2013-10-25 00:58:23 +02:00
< ? php
/**
* WordPress User Page
*
* Handles authentication , registering , resetting passwords , forgot password ,
* and other user handling .
*
* @ package WordPress
*/
/** Make sure that the WordPress bootstrap has run before continuing. */
2017-12-01 00:11:00 +01:00
require ( dirname ( __FILE__ ) . '/wp-load.php' );
2013-10-25 00:58:23 +02:00
2018-09-14 15:48:24 +02:00
// Redirect to HTTPS login if forced to use SSL.
2013-10-25 00:58:23 +02:00
if ( force_ssl_admin () && ! is_ssl () ) {
2017-12-01 00:11:00 +01:00
if ( 0 === strpos ( $_SERVER [ 'REQUEST_URI' ], 'http' ) ) {
2018-04-03 16:32:31 +02:00
wp_safe_redirect ( set_url_scheme ( $_SERVER [ 'REQUEST_URI' ], 'https' ) );
2013-10-25 00:58:23 +02:00
exit ();
} else {
2018-04-03 16:32:31 +02:00
wp_safe_redirect ( 'https://' . $_SERVER [ 'HTTP_HOST' ] . $_SERVER [ 'REQUEST_URI' ] );
2013-10-25 00:58:23 +02:00
exit ();
}
}
/**
* Output the login page header .
*
2018-09-14 15:48:24 +02:00
* @ since 2.1 . 0
*
2014-11-24 07:31:21 +01:00
* @ param string $title Optional . WordPress login Page title to display in the `<title>` element .
* Default 'Log In' .
2014-06-20 21:19:14 +02:00
* @ param string $message Optional . Message to display in header . Default empty .
2018-07-16 16:10:26 +02:00
* @ param WP_Error $wp_error Optional . The error to pass . Default is a WP_Error instance .
2013-10-25 00:58:23 +02:00
*/
2018-07-16 16:10:26 +02:00
function login_header ( $title = 'Log In' , $message = '' , $wp_error = null ) {
2013-11-13 04:23:10 +01:00
global $error , $interim_login , $action ;
2013-10-25 00:58:23 +02:00
// Don't index any of these forms
2018-12-13 01:23:24 +01:00
add_action ( 'login_head' , 'wp_sensitive_page_meta' );
2013-10-25 00:58:23 +02:00
2016-10-06 17:52:30 +02:00
add_action ( 'login_head' , 'wp_login_viewport_meta' );
2013-10-25 00:58:23 +02:00
2018-07-16 16:10:26 +02:00
if ( ! is_wp_error ( $wp_error ) ) {
2013-10-25 00:58:23 +02:00
$wp_error = new WP_Error ();
2017-12-01 00:11:00 +01:00
}
2013-10-25 00:58:23 +02:00
// Shake it!
$shake_error_codes = array ( 'empty_password' , 'empty_email' , 'invalid_email' , 'invalidcombo' , 'empty_username' , 'invalid_username' , 'incorrect_password' );
/**
2016-05-23 18:44:27 +02:00
* Filters the error codes array for shaking the login form .
2013-10-25 00:58:23 +02:00
*
* @ since 3.0 . 0
*
* @ param array $shake_error_codes Error codes that shake the login form .
*/
$shake_error_codes = apply_filters ( 'shake_error_codes' , $shake_error_codes );
2018-02-27 03:31:31 +01:00
if ( $shake_error_codes && $wp_error -> has_errors () && in_array ( $wp_error -> get_error_code (), $shake_error_codes ) ) {
2013-10-25 00:58:23 +02:00
add_action ( 'login_head' , 'wp_shake_js' , 12 );
2017-12-01 00:11:00 +01:00
}
2013-10-25 00:58:23 +02:00
2017-10-03 01:00:46 +02:00
$login_title = get_bloginfo ( 'name' , 'display' );
/* translators: Login screen title. 1: Login screen name, 2: Network or site name */
$login_title = sprintf ( __ ( '%1$s ‹ %2$s — WordPress' ), $title , $login_title );
/**
* Filters the title tag content for login page .
*
* @ since 4.9 . 0
*
* @ param string $login_title The page title , with extra context added .
* @ param string $title The original page title .
*/
$login_title = apply_filters ( 'login_title' , $login_title , $title );
2016-02-06 23:56:27 +01:00
2013-10-25 00:58:23 +02:00
?> <!DOCTYPE html>
2013-12-03 21:12:11 +01:00
<!-- [ if IE 8 ] >
< html xmlns = " http://www.w3.org/1999/xhtml " class = " ie8 " < ? php language_attributes (); ?> >
<! [ endif ] -->
<!-- [ if ! ( IE 8 ) ] ><!-->
< html xmlns = " http://www.w3.org/1999/xhtml " < ? php language_attributes (); ?> >
<!--<! [ endif ] -->
2013-10-25 00:58:23 +02:00
< head >
2017-12-01 00:11:00 +01:00
< meta http - equiv = " Content-Type " content = " <?php bloginfo( 'html_type' ); ?>; charset=<?php bloginfo( 'charset' ); ?> " />
2017-10-03 01:00:46 +02:00
< title >< ? php echo $login_title ; ?> </title>
2013-10-25 00:58:23 +02:00
< ? php
2016-01-18 10:57:29 +01:00
wp_enqueue_style ( 'login' );
2013-10-25 00:58:23 +02:00
2014-07-17 11:12:16 +02:00
/*
* Remove all stored post data on logging out .
* This could be added by add_action ( 'login_head' ... ) like wp_shake_js (),
2018-09-14 15:48:24 +02:00
* but maybe better if it ' s not removable by plugins .
2014-07-17 11:12:16 +02:00
*/
2013-10-25 00:58:23 +02:00
if ( 'loggedout' == $wp_error -> get_error_code () ) {
?>
< script > if ( " sessionStorage " in window ){ try { for ( var key in sessionStorage ){ if ( key . indexOf ( " wp-autosave- " ) !=- 1 ){ sessionStorage . removeItem ( key )}}} catch ( e ){}}; </ script >
< ? php
}
/**
* Enqueue scripts and styles for the login page .
*
* @ since 3.1 . 0
*/
do_action ( 'login_enqueue_scripts' );
2016-01-18 10:57:29 +01:00
2013-10-25 00:58:23 +02:00
/**
* Fires in the login page header after scripts are enqueued .
*
* @ since 2.1 . 0
*/
do_action ( 'login_head' );
2019-03-14 22:10:50 +01:00
$login_header_url = __ ( 'https://wordpress.org/' );
2013-10-25 00:58:23 +02:00
/**
2016-05-23 18:44:27 +02:00
* Filters link URL of the header logo above login form .
2013-10-25 00:58:23 +02:00
*
* @ since 2.1 . 0
*
* @ param string $login_header_url Login header logo URL .
*/
$login_header_url = apply_filters ( 'login_headerurl' , $login_header_url );
2016-05-23 18:44:27 +02:00
2019-03-14 22:10:50 +01:00
$login_header_title = '' ;
2013-10-25 00:58:23 +02:00
/**
2016-05-23 18:44:27 +02:00
* Filters the title attribute of the header logo above login form .
2013-10-25 00:58:23 +02:00
*
* @ since 2.1 . 0
2019-03-14 22:10:50 +01:00
* @ deprecated 5.2 . 0 Use login_headertext
2013-10-25 00:58:23 +02:00
*
* @ param string $login_header_title Login header logo title attribute .
*/
2019-03-14 22:10:50 +01:00
$login_header_title = apply_filters_deprecated (
'login_headertitle' ,
array ( $login_header_title ),
'5.2.0' ,
'login_headertext' ,
__ ( 'Usage of the title attribute on the login logo is not recommended for accessibility reasons. Use the link text instead.' )
);
2013-10-25 00:58:23 +02:00
2019-03-14 22:10:50 +01:00
$login_header_text = empty ( $login_header_title ) ? __ ( 'Powered by WordPress' ) : $login_header_title ;
/**
* Filters the link text of the header logo above the login form .
*
* @ since 5.2 . 0
*
* @ param string $login_header_text The login header logo link text .
Login: On the single site login screen, match the logo link text with the title.
Previously, the (W) logo on the single site login screen linked to wordpress.org, with an appropriate `title` attribute, but the link text was the blog name.
To fix this discrepency, the link text is now the same as the `title` attribute.
Props pento, obrienlabs, afercia, flixos90, lukecavanagh, and the infinite stack of bikesheds that WordPress is balanced upon.
Fixes #34625.
Built from https://develop.svn.wordpress.org/trunk@41843
git-svn-id: http://core.svn.wordpress.org/trunk@41677 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-10-12 06:57:46 +02:00
*/
2019-03-14 22:10:50 +01:00
$login_header_text = apply_filters ( 'login_headertext' , $login_header_text );
Login: On the single site login screen, match the logo link text with the title.
Previously, the (W) logo on the single site login screen linked to wordpress.org, with an appropriate `title` attribute, but the link text was the blog name.
To fix this discrepency, the link text is now the same as the `title` attribute.
Props pento, obrienlabs, afercia, flixos90, lukecavanagh, and the infinite stack of bikesheds that WordPress is balanced upon.
Fixes #34625.
Built from https://develop.svn.wordpress.org/trunk@41843
git-svn-id: http://core.svn.wordpress.org/trunk@41677 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-10-12 06:57:46 +02:00
2013-10-25 00:58:23 +02:00
$classes = array ( 'login-action-' . $action , 'wp-core-ui' );
2017-12-01 00:11:00 +01:00
if ( is_rtl () ) {
2013-10-25 00:58:23 +02:00
$classes [] = 'rtl' ;
2017-12-01 00:11:00 +01:00
}
2013-10-25 00:58:23 +02:00
if ( $interim_login ) {
$classes [] = 'interim-login' ;
?>
< style type = " text/css " > html { background - color : transparent ;} </ style >
< ? php
2017-12-01 00:11:00 +01:00
if ( 'success' === $interim_login ) {
2013-10-25 00:58:23 +02:00
$classes [] = 'interim-login-success' ;
2017-12-01 00:11:00 +01:00
}
2013-10-25 00:58:23 +02:00
}
2017-12-01 00:11:00 +01:00
$classes [] = ' locale-' . sanitize_html_class ( strtolower ( str_replace ( '_' , '-' , get_locale () ) ) );
2013-10-25 00:58:23 +02:00
/**
2016-05-23 18:44:27 +02:00
* Filters the login page body classes .
2013-10-25 00:58:23 +02:00
*
* @ since 3.5 . 0
*
* @ param array $classes An array of body classes .
* @ param string $action The action that brought the visitor to the login page .
*/
$classes = apply_filters ( 'login_body_class' , $classes , $action );
?>
</ head >
< body class = " login <?php echo esc_attr( implode( ' ', $classes ) ); ?> " >
2016-04-19 01:54:29 +02:00
< ? php
/**
* Fires in the login page header after the body tag is opened .
*
* @ since 4.6 . 0
*/
do_action ( 'login_header' );
?>
2013-10-25 00:58:23 +02:00
< div id = " login " >
2019-03-14 22:10:50 +01:00
< h1 >< a href = " <?php echo esc_url( $login_header_url ); ?> " >< ? php echo $login_header_text ; ?> </a></h1>
2013-10-25 00:58:23 +02:00
< ? php
/**
2016-05-23 18:44:27 +02:00
* Filters the message to display above the login form .
2013-10-25 00:58:23 +02:00
*
* @ since 2.1 . 0
*
* @ param string $message Login message text .
*/
$message = apply_filters ( 'login_message' , $message );
2017-12-01 00:11:00 +01:00
if ( ! empty ( $message ) ) {
2013-10-25 00:58:23 +02:00
echo $message . " \n " ;
2017-12-01 00:11:00 +01:00
}
2013-10-25 00:58:23 +02:00
2018-09-14 15:48:24 +02:00
// In case a plugin uses $error rather than the $wp_errors object.
2017-12-01 00:11:00 +01:00
if ( ! empty ( $error ) ) {
$wp_error -> add ( 'error' , $error );
unset ( $error );
2013-10-25 00:58:23 +02:00
}
2018-02-27 03:31:31 +01:00
if ( $wp_error -> has_errors () ) {
2017-12-01 00:11:00 +01:00
$errors = '' ;
2013-10-25 00:58:23 +02:00
$messages = '' ;
foreach ( $wp_error -> get_error_codes () as $code ) {
2014-06-30 16:39:17 +02:00
$severity = $wp_error -> get_error_data ( $code );
foreach ( $wp_error -> get_error_messages ( $code ) as $error_message ) {
2017-12-01 00:11:00 +01:00
if ( 'message' == $severity ) {
2014-06-30 16:39:17 +02:00
$messages .= ' ' . $error_message . " <br /> \n " ;
2017-12-01 00:11:00 +01:00
} else {
2014-06-30 16:39:17 +02:00
$errors .= ' ' . $error_message . " <br /> \n " ;
2017-12-01 00:11:00 +01:00
}
2013-10-25 00:58:23 +02:00
}
}
if ( ! empty ( $errors ) ) {
/**
2016-05-23 18:44:27 +02:00
* Filters the error messages displayed above the login form .
2013-10-25 00:58:23 +02:00
*
* @ since 2.1 . 0
*
* @ param string $errors Login error message .
*/
echo '<div id="login_error">' . apply_filters ( 'login_errors' , $errors ) . " </div> \n " ;
}
if ( ! empty ( $messages ) ) {
/**
2016-05-23 18:44:27 +02:00
* Filters instructional messages displayed above the login form .
2013-10-25 00:58:23 +02:00
*
* @ since 2.5 . 0
*
* @ param string $messages Login messages .
*/
echo '<p class="message">' . apply_filters ( 'login_messages' , $messages ) . " </p> \n " ;
}
}
} // End of login_header()
/**
* Outputs the footer for the login page .
*
2018-09-14 15:48:24 +02:00
* @ since 3.1 . 0
*
* @ param string $input_id Which input to auto - focus .
2013-10-25 00:58:23 +02:00
*/
2017-12-01 00:11:00 +01:00
function login_footer ( $input_id = '' ) {
2013-10-25 00:58:23 +02:00
global $interim_login ;
// Don't allow interim logins to navigate away from the page.
2017-12-01 00:11:00 +01:00
if ( ! $interim_login ) :
2018-08-17 03:51:36 +02:00
?>
2017-12-01 00:11:00 +01:00
< p id = " backtoblog " >< a href = " <?php echo esc_url( home_url( '/' ) ); ?> " >
2018-08-17 03:51:36 +02:00
< ? php
2018-08-15 08:22:26 +02:00
/* translators: %s: site title */
printf ( _x ( '← Back to %s' , 'site' ), get_bloginfo ( 'title' , 'display' ) );
2018-08-17 03:51:36 +02:00
?>
2017-12-01 00:11:00 +01:00
</ a ></ p >
2018-08-17 03:51:36 +02:00
< ? php the_privacy_policy_link ( '<div class="privacy-policy-page-link">' , '</div>' ); ?>
2013-10-25 00:58:23 +02:00
< ? php endif ; ?>
</ div >
2017-12-01 00:11:00 +01:00
< ? php if ( ! empty ( $input_id ) ) : ?>
2013-10-25 00:58:23 +02:00
< script type = " text/javascript " >
try { document . getElementById ( '<?php echo $input_id; ?>' ) . focus ();} catch ( e ){}
if ( typeof wpOnload == 'function' ) wpOnload ();
</ script >
< ? php endif ; ?>
< ? php
/**
* Fires in the login page footer .
*
* @ since 3.1 . 0
*/
2017-12-01 00:11:00 +01:00
do_action ( 'login_footer' );
?>
2013-10-25 00:58:23 +02:00
< div class = " clear " ></ div >
</ body >
</ html >
< ? php
}
2015-05-31 05:18:25 +02:00
/**
2018-09-14 15:48:24 +02:00
* Outputs the Javascript to handle the form shaking .
*
2015-05-31 05:18:25 +02:00
* @ since 3.0 . 0
*/
2013-10-25 00:58:23 +02:00
function wp_shake_js () {
2018-08-17 03:51:36 +02:00
?>
2013-10-25 00:58:23 +02:00
< script type = " text/javascript " >
addLoadEvent = function ( func ){ if ( typeof jQuery != " undefined " ) jQuery ( document ) . ready ( func ); else if ( typeof wpOnload != 'function' ){ wpOnload = func ;} else { var oldonload = wpOnload ; wpOnload = function (){ oldonload (); func ();}}};
function s ( id , pos ){ g ( id ) . left = pos + 'px' ;}
function g ( id ){ return document . getElementById ( id ) . style ;}
function shake ( id , a , d ){ c = a . shift (); s ( id , c ); if ( a . length > 0 ){ setTimeout ( function (){ shake ( id , a , d );}, d );} else { try { g ( id ) . position = 'static' ; wp_attempt_focus ();} catch ( e ){}}}
addLoadEvent ( function (){ var p = new Array ( 15 , 30 , 15 , 0 , - 15 , - 30 , - 15 , 0 ); p = p . concat ( p . concat ( p )); var i = document . forms [ 0 ] . id ; g ( i ) . position = 'relative' ; shake ( i , p , 20 );});
</ script >
2018-08-17 03:51:36 +02:00
< ? php
2013-10-25 00:58:23 +02:00
}
2015-05-31 05:18:25 +02:00
/**
2018-09-14 15:48:24 +02:00
* Outputs the viewport meta tag .
*
2015-05-31 05:18:25 +02:00
* @ since 3.7 . 0
*/
2013-10-25 00:58:23 +02:00
function wp_login_viewport_meta () {
?>
< meta name = " viewport " content = " width=device-width " />
< ? php
}
/**
* Handles sending password retrieval email to user .
*
2018-09-14 15:48:24 +02:00
* @ since 2.5 . 0
*
2013-10-25 00:58:23 +02:00
* @ return bool | WP_Error True : when finish . WP_Error on error
*/
function retrieve_password () {
$errors = new WP_Error ();
2017-10-06 19:37:47 +02:00
if ( empty ( $_POST [ 'user_login' ] ) || ! is_string ( $_POST [ 'user_login' ] ) ) {
2017-12-01 00:11:00 +01:00
$errors -> add ( 'empty_username' , __ ( '<strong>ERROR</strong>: Enter a username or email address.' ) );
2015-01-08 08:05:25 +01:00
} elseif ( strpos ( $_POST [ 'user_login' ], '@' ) ) {
2016-05-20 21:21:30 +02:00
$user_data = get_user_by ( 'email' , trim ( wp_unslash ( $_POST [ 'user_login' ] ) ) );
2017-12-01 00:11:00 +01:00
if ( empty ( $user_data ) ) {
2019-01-09 03:06:50 +01:00
$errors -> add ( 'invalid_email' , __ ( '<strong>ERROR</strong>: There is no account with that username or email address.' ) );
2017-12-01 00:11:00 +01:00
}
2013-10-25 00:58:23 +02:00
} else {
2017-12-01 00:11:00 +01:00
$login = trim ( $_POST [ 'user_login' ] );
$user_data = get_user_by ( 'login' , $login );
2013-10-25 00:58:23 +02:00
}
/**
* Fires before errors are returned from a password reset request .
*
* @ since 2.1 . 0
2015-10-07 01:00:25 +02:00
* @ since 4.4 . 0 Added the `$errors` parameter .
*
* @ param WP_Error $errors A WP_Error object containing any errors generated
* by using invalid credentials .
2013-10-25 00:58:23 +02:00
*/
2015-10-07 01:00:25 +02:00
do_action ( 'lostpassword_post' , $errors );
2013-10-25 00:58:23 +02:00
2018-02-27 03:31:31 +01:00
if ( $errors -> has_errors () ) {
2013-10-25 00:58:23 +02:00
return $errors ;
2017-12-01 00:11:00 +01:00
}
2013-10-25 00:58:23 +02:00
2017-12-01 00:11:00 +01:00
if ( ! $user_data ) {
2019-01-09 03:06:50 +01:00
$errors -> add ( 'invalidcombo' , __ ( '<strong>ERROR</strong>: There is no account with that username or email address.' ) );
2013-10-25 00:58:23 +02:00
return $errors ;
}
2014-07-17 11:12:16 +02:00
// Redefining user_login ensures we return the right case in the email.
2013-10-25 00:58:23 +02:00
$user_login = $user_data -> user_login ;
$user_email = $user_data -> user_email ;
2017-12-01 00:11:00 +01:00
$key = get_password_reset_key ( $user_data );
2013-10-25 00:58:23 +02:00
2015-10-08 02:11:24 +02:00
if ( is_wp_error ( $key ) ) {
return $key ;
2013-10-25 00:58:23 +02:00
}
2016-08-31 07:04:29 +02:00
if ( is_multisite () ) {
2017-09-23 13:44:46 +02:00
$site_name = get_network () -> site_name ;
2016-08-31 07:04:29 +02:00
} else {
2014-07-17 11:12:16 +02:00
/*
* The blogname option is escaped with esc_html on the way into the database
* in sanitize_option we want to reverse this for the plain text arena of emails .
*/
2017-09-23 13:44:46 +02:00
$site_name = wp_specialchars_decode ( get_option ( 'blogname' ), ENT_QUOTES );
2016-08-31 07:04:29 +02:00
}
2013-10-25 00:58:23 +02:00
2017-09-23 13:44:46 +02:00
$message = __ ( 'Someone has requested a password reset for the following account:' ) . " \r \n \r \n " ;
/* translators: %s: site name */
2017-12-01 00:11:00 +01:00
$message .= sprintf ( __ ( 'Site Name: %s' ), $site_name ) . " \r \n \r \n " ;
2017-09-23 13:44:46 +02:00
/* translators: %s: user login */
2017-12-01 00:11:00 +01:00
$message .= sprintf ( __ ( 'Username: %s' ), $user_login ) . " \r \n \r \n " ;
2017-09-23 13:44:46 +02:00
$message .= __ ( 'If this was a mistake, just ignore this email and nothing will happen.' ) . " \r \n \r \n " ;
$message .= __ ( 'To reset your password, visit the following address:' ) . " \r \n \r \n " ;
$message .= '<' . network_site_url ( " wp-login.php?action=rp&key= $key &login= " . rawurlencode ( $user_login ), 'login' ) . " > \r \n " ;
/* translators: Password reset email subject. %s: Site name */
$title = sprintf ( __ ( '[%s] Password Reset' ), $site_name );
2013-10-25 00:58:23 +02:00
/**
2016-05-23 18:44:27 +02:00
* Filters the subject of the password reset email .
2013-10-25 00:58:23 +02:00
*
* @ since 2.8 . 0
2015-10-13 02:51:24 +02:00
* @ since 4.4 . 0 Added the `$user_login` and `$user_data` parameters .
2013-10-25 00:58:23 +02:00
*
2015-10-13 02:51:24 +02:00
* @ param string $title Default email title .
* @ param string $user_login The username for the user .
* @ param WP_User $user_data WP_User object .
2013-10-25 00:58:23 +02:00
*/
2015-10-13 02:51:24 +02:00
$title = apply_filters ( 'retrieve_password_title' , $title , $user_login , $user_data );
2014-11-16 08:25:22 +01:00
2013-10-25 00:58:23 +02:00
/**
2016-05-23 18:44:27 +02:00
* Filters the message body of the password reset mail .
2017-05-12 19:12:46 +02:00
*
2017-02-06 05:16:42 +01:00
* If the filtered message is empty , the password reset email will not be sent .
2013-10-25 00:58:23 +02:00
*
* @ since 2.8 . 0
2014-11-16 08:25:22 +01:00
* @ since 4.1 . 0 Added `$user_login` and `$user_data` parameters .
2013-10-25 00:58:23 +02:00
*
2014-11-16 08:25:22 +01:00
* @ param string $message Default mail message .
* @ param string $key The activation key .
* @ param string $user_login The username for the user .
* @ param WP_User $user_data WP_User object .
2013-10-25 00:58:23 +02:00
*/
2014-11-16 08:25:22 +01:00
$message = apply_filters ( 'retrieve_password_message' , $message , $key , $user_login , $user_data );
2013-10-25 00:58:23 +02:00
2017-12-01 00:11:00 +01:00
if ( $message && ! wp_mail ( $user_email , wp_specialchars_decode ( $title ), $message ) ) {
wp_die ( __ ( 'The email could not be sent.' ) . " <br /> \n " . __ ( 'Possible reason: your host may have disabled the mail() function.' ) );
}
2013-10-25 00:58:23 +02:00
return true ;
}
//
2018-09-14 15:48:24 +02:00
// Main.
2013-10-25 00:58:23 +02:00
//
2017-12-01 00:11:00 +01:00
$action = isset ( $_REQUEST [ 'action' ] ) ? $_REQUEST [ 'action' ] : 'login' ;
2013-10-25 00:58:23 +02:00
$errors = new WP_Error ();
2017-12-01 00:11:00 +01:00
if ( isset ( $_GET [ 'key' ] ) ) {
2013-10-25 00:58:23 +02:00
$action = 'resetpass' ;
2017-12-01 00:11:00 +01:00
}
2013-10-25 00:58:23 +02:00
2018-09-14 15:48:24 +02:00
// Validate action so as to default to the login screen.
Bootstrap/Load: Introduce a recovery mode for fixing fatal errors.
Using the new fatal handler introduced in [44962], an email is sent to the admin when a fatal error occurs. This email includes a secret link to enter recovery mode. When clicked, the link will be validated and on success a cookie will be placed on the client, enabling recovery mode for that user. This functionality is executed early before plugins and themes are loaded, in order to be unaffected by potential fatal errors these might be causing.
When in recovery mode, broken plugins and themes will be paused for that client, so that they are able to access the admin backend despite of these errors. They are notified about the broken extensions and the errors caused, and can then decide whether they would like to temporarily deactivate the extension or fix the problem and resume the extension.
A link in the admin bar allows the client to exit recovery mode.
Props timothyblynjacobs, afragen, flixos90, nerrad, miss_jwo, schlessera, spacedmonkey, swissspidy.
Fixes #46130, #44458.
Built from https://develop.svn.wordpress.org/trunk@44973
git-svn-id: http://core.svn.wordpress.org/trunk@44804 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2019-03-21 22:53:51 +01:00
if ( ! in_array ( $action , array ( 'postpass' , 'logout' , 'lostpassword' , 'retrievepassword' , 'resetpass' , 'rp' , 'register' , 'login' , 'confirmaction' , WP_Recovery_Mode_Link_Service :: LOGIN_ACTION_ENTERED ), true ) && false === has_filter ( 'login_form_' . $action ) ) {
2013-10-25 00:58:23 +02:00
$action = 'login' ;
2017-12-01 00:11:00 +01:00
}
2013-10-25 00:58:23 +02:00
nocache_headers ();
2017-12-01 00:11:00 +01:00
header ( 'Content-Type: ' . get_bloginfo ( 'html_type' ) . '; charset=' . get_bloginfo ( 'charset' ) );
2013-10-25 00:58:23 +02:00
if ( defined ( 'RELOCATE' ) && RELOCATE ) { // Move flag is set
2017-12-01 00:11:00 +01:00
if ( isset ( $_SERVER [ 'PATH_INFO' ] ) && ( $_SERVER [ 'PATH_INFO' ] != $_SERVER [ 'PHP_SELF' ] ) ) {
2013-10-25 00:58:23 +02:00
$_SERVER [ 'PHP_SELF' ] = str_replace ( $_SERVER [ 'PATH_INFO' ], '' , $_SERVER [ 'PHP_SELF' ] );
2017-12-01 00:11:00 +01:00
}
2013-10-25 00:58:23 +02:00
2017-12-01 00:11:00 +01:00
$url = dirname ( set_url_scheme ( 'http://' . $_SERVER [ 'HTTP_HOST' ] . $_SERVER [ 'PHP_SELF' ] ) );
if ( $url != get_option ( 'siteurl' ) ) {
2013-10-25 00:58:23 +02:00
update_option ( 'siteurl' , $url );
2017-12-01 00:11:00 +01:00
}
2013-10-25 00:58:23 +02:00
}
//Set a cookie now to see if they are supported by the browser.
2015-10-08 05:05:25 +02:00
$secure = ( 'https' === parse_url ( wp_login_url (), PHP_URL_SCHEME ) );
2014-06-29 15:25:16 +02:00
setcookie ( TEST_COOKIE , 'WP Cookie check' , 0 , COOKIEPATH , COOKIE_DOMAIN , $secure );
2017-12-01 00:11:00 +01:00
if ( SITECOOKIEPATH != COOKIEPATH ) {
2014-06-29 15:25:16 +02:00
setcookie ( TEST_COOKIE , 'WP Cookie check' , 0 , SITECOOKIEPATH , COOKIE_DOMAIN , $secure );
2017-12-01 00:11:00 +01:00
}
2013-10-25 00:58:23 +02:00
/**
* Fires when the login form is initialized .
2013-10-25 04:29:52 +02:00
*
2013-10-25 00:58:23 +02:00
* @ since 3.2 . 0
*/
do_action ( 'login_init' );
2017-10-03 01:21:47 +02:00
2013-10-25 00:58:23 +02:00
/**
* Fires before a specified login form action .
*
2014-11-30 12:45:23 +01:00
* The dynamic portion of the hook name , `$action` , refers to the action
2013-10-25 00:58:23 +02:00
* that brought the visitor to the login form . Actions include 'postpass' ,
* 'logout' , 'lostpassword' , etc .
2013-10-25 04:29:52 +02:00
*
2013-10-25 00:58:23 +02:00
* @ since 2.8 . 0
*/
2016-08-22 20:25:31 +02:00
do_action ( " login_form_ { $action } " );
2013-10-25 00:58:23 +02:00
2017-12-01 00:11:00 +01:00
$http_post = ( 'POST' == $_SERVER [ 'REQUEST_METHOD' ] );
$interim_login = isset ( $_REQUEST [ 'interim-login' ] );
2013-10-25 00:58:23 +02:00
2017-08-22 16:23:47 +02:00
/**
* Filters the separator used between login form navigation links .
*
* @ since 4.9 . 0
*
* @ param string $login_link_separator The separator used between login form navigation links .
*/
$login_link_separator = apply_filters ( 'login_link_separator' , ' | ' );
2017-12-01 00:11:00 +01:00
switch ( $action ) {
2015-10-07 16:30:25 +02:00
2017-12-01 00:11:00 +01:00
case 'postpass' :
if ( ! array_key_exists ( 'post_password' , $_POST ) ) {
wp_safe_redirect ( wp_get_referer () );
exit ();
}
2013-10-25 00:58:23 +02:00
2017-12-01 00:11:00 +01:00
require_once ABSPATH . WPINC . '/class-phpass.php' ;
$hasher = new PasswordHash ( 8 , true );
2013-10-25 00:58:23 +02:00
2017-12-01 00:11:00 +01:00
/**
* Filters the life span of the post password cookie .
*
* By default , the cookie expires 10 days from creation . To turn this
* into a session cookie , return 0.
*
* @ since 3.7 . 0
*
* @ param int $expires The expiry time , as passed to setcookie () .
*/
$expire = apply_filters ( 'post_password_expires' , time () + 10 * DAY_IN_SECONDS );
$referer = wp_get_referer ();
if ( $referer ) {
$secure = ( 'https' === parse_url ( $referer , PHP_URL_SCHEME ) );
} else {
$secure = false ;
}
setcookie ( 'wp-postpass_' . COOKIEHASH , $hasher -> HashPassword ( wp_unslash ( $_POST [ 'post_password' ] ) ), $expire , COOKIEPATH , COOKIE_DOMAIN , $secure );
2017-10-03 01:21:47 +02:00
2017-12-01 00:11:00 +01:00
wp_safe_redirect ( wp_get_referer () );
exit ();
2015-02-11 20:19:26 +01:00
2017-12-01 00:11:00 +01:00
case 'logout' :
check_admin_referer ( 'log-out' );
2015-02-11 20:19:26 +01:00
2017-12-01 00:11:00 +01:00
$user = wp_get_current_user ();
2013-10-25 00:58:23 +02:00
2017-12-01 00:11:00 +01:00
wp_logout ();
2015-02-11 20:19:26 +01:00
2017-12-01 00:11:00 +01:00
if ( ! empty ( $_REQUEST [ 'redirect_to' ] ) ) {
$redirect_to = $requested_redirect_to = $_REQUEST [ 'redirect_to' ];
} else {
$redirect_to = 'wp-login.php?loggedout=true' ;
$requested_redirect_to = '' ;
}
2017-10-03 01:21:47 +02:00
2017-12-01 00:11:00 +01:00
/**
* Filters the log out redirect URL .
*
* @ since 4.2 . 0
*
* @ param string $redirect_to The redirect destination URL .
* @ param string $requested_redirect_to The requested redirect destination URL passed as a parameter .
* @ param WP_User $user The WP_User object for the user that ' s logging out .
*/
$redirect_to = apply_filters ( 'logout_redirect' , $redirect_to , $requested_redirect_to , $user );
wp_safe_redirect ( $redirect_to );
exit ();
2013-10-25 00:58:23 +02:00
2017-12-01 00:11:00 +01:00
case 'lostpassword' :
case 'retrievepassword' :
if ( $http_post ) {
$errors = retrieve_password ();
if ( ! is_wp_error ( $errors ) ) {
$redirect_to = ! empty ( $_REQUEST [ 'redirect_to' ] ) ? $_REQUEST [ 'redirect_to' ] : 'wp-login.php?checkemail=confirm' ;
wp_safe_redirect ( $redirect_to );
exit ();
}
2013-10-25 00:58:23 +02:00
}
2017-12-01 00:11:00 +01:00
if ( isset ( $_GET [ 'error' ] ) ) {
if ( 'invalidkey' == $_GET [ 'error' ] ) {
$errors -> add ( 'invalidkey' , __ ( 'Your password reset link appears to be invalid. Please request a new link below.' ) );
} elseif ( 'expiredkey' == $_GET [ 'error' ] ) {
$errors -> add ( 'expiredkey' , __ ( 'Your password reset link has expired. Please request a new link below.' ) );
}
2015-07-01 08:33:26 +02:00
}
2013-10-25 00:58:23 +02:00
2017-12-01 00:11:00 +01:00
$lostpassword_redirect = ! empty ( $_REQUEST [ 'redirect_to' ] ) ? $_REQUEST [ 'redirect_to' ] : '' ;
/**
* Filters the URL redirected to after submitting the lostpassword / retrievepassword form .
*
* @ since 3.0 . 0
*
* @ param string $lostpassword_redirect The redirect destination URL .
*/
$redirect_to = apply_filters ( 'lostpassword_redirect' , $lostpassword_redirect );
2013-10-25 00:58:23 +02:00
2017-12-01 00:11:00 +01:00
/**
* Fires before the lost password form .
*
* @ since 1.5 . 1
2019-01-04 22:52:50 +01:00
* @ since 5.1 . 0 Added the `$errors` parameter .
2018-07-28 15:02:25 +02:00
*
* @ param WP_Error $errors A `WP_Error` object containing any errors generated by using invalid
* credentials . Note that the error object may not contain any errors .
2017-12-01 00:11:00 +01:00
*/
2018-07-28 15:02:25 +02:00
do_action ( 'lost_password' , $errors );
2013-10-25 00:58:23 +02:00
2017-12-01 00:11:00 +01:00
login_header ( __ ( 'Lost Password' ), '<p class="message">' . __ ( 'Please enter your username or email address. You will receive a link to create a new password via email.' ) . '</p>' , $errors );
2013-10-25 00:58:23 +02:00
2017-12-01 00:11:00 +01:00
$user_login = '' ;
2017-10-06 19:37:47 +02:00
2017-12-01 00:11:00 +01:00
if ( isset ( $_POST [ 'user_login' ] ) && is_string ( $_POST [ 'user_login' ] ) ) {
$user_login = wp_unslash ( $_POST [ 'user_login' ] );
}
2013-10-25 00:58:23 +02:00
2018-08-17 03:51:36 +02:00
?>
2013-10-25 00:58:23 +02:00
2017-12-01 00:11:00 +01:00
< form name = " lostpasswordform " id = " lostpasswordform " action = " <?php echo esc_url( network_site_url( 'wp-login.php?action=lostpassword', 'login_post' ) ); ?> " method = " post " >
2013-10-25 00:58:23 +02:00
< p >
2016-08-31 20:51:28 +02:00
< label for = " user_login " >< ? php _e ( 'Username or Email Address' ); ?> <br />
2017-12-16 14:41:48 +01:00
< input type = " text " name = " user_login " id = " user_login " class = " input " value = " <?php echo esc_attr( $user_login ); ?> " size = " 20 " autocapitalize = " off " /></ label >
2013-10-25 00:58:23 +02:00
</ p >
2018-08-17 03:51:36 +02:00
< ? php
/**
* Fires inside the lostpassword form tags , before the hidden fields .
*
* @ since 2.1 . 0
*/
do_action ( 'lostpassword_form' );
?>
2017-12-01 00:11:00 +01:00
< input type = " hidden " name = " redirect_to " value = " <?php echo esc_attr( $redirect_to ); ?> " />
< p class = " submit " >< input type = " submit " name = " wp-submit " id = " wp-submit " class = " button button-primary button-large " value = " <?php esc_attr_e( 'Get New Password' ); ?> " /></ p >
</ form >
2014-04-25 08:24:15 +02:00
2017-12-01 00:11:00 +01:00
< p id = " nav " >
< a href = " <?php echo esc_url( wp_login_url() ); ?> " >< ? php _e ( 'Log in' ); ?> </a>
2018-08-17 03:51:36 +02:00
< ? php
if ( get_option ( 'users_can_register' ) ) :
$registration_url = sprintf ( '<a href="%s">%s</a>' , esc_url ( wp_registration_url () ), __ ( 'Register' ) );
2017-08-22 16:23:47 +02:00
2018-08-17 03:51:36 +02:00
echo esc_html ( $login_link_separator );
2013-10-25 00:58:23 +02:00
2018-08-17 03:51:36 +02:00
/** This filter is documented in wp-includes/general-template.php */
echo apply_filters ( 'register' , $registration_url );
2017-12-01 00:11:00 +01:00
endif ;
2018-08-17 03:51:36 +02:00
?>
2017-12-01 00:11:00 +01:00
</ p >
2017-10-03 01:21:47 +02:00
2018-08-17 03:51:36 +02:00
< ? php
login_footer ( 'user_login' );
2017-10-03 01:21:47 +02:00
2017-12-01 00:11:00 +01:00
break ;
case 'resetpass' :
case 'rp' :
list ( $rp_path ) = explode ( '?' , wp_unslash ( $_SERVER [ 'REQUEST_URI' ] ) );
$rp_cookie = 'wp-resetpass-' . COOKIEHASH ;
if ( isset ( $_GET [ 'key' ] ) ) {
$value = sprintf ( '%s:%s' , wp_unslash ( $_GET [ 'login' ] ), wp_unslash ( $_GET [ 'key' ] ) );
setcookie ( $rp_cookie , $value , 0 , $rp_path , COOKIE_DOMAIN , is_ssl (), true );
wp_safe_redirect ( remove_query_arg ( array ( 'key' , 'login' ) ) );
exit ;
}
if ( isset ( $_COOKIE [ $rp_cookie ] ) && 0 < strpos ( $_COOKIE [ $rp_cookie ], ':' ) ) {
list ( $rp_login , $rp_key ) = explode ( ':' , wp_unslash ( $_COOKIE [ $rp_cookie ] ), 2 );
$user = check_password_reset_key ( $rp_key , $rp_login );
if ( isset ( $_POST [ 'pass1' ] ) && ! hash_equals ( $rp_key , $_POST [ 'rp_key' ] ) ) {
$user = false ;
}
} else {
2014-11-20 13:22:22 +01:00
$user = false ;
}
2013-10-25 00:58:23 +02:00
2017-12-01 00:11:00 +01:00
if ( ! $user || is_wp_error ( $user ) ) {
setcookie ( $rp_cookie , ' ' , time () - YEAR_IN_SECONDS , $rp_path , COOKIE_DOMAIN , is_ssl (), true );
if ( $user && $user -> get_error_code () === 'expired_key' ) {
wp_redirect ( site_url ( 'wp-login.php?action=lostpassword&error=expiredkey' ) );
} else {
wp_redirect ( site_url ( 'wp-login.php?action=lostpassword&error=invalidkey' ) );
}
exit ;
}
2013-10-25 00:58:23 +02:00
2017-12-01 00:11:00 +01:00
$errors = new WP_Error ();
2013-10-25 00:58:23 +02:00
2017-12-01 00:11:00 +01:00
if ( isset ( $_POST [ 'pass1' ] ) && $_POST [ 'pass1' ] != $_POST [ 'pass2' ] ) {
$errors -> add ( 'password_reset_mismatch' , __ ( 'The passwords do not match.' ) );
}
2013-10-25 00:58:23 +02:00
2017-12-01 00:11:00 +01:00
/**
* Fires before the password reset procedure is validated .
*
* @ since 3.5 . 0
*
* @ param object $errors WP Error object .
* @ param WP_User | WP_Error $user WP_User object if the login and reset key match . WP_Error object otherwise .
*/
do_action ( 'validate_password_reset' , $errors , $user );
2018-02-27 03:31:31 +01:00
if ( ( ! $errors -> has_errors () ) && isset ( $_POST [ 'pass1' ] ) && ! empty ( $_POST [ 'pass1' ] ) ) {
2017-12-01 00:11:00 +01:00
reset_password ( $user , $_POST [ 'pass1' ] );
setcookie ( $rp_cookie , ' ' , time () - YEAR_IN_SECONDS , $rp_path , COOKIE_DOMAIN , is_ssl (), true );
login_header ( __ ( 'Password Reset' ), '<p class="message reset-pass">' . __ ( 'Your password has been reset.' ) . ' <a href="' . esc_url ( wp_login_url () ) . '">' . __ ( 'Log in' ) . '</a></p>' );
login_footer ();
exit ;
}
2013-10-25 00:58:23 +02:00
2017-12-01 00:11:00 +01:00
wp_enqueue_script ( 'utils' );
wp_enqueue_script ( 'user-profile' );
2013-10-25 00:58:23 +02:00
2017-12-01 00:11:00 +01:00
login_header ( __ ( 'Reset Password' ), '<p class="message reset-pass">' . __ ( 'Enter your new password below.' ) . '</p>' , $errors );
2013-10-25 00:58:23 +02:00
2018-08-17 03:51:36 +02:00
?>
2017-12-01 00:11:00 +01:00
< form name = " resetpassform " id = " resetpassform " action = " <?php echo esc_url( network_site_url( 'wp-login.php?action=resetpass', 'login_post' ) ); ?> " method = " post " autocomplete = " off " >
2014-07-29 20:19:16 +02:00
< input type = " hidden " id = " user_login " value = " <?php echo esc_attr( $rp_login ); ?> " autocomplete = " off " />
2013-10-25 00:58:23 +02:00
2015-09-22 05:57:24 +02:00
< div class = " user-pass1-wrap " >
< p >
2017-12-01 00:11:00 +01:00
< label for = " pass1 " >< ? php _e ( 'New password' ); ?> </label>
2015-09-22 05:57:24 +02:00
</ p >
< div class = " wp-pwd " >
2017-09-21 23:29:48 +02:00
< div class = " password-input-wrapper " >
< input type = " password " data - reveal = " 1 " data - pw = " <?php echo esc_attr( wp_generate_password( 16 ) ); ?> " name = " pass1 " id = " pass1 " class = " input password-input " size = " 24 " value = " " autocomplete = " off " aria - describedby = " pass-strength-result " />
2019-03-14 00:37:57 +01:00
< button type = " button " class = " button button-secondary wp-hide-pw hide-if-no-js " >
< span class = " dashicons dashicons-hidden " aria - hidden = " true " ></ span >
</ button >
2017-09-21 23:29:48 +02:00
</ div >
2015-09-22 05:57:24 +02:00
< div id = " pass-strength-result " class = " hide-if-no-js " aria - live = " polite " >< ? php _e ( 'Strength indicator' ); ?> </div>
</ div >
2017-09-21 23:29:48 +02:00
< div class = " pw-weak " >
< label >
< input type = " checkbox " name = " pw_weak " class = " pw-checkbox " />
< ? php _e ( 'Confirm use of weak password' ); ?>
</ label >
</ div >
2015-09-16 13:46:25 +02:00
</ div >
2015-07-01 16:48:24 +02:00
< p class = " user-pass2-wrap " >
2017-12-01 00:11:00 +01:00
< label for = " pass2 " >< ? php _e ( 'Confirm new password' ); ?> </label><br />
2015-07-01 16:48:24 +02:00
< input type = " password " name = " pass2 " id = " pass2 " class = " input " size = " 20 " value = " " autocomplete = " off " />
2013-10-25 00:58:23 +02:00
</ p >
2014-12-15 09:34:23 +01:00
< p class = " description indicator-hint " >< ? php echo wp_get_password_hint (); ?> </p>
2013-10-25 00:58:23 +02:00
< br class = " clear " />
2014-02-02 08:52:13 +01:00
2018-08-17 03:51:36 +02:00
< ? php
/**
* Fires following the 'Strength indicator' meter in the user password reset form .
*
* @ since 3.9 . 0
*
* @ param WP_User $user User object of the user whose password is being reset .
*/
do_action ( 'resetpass_form' , $user );
?>
2014-11-20 13:22:22 +01:00
< input type = " hidden " name = " rp_key " value = " <?php echo esc_attr( $rp_key ); ?> " />
2017-12-01 00:11:00 +01:00
< p class = " submit " >< input type = " submit " name = " wp-submit " id = " wp-submit " class = " button button-primary button-large " value = " <?php esc_attr_e( 'Reset Password' ); ?> " /></ p >
</ form >
2013-10-25 00:58:23 +02:00
2017-12-01 00:11:00 +01:00
< p id = " nav " >
< a href = " <?php echo esc_url( wp_login_url() ); ?> " >< ? php _e ( 'Log in' ); ?> </a>
2018-08-17 03:51:36 +02:00
< ? php
if ( get_option ( 'users_can_register' ) ) :
$registration_url = sprintf ( '<a href="%s">%s</a>' , esc_url ( wp_registration_url () ), __ ( 'Register' ) );
2017-10-03 01:21:47 +02:00
2018-08-17 03:51:36 +02:00
echo esc_html ( $login_link_separator );
2017-10-03 01:21:47 +02:00
2018-08-17 03:51:36 +02:00
/** This filter is documented in wp-includes/general-template.php */
echo apply_filters ( 'register' , $registration_url );
2017-12-01 00:11:00 +01:00
endif ;
2018-08-17 03:51:36 +02:00
?>
2017-12-01 00:11:00 +01:00
</ p >
2013-10-25 00:58:23 +02:00
2018-08-17 03:51:36 +02:00
< ? php
login_footer ( 'user_pass' );
2013-10-25 00:58:23 +02:00
2017-12-01 00:11:00 +01:00
break ;
2017-10-06 19:37:47 +02:00
2017-12-01 00:11:00 +01:00
case 'register' :
if ( is_multisite () ) {
/**
* Filters the Multisite sign up URL .
*
* @ since 3.0 . 0
*
* @ param string $sign_up_url The sign up URL .
*/
wp_redirect ( apply_filters ( 'wp_signup_location' , network_site_url ( 'wp-signup.php' ) ) );
exit ;
2017-10-06 19:37:47 +02:00
}
2017-12-01 00:11:00 +01:00
if ( ! get_option ( 'users_can_register' ) ) {
wp_redirect ( site_url ( 'wp-login.php?registration=disabled' ) );
exit ();
2017-10-06 19:37:47 +02:00
}
2017-12-01 00:11:00 +01:00
$user_login = '' ;
$user_email = '' ;
if ( $http_post ) {
if ( isset ( $_POST [ 'user_login' ] ) && is_string ( $_POST [ 'user_login' ] ) ) {
$user_login = $_POST [ 'user_login' ];
}
if ( isset ( $_POST [ 'user_email' ] ) && is_string ( $_POST [ 'user_email' ] ) ) {
$user_email = wp_unslash ( $_POST [ 'user_email' ] );
}
$errors = register_new_user ( $user_login , $user_email );
if ( ! is_wp_error ( $errors ) ) {
$redirect_to = ! empty ( $_POST [ 'redirect_to' ] ) ? $_POST [ 'redirect_to' ] : 'wp-login.php?checkemail=registered' ;
wp_safe_redirect ( $redirect_to );
exit ();
}
2013-10-25 00:58:23 +02:00
}
2017-12-01 00:11:00 +01:00
$registration_redirect = ! empty ( $_REQUEST [ 'redirect_to' ] ) ? $_REQUEST [ 'redirect_to' ] : '' ;
/**
* Filters the registration redirect URL .
*
* @ since 3.0 . 0
*
* @ param string $registration_redirect The redirect destination URL .
*/
$redirect_to = apply_filters ( 'registration_redirect' , $registration_redirect );
login_header ( __ ( 'Registration Form' ), '<p class="message register">' . __ ( 'Register For This Site' ) . '</p>' , $errors );
2018-08-17 03:51:36 +02:00
?>
2017-12-01 00:11:00 +01:00
< form name = " registerform " id = " registerform " action = " <?php echo esc_url( site_url( 'wp-login.php?action=register', 'login_post' ) ); ?> " method = " post " novalidate = " novalidate " >
2013-10-25 00:58:23 +02:00
< p >
2017-12-01 00:11:00 +01:00
< label for = " user_login " >< ? php _e ( 'Username' ); ?> <br />
2017-12-16 14:41:48 +01:00
< input type = " text " name = " user_login " id = " user_login " class = " input " value = " <?php echo esc_attr( wp_unslash( $user_login ) ); ?> " size = " 20 " autocapitalize = " off " /></ label >
2013-10-25 00:58:23 +02:00
</ p >
< p >
2017-12-01 00:11:00 +01:00
< label for = " user_email " >< ? php _e ( 'Email' ); ?> <br />
2014-07-08 19:52:14 +02:00
< input type = " email " name = " user_email " id = " user_email " class = " input " value = " <?php echo esc_attr( wp_unslash( $user_email ) ); ?> " size = " 25 " /></ label >
2013-10-25 00:58:23 +02:00
</ p >
2018-08-17 03:51:36 +02:00
< ? php
/**
* Fires following the 'Email' field in the user registration form .
*
* @ since 2.1 . 0
*/
do_action ( 'register_form' );
?>
2015-08-28 05:17:21 +02:00
< p id = " reg_passmail " >< ? php _e ( 'Registration confirmation will be emailed to you.' ); ?> </p>
2013-10-25 00:58:23 +02:00
< br class = " clear " />
< input type = " hidden " name = " redirect_to " value = " <?php echo esc_attr( $redirect_to ); ?> " />
2017-12-01 00:11:00 +01:00
< p class = " submit " >< input type = " submit " name = " wp-submit " id = " wp-submit " class = " button button-primary button-large " value = " <?php esc_attr_e( 'Register' ); ?> " /></ p >
</ form >
2013-10-25 00:58:23 +02:00
2017-12-01 00:11:00 +01:00
< p id = " nav " >
< a href = " <?php echo esc_url( wp_login_url() ); ?> " >< ? php _e ( 'Log in' ); ?> </a>
2018-08-17 03:51:36 +02:00
< ? php echo esc_html ( $login_link_separator ); ?>
2017-12-01 00:11:00 +01:00
< a href = " <?php echo esc_url( wp_lostpassword_url() ); ?> " >< ? php _e ( 'Lost your password?' ); ?> </a>
</ p >
2013-10-25 00:58:23 +02:00
2018-08-17 03:51:36 +02:00
< ? php
login_footer ( 'user_login' );
2017-10-03 01:21:47 +02:00
2017-12-01 00:11:00 +01:00
break ;
2013-10-25 00:58:23 +02:00
2018-08-17 03:51:36 +02:00
case 'confirmaction' :
2018-04-27 12:12:22 +02:00
if ( ! isset ( $_GET [ 'request_id' ] ) ) {
2019-03-19 03:38:48 +01:00
wp_die ( __ ( 'Missing request ID.' ) );
2018-04-27 12:12:22 +02:00
}
2019-03-19 03:38:48 +01:00
if ( ! isset ( $_GET [ 'confirm_key' ] ) ) {
wp_die ( __ ( 'Missing confirm key.' ) );
2018-03-07 00:47:30 +01:00
}
2019-03-19 03:38:48 +01:00
$request_id = ( int ) $_GET [ 'request_id' ];
2019-03-19 03:48:49 +01:00
$key = sanitize_text_field ( wp_unslash ( $_GET [ 'confirm_key' ] ) );
$result = wp_validate_user_request_key ( $request_id , $key );
2019-03-19 03:38:48 +01:00
2018-03-07 00:47:30 +01:00
if ( is_wp_error ( $result ) ) {
wp_die ( $result );
}
2018-03-18 15:23:33 +01:00
2018-03-07 00:47:30 +01:00
/**
* Fires an action hook when the account action has been confirmed by the user .
2018-03-18 15:23:33 +01:00
*
2018-03-07 00:47:30 +01:00
* Using this you can assume the user has agreed to perform the action by
* clicking on the link in the confirmation email .
2018-03-18 15:23:33 +01:00
*
* After firing this action hook the page will redirect to wp - login a callback
2018-03-07 00:47:30 +01:00
* redirects or exits first .
2018-03-18 15:23:33 +01:00
*
2018-09-14 15:48:24 +02:00
* @ since 4.9 . 6
*
2018-04-27 12:12:22 +02:00
* @ param int $request_id Request ID .
2018-03-07 00:47:30 +01:00
*/
2018-04-27 12:12:22 +02:00
do_action ( 'user_request_action_confirmed' , $request_id );
2018-05-10 22:53:21 +02:00
$message = _wp_privacy_account_request_confirmed_message ( $request_id );
2018-03-07 00:47:30 +01:00
2018-04-27 12:12:22 +02:00
login_header ( __ ( 'User action confirmed.' ), $message );
2018-03-07 00:47:30 +01:00
login_footer ();
exit ;
2017-12-01 00:11:00 +01:00
case 'login' :
default :
$secure_cookie = '' ;
$customize_login = isset ( $_REQUEST [ 'customize-login' ] );
if ( $customize_login ) {
wp_enqueue_script ( 'customize-base' );
}
2013-10-25 00:58:23 +02:00
2018-09-14 15:48:24 +02:00
// If the user wants SSL but the session is not SSL, force a secure cookie.
2017-12-01 00:11:00 +01:00
if ( ! empty ( $_POST [ 'log' ] ) && ! force_ssl_admin () ) {
$user_name = sanitize_user ( $_POST [ 'log' ] );
$user = get_user_by ( 'login' , $user_name );
2016-02-23 00:15:27 +01:00
2017-12-01 00:11:00 +01:00
if ( ! $user && strpos ( $user_name , '@' ) ) {
$user = get_user_by ( 'email' , $user_name );
}
2016-02-23 00:15:27 +01:00
2017-12-01 00:11:00 +01:00
if ( $user ) {
if ( get_user_option ( 'use_ssl' , $user -> ID ) ) {
$secure_cookie = true ;
force_ssl_admin ( true );
}
2013-10-25 00:58:23 +02:00
}
}
2017-12-01 00:11:00 +01:00
if ( isset ( $_REQUEST [ 'redirect_to' ] ) ) {
$redirect_to = $_REQUEST [ 'redirect_to' ];
2018-09-14 15:48:24 +02:00
// Redirect to HTTPS if user wants SSL.
2017-12-01 00:11:00 +01:00
if ( $secure_cookie && false !== strpos ( $redirect_to , 'wp-admin' ) ) {
$redirect_to = preg_replace ( '|^http://|' , 'https://' , $redirect_to );
}
} else {
$redirect_to = admin_url ();
2014-03-30 01:41:15 +01:00
}
2013-10-25 00:58:23 +02:00
2017-12-01 00:11:00 +01:00
$reauth = empty ( $_REQUEST [ 'reauth' ] ) ? false : true ;
$user = wp_signon ( array (), $secure_cookie );
if ( empty ( $_COOKIE [ LOGGED_IN_COOKIE ] ) ) {
if ( headers_sent () ) {
$user = new WP_Error (
2018-08-17 03:51:36 +02:00
'test_cookie' ,
sprintf (
2018-08-30 14:14:24 +02:00
/* translators: 1: Browser cookie documentation URL, 2: Support forums URL */
2017-12-01 00:11:00 +01:00
__ ( '<strong>ERROR</strong>: Cookies are blocked due to unexpected output. For help, please see <a href="%1$s">this documentation</a> or try the <a href="%2$s">support forums</a>.' ),
2019-02-28 12:44:52 +01:00
__ ( 'https://wordpress.org/support/article/cookies/' ),
2018-08-17 03:51:36 +02:00
__ ( 'https://wordpress.org/support/' )
2017-12-01 00:11:00 +01:00
)
);
} elseif ( isset ( $_POST [ 'testcookie' ] ) && empty ( $_COOKIE [ TEST_COOKIE ] ) ) {
// If cookies are disabled we can't log in even with a valid user+pass
$user = new WP_Error (
2018-08-17 03:51:36 +02:00
'test_cookie' ,
sprintf (
2018-08-30 14:14:24 +02:00
/* translators: %s: Browser cookie documentation URL */
2017-12-01 00:11:00 +01:00
__ ( '<strong>ERROR</strong>: Cookies are blocked or not supported by your browser. You must <a href="%s">enable cookies</a> to use WordPress.' ),
2019-02-28 12:44:52 +01:00
__ ( 'https://wordpress.org/support/article/cookies/#enable-cookies-in-your-browser' )
2017-12-01 00:11:00 +01:00
)
);
}
}
2013-10-25 00:58:23 +02:00
2017-12-01 00:11:00 +01:00
$requested_redirect_to = isset ( $_REQUEST [ 'redirect_to' ] ) ? $_REQUEST [ 'redirect_to' ] : '' ;
/**
* Filters the login redirect URL .
*
* @ since 3.0 . 0
*
* @ param string $redirect_to The redirect destination URL .
* @ param string $requested_redirect_to The requested redirect destination URL passed as a parameter .
* @ param WP_User | WP_Error $user WP_User object if login was successful , WP_Error object otherwise .
*/
$redirect_to = apply_filters ( 'login_redirect' , $redirect_to , $requested_redirect_to , $user );
if ( ! is_wp_error ( $user ) && ! $reauth ) {
if ( $interim_login ) {
$message = '<p class="message">' . __ ( 'You have logged in successfully.' ) . '</p>' ;
$interim_login = 'success' ;
login_header ( '' , $message );
2018-08-17 03:51:36 +02:00
?>
2017-12-01 00:11:00 +01:00
</ div >
< ? php
/** This action is documented in wp-login.php */
do_action ( 'login_footer' );
2018-08-17 03:51:36 +02:00
?>
2017-12-01 00:11:00 +01:00
< ? php if ( $customize_login ) : ?>
2013-10-25 00:58:23 +02:00
< script type = " text/javascript " > setTimeout ( function (){ new wp . customize . Messenger ({ url : '<?php echo wp_customize_url(); ?>' , channel : 'login' }) . send ( 'login' ) }, 1000 ); </ script >
< ? php endif ; ?>
2017-12-01 00:11:00 +01:00
</ body ></ html >
2018-08-17 03:51:36 +02:00
< ? php
exit ;
2017-12-01 00:11:00 +01:00
}
2016-03-06 04:06:29 +01:00
2017-12-01 00:11:00 +01:00
if ( ( empty ( $redirect_to ) || $redirect_to == 'wp-admin/' || $redirect_to == admin_url () ) ) {
// If the user doesn't belong to a blog, send them to user admin. If the user can't edit posts, send them to their profile.
if ( is_multisite () && ! get_active_blog_for_user ( $user -> ID ) && ! is_super_admin ( $user -> ID ) ) {
$redirect_to = user_admin_url ();
} elseif ( is_multisite () && ! $user -> has_cap ( 'read' ) ) {
$redirect_to = get_dashboard_url ( $user -> ID );
} elseif ( ! $user -> has_cap ( 'edit_posts' ) ) {
$redirect_to = $user -> has_cap ( 'read' ) ? admin_url ( 'profile.php' ) : home_url ();
}
wp_redirect ( $redirect_to );
exit ();
}
wp_safe_redirect ( $redirect_to );
2016-03-06 04:06:29 +01:00
exit ();
2013-10-25 00:58:23 +02:00
}
2017-12-01 00:11:00 +01:00
$errors = $user ;
// Clear errors if loggedout is set.
if ( ! empty ( $_GET [ 'loggedout' ] ) || $reauth ) {
$errors = new WP_Error ();
}
2013-10-25 00:58:23 +02:00
2019-03-16 16:22:53 +01:00
if ( empty ( $_POST ) && $errors -> get_error_codes () === array ( 'empty_username' , 'empty_password' ) ) {
$errors = new WP_Error ( '' , '' );
}
2017-12-01 00:11:00 +01:00
if ( $interim_login ) {
2018-02-27 03:31:31 +01:00
if ( ! $errors -> has_errors () ) {
2017-12-01 00:11:00 +01:00
$errors -> add ( 'expired' , __ ( 'Your session has expired. Please log in to continue where you left off.' ), 'message' );
}
} else {
2018-09-14 15:48:24 +02:00
// Some parts of this script use the main login form to display a message.
2017-12-01 00:11:00 +01:00
if ( isset ( $_GET [ 'loggedout' ] ) && true == $_GET [ 'loggedout' ] ) {
$errors -> add ( 'loggedout' , __ ( 'You are now logged out.' ), 'message' );
} elseif ( isset ( $_GET [ 'registration' ] ) && 'disabled' == $_GET [ 'registration' ] ) {
$errors -> add ( 'registerdisabled' , __ ( 'User registration is currently not allowed.' ) );
} elseif ( isset ( $_GET [ 'checkemail' ] ) && 'confirm' == $_GET [ 'checkemail' ] ) {
$errors -> add ( 'confirm' , __ ( 'Check your email for the confirmation link.' ), 'message' );
} elseif ( isset ( $_GET [ 'checkemail' ] ) && 'newpass' == $_GET [ 'checkemail' ] ) {
$errors -> add ( 'newpass' , __ ( 'Check your email for your new password.' ), 'message' );
} elseif ( isset ( $_GET [ 'checkemail' ] ) && 'registered' == $_GET [ 'checkemail' ] ) {
$errors -> add ( 'registered' , __ ( 'Registration complete. Please check your email.' ), 'message' );
} elseif ( strpos ( $redirect_to , 'about.php?updated' ) ) {
$errors -> add ( 'updated' , __ ( '<strong>You have successfully updated WordPress!</strong> Please log back in to see what’s new.' ), 'message' );
Bootstrap/Load: Introduce a recovery mode for fixing fatal errors.
Using the new fatal handler introduced in [44962], an email is sent to the admin when a fatal error occurs. This email includes a secret link to enter recovery mode. When clicked, the link will be validated and on success a cookie will be placed on the client, enabling recovery mode for that user. This functionality is executed early before plugins and themes are loaded, in order to be unaffected by potential fatal errors these might be causing.
When in recovery mode, broken plugins and themes will be paused for that client, so that they are able to access the admin backend despite of these errors. They are notified about the broken extensions and the errors caused, and can then decide whether they would like to temporarily deactivate the extension or fix the problem and resume the extension.
A link in the admin bar allows the client to exit recovery mode.
Props timothyblynjacobs, afragen, flixos90, nerrad, miss_jwo, schlessera, spacedmonkey, swissspidy.
Fixes #46130, #44458.
Built from https://develop.svn.wordpress.org/trunk@44973
git-svn-id: http://core.svn.wordpress.org/trunk@44804 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2019-03-21 22:53:51 +01:00
} elseif ( WP_Recovery_Mode_Link_Service :: LOGIN_ACTION_ENTERED === $action ) {
$errors -> add ( 'enter_recovery_mode' , __ ( 'Recovery Mode Initialized. Please log in to continue.' ), 'message' );
2017-12-01 00:11:00 +01:00
}
}
2013-10-25 00:58:23 +02:00
2017-12-01 00:11:00 +01:00
/**
* Filters the login page errors .
*
* @ since 3.6 . 0
*
* @ param object $errors WP Error object .
* @ param string $redirect_to Redirect destination URL .
*/
$errors = apply_filters ( 'wp_login_errors' , $errors , $redirect_to );
2013-10-25 00:58:23 +02:00
2017-12-01 00:11:00 +01:00
// Clear any stale cookies.
if ( $reauth ) {
wp_clear_auth_cookie ();
}
2013-10-25 00:58:23 +02:00
2017-12-01 00:11:00 +01:00
login_header ( __ ( 'Log In' ), '' , $errors );
2013-10-25 00:58:23 +02:00
2017-12-01 00:11:00 +01:00
if ( isset ( $_POST [ 'log' ] ) ) {
$user_login = ( 'incorrect_password' == $errors -> get_error_code () || 'empty_password' == $errors -> get_error_code () ) ? esc_attr ( wp_unslash ( $_POST [ 'log' ] ) ) : '' ;
}
$rememberme = ! empty ( $_POST [ 'rememberme' ] );
2015-03-24 17:29:26 +01:00
2018-02-27 03:31:31 +01:00
if ( $errors -> has_errors () ) {
2017-12-01 00:11:00 +01:00
$aria_describedby_error = ' aria-describedby="login_error"' ;
} else {
$aria_describedby_error = '' ;
}
2018-08-17 03:51:36 +02:00
?>
2013-10-25 00:58:23 +02:00
2017-12-01 00:11:00 +01:00
< form name = " loginform " id = " loginform " action = " <?php echo esc_url( site_url( 'wp-login.php', 'login_post' ) ); ?> " method = " post " >
2013-10-25 00:58:23 +02:00
< p >
2016-08-31 20:51:28 +02:00
< label for = " user_login " >< ? php _e ( 'Username or Email Address' ); ?> <br />
2017-12-16 14:41:48 +01:00
< input type = " text " name = " log " id = " user_login " < ? php echo $aria_describedby_error ; ?> class="input" value="<?php echo esc_attr( $user_login ); ?>" size="20" autocapitalize="off" /></label>
2013-10-25 00:58:23 +02:00
</ p >
< p >
2016-08-31 20:51:28 +02:00
< label for = " user_pass " >< ? php _e ( 'Password' ); ?> <br />
2015-03-24 17:29:26 +01:00
< input type = " password " name = " pwd " id = " user_pass " < ? php echo $aria_describedby_error ; ?> class="input" value="" size="20" /></label>
2013-10-25 00:58:23 +02:00
</ p >
2018-08-17 03:51:36 +02:00
< ? php
/**
* Fires following the 'Password' field in the login form .
*
* @ since 2.1 . 0
*/
do_action ( 'login_form' );
?>
2016-08-28 20:06:30 +02:00
< p class = " forgetmenot " >< label for = " rememberme " >< input name = " rememberme " type = " checkbox " id = " rememberme " value = " forever " < ? php checked ( $rememberme ); ?> /> <?php esc_html_e( 'Remember Me' ); ?></label></p>
2013-10-25 00:58:23 +02:00
< p class = " submit " >
2017-12-01 00:11:00 +01:00
< input type = " submit " name = " wp-submit " id = " wp-submit " class = " button button-primary button-large " value = " <?php esc_attr_e( 'Log In' ); ?> " />
2018-08-17 03:51:36 +02:00
< ? php if ( $interim_login ) { ?>
2013-10-25 00:58:23 +02:00
< input type = " hidden " name = " interim-login " value = " 1 " />
2017-12-01 00:11:00 +01:00
< ? php } else { ?>
< input type = " hidden " name = " redirect_to " value = " <?php echo esc_attr( $redirect_to ); ?> " />
< ? php } ?>
2018-08-17 03:51:36 +02:00
< ? php if ( $customize_login ) : ?>
2013-10-25 00:58:23 +02:00
< input type = " hidden " name = " customize-login " value = " 1 " />
2017-12-01 00:11:00 +01:00
< ? php endif ; ?>
2013-10-25 00:58:23 +02:00
< input type = " hidden " name = " testcookie " value = " 1 " />
</ p >
2017-12-01 00:11:00 +01:00
</ form >
2013-10-25 00:58:23 +02:00
2018-08-17 03:51:36 +02:00
< ? php if ( ! $interim_login ) { ?>
2017-12-01 00:11:00 +01:00
< p id = " nav " >
2018-08-17 03:51:36 +02:00
< ? php
if ( ! isset ( $_GET [ 'checkemail' ] ) || ! in_array ( $_GET [ 'checkemail' ], array ( 'confirm' , 'newpass' ) ) ) :
if ( get_option ( 'users_can_register' ) ) :
$registration_url = sprintf ( '<a href="%s">%s</a>' , esc_url ( wp_registration_url () ), __ ( 'Register' ) );
2014-04-25 08:24:15 +02:00
2018-08-17 03:51:36 +02:00
/** This filter is documented in wp-includes/general-template.php */
echo apply_filters ( 'register' , $registration_url );
2017-08-22 16:23:47 +02:00
2018-08-17 03:51:36 +02:00
echo esc_html ( $login_link_separator );
endif ;
?>
2017-12-01 00:11:00 +01:00
< a href = " <?php echo esc_url( wp_lostpassword_url() ); ?> " >< ? php _e ( 'Lost your password?' ); ?> </a>
2018-08-17 03:51:36 +02:00
< ? php endif ; ?>
2017-12-01 00:11:00 +01:00
</ p >
< ? php } ?>
2013-10-25 00:58:23 +02:00
2017-12-01 00:11:00 +01:00
< script type = " text/javascript " >
function wp_attempt_focus (){
setTimeout ( function (){ try {
2018-08-17 03:51:36 +02:00
< ? php if ( $user_login ) { ?>
2017-12-01 00:11:00 +01:00
d = document . getElementById ( 'user_pass' );
d . value = '' ;
< ? php } else { ?>
d = document . getElementById ( 'user_login' );
2019-01-12 07:41:52 +01:00
< ? php if ( 'invalid_username' == $errors -> get_error_code () ) { ?>
2017-12-01 00:11:00 +01:00
if ( d . value != '' )
d . value = '' ;
2019-01-12 07:41:52 +01:00
< ? php
}
}
?>
2017-12-01 00:11:00 +01:00
d . focus ();
d . select ();
} catch ( e ){}
}, 200 );
2013-10-25 00:58:23 +02:00
}
2018-08-17 03:51:36 +02:00
< ? php
/**
* Filters whether to print the call to `wp_attempt_focus()` on the login screen .
*
* @ since 4.8 . 0
*
* @ param bool $print Whether to print the function call . Default true .
*/
if ( apply_filters ( 'enable_login_autofocus' , true ) && ! $error ) {
?>
2017-12-01 00:11:00 +01:00
wp_attempt_focus ();
2018-08-17 03:51:36 +02:00
< ? php } ?>
2017-12-01 00:11:00 +01:00
if ( typeof wpOnload == 'function' ) wpOnload ();
2018-08-17 03:51:36 +02:00
< ? php if ( $interim_login ) { ?>
2017-12-01 00:11:00 +01:00
( function (){
try {
var i , links = document . getElementsByTagName ( 'a' );
for ( i in links ) {
if ( links [ i ] . href )
links [ i ] . target = '_blank' ;
}
} catch ( e ){}
}());
< ? php } ?>
</ script >
2017-10-03 01:21:47 +02:00
2018-08-17 03:51:36 +02:00
< ? php
login_footer ();
2017-12-01 00:11:00 +01:00
break ;
2018-09-14 15:48:24 +02:00
} // End action switch.
