friloo/wp-m365-login
1
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions 8

Remove the login box frame and hide "Lost your password?" reliably
Some checks are pending
CI / PHP lint (7.4) (pull_request) Waiting to run
Details
CI / PHP lint (8.0) (pull_request) Waiting to run
Details
CI / PHP lint (8.1) (pull_request) Waiting to run
Details
CI / PHP lint (8.2) (pull_request) Waiting to run
Details
CI / PHP lint (8.3) (pull_request) Waiting to run
Details
CI / PHP lint (8.4) (pull_request) Waiting to run
Details
CI / WordPress Coding Standards (pull_request) Waiting to run
Details
CI / WordPress.org Plugin Check (pull_request) Waiting to run
Details

Browse source 
- No border or shadow around the login box on wp-login.php (form and
  Microsoft block, also in button-only mode); the white area stays.
- Button-only mode: the "Lost your password?" link is removed through
  lost_password_html_link instead of CSS only, the lostpassword,
  retrievepassword, rp and resetpass screens redirect to the login page
  and allow_password_reset refuses resets – all unless the fallback link
  is active.
- The login stylesheet is also loaded when only the form is hidden
  (e.g. broken connection); before, the link and form showed there.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Friederich Loheide 2026-09-24 04:30:13 +00:00
parent cc88f145f2
commit 7749ebff9b
10 changed files with 377 additions and 301 deletions
Download patch file Download diff file Expand all files Collapse all files

95
includes/class-m365-login-auth.php
View file

@ -68,6 +68,12 @@ class M365_Login_Auth {
// Track application-password sign-ins per authenticate pass (XML-RPC multicall runs several passes per request).
add_filter( 'authenticate', array( $this, 'reset_app_password_user' ), 0 );
add_action( 'application_password_did_authenticate', array( $this, 'remember_app_password_user' ) );
// Button-only mode: no "Lost your password?" link, no reset screen, no reset e-mails.
add_filter( 'lost_password_html_link', array( $this, 'hide_lost_password_link' ), 99 );
add_filter( 'allow_password_reset', array( $this, 'block_password_reset' ), 99 );
foreach ( array( 'lostpassword', 'retrievepassword', 'rp', 'resetpass' ) as $reset_action ) {
add_action( 'login_form_' . $reset_action, array( $this, 'block_reset_screen' ) );
}
// No session cookies from API contexts (XML-RPC, REST) while password sign-in is disabled.
add_filter( 'send_auth_cookies', array( $this, 'block_api_auth_cookies' ), 99, 4 );
@ -197,6 +203,50 @@ class M365_Login_Auth {
return new WP_Error( 'm365_login_button_only', __( 'Password sign-in is disabled on this site. Please use the Microsoft button.', 'm365-login' ) );
}
/**
* Whether password resets are switched off (button-only mode without an active fallback).
*
* @return bool
*/
private function passwords_disabled() {
return $this->settings->button_only() && ! $this->fallback_active();
}
/**
* Removes the "Lost your password?" link from wp-login.php (server side, independent of CSS).
*
* @param string $html Link markup.
* @return string
*/
public function hide_lost_password_link( $html ) {
return $this->passwords_disabled() ? '' : $html;
}
/**
* Refuses password resets (form, e-mails, "Send password reset" in the users list).
*
* @param bool|WP_Error $allow Whether the reset is allowed.
* @return bool|WP_Error
*/
public function block_password_reset( $allow ) {
if ( ! $this->passwords_disabled() ) {
return $allow;
}
return new WP_Error( 'm365_login_no_password_reset', __( 'Passwords are not used on this site. Please sign in with the Microsoft button.', 'm365-login' ) );
}
/**
* Sends the lost-password and reset screens back to the login page.
*/
public function block_reset_screen() {
if ( ! $this->passwords_disabled() ) {
return;
}
nocache_headers();
wp_safe_redirect( add_query_arg( 'm365_error', 'password_reset_disabled', $this->settings->login_page_url() ) );
exit;
}
/**
* Starts a new authenticate pass (runs first on the authenticate filter).
*
@ -1261,28 +1311,29 @@ class M365_Login_Auth {
*/
private function error_messages() {
return array(
'not_configured' => __( 'Microsoft login is not configured yet.', 'm365-login' ),
'invalid_state' => __( 'The login request expired or was invalid. Please try again.', 'm365-login' ),
'access_denied' => __( 'Microsoft sign-in was cancelled.', 'm365-login' ),
'provider_error' => __( 'Microsoft returned an error. Please try again.', 'm365-login' ),
'token_exchange' => __( 'Could not complete the sign-in with Microsoft. Please try again or contact an administrator.', 'm365-login' ),
'invalid_token' => __( 'The Microsoft sign-in could not be verified.', 'm365-login' ),
'no_email' => __( 'Your Microsoft account did not provide an e-mail address.', 'm365-login' ),
'domain_not_allowed' => __( 'Your e-mail domain is not allowed to sign in here.', 'm365-login' ),
'no_user' => __( 'No WordPress account exists for your Microsoft e-mail address.', 'm365-login' ),
'oid_mismatch' => __( 'This WordPress account is linked to a different Microsoft account. Please contact an administrator.', 'm365-login' ),
'not_allowed' => __( 'You are not allowed to sign in with this account.', 'm365-login' ),
'not_in_group' => __( 'Your Microsoft account is not a member of a group that is allowed to sign in here.', 'm365-login' ),
'group_check_failed' => __( 'Your group membership could not be verified. Please contact an administrator.', 'm365-login' ),
'in_denied_group' => __( 'Your Microsoft account is a member of a group that is not allowed to sign in here.', 'm365-login' ),
'fallback_invalid' => __( 'The fallback key is not valid.', 'm365-login' ),
'fallback_locked' => __( 'Too many attempts. Please wait 15 minutes.', 'm365-login' ),
'too_many_attempts' => __( 'Too many sign-in attempts from your connection. Please wait a few minutes and try again.', 'm365-login' ),
'account_disabled' => __( 'This account has been deactivated.', 'm365-login' ),
'privileged_unlinked' => __( 'For security reasons this administrator account is not linked automatically. Sign in once with your password and click "Link Microsoft account" on your profile page – or ask an administrator to enter your Microsoft account (user principal name) in your WordPress profile.', 'm365-login' ),
'link_session' => __( 'The link could not be completed because you are no longer signed in to WordPress. Please sign in and try again.', 'm365-login' ),
'link_other' => __( 'Your WordPress account is already linked to a different Microsoft account. An administrator can remove the link in your profile.', 'm365-login' ),
'external_identity' => __( 'Guest and external accounts cannot sign in here.', 'm365-login' ),
'not_configured' => __( 'Microsoft login is not configured yet.', 'm365-login' ),
'invalid_state' => __( 'The login request expired or was invalid. Please try again.', 'm365-login' ),
'access_denied' => __( 'Microsoft sign-in was cancelled.', 'm365-login' ),
'provider_error' => __( 'Microsoft returned an error. Please try again.', 'm365-login' ),
'token_exchange' => __( 'Could not complete the sign-in with Microsoft. Please try again or contact an administrator.', 'm365-login' ),
'invalid_token' => __( 'The Microsoft sign-in could not be verified.', 'm365-login' ),
'no_email' => __( 'Your Microsoft account did not provide an e-mail address.', 'm365-login' ),
'domain_not_allowed' => __( 'Your e-mail domain is not allowed to sign in here.', 'm365-login' ),
'no_user' => __( 'No WordPress account exists for your Microsoft e-mail address.', 'm365-login' ),
'oid_mismatch' => __( 'This WordPress account is linked to a different Microsoft account. Please contact an administrator.', 'm365-login' ),
'not_allowed' => __( 'You are not allowed to sign in with this account.', 'm365-login' ),
'not_in_group' => __( 'Your Microsoft account is not a member of a group that is allowed to sign in here.', 'm365-login' ),
'group_check_failed' => __( 'Your group membership could not be verified. Please contact an administrator.', 'm365-login' ),
'in_denied_group' => __( 'Your Microsoft account is a member of a group that is not allowed to sign in here.', 'm365-login' ),
'fallback_invalid' => __( 'The fallback key is not valid.', 'm365-login' ),
'fallback_locked' => __( 'Too many attempts. Please wait 15 minutes.', 'm365-login' ),
'too_many_attempts' => __( 'Too many sign-in attempts from your connection. Please wait a few minutes and try again.', 'm365-login' ),
'account_disabled' => __( 'This account has been deactivated.', 'm365-login' ),
'privileged_unlinked' => __( 'For security reasons this administrator account is not linked automatically. Sign in once with your password and click "Link Microsoft account" on your profile page – or ask an administrator to enter your Microsoft account (user principal name) in your WordPress profile.', 'm365-login' ),
'link_session' => __( 'The link could not be completed because you are no longer signed in to WordPress. Please sign in and try again.', 'm365-login' ),
'link_other' => __( 'Your WordPress account is already linked to a different Microsoft account. An administrator can remove the link in your profile.', 'm365-login' ),
'external_identity' => __( 'Guest and external accounts cannot sign in here.', 'm365-login' ),
'password_reset_disabled' => __( 'Passwords are not used on this site. Please sign in with the Microsoft button.', 'm365-login' ),
);
}

6
includes/class-m365-login-button.php
View file

@ -212,6 +212,9 @@ class M365_Login_Button {
* @return string[]
*/
public function body_class( $classes ) {
if ( $this->should_render() ) {
$classes[] = 'm365-login-page';
}
if ( $this->form_hidden() ) {
$classes[] = 'm365-button-only';
}
@ -222,7 +225,8 @@ class M365_Login_Button {
* Enqueues login styles and the small positioning script.
*/
public function enqueue() {
if ( ! $this->should_render() ) {
// Also when only the form is hidden (e.g. broken connection): the stylesheet hides the password form and links.
if ( ! $this->should_render() && ! $this->form_hidden() ) {
return;
}
wp_enqueue_style( 'm365-login', M365_LOGIN_URL . 'assets/css/login.css', array(), M365_LOGIN_VERSION );