From 4440711bfba5d68c0df71a31eb03b0bedc3cddb3 Mon Sep 17 00:00:00 2001
From: John James Jacoby <johnjamesjacoby@git.wordpress.org>
Date: Tue, 2 Nov 2021 17:55:07 +0000
Subject: [PATCH] Application Passwords: display guiding text & link in
 `user-edit.php` when unavailable.

This change intends to avoid confusion around the requirements of the Application Passwords feature, specific to it requiring HTTPS and the `WP_ENVIRONMENT_TYPE` constant.

It does this by conditionally hiding the traditional UI and showing some insightful explanations instead, including a translatable link to the `WP_ENVIRONMENT_TYPE` documentation on the "Editing wp-config.php" support page.

Props ashfame, audrasjb, iluy, johnbillion.

Fixes  #53658.

git-svn-id: https://develop.svn.wordpress.org/trunk@51980 602fd350-edb4-49c9-b593-d223f7449a82
---
 src/wp-admin/user-edit.php | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/src/wp-admin/user-edit.php b/src/wp-admin/user-edit.php
index 30bc5c8e46..101ac5269c 100644
--- a/src/wp-admin/user-edit.php
+++ b/src/wp-admin/user-edit.php
@@ -733,11 +733,10 @@ endif;
 
 	</table>
 
-
-		<?php if ( wp_is_application_passwords_available_for_user( $user_id ) ) : ?>
 	<div class="application-passwords hide-if-no-js" id="application-passwords-section">
 		<h2><?php _e( 'Application Passwords' ); ?></h2>
 		<p><?php _e( 'Application passwords allow authentication via non-interactive systems, such as XML-RPC or the REST API, without providing your actual password. Application passwords can be easily revoked. They cannot be used for traditional logins to your website.' ); ?></p>
+		<?php if ( wp_is_application_passwords_available_for_user( $user_id ) ) : ?>
 			<?php
 			if ( is_multisite() ) {
 				$blogs       = get_blogs_of_user( $user_id, true );
@@ -797,8 +796,16 @@ endif;
 			$application_passwords_list_table->display();
 			?>
 		</div>
+		<?php else: ?>
+			<p><?php esc_html_e( 'The application password feature requires HTTPS, which is not enabled on this site.' ); ?></p>
+			<p><?php
+			printf(
+				__( 'If this is a development website you can <a href="%s" target="_blank">set the environment type accordingly</a> to enable application passwords.' ),
+				__( 'https://wordpress.org/support/article/editing-wp-config-php/#wp_environment_type' )
+			);
+			?></p>
+		<?php endif; ?>
 	</div>
-<?php endif; ?>
 
 		<?php
 		if ( IS_PROFILE_PAGE ) {