember, '', $session_token );
	78	+ if ( ! empty( $session_token ) ) {
	79	+ $cookie_life = $remember ? 14 * DAY_IN_SECONDS : 2 * DAY_IN_SECONDS;
	80	+ /** This filter is documented in wp-includes/pluggable.php */
	81	+ $cookie_expiration = time() + apply_filters( 'auth_cookie_expiration', $cookie_life, $user_id, $remember );
	82	+
	83	+ // wp_set_auth_cookie() sends the new browser cookie, but it does not repopulate $_COOKIE
	84	+ // - restore it for the remaining form processing, including the second nonce verification
	85	+ $_COOKIE[ LOGGED_IN_COOKIE ] = wp_generate_auth_cookie( $user_id, $cookie_expiration, 'logged_in', $session_token );
	86	+ }
	87	+
	88	+ wp_set_current_user( $user_id );
	89	+ do_action( 'wppb_edit_profile_password_changed', $user_id );
	90	+ }
	91	+ else{
	92	+ wp_set_password($_POST['passw1'], $user_id); //phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
	93	+ do_action( 'wppb_edit_profile_password_changed', $user_id );
	94	+ }
	95	+
	96	+ /* log out of other sessions or all sessions if the admin is editing the profile */
	97	+ $sessions = WP_Session_Tokens::get_instance( $user_id );
	98	+ if ( $user_id === get_current_user_id() ) {
	99	+ // Reuse the captured token so destroying other sessions does not depend on the current $_COOKIE state
	100	+ $current_session_token = ! empty( $session_token ) ? $session_token : wp_get_session_token();
	101	+ $sessions->destroy_others( $current_session_token );
	102	+ } else {
	103	+ $sessions->destroy_all();
	104	+ }
	105	+
	106	+ }
	107	+ }
	108	+ }
	109	+ }
	110	+}
	111	+
	112	+
	113	+function wppb_front_end_profile_info( $atts ){
	114	+
	115	+ $atts = shortcode_atts( array(
	116	+ 'form_name' => 'unspecified',
	117	+ 'redirect_url' => '',
	118	+ 'redirect_priority' => 'normal',
	119	+ 'ajax' => false,
	120	+ 'admin_edit_roles' => ''
	121	+ ), $atts, 'wppb-edit-profile' );
	122	+
	123	+ $form = new Profile_Builder_Form_Creator(
	124	+ array( 'form_type' => 'edit_profile', 'form_name' => $atts['form_name'], 'redirect_url' => $atts['redirect_url'], 'redirect_priority' => $atts['redirect_priority'], 'ajax' => $atts['ajax'], 'admin_edit_roles' => $atts['admin_edit_roles'] )
	125	+ );
	126	+
	127	+ return $form;
	128	+}