| 1 |
<?php |
| 2 |
/* |
| 3 |
Plugin Name: Force Login |
| 4 |
Plugin URI: https://wordpress.org/plugins/wp-force-login/ |
| 5 |
Description: Easily hide your WordPress site from public viewing by requiring visitors to log in first. Activate to turn on. |
| 6 |
Version: 5.6 |
| 7 |
Author: Kevin Vess |
| 8 |
Author URI: http://vess.me/ |
| 9 |
|
| 10 |
Text Domain: wp-force-login |
| 11 |
Domain Path: /languages |
| 12 |
|
| 13 |
License: GPL2 |
| 14 |
License URI: https://www.gnu.org/licenses/gpl-2.0.html |
| 15 |
*/ |
| 16 |
|
| 17 |
function v_forcelogin() { |
| 18 |
|
| 19 |
// Exceptions for AJAX, Cron, or WP-CLI requests |
| 20 |
if ( ( defined( 'DOING_AJAX' ) && DOING_AJAX ) || ( defined( 'DOING_CRON' ) && DOING_CRON ) || ( defined( 'WP_CLI' ) && WP_CLI ) ) { |
| 21 |
return; |
| 22 |
} |
| 23 |
|
| 24 |
// Bail if the current visitor is a logged in user, unless Multisite is enabled |
| 25 |
if ( is_user_logged_in() && ! is_multisite() ) { |
| 26 |
return; |
| 27 |
} |
| 28 |
|
| 29 |
// Get visited URL |
| 30 |
$schema = isset( $_SERVER['HTTPS'] ) && 'on' === $_SERVER['HTTPS'] ? 'https://' : 'http://'; |
| 31 |
$url = $schema . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI']; |
| 32 |
|
| 33 |
/** |
| 34 |
* Whitelist filter. |
| 35 |
* |
| 36 |
* @since 3.0.0 |
| 37 |
* @deprecated 5.5.0 Use {@see 'v_forcelogin_bypass'} instead. |
| 38 |
* |
| 39 |
* @param array An array of absolute URLs. |
| 40 |
*/ |
| 41 |
$allowed = apply_filters_deprecated( 'v_forcelogin_whitelist', array( array() ), '5.5.0', 'v_forcelogin_bypass' ); |
| 42 |
|
| 43 |
/** |
| 44 |
* Bypass filter. |
| 45 |
* |
| 46 |
* @since 5.0.0 |
| 47 |
* @since 5.2.0 Added the `$url` parameter. |
| 48 |
* |
| 49 |
* @param bool Whether to disable Force Login. Default false. |
| 50 |
* @param string $url The visited URL. |
| 51 |
*/ |
| 52 |
$bypass = apply_filters( 'v_forcelogin_bypass', in_array( $url, $allowed ), $url ); |
| 53 |
|
| 54 |
// Bail if bypass is enabled |
| 55 |
if ( $bypass ) { |
| 56 |
return; |
| 57 |
} |
| 58 |
|
| 59 |
// Only allow Multisite users access to their assigned sites |
| 60 |
if ( is_multisite() && ! is_user_member_of_blog() && ! current_user_can( 'setup_network' ) ) { |
| 61 |
$message = apply_filters( 'v_forcelogin_multisite_message', __( "You're not authorized to access this site.", 'wp-force-login' ), $url ); |
| 62 |
wp_die( $message, get_option( 'blogname' ) . ' › ' . __( 'Error', 'wp-force-login' ) ); |
| 63 |
} |
| 64 |
|
| 65 |
// Determine redirect URL |
| 66 |
$redirect_url = apply_filters( 'v_forcelogin_redirect', $url ); |
| 67 |
|
| 68 |
// Set the headers to prevent caching |
| 69 |
nocache_headers(); |
| 70 |
|
| 71 |
// Redirect unauthorized visitors |
| 72 |
wp_safe_redirect( wp_login_url( $redirect_url ), 302 ); |
| 73 |
exit; |
| 74 |
} |
| 75 |
add_action( 'template_redirect', 'v_forcelogin' ); |
| 76 |
|
| 77 |
/** |
| 78 |
* Restrict REST API for authorized users only |
| 79 |
* |
| 80 |
* @since 5.1.0 |
| 81 |
* @param WP_Error|null|bool $result WP_Error if authentication error, null if authentication |
| 82 |
* method wasn't used, true if authentication succeeded. |
| 83 |
* |
| 84 |
* @return WP_Error|null|bool |
| 85 |
*/ |
| 86 |
function v_forcelogin_rest_access( $result ) { |
| 87 |
if ( null === $result && ! is_user_logged_in() ) { |
| 88 |
return new WP_Error( 'rest_unauthorized', __( 'Only authenticated users can access the REST API.', 'wp-force-login' ), array( 'status' => rest_authorization_required_code() ) ); |
| 89 |
} |
| 90 |
return $result; |
| 91 |
} |
| 92 |
add_filter( 'rest_authentication_errors', 'v_forcelogin_rest_access', 99 ); |
| 93 |
|
| 94 |
/* |
| 95 |
* Localization |
| 96 |
*/ |
| 97 |
function v_forcelogin_load_textdomain() { |
| 98 |
load_plugin_textdomain( 'wp-force-login', false, dirname( plugin_basename( __FILE__ ) ) . '/languages/' ); |
| 99 |
} |
| 100 |
add_action( 'plugins_loaded', 'v_forcelogin_load_textdomain' ); |
| 101 |
|
