# s2member/trunk/src/includes/classes/user-securities.inc.php s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions, version trunk. 270 lines. - Page: https://pluginprobe.com/plugins/s2member/trunk/code/src/includes/classes/user-securities.inc.php - Raw: https://pluginprobe.com/plugins/s2member/trunk/raw/src/includes/classes/user-securities.inc.php - Modified: 2026-09-09T05:26:58+00:00 Line numbers below start at 1. Link to a line or a range by appending a fragment to the page URL, for example `https://pluginprobe.com/plugins/s2member/trunk/code/src/includes/classes/user-securities.inc.php#L10-L20`. ```php init()`. * This prevents crashes when other plugins attempt to call upon `current_user_can()` before WordPress is initialized. * For instance, some plugins attempt to use `current_user_can()` on the `plugins_loaded` Hook, which they should not do. * * @package s2Member\User_Securities * @since 3.5 * * @attaches-to ``add_action('init');`` */ public static function initialize() // Initializes the Filter for `user_has_cap`. { add_filter('user_has_cap', 'c_ws_plugin__s2member_user_securities::user_capabilities', 10, 3); } /** * Deals w/ bbPress-specific issues on a Multisite Network. * * @package s2Member\User_Securities * @since 150224 * * @attaches-to ``add_action('after_setup_theme');`` */ public static function set_current_user() { if(is_multisite() && is_user_logged_in() && !current_user_can('read')) remove_action('bbp_setup_current_user', 'bbp_set_current_user_default_role'); } /** * Alters `WP_User->has_cap()` in special cases for Administrators. * * @package s2Member\User_Securities * @since 110815 * * @attaches-to ``add_filter('user_has_cap');`` * * @param array $capabilities Expects an array of Capabilities passed in by the Filter. * This array contains all of the Capabilities that the User has *( i.e., ``$user->allcaps`` )*. * @param array $caps_map An array of Capabilities mapped out by the ``map_meta_cap`` function. * @param array $args Array of arguments originally passed through the ``has_cap()`` function. * However, WordPress modifies this array of arguments in the following way. * Argument `[0]` is the Capability test string itself *(this is normal)*. * Argument `[1]` is added by WordPress; it's the ID of the User. * Other arguments starting from array index `[2]` are normal. * * @return array An array of Capabilities. */ public static function user_capabilities($capabilities, $caps_map, $args) { $_hook = 'ws_plugin__s2member_before_user_capabilities'; if (isset($GLOBALS['wp_filter'][$_hook]) || isset($GLOBALS['wp_filter']['all'])) { foreach(array_keys(get_defined_vars()) as $__v) $__refs[$__v] =& $$__v; do_action($_hook, get_defined_vars()); } unset($_hook, $__refs, $__v); //260901 Vars by reference. if(!empty($capabilities['access_s2member_ccap_all_ccaps']) && !empty($args[0]) && preg_match('/^access_s2member_ccap_/i', $args[0]) && apply_filters('ws_plugin__s2member_all_ccaps_enable', TRUE, get_defined_vars())) $capabilities = array_merge((array)$capabilities, array($args[0] => 1)); else if(!is_multisite() && !empty($capabilities['administrator']) && !empty($args[0]) && preg_match('/^access_s2member_ccap_/i', $args[0]) && apply_filters('ws_plugin__s2member_admins_have_all_ccaps', TRUE, get_defined_vars())) $capabilities = array_merge((array)$capabilities, array($args[0] => 1)); else if(is_multisite() && c_ws_plugin__s2member_utils_conds::is_multisite_farm() && (is_super_admin() || !empty($capabilities['administrator'])) && !empty($args[0]) && ($args[0] === 'edit_user' || $args[0] === 'edit_users')) if($args[0] === 'edit_users' || ($args[0] === 'edit_user' && !empty($args[2]) && ((!empty($args[1]) && (int)$args[1] === (int)$args[2]) || is_user_member_of_blog($args[2])))) $capabilities = array_merge((array)$capabilities, array('edit_users' => 1)); $_hook = 'ws_plugin__s2member_user_capabilities'; if (isset($GLOBALS['wp_filter'][$_hook]) || isset($GLOBALS['wp_filter']['all'])) $capabilities = apply_filters($_hook, $capabilities, get_defined_vars()); unset($_hook); //260901 Defined vars. return $capabilities; } /** * Alters this Filter inside `/wp-admin/user-edit.php`. * * @package s2Member\User_Securities * @since 3.5 * * @attaches-to ``add_filter('enable_edit_any_user_configuration');`` * * @param bool $allow Expects boolean value passed through by the Filter. * * @return bool True if the current User is allowed to edit any User, else existing value. */ public static function ms_allow_edits($allow = FALSE) { global $user_id; // Available inside `/wp-admin/user-edit.php`. foreach(array_keys(get_defined_vars()) as $__v) $__refs[$__v] =& $$__v; do_action('ws_plugin__s2member_before_ms_allow_edits', get_defined_vars()); unset($__refs, $__v); if(is_multisite() && c_ws_plugin__s2member_utils_conds::is_multisite_farm()) if(is_super_admin() || (current_user_can('administrator') && $user_id && is_user_member_of_blog($user_id))) $allow = TRUE; // Yes, allow Administrators to edit User Profiles. return apply_filters('ws_plugin__s2member_ms_allow_edits', $allow, get_defined_vars()); } /** * Hides Password fields for Demo Users; and deals with Password fields on Multisite Blog Farms. * * Demo accounts *( where the Username MUST be 'demo' )*, will NOT be allowed to change their Password. * Any other restrictions you need to impose must be done through custom programming, using s2Member's Conditionals. * See `s2Member → API Scripting`. * * @package s2Member\User_Securities * @since 3.5 * * @attaches-to ``add_filter('show_password_fields');`` * * @param bool $show Expects boolean value passed through by the Filter. * @param WP_User $user Expects a `WP_User` object passed through by the Filter. * If this is NOT passed (it isn't always), then we assume the current user. * * @return bool False if the Password is locked for this User, else existing value. */ public static function hide_password_fields($show, $user = NULL) { foreach(array_keys(get_defined_vars()) as $__v) $__refs[$__v] =& $$__v; do_action('ws_plugin__s2member_before_hide_password_fields', get_defined_vars()); unset($__refs, $__v); if($show && is_multisite() && c_ws_plugin__s2member_utils_conds::is_multisite_farm()) if(!is_super_admin() && is_object($user) && !empty($user->ID) && is_object($current_user = wp_get_current_user()) && !empty($current_user->ID)) if($user->ID !== $current_user->ID) $show = FALSE; if($show && is_object($user) && !empty($user->ID) && $user->user_login === 'demo') $show = FALSE; // Lock Password on Demos. return apply_filters('ws_plugin__s2member_hide_password_fields', $show, get_defined_vars()); } /** * Acquires password minimum length. * * @package s2Member\User_Securities * @since 150717 * * @param string $password The password to score. * * @return integer Password minimum length. */ public static function min_password_length() { $min = (int)$GLOBALS['WS_PLUGIN__']['s2member']['o']['custom_reg_password_min_length']; return max(6, (int)apply_filters('ws_plugin__s2member_min_password_length', $min > 0 ? $min : 0)); } /** * Acquires minimum password strength code. * * @package s2Member\User_Securities * @since 150717 * * @return string Minimum password strength code. */ public static function min_password_strength_code() { $code = $GLOBALS['WS_PLUGIN__']['s2member']['o']['custom_reg_password_min_strength']; return apply_filters('ws_plugin__s2member_min_password_strength_code', trim($code)); } /** * Acquires minimum password strength label. * * @package s2Member\User_Securities * @since 150717 * * @return string Minimum password strength label. */ public static function min_password_strength_label() { switch(self::min_password_strength_code()) { case 'weak': return _x('`weak`, `good`, or `strong`', 's2member-front', 's2member'); case 'good': return _x('`good` or `strong` (i.e., use numbers, letters, and mixed caSe)', 's2member-front', 's2member'); case 'strong': return _x('`strong` (i.e., use numbers, letters, mixed caSe, and punctuation)', 's2member-front', 's2member'); } return ''; // Default behavior. } /** * Acquires minimum password strength score. * * @package s2Member\User_Securities * @since 150717 * * @return integer Minimum password strength score. */ public static function min_password_strength_score() { $score = 0; // Default behavior. switch(self::min_password_strength_code()) { case 'n/a': $score = 0; break; case 'weak': $score = 10; break; case 'good': $score = 30; break; case 'strong': $score = 50; break; } return apply_filters('ws_plugin__s2member_min_password_strength_score', $score > 0 ? $score : 0); } /** * Acquires password strength score. * * @package s2Member\User_Securities * @since 150717 * * @param string $password The password to score. * * @return integer Password strength score. */ public static function password_strength_score($password) { $score = 0; // Initialize score. if(strlen($password) < 1) return $score; else if(strlen($password) < self::min_password_length()) return $score; if(preg_match('/[0-9]/', $password)) $score += 10; if(preg_match('/[a-z]/', $password)) $score += 10; if(preg_match('/[A-Z]/', $password)) $score += 10; if(preg_match('/[^0-9a-zA-Z]/', $password)) $score += $score === 30 ? 20 : 10; return apply_filters('ws_plugin__s2member_password_strength_score', $score > 0 ? $score : 0); } } } ```