← All changes
|
core/extensions/controllers/extension-controller.php
+41
-3
1.0.24
→
1.0.29
View file →
| @@ -142,8 +142,23 @@ | ||
| 142 | 142 | if ( ! isset( $extensions[ $name ] ) ) { |
| 143 | 143 | return $this->error( __( 'Invalid extension', 'booktics' ) ); |
| 144 | 144 | } |
| 145 | 145 | $extension = $extensions[ $name ]; |
| 146 | + | |
| 147 | + // Strict, so a "1" or "true" string never counts as agreement. | |
| 148 | + $aisentic_consent = 'aisentic' === $name && true === ( $input_data['consent'] ?? null ); | |
| 149 | + $aisentic_email = ''; | |
| 150 | + | |
| 151 | + // The Ask AI setup dialog sends an edited email. Reject a bad one before | |
| 152 | + // anything is installed. | |
| 153 | + if ( $aisentic_consent && isset( $input_data['email'] ) ) { | |
| 154 | + $aisentic_email = sanitize_email( (string) $input_data['email'] ); | |
| 155 | + | |
| 156 | + if ( ! is_email( $aisentic_email ) ) { | |
| 157 | + return $this->error( __( 'Enter a valid email address.', 'booktics' ), 400 ); | |
| 158 | + } | |
| 159 | + } | |
| 160 | + | |
| 146 | 161 | if ( 'addon' === $extension['type'] ) { |
| 147 | 162 | $result = null; |
| 148 | 163 | |
| 149 | 164 | if ( in_array( $status, array( 'install', 'activate' ) ) ) { |
| @@ -169,8 +184,17 @@ | ||
| 169 | 184 | |
| 170 | 185 | if ( 'plugin' === $extension['type'] ) { |
| 171 | 186 | $result = null; |
| 172 | 187 | |
| 188 | + // Only people who could do this by hand from the Plugins screen. | |
| 189 | + if ( 'install' === $status && ! current_user_can( 'install_plugins' ) ) { | |
| 190 | + return $this->error( __( 'You are not allowed to install plugins.', 'booktics' ), 403 ); | |
| 191 | + } | |
| 192 | + | |
| 193 | + if ( 'install' !== $status && ! current_user_can( 'activate_plugins' ) ) { | |
| 194 | + return $this->error( __( 'You are not allowed to manage plugins.', 'booktics' ), 403 ); | |
| 195 | + } | |
| 196 | + | |
| 173 | 197 | if ( 'install' === $status ) { |
| 174 | 198 | // Prefer the extension's own download_link (e.g. GitHub release) so a |
| 175 | 199 | // non-wordpress.org URL is not shadowed by the SDK's hardcoded wp.org zip. |
| 176 | 200 | $result = ! empty( $extension['download_link'] ) |
| @@ -200,9 +224,9 @@ | ||
| 200 | 224 | // Nothing reaches Aisentic's provider on activation alone. The handshake only |
| 201 | 225 | // runs when the caller ticked the consent box and the plugin really is active. |
| 202 | 226 | if ( 'aisentic' === $name |
| 203 | 227 | && in_array( $status, array( 'install', 'activate' ), true ) |
| 204 | - && ! empty( $input_data['consent'] ) | |
| 228 | + && $aisentic_consent | |
| 205 | 229 | && SdkPluginManager::is_activated( $extension['slug'] ) ) { |
| 206 | 230 | // Snapshot before the handshake so the caller can tell a fresh |
| 207 | 231 | // registration (tokens just granted) from re-activating a site that |
| 208 | 232 | // was already connected (no new tokens). |
| @@ -207,9 +231,12 @@ | ||
| 207 | 231 | // registration (tokens just granted) from re-activating a site that |
| 208 | 232 | // was already connected (no new tokens). |
| 209 | 233 | $was_registered = booktics_aisentic_is_registered(); |
| 210 | 234 | |
| 211 | - $this->register_aisentic_site(); | |
| 235 | + $this->register_aisentic_site( | |
| 236 | + $aisentic_email, | |
| 237 | + sanitize_text_field( (string) ( $input_data['account_name'] ?? '' ) ) | |
| 238 | + ); | |
| 212 | 239 | |
| 213 | 240 | $is_registered = booktics_aisentic_is_registered(); |
| 214 | 241 | |
| 215 | 242 | $response['aisentic_registered'] = $is_registered; |
| @@ -236,11 +263,14 @@ | ||
| 236 | 263 | * Only ever called from behind the consent gate in update_item(). The action is |
| 237 | 264 | * fire and forget: Aisentic owns the provider call, so a provider outage cannot |
| 238 | 265 | * fail the activation the user actually asked for. |
| 239 | 266 | * |
| 267 | + * @param string $email Email the user confirmed in the Ask AI dialog. Empty uses the business email. | |
| 268 | + * @param string $name Account name sent by the Ask AI dialog. Empty uses the business name. | |
| 269 | + * | |
| 240 | 270 | * @return void |
| 241 | 271 | */ |
| 242 | - private function register_aisentic_site(): void { | |
| 272 | + private function register_aisentic_site( string $email = '', string $name = '' ): void { | |
| 243 | 273 | // Older Aisentic builds ship no listener, so the handshake would go nowhere. |
| 244 | 274 | if ( ! class_exists( 'Aisentic\Api\Services\Registration_Service' ) ) { |
| 245 | 275 | return; |
| 246 | 276 | } |
| @@ -245,8 +275,16 @@ | ||
| 245 | 275 | return; |
| 246 | 276 | } |
| 247 | 277 | |
| 248 | 278 | $identity = booktics_aisentic_identity(); |
| 279 | + | |
| 280 | + if ( $email ) { | |
| 281 | + $identity['email'] = $email; | |
| 282 | + } | |
| 283 | + | |
| 284 | + if ( $name ) { | |
| 285 | + $identity['name'] = $name; | |
| 286 | + } | |
| 249 | 287 | |
| 250 | 288 | // Fail closed. An account cannot be minted without a real address. |
| 251 | 289 | if ( empty( $identity['email'] ) ) { |
| 252 | 290 | return; |