| 1 |
<?php |
| 2 |
/** |
| 3 |
* Query protection routines. |
| 4 |
* |
| 5 |
* Copyright: © 2009-2011 |
| 6 |
* {@link http://www.websharks-inc.com/ WebSharks, Inc.} |
| 7 |
* ( coded in the USA ) |
| 8 |
* |
| 9 |
* Released under the terms of the GNU General Public License. |
| 10 |
* You should have received a copy of the GNU General Public License, |
| 11 |
* along with this software. In the main directory, see: /licensing/ |
| 12 |
* If not, see: {@link http://www.gnu.org/licenses/}. |
| 13 |
* |
| 14 |
* @package s2Member\Queries |
| 15 |
* @since 3.5 |
| 16 |
*/ |
| 17 |
if (realpath (__FILE__) === realpath ($_SERVER["SCRIPT_FILENAME"])) |
| 18 |
exit("Do not access this file directly."); |
| 19 |
/**/ |
| 20 |
if (!class_exists ("c_ws_plugin__s2member_querys")) |
| 21 |
{ |
| 22 |
/** |
| 23 |
* Query protection routines. |
| 24 |
* |
| 25 |
* @package s2Member\Queries |
| 26 |
* @since 3.5 |
| 27 |
*/ |
| 28 |
class c_ws_plugin__s2member_querys |
| 29 |
{ |
| 30 |
/** |
| 31 |
* Filter all WordPress® queries. |
| 32 |
* |
| 33 |
* s2Member respects the query var: `suppress_filters`. |
| 34 |
* If you need to make a query without it being Filtered, use ``$wp_query->set ("suppress_filters", true);``. |
| 35 |
* |
| 36 |
* WordPress® 3.0+ Menus set: `suppress_filters = true`. |
| 37 |
* So this will NOT affect WP Menus |
| 38 |
* ( intended behavior ). |
| 39 |
* |
| 40 |
* @package s2Member\Queries |
| 41 |
* @since 3.5 |
| 42 |
* |
| 43 |
* @param obj $wp_query Expects ``$wp_query`` by reference, from the Filter. |
| 44 |
* @param bool $force Optional. Defaults to false. If true, we bypass all standard conditions. |
| 45 |
* However, will never bypass `supress_filters`. |
| 46 |
* @return null |
| 47 |
*/ |
| 48 |
public static function query_level_access (&$wp_query = FALSE, $force = FALSE) |
| 49 |
{ |
| 50 |
static $initial_query = true; /* Tracks initial query Filtering. */ |
| 51 |
/**/ |
| 52 |
eval('foreach(array_keys(get_defined_vars())as$__v)$__refs[$__v]=&$$__v;'); |
| 53 |
do_action ("ws_plugin__s2member_before_query_level_access", get_defined_vars ()); |
| 54 |
unset ($__refs, $__v); /* Unset defined __refs, __v. */ |
| 55 |
/**/ |
| 56 |
if (is_object ($wp_query) && !$wp_query->get ("suppress_filters")) /* s2Member will always respect the `suppress_filters` query arg. */ |
| 57 |
{ |
| 58 |
if (($o = $GLOBALS["WS_PLUGIN__"]["s2member"]["o"]["filter_wp_query"]) !== "none" || $force) /* If `none`; only Filter with $force. */ |
| 59 |
{ |
| 60 |
if ($force /* Forcing this routine bypasses all of these other conditions. This works with the API function `attach_s2member_query_filters()`. */ |
| 61 |
|| ($initial_query && preg_match ("/^(all|searches,feeds|searches)$/", $o) && $wp_query->is_search ()) /* Initial query for search results? */ |
| 62 |
|| ($initial_query && preg_match ("/^(all|searches,feeds|feeds)$/", $o) && $wp_query->is_feed ()) /* Initital query for feed listings? */ |
| 63 |
|| ($o === "all" && !($initial_query && $wp_query->is_singular ())) /* << do NOT create 404's. Allow Security Gate to handle these. */) |
| 64 |
{ |
| 65 |
if (!is_admin () /* The additional Ajax checks below, allow search plugins like Daves Live Search to be Filtered. Even when `is_admin() = true`. |
| 66 |
See: `http://wordpress.org/extend/plugins/daves-wordpress-live-search/`. Also see: `http://www.primothemes.com/forums/viewtopic.php?f=4&t=3087#p12786`. */ |
| 67 |
|| (is_admin () && defined ("DOING_AJAX") && DOING_AJAX && !empty ($_REQUEST["action"]) && (did_action ("wp_ajax_nopriv_" . $_REQUEST["action"]) || did_action ("wp_ajax_" . $_REQUEST["action"])) && $wp_query->is_search ())) |
| 68 |
{ |
| 69 |
$user = (is_user_logged_in ()) ? wp_get_current_user () : false; /* Get the current User's object. */ |
| 70 |
/* |
| 71 |
Filter all Posts/Pages requiring Custom Capabilities that the current User does NOT have access to. |
| 72 |
*/ |
| 73 |
if (is_array ($ccaps = c_ws_plugin__s2member_utils_gets::get_singular_ids_with_ccaps_req ($user)) && !empty ($ccaps)) |
| 74 |
$wp_query->set ("post__not_in", array_unique (array_merge ((array)$wp_query->get ("post__not_in"), $ccaps))); |
| 75 |
/* |
| 76 |
Filter all Posts/Pages requiring Specific Post/Page Access that the current Visitor does NOT have access to. |
| 77 |
*/ |
| 78 |
if (is_array ($sps = c_ws_plugin__s2member_utils_gets::get_singular_ids_with_sp_req ()) && !empty ($sps)) |
| 79 |
$wp_query->set ("post__not_in", array_unique (array_merge ((array)$wp_query->get ("post__not_in"), $sps))); |
| 80 |
/**/ |
| 81 |
for ($n = $GLOBALS["WS_PLUGIN__"]["s2member"]["c"]["levels"]; $n >= 0; $n--) /* Category Level Restrictions. Go through each Level. */ |
| 82 |
{ |
| 83 |
if ($GLOBALS["WS_PLUGIN__"]["s2member"]["o"]["level" . $n . "_catgs"] === "all" && (!$user || !current_user_can ("access_s2member_level" . $n))) |
| 84 |
{ |
| 85 |
$wp_query->set ("category__not_in", c_ws_plugin__s2member_utils_gets::get_all_category_ids ()); |
| 86 |
break; /* All Categories will be locked down. */ |
| 87 |
} |
| 88 |
else if ($GLOBALS["WS_PLUGIN__"]["s2member"]["o"]["level" . $n . "_catgs"] && (!$user || !current_user_can ("access_s2member_level" . $n))) |
| 89 |
{ |
| 90 |
foreach (preg_split ("/[\r\n\t\s;,]+/", $GLOBALS["WS_PLUGIN__"]["s2member"]["o"]["level" . $n . "_catgs"]) as $catg) |
| 91 |
$catgs = array_merge ((array)$catgs, array ($catg), c_ws_plugin__s2member_utils_gets::get_all_child_category_ids ($catg)); |
| 92 |
$wp_query->set ("category__not_in", array_unique (array_merge ((array)$wp_query->get ("category__not_in"), $catgs))); |
| 93 |
} |
| 94 |
} |
| 95 |
/**/ |
| 96 |
for ($n = $GLOBALS["WS_PLUGIN__"]["s2member"]["c"]["levels"]; $n >= 0; $n--) /* Tag Level Restrictions. Go through each Level. */ |
| 97 |
{ |
| 98 |
if ($GLOBALS["WS_PLUGIN__"]["s2member"]["o"]["level" . $n . "_ptags"] === "all" && (!$user || !current_user_can ("access_s2member_level" . $n))) |
| 99 |
{ |
| 100 |
$wp_query->set ("tag__not_in", c_ws_plugin__s2member_utils_gets::get_all_tag_ids ()); |
| 101 |
break; /* ALL Tags will be locked down. */ |
| 102 |
} |
| 103 |
else if ($GLOBALS["WS_PLUGIN__"]["s2member"]["o"]["level" . $n . "_ptags"] && (!$user || !current_user_can ("access_s2member_level" . $n))) |
| 104 |
{ |
| 105 |
$tags = c_ws_plugin__s2member_utils_gets::convert_tags_2_ids ($GLOBALS["WS_PLUGIN__"]["s2member"]["o"]["level" . $n . "_ptags"]); |
| 106 |
$wp_query->set ("tag__not_in", array_unique (array_merge ((array)$wp_query->get ("tag__not_in"), $tags))); |
| 107 |
} |
| 108 |
} |
| 109 |
/**/ |
| 110 |
for ($n = $GLOBALS["WS_PLUGIN__"]["s2member"]["c"]["levels"]; $n >= 0; $n--) /* Post Level Restrictions. Go through each Level. */ |
| 111 |
{ |
| 112 |
if ($GLOBALS["WS_PLUGIN__"]["s2member"]["o"]["level" . $n . "_posts"] === "all" && (!$user || !current_user_can ("access_s2member_level" . $n))) |
| 113 |
{ |
| 114 |
$wp_query->set ("post__not_in", c_ws_plugin__s2member_utils_gets::get_all_post_ids ()); |
| 115 |
break; /* ALL Posts will be locked down. */ |
| 116 |
} |
| 117 |
else if ($GLOBALS["WS_PLUGIN__"]["s2member"]["o"]["level" . $n . "_posts"] && (!$user || !current_user_can ("access_s2member_level" . $n))) |
| 118 |
{ |
| 119 |
$posts = preg_split ("/[\r\n\t\s;,]+/", $GLOBALS["WS_PLUGIN__"]["s2member"]["o"]["level" . $n . "_posts"]); |
| 120 |
$wp_query->set ("post__not_in", array_unique (array_merge ((array)$wp_query->get ("post__not_in"), $posts))); |
| 121 |
} |
| 122 |
} |
| 123 |
/**/ |
| 124 |
for ($n = $GLOBALS["WS_PLUGIN__"]["s2member"]["c"]["levels"]; $n >= 0; $n--) /* Page Level Restrictions. Go through each Level. */ |
| 125 |
{ |
| 126 |
if ($GLOBALS["WS_PLUGIN__"]["s2member"]["o"]["level" . $n . "_pages"] === "all" && (!$user || !current_user_can ("access_s2member_level" . $n))) |
| 127 |
{ |
| 128 |
$wp_query->set ("post__not_in", c_ws_plugin__s2member_utils_gets::get_all_page_ids ()); |
| 129 |
break; /* ALL Pages will be locked down. */ |
| 130 |
} |
| 131 |
else if ($GLOBALS["WS_PLUGIN__"]["s2member"]["o"]["level" . $n . "_pages"] && (!$user || !current_user_can ("access_s2member_level" . $n))) |
| 132 |
{ |
| 133 |
$pages = preg_split ("/[\r\n\t\s;,]+/", $GLOBALS["WS_PLUGIN__"]["s2member"]["o"]["level" . $n . "_pages"]); |
| 134 |
$wp_query->set ("post__not_in", array_unique (array_merge ((array)$wp_query->get ("post__not_in"), $pages))); |
| 135 |
} |
| 136 |
} |
| 137 |
/**/ |
| 138 |
eval('foreach(array_keys(get_defined_vars())as$__v)$__refs[$__v]=&$$__v;'); |
| 139 |
do_action ("ws_plugin__s2member_during_query_level_access", get_defined_vars ()); |
| 140 |
unset ($__refs, $__v); /* Unset defined __refs, __v. */ |
| 141 |
} |
| 142 |
} |
| 143 |
} |
| 144 |
} |
| 145 |
/**/ |
| 146 |
if ($initial_query && is_object ($wp_query)) /* Systematics. */ |
| 147 |
c_ws_plugin__s2member_querys::_query_level_access_sys ($wp_query); |
| 148 |
/**/ |
| 149 |
eval('foreach(array_keys(get_defined_vars())as$__v)$__refs[$__v]=&$$__v;'); |
| 150 |
do_action ("ws_plugin__s2member_after_query_level_access", get_defined_vars ()); |
| 151 |
unset ($__refs, $__v); /* Unset defined __refs, __v. */ |
| 152 |
/**/ |
| 153 |
$initial_query = false; /* No longer. */ |
| 154 |
/**/ |
| 155 |
return; /* For uniformity. */ |
| 156 |
} |
| 157 |
/** |
| 158 |
* Filters Systematics in search results & feeds. |
| 159 |
* |
| 160 |
* s2Member respects the query var: `suppress_filters`. |
| 161 |
* If you need to make a query without it being Filtered, use ``$wp_query->set ("suppress_filters", true);``. |
| 162 |
* |
| 163 |
* WordPress® 3.0+ Menus set: `suppress_filters = true`. |
| 164 |
* So this will NOT affect WP Menus |
| 165 |
* ( intended behavior ). |
| 166 |
* |
| 167 |
* @package s2Member\Queries |
| 168 |
* @since 3.5 |
| 169 |
* |
| 170 |
* @param obj $wp_query Expects ``$wp_query`` by reference. |
| 171 |
* @return null |
| 172 |
*/ |
| 173 |
public static function _query_level_access_sys (&$wp_query = FALSE) |
| 174 |
{ |
| 175 |
static $initial_query = true; /* Tracks initial query filtering. */ |
| 176 |
/**/ |
| 177 |
eval('foreach(array_keys(get_defined_vars())as$__v)$__refs[$__v]=&$$__v;'); |
| 178 |
do_action ("_ws_plugin__s2member_before_query_level_access_sys", get_defined_vars ()); |
| 179 |
unset ($__refs, $__v); /* Unset defined __refs, __v. */ |
| 180 |
/**/ |
| 181 |
if ($initial_query && is_object ($wp_query) && !$wp_query->get ("suppress_filters")) /* Suppressing Filters? */ |
| 182 |
{ |
| 183 |
if ((!is_admin () && ($wp_query->is_search () || $wp_query->is_feed ())) /* Filter Systematics in searches and in feeds. */ |
| 184 |
/* The additional Ajax checks below, allow search plugins like Daves Live Search to be Filtered. Even when `is_admin() = true`. |
| 185 |
See: `http://wordpress.org/extend/plugins/daves-wordpress-live-search/`. Also see: `http://www.primothemes.com/forums/viewtopic.php?f=4&t=3087#p12786`. */ |
| 186 |
|| (is_admin () && defined ("DOING_AJAX") && DOING_AJAX && !empty ($_REQUEST["action"]) && (did_action ("wp_ajax_nopriv_" . $_REQUEST["action"]) || did_action ("wp_ajax_" . $_REQUEST["action"])) && $wp_query->is_search ())) |
| 187 |
{ |
| 188 |
$s[] = $GLOBALS["WS_PLUGIN__"]["s2member"]["o"]["membership_options_page"]; |
| 189 |
$s[] = $GLOBALS["WS_PLUGIN__"]["s2member"]["o"]["login_welcome_page"]; |
| 190 |
$s[] = $GLOBALS["WS_PLUGIN__"]["s2member"]["o"]["file_download_limit_exceeded_page"]; |
| 191 |
/**/ |
| 192 |
$wp_query->set ("post__not_in", array_unique (array_merge ((array)$wp_query->get ("post__not_in"), $s))); |
| 193 |
/**/ |
| 194 |
eval('foreach(array_keys(get_defined_vars())as$__v)$__refs[$__v]=&$$__v;'); |
| 195 |
do_action ("_ws_plugin__s2member_during_query_level_access_sys", get_defined_vars ()); |
| 196 |
unset ($__refs, $__v); /* Unset defined __refs, __v. */ |
| 197 |
} |
| 198 |
} |
| 199 |
/**/ |
| 200 |
eval('foreach(array_keys(get_defined_vars())as$__v)$__refs[$__v]=&$$__v;'); |
| 201 |
do_action ("_ws_plugin__s2member_after_query_level_access_sys", get_defined_vars ()); |
| 202 |
unset ($__refs, $__v); /* Unset defined __refs, __v. */ |
| 203 |
/**/ |
| 204 |
$initial_query = false; /* No longer. */ |
| 205 |
/**/ |
| 206 |
return; /* For uniformity. */ |
| 207 |
} |
| 208 |
/** |
| 209 |
* Forces query Filters *( on-demand )*. |
| 210 |
* |
| 211 |
* s2Member respects the query var: `suppress_filters`. |
| 212 |
* If you need to make a query without it being Filtered, use ``$wp_query->set ("suppress_filters", true);``. |
| 213 |
* |
| 214 |
* WordPress® 3.0+ Menus set: `suppress_filters = true`. |
| 215 |
* So this will NOT affect WP Menus |
| 216 |
* ( intended behavior ). |
| 217 |
* |
| 218 |
* @package s2Member\Queries |
| 219 |
* @since 3.5 |
| 220 |
* |
| 221 |
* @param obj $wp_query Expects ``$wp_query`` by reference. |
| 222 |
* @return null |
| 223 |
*/ |
| 224 |
public static function force_query_level_access (&$wp_query = FALSE) |
| 225 |
{ |
| 226 |
eval('foreach(array_keys(get_defined_vars())as$__v)$__refs[$__v]=&$$__v;'); |
| 227 |
do_action ("ws_plugin__s2member_before_force_query_level_access", get_defined_vars ()); |
| 228 |
unset ($__refs, $__v); /* Unset defined __refs, __v. */ |
| 229 |
/**/ |
| 230 |
c_ws_plugin__s2member_querys::query_level_access ($wp_query, "force-filters"); |
| 231 |
/**/ |
| 232 |
eval('foreach(array_keys(get_defined_vars())as$__v)$__refs[$__v]=&$$__v;'); |
| 233 |
do_action ("ws_plugin__s2member_after_force_query_level_access", get_defined_vars ()); |
| 234 |
unset ($__refs, $__v); /* Unset defined __refs, __v. */ |
| 235 |
/**/ |
| 236 |
return; /* For uniformity. */ |
| 237 |
} |
| 238 |
} |
| 239 |
} |
| 240 |
?> |
