| 1 |
<?php |
| 2 |
|
| 3 |
namespace BitCode\BitForm\API\Controller; |
| 4 |
|
| 5 |
use BitCode\BitForm\Core\Database\FormModel; |
| 6 |
use WP_Error; |
| 7 |
use WP_REST_Controller; |
| 8 |
use WP_REST_Request; |
| 9 |
|
| 10 |
class EntryController extends WP_REST_Controller |
| 11 |
{ |
| 12 |
protected static $form; |
| 13 |
protected $formModel; |
| 14 |
protected $form_id; |
| 15 |
|
| 16 |
public function __construct() |
| 17 |
{ |
| 18 |
$this->formModel = new FormModel(); |
| 19 |
} |
| 20 |
|
| 21 |
// public function oneDriveAuth() |
| 22 |
// { |
| 23 |
// $state = $_GET['state']; |
| 24 |
// $code = urlencode($_GET['code']); |
| 25 |
// // echo $code; |
| 26 |
// if (wp_redirect($state . '&code=' . $code, 302)) { |
| 27 |
// exit; |
| 28 |
// } |
| 29 |
// } |
| 30 |
|
| 31 |
public function authRedirect(WP_REST_Request $request) |
| 32 |
{ |
| 33 |
$state = $request->get_param('state'); |
| 34 |
$site_url = $this->getDomain(get_site_url()); |
| 35 |
$state_domain = $this->getDomain($state); |
| 36 |
|
| 37 |
// the refused domain is caller-supplied; echoing it back reflects attacker |
| 38 |
// input into the response of a public endpoint |
| 39 |
if ('' === $state_domain || $site_url !== $state_domain) { |
| 40 |
return new WP_Error('404', 'Invalid redirect URL'); |
| 41 |
} |
| 42 |
|
| 43 |
$params = $request->get_params(); |
| 44 |
unset($params['rest_route'], $params['state']); |
| 45 |
|
| 46 |
$redirect_url = $state . '&' . http_build_query($params); |
| 47 |
|
| 48 |
if (wp_safe_redirect($redirect_url, 302)) { |
| 49 |
exit; |
| 50 |
} |
| 51 |
} |
| 52 |
|
| 53 |
private function getDomain($url) |
| 54 |
{ |
| 55 |
// these endpoints are public: a missing or non-URL state must not raise |
| 56 |
// notices, it must simply fail the same-origin comparison |
| 57 |
$parsed_url = is_string($url) && '' !== $url ? wp_parse_url($url) : false; |
| 58 |
if (!is_array($parsed_url) || empty($parsed_url['scheme']) || empty($parsed_url['host'])) { |
| 59 |
return ''; |
| 60 |
} |
| 61 |
$domain = $parsed_url['scheme'] . '://' . $parsed_url['host']; |
| 62 |
$domain .= empty($parsed_url['port']) ? null : ':' . $parsed_url['port']; |
| 63 |
return $domain; |
| 64 |
} |
| 65 |
} |
| 66 |
|
