router(true); } public function router(bool $front = false): void { acym_displayFreeTrialMessage(); if (!$front) { auth_redirect(); // The router only enforces auth_redirect() and the 'dashboard' controller is exempt from call()'s ACL, so mirror Menu.php's back-office access gate (wp_access groups) to keep arbitrary logged-in users out. if (!acym_hasBackofficeAccess()) { wp_die(esc_html(acym_translation('ACYM_ACCESS_DENIED')), '', ['response' => 403]); } } if (file_exists(ACYM_FOLDER.'update.php')) { $acyActivation = new Activation(); if (is_multisite()) { $currentBlog = get_current_blog_id(); $sites = get_sites(); foreach ($sites as $site) { if (is_object($site)) { $site = get_object_vars($site); } switch_to_blog($site['blog_id']); acym_config(true); $acyActivation->updateAcym(); } switch_to_blog($currentBlog); } else { $acyActivation->updateAcym(); } acym_deleteFile(ACYM_FOLDER.'update.php'); } $config = acym_config(true); // Get controller. If not found, take it from the page $ctrl = acym_getVar('cmd', 'ctrl', ''); $task = acym_getVar('cmd', 'task', ''); if (!$front && acym_isAdmin() && file_exists(ACYM_NEW_FEATURES_SPLASHSCREEN_JSON) && acym_isWritable(ACYM_NEW_FEATURES_SPLASHSCREEN_JSON)) { $ctrl = 'dashboard'; $task = 'features'; acym_setVar('ctrl', $ctrl); acym_setVar('task', $task); } $needToMigrate = $config->get('migration') == 0 && acym_existsAcyMailing59() && acym_getVar('string', 'task') !== 'migrationDone'; $forceDashboard = !$front && ($needToMigrate || $config->get('walk_through', 0) == 1) && !(defined('DOING_AJAX') && DOING_AJAX) && 'dynamics' !== $ctrl; if ($forceDashboard) { $ctrl = 'dashboard'; acym_setVar('ctrl', $ctrl); } if (empty($ctrl)) { $ctrl = str_replace(ACYM_COMPONENT.'_', '', acym_getVar('cmd', 'page', '')); if (empty($ctrl)) { echo esc_html(acym_translation('ACYM_PAGE_NOT_FOUND')); // For Google search console in the frontend to prevent from doing 404 errors $noCache = acym_getVar('int', 'nocache', 0); if (!empty($noCache)) { acym_redirect(acym_rootURI()); } return; } acym_setVar('ctrl', $ctrl); } $this->deactivateHookAdminFooter(); $subNamespace = $front ? 'Front' : ''; $controllerNamespace = 'AcyMailing\\'.$subNamespace.'Controllers\\'.ucfirst($ctrl).'Controller'; if (!class_exists($controllerNamespace)) { echo esc_html(acym_translation('ACYM_PAGE_NOT_FOUND').': '.$ctrl); return; } if (!$front && acym_isAdmin() && $task != 'edit' && !(defined('DOING_AJAX') && DOING_AJAX)) { $pluginClass = new PluginClass(); $installedPlugins = $pluginClass->getAll('title'); foreach (ACYM_AVAILABLE_PLUGINS as $onePlugin) { if (empty($installedPlugins[$onePlugin['name']])) continue; if ($installedPlugins[$onePlugin['name']]->type !== 'ADDON') continue; acym_enqueueMessage( acym_translationSprintf( 'ACYM_NEW_PLUGIN_FORMAT', $onePlugin['name'], ''.acym_translation('ACYM_CLICK_HERE').'' ), 'error' ); } } $controller = new $controllerNamespace(); if (empty($task)) { $task = acym_getVar('cmd', 'defaulttask', $controller->defaulttask); } if ($forceDashboard && !method_exists($controller, $task)) { $task = 'listing'; acym_setVar('task', $task); } $controller->call($task, $front); } public function autologin() { $subId = acym_getVar('int', 'autoSubId'); $subToken = acym_getVar('string', 'subKey'); if (empty($subId) || empty($subToken)) { return; } $currentUrl = acym_currentURL(); $cleanedUrl = acym_cleanUrl($currentUrl, ['autoSubId', 'subKey']); $config = acym_config(); if ($config->get('autologin_urls', 0) == 0) { acym_redirect($cleanedUrl); } $subscriber = acym_loadObject('SELECT `cms_id`, `key` FROM #__acym_user WHERE `id` = '.intval($subId)); if (empty($subscriber->cms_id) || $subscriber->cms_id === acym_currentUserId()) { acym_redirect($cleanedUrl); } if (!acym_verifyAutologinToken($subId, $subToken, $subscriber->key)) { acym_redirect($cleanedUrl); } $user = get_user_by('id', $subscriber->cms_id); if (is_wp_error($user) || !$user) { acym_redirect($cleanedUrl); } // Never allow autologin for administrator accounts if ($user->has_cap('manage_options')) { acym_redirect($cleanedUrl); } wp_clear_auth_cookie(); wp_set_current_user($user->ID); wp_set_auth_cookie($user->ID); acym_redirect($cleanedUrl); } private function deactivateHookAdminFooter() { //Remove hook function which break AcyMailing pages remove_action('admin_footer', 'Freemius::_enrich_ajax_url'); remove_action('admin_footer', 'Freemius::_open_support_forum_in_new_page'); } }