← All changes | includes/class-convertkit-subscriber.php +53 -3 3.3.1 → 3.1.0 View file →

		@@ -34,14 +34,14 @@
34	34	public function get_subscriber_id() {
35	35
36	36	// If the subscriber ID is in the request URI, use it.
37	37	if ( filter_has_var( INPUT_GET, $this->key ) ) {
38		- $subscriber_id = filter_input( INPUT_GET, $this->key, FILTER_SANITIZE_FULL_SPECIAL_CHARS );
39		- $this->set( $subscriber_id );
40		- return $subscriber_id;
	38	+ return $this->validate_and_store_subscriber_id( filter_input( INPUT_GET, $this->key, FILTER_SANITIZE_FULL_SPECIAL_CHARS ) );
41	39	}
42	40
43	41	// If the subscriber ID is in a cookie, return it.
	42	+ // For performance, we don't check that the subscriber ID exists every time, otherwise this would
	43	+ // call the API on every page load.
44	44	if ( isset( $_COOKIE[ $this->key ] ) && ! empty( $_COOKIE[ $this->key ] ) ) {
45	45	return $this->get_subscriber_id_from_cookie();
46	46	}
47	47
		@@ -46,8 +46,58 @@
46	46	}
47	47
48	48	// If here, no subscriber ID exists.
49	49	return false;
	50	+
	51	+ }
	52	+
	53	+ /**
	54	+ * Validates the given subscriber ID by querying the API to confirm
	55	+ * the subscriber exists before storing their ID in a cookie.
	56	+ *
	57	+ * @since 2.0.0
	58	+ *
	59	+ * @param int|string $subscriber_id Possible Subscriber ID or Signed Subscriber ID.
	60	+ * @return WP_Error|int|string Error | Confirmed Subscriber ID or Signed Subscriber ID
	61	+ */
	62	+ public function validate_and_store_subscriber_id( $subscriber_id ) {
	63	+
	64	+ // Bail if the API hasn't been configured.
	65	+ $settings = new ConvertKit_Settings();
	66	+ if ( ! $settings->has_access_and_refresh_token() ) {
	67	+ return new WP_Error(
	68	+ 'convertkit_subscriber_get_subscriber_id_from_request_error',
	69	+ __( 'Access Token not configured in Plugin Settings.', 'convertkit' )
	70	+ );
	71	+ }
	72	+
	73	+ // Initialize the API.
	74	+ $api = new ConvertKit_API_V4(
	75	+ CONVERTKIT_OAUTH_CLIENT_ID,
	76	+ CONVERTKIT_OAUTH_CLIENT_REDIRECT_URI,
	77	+ $settings->get_access_token(),
	78	+ $settings->get_refresh_token(),
	79	+ $settings->debug_enabled(),
	80	+ 'subscriber'
	81	+ );
	82	+
	83	+ // Get subscriber by ID, to ensure they exist.
	84	+ $subscriber = $api->get_subscriber( absint( $subscriber_id ) );
	85	+
	86	+ // Bail if no subscriber exists with the given subscriber ID, or an error occured.
	87	+ if ( is_wp_error( $subscriber ) ) {
	88	+ // Delete the cookie.
	89	+ $this->forget();
	90	+
	91	+ // Return error.
	92	+ return $subscriber;
	93	+ }
	94	+
	95	+ // Store the subscriber ID as a cookie.
	96	+ $this->set( $subscriber['subscriber']['id'] );
	97	+
	98	+ // Return subscriber ID.
	99	+ return $subscriber['subscriber']['id'];
50	100
51	101	}
52	102
53	103	/**