| 1 |
<?php |
| 2 |
/** |
| 3 |
* Accessors for the WpStream account credentials used to authenticate |
| 4 |
* against the backend API. |
| 5 |
* |
| 6 |
* Credentials can be supplied two ways, in priority order: |
| 7 |
* 1. wp-config.php constants WPSTREAM_API_USERNAME / WPSTREAM_API_PASSWORD, |
| 8 |
* which keep the secret out of the database entirely, or |
| 9 |
* 2. the wpstream_api_username / wpstream_api_password options saved from |
| 10 |
* the Credentials admin screen or the onboarding wizard. |
| 11 |
* |
| 12 |
* Every read of the account credentials must go through these helpers so the |
| 13 |
* constant override is honoured everywhere. |
| 14 |
* |
| 15 |
* @package Wpstream |
| 16 |
* @subpackage Wpstream/includes/Helpers |
| 17 |
*/ |
| 18 |
|
| 19 |
// Block direct file access outside of WordPress. |
| 20 |
if ( ! defined( 'ABSPATH' ) ) { |
| 21 |
exit; |
| 22 |
} |
| 23 |
|
| 24 |
/** |
| 25 |
* Whether both credentials are supplied as wp-config.php constants. |
| 26 |
* |
| 27 |
* Used by the admin screens to disable the credential inputs, since values |
| 28 |
* saved there would be ignored while the constants are defined. |
| 29 |
* |
| 30 |
* @return bool True when WPSTREAM_API_USERNAME and WPSTREAM_API_PASSWORD are both defined and non-empty. |
| 31 |
*/ |
| 32 |
function wpstream_api_credentials_from_constants() { |
| 33 |
return defined( 'WPSTREAM_API_USERNAME' ) && WPSTREAM_API_USERNAME !== '' |
| 34 |
&& defined( 'WPSTREAM_API_PASSWORD' ) && WPSTREAM_API_PASSWORD !== ''; |
| 35 |
} |
| 36 |
|
| 37 |
/** |
| 38 |
* The WpStream account username/email: constant first, option as fallback. |
| 39 |
* |
| 40 |
* @return string Username, or '' when not configured. |
| 41 |
*/ |
| 42 |
function wpstream_get_api_username() { |
| 43 |
if ( wpstream_api_credentials_from_constants() ) { |
| 44 |
return WPSTREAM_API_USERNAME; |
| 45 |
} |
| 46 |
return get_option( 'wpstream_api_username', '' ); |
| 47 |
} |
| 48 |
|
| 49 |
/** |
| 50 |
* The WpStream account password: constant first, option as fallback. |
| 51 |
* |
| 52 |
* Never echo this value into markup or send it to a client — it is only for |
| 53 |
* server-side authentication against the backend API. |
| 54 |
* |
| 55 |
* @return string Password, or '' when not configured. |
| 56 |
*/ |
| 57 |
function wpstream_get_api_password() { |
| 58 |
if ( wpstream_api_credentials_from_constants() ) { |
| 59 |
return WPSTREAM_API_PASSWORD; |
| 60 |
} |
| 61 |
return get_option( 'wpstream_api_password', '' ); |
| 62 |
} |
| 63 |
|
