2013-10-25 00:58:23 +02:00
< ? php
/**
* WordPress User Page
*
* Handles authentication , registering , resetting passwords , forgot password ,
* and other user handling .
*
* @ package WordPress
*/
/** Make sure that the WordPress bootstrap has run before continuing. */
2020-02-06 07:33:11 +01:00
require __DIR__ . '/wp-load.php' ;
2013-10-25 00:58:23 +02:00
2018-09-14 15:48:24 +02:00
// Redirect to HTTPS login if forced to use SSL.
2013-10-25 00:58:23 +02:00
if ( force_ssl_admin () && ! is_ssl () ) {
Code Modernization: Replace usage of `strpos()` with `str_starts_with()`.
`str_starts_with()` was introduced in PHP 8.0 to perform a case-sensitive check indicating if the string to search in (haystack) begins with the given substring (needle).
WordPress core includes a polyfill for `str_starts_with()` on PHP < 8.0 as of WordPress 5.9.
This commit replaces `0 === strpos( ... )` with `str_starts_with()` in core files, making the code more readable and consistent, as well as improving performance.
While `strpos()` is slightly faster than the polyfill on PHP < 8.0, `str_starts_with()` is noticeably faster on PHP 8.0+, as it is optimized to avoid unnecessarily searching along the whole haystack if it does not find the needle.
Follow-up to [52039], [52040], [52326].
Props spacedmonkey, costdev, sabernhardt, mukesh27, desrosj, jorbin, TobiasBg, ayeshrajans, lgadzhev, SergeyBiryukov.
Fixes #58012.
Built from https://develop.svn.wordpress.org/trunk@55703
git-svn-id: http://core.svn.wordpress.org/trunk@55215 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2023-05-02 17:45:22 +02:00
if ( str_starts_with ( $_SERVER [ 'REQUEST_URI' ], 'http' ) ) {
2018-04-03 16:32:31 +02:00
wp_safe_redirect ( set_url_scheme ( $_SERVER [ 'REQUEST_URI' ], 'https' ) );
2020-05-26 11:37:10 +02:00
exit ;
2013-10-25 00:58:23 +02:00
} else {
2018-04-03 16:32:31 +02:00
wp_safe_redirect ( 'https://' . $_SERVER [ 'HTTP_HOST' ] . $_SERVER [ 'REQUEST_URI' ] );
2020-05-26 11:37:10 +02:00
exit ;
2013-10-25 00:58:23 +02:00
}
}
/**
2023-06-14 16:11:16 +02:00
* Outputs the login page header .
2013-10-25 00:58:23 +02:00
*
2018-09-14 15:48:24 +02:00
* @ since 2.1 . 0
*
2019-10-30 03:59:03 +01:00
* @ global string $error Login error message set by deprecated pluggable wp_login () function
* or plugins replacing it .
* @ global bool | string $interim_login Whether interim login modal is being displayed . String 'success'
* upon successful login .
* @ global string $action The action that brought the visitor to the login page .
*
2014-11-24 07:31:21 +01:00
* @ param string $title Optional . WordPress login Page title to display in the `<title>` element .
* Default 'Log In' .
2014-06-20 21:19:14 +02:00
* @ param string $message Optional . Message to display in header . Default empty .
2018-07-16 16:10:26 +02:00
* @ param WP_Error $wp_error Optional . The error to pass . Default is a WP_Error instance .
2013-10-25 00:58:23 +02:00
*/
2018-07-16 16:10:26 +02:00
function login_header ( $title = 'Log In' , $message = '' , $wp_error = null ) {
2013-11-13 04:23:10 +01:00
global $error , $interim_login , $action ;
2013-10-25 00:58:23 +02:00
2020-01-29 01:45:18 +01:00
// Don't index any of these forms.
Robots: Introduce Robots API.
This changeset introduces a filter-based Robots API, providing central control over the `robots` meta tag.
* Introduces `wp_robots()` function which should be called anywhere a `robots` meta tag should be included.
* Introduces `wp_robots` filter which allows adding or modifying directives for the `robots` meta tag. The `wp_robots()` function is entirely filter-based, i.e. if no filter is added to `wp_robots`, no directives will be present, and therefore the entire `robots` meta tag will be omitted.
* Introduces the following `wp_robots` filter functions which replace similar existing functions that were manually rendering a `robots` meta tag:
* `wp_robots_noindex()` replaces `noindex()`, which has been deprecated.
* `wp_robots_no_robots()` replaces `wp_no_robots()`, which has been deprecated.
* `wp_robots_sensitive_page()` replaces `wp_sensitive_page_meta()`, which has been deprecated. Its rendering of the `referrer` meta tag has been moved to another new function `wp_strict_cross_origin_referrer()`.
Migration to the new functions is straightforward. For example, a call to `add_action( 'wp_head', 'wp_no_robots' )` should be replaced with `add_filter( 'wp_robots', 'wp_robots_no_robots' )`.
Plugins and themes that render their own `robots` meta tags are encouraged to switch to rely on the `wp_robots` filter in order to use the central management layer now provided by WordPress core.
Props adamsilverstein, flixos90, timothyblynjacobs, westonruter.
See #51511.
Built from https://develop.svn.wordpress.org/trunk@49992
git-svn-id: http://core.svn.wordpress.org/trunk@49693 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2021-01-21 02:37:00 +01:00
add_filter ( 'wp_robots' , 'wp_robots_sensitive_page' );
add_action ( 'login_head' , 'wp_strict_cross_origin_referrer' );
2013-10-25 00:58:23 +02:00
2016-10-06 17:52:30 +02:00
add_action ( 'login_head' , 'wp_login_viewport_meta' );
2013-10-25 00:58:23 +02:00
2018-07-16 16:10:26 +02:00
if ( ! is_wp_error ( $wp_error ) ) {
2013-10-25 00:58:23 +02:00
$wp_error = new WP_Error ();
2017-12-01 00:11:00 +01:00
}
2013-10-25 00:58:23 +02:00
// Shake it!
2019-05-25 00:14:52 +02:00
$shake_error_codes = array ( 'empty_password' , 'empty_email' , 'invalid_email' , 'invalidcombo' , 'empty_username' , 'invalid_username' , 'incorrect_password' , 'retrieve_password_email_failure' );
2013-10-25 00:58:23 +02:00
/**
2016-05-23 18:44:27 +02:00
* Filters the error codes array for shaking the login form .
2013-10-25 00:58:23 +02:00
*
* @ since 3.0 . 0
*
2021-12-07 13:20:02 +01:00
* @ param string [] $shake_error_codes Error codes that shake the login form .
2013-10-25 00:58:23 +02:00
*/
$shake_error_codes = apply_filters ( 'shake_error_codes' , $shake_error_codes );
2019-08-07 02:04:56 +02:00
if ( $shake_error_codes && $wp_error -> has_errors () && in_array ( $wp_error -> get_error_code (), $shake_error_codes , true ) ) {
2020-02-10 02:52:04 +01:00
add_action ( 'login_footer' , 'wp_shake_js' , 12 );
2017-12-01 00:11:00 +01:00
}
2013-10-25 00:58:23 +02:00
2017-10-03 01:00:46 +02:00
$login_title = get_bloginfo ( 'name' , 'display' );
2019-09-03 02:41:05 +02:00
/* translators: Login screen title. 1: Login screen name, 2: Network or site name. */
2017-10-03 01:00:46 +02:00
$login_title = sprintf ( __ ( '%1$s ‹ %2$s — WordPress' ), $title , $login_title );
Administration: Improve user experience and clarify when in recovery mode.
This changeset introduces several changes around usability when recovery mode is active:
* Display a notice in the admin clarifying that the user is in recovery mode.
* Use a highlight color for the admin bar link to exit recovery mode.
* Exit recovery mode automatically when logging out.
* Include a recovery mode indicator in the title tag.
Props aandrewdixon, azaozz, dhanukanuwan, flixos90, henrywright, karmatosed, mapk, melchoyce, spacedmonkey, TimothyBlynJacobs, tinkerbelly.
See #46608.
Built from https://develop.svn.wordpress.org/trunk@45117
git-svn-id: http://core.svn.wordpress.org/trunk@44926 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2019-04-05 19:00:52 +02:00
if ( wp_is_recovery_mode () ) {
/* translators: %s: Login screen title. */
2019-04-12 21:05:51 +02:00
$login_title = sprintf ( __ ( 'Recovery Mode — %s' ), $login_title );
Administration: Improve user experience and clarify when in recovery mode.
This changeset introduces several changes around usability when recovery mode is active:
* Display a notice in the admin clarifying that the user is in recovery mode.
* Use a highlight color for the admin bar link to exit recovery mode.
* Exit recovery mode automatically when logging out.
* Include a recovery mode indicator in the title tag.
Props aandrewdixon, azaozz, dhanukanuwan, flixos90, henrywright, karmatosed, mapk, melchoyce, spacedmonkey, TimothyBlynJacobs, tinkerbelly.
See #46608.
Built from https://develop.svn.wordpress.org/trunk@45117
git-svn-id: http://core.svn.wordpress.org/trunk@44926 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2019-04-05 19:00:52 +02:00
}
2017-10-03 01:00:46 +02:00
/**
* Filters the title tag content for login page .
*
* @ since 4.9 . 0
*
* @ param string $login_title The page title , with extra context added .
* @ param string $title The original page title .
*/
$login_title = apply_filters ( 'login_title' , $login_title , $title );
2016-02-06 23:56:27 +01:00
2013-10-25 00:58:23 +02:00
?> <!DOCTYPE html>
2020-06-22 23:26:16 +02:00
< html < ? php language_attributes (); ?> >
2013-10-25 00:58:23 +02:00
< head >
2017-12-01 00:11:00 +01:00
< meta http - equiv = " Content-Type " content = " <?php bloginfo( 'html_type' ); ?>; charset=<?php bloginfo( 'charset' ); ?> " />
2017-10-03 01:00:46 +02:00
< title >< ? php echo $login_title ; ?> </title>
2013-10-25 00:58:23 +02:00
< ? php
2016-01-18 10:57:29 +01:00
wp_enqueue_style ( 'login' );
2013-10-25 00:58:23 +02:00
2014-07-17 11:12:16 +02:00
/*
* Remove all stored post data on logging out .
* This could be added by add_action ( 'login_head' ... ) like wp_shake_js (),
2018-09-14 15:48:24 +02:00
* but maybe better if it ' s not removable by plugins .
2014-07-17 11:12:16 +02:00
*/
2019-08-07 02:04:56 +02:00
if ( 'loggedout' === $wp_error -> get_error_code () ) {
2013-10-25 00:58:23 +02:00
?>
< script > if ( " sessionStorage " in window ){ try { for ( var key in sessionStorage ){ if ( key . indexOf ( " wp-autosave- " ) !=- 1 ){ sessionStorage . removeItem ( key )}}} catch ( e ){}}; </ script >
< ? php
}
/**
2023-06-14 16:11:16 +02:00
* Enqueues scripts and styles for the login page .
2013-10-25 00:58:23 +02:00
*
* @ since 3.1 . 0
*/
do_action ( 'login_enqueue_scripts' );
2016-01-18 10:57:29 +01:00
2013-10-25 00:58:23 +02:00
/**
* Fires in the login page header after scripts are enqueued .
*
* @ since 2.1 . 0
*/
do_action ( 'login_head' );
2019-03-14 22:10:50 +01:00
$login_header_url = __ ( 'https://wordpress.org/' );
2013-10-25 00:58:23 +02:00
/**
2016-05-23 18:44:27 +02:00
* Filters link URL of the header logo above login form .
2013-10-25 00:58:23 +02:00
*
* @ since 2.1 . 0
*
* @ param string $login_header_url Login header logo URL .
*/
$login_header_url = apply_filters ( 'login_headerurl' , $login_header_url );
2016-05-23 18:44:27 +02:00
2019-03-14 22:10:50 +01:00
$login_header_title = '' ;
2013-10-25 00:58:23 +02:00
/**
2016-05-23 18:44:27 +02:00
* Filters the title attribute of the header logo above login form .
2013-10-25 00:58:23 +02:00
*
* @ since 2.1 . 0
2019-11-09 14:05:02 +01:00
* @ deprecated 5.2 . 0 Use { @ see 'login_headertext' } instead .
2013-10-25 00:58:23 +02:00
*
* @ param string $login_header_title Login header logo title attribute .
*/
2019-03-14 22:10:50 +01:00
$login_header_title = apply_filters_deprecated (
'login_headertitle' ,
array ( $login_header_title ),
'5.2.0' ,
'login_headertext' ,
__ ( 'Usage of the title attribute on the login logo is not recommended for accessibility reasons. Use the link text instead.' )
);
2013-10-25 00:58:23 +02:00
2019-03-14 22:10:50 +01:00
$login_header_text = empty ( $login_header_title ) ? __ ( 'Powered by WordPress' ) : $login_header_title ;
/**
* Filters the link text of the header logo above the login form .
*
* @ since 5.2 . 0
*
* @ param string $login_header_text The login header logo link text .
Login: On the single site login screen, match the logo link text with the title.
Previously, the (W) logo on the single site login screen linked to wordpress.org, with an appropriate `title` attribute, but the link text was the blog name.
To fix this discrepency, the link text is now the same as the `title` attribute.
Props pento, obrienlabs, afercia, flixos90, lukecavanagh, and the infinite stack of bikesheds that WordPress is balanced upon.
Fixes #34625.
Built from https://develop.svn.wordpress.org/trunk@41843
git-svn-id: http://core.svn.wordpress.org/trunk@41677 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-10-12 06:57:46 +02:00
*/
2019-03-14 22:10:50 +01:00
$login_header_text = apply_filters ( 'login_headertext' , $login_header_text );
Login: On the single site login screen, match the logo link text with the title.
Previously, the (W) logo on the single site login screen linked to wordpress.org, with an appropriate `title` attribute, but the link text was the blog name.
To fix this discrepency, the link text is now the same as the `title` attribute.
Props pento, obrienlabs, afercia, flixos90, lukecavanagh, and the infinite stack of bikesheds that WordPress is balanced upon.
Fixes #34625.
Built from https://develop.svn.wordpress.org/trunk@41843
git-svn-id: http://core.svn.wordpress.org/trunk@41677 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-10-12 06:57:46 +02:00
2013-10-25 00:58:23 +02:00
$classes = array ( 'login-action-' . $action , 'wp-core-ui' );
2019-08-07 02:04:56 +02:00
2017-12-01 00:11:00 +01:00
if ( is_rtl () ) {
2013-10-25 00:58:23 +02:00
$classes [] = 'rtl' ;
2017-12-01 00:11:00 +01:00
}
2019-08-07 02:04:56 +02:00
2013-10-25 00:58:23 +02:00
if ( $interim_login ) {
$classes [] = 'interim-login' ;
2019-08-07 02:04:56 +02:00
2013-10-25 00:58:23 +02:00
?>
< style type = " text/css " > html { background - color : transparent ;} </ style >
< ? php
2017-12-01 00:11:00 +01:00
if ( 'success' === $interim_login ) {
2013-10-25 00:58:23 +02:00
$classes [] = 'interim-login-success' ;
2017-12-01 00:11:00 +01:00
}
2013-10-25 00:58:23 +02:00
}
2019-08-07 02:04:56 +02:00
2017-12-01 00:11:00 +01:00
$classes [] = ' locale-' . sanitize_html_class ( strtolower ( str_replace ( '_' , '-' , get_locale () ) ) );
2013-10-25 00:58:23 +02:00
/**
2016-05-23 18:44:27 +02:00
* Filters the login page body classes .
2013-10-25 00:58:23 +02:00
*
* @ since 3.5 . 0
*
2021-12-07 13:20:02 +01:00
* @ param string [] $classes An array of body classes .
* @ param string $action The action that brought the visitor to the login page .
2013-10-25 00:58:23 +02:00
*/
$classes = apply_filters ( 'login_body_class' , $classes , $action );
?>
</ head >
2019-09-19 21:22:58 +02:00
< body class = " login no-js <?php echo esc_attr( implode( ' ', $classes ) ); ?> " >
< script type = " text/javascript " >
document . body . className = document . body . className . replace ( 'no-js' , 'js' );
</ script >
2016-04-19 01:54:29 +02:00
< ? php
/**
* Fires in the login page header after the body tag is opened .
*
* @ since 4.6 . 0
*/
do_action ( 'login_header' );
2019-08-07 02:04:56 +02:00
2016-04-19 01:54:29 +02:00
?>
2013-10-25 00:58:23 +02:00
< div id = " login " >
2019-03-14 22:10:50 +01:00
< h1 >< a href = " <?php echo esc_url( $login_header_url ); ?> " >< ? php echo $login_header_text ; ?> </a></h1>
2013-10-25 00:58:23 +02:00
< ? php
/**
2016-05-23 18:44:27 +02:00
* Filters the message to display above the login form .
2013-10-25 00:58:23 +02:00
*
* @ since 2.1 . 0
*
* @ param string $message Login message text .
*/
$message = apply_filters ( 'login_message' , $message );
2019-08-07 02:04:56 +02:00
2017-12-01 00:11:00 +01:00
if ( ! empty ( $message ) ) {
2013-10-25 00:58:23 +02:00
echo $message . " \n " ;
2017-12-01 00:11:00 +01:00
}
2013-10-25 00:58:23 +02:00
2018-09-14 15:48:24 +02:00
// In case a plugin uses $error rather than the $wp_errors object.
2017-12-01 00:11:00 +01:00
if ( ! empty ( $error ) ) {
$wp_error -> add ( 'error' , $error );
unset ( $error );
2013-10-25 00:58:23 +02:00
}
2018-02-27 03:31:31 +01:00
if ( $wp_error -> has_errors () ) {
2017-12-01 00:11:00 +01:00
$errors = '' ;
2013-10-25 00:58:23 +02:00
$messages = '' ;
2019-08-07 02:04:56 +02:00
2013-10-25 00:58:23 +02:00
foreach ( $wp_error -> get_error_codes () as $code ) {
2014-06-30 16:39:17 +02:00
$severity = $wp_error -> get_error_data ( $code );
foreach ( $wp_error -> get_error_messages ( $code ) as $error_message ) {
2019-08-07 02:04:56 +02:00
if ( 'message' === $severity ) {
2014-06-30 16:39:17 +02:00
$messages .= ' ' . $error_message . " <br /> \n " ;
2017-12-01 00:11:00 +01:00
} else {
2014-06-30 16:39:17 +02:00
$errors .= ' ' . $error_message . " <br /> \n " ;
2017-12-01 00:11:00 +01:00
}
2013-10-25 00:58:23 +02:00
}
}
2019-08-07 02:04:56 +02:00
2013-10-25 00:58:23 +02:00
if ( ! empty ( $errors ) ) {
/**
2016-05-23 18:44:27 +02:00
* Filters the error messages displayed above the login form .
2013-10-25 00:58:23 +02:00
*
* @ since 2.1 . 0
*
* @ param string $errors Login error message .
*/
echo '<div id="login_error">' . apply_filters ( 'login_errors' , $errors ) . " </div> \n " ;
}
2019-08-07 02:04:56 +02:00
2013-10-25 00:58:23 +02:00
if ( ! empty ( $messages ) ) {
/**
2016-05-23 18:44:27 +02:00
* Filters instructional messages displayed above the login form .
2013-10-25 00:58:23 +02:00
*
* @ since 2.5 . 0
*
* @ param string $messages Login messages .
*/
2022-07-16 01:40:10 +02:00
echo '<p class="message" id="login-message">' . apply_filters ( 'login_messages' , $messages ) . " </p> \n " ;
2013-10-25 00:58:23 +02:00
}
}
2020-01-29 01:45:18 +01:00
} // End of login_header().
2013-10-25 00:58:23 +02:00
/**
* Outputs the footer for the login page .
*
2018-09-14 15:48:24 +02:00
* @ since 3.1 . 0
*
2019-10-30 03:59:03 +01:00
* @ global bool | string $interim_login Whether interim login modal is being displayed . String 'success'
* upon successful login .
*
2018-09-14 15:48:24 +02:00
* @ param string $input_id Which input to auto - focus .
2013-10-25 00:58:23 +02:00
*/
2017-12-01 00:11:00 +01:00
function login_footer ( $input_id = '' ) {
2013-10-25 00:58:23 +02:00
global $interim_login ;
// Don't allow interim logins to navigate away from the page.
2019-08-07 02:04:56 +02:00
if ( ! $interim_login ) {
2018-08-17 03:51:36 +02:00
?>
2021-02-01 01:17:59 +01:00
< p id = " backtoblog " >
< ? php
$html_link = sprintf (
'<a href="%s">%s</a>' ,
esc_url ( home_url ( '/' ) ),
sprintf (
2021-04-04 20:30:05 +02:00
/* translators: %s: Site title. */
2021-02-01 01:17:59 +01:00
_x ( '← Go to %s' , 'site' ),
get_bloginfo ( 'title' , 'display' )
)
);
/**
2023-06-14 16:11:16 +02:00
* Filters the " Go to site " link displayed in the login page footer .
2021-02-01 01:17:59 +01:00
*
* @ since 5.7 . 0
*
* @ param string $link HTML link to the home URL of the current site .
*/
echo apply_filters ( 'login_site_html_link' , $html_link );
?>
</ p >
2019-08-07 02:04:56 +02:00
< ? php
2013-10-25 00:58:23 +02:00
2019-08-07 02:04:56 +02:00
the_privacy_policy_link ( '<div class="privacy-policy-page-link">' , '</div>' );
}
2013-10-25 00:58:23 +02:00
2019-08-07 02:04:56 +02:00
?>
2020-01-29 01:45:18 +01:00
</ div >< ? php // End of <div id="login">. ?>
2013-10-25 00:58:23 +02:00
2021-11-08 23:37:59 +01:00
< ? php
2021-12-21 19:52:03 +01:00
if (
! $interim_login &&
/**
2023-07-07 02:36:22 +02:00
* Filters whether to display the Language selector on the login screen .
2021-12-21 19:52:03 +01:00
*
* @ since 5.9 . 0
*
2023-07-07 02:36:22 +02:00
* @ param bool $display Whether to display the Language selector on the login screen .
2021-12-21 19:52:03 +01:00
*/
2022-01-03 23:14:00 +01:00
apply_filters ( 'login_display_language_dropdown' , true )
2021-12-21 19:52:03 +01:00
) {
$languages = get_available_languages ();
if ( ! empty ( $languages ) ) {
?>
< div class = " language-switcher " >
< form id = " language-switcher " action = " " method = " get " >
2021-12-21 20:00:00 +01:00
2021-12-21 19:52:03 +01:00
< label for = " language-switcher-locales " >
< span class = " dashicons dashicons-translation " aria - hidden = " true " ></ span >
I18N: Mark screen reader strings as such with translator comments.
This aims to provide better context for translators and make it easier to determine that some strings contain hidden accessibility text and are not displayed in the UI.
Props kebbet, mercime, pavelevap, ocean90, swissspidy, Chouby, jipmoors, afercia, desrosj, costdev, audrasjb, SergeyBiryukov.
Fixes #29748.
Built from https://develop.svn.wordpress.org/trunk@55276
git-svn-id: http://core.svn.wordpress.org/trunk@54809 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2023-02-07 18:10:21 +01:00
< span class = " screen-reader-text " >
< ? php
/* translators: Hidden accessibility text. */
_e ( 'Language' );
?>
</ span >
2021-12-21 19:52:03 +01:00
</ label >
2021-12-21 20:00:00 +01:00
2021-12-21 19:52:03 +01:00
< ? php
$args = array (
'id' => 'language-switcher-locales' ,
'name' => 'wp_lang' ,
'selected' => determine_locale (),
'show_available_translations' => false ,
'explicit_option_en_us' => true ,
'languages' => $languages ,
);
2021-12-21 20:00:00 +01:00
2021-12-21 19:52:03 +01:00
/**
* Filters default arguments for the Languages select input on the login screen .
*
2022-08-04 16:52:11 +02:00
* The arguments get passed to the wp_dropdown_languages () function .
*
2021-12-21 19:52:03 +01:00
* @ since 5.9 . 0
*
* @ param array $args Arguments for the Languages select input on the login screen .
*/
2022-01-04 09:30:04 +01:00
wp_dropdown_languages ( apply_filters ( 'login_language_dropdown_args' , $args ) );
2021-12-21 19:52:03 +01:00
?>
2021-12-21 20:00:00 +01:00
2021-12-21 19:52:03 +01:00
< ? php if ( $interim_login ) { ?>
< input type = " hidden " name = " interim-login " value = " 1 " />
< ? php } ?>
2021-12-21 20:00:00 +01:00
2021-12-21 19:52:03 +01:00
< ? php if ( isset ( $_GET [ 'redirect_to' ] ) && '' !== $_GET [ 'redirect_to' ] ) { ?>
2022-06-01 20:14:10 +02:00
< input type = " hidden " name = " redirect_to " value = " <?php echo sanitize_url( $_GET['redirect_to'] ); ?> " />
2021-12-21 19:52:03 +01:00
< ? php } ?>
2021-12-21 20:00:00 +01:00
2021-12-21 19:52:03 +01:00
< ? php if ( isset ( $_GET [ 'action' ] ) && '' !== $_GET [ 'action' ] ) { ?>
< input type = " hidden " name = " action " value = " <?php echo esc_attr( $_GET['action'] ); ?> " />
< ? php } ?>
2021-12-21 20:00:00 +01:00
2021-12-25 12:36:59 +01:00
< input type = " submit " class = " button " value = " <?php esc_attr_e( 'Change' ); ?> " >
2021-12-21 20:00:00 +01:00
2021-12-21 19:52:03 +01:00
</ form >
</ div >
< ? php } ?>
< ? php } ?>
2013-10-25 00:58:23 +02:00
< ? php
2019-08-07 02:04:56 +02:00
if ( ! empty ( $input_id ) ) {
?>
< script type = " text/javascript " >
try { document . getElementById ( '<?php echo $input_id; ?>' ) . focus ();} catch ( e ){}
2021-03-18 15:13:08 +01:00
if ( typeof wpOnload === 'function' ) wpOnload ();
2019-08-07 02:04:56 +02:00
</ script >
< ? php
}
2013-10-25 00:58:23 +02:00
/**
* Fires in the login page footer .
*
* @ since 3.1 . 0
*/
2017-12-01 00:11:00 +01:00
do_action ( 'login_footer' );
2019-08-07 02:04:56 +02:00
2017-12-01 00:11:00 +01:00
?>
2013-10-25 00:58:23 +02:00
< div class = " clear " ></ div >
</ body >
</ html >
< ? php
}
2015-05-31 05:18:25 +02:00
/**
2020-12-06 03:21:07 +01:00
* Outputs the JavaScript to handle the form shaking on the login page .
2018-09-14 15:48:24 +02:00
*
2015-05-31 05:18:25 +02:00
* @ since 3.0 . 0
*/
2013-10-25 00:58:23 +02:00
function wp_shake_js () {
2018-08-17 03:51:36 +02:00
?>
2019-08-07 02:04:56 +02:00
< script type = " text/javascript " >
2020-02-10 02:52:04 +01:00
document . querySelector ( 'form' ) . classList . add ( 'shake' );
2019-08-07 02:04:56 +02:00
</ script >
2018-08-17 03:51:36 +02:00
< ? php
2013-10-25 00:58:23 +02:00
}
2015-05-31 05:18:25 +02:00
/**
2020-09-30 23:54:07 +02:00
* Outputs the viewport meta tag for the login page .
2018-09-14 15:48:24 +02:00
*
2015-05-31 05:18:25 +02:00
* @ since 3.7 . 0
*/
2013-10-25 00:58:23 +02:00
function wp_login_viewport_meta () {
?>
< meta name = " viewport " content = " width=device-width " />
< ? php
}
2022-04-29 16:36:10 +02:00
/*
2022-11-16 14:51:13 +01:00
* Main part .
*
* Check the request and redirect or display a form based on the current action .
2022-04-29 16:36:10 +02:00
*/
2017-12-01 00:11:00 +01:00
$action = isset ( $_REQUEST [ 'action' ] ) ? $_REQUEST [ 'action' ] : 'login' ;
2013-10-25 00:58:23 +02:00
$errors = new WP_Error ();
2017-12-01 00:11:00 +01:00
if ( isset ( $_GET [ 'key' ] ) ) {
2013-10-25 00:58:23 +02:00
$action = 'resetpass' ;
2017-12-01 00:11:00 +01:00
}
2013-10-25 00:58:23 +02:00
Login and Registration: Hide the login form on the "check your email" step of new user registration or password reset.
This aims to reduce some confusion and make it clearer that the email should be checked before attempting to log in right away.
Props rianrietveld, pratik028, bdbch, johnbillion, hankthetank, yashrs, williampatton, audrasjb, bmartinent, florianatwhodunit, henry.wright, birgire, SergeyBiryukov.
Fixes #40605, #41514.
Built from https://develop.svn.wordpress.org/trunk@48304
git-svn-id: http://core.svn.wordpress.org/trunk@48073 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2020-07-04 23:58:03 +02:00
if ( isset ( $_GET [ 'checkemail' ] ) ) {
$action = 'checkemail' ;
}
2019-08-07 02:04:56 +02:00
$default_actions = array (
'confirm_admin_email' ,
'postpass' ,
'logout' ,
'lostpassword' ,
'retrievepassword' ,
'resetpass' ,
'rp' ,
'register' ,
Login and Registration: Hide the login form on the "check your email" step of new user registration or password reset.
This aims to reduce some confusion and make it clearer that the email should be checked before attempting to log in right away.
Props rianrietveld, pratik028, bdbch, johnbillion, hankthetank, yashrs, williampatton, audrasjb, bmartinent, florianatwhodunit, henry.wright, birgire, SergeyBiryukov.
Fixes #40605, #41514.
Built from https://develop.svn.wordpress.org/trunk@48304
git-svn-id: http://core.svn.wordpress.org/trunk@48073 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2020-07-04 23:58:03 +02:00
'checkemail' ,
2019-08-07 02:04:56 +02:00
'confirmaction' ,
2020-07-05 00:03:02 +02:00
'login' ,
2019-08-07 02:04:56 +02:00
WP_Recovery_Mode_Link_Service :: LOGIN_ACTION_ENTERED ,
);
2018-09-14 15:48:24 +02:00
// Validate action so as to default to the login screen.
2019-08-07 02:04:56 +02:00
if ( ! in_array ( $action , $default_actions , true ) && false === has_filter ( 'login_form_' . $action ) ) {
2013-10-25 00:58:23 +02:00
$action = 'login' ;
2017-12-01 00:11:00 +01:00
}
2013-10-25 00:58:23 +02:00
nocache_headers ();
2017-12-01 00:11:00 +01:00
header ( 'Content-Type: ' . get_bloginfo ( 'html_type' ) . '; charset=' . get_bloginfo ( 'charset' ) );
2013-10-25 00:58:23 +02:00
2020-01-29 01:45:18 +01:00
if ( defined ( 'RELOCATE' ) && RELOCATE ) { // Move flag is set.
2019-08-07 02:04:56 +02:00
if ( isset ( $_SERVER [ 'PATH_INFO' ] ) && ( $_SERVER [ 'PATH_INFO' ] !== $_SERVER [ 'PHP_SELF' ] ) ) {
2013-10-25 00:58:23 +02:00
$_SERVER [ 'PHP_SELF' ] = str_replace ( $_SERVER [ 'PATH_INFO' ], '' , $_SERVER [ 'PHP_SELF' ] );
2017-12-01 00:11:00 +01:00
}
2013-10-25 00:58:23 +02:00
2017-12-01 00:11:00 +01:00
$url = dirname ( set_url_scheme ( 'http://' . $_SERVER [ 'HTTP_HOST' ] . $_SERVER [ 'PHP_SELF' ] ) );
2019-08-07 02:04:56 +02:00
2020-02-09 17:55:09 +01:00
if ( get_option ( 'siteurl' ) !== $url ) {
2013-10-25 00:58:23 +02:00
update_option ( 'siteurl' , $url );
2017-12-01 00:11:00 +01:00
}
2013-10-25 00:58:23 +02:00
}
2020-01-29 01:45:18 +01:00
// Set a cookie now to see if they are supported by the browser.
2015-10-08 05:05:25 +02:00
$secure = ( 'https' === parse_url ( wp_login_url (), PHP_URL_SCHEME ) );
2014-06-29 15:25:16 +02:00
setcookie ( TEST_COOKIE , 'WP Cookie check' , 0 , COOKIEPATH , COOKIE_DOMAIN , $secure );
2019-08-07 02:04:56 +02:00
2020-01-09 01:55:05 +01:00
if ( SITECOOKIEPATH !== COOKIEPATH ) {
2014-06-29 15:25:16 +02:00
setcookie ( TEST_COOKIE , 'WP Cookie check' , 0 , SITECOOKIEPATH , COOKIE_DOMAIN , $secure );
2017-12-01 00:11:00 +01:00
}
2013-10-25 00:58:23 +02:00
2021-11-08 23:37:59 +01:00
if ( isset ( $_GET [ 'wp_lang' ] ) ) {
setcookie ( 'wp_lang' , sanitize_text_field ( $_GET [ 'wp_lang' ] ), 0 , COOKIEPATH , COOKIE_DOMAIN , $secure );
}
2013-10-25 00:58:23 +02:00
/**
* Fires when the login form is initialized .
2013-10-25 04:29:52 +02:00
*
2013-10-25 00:58:23 +02:00
* @ since 3.2 . 0
*/
do_action ( 'login_init' );
2017-10-03 01:21:47 +02:00
2013-10-25 00:58:23 +02:00
/**
* Fires before a specified login form action .
*
2014-11-30 12:45:23 +01:00
* The dynamic portion of the hook name , `$action` , refers to the action
2021-03-07 13:32:09 +01:00
* that brought the visitor to the login form .
*
* Possible hook names include :
*
2021-10-30 01:13:05 +02:00
* - `login_form_checkemail`
* - `login_form_confirm_admin_email`
* - `login_form_confirmaction`
* - `login_form_entered_recovery_mode`
* - `login_form_login`
* - `login_form_logout`
* - `login_form_lostpassword`
* - `login_form_postpass`
* - `login_form_register`
* - `login_form_resetpass`
* - `login_form_retrievepassword`
* - `login_form_rp`
2013-10-25 04:29:52 +02:00
*
2013-10-25 00:58:23 +02:00
* @ since 2.8 . 0
*/
2016-08-22 20:25:31 +02:00
do_action ( " login_form_ { $action } " );
2013-10-25 00:58:23 +02:00
2019-08-07 02:04:56 +02:00
$http_post = ( 'POST' === $_SERVER [ 'REQUEST_METHOD' ] );
2017-12-01 00:11:00 +01:00
$interim_login = isset ( $_REQUEST [ 'interim-login' ] );
2013-10-25 00:58:23 +02:00
2017-08-22 16:23:47 +02:00
/**
* Filters the separator used between login form navigation links .
*
* @ since 4.9 . 0
*
* @ param string $login_link_separator The separator used between login form navigation links .
*/
$login_link_separator = apply_filters ( 'login_link_separator' , ' | ' );
2017-12-01 00:11:00 +01:00
switch ( $action ) {
2015-10-07 16:30:25 +02:00
2019-08-07 02:04:56 +02:00
case 'confirm_admin_email' :
2020-01-29 01:45:18 +01:00
/*
* Note that `is_user_logged_in()` will return false immediately after logging in
* as the current user is not set , see wp - includes / pluggable . php .
* However this action runs on a redirect after logging in .
*/
2019-08-07 02:04:56 +02:00
if ( ! is_user_logged_in () ) {
wp_safe_redirect ( wp_login_url () );
exit ;
}
if ( ! empty ( $_REQUEST [ 'redirect_to' ] ) ) {
$redirect_to = $_REQUEST [ 'redirect_to' ];
} else {
$redirect_to = admin_url ();
}
if ( current_user_can ( 'manage_options' ) ) {
$admin_email = get_option ( 'admin_email' );
} else {
wp_safe_redirect ( $redirect_to );
exit ;
}
2019-12-09 14:26:02 +01:00
/**
* Filters the interval for dismissing the admin email confirmation screen .
*
* If `0` ( zero ) is returned , the " Remind me later " link will not be displayed .
*
* @ since 5.3 . 1
*
* @ param int $interval Interval time ( in seconds ) . Default is 3 days .
*/
$remind_interval = ( int ) apply_filters ( 'admin_email_remind_interval' , 3 * DAY_IN_SECONDS );
2019-08-07 02:04:56 +02:00
if ( ! empty ( $_GET [ 'remind_me_later' ] ) ) {
if ( ! wp_verify_nonce ( $_GET [ 'remind_me_later' ], 'remind_me_later_nonce' ) ) {
wp_safe_redirect ( wp_login_url () );
exit ;
}
2019-12-09 14:26:02 +01:00
if ( $remind_interval > 0 ) {
update_option ( 'admin_email_lifespan' , time () + $remind_interval );
}
2019-08-07 02:04:56 +02:00
2020-07-07 05:59:02 +02:00
$redirect_to = add_query_arg ( 'admin_email_remind_later' , 1 , $redirect_to );
2019-08-07 02:04:56 +02:00
wp_safe_redirect ( $redirect_to );
exit ;
}
if ( ! empty ( $_POST [ 'correct-admin-email' ] ) ) {
if ( ! check_admin_referer ( 'confirm_admin_email' , 'confirm_admin_email_nonce' ) ) {
wp_safe_redirect ( wp_login_url () );
exit ;
}
/**
* Filters the interval for redirecting the user to the admin email confirmation screen .
2019-12-09 14:10:01 +01:00
*
2019-09-30 20:53:00 +02:00
* If `0` ( zero ) is returned , the user will not be redirected .
2019-08-07 02:04:56 +02:00
*
* @ since 5.3 . 0
*
2019-12-09 14:10:01 +01:00
* @ param int $interval Interval time ( in seconds ) . Default is 6 months .
2019-08-07 02:04:56 +02:00
*/
2019-08-13 19:40:55 +02:00
$admin_email_check_interval = ( int ) apply_filters ( 'admin_email_check_interval' , 6 * MONTH_IN_SECONDS );
2019-08-07 02:04:56 +02:00
if ( $admin_email_check_interval > 0 ) {
update_option ( 'admin_email_lifespan' , time () + $admin_email_check_interval );
}
wp_safe_redirect ( $redirect_to );
exit ;
}
2019-09-20 20:51:56 +02:00
login_header ( __ ( 'Confirm your administration email' ), '' , $errors );
2019-08-07 02:04:56 +02:00
/**
2019-12-09 14:10:01 +01:00
* Fires before the admin email confirm form .
*
* @ since 5.3 . 0
*
* @ param WP_Error $errors A `WP_Error` object containing any errors generated by using invalid
* credentials . Note that the error object may not contain any errors .
*/
2019-08-07 02:04:56 +02:00
do_action ( 'admin_email_confirm' , $errors );
?>
2019-08-13 19:40:55 +02:00
< form class = " admin-email-confirm-form " name = " admin-email-confirm-form " action = " <?php echo esc_url( site_url( 'wp-login.php?action=confirm_admin_email', 'login_post' ) ); ?> " method = " post " >
2019-08-07 02:04:56 +02:00
< ? php
/**
2019-12-09 14:10:01 +01:00
* Fires inside the admin - email - confirm - form form tags , before the hidden fields .
*
* @ since 5.3 . 0
*/
2019-08-07 02:04:56 +02:00
do_action ( 'admin_email_confirm_form' );
wp_nonce_field ( 'confirm_admin_email' , 'confirm_admin_email_nonce' );
?>
< input type = " hidden " name = " redirect_to " value = " <?php echo esc_attr( $redirect_to ); ?> " />
< h1 class = " admin-email__heading " >
< ? php _e ( 'Administration email verification' ); ?>
</ h1 >
< p class = " admin-email__details " >
< ? php _e ( 'Please verify that the <strong>administration email</strong> for this website is still correct.' ); ?>
< ? php
/* translators: URL to the WordPress help section about admin email. */
2023-02-23 11:38:21 +01:00
$admin_email_help_url = __ ( 'https://wordpress.org/documentation/article/settings-general-screen/#email-address' );
2019-08-07 02:04:56 +02:00
I18N: Mark screen reader strings as such with translator comments.
This aims to provide better context for translators and make it easier to determine that some strings contain hidden accessibility text and are not displayed in the UI.
Props kebbet, mercime, pavelevap, ocean90, swissspidy, Chouby, jipmoors, afercia, desrosj, costdev, audrasjb, SergeyBiryukov.
Fixes #29748.
Built from https://develop.svn.wordpress.org/trunk@55276
git-svn-id: http://core.svn.wordpress.org/trunk@54809 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2023-02-07 18:10:21 +01:00
$accessibility_text = sprintf (
'<span class="screen-reader-text"> %s</span>' ,
/* translators: Hidden accessibility text. */
__ ( '(opens in a new tab)' )
);
2019-09-20 20:51:56 +02:00
2019-08-07 02:04:56 +02:00
printf (
2020-10-20 01:39:04 +02:00
'<a href="%s" rel="noopener" target="_blank">%s%s</a>' ,
2019-08-07 02:04:56 +02:00
esc_url ( $admin_email_help_url ),
2019-09-20 20:51:56 +02:00
__ ( 'Why is this important?' ),
$accessibility_text
2019-08-07 02:04:56 +02:00
);
?>
</ p >
< p class = " admin-email__details " >
< ? php
printf (
2019-09-03 02:41:05 +02:00
/* translators: %s: Admin email address. */
2019-09-21 17:54:57 +02:00
__ ( 'Current administration email: %s' ),
'<strong>' . esc_html ( $admin_email ) . '</strong>'
2019-08-07 02:04:56 +02:00
);
?>
</ p >
< p class = " admin-email__details " >
< ? php _e ( 'This email may be different from your personal email address.' ); ?>
</ p >
< div class = " admin-email__actions " >
< div class = " admin-email__actions-primary " >
< ? php
$change_link = admin_url ( 'options-general.php' );
$change_link = add_query_arg ( 'highlight' , 'confirm_admin_email' , $change_link );
?>
< a class = " button button-large " href = " <?php echo esc_url( $change_link ); ?> " >< ? php _e ( 'Update' ); ?> </a>
< input type = " submit " name = " correct-admin-email " id = " correct-admin-email " class = " button button-primary button-large " value = " <?php esc_attr_e( 'The email is correct' ); ?> " />
</ div >
2019-12-09 14:26:02 +01:00
< ? php if ( $remind_interval > 0 ) : ?>
< div class = " admin-email__actions-secondary " >
< ? php
$remind_me_link = wp_login_url ( $redirect_to );
$remind_me_link = add_query_arg (
array (
'action' => 'confirm_admin_email' ,
'remind_me_later' => wp_create_nonce ( 'remind_me_later_nonce' ),
),
$remind_me_link
);
?>
< a href = " <?php echo esc_url( $remind_me_link ); ?> " >< ? php _e ( 'Remind me later' ); ?> </a>
</ div >
< ? php endif ; ?>
2019-08-07 02:04:56 +02:00
</ div >
</ form >
< ? php
login_footer ();
break ;
2017-12-01 00:11:00 +01:00
case 'postpass' :
if ( ! array_key_exists ( 'post_password' , $_POST ) ) {
wp_safe_redirect ( wp_get_referer () );
2019-08-07 02:04:56 +02:00
exit ;
2017-12-01 00:11:00 +01:00
}
2013-10-25 00:58:23 +02:00
2017-12-01 00:11:00 +01:00
require_once ABSPATH . WPINC . '/class-phpass.php' ;
$hasher = new PasswordHash ( 8 , true );
2013-10-25 00:58:23 +02:00
2017-12-01 00:11:00 +01:00
/**
* Filters the life span of the post password cookie .
*
* By default , the cookie expires 10 days from creation . To turn this
* into a session cookie , return 0.
*
* @ since 3.7 . 0
*
* @ param int $expires The expiry time , as passed to setcookie () .
*/
$expire = apply_filters ( 'post_password_expires' , time () + 10 * DAY_IN_SECONDS );
$referer = wp_get_referer ();
2019-08-07 02:04:56 +02:00
2017-12-01 00:11:00 +01:00
if ( $referer ) {
$secure = ( 'https' === parse_url ( $referer , PHP_URL_SCHEME ) );
} else {
$secure = false ;
}
2019-08-07 02:04:56 +02:00
2017-12-01 00:11:00 +01:00
setcookie ( 'wp-postpass_' . COOKIEHASH , $hasher -> HashPassword ( wp_unslash ( $_POST [ 'post_password' ] ) ), $expire , COOKIEPATH , COOKIE_DOMAIN , $secure );
2017-10-03 01:21:47 +02:00
2017-12-01 00:11:00 +01:00
wp_safe_redirect ( wp_get_referer () );
2020-05-26 11:37:10 +02:00
exit ;
2015-02-11 20:19:26 +01:00
2017-12-01 00:11:00 +01:00
case 'logout' :
check_admin_referer ( 'log-out' );
2015-02-11 20:19:26 +01:00
2017-12-01 00:11:00 +01:00
$user = wp_get_current_user ();
2013-10-25 00:58:23 +02:00
2017-12-01 00:11:00 +01:00
wp_logout ();
2015-02-11 20:19:26 +01:00
2017-12-01 00:11:00 +01:00
if ( ! empty ( $_REQUEST [ 'redirect_to' ] ) ) {
2019-07-01 10:27:58 +02:00
$redirect_to = $_REQUEST [ 'redirect_to' ];
$requested_redirect_to = $redirect_to ;
2017-12-01 00:11:00 +01:00
} else {
2019-08-07 02:04:56 +02:00
$redirect_to = add_query_arg (
2019-07-27 16:31:55 +02:00
array (
'loggedout' => 'true' ,
'wp_lang' => get_user_locale ( $user ),
),
wp_login_url ()
);
2019-08-07 02:04:56 +02:00
2017-12-01 00:11:00 +01:00
$requested_redirect_to = '' ;
}
2017-10-03 01:21:47 +02:00
2017-12-01 00:11:00 +01:00
/**
* Filters the log out redirect URL .
*
* @ since 4.2 . 0
*
* @ param string $redirect_to The redirect destination URL .
* @ param string $requested_redirect_to The requested redirect destination URL passed as a parameter .
* @ param WP_User $user The WP_User object for the user that ' s logging out .
*/
$redirect_to = apply_filters ( 'logout_redirect' , $redirect_to , $requested_redirect_to , $user );
2019-08-07 02:04:56 +02:00
2017-12-01 00:11:00 +01:00
wp_safe_redirect ( $redirect_to );
2020-05-26 11:37:10 +02:00
exit ;
2013-10-25 00:58:23 +02:00
2017-12-01 00:11:00 +01:00
case 'lostpassword' :
case 'retrievepassword' :
if ( $http_post ) {
$errors = retrieve_password ();
2019-08-07 02:04:56 +02:00
2017-12-01 00:11:00 +01:00
if ( ! is_wp_error ( $errors ) ) {
$redirect_to = ! empty ( $_REQUEST [ 'redirect_to' ] ) ? $_REQUEST [ 'redirect_to' ] : 'wp-login.php?checkemail=confirm' ;
wp_safe_redirect ( $redirect_to );
2020-05-26 11:37:10 +02:00
exit ;
2017-12-01 00:11:00 +01:00
}
2013-10-25 00:58:23 +02:00
}
2017-12-01 00:11:00 +01:00
if ( isset ( $_GET [ 'error' ] ) ) {
2019-08-07 02:04:56 +02:00
if ( 'invalidkey' === $_GET [ 'error' ] ) {
2022-06-02 17:05:13 +02:00
$errors -> add ( 'invalidkey' , __ ( '<strong>Error:</strong> Your password reset link appears to be invalid. Please request a new link below.' ) );
2019-08-07 02:04:56 +02:00
} elseif ( 'expiredkey' === $_GET [ 'error' ] ) {
2022-06-02 17:05:13 +02:00
$errors -> add ( 'expiredkey' , __ ( '<strong>Error:</strong> Your password reset link has expired. Please request a new link below.' ) );
2017-12-01 00:11:00 +01:00
}
2015-07-01 08:33:26 +02:00
}
2013-10-25 00:58:23 +02:00
2017-12-01 00:11:00 +01:00
$lostpassword_redirect = ! empty ( $_REQUEST [ 'redirect_to' ] ) ? $_REQUEST [ 'redirect_to' ] : '' ;
/**
* Filters the URL redirected to after submitting the lostpassword / retrievepassword form .
*
* @ since 3.0 . 0
*
* @ param string $lostpassword_redirect The redirect destination URL .
*/
$redirect_to = apply_filters ( 'lostpassword_redirect' , $lostpassword_redirect );
2013-10-25 00:58:23 +02:00
2017-12-01 00:11:00 +01:00
/**
* Fires before the lost password form .
*
* @ since 1.5 . 1
2019-01-04 22:52:50 +01:00
* @ since 5.1 . 0 Added the `$errors` parameter .
2018-07-28 15:02:25 +02:00
*
* @ param WP_Error $errors A `WP_Error` object containing any errors generated by using invalid
* credentials . Note that the error object may not contain any errors .
2017-12-01 00:11:00 +01:00
*/
2018-07-28 15:02:25 +02:00
do_action ( 'lost_password' , $errors );
2013-10-25 00:58:23 +02:00
2020-02-10 04:50:05 +01:00
login_header ( __ ( 'Lost Password' ), '<p class="message">' . __ ( 'Please enter your username or email address. You will receive an email message with instructions on how to reset your password.' ) . '</p>' , $errors );
2013-10-25 00:58:23 +02:00
2017-12-01 00:11:00 +01:00
$user_login = '' ;
2017-10-06 19:37:47 +02:00
2017-12-01 00:11:00 +01:00
if ( isset ( $_POST [ 'user_login' ] ) && is_string ( $_POST [ 'user_login' ] ) ) {
$user_login = wp_unslash ( $_POST [ 'user_login' ] );
}
2013-10-25 00:58:23 +02:00
2018-08-17 03:51:36 +02:00
?>
2013-10-25 00:58:23 +02:00
2019-08-07 02:04:56 +02:00
< form name = " lostpasswordform " id = " lostpasswordform " action = " <?php echo esc_url( network_site_url( 'wp-login.php?action=lostpassword', 'login_post' ) ); ?> " method = " post " >
2019-09-27 00:20:56 +02:00
< p >
< label for = " user_login " >< ? php _e ( 'Username or Email Address' ); ?> </label>
2023-06-21 00:48:21 +02:00
< input type = " text " name = " user_login " id = " user_login " class = " input " value = " <?php echo esc_attr( $user_login ); ?> " size = " 20 " autocapitalize = " off " autocomplete = " username " required = " required " />
2019-09-27 00:20:56 +02:00
</ p >
2019-08-07 02:04:56 +02:00
< ? php
2014-04-25 08:24:15 +02:00
2019-08-07 02:04:56 +02:00
/**
* Fires inside the lostpassword form tags , before the hidden fields .
*
* @ since 2.1 . 0
*/
do_action ( 'lostpassword_form' );
2017-08-22 16:23:47 +02:00
2019-08-07 02:04:56 +02:00
?>
< input type = " hidden " name = " redirect_to " value = " <?php echo esc_attr( $redirect_to ); ?> " />
2019-09-27 00:20:56 +02:00
< p class = " submit " >
2019-08-07 02:04:56 +02:00
< input type = " submit " name = " wp-submit " id = " wp-submit " class = " button button-primary button-large " value = " <?php esc_attr_e( 'Get New Password' ); ?> " />
2019-09-27 00:20:56 +02:00
</ p >
2019-08-07 02:04:56 +02:00
</ form >
2019-09-27 00:20:56 +02:00
< p id = " nav " >
2019-08-07 02:04:56 +02:00
< a href = " <?php echo esc_url( wp_login_url() ); ?> " >< ? php _e ( 'Log in' ); ?> </a>
< ? php
2013-10-25 00:58:23 +02:00
2019-08-07 02:04:56 +02:00
if ( get_option ( 'users_can_register' ) ) {
$registration_url = sprintf ( '<a href="%s">%s</a>' , esc_url ( wp_registration_url () ), __ ( 'Register' ) );
echo esc_html ( $login_link_separator );
/** This filter is documented in wp-includes/general-template.php */
echo apply_filters ( 'register' , $registration_url );
}
2017-10-03 01:21:47 +02:00
2019-08-07 02:04:56 +02:00
?>
2019-09-27 00:20:56 +02:00
</ p >
2018-08-17 03:51:36 +02:00
< ? php
2017-10-03 01:21:47 +02:00
2019-08-07 02:04:56 +02:00
login_footer ( 'user_login' );
2017-12-01 00:11:00 +01:00
break ;
case 'resetpass' :
case 'rp' :
list ( $rp_path ) = explode ( '?' , wp_unslash ( $_SERVER [ 'REQUEST_URI' ] ) );
$rp_cookie = 'wp-resetpass-' . COOKIEHASH ;
2019-08-07 02:04:56 +02:00
2021-04-06 20:39:10 +02:00
if ( isset ( $_GET [ 'key' ] ) && isset ( $_GET [ 'login' ] ) ) {
2017-12-01 00:11:00 +01:00
$value = sprintf ( '%s:%s' , wp_unslash ( $_GET [ 'login' ] ), wp_unslash ( $_GET [ 'key' ] ) );
setcookie ( $rp_cookie , $value , 0 , $rp_path , COOKIE_DOMAIN , is_ssl (), true );
2019-08-07 02:04:56 +02:00
2017-12-01 00:11:00 +01:00
wp_safe_redirect ( remove_query_arg ( array ( 'key' , 'login' ) ) );
exit ;
}
if ( isset ( $_COOKIE [ $rp_cookie ] ) && 0 < strpos ( $_COOKIE [ $rp_cookie ], ':' ) ) {
list ( $rp_login , $rp_key ) = explode ( ':' , wp_unslash ( $_COOKIE [ $rp_cookie ] ), 2 );
2019-08-07 02:04:56 +02:00
$user = check_password_reset_key ( $rp_key , $rp_login );
2017-12-01 00:11:00 +01:00
if ( isset ( $_POST [ 'pass1' ] ) && ! hash_equals ( $rp_key , $_POST [ 'rp_key' ] ) ) {
$user = false ;
}
} else {
2014-11-20 13:22:22 +01:00
$user = false ;
}
2013-10-25 00:58:23 +02:00
2017-12-01 00:11:00 +01:00
if ( ! $user || is_wp_error ( $user ) ) {
setcookie ( $rp_cookie , ' ' , time () - YEAR_IN_SECONDS , $rp_path , COOKIE_DOMAIN , is_ssl (), true );
2019-08-07 02:04:56 +02:00
2017-12-01 00:11:00 +01:00
if ( $user && $user -> get_error_code () === 'expired_key' ) {
wp_redirect ( site_url ( 'wp-login.php?action=lostpassword&error=expiredkey' ) );
} else {
wp_redirect ( site_url ( 'wp-login.php?action=lostpassword&error=invalidkey' ) );
}
2019-08-07 02:04:56 +02:00
2017-12-01 00:11:00 +01:00
exit ;
}
2013-10-25 00:58:23 +02:00
2017-12-01 00:11:00 +01:00
$errors = new WP_Error ();
2013-10-25 00:58:23 +02:00
2022-04-05 05:27:03 +02:00
// Check if password is one or all empty spaces.
if ( ! empty ( $_POST [ 'pass1' ] ) ) {
$_POST [ 'pass1' ] = trim ( $_POST [ 'pass1' ] );
if ( empty ( $_POST [ 'pass1' ] ) ) {
2022-04-05 06:18:03 +02:00
$errors -> add ( 'password_reset_empty_space' , __ ( 'The password cannot be a space or all spaces.' ) );
2022-04-05 05:27:03 +02:00
}
2022-04-05 06:18:03 +02:00
}
2022-04-05 05:27:03 +02:00
// Check if password fields do not match.
2022-04-05 06:18:03 +02:00
if ( ! empty ( $_POST [ 'pass1' ] ) && trim ( $_POST [ 'pass2' ] ) !== $_POST [ 'pass1' ] ) {
2022-06-02 17:05:13 +02:00
$errors -> add ( 'password_reset_mismatch' , __ ( '<strong>Error:</strong> The passwords do not match.' ) );
2017-12-01 00:11:00 +01:00
}
2013-10-25 00:58:23 +02:00
2017-12-01 00:11:00 +01:00
/**
* Fires before the password reset procedure is validated .
*
* @ since 3.5 . 0
*
2019-12-06 23:43:04 +01:00
* @ param WP_Error $errors WP Error object .
2017-12-01 00:11:00 +01:00
* @ param WP_User | WP_Error $user WP_User object if the login and reset key match . WP_Error object otherwise .
*/
do_action ( 'validate_password_reset' , $errors , $user );
2018-02-27 03:31:31 +01:00
if ( ( ! $errors -> has_errors () ) && isset ( $_POST [ 'pass1' ] ) && ! empty ( $_POST [ 'pass1' ] ) ) {
2017-12-01 00:11:00 +01:00
reset_password ( $user , $_POST [ 'pass1' ] );
setcookie ( $rp_cookie , ' ' , time () - YEAR_IN_SECONDS , $rp_path , COOKIE_DOMAIN , is_ssl (), true );
login_header ( __ ( 'Password Reset' ), '<p class="message reset-pass">' . __ ( 'Your password has been reset.' ) . ' <a href="' . esc_url ( wp_login_url () ) . '">' . __ ( 'Log in' ) . '</a></p>' );
login_footer ();
exit ;
}
2013-10-25 00:58:23 +02:00
2017-12-01 00:11:00 +01:00
wp_enqueue_script ( 'utils' );
wp_enqueue_script ( 'user-profile' );
2013-10-25 00:58:23 +02:00
Login and Registration: Improve the UX of the Reset Password screen.
Previously, it was unclear that the displayed password is only being suggested and should be saved by clicking the Reset Password button.
This adds separate Generate Password and Save Password buttons, for clarity.
Props xkon, estelaris, jaymanpandya, hedgefield, audrasjb, erichmond, magicroundabout, lukecavanagh, knutsp, tinodidriksen, nico_martin, markhowellsmead, kara.mcnair, e_baker, pixelverbieger, souri_wpaustria, megabyterose, poena, whyisjake.
Fixes #39638.
Built from https://develop.svn.wordpress.org/trunk@50153
git-svn-id: http://core.svn.wordpress.org/trunk@49832 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2021-02-02 19:13:04 +01:00
login_header ( __ ( 'Reset Password' ), '<p class="message reset-pass">' . __ ( 'Enter your new password below or generate one.' ) . '</p>' , $errors );
2013-10-25 00:58:23 +02:00
2018-08-17 03:51:36 +02:00
?>
2019-08-07 02:04:56 +02:00
< form name = " resetpassform " id = " resetpassform " action = " <?php echo esc_url( network_site_url( 'wp-login.php?action=resetpass', 'login_post' ) ); ?> " method = " post " autocomplete = " off " >
< input type = " hidden " id = " user_login " value = " <?php echo esc_attr( $rp_login ); ?> " autocomplete = " off " />
< div class = " user-pass1-wrap " >
2019-09-27 00:20:56 +02:00
< p >
< label for = " pass1 " >< ? php _e ( 'New password' ); ?> </label>
</ p >
2019-08-07 02:04:56 +02:00
< div class = " wp-pwd " >
Coding Standards: Bring some consistency to the order of attributes in password fields.
Follow-up to [11359], [13592], [13696], [33023], [33246], [33353], [41556], [46256], [49248], [53111], [55094].
See #56791.
Built from https://develop.svn.wordpress.org/trunk@55145
git-svn-id: http://core.svn.wordpress.org/trunk@54678 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2023-01-26 19:12:11 +01:00
< input type = " password " name = " pass1 " id = " pass1 " class = " input password-input " size = " 24 " value = " " autocomplete = " new-password " spellcheck = " false " data - reveal = " 1 " data - pw = " <?php echo esc_attr( wp_generate_password( 16 ) ); ?> " aria - describedby = " pass-strength-result " />
Login and Registration: Add a "Show password" button on the login page.
The ability for users to see the password they're typing improves usability and accessibility of the login users flow.
- brings the login screen in line with the same feature already used in the New User, Edit User, and Reset Password pages
- improves association of labels and input fields by using explicit association with `for` / `id` attributes
- slightly increases the "Remember me" label font size
Props johnbillion, Iceable, audrasjb, joyously, adamsilverstein, boemedia, DrewAPicture, shadyvb, birgire, peterwilsoncc, pento, anevins, davidbaumwald, whyisjake, afercia.
Fixes #42888.
Built from https://develop.svn.wordpress.org/trunk@46256
git-svn-id: http://core.svn.wordpress.org/trunk@46068 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2019-09-23 20:06:57 +02:00
< button type = " button " class = " button button-secondary wp-hide-pw hide-if-no-js " data - toggle = " 0 " aria - label = " <?php esc_attr_e( 'Hide password' ); ?> " >
< span class = " dashicons dashicons-hidden " aria - hidden = " true " ></ span >
</ button >
2019-08-07 02:04:56 +02:00
< div id = " pass-strength-result " class = " hide-if-no-js " aria - live = " polite " >< ? php _e ( 'Strength indicator' ); ?> </div>
</ div >
< div class = " pw-weak " >
Login and Registration: Add a "Show password" button on the login page.
The ability for users to see the password they're typing improves usability and accessibility of the login users flow.
- brings the login screen in line with the same feature already used in the New User, Edit User, and Reset Password pages
- improves association of labels and input fields by using explicit association with `for` / `id` attributes
- slightly increases the "Remember me" label font size
Props johnbillion, Iceable, audrasjb, joyously, adamsilverstein, boemedia, DrewAPicture, shadyvb, birgire, peterwilsoncc, pento, anevins, davidbaumwald, whyisjake, afercia.
Fixes #42888.
Built from https://develop.svn.wordpress.org/trunk@46256
git-svn-id: http://core.svn.wordpress.org/trunk@46068 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2019-09-23 20:06:57 +02:00
< input type = " checkbox " name = " pw_weak " id = " pw-weak " class = " pw-checkbox " />
< label for = " pw-weak " >< ? php _e ( 'Confirm use of weak password' ); ?> </label>
2019-08-07 02:04:56 +02:00
</ div >
</ div >
2013-10-25 00:58:23 +02:00
2019-09-27 00:20:56 +02:00
< p class = " user-pass2-wrap " >
Login and Registration: Add a "Show password" button on the login page.
The ability for users to see the password they're typing improves usability and accessibility of the login users flow.
- brings the login screen in line with the same feature already used in the New User, Edit User, and Reset Password pages
- improves association of labels and input fields by using explicit association with `for` / `id` attributes
- slightly increases the "Remember me" label font size
Props johnbillion, Iceable, audrasjb, joyously, adamsilverstein, boemedia, DrewAPicture, shadyvb, birgire, peterwilsoncc, pento, anevins, davidbaumwald, whyisjake, afercia.
Fixes #42888.
Built from https://develop.svn.wordpress.org/trunk@46256
git-svn-id: http://core.svn.wordpress.org/trunk@46068 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2019-09-23 20:06:57 +02:00
< label for = " pass2 " >< ? php _e ( 'Confirm new password' ); ?> </label>
2023-01-19 09:53:13 +01:00
< input type = " password " name = " pass2 " id = " pass2 " class = " input " size = " 20 " value = " " autocomplete = " new-password " spellcheck = " false " />
2019-09-27 00:20:56 +02:00
</ p >
2015-09-22 05:57:24 +02:00
2019-08-07 02:04:56 +02:00
< p class = " description indicator-hint " >< ? php echo wp_get_password_hint (); ?> </p>
< br class = " clear " />
2014-02-02 08:52:13 +01:00
2019-08-07 02:04:56 +02:00
< ? php
2013-10-25 00:58:23 +02:00
2019-08-07 02:04:56 +02:00
/**
* Fires following the 'Strength indicator' meter in the user password reset form .
*
* @ since 3.9 . 0
*
* @ param WP_User $user User object of the user whose password is being reset .
*/
do_action ( 'resetpass_form' , $user );
?>
< input type = " hidden " name = " rp_key " value = " <?php echo esc_attr( $rp_key ); ?> " />
Login and Registration: Improve the UX of the Reset Password screen.
Previously, it was unclear that the displayed password is only being suggested and should be saved by clicking the Reset Password button.
This adds separate Generate Password and Save Password buttons, for clarity.
Props xkon, estelaris, jaymanpandya, hedgefield, audrasjb, erichmond, magicroundabout, lukecavanagh, knutsp, tinodidriksen, nico_martin, markhowellsmead, kara.mcnair, e_baker, pixelverbieger, souri_wpaustria, megabyterose, poena, whyisjake.
Fixes #39638.
Built from https://develop.svn.wordpress.org/trunk@50153
git-svn-id: http://core.svn.wordpress.org/trunk@49832 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2021-02-02 19:13:04 +01:00
< p class = " submit reset-pass-submit " >
2022-01-05 18:37:03 +01:00
< button type = " button " class = " button wp-generate-pw hide-if-no-js skip-aria-expanded " >< ? php _e ( 'Generate Password' ); ?> </button>
Login and Registration: Improve the UX of the Reset Password screen.
Previously, it was unclear that the displayed password is only being suggested and should be saved by clicking the Reset Password button.
This adds separate Generate Password and Save Password buttons, for clarity.
Props xkon, estelaris, jaymanpandya, hedgefield, audrasjb, erichmond, magicroundabout, lukecavanagh, knutsp, tinodidriksen, nico_martin, markhowellsmead, kara.mcnair, e_baker, pixelverbieger, souri_wpaustria, megabyterose, poena, whyisjake.
Fixes #39638.
Built from https://develop.svn.wordpress.org/trunk@50153
git-svn-id: http://core.svn.wordpress.org/trunk@49832 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2021-02-02 19:13:04 +01:00
< input type = " submit " name = " wp-submit " id = " wp-submit " class = " button button-primary button-large " value = " <?php esc_attr_e( 'Save Password' ); ?> " />
2019-09-27 00:20:56 +02:00
</ p >
2019-08-07 02:04:56 +02:00
</ form >
2019-09-27 00:20:56 +02:00
< p id = " nav " >
2019-08-07 02:04:56 +02:00
< a href = " <?php echo esc_url( wp_login_url() ); ?> " >< ? php _e ( 'Log in' ); ?> </a>
< ? php
2017-10-03 01:21:47 +02:00
2019-08-07 02:04:56 +02:00
if ( get_option ( 'users_can_register' ) ) {
$registration_url = sprintf ( '<a href="%s">%s</a>' , esc_url ( wp_registration_url () ), __ ( 'Register' ) );
2017-10-03 01:21:47 +02:00
2019-08-07 02:04:56 +02:00
echo esc_html ( $login_link_separator );
2013-10-25 00:58:23 +02:00
2019-08-07 02:04:56 +02:00
/** This filter is documented in wp-includes/general-template.php */
echo apply_filters ( 'register' , $registration_url );
}
?>
2019-09-27 00:20:56 +02:00
</ p >
2018-08-17 03:51:36 +02:00
< ? php
2013-10-25 00:58:23 +02:00
2021-11-17 01:14:01 +01:00
login_footer ( 'pass1' );
2017-12-01 00:11:00 +01:00
break ;
2017-10-06 19:37:47 +02:00
2017-12-01 00:11:00 +01:00
case 'register' :
if ( is_multisite () ) {
/**
* Filters the Multisite sign up URL .
*
* @ since 3.0 . 0
*
* @ param string $sign_up_url The sign up URL .
*/
wp_redirect ( apply_filters ( 'wp_signup_location' , network_site_url ( 'wp-signup.php' ) ) );
exit ;
2017-10-06 19:37:47 +02:00
}
2017-12-01 00:11:00 +01:00
if ( ! get_option ( 'users_can_register' ) ) {
wp_redirect ( site_url ( 'wp-login.php?registration=disabled' ) );
2020-05-26 11:37:10 +02:00
exit ;
2017-10-06 19:37:47 +02:00
}
2017-12-01 00:11:00 +01:00
$user_login = '' ;
$user_email = '' ;
if ( $http_post ) {
if ( isset ( $_POST [ 'user_login' ] ) && is_string ( $_POST [ 'user_login' ] ) ) {
2019-11-03 21:12:02 +01:00
$user_login = wp_unslash ( $_POST [ 'user_login' ] );
2017-12-01 00:11:00 +01:00
}
if ( isset ( $_POST [ 'user_email' ] ) && is_string ( $_POST [ 'user_email' ] ) ) {
$user_email = wp_unslash ( $_POST [ 'user_email' ] );
}
$errors = register_new_user ( $user_login , $user_email );
2019-08-07 02:04:56 +02:00
2017-12-01 00:11:00 +01:00
if ( ! is_wp_error ( $errors ) ) {
$redirect_to = ! empty ( $_POST [ 'redirect_to' ] ) ? $_POST [ 'redirect_to' ] : 'wp-login.php?checkemail=registered' ;
wp_safe_redirect ( $redirect_to );
2020-05-26 11:37:10 +02:00
exit ;
2017-12-01 00:11:00 +01:00
}
2013-10-25 00:58:23 +02:00
}
2017-12-01 00:11:00 +01:00
$registration_redirect = ! empty ( $_REQUEST [ 'redirect_to' ] ) ? $_REQUEST [ 'redirect_to' ] : '' ;
2019-08-07 02:04:56 +02:00
2017-12-01 00:11:00 +01:00
/**
* Filters the registration redirect URL .
*
* @ since 3.0 . 0
2021-11-10 00:47:59 +01:00
* @ since 5.9 . 0 Added the `$errors` parameter .
2017-12-01 00:11:00 +01:00
*
2021-11-10 00:47:59 +01:00
* @ param string $registration_redirect The redirect destination URL .
* @ param int | WP_Error $errors User id if registration was successful ,
* WP_Error object otherwise .
2017-12-01 00:11:00 +01:00
*/
2021-11-10 00:47:59 +01:00
$redirect_to = apply_filters ( 'registration_redirect' , $registration_redirect , $errors );
2019-08-07 02:04:56 +02:00
2017-12-01 00:11:00 +01:00
login_header ( __ ( 'Registration Form' ), '<p class="message register">' . __ ( 'Register For This Site' ) . '</p>' , $errors );
2019-08-07 02:04:56 +02:00
2018-08-17 03:51:36 +02:00
?>
2019-08-07 02:04:56 +02:00
< form name = " registerform " id = " registerform " action = " <?php echo esc_url( site_url( 'wp-login.php?action=register', 'login_post' ) ); ?> " method = " post " novalidate = " novalidate " >
2019-09-27 00:20:56 +02:00
< p >
Login and Registration: Add a "Show password" button on the login page.
The ability for users to see the password they're typing improves usability and accessibility of the login users flow.
- brings the login screen in line with the same feature already used in the New User, Edit User, and Reset Password pages
- improves association of labels and input fields by using explicit association with `for` / `id` attributes
- slightly increases the "Remember me" label font size
Props johnbillion, Iceable, audrasjb, joyously, adamsilverstein, boemedia, DrewAPicture, shadyvb, birgire, peterwilsoncc, pento, anevins, davidbaumwald, whyisjake, afercia.
Fixes #42888.
Built from https://develop.svn.wordpress.org/trunk@46256
git-svn-id: http://core.svn.wordpress.org/trunk@46068 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2019-09-23 20:06:57 +02:00
< label for = " user_login " >< ? php _e ( 'Username' ); ?> </label>
2023-06-21 00:48:21 +02:00
< input type = " text " name = " user_login " id = " user_login " class = " input " value = " <?php echo esc_attr( wp_unslash( $user_login ) ); ?> " size = " 20 " autocapitalize = " off " autocomplete = " username " required = " required " />
2019-09-27 00:20:56 +02:00
</ p >
< p >
Login and Registration: Add a "Show password" button on the login page.
The ability for users to see the password they're typing improves usability and accessibility of the login users flow.
- brings the login screen in line with the same feature already used in the New User, Edit User, and Reset Password pages
- improves association of labels and input fields by using explicit association with `for` / `id` attributes
- slightly increases the "Remember me" label font size
Props johnbillion, Iceable, audrasjb, joyously, adamsilverstein, boemedia, DrewAPicture, shadyvb, birgire, peterwilsoncc, pento, anevins, davidbaumwald, whyisjake, afercia.
Fixes #42888.
Built from https://develop.svn.wordpress.org/trunk@46256
git-svn-id: http://core.svn.wordpress.org/trunk@46068 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2019-09-23 20:06:57 +02:00
< label for = " user_email " >< ? php _e ( 'Email' ); ?> </label>
2023-06-21 00:48:21 +02:00
< input type = " email " name = " user_email " id = " user_email " class = " input " value = " <?php echo esc_attr( wp_unslash( $user_email ) ); ?> " size = " 25 " autocomplete = " email " required = " required " />
2019-09-27 00:20:56 +02:00
</ p >
2019-08-07 02:04:56 +02:00
< ? php
2013-10-25 00:58:23 +02:00
2019-08-07 02:04:56 +02:00
/**
* Fires following the 'Email' field in the user registration form .
*
* @ since 2.1 . 0
*/
do_action ( 'register_form' );
?>
< p id = " reg_passmail " >
< ? php _e ( 'Registration confirmation will be emailed to you.' ); ?>
</ p >
< br class = " clear " />
< input type = " hidden " name = " redirect_to " value = " <?php echo esc_attr( $redirect_to ); ?> " />
2019-09-27 00:20:56 +02:00
< p class = " submit " >
2019-08-07 02:04:56 +02:00
< input type = " submit " name = " wp-submit " id = " wp-submit " class = " button button-primary button-large " value = " <?php esc_attr_e( 'Register' ); ?> " />
2019-09-27 00:20:56 +02:00
</ p >
2019-08-07 02:04:56 +02:00
</ form >
2019-09-27 00:20:56 +02:00
< p id = " nav " >
2019-08-07 02:04:56 +02:00
< a href = " <?php echo esc_url( wp_login_url() ); ?> " >< ? php _e ( 'Log in' ); ?> </a>
2022-09-19 19:09:08 +02:00
< ? php
echo esc_html ( $login_link_separator );
$html_link = sprintf ( '<a href="%s">%s</a>' , esc_url ( wp_lostpassword_url () ), __ ( 'Lost your password?' ) );
/** This filter is documented in wp-login.php */
echo apply_filters ( 'lost_password_html_link' , $html_link );
?>
2019-09-27 00:20:56 +02:00
</ p >
2018-08-17 03:51:36 +02:00
< ? php
2017-10-03 01:21:47 +02:00
2019-08-07 02:04:56 +02:00
login_footer ( 'user_login' );
2017-12-01 00:11:00 +01:00
break ;
2013-10-25 00:58:23 +02:00
Login and Registration: Hide the login form on the "check your email" step of new user registration or password reset.
This aims to reduce some confusion and make it clearer that the email should be checked before attempting to log in right away.
Props rianrietveld, pratik028, bdbch, johnbillion, hankthetank, yashrs, williampatton, audrasjb, bmartinent, florianatwhodunit, henry.wright, birgire, SergeyBiryukov.
Fixes #40605, #41514.
Built from https://develop.svn.wordpress.org/trunk@48304
git-svn-id: http://core.svn.wordpress.org/trunk@48073 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2020-07-04 23:58:03 +02:00
case 'checkemail' :
$redirect_to = admin_url ();
$errors = new WP_Error ();
if ( 'confirm' === $_GET [ 'checkemail' ] ) {
$errors -> add (
'confirm' ,
sprintf (
/* translators: %s: Link to the login page. */
__ ( 'Check your email for the confirmation link, then visit the <a href="%s">login page</a>.' ),
wp_login_url ()
),
'message'
);
} elseif ( 'registered' === $_GET [ 'checkemail' ] ) {
$errors -> add (
'registered' ,
sprintf (
/* translators: %s: Link to the login page. */
__ ( 'Registration complete. Please check your email, then visit the <a href="%s">login page</a>.' ),
wp_login_url ()
),
'message'
);
}
/** This action is documented in wp-login.php */
$errors = apply_filters ( 'wp_login_errors' , $errors , $redirect_to );
2020-07-05 00:03:02 +02:00
login_header ( __ ( 'Check your email' ), '' , $errors );
Login and Registration: Hide the login form on the "check your email" step of new user registration or password reset.
This aims to reduce some confusion and make it clearer that the email should be checked before attempting to log in right away.
Props rianrietveld, pratik028, bdbch, johnbillion, hankthetank, yashrs, williampatton, audrasjb, bmartinent, florianatwhodunit, henry.wright, birgire, SergeyBiryukov.
Fixes #40605, #41514.
Built from https://develop.svn.wordpress.org/trunk@48304
git-svn-id: http://core.svn.wordpress.org/trunk@48073 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2020-07-04 23:58:03 +02:00
login_footer ();
break ;
2018-08-17 03:51:36 +02:00
case 'confirmaction' :
2018-04-27 12:12:22 +02:00
if ( ! isset ( $_GET [ 'request_id' ] ) ) {
2019-03-19 03:38:48 +01:00
wp_die ( __ ( 'Missing request ID.' ) );
2018-04-27 12:12:22 +02:00
}
2019-03-19 03:38:48 +01:00
if ( ! isset ( $_GET [ 'confirm_key' ] ) ) {
wp_die ( __ ( 'Missing confirm key.' ) );
2018-03-07 00:47:30 +01:00
}
2019-03-19 03:38:48 +01:00
$request_id = ( int ) $_GET [ 'request_id' ];
2019-03-19 03:48:49 +01:00
$key = sanitize_text_field ( wp_unslash ( $_GET [ 'confirm_key' ] ) );
$result = wp_validate_user_request_key ( $request_id , $key );
2019-03-19 03:38:48 +01:00
2018-03-07 00:47:30 +01:00
if ( is_wp_error ( $result ) ) {
wp_die ( $result );
}
2018-03-18 15:23:33 +01:00
2018-03-07 00:47:30 +01:00
/**
* Fires an action hook when the account action has been confirmed by the user .
2018-03-18 15:23:33 +01:00
*
2018-03-07 00:47:30 +01:00
* Using this you can assume the user has agreed to perform the action by
* clicking on the link in the confirmation email .
2018-03-18 15:23:33 +01:00
*
* After firing this action hook the page will redirect to wp - login a callback
2018-03-07 00:47:30 +01:00
* redirects or exits first .
2018-03-18 15:23:33 +01:00
*
2018-09-14 15:48:24 +02:00
* @ since 4.9 . 6
*
2018-04-27 12:12:22 +02:00
* @ param int $request_id Request ID .
2018-03-07 00:47:30 +01:00
*/
2018-04-27 12:12:22 +02:00
do_action ( 'user_request_action_confirmed' , $request_id );
2018-05-10 22:53:21 +02:00
$message = _wp_privacy_account_request_confirmed_message ( $request_id );
2018-03-07 00:47:30 +01:00
2018-04-27 12:12:22 +02:00
login_header ( __ ( 'User action confirmed.' ), $message );
2018-03-07 00:47:30 +01:00
login_footer ();
exit ;
2017-12-01 00:11:00 +01:00
case 'login' :
default :
$secure_cookie = '' ;
$customize_login = isset ( $_REQUEST [ 'customize-login' ] );
2019-08-07 02:04:56 +02:00
2017-12-01 00:11:00 +01:00
if ( $customize_login ) {
wp_enqueue_script ( 'customize-base' );
}
2013-10-25 00:58:23 +02:00
2018-09-14 15:48:24 +02:00
// If the user wants SSL but the session is not SSL, force a secure cookie.
2017-12-01 00:11:00 +01:00
if ( ! empty ( $_POST [ 'log' ] ) && ! force_ssl_admin () ) {
2019-11-03 21:12:02 +01:00
$user_name = sanitize_user ( wp_unslash ( $_POST [ 'log' ] ) );
2017-12-01 00:11:00 +01:00
$user = get_user_by ( 'login' , $user_name );
2016-02-23 00:15:27 +01:00
2017-12-01 00:11:00 +01:00
if ( ! $user && strpos ( $user_name , '@' ) ) {
$user = get_user_by ( 'email' , $user_name );
}
2016-02-23 00:15:27 +01:00
2017-12-01 00:11:00 +01:00
if ( $user ) {
if ( get_user_option ( 'use_ssl' , $user -> ID ) ) {
$secure_cookie = true ;
force_ssl_admin ( true );
}
2013-10-25 00:58:23 +02:00
}
}
2017-12-01 00:11:00 +01:00
if ( isset ( $_REQUEST [ 'redirect_to' ] ) ) {
$redirect_to = $_REQUEST [ 'redirect_to' ];
2018-09-14 15:48:24 +02:00
// Redirect to HTTPS if user wants SSL.
Code Modernization: Replace usage of `strpos()` with `str_contains()`.
`str_contains()` was introduced in PHP 8.0 to perform a case-sensitive check indicating if the string to search in (haystack) contains the given substring (needle).
WordPress core includes a polyfill for `str_contains()` on PHP < 8.0 as of WordPress 5.9.
This commit replaces `false !== strpos( ... )` with `str_contains()` in core files, making the code more readable and consistent, as well as better aligned with modern development practices.
Follow-up to [52039], [52040], [52326], [55703], [55710], [55987].
Props Soean, spacedmonkey, costdev, dingo_d, azaozz, mikeschroder, flixos90, peterwilsoncc, SergeyBiryukov.
Fixes #58206.
Built from https://develop.svn.wordpress.org/trunk@55988
git-svn-id: http://core.svn.wordpress.org/trunk@55500 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2023-06-22 16:36:26 +02:00
if ( $secure_cookie && str_contains ( $redirect_to , 'wp-admin' ) ) {
2017-12-01 00:11:00 +01:00
$redirect_to = preg_replace ( '|^http://|' , 'https://' , $redirect_to );
}
} else {
$redirect_to = admin_url ();
2014-03-30 01:41:15 +01:00
}
2013-10-25 00:58:23 +02:00
2017-12-01 00:11:00 +01:00
$reauth = empty ( $_REQUEST [ 'reauth' ] ) ? false : true ;
$user = wp_signon ( array (), $secure_cookie );
if ( empty ( $_COOKIE [ LOGGED_IN_COOKIE ] ) ) {
if ( headers_sent () ) {
$user = new WP_Error (
2018-08-17 03:51:36 +02:00
'test_cookie' ,
sprintf (
2019-09-03 02:41:05 +02:00
/* translators: 1: Browser cookie documentation URL, 2: Support forums URL. */
2022-06-02 17:05:13 +02:00
__ ( '<strong>Error:</strong> Cookies are blocked due to unexpected output. For help, please see <a href="%1$s">this documentation</a> or try the <a href="%2$s">support forums</a>.' ),
2023-02-23 11:38:21 +01:00
__ ( 'https://wordpress.org/documentation/article/cookies/' ),
2019-05-25 16:24:50 +02:00
__ ( 'https://wordpress.org/support/forums/' )
2017-12-01 00:11:00 +01:00
)
);
} elseif ( isset ( $_POST [ 'testcookie' ] ) && empty ( $_COOKIE [ TEST_COOKIE ] ) ) {
Docs: Revise comments using “we” in WordPress root directory files.
This updates some inline comments to better match the guidelines and recommendations set forth in the make/core and make/docs handbooks:
> In general, use second person in your documentation. Second person depicts a friendly tone, with a perfect focus on the reader. In addition to this, directly addressing the reader helps avoid passive voice; thereby preventing unwanted confusion.
> ...
> the word “we” should be avoided (...) unless its made very clear which group is speaking.
Includes:
* Replacing first-person usage of "we" with second person point of view.
* Making small clarification adjustments where the voice is much too casual or lacks clear context, especially for non-native English speakers.
References:
* [https://make.wordpress.org/docs/style-guide/language-grammar/grammatical-person/ Style Guide: Grammatical person]
* [https://make.wordpress.org/docs/handbook/documentation-team-handbook/handbooks-style-and-formatting-guide/ Handbooks & HelpHub Style and Formatting Guide]
* [https://make.wordpress.org/core/handbook/best-practices/post-comment-guidelines/#style-and-substance Post & Comment Guidelines: Style and Substance]
Follow-up to [2176], [3430], [4676], [6009], [7991], [12688], [12762], [26008], [28978], [44488], [44962], [51979], [53131], [53132], [53156], [53131], [54200].
Props ironprogrammer, costdev, jorbin, SergeyBiryukov.
See #57052.
Built from https://develop.svn.wordpress.org/trunk@54866
git-svn-id: http://core.svn.wordpress.org/trunk@54418 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2022-11-23 16:43:13 +01:00
// If cookies are disabled, the user can't log in even with a valid username and password.
2017-12-01 00:11:00 +01:00
$user = new WP_Error (
2018-08-17 03:51:36 +02:00
'test_cookie' ,
sprintf (
2019-09-03 02:41:05 +02:00
/* translators: %s: Browser cookie documentation URL. */
2022-06-02 17:05:13 +02:00
__ ( '<strong>Error:</strong> Cookies are blocked or not supported by your browser. You must <a href="%s">enable cookies</a> to use WordPress.' ),
2023-02-23 11:38:21 +01:00
__ ( 'https://wordpress.org/documentation/article/cookies/#enable-cookies-in-your-browser' )
2017-12-01 00:11:00 +01:00
)
);
}
}
2013-10-25 00:58:23 +02:00
2017-12-01 00:11:00 +01:00
$requested_redirect_to = isset ( $_REQUEST [ 'redirect_to' ] ) ? $_REQUEST [ 'redirect_to' ] : '' ;
/**
* Filters the login redirect URL .
*
* @ since 3.0 . 0
*
* @ param string $redirect_to The redirect destination URL .
* @ param string $requested_redirect_to The requested redirect destination URL passed as a parameter .
* @ param WP_User | WP_Error $user WP_User object if login was successful , WP_Error object otherwise .
*/
$redirect_to = apply_filters ( 'login_redirect' , $redirect_to , $requested_redirect_to , $user );
if ( ! is_wp_error ( $user ) && ! $reauth ) {
if ( $interim_login ) {
$message = '<p class="message">' . __ ( 'You have logged in successfully.' ) . '</p>' ;
$interim_login = 'success' ;
login_header ( '' , $message );
2019-08-07 02:04:56 +02:00
2018-08-17 03:51:36 +02:00
?>
2017-12-01 00:11:00 +01:00
</ div >
< ? php
2019-08-07 02:04:56 +02:00
2017-12-01 00:11:00 +01:00
/** This action is documented in wp-login.php */
do_action ( 'login_footer' );
2019-08-07 02:04:56 +02:00
if ( $customize_login ) {
?>
< script type = " text/javascript " > setTimeout ( function (){ new wp . customize . Messenger ({ url : '<?php echo wp_customize_url(); ?>' , channel : 'login' }) . send ( 'login' ) }, 1000 ); </ script >
< ? php
}
2018-08-17 03:51:36 +02:00
?>
2017-12-01 00:11:00 +01:00
</ body ></ html >
2018-08-17 03:51:36 +02:00
< ? php
2019-08-07 02:04:56 +02:00
2018-08-17 03:51:36 +02:00
exit ;
2017-12-01 00:11:00 +01:00
}
2016-03-06 04:06:29 +01:00
2019-08-07 02:04:56 +02:00
// Check if it is time to add a redirect to the admin email confirmation screen.
2019-09-30 20:53:00 +02:00
if ( is_a ( $user , 'WP_User' ) && $user -> exists () && $user -> has_cap ( 'manage_options' ) ) {
2019-08-07 02:04:56 +02:00
$admin_email_lifespan = ( int ) get_option ( 'admin_email_lifespan' );
2022-03-17 05:57:03 +01:00
/*
* If `0` ( or anything " falsey " as it is cast to int ) is returned , the user will not be redirected
* to the admin email confirmation screen .
*/
2019-08-07 02:04:56 +02:00
/** This filter is documented in wp-login.php */
2019-09-26 04:29:58 +02:00
$admin_email_check_interval = ( int ) apply_filters ( 'admin_email_check_interval' , 6 * MONTH_IN_SECONDS );
2019-09-20 21:27:57 +02:00
2019-08-07 02:04:56 +02:00
if ( $admin_email_check_interval > 0 && time () > $admin_email_lifespan ) {
2019-11-27 15:35:02 +01:00
$redirect_to = add_query_arg (
array (
'action' => 'confirm_admin_email' ,
'wp_lang' => get_user_locale ( $user ),
),
wp_login_url ( $redirect_to )
);
2019-08-07 02:04:56 +02:00
}
}
2020-02-09 17:55:09 +01:00
if ( ( empty ( $redirect_to ) || 'wp-admin/' === $redirect_to || admin_url () === $redirect_to ) ) {
2017-12-01 00:11:00 +01:00
// If the user doesn't belong to a blog, send them to user admin. If the user can't edit posts, send them to their profile.
if ( is_multisite () && ! get_active_blog_for_user ( $user -> ID ) && ! is_super_admin ( $user -> ID ) ) {
$redirect_to = user_admin_url ();
} elseif ( is_multisite () && ! $user -> has_cap ( 'read' ) ) {
$redirect_to = get_dashboard_url ( $user -> ID );
} elseif ( ! $user -> has_cap ( 'edit_posts' ) ) {
$redirect_to = $user -> has_cap ( 'read' ) ? admin_url ( 'profile.php' ) : home_url ();
}
wp_redirect ( $redirect_to );
2019-08-07 02:04:56 +02:00
exit ;
2017-12-01 00:11:00 +01:00
}
2019-08-07 02:04:56 +02:00
2017-12-01 00:11:00 +01:00
wp_safe_redirect ( $redirect_to );
2019-08-07 02:04:56 +02:00
exit ;
2013-10-25 00:58:23 +02:00
}
2017-12-01 00:11:00 +01:00
$errors = $user ;
// Clear errors if loggedout is set.
if ( ! empty ( $_GET [ 'loggedout' ] ) || $reauth ) {
$errors = new WP_Error ();
}
2013-10-25 00:58:23 +02:00
2019-03-16 16:22:53 +01:00
if ( empty ( $_POST ) && $errors -> get_error_codes () === array ( 'empty_username' , 'empty_password' ) ) {
$errors = new WP_Error ( '' , '' );
}
2017-12-01 00:11:00 +01:00
if ( $interim_login ) {
2018-02-27 03:31:31 +01:00
if ( ! $errors -> has_errors () ) {
2017-12-01 00:11:00 +01:00
$errors -> add ( 'expired' , __ ( 'Your session has expired. Please log in to continue where you left off.' ), 'message' );
}
} else {
2018-09-14 15:48:24 +02:00
// Some parts of this script use the main login form to display a message.
2019-08-07 02:04:56 +02:00
if ( isset ( $_GET [ 'loggedout' ] ) && $_GET [ 'loggedout' ] ) {
2017-12-01 00:11:00 +01:00
$errors -> add ( 'loggedout' , __ ( 'You are now logged out.' ), 'message' );
2019-08-07 02:04:56 +02:00
} elseif ( isset ( $_GET [ 'registration' ] ) && 'disabled' === $_GET [ 'registration' ] ) {
2022-06-02 17:05:13 +02:00
$errors -> add ( 'registerdisabled' , __ ( '<strong>Error:</strong> User registration is currently not allowed.' ) );
2017-12-01 00:11:00 +01:00
} elseif ( strpos ( $redirect_to , 'about.php?updated' ) ) {
$errors -> add ( 'updated' , __ ( '<strong>You have successfully updated WordPress!</strong> Please log back in to see what’s new.' ), 'message' );
Bootstrap/Load: Introduce a recovery mode for fixing fatal errors.
Using the new fatal handler introduced in [44962], an email is sent to the admin when a fatal error occurs. This email includes a secret link to enter recovery mode. When clicked, the link will be validated and on success a cookie will be placed on the client, enabling recovery mode for that user. This functionality is executed early before plugins and themes are loaded, in order to be unaffected by potential fatal errors these might be causing.
When in recovery mode, broken plugins and themes will be paused for that client, so that they are able to access the admin backend despite of these errors. They are notified about the broken extensions and the errors caused, and can then decide whether they would like to temporarily deactivate the extension or fix the problem and resume the extension.
A link in the admin bar allows the client to exit recovery mode.
Props timothyblynjacobs, afragen, flixos90, nerrad, miss_jwo, schlessera, spacedmonkey, swissspidy.
Fixes #46130, #44458.
Built from https://develop.svn.wordpress.org/trunk@44973
git-svn-id: http://core.svn.wordpress.org/trunk@44804 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2019-03-21 22:53:51 +01:00
} elseif ( WP_Recovery_Mode_Link_Service :: LOGIN_ACTION_ENTERED === $action ) {
$errors -> add ( 'enter_recovery_mode' , __ ( 'Recovery Mode Initialized. Please log in to continue.' ), 'message' );
Code Modernization: Replace usage of `strpos()` with `str_contains()`.
`str_contains()` was introduced in PHP 8.0 to perform a case-sensitive check indicating if the string to search in (haystack) contains the given substring (needle).
WordPress core includes a polyfill for `str_contains()` on PHP < 8.0 as of WordPress 5.9.
This commit replaces `false !== strpos( ... )` with `str_contains()` in core files, making the code more readable and consistent, as well as better aligned with modern development practices.
Follow-up to [52039], [52040], [52326], [55703], [55710], [55987].
Props Soean, spacedmonkey, costdev, dingo_d, azaozz, mikeschroder, flixos90, peterwilsoncc, SergeyBiryukov.
Fixes #58206.
Built from https://develop.svn.wordpress.org/trunk@55988
git-svn-id: http://core.svn.wordpress.org/trunk@55500 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2023-06-22 16:36:26 +02:00
} elseif ( isset ( $_GET [ 'redirect_to' ] ) && str_contains ( $_GET [ 'redirect_to' ], 'wp-admin/authorize-application.php' ) ) {
REST API: Introduce Application Passwords for API authentication.
In WordPress 4.4 the REST API was first introduced. A few releases later in WordPress 4.7, the Content API endpoints were added, paving the way for Gutenberg and countless in-site experiences. In the intervening years, numerous plugins have built on top of the REST API. Many developers shared a common frustration, the lack of external authentication to the REST API.
This commit introduces Application Passwords to allow users to connect to external applications to their WordPress website. Users can generate individual passwords for each application, allowing for easy revocation and activity monitoring. An authorization flow is introduced to make the connection flow simple for users and application developers.
Application Passwords uses Basic Authentication, and by default is only available over an SSL connection.
Props georgestephanis, kasparsd, timothyblynjacobs, afercia, akkspro, andraganescu, arippberger, aristath, austyfrosty, ayesh, batmoo, bradyvercher, brianhenryie, helen, ipstenu, jeffmatson, jeffpaul, joostdevalk, joshlevinson, kadamwhite, kjbenk, koke, michael-arestad, Otto42, pekz0r, salzano, spacedmonkey, valendesigns.
Fixes #42790.
Built from https://develop.svn.wordpress.org/trunk@49109
git-svn-id: http://core.svn.wordpress.org/trunk@48871 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2020-10-09 00:14:06 +02:00
$query_component = wp_parse_url ( $_GET [ 'redirect_to' ], PHP_URL_QUERY );
2021-09-20 20:22:57 +02:00
$query = array ();
if ( $query_component ) {
parse_str ( $query_component , $query );
}
REST API: Introduce Application Passwords for API authentication.
In WordPress 4.4 the REST API was first introduced. A few releases later in WordPress 4.7, the Content API endpoints were added, paving the way for Gutenberg and countless in-site experiences. In the intervening years, numerous plugins have built on top of the REST API. Many developers shared a common frustration, the lack of external authentication to the REST API.
This commit introduces Application Passwords to allow users to connect to external applications to their WordPress website. Users can generate individual passwords for each application, allowing for easy revocation and activity monitoring. An authorization flow is introduced to make the connection flow simple for users and application developers.
Application Passwords uses Basic Authentication, and by default is only available over an SSL connection.
Props georgestephanis, kasparsd, timothyblynjacobs, afercia, akkspro, andraganescu, arippberger, aristath, austyfrosty, ayesh, batmoo, bradyvercher, brianhenryie, helen, ipstenu, jeffmatson, jeffpaul, joostdevalk, joshlevinson, kadamwhite, kjbenk, koke, michael-arestad, Otto42, pekz0r, salzano, spacedmonkey, valendesigns.
Fixes #42790.
Built from https://develop.svn.wordpress.org/trunk@49109
git-svn-id: http://core.svn.wordpress.org/trunk@48871 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2020-10-09 00:14:06 +02:00
if ( ! empty ( $query [ 'app_name' ] ) ) {
/* translators: 1: Website name, 2: Application name. */
$message = sprintf ( 'Please log in to %1$s to authorize %2$s to connect to your account.' , get_bloginfo ( 'name' , 'display' ), '<strong>' . esc_html ( $query [ 'app_name' ] ) . '</strong>' );
} else {
2020-10-09 03:06:03 +02:00
/* translators: %s: Website name. */
REST API: Introduce Application Passwords for API authentication.
In WordPress 4.4 the REST API was first introduced. A few releases later in WordPress 4.7, the Content API endpoints were added, paving the way for Gutenberg and countless in-site experiences. In the intervening years, numerous plugins have built on top of the REST API. Many developers shared a common frustration, the lack of external authentication to the REST API.
This commit introduces Application Passwords to allow users to connect to external applications to their WordPress website. Users can generate individual passwords for each application, allowing for easy revocation and activity monitoring. An authorization flow is introduced to make the connection flow simple for users and application developers.
Application Passwords uses Basic Authentication, and by default is only available over an SSL connection.
Props georgestephanis, kasparsd, timothyblynjacobs, afercia, akkspro, andraganescu, arippberger, aristath, austyfrosty, ayesh, batmoo, bradyvercher, brianhenryie, helen, ipstenu, jeffmatson, jeffpaul, joostdevalk, joshlevinson, kadamwhite, kjbenk, koke, michael-arestad, Otto42, pekz0r, salzano, spacedmonkey, valendesigns.
Fixes #42790.
Built from https://develop.svn.wordpress.org/trunk@49109
git-svn-id: http://core.svn.wordpress.org/trunk@48871 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2020-10-09 00:14:06 +02:00
$message = sprintf ( 'Please log in to %s to proceed with authorization.' , get_bloginfo ( 'name' , 'display' ) );
}
$errors -> add ( 'authorize_application' , $message , 'message' );
2017-12-01 00:11:00 +01:00
}
}
2013-10-25 00:58:23 +02:00
2017-12-01 00:11:00 +01:00
/**
* Filters the login page errors .
*
* @ since 3.6 . 0
*
2019-12-06 23:43:04 +01:00
* @ param WP_Error $errors WP Error object .
* @ param string $redirect_to Redirect destination URL .
2017-12-01 00:11:00 +01:00
*/
$errors = apply_filters ( 'wp_login_errors' , $errors , $redirect_to );
2013-10-25 00:58:23 +02:00
2017-12-01 00:11:00 +01:00
// Clear any stale cookies.
if ( $reauth ) {
wp_clear_auth_cookie ();
}
2013-10-25 00:58:23 +02:00
2017-12-01 00:11:00 +01:00
login_header ( __ ( 'Log In' ), '' , $errors );
2013-10-25 00:58:23 +02:00
2017-12-01 00:11:00 +01:00
if ( isset ( $_POST [ 'log' ] ) ) {
2019-08-07 02:04:56 +02:00
$user_login = ( 'incorrect_password' === $errors -> get_error_code () || 'empty_password' === $errors -> get_error_code () ) ? esc_attr ( wp_unslash ( $_POST [ 'log' ] ) ) : '' ;
2017-12-01 00:11:00 +01:00
}
2019-08-07 02:04:56 +02:00
2017-12-01 00:11:00 +01:00
$rememberme = ! empty ( $_POST [ 'rememberme' ] );
2015-03-24 17:29:26 +01:00
2022-07-16 01:40:10 +02:00
$aria_describedby = '' ;
$has_errors = $errors -> has_errors ();
if ( $has_errors ) {
$aria_describedby = ' aria-describedby="login_error"' ;
2022-07-16 01:59:09 +02:00
}
2022-07-16 01:40:10 +02:00
if ( $has_errors && 'message' === $errors -> get_error_data () ) {
$aria_describedby = ' aria-describedby="login-message"' ;
2017-12-01 00:11:00 +01:00
}
2013-10-25 00:58:23 +02:00
Login and Registration: Add a "Show password" button on the login page.
The ability for users to see the password they're typing improves usability and accessibility of the login users flow.
- brings the login screen in line with the same feature already used in the New User, Edit User, and Reset Password pages
- improves association of labels and input fields by using explicit association with `for` / `id` attributes
- slightly increases the "Remember me" label font size
Props johnbillion, Iceable, audrasjb, joyously, adamsilverstein, boemedia, DrewAPicture, shadyvb, birgire, peterwilsoncc, pento, anevins, davidbaumwald, whyisjake, afercia.
Fixes #42888.
Built from https://develop.svn.wordpress.org/trunk@46256
git-svn-id: http://core.svn.wordpress.org/trunk@46068 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2019-09-23 20:06:57 +02:00
wp_enqueue_script ( 'user-profile' );
2018-08-17 03:51:36 +02:00
?>
2019-08-07 02:04:56 +02:00
< form name = " loginform " id = " loginform " action = " <?php echo esc_url( site_url( 'wp-login.php', 'login_post' ) ); ?> " method = " post " >
2019-09-27 00:20:56 +02:00
< p >
< label for = " user_login " >< ? php _e ( 'Username or Email Address' ); ?> </label>
2023-06-21 00:48:21 +02:00
< input type = " text " name = " log " id = " user_login " < ? php echo $aria_describedby ; ?> class="input" value="<?php echo esc_attr( $user_login ); ?>" size="20" autocapitalize="off" autocomplete="username" required="required" />
2019-09-27 00:20:56 +02:00
</ p >
Login and Registration: Add a "Show password" button on the login page.
The ability for users to see the password they're typing improves usability and accessibility of the login users flow.
- brings the login screen in line with the same feature already used in the New User, Edit User, and Reset Password pages
- improves association of labels and input fields by using explicit association with `for` / `id` attributes
- slightly increases the "Remember me" label font size
Props johnbillion, Iceable, audrasjb, joyously, adamsilverstein, boemedia, DrewAPicture, shadyvb, birgire, peterwilsoncc, pento, anevins, davidbaumwald, whyisjake, afercia.
Fixes #42888.
Built from https://develop.svn.wordpress.org/trunk@46256
git-svn-id: http://core.svn.wordpress.org/trunk@46068 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2019-09-23 20:06:57 +02:00
< div class = " user-pass-wrap " >
< label for = " user_pass " >< ? php _e ( 'Password' ); ?> </label>
< div class = " wp-pwd " >
2023-06-21 00:48:21 +02:00
< input type = " password " name = " pwd " id = " user_pass " < ? php echo $aria_describedby ; ?> class="input password-input" value="" size="20" autocomplete="current-password" spellcheck="false" required="required" />
Login and Registration: Add a "Show password" button on the login page.
The ability for users to see the password they're typing improves usability and accessibility of the login users flow.
- brings the login screen in line with the same feature already used in the New User, Edit User, and Reset Password pages
- improves association of labels and input fields by using explicit association with `for` / `id` attributes
- slightly increases the "Remember me" label font size
Props johnbillion, Iceable, audrasjb, joyously, adamsilverstein, boemedia, DrewAPicture, shadyvb, birgire, peterwilsoncc, pento, anevins, davidbaumwald, whyisjake, afercia.
Fixes #42888.
Built from https://develop.svn.wordpress.org/trunk@46256
git-svn-id: http://core.svn.wordpress.org/trunk@46068 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2019-09-23 20:06:57 +02:00
< button type = " button " class = " button button-secondary wp-hide-pw hide-if-no-js " data - toggle = " 0 " aria - label = " <?php esc_attr_e( 'Show password' ); ?> " >
< span class = " dashicons dashicons-visibility " aria - hidden = " true " ></ span >
</ button >
</ div >
</ div >
2018-08-17 03:51:36 +02:00
< ? php
2014-04-25 08:24:15 +02:00
2019-08-07 02:04:56 +02:00
/**
* Fires following the 'Password' field in the login form .
*
* @ since 2.1 . 0
*/
do_action ( 'login_form' );
?>
2019-09-27 00:20:56 +02:00
< p class = " forgetmenot " >< input name = " rememberme " type = " checkbox " id = " rememberme " value = " forever " < ? php checked ( $rememberme ); ?> /> <label for="rememberme"><?php esc_html_e( 'Remember Me' ); ?></label></p>
< p class = " submit " >
2019-08-07 02:04:56 +02:00
< input type = " submit " name = " wp-submit " id = " wp-submit " class = " button button-primary button-large " value = " <?php esc_attr_e( 'Log In' ); ?> " />
< ? php
if ( $interim_login ) {
?>
< input type = " hidden " name = " interim-login " value = " 1 " />
< ? php
} else {
?>
< input type = " hidden " name = " redirect_to " value = " <?php echo esc_attr( $redirect_to ); ?> " />
< ? php
}
if ( $customize_login ) {
?>
< input type = " hidden " name = " customize-login " value = " 1 " />
< ? php
}
2017-08-22 16:23:47 +02:00
2018-08-17 03:51:36 +02:00
?>
2019-08-07 02:04:56 +02:00
< input type = " hidden " name = " testcookie " value = " 1 " />
2019-09-27 00:20:56 +02:00
</ p >
2019-08-07 02:04:56 +02:00
</ form >
2013-10-25 00:58:23 +02:00
2019-08-07 02:04:56 +02:00
< ? php
if ( ! $interim_login ) {
?>
2019-09-27 00:20:56 +02:00
< p id = " nav " >
2019-01-12 07:41:52 +01:00
< ? php
2019-08-07 02:04:56 +02:00
Login and Registration: Hide the login form on the "check your email" step of new user registration or password reset.
This aims to reduce some confusion and make it clearer that the email should be checked before attempting to log in right away.
Props rianrietveld, pratik028, bdbch, johnbillion, hankthetank, yashrs, williampatton, audrasjb, bmartinent, florianatwhodunit, henry.wright, birgire, SergeyBiryukov.
Fixes #40605, #41514.
Built from https://develop.svn.wordpress.org/trunk@48304
git-svn-id: http://core.svn.wordpress.org/trunk@48073 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2020-07-04 23:58:03 +02:00
if ( get_option ( 'users_can_register' ) ) {
$registration_url = sprintf ( '<a href="%s">%s</a>' , esc_url ( wp_registration_url () ), __ ( 'Register' ) );
2019-08-07 02:04:56 +02:00
Login and Registration: Hide the login form on the "check your email" step of new user registration or password reset.
This aims to reduce some confusion and make it clearer that the email should be checked before attempting to log in right away.
Props rianrietveld, pratik028, bdbch, johnbillion, hankthetank, yashrs, williampatton, audrasjb, bmartinent, florianatwhodunit, henry.wright, birgire, SergeyBiryukov.
Fixes #40605, #41514.
Built from https://develop.svn.wordpress.org/trunk@48304
git-svn-id: http://core.svn.wordpress.org/trunk@48073 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2020-07-04 23:58:03 +02:00
/** This filter is documented in wp-includes/general-template.php */
echo apply_filters ( 'register' , $registration_url );
2019-08-07 02:04:56 +02:00
Login and Registration: Hide the login form on the "check your email" step of new user registration or password reset.
This aims to reduce some confusion and make it clearer that the email should be checked before attempting to log in right away.
Props rianrietveld, pratik028, bdbch, johnbillion, hankthetank, yashrs, williampatton, audrasjb, bmartinent, florianatwhodunit, henry.wright, birgire, SergeyBiryukov.
Fixes #40605, #41514.
Built from https://develop.svn.wordpress.org/trunk@48304
git-svn-id: http://core.svn.wordpress.org/trunk@48073 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2020-07-04 23:58:03 +02:00
echo esc_html ( $login_link_separator );
2019-08-07 02:04:56 +02:00
}
2022-09-19 19:09:08 +02:00
$html_link = sprintf ( '<a href="%s">%s</a>' , esc_url ( wp_lostpassword_url () ), __ ( 'Lost your password?' ) );
/**
2022-09-20 00:26:10 +02:00
* Filters the link that allows the user to reset the lost password .
2022-09-19 19:09:08 +02:00
*
* @ since 6.1 . 0
*
* @ param string $html_link HTML link to the lost password form .
*/
echo apply_filters ( 'lost_password_html_link' , $html_link );
2019-08-07 02:04:56 +02:00
?>
2019-09-27 00:20:56 +02:00
</ p >
2019-08-07 02:04:56 +02:00
< ? php
}
$login_script = 'function wp_attempt_focus() {' ;
$login_script .= 'setTimeout( function() {' ;
$login_script .= 'try {' ;
if ( $user_login ) {
$login_script .= 'd = document.getElementById( "user_pass" ); d.value = "";' ;
} else {
$login_script .= 'd = document.getElementById( "user_login" );' ;
if ( $errors -> get_error_code () === 'invalid_username' ) {
$login_script .= 'd.value = "";' ;
2019-01-12 07:41:52 +01:00
}
2019-08-07 02:04:56 +02:00
}
$login_script .= 'd.focus(); d.select();' ;
$login_script .= '} catch( er ) {}' ;
$login_script .= '}, 200);' ;
$login_script .= " } \n " ; // End of wp_attempt_focus().
2013-10-25 00:58:23 +02:00
2018-08-17 03:51:36 +02:00
/**
* Filters whether to print the call to `wp_attempt_focus()` on the login screen .
*
* @ since 4.8 . 0
*
* @ param bool $print Whether to print the function call . Default true .
*/
if ( apply_filters ( 'enable_login_autofocus' , true ) && ! $error ) {
2019-08-07 02:04:56 +02:00
$login_script .= " wp_attempt_focus(); \n " ;
2017-12-01 00:11:00 +01:00
}
2017-10-03 01:21:47 +02:00
2019-08-07 02:04:56 +02:00
// Run `wpOnload()` if defined.
$login_script .= " if ( typeof wpOnload === 'function' ) { wpOnload() } " ;
?>
< script type = " text/javascript " >
< ? php echo $login_script ; ?>
</ script >
2018-08-17 03:51:36 +02:00
< ? php
2017-12-01 00:11:00 +01:00
2019-08-07 02:04:56 +02:00
if ( $interim_login ) {
?>
< script type = " text/javascript " >
( function () {
try {
var i , links = document . getElementsByTagName ( 'a' );
for ( i in links ) {
if ( links [ i ] . href ) {
links [ i ] . target = '_blank' ;
2020-10-20 01:39:04 +02:00
links [ i ] . rel = 'noopener' ;
2019-08-07 02:04:56 +02:00
}
}
} catch ( er ) {}
}());
</ script >
< ? php
}
login_footer ();
2017-12-01 00:11:00 +01:00
break ;
2018-09-14 15:48:24 +02:00
} // End action switch.
