';
} else {
$options = get_option( ABSPRIVACY_OPTIONS );
}
//notify user that registrations are not enabled. Hopefully this will save me some support emails.
if ( 1 !== get_option( 'users_can_register' ) ) {
echo '
' . sprintf( __( 'Notice: Your settings do not currently allow users to register themselves. If you want to allow the Absolute Privacy plugin to handle user moderation, please check anyone can register on the general settings page.', 'absprivacy' ), home_url( 'wp-admin/options-general.php' ) ) . '
' . __( 'Approved users will receive an email notification of their approval.', 'absprivacy' ) . '
';
echo $output;
}
/**
* abpr_handleEmail function.
*
* handles email notifications
*
* @param $user_id: the integer ID of the user being acted upon (newly registered, approved, etc)
* @param $type: pending_welcome, account_approve, or admin_notification
* @return bool
*/
function abpr_handleEmail( $user_id, $type ) {
$options = get_option( ABSPRIVACY_OPTIONS );
$user = get_userdata( $user_id ); //object with user info
switch ( $type ) {
case( 'pending_welcome' ):
$to_email = $user->user_email;
$subject = $options['pending_welcome_email_subject'];
$message = $options['pending_welcome_message'];
break;
case( 'account_approved' ):
$to_email = $user->user_email;
$subject = $options['account_approval_email_subject'];
$message = $options['account_approval_message'];
break;
case( 'admin_notification' ):
$to_email = get_bloginfo( 'admin_email' );
$subject = $options['admin_approval_email_subject'];
$message = $options['admin_approval_message'];
break;
default : //an invalid response has been given
return false;
}
$login_url = ( isset( $options['redirect_page'] ) && $options['redirect_page'] != '' ) ? get_permalink( $options['redirect_page'] ) : wp_login_url();
$replace = array(
'%username%' => $user->user_login,
'%name%' => $user->display_name,
'%blogname%' => get_bloginfo( 'name' ),
'%blogurl%' => get_bloginfo( 'url' ),
'%approval_url%' => get_bloginfo( 'url' ) . '/wp-admin/users.php?page=functions.php&u_id=' . $user_id,
'%login_url%' => $login_url
);
$email_body = strtr( stripslashes( $message ), $replace ); //get email body and replace variables
$headers = "MIME-Version: 1.0\n" .
"From: " . get_option( 'blogname' ) . " <" . get_option( 'admin_email' ) . ">";
wp_mail( $to_email, $subject, $email_body, $headers );
}
/**
* abpr_check_is_feed function.
*
* handles filtering the content based on the value the user selected on the options page.
* Only runs if user has enabled "Lockdown Mode"
*
* @param $content: The post content passed from the action
* @return string
*/
function abpr_check_is_feed( $content ) {
$options = get_option( ABSPRIVACY_OPTIONS );
if ( $options['member_lockdown'] == "lockdown" && is_feed() ) :
switch ( $options['rss_control'] ) {
case "on":
//allow full RSS
break;
case "headline":
$content = '';
break;
case "excerpt":
$content = substr( strip_tags( get_the_content() ), 0, $options['rss_characters'] ) . "...";
break;
}
endif;
return $content;
}
/**
* abpr_lockDown function.
*
* Checks if plugin is enabled, on lockdown mode, or in member area mode
* and restricts non-logged in users accordingly.
*
* @return void
*/
function abpr_lockDown() {
$options = get_option( ABSPRIVACY_OPTIONS );
if ( $options['member_lockdown'] == 'off' || is_user_logged_in() ) {
return; //plugin is activated but disabled or user is logged in
} elseif ( $options['member_lockdown'] == "lockdown" ) {
if ( is_feed() && $options['rss_control'] != "off" ) return; //allow RSS feed to be handled by check_is_feed() function unless the RSS feed is disabled.
if ( isset( $options['allowed_pages'] ) && $options['allowed_pages'] != '' ) {
$allowed_pages = explode( ',', $options['allowed_pages'] );
if ( in_array( 0, $allowed_pages ) && is_front_page() )
return;
if ( is_page( $allowed_pages ) || is_single( $allowed_pages ) )
return; //let them visit the allowed pages
}
$http = ( ! empty( $_SERVER['HTTPS'] ) && strtolower( $_SERVER['HTTPS'] != 'off' ) ) ? 'https://' : 'http://'; //Thanks to Brian L. for this fix
$original_request = $http . $_SERVER['SERVER_NAME'] . $_SERVER['REQUEST_URI']; //this is where the user was trying to go
if ( isset( $options['redirect_page'] ) && $options['redirect_page'] != '' ) { //redirect page setting has been set
if ( is_single( $options['redirect_page'] ) || is_page( $options['redirect_page'] ) )
return; //end the function if the visitor is already on the redirect_page page
$redirect_url = get_permalink( $options['redirect_page'] );
$url = $redirect_url . '?req=' . urlencode( $original_request );
} else {
$url = wp_login_url( $original_request );
}
wp_redirect( $url, 302 );
exit();
} elseif ( $options['member_lockdown'] == 'members_area' ) {
if ( abpr_is_members_page() ) {
$http = ( ! empty( $_SERVER['HTTPS'] ) && strtolower( $_SERVER['HTTPS'] != 'off' ) ) ? 'https://' : 'http://'; //Thanks to Brian L. for this fix
$original_request = $http . $_SERVER['SERVER_NAME'] . $_SERVER['REQUEST_URI']; //this is where the user was trying to go
if ( isset( $options['redirect_page'] ) && $options['redirect_page'] != '' ) {
if ( is_single( $options['redirect_page'] ) || is_page( $options['redirect_page'] ) )
return; //end the function if the visitor is already on the redirect_page page
$redirect_url = get_permalink( $options['redirect_page'] );
$url = $redirect_url . '?req=' . urlencode( $original_request );
} else {
$url = wp_login_url( $original_request );
}
wp_redirect( $url, 302 ); //send them there
exit();
} else {
return; //not a members page, so let it go
}
}
return;
}
/**
* abpr_adminLockDown function.
*
* Blocks subscribers from their admin profile page if enabled
* in the plugin settings
*
* @return void
*/
function abpr_adminLockDown() {
global $userdata, $wpdb;
$options = get_option( ABSPRIVACY_OPTIONS );
if ( ! is_admin() || ! ( is_user_logged_in() ) || ( isset( $options['member_lockdown'] ) && $options['member_lockdown'] == 'off' ) ) return;
//if it's not an admin page or the user isn't logged in at all, we don't need this
$user_role = new WP_User( $userdata->ID );
$capabilities = $wpdb->prefix . 'capabilities';
if ( isset( $options['admin_block'] ) && $options['admin_block'] == "yes" && array_key_exists( 'subscriber', $user_role->$capabilities ) ) {
$url = get_bloginfo( 'url' );
wp_redirect( $url, 302 );
exit();
}
}
/**
* abpr_regCSS function.
*
* Adds CSS for registration form
*
* @return void
*/
function abpr_regCSS() {
echo '';
}
/**
* abpr_registrationBox function.
*
* Echos input boxes for first name, last name, and password to
* the registration box.
*
* Todo: allow users to add custom boxes via filter/action
* @return void
*/
function abpr_registrationBox() {
$output = '
';
$output .= "\n" . '
' . __( 'Your account must be approved before you will be able to log in. You will be emailed once it is approved.', 'absprivacy' ) . '
';
// echo apply_filter( 'abpr_regbox', $output );
// do_action( 'abpor_add_regbox' );
echo $output;
}
/**
* abpr_checkRegErrors function.
*
* Adds error checks to registration form
*
* @param $errors: contains other errors passed to the function
* @return mixed
*/
function abpr_checkRegErrors( $errors ) {
if ( empty( $_POST['first_name'] ) || empty( $_POST['last_name'] ) ) {
$errors->add( 'name', __( 'ERROR: You must enter a first and last name', 'absprivacy' ) );
}
if ( empty( $_POST['pswd1'] ) || empty( $_POST['pswd2'] ) || $_POST['pswd1'] == '' || $_POST['pswd2'] == '' ) {
$errors->add( 'password', __( 'ERROR: Please enter a password in both password boxes.', 'absprivacy' ) );
} elseif ( $_POST['pswd1'] != $_POST['pswd2'] ) {
$errors->add( 'password', __( 'ERROR: Passwords do not match.', 'absprivacy' ) );
}
return $errors;
}
/**
* abpr_addNewUser function.
*
* Adds new registrants name and password to the database
*
* @param $user_id: the integer ID of the newly added user
* @return void
*/
function abpr_addNewUser( $user_id ) {
update_user_meta( $user_id, 'first_name', esc_attr( stripslashes( $_POST['first_name'] ) ) );
update_user_meta( $user_id, 'last_name', esc_attr( stripslashes( $_POST['last_name'] ) ) );
$user_role = new WP_User( $user_id );
$user_role->set_role( ABSPRIVACY_ROLEREF ); //for some reason this role isn't being set. Need to look into it
if ( ! empty( $_POST['pswd1'] ) ) {
wp_set_password( esc_attr( stripslashes( $_POST['pswd1'] ) ), $user_id );
}
unset( $_POST['pswd1'] );
unset( $_POST['pswd2'] );
}
/**
* abpr_add_error_code function.
*
* Adds 'unapproved' $wp_error to the list of shake codes for the login box
*
* @param $shake_codes: other shake error codes passed to the function
* @return array
*/
function abpr_add_error_code( $shake_codes ) {
$shake_codes[] = 'unapproved';
return $shake_codes;
}
/**
* abpr_authenticateUser function.
*
* Adds additional authentication when logging in. Checks that the
* user trying to log in isn't an 'Unapproved User'
*
* @param $user: NULL
* @param $username: username of attempted login
* @param $password: password of attempted login
*
* @return WP_User
*/
function abpr_authenticateUser( $user, $username, $password ) {
global $wpdb;
$tempUser = get_user_by( 'login', $username );
$cap = $wpdb->prefix . "capabilities";
if ( $tempUser && array_key_exists( ABSPRIVACY_ROLEREF, $tempUser->$cap ) ) { //if the user's role is listed as "unapproved"
$user = new WP_Error( 'unapproved', __( "ERROR: The administrator of this site must approve your account before you can login. You will be notified via email when it has been approved.", 'absprivacy' ) );
add_filter( 'shake_error_codes', 'abpr_add_error_code' ); //make the login box shake
remove_action( 'authenticate', 'wp_authenticate_username_password', 20 ); //prevent authentication of user
}
return $user;
}
/**
* abpr_profileRecoveryLink function.
*
* If the profile page has been set in the options, this
* adds a link in the password recovery email to allow the
* user to change their password.
*
* @param $message: The original password recovery message
* @param $key: The users unique key. Not used in this function
* @return bool
*/
function abpr_profileRecoveryLink( $message, $key ) {
$options = get_option( ABSPRIVACY_OPTIONS );
$message = sprintf( __( "Here is your temporary password for %s\n \n%s", 'absprivacy' ), get_option( 'blogname' ), $message );
if ( isset( $options['profile_page'] ) && $options['profile_page'] != '' ) {
$message .= sprintf( __( "\n \n After logging in, you may change this temporary password here: %s", 'absprivacy' ), get_permalink( $options['profile_page'] ) );
}
return $message;
}
/**
* abpr_is_ancestor function.
*
* Checks if the given $post_id is an ancestor of the currently
* queried post
*
* Thanks to http://www.kevinleary.net/wordpress-is_child-for-advanced-navigation/ for this
* $post_id: ID of post/page to check
* @return bool
*/
function abpr_is_ancestor( $post_id ) {
global $wp_query;
$ancestors = $wp_query->post->ancestors;
if ( in_array( $post_id, $ancestors ) ) {
$return = true;
} else {
$return = false;
}
return $return;
}
/**
* abpr_is_members_page function.
*
* Checks if the current page is the members page or a subpage of it. Calls abpr_is_ancestor()
*
* @return bool
*/
function abpr_is_members_page() {
global $wpdb;
$options = get_option( ABSPRIVACY_OPTIONS );
$members_page = $options['members_only_page'];
if ( is_single( $members_page ) || is_page( $members_page ) ) {
$return = true;
} elseif ( is_page() && abpr_is_ancestor( $members_page ) ) {
$return = true;
} else {
$return = false;
}
return $return; //true = is member page; false = not member page
}
/**
* wp_new_user_notification function
*
* Overwrites wp_new_user_notification() function found in pluggable.php
* Handles emails when a new user registers.
*
* @return void
*/
if ( ! function_exists( 'wp_new_user_notification' ) ) {
function wp_new_user_notification( $user_id, $plaintext_pass = '' ) {
$user = get_userdata( $user_id ); //object with user info
abpr_handleEmail( $user_id, $type = 'admin_notification' ); //send admin email
if ( empty( $plaintext_pass ) )
return;
abpr_handleEmail( $user_id, $type = 'pending_welcome' ); //send new user pending message email
}
}
/**
* abpr_loginShortcode function.
*
* Handles the [loginform] shortcode. This displays a login form
* via wp_login_form() if the user is not logged in. Otherwise it
* displays the useraname and a logout link.
*
* The shortcode takes the standard inputs of wp_login_form()
*/
function abpr_loginShortcode( $atts ) {
global $userdata;
extract(
shortcode_atts(
array(
'redirect' => null,
'form_id' => 'loginform',
'label_username' => __( 'Username', 'absprivacy' ),
'label_password' => __( 'Password', 'absprivacy' ),
'label_remember' => __( 'Remember Me', 'absprivacy' ),
'label_log_in' => __( 'Log In', 'absprivacy' ),
'id_username' => 'user_login',
'id_password' => 'user_pass',
'id_remember' => 'rememberme',
'id_submit' => 'wp-submit',
'remember' => true,
'value_username' => '',
'value_remember' => false,
'loggedin_id' => 'logged-in',
'logout_url' => home_url(),
'lostpassword' => null
),
$atts
)
);
switch ( $redirect ) {
case null :
case 'same' :
if ( null === $redirect && isset( $options['redirect_page'] ) && $options['redirect_page'] != '' ) {
$redirect_to = get_permalink( $options['redirect_page'] );
break;
}
$http = ( ! empty( $_SERVER['HTTPS'] ) && strtolower( $_SERVER['HTTPS'] != 'off' ) ) ? 'https://' : 'http://';
$redirect_to = $http . $_SERVER['SERVER_NAME'] . $_SERVER['REQUEST_URI']; //this is where the user was trying to go
break;
case 'home' :
$redirect_to = home_url();
break;
default :
$redirect_to = $redirect;
}
$redirect_to = ( empty( $_GET['req'] ) ? $redirect_to : $_GET['req'] ); //a get request trumps the user input for now
if ( is_user_logged_in() ) {
echo '
';
} else {
$return = wp_login_form(
array(
'echo' => false,
'redirect' => $redirect_to,
'label_username' => $label_username,
'label_password' => $label_password,
'label_remember' => $label_remember,
'label_log_in' => $label_log_in,
'id_username' => $id_username,
'id_password' => $id_password,
'id_remember' => $id_remember,
'id_submit' => $id_submit,
'remember' => $remember,
'value_username' => $value_username,
'value_remember' => $value_remember
)
);
}
return $return;
}
/**
* abpr_profileShortcode function.
*
* Handles the [profilepage] shortcode. This displays a login form
* via wp_login_form() if the user is not logged in. Otherwise it
* displays the useraname and a logout link, and a form where the user
* can chagne their name, email, and password. The code is found in
* profile_page.php
*
*/
function abpr_profileShortcode() {
include( 'profile_page.php' );
}
function abpr_needsUpgrade() {
$db_version = get_option( ABSPRIVACY_DBOPTION );
$options = get_option( ABSPRIVACY_OPTIONS );
if ( ! $db_version || $db_version < ABSPRIVACY_DBVERSION || ! $options ) {
return true;
}
return false;
}
function abpr_adminnotice() {
echo '
';
}
/**
* abpr_doUpgrade function
*
* Runs when plugin is first activated or if a database/settings update
* is needed. Handles
*
* @return void
*/
function abpr_doUpgrade() {
global $wp_roles;
/* First lets make sure the absolute privacy role is set */
$role = get_role( ABSPRIVACY_ROLEREF );
if ( ! $role ) add_role( ABSPRIVACY_ROLEREF, ABSPRIVACY_ROLENAME ); //create the unapproved role
$options = get_option( ABSPRIVACY_OPTIONS );
if ( ! $options ) { // no options set so set default
$legacy_options = get_option( 'absolute_privacy' ); // options term used prior to 2.0
if ( $legacy_options ) { // user is upgrading from legacy version
$options['member_lockdown'] = ( $legacy_options['members_enabled'] == 'yes' ) ? 'lockdown' : 'off';
$options['allowed_pages'] = $legacy_options['allowed_pages'];
$options['pending_welcome_email_subject'] = $legacy_options['pending_welcome_email_subject'];
$options['pending_welcome_message'] = $legacy_options['pending_welcome_message'];
$options['account_approval_email_subject'] = $legacy_options['account_approval_email_subject'];
$options['account_approval_message'] = $legacy_options['account_approval_message'];
$options['admin_approval_email_subject'] = $legacy_options['admin_approval_email_subject'];
$options['admin_approval_message'] = $legacy_options['admin_approval_message'];
$options['redirect_page'] = $legacy_options['redirect_page'];
$options['admin_block'] = $legacy_options['admin_block'];
$options['rss_control'] = $legacy_options['rss_control'];
$options['rss_characters'] = $legacy_options['rss_characters'];
delete_option( 'absolute_privacy' ); // delete legacy options from database
delete_option( 'absolute_privacy_default' );
/* prior to 2.0 Absolute Privacy changed the default role. 2.0+ no longer does this
* so we need to change the default role back. For now we'll just change this to subscriber
*/
$default_role = get_option( 'default_role' );
if ( $default_role == 'unapproved' ) {
update_option( 'default_role', 'subscriber' );
}
} else { // user must be installing fresh since no options were found
$options['member_lockdown'] = 'off';
$options['rss_control'] = 'off';
$options['pending_welcome_email_subject'] = sprintf( __( 'Your account with %s is under review', 'absprivacy' ), stripslashes( get_option( 'blogname' ) ) );
$options['pending_welcome_message'] = __( "Hi %name%, \n \n Thanks for registering for %blogname%! Your registration is currently being reviewed. You will not be able to login until it has been approved. You will receive an email at that time. Thanks for your patience. \n \n Sincerely, \n \n %blogname%", 'absprivacy' );
$options['account_approval_email_subject'] = __( "Your account has been approved!", 'absprivacy' );
$options['account_approval_message'] = __( "Your registration with %blogname% has been approved! \n \n You may login using the following information: \n Username: %username% \n Password: (hidden) \n URL: %login_url%", 'absprivacy' );
$options['admin_approval_email_subject'] = __( "A new user is waiting approval", 'absprivacy' );
$options['admin_approval_message'] = __( "A new user has registered for %blogname% and is waiting your approval. You may approve or delete them here: %approval_url% \n \n This user cannot log in until you approve them.", 'absprivacy' );
}
update_option( ABSPRIVACY_OPTIONS, $options ); // set option values
update_option( ABSPRIVACY_DBOPTION, ABSPRIVACY_DBVERSION );
} else { // there are $options already in the database
if ( abpr_needsUpgrade() ) {
/* Run options upgrade script here */
// for now lets just enter the DB version
update_option( ABSPRIVACY_DBOPTION, ABSPRIVACY_DBVERSION );
}
}
}