← All changes | includes/Core/Integration/ZohoMail/ZohoMailHandler.php +46 -14 2.10.0 → 3.3.1 View file →

		@@ -6,11 +6,16 @@
6	6	*/
7	7
8	8	namespace BitCode\BitForm\Core\Integration\ZohoMail;
9	9
	10	+if (!defined('ABSPATH')) {
	11	+ exit;
	12	+}
	13	+
10	14	use BitCode\BitForm\Core\Integration\IntegrationHandler;
11	15	use BitCode\BitForm\Core\Util\HttpHelper;
12	16	use BitCode\BitForm\Core\Util\IpTool;
	17	+use BitCode\BitForm\GlobalHelper;
13	18	use WP_Error;
14	19
15	20	/**
16	21	* Provide functionality for ZohoCrm integration
		@@ -33,11 +38,8 @@
33	38	*/
34	39	public static function registerAjax()
35	40	{
36	41	add_action('wp_ajax_bitforms_zmail_generate_token', [__CLASS__, 'generateTokens']);
37		- add_action('wp_ajax_bitforms_zmail_refresh_workspaces', [__CLASS__, 'refreshWorkspacesAjaxHelper']);
38		- add_action('wp_ajax_bitforms_zmail_refresh_tables', [__CLASS__, 'refreshTablesAjaxHelper']);
39		- add_action('wp_ajax_bitforms_zmail_refresh_table_headers', [__CLASS__, 'refreshTableHeadersAjaxHelper']);
40	42	}
41	43
42	44	/**
43	45	* Process ajax request for generate_token
		@@ -45,12 +47,19 @@
45	47	* @return JSON zoho crm api response and status
46	48	*/
47	49	public static function generateTokens()
48	50	{
49		- if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce($_REQUEST['_ajax_nonce'], 'bitforms_save')) {
	51	+ if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
50	52	$authorizationHeader = null;
51		- $inputJSON = file_get_contents('php://input');
52		- $requestsParams = json_decode($inputJSON);
	53	+
	54	+ GlobalHelper::requirePostMethod();
	55	+
	56	+ try {
	57	+ $requestsParams = GlobalHelper::formatRequestData();
	58	+ } catch (\InvalidArgumentException $e) {
	59	+ wp_send_json_error($e->getMessage(), 400);
	60	+ }
	61	+
53	62	if (
54	63	empty($requestsParams->{'accounts-server'})
55	64	|| empty($requestsParams->dataCenter)
56	65	|| empty($requestsParams->clientId)
		@@ -76,21 +85,44 @@
76	85	'code' => $requestsParams->code
77	86	];
78	87	$apiResponse = HttpHelper::post($apiEndpoint, $requestParams);
79	88
80		- $accountIdEndpoint = "http://mail.zoho.{$requestsParams->dataCenter}/api/accounts";
	89	+ // Validate the token exchange before using the token: reading access_token
	90	+ // off an error response fatals.
	91	+ if (is_wp_error($apiResponse) || !empty($apiResponse->error) || empty($apiResponse->access_token)) {
	92	+ wp_send_json_error(
	93	+ empty($apiResponse->error) ? 'Unknown' : $apiResponse->error,
	94	+ 400
	95	+ );
	96	+ }
	97	+
	98	+ // https, not http: the WP HTTP API drops the Authorization header on a
	99	+ // redirect, so an http:// call reaches Zoho as INVALID_OAUTHTOKEN.
	100	+ $accountIdEndpoint = "https://mail.zoho.{$requestsParams->dataCenter}/api/accounts";
81	101	$authorizationHeader['Authorization'] = "Zoho-oauthtoken {$apiResponse->access_token}";
82	102	$accountResponse = HttpHelper::get($accountIdEndpoint, null, $authorizationHeader);
83	103
84		- $apiResponse->accountId = $accountResponse->data[0]->accountId;
85		- $apiResponse->accountEmail = $accountResponse->data[0]->primaryEmailAddress;
	104	+ // On success `data` is a list of accounts; on failure it is an object
	105	+ // ({errorCode:...}), so check the shape before reading the account.
	106	+ $account = null;
	107	+ if (!is_wp_error($accountResponse) && isset($accountResponse->data) && is_array($accountResponse->data)) {
	108	+ $account = reset($accountResponse->data);
	109	+ }
86	110
87		- if (is_wp_error($apiResponse) || !empty($apiResponse->error) || is_wp_error($accountResponse) || !empty($accountResponse->errors)) {
88		- wp_send_json_error(
89		- empty($apiResponse->error) ? 'Unknown' : $apiResponse->error,
90		- 400
91		- );
	111	+ if (empty($account) || empty($account->accountId)) {
	112	+ $reason = __('Could not read the Zoho Mail account for this token', 'bit-form');
	113	+ if (is_wp_error($accountResponse)) {
	114	+ $reason = $accountResponse->get_error_message();
	115	+ } elseif (!empty($accountResponse->data->errorCode)) {
	116	+ $reason = $accountResponse->data->errorCode;
	117	+ } elseif (!empty($accountResponse->status->description)) {
	118	+ $reason = $accountResponse->status->description;
	119	+ }
	120	+ wp_send_json_error($reason, 400);
92	121	}
	122	+
	123	+ $apiResponse->accountId = $account->accountId;
	124	+ $apiResponse->accountEmail = isset($account->primaryEmailAddress) ? $account->primaryEmailAddress : '';
93	125	$apiResponse->generates_on = \time();
94	126	wp_send_json_success($apiResponse, 200);
95	127	} else {
96	128	wp_send_json_error(