cartflows / admin-legacy-core / ajax / debugger.php

debugger.php in CartFlows – Funnel Builder & Checkout Plugin for WooCommerce 3.3.0, at admin-legacy-core/ajax/debugger.php

240 lines 6.4 KB

Raw Download Zip

1	<?php
2	/**
3	* CartFlows Flows ajax actions.
4	*
5	* @package CartFlows
6	*/
7
8	namespace CartflowsAdmin\AdminLegacyCore\Ajax;
9
10	// Exit if accessed directly.
11	if ( ! defined( 'ABSPATH' ) ) {
12	exit;
13	}
14
15	use CartflowsAdmin\AdminLegacyCore\Ajax\AjaxBase;
16	use CartflowsAdmin\AdminLegacyCore\Inc\LogStatus;
17
18	/**
19	* Class Steps.
20	*/
21	class Debugger extends AjaxBase {
22
23	/**
24	* Instance
25	*
26	* @access private
27	* @var object Class object.
28	* @since 1.0.0
29	*/
30	private static $instance;
31
32	/**
33	* Deleted
34	*
35	* @access private
36	* @var object Class object.
37	* @since 1.0.0
38	*/
39	private static $file_deleted = false;
40
41	/**
42	* Initiator
43	*
44	* @since 1.0.0
45	* @return object initialized object of class.
46	*/
47	public static function get_instance() {
48	if ( ! isset( self::$instance ) ) {
49	self::$instance = new self();
50	}
51	return self::$instance;
52	}
53
54	/**
55	* Register ajax events.
56	*
57	* @since 1.0.0
58	* @return void
59	*/
60	public function register_ajax_events() {
61
62	$ajax_events = array(
63	'show_cf_log',
64	'delete_cf_log',
65	'download_cf_log',
66	'sync_kb_docs',
67	);
68
69	$this->init_ajax_events( $ajax_events );
70	}
71
72	/**
73	* Sync knowledge base library.
74	*
75	* @since 2.0.0
76	* @return void
77	*/
78	public function sync_kb_docs() {
79
80	if ( ! current_user_can( 'cartflows_manage_flows_steps' ) ) {
81	wp_die( esc_html__( 'You don\'t have permission to perform this action.', 'cartflows' ) );
82	}
83
84	check_ajax_referer( 'cartflows_sync_kb_docs', 'security' );
85
86	$docs_json = json_decode( wp_remote_retrieve_body( wp_remote_get( 'https://cartflows.com//wp-json/powerful-docs/v1/get-docs' ) ) );
87
88	// Never autoload — this payload runs to hundreds of KB and only the Knowledge Base screen reads it.
89	update_option( 'cartflows_docs_data', $docs_json, false );
90
91	$response_data = array(
92	'message' => __( 'Sync Success.', 'cartflows' ),
93	'status' => true,
94	);
95
96	wp_send_json_success( $response_data );
97	}
98
99
100	/**
101	* Clone step with its meta.
102	*/
103	public function show_cf_log() {
104
105	if ( ! current_user_can( 'cartflows_manage_settings' ) ) {
106	wp_die( esc_html__( 'You don\'t have permission to view this page.', 'cartflows' ) );
107	}
108
109	check_ajax_referer( 'cartflows_show_cf_log', 'security' );
110
111	$log_key = isset( $_POST['log_key'] ) ? sanitize_text_field( wp_unslash( $_POST['log_key'] ) ) : '';
112
113
114	$logs = LogStatus::get_instance()->get_log_files();
115
116	$log_filename = isset( $logs[ $log_key ] ) ? $logs[ $log_key ] : '';
117
118	$file_content = file_get_contents( CARTFLOWS_LOG_DIR . $log_filename );
119
120	wp_send_json(
121	array(
122	'log_content' => esc_html( $file_content ),
123	)
124	);
125	}
126
127	/**
128	* Delete Provided log file
129	*/
130	public function delete_cf_log() {
131
132	// Ensure the current user has permission to manage CartFlows settings.
133	if ( ! current_user_can( 'cartflows_manage_settings' ) ) {
134	wp_die( esc_html__( 'You don\'t have permission to perform this action.', 'cartflows' ) );
135	}
136
137	// Verify the nonce to protect against CSRF attacks.
138	check_ajax_referer( 'cartflows_delete_cf_log', 'security' );
139
140	// Bail early if no log key was provided in the request.
141	if ( empty( $_REQUEST['log_key'] ) ) {
142	$response_data = array(
143	'message' => esc_html__( 'Filename is empty. Please refresh the page and retry.', 'cartflows' ),
144	'file_content' => '',
145	);
146	wp_send_json_error( $response_data );
147	}
148
149	// Sanitize the log key from the request.
150	$log_key = sanitize_text_field( wp_unslash( $_REQUEST['log_key'] ) );
151
152	// Retrieve the list of available log files.
153	$logs = LogStatus::get_instance()->get_log_files();
154
155	// Bail if the provided key does not match any known log file.
156	if ( ! isset( $logs[ $log_key ] ) ) {
157	$response_data = array(
158	'message' => esc_html__( 'Invalid log file.', 'cartflows' ),
159	'file_content' => '',
160	);
161	wp_send_json_error( $response_data );
162	}
163
164	// Resolve the full file path for the log file.
165	$file_name = $logs[ $log_key ];
166	$file_path = CARTFLOWS_LOG_DIR . $file_name;
167
168	// Security: Validate file path is within log directory to prevent path traversal.
169	$real_path = realpath( $file_path );
170	$real_log_dir = realpath( CARTFLOWS_LOG_DIR );
171
172	if ( $real_path && $real_log_dir && 0 === strpos( $real_path, $real_log_dir ) && file_exists( $real_path ) ) {
173	wp_delete_file( $real_path );
174	self::$file_deleted = true;
175	}
176
177	// Return a success response to the client.
178	$response_data = array(
179	'message' => esc_html__( 'Log file deleted successfully.', 'cartflows' ),
180	);
181	wp_send_json_success( $response_data );
182	}
183
184	/**
185	* Download the selected log file.
186	*/
187	public function download_cf_log() {
188
189	// Ensure the current user has permission to manage CartFlows settings.
190	if ( ! current_user_can( 'cartflows_manage_settings' ) ) {
191	wp_die( esc_html__( 'You don\'t have permission to perform this action.', 'cartflows' ) );
192	}
193
194	// Verify the nonce to protect against CSRF attacks.
195	check_ajax_referer( 'cartflows_download_cf_log', 'security' );
196
197	// Sanitize the log key from the request, defaulting to empty string if not set.
198	$log_key = isset( $_REQUEST['log_key'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['log_key'] ) ) : '';
199
200	// Retrieve the list of available log files.
201	$logs = LogStatus::get_instance()->get_log_files();
202
203	// Bail if the provided key does not match any known log file.
204	if ( ! isset( $logs[ $log_key ] ) ) {
205	return;
206	}
207
208	// Resolve the full file path for the log file.
209	$file_name = $logs[ $log_key ];
210	$file_path = CARTFLOWS_LOG_DIR . $file_name;
211
212	// Security: Validate file path is within log directory to prevent path traversal.
213	$real_path = realpath( $file_path );
214	$real_log_dir = realpath( CARTFLOWS_LOG_DIR );
215
216	if ( ! $real_path \|\| ! $real_log_dir \|\| 0 !== strpos( $real_path, $real_log_dir ) \|\| ! file_exists( $real_path ) ) {
217	return;
218	}
219
220	$file_extension = pathinfo( $file_name, PATHINFO_EXTENSION );
221	$allowed_files = array( 'log' );
222
223	// Return if the desired file is not found for download.
224	if ( ! in_array( $file_extension, $allowed_files, true ) \|\| strpos( $file_name, '.php' ) !== false ) {
225	wp_die( esc_html__( 'Invalid file.', 'cartflows' ) );
226	return;
227	}
228
229	$file_content = file_get_contents( $real_path ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents
230
231	// Return the file contents along with a success message.
232	$response_data = array(
233	'message' => __( 'Export logs successfully', 'cartflows' ),
234	'file_content' => $file_content,
235	);
236
237	wp_send_json_success( $response_data );
238	}
239	}
240