isEnabledForRequest() ) { return; } //Let the user disable all redirects in wp-config.php. $allRedirectsDisabled = defined('AME_DISABLE_REDIRECTS') && constant('AME_DISABLE_REDIRECTS'); if ( !$allRedirectsDisabled ) { //Login redirect. add_filter('login_redirect', [$this, 'filterLoginRedirect'], self::FILTER_PRIORITY, 3); //Logout redirect. We might need to also use the "wp_logout" action if something bypasses wp-login.php. add_filter('logout_redirect', [$this, 'filterLogoutRedirect'], self::FILTER_PRIORITY, 3); //Registration redirect. This happens after the user is created but before the user logs in. add_filter('registration_redirect', [$this, 'filterRegistrationRedirect'], self::FILTER_PRIORITY, 1); //Let other components, like the "[ame-user-info]" shortcode, know which user is being redirected. //This is necessary because WP doesn't set the global user object when performing some redirects. add_filter('admin_menu_editor-redirected_user', [$this, 'provideRedirectedUser']); } if ( is_admin() ) { $this->searchUsersAction = Action::builder('ws-ame-rui-search-users') ->requiredParam('term', Action::PARSE_STRING) ->method('get') ->permissionCallback([$this, 'userCanSearchUsers']) ->handler([$this, 'ajaxSearchUsers']) ->register(); add_action('admin_menu_editor-load_tab-' . $this->tabSlug, [$this, 'addContextualHelp']); $this->localTabStyles['ame-redirector-ui-css'] = 'redirector.css'; } } /** * Get the redirect that best matches the given trigger and user. * * When there are multiple redirects that could apply in this context, only the redirect * with the highest priority will be returned. * * @param string $trigger * @param WP_User $user * @return Option */ protected function getBestRedirectFor($trigger, WP_User $user) { $redirectsForTrigger = $this->getRedirects()->filterByTrigger($trigger); if ( empty($redirectsForTrigger) ) { return None::getInstance(); } $actors = $this->getUserActors($user); //Redirects should already be sorted by priority, so we can just return the first match. foreach ($redirectsForTrigger as $redirect) { if ( array_key_exists($redirect->getActorId(), $actors) ) { return new Some($redirect); } } return None::getInstance(); } /** * @param WP_User|null $user * @return array */ protected function getUserActors(WP_User $user) { $actorIds = [self::DEFAULT_SETTING_ACTOR_ID => true]; //The "default" setting applies to every user. if ( !isset($user) ) { return $actorIds; } if ( isset($user->user_login) ) { $actorIds['user:' . $user->user_login] = true; } if ( isset($user->roles) && is_array($user->roles) ) { foreach ($user->roles as $roleId) { $actorIds['role:' . $roleId] = true; } } if ( is_multisite() && is_super_admin($user) ) { $actorIds['special:super_admin'] = true; } return $actorIds; } /** * @return RedirectCollection */ protected function getRedirects() { if ( $this->redirects !== null ) { return $this->redirects; } $settings = $this->loadSettings(); if ( isset($settings['redirects']) ) { $this->redirects = RedirectCollection::fromDbFormat($settings['redirects']); } else { $this->redirects = new RedirectCollection(); } return $this->redirects; } public function saveSettings() { if ( isset($this->redirects) ) { $this->loadSettings(); $this->settings['redirects'] = $this->redirects->toDbFormat(); } parent::saveSettings(); } /** * @param string $redirectTo * @param string $requestedRedirectTo * @param WP_User|WP_Error $user * @return string * @noinspection PhpUnusedParameterInspection The parameters are defined by the hook and can't be changed. */ public function filterLoginRedirect($redirectTo, $requestedRedirectTo = '', $user = null) { //TODO: If there are no "first login" settings for this user, apply the regular login redirect. if ( $this->checkFirstLogin($user) ) { $trigger = Triggers::FIRST_LOGIN; } else { $trigger = Triggers::LOGIN; } return $this->filterRedirect($trigger, $redirectTo, $requestedRedirectTo, $user); } public function filterLogoutRedirect($redirectTo, $requestedRedirectTo, $user = null) { return $this->filterRedirect(Triggers::LOGOUT, $redirectTo, $requestedRedirectTo, $user); } public function filterRegistrationRedirect($redirectTo) { //Note that this does not depend on the user's role as the user isn't logged in yet. return $this->filterRedirect(Triggers::REGISTRATION, $redirectTo, ''); } /** * @param string $trigger * @param string $redirectTo * @param string $requestedRedirectTo * @param WP_User|WP_Error $user * @return string * @noinspection PhpUnusedParameterInspection The requested URL is unused right now, but might be useful in the future. */ protected function filterRedirect($trigger, $redirectTo, $requestedRedirectTo, $user = null) { if ( !($user instanceof WP_User) ) { $this->currentRedirectedUser = null; return $redirectTo; } $found = $this->getBestRedirectFor($trigger, $user); if ( $found->nonEmpty() ) { /** @var Redirect $customRedirect */ $customRedirect = $found->get(); //Set the user for shortcodes in the redirect URL. wp_get_current_user() doesn't always work, //like when the user is still in the process of logging in. $this->currentRedirectedUser = $user; $url = $customRedirect->getUrl(); $this->currentRedirectedUser = null; //WordPress uses wp_safe_redirect() for login, logout, and registration redirects, which //only allows local redirects by default. Let's temporarily add the domain name of the URL //to the allowed host list to let the user set any redirect URL they want. $redirectHost = wp_parse_url($url, PHP_URL_HOST); if ( !empty($redirectHost) ) { add_filter('allowed_redirect_hosts', function ($allowedHosts) use ($redirectHost) { $allowedHosts[] = $redirectHost; return $allowedHosts; }); } return $url; } else { return $redirectTo; } } /** * @param WP_User|null $user * @return bool */ private function checkFirstLogin($user) { if ( !($user instanceof WP_User) ) { return false; } /* WordPress doesn't record logins by default, so we use a few checks to help ensure that * this redirect will only happen when a new user logs in for the first time: * * - Account doesn't have the custom "first login done" flag. * - Account is less than X days old. * - Account was created after the admin changed redirect settings for the first time. */ //Check the first login flag. $isFirstLoginDone = !empty(get_user_meta($user->ID, self::FIRST_LOGIN_META_KEY, true)); if ( $isFirstLoginDone ) { return false; } //This may or may not be the first login, but any future logins definitely won't be first. update_user_meta($user->ID, self::FIRST_LOGIN_META_KEY, 1); //Account age. //Handle invalid timestamps by acting as if the user was registered just now. $registrationTime = $this->getRegistrationTimestamp($user, time()); $accountAgeInDays = (time() - $registrationTime) / (24 * 3600); if ( $accountAgeInDays > self::FIRST_LOGIN_AGE_LIMIT_IN_DAYS ) { return false; } //Account created after using the "redirects" feature, not before. if ( $registrationTime <= $this->getFirstSettingsActivityTime() ) { return false; } return true; } /** * @param WP_User $user * @param int $default */ private function getRegistrationTimestamp($user, $default) { if ( !isset($user, $user->user_registered) ) { return $default; } try { $dateTime = new DateTime($user->user_registered, new DateTimeZone('UTC')); return $dateTime->getTimestamp(); } catch (Exception $e) { return $default; } } /** * @return int */ private function getFirstSettingsActivityTime() { $activityTimestamp = get_site_option(self::SETTINGS_INIT_TIME_KEY, 0); if ( is_numeric($activityTimestamp) ) { return intval($activityTimestamp); } else { return 0; } } /** * @param $user * @return WP_User|null */ public function provideRedirectedUser($user = null) { if ( $this->currentRedirectedUser !== null ) { return $this->currentRedirectedUser; } return $user; } /** @noinspection PhpVariableIsUsedOnlyInClosureInspection */ public function enqueueTabScripts() { parent::enqueueTabScripts(); $baseDeps = $this->menuEditor->get_base_dependencies(); $script = $this->registerLocalScript( self::UI_SCRIPT_HANDLE, 'redirector-ui.js', [ 'jquery', 'jquery-ui-position', 'jquery-ui-autocomplete', $baseDeps()->koPackage()->koSortable(), $this->searchUsersAction->getRegisteredScriptHandle(), ] ); $flattenedRedirects = $this->getRedirects()->flatten(); $usableMenuItems = []; $adminMenuTree = $this->menuEditor->get_active_admin_menu_tree(); if ( !empty($adminMenuTree) ) { $extractor = new MenuExtractor($adminMenuTree); $usableMenuItems = $extractor->getUsableItems(); } $wpRoles = ameRoleUtils::get_roles(); $roles = []; foreach ($wpRoles->role_objects as $roleId => $role) { $roles[] = [ 'name' => $roleId, 'displayName' => ameUtils::get($wpRoles->role_names, $roleId, $roleId), ]; } list($loadedUsers, $hasMoreUsers) = $this->preloadUsers($flattenedRedirects); //Optionally, discard redirects associated with roles or users that no longer exist. if ( $this->menuEditor->get_plugin_option('delete_orphan_actor_settings') ) { $cleaner = new \ameActorAccessCleaner(); $flattenedRedirects = array_filter($flattenedRedirects, function ($details) use ($cleaner) { //Special case: the "actor" that holds the default setting is always valid. if ( $details['actorId'] === self::DEFAULT_SETTING_ACTOR_ID ) { return true; } return $cleaner->tryActorExists($details['actorId'], true); }); //Reindex the array. If filtering removed some elements, the array keys can be sparse, //which would cause it to be serialized as an object instead of an array. $flattenedRedirects = array_values($flattenedRedirects); } $scriptData = [ 'redirects' => $flattenedRedirects, 'usableMenuItems' => $usableMenuItems, 'roles' => $roles, 'users' => $loadedUsers, 'hasMoreUsers' => $hasMoreUsers, 'saveFormConfig' => $this->getSaveSettingsForm()->getJsSaveFormConfig(), ]; //phpcs:disable WordPress.Security.NonceVerification.Recommended if ( isset($_GET['selectedTrigger']) && in_array($_GET['selectedTrigger'], Triggers::getValues()) ) { //phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Already validated by checking against Triggers::getValues(). $scriptData['selectedTrigger'] = $_GET['selectedTrigger']; } //phpcs:enable $script->addJsVariable('wsAmeRedirectorSettings', $scriptData); $script->enqueue(); } public function handleSettingsForm($post = []) { parent::handleSettingsForm($post); $submission = $this->getSaveSettingsForm()->processKnockoutSubmission($post); $submittedSettings = $submission->getSettings(); $this->redirects = w($submittedSettings['redirects'])->foldLeft( new RedirectCollection(), fn($collection, $redirectData) => $collection->add($redirectData) ); $this->saveSettings(); //Remember the first time the admin changes settings. This can then be used to avoid applying //"first login" redirects to users who existed before any custom redirects did. $activityTimestamp = get_site_option(self::SETTINGS_INIT_TIME_KEY, null); if ( empty($activityTimestamp) ) { add_site_option(self::SETTINGS_INIT_TIME_KEY, time()); } $submission->performSuccessRedirect(); } /** * @var KnockoutSaveForm|null */ private ?KnockoutSaveForm $saveForm = null; private function getSaveSettingsForm(): KnockoutSaveForm { if ( $this->saveForm === null ) { $s = new SchemaFactory(); $submittedSettingsSchema = $s->struct([ 'redirects' => $s->arr( $s->struct([ //Actor IDs always follow the "prefix:value" format. 'actorId' => $s->actorId(), //The URL can be basically anything, so we don't try to validate it. 'urlTemplate' => $s->string()->max(2000), //Menu template IDs are based on menu URLs, so they're pretty unpredictable. //If one is given, it must be non-empty. 'menuTemplateId' => $s->string()->min(1), //A trigger is always a lowercase string. 'trigger' => $s->string()->min(2)->max(20)->regex('@^[a-z\-]{2,20}+$@i'), 'shortcodesEnabled' => $s->boolean(), ])->required([ 'actorId', 'urlTemplate', 'trigger', 'shortcodesEnabled', ]) ), ])->required(); $this->saveForm = KnockoutSaveForm::builderFor($this) ->settingsFieldSchema($submittedSettingsSchema) ->passThroughParams(['selectedTrigger']) ->build(); } return $this->saveForm; } /** * Load user data for display in the redirect management UI. * * Will load some or all users depending on how many users there are in total. * Users that have custom redirects are always loaded. * * @param array $flattenedRedirects * @return array{array,boolean} An array of users and a boolean indicating if the total number exceeds the limit. */ protected function preloadUsers(array $flattenedRedirects) { $loadedUsers = get_users([ //In Multisite, include all sites and not just the current site. Note that this might not work if used //together with some other arguments (judging by WP_User_Query::prepare_query source code). 'blog_id' => 0, 'number' => self::PRELOADED_USER_LIMIT + 1, 'count_total' => false, //Allegedly, this can improve performance. 'fields' => self::$desiredUserFields, ]); $hasMoreUsers = count($loadedUsers) > self::PRELOADED_USER_LIMIT; $isUserLoaded = []; foreach ($loadedUsers as $user) { $isUserLoaded[$user->user_login] = true; } //Always load users that already have custom redirects. $userPrefix = 'user:'; $userPrefixLength = strlen($userPrefix); $usersToLoad = []; foreach ($flattenedRedirects as $details) { if ( substr($details['actorId'], 0, $userPrefixLength) === $userPrefix ) { $userLogin = substr($details['actorId'], $userPrefixLength); if ( is_string($userLogin) && ($userLogin !== '') && empty($isUserLoaded[$userLogin]) && empty($usersToLoad[$userLogin]) ) { $usersToLoad[$userLogin] = true; } } } if ( !empty($usersToLoad) ) { $additionalUsers = get_users([ 'blog_id' => 0, 'count_total' => false, 'fields' => self::$desiredUserFields, 'login__in' => array_keys($usersToLoad), ]); $loadedUsers = array_merge($loadedUsers, $additionalUsers); } return [$loadedUsers, $hasMoreUsers]; } public function userCanSearchUsers() { return $this->menuEditor->current_user_can_edit_menu(); } public function ajaxSearchUsers($params) { $foundUsers = get_users([ 'search' => '*' . $params['term'] . '*', 'search_columns' => ['user_login', 'display_name'], 'blog_id' => 0, 'number' => self::SEARCH_USER_LIMIT, 'count_total' => false, 'fields' => self::$desiredUserFields, ]); $results = []; foreach ($foundUsers as $user) { $user = (array)$user; $results[] = array_merge($user, ['label' => $user['user_login']]); } return $results; } public function addContextualHelp() { if ( !is_callable('get_current_screen') ) { return; } $screen = get_current_screen(); if ( $screen ) { $screen->add_help_tab([ 'title' => 'Shortcodes', 'id' => 'ame-rui-help-shortcodes', 'content' => $this->getShortcodeHelp(), ]); $screen->add_help_tab([ 'title' => 'Priority', 'id' => 'ame-rui-help-priority', 'content' => $this->getPriorityHelp(), ]); $screen->add_help_tab([ 'title' => 'First Login', 'id' => 'ame-rui-help-first-login', 'content' => $this->getFirstLoginHelp(), ]); $screen->add_help_tab([ 'title' => 'Disabling Redirects', 'id' => 'ame-rui-emergency-shutdown', 'content' => $this->getEmergencyShutdownHelp(), ]); } } private function getShortcodeHelp() { $message = '

You can use shortcodes in redirect URLs. This plugin comes with a few shortcodes that could be useful for redirects:

'; $message .= ''; $message .= '

Some shortcodes from other plugins may also work, but it depends on the shortcode.

'; return $message; } private function formatShortcodeInfo($tag, $description, $exampleCode = null) { $result = sprintf('[%s] - %s', esc_html($tag), $description); if ( $exampleCode !== null ) { $result .= ' Example output:
' . $this->getExampleShortcodeOutput($exampleCode); } return $result; } private function getExampleShortcodeOutput($exampleCode) { $output = do_shortcode($exampleCode); if ( $output === '' ) { return '(empty string)'; } return sprintf('%s', esc_html($output)); } private function getPriorityHelp() { $tips = [ 'Redirects are processed from top to bottom and the first matching setting is used.', 'You can drag and drop redirects to change their priority.', 'When you create redirects for specific users their order doesn\'t matter, but you can still move them around to organize them.', ]; return ''; } private function getFirstLoginHelp() { $conditions = [ sprintf('The user was registered less than %d days ago.', self::FIRST_LOGIN_AGE_LIMIT_IN_DAYS), 'The user was registered after redirect settings were changed for the first time.', sprintf('The user has not logged in while this plugin and the "%s" module is active.', $this->tabTitle), ]; return '

A "first login" redirect happens when a new user logs in for the first time.

' . '

WordPress does not record logins, so sometimes it\'s not possible to reliably determine if a user has already logged in before or not. To help avoid unnecessary redirects, the plugin will only perform a "first login" redirect when all of the following conditions are met:

' . ''; } private function getEmergencyShutdownHelp() { return '

If something goes wrong, you can disable all custom redirects by adding this code to wp-config.php:

' . '

define(\'AME_DISABLE_REDIRECTS\', true);

' . '

Note that this only applies to redirects created using this plugin. It will not prevent other plugins or themes from redirecting users.

'; } } class Redirect { /** * @var string */ private $actorId; /** * @var string */ private $urlTemplate; /** * @var boolean */ private $shortcodesEnabled; protected function __construct( $actorId, $urlTemplate, $shortcodesEnabled = false ) { $this->actorId = $actorId; $this->urlTemplate = $urlTemplate; $this->shortcodesEnabled = $shortcodesEnabled; } public static function fromArray(array $properties) { return new static( $properties['actorId'], $properties['urlTemplate'], !empty($properties['shortcodesEnabled']) ); } /** * @return string */ public function getActorId() { return $this->actorId; } /** * @return string */ public function getUrl() { $url = $this->urlTemplate; if ( $this->shortcodesEnabled && function_exists('do_shortcode') ) { $url = do_shortcode($url); } return $url; } } class RedirectCollection { /** * @var array */ protected $rawItems = []; public function __construct($rawItems = []) { $this->rawItems = $rawItems; } /** * @param string $trigger * @return Redirect[] */ public function filterByTrigger($trigger) { if ( isset($this->rawItems[$trigger]) ) { return array_map([Redirect::class, 'fromArray'], $this->rawItems[$trigger]); } else { return []; } } /** * @return array */ public function toDbFormat() { return $this->rawItems; } /** * @param array $items * @return static */ public static function fromDbFormat($items) { return new static($items); } /** * @return array */ public function flatten() { $results = []; foreach ($this->rawItems as $trigger => $items) { foreach ($items as $properties) { if ( !is_array($properties) ) { continue; } $properties['trigger'] = $trigger; $results[] = $properties; } } return $results; } /** * Add a redirect to the collection. * * @param array $redirectProperties * @return $this */ public function add(array $redirectProperties): self { $trigger = $redirectProperties['trigger']; if ( !isset($this->rawItems[$trigger]) ) { $this->rawItems[$trigger] = []; } $this->rawItems[$trigger][] = $redirectProperties; return $this; } } abstract class Triggers { const LOGIN = 'login'; const LOGOUT = 'logout'; const REGISTRATION = 'registration'; const FIRST_LOGIN = 'firstLogin'; public static function getValues() { return [self::LOGIN, self::LOGOUT, self::REGISTRATION, self::FIRST_LOGIN]; } } class MenuExtractor { private $items = []; public function __construct($menuTree) { foreach ($menuTree as $item) { $this->processItem($item); } } private function processItem($item, $parentTitle = null) { //Skip separators. if ( !empty($item['separator']) ) { return; } $templateId = ameMenuItem::get($item, 'template_id'); $url = ameMenuItem::get($item, 'url'); $rawTitle = ameMenuItem::get($item, 'menu_title', '[Untitled]'); $fullTitle = trim(wp_strip_all_tags(ameMenuItem::remove_update_count($rawTitle))); if ( $parentTitle !== null ) { $fullTitle = $parentTitle . ' → ' . $fullTitle; } if ( empty($item['custom']) && ($templateId !== null) && !$this->looksLikeUnusableSlug($url) ) { //Add the admin URL shortcode to the URL if it looks like a relative URL that points //to a dashboard page. if ( $this->looksLikeDashboardUrl($url) ) { $url = '[ame-wp-admin]' . $url; } $this->items[] = [ 'templateId' => $templateId, 'title' => $fullTitle, 'url' => $url, ]; } if ( !empty($item['items']) ) { foreach ($item['items'] as $submenu) { $this->processItem($submenu, $fullTitle); } } } /** * @param string $url * @return boolean */ private function looksLikeDashboardUrl($url) { $scheme = wp_parse_url($url, PHP_URL_SCHEME); if ( !empty($scheme) ) { return false; } return preg_match('@^[a-z0-9][a-z0-9_-]{0,30}?\.php@i', $url) === 1; } /** * Check if a string looks like a plain admin menu slug and not a usable URL. * * Sometimes plugins create admin menus that don't have a callback function. A menu like that * will show up fine, and it can be used as a parent for other menu items. However, the menu * itself won't have a working URL, so we don't want to offer it as a redirect option. * * For example, the top level "WooCommerce" menu doesn't have a valid URL, it just has * a slug: "woocommerce". You just usually don't notice this because WordPress automatically * replaces the menu URL with the URL of the first child item. * * @param string|mixed $url * @return bool */ private function looksLikeUnusableSlug($url) { if ( !is_string($url) ) { return true; } //Technically, a menu slug could be anything, so we can't easily determine if a string //is really a slug or just a weird relative URL. However, it seems safe to assume that //a "URL" that has no dots (so no file extension or domain name) and no slashes (so no //protocol or relative directories) is probably unusable. $suspiciousSegmentLength = strcspn($url, './'); return ($suspiciousSegmentLength === strlen($url)); } public function getUsableItems() { return $this->items; } }