|
| 1 | +# Sage Password Protected |
| 2 | + |
| 3 | +Sage Password Protected is a simple password protection package for use with [Sage 9](https://github.com/roots/sage) built for developers. No admin pages, no styles, no javascript, no bloat. Simply pass your own configuration to the provided filters and off you go. |
| 4 | + |
| 5 | +Easily build your own field group for it within your theme options using ACF, or pass a filter so it is only enabled when `WP_ENV` does not equal `production`. |
| 6 | + |
| 7 | +## Requirements |
| 8 | + |
| 9 | +* [Sage](https://github.com/roots/sage) >= 9.0 |
| 10 | +* [PHP](https://secure.php.net/manual/en/install.php) >= 7.0 |
| 11 | +* [Composer](https://getcomposer.org/download/) |
| 12 | + |
| 13 | +## Installation |
| 14 | + |
| 15 | +Install via Composer: |
| 16 | + |
| 17 | +```bash |
| 18 | +composer require log1x/sage-password-protected |
| 19 | +``` |
| 20 | + |
| 21 | +## Usage |
| 22 | + |
| 23 | +Out of the box, this package does absolutely nothing as all values are defaulted to false. To get started, begin passing your values through the provided filters. When passing the password, you must either pass it through `password_hash()` or if using ACF, use my [acf-encrypted-password](https://github.com/log1x/acf-encrypted-password) field. |
| 24 | + |
| 25 | +Below are not only the provided filters, but a personal example of how I use them alongside ACF and [ACF Fluent](https://github.com/samrap/acf-fluent). |
| 26 | + |
| 27 | +### Filters |
| 28 | + |
| 29 | +```php |
| 30 | +/** |
| 31 | + * Returns true if password protection is enabled. |
| 32 | + * |
| 33 | + * @return boolean |
| 34 | + */ |
| 35 | +add_filter('password-protected/isActive', function () { |
| 36 | + return Acf::option('password_protected')->get(); |
| 37 | +}); |
| 38 | + |
| 39 | +/** |
| 40 | + * Returns the password set for password protection. |
| 41 | + * |
| 42 | + * @return string |
| 43 | + */ |
| 44 | +add_filter('password-protected/password', function () { |
| 45 | + return Acf::option('password')->get(); |
| 46 | +}); |
| 47 | + |
| 48 | +/** |
| 49 | + * Returns true if feeds are allowed while password protection is enabled. |
| 50 | + * |
| 51 | + * @return boolean |
| 52 | + */ |
| 53 | +add_filter('password-protected/allowFeeds', function () { |
| 54 | + return Acf::option('password_show_feeds')->get(); |
| 55 | +}); |
| 56 | + |
| 57 | +/** |
| 58 | + * Returns true if admins are allowed to bypass authentication while password protection is enabled. |
| 59 | + * |
| 60 | + * @return boolean |
| 61 | + */ |
| 62 | +add_filter('password-protected/allowAdmins', function () { |
| 63 | + return Acf::option('password_allow_administrators')->get(); |
| 64 | +}); |
| 65 | + |
| 66 | +/** |
| 67 | + * Returns true if users are allowed to bypass authentication while password protection is enabled. |
| 68 | + * |
| 69 | + * @return boolean |
| 70 | + */ |
| 71 | +add_filter('password-protected/allowUsers', function () { |
| 72 | + return Acf::option('password_allow_users')->get(); |
| 73 | +}); |
| 74 | + |
| 75 | +/** |
| 76 | + * Returns true if specific IP Addresses are allowed to bypass authentication while password protection is enabled. |
| 77 | + * |
| 78 | + * @return boolean |
| 79 | + */ |
| 80 | +add_filter('password-protected/allowIpAddresses', function () { |
| 81 | + return Acf::option('password_allow_by_ip_address')->get(); |
| 82 | +}); |
| 83 | + |
| 84 | +/** |
| 85 | + * Returns the IP addresses allowed to bypass authentication while password protection is enabled. |
| 86 | + * |
| 87 | + * @return array |
| 88 | + */ |
| 89 | +add_filter('password-protected/allowedIpAddresses', function () { |
| 90 | + return Acf::option('password_allowed_ip_addresses')->get(); |
| 91 | +}); |
| 92 | +``` |
| 93 | + |
| 94 | +You can also filter the page title: |
| 95 | + |
| 96 | +```php |
| 97 | +/** |
| 98 | + * Returns the page title used for the password protection page. |
| 99 | + * |
| 100 | + * @param string $name |
| 101 | + * @return string |
| 102 | + */ |
| 103 | +add_filter('password-protected/title', function ($name) { |
| 104 | + return $name . ' | Protected'; |
| 105 | +}); |
| 106 | +``` |
| 107 | + |
| 108 | +### ACF Builder |
| 109 | + |
| 110 | +If you happen to be utilizing ACF Builder, you can use my above filters along with: |
| 111 | + |
| 112 | +```php |
| 113 | +<?php |
| 114 | + |
| 115 | +namespace App; |
| 116 | + |
| 117 | +use StoutLogic\AcfBuilder\FieldsBuilder; |
| 118 | + |
| 119 | +$config = (object) [ |
| 120 | + 'ui' => 1, |
| 121 | + 'wrapper' => ['width' => 30], |
| 122 | + 'ip' => $_SERVER['X-Forwarded-For'] ?? $_SERVER['REMOTE_ADDR'], |
| 123 | +]; |
| 124 | + |
| 125 | +$password = new FieldsBuilder('password_protected'); |
| 126 | + |
| 127 | +$password |
| 128 | + ->addTab('password_protected', ['placement' => 'left']); |
| 129 | + |
| 130 | +$password |
| 131 | + ->addTrueFalse('password_protected', ['ui' => $config->ui]) |
| 132 | + ->setInstructions('Enable site-wide password protection?') |
| 133 | + |
| 134 | + ->addField('password', 'encrypted_password', ['wrapper' => $config->wrapper]) |
| 135 | + ->setInstructions('Enter the login password.') |
| 136 | + ->conditional('password_protected', '==', '1') |
| 137 | + |
| 138 | + ->addTrueFalse('password_show_feeds', ['label' => 'Show Feeds?', 'ui' => $config->ui]) |
| 139 | + ->setInstructions('Enable RSS Feeds without a password?') |
| 140 | + ->conditional('password_protected', '==', '1') |
| 141 | + |
| 142 | + ->addTrueFalse('password_allow_ip_address', ['label' => 'Allow by IP Address', 'ui' => $config->ui]) |
| 143 | + ->setInstructions('Enable whitelisting users by their IP Address.') |
| 144 | + ->conditional('password_protected', '==', '1') |
| 145 | + |
| 146 | + ->addRepeater('password_allowed_ip_addresses', ['label' => 'Allowed IP Addresses', 'button_label' => 'Add IP Address']) |
| 147 | + ->conditional('password_protected', '==', '1') |
| 148 | + ->and('password_allow_ip_address', '==', '1') |
| 149 | + ->setInstructions('Current IP Address: ' . $config->ip) |
| 150 | + |
| 151 | + ->addText('ip_address', ['label' => 'IP Address', 'placeholder' => $config->ip]) |
| 152 | + ->setInstructions('The IP Address of the user to allow through password protection.') |
| 153 | + |
| 154 | + ->addText('ip_address_comment', ['label' => 'Comment', 'placeholder' => 'John Doe\'s Home']) |
| 155 | + ->setInstructions('A comment containing an identifier for this IP address. This is strictly for organization purposes.') |
| 156 | + ->endRepeater() |
| 157 | + |
| 158 | + ->addTrueFalse('password_allow_users', ['ui' => $config->ui]) |
| 159 | + ->setInstructions('Allow bypassing password protection while logged in as a user.') |
| 160 | + ->conditional('password_protected', '==', '1') |
| 161 | + |
| 162 | + ->addTrueFalse('password_allow_administrators', ['ui' => $config->ui]) |
| 163 | + ->conditional('password_protected', '==', '1') |
| 164 | + ->and('password_allow_users', '==', '0') |
| 165 | + ->setInstructions('Allow bypassing password protection while logged in as an administrator.'); |
| 166 | + |
| 167 | +return $password; |
| 168 | +``` |
| 169 | + |
| 170 | +## Security |
| 171 | + |
| 172 | +Obviously the cookie isn't absolutely foolproof, my default hash being passed to `openssl_encrypt()` is laughable, and storing the encrypted password md5'd as the hash is laughable– but let's be real, this is a simple password protection package to protect your front-facing site during things such as staging (to prevent webcrawling), maintenance, etc. and I personally believe the effort I put into place is **extremely** overkill as is. |
| 173 | + |
| 174 | +## Contributing |
| 175 | + |
| 176 | +Any contributions are appreciated. There are still some things left untouched such as the ability to customize the cookie hash, filtering the Blade view location, etc. |
| 177 | + |
| 178 | +:heart: |
0 commit comments