wp-members / includes / class-wp-members-validation-link.php

class-wp-members-validation-link.php in WP-Members Membership Plugin trunk, at includes/class-wp-members-validation-link.php

375 lines 10.7 KB

Raw Download Zip

1	<?php
2	/**
3	*
4	*
5	*/
6	class WP_Members_Validation_Link {
7
8	/**
9	* Meta containers
10	*
11	* @since 3.3.5
12	*/
13	public $validation_confirm = '_wpmem_user_confirmed';
14
15	/**
16	* Options.
17	*
18	* @since 3.3.5
19	*/
20	public $send_welcome = true;
21	public $show_success = true;
22	public $send_notify = true;
23	public $validated = false;
24	public $email_text;
25	public $invalid_message;
26	public $success_message;
27	public $moderated_message;
28
29	/**
30	* Initialize validation link feature.
31	*
32	* @since 3.3.5
33	*/
34	public function __construct() {
35
36	$defaults = array(
37	'email_text' => wpmem_get_text( 'validate_email_text' ), // 'Click to validate your account: '
38	'success_message' => wpmem_get_text( 'validate_success_msg' ), // 'Thank you for validating your account.'
39	'invalid_message' => wpmem_get_text( 'validate_invalid_msg' ), // 'Validation key was expired or invalid'
40	'moderated_message' => wpmem_get_text( 'validate_moderated_msg' ), // 'Your account is now pending approval'
41	);
42
43	/**
44	* Filter default dialogs.
45	*
46	* @since 3.3.8
47	*
48	* @param array $defaults
49	*/
50	$defaults = apply_filters( 'wpmem_validation_link_default_dialogs', $defaults );
51
52	foreach ( $defaults as $key => $value ) {
53	$this->{$key} = $value;
54	}
55
56	add_action( 'template_redirect', array( $this, 'validate_key' ) );
57	add_filter( 'authenticate', array( $this, 'check_validated' ), 99, 3 );
58	add_filter( 'wpmem_email_filter', array( $this, 'add_key_to_email' ), 10, 3 );
59	add_filter( 'the_content', array( $this, 'validation_success' ), 100 );
60
61	add_action( 'wpmem_account_validation_success', array( $this, 'set_as_logged_in' ), 9 );
62	add_action( 'wpmem_account_validation_success', array( $this, 'send_welcome' ) );
63	add_action( 'wpmem_account_validation_success', array( $this, 'notify_admin' ) );
64	}
65
66	/**
67	* Include the validation key in the new user registration email as a validation link.
68	*
69	* @since 3.3.5
70	*
71	* @param array $arr
72	* @param array $wpmem_fields
73	* @param array $field_data
74	* @return array
75	*/
76	public function add_key_to_email( $arr, $wpmem_fields, $field_data ) {
77
78	// Only do this for new registrations.
79	$email_type = ( wpmem_is_enabled( 'mod_reg' ) ) ? 'newmod' : 'newreg';
80	if ( $arr['toggle'] == $email_type ) {
81
82	$user = get_user_by( 'ID', intval( $arr['user_id'] ) );
83
84	/**
85	* Gets the user based on the password key.
86	*
87	* WP filters/actions triggered:
88	* - retrieve_password
89	* - allow_password_reset
90	* - retrieve_password_key
91	*
92	* @see: https://developer.wordpress.org/reference/functions/get_password_reset_key/
93	* @param WP_User User to retrieve password reset key for.
94	* @return string\|WP_Error Password reset key on success. WP_Error on error.
95	*/
96	$key = $this->set_validation_key( $user );
97
98	// Generate confirm link.
99	/**
100	* Filter the return url
101	*
102	* @since 3.3.5
103	* @since 3.3.9 Added $user object
104	*
105	* @param string The link URL (trailing slash recommended).
106	* @param object $user
107	*/
108	$url = apply_filters( 'wpmem_validation_link_return_url', trailingslashit( wpmem_profile_url() ), $user );
109	$query_args = array(
110	'a' => 'confirm',
111	'key' => $key,
112	'login' => $user->user_login,
113	);
114
115	// urlencode, primarily for user_login with a space.
116	$query_args = array_map( 'rawurlencode', $query_args );
117
118	$link = add_query_arg( $query_args, trailingslashit( $url ) );
119
120	/**
121	* Filter the confirmation link.
122	*
123	* @since 3.3.9
124	*
125	* @param string $link
126	* @param string $url
127	* @param array $query_args
128	*/
129	$link = apply_filters( 'wpmem_validation_link', $link, $url, $query_args );
130
131	$sanitized_link = esc_url_raw( $link );
132
133	// Does email body have the [confirm_link] shortcode?
134	if ( strpos( $arr['body'], '[confirm_link]' ) ) {
135	$arr['body'] = str_replace( '[confirm_link]', $sanitized_link, $arr['body'] );
136	} else {
137	// Add text and link to the email body.
138	$arr['body'] = $arr['body'] . "\r\n"
139	. $this->email_text . ' ' . $sanitized_link;
140	}
141	}
142
143	return $arr;
144	}
145
146	/**
147	* Check for a validation key and if one exists, validate and log in user.
148	*
149	* @since 3.3.5
150	*/
151	public function validate_key() {
152
153	// Check for validation key.
154	$key = ( 'confirm' == wpmem_get( 'a', false, 'get' ) ) ? wpmem_get( 'key', false, 'get' ) : false;
155	$login = ( 'confirm' == wpmem_get( 'a', false, 'get' ) ) ? wpmem_get( 'login', false, 'get' ) : false;
156
157	if ( false !== $key ) {
158
159	// Set an error container.
160	$errors = new WP_Error();
161
162	/**
163	* Validate the key.
164	*
165	* WP_Error will be invalid_key or expired_key. Process triggers password_reset_expiration filter
166	* filtering DAY_IN_SECONDS default. Filter password_reset_key_expired is also triggered filtering
167	* the return value (which can be used to override the expired/invalid check based on user_id).
168	*
169	* WP filter/actions triggered:
170	* - password_reset_expiration
171	* - password_reset_key_expired
172	*
173	* @see https://developer.wordpress.org/reference/functions/check_password_reset_key/
174	* @param string Hash to validate sending user's password.
175	* @param string The user login.
176	* @return WP_User\|WP_Error WP_User object on success, WP_Error object for invalid or expired keys (invalid_key\|expired_key).
177	*/
178	$user = check_password_reset_key( $key, $login );
179
180	if ( ! is_wp_error( $user ) ) {
181
182	$this->validated = true;
183
184	// Delete validation_key meta and set active.
185	$this->clear_activation_key( $user->ID );
186	$this->set_as_confirmed( $user->ID );
187
188	/**
189	* Fires when a user has successfully validated their account.
190	*
191	* @since 3.3.5
192	*
193	* @param int $user_id
194	*/
195	do_action( 'wpmem_account_validation_success', $user->ID );
196
197	} else {
198	$this->validated = false;
199	}
200	}
201	}
202
203	/**
204	* Display messaging.
205	*
206	* Shows success if key validates, expired if it does not.
207	*
208	* @since 3.3.5
209	*
210	* @param string $content
211	* @return string $content
212	*/
213	public function validation_success( $content ) {
214
215	if ( $this->show_success && 'confirm' == wpmem_get( 'a', false, 'get' ) && isset( $this->validated ) ) {
216
217	if ( true === $this->validated ) {
218	$msg = $this->success_message;
219
220	if ( wpmem_is_mod_reg() ) {
221	$user = get_user_by( 'login', sanitize_user( wpmem_get( 'login', false, 'get' ) ) );
222	if ( ! wpmem_is_user_activated( $user->ID ) ) {
223	$msg = $msg . ' ' . $this->moderated_message;
224	}
225	}
226	} elseif ( false === $this->validated ) {
227	$msg = $this->invalid_message;
228	} else {
229	$msg = '';
230	}
231
232	$content = wpmem_get_display_message( 'custom', $msg ) . $content;
233	}
234
235	return $content;
236	}
237
238	/**
239	* Checks if a user is activated during user authentication.
240	*
241	* This prevents access via login if the user has not confirmed their email.
242	*
243	* @since 3.3.5 Moved from core to user object.
244	*
245	* @param object $user The WordPress User object.
246	* @param string $username The user's username (user_login).
247	* @param string $password The user's password.
248	* @return object $user The WordPress User object.
249	*/
250	function check_validated( $user, $username, $password ) {
251	if ( ! is_wp_error( $user ) && ! is_null( $user ) && false == wpmem_is_user_confirmed( $user->ID ) ) {
252	$error_message = sprintf( wpmem_get_text( 'login_not_confirmed' ), '<strong>', '</strong>', '<a href="' . esc_url_raw( wpmem_reconfirm_url() ) . '">', '</a>' );
253	$user = new WP_Error( 'authentication_failed', $error_message );
254	}
255	/**
256	* Filters the check_validated result.
257	*
258	* @since 3.4.2
259	*
260	* @param mixed $user
261	* @param string $username
262	* @param string $password
263	*/
264	return apply_filters( 'wpmem_check_validated', $user, $username, $password );
265	}
266
267	/**
268	* Sets user as logged in upon validation (if moderated reg is not enabled).
269	*
270	* @since 3.5.0
271	*
272	* @param int $user_id
273	*/
274	public function set_as_logged_in( $user_id ) {
275	// If registration is not moderated, set the user as logged in.
276	if ( ! wpmem_is_enabled( 'mod_reg' ) ) {
277	wpmem_set_as_logged_in( $user_id );
278	}
279	}
280
281	/**
282	* Sends the welcome email to the user upon validation of their email.
283	*
284	* @since 3.3.5
285	* @since 3.3.8 Sends email specific to email validation (previously was moderated approved email).
286	*
287	* @param int $user_id
288	*/
289	public function send_welcome( $user_id ) {
290	if ( $this->send_welcome ) {
291	$email_to_send = ( wpmem_get_email_settings( 'wpmembers_email_validated' ) ) ? 'validated' : 'modreg';
292	wpmem_email_to_user( array( 'user_id'=>$user_id, 'tag'=>$email_to_send ) );
293	}
294	}
295
296	/**
297	* Sends notification email to the admin upon validation of the user's email.
298	*
299	* @since 3.3.5
300	*
301	* @param int $user_id
302	*/
303	public function notify_admin( $user_id ) {
304	if ( $this->send_notify ) {
305	wpmem_notify_admin( $user_id );
306	}
307	}
308
309	/**
310	* Clears user_activation_key.
311	*
312	* @since 3.3.8
313	*
314	* @param int $user_id
315	*/
316	public function clear_activation_key( $user_id ) {
317	global $wpdb;
318	$result = $wpdb->update( $wpdb->users, array( 'user_activation_key' => '', ), array( 'ID' => intval( $user_id ) ) );
319	//clean_user_cache( $user_id );
320	}
321
322	/**
323	* Sets a user activation key.
324	*
325	* @since 3.3.8
326	*
327	* @param mixed $user user ID (int)\|WP_User (object).
328	*/
329	public function set_validation_key( $user ) {
330	$user = ( is_object( $user ) ) ? $user : get_user_by( 'ID', intval( $user ) );
331	return get_password_reset_key( $user );
332	}
333
334	/**
335	* Sets user as having validated their email.
336	*
337	* @since 3.3.8
338	*
339	* @param int $user_id
340	*/
341	public function set_as_confirmed( $user_id ) {
342	update_user_meta( $user_id, $this->validation_confirm, time() );
343	/**
344	* Fires when user is set as confirmed (either manually or by user).
345	*
346	* @since 3.3.9
347	*
348	* @param int $user_id
349	* @param string time()
350	*/
351	do_action( 'wpmem_user_set_as_confirmed', $user_id, time() );
352	}
353
354	/**
355	* Sets user as NOT having validated their email.
356	*
357	* @since 3.3.8
358	*
359	* @param int $user_id
360	*/
361	public function set_as_unconfirmed( $user_id ) {
362	delete_user_meta( $user_id, $this->validation_confirm );
363	$validation_key = $this->set_validation_key( $user_id );
364	/**
365	* Fires when user is set as confirmed (either manually or by user).
366	*
367	* @since 3.3.9
368	*
369	* @param int $user_id
370	* @param string time()
371	* @param string $key
372	*/
373	do_action( 'wpmem_user_set_as_unconfirmed', $user_id, time(), $validation_key );
374	}
375	}