← All changes | classes/FormHandler.php +133 -104 trunk → 1.6.0 View file →

		@@ -1,65 +1,88 @@
1	1	<?php
2	2	/**
3		- * Manage Form
	3	+ * FormHandler class
4	4	*
	5	+ * @author: themeum
	6	+ * @author_uri: https://themeum.com
5	7	* @package Tutor
6		- * @author Themeum <support@themeum.com>
7		- * @link https://themeum.com
8		- * @since 1.4.3
	8	+ * @since v.1.4.3
9	9	*/
10	10
11	11	namespace TUTOR;
12	12
13		-if ( ! defined( 'ABSPATH' ) ) {
	13	+
	14	+if ( ! defined( 'ABSPATH' ) )
14	15	exit;
15		-}
16	16
17		-/**
18		- * FormHandler class
19		- *
20		- * @since 1.4.3
21		- */
	17	+
22	18	class FormHandler {
23	19
24		- /**
25		- * Constructor
26		- *
27		- * @since 1.4.3
28		- * @return void
29		- */
30	20	public function __construct() {
31		- add_action( 'tutor_action_tutor_retrieve_password', array( $this, 'tutor_retrieve_password' ) );
32		- add_action( 'tutor_action_tutor_process_reset_password', array( $this, 'tutor_process_reset_password' ) );
	21	+ add_action('tutor_action_tutor_user_login', array($this, 'process_login'));
	22	+ add_action('tutor_action_tutor_retrieve_password', array($this, 'tutor_retrieve_password'));
	23	+ add_action('tutor_action_tutor_process_reset_password', array($this, 'tutor_process_reset_password'));
	24	+
	25	+ add_action( 'tutor_reset_password_notification', array( $this, 'reset_password_notification' ), 10, 2 );
33	26	add_filter( 'tutor_lostpassword_url', array( $this, 'lostpassword_url' ) );
34	27	}
35	28
36		- /**
37		- * Retrieve Password
38		- *
39		- * @since 1.4.3
40		- *
41		- * @return void|bool
42		- */
43		- public function tutor_retrieve_password() {
	29	+ public function process_login(){
44	30	tutils()->checking_nonce();
45	31
46		- /**
47		- * To check spam or other logic before form process.
48		- *
49		- * @since 2.1.10
50		- */
51		- $before_form_process = apply_filters( 'tutor_before_retrieve_password_form_process', null );
52		- if ( is_wp_error( $before_form_process ) ) {
53		- tutor_flash_set( 'danger', $before_form_process->get_error_message() );
54		- return false;
	32	+ $username = tutils()->array_get('log', $_POST);
	33	+ $password = tutils()->array_get('pwd', $_POST);
	34	+
	35	+ try {
	36	+ $creds = array(
	37	+ 'user_login' => trim( wp_unslash( $username ) ), // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
	38	+ 'user_password' => $password, // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized, WordPress.Security.ValidatedSanitizedInput.MissingUnslash
	39	+ 'remember' => isset( $_POST['rememberme'] ), // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
	40	+ );
	41	+
	42	+ $validation_error = new \WP_Error();
	43	+ $validation_error = apply_filters( 'tutor_process_login_errors', $validation_error, $creds['user_login'], $creds['user_password'] );
	44	+
	45	+ if ( $validation_error->get_error_code() ) {
	46	+ throw new \Exception( '<strong>' . __( 'Error:', 'tutor' ) . '</strong> ' . $validation_error->get_error_message() );
	47	+ }
	48	+
	49	+ if ( empty( $creds['user_login'] ) ) {
	50	+ throw new \Exception( '<strong>' . __( 'Error:', 'tutor' ) . '</strong> ' . __( 'Username is required.', 'tutor' ) );
	51	+ }
	52	+
	53	+ // On multisite, ensure user exists on current site, if not add them before allowing login.
	54	+ if ( is_multisite() ) {
	55	+ $user_data = get_user_by( is_email( $creds['user_login'] ) ? 'email' : 'login', $creds['user_login'] );
	56	+
	57	+ if ( $user_data && ! is_user_member_of_blog( $user_data->ID, get_current_blog_id() ) ) {
	58	+ add_user_to_blog( get_current_blog_id(), $user_data->ID, 'customer' );
	59	+ }
	60	+ }
	61	+
	62	+ // Perform the login.
	63	+ $user = wp_signon( apply_filters( 'tutor_login_credentials', $creds ), is_ssl() );
	64	+
	65	+ if ( is_wp_error( $user ) ) {
	66	+ $message = $user->get_error_message();
	67	+ $message = str_replace( '<strong>' . esc_html( $creds['user_login'] ) . '</strong>', '<strong>' . esc_html( $creds['user_login'] ) . '</strong>', $message );
	68	+ throw new \Exception( $message );
	69	+ } else {
	70	+ tutor_redirect_back(apply_filters('tutor_login_redirect_url', tutils()->tutor_dashboard_url()));
	71	+ }
	72	+ } catch ( \Exception $e ) {
	73	+ tutor_flash_set('warning', apply_filters( 'login_errors', $e->getMessage()) );
	74	+ do_action( 'tutor_login_failed' );
55	75	}
	76	+ }
56	77
57		- //phpcs:ignore WordPress.Security.NonceVerification.Missing
58		- $login = sanitize_user( tutils()->array_get( 'user_login', $_POST ) );
	78	+ public function tutor_retrieve_password(){
	79	+ tutils()->checking_nonce();
59	80
	81	+ $login = sanitize_user( tutils()->array_get('user_login', $_POST));
	82	+
60	83	if ( empty( $login ) ) {
61		- tutor_flash_set( 'danger', __( 'Enter a username or email address.', 'tutor' ) );
	84	+ tutor_flash_set('danger', __( 'Enter a username or email address.', 'tutor' ));
62	85	return false;
63	86	} else {
64	87	// Check on username first, as customers can use emails as usernames.
65	88	$user_data = get_user_by( 'login', $login );
		@@ -74,19 +97,19 @@
74	97
75	98	do_action( 'lostpassword_post', $errors );
76	99
77	100	if ( $errors->get_error_code() ) {
78		- tutor_flash_set( 'danger', $errors->get_error_message() );
	101	+ tutor_flash_set('danger', $errors->get_error_message() );
79	102	return false;
80	103	}
81	104
82	105	if ( ! $user_data ) {
83		- tutor_flash_set( 'danger', __( 'Invalid username or email.', 'tutor' ) );
	106	+ tutor_flash_set('danger', __( 'Invalid username or email.', 'tutor' ) );
84	107	return false;
85	108	}
86	109
87	110	if ( is_multisite() && ! is_user_member_of_blog( $user_data->ID, get_current_blog_id() ) ) {
88		- tutor_flash_set( 'danger', __( 'Invalid username or email.', 'tutor' ) );
	111	+ tutor_flash_set('danger', __( 'Invalid username or email.', 'tutor' ) );
89	112	return false;
90	113	}
91	114
92	115	// Redefining user_login ensures we return the right case in the email.
		@@ -96,110 +119,116 @@
96	119
97	120	$allow = apply_filters( 'allow_password_reset', true, $user_data->ID );
98	121
99	122	if ( ! $allow ) {
100		- tutor_flash_set( 'danger', __( 'Password reset is not allowed for this user', 'tutor' ) );
	123	+ tutor_flash_set('danger', __( 'Password reset is not allowed for this user', 'tutor' ) );
101	124	return false;
102	125	} elseif ( is_wp_error( $allow ) ) {
103		- tutor_flash_set( 'danger', $allow->get_error_message() );
	126	+ tutor_flash_set('danger', $allow->get_error_message() );
104	127	return false;
105	128	}
106	129
107		- $errors = retrieve_password();
108		- if ( is_wp_error( $errors ) ) {
109		- tutor_flash_set( 'danger', $errors->get_error_message() );
110		- return false;
111		- }
	130	+ // Get password reset key (function introduced in WordPress 4.4).
	131	+ $key = get_password_reset_key($user_data);
112	132
113		- $html = '<p> ' . __( "We've sent an email to this account's email address. Click the link in the email to reset your password. If you don't see the email, check other places it might be, like your junk, spam, social, promotion or others folders.", 'tutor' ) . '</p>';
114		- tutor_flash_set( 'success', $html );
	133	+ // Send email notification.
	134	+ do_action( 'tutor_reset_password_notification', $user_login, $key );
115	135	}
116	136
117		- /**
118		- * Get lost password URL
119		- *
120		- * @since 1.4.3
121		- *
122		- * @param string $url URL.
123		- * @return string
124		- */
125		- public function lostpassword_url( $url ) {
126		- return tutils()->tutor_dashboard_url( 'retrieve-password' );
	137	+ public function reset_password_notification( $user_login = '', $reset_key = ''){
	138	+ $this->sendNotification($user_login, $reset_key);
	139	+
	140	+ $html = "<h3>".__('Check your E-Mail', 'tutor')."</h3>";
	141	+ $html .= "<p>".__("We've sent an email to this account's email address. Click the link in the email to reset your password", 'tutor')."</p>";
	142	+ $html .= "<p>".__("If you don't see the email, check other places it might be, like your junk, spam, social, promotion or others folders.", 'tutor')."</p>";
	143	+ tutor_flash_set('success', $html);
127	144	}
128	145
129		- /**
130		- * Handle reset password request
131		- *
132		- * @since 1.4.3
133		- * @return void|bool
134		- */
135		- public function tutor_process_reset_password() {
	146	+ public function lostpassword_url($url){
	147	+ return tutils()->tutor_dashboard_url('retrieve-password');
	148	+ }
	149	+
	150	+ public function tutor_process_reset_password(){
136	151	tutils()->checking_nonce();
137	152
138		- $reset_key = Input::post( 'reset_key' );
139		- $user_id = Input::post( 'user_id', 0, Input::TYPE_INT );
140		- $password = Input::post( 'password' );
141		- $confirm_password = Input::post( 'confirm_password' );
	153	+ $reset_key = sanitize_text_field(tutils()->array_get('reset_key', $_POST));
	154	+ $user_id = (int) sanitize_text_field(tutils()->array_get('user_id', $_POST));
	155	+ $password = sanitize_text_field(tutils()->array_get('password', $_POST));
	156	+ $confirm_password = sanitize_text_field(tutils()->array_get('confirm_password', $_POST));
142	157
143		- $user = get_user_by( 'ID', $user_id );
	158	+ $user = get_user_by('ID', $user_id);
144	159	$user = check_password_reset_key( $reset_key, $user->user_login );
145	160
146	161	if ( is_wp_error( $user ) ) {
147		- tutor_flash_set( 'danger', __( 'This key is invalid or has already been used. Please reset your password again if needed.', 'tutor' ) );
	162	+ tutor_flash_set('danger', __( 'This key is invalid or has already been used. Please reset your password again if needed.', 'tutor') );
148	163	return false;
149	164	}
150	165
	166	+
151	167	if ( $user instanceof \WP_User ) {
152		- if ( ! $password ) {
153		- tutor_flash_set( 'danger', __( 'Please enter your password.', 'tutor' ) );
	168	+ if ( !$password ) {
	169	+ tutor_flash_set('danger', __( 'Please enter your password.', 'tutor') );
154	170	return false;
155	171	}
156	172
157		- if ( $password !== $confirm_password ) {
158		- tutor_flash_set( 'danger', __( 'Passwords do not match.', 'tutor' ) );
	173	+ if ( $password !== $confirm_password) {
	174	+ tutor_flash_set('danger', __( 'Passwords do not match.', 'tutor') );
159	175	return false;
160	176	}
161	177
162		- tutils()->reset_password( $user, $password );
	178	+ tutils()->reset_password($user, $password);
163	179
164	180	do_action( 'tutor_user_reset_password', $user );
165	181
166	182	// Perform the login.
167		- $creds = array(
168		- 'user_login' => $user->user_login,
169		- 'user_password' => $password,
170		- 'remember' => true,
171		- );
172		- $user = wp_signon( apply_filters( 'tutor_login_credentials', $creds ), is_ssl() );
	183	+ $creds = array('user_login' => $user->user_login, 'user_password' => $password, 'remember' => true);
	184	+ $user = wp_signon( apply_filters( 'tutor_login_credentials', $creds ), is_ssl() );
173	185
174	186	do_action( 'tutor_user_reset_password_login', $user );
175	187
176		- wp_safe_redirect( tutor_utils()->tutor_dashboard_url() );
	188	+ wp_safe_redirect( tutils()->tutor_dashboard_url() );
177	189	exit;
178	190	}
179	191	}
180	192
181	193	/**
182		- * Get e-mail from address
	194	+ * @param $user_login
	195	+ * @param $reset_key
183	196	*
184		- * @since 1.4.3
185		- * @return string
	197	+ * Send E-Mail notification
	198	+ * We are sending directly right now, later we will introduce centralised E-Mail notification System...
186	199	*/
187		- public function get_from_address() {
188		- $from_address = get_tutor_option( 'email_from_address' );
189		- $default = ! $from_address ? get_option( 'admin_email' ) : $from_address;
190		- return apply_filters( 'tutor_email_from_address', $default );
	200	+ public function sendNotification($user_login, $reset_key){
	201	+ //Send the E-Mail to user
	202	+
	203	+ $user_data = get_user_by( 'login', $user_login );
	204	+
	205	+ $variable = array(
	206	+ 'user_login' => $user_login,
	207	+ 'reset_key' => $reset_key,
	208	+ 'user_id' => $user_data->ID,
	209	+ );
	210	+
	211	+ $html = tutor_get_template_html('email.send-reset-password', $variable);
	212	+ $subject = sprintf(__( 'Password Reset Request for %s', 'tutor' ), get_option( 'blogname' ));
	213	+
	214	+ $header = 'Content-Type: text/html' . "\r\n";
	215	+
	216	+ add_filter( 'wp_mail_from', array( $this, 'get_from_address' ) );
	217	+ add_filter( 'wp_mail_from_name', array( $this, 'get_from_name' ) );
	218	+
	219	+ wp_mail($user_data->user_email, $subject, $html, $header);
	220	+
	221	+ remove_filter( 'wp_mail_from', array( $this, 'get_from_address' ) );
	222	+ remove_filter( 'wp_mail_from_name', array( $this, 'get_from_name' ) );
191	223	}
192	224
193		- /**
194		- * Get e-mail from name
195		- *
196		- * @since 1.4.3
197		- * @return string
198		- */
199		- public function get_from_name() {
200		- $from_name = get_tutor_option( 'email_from_name' );
201		- $default = ! $from_name ? get_option( 'blogname' ) : $from_name;
202		- return apply_filters( 'tutor_email_from_name', $default );
	225	+ public function get_from_address(){
	226	+ return apply_filters('tutor_email_from_address', get_tutor_option('email_from_address'));
203	227	}
204	228
205		-}
	229	+ public function get_from_name(){
	230	+ return apply_filters('tutor_email_from_name', get_tutor_option('email_from_name'));
	231	+ }
	232	+
	233	+
	234	+}