| 1 |
<?php |
| 2 |
/* |
| 3 |
Plugin Name: Force Login |
| 4 |
Plugin URI: https://wordpress.org/plugins/wp-force-login/ |
| 5 |
Description: Easily hide your WordPress site from public viewing by requiring visitors to log in first. Activate to turn on. |
| 6 |
Version: 5.2 |
| 7 |
Author: Kevin Vess |
| 8 |
Author URI: http://vess.me/ |
| 9 |
|
| 10 |
Text Domain: wp-force-login |
| 11 |
Domain Path: /languages |
| 12 |
|
| 13 |
License: GPL2 |
| 14 |
License URI: https://www.gnu.org/licenses/gpl-2.0.html |
| 15 |
*/ |
| 16 |
|
| 17 |
function v_forcelogin() { |
| 18 |
|
| 19 |
// Exceptions for AJAX, Cron, or WP-CLI requests |
| 20 |
if ( ( defined( 'DOING_AJAX' ) && DOING_AJAX ) || ( defined( 'DOING_CRON' ) && DOING_CRON ) || ( defined( 'WP_CLI' ) && WP_CLI ) ) { |
| 21 |
return; |
| 22 |
} |
| 23 |
|
| 24 |
// Redirect unauthorized visitors |
| 25 |
if ( ! is_user_logged_in() ) { |
| 26 |
// Get URL |
| 27 |
$url = isset( $_SERVER['HTTPS'] ) && 'on' === $_SERVER['HTTPS'] ? 'https' : 'http'; |
| 28 |
$url .= '://' . $_SERVER['HTTP_HOST']; |
| 29 |
// port is prepopulated here sometimes |
| 30 |
if ( strpos( $_SERVER['HTTP_HOST'], ':' ) === FALSE ) { |
| 31 |
$url .= in_array( $_SERVER['SERVER_PORT'], array('80', '443') ) ? '' : ':' . $_SERVER['SERVER_PORT']; |
| 32 |
} |
| 33 |
$url .= $_SERVER['REQUEST_URI']; |
| 34 |
|
| 35 |
/** |
| 36 |
* Bypass filters. |
| 37 |
* |
| 38 |
* @since 3.0.0 The `$whitelist` filter was added. |
| 39 |
* @since 4.0.0 The `$bypass` filter was added. |
| 40 |
* @since 5.2.0 The `$url` parameter was added. |
| 41 |
*/ |
| 42 |
$bypass = apply_filters( 'v_forcelogin_bypass', false, $url ); |
| 43 |
$whitelist = apply_filters( 'v_forcelogin_whitelist', array(), $url ); |
| 44 |
|
| 45 |
// Redirect |
| 46 |
if ( preg_replace( '/\?.*/', '', $url ) != preg_replace( '/\?.*/', '', wp_login_url() ) && ! in_array( $url, $whitelist ) && ! $bypass ) { |
| 47 |
$redirect_url = apply_filters( 'v_forcelogin_redirect', $url ); |
| 48 |
wp_safe_redirect( wp_login_url( $redirect_url ), 302 ); exit; |
| 49 |
} |
| 50 |
} |
| 51 |
elseif ( function_exists('is_multisite') && is_multisite() ) { |
| 52 |
// Only allow Multisite users access to their assigned sites |
| 53 |
if ( ! is_user_member_of_blog() && ! current_user_can('setup_network') ) { |
| 54 |
wp_die( __( "You're not authorized to access this site.", 'wp-force-login' ), get_option('blogname') . ' › ' . __( "Error", 'wp-force-login' ) ); |
| 55 |
} |
| 56 |
} |
| 57 |
} |
| 58 |
add_action( 'template_redirect', 'v_forcelogin' ); |
| 59 |
|
| 60 |
/** |
| 61 |
* Restrict REST API for authorized users only |
| 62 |
* |
| 63 |
* @since 5.1.0 |
| 64 |
* @param WP_Error|null|bool $result WP_Error if authentication error, null if authentication |
| 65 |
* method wasn't used, true if authentication succeeded. |
| 66 |
*/ |
| 67 |
function v_forcelogin_rest_access( $result ) { |
| 68 |
if ( null === $result && ! is_user_logged_in() ) { |
| 69 |
return new WP_Error( 'rest_unauthorized', __( "Only authenticated users can access the REST API.", 'wp-force-login' ), array( 'status' => rest_authorization_required_code() ) ); |
| 70 |
} |
| 71 |
return $result; |
| 72 |
} |
| 73 |
add_filter( 'rest_authentication_errors', 'v_forcelogin_rest_access', 99 ); |
| 74 |
|
| 75 |
/* |
| 76 |
* Localization |
| 77 |
*/ |
| 78 |
function v_forcelogin_load_textdomain() { |
| 79 |
load_plugin_textdomain( 'wp-force-login', false, dirname( plugin_basename( __FILE__ ) ) . '/languages/' ); |
| 80 |
} |
| 81 |
add_action( 'plugins_loaded', 'v_forcelogin_load_textdomain' ); |
| 82 |
|
