Theme_My_Login_Widget::widget()

public function widget( $args, $instance ) {
    $instance = wp_parse_args( $instance, $this->defaults() );

    $show_widget = ( is_user_logged_in() && 'login' !== $instance['action'] ) || ! tml_is_action();

    /**
     * Filters whether to show the widget or not.
     *
     * @since 7.0.5
     *
     * @param bool  $show_widget Whether to show the widget or not.
     * @param array $instance    The widget instance settings.
     */
    $show_widget = apply_filters( 'tml_show_widget', $show_widget, $instance );

    if ( ! $show_widget ) {
        return;
    }

    if ( is_user_logged_in() ) {
        $title = _x( 'Welcome', 'Howdy', 'theme-my-login' );
    } else {
        $title = tml_get_action_title( $instance['action'] );
    }
    $title = apply_filters( 'widget_title', $title, $instance, $this->id_base );

    // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- before_widget/before_title/after_title come from the theme's register_sidebar() args, not request data; matches how every WP core bundled widget outputs them.
    echo $args['before_widget'];

    if ( $title ) {
        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- matches WP core's own widget convention of not escaping widget_title-filtered output (see e.g. WP_Widget_Pages::widget()); before_title/after_title are theme-provided wrapper markup.
        echo $args['before_title'] . $title . $args['after_title'];
    }

    if ( is_user_logged_in() ) :
        /**
         * Filters the size of the avatar shwon in the widget when logged in.
         *
         * @since 7.0.5
         *
         * @param int $avatar_size The size of the avatar shown in the widget when logged in.
         */
        $avatar_size = apply_filters( 'tml_widget_avatar_size', 64 );

        /**
         * Filters the links shown in the widget when logged in.
         *
         * @since 7.0.5
         *
         * @param array $user_links The links shown in the widget when logged in.
         */
        // phpcs:disable WordPress.WP.I18n.MissingArgDomain -- these labels intentionally reuse WP core's translated strings ("Site Admin"/"Dashboard"/"Edit Profile"/"Log Out" all exist verbatim in wp-admin/wp-includes), not TML-specific strings.
        $user_links = apply_filters(
            'tml_widget_user_links',
            array_filter(
                array(
                    'site_admin' => current_user_can( 'edit_posts' ) ? array(
                        'title' => __( 'Site Admin' ),
                        'url'   => admin_url(),
                    ) : false,
                    'dashboard'  => array(
                        'title' => __( 'Dashboard' ),
                        'url'   => tml_get_action_url( 'dashboard' ),
                    ),
                    'profile'    => array(
                        'title' => __( 'Edit Profile' ),
                        'url'   => admin_url( 'profile.php' ),
                    ),
                    'logout'     => array(
                        'title' => __( 'Log Out' ),
                        'url'   => wp_logout_url(),
                    ),
                )
            )
        );
        // phpcs:enable WordPress.WP.I18n.MissingArgDomain
        ?>

        <div class="tml tml-user-panel">
            <?php if ( ! empty( $avatar_size ) ) : ?>
                <div class="tml-user-avatar"><?php echo get_avatar( get_current_user_id(), $avatar_size ); ?></div>
            <?php endif; ?>

            <?php if ( ! empty( $user_links ) ) : ?>
                <ul class="tml-user-links">

                <?php foreach ( $user_links as $name => $user_link ) : ?>

                    <li class="tml-user-link-<?php echo esc_attr( $name ); ?>">
                        <a href="<?php echo esc_url( $user_link['url'] ); ?>"><?php echo esc_html( $user_link['title'] ); ?></a>
                    </li>

                <?php endforeach; ?>

                </ul>
            <?php endif; ?>

            <?php
            /**
             * Fires at the end of the logged in widget.
             *
             * @since 7.0.5
             *
             * @param array $instance The widget instance settings.
             */
            do_action( 'tml_widget_user_panel', $instance );
            ?>

        </div>

        <?php
    else :

        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- tml_shortcode() builds its own safely-escaped markup internally (see includes/shortcodes.php).
        echo tml_shortcode(
            array(
                'action'      => $instance['action'],
                'show_links'  => $instance['show_links'],
                'redirect_to' => $_SERVER['REQUEST_URI'],
            )
        );

    endif;

    // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- after_widget comes from the theme's register_sidebar() args, not request data; matches how every WP core bundled widget outputs it.
    echo $args['after_widget'];
}

View src/includes/class-theme-my-login-widget.php, line 41 on GitHub