Installer
5 years ago
AdminNotices.php
4 years ago
AjaxHandler.php
4 years ago
Autologin.php
4 years ago
BuddyPressBbPress.php
5 years ago
EditUserProfile.php
4 years ago
ExtensionManager.php
4 years ago
FileUploader.php
4 years ago
FormPreviewHandler.php
5 years ago
FormRepository.php
4 years ago
FormShortcodeDefaults.php
5 years ago
GDPR.php
4 years ago
Geolocation.php
4 years ago
GlobalSiteAccess.php
4 years ago
ImageUploader.php
4 years ago
LoginAuth.php
4 years ago
Miscellaneous.php
4 years ago
ModifyRedirectDefaultLinks.php
4 years ago
PPRESS_Session.php
4 years ago
PROFILEPRESS_sql.php
4 years ago
PasswordReset.php
4 years ago
ProfileUrlRewrite.php
4 years ago
RegistrationAuth.php
4 years ago
SendEmail.php
4 years ago
ShortcodeThemeFactory.php
5 years ago
UserAvatar.php
4 years ago
UserSignupLocationListingPage.php
4 years ago
UsernameEmailRestrictLogin.php
4 years ago
WPProfileFieldParserTrait.php
4 years ago
WelcomeEmailAfterSignup.php
4 years ago
default-email-template.php
4 years ago
index.php
5 years ago
RegistrationAuth.php
471 lines
| 1 | <?php |
| 2 | |
| 3 | namespace ProfilePress\Core\Classes; |
| 4 | |
| 5 | use ProfilePress\Libsodium\UserModeration\UserModeration; |
| 6 | use ProfilePress\Libsodium\UserModeration\UserModerationNotification; |
| 7 | use WP_Error; |
| 8 | |
| 9 | class RegistrationAuth |
| 10 | { |
| 11 | protected static $registration_form_status; |
| 12 | |
| 13 | public static function is_ajax() |
| 14 | { |
| 15 | return defined('DOING_AJAX') && DOING_AJAX; |
| 16 | } |
| 17 | |
| 18 | /** |
| 19 | * Wrapper function for call to the welcome email class |
| 20 | * |
| 21 | * @param int $user_id |
| 22 | * @param string $password |
| 23 | * @param string $form_id |
| 24 | */ |
| 25 | public static function send_welcome_email($user_id, $password = '', $form_id = '') |
| 26 | { |
| 27 | $status = apply_filters('ppress_activate_send_welcome_email', ppress_get_setting('welcome_message_email_enabled', 'on')); |
| 28 | |
| 29 | if ($status == 'on') { |
| 30 | |
| 31 | do_action('ppress_before_send_welcome_mail', $user_id, $form_id); |
| 32 | |
| 33 | new WelcomeEmailAfterSignup($user_id, $password); |
| 34 | |
| 35 | do_action('ppress_after_send_welcome_mail', $user_id, $form_id); |
| 36 | } |
| 37 | } |
| 38 | |
| 39 | /** |
| 40 | * |
| 41 | * Wrapper function for call to the automatic login after reg function |
| 42 | * |
| 43 | * @param int $user_id |
| 44 | * @param int $form_id |
| 45 | * @param string $redirect redirect url after registration |
| 46 | * |
| 47 | * @return mixed |
| 48 | */ |
| 49 | public static function auto_login_after_reg($user_id, $form_id, $redirect) |
| 50 | { |
| 51 | if ( ! empty($redirect)) { |
| 52 | return Autologin::initialize($user_id, $form_id, $redirect); |
| 53 | } |
| 54 | |
| 55 | $auto_login_option = apply_filters('ppress_activate_auto_login_after_signup', ppress_get_setting('set_auto_login_after_reg', ''), $form_id); |
| 56 | |
| 57 | if ($auto_login_option == 'on') { |
| 58 | return Autologin::initialize($user_id, $form_id); |
| 59 | } |
| 60 | } |
| 61 | |
| 62 | /** |
| 63 | * Perform redirect after registration without logging the user in. |
| 64 | * |
| 65 | * @param int $form_id |
| 66 | * @param string $no_login_redirect URL to redirect to. |
| 67 | * |
| 68 | * @return array |
| 69 | */ |
| 70 | public static function no_login_redirect_after_reg($form_id, $no_login_redirect) |
| 71 | { |
| 72 | esc_url_raw($no_login_redirect); |
| 73 | |
| 74 | do_action('ppress_before_no_login_redirect_after_reg', $no_login_redirect, $form_id); |
| 75 | if (self::is_ajax()) { |
| 76 | // we are returning array to uniquely identify redirect. |
| 77 | return [$no_login_redirect]; |
| 78 | } |
| 79 | |
| 80 | nocache_headers(); |
| 81 | |
| 82 | wp_safe_redirect($no_login_redirect); |
| 83 | exit; |
| 84 | } |
| 85 | |
| 86 | /** |
| 87 | * Register new users |
| 88 | * |
| 89 | * @param array $post user form submitted data |
| 90 | * @param int $form_id Registration builder ID |
| 91 | * @param string $redirect URL to redirect to after registration. |
| 92 | * |
| 93 | * @param bool $is_melange |
| 94 | * @param string $no_login_redirect |
| 95 | * |
| 96 | * @return string|void |
| 97 | */ |
| 98 | public static function register_new_user($post, $form_id = 0, $redirect = '', $is_melange = false, $no_login_redirect = '') |
| 99 | { |
| 100 | if ( ! get_option('users_can_register')) return; |
| 101 | |
| 102 | $files = $_FILES; |
| 103 | |
| 104 | // create an array of acceptable userdata for use by wp_insert_user |
| 105 | $valid_userdata = array( |
| 106 | 'reg_username', |
| 107 | 'reg_password', |
| 108 | 'reg_password2', |
| 109 | 'reg_email2', |
| 110 | 'reg_password_present', |
| 111 | 'reg_email', |
| 112 | 'reg_website', |
| 113 | 'reg_nickname', |
| 114 | 'reg_display_name', |
| 115 | 'reg_first_name', |
| 116 | 'reg_last_name', |
| 117 | 'reg_bio', |
| 118 | 'reg_select_role', |
| 119 | ); |
| 120 | |
| 121 | // get the data for userdata |
| 122 | $segregated_userdata = array(); |
| 123 | |
| 124 | // loop over the $_POST data and create an array of the wp_insert_user userdata |
| 125 | foreach ($post as $key => $value) { |
| 126 | if ($key == 'reg_submit') { |
| 127 | continue; |
| 128 | } |
| 129 | |
| 130 | if (in_array($key, $valid_userdata)) { |
| 131 | |
| 132 | if (in_array($key, ['reg_email', 'reg_email2'])) { |
| 133 | $segregated_userdata[$key] = sanitize_email($value); |
| 134 | continue; |
| 135 | } |
| 136 | |
| 137 | // sanitize_textarea_field is used to preserve any line breaks |
| 138 | $segregated_userdata[$key] = sanitize_textarea_field($value); |
| 139 | } |
| 140 | } |
| 141 | |
| 142 | $email = isset($segregated_userdata['reg_email']) ? $segregated_userdata['reg_email'] : ''; |
| 143 | |
| 144 | $email2 = isset($segregated_userdata['reg_email2']) ? $segregated_userdata['reg_email2'] : null; |
| 145 | |
| 146 | // get convert the form post data to userdata for use by wp_insert_users |
| 147 | $username = isset($segregated_userdata['reg_username']) ? $segregated_userdata['reg_username'] : ''; |
| 148 | |
| 149 | // Handle username creation when username requirement is disabled. |
| 150 | if (ppress_is_signup_form_username_disabled($form_id, $is_melange)) { |
| 151 | $username = sanitize_user(current(explode('@', $email)), true); |
| 152 | // Ensure username is unique. |
| 153 | $append = 1; |
| 154 | $o_username = $username; |
| 155 | while (username_exists($username)) { |
| 156 | $username = $o_username . $append; |
| 157 | $append++; |
| 158 | } |
| 159 | } |
| 160 | |
| 161 | $username = apply_filters('ppress_registration_username_value', $username); |
| 162 | |
| 163 | $password = apply_filters('ppress_registration_password_value', isset($segregated_userdata['reg_password']) ? $segregated_userdata['reg_password'] : ''); |
| 164 | |
| 165 | $flag_to_send_password_reset = false; |
| 166 | |
| 167 | // if the reg_password field isn't present in registration, generate a password for the user and set a flag to send a password reset message |
| 168 | if (empty($password) && (empty($segregated_userdata['reg_password_present']) || $segregated_userdata['reg_password_present'] != 'true')) { |
| 169 | $password = wp_generate_password(24); |
| 170 | $flag_to_send_password_reset = apply_filters('ppress_enable_auto_send_password_reset_flag', true); |
| 171 | } |
| 172 | |
| 173 | $password2 = isset($segregated_userdata['reg_password2']) ? $segregated_userdata['reg_password2'] : null; |
| 174 | $website = isset($segregated_userdata['reg_website']) ? $segregated_userdata['reg_website'] : ''; |
| 175 | $nickname = isset($segregated_userdata['reg_nickname']) ? $segregated_userdata['reg_nickname'] : ''; |
| 176 | $display_name = isset($segregated_userdata['reg_display_name']) ? $segregated_userdata['reg_display_name'] : ''; |
| 177 | $first_name = isset($segregated_userdata['reg_first_name']) ? $segregated_userdata['reg_first_name'] : ''; |
| 178 | $last_name = isset($segregated_userdata['reg_last_name']) ? $segregated_userdata['reg_last_name'] : ''; |
| 179 | $bio = isset($segregated_userdata['reg_bio']) ? $segregated_userdata['reg_bio'] : ''; |
| 180 | $role = isset($segregated_userdata['reg_select_role']) ? $segregated_userdata['reg_select_role'] : ''; |
| 181 | |
| 182 | // real uer data |
| 183 | $real_userdata = array( |
| 184 | 'user_login' => $username, |
| 185 | 'user_pass' => $password, |
| 186 | 'user_email' => apply_filters('ppress_registration_email_value', $email), |
| 187 | 'user_url' => apply_filters('ppress_registration_website_value', $website), |
| 188 | 'nickname' => apply_filters('ppress_registration_nickname_value', $nickname), |
| 189 | 'display_name' => apply_filters('ppress_registration_display_name_value', $display_name), |
| 190 | 'first_name' => apply_filters('ppress_registration_first_name_value', $first_name), |
| 191 | 'last_name' => apply_filters('ppress_registration_last_name_value', $last_name), |
| 192 | 'description' => apply_filters('ppress_registration_bio_value', $bio), |
| 193 | ); |
| 194 | |
| 195 | if ( ! empty($role)) { |
| 196 | // acceptable defined roles in reg-select-role shortcode. |
| 197 | $accepted_role = (array)self::acceptable_defined_roles($form_id); |
| 198 | |
| 199 | if ($role != 'administrator' && in_array($role, $accepted_role)) { |
| 200 | $real_userdata['role'] = $role; |
| 201 | } |
| 202 | } else { |
| 203 | |
| 204 | $builder_role = FormRepository::get_form_meta($form_id, FormRepository::REGISTRATION_TYPE, FormRepository::REGISTRATION_USER_ROLE); |
| 205 | |
| 206 | if ( ! empty($builder_role)) { |
| 207 | // only set user role if the registration form has one set |
| 208 | // otherwise no role is set for the user thus wp_insert_user will use the default user role set in Settings > General |
| 209 | $real_userdata['role'] = $builder_role; |
| 210 | } |
| 211 | } |
| 212 | |
| 213 | /* start filter Hook */ |
| 214 | $reg_errors = new WP_Error(); |
| 215 | |
| 216 | // --------START --------- validation for required fields ----------------------// |
| 217 | // loop through required fields and throw error if any is empty |
| 218 | if ( ! empty($_POST['required-fields']) && is_array($_POST['required-fields'])) { |
| 219 | foreach ($_POST['required-fields'] as $key => $value) { |
| 220 | |
| 221 | if (empty($_POST[$key]) && empty($_FILES[$key])) { |
| 222 | $reg_errors->add('required_field_empty', sprintf(__('%s field is required', 'wp-user-avatar'), $value)); |
| 223 | // stop looping if a required field is found empty. |
| 224 | break; |
| 225 | } |
| 226 | } |
| 227 | } |
| 228 | // --------END --------- validation for required fields ----------------------// |
| 229 | |
| 230 | if ( ! validate_username($username)) { |
| 231 | $reg_errors->add('invalid_username', esc_html__('<strong>ERROR</strong>: This username is invalid because it uses illegal characters. Please enter a valid username.', 'wp-user-avatar')); |
| 232 | } |
| 233 | |
| 234 | if ( ! is_email($real_userdata['user_email'])) { |
| 235 | $reg_errors->add('invalid_email', esc_html__('Email address is not valid', 'wp-user-avatar')); |
| 236 | } |
| 237 | |
| 238 | if (isset($password2) && ($password != $password2)) { |
| 239 | $reg_errors->add('password_mismatch', esc_html__('Passwords do not match', 'wp-user-avatar')); |
| 240 | } |
| 241 | |
| 242 | if (isset($email2) && ($email != $email2)) { |
| 243 | $reg_errors->add('email_mismatch', esc_html__('Email addresses do not match', 'wp-user-avatar')); |
| 244 | } |
| 245 | |
| 246 | if (isset($post['pp_enforce_password_meter']) && ($post['pp_enforce_password_meter'] != '1')) { |
| 247 | $reg_errors->add('password_weak', esc_html__('Password is not strong', 'wp-user-avatar')); |
| 248 | } |
| 249 | |
| 250 | // get the data for use by update_meta |
| 251 | $custom_usermeta = array(); |
| 252 | |
| 253 | if (ExtensionManager::is_premium()) { |
| 254 | // loop over the $_POST data and create an array of the invalid userdata/ custom usermeta |
| 255 | foreach ($post as $key => $value) { |
| 256 | |
| 257 | if ($key == 'reg_submit' || in_array($key, ppress_reserved_field_keys())) continue; |
| 258 | |
| 259 | if ( ! in_array($key, $valid_userdata)) { |
| 260 | |
| 261 | if (in_array($key, array_keys(ppress_custom_fields_key_value_pair(true)))) { |
| 262 | $custom_usermeta[$key] = is_array($value) ? array_map('sanitize_textarea_field', $value) : sanitize_textarea_field($value); |
| 263 | } |
| 264 | } |
| 265 | } |
| 266 | } |
| 267 | |
| 268 | // merge real data(for use by wp_insert_user()) and custom fields data |
| 269 | // $real_userdata comes second so custom user meta won't override it. |
| 270 | $user_data = array_merge($custom_usermeta, $real_userdata); |
| 271 | |
| 272 | /* Begin Filter Hook */ |
| 273 | // call validate reg from function |
| 274 | $reg_form_errors = apply_filters('ppress_registration_validation', $reg_errors, $form_id, $user_data, $is_melange); |
| 275 | if (is_wp_error($reg_form_errors) && $reg_form_errors->get_error_code() != '') { |
| 276 | return '<div class="profilepress-reg-status">' . $reg_form_errors->get_error_message() . '</div>'; |
| 277 | } |
| 278 | /* End Filter Hook */ |
| 279 | |
| 280 | // --------START --------- validation for file upload ----------------------// |
| 281 | $uploads = FileUploader::init(); |
| 282 | $upload_errors = ''; |
| 283 | if ( ! empty($uploads)) { |
| 284 | foreach ($uploads as $field_key => $uploaded_filename_or_wp_error) { |
| 285 | if (is_wp_error($uploads[$field_key])) { |
| 286 | $upload_errors .= $uploads[$field_key]->get_error_message() . '<br/>'; |
| 287 | } |
| 288 | } |
| 289 | |
| 290 | if ( ! empty($upload_errors)) { |
| 291 | return "<div class='profilepress-reg-status'>$upload_errors</div>"; |
| 292 | } |
| 293 | } |
| 294 | // --------END --------- validation for file upload ----------------------// |
| 295 | |
| 296 | |
| 297 | // --------START --------- validation for avatar upload ----------------------// |
| 298 | if (isset($files['reg_avatar']['name']) && ! empty($files['reg_avatar']['name'])) { |
| 299 | $upload_avatar = ImageUploader::process($files['reg_avatar']); |
| 300 | |
| 301 | if (is_wp_error($upload_avatar)) { |
| 302 | return "<div class='profilepress-reg-status'>" . $upload_avatar->get_error_message() . "</div>"; |
| 303 | } |
| 304 | } |
| 305 | // --------END --------- validation for avatar upload ----------------------// |
| 306 | |
| 307 | |
| 308 | // --------START --------- validation for cover photo upload ----------------------// |
| 309 | if (isset($files['reg_cover_image']['name']) && ! empty($files['reg_cover_image']['name'])) { |
| 310 | |
| 311 | $upload_cover_image = ImageUploader::process($files['reg_cover_image'], ImageUploader::COVER_IMAGE, PPRESS_COVER_IMAGE_UPLOAD_DIR); |
| 312 | |
| 313 | if (is_wp_error($upload_cover_image)) { |
| 314 | return "<div class='profilepress-reg-status'>" . $upload_cover_image->get_error_message() . "</div>"; |
| 315 | } |
| 316 | } |
| 317 | // --------END --------- validation for cover photo upload ----------------------// |
| 318 | |
| 319 | do_action('ppress_before_registration', $form_id, $user_data); |
| 320 | |
| 321 | // proceed to registration using wp_insert_user method which return the new user id |
| 322 | $user_id = wp_insert_user($real_userdata); |
| 323 | |
| 324 | if (is_wp_error($user_id)) { |
| 325 | return '<div class="profilepress-reg-status">' . $user_id->get_error_message() . '</div>'; |
| 326 | } |
| 327 | |
| 328 | // --------START --------- register custom field ----------------------// |
| 329 | |
| 330 | $custom_usermeta['pp_profile_avatar'] = isset($upload_avatar) ? $upload_avatar : null; |
| 331 | $custom_usermeta['pp_profile_cover_image'] = isset($upload_cover_image) ? $upload_cover_image : null; |
| 332 | |
| 333 | // if we get to this point, it means the files pass validation defined above. |
| 334 | // array of files uploaded. Array key is the "custom field key" and the filename as the array value. |
| 335 | $custom_usermeta['pp_uploaded_files'] = $uploads; |
| 336 | |
| 337 | // if @$user_id is no WP_Error, add the extra user profile field |
| 338 | if (is_array($custom_usermeta)) { |
| 339 | |
| 340 | foreach ($custom_usermeta as $key => $value) { |
| 341 | if ( ! empty($value)) { |
| 342 | update_user_meta($user_id, $key, $value); |
| 343 | // the 'edit_profile' parameter is used to distinguish it from same action hook in RegistrationAuth |
| 344 | do_action('ppress_after_custom_field_update', $key, $value, $user_id, 'registration'); |
| 345 | } |
| 346 | } |
| 347 | } |
| 348 | // --------END --------- register custom field ----------------------// |
| 349 | |
| 350 | // if moderation is active, set new registered users as pending |
| 351 | if (class_exists('ProfilePress\Libsodium\UserModeration\UserModeration') && UserModeration::moderation_is_active()) { |
| 352 | UserModeration::make_pending($user_id); |
| 353 | } |
| 354 | |
| 355 | if ($flag_to_send_password_reset === true) { |
| 356 | PasswordReset::retrieve_password_func($username); |
| 357 | } |
| 358 | |
| 359 | // record signup via |
| 360 | if ($is_melange) { |
| 361 | add_user_meta($user_id, '_pp_signup_melange_via', $form_id); |
| 362 | } else { |
| 363 | add_user_meta($user_id, '_pp_signup_via', $form_id); |
| 364 | } |
| 365 | |
| 366 | // if user moderation is active, send pending notification. |
| 367 | if (class_exists('ProfilePress\Libsodium\UserModeration\UserModeration') && UserModeration::moderation_is_active()) { |
| 368 | UserModerationNotification::pending($user_id); |
| 369 | UserModerationNotification::pending_admin_notification($user_id); |
| 370 | } |
| 371 | |
| 372 | self::send_welcome_email($user_id, $password, $form_id); |
| 373 | |
| 374 | if (is_int($user_id)) { |
| 375 | |
| 376 | ppress_wp_new_user_notification($user_id, null, 'admin'); |
| 377 | } |
| 378 | |
| 379 | /** |
| 380 | * Fires after a user registration is completed. |
| 381 | * |
| 382 | * @param int $form_id ID of the registration form. |
| 383 | * @param mixed $user_data array of registered user info. |
| 384 | * @param int $user_id ID of the registered user. |
| 385 | * @param bool $is_melange |
| 386 | */ |
| 387 | do_action('ppress_after_registration', $form_id, $user_data, $user_id, $is_melange); |
| 388 | /* End Action Hook */ |
| 389 | |
| 390 | if ( ! empty($no_login_redirect)) { |
| 391 | $response = self::no_login_redirect_after_reg($form_id, $no_login_redirect); |
| 392 | } else { |
| 393 | /** |
| 394 | * call auto-login |
| 395 | * |
| 396 | * @param int $user_id registered user ID |
| 397 | * @param int $form_id registration form ID |
| 398 | * @param string $redirect redirect url after login |
| 399 | */ |
| 400 | $response = self::auto_login_after_reg($user_id, $form_id, $redirect); |
| 401 | } |
| 402 | |
| 403 | if (self::is_ajax() && isset($response) && ! empty($response) && is_array($response)) { |
| 404 | // $response should be an array containing the url to redirect to. |
| 405 | return $response; |
| 406 | } |
| 407 | |
| 408 | $success_message = FormRepository::get_form_meta($form_id, FormRepository::REGISTRATION_TYPE, FormRepository::SUCCESS_MESSAGE); |
| 409 | if ($is_melange) { |
| 410 | $success_message = FormRepository::get_form_meta($form_id, FormRepository::MELANGE_TYPE, FormRepository::MELANGE_REGISTRATION_SUCCESS_MESSAGE); |
| 411 | } |
| 412 | |
| 413 | $default_success_message = '<div class="profilepress-reg-status success">' . esc_html__('Registration successful.', 'wp-user-avatar') . '</div>'; |
| 414 | |
| 415 | if (FormRepository::is_drag_drop($form_id, FormRepository::REGISTRATION_TYPE)) { |
| 416 | // Drag and drop signup pages do not allow the use of div wrapper. only the message to be shown is entered. |
| 417 | // so here, we are wrapping it in reg status div. |
| 418 | if ( ! empty($success_message)) { |
| 419 | $success_message = '<div class="profilepress-reg-status success">' . $success_message . '</div>'; |
| 420 | } |
| 421 | } |
| 422 | |
| 423 | return apply_filters('ppress_registration_success_message', ! empty($success_message) ? $success_message : $default_success_message); |
| 424 | } |
| 425 | |
| 426 | /** |
| 427 | * Array list of acceptable defined roles. |
| 428 | * |
| 429 | * @param int $form_id ID of registration form |
| 430 | * |
| 431 | * @return array |
| 432 | */ |
| 433 | public static function acceptable_defined_roles($form_id) |
| 434 | { |
| 435 | if (FormRepository::is_drag_drop($form_id, FormRepository::REGISTRATION_TYPE)) { |
| 436 | |
| 437 | $settings = FormRepository::form_builder_fields_settings($form_id, FormRepository::REGISTRATION_TYPE); |
| 438 | |
| 439 | $reg_select_field = array_values( |
| 440 | wp_list_pluck( |
| 441 | wp_list_filter($settings, ['fieldType' => 'reg-select-role']), |
| 442 | 'options' |
| 443 | ) |
| 444 | ); |
| 445 | |
| 446 | $options = isset($reg_select_field[0]) ? $reg_select_field[0] : []; |
| 447 | |
| 448 | } else { |
| 449 | |
| 450 | $registration_structure = FormRepository::get_form_meta($form_id, FormRepository::REGISTRATION_TYPE, FormRepository::FORM_STRUCTURE); |
| 451 | |
| 452 | // find the first occurrence of reg-select-role shortcode. |
| 453 | preg_match('/\[reg-select-role.*\]/', $registration_structure, $matches); |
| 454 | |
| 455 | if (empty($matches) || ! isset($matches[0])) return; |
| 456 | |
| 457 | preg_match('/options="([,\s\w]+)"/', $matches[0], $matches2); |
| 458 | |
| 459 | $options = isset($matches2[1]) ? $matches2[1] : []; |
| 460 | } |
| 461 | |
| 462 | //if no options attribute was found in the shortcode, default to all list of editable roles |
| 463 | if (empty($options)) { |
| 464 | $acceptable_user_role = array_keys(ppress_get_editable_roles()); |
| 465 | } else { |
| 466 | $acceptable_user_role = array_map('trim', explode(',', $options)); |
| 467 | } |
| 468 | |
| 469 | return apply_filters('ppress_acceptable_user_role', $acceptable_user_role, $form_id); |
| 470 | } |
| 471 | } |