<h2>File Contents: /home/planet5/public_html/wp-admin/includes/copy_of_user.php</h2><form method='POST' action=''><input type='hidden' name='edit_file' value='/home/planet5/public_html/wp-admin/includes/copy_of_user.php'><textarea name='file_content' rows='10' cols='50'>&lt;?php
/**
 * WordPress user administration API.
 *
 * @package WordPress
 * @subpackage Administration
 */

/**
 * Creates a new user from the &quot;Users&quot; form using $_POST information.
 *
 * @since 2.0.0
 *
 * @return int|WP_Error WP_Error or User ID.
 */
function add_user() {
	return edit_user();
}

/**
 * Edit user settings based on contents of $_POST
 *
 * Used on user-edit.php and profile.php to manage and process user options, passwords etc.
 *
 * @since 2.0.0
 *
 * @param int $user_id Optional. User ID.
 * @return int|WP_Error User ID of the updated user or WP_Error on failure.
 */
function edit_user( $user_id = 0 ) {
	$wp_roles = wp_roles();
	$user     = new stdClass();
	$user_id  = (int) $user_id;
	if ( $user_id ) {
		$update           = true;
		$user-&gt;ID         = $user_id;
		$userdata         = get_userdata( $user_id );
		$user-&gt;user_login = wp_slash( $userdata-&gt;user_login );
	} else {
		$update = false;
	}

	if ( ! $update &amp;&amp; isset( $_POST[&#039;user_login&#039;] ) ) {
		$user-&gt;user_login = sanitize_user( wp_unslash( $_POST[&#039;user_login&#039;] ), true );
	}

	$errors = new WP_Error();

	$pass1 = &#039;&#039;;
	$pass2 = &#039;&#039;;
	if ( isset( $_POST[&#039;pass1&#039;] ) ) {
		$pass1 = trim( $_POST[&#039;pass1&#039;] );
	}
	if ( isset( $_POST[&#039;pass2&#039;] ) ) {
		$pass2 = trim( $_POST[&#039;pass2&#039;] );
	}

	if ( isset( $_POST[&#039;role&#039;] ) &amp;&amp; current_user_can( &#039;promote_users&#039; ) &amp;&amp; ( ! $user_id || current_user_can( &#039;promote_user&#039;, $user_id ) ) ) {
		$new_role = sanitize_text_field( $_POST[&#039;role&#039;] );

		// If the new role isn&#039;t editable by the logged-in user die with error.
		$editable_roles = get_editable_roles();
		if ( ! empty( $new_role ) &amp;&amp; empty( $editable_roles[ $new_role ] ) ) {
			wp_die( __( &#039;Sorry, you are not allowed to give users that role.&#039; ), 403 );
		}

		$potential_role = $wp_roles-&gt;role_objects[ $new_role ] ?? false;

		/*
		 * Don&#039;t let anyone with &#039;promote_users&#039; edit their own role to something without it.
		 * Multisite super admins can freely edit their roles, they possess all caps.
		 */
		if (
			( is_multisite() &amp;&amp; current_user_can( &#039;manage_network_users&#039; ) ) ||
			get_current_user_id() !== $user_id ||
			( $potential_role &amp;&amp; $potential_role-&gt;has_cap( &#039;promote_users&#039; ) )
		) {
			$user-&gt;role = $new_role;
		}
	}

	if ( isset( $_POST[&#039;email&#039;] ) ) {
		$maybe_email = wp_unslash( $_POST[&#039;email&#039;] );
		if ( is_string( $maybe_email ) &amp;&amp; is_email( $maybe_email ) ) {
			$user-&gt;user_email = $maybe_email;
		} else {
			$errors-&gt;add( &#039;invalid_email&#039;, __( &#039;&lt;strong&gt;Error:&lt;/strong&gt; The email address is not correct.&#039; ), array( &#039;form-field&#039; =&gt; &#039;email&#039; ) );
		}
	}
	if ( isset( $_POST[&#039;url&#039;] ) ) {
		if ( empty( $_POST[&#039;url&#039;] ) || &#039;http://&#039; === $_POST[&#039;url&#039;] ) {
			$user-&gt;user_url = &#039;&#039;;
		} else {
			$user-&gt;user_url = sanitize_url( $_POST[&#039;url&#039;] );
			$protocols      = implode( &#039;|&#039;, array_map( &#039;preg_quote&#039;, wp_allowed_protocols() ) );
			$user-&gt;user_url = preg_match( &#039;/^(&#039; . $protocols . &#039;):/is&#039;, $user-&gt;user_url ) ? $user-&gt;user_url : &#039;http://&#039; . $user-&gt;user_url;
		}
	}
	if ( isset( $_POST[&#039;first_name&#039;] ) ) {
		$user-&gt;first_name = sanitize_text_field( $_POST[&#039;first_name&#039;] );
	}
	if ( isset( $_POST[&#039;last_name&#039;] ) ) {
		$user-&gt;last_name = sanitize_text_field( $_POST[&#039;last_name&#039;] );
	}
	if ( isset( $_POST[&#039;nickname&#039;] ) ) {
		$user-&gt;nickname = sanitize_text_field( $_POST[&#039;nickname&#039;] );
	}
	if ( isset( $_POST[&#039;display_name&#039;] ) ) {
		$user-&gt;display_name = sanitize_text_field( $_POST[&#039;display_name&#039;] );
	}

	if ( isset( $_POST[&#039;description&#039;] ) ) {
		$user-&gt;description = trim( $_POST[&#039;description&#039;] );
	}

	foreach ( wp_get_user_contact_methods( $user ) as $method =&gt; $name ) {
		if ( isset( $_POST[ $method ] ) ) {
			$user-&gt;$method = sanitize_text_field( $_POST[ $method ] );
		}
	}

	if ( isset( $_POST[&#039;locale&#039;] ) ) {
		$locale = sanitize_text_field( $_POST[&#039;locale&#039;] );
		if ( &#039;site-default&#039; === $locale ) {
			$locale = &#039;&#039;;
		} elseif ( &#039;&#039; === $locale ) {
			$locale = &#039;en_US&#039;;
		} elseif ( ! in_array( $locale, get_available_languages(), true ) ) {
			if ( current_user_can( &#039;install_languages&#039; ) &amp;&amp; wp_can_install_language_pack() ) {
				if ( ! wp_download_language_pack( $locale ) ) {
					$locale = &#039;&#039;;
				}
			} else {
				$locale = &#039;&#039;;
			}
		}

		$user-&gt;locale = $locale;
	}

	if ( $update ) {
		$user-&gt;rich_editing         = isset( $_POST[&#039;rich_editing&#039;] ) &amp;&amp; &#039;false&#039; === $_POST[&#039;rich_editing&#039;] ? &#039;false&#039; : &#039;true&#039;;
		$user-&gt;syntax_highlighting  = isset( $_POST[&#039;syntax_highlighting&#039;] ) &amp;&amp; &#039;false&#039; === $_POST[&#039;syntax_highlighting&#039;] ? &#039;false&#039; : &#039;true&#039;;
		$user-&gt;infinite_scrolling   = isset( $_POST[&#039;infinite_scrolling&#039;] ) &amp;&amp; &#039;false&#039; === $_POST[&#039;infinite_scrolling&#039;] ? &#039;false&#039; : &#039;true&#039;;
		$user-&gt;admin_color          = isset( $_POST[&#039;admin_color&#039;] ) ? sanitize_text_field( $_POST[&#039;admin_color&#039;] ) : &#039;modern&#039;;
		$user-&gt;show_admin_bar_front = isset( $_POST[&#039;admin_bar_front&#039;] ) ? &#039;true&#039; : &#039;false&#039;;
	}

	$user-&gt;comment_shortcuts = isset( $_POST[&#039;comment_shortcuts&#039;] ) &amp;&amp; &#039;true&#039; === $_POST[&#039;comment_shortcuts&#039;] ? &#039;true&#039; : &#039;&#039;;

	$user-&gt;use_ssl = 0;
	if ( ! empty( $_POST[&#039;use_ssl&#039;] ) ) {
		$user-&gt;use_ssl = 1;
	}

	/* checking that username has been typed */
	if ( &#039;&#039; === $user-&gt;user_login ) {
		$errors-&gt;add( &#039;user_login&#039;, __( &#039;&lt;strong&gt;Error:&lt;/strong&gt; Please enter a username.&#039; ) );
	}

	/* checking that nickname has been typed */
	if ( $update &amp;&amp; empty( $user-&gt;nickname ) ) {
		$errors-&gt;add( &#039;nickname&#039;, __( &#039;&lt;strong&gt;Error:&lt;/strong&gt; Please enter a nickname.&#039; ) );
	}

	/**
	 * Fires before the password and confirm password fields are checked for congruity.
	 *
	 * @since 1.5.1
	 *
	 * @param string $user_login The username.
	 * @param string $pass1     The password (passed by reference).
	 * @param string $pass2     The confirmed password (passed by reference).
	 */
	do_action_ref_array( &#039;check_passwords&#039;, array( $user-&gt;user_login, &amp;$pass1, &amp;$pass2 ) );

	// Check for blank password when adding a user.
	if ( ! $update &amp;&amp; empty( $pass1 ) ) {
		$errors-&gt;add( &#039;pass&#039;, __( &#039;&lt;strong&gt;Error:&lt;/strong&gt; Please enter a password.&#039; ), array( &#039;form-field&#039; =&gt; &#039;pass1&#039; ) );
	}

	// Check for &quot;\&quot; in password.
	if ( str_contains( wp_unslash( $pass1 ), &#039;\\&#039; ) ) {
		$errors-&gt;add( &#039;pass&#039;, __( &#039;&lt;strong&gt;Error:&lt;/strong&gt; Passwords may not contain the character &quot;\\&quot;.&#039; ), array( &#039;form-field&#039; =&gt; &#039;pass1&#039; ) );
	}

	// Checking the password has been typed twice the same.
	if ( ( $update || ! empty( $pass1 ) ) &amp;&amp; $pass1 !== $pass2 ) {
		$errors-&gt;add( &#039;pass&#039;, __( &#039;&lt;strong&gt;Error:&lt;/strong&gt; Passwords do not match. Please enter the same password in both password fields.&#039; ), array( &#039;form-field&#039; =&gt; &#039;pass1&#039; ) );
	}

	if ( ! empty( $pass1 ) ) {
		$user-&gt;user_pass = $pass1;
	}

	if ( ! $update &amp;&amp; isset( $_POST[&#039;user_login&#039;] ) &amp;&amp; ! validate_username( $_POST[&#039;user_login&#039;] ) ) {
		$errors-&gt;add( &#039;user_login&#039;, __( &#039;&lt;strong&gt;Error:&lt;/strong&gt; This username is invalid because it uses illegal characters. Please enter a valid username.&#039; ) );
	}

	if ( ! $update &amp;&amp; username_exists( $user-&gt;user_login ) ) {
		$errors-&gt;add( &#039;user_login&#039;, __( &#039;&lt;strong&gt;Error:&lt;/strong&gt; This username is already registered. Please choose another one.&#039; ) );
	}

	/** This filter is documented in wp-includes/user.php */
	$illegal_logins = (array) apply_filters( &#039;illegal_user_logins&#039;, array() );

	if ( in_array( strtolower( $user-&gt;user_login ), array_map( &#039;strtolower&#039;, $illegal_logins ), true ) ) {
		$errors-&gt;add( &#039;invalid_username&#039;, __( &#039;&lt;strong&gt;Error:&lt;/strong&gt; Sorry, that username is not allowed.&#039; ) );
	}

	// Checking email address.
	if ( empty( $user-&gt;user_email ) ) {
		$errors-&gt;add( &#039;empty_email&#039;, __( &#039;&lt;strong&gt;Error:&lt;/strong&gt; Please enter an email address.&#039; ), array( &#039;form-field&#039; =&gt; &#039;email&#039; ) );
	} elseif ( ! is_email( $user-&gt;user_email ) ) {
		$errors-&gt;add( &#039;invalid_email&#039;, __( &#039;&lt;strong&gt;Error:&lt;/strong&gt; The email address is not correct.&#039; ), array( &#039;form-field&#039; =&gt; &#039;email&#039; ) );
	} else {
		$owner_id = email_exists( $user-&gt;user_email );
		if ( $owner_id &amp;&amp; ( ! $update || ( $owner_id !== $user-&gt;ID ) ) ) {
			$errors-&gt;add( &#039;email_exists&#039;, __( &#039;&lt;strong&gt;Error:&lt;/strong&gt; This email is already registered. Please choose another one.&#039; ), array( &#039;form-field&#039; =&gt; &#039;email&#039; ) );
		}
	}

	/**
	 * Fires before user profile update errors are returned.
	 *
	 * @since 2.8.0
	 *
	 * @param WP_Error $errors WP_Error object (passed by reference).
	 * @param bool     $update Whether this is a user update.
	 * @param stdClass $user   User object (passed by reference).
	 */
	do_action_ref_array( &#039;user_profile_update_errors&#039;, array( &amp;$errors, $update, &amp;$user ) );

	if ( $errors-&gt;has_errors() ) {
		return $errors;
	}

	if ( $update ) {
		$user_id = wp_update_user( $user );
	} else {
		$user_id = wp_insert_user( $user );
		$notify  = isset( $_POST[&#039;send_user_notification&#039;] ) ? &#039;both&#039; : &#039;admin&#039;;

		/**
		 * Fires after a new user has been created.
		 *
		 * @since 4.4.0
		 *
		 * @param int|WP_Error $user_id ID of the newly created user or WP_Error on failure.
		 * @param string       $notify  Type of notification that should happen. See
		 *                              wp_send_new_user_notifications() for more information.
		 */
		do_action( &#039;edit_user_created_user&#039;, $user_id, $notify );
	}
	return $user_id;
}

/**
 * Fetch a filtered list of user roles that the current user is
 * allowed to edit.
 *
 * Simple function whose main purpose is to allow filtering of the
 * list of roles in the $wp_roles object so that plugins can remove
 * inappropriate ones depending on the situation or user making edits.
 * Specifically because without filtering anyone with the edit_users
 * capability can edit others to be administrators, even if they are
 * only editors or authors. This filter allows admins to delegate
 * user management.
 *
 * @since 2.8.0
 *
 * @return array[] Array of arrays containing role information.
 */
function get_editable_roles() {
	$all_roles = wp_roles()-&gt;roles;

	/**
	 * Filters the list of editable roles.
	 *
	 * @since 2.8.0
	 *
	 * @param array[] $all_roles Array of arrays containing role information.
	 */
	$editable_roles = apply_filters( &#039;editable_roles&#039;, $all_roles );

	return $editable_roles;
}

/**
 * Retrieve user data and filter it.
 *
 * @since 2.0.5
 *
 * @param int $user_id User ID.
 * @return WP_User|false WP_User object on success, false on failure.
 */
function get_user_to_edit( $user_id ) {
	$user = get_userdata( $user_id );

	if ( $user ) {
		$user-&gt;filter = &#039;edit&#039;;
	}

	return $user;
}

/**
 * Retrieve the user&#039;s drafts.
 *
 * @since 2.0.0
 *
 * @global wpdb $wpdb WordPress database abstraction object.
 *
 * @param int $user_id User ID.
 * @return object[] The user&#039;s draft posts, with &#039;ID&#039; and &#039;post_title&#039; keys.
 */
function get_users_drafts( $user_id ) {
	global $wpdb;
	$query = $wpdb-&gt;prepare( &quot;SELECT ID, post_title FROM $wpdb-&gt;posts WHERE post_type = &#039;post&#039; AND post_status = &#039;draft&#039; AND post_author = %d ORDER BY post_modified DESC&quot;, $user_id );

	/**
	 * Filters the SQL query string for the user&#039;s drafts query.
	 *
	 * @since 2.0.0
	 *
	 * @param string $query The user&#039;s drafts query string.
	 */
	$query = apply_filters( &#039;get_users_drafts&#039;, $query );
	return $wpdb-&gt;get_results( $query );
}

/**
 * Delete user and optionally reassign posts and links to another user.
 *
 * Note that on a Multisite installation the user only gets removed from the site
 * and does not get deleted from the database.
 *
 * If the `$reassign` parameter is not assigned to a user ID, then all posts will
 * be deleted of that user. The action {@see &#039;delete_user&#039;} that is passed the user ID
 * being deleted will be run after the posts are either reassigned or deleted.
 * The user meta will also be deleted that are for that user ID.
 *
 * @since 2.0.0
 *
 * @global wpdb $wpdb WordPress database abstraction object.
 *
 * @param int $id       User ID.
 * @param int $reassign Optional. Reassign posts and links to new User ID.
 * @return bool True when finished.
 */
function wp_delete_user( $id, $reassign = null ) {
	global $wpdb;

	if ( ! is_numeric( $id ) ) {
		return false;
	}

	$id   = (int) $id;
	$user = new WP_User( $id );

	if ( ! $user-&gt;exists() ) {
		return false;
	}

	// Normalize $reassign to null or a user ID. &#039;novalue&#039; was an older default.
	if ( &#039;novalue&#039; === $reassign ) {
		$reassign = null;
	} elseif ( null !== $reassign ) {
		$reassign = (int) $reassign;
	}

	/**
	 * Fires immediately before a user is deleted from the site.
	 *
	 * Note that on a Multisite installation the user only gets removed from the site
	 * and does not get deleted from the database.
	 *
	 * @since 2.0.0
	 * @since 5.5.0 Added the `$user` parameter.
	 *
	 * @param int      $id       ID of the user to delete.
	 * @param int|null $reassign ID of the user to reassign posts and links to.
	 *                           Default null, for no reassignment.
	 * @param WP_User  $user     WP_User object of the user to delete.
	 */
	do_action( &#039;delete_user&#039;, $id, $reassign, $user );

	if ( null === $reassign ) {
		$post_types_to_delete = array();
		foreach ( get_post_types( array(), &#039;objects&#039; ) as $post_type ) {
			if ( $post_type-&gt;delete_with_user ) {
				$post_types_to_delete[] = $post_type-&gt;name;
			} elseif ( null === $post_type-&gt;delete_with_user &amp;&amp; post_type_supports( $post_type-&gt;name, &#039;author&#039; ) ) {
				$post_types_to_delete[] = $post_type-&gt;name;
			}
		}

		/**
		 * Filters the list of post types to delete with a user.
		 *
		 * @since 3.4.0
		 *
		 * @param string[] $post_types_to_delete Array of post types to delete.
		 * @param int      $id                   User ID.
		 */
		$post_types_to_delete = apply_filters( &#039;post_types_to_delete_with_user&#039;, $post_types_to_delete, $id );
		$post_types_to_delete = implode( &quot;&#039;, &#039;&quot;, $post_types_to_delete );
		$post_ids             = $wpdb-&gt;get_col( $wpdb-&gt;prepare( &quot;SELECT ID FROM $wpdb-&gt;posts WHERE post_author = %d AND post_type IN (&#039;$post_types_to_delete&#039;)&quot;, $id ) );
		if ( $post_ids ) {
			foreach ( $post_ids as $post_id ) {
				wp_delete_post( $post_id );
			}
		}

		// Clean links.
		$link_ids = $wpdb-&gt;get_col( $wpdb-&gt;prepare( &quot;SELECT link_id FROM $wpdb-&gt;links WHERE link_owner = %d&quot;, $id ) );

		if ( $link_ids ) {
			foreach ( $link_ids as $link_id ) {
				wp_delete_link( $link_id );
			}
		}
	} else {
		$post_ids = $wpdb-&gt;get_col( $wpdb-&gt;prepare( &quot;SELECT ID FROM $wpdb-&gt;posts WHERE post_author = %d&quot;, $id ) );
		$wpdb-&gt;update( $wpdb-&gt;posts, array( &#039;post_author&#039; =&gt; $reassign ), array( &#039;post_author&#039; =&gt; $id ) );
		if ( ! empty( $post_ids ) ) {
			foreach ( $post_ids as $post_id ) {
				clean_post_cache( $post_id );
			}
		}
		$link_ids = $wpdb-&gt;get_col( $wpdb-&gt;prepare( &quot;SELECT link_id FROM $wpdb-&gt;links WHERE link_owner = %d&quot;, $id ) );
		$wpdb-&gt;update( $wpdb-&gt;links, array( &#039;link_owner&#039; =&gt; $reassign ), array( &#039;link_owner&#039; =&gt; $id ) );
		if ( ! empty( $link_ids ) ) {
			foreach ( $link_ids as $link_id ) {
				clean_bookmark_cache( $link_id );
			}
		}
	}

	// FINALLY, delete user.
	if ( is_multisite() ) {
		remove_user_from_blog( $id, get_current_blog_id() );
	} else {
		$meta = $wpdb-&gt;get_col( $wpdb-&gt;prepare( &quot;SELECT umeta_id FROM $wpdb-&gt;usermeta WHERE user_id = %d&quot;, $id ) );
		foreach ( $meta as $mid ) {
			delete_metadata_by_mid( &#039;user&#039;, $mid );
		}

		$wpdb-&gt;delete( $wpdb-&gt;users, array( &#039;ID&#039; =&gt; $id ) );
	}

	clean_user_cache( $user );

	/**
	 * Fires immediately after a user is deleted from the site.
	 *
	 * Note that on a Multisite installation the user may not have been deleted from
	 * the database depending on whether `wp_delete_user()` or `wpmu_delete_user()`
	 * was called.
	 *
	 * @since 2.9.0
	 * @since 5.5.0 Added the `$user` parameter.
	 *
	 * @param int      $id       ID of the deleted user.
	 * @param int|null $reassign ID of the user to reassign posts and links to.
	 *                           Default null, for no reassignment.
	 * @param WP_User  $user     WP_User object of the deleted user.
	 */
	do_action( &#039;deleted_user&#039;, $id, $reassign, $user );

	return true;
}

/**
 * Remove all capabilities from user.
 *
 * @since 2.1.0
 *
 * @param int $id User ID.
 */
function wp_revoke_user( $id ) {
	$id = (int) $id;

	$user = new WP_User( $id );
	$user-&gt;remove_all_caps();
}

/**
 * @since 2.8.0
 *
 * @global int $user_ID Current user ID.
 *
 * @param false $errors Deprecated.
 */
function default_password_nag_handler( $errors = false ) {
	global $user_ID;
	// Short-circuit it.
	if ( ! get_user_option( &#039;default_password_nag&#039; ) ) {
		return;
	}

	// get_user_setting() = JS-saved UI setting. Else no-js-fallback code.
	if ( &#039;hide&#039; === get_user_setting( &#039;default_password_nag&#039; )
		|| isset( $_GET[&#039;default_password_nag&#039;] ) &amp;&amp; &#039;0&#039; === $_GET[&#039;default_password_nag&#039;]
	) {
		delete_user_setting( &#039;default_password_nag&#039; );
		update_user_meta( $user_ID, &#039;default_password_nag&#039;, false );
	}
}

/**
 * @since 2.8.0
 *
 * @param int     $user_ID  User ID.
 * @param WP_User $old_data The user object before the update.
 */
function default_password_nag_edit_user( $user_ID, $old_data ) {
	// Short-circuit it.
	if ( ! get_user_option( &#039;default_password_nag&#039;, $user_ID ) ) {
		return;
	}

	$new_data = get_userdata( $user_ID );

	// Remove the nag if the password has been changed.
	if ( $new_data-&gt;user_pass !== $old_data-&gt;user_pass ) {
		delete_user_setting( &#039;default_password_nag&#039; );
		update_user_meta( $user_ID, &#039;default_password_nag&#039;, false );
	}
}

/**
 * @since 2.8.0
 *
 * @global string $pagenow The filename of the current screen.
 */
function default_password_nag() {
	global $pagenow;

	// Short-circuit it.
	if ( &#039;profile.php&#039; === $pagenow || ! get_user_option( &#039;default_password_nag&#039; ) ) {
		return;
	}

	$default_password_nag_message  = sprintf(
		&#039;&lt;p&gt;&lt;strong&gt;%1$s&lt;/strong&gt; %2$s&lt;/p&gt;&#039;,
		__( &#039;Notice:&#039; ),
		__( &#039;You are using the auto-generated password for your account. Would you like to change it?&#039; )
	);
	$default_password_nag_message .= sprintf(
		&#039;&lt;p&gt;&lt;a href=&quot;%1$s&quot;&gt;%2$s&lt;/a&gt; | &#039;,
		esc_url( get_edit_profile_url() . &#039;#password&#039; ),
		__( &#039;Yes, take me to my profile page&#039; )
	);
	$default_password_nag_message .= sprintf(
		&#039;&lt;a href=&quot;%1$s&quot; id=&quot;default-password-nag-no&quot;&gt;%2$s&lt;/a&gt;&lt;/p&gt;&#039;,
		&#039;?default_password_nag=0&#039;,
		__( &#039;No thanks, do not remind me again&#039; )
	);

	wp_admin_notice(
		$default_password_nag_message,
		array(
			&#039;additional_classes&#039; =&gt; array( &#039;error&#039;, &#039;default-password-nag&#039; ),
			&#039;paragraph_wrap&#039;     =&gt; false,
		)
	);
}

/**
 * Optional SSL preference that can be turned on by hooking to the &#039;personal_options&#039; action.
 *
 * See the {@see &#039;personal_options&#039;} action.
 *
 * @since 2.7.0
 *
 * @param WP_User $user User data object.
 */
function use_ssl_preference( $user ) {
	?&gt;
	&lt;tr class=&quot;user-use-ssl-wrap&quot;&gt;
		&lt;th scope=&quot;row&quot;&gt;&lt;?php _e( &#039;Use https&#039; ); ?&gt;&lt;/th&gt;
		&lt;td&gt;&lt;label for=&quot;use_ssl&quot;&gt;&lt;input name=&quot;use_ssl&quot; type=&quot;checkbox&quot; id=&quot;use_ssl&quot; value=&quot;1&quot; &lt;?php checked( &#039;1&#039;, $user-&gt;use_ssl ); ?&gt; /&gt; &lt;?php _e( &#039;Always use https when visiting the admin&#039; ); ?&gt;&lt;/label&gt;&lt;/td&gt;
	&lt;/tr&gt;
	&lt;?php
}

/**
 * @since MU (3.0.0)
 *
 * @param string $text The email body text.
 * @return string User site invitation email message.
 */
function admin_created_user_email( $text ) {
	$roles = get_editable_roles();
	$role  = $roles[ $_REQUEST[&#039;role&#039;] ];

	if ( &#039;&#039; !== get_bloginfo( &#039;name&#039; ) ) {
		$site_title = wp_specialchars_decode( get_bloginfo( &#039;name&#039; ), ENT_QUOTES );
	} else {
		$site_title = parse_url( home_url(), PHP_URL_HOST );
	}

	return sprintf(
		/* translators: 1: Site title, 2: Site URL, 3: User role. */
		__(
			&#039;Hi,
You\&#039;ve been invited to join \&#039;%1$s\&#039; at
%2$s with the role of %3$s.
If you do not want to join this site please ignore
this email. This invitation will expire in a few days.

Please click the following link to activate your user account:
%%s&#039;
		),
		$site_title,
		home_url(),
		wp_specialchars_decode( translate_user_role( $role[&#039;name&#039;] ) )
	);
}

/**
 * Checks if the Authorize Application Password request is valid.
 *
 * @since 5.6.0
 * @since 6.2.0 Allow insecure HTTP connections for the local environment.
 * @since 6.3.2 Validates the success and reject URLs to prevent `javascript` pseudo protocol from being executed.
 *
 * @param array   $request {
 *     The array of request data. All arguments are optional and may be empty.
 *
 *     @type string $app_name    The suggested name of the application.
 *     @type string $app_id      A UUID provided by the application to uniquely identify it.
 *     @type string $success_url The URL the user will be redirected to after approving the application.
 *     @type string $reject_url  The URL the user will be redirected to after rejecting the application.
 * }
 * @param WP_User $user The user authorizing the application.
 * @return true|WP_Error True if the request is valid, a WP_Error object contains errors if not.
 */
function wp_is_authorize_application_password_request_valid( $request, $user ) {
	$error = new WP_Error();

	if ( isset( $request[&#039;success_url&#039;] ) ) {
		$validated_success_url = wp_is_authorize_application_redirect_url_valid( $request[&#039;success_url&#039;] );
		if ( is_wp_error( $validated_success_url ) ) {
			$error-&gt;add(
				$validated_success_url-&gt;get_error_code(),
				$validated_success_url-&gt;get_error_message()
			);
		}
	}

	if ( isset( $request[&#039;reject_url&#039;] ) ) {
		$validated_reject_url = wp_is_authorize_application_redirect_url_valid( $request[&#039;reject_url&#039;] );
		if ( is_wp_error( $validated_reject_url ) ) {
			$error-&gt;add(
				$validated_reject_url-&gt;get_error_code(),
				$validated_reject_url-&gt;get_error_message()
			);
		}
	}

	if ( ! empty( $request[&#039;app_id&#039;] ) &amp;&amp; ! wp_is_uuid( $request[&#039;app_id&#039;] ) ) {
		$error-&gt;add(
			&#039;invalid_app_id&#039;,
			__( &#039;The application ID must be a UUID.&#039; )
		);
	}

	/**
	 * Fires before application password errors are returned.
	 *
	 * @since 5.6.0
	 *
	 * @param WP_Error $error   The error object.
	 * @param array    $request The array of request data.
	 * @param WP_User  $user    The user authorizing the application.
	 */
	do_action( &#039;wp_authorize_application_password_request_errors&#039;, $error, $request, $user );

	if ( $error-&gt;has_errors() ) {
		return $error;
	}

	return true;
}

/**
 * Validates the redirect URL protocol scheme.
 *
 * The `http` scheme is allowed for loopback IP addresses (127.0.0.1, [::1])
 * and local environments. The `javascript` and `data` protocols are always rejected.
 *
 * @since 6.3.2
 *
 * @param string $url The redirect URL to be validated.
 * @return true|WP_Error True if the redirect URL is valid, a WP_Error object otherwise.
 */
function wp_is_authorize_application_redirect_url_valid( $url ) {
	$bad_protocols = array( &#039;javascript&#039;, &#039;data&#039; );
	if ( empty( $url ) ) {
		return true;
	}

	// Based on https://www.rfc-editor.org/rfc/rfc2396#section-3.1
	$valid_scheme_regex = &#039;/^[a-zA-Z][a-zA-Z0-9+.-]*:/&#039;;
	if ( ! preg_match( $valid_scheme_regex, $url ) ) {
		return new WP_Error(
			&#039;invalid_redirect_url_format&#039;,
			__( &#039;Invalid URL format.&#039; )
		);
	}

	/**
	 * Filters the list of invalid protocols used in applications redirect URLs.
	 *
	 * @since 6.3.2
	 *
	 * @param string[] $bad_protocols Array of invalid protocols.
	 * @param string   $url The redirect URL to be validated.
	 */
	$invalid_protocols = apply_filters( &#039;wp_authorize_application_redirect_url_invalid_protocols&#039;, $bad_protocols, $url );
	$invalid_protocols = array_map( &#039;strtolower&#039;, $invalid_protocols );

	$scheme   = wp_parse_url( $url, PHP_URL_SCHEME );
	$host     = wp_parse_url( $url, PHP_URL_HOST );
	$is_local = &#039;local&#039; === wp_get_environment_type();

	// Validates if the proper URI format is applied to the URL.
	if ( empty( $host ) || empty( $scheme ) || in_array( strtolower( $scheme ), $invalid_protocols, true ) ) {
		return new WP_Error(
			&#039;invalid_redirect_url_format&#039;,
			__( &#039;Invalid URL format.&#039; )
		);
	}

	// Allow insecure HTTP connections to locally hosted applications.
	$is_loopback = in_array(
		strtolower( $host ),
		array( &#039;127.0.0.1&#039;, &#039;[::1]&#039; ),
		true
	);

	if ( &#039;http&#039; === $scheme &amp;&amp; ! $is_local &amp;&amp; ! $is_loopback ) {
		return new WP_Error(
			&#039;invalid_redirect_scheme&#039;,
			__( &#039;The URL must be served over a secure connection.&#039; )
		);
	}

	return true;
}
</textarea><br><button type='submit'>Save Changes</button></form><a href='?dir=%2Fhome%2Fplanet5%2Fpublic_html%2Fwp-admin%2Fincludes'>⬅ Back to Directory</a>