| 1 |
<?php |
| 2 |
namespace ABlocks\Blocks\FormBuilder; |
| 3 |
|
| 4 |
use Exception; |
| 5 |
/** |
| 6 |
* @class EmailVerification |
| 7 |
* This class is user to verify forms email |
| 8 |
*/ |
| 9 |
class EmailVerification { |
| 10 |
/** Link expiration time */ |
| 11 |
const EXPIRE_IN = 3600; |
| 12 |
private int $id; |
| 13 |
private string $email; |
| 14 |
private string $verification_token; |
| 15 |
|
| 16 |
private string $signature; |
| 17 |
private bool $expiration_check = false; |
| 18 |
private int $expire_at; |
| 19 |
|
| 20 |
public function __construct( $id_or_email, ?string $search_key = null ) { |
| 21 |
global $wpdb; |
| 22 |
$table_entries = $wpdb->prefix . ABLOCKS_PLUGIN_SLUG . '_form_entries'; |
| 23 |
|
| 24 |
if ( $search_key === 'id' ) { |
| 25 |
$query = "SELECT id, user_email, email_verification_token, expire, is_email_verified FROM {$table_entries} WHERE id = %d"; |
| 26 |
} else { |
| 27 |
$query = "SELECT id, user_email, email_verification_token, expire, is_email_verified FROM {$table_entries} WHERE user_email = %s"; |
| 28 |
} |
| 29 |
// phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared |
| 30 |
$entry = $wpdb->get_row( $wpdb->prepare( $query, $id_or_email ), ARRAY_A ); |
| 31 |
|
| 32 |
if ( |
| 33 |
! array_key_exists( 'email_verification_token', $entry ) || |
| 34 |
$entry['is_email_verified'] === 'yes' |
| 35 |
) { |
| 36 |
throw new Exception( 'Invalid ID or Email/ Already verified.' ); |
| 37 |
} |
| 38 |
|
| 39 |
$this->id = $entry['id']; |
| 40 |
$this->email = $entry['user_email']; |
| 41 |
$this->verification_token = $entry['email_verification_token']; |
| 42 |
$this->expire_at = $entry['expire']; |
| 43 |
} |
| 44 |
|
| 45 |
public function verify_signature( string $signature ) { |
| 46 |
$saved_signature = $this->get_signature(); |
| 47 |
if ( $saved_signature ) { |
| 48 |
return hash_equals( $saved_signature, $signature ); |
| 49 |
} |
| 50 |
return false; |
| 51 |
} |
| 52 |
|
| 53 |
public function get_signature() { |
| 54 |
if ( $this->verification_token ) { |
| 55 |
return hash_hmac( 'sha256', $this->email . $this->expire_at, $this->verification_token ); |
| 56 |
} |
| 57 |
return false; |
| 58 |
} |
| 59 |
|
| 60 |
public function get_signed_url() { |
| 61 |
$signature = $this->get_signature(); |
| 62 |
if ( $signature ) { |
| 63 |
return add_query_arg( |
| 64 |
[ |
| 65 |
'id' => $this->id, |
| 66 |
'signature' => $signature, |
| 67 |
'expire' => $this->expire_at, |
| 68 |
], |
| 69 |
home_url( '/' ) |
| 70 |
); |
| 71 |
} |
| 72 |
} |
| 73 |
|
| 74 |
public function mark_email_as_verified() { |
| 75 |
global $wpdb; |
| 76 |
$table_entries = $wpdb->prefix . ABLOCKS_PLUGIN_SLUG . '_form_entries'; |
| 77 |
if ( $wpdb->update( $table_entries, [ 'is_email_verified' => 'yes' ], [ 'id' => $this->id ] ) ) { |
| 78 |
return true; |
| 79 |
} |
| 80 |
return false; |
| 81 |
} |
| 82 |
|
| 83 |
|
| 84 |
|
| 85 |
public static function verify( $post_data ) { |
| 86 |
if ( |
| 87 |
! isset( $post_data['id'] ) || |
| 88 |
! isset( $post_data['signature'] ) || |
| 89 |
! isset( $post_data['expire'] ) |
| 90 |
) { |
| 91 |
return 'no data'; |
| 92 |
} |
| 93 |
|
| 94 |
$id = intval( sanitize_text_field( $post_data['id'] ) ); |
| 95 |
$expire = intval( sanitize_text_field( $post_data['expire'] ) ); |
| 96 |
$signature = sanitize_text_field( $post_data['signature'] ); |
| 97 |
|
| 98 |
try { |
| 99 |
|
| 100 |
$verification_obj = new self( $id, 'id' ); |
| 101 |
|
| 102 |
if ( |
| 103 |
$verification_obj->expiration_check && |
| 104 |
$verification_obj->expire_at !== $expire && |
| 105 |
time() > $expire |
| 106 |
) { |
| 107 |
return 'Link expired.'; |
| 108 |
} |
| 109 |
|
| 110 |
if ( $verification_obj->verify_signature( $signature ) ) { |
| 111 |
return $verification_obj->mark_email_as_verified() ? [ 'success' => true ] : 'error'; |
| 112 |
} |
| 113 |
} catch ( Exception $e ) { |
| 114 |
return 'Error'; |
| 115 |
} |
| 116 |
return 'Error'; |
| 117 |
} |
| 118 |
} |
| 119 |
|
