← All changes | includes/Core/Integration/ZohoMail/ZohoMailHandler.php +31 -11 3.2.2 → 3.3.1 View file →

		@@ -38,11 +38,8 @@
38	38	*/
39	39	public static function registerAjax()
40	40	{
41	41	add_action('wp_ajax_bitforms_zmail_generate_token', [__CLASS__, 'generateTokens']);
42		- add_action('wp_ajax_bitforms_zmail_refresh_workspaces', [__CLASS__, 'refreshWorkspacesAjaxHelper']);
43		- add_action('wp_ajax_bitforms_zmail_refresh_tables', [__CLASS__, 'refreshTablesAjaxHelper']);
44		- add_action('wp_ajax_bitforms_zmail_refresh_table_headers', [__CLASS__, 'refreshTableHeadersAjaxHelper']);
45	42	}
46	43
47	44	/**
48	45	* Process ajax request for generate_token
		@@ -88,21 +85,44 @@
88	85	'code' => $requestsParams->code
89	86	];
90	87	$apiResponse = HttpHelper::post($apiEndpoint, $requestParams);
91	88
92		- $accountIdEndpoint = "http://mail.zoho.{$requestsParams->dataCenter}/api/accounts";
	89	+ // Validate the token exchange before using the token: reading access_token
	90	+ // off an error response fatals.
	91	+ if (is_wp_error($apiResponse) || !empty($apiResponse->error) || empty($apiResponse->access_token)) {
	92	+ wp_send_json_error(
	93	+ empty($apiResponse->error) ? 'Unknown' : $apiResponse->error,
	94	+ 400
	95	+ );
	96	+ }
	97	+
	98	+ // https, not http: the WP HTTP API drops the Authorization header on a
	99	+ // redirect, so an http:// call reaches Zoho as INVALID_OAUTHTOKEN.
	100	+ $accountIdEndpoint = "https://mail.zoho.{$requestsParams->dataCenter}/api/accounts";
93	101	$authorizationHeader['Authorization'] = "Zoho-oauthtoken {$apiResponse->access_token}";
94	102	$accountResponse = HttpHelper::get($accountIdEndpoint, null, $authorizationHeader);
95	103
96		- $apiResponse->accountId = $accountResponse->data[0]->accountId;
97		- $apiResponse->accountEmail = $accountResponse->data[0]->primaryEmailAddress;
	104	+ // On success `data` is a list of accounts; on failure it is an object
	105	+ // ({errorCode:...}), so check the shape before reading the account.
	106	+ $account = null;
	107	+ if (!is_wp_error($accountResponse) && isset($accountResponse->data) && is_array($accountResponse->data)) {
	108	+ $account = reset($accountResponse->data);
	109	+ }
98	110
99		- if (is_wp_error($apiResponse) || !empty($apiResponse->error) || is_wp_error($accountResponse) || !empty($accountResponse->errors)) {
100		- wp_send_json_error(
101		- empty($apiResponse->error) ? 'Unknown' : $apiResponse->error,
102		- 400
103		- );
	111	+ if (empty($account) || empty($account->accountId)) {
	112	+ $reason = __('Could not read the Zoho Mail account for this token', 'bit-form');
	113	+ if (is_wp_error($accountResponse)) {
	114	+ $reason = $accountResponse->get_error_message();
	115	+ } elseif (!empty($accountResponse->data->errorCode)) {
	116	+ $reason = $accountResponse->data->errorCode;
	117	+ } elseif (!empty($accountResponse->status->description)) {
	118	+ $reason = $accountResponse->status->description;
	119	+ }
	120	+ wp_send_json_error($reason, 400);
104	121	}
	122	+
	123	+ $apiResponse->accountId = $account->accountId;
	124	+ $apiResponse->accountEmail = isset($account->primaryEmailAddress) ? $account->primaryEmailAddress : '';
105	125	$apiResponse->generates_on = \time();
106	126	wp_send_json_success($apiResponse, 200);
107	127	} else {
108	128	wp_send_json_error(