<?php // phpcs:disable WordPress.Files.FileName

/**

* Plugin Name: Restricted Site Access

* Plugin URI: https://10up.com/plugins/restricted-site-access-wordpress/

* Description: <strong>Limit access your site</strong> to visitors who are logged in or accessing the site from a set of specific IP addresses. Send restricted visitors to the log in page, redirect them, or display a message or page. <strong>Powerful control over redirection</strong>, including <strong>SEO friendly redirect headers</strong>. Great solution for Extranets, publicly hosted Intranets, or parallel development sites.

* Version: 7.6.1

* Requires at least: 6.6

* Requires PHP: 7.4

* Author: 10up

* Author URI: https://10up.com

* License: GPL-2.0-or-later

* License URI: https://spdx.org/licenses/GPL-2.0-or-later.html

* Text Domain: restricted-site-access

*/

// Try and include our autoloader.

if ( ! is_readable( __DIR__ . '/10up-lib/wp-compat-validation-tool/src/Validator.php' ) ) {

return;

}

require_once '10up-lib/wp-compat-validation-tool/src/Validator.php';

$compat_checker = new \RSA_Validator\Validator();

$compat_checker

->set_plugin_name( 'Restricted Site Access' )

->set_php_min_required_version( '7.4' );

if ( ! $compat_checker->is_plugin_compatible() ) {

return;

}

if ( is_readable( __DIR__ . '/vendor/autoload.php' ) ) {

require_once __DIR__ . '/vendor/autoload.php';

}

if ( ! class_exists( 'IPLib\\Factory' ) ) {

add_action(

'admin_notices',

function() {

?>

<div class="notice notice-error">

<p>

<?php

echo wp_kses_post(

sprintf(

/* translators: %1$s is the command that needs to be run. */

__( 'You appear to be running a development version of Restricted Site Access. Please run %1$s in order for things to work properly.', 'restricted-site-access' ),

'<code>composer install</code>'

)

);

?>

</p>

</div>

<?php

}

);

return;

}

define( 'RSA_VERSION', '7.6.1' );

/**

* Class responsible for all plugin funcitonality.

*/

class Restricted_Site_Access {

/**

* Plugin basename.

*

* @var array $basename The plugin base name.

*/

private static $basename;

/**

* Plugin options.

*

* @var array $rsa_options The plugin options.

*/

private static $rsa_options;

/**

* Settings page slug.

*

* @var array $settings_page The settings page slug.

*/

private static $settings_page = 'reading';

/**

* Settings fields.

*

* @var array $fields The plugin settings fields.

*/

private static $fields;

/**

* Settings fields that should always be visible.

*

* @var array $always_visible_fields The plugin settings fields that should always be visible.

*/

private static $always_visible_fields;

/**

* The redirection nonce.

*

* @var string

*/

private static $redirection_nonce;

/**

* Handles initializing this class and returning the singleton instance after it's been cached.

*

* @return null|Restricted_Site_Access

* @codeCoverageIgnore

*/

public static function get_instance() {

// Store the instance locally to avoid private static replication.

static $instance = null;

if ( null === $instance ) {

$instance = new self();

self::add_actions();

}

return $instance;

}

/**

* An empty constructor

*

* @codeCoverageIgnore

*/

public function __construct() {

/* Purposely do nothing here */ }

/**

* Handles registering hooks that initialize this plugin.

*/

public static function add_actions() {

self::$basename = plugin_basename( __FILE__ );

add_action( 'parse_request', array( __CLASS__, 'restrict_access' ), 1 );

add_action( 'admin_init', array( __CLASS__, 'admin_init' ), 1 );

add_action( 'init', array( __CLASS__, 'generate_nonce' ) );

add_action( 'init', array( __CLASS__, 'populate_fields' ) );

add_action( 'wp_ajax_rsa_ip_check', array( __CLASS__, 'ajax_rsa_ip_check' ) );

add_action( 'activate_' . self::$basename, array( __CLASS__, 'activation' ), 10, 1 );

add_action( 'deactivate_' . self::$basename, array( __CLASS__, 'deactivation' ), 10, 1 );

add_action( 'wpmu_new_blog', array( __CLASS__, 'set_defaults' ), 10, 6 );

add_action( 'admin_enqueue_scripts', array( __CLASS__, 'enqueue_admin_script' ) );

add_action( 'wp_ajax_rsa_notice_dismiss', array( __CLASS__, 'ajax_notice_dismiss' ) );

add_action( 'admin_footer', array( __CLASS__, 'admin_footer' ) );

add_filter( 'pre_option_blog_public', array( __CLASS__, 'pre_option_blog_public' ), 10, 1 );

add_filter( 'pre_site_option_blog_public', array( __CLASS__, 'pre_option_blog_public' ), 10, 1 );

add_filter( 'application_password_is_api_request', array( __CLASS__, 'is_api_request' ) );

// Hide admin bar for selected user roles.

add_filter( 'show_admin_bar', array( __CLASS__, 'hide_admin_bar_for_roles' ), 10, 1 );

// Prevent WordPress from auto-resolving 404 URLs.

add_filter( 'do_redirect_guess_404_permalink', '__return_false' );

add_filter( 'wp_headers', array( __CLASS__, 'maybe_add_no_cache_headers' ) );

}

/**

* Generates a nonce on init.

*/

public static function generate_nonce() {

self::$redirection_nonce = wp_create_nonce( 'redirection_nonce' );

}

/**

* Populates the fields array with the field information.

*/

public static function populate_fields() {

self::populate_fields_array();

}

/**

* Determine if this is a REST request.

*

* Determine whether this is a REST API request based on the URL. As RSA redirects prior

* to the `init` hook running, RSA needs to replace the API check in wp_authenticate_application_password().

*

* @since 7.4.0

*

* @param bool $original_value Original value passed by filter.

* @return bool

*/

public static function is_api_request( $original_value ) {

if ( did_action( 'init' ) ) {

return $original_value;

}

$protocol = ( isset( $_SERVER['HTTPS'] ) && 'on' === $_SERVER['HTTPS'] ) ? 'https' : 'http';

$host = isset( $_SERVER['HTTP_HOST'] ) ? sanitize_text_field( wp_unslash( $_SERVER['HTTP_HOST'] ) ) : '';

$path = isset( $_SERVER['REQUEST_URI'] ) ? sanitize_text_field( wp_unslash( $_SERVER['REQUEST_URI'] ) ) : '';

// We need to determine current URL via php because $wp->request is not set at this point.

$current_request = esc_url_raw( "{$protocol}://{$host}{$path}" );

// Strip the query string.

$current_request = explode( '?', $current_request, 2 )[0];

// phpcs:ignore WordPress.Security.NonceVerification.Recommended

if ( ! get_option( 'permalink_structure' ) && isset( $_GET['rest_route'] ) ) {

return true;

} elseif (

strpos( $current_request, home_url( '/wp-json/' ) ) === 0

|| home_url( '/wp-json' ) === $current_request

) {

return true;

}

return $original_value;

}

/**

* Hide admin bar for selected user roles.

*

* @param bool $show_admin_bar Whether the admin bar should be shown.

* @return bool Whether the admin bar should be shown.

*/

public static function hide_admin_bar_for_roles( $show_admin_bar ) {

// Only hide admin bar on frontend, not in admin.

if ( is_admin() ) {

return $show_admin_bar;

}

// Only hide for logged-in users.

if ( ! is_user_logged_in() ) {

return $show_admin_bar;

}

// Get current user's roles.

$user = wp_get_current_user();

if ( ! $user || empty( $user->roles ) ) {

return $show_admin_bar;

}

// Get RSA options to check which roles should have admin bar hidden.

if ( RSA_IS_NETWORK && 'enforce' === self::get_network_mode() ) {

$rsa_options = self::get_options( true );

} else {

$rsa_options = self::get_options();

}

$hide_admin_bar_roles = isset( $rsa_options['hide_admin_bar_roles'] ) ? (array) $rsa_options['hide_admin_bar_roles'] : array();

// Check if current user has any role that should hide admin bar.

foreach ( $user->roles as $role ) {

if ( in_array( $role, $hide_admin_bar_roles, true ) ) {

return false;

}

}

return $show_admin_bar;

}

/**

* Ajax handler for dismissing the network controlled settings notice.

*/

public static function ajax_notice_dismiss() {

// @codeCoverageIgnoreStart

if ( ! defined( 'PHP_UNIT_TESTS_ENV' ) ) {

if ( ! check_ajax_referer( 'rsa_admin_nonce', 'nonce', false ) ) {

wp_send_json_error();

exit;

}

if ( RSA_IS_NETWORK ) {

if ( ! is_super_admin() ) {

wp_send_json_error();

exit;

}

} else {

if ( ! current_user_can( 'manage_options' ) ) {

wp_send_json_error();

exit;

}

}

}

// @codeCoverageIgnoreEnd

if ( RSA_IS_NETWORK ) {

update_site_option( 'rsa_hide_page_cache_notice', true );

} else {

update_option( 'rsa_hide_page_cache_notice', true );

}

// @codeCoverageIgnoreStart

if ( ! defined( 'PHP_UNIT_TESTS_ENV' ) ) {

wp_send_json_success();

}

// @codeCoverageIgnoreEnd

}

/**

* Set RSA defaults for new site.

*

* @param int $blog_id Blog ID.

* @param int $user_id User ID.

* @param string $domain Site domain.

* @param string $path Site path.

* @param int $site_id Site ID. Only relevant on multi-network installs.

* @param array $meta Meta data. Used to set initial site options.

*/

public static function set_defaults( $blog_id, $user_id, $domain, $path, $site_id, $meta ) {

if ( 'enforce' === self::get_network_mode() ) {

return;

}

$network_options = self::get_options( true );

$blog_public = get_site_option( 'blog_public', 2 );

switch_to_blog( $blog_id );

update_option( 'rsa_options', self::sanitize_options( $network_options ) );

update_option( 'blog_public', (int) $blog_public );

restore_current_blog();

}

/**

* Populate Restricted_Site_Access::$fields with internationalization-ready field information.

*

* @codeCoverageIgnore

*/

protected static function populate_fields_array() {

self::$fields = array(

'approach' => array(

'default' => 1,

'label' => esc_html__( 'Handle restricted visitors', 'restricted-site-access' ),

'field' => 'settings_field_handling',

),

'message' => array(

'default' => esc_html_x( 'Access to this site is restricted.', 'default restriction message', 'restricted-site-access' ),

'label' => esc_html__( 'Restriction message', 'restricted-site-access' ),

'field' => 'settings_field_message',

),

'redirect_url' => array(

'default' => '',

'label' => esc_html__( 'Redirect web address', 'restricted-site-access' ),

'field' => 'settings_field_redirect',

),

'redirect_path' => array(

'default' => 0,

'label' => esc_html__( 'Redirect to same path', 'restricted-site-access' ),

'field' => 'settings_field_redirect_path',

),

'head_code' => array(

'default' => 302,

'label' => esc_html__( 'Redirection status code', 'restricted-site-access' ),

'field' => 'settings_field_redirect_code',

),

'page' => array(

'default' => 0,

'label' => esc_html__( 'Restricted notice page', 'restricted-site-access' ),

'field' => 'settings_field_rsa_page',

),

'allowed' => array(

'default' => array(),

'label' => esc_html__( 'Unrestricted IP addresses', 'restricted-site-access' ),

'field' => 'settings_field_allowed',

),

);

self::$always_visible_fields = array(

'hide_admin_bar_roles' => array(

'default' => array(),

'label' => esc_html__( 'Hide admin bar for roles', 'restricted-site-access' ),

'field' => 'settings_field_hide_admin_bar_roles',

),

);

}

/**

* Get the network mode from the RSA_NETWORK_MODE constant.

*

* @return string

*/

private static function get_config_network_mode() {

/**

* Get the network mode from the RSA_NETWORK_MODE constant.

* Only allow 'enforce' or 'default'.

*/

if ( defined( 'RSA_NETWORK_MODE' ) && in_array( RSA_NETWORK_MODE, array( 'enforce', 'default' ), true ) ) {

return RSA_NETWORK_MODE;

}

return '';

}

/**

* Get current plugin network mode

*/

private static function get_network_mode() {

/**

* Get the network mode from the RSA_NETWORK_MODE constant.

* Only allow 'enforce' or 'default'.

*/

$config_network_mode = self::get_config_network_mode();

if ( ! empty( $config_network_mode ) ) {

return $config_network_mode;

}

if ( RSA_IS_NETWORK ) {

return get_site_option( 'rsa_mode', 'default' );

}

return 'default';

}

/**

* Populate the option with defaults.

*

* @param boolean $network Whether this is a network install. Default false.

*/

public static function get_options( $network = false ) {

if ( $network ) {

$options = get_site_option( 'rsa_options', array() );

} else {

$options = get_option( 'rsa_options', array() );

}

// Populate fields if they are not set.

if ( is_null( self::$fields ) || is_null( self::$always_visible_fields ) ) {

self::populate_fields_array();

}

// Merge fields that should always be visible with the rest of the fields.

$all_fields = array_merge( self::$fields, self::$always_visible_fields );

// Fill in defaults where values aren't set.

foreach ( $all_fields as $field_name => $field_details ) {

if ( ! isset( $options[ $field_name ] ) ) {

$options[ $field_name ] = $field_details['default'];

}

}

return $options;

}

/**

* Determine if site should be restricted

*/

protected static function is_restricted() {

$mode = self::get_network_mode();

if ( RSA_IS_NETWORK ) {

if ( 'enforce' === $mode ) {

self::$rsa_options = self::get_options( true );

}

}

$blog_public = get_option( 'blog_public', 2 );

$user_check = self::user_can_access();

$checks = is_admin() || $user_check || 2 !== (int) $blog_public || ( defined( 'WP_INSTALLING' ) && isset( $_GET['key'] ) ); // phpcs:ignore WordPress.Security.NonceVerification

return ! $checks;

}

/**

* Check if current user has access.

*

* Can be short-circuited using the `restricted_site_access_user_can_access` filter

* to return a value other than null (boolean recommended).

*

* @return bool Whether the user has access

*/

protected static function user_can_access() {

/**

* Filters whether the user can access the site before any other checks.

*

* Returning a non-null value will short-circuit the function

* and return that value instead.

*

* @param null|bool $access Whether the user can access the site.

*/

$access = apply_filters( 'restricted_site_access_user_can_access', null );

if ( null !== $access ) {

return $access;

}

if ( is_multisite() ) {

$user_id = get_current_user_id();

if ( is_super_admin( $user_id ) ) {

return true;

}

if ( is_user_member_of_blog( $user_id ) && current_user_can( 'read' ) ) {

return true;

}

} elseif ( is_user_logged_in() ) {

return true;

}

return false;

}

/**

* Generates a cookie that is used to prevent redirection loops.

*

* @param string $url The current URL.

* @return string

*/

private static function generate_redirection_cookie( $url ) {

$cookie_value = sprintf(

'rsa_redirect:%1$s%2$s',

trailingslashit( $url ),

self::$redirection_nonce

);

$hash = md5( $cookie_value );

return $hash;

}

/**

* Returns the request URI of the current page.

*

* @param \WP $wp The WP instance object.

*

* @return boolean

*/

public static function get_request_uri( $wp ) {

if ( ! $wp instanceof \WP ) {

return '';

}

if ( $wp->request ) {

return $wp->request;

}

if ( isset( $_SERVER['REQUEST_URI'] ) ) {

$request_uri = filter_var( wp_unslash( $_SERVER['REQUEST_URI'] ), FILTER_SANITIZE_URL );

if ( false !== $request_uri ) {

return trim( $request_uri, '/' );

}

}

return '';

}

/**

* Redirects restricted requests.

*

* @param \WP $wp WordPress request.

* @codeCoverageIgnore

*/

public static function restrict_access( $wp ) {

$results = self::restrict_access_check( $wp );

// We do this because ` $wp->request` is defined for a multisite setup but not for a single site.

$request_uri = self::get_request_uri( $wp );

if ( is_array( $results ) && ! empty( $results ) ) {

/**

* This conditional prevents a redirect loop if the redirect URL

* belongs to the same domain.

*/

if ( 2 === self::$rsa_options['approach'] ) {

$redirect_url_without_scheme = trailingslashit( preg_replace( '(^https?://)', '', $results['url'] ) );

$current_url_without_scheme = trailingslashit( preg_replace( '(^https?://)', '', home_url( $request_uri ) ) );

$current_url_path = trailingslashit( (string) ( wp_parse_url( home_url( $request_uri ), PHP_URL_PATH ) ?? '' ) );

if ( ( $current_url_path === $redirect_url_without_scheme ) || ( $redirect_url_without_scheme === $current_url_without_scheme ) ) {

return;

}

$redirection_url_host = trailingslashit( (string) ( wp_parse_url( $results['url'], PHP_URL_HOST ) ?? '' ) );

$current_url_host = trailingslashit( (string) ( wp_parse_url( home_url( $request_uri ), PHP_URL_HOST ) ?? '' ) );

$cookie_path = wp_parse_url( home_url( '/' ), PHP_URL_PATH );

if ( $redirection_url_host === $current_url_host || '/' === $redirection_url_host ) {

if ( ! filter_var( $results['url'], FILTER_VALIDATE_URL ) ) {

$results['url'] = home_url( $results['url'] );

}

setcookie( 'wp-rsa_redirect', self::generate_redirection_cookie( $results['url'] ), 0, $cookie_path );

}

}

// Don't redirect during unit tests.

if ( ! empty( $results['url'] ) && ! defined( 'PHP_UNIT_TESTS_ENV' ) ) {

wp_redirect( $results['url'], $results['code'] ); // phpcs:ignore WordPress.Security.SafeRedirect.wp_redirect_wp_redirect

die();

}

// Don't die during unit tests.

if ( ! empty( $results['die_message'] ) && ! defined( 'PHP_UNIT_TESTS_ENV' ) ) {

wp_die( wp_kses_post( $results['die_message'] ), esc_html( $results['die_title'] ), array( 'response' => esc_html( $results['die_code'] ) ) );

}

}

}

/**

* Add nocache headers to the response if required.

*

* Add the nocache headers to the response if there is an IP allow list

* configured. This is to prevent the caching of restricted pages

* by caching plugins, CDNs or similar services.

*

* Runs on the `wp_headers` filter.

*

* @param array $headers The headers to be sent.

* @return array The headers to be sent, possibly with no-cache headers added.

*/

public static function maybe_add_no_cache_headers( $headers ) {

$options_ips = (array) self::get_options()['allowed'];

$config_ips = (array) self::get_config_ips();

$allowed_ips = array_merge( $options_ips, $config_ips );

if ( ! empty( $allowed_ips ) ) {

// Add no cache headers if there is an IP allow list.

$headers = array_merge( $headers, wp_get_nocache_headers() );

}

return $headers;

}

/**

* Determine whether page should be restricted at point of request.

*

* @param \WP $wp WordPress The main WP request.

* @return array List of URL and code, otherwise empty.

*/

public static function restrict_access_check( $wp ) {

self::$rsa_options = self::get_options();

$is_restricted = self::is_restricted();

// We do this because ` $wp->request` is defined for a multisite setup but not for a single site.

$request_uri = self::get_request_uri( $wp );

// Check to see if we're activating new user.

if ( 'wp-activate.php' === $request_uri ) {

return;

}

// Check to see if it's _not_ restricted.

if ( apply_filters( 'restricted_site_access_is_restricted', $is_restricted, $wp ) === false ) {

return;

}

$allowed_ips = self::get_config_ips();

if (

! empty( self::$rsa_options['allowed'] ) &&

is_array( self::$rsa_options['allowed'] )

) {

$allowed_ips = array_merge( $allowed_ips, self::$rsa_options['allowed'] );

}

// check for the allow list, if its empty block everything.

if ( count( $allowed_ips ) > 0 ) {

$remote_ip = self::get_client_ip_address();

// iterate through the allow list.

foreach ( $allowed_ips as $allowed_ip ) {

if ( $remote_ip && self::ip_in_range( $remote_ip, $allowed_ip ) ) {

/**

* Fires when an ip address match occurs.

*

* Enables adding session_start() to the IP check, ensuring Varnish type cache will

* not cache the request. Passes the matched line; previous to 6.1.0 this action passed

* the matched ip and mask.

*

* @since 6.0.2

*

* @param string $remote_ip The remote IP address being checked.

* @param string $allowed_ip The matched masked IP address.

*/

do_action( 'restrict_site_access_ip_match', $remote_ip, $allowed_ip );

return;

}

}

}

$rsa_restrict_approach = apply_filters( 'restricted_site_access_approach', self::$rsa_options['approach'] );

do_action( 'restrict_site_access_handling', $rsa_restrict_approach, $wp ); // allow users to hook handling.

switch ( $rsa_restrict_approach ) {

case 4: // Show them a page.

if ( ! empty( self::$rsa_options['page'] ) ) {

$page = get_post( self::$rsa_options['page'] );

// If the selected page isn't found or isn't published, fall back to default values.

if ( ! $page || 'publish' !== $page->post_status ) {

self::$rsa_options['head_code'] = 302;

$current_path = empty( $_SERVER['REQUEST_URI'] ) ? home_url() : sanitize_text_field( wp_unslash( $_SERVER['REQUEST_URI'] ) );

self::$rsa_options['redirect_url'] = wp_login_url( $current_path );

break;

}

// Are we already on the selected page?

$on_selected_page = false;

if ( isset( $wp->query_vars['page_id'] ) && absint( $wp->query_vars['page_id'] ) === $page->ID ) {

$on_selected_page = true;

}

if ( ! $on_selected_page && ( isset( $wp->query_vars['pagename'] ) && $wp->query_vars['pagename'] === $page->post_name ) ) {

$on_selected_page = true;

}

// There's a separate unpleasant conditional to match the page on front because of the way query vars are (not) filled at this point.

if ( $on_selected_page

||

(

empty( $wp->query_vars ) &&

'page' === get_option( 'show_on_front' ) &&

(int) get_option( 'page_on_front' ) === (int) self::$rsa_options['page']

)

) {

return;

}

self::$rsa_options['redirect_url'] = get_permalink( $page->ID );

break;

}

// Fall thru to case 3 if case 2 not handled.

case 3:

$message = self::$rsa_options['message'];

$message .= "\n<!-- protected by Restricted Site Access http://10up.com/plugins/restricted-site-access-wordpress/ -->";

$message = apply_filters( 'restricted_site_access_message', $message, $wp );

return array(

'die_message' => $message,

'die_title' => esc_html( get_bloginfo( 'name' ) ) . ' - Site Access Restricted',

'die_code' => 403,

);

case 2:

if ( ! empty( self::$rsa_options['redirect_url'] ) ) {

if ( ! empty( self::$rsa_options['redirect_path'] ) ) {

/**

* This conditional prevents a redirect loop if the redirect URL

* belongs to the same domain.

*/

// phpcs:ignore WordPress.Security.NonceVerification.Recommended

if ( isset( $_COOKIE['wp-rsa_redirect'] ) && self::generate_redirection_cookie( home_url( $request_uri ) ) === $_COOKIE['wp-rsa_redirect'] ) {

self::$rsa_options['redirect_url'] = home_url( $request_uri );

} else {

self::$rsa_options['redirect_url'] = untrailingslashit( self::$rsa_options['redirect_url'] ) . sanitize_text_field( wp_unslash( $_SERVER['REQUEST_URI'] ) );

}

}

break;

}

// No break, fall thru to default.

default:

self::validate_blog_access();

self::$rsa_options['head_code'] = 302;

$current_path = empty( $_SERVER['REQUEST_URI'] ) ? home_url() : sanitize_text_field( wp_unslash( $_SERVER['REQUEST_URI'] ) );

self::$rsa_options['redirect_url'] = wp_login_url( $current_path );

}

$redirect_url = apply_filters( 'restricted_site_access_redirect_url', self::$rsa_options['redirect_url'], $wp );

$redirect_code = apply_filters( 'restricted_site_access_head', self::$rsa_options['head_code'], $wp );

return array(

'url' => $redirect_url,

'code' => $redirect_code,

);

}

/**

* Ensure the user has access to the blog attempting to be accessed.

*

* This method borrows from core's _access_denied_splash() for multi-site installs.

*/

public static function validate_blog_access() {

if ( ! is_multisite() || ! is_user_logged_in() ) {

return;

}

if ( is_user_member_of_blog() || is_network_admin() ) {

return;

}

// We're logged in but not a member of this blog, let the user know.

$blogs = get_blogs_of_user( get_current_user_id() );

if ( wp_list_filter( $blogs, array( 'userblog_id' => get_current_blog_id() ) ) ) {

return;

}

$blog_name = get_bloginfo( 'name' );

if ( empty( $blogs ) ) {

// Translators: %1$s: The site name.

wp_die( sprintf( esc_html__( 'You attempted to access the "%1$s" site, but you do not currently have privileges on this site. If you believe you should be able to access the "%1$s" dashboard, please contact your network administrator.', 'restricted-site-access' ), esc_html( $blog_name ) ), 403 );

}

// Translators: %1$s: The site name.

$output = '<p>' . sprintf( esc_html__( 'You attempted to access the "%1$s", but you do not currently have privileges on this site. If you believe you should be able to access the "%1$s" dashboard, please contact your network administrator.', 'restricted-site-access' ), esc_html( $blog_name ) ) . '</p>';

$output .= '<p>' . esc_html__( 'If you reached this screen by accident and meant to visit one of your own sites, here are some shortcuts to help you find your way.', 'restricted-site-access' ) . '</p>';

$output .= '<h3>' . esc_html__( 'Your Sites', 'restricted-site-access' ) . '</h3>';

$output .= '<table>';

foreach ( $blogs as $blog ) {

$output .= '<tr>';

$output .= '<td>' . esc_html( $blog->blogname ) . '</td>';

$output .= '<td><a href="' . esc_url( get_admin_url( $blog->userblog_id ) ) . '">' . esc_html__( 'Visit Dashboard', 'restricted-site-access' ) . '</a> | ' .

'<a href="' . esc_url( $blog->siteurl ) . '">' . esc_html__( 'View Site', 'restricted-site-access' ) . '</a></td>';

$output .= '</tr>';

}

$output .= '</table>';

wp_die( wp_kses_post( $output ), 403 );

}

/**

* Admin only hooks

*/

public static function admin_init() {

// customize privacy message.

add_filter( 'privacy_on_link_text', array( __CLASS__, 'privacy_on_link_text' ) );

add_filter( 'privacy_on_link_title', array( __CLASS__, 'privacy_on_link_title' ) );

// customize privacy page.

add_action( 'load-options-' . self::$settings_page . '.php', array( __CLASS__, 'load_options_page' ) );

// add new choice for blog privacy.

add_action( 'blog_privacy_selector', array( __CLASS__, 'blog_privacy_selector' ) );

// settings for restricted site access.

register_setting( self::$settings_page, 'rsa_options', array( __CLASS__, 'sanitize_options' ) ); // array of fundamental options including ID and caching info.

add_settings_section( 'restricted-site-access', __( 'Restricted Site Access', 'restricted-site-access' ), array( __CLASS__, 'settings_section_restricted_site_access' ), self::$settings_page );

// Limit when additional settings fields show up.

if (

is_network_admin() || // Show on the network admin.

( RSA_IS_NETWORK && 'enforce' !== self::get_network_mode() ) || // Show on single (network) site when not enforced at the network level.

! RSA_IS_NETWORK // Show on single non-network sites.

) {

// Populate fields if they are not set.

if ( is_null( self::$fields ) ) {

self::populate_fields_array();

}

foreach ( self::$fields as $field_name => $field_data ) {

add_settings_field(

$field_name,

$field_data['label'],

array( __CLASS__, $field_data['field'] ),

self::$settings_page,

'restricted-site-access',

array( 'class' => 'rsa-setting rsa-setting_' . esc_attr( $field_data['field'] ) )

);

}

}

// Default classes for always visible fields.

$always_visible_field_default_classes = array( 'rsa-setting' );

if ( self::is_enforced() ) {

$always_visible_field_default_classes[] = 'option-site-visibility';

}

// Add settings fields that should always be visible.

add_settings_section( 'restricted-site-access-always-visible', '', '__return_empty_string', self::$settings_page );

// Populate fields if they are not set.

if ( is_null( self::$always_visible_fields ) ) {

self::populate_fields_array();

}

foreach ( self::$always_visible_fields as $field_name => $field_data ) {

// Add field to the section, along with the default classes.

$always_visible_field_classes = $always_visible_field_default_classes;

$always_visible_field_classes[] = 'rsa-setting_' . $field_data['field'];

add_settings_field(

$field_name,

$field_data['label'],

array( __CLASS__, $field_data['field'] ),

self::$settings_page,

'restricted-site-access-always-visible',

array( 'class' => esc_attr( implode( ' ', $always_visible_field_classes ) ) )

);

}

add_filter( 'plugin_action_links_' . self::$basename, array( __CLASS__, 'plugin_action_links' ) );

// This is for Network Site Settings.

if ( RSA_IS_NETWORK && is_network_admin() ) {

add_action( 'load-settings.php', array( __CLASS__, 'load_network_settings_page' ) );

add_action( 'network_admin_notices', array( __CLASS__, 'page_cache_notice' ) );

}

add_action( 'admin_notices', array( __CLASS__, 'page_cache_notice' ) );

}

/**

* Show a notice if the settings are enforced.

*/

public static function settings_section_restricted_site_access() {

if ( ! self::is_enforced() ) {

return;

}

if ( RSA_IS_NETWORK && 'enforce' === self::get_network_mode() ) {

$message = __( 'Restricted Site Access settings are currently enforced across all sites on the network.', 'restricted-site-access' );

} else {

$message = __( 'Restricted Site Access settings are currently enforced by code configuration.', 'restricted-site-access' );

}

?>

<div class="notice notice-warning inline">

<p><strong><?php echo esc_html( $message ); ?></strong></p>

</div>

<?php

}

/**

* Show RSA Settings in Network Settings

*/

public static function show_network_settings() {

$mode = self::get_network_mode();

$config_network_mode = self::get_config_network_mode();

$mode_css_class = empty( $config_network_mode ) ? '' : 'rsa-config-network-mode-enabled';

?>

<h2><?php esc_html_e( 'Restricted Site Access Settings', 'restricted-site-access' ); ?></h2>

<table id="restricted-site-access-mode" class="form-table">

<tr class="<?php echo esc_attr( $mode_css_class ); ?>">

<th scope="row"><?php esc_html_e( 'Mode', 'restricted-site-access' ); ?></th>

<td>

<fieldset>

<legend class="screen-reader-text"><?php esc_html_e( 'Mode', 'restricted-site-access' ); ?></legend>

<label><input name="rsa_mode" type="radio" id="rsa-mode-default" value="default"<?php checked( $mode, 'default' ); ?> /> <?php esc_html_e( 'Default to the settings below when creating a new site', 'restricted-site-access' ); ?></label><br />

<label><input name="rsa_mode" type="radio" id="rsa-mode-enforce" value="enforce"<?php checked( $mode, 'enforce' ); ?> /> <?php esc_html_e( 'Enforce the settings below across all sites', 'restricted-site-access' ); ?></label><br />

</fieldset>

</td>

</tr>

<?php if ( ! empty( $config_network_mode ) ) { ?>

<tr class="rsa-network-enforced-warning">

<td colspan="2">

<div class="notice notice-warning inline">

<p><strong><?php echo esc_html__( 'The mode is currently enforced by code configuration.', 'restricted-site-access' ); ?></strong></p>

</div>

</td>

</tr>

<?php } ?>

<tr class="option-site-visibility">

<th scope="row"><?php esc_html_e( 'Site Visibility', 'restricted-site-access' ); ?></th>

<?php

$blog_public = get_site_option( 'blog_public' );

if ( false === $blog_public ) {

$blog_public = 1;

}

?>

<td>

<fieldset>

<legend class="screen-reader-text"><span><?php esc_html_e( 'Site Visibility', 'restricted-site-access' ); ?></span></legend>

<input id="blog-public" type="radio" name="blog_public" value="1" <?php checked( $blog_public, '1' ); ?>>

<label for="blog-public"><?php esc_html_e( 'Allow search engines to index this site', 'restricted-site-access' ); ?></label><br>

<input id="blog-norobots" type="radio" name="blog_public" value="0" <?php checked( $blog_public, '0' ); ?>>

<label for="blog-norobots"><?php esc_html_e( 'Discourage search engines from indexing this site', 'restricted-site-access' ); ?></label>

<p class="description"><?php esc_html_e( 'Note: Neither of these options blocks access to your site — it is up to search engines to honor your request.', 'restricted-site-access' ); ?></p>

<p>

<input id="blog-restricted" type="radio" name="blog_public" value="2" <?php checked( $blog_public, '2' ); ?>>

<label for="blog-restricted"><?php esc_html_e( 'Restrict site access to visitors who are logged in or allowed by IP address', 'restricted-site-access' ); ?></label>

</p>

</fieldset>

</td>

</tr>

</table>

<?php

if ( ( defined( 'RSA_FORCE_RESTRICTION' ) && RSA_FORCE_RESTRICTION === true )

|| ( defined( 'RSA_FORBID_RESTRICTION' ) && RSA_FORBID_RESTRICTION === true ) ) {

$message = __( 'Site visibility settings are currently enforced by code configuration.', 'restricted-site-access' );

?>

<div class="notice notice-warning inline">

<p><strong><?php echo esc_html( $message ); ?></strong></p>

</div>

<?php } ?>

<table id="restricted-site-access" class="form-table">

<tr>

<th scope="row"><?php esc_html_e( 'Handle restricted visitors', 'restricted-site-access' ); ?></th>

<td>

<?php

self::settings_field_handling();

?>

</td>

</tr>

<tr>

<th scope="row"><?php esc_html_e( 'Redirect web address', 'restricted-site-access' ); ?></th>

<td>

<?php

self::settings_field_redirect();

?>

</td>