cartflows / admin-core / ajax / debugger.php

debugger.php in CartFlows – Funnel Builder & Checkout Plugin for WooCommerce 3.1.0, at admin-core/ajax/debugger.php

239 lines 6.3 KB

Raw Download Zip

1	<?php
2	/**
3	* CartFlows Flows ajax actions.
4	*
5	* @package CartFlows
6	*/
7
8	namespace CartflowsAdmin\AdminCore\Ajax;
9
10	// Exit if accessed directly.
11	if ( ! defined( 'ABSPATH' ) ) {
12	exit;
13	}
14
15	use CartflowsAdmin\AdminCore\Ajax\AjaxBase;
16	use CartflowsAdmin\AdminCore\Inc\LogStatus;
17	use CartflowsAdmin\AdminCore\Inc\AdminHelper;
18
19	/**
20	* Class Steps.
21	*/
22	class Debugger extends AjaxBase {
23
24	/**
25	* Instance
26	*
27	* @access private
28	* @var object Class object.
29	* @since 1.0.0
30	*/
31	private static $instance;
32
33	/**
34	* Deleted
35	*
36	* @access private
37	* @var object Class object.
38	* @since 1.0.0
39	*/
40	private static $file_deleted = false;
41
42	/**
43	* Initiator
44	*
45	* @since 1.0.0
46	* @return object initialized object of class.
47	*/
48	public static function get_instance() {
49	if ( ! isset( self::$instance ) ) {
50	self::$instance = new self();
51	}
52	return self::$instance;
53	}
54
55	/**
56	* Register ajax events.
57	*
58	* @since 1.0.0
59	* @return void
60	*/
61	public function register_ajax_events() {
62
63	$ajax_events = array(
64	'show_cf_log',
65	'delete_cf_log',
66	'download_cf_log',
67	'sync_kb_docs',
68	);
69
70	$this->init_ajax_events( $ajax_events );
71	}
72
73	/**
74	* Sync knowledge base library.
75	*
76	* @since 2.0.0
77	* @return void
78	*/
79	public function sync_kb_docs() {
80
81	if ( ! current_user_can( 'cartflows_manage_flows_steps' ) ) {
82	wp_die( esc_html__( 'You don\'t have permission to perform this action.', 'cartflows' ) );
83	}
84
85	check_ajax_referer( 'cartflows_sync_kb_docs', 'security' );
86
87	$docs_json = json_decode( wp_remote_retrieve_body( wp_remote_get( 'https://cartflows.com//wp-json/powerful-docs/v1/get-docs' ) ) );
88	AdminHelper::update_admin_settings_option( 'cartflows_docs_data', $docs_json );
89
90	$response_data = array(
91	'message' => __( 'Sync Success.', 'cartflows' ),
92	'status' => true,
93	);
94
95	wp_send_json_success( $response_data );
96	}
97
98
99	/**
100	* Clone step with its meta.
101	*/
102	public function show_cf_log() {
103
104	if ( ! current_user_can( 'cartflows_manage_settings' ) ) {
105	wp_die( esc_html__( 'You don\'t have permission to view this page.', 'cartflows' ) );
106	}
107
108	check_ajax_referer( 'cartflows_show_cf_log', 'security' );
109
110	$log_key = isset( $_POST['log_key'] ) ? sanitize_text_field( wp_unslash( $_POST['log_key'] ) ) : '';
111
112
113	$logs = LogStatus::get_instance()->get_log_files();
114
115	$log_filename = isset( $logs[ $log_key ] ) ? $logs[ $log_key ] : '';
116
117	$file_content = file_get_contents( CARTFLOWS_LOG_DIR . $log_filename );
118
119	wp_send_json(
120	array(
121	'log_content' => esc_html( $file_content ),
122	)
123	);
124	}
125
126	/**
127	* Delete Provided log file
128	*/
129	public function delete_cf_log() {
130
131	// Ensure the current user has permission to manage CartFlows settings.
132	if ( ! current_user_can( 'cartflows_manage_settings' ) ) {
133	wp_die( esc_html__( 'You don\'t have permission to perform this action.', 'cartflows' ) );
134	}
135
136	// Verify the nonce to protect against CSRF attacks.
137	check_ajax_referer( 'cartflows_delete_cf_log', 'security' );
138
139	// Bail early if no log key was provided in the request.
140	if ( empty( $_REQUEST['log_key'] ) ) {
141	$response_data = array(
142	'message' => esc_html__( 'Filename is empty. Please refresh the page and retry.', 'cartflows' ),
143	'file_content' => '',
144	);
145	wp_send_json_error( $response_data );
146	}
147
148	// Sanitize the log key from the request.
149	$log_key = sanitize_text_field( wp_unslash( $_REQUEST['log_key'] ) );
150
151	// Retrieve the list of available log files.
152	$logs = LogStatus::get_instance()->get_log_files();
153
154	// Bail if the provided key does not match any known log file.
155	if ( ! isset( $logs[ $log_key ] ) ) {
156	$response_data = array(
157	'message' => esc_html__( 'Invalid log file.', 'cartflows' ),
158	'file_content' => '',
159	);
160	wp_send_json_error( $response_data );
161	}
162
163	// Resolve the full file path for the log file.
164	$file_name = $logs[ $log_key ];
165	$file_path = CARTFLOWS_LOG_DIR . $file_name;
166
167	// Security: Validate file path is within log directory to prevent path traversal.
168	$real_path = realpath( $file_path );
169	$real_log_dir = realpath( CARTFLOWS_LOG_DIR );
170
171	if ( $real_path && $real_log_dir && 0 === strpos( $real_path, $real_log_dir ) && file_exists( $real_path ) ) {
172	wp_delete_file( $real_path );
173	self::$file_deleted = true;
174	}
175
176	// Return a success response to the client.
177	$response_data = array(
178	'message' => esc_html__( 'Log file deleted successfully.', 'cartflows' ),
179	);
180	wp_send_json_success( $response_data );
181	}
182
183	/**
184	* Download the selected log file.
185	*/
186	public function download_cf_log() {
187
188	// Ensure the current user has permission to manage CartFlows settings.
189	if ( ! current_user_can( 'cartflows_manage_settings' ) ) {
190	wp_die( esc_html__( 'You don\'t have permission to perform this action.', 'cartflows' ) );
191	}
192
193	// Verify the nonce to protect against CSRF attacks.
194	check_ajax_referer( 'cartflows_download_cf_log', 'security' );
195
196	// Sanitize the log key from the request, defaulting to empty string if not set.
197	$log_key = isset( $_REQUEST['log_key'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['log_key'] ) ) : '';
198
199	// Retrieve the list of available log files.
200	$logs = LogStatus::get_instance()->get_log_files();
201
202	// Bail if the provided key does not match any known log file.
203	if ( ! isset( $logs[ $log_key ] ) ) {
204	return;
205	}
206
207	// Resolve the full file path for the log file.
208	$file_name = $logs[ $log_key ];
209	$file_path = CARTFLOWS_LOG_DIR . $file_name;
210
211	// Security: Validate file path is within log directory to prevent path traversal.
212	$real_path = realpath( $file_path );
213	$real_log_dir = realpath( CARTFLOWS_LOG_DIR );
214
215	if ( ! $real_path \|\| ! $real_log_dir \|\| 0 !== strpos( $real_path, $real_log_dir ) \|\| ! file_exists( $real_path ) ) {
216	return;
217	}
218
219	$file_extension = pathinfo( $file_name, PATHINFO_EXTENSION );
220	$allowed_files = array( 'log' );
221
222	// Return if the desired file is not found for download.
223	if ( ! in_array( $file_extension, $allowed_files, true ) \|\| strpos( $file_name, '.php' ) !== false ) {
224	wp_die( esc_html__( 'Invalid file.', 'cartflows' ) );
225	return;
226	}
227
228	$file_content = file_get_contents( $real_path ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents
229
230	// Return the file contents along with a success message.
231	$response_data = array(
232	'message' => __( 'Export logs successfully', 'cartflows' ),
233	'file_content' => $file_content,
234	);
235
236	wp_send_json_success( $response_data );
237	}
238	}
239