cartflows / admin-core / ajax / ajax-base.php

ajax-base.php in CartFlows – Funnel Builder & Checkout Plugin for WooCommerce 3.1.0, at admin-core/ajax/ajax-base.php

150 lines 2.8 KB

Raw Download Zip

1	<?php
2	/**
3	* CartFlows Ajax Base.
4	*
5	* @package CartFlows
6	*/
7
8	namespace CartflowsAdmin\AdminCore\Ajax;
9
10	// Exit if accessed directly.
11	if ( ! defined( 'ABSPATH' ) ) {
12	exit;
13	}
14
15	use CartflowsAdmin\AdminCore\Ajax\AjaxErrors;
16
17	/**
18	* Class Admin_Menu.
19	*/
20	abstract class AjaxBase {
21
22	/**
23	* Ajax action prefix.
24	*
25	* @var string
26	*/
27	private $prefix = 'cartflows';
28
29	/**
30	* Erros class instance.
31	*
32	* @var object
33	*/
34	public $errors = null;
35
36	/**
37	* Constructor
38	*
39	* @since 1.0.0
40	*/
41	public function __construct() {
42
43	$this->errors = AjaxErrors::get_instance();
44	}
45
46	/**
47	* Register ajax events.
48	*
49	* @param array $ajax_events Ajax events.
50	*/
51	public function init_ajax_events( $ajax_events ) {
52
53	if ( ! empty( $ajax_events ) ) {
54
55	foreach ( $ajax_events as $ajax_event ) {
56	add_action( 'wp_ajax_' . $this->prefix . '_' . $ajax_event, array( $this, $ajax_event ) );
57
58	$this->localize_ajax_action_nonce( $ajax_event );
59	}
60	}
61	}
62
63	/**
64	* Localize nonce for ajax call.
65	*
66	* @param string $action Action name.
67	* @return void
68	*/
69	public function localize_ajax_action_nonce( $action ) {
70
71	if ( current_user_can( 'cartflows_manage_flows_steps' ) ) {
72
73	add_filter(
74	'cartflows_admin_localized_vars',
75	function( $localize ) use ( $action ) {
76
77	$localize[ $action . '_nonce' ] = wp_create_nonce( $this->prefix . '_' . $action );
78	return $localize;
79	}
80	);
81
82	}
83	}
84
85
86	/**
87	* Get ajax error message.
88	*
89	* @param string $type Message type.
90	* @return string
91	*/
92	public function get_error_msg( $type ) {
93
94	return $this->errors->get_error_msg( $type );
95	}
96
97	/**
98	* Verify the current user can edit the given flow post.
99	*
100	* Used as a per-flow ownership check in addition to the global
101	* `cartflows_manage_flows_steps` capability — defends against IDOR where
102	* an editor with access to one flow submits step IDs from another flow.
103	*
104	* @since 3.1.0
105	* @param int $flow_id Flow post ID.
106	* @return bool
107	*/
108	protected function user_can_edit_flow( $flow_id ) {
109
110	$flow_id = (int) $flow_id;
111
112	if ( $flow_id <= 0 ) {
113	return false;
114	}
115
116	if ( CARTFLOWS_FLOW_POST_TYPE !== get_post_type( $flow_id ) ) {
117	return false;
118	}
119
120	return current_user_can( 'cartflows_manage_flows_steps' )
121	&& current_user_can( 'edit_post', $flow_id );
122	}
123
124	/**
125	* Verify a step belongs to the given flow.
126	*
127	* @since 3.1.0
128	* @param int $step_id Step post ID.
129	* @param int $flow_id Flow post ID.
130	* @return bool
131	*/
132	protected function is_step_in_flow( $step_id, $flow_id ) {
133
134	$step_id = (int) $step_id;
135	$flow_id = (int) $flow_id;
136
137	if ( $step_id <= 0 \|\| $flow_id <= 0 ) {
138	return false;
139	}
140
141	if ( CARTFLOWS_STEP_POST_TYPE !== get_post_type( $step_id ) ) {
142	return false;
143	}
144
145	$step_flow_id = wcf()->utils->get_flow_id_from_step_id( $step_id );
146
147	return is_scalar( $step_flow_id ) && (int) $step_flow_id === $flow_id;
148	}
149	}
150