← All changes | includes/class-convertkit-subscriber.php +92 -15 3.4.2 → 2.4.7 View file →

		@@ -33,16 +33,16 @@
33	33	*/
34	34	public function get_subscriber_id() {
35	35
36	36	// If the subscriber ID is in the request URI, use it.
37		- if ( filter_has_var( INPUT_GET, $this->key ) ) {
38		- $subscriber_id = filter_input( INPUT_GET, $this->key, FILTER_SANITIZE_FULL_SPECIAL_CHARS );
39		- $this->set( $subscriber_id );
40		- return $subscriber_id;
	37	+ if ( isset( $_REQUEST[ $this->key ] ) ) { // phpcs:ignore WordPress.Security.NonceVerification
	38	+ return $this->validate_and_store_subscriber_id( sanitize_text_field( $_REQUEST[ $this->key ] ) ); // phpcs:ignore WordPress.Security.NonceVerification
41	39	}
42	40
43	41	// If the subscriber ID is in a cookie, return it.
44		- if ( isset( $_COOKIE[ $this->key ] ) && ! empty( $_COOKIE[ $this->key ] ) ) {
	42	+ // For performance, we don't check that the subscriber ID exists every time, otherwise this would
	43	+ // call the API on every page load.
	44	+ if ( isset( $_COOKIE[ $this->key ] ) ) {
45	45	return $this->get_subscriber_id_from_cookie();
46	46	}
47	47
48	48	// If here, no subscriber ID exists.
		@@ -50,36 +50,114 @@
50	50
51	51	}
52	52
53	53	/**
54		- * Gets the subscriber ID from the `ck_subscriber_id` cookie.
	54	+ * Validates the given subscriber ID by querying the API to confirm
	55	+ * the subscriber exists before storing their ID in a cookie.
55	56	*
56	57	* @since 2.0.0
57	58	*
58		- * @return string
	59	+ * @param int|string $subscriber_id Possible Subscriber ID or Signed Subscriber ID.
	60	+ * @return WP_Error|int|string Error | Confirmed Subscriber ID or Signed Subscriber ID
59	61	*/
60		- private function get_subscriber_id_from_cookie() {
	62	+ public function validate_and_store_subscriber_id( $subscriber_id ) {
61	63
62		- if ( ! isset( $_COOKIE[ $this->key ] ) ) {
63		- return '';
	64	+ // Bail if the API hasn't been configured.
	65	+ $settings = new ConvertKit_Settings();
	66	+ if ( ! $settings->has_api_key_and_secret() ) {
	67	+ return new WP_Error(
	68	+ 'convertkit_subscriber_get_subscriber_id_from_request_error',
	69	+ __( 'API Key and Secret not configured in Plugin Settings.', 'convertkit' )
	70	+ );
64	71	}
65	72
66		- return sanitize_text_field( wp_unslash( $_COOKIE[ $this->key ] ) );
	73	+ // Initialize the API.
	74	+ $api = new ConvertKit_API( $settings->get_api_key(), $settings->get_api_secret(), $settings->debug_enabled() );
67	75
	76	+ // Get subscriber by ID, to ensure they exist.
	77	+ $subscriber = $api->get_subscriber_by_id( $subscriber_id );
	78	+
	79	+ // Bail if no subscriber exists with the given subscriber ID, or an error occured.
	80	+ if ( is_wp_error( $subscriber ) ) {
	81	+ // Delete the cookie.
	82	+ $this->forget();
	83	+
	84	+ // Return error.
	85	+ return $subscriber;
	86	+ }
	87	+
	88	+ // Store the subscriber ID as a cookie.
	89	+ $this->set( $subscriber['id'] );
	90	+
	91	+ // Return subscriber ID.
	92	+ return $subscriber['id'];
	93	+
68	94	}
69	95
70	96	/**
71		- * Stores the given subscriber ID in the `ck_subscriber_id` cookie
72		- * and a prefixed `wordpress_ck_subscriber_id` cookie.
	97	+ * Validates the given subscriber email by querying the API to confirm
	98	+ * the subscriber exists before storing their ID in a cookie.
73	99	*
74	100	* @since 2.0.0
75	101	*
	102	+ * @param string $subscriber_email Possible Subscriber Email.
	103	+ * @return WP_Error|int|string Error | Confirmed Subscriber ID or Signed Subscriber ID
	104	+ */
	105	+ public function validate_and_store_subscriber_email( $subscriber_email ) {
	106	+
	107	+ // Bail if the API hasn't been configured.
	108	+ $settings = new ConvertKit_Settings();
	109	+ if ( ! $settings->has_api_key_and_secret() ) {
	110	+ return new WP_Error(
	111	+ 'convertkit_subscriber_get_subscriber_id_from_request_error',
	112	+ __( 'API Key and Secret not configured in Plugin Settings.', 'convertkit' )
	113	+ );
	114	+ }
	115	+
	116	+ // Initialize the API.
	117	+ $api = new ConvertKit_API( $settings->get_api_key(), $settings->get_api_secret(), $settings->debug_enabled() );
	118	+
	119	+ // Get subscriber by email, to ensure they exist.
	120	+ $subscriber = $api->get_subscriber_by_email( $subscriber_email );
	121	+
	122	+ // Bail if no subscriber exists with the given subscriber ID, or an error occured.
	123	+ if ( is_wp_error( $subscriber ) ) {
	124	+ // Delete the cookie.
	125	+ $this->forget();
	126	+
	127	+ // Return error.
	128	+ return $subscriber;
	129	+ }
	130	+
	131	+ // Store the subscriber ID as a cookie.
	132	+ $this->set( $subscriber['id'] );
	133	+
	134	+ // Return subscriber ID.
	135	+ return $subscriber['id'];
	136	+
	137	+ }
	138	+
	139	+ /**
	140	+ * Gets the subscriber ID from the `ck_subscriber_id` cookie.
	141	+ *
	142	+ * @since 2.0.0
	143	+ */
	144	+ private function get_subscriber_id_from_cookie() {
	145	+
	146	+ return $_COOKIE[ $this->key ];
	147	+
	148	+ }
	149	+
	150	+ /**
	151	+ * Stores the given subscriber ID in the `ck_subscriber_id` cookie.
	152	+ *
	153	+ * @since 2.0.0
	154	+ *
76	155	* @param int|string $subscriber_id Subscriber ID.
77	156	*/
78	157	public function set( $subscriber_id ) {
79	158
80	159	setcookie( $this->key, (string) $subscriber_id, time() + ( 365 * DAY_IN_SECONDS ), '/' );
81		- setcookie( 'wordpress_' . $this->key, (string) $subscriber_id, time() + ( 365 * DAY_IN_SECONDS ), '/' );
82	160
83	161	}
84	162
85	163	/**
		@@ -89,9 +167,8 @@
89	167	*/
90	168	public function forget() {
91	169
92	170	setcookie( $this->key, '', time() - ( 365 * DAY_IN_SECONDS ), '/' );
93		- setcookie( 'wordpress_' . $this->key, '', time() - ( 365 * DAY_IN_SECONDS ), '/' );
94	171
95	172	}
96	173
97	174	}