'', 'invalid_usernames' => array(), ); } $username_list = array_filter( array_map( 'trim', explode( ',', $usernames ) ) ); if ( empty( $username_list ) ) { return array( 'valid_usernames' => '', 'invalid_usernames' => array(), ); } // Batch query all usernames in a single DB call. $user_query = new WP_User_Query( array( 'login__in' => array_values( $username_list ), 'fields' => 'user_login', 'count_total' => false, ) ); $existing_logins = $user_query->get_results(); $valid_usernames = array_values( array_intersect( $username_list, $existing_logins ) ); $invalid_usernames = array_values( array_diff( $username_list, $existing_logins ) ); return array( 'valid_usernames' => implode( ',', $valid_usernames ), 'invalid_usernames' => $invalid_usernames, ); } /** * Redirects the user to the home page if they do not have the * capability to manage options. */ function admon_dashboard_redirect() { if ( ! admon_user_has_access() && ! wp_doing_ajax() ) { $redirect_url = admon_get_redirect_url(); $redirected = wp_safe_redirect( $redirect_url ); if ( ! $redirected ) { // Headers already sent; fall back to meta refresh. echo ''; } exit; } } add_action( 'admin_init', 'admon_dashboard_redirect' ); /** * Hides the toolbar for non-admin users. * * @param bool $show_admin_bar Whether to show the admin toolbar. * @return bool Whether to show the admin toolbar. */ function admon_hide_toolbar( $show_admin_bar ) { return admon_user_has_access() ? $show_admin_bar : false; } add_filter( 'show_admin_bar', 'admon_hide_toolbar' ); /** * Check if current user has access to dashboard * * @return bool True if user has access, false otherwise */ function admon_user_has_access() { $capability = apply_filters( 'admon_access_capability', 'manage_options' ); $has_access = current_user_can( $capability ); // Apply whitelist logic if settings exist. $settings = get_option( 'admin_only_settings', array() ); if ( ! empty( $settings['allowed_users'] ) ) { $current_user = wp_get_current_user(); $allowed_users = array_map( 'trim', explode( ',', $settings['allowed_users'] ) ); // Always allow administrators. if ( current_user_can( $capability ) ) { $has_access = true; } elseif ( in_array( $current_user->user_login, $allowed_users, true ) ) { // Check if user is in whitelist. $has_access = true; } else { $has_access = false; } } $has_access = apply_filters( 'admon_user_has_access', $has_access ); return $has_access; } /** * Validate if URL is within the same WordPress site * * @param string $url URL to validate. * @return string|false Sanitized URL if valid, false otherwise. */ function admon_validate_same_site_url( $url ) { if ( empty( $url ) ) { return false; } // Use WordPress's built-in redirect validation to ensure the URL is safe. $validated_url = wp_validate_redirect( $url, false ); // If wp_validate_redirect returns false, it's not a safe internal/same-site URL. if ( false === $validated_url ) { return false; } return esc_url_raw( $validated_url ); } /** * Get redirect URL for blocked users * * @return string Redirect URL */ function admon_get_redirect_url() { $settings = get_option( 'admin_only_settings', array() ); $redirect_url = home_url( '/' ); // Use custom redirect URL if set and valid. if ( ! empty( $settings['custom_redirect'] ) ) { $custom_url = admon_validate_same_site_url( $settings['custom_redirect'] ); if ( ! empty( $custom_url ) ) { $redirect_url = $custom_url; } } return apply_filters( 'admon_redirect_page', $redirect_url ); }