From 5e7f10c861d0b15d01ebf41a8977b5c48df3e816 Mon Sep 17 00:00:00 2001 From: Ivan Lopez Date: Thu, 27 Sep 2018 15:59:34 -0400 Subject: [PATCH 1/4] add option screen to control what email domains can be added to specific roles --- 10up-experience.php | 1 + includes/admin-pages.php | 2 + includes/limit-roles.php | 201 +++++++++++++++++++++++++++++++++++++++ 3 files changed, 204 insertions(+) create mode 100644 includes/limit-roles.php diff --git a/10up-experience.php b/10up-experience.php index 7bd8fb2..3c80409 100644 --- a/10up-experience.php +++ b/10up-experience.php @@ -19,6 +19,7 @@ require_once __DIR__ . '/includes/admin-pages.php'; require_once __DIR__ . '/includes/plugins.php'; require_once __DIR__ . '/includes/rest-api.php'; +require_once __DIR__ . '/includes/limit-roles.php'; require_once __DIR__ . '/vendor/plugin-update-checker/plugin-update-checker.php'; diff --git a/includes/admin-pages.php b/includes/admin-pages.php index 2012118..8140b84 100644 --- a/includes/admin-pages.php +++ b/includes/admin-pages.php @@ -12,6 +12,8 @@ */ function register_admin_pages() { add_submenu_page( null, esc_html__( 'About 10up', 'tenup' ), esc_html__( 'About 10up', 'tenup' ), 'edit_posts', '10up-about', __NAMESPACE__ . '\main_screen' ); + + add_submenu_page( 'users.php', esc_html__( '10up Limit Roles', 'tenup' ), esc_html__( '10up Limit Roles', 'tenup' ), 'edit_users', '10up-limit-roles', __NAMESPACE__ . '\limit_role_screen' ); } add_action( 'admin_menu', __NAMESPACE__ . '\register_admin_pages' ); diff --git a/includes/limit-roles.php b/includes/limit-roles.php new file mode 100644 index 0000000..63e00d6 --- /dev/null +++ b/includes/limit-roles.php @@ -0,0 +1,201 @@ +add( 'invalid_email', sprintf( __( 'ERROR: Sorry, that email is not allowed to have the %s role.' ), esc_html( $role ) ) ); + } +} + +add_action( 'user_profile_update_errors', __NAMESPACE__ . '\confirm_user_email_is_not_whitelisted', 10, 3 ); + +/** + * Confirm that the users email and role are whitelisted before allowing + * them to be added to a blog + * + * @param $boolean + * @param $user_id + * @param $role + * @param $blog_id + * + * @return bool + */ +function confirm_user_email_is_not_whitelisted_add_to_blog( $boolean, $user_id, $role, $blog_id ) { + + $user = get_user_by( 'id', $user_id ); + $boolean = can_create_user( $user, $role ); + + return $boolean; +} + +add_filter( 'can_add_user_to_blog', __NAMESPACE__ . '\confirm_user_email_is_not_whitelisted_add_to_blog' ); + +/** + * Register limit role settings + */ +function limit_roles_settings() { + + register_setting( + 'tenup_limit_role_fields', + 'tenup_limit_roles', + __NAMESPACE__ . '\sanitize_options' + ); + + add_settings_section( + 'limit_roles', + '', + '__return_false', + '10up-limit-roles' + ); + + add_settings_field( + 'whitelisted_domains', + __( 'Whitelisted domains', 'tenup' ), + __NAMESPACE__ . '\domain_text_area', + '10up-limit-roles', + 'limit_roles' + ); + + add_settings_field( + 'roles', + __( 'Roles', 'tenup' ), + __NAMESPACE__ . '\roles_checkbox', + '10up-limit-roles', + 'limit_roles' + ); +} + +add_action( 'admin_init', __NAMESPACE__ . '\limit_roles_settings' ); + +/** + * output domain text area + */ +function domain_text_area() { + $options = get_option( 'tenup_limit_roles', array() ); + $value = ! empty( $options['whitelisted-domains'] ) ? $options['whitelisted-domains'] : ''; + printf( '', esc_textarea( $value ) ); + printf( '

%s

', esc_html__( 'Enter each domain you would like to whitelist on a new line.', 'tenup' ) ); +} + +/** + * output list of roles available on the site + */ +function roles_checkbox() { + $options = get_option( 'tenup_limit_roles', array() ); + $selected_roles = ! empty( $options['roles'] ) ? array_flip( $options['roles'] ) : array(); + echo ''; + + printf( '

%s

', esc_html__( 'Select each role you would like to be limited to the whitelist domains.', 'tenup' ) ); +} + +/** + * Sanitize limit roles settings + * + * @param $input + * + * @return array + */ +function sanitize_options( $input ) { + if ( ! empty( $input['whitelisted-domains'] ) ) { + $input['whitelisted-domains'] = wp_kses_post( $input['whitelisted-domains'] ); + } + + if ( ! empty( $input['roles'] ) && is_array( $input['roles'] ) ) { + $roles = array(); + foreach ( $input['roles'] as $role ) { + $roles[] = sanitize_text_field( $role ); + } + $input['roles'] = $roles; + } + + return $input; +} + +/** + * Output limit role screens + */ +function limit_role_screen() { + ?> +
+ +

+

+ +
+ +
+
+ user_email ), '@' . strtolower( trim( $email ) ) ) ) { + $can_create = false; + } else { + //users email does match a whitelisted one lets stop checking + $can_create = true; + break; + } + } + } + + return $can_create; +} \ No newline at end of file From 9806dcaeb6eff8ca972394181329f9b8c67fb6a8 Mon Sep 17 00:00:00 2001 From: Ivan Lopez Date: Thu, 27 Sep 2018 16:33:51 -0400 Subject: [PATCH 2/4] update filter params --- includes/limit-roles.php | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/includes/limit-roles.php b/includes/limit-roles.php index 63e00d6..95a5d19 100644 --- a/includes/limit-roles.php +++ b/includes/limit-roles.php @@ -48,7 +48,7 @@ function confirm_user_email_is_not_whitelisted_add_to_blog( $boolean, $user_id, return $boolean; } -add_filter( 'can_add_user_to_blog', __NAMESPACE__ . '\confirm_user_email_is_not_whitelisted_add_to_blog' ); +add_filter( 'can_add_user_to_blog', __NAMESPACE__ . '\confirm_user_email_is_not_whitelisted_add_to_blog', 10, 4 ); /** * Register limit role settings @@ -173,6 +173,7 @@ function limit_role_screen() { function can_create_user( $user, $role ) { $can_create = true; $options = get_option( 'tenup_limit_roles' ); + if ( empty( $options ) || empty( $options['whitelisted-domains'] ) ) { return $can_create; } From 99a8d06c72e36c85e1b17ea7a4cdb18393049eda Mon Sep 17 00:00:00 2001 From: Ivan Lopez Date: Fri, 28 Sep 2018 10:48:40 -0400 Subject: [PATCH 3/4] PHPCS updates --- includes/limit-roles.php | 41 +++++++++++++++++++++------------------- 1 file changed, 22 insertions(+), 19 deletions(-) diff --git a/includes/limit-roles.php b/includes/limit-roles.php index 95a5d19..c733e35 100644 --- a/includes/limit-roles.php +++ b/includes/limit-roles.php @@ -11,9 +11,9 @@ * Confirm that the new users email and role are whitelisted if not throw * and error * - * @param $error - * @param $update - * @param $user + * @param \WP_Error $error Errors object to add any custom errors to + * @param boolean $update true if updating an existing user, false if saving a new user + * @param \WP_User $user User object for user being edited */ function confirm_user_email_is_not_whitelisted( $error, $update, $user ) { @@ -23,6 +23,8 @@ function confirm_user_email_is_not_whitelisted( $error, $update, $user ) { if ( ! $can_create ) { $editable_roles = get_editable_roles(); $role = isset( $editable_roles[ $new_role ] ) ? $editable_roles[ $new_role ]['name'] : 'empty'; + + /* translators: %s is a placeholder for the current role trying to be assigned to a user */ $error->add( 'invalid_email', sprintf( __( 'ERROR: Sorry, that email is not allowed to have the %s role.' ), esc_html( $role ) ) ); } } @@ -33,10 +35,11 @@ function confirm_user_email_is_not_whitelisted( $error, $update, $user ) { * Confirm that the users email and role are whitelisted before allowing * them to be added to a blog * - * @param $boolean - * @param $user_id - * @param $role - * @param $blog_id + * @param bool|WP_Error $boolean True if the user should be added to the site, false + * or error object otherwise. + * @param int $user_id User ID. + * @param string $role User role. + * @param int $blog_id Site ID. * * @return bool */ @@ -88,7 +91,7 @@ function limit_roles_settings() { add_action( 'admin_init', __NAMESPACE__ . '\limit_roles_settings' ); /** - * output domain text area + * Output domain text area */ function domain_text_area() { $options = get_option( 'tenup_limit_roles', array() ); @@ -98,7 +101,7 @@ function domain_text_area() { } /** - * output list of roles available on the site + * Output list of roles available on the site */ function roles_checkbox() { $options = get_option( 'tenup_limit_roles', array() ); @@ -109,7 +112,7 @@ function roles_checkbox() { foreach ( $editable_roles as $role => $details ) { $name = translate_user_role( $details['name'] ); $checked = isset( $selected_roles[ $role ] ) ? 'checked' : ''; - printf( '
    • ', esc_attr( $role ), esc_html( $name ), $checked ); + printf( '
    • ', esc_attr( $role ), esc_html( $name ), esc_attr( $checked ) ); } echo ''; @@ -120,7 +123,7 @@ function roles_checkbox() { /** * Sanitize limit roles settings * - * @param $input + * @param array $input List of settings getting saved * * @return array */ @@ -165,8 +168,8 @@ function limit_role_screen() { * Validate that the provided users email is allowed to be * used for the selected role * - * @param $user - * @param $role + * @param \WP_User $user User that is trying to get updated or added + * @param string $role The role the user is trying to be assigned * * @return bool */ @@ -178,20 +181,20 @@ function can_create_user( $user, $role ) { return $can_create; } - //whitelisted emails + // whitelisted emails $emails = explode( PHP_EOL, $options['whitelisted-domains'] ); - //roles to be checked + // roles to be checked $roles = array_flip( $options['roles'] ); - //if current user is trying to be assigned a limited role + // if current user is trying to be assigned a limited role if ( isset( $roles[ $role ] ) && is_array( $emails ) ) { foreach ( $emails as $email ) { - //users email is does not match a whitelisted one + // users email is does not match a whitelisted one if ( false === strpos( strtolower( $user->user_email ), '@' . strtolower( trim( $email ) ) ) ) { $can_create = false; } else { - //users email does match a whitelisted one lets stop checking + // users email does match a whitelisted one lets stop checking $can_create = true; break; } @@ -199,4 +202,4 @@ function can_create_user( $user, $role ) { } return $can_create; -} \ No newline at end of file +} From e68d739f03ea3724cc27e47531d79377e7a2543d Mon Sep 17 00:00:00 2001 From: Ivan Lopez Date: Mon, 8 Oct 2018 10:57:28 -0400 Subject: [PATCH 4/4] Update description labels and fix php notice --- includes/limit-roles.php | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-) diff --git a/includes/limit-roles.php b/includes/limit-roles.php index c733e35..ec23e7e 100644 --- a/includes/limit-roles.php +++ b/includes/limit-roles.php @@ -17,15 +17,18 @@ */ function confirm_user_email_is_not_whitelisted( $error, $update, $user ) { - $new_role = sanitize_text_field( $_POST['role'] ); - $can_create = can_create_user( $user, $new_role ); + $new_role = sanitize_text_field( $_POST['role'] ); + $email = sanitize_text_field( $_POST['email'] ); + $email_domain = substr( strrchr( $email, '@' ), 1 ); + $can_create = can_create_user( $user, $new_role ); if ( ! $can_create ) { $editable_roles = get_editable_roles(); $role = isset( $editable_roles[ $new_role ] ) ? $editable_roles[ $new_role ]['name'] : 'empty'; + $edit_link = sprintf( '%s', esc_url( admin_url( 'users.php?page=10up-limit-roles' ) ), esc_html__( 'update your whitelisted domains', 'tenup' ) ); /* translators: %s is a placeholder for the current role trying to be assigned to a user */ - $error->add( 'invalid_email', sprintf( __( 'ERROR: Sorry, that email is not allowed to have the %s role.' ), esc_html( $role ) ) ); + $error->add( 'invalid_email', sprintf( __( 'ERROR: Sorry, the domain "%1$s" is ineligible for the %2$s role. Please %3$s or talk to an Administrator.', 'tenup' ), esc_html( $email_domain ), esc_html( $role ), $edit_link ) ); } } @@ -81,7 +84,7 @@ function limit_roles_settings() { add_settings_field( 'roles', - __( 'Roles', 'tenup' ), + __( 'Role(s)', 'tenup' ), __NAMESPACE__ . '\roles_checkbox', '10up-limit-roles', 'limit_roles' @@ -96,8 +99,8 @@ function limit_roles_settings() { function domain_text_area() { $options = get_option( 'tenup_limit_roles', array() ); $value = ! empty( $options['whitelisted-domains'] ) ? $options['whitelisted-domains'] : ''; - printf( '', esc_textarea( $value ) ); - printf( '

    %s

    ', esc_html__( 'Enter each domain you would like to whitelist on a new line.', 'tenup' ) ); + printf( '', esc_textarea( $value ) ); + printf( '

    %s

    ', esc_html__( 'Enter each domain on a new line.', 'tenup' ) ); } /** @@ -116,8 +119,6 @@ function roles_checkbox() { } echo ''; - - printf( '

    %s

    ', esc_html__( 'Select each role you would like to be limited to the whitelist domains.', 'tenup' ) ); } /** @@ -151,7 +152,7 @@ function limit_role_screen() {

    -

    +