From c6effa5afc6e64ce61ba3fa923ce36d93b0ce0f9 Mon Sep 17 00:00:00 2001
From: Sazedul Haque <sazedulhaque5@gmail.com>
Date: Tue, 5 May 2026 12:31:24 +0600
Subject: [PATCH 1/2] Make password modal non-dismissible

Add data-tutor-modal-no-dismiss to the password-protected template to mark the modal as non-dismissible. Update modal.js to skip closing modals that have this attribute on Escape or overlay/click, while still allowing explicit close buttons to close such modals. This prevents accidental dismissal of the password prompt while preserving deliberate close actions.
---
 templates/single/password-protected.php |  2 +-
 v2-library/src/js/modal.js              | 13 +++++++++++--
 2 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/templates/single/password-protected.php b/templates/single/password-protected.php
index 9addac2d6d..b41dc719c2 100644
--- a/templates/single/password-protected.php
+++ b/templates/single/password-protected.php
@@ -18,7 +18,7 @@
 	<?php ( isset( $is_enrolled ) && $is_enrolled ) ? tutor_course_enrolled_lead_info() : tutor_course_lead_info(); ?>
 	<?php tutor_utils()->has_video_in_single() ? tutor_course_video() : get_tutor_course_thumbnail(); ?>
 
-	<div id="tutor-password-protected-modal" class="tutor-modal tutor-is-active" role="dialog" aria-modal="true" aria-labelledby="tutor-password-protected-title" aria-hidden="false">
+	<div id="tutor-password-protected-modal" class="tutor-modal tutor-is-active" role="dialog" aria-modal="true" aria-labelledby="tutor-password-protected-title" aria-hidden="false" data-tutor-modal-no-dismiss>
 		<div class="tutor-modal-overlay"></div>
 		<div class="tutor-modal-window" style="max-width: 834px;">
 			<div class="tutor-modal-content tutor-bg-white tutor-p-40">
diff --git a/v2-library/src/js/modal.js b/v2-library/src/js/modal.js
index b48f24238e..579bc63d30 100644
--- a/v2-library/src/js/modal.js
+++ b/v2-library/src/js/modal.js
@@ -135,7 +135,9 @@
 
 		if (e.key === 'Escape' || e.key === 'Esc') {
 			e.preventDefault();
-			closeModal(activeModal);
+			if (!activeModal.hasAttribute('data-tutor-modal-no-dismiss')) {
+				closeModal(activeModal);
+			}
 		} else if (e.key === 'Tab') {
 			trapFocus(e);
 		}
@@ -159,7 +161,14 @@
 		if (e.target.hasAttribute(closeAttr) || e.target.classList.contains(overlay) || e.target.closest(`[${closeAttr}]`)) {
 			e.preventDefault();
 			const modal = e.target.closest('.tutor-modal.tutor-is-active');
-			if (modal) closeModal(modal);
+			if (modal && !modal.hasAttribute('data-tutor-modal-no-dismiss')) {
+				closeModal(modal);
+			} else if (modal && !e.target.classList.contains(overlay) && !e.target.closest(`.${overlay}`)) {
+				// Allow explicit close buttons even on no-dismiss modals
+				if (e.target.hasAttribute(closeAttr) || e.target.closest(`[${closeAttr}]`)) {
+					closeModal(modal);
+				}
+			}
 		}
 	});
 

From b3c39e414266e207e4f5f779b6a100336d53d625 Mon Sep 17 00:00:00 2001
From: Sazedul Haque <sazedulhaque5@gmail.com>
Date: Tue, 5 May 2026 13:06:33 +0600
Subject: [PATCH 2/2] Bypass password for enrolled users

Add a post_password_required filter and implement bypass_password_for_enrolled to allow enrolled users to view password-protected course and bundle posts. The new method returns false (no password required) when the post is a course or bundle and the current user is enrolled; otherwise it preserves the original value. Includes a docblock (since 3.0.0) and registers the filter in the class initialization.
---
 classes/Course.php | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/classes/Course.php b/classes/Course.php
index d89778ba93..fac8d341bf 100644
--- a/classes/Course.php
+++ b/classes/Course.php
@@ -299,6 +299,7 @@ public function __construct( $register_hooks = true ) {
 
 		add_filter( 'template_include', array( $this, 'handle_password_protected' ) );
 		add_action( 'login_form_postpass', array( $this, 'handle_password_submit' ) );
+		add_filter( 'post_password_required', array( $this, 'bypass_password_for_enrolled' ), 10, 2 );
 		add_filter( 'the_preview', array( $this, 'handle_schedule_courses' ) );
 	}
 
@@ -342,6 +343,29 @@ public function handle_password_submit() {
 		}
 	}
 
+	/**
+	 * Bypass password protection for enrolled users.
+	 *
+	 * @since 3.0.0
+	 *
+	 * @param bool    $required Whether the password is required.
+	 * @param WP_Post $post     The post object.
+	 *
+	 * @return bool false if the current user is enrolled, original value otherwise.
+	 */
+	public function bypass_password_for_enrolled( $required, $post ) {
+		if ( ! $required ) {
+			return $required;
+		}
+
+		$post_types = array( tutor()->course_post_type, tutor()->bundle_post_type );
+		if ( in_array( $post->post_type, $post_types, true ) && tutor_utils()->is_enrolled( $post->ID ) ) {
+			return false;
+		}
+
+		return $required;
+	}
+
 	/**
 	 * Handle password protected course/bundle.
 	 *