Changeset 3198971
- Timestamp:
- 11/28/2024 02:41:28 PM (16 months ago)
- Location:
- simple-restrict
- Files:
-
- 7 edited
- 2 copied
-
tags/1.2.8 (copied) (copied from simple-restrict/trunk)
-
tags/1.2.8/README.txt (modified) (2 diffs)
-
tags/1.2.8/includes/class-simple-restrict.php (modified) (11 diffs)
-
tags/1.2.8/public/class-simple-restrict-public.php (modified) (11 diffs)
-
tags/1.2.8/simple-restrict.php (copied) (copied from simple-restrict/trunk/simple-restrict.php) (2 diffs)
-
trunk/README.txt (modified) (2 diffs)
-
trunk/includes/class-simple-restrict.php (modified) (11 diffs)
-
trunk/public/class-simple-restrict-public.php (modified) (11 diffs)
-
trunk/simple-restrict.php (modified) (2 diffs)
Legend:
- Unmodified
- Added
- Removed
-
simple-restrict/tags/1.2.8/README.txt
r3116467 r3198971 3 3 Tags: restrict, hide, permission, authorization, restrict pages, hide pages, restrict content, hide content, user permission, page permission, user permissions, page 4 4 Requires at least: 3.4 5 Tested up to: 6. 66 Stable tag: 1.2. 75 Tested up to: 6.7 6 Stable tag: 1.2.8 7 7 License: GPLv2 or later 8 8 License URI: http://www.gnu.org/licenses/gpl-2.0.html … … 139 139 = 1.2.7 - 14.02.2024 = 140 140 Fixed: Security issue 141 142 = 1.2.8 - 28.11.2024 = 143 Fixed: Security issue -
simple-restrict/tags/1.2.8/includes/class-simple-restrict.php
r3035727 r3198971 29 29 */ 30 30 class Simple_Restrict { 31 31 32 32 33 33 /** … … 71 71 72 72 $this->simple_restrict = 'simple-restrict'; 73 $this->version = '1.0.0';73 $this->version = '1.2.8'; 74 74 75 75 $this->load_dependencies(); … … 77 77 $this->define_admin_hooks(); 78 78 $this->define_public_hooks(); 79 80 79 } 81 80 … … 102 101 * core plugin. 103 102 */ 104 require_once plugin_dir_path( dirname( __FILE__ )) . 'includes/class-simple-restrict-loader.php';103 require_once plugin_dir_path( __DIR__ ) . 'includes/class-simple-restrict-loader.php'; 105 104 106 105 /** … … 108 107 * of the plugin. 109 108 */ 110 require_once plugin_dir_path( dirname( __FILE__ )) . 'includes/class-simple-restrict-i18n.php';109 require_once plugin_dir_path( __DIR__ ) . 'includes/class-simple-restrict-i18n.php'; 111 110 112 111 /** 113 112 * The class responsible for defining all actions that occur in the admin area. 114 113 */ 115 require_once plugin_dir_path( dirname( __FILE__ )) . 'admin/class-simple-restrict-admin.php';114 require_once plugin_dir_path( __DIR__ ) . 'admin/class-simple-restrict-admin.php'; 116 115 117 116 /** … … 119 118 * side of the site. 120 119 */ 121 require_once plugin_dir_path( dirname( __FILE__ )) . 'public/class-simple-restrict-public.php';120 require_once plugin_dir_path( __DIR__ ) . 'public/class-simple-restrict-public.php'; 122 121 123 122 $this->loader = new Simple_Restrict_Loader(); 124 125 123 } 126 124 … … 138 136 $plugin_i18n = new Simple_Restrict_i18n(); 139 137 140 $this->loader->add_action( 'plugins_loaded', $plugin_i18n, 'load_plugin_textdomain' ); 141 138 $this->loader->add_action( 'init', $plugin_i18n, 'load_plugin_textdomain' ); 142 139 } 143 140 … … 169 166 $this->loader->add_action( 'personal_options_update', $plugin_admin, 'save_permission_checkboxes' ); 170 167 $this->loader->add_action( 'edit_user_profile_update', $plugin_admin, 'save_permission_checkboxes' ); 171 168 172 169 // Add plugin settings menu 173 170 $this->loader->add_action( 'admin_menu', $plugin_admin, 'custom_admin_menu' ); 174 171 175 // Register new admin settings with WordPress and add them to the settings page 172 // Register new admin settings with WordPress and add them to the settings page 176 173 $this->loader->add_action( 'admin_init', $plugin_admin, 'simple_restrict_admin_init' ); 177 174 178 175 $this->loader->add_action( 'manage_users_columns', $plugin_admin, 'add_permissions_column', 10, 1 ); 179 176 $this->loader->add_action( 'manage_users_custom_column', $plugin_admin, 'show_permissions_column_content', 10, 3 ); … … 181 178 $this->loader->add_action( 'user_new_form', $plugin_admin, 'user_new_form_function' ); 182 179 $this->loader->add_action( 'user_register', $plugin_admin, 'save_custom_user_profile_fields' ); 183 184 180 } 185 181 … … 200 196 // Check permissions and restrict content if necessary (call with wp hook instead of init hook so we can access post ID for all pages including homepage) 201 197 $this->loader->add_action( 'wp', $plugin_public, 'restrict_content' ); 202 198 203 199 $this->loader->add_action( 'init', $plugin_public, 'get_taxonomy_terms_object_array' ); 204 200 205 201 $this->loader->add_action( 'wp_enqueue_scripts', $plugin_public, 'enqueue_styles' ); 206 202 $this->loader->add_action( 'wp_enqueue_scripts', $plugin_public, 'enqueue_scripts' ); 207 203 $this->loader->add_filter( 'rest_prepare_page', $plugin_public, 'rest_restrict', 30, 3 ); 208 204 $this->loader->add_action( 'pre_get_posts', $plugin_public, 'posts_args_search', 90, 1 ); 209 205 } 210 206 … … 248 244 return $this->version; 249 245 } 250 251 246 } -
simple-restrict/tags/1.2.8/public/class-simple-restrict-public.php
r3035727 r3198971 1 1 <?php 2 3 2 /** 4 3 * The public-facing functionality of the plugin. … … 47 46 * Initialize the class and set its properties. 48 47 * 49 * @param string 50 * @param string 48 * @param string $simple_restrict The name of the plugin. 49 * @param string $version The version of this plugin. 51 50 * 52 51 * @since 1.0.0 … … 107 106 'order' => 'ASC', 108 107 ); 109 //echo('taxonomy = '.$taxonomy);110 108 $this->taxonomy_terms_object_array = get_terms( $taxonomy, $term_args ); 111 109 } 112 110 113 // Also defined in class-simple-restrict-admin.php111 // Also defined in class-simple-restrict-admin.php. 114 112 public function define_initial_variables() { 115 $this->generic_restricted_message = __( "Sorry, this content is restricted to users who are logged in with the correct permissions.", 'simple-restrict' );113 $this->generic_restricted_message = __( 'Sorry, this content is restricted to users who are logged in with the correct permissions.', 'simple-restrict' ); 116 114 } 117 115 … … 127 125 128 126 129 // Restrict content of specific page(s) 127 /** 128 * Restrict content of specific page(s). 129 * 130 * @param string $content The content of the page. 131 * @return string 132 */ 130 133 public function restrict_content( $content ) { 131 // We must prefix 'simple-restrict' to all the user metas (to not conflict with WordPress existing metas) 132 $current_user_permissions = array(); // User permissions will be prefixed by default 133 $current_page_permissions = array(); // Page permissions are user-defined, so we prefix them manually in next array 134 $current_page_permissions_prefixed = array(); // This array will prefix each of the page permissions 135 136 $postID = get_the_ID(); 137 //echo('$postID' . $postID); 138 139 //echo("<br />Current page's permissions:<br />"); 140 // Create an array of the current page's permissions 141 $page_terms_list = wp_get_post_terms( $postID, 'simple-restrict-permission', array( "fields" => "all" ) ); 134 // We must prefix 'simple-restrict' to all the user metas (to not conflict with WordPress existing metas). 135 $current_user_permissions = array(); // User permissions will be prefixed by default. 136 $current_page_permissions = array(); // Page permissions are user-defined, so we prefix them manually in next array. 137 $current_page_permissions_prefixed = array(); // This array will prefix each of the page permissions. 138 139 $post_id = get_the_ID(); 140 // Create an array of the current page's permissions. 141 $page_terms_list = wp_get_post_terms( $post_id, 'simple-restrict-permission', array( 'fields' => 'all' ) ); 142 142 foreach ( $page_terms_list as $current_term ) { 143 143 if ( ! in_array( $current_term->slug, $current_page_permissions, true ) ) { … … 146 146 array_push( $current_page_permissions, $current_term->slug ); 147 147 array_push( $current_page_permissions_prefixed, $current_term_slug_prefixed ); 148 //print_r($current_page_permissions_prefixed); 149 } 150 } 151 // Debug 152 /* 153 foreach($current_page_permissions as $current_page_permission) { 154 echo('Page permission: '.$current_page_permission.'<br />'); 155 } 156 foreach($current_page_permissions_prefixed as $current_page_permission) { 157 echo('Page permission prefixed: '.$current_page_permission.'<br />'); 158 } 159 */ 160 161 // If the page has no permissions required, show the content and don't bother checking user 148 } 149 } 150 151 // If the page has no permissions required, show the content and don't bother checking user. 162 152 if ( empty( $current_page_permissions ) ) { 163 153 return $content; 164 // Otherwise check the user to see if it's permissions match the page's permissions 154 // Otherwise check the user to see if it's permissions match the page's permissions. 165 155 } else { 166 //echo("<br />Current user's permissions:<br />"); 167 // Create an array of the current user's permissions by cycling through all possible page permissions and putting any matches into user permissions array 156 // Create an array of the current user's permissions by cycling through all possible page permissions and putting any matches into user permissions array. 168 157 $current_user_id = get_current_user_id(); 169 //echo('$current_user_id: ' . $current_user_id); 170 // Only populate user permissions if this is a registered user, otherwise leave permissions array empty 158 // Only populate user permissions if this is a registered user, otherwise leave permissions array empty. 171 159 if ( $current_user_id != 0 ) { 172 160 foreach ( $this->taxonomy_terms_object_array as $taxonomy_object ) { 173 161 $taxonomy_slug = $taxonomy_object->slug; 174 162 $taxonomy_slug_prefixed = 'simple-restrict-' . $taxonomy_slug; 175 //echo('$taxonomy_slug_prefixed ' . $taxonomy_slug_prefixed); 176 if ( esc_attr( get_the_author_meta( $taxonomy_slug_prefixed, $current_user_id ) ) == "yes" ) { 177 // Only add to array if it wasn't already there ($current_user_permissions values are always prefixed) 163 if ( 'yes' === esc_attr( get_the_author_meta( $taxonomy_slug_prefixed, $current_user_id ) ) ) { 164 // Only add to array if it wasn't already there ($current_user_permissions values are always prefixed). 178 165 if ( ! in_array( $taxonomy_slug_prefixed, $current_user_permissions, true ) ) { 179 166 array_push( $current_user_permissions, $taxonomy_slug_prefixed ); … … 182 169 } 183 170 } 184 // Debug 185 /* 186 foreach($current_user_permissions as $current_user_permission) { 187 echo('User permission: '.$current_user_permission.'<br />'); 188 } 189 */ 190 191 $user_defined_restricted_message = esc_attr( get_option( 'simple_restrict_setting_one' ) ); 192 $user_defined_restricted_message = get_option( 'simple_restrict_setting_one' ); 171 193 172 $simple_restrict_setting_redirect = get_option( 'simple_restrict_setting_redirect' ); 194 // If the user's permissions don't match any of the page's permissions 173 // If the user's permissions don't match any of the page's permissions. 195 174 if ( ! array_intersect( $current_page_permissions_prefixed, $current_user_permissions ) ) { 196 // Redirect to login or display message 175 // Redirect to login or display message. 197 176 if ( isset( $simple_restrict_setting_redirect ) && ( $simple_restrict_setting_redirect == 1 ) ) { 198 header( "Location: /wp-login.php?redirect_to=" . $_SERVER['REQUEST_URI'] );177 header( 'Location: /wp-login.php?redirect_to=' . $_SERVER['REQUEST_URI'] ); // phpcs:ignore 199 178 exit; 200 179 } else { … … 202 181 } 203 182 } else { 204 // Otherwise show the regular content because it is restricted but the user has the permission 205 // (Note that $content is empty so below does nothing, and our script simply ends without a restriction) 183 // Otherwise show the regular content because it is restricted but the user has the permission. 184 // (Note that $content is empty so below does nothing, and our script simply ends without a restriction). 206 185 return $content; 207 186 } … … 212 191 * Restrict content of specific page(s) for REST API 213 192 * 214 * @param string 215 * @param string$post The post object.216 * @param string 193 * @param string $response The response object. 194 * @param object $post The post object. 195 * @param string $request The request object. 217 196 * 218 197 * @since 1.0.0 219 198 */ 220 199 public function rest_restrict( $response, $post, $request ) { 221 // If this is an admin page, don't restrict content 200 // If this is an admin page, don't restrict content. 222 201 if ( is_admin() ) { 223 202 return $response; 224 203 } 225 204 226 // We must prefix 'simple-restrict' to all the user metas (to not conflict with WordPress existing metas) 227 $current_page_permissions = array(); // Page permissions are user-defined, so we prefix them manually in next array 228 $post ID= $post->ID;229 // Create an array of the current page's permissions 230 $page_terms_list = wp_get_post_terms( $post ID, 'simple-restrict-permission', array( 'fields' => 'all' ) );205 // We must prefix 'simple-restrict' to all the user metas (to not conflict with WordPress existing metas). 206 $current_page_permissions = array(); // Page permissions are user-defined, so we prefix them manually in next array. 207 $post_id = $post->ID; 208 // Create an array of the current page's permissions. 209 $page_terms_list = wp_get_post_terms( $post_id, 'simple-restrict-permission', array( 'fields' => 'all' ) ); 231 210 foreach ( $page_terms_list as $current_term ) { 232 211 if ( ! in_array( $current_term->slug, $current_page_permissions, true ) ) { … … 235 214 } 236 215 237 // If the page has no permissions required, show the content and don't bother checking user 216 // If the page has no permissions required, show the content and don't bother checking user. 238 217 if ( empty( $current_page_permissions ) ) { 239 218 return $response; 240 // Otherwise check the user to see if it's permissions match the page's permissions 219 // Otherwise check the user to see if it's permissions match the page's permissions. 241 220 } else { 242 221 // Check if the user has the required permissions. … … 246 225 247 226 // Send a 403 error if the content is restricted. 248 // @todo: What can be done here is to check the request for the user's permissions and then send a 403 error if the user doesn't have the required permissions.249 // @todo: else return the content 227 // @todo: What can be done here is to check the request for the user's permissions and then send a 403 error if the user doesn't have the required permissions. 228 // @todo: else return the content. 250 229 wp_send_json_error( __( 'Sorry, this content is restricted', 'simple-restrict' ), 403 ); 251 230 … … 253 232 } 254 233 } 234 235 /** 236 * Get all restricted pages 237 * 238 * @since 1.2.8 239 */ 240 public function get_all_restricted_pages() { 241 $terms = get_terms( 'simple-restrict-permission' ); 242 $restricted_pages = array(); 243 $restricted_pages_ids = array(); 244 $args = array( 245 'post_type' => 'page', 246 'posts_per_page' => -1, 247 'tax_query' => array( 248 array( 249 'taxonomy' => 'simple-restrict-permission', 250 'field' => 'slug', 251 'terms' => wp_list_pluck( $terms, 'slug' ), 252 ), 253 ), 254 ); 255 $restricted_pages = get_posts( $args ); 256 $current_user_id = 0; 257 if ( is_user_logged_in() ) { 258 $current_user_id = get_current_user_id(); 259 } 260 if ( ! empty( $restricted_pages ) ) { 261 foreach ( $restricted_pages as $page ) { 262 // Check if the user is logged in and has the required permissions. 263 if ( 0 !== $current_user_id ) { 264 // Get the page's permissions. 265 $terms = wp_get_post_terms( $page->ID, 'simple-restrict-permission', array( 'fields' => 'all' ) ); 266 foreach ( $terms as $taxonomy_object ) { 267 $taxonomy_slug = $taxonomy_object->slug; 268 $taxonomy_slug_prefixed = 'simple-restrict-' . $taxonomy_slug; 269 // If the user has the required permissions, allow access. 270 if ( 'yes' === esc_attr( get_the_author_meta( $taxonomy_slug_prefixed, $current_user_id ) ) ) { 271 $access = true; 272 } else { 273 $access = false; 274 } 275 } 276 } else { // User not logged in, so restrict access. 277 $access = false; 278 } 279 280 if ( ! $access ) { 281 $restricted_pages_ids[] = $page->ID; 282 } 283 } 284 } 285 286 return $restricted_pages_ids; 287 } 288 289 /** 290 * Restrict search results 291 * 292 * @param object $query The query object. 293 * 294 * @since 1.2.8 295 */ 296 public function posts_args_search( $query ) { 297 298 if ( ! $query->is_search ) { 299 return; 300 } 301 // Check if it's a pages query. 302 $post_type_query = $query->get( 'post_type' ); 303 if ( '' !== $post_type_query && ( ( is_array( $post_type_query ) && ! in_array( 'page', $post_type_query, true ) ) || ( is_string( $post_type_query ) && 'page' !== $post_type_query ) ) ) { 304 return; 305 } 306 307 // Check if it's a search query or a REST request. 308 if ( ( ! is_admin() ) || ( defined( 'REST_REQUEST' ) && REST_REQUEST && isset( $query->query_vars['s'] ) ) ) { 309 // Remove the filter to avoid infinite loop. 310 remove_filter( 'pre_get_posts', array( $this, 'posts_args_search' ), 90 ); 311 $excluded_post_ids = $this->get_all_restricted_pages(); 312 // Add the filter back, as the request for the restricted pages is done. 313 add_filter( 'pre_get_posts', array( $this, 'posts_args_search' ), 90, 1 ); 314 $query->set( 'post__not_in', $excluded_post_ids ); 315 316 } 317 } 255 318 } -
simple-restrict/tags/1.2.8/simple-restrict.php
r3121456 r3198971 16 16 * Plugin Name: Simple Restrict 17 17 * Description: Restrict pages based on permissions assigned to pages and granted in user profiles. 18 * Version: 1.2. 718 * Version: 1.2.8 19 19 * Author: WPChill 20 20 * Author URI: https://wpchill.com … … 24 24 * Tested up to: 6.6 25 25 * Domain Path: /languages 26 * 27 * 28 * Original Plugin URI: http://www.awakensolutions.com/simple-restrict/ 29 * Original Author URI: http://www.awakensolutions.com 30 * Original Author: Awaken Solutions Inc. 31 * Awaken Solutions Inc. has transferred ownership to WPChill on: 10th of February, 2024. 26 32 */ 27 33 -
simple-restrict/trunk/README.txt
r3116467 r3198971 3 3 Tags: restrict, hide, permission, authorization, restrict pages, hide pages, restrict content, hide content, user permission, page permission, user permissions, page 4 4 Requires at least: 3.4 5 Tested up to: 6. 66 Stable tag: 1.2. 75 Tested up to: 6.7 6 Stable tag: 1.2.8 7 7 License: GPLv2 or later 8 8 License URI: http://www.gnu.org/licenses/gpl-2.0.html … … 139 139 = 1.2.7 - 14.02.2024 = 140 140 Fixed: Security issue 141 142 = 1.2.8 - 28.11.2024 = 143 Fixed: Security issue -
simple-restrict/trunk/includes/class-simple-restrict.php
r3035727 r3198971 29 29 */ 30 30 class Simple_Restrict { 31 31 32 32 33 33 /** … … 71 71 72 72 $this->simple_restrict = 'simple-restrict'; 73 $this->version = '1.0.0';73 $this->version = '1.2.8'; 74 74 75 75 $this->load_dependencies(); … … 77 77 $this->define_admin_hooks(); 78 78 $this->define_public_hooks(); 79 80 79 } 81 80 … … 102 101 * core plugin. 103 102 */ 104 require_once plugin_dir_path( dirname( __FILE__ )) . 'includes/class-simple-restrict-loader.php';103 require_once plugin_dir_path( __DIR__ ) . 'includes/class-simple-restrict-loader.php'; 105 104 106 105 /** … … 108 107 * of the plugin. 109 108 */ 110 require_once plugin_dir_path( dirname( __FILE__ )) . 'includes/class-simple-restrict-i18n.php';109 require_once plugin_dir_path( __DIR__ ) . 'includes/class-simple-restrict-i18n.php'; 111 110 112 111 /** 113 112 * The class responsible for defining all actions that occur in the admin area. 114 113 */ 115 require_once plugin_dir_path( dirname( __FILE__ )) . 'admin/class-simple-restrict-admin.php';114 require_once plugin_dir_path( __DIR__ ) . 'admin/class-simple-restrict-admin.php'; 116 115 117 116 /** … … 119 118 * side of the site. 120 119 */ 121 require_once plugin_dir_path( dirname( __FILE__ )) . 'public/class-simple-restrict-public.php';120 require_once plugin_dir_path( __DIR__ ) . 'public/class-simple-restrict-public.php'; 122 121 123 122 $this->loader = new Simple_Restrict_Loader(); 124 125 123 } 126 124 … … 138 136 $plugin_i18n = new Simple_Restrict_i18n(); 139 137 140 $this->loader->add_action( 'plugins_loaded', $plugin_i18n, 'load_plugin_textdomain' ); 141 138 $this->loader->add_action( 'init', $plugin_i18n, 'load_plugin_textdomain' ); 142 139 } 143 140 … … 169 166 $this->loader->add_action( 'personal_options_update', $plugin_admin, 'save_permission_checkboxes' ); 170 167 $this->loader->add_action( 'edit_user_profile_update', $plugin_admin, 'save_permission_checkboxes' ); 171 168 172 169 // Add plugin settings menu 173 170 $this->loader->add_action( 'admin_menu', $plugin_admin, 'custom_admin_menu' ); 174 171 175 // Register new admin settings with WordPress and add them to the settings page 172 // Register new admin settings with WordPress and add them to the settings page 176 173 $this->loader->add_action( 'admin_init', $plugin_admin, 'simple_restrict_admin_init' ); 177 174 178 175 $this->loader->add_action( 'manage_users_columns', $plugin_admin, 'add_permissions_column', 10, 1 ); 179 176 $this->loader->add_action( 'manage_users_custom_column', $plugin_admin, 'show_permissions_column_content', 10, 3 ); … … 181 178 $this->loader->add_action( 'user_new_form', $plugin_admin, 'user_new_form_function' ); 182 179 $this->loader->add_action( 'user_register', $plugin_admin, 'save_custom_user_profile_fields' ); 183 184 180 } 185 181 … … 200 196 // Check permissions and restrict content if necessary (call with wp hook instead of init hook so we can access post ID for all pages including homepage) 201 197 $this->loader->add_action( 'wp', $plugin_public, 'restrict_content' ); 202 198 203 199 $this->loader->add_action( 'init', $plugin_public, 'get_taxonomy_terms_object_array' ); 204 200 205 201 $this->loader->add_action( 'wp_enqueue_scripts', $plugin_public, 'enqueue_styles' ); 206 202 $this->loader->add_action( 'wp_enqueue_scripts', $plugin_public, 'enqueue_scripts' ); 207 203 $this->loader->add_filter( 'rest_prepare_page', $plugin_public, 'rest_restrict', 30, 3 ); 208 204 $this->loader->add_action( 'pre_get_posts', $plugin_public, 'posts_args_search', 90, 1 ); 209 205 } 210 206 … … 248 244 return $this->version; 249 245 } 250 251 246 } -
simple-restrict/trunk/public/class-simple-restrict-public.php
r3035727 r3198971 1 1 <?php 2 3 2 /** 4 3 * The public-facing functionality of the plugin. … … 47 46 * Initialize the class and set its properties. 48 47 * 49 * @param string 50 * @param string 48 * @param string $simple_restrict The name of the plugin. 49 * @param string $version The version of this plugin. 51 50 * 52 51 * @since 1.0.0 … … 107 106 'order' => 'ASC', 108 107 ); 109 //echo('taxonomy = '.$taxonomy);110 108 $this->taxonomy_terms_object_array = get_terms( $taxonomy, $term_args ); 111 109 } 112 110 113 // Also defined in class-simple-restrict-admin.php111 // Also defined in class-simple-restrict-admin.php. 114 112 public function define_initial_variables() { 115 $this->generic_restricted_message = __( "Sorry, this content is restricted to users who are logged in with the correct permissions.", 'simple-restrict' );113 $this->generic_restricted_message = __( 'Sorry, this content is restricted to users who are logged in with the correct permissions.', 'simple-restrict' ); 116 114 } 117 115 … … 127 125 128 126 129 // Restrict content of specific page(s) 127 /** 128 * Restrict content of specific page(s). 129 * 130 * @param string $content The content of the page. 131 * @return string 132 */ 130 133 public function restrict_content( $content ) { 131 // We must prefix 'simple-restrict' to all the user metas (to not conflict with WordPress existing metas) 132 $current_user_permissions = array(); // User permissions will be prefixed by default 133 $current_page_permissions = array(); // Page permissions are user-defined, so we prefix them manually in next array 134 $current_page_permissions_prefixed = array(); // This array will prefix each of the page permissions 135 136 $postID = get_the_ID(); 137 //echo('$postID' . $postID); 138 139 //echo("<br />Current page's permissions:<br />"); 140 // Create an array of the current page's permissions 141 $page_terms_list = wp_get_post_terms( $postID, 'simple-restrict-permission', array( "fields" => "all" ) ); 134 // We must prefix 'simple-restrict' to all the user metas (to not conflict with WordPress existing metas). 135 $current_user_permissions = array(); // User permissions will be prefixed by default. 136 $current_page_permissions = array(); // Page permissions are user-defined, so we prefix them manually in next array. 137 $current_page_permissions_prefixed = array(); // This array will prefix each of the page permissions. 138 139 $post_id = get_the_ID(); 140 // Create an array of the current page's permissions. 141 $page_terms_list = wp_get_post_terms( $post_id, 'simple-restrict-permission', array( 'fields' => 'all' ) ); 142 142 foreach ( $page_terms_list as $current_term ) { 143 143 if ( ! in_array( $current_term->slug, $current_page_permissions, true ) ) { … … 146 146 array_push( $current_page_permissions, $current_term->slug ); 147 147 array_push( $current_page_permissions_prefixed, $current_term_slug_prefixed ); 148 //print_r($current_page_permissions_prefixed); 149 } 150 } 151 // Debug 152 /* 153 foreach($current_page_permissions as $current_page_permission) { 154 echo('Page permission: '.$current_page_permission.'<br />'); 155 } 156 foreach($current_page_permissions_prefixed as $current_page_permission) { 157 echo('Page permission prefixed: '.$current_page_permission.'<br />'); 158 } 159 */ 160 161 // If the page has no permissions required, show the content and don't bother checking user 148 } 149 } 150 151 // If the page has no permissions required, show the content and don't bother checking user. 162 152 if ( empty( $current_page_permissions ) ) { 163 153 return $content; 164 // Otherwise check the user to see if it's permissions match the page's permissions 154 // Otherwise check the user to see if it's permissions match the page's permissions. 165 155 } else { 166 //echo("<br />Current user's permissions:<br />"); 167 // Create an array of the current user's permissions by cycling through all possible page permissions and putting any matches into user permissions array 156 // Create an array of the current user's permissions by cycling through all possible page permissions and putting any matches into user permissions array. 168 157 $current_user_id = get_current_user_id(); 169 //echo('$current_user_id: ' . $current_user_id); 170 // Only populate user permissions if this is a registered user, otherwise leave permissions array empty 158 // Only populate user permissions if this is a registered user, otherwise leave permissions array empty. 171 159 if ( $current_user_id != 0 ) { 172 160 foreach ( $this->taxonomy_terms_object_array as $taxonomy_object ) { 173 161 $taxonomy_slug = $taxonomy_object->slug; 174 162 $taxonomy_slug_prefixed = 'simple-restrict-' . $taxonomy_slug; 175 //echo('$taxonomy_slug_prefixed ' . $taxonomy_slug_prefixed); 176 if ( esc_attr( get_the_author_meta( $taxonomy_slug_prefixed, $current_user_id ) ) == "yes" ) { 177 // Only add to array if it wasn't already there ($current_user_permissions values are always prefixed) 163 if ( 'yes' === esc_attr( get_the_author_meta( $taxonomy_slug_prefixed, $current_user_id ) ) ) { 164 // Only add to array if it wasn't already there ($current_user_permissions values are always prefixed). 178 165 if ( ! in_array( $taxonomy_slug_prefixed, $current_user_permissions, true ) ) { 179 166 array_push( $current_user_permissions, $taxonomy_slug_prefixed ); … … 182 169 } 183 170 } 184 // Debug 185 /* 186 foreach($current_user_permissions as $current_user_permission) { 187 echo('User permission: '.$current_user_permission.'<br />'); 188 } 189 */ 190 191 $user_defined_restricted_message = esc_attr( get_option( 'simple_restrict_setting_one' ) ); 192 $user_defined_restricted_message = get_option( 'simple_restrict_setting_one' ); 171 193 172 $simple_restrict_setting_redirect = get_option( 'simple_restrict_setting_redirect' ); 194 // If the user's permissions don't match any of the page's permissions 173 // If the user's permissions don't match any of the page's permissions. 195 174 if ( ! array_intersect( $current_page_permissions_prefixed, $current_user_permissions ) ) { 196 // Redirect to login or display message 175 // Redirect to login or display message. 197 176 if ( isset( $simple_restrict_setting_redirect ) && ( $simple_restrict_setting_redirect == 1 ) ) { 198 header( "Location: /wp-login.php?redirect_to=" . $_SERVER['REQUEST_URI'] );177 header( 'Location: /wp-login.php?redirect_to=' . $_SERVER['REQUEST_URI'] ); // phpcs:ignore 199 178 exit; 200 179 } else { … … 202 181 } 203 182 } else { 204 // Otherwise show the regular content because it is restricted but the user has the permission 205 // (Note that $content is empty so below does nothing, and our script simply ends without a restriction) 183 // Otherwise show the regular content because it is restricted but the user has the permission. 184 // (Note that $content is empty so below does nothing, and our script simply ends without a restriction). 206 185 return $content; 207 186 } … … 212 191 * Restrict content of specific page(s) for REST API 213 192 * 214 * @param string 215 * @param string$post The post object.216 * @param string 193 * @param string $response The response object. 194 * @param object $post The post object. 195 * @param string $request The request object. 217 196 * 218 197 * @since 1.0.0 219 198 */ 220 199 public function rest_restrict( $response, $post, $request ) { 221 // If this is an admin page, don't restrict content 200 // If this is an admin page, don't restrict content. 222 201 if ( is_admin() ) { 223 202 return $response; 224 203 } 225 204 226 // We must prefix 'simple-restrict' to all the user metas (to not conflict with WordPress existing metas) 227 $current_page_permissions = array(); // Page permissions are user-defined, so we prefix them manually in next array 228 $post ID= $post->ID;229 // Create an array of the current page's permissions 230 $page_terms_list = wp_get_post_terms( $post ID, 'simple-restrict-permission', array( 'fields' => 'all' ) );205 // We must prefix 'simple-restrict' to all the user metas (to not conflict with WordPress existing metas). 206 $current_page_permissions = array(); // Page permissions are user-defined, so we prefix them manually in next array. 207 $post_id = $post->ID; 208 // Create an array of the current page's permissions. 209 $page_terms_list = wp_get_post_terms( $post_id, 'simple-restrict-permission', array( 'fields' => 'all' ) ); 231 210 foreach ( $page_terms_list as $current_term ) { 232 211 if ( ! in_array( $current_term->slug, $current_page_permissions, true ) ) { … … 235 214 } 236 215 237 // If the page has no permissions required, show the content and don't bother checking user 216 // If the page has no permissions required, show the content and don't bother checking user. 238 217 if ( empty( $current_page_permissions ) ) { 239 218 return $response; 240 // Otherwise check the user to see if it's permissions match the page's permissions 219 // Otherwise check the user to see if it's permissions match the page's permissions. 241 220 } else { 242 221 // Check if the user has the required permissions. … … 246 225 247 226 // Send a 403 error if the content is restricted. 248 // @todo: What can be done here is to check the request for the user's permissions and then send a 403 error if the user doesn't have the required permissions.249 // @todo: else return the content 227 // @todo: What can be done here is to check the request for the user's permissions and then send a 403 error if the user doesn't have the required permissions. 228 // @todo: else return the content. 250 229 wp_send_json_error( __( 'Sorry, this content is restricted', 'simple-restrict' ), 403 ); 251 230 … … 253 232 } 254 233 } 234 235 /** 236 * Get all restricted pages 237 * 238 * @since 1.2.8 239 */ 240 public function get_all_restricted_pages() { 241 $terms = get_terms( 'simple-restrict-permission' ); 242 $restricted_pages = array(); 243 $restricted_pages_ids = array(); 244 $args = array( 245 'post_type' => 'page', 246 'posts_per_page' => -1, 247 'tax_query' => array( 248 array( 249 'taxonomy' => 'simple-restrict-permission', 250 'field' => 'slug', 251 'terms' => wp_list_pluck( $terms, 'slug' ), 252 ), 253 ), 254 ); 255 $restricted_pages = get_posts( $args ); 256 $current_user_id = 0; 257 if ( is_user_logged_in() ) { 258 $current_user_id = get_current_user_id(); 259 } 260 if ( ! empty( $restricted_pages ) ) { 261 foreach ( $restricted_pages as $page ) { 262 // Check if the user is logged in and has the required permissions. 263 if ( 0 !== $current_user_id ) { 264 // Get the page's permissions. 265 $terms = wp_get_post_terms( $page->ID, 'simple-restrict-permission', array( 'fields' => 'all' ) ); 266 foreach ( $terms as $taxonomy_object ) { 267 $taxonomy_slug = $taxonomy_object->slug; 268 $taxonomy_slug_prefixed = 'simple-restrict-' . $taxonomy_slug; 269 // If the user has the required permissions, allow access. 270 if ( 'yes' === esc_attr( get_the_author_meta( $taxonomy_slug_prefixed, $current_user_id ) ) ) { 271 $access = true; 272 } else { 273 $access = false; 274 } 275 } 276 } else { // User not logged in, so restrict access. 277 $access = false; 278 } 279 280 if ( ! $access ) { 281 $restricted_pages_ids[] = $page->ID; 282 } 283 } 284 } 285 286 return $restricted_pages_ids; 287 } 288 289 /** 290 * Restrict search results 291 * 292 * @param object $query The query object. 293 * 294 * @since 1.2.8 295 */ 296 public function posts_args_search( $query ) { 297 298 if ( ! $query->is_search ) { 299 return; 300 } 301 // Check if it's a pages query. 302 $post_type_query = $query->get( 'post_type' ); 303 if ( '' !== $post_type_query && ( ( is_array( $post_type_query ) && ! in_array( 'page', $post_type_query, true ) ) || ( is_string( $post_type_query ) && 'page' !== $post_type_query ) ) ) { 304 return; 305 } 306 307 // Check if it's a search query or a REST request. 308 if ( ( ! is_admin() ) || ( defined( 'REST_REQUEST' ) && REST_REQUEST && isset( $query->query_vars['s'] ) ) ) { 309 // Remove the filter to avoid infinite loop. 310 remove_filter( 'pre_get_posts', array( $this, 'posts_args_search' ), 90 ); 311 $excluded_post_ids = $this->get_all_restricted_pages(); 312 // Add the filter back, as the request for the restricted pages is done. 313 add_filter( 'pre_get_posts', array( $this, 'posts_args_search' ), 90, 1 ); 314 $query->set( 'post__not_in', $excluded_post_ids ); 315 316 } 317 } 255 318 } -
simple-restrict/trunk/simple-restrict.php
r3121456 r3198971 16 16 * Plugin Name: Simple Restrict 17 17 * Description: Restrict pages based on permissions assigned to pages and granted in user profiles. 18 * Version: 1.2. 718 * Version: 1.2.8 19 19 * Author: WPChill 20 20 * Author URI: https://wpchill.com … … 24 24 * Tested up to: 6.6 25 25 * Domain Path: /languages 26 * 27 * 28 * Original Plugin URI: http://www.awakensolutions.com/simple-restrict/ 29 * Original Author URI: http://www.awakensolutions.com 30 * Original Author: Awaken Solutions Inc. 31 * Awaken Solutions Inc. has transferred ownership to WPChill on: 10th of February, 2024. 26 32 */ 27 33
Note: See TracChangeset
for help on using the changeset viewer.