$atts Block attributes (`bookingPageId`) or * shortcode attributes (`booking_page_id`). */ public function render( array $atts ): string { $bookingPageId = Val::int( $atts['bookingPageId'] ?? $atts['booking_page_id'] ?? 0 ); if ( is_user_logged_in() ) { return sprintf( '

%s %s.

', esc_html__( 'You are already logged in.', 'unsupervised-schedular' ), esc_url( $this->bookingUrl( $bookingPageId ) ?? (string) get_permalink() ), esc_html__( 'View available lessons', 'unsupervised-schedular' ) ); } $error = ''; $redirect = sanitize_url( $this->bookingUrl( $bookingPageId ) ?? (string) get_permalink() ); if ( isset( $_POST['us_login'] ) && check_admin_referer( 'us_student_login' ) ) { $credentials = [ 'user_login' => sanitize_user( Val::string( wp_unslash( $_POST['log'] ?? '' ) ) ), // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- passwords must not be sanitized. 'user_password' => Val::string( wp_unslash( $_POST['pwd'] ?? '' ) ), 'remember' => isset( $_POST['rememberme'] ), ]; // The secure-cookie argument is deliberately left at its default. Only // the empty string makes wp_signon() work it out from is_ssl(); passing // an explicit false skips that and issues the plain, non-Secure auth // cookie on an HTTPS site — a session that then leaks over the first // http:// request to the domain. $user = wp_signon( $credentials ); if ( is_wp_error( $user ) ) { $error = esc_html__( 'Invalid username or password.', 'unsupervised-schedular' ); } else { wp_safe_redirect( $redirect ); exit; } } ob_start(); include USC_PLUGIN_DIR . 'templates/frontend/login-page.php'; return (string) ob_get_clean(); } /** * Permalink of the configured booking page, or null when no page is * chosen (or the chosen page no longer exists). Logged-in visitors are * linked (and redirected after login) there instead of the current page. */ public function bookingUrl( int $bookingPageId ): ?string { if ( $bookingPageId <= 0 ) { return null; } $url = get_permalink( $bookingPageId ); return is_string( $url ) ? $url : null; } }