global $current_user;

if ( isset( $current_user ) && ( $current_user instanceof WP_User ) && ( $id == $current_user->ID ) )

return $current_user;

$current_user = new WP_User( $id, $name );

setup_userdata( $current_user->ID );

do_action('set_current_user');

return $current_user;

global $current_user;

get_currentuserinfo();

return $current_user;

global $current_user;

if ( ! empty( $current_user ) ) {

if ( $current_user instanceof WP_User )

return;

// Upgrade stdClass to WP_User

if ( is_object( $current_user ) && isset( $current_user->ID ) ) {

$cur_id = $current_user->ID;

$current_user = null;

wp_set_current_user( $cur_id );

return;

}

// $current_user has a junk value. Force to WP_User with ID 0.

$current_user = null;

wp_set_current_user( 0 );

return false;

}

if ( defined('XMLRPC_REQUEST') && XMLRPC_REQUEST ) {

wp_set_current_user( 0 );

return false;

}

if ( ! $user = wp_validate_auth_cookie() ) {

if ( is_blog_admin() || is_network_admin() || empty( $_COOKIE[LOGGED_IN_COOKIE] ) || !$user = wp_validate_auth_cookie( $_COOKIE[LOGGED_IN_COOKIE], 'logged_in' ) ) {

wp_set_current_user( 0 );

return false;

}

}

wp_set_current_user( $user );

$userdata = WP_User::get_data_by( $field, $value );

if ( !$userdata )

return false;

$user = new WP_User;

$user->init( $userdata );

return $user;

global $wpdb;

$clean = _get_non_cached_ids( $user_ids, 'users' );

if ( empty( $clean ) )

return;

$list = implode( ',', $clean );

$users = $wpdb->get_results( "SELECT * FROM $wpdb->users WHERE ID IN ($list)" );

$ids = array();

foreach ( $users as $user ) {

update_user_caches( $user );

$ids[] = $user->ID;

}

update_meta_cache( 'user', $ids );

// Compact the input, apply the filters, and extract them back out

extract( apply_filters( 'wp_mail', compact( 'to', 'subject', 'message', 'headers', 'attachments' ) ) );

if ( !is_array($attachments) )

$attachments = explode( "\n", str_replace( "\r\n", "\n", $attachments ) );

global $phpmailer;

// (Re)create it, if it's gone missing

if ( !is_object( $phpmailer ) || !is_a( $phpmailer, 'PHPMailer' ) ) {

require_once ABSPATH . WPINC . '/class-phpmailer.php';

require_once ABSPATH . WPINC . '/class-smtp.php';

$phpmailer = new PHPMailer( true );

}

// Headers

if ( empty( $headers ) ) {

$headers = array();

} else {

if ( !is_array( $headers ) ) {

// Explode the headers out, so this function can take both

// string headers and an array of headers.

$tempheaders = explode( "\n", str_replace( "\r\n", "\n", $headers ) );

} else {

$tempheaders = $headers;

}

$headers = array();

$cc = array();

$bcc = array();

// If it's actually got contents

if ( !empty( $tempheaders ) ) {

// Iterate through the raw headers

foreach ( (array) $tempheaders as $header ) {

if ( strpos($header, ':') === false ) {

if ( false !== stripos( $header, 'boundary=' ) ) {

$parts = preg_split('/boundary=/i', trim( $header ) );

$boundary = trim( str_replace( array( "'", '"' ), '', $parts[1] ) );

}

continue;

}

// Explode them out

list( $name, $content ) = explode( ':', trim( $header ), 2 );

// Cleanup crew

$name = trim( $name );

$content = trim( $content );

switch ( strtolower( $name ) ) {

// Mainly for legacy -- process a From: header if it's there

case 'from':

if ( strpos($content, '<' ) !== false ) {

// So... making my life hard again?

$from_name = substr( $content, 0, strpos( $content, '<' ) - 1 );

$from_name = str_replace( '"', '', $from_name );

$from_name = trim( $from_name );

$from_email = substr( $content, strpos( $content, '<' ) + 1 );

$from_email = str_replace( '>', '', $from_email );

$from_email = trim( $from_email );

} else {

$from_email = trim( $content );

}

break;

case 'content-type':

if ( strpos( $content, ';' ) !== false ) {

list( $type, $charset ) = explode( ';', $content );

$content_type = trim( $type );

if ( false !== stripos( $charset, 'charset=' ) ) {

$charset = trim( str_replace( array( 'charset=', '"' ), '', $charset ) );

} elseif ( false !== stripos( $charset, 'boundary=' ) ) {

$boundary = trim( str_replace( array( 'BOUNDARY=', 'boundary=', '"' ), '', $charset ) );

$charset = '';

}

} else {

$content_type = trim( $content );

}

break;

case 'cc':

$cc = array_merge( (array) $cc, explode( ',', $content ) );

break;

case 'bcc':

$bcc = array_merge( (array) $bcc, explode( ',', $content ) );

break;

default:

// Add it to our grand headers array

$headers[trim( $name )] = trim( $content );

break;

}

}

}

}

// Empty out the values that may be set

$phpmailer->ClearAllRecipients();

$phpmailer->ClearAttachments();

$phpmailer->ClearCustomHeaders();

$phpmailer->ClearReplyTos();

// From email and name

// If we don't have a name from the input headers

if ( !isset( $from_name ) )

$from_name = 'WordPress';

/* If we don't have an email from the input headers default to wordpress@$sitename

if ( !isset( $from_email ) ) {

// Get the site domain and get rid of www.

$sitename = strtolower( $_SERVER['SERVER_NAME'] );

if ( substr( $sitename, 0, 4 ) == 'www.' ) {

$sitename = substr( $sitename, 4 );

}

$from_email = 'wordpress@' . $sitename;

}

// Plugin authors can override the potentially troublesome default

$phpmailer->From = apply_filters( 'wp_mail_from' , $from_email );

$phpmailer->FromName = apply_filters( 'wp_mail_from_name', $from_name );

// Set destination addresses

if ( !is_array( $to ) )

$to = explode( ',', $to );

foreach ( (array) $to as $recipient ) {

try {

// Break $recipient into name and address parts if in the format "Foo <bar@baz.com>"

$recipient_name = '';

if( preg_match( '/(.*)<(.+)>/', $recipient, $matches ) ) {

if ( count( $matches ) == 3 ) {

$recipient_name = $matches[1];

$recipient = $matches[2];

}

}

$phpmailer->AddAddress( $recipient, $recipient_name);

} catch ( phpmailerException $e ) {

continue;

}

}

// Set mail's subject and body

$phpmailer->Subject = $subject;

$phpmailer->Body = $message;

// Add any CC and BCC recipients

if ( !empty( $cc ) ) {

foreach ( (array) $cc as $recipient ) {

try {

// Break $recipient into name and address parts if in the format "Foo <bar@baz.com>"

$recipient_name = '';

if( preg_match( '/(.*)<(.+)>/', $recipient, $matches ) ) {

if ( count( $matches ) == 3 ) {

$recipient_name = $matches[1];

$recipient = $matches[2];

}

}

$phpmailer->AddCc( $recipient, $recipient_name );

} catch ( phpmailerException $e ) {

continue;

}

}

}

if ( !empty( $bcc ) ) {

foreach ( (array) $bcc as $recipient) {

try {

// Break $recipient into name and address parts if in the format "Foo <bar@baz.com>"

$recipient_name = '';

if( preg_match( '/(.*)<(.+)>/', $recipient, $matches ) ) {

if ( count( $matches ) == 3 ) {

$recipient_name = $matches[1];

$recipient = $matches[2];

}

}

$phpmailer->AddBcc( $recipient, $recipient_name );

} catch ( phpmailerException $e ) {

continue;

}

}

}

// Set to use PHP's mail()

$phpmailer->IsMail();

// Set Content-Type and charset

// If we don't have a content-type from the input headers

if ( !isset( $content_type ) )

$content_type = 'text/plain';

$content_type = apply_filters( 'wp_mail_content_type', $content_type );

$phpmailer->ContentType = $content_type;

// Set whether it's plaintext, depending on $content_type

if ( 'text/html' == $content_type )

$phpmailer->IsHTML( true );

// If we don't have a charset from the input headers

if ( !isset( $charset ) )

$charset = get_bloginfo( 'charset' );

// Set the content-type and charset

$phpmailer->CharSet = apply_filters( 'wp_mail_charset', $charset );

// Set custom headers

if ( !empty( $headers ) ) {

foreach( (array) $headers as $name => $content ) {

$phpmailer->AddCustomHeader( sprintf( '%1$s: %2$s', $name, $content ) );

}

if ( false !== stripos( $content_type, 'multipart' ) && ! empty($boundary) )

$phpmailer->AddCustomHeader( sprintf( "Content-Type: %s;\n\t boundary=\"%s\"", $content_type, $boundary ) );

}

if ( !empty( $attachments ) ) {

foreach ( $attachments as $attachment ) {

try {

$phpmailer->AddAttachment($attachment);

} catch ( phpmailerException $e ) {

continue;

}

}

}

do_action_ref_array( 'phpmailer_init', array( &$phpmailer ) );

// Send!

try {

return $phpmailer->Send();

} catch ( phpmailerException $e ) {

return false;

}

$username = sanitize_user($username);

$password = trim($password);

$user = apply_filters('authenticate', null, $username, $password);

if ( $user == null ) {

// TODO what should the error message be? (Or would these even happen?)

// Only needed if all authentication handlers fail to return anything.

$user = new WP_Error('authentication_failed', __('<strong>ERROR</strong>: Invalid username or incorrect password.'));

}

$ignore_codes = array('empty_username', 'empty_password');

if (is_wp_error($user) && !in_array($user->get_error_code(), $ignore_codes) ) {

do_action('wp_login_failed', $username);

}

return $user;

if ( ! $cookie_elements = wp_parse_auth_cookie($cookie, $scheme) ) {

do_action('auth_cookie_malformed', $cookie, $scheme);

return false;

}

extract($cookie_elements, EXTR_OVERWRITE);

$expired = $expiration;

// Allow a grace period for POST and AJAX requests

if ( defined('DOING_AJAX') || 'POST' == $_SERVER['REQUEST_METHOD'] )

$expired += HOUR_IN_SECONDS;

// Quick check to see if an honest cookie has expired

if ( $expired < time() ) {

do_action('auth_cookie_expired', $cookie_elements);

return false;

}

$user = get_user_by('login', $username);

if ( ! $user ) {

do_action('auth_cookie_bad_username', $cookie_elements);

return false;

}

$pass_frag = substr($user->user_pass, 8, 4);

$key = wp_hash($username . $pass_frag . '|' . $expiration, $scheme);

$hash = hash_hmac('md5', $username . '|' . $expiration, $key);

if ( ! hash_equals( $hash, $hmac ) ) {

do_action('auth_cookie_bad_hash', $cookie_elements);

return false;

}

if ( $expiration < time() ) // AJAX/POST grace period set above

$GLOBALS['login_grace_period'] = 1;

do_action('auth_cookie_valid', $cookie_elements, $user);

return $user->ID;

$user = get_userdata($user_id);

$pass_frag = substr($user->user_pass, 8, 4);

$key = wp_hash($user->user_login . $pass_frag . '|' . $expiration, $scheme);

$hash = hash_hmac('md5', $user->user_login . '|' . $expiration, $key);

$cookie = $user->user_login . '|' . $expiration . '|' . $hash;

return apply_filters('auth_cookie', $cookie, $user_id, $expiration, $scheme);

if ( empty($cookie) ) {

switch ($scheme){

case 'auth':

$cookie_name = AUTH_COOKIE;

break;

case 'secure_auth':

$cookie_name = SECURE_AUTH_COOKIE;

break;

case "logged_in":

$cookie_name = LOGGED_IN_COOKIE;

break;

default:

if ( is_ssl() ) {

$cookie_name = SECURE_AUTH_COOKIE;

$scheme = 'secure_auth';

} else {

$cookie_name = AUTH_COOKIE;

$scheme = 'auth';

}

}

if ( empty($_COOKIE[$cookie_name]) )

return false;

$cookie = $_COOKIE[$cookie_name];

}

$cookie_elements = explode('|', $cookie);

if ( count($cookie_elements) != 3 )

return false;

list($username, $expiration, $hmac) = $cookie_elements;

return compact('username', 'expiration', 'hmac', 'scheme');

if ( $remember ) {

$expiration = time() + apply_filters('auth_cookie_expiration', 14 * DAY_IN_SECONDS, $user_id, $remember);

// Ensure the browser will continue to send the cookie after the expiration time is reached.

// Needed for the login grace period in wp_validate_auth_cookie().

$expire = $expiration + ( 12 * HOUR_IN_SECONDS );

} else {

$expiration = time() + apply_filters('auth_cookie_expiration', 2 * DAY_IN_SECONDS, $user_id, $remember);

$expire = 0;

}

if ( '' === $secure )

$secure = is_ssl();

$secure = apply_filters('secure_auth_cookie', $secure, $user_id);

$secure_logged_in_cookie = apply_filters('secure_logged_in_cookie', false, $user_id, $secure);

if ( $secure ) {

$auth_cookie_name = SECURE_AUTH_COOKIE;

$scheme = 'secure_auth';

} else {

$auth_cookie_name = AUTH_COOKIE;

$scheme = 'auth';

}

$auth_cookie = wp_generate_auth_cookie($user_id, $expiration, $scheme);

$logged_in_cookie = wp_generate_auth_cookie($user_id, $expiration, 'logged_in');

do_action('set_auth_cookie', $auth_cookie, $expire, $expiration, $user_id, $scheme);

do_action('set_logged_in_cookie', $logged_in_cookie, $expire, $expiration, $user_id, 'logged_in');

setcookie($auth_cookie_name, $auth_cookie, $expire, PLUGINS_COOKIE_PATH, COOKIE_DOMAIN, $secure, true);

setcookie($auth_cookie_name, $auth_cookie, $expire, ADMIN_COOKIE_PATH, COOKIE_DOMAIN, $secure, true);

setcookie(LOGGED_IN_COOKIE, $logged_in_cookie, $expire, COOKIEPATH, COOKIE_DOMAIN, $secure_logged_in_cookie, true);

if ( COOKIEPATH != SITECOOKIEPATH )

setcookie(LOGGED_IN_COOKIE, $logged_in_cookie, $expire, SITECOOKIEPATH, COOKIE_DOMAIN, $secure_logged_in_cookie, true);

do_action('clear_auth_cookie');

setcookie( AUTH_COOKIE, ' ', time() - YEAR_IN_SECONDS, ADMIN_COOKIE_PATH, COOKIE_DOMAIN );

setcookie( SECURE_AUTH_COOKIE, ' ', time() - YEAR_IN_SECONDS, ADMIN_COOKIE_PATH, COOKIE_DOMAIN );

setcookie( AUTH_COOKIE, ' ', time() - YEAR_IN_SECONDS, PLUGINS_COOKIE_PATH, COOKIE_DOMAIN );

setcookie( SECURE_AUTH_COOKIE, ' ', time() - YEAR_IN_SECONDS, PLUGINS_COOKIE_PATH, COOKIE_DOMAIN );

setcookie( LOGGED_IN_COOKIE, ' ', time() - YEAR_IN_SECONDS, COOKIEPATH, COOKIE_DOMAIN );

setcookie( LOGGED_IN_COOKIE, ' ', time() - YEAR_IN_SECONDS, SITECOOKIEPATH, COOKIE_DOMAIN );

// Old cookies

setcookie( AUTH_COOKIE, ' ', time() - YEAR_IN_SECONDS, COOKIEPATH, COOKIE_DOMAIN );

setcookie( AUTH_COOKIE, ' ', time() - YEAR_IN_SECONDS, SITECOOKIEPATH, COOKIE_DOMAIN );

setcookie( SECURE_AUTH_COOKIE, ' ', time() - YEAR_IN_SECONDS, COOKIEPATH, COOKIE_DOMAIN );

setcookie( SECURE_AUTH_COOKIE, ' ', time() - YEAR_IN_SECONDS, SITECOOKIEPATH, COOKIE_DOMAIN );

// Even older cookies

setcookie( USER_COOKIE, ' ', time() - YEAR_IN_SECONDS, COOKIEPATH, COOKIE_DOMAIN );

setcookie( PASS_COOKIE, ' ', time() - YEAR_IN_SECONDS, COOKIEPATH, COOKIE_DOMAIN );

setcookie( USER_COOKIE, ' ', time() - YEAR_IN_SECONDS, SITECOOKIEPATH, COOKIE_DOMAIN );

setcookie( PASS_COOKIE, ' ', time() - YEAR_IN_SECONDS, SITECOOKIEPATH, COOKIE_DOMAIN );

$user = wp_get_current_user();

if ( ! $user->exists() )

return false;

return true;

// Checks if a user is logged in, if not redirects them to the login page

$secure = ( is_ssl() || force_ssl_admin() );

$secure = apply_filters('secure_auth_redirect', $secure);

// If https is required and request is http, redirect

if ( $secure && !is_ssl() && false !== strpos($_SERVER['REQUEST_URI'], 'wp-admin') ) {

if ( 0 === strpos( $_SERVER['REQUEST_URI'], 'http' ) ) {

wp_redirect( set_url_scheme( $_SERVER['REQUEST_URI'], 'https' ) );

exit();

} else {

wp_redirect( 'https://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'] );

exit();

}

}

/**

$scheme = apply_filters( 'auth_redirect_scheme', '' );

if ( $user_id = wp_validate_auth_cookie( '', $scheme) ) {

do_action('auth_redirect', $user_id);

// If the user wants ssl but the session is not ssl, redirect.

if ( !$secure && get_user_option('use_ssl', $user_id) && false !== strpos($_SERVER['REQUEST_URI'], 'wp-admin') ) {

if ( 0 === strpos( $_SERVER['REQUEST_URI'], 'http' ) ) {

wp_redirect( set_url_scheme( $_SERVER['REQUEST_URI'], 'https' ) );

exit();

} else {

wp_redirect( 'https://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'] );

exit();

}

}

return; // The cookie is good so we're done

}

// The cookie is no good so force login

nocache_headers();

$redirect = ( strpos( $_SERVER['REQUEST_URI'], '/options.php' ) && wp_get_referer() ) ? wp_get_referer() : set_url_scheme( 'http://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'] );

$login_url = wp_login_url($redirect, true);

wp_redirect($login_url);

exit();

if ( -1 == $action )

_doing_it_wrong( __FUNCTION__, __( 'You should specify a nonce action to be verified by using the first parameter.' ), '3.2' );

$adminurl = strtolower(admin_url());

$referer = strtolower(wp_get_referer());

$result = isset($_REQUEST[$query_arg]) ? wp_verify_nonce($_REQUEST[$query_arg], $action) : false;

if ( !$result && !(-1 == $action && strpos($referer, $adminurl) === 0) ) {

wp_nonce_ays($action);

die();

}

do_action('check_admin_referer', $action, $result);

return $result;

$nonce = '';

if ( $query_arg && isset( $_REQUEST[ $query_arg ] ) )

$nonce = $_REQUEST[ $query_arg ];

elseif ( isset( $_REQUEST['_ajax_nonce'] ) )

$nonce = $_REQUEST['_ajax_nonce'];

elseif ( isset( $_REQUEST['_wpnonce'] ) )

$nonce = $_REQUEST['_wpnonce'];

$result = wp_verify_nonce( $nonce, $action );

if ( $die && false == $result ) {

if ( defined( 'DOING_AJAX' ) && DOING_AJAX )

wp_die( -1 );

else

die( '-1' );

}

do_action('check_ajax_referer', $action, $result);

return $result;

global $is_IIS;

/**

$location = apply_filters( 'wp_redirect', $location, $status );

/**

$status = apply_filters( 'wp_redirect_status', $status, $location );

if ( ! $location )

return false;

$location = wp_sanitize_redirect($location);

if ( !$is_IIS && php_sapi_name() != 'cgi-fcgi' )

status_header($status); // This causes problems on IIS and some FastCGI setups

header("Location: $location", true, $status);

return true;

$location = preg_replace('|[^a-z0-9-~+_.?#=&;,/:%!]|i', '', $location);

$location = wp_kses_no_null($location);

// remove %0d and %0a from location

$strip = array('%0d', '%0a', '%0D', '%0A');

$location = _deep_replace($strip, $location);

return $location;

// Need to look at the URL the way it will end up in wp_redirect()

$location = wp_sanitize_redirect($location);

$location = wp_validate_redirect($location, admin_url());

wp_redirect($location, $status);

$location = trim( $location, " \t\n\r\0\x08\x0B" );

// browsers will assume 'http' is your protocol, and will obey a redirect to a URL starting with '//'

if ( substr($location, 0, 2) == '//' )

$location = 'http:' . $location;

// In php 5 parse_url may fail if the URL query part contains http://, bug #38143

$test = ( $cut = strpos($location, '?') ) ? substr( $location, 0, $cut ) : $location;

// @-operator is used to prevent possible warnings in PHP < 5.3.3.

$lp = @parse_url($test);

// Give up if malformed URL

if ( false === $lp )

return $default;

// Allow only http and https schemes. No data:, etc.

if ( isset($lp['scheme']) && !('http' == $lp['scheme'] || 'https' == $lp['scheme']) )

return $default;

// Reject if certain components are set but host is not. This catches urls like https:host.com for which parse_url does not set the host field.

if ( ! isset( $lp['host'] ) && ( isset( $lp['scheme'] ) || isset( $lp['user'] ) || isset( $lp['pass'] ) || isset( $lp['port'] ) ) ) {

return $default;

}

// Reject malformed components parse_url() can return on odd inputs.

foreach ( array( 'user', 'pass', 'host' ) as $component ) {

if ( isset( $lp[ $component ] ) && strpbrk( $lp[ $component ], ':/?#@' ) ) {

return $default;

}