wp-force-login / wp-force-login.php

wp-force-login.php in Force Login 5.6.3, at wp-force-login.php

109 lines 3.3 KB

Raw Download Zip

1	<?php
2	/*
3	Plugin Name: Force Login
4	Plugin URI: https://wordpress.org/plugins/wp-force-login/
5	Description: Easily hide your WordPress site from public viewing by requiring visitors to log in first. Activate to turn on.
6	Version: 5.6.3
7	Author: Kevin Vess
8	Author URI: https://brightlightmedia.co/
9
10	Text Domain: wp-force-login
11	Domain Path: /languages
12
13	License: GPL2
14	License URI: https://www.gnu.org/licenses/gpl-2.0.html
15	*/
16
17	function v_forcelogin() {
18
19	// Exceptions for AJAX, Cron, or WP-CLI requests
20	if ( ( defined( 'DOING_AJAX' ) && DOING_AJAX ) \|\| ( defined( 'DOING_CRON' ) && DOING_CRON ) \|\| ( defined( 'WP_CLI' ) && WP_CLI ) ) {
21	return;
22	}
23
24	// Bail if the current visitor is a logged in user, unless Multisite is enabled
25	if ( is_user_logged_in() && ! is_multisite() ) {
26	return;
27	}
28
29	// Get visited URL
30	$schema = isset( $_SERVER['HTTPS'] ) && 'on' === $_SERVER['HTTPS'] ? 'https://' : 'http://';
31	$url = $schema . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
32
33	// Bail if visiting the login URL. Fix for custom login URLs
34	if ( preg_replace( '/\?./', '', wp_login_url() ) === preg_replace( '/\?./', '', $url ) ) {
35	return;
36	}
37
38	/**
39	* Whitelist filter.
40	*
41	* @since 3.0.0
42	* @deprecated 5.5.0 Use {@see 'v_forcelogin_bypass'} instead.
43	*
44	* @param array An array of absolute URLs.
45	*/
46	$allowed = apply_filters_deprecated( 'v_forcelogin_whitelist', array( array() ), '5.5.0', 'v_forcelogin_bypass' );
47
48	/**
49	* Bypass filter.
50	*
51	* @since 5.0.0
52	* @since 5.2.0 Added the `$url` parameter.
53	*
54	* @param bool Whether to disable Force Login. Default false.
55	* @param string $url The visited URL.
56	*/
57	$bypass = apply_filters( 'v_forcelogin_bypass', in_array( $url, $allowed ), $url );
58
59	// Bail if bypass is enabled
60	if ( $bypass ) {
61	return;
62	}
63
64	// Only allow Multisite users access to their assigned sites
65	if ( is_multisite() && is_user_logged_in() ) {
66	if ( ! is_user_member_of_blog() && ! current_user_can( 'setup_network' ) ) {
67	$message = apply_filters( 'v_forcelogin_multisite_message', __( "You're not authorized to access this site.", 'wp-force-login' ), $url );
68	wp_die( $message, get_option( 'blogname' ) . ' &rsaquo; ' . __( 'Error', 'wp-force-login' ) );
69	}
70	return;
71	}
72
73	// Determine redirect URL
74	$redirect_url = apply_filters( 'v_forcelogin_redirect', $url );
75
76	// Set the headers to prevent caching
77	nocache_headers();
78
79	// Redirect unauthorized visitors
80	wp_safe_redirect( wp_login_url( $redirect_url ), 302 );
81	exit;
82	}
83	add_action( 'template_redirect', 'v_forcelogin' );
84
85	/**
86	* Restrict REST API for authorized users only
87	*
88	* @since 5.1.0
89	* @param WP_Error\|null\|bool $result WP_Error if authentication error, null if authentication
90	* method wasn't used, true if authentication succeeded.
91	*
92	* @return WP_Error\|null\|bool
93	*/
94	function v_forcelogin_rest_access( $result ) {
95	if ( null === $result && ! is_user_logged_in() ) {
96	return new WP_Error( 'rest_unauthorized', __( 'Only authenticated users can access the REST API.', 'wp-force-login' ), array( 'status' => rest_authorization_required_code() ) );
97	}
98	return $result;
99	}
100	add_filter( 'rest_authentication_errors', 'v_forcelogin_rest_access', 99 );
101
102	/*
103	* Localization
104	*/
105	function v_forcelogin_load_textdomain() {
106	load_plugin_textdomain( 'wp-force-login', false, dirname( plugin_basename( __FILE__ ) ) . '/languages/' );
107	}
108	add_action( 'plugins_loaded', 'v_forcelogin_load_textdomain' );
109