← All changes | includes/class-convertkit-subscriber.php +105 -14 3.4.2 → 2.7.4 View file →

		@@ -33,15 +33,15 @@
33	33	*/
34	34	public function get_subscriber_id() {
35	35
36	36	// If the subscriber ID is in the request URI, use it.
37		- if ( filter_has_var( INPUT_GET, $this->key ) ) {
38		- $subscriber_id = filter_input( INPUT_GET, $this->key, FILTER_SANITIZE_FULL_SPECIAL_CHARS );
39		- $this->set( $subscriber_id );
40		- return $subscriber_id;
	37	+ if ( isset( $_REQUEST[ $this->key ] ) && is_numeric( $_REQUEST[ $this->key ] ) ) { // phpcs:ignore WordPress.Security.NonceVerification
	38	+ return $this->validate_and_store_subscriber_id( sanitize_text_field( $_REQUEST[ $this->key ] ) ); // phpcs:ignore WordPress.Security.NonceVerification
41	39	}
42	40
43	41	// If the subscriber ID is in a cookie, return it.
	42	+ // For performance, we don't check that the subscriber ID exists every time, otherwise this would
	43	+ // call the API on every page load.
44	44	if ( isset( $_COOKIE[ $this->key ] ) && ! empty( $_COOKIE[ $this->key ] ) ) {
45	45	return $this->get_subscriber_id_from_cookie();
46	46	}
47	47
		@@ -50,36 +50,128 @@
50	50
51	51	}
52	52
53	53	/**
54		- * Gets the subscriber ID from the `ck_subscriber_id` cookie.
	54	+ * Validates the given subscriber ID by querying the API to confirm
	55	+ * the subscriber exists before storing their ID in a cookie.
55	56	*
56	57	* @since 2.0.0
57	58	*
58		- * @return string
	59	+ * @param int|string $subscriber_id Possible Subscriber ID or Signed Subscriber ID.
	60	+ * @return WP_Error|int|string Error | Confirmed Subscriber ID or Signed Subscriber ID
59	61	*/
60		- private function get_subscriber_id_from_cookie() {
	62	+ public function validate_and_store_subscriber_id( $subscriber_id ) {
61	63
62		- if ( ! isset( $_COOKIE[ $this->key ] ) ) {
63		- return '';
	64	+ // Bail if the API hasn't been configured.
	65	+ $settings = new ConvertKit_Settings();
	66	+ if ( ! $settings->has_access_and_refresh_token() ) {
	67	+ return new WP_Error(
	68	+ 'convertkit_subscriber_get_subscriber_id_from_request_error',
	69	+ __( 'Access Token not configured in Plugin Settings.', 'convertkit' )
	70	+ );
64	71	}
65	72
66		- return sanitize_text_field( wp_unslash( $_COOKIE[ $this->key ] ) );
	73	+ // Initialize the API.
	74	+ $api = new ConvertKit_API_V4(
	75	+ CONVERTKIT_OAUTH_CLIENT_ID,
	76	+ CONVERTKIT_OAUTH_CLIENT_REDIRECT_URI,
	77	+ $settings->get_access_token(),
	78	+ $settings->get_refresh_token(),
	79	+ $settings->debug_enabled(),
	80	+ 'subscriber'
	81	+ );
67	82
	83	+ // Get subscriber by ID, to ensure they exist.
	84	+ $subscriber = $api->get_subscriber( absint( $subscriber_id ) );
	85	+
	86	+ // Bail if no subscriber exists with the given subscriber ID, or an error occured.
	87	+ if ( is_wp_error( $subscriber ) ) {
	88	+ // Delete the cookie.
	89	+ $this->forget();
	90	+
	91	+ // Return error.
	92	+ return $subscriber;
	93	+ }
	94	+
	95	+ // Store the subscriber ID as a cookie.
	96	+ $this->set( $subscriber['subscriber']['id'] );
	97	+
	98	+ // Return subscriber ID.
	99	+ return $subscriber['subscriber']['id'];
	100	+
68	101	}
69	102
70	103	/**
71		- * Stores the given subscriber ID in the `ck_subscriber_id` cookie
72		- * and a prefixed `wordpress_ck_subscriber_id` cookie.
	104	+ * Validates the given subscriber email by querying the API to confirm
	105	+ * the subscriber exists before storing their ID in a cookie.
73	106	*
74	107	* @since 2.0.0
75	108	*
	109	+ * @param string $subscriber_email Possible Subscriber Email.
	110	+ * @return WP_Error|int|string Error | Confirmed Subscriber ID or Signed Subscriber ID
	111	+ */
	112	+ public function validate_and_store_subscriber_email( $subscriber_email ) {
	113	+
	114	+ // Bail if the API hasn't been configured.
	115	+ $settings = new ConvertKit_Settings();
	116	+ if ( ! $settings->has_access_and_refresh_token() ) {
	117	+ return new WP_Error(
	118	+ 'convertkit_subscriber_get_subscriber_id_from_request_error',
	119	+ __( 'Access Token not configured in Plugin Settings.', 'convertkit' )
	120	+ );
	121	+ }
	122	+
	123	+ // Initialize the API.
	124	+ $api = new ConvertKit_API_V4(
	125	+ CONVERTKIT_OAUTH_CLIENT_ID,
	126	+ CONVERTKIT_OAUTH_CLIENT_REDIRECT_URI,
	127	+ $settings->get_access_token(),
	128	+ $settings->get_refresh_token(),
	129	+ $settings->debug_enabled(),
	130	+ 'subscriber'
	131	+ );
	132	+
	133	+ // Get subscriber by email, to ensure they exist.
	134	+ $subscriber_id = $api->get_subscriber_id( $subscriber_email );
	135	+
	136	+ // Bail if no subscriber exists with the given subscriber ID, or an error occured.
	137	+ if ( is_wp_error( $subscriber_id ) ) {
	138	+ // Delete the cookie.
	139	+ $this->forget();
	140	+
	141	+ // Return error.
	142	+ return $subscriber_id;
	143	+ }
	144	+
	145	+ // Store the subscriber ID as a cookie.
	146	+ $this->set( $subscriber_id );
	147	+
	148	+ // Return subscriber ID.
	149	+ return $subscriber_id;
	150	+
	151	+ }
	152	+
	153	+ /**
	154	+ * Gets the subscriber ID from the `ck_subscriber_id` cookie.
	155	+ *
	156	+ * @since 2.0.0
	157	+ */
	158	+ private function get_subscriber_id_from_cookie() {
	159	+
	160	+ return $_COOKIE[ $this->key ];
	161	+
	162	+ }
	163	+
	164	+ /**
	165	+ * Stores the given subscriber ID in the `ck_subscriber_id` cookie.
	166	+ *
	167	+ * @since 2.0.0
	168	+ *
76	169	* @param int|string $subscriber_id Subscriber ID.
77	170	*/
78	171	public function set( $subscriber_id ) {
79	172
80	173	setcookie( $this->key, (string) $subscriber_id, time() + ( 365 * DAY_IN_SECONDS ), '/' );
81		- setcookie( 'wordpress_' . $this->key, (string) $subscriber_id, time() + ( 365 * DAY_IN_SECONDS ), '/' );
82	174
83	175	}
84	176
85	177	/**
		@@ -89,9 +181,8 @@
89	181	*/
90	182	public function forget() {
91	183
92	184	setcookie( $this->key, '', time() - ( 365 * DAY_IN_SECONDS ), '/' );
93		- setcookie( 'wordpress_' . $this->key, '', time() - ( 365 * DAY_IN_SECONDS ), '/' );
94	185
95	186	}
96	187
97	188	}