3 +--------------------------------------------------------------------+
4 | Copyright CiviCRM LLC. All rights reserved. |
6 | This work is published under the GNU AGPLv3 license with some |
7 | permitted exceptions and without any warranty. For full license |
8 | and copyright information, see https://civicrm.org/licensing |
9 +--------------------------------------------------------------------+
15 * @copyright CiviCRM LLC https://civicrm.org/licensing
19 * WordPress specific stuff goes here
21 class CRM_Utils_System_WordPress
extends CRM_Utils_System_Base
{
24 * Get a normalized version of the wpBasePage.
26 public static function getBasePage() {
27 return strtolower(rtrim(Civi
::settings()->get('wpBasePage'), '/'));
32 public function __construct() {
34 * deprecated property to check if this is a drupal install. The correct method is to have functions on the UF classes for all UF specific
35 * functions and leave the codebase oblivious to the type of CMS
39 $this->is_drupal
= FALSE;
40 $this->is_wordpress
= TRUE;
43 public function initialize() {
45 $this->registerPathVars();
49 * Specify the default computation for various paths/URLs.
51 protected function registerPathVars():void
{
52 $isNormalBoot = function_exists('get_option');
54 // Normal mode - CMS boots first, then calls Civi. "Normal" web pages and newer extern routes.
55 // To simplify the code-paths, some items are re-registered with WP-specific functions.
56 $cmsRoot = function() {
58 'path' => untrailingslashit(ABSPATH
),
62 Civi
::paths()->register('cms', $cmsRoot);
63 Civi
::paths()->register('cms.root', $cmsRoot);
64 Civi
::paths()->register('civicrm.root', function () {
66 'path' => CIVICRM_PLUGIN_DIR
. 'civicrm' . DIRECTORY_SEPARATOR
,
67 'url' => CIVICRM_PLUGIN_URL
. 'civicrm/',
70 Civi
::paths()->register('wp.frontend.base', function () {
72 'url' => home_url('/'),
75 Civi
::paths()->register('wp.frontend', function () {
76 $config = CRM_Core_Config
::singleton();
77 $basepage = get_page_by_path($config->wpBasePage
);
79 'url' => get_permalink($basepage->ID
),
82 Civi
::paths()->register('wp.backend.base', function () {
87 Civi
::paths()->register('wp.backend', function() {
89 'url' => admin_url('admin.php'),
92 Civi
::paths()->register('civicrm.files', function () {
93 $upload_dir = wp_get_upload_dir();
95 $old = CRM_Core_Config
::singleton()->userSystem
->getDefaultFileStorage();
97 'path' => $upload_dir['basedir'] . DIRECTORY_SEPARATOR
. 'civicrm' . DIRECTORY_SEPARATOR
,
98 'url' => $upload_dir['baseurl'] . '/civicrm/',
101 if ($old['path'] === $new['path']) {
105 $oldExists = file_exists($old['path']);
106 $newExists = file_exists($new['path']);
108 if ($oldExists && !$newExists) {
111 elseif (!$oldExists && $newExists) {
114 elseif (!$oldExists && !$newExists) {
115 // neither exists. but that's ok. we're in one of these two cases:
116 // - we're just starting installation... which will get sorted in a moment
117 // when someone calls mkdir().
118 // - we're running a bespoke setup... which will get sorted in a moment
119 // by applying $civicrm_paths.
122 elseif ($oldExists && $newExists) {
123 // situation ambiguous. encourage admin to set value explicitly.
124 if (!isset($GLOBALS['civicrm_paths']['civicrm.files'])) {
125 \Civi
::log()->warning("The system has data from both old+new conventions. Please use civicrm.settings.php to set civicrm.files explicitly.");
132 // Legacy support - only relevant for older extern routes.
134 ->register('wp.frontend.base', function () {
135 return ['url' => rtrim(CIVICRM_UF_BASEURL
, '/') . '/'];
137 ->register('wp.frontend', function () {
138 $config = \CRM_Core_Config
::singleton();
139 $suffix = defined('CIVICRM_UF_WP_BASEPAGE') ? CIVICRM_UF_WP_BASEPAGE
: $config->wpBasePage
;
141 'url' => Civi
::paths()->getVariable('wp.frontend.base', 'url') . $suffix,
144 ->register('wp.backend.base', function () {
145 return ['url' => rtrim(CIVICRM_UF_BASEURL
, '/') . '/wp-admin/'];
147 ->register('wp.backend', function () {
149 'url' => Civi
::paths()->getVariable('wp.backend.base', 'url') . 'admin.php',
158 public function setTitle($title, $pageTitle = NULL) {
163 // FIXME: Why is this global?
164 global $civicrm_wp_title;
165 $civicrm_wp_title = $title;
167 // yes, set page title, depending on context
168 $context = civi_wp()->civicrm_context_get();
172 $template = CRM_Core_Smarty
::singleton();
173 $template->assign('pageTitle', $pageTitle);
178 * Moved from CRM_Utils_System_Base
180 public function getDefaultFileStorage() {
181 // NOTE: On WordPress, this will be circumvented in the future. However,
182 // should retain it to allow transitional/upgrade code determine the old value.
184 $config = CRM_Core_Config
::singleton();
185 $cmsUrl = CRM_Utils_System
::languageNegotiationURL($config->userFrameworkBaseURL
, FALSE, TRUE);
186 $cmsPath = $this->cmsRootPath();
187 $filesPath = CRM_Utils_File
::baseFilePath();
188 $filesRelPath = CRM_Utils_File
::relativize($filesPath, $cmsPath);
189 $filesURL = rtrim($cmsUrl, '/') . '/' . ltrim($filesRelPath, ' /');
191 'url' => CRM_Utils_File
::addTrailingSlash($filesURL, '/'),
192 'path' => CRM_Utils_File
::addTrailingSlash($filesPath),
197 * Determine the location of the CiviCRM source tree.
200 * - url: string. ex: "http://example.com/sites/all/modules/civicrm"
201 * - path: string. ex: "/var/www/sites/all/modules/civicrm"
203 public function getCiviSourceStorage() {
204 global $civicrm_root;
206 // Don't use $config->userFrameworkBaseURL; it has garbage on it.
207 // More generally, we shouldn't be using $config here.
208 if (!defined('CIVICRM_UF_BASEURL')) {
209 throw new RuntimeException('Undefined constant: CIVICRM_UF_BASEURL');
212 $cmsPath = $this->cmsRootPath();
214 // $config = CRM_Core_Config::singleton();
215 // overkill? // $cmsUrl = CRM_Utils_System::languageNegotiationURL($config->userFrameworkBaseURL, FALSE, TRUE);
216 $cmsUrl = CIVICRM_UF_BASEURL
;
217 if (CRM_Utils_System
::isSSL()) {
218 $cmsUrl = str_replace('http://', 'https://', $cmsUrl);
220 $civiRelPath = CRM_Utils_File
::relativize(realpath($civicrm_root), realpath($cmsPath));
221 $civiUrl = rtrim($cmsUrl, '/') . '/' . ltrim($civiRelPath, ' /');
223 'url' => CRM_Utils_File
::addTrailingSlash($civiUrl, '/'),
224 'path' => CRM_Utils_File
::addTrailingSlash($civicrm_root),
231 public function appendBreadCrumb($breadCrumbs) {
232 $breadCrumb = wp_get_breadcrumb();
234 if (is_array($breadCrumbs)) {
235 foreach ($breadCrumbs as $crumbs) {
236 if (stripos($crumbs['url'], 'id%%')) {
237 $args = ['cid', 'mid'];
238 foreach ($args as $a) {
239 $val = CRM_Utils_Request
::retrieve($a, 'Positive', CRM_Core_DAO
::$_nullObject,
243 $crumbs['url'] = str_ireplace("%%{$a}%%", $val, $crumbs['url']);
247 $breadCrumb[] = "<a href=\"{$crumbs['url']}\">{$crumbs['title']}</a>";
251 $template = CRM_Core_Smarty
::singleton();
252 $template->assign_by_ref('breadcrumb', $breadCrumb);
253 wp_set_breadcrumb($breadCrumb);
259 public function resetBreadCrumb() {
261 wp_set_breadcrumb($bc);
267 public function addHTMLHead($head) {
268 static $registered = FALSE;
271 add_action('wp_head', [__CLASS__
, '_showHTMLHead']);
273 add_action('admin_head', [__CLASS__
, '_showHTMLHead']);
276 CRM_Core_Region
::instance('wp_head')->add([
282 * WP action callback.
284 public static function _showHTMLHead() {
285 $region = CRM_Core_Region
::instance('wp_head', FALSE);
287 echo $region->render('');
294 public function mapConfigToSSL() {
296 $base_url = str_replace('http://', 'https://', $base_url);
308 $forceBackend = FALSE,
311 $config = CRM_Core_Config
::singleton();
315 $fragment = isset($fragment) ?
('#' . $fragment) : '';
317 $path = CRM_Utils_String
::stripPathChars($path);
320 //this means wp function we are trying to use is not available,
322 // FIXME: Why bootstrap in url()? Generally want to define 1-2 strategic places to put bootstrap
323 if (!function_exists('get_option')) {
324 $this->loadBootStrap();
327 if ($config->userFrameworkFrontend
) {
329 if (get_option('permalink_structure') != '') {
330 $script = $post ?
get_permalink($post->ID
) : "";
332 if ($post && $config->wpBasePage
== $post->post_name
) {
335 // when shortcode is included in page
336 // also make sure we have valid query object
337 // FIXME: $wpPageParam has no effect and is only set on the *basepage*
339 if (get_option('permalink_structure') == '' && method_exists($wp_query, 'get')) {
340 if (get_query_var('page_id')) {
341 $wpPageParam = "page_id=" . get_query_var('page_id');
343 elseif (get_query_var('p')) {
344 // when shortcode is inserted in post
345 $wpPageParam = "p=" . get_query_var('p');
350 $base = $this->getBaseUrl($absolute, $frontend, $forceBackend);
352 if (!isset($path) && !isset($query)) {
353 // FIXME: This short-circuited codepath is the same as the general one below, except
354 // in that it ignores "permlink_structure" / $wpPageParam / $script . I don't know
355 // why it's different (and I can only find two obvious use-cases for this codepath,
356 // of which at least one looks gratuitous). A more ambitious person would simply remove
358 return $base . $fragment;
361 if (!$forceBackend && get_option('permalink_structure') != '' && ($wpPageParam ||
$script != '')) {
368 // not using clean URLs
370 // requesting an admin URL
371 ||
((is_admin() && !$frontend) ||
$forceBackend)
373 ||
(!$basepage && $script != '')
376 // pre-existing logic
378 // Admin URLs still need "page=CiviCRM", front-end URLs do not.
379 if ((is_admin() && !$frontend) ||
$forceBackend) {
380 $queryParts[] = 'page=CiviCRM';
383 $queryParts[] = 'civiwp=CiviCRM';
385 $queryParts[] = 'q=' . rawurlencode($path);
388 $queryParts[] = $wpPageParam;
390 if (!empty($query)) {
391 $queryParts[] = $query;
394 $final = $base . '?' . implode($separator, $queryParts) . $fragment;
401 $base = trailingslashit($base) . str_replace('civicrm/', '', $path) . '/';
404 $query = ltrim($query, '=?&');
405 $queryParts[] = $query;
408 if (!empty($queryParts)) {
409 $final = $base . '?' . implode($separator, $queryParts) . $fragment;
412 $final = $base . $fragment;
422 * CRM-16421 CRM-17633 WIP Changes to support WP in it's own directory
423 * https://wiki.civicrm.org/confluence/display/CRM/WordPress+installed+in+its+own+directory+issues
424 * For now leave hard coded wp-admin references.
425 * TODO: remove wp-admin references and replace with admin_url() in the future. Look at best way to get path to admin_url
429 * @param $forceBackend
431 * @return mixed|null|string
433 private function getBaseUrl($absolute, $frontend, $forceBackend) {
434 $config = CRM_Core_Config
::singleton();
435 if ((is_admin() && !$frontend) ||
$forceBackend) {
436 return Civi
::paths()->getUrl('[wp.backend]/.', $absolute ?
'absolute' : 'relative');
439 return Civi
::paths()->getUrl('[wp.frontend]/.', $absolute ?
'absolute' : 'relative');
446 public function authenticate($name, $password, $loadCMSBootstrap = FALSE, $realPath = NULL) {
447 $config = CRM_Core_Config
::singleton();
449 if ($loadCMSBootstrap) {
450 $config->userSystem
->loadBootStrap([
456 $user = wp_authenticate($name, $password);
457 if (is_a($user, 'WP_Error')) {
461 // TODO: need to change this to make sure we matched only one row
463 CRM_Core_BAO_UFMatch
::synchronizeUFMatch($user->data
, $user->data
->ID
, $user->data
->user_email
, 'WordPress');
464 $contactID = CRM_Core_BAO_UFMatch
::getContactId($user->data
->ID
);
468 return [$contactID, $user->data
->ID
, mt_rand()];
472 * FIXME: Do something
474 * @param string $message
476 public function setMessage($message) {
480 * @param \string $user
484 public function loadUser($user) {
485 $userdata = get_user_by('login', $user);
486 if (!$userdata->data
->ID
) {
490 $uid = $userdata->data
->ID
;
491 wp_set_current_user($uid);
492 $contactID = CRM_Core_BAO_UFMatch
::getContactId($uid);
494 // lets store contact id and user id in session
495 $session = CRM_Core_Session
::singleton();
496 $session->set('ufID', $uid);
497 $session->set('userID', $contactID);
502 * FIXME: Use CMS-native approach
503 * @throws \CRM_Core_Exception
505 public function permissionDenied() {
507 throw new CRM_Core_Exception(ts('You do not have permission to access this page.'));
511 * Determine the native ID of the CMS user.
513 * @param string $username
517 public function getUfId($username) {
518 $userdata = get_user_by('login', $username);
519 if (!$userdata->data
->ID
) {
522 return $userdata->data
->ID
;
528 public function logout() {
534 wp_redirect(wp_login_url());
540 public function getUFLocale() {
541 // Bail early if method is called when WordPress isn't bootstrapped.
542 // Additionally, the function checked here is located in pluggable.php
543 // and is required by wp_get_referer() - so this also bails early if it is
544 // called too early in the request lifecycle.
545 // @see https://core.trac.wordpress.org/ticket/25294
546 if (!function_exists('wp_validate_redirect')) {
550 // Default to WordPress User locale.
551 $locale = get_user_locale();
553 // Is this a "back-end" AJAX call?
555 if (wp_doing_ajax() && FALSE !== strpos(wp_get_referer(), admin_url())) {
559 // Ignore when in WordPress admin or it's a "back-end" AJAX call.
560 if (!(is_admin() ||
$is_backend)) {
562 // Reaching here means it is very likely to be a front-end context.
564 // Default to WordPress locale.
565 $locale = get_locale();
567 // Maybe override with the locale that Polylang reports.
568 if (function_exists('pll_current_language')) {
569 $pll_locale = pll_current_language('locale');
570 if (!empty($pll_locale)) {
571 $locale = $pll_locale;
575 // Maybe override with the locale that WPML reports.
576 elseif (defined('ICL_LANGUAGE_CODE')) {
577 $languages = apply_filters('wpml_active_languages', NULL);
578 foreach ($languages as $language) {
579 if ($language['active']) {
580 $locale = $language['default_locale'];
586 // TODO: Set locale for other WordPress plugins.
587 // @see https://wordpress.org/plugins/tags/multilingual/
588 // A hook would be nice here.
592 if (!empty($locale)) {
593 // If for some reason only we get a language code, convert it to a locale.
594 if (2 === strlen($locale)) {
595 $locale = CRM_Core_I18n_PseudoConstant
::longForShort($locale);
607 public function setUFLocale($civicrm_language) {
608 // TODO (probably not possible with WPML?)
613 * Load wordpress bootstrap.
615 * @param array $params
616 * Optional credentials
617 * - name: string, cms username
618 * - pass: string, cms password
619 * @param bool $loadUser
620 * @param bool $throwError
621 * @param mixed $realPath
624 * @throws \CRM_Core_Exception
626 public function loadBootStrap($params = [], $loadUser = TRUE, $throwError = TRUE, $realPath = NULL) {
627 global $wp, $wp_rewrite, $wp_the_query, $wp_query, $wpdb, $current_site, $current_blog, $current_user;
629 $name = $params['name'] ??
NULL;
630 $pass = $params['pass'] ??
NULL;
632 if (!defined('WP_USE_THEMES')) {
633 define('WP_USE_THEMES', FALSE);
636 $cmsRootPath = $this->cmsRootPath();
638 throw new CRM_Core_Exception("Could not find the install directory for WordPress");
640 $path = Civi
::settings()->get('wpLoadPhp');
644 elseif (file_exists($cmsRootPath . DIRECTORY_SEPARATOR
. 'wp-load.php')) {
645 require_once $cmsRootPath . DIRECTORY_SEPARATOR
. 'wp-load.php';
648 throw new CRM_Core_Exception("Could not find the bootstrap file for WordPress");
650 $wpUserTimezone = get_option('timezone_string');
651 if ($wpUserTimezone) {
652 date_default_timezone_set($wpUserTimezone);
653 CRM_Core_Config
::singleton()->userSystem
->setMySQLTimeZone();
655 require_once $cmsRootPath . DIRECTORY_SEPARATOR
. 'wp-includes/pluggable.php';
656 $uid = $params['uid'] ??
NULL;
658 $name = $name ?
$name : trim(CRM_Utils_Array
::value('name', $_REQUEST));
659 $pass = $pass ?
$pass : trim(CRM_Utils_Array
::value('pass', $_REQUEST));
661 $uid = wp_authenticate($name, $pass);
664 echo '<br />Sorry, unrecognized username or password.';
672 if ($uid instanceof WP_User
) {
673 $account = wp_set_current_user($uid->ID
);
676 $account = wp_set_current_user($uid);
678 if ($account && $account->data
->ID
) {
692 public function validInstallDir($dir) {
693 $includePath = "$dir/wp-includes";
694 if (@file_exists
("$includePath/version.php")) {
701 * Determine the location of the CMS root.
703 * @return string|NULL
704 * local file system path to CMS root, or NULL if it cannot be determined
706 public function cmsRootPath() {
708 // Return early if the path is already set.
709 global $civicrm_paths;
710 if (!empty($civicrm_paths['cms.root']['path'])) {
711 return $civicrm_paths['cms.root']['path'];
714 // Return early if constant has been defined.
715 if (defined('CIVICRM_CMSDIR')) {
716 if ($this->validInstallDir(CIVICRM_CMSDIR
)) {
717 return CIVICRM_CMSDIR
;
721 // Return early if path to wp-load.php can be retrieved from settings.
722 $setting = Civi
::settings()->get('wpLoadPhp');
723 if (!empty($setting)) {
724 $path = str_replace('wp-load.php', '', $setting);
725 $cmsRoot = rtrim($path, '/\\');
726 if ($this->validInstallDir($cmsRoot)) {
732 * Keep previous logic as fallback of last resort.
734 * At some point, it would be good to remove this because there are serious
735 * problems in correctly locating WordPress in this manner. In summary, it
736 * is impossible to do so reliably.
738 * @see https://github.com/civicrm/civicrm-wordpress/pull/63#issuecomment-61792328
739 * @see https://github.com/civicrm/civicrm-core/pull/11086#issuecomment-335454992
741 $cmsRoot = $valid = NULL;
743 $pathVars = explode('/', str_replace('\\', '/', $_SERVER['SCRIPT_FILENAME']));
745 // Might be Windows installation.
746 $firstVar = array_shift($pathVars);
748 $cmsRoot = $firstVar;
751 // Start with CMS dir search.
752 foreach ($pathVars as $var) {
754 if ($this->validInstallDir($cmsRoot)) {
755 // Stop as we found bootstrap.
761 return ($valid) ?
$cmsRoot : NULL;
767 public function createUser(&$params, $mail) {
770 'user_login' => $params['cms_name'],
771 'user_email' => $params[$mail],
772 'nickname' => $params['cms_name'],
773 'role' => get_option('default_role'),
775 if (isset($params['contactID'])) {
776 $contactType = CRM_Contact_BAO_Contact
::getContactType($params['contactID']);
777 if ($contactType == 'Individual') {
778 $user_data['first_name'] = CRM_Core_DAO
::getFieldValue('CRM_Contact_DAO_Contact',
779 $params['contactID'], 'first_name'
781 $user_data['last_name'] = CRM_Core_DAO
::getFieldValue('CRM_Contact_DAO_Contact',
782 $params['contactID'], 'last_name'
787 $this->hooks_core_remove();
788 $uid = wp_insert_user($user_data);
791 $creds['user_login'] = $params['cms_name'];
792 $creds['remember'] = TRUE;
794 // Call wp_signon if we aren't already logged in
795 // For example, we might be creating a new user from the Contact record.
796 if (!current_user_can('create_users')) {
797 wp_signon($creds, FALSE);
800 do_action('register_new_user', $uid);
801 $this->hooks_core_add();
809 public function updateCMSName($ufID, $ufName) {
811 if (function_exists('wp_update_user')) {
812 $ufID = CRM_Utils_Type
::escape($ufID, 'Integer');
813 $ufName = CRM_Utils_Type
::escape($ufName, 'String');
815 $values = ['ID' => $ufID, 'user_email' => $ufName];
817 wp_update_user($values);
823 * @param array $params
825 * @param string $emailName
827 public function checkUserNameEmailExists(&$params, &$errors, $emailName = 'email') {
828 $config = CRM_Core_Config
::singleton();
830 $dao = new CRM_Core_DAO();
831 $name = $dao->escape(CRM_Utils_Array
::value('name', $params));
832 $email = $dao->escape(CRM_Utils_Array
::value('mail', $params));
834 if (!empty($params['name'])) {
835 if (!validate_username($params['name'])) {
836 $errors['cms_name'] = ts("Your username contains invalid characters");
838 elseif (username_exists(sanitize_user($params['name']))) {
839 $errors['cms_name'] = ts('The username %1 is already taken. Please select another username.', [1 => $params['name']]);
843 if (!empty($params['mail'])) {
844 if (!is_email($params['mail'])) {
845 $errors[$emailName] = "Your email is invaid";
847 elseif (email_exists($params['mail'])) {
848 $errors[$emailName] = ts('The email address %1 already has an account associated with it. <a href="%2">Have you forgotten your password?</a>',
849 [1 => $params['mail'], 2 => wp_lostpassword_url()]
858 public function isUserLoggedIn() {
860 if (function_exists('is_user_logged_in')) {
861 $isloggedIn = is_user_logged_in();
870 public function isUserRegistrationPermitted() {
871 if (!get_option('users_can_register')) {
880 public function isPasswordUserGenerated() {
887 public function getLoggedInUserObject() {
888 if (function_exists('is_user_logged_in') &&
891 global $current_user;
893 return $current_user;
899 public function getLoggedInUfID() {
901 $current_user = $this->getLoggedInUserObject();
902 return $current_user->ID ??
NULL;
908 public function getLoggedInUniqueIdentifier() {
909 $user = $this->getLoggedInUserObject();
910 return $this->getUniqueIdentifierFromUserObject($user);
914 * Get User ID from UserFramework system (Joomla)
915 * @param object $user
916 * Object as described by the CMS.
920 public function getUserIDFromUserObject($user) {
921 return !empty($user->ID
) ?
$user->ID
: NULL;
927 public function getUniqueIdentifierFromUserObject($user) {
928 return empty($user->user_email
) ?
NULL : $user->user_email
;
934 public function getLoginURL($destination = '') {
935 return wp_login_url($destination);
939 * @param \CRM_Core_Form $form
941 * @return NULL|string
943 public function getLoginDestination(&$form) {
946 $id = $form->get('id');
951 $gid = $form->get('gid');
953 $args .= "&gid=$gid";
956 // Setup Personal Campaign Page link uses pageId
957 $pageId = $form->get('pageId');
959 $component = $form->get('component');
960 $args .= "&pageId=$pageId&component=$component&action=add";
967 // append destination so user is returned to form they came from after login
968 $destination = CRM_Utils_System
::url(CRM_Utils_System
::currentPath(), 'reset=1' . $args);
976 public function getVersion() {
977 if (function_exists('get_bloginfo')) {
978 return get_bloginfo('version', 'display');
988 public function getTimeZoneString() {
989 return get_option('timezone_string');
995 public function getUserRecordUrl($contactID) {
996 $uid = CRM_Core_BAO_UFMatch
::getUFId($contactID);
997 if (CRM_Core_Session
::singleton()
998 ->get('userID') == $contactID || CRM_Core_Permission
::checkAnyPerm(['cms:administer users'])
1000 return CRM_Core_Config
::singleton()->userFrameworkBaseURL
. "wp-admin/user-edit.php?user_id=" . $uid;
1005 * Append WP js to coreResourcesList.
1007 * @param \Civi\Core\Event\GenericHookEvent $e
1009 public function appendCoreResources(\Civi\Core\Event\GenericHookEvent
$e) {
1010 $e->list[] = 'js/crm.wordpress.js';
1016 public function alterAssetUrl(\Civi\Core\Event\GenericHookEvent
$e) {
1017 // Set menubar breakpoint to match WP admin theme
1018 if ($e->asset
== 'crm-menubar.css') {
1019 $e->params
['breakpoint'] = 783;
1026 public function checkPermissionAddUser() {
1027 return current_user_can('create_users');
1033 public function synchronizeUsers() {
1034 $config = CRM_Core_Config
::singleton();
1035 if (PHP_SAPI
!= 'cli') {
1036 set_time_limit(300);
1039 $mail = 'user_email';
1041 $uf = $config->userFramework
;
1043 $contactCreated = 0;
1044 $contactMatching = 0;
1046 // Previously used the $wpdb global - which means WordPress *must* be bootstrapped.
1047 $wpUsers = get_users(array(
1048 'blog_id' => get_current_blog_id(),
1052 foreach ($wpUsers as $wpUserData) {
1054 if ($match = CRM_Core_BAO_UFMatch
::synchronizeUFMatch($wpUserData,
1068 if (is_object($match)) {
1074 'contactCount' => $contactCount,
1075 'contactMatching' => $contactMatching,
1076 'contactCreated' => $contactCreated,
1081 * Send an HTTP Response base on PSR HTTP RespnseInterface response.
1083 * @param \Psr\Http\Message\ResponseInterface $response
1085 public function sendResponse(\Psr\Http\Message\ResponseInterface
$response) {
1086 // use WordPress function status_header to ensure 404 response is sent
1087 status_header($response->getStatusCode());
1088 foreach ($response->getHeaders() as $name => $values) {
1089 CRM_Utils_System
::setHttpHeader($name, implode(', ', (array) $values));
1091 echo $response->getBody();
1092 CRM_Utils_System
::civiExit();
1096 * Start a new session if there's no existing session ID.
1098 * Checks are needed to prevent sessions being started when not necessary.
1100 public function sessionStart() {
1101 $session_id = session_id();
1103 // Check WordPress pseudo-cron.
1105 if (function_exists('wp_doing_cron') && wp_doing_cron()) {
1111 if (defined('WP_CLI') && WP_CLI
) {
1115 // Check PHP on the command line - e.g. `cv`.
1117 if (PHP_SAPI
!== 'cli') {
1121 // Maybe start session.
1122 if (empty($session_id) && !$wp_cron && !$wp_cli && !$php_cli) {
1128 * Perform any necessary actions prior to redirecting via POST.
1130 * Redirecting via POST means that cookies need to be sent with SameSite=None.
1132 public function prePostRedirect() {
1133 // Get User Agent string.
1134 $rawUserAgent = isset($_SERVER['HTTP_USER_AGENT']) ?
$_SERVER['HTTP_USER_AGENT'] : '';
1135 $userAgent = mb_convert_encoding($rawUserAgent, 'UTF-8');
1137 // Bail early if User Agent does not support `SameSite=None`.
1138 $shouldUseSameSite = CRM_Utils_SameSite
::shouldSendSameSiteNone($userAgent);
1139 if (!$shouldUseSameSite) {
1143 // Make sure session cookie is present in header.
1144 $cookie_params = session_name() . '=' . session_id() . '; SameSite=None; Secure';
1145 CRM_Utils_System
::setHttpHeader('Set-Cookie', $cookie_params);
1147 // Add WordPress auth cookies when user is logged in.
1148 $user = wp_get_current_user();
1149 if ($user->exists()) {
1150 self
::setAuthCookies($user->ID
, TRUE, TRUE);
1155 * Explicitly set WordPress authentication cookies.
1157 * Chrome 84 introduced a cookie policy change which prevents cookies for the
1158 * session and for WordPress user authentication from being indentified when
1159 * a purchaser returns to the site from PayPal using the "Back to Merchant"
1162 * In order to comply with this policy, cookies need to be sent with their
1163 * "SameSite" attribute set to "None" and with the "Secure" flag set, but this
1164 * isn't possible to do via `wp_set_auth_cookie()` as it stands.
1166 * This method is a modified clone of `wp_set_auth_cookie()` which satisfies
1167 * the Chrome policy.
1169 * @see wp_set_auth_cookie()
1171 * The $remember parameter increases the time that the cookie will be kept. The
1172 * default the cookie is kept without remembering is two days. When $remember is
1173 * set, the cookies will be kept for 14 days or two weeks.
1175 * @param int $user_id The WordPress User ID.
1176 * @param bool $remember Whether to remember the user.
1177 * @param bool|string $secure Whether the auth cookie should only be sent over
1178 * HTTPS. Default is an empty string which means the
1179 * value of `is_ssl()` will be used.
1180 * @param string $token Optional. User's session token to use for this cookie.
1182 private function setAuthCookies($user_id, $remember = FALSE, $secure = '', $token = '') {
1184 /** This filter is documented in wp-includes/pluggable.php */
1185 $expiration = time() +
apply_filters('auth_cookie_expiration', 14 * DAY_IN_SECONDS
, $user_id, $remember);
1188 * Ensure the browser will continue to send the cookie after the expiration time is reached.
1189 * Needed for the login grace period in wp_validate_auth_cookie().
1191 $expire = $expiration +
(12 * HOUR_IN_SECONDS
);
1194 /** This filter is documented in wp-includes/pluggable.php */
1195 $expiration = time() +
apply_filters('auth_cookie_expiration', 2 * DAY_IN_SECONDS
, $user_id, $remember);
1199 if ('' === $secure) {
1203 // Front-end cookie is secure when the auth cookie is secure and the site's home URL is forced HTTPS.
1204 $secure_logged_in_cookie = $secure && 'https' === parse_url(get_option('home'), PHP_URL_SCHEME
);
1206 /** This filter is documented in wp-includes/pluggable.php */
1207 $secure = apply_filters('secure_auth_cookie', $secure, $user_id);
1209 /** This filter is documented in wp-includes/pluggable.php */
1210 $secure_logged_in_cookie = apply_filters('secure_logged_in_cookie', $secure_logged_in_cookie, $user_id, $secure);
1213 $auth_cookie_name = SECURE_AUTH_COOKIE
;
1214 $scheme = 'secure_auth';
1217 $auth_cookie_name = AUTH_COOKIE
;
1221 if ('' === $token) {
1222 $manager = WP_Session_Tokens
::get_instance($user_id);
1223 $token = $manager->create($expiration);
1226 $auth_cookie = wp_generate_auth_cookie($user_id, $expiration, $scheme, $token);
1227 $logged_in_cookie = wp_generate_auth_cookie($user_id, $expiration, 'logged_in', $token);
1229 /** This filter is documented in wp-includes/pluggable.php */
1230 do_action('set_auth_cookie', $auth_cookie, $expire, $expiration, $user_id, $scheme, $token);
1232 /** This filter is documented in wp-includes/pluggable.php */
1233 do_action('set_logged_in_cookie', $logged_in_cookie, $expire, $expiration, $user_id, 'logged_in', $token);
1235 /** This filter is documented in wp-includes/pluggable.php */
1236 if (!apply_filters('send_auth_cookies', TRUE)) {
1241 'expires' => $expire,
1242 'domain' => COOKIE_DOMAIN
,
1244 'samesite' => 'None',
1247 self
::setAuthCookie($auth_cookie_name, $auth_cookie, $base_options +
['secure' => $secure, 'path' => PLUGINS_COOKIE_PATH
]);
1248 self
::setAuthCookie($auth_cookie_name, $auth_cookie, $base_options +
['secure' => $secure, 'path' => ADMIN_COOKIE_PATH
]);
1249 self
::setAuthCookie(LOGGED_IN_COOKIE
, $logged_in_cookie, $base_options +
['secure' => $secure_logged_in_cookie, 'path' => COOKIEPATH
]);
1250 if (COOKIEPATH
!= SITECOOKIEPATH
) {
1251 self
::setAuthCookie(LOGGED_IN_COOKIE
, $logged_in_cookie, $base_options +
['secure' => $secure_logged_in_cookie, 'path' => SITECOOKIEPATH
]);
1256 * Set cookie with "SameSite" flag.
1258 * The method here is compatible with all versions of PHP. Needed because it
1259 * is only as of PHP 7.3.0 that the setcookie() method supports the "SameSite"
1260 * attribute in its options and will accept "None" as a valid value.
1262 * @param $name The name of the cookie.
1263 * @param $value The value of the cookie.
1264 * @param array $options The header options for the cookie.
1266 private function setAuthCookie($name, $value, $options) {
1267 $header = 'Set-Cookie: ';
1268 $header .= rawurlencode($name) . '=' . rawurlencode($value) . '; ';
1269 $header .= 'expires=' . gmdate('D, d-M-Y H:i:s T', $options['expires']) . '; ';
1270 $header .= 'Max-Age=' . max(0, (int) ($options['expires'] - time())) . '; ';
1271 $header .= 'path=' . rawurlencode($options['path']) . '; ';
1272 $header .= 'domain=' . rawurlencode($options['domain']) . '; ';
1274 if (!empty($options['secure'])) {
1275 $header .= 'secure; ';
1277 $header .= 'httponly; ';
1278 $header .= 'SameSite=' . rawurlencode($options['samesite']);
1280 header($header, FALSE);
1281 $_COOKIE[$name] = $value;
1285 * Return the CMS-specific url for its permissions page
1288 public function getCMSPermissionsUrlParams() {
1289 return ['ufAccessURL' => CRM_Utils_System
::url('civicrm/admin/access/wp-permissions', 'reset=1')];
1293 * Remove CiviCRM's callbacks.
1295 * These may cause recursive updates when creating or editing a WordPress
1296 * user. This doesn't seem to have been necessary in the past, but seems
1297 * to be causing trouble when newer versions of BuddyPress and CiviCRM are
1300 * Based on the civicrm-wp-profile-sync plugin by Christian Wach.
1302 * @see self::hooks_core_add()
1304 public function hooks_core_remove() {
1305 $civicrm = civi_wp();
1307 // Remove current CiviCRM plugin filters.
1308 remove_action('user_register', [$civicrm->users
, 'update_user']);
1309 remove_action('profile_update', [$civicrm->users
, 'update_user']);
1313 * Add back CiviCRM's callbacks.
1314 * This method undoes the removal of the callbacks above.
1316 * @see self::hooks_core_remove()
1318 public function hooks_core_add() {
1319 $civicrm = civi_wp();
1321 // Re-add current CiviCRM plugin filters.
1322 add_action('user_register', [$civicrm->users
, 'update_user']);
1323 add_action('profile_update', [$civicrm->users
, 'update_user']);