| @@ -9,11 +9,9 @@ | ||
| 9 | 9 | |
| 10 | 10 | $key = ( !empty( $_GET['key'] ) ? sanitize_text_field( $_GET['key'] ) : null ); |
| 11 | 11 | $key = ( !empty( $_POST['key'] ) ? sanitize_text_field( $_POST['key'] ) : $key ); |
| 12 | 12 | |
| 13 | - if ( !empty( $_POST['user_pass'] ) )// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized, WordPress.Security.ValidatedSanitizedInput.MissingUnslash | |
| 14 | - $password = $_POST['user_pass'];// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized, WordPress.Security.ValidatedSanitizedInput.MissingUnslash | |
| 15 | - elseif ( !is_null( $key ) ) { | |
| 13 | + if ( !is_null( $key ) ) { | |
| 16 | 14 | $signup = ( is_multisite() ? $wpdb->get_row( $wpdb->prepare( "SELECT * FROM " . $wpdb->signups . " WHERE activation_key = %s", $key ) ) : $wpdb->get_row( $wpdb->prepare( "SELECT * FROM " . $wpdb->base_prefix . "signups WHERE activation_key = %s", $key ) ) ); |
| 17 | 15 | |
| 18 | 16 | if ( empty( $signup ) || $signup->active ) { |
| 19 | 17 | //bad key or already active |
| @@ -45,22 +43,25 @@ | ||
| 45 | 43 | $login_after_register = ( isset( $wppb_general_settings['automaticallyLogIn'] ) ? $wppb_general_settings['automaticallyLogIn'] : apply_filters( 'wppb_automatically_login_after_register', 'No' ) ); |
| 46 | 44 | |
| 47 | 45 | $signup = ( is_multisite() ? $wpdb->get_row( $wpdb->prepare("SELECT * FROM $wpdb->signups WHERE activation_key = %s", $key) ) : $wpdb->get_row( $wpdb->prepare( "SELECT * FROM ".$wpdb->base_prefix."signups WHERE activation_key = %s", $key ) ) ); |
| 48 | 46 | |
| 47 | + if( empty( $signup ) ) | |
| 48 | + return apply_filters( 'wppb_register_activate_user_error_message6', '<p class="error" role="alert">'.__( 'Could not find registration. Contact administrator.', 'profile-builder' ).'</p>'); | |
| 49 | + | |
| 49 | 50 | $user_login = ( ( isset( $wppb_general_settings['loginWith'] ) && ( $wppb_general_settings['loginWith'] == 'email' ) ) ? trim( $signup->user_email ) : trim( $signup->user_login ) ); |
| 50 | 51 | |
| 51 | 52 | $user_email = esc_sql( $signup->user_email ); |
| 52 | - /* the password is in hashed form in the signup table so we will add it later */ | |
| 53 | - $password = NULL; | |
| 53 | + /* Signup meta holds the real password hash, applied after user creation. WordPress requires a non-empty user_pass when creating users. */ | |
| 54 | + $password = ''; | |
| 54 | 55 | |
| 55 | - $user_id = username_exists( $user_login ); | |
| 56 | + $user_id = ( ( isset( $wppb_general_settings['loginWith'] ) && ( $wppb_general_settings['loginWith'] == 'email' ) ) ? email_exists( $user_login ) : username_exists( $user_login ) ); | |
| 56 | 57 | |
| 57 | 58 | if ( empty( $signup ) ) |
| 58 | - return apply_filters( 'wppb_register_activate_user_error_message1', '<p class="error">'.__( 'Invalid activation key!', 'profile-builder' ).'</p>'); | |
| 59 | + return apply_filters( 'wppb_register_activate_user_error_message1', '<p class="error" role="alert">'.__( 'Invalid activation key!', 'profile-builder' ).'</p>'); | |
| 59 | 60 | |
| 60 | 61 | if ( $signup->active ) |
| 61 | 62 | if ( empty( $signup->domain ) ) |
| 62 | - return apply_filters( 'wppb_register_activate_user_error_message2', '<p class="wppb-success">'.__( 'This username is now active!', 'profile-builder' ).'</p>', $user_id ); | |
| 63 | + return apply_filters( 'wppb_register_activate_user_error_message2', '<p class="wppb-success" role="alert">'.__( 'This username is now active!', 'profile-builder' ).'</p>', $user_id ); | |
| 63 | 64 | |
| 64 | 65 | $meta = unserialize( $signup->meta ); |
| 65 | 66 | |
| 66 | 67 | if( strcasecmp($login_after_register, 'Yes') === 0 ) { |
| @@ -71,18 +72,19 @@ | ||
| 71 | 72 | } else { |
| 72 | 73 | $login_after_register = false; |
| 73 | 74 | } |
| 74 | 75 | |
| 75 | - if ( !$user_id ) | |
| 76 | - $user_id = wppb_create_user( $user_login, $password, $user_email ); | |
| 76 | + if ( ! $user_id ) { | |
| 77 | + $user_id = wppb_create_user( $user_login, wp_generate_password( 24, true, true ), $user_email ); | |
| 78 | + } | |
| 77 | 79 | else |
| 78 | 80 | $user_already_exists = true; |
| 79 | 81 | |
| 80 | 82 | if ( ! $user_id ) |
| 81 | - return apply_filters( 'wppb_register_activate_user_error_message4', '<p class="error">'.__('Could not create user!', 'profile-builder').'</p>' ); | |
| 83 | + return apply_filters( 'wppb_register_activate_user_error_message4', '<p class="error" role="alert">'.__('Could not create user!', 'profile-builder').'</p>' ); | |
| 82 | 84 | |
| 83 | 85 | elseif ( isset( $user_already_exists ) && ( $user_already_exists == true ) ) |
| 84 | - return apply_filters( 'wppb_register_activate_user_error_message5', '<p class="error">'.__( 'This username is already activated!', 'profile-builder' ).'</p>' ); | |
| 86 | + return apply_filters( 'wppb_register_activate_user_error_message5', '<p class="error" role="alert">'.__( 'This username is already activated!', 'profile-builder' ).'</p>' ); | |
| 85 | 87 | |
| 86 | 88 | else{ |
| 87 | 89 | $inserted_user = ( is_multisite() ? $wpdb->update( $wpdb->signups, array( 'active' => 1, 'activated' => current_time( 'mysql', true ) ), array( 'activation_key' => $key ) ) : $wpdb->update( $wpdb->base_prefix.'signups', array( 'active' => 1, 'activated' => current_time( 'mysql', true ) ), array( 'activation_key' => $key ) ) ); |
| 88 | 90 | |
| @@ -116,11 +118,12 @@ | ||
| 116 | 118 | $redirect_url = wppb_get_redirect_url( 'normal', 'after_success_email_confirmation', '', $user_login ); |
| 117 | 119 | |
| 118 | 120 | $redirect_delay = apply_filters( 'wppb_success_email_confirmation_redirect_delay', 3, $user_id ); |
| 119 | 121 | $redirect_message = wppb_build_redirect( $redirect_url, $redirect_delay, 'after_success_email_confirmation' ); |
| 122 | + $redirect_message = apply_filters( 'wppb_ec_sucess_message_redirect', $redirect_message, $meta ); | |
| 120 | 123 | |
| 121 | - $success_message = apply_filters( 'wppb_success_email_confirmation', '<p class="wppb-success">' . __( 'Your email was successfully confirmed.', 'profile-builder' ) . '</p><!-- .success -->', $user_id ); | |
| 122 | - $admin_approval_message = apply_filters( 'wppb_email_confirmation_with_admin_approval', '<p class="alert">' . __( 'Before you can access your account, an administrator needs to approve it. You will be notified via email.', 'profile-builder' ) . '</p>', $user_id ); | |
| 124 | + $success_message = apply_filters( 'wppb_success_email_confirmation', '<p class="wppb-success" role="alert">' . __( 'Your email was successfully confirmed.', 'profile-builder' ) . '</p><!-- .success -->', $user_id ); | |
| 125 | + $admin_approval_message = apply_filters( 'wppb_email_confirmation_with_admin_approval', '<p class="alert" role="alert">' . __( 'Before you can access your account, an administrator needs to approve it. You will be notified via email.', 'profile-builder' ) . '</p>', $user_id ); | |
| 123 | 126 | |
| 124 | 127 | $wppb_general_settings = get_option( 'wppb_general_settings', 'false' ); |
| 125 | 128 | |
| 126 | 129 | if ( wppb_get_admin_approval_option_value() === 'yes' ){ |
| @@ -138,8 +141,9 @@ | ||
| 138 | 141 | if( empty( $redirect_url ) ) { |
| 139 | 142 | $redirect_url = wppb_curpageurl(); |
| 140 | 143 | } |
| 141 | 144 | $redirect_message = wppb_activate_signup_autologin_redirect_url($user_id, $redirect_url, $redirect_delay); |
| 145 | + $redirect_message = apply_filters( 'wppb_ec_sucess_message_redirect', $redirect_message, $meta ); | |
| 142 | 146 | } |
| 143 | 147 | |
| 144 | 148 | return $success_message . ( ! empty ( $redirect_message ) ? $redirect_message : '' ); |
| 145 | 149 | } |
| @@ -155,14 +159,15 @@ | ||
| 155 | 159 | if( empty( $redirect_url ) ) { |
| 156 | 160 | $redirect_url = wppb_curpageurl(); |
| 157 | 161 | } |
| 158 | 162 | $redirect_message = wppb_activate_signup_autologin_redirect_url($user_id, $redirect_url, $redirect_delay); |
| 163 | + $redirect_message = apply_filters( 'wppb_ec_sucess_message_redirect', $redirect_message, $meta ); | |
| 159 | 164 | } |
| 160 | 165 | |
| 161 | 166 | return $success_message . ( ! empty ( $redirect_message ) ? $redirect_message : '' ); |
| 162 | 167 | } |
| 163 | 168 | } else { |
| 164 | - return apply_filters('wppb_register_failed_user_activation', '<p class="error">'. __('There was an error while trying to activate the user.', 'profile-builder') .'</p><!-- .error -->'); | |
| 169 | + return apply_filters('wppb_register_failed_user_activation', '<p class="error" role="alert">'. __('There was an error while trying to activate the user.', 'profile-builder') .'</p><!-- .error -->'); | |
| 165 | 170 | } |
| 166 | 171 | } |
| 167 | 172 | } |
| 168 | 173 | |
| @@ -167,14 +172,12 @@ | ||
| 167 | 172 | } |
| 168 | 173 | |
| 169 | 174 | //function that generates the redirect message when the user should be automatically logged in |
| 170 | 175 | function wppb_activate_signup_autologin_redirect_url( $user_id, $redirect_url, $redirect_delay ){ |
| 171 | - $nonce = wp_create_nonce( 'autologin-'. $user_id .'-'. (int)( time() / 60 ) ); | |
| 172 | - | |
| 173 | 176 | $redirect_url = remove_query_arg( 'activation_key' ,$redirect_url ); |
| 174 | 177 | |
| 175 | 178 | $redirect_url = apply_filters( 'wppb_login_after_reg_redirect_url', $redirect_url ); |
| 176 | - $redirect_url = add_query_arg( array( 'autologin' => 'true', 'uid' => $user_id, '_wpnonce' => $nonce ), $redirect_url ); | |
| 179 | + $redirect_url = add_query_arg( wppb_get_autologin_query_args( $user_id ), $redirect_url ); | |
| 177 | 180 | |
| 178 | 181 | return wppb_build_redirect( $redirect_url, $redirect_delay, 'after_success_email_confirmation' ); |
| 179 | 182 | } |
| 180 | 183 | |
| @@ -179,12 +182,21 @@ | ||
| 179 | 182 | } |
| 180 | 183 | |
| 181 | 184 | //function to display the registration page |
| 182 | 185 | function wppb_front_end_register( $atts ){ |
| 183 | - extract( shortcode_atts( array( 'role' => get_option( 'default_role' ), 'form_name' => 'unspecified', 'redirect_url' => '', 'logout_redirect_url' => '', 'automatic_login' => '', 'redirect_priority' => 'normal' ), $atts, 'wppb-register' ) ); | |
| 184 | - | |
| 185 | - $form = new Profile_Builder_Form_Creator( array( 'form_type' => 'register', 'form_name' => $form_name, 'role' => ( is_object( get_role( $role ) ) ? $role : get_option( 'default_role' ) ) , 'redirect_url' => $redirect_url, 'logout_redirect_url' => $logout_redirect_url, 'automatic_login' => $automatic_login, 'redirect_priority' => $redirect_priority ) ); | |
| 186 | 186 | |
| 187 | + $atts = shortcode_atts( array( | |
| 188 | + 'role' => get_option( 'default_role' ), | |
| 189 | + 'form_name' => 'unspecified', | |
| 190 | + 'redirect_url' => '', | |
| 191 | + 'logout_redirect_url' => '', | |
| 192 | + 'automatic_login' => '', | |
| 193 | + 'redirect_priority' => 'normal', | |
| 194 | + 'ajax' => false | |
| 195 | + ), $atts, 'wppb-register' ); | |
| 196 | + | |
| 197 | + $form = new Profile_Builder_Form_Creator( array( 'form_type' => 'register', 'form_name' => $atts['form_name'], 'role' => ( is_object( get_role( $atts['role'] ) ) ? $atts['role'] : get_option( 'default_role' ) ) , 'redirect_url' => $atts['redirect_url'], 'logout_redirect_url' => $atts['logout_redirect_url'], 'automatic_login' => $atts['automatic_login'], 'redirect_priority' => $atts['redirect_priority'], 'ajax' => $atts['ajax'] ) ); | |
| 198 | + | |
| 187 | 199 | return $form; |
| 188 | 200 | } |
| 189 | 201 | |
| 190 | 202 | // function to choose whether to display the registration page or the validation message |
| @@ -202,18 +214,20 @@ | ||
| 202 | 214 | |
| 203 | 215 | /* authors and contributors shouldn't be allowed to create pages with the register shortcode in them */ |
| 204 | 216 | add_filter( 'the_content', 'wppb_maybe_remove_register_shortcode' ); |
| 205 | 217 | function wppb_maybe_remove_register_shortcode( $content ){ |
| 206 | - if ( has_shortcode( $content, 'wppb-register' ) ){ | |
| 207 | - $author_id = get_the_author_meta( 'ID' ); | |
| 208 | - if( !empty( $author_id ) ){ | |
| 209 | - if( !user_can( $author_id, 'edit_others_posts' ) ) { | |
| 210 | - remove_shortcode('wppb-register'); | |
| 211 | - } | |
| 212 | - } | |
| 213 | - } | |
| 218 | + if ( has_shortcode( $content, 'wppb-register' ) ){ | |
| 219 | + $author_id = get_the_author_meta( 'ID' ); | |
| 220 | + if( !empty( $author_id ) ){ | |
| 221 | + if( !user_can( $author_id, 'edit_others_posts' ) ) { | |
| 222 | + remove_shortcode('wppb-register'); | |
| 214 | 223 | |
| 215 | - return $content; | |
| 224 | + $content = str_replace('[wppb-register]', __( 'Only an administrator can create pages with the register shortcode.', 'profile-builder' ), $content); | |
| 225 | + } | |
| 226 | + } | |
| 227 | + } | |
| 228 | + | |
| 229 | + return $content; | |
| 216 | 230 | } |
| 217 | 231 | |
| 218 | 232 | /* custom redirect after registration on wp default register form */ |
| 219 | 233 | function wppb_default_registration_redirect( $user_id ) { |
| @@ -221,8 +235,8 @@ | ||
| 221 | 235 | $user_data = get_userdata( $user_id ); |
| 222 | 236 | |
| 223 | 237 | // CHECK FOR REDIRECT |
| 224 | 238 | if( isset( $_POST['redirect_to'] ) ) |
| 225 | - $_POST['redirect_to'] = apply_filters( 'wppb_after_registration_redirect_url', wppb_get_redirect_url( 'normal', 'after_registration', esc_url_raw( $_POST['redirect_to'] ), $user_data ) ); | |
| 239 | + $_POST['redirect_to'] = apply_filters( 'wppb_after_registration_redirect_url', wppb_get_redirect_url( 'normal', 'after_registration', wppb_sanitize_request_url( $_POST['redirect_to'] ), $user_data ) ); | |
| 226 | 240 | |
| 227 | 241 | } |
| 228 | -add_action( 'register_new_user', 'wppb_default_registration_redirect' ); | |
| 242 | +add_action( 'register_new_user', 'wppb_default_registration_redirect' ); | |
