Edit File by line

update_user_meta( $user_ID, 'default_password_nag', false );

[500] Fix | Delete

}

[501] Fix | Delete

}

[502] Fix | Delete

[503] Fix | Delete

/**

[504] Fix | Delete

* @since 2.8.0

[505] Fix | Delete

[506] Fix | Delete

* @param int $user_ID

[507] Fix | Delete

* @param WP_User $old_data

[508] Fix | Delete

[509] Fix | Delete

function default_password_nag_edit_user( $user_ID, $old_data ) {

[510] Fix | Delete

// Short-circuit it.

[511] Fix | Delete

if ( ! get_user_option( 'default_password_nag', $user_ID ) ) {

[512] Fix | Delete

return;

[513] Fix | Delete

}

[514] Fix | Delete

[515] Fix | Delete

$new_data = get_userdata( $user_ID );

[516] Fix | Delete

[517] Fix | Delete

// Remove the nag if the password has been changed.

[518] Fix | Delete

if ( $new_data->user_pass !== $old_data->user_pass ) {

[519] Fix | Delete

delete_user_setting( 'default_password_nag' );

[520] Fix | Delete

update_user_meta( $user_ID, 'default_password_nag', false );

[521] Fix | Delete

}

[522] Fix | Delete

}

[523] Fix | Delete

[524] Fix | Delete

/**

[525] Fix | Delete

* @since 2.8.0

[526] Fix | Delete

[527] Fix | Delete

* @global string $pagenow The filename of the current screen.

[528] Fix | Delete

[529] Fix | Delete

function default_password_nag() {

[530] Fix | Delete

global $pagenow;

[531] Fix | Delete

[532] Fix | Delete

// Short-circuit it.

[533] Fix | Delete

if ( 'profile.php' === $pagenow || ! get_user_option( 'default_password_nag' ) ) {

[534] Fix | Delete

return;

[535] Fix | Delete

}

[536] Fix | Delete

[537] Fix | Delete

$default_password_nag_message = sprintf(

[538] Fix | Delete

'<p><strong>%1$s</strong> %2$s</p>',

[539] Fix | Delete

__( 'Notice:' ),

[540] Fix | Delete

__( 'You are using the auto-generated password for your account. Would you like to change it?' )

[541] Fix | Delete

);

[542] Fix | Delete

$default_password_nag_message .= sprintf(

[543] Fix | Delete

'<p><a href="%1$s">%2$s</a> | ',

[544] Fix | Delete

esc_url( get_edit_profile_url() . '#password' ),

[545] Fix | Delete

__( 'Yes, take me to my profile page' )

[546] Fix | Delete

);

[547] Fix | Delete

$default_password_nag_message .= sprintf(

[548] Fix | Delete

'<a href="%1$s" id="default-password-nag-no">%2$s</a></p>',

[549] Fix | Delete

'?default_password_nag=0',

[550] Fix | Delete

__( 'No thanks, do not remind me again' )

[551] Fix | Delete

);

[552] Fix | Delete

[553] Fix | Delete

wp_admin_notice(

[554] Fix | Delete

$default_password_nag_message,

[555] Fix | Delete

array(

[556] Fix | Delete

'additional_classes' => array( 'error', 'default-password-nag' ),

[557] Fix | Delete

'paragraph_wrap' => false,

[558] Fix | Delete

)

[559] Fix | Delete

);

[560] Fix | Delete

}

[561] Fix | Delete

[562] Fix | Delete

/**

[563] Fix | Delete

* @since 3.5.0

[564] Fix | Delete

* @access private

[565] Fix | Delete

[566] Fix | Delete

function delete_users_add_js() {

[567] Fix | Delete

[568] Fix | Delete

[569] Fix | Delete

jQuery( function($) {

[570] Fix | Delete

var submit = $('#submit').prop('disabled', true);

[571] Fix | Delete

$('input[name="delete_option"]').one('change', function() {

[572] Fix | Delete

submit.prop('disabled', false);

[573] Fix | Delete

});

[574] Fix | Delete

$('#reassign_user').focus( function() {

[575] Fix | Delete

$('#delete_option1').prop('checked', true).trigger('change');

[576] Fix | Delete

});

[577] Fix | Delete

} );

[578] Fix | Delete

</script>

[579] Fix | Delete

<?php

[580] Fix | Delete

}

[581] Fix | Delete

[582] Fix | Delete

/**

[583] Fix | Delete

* Optional SSL preference that can be turned on by hooking to the 'personal_options' action.

[584] Fix | Delete

[585] Fix | Delete

* See the {@see 'personal_options'} action.

[586] Fix | Delete

[587] Fix | Delete

* @since 2.7.0

[588] Fix | Delete

[589] Fix | Delete

* @param WP_User $user User data object.

[590] Fix | Delete

[591] Fix | Delete

function use_ssl_preference( $user ) {

[592] Fix | Delete

[593] Fix | Delete

[594] Fix | Delete

[595] Fix | Delete

[596] Fix | Delete

</tr>

[597] Fix | Delete

<?php

[598] Fix | Delete

}

[599] Fix | Delete

[600] Fix | Delete

/**

[601] Fix | Delete

* @since MU (3.0.0)

[602] Fix | Delete

[603] Fix | Delete

* @param string $text

[604] Fix | Delete

* @return string

[605] Fix | Delete

[606] Fix | Delete

function admin_created_user_email( $text ) {

[607] Fix | Delete

$roles = get_editable_roles();

[608] Fix | Delete

$role = $roles[ $_REQUEST['role'] ];

[609] Fix | Delete

[610] Fix | Delete

if ( '' !== get_bloginfo( 'name' ) ) {

[611] Fix | Delete

$site_title = wp_specialchars_decode( get_bloginfo( 'name' ), ENT_QUOTES );

[612] Fix | Delete

} else {

[613] Fix | Delete

$site_title = parse_url( home_url(), PHP_URL_HOST );

[614] Fix | Delete

}

[615] Fix | Delete

[616] Fix | Delete

return sprintf(

[617] Fix | Delete

/* translators: 1: Site title, 2: Site URL, 3: User role. */

[618] Fix | Delete

__(

[619] Fix | Delete

'Hi,

[620] Fix | Delete

You\'ve been invited to join \'%1$s\' at

[621] Fix | Delete

%2$s with the role of %3$s.

[622] Fix | Delete

If you do not want to join this site please ignore

[623] Fix | Delete

this email. This invitation will expire in a few days.

[624] Fix | Delete

[625] Fix | Delete

Please click the following link to activate your user account:

[626] Fix | Delete

%%s'

[627] Fix | Delete

[628] Fix | Delete

$site_title,

[629] Fix | Delete

home_url(),

[630] Fix | Delete

wp_specialchars_decode( translate_user_role( $role['name'] ) )

[631] Fix | Delete

);

[632] Fix | Delete

}

[633] Fix | Delete

[634] Fix | Delete

/**

[635] Fix | Delete

* Checks if the Authorize Application Password request is valid.

[636] Fix | Delete

[637] Fix | Delete

* @since 5.6.0

[638] Fix | Delete

* @since 6.2.0 Allow insecure HTTP connections for the local environment.

[639] Fix | Delete

* @since 6.3.2 Validates the success and reject URLs to prevent `javascript` pseudo protocol from being executed.

[640] Fix | Delete

[641] Fix | Delete

* @param array $request {

[642] Fix | Delete

* The array of request data. All arguments are optional and may be empty.

[643] Fix | Delete

[644] Fix | Delete

* @type string $app_name The suggested name of the application.

[645] Fix | Delete

* @type string $app_id A UUID provided by the application to uniquely identify it.

[646] Fix | Delete

* @type string $success_url The URL the user will be redirected to after approving the application.

[647] Fix | Delete

* @type string $reject_url The URL the user will be redirected to after rejecting the application.

[648] Fix | Delete

* }

[649] Fix | Delete

* @param WP_User $user The user authorizing the application.

[650] Fix | Delete

* @return true|WP_Error True if the request is valid, a WP_Error object contains errors if not.

[651] Fix | Delete

[652] Fix | Delete

function wp_is_authorize_application_password_request_valid( $request, $user ) {

[653] Fix | Delete

$error = new WP_Error();

[654] Fix | Delete

[655] Fix | Delete

if ( isset( $request['success_url'] ) ) {

[656] Fix | Delete

$validated_success_url = wp_is_authorize_application_redirect_url_valid( $request['success_url'] );

[657] Fix | Delete

if ( is_wp_error( $validated_success_url ) ) {

[658] Fix | Delete

$error->add(

[659] Fix | Delete

$validated_success_url->get_error_code(),

[660] Fix | Delete

$validated_success_url->get_error_message()

[661] Fix | Delete

);

[662] Fix | Delete

}

[663] Fix | Delete

}

[664] Fix | Delete

[665] Fix | Delete

if ( isset( $request['reject_url'] ) ) {

[666] Fix | Delete

$validated_reject_url = wp_is_authorize_application_redirect_url_valid( $request['reject_url'] );

[667] Fix | Delete

if ( is_wp_error( $validated_reject_url ) ) {

[668] Fix | Delete

$error->add(

[669] Fix | Delete

$validated_reject_url->get_error_code(),

[670] Fix | Delete

$validated_reject_url->get_error_message()

[671] Fix | Delete

);

[672] Fix | Delete

}

[673] Fix | Delete

}

[674] Fix | Delete

[675] Fix | Delete

if ( ! empty( $request['app_id'] ) && ! wp_is_uuid( $request['app_id'] ) ) {

[676] Fix | Delete

$error->add(

[677] Fix | Delete

'invalid_app_id',

[678] Fix | Delete

__( 'The application ID must be a UUID.' )

[679] Fix | Delete

);

[680] Fix | Delete

}

[681] Fix | Delete

[682] Fix | Delete

/**

[683] Fix | Delete

* Fires before application password errors are returned.

[684] Fix | Delete

[685] Fix | Delete

* @since 5.6.0

[686] Fix | Delete

[687] Fix | Delete

* @param WP_Error $error The error object.

[688] Fix | Delete

* @param array $request The array of request data.

[689] Fix | Delete

* @param WP_User $user The user authorizing the application.

[690] Fix | Delete

[691] Fix | Delete

do_action( 'wp_authorize_application_password_request_errors', $error, $request, $user );

[692] Fix | Delete

[693] Fix | Delete

if ( $error->has_errors() ) {

[694] Fix | Delete

return $error;

[695] Fix | Delete

}

[696] Fix | Delete

[697] Fix | Delete

return true;

[698] Fix | Delete

}

[699] Fix | Delete

[700] Fix | Delete

/**

[701] Fix | Delete

* Validates the redirect URL protocol scheme. The protocol can be anything except `http` and `javascript`.

[702] Fix | Delete

[703] Fix | Delete

* @since 6.3.2

[704] Fix | Delete

[705] Fix | Delete

* @param string $url The redirect URL to be validated.

[706] Fix | Delete

* @return true|WP_Error True if the redirect URL is valid, a WP_Error object otherwise.

[707] Fix | Delete

[708] Fix | Delete

function wp_is_authorize_application_redirect_url_valid( $url ) {

[709] Fix | Delete

$bad_protocols = array( 'javascript', 'data' );

[710] Fix | Delete

if ( empty( $url ) ) {

[711] Fix | Delete

return true;

[712] Fix | Delete

}

[713] Fix | Delete

[714] Fix | Delete

// Based on https://www.rfc-editor.org/rfc/rfc2396#section-3.1

[715] Fix | Delete

$valid_scheme_regex = '/^[a-zA-Z][a-zA-Z0-9+.-]*:/';

[716] Fix | Delete

if ( ! preg_match( $valid_scheme_regex, $url ) ) {

[717] Fix | Delete

return new WP_Error(

[718] Fix | Delete

'invalid_redirect_url_format',

[719] Fix | Delete

__( 'Invalid URL format.' )

[720] Fix | Delete

);

[721] Fix | Delete

}

[722] Fix | Delete

[723] Fix | Delete

/**

[724] Fix | Delete

* Filters the list of invalid protocols used in applications redirect URLs.

[725] Fix | Delete

[726] Fix | Delete

* @since 6.3.2

[727] Fix | Delete

[728] Fix | Delete

* @param string[] $bad_protocols Array of invalid protocols.

[729] Fix | Delete

* @param string $url The redirect URL to be validated.

[730] Fix | Delete

[731] Fix | Delete

$invalid_protocols = apply_filters( 'wp_authorize_application_redirect_url_invalid_protocols', $bad_protocols, $url );

[732] Fix | Delete

$invalid_protocols = array_map( 'strtolower', $invalid_protocols );

[733] Fix | Delete

[734] Fix | Delete

$scheme = wp_parse_url( $url, PHP_URL_SCHEME );

[735] Fix | Delete

$host = wp_parse_url( $url, PHP_URL_HOST );

[736] Fix | Delete

$is_local = 'local' === wp_get_environment_type();

[737] Fix | Delete

[738] Fix | Delete

// Validates if the proper URI format is applied to the URL.

[739] Fix | Delete

if ( empty( $host ) || empty( $scheme ) || in_array( strtolower( $scheme ), $invalid_protocols, true ) ) {

[740] Fix | Delete

return new WP_Error(

[741] Fix | Delete

'invalid_redirect_url_format',

[742] Fix | Delete

__( 'Invalid URL format.' )

[743] Fix | Delete

);

[744] Fix | Delete

}

[745] Fix | Delete

[746] Fix | Delete

if ( 'http' === $scheme && ! $is_local ) {

[747] Fix | Delete

return new WP_Error(

[748] Fix | Delete

'invalid_redirect_scheme',

[749] Fix | Delete

__( 'The URL must be served over a secure connection.' )

[750] Fix | Delete

);

[751] Fix | Delete

}

[752] Fix | Delete

[753] Fix | Delete

return true;

[754] Fix | Delete

}

[755] Fix | Delete

[756] Fix | Delete