conversational-forms / classes / api / token.php

token.php in WPBot – ChatBot Conversational Forms 1.2.0, at classes/api/token.php

87 lines 2.3 KB

Raw Download Zip

1	<?php
2
3	/**
4	* Entry viewer shortcode
5	*
6	* @package Caldera_Forms Modified by QuantumCloud
7	* @author Josh Pollock <Josh@CalderaWP.com>
8	* @license GPL-2.0+
9	* @link
10	* @copyright 2016 CalderaWP LLC
11	*/
12	class Qcformbuilder_Forms_API_Token {
13
14	/**
15	* Create an API token
16	*
17	* Used as a possible way of authenticating for GET only. Don't use for POST.
18	*
19	* @since 1.5.0
20	*
21	* @param string $lowest_role The lowest user role -- IE editor -- that this token is valid for. Use "public" to make public.
22	* @param string $form_id Form ID to generate token for.
23	*
24	* @return string
25	*/
26	public static function make_token( $lowest_role, $form_id ){
27
28	/**
29	* Filter secret portion of API token
30	*
31	* @since 1.5.0
32	*
33	* @param string $secret Secret thing to use
34	* @param string $form_id ID of form generating/checking token on
35	*/
36	$secret = apply_filters( 'qcformbuilder_forms_api_token_secret', get_option( 'qcformbuilder_forms_api_token_secret', NONCE_SALT . md5_file( __FILE__ ) ), $form_id );
37	return sha1( 'wfb_viewer_' . $lowest_role . $secret . $form_id );
38
39	}
40
41	/**
42	* Check a token
43	*
44	* @since 1.5.0
45	*
46	* @param string $token Token to check
47	* @param string $form_id Form ID to check based on.
48	* @param WP_User\|null $user Optional. User to check for sufficient role of. Defaults to current user. If null and not logged in, only "public" is checked for.
49	*
50	* @return bool
51	*/
52	public static function check_token( $token, $form_id, WP_User $user = null ){
53	if ( null == $user ) {
54	$user = get_user_by( 'ID', get_current_user_id() );
55	}
56
57	if( null == $user ){
58	return self::verify_token( $token, 'public', $form_id );
59	}
60
61	foreach( array_merge( array_keys( qcformbuilder_forms_get_roles() ), array('public') ) as $role ){
62	if( true == self::verify_token( $token, $role, $form_id ) ){
63	return true;
64	}
65	}
66
67	return false;
68
69	}
70
71	/**
72	* Check a token against a role
73	*
74	* @since 1.5.0
75	*
76	* @param string $check_token Token to check.
77	* @param string $role User role to check against.
78	* @param string $form_id ID of form this token is for.
79	*
80	* @return bool
81	*/
82	protected static function verify_token( $check_token, $role, $form_id ){
83	return hash_equals( self::make_token( $role, $form_id ), $check_token );
84
85	}
86
87	}