dologin / src / router.cls.php

router.cls.php in DoLogin Security trunk, at src/router.cls.php

182 lines 5.2 KB

Raw Download Zip

1	<?php
2	/**
3	* Router class
4	*
5	* @since 1.4
6	*/
7	namespace dologin;
8
9	defined( 'WPINC' ) \|\| exit;
10
11	class Router extends Instance {
12	const NONCE = 'dologin_nonce';
13	const ACTION = 'dologin_action';
14	const TYPE = 'dologin_type';
15	const I = 'dologin_i';
16
17	const ACTION_SITE = 'site';
18	const ACTION_PSWD = 'pswdless';
19	const ACTION_AUTH = 'auth';
20	const ACTION_INSTALLER = 'installer';
21
22	// List all handlers here
23	private static $_HANDLERS = array(
24	self::ACTION_SITE,
25	self::ACTION_PSWD,
26	self::ACTION_AUTH,
27	self::ACTION_INSTALLER,
28	);
29
30	private static $_action;
31
32	/**
33	* Init
34	*/
35	public function init() {
36	add_action( 'init', array( $this, 'handler' ) );
37	}
38
39	/**
40	* Auto handler in `after_user_init`
41	*
42	* @since 2.7
43	*/
44	public function handler() {
45	$cls = $this->get_action();
46	if ( ! $cls ) {
47	return;
48	}
49
50	if ( ! in_array( $cls, self::$_HANDLERS ) ) {
51	return;
52	}
53
54	$this->cls( $cls )->handler();
55	self::redirect();
56	}
57
58	/**
59	* Redirect page and drop self params
60	*
61	* @since 1.4
62	*/
63	public static function redirect( $url = false ) {
64	global $pagenow;
65	$qs = '';
66	if ( ! $url ) {
67	if ( ! empty( $_GET ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- nonce verified by verify_nonce() during action dispatch.
68	if ( isset( $_GET[ self::ACTION ] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- nonce verified by verify_nonce() during action dispatch.
69	unset( $_GET[ self::ACTION ] );
70	}
71	if ( isset( $_GET[ self::NONCE ] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- nonce verified by verify_nonce() during action dispatch.
72	unset( $_GET[ self::NONCE ] );
73	}
74	if ( isset( $_GET[ self::TYPE ] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- nonce verified by verify_nonce() during action dispatch.
75	unset( $_GET[ self::TYPE ] );
76	}
77	if ( isset( $_GET[ self::I ] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- nonce verified by verify_nonce() during action dispatch.
78	unset( $_GET[ self::I ] );
79	}
80	if ( ! empty( $_GET ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- nonce verified by verify_nonce() during action dispatch.
81	$qs = '?' . http_build_query( $_GET ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- nonce verified by verify_nonce() during action dispatch.
82	}
83	}
84	if ( is_network_admin() ) {
85	$url = network_admin_url( $pagenow . $qs );
86	} else {
87	$url = admin_url( $pagenow . $qs );
88	}
89	}
90
91	wp_safe_redirect( $url );
92	exit();
93	}
94
95	/**
96	* Parse action
97	*
98	* @since 1.4
99	*/
100	public function get_action() {
101	if ( ! isset( self::$_action ) ) {
102	self::$_action = false;
103	$this->verify_action();
104	if ( self::$_action ) {
105	defined( 'debug' ) && debug( 'do_login action verified: ' . var_export( self::$_action, true ) ); // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_var_export -- debug output gated behind the debug constant.
106	}
107	}
108	return self::$_action;
109	}
110
111	/**
112	* Verify action
113	*
114	* @since 1.4
115	*/
116	private function verify_action() {
117	if ( empty( $_REQUEST[ self::ACTION ] ) \|\| ! is_string( $_REQUEST[ self::ACTION ] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- nonce verified by verify_nonce() below.
118	return;
119	}
120
121	$action = sanitize_text_field( wp_unslash( $_REQUEST[ self::ACTION ] ) ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- nonce verified by verify_nonce() below.
122
123	if ( ! $this->verify_nonce( $action ) ) {
124	return;
125	}
126
127	switch ( $action ) {
128	case self::ACTION_SITE:
129	case self::ACTION_PSWD:
130	case self::ACTION_AUTH:
131	if ( current_user_can( 'manage_options' ) ) {
132	self::$_action = $action;
133	}
134	return;
135
136	case self::ACTION_INSTALLER:
137	if ( current_user_can( 'install_plugins' ) && current_user_can( 'activate_plugins' ) && ( ! is_multisite() \|\| is_super_admin() ) ) {
138	self::$_action = $action;
139	}
140	return;
141
142	default:
143	defined( 'debug' ) && debug( 'do_login match falied: ' . $action );
144	return;
145	}
146	}
147
148	/**
149	* Verify nonce
150	*
151	* @since 1.4
152	*/
153	private function verify_nonce( $action ) {
154	if ( ! isset( $_REQUEST[ self::NONCE ] ) \|\| ! is_string( $_REQUEST[ self::NONCE ] ) ) {
155	return false;
156	}
157
158	if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST[ self::NONCE ] ) ), $action ) ) {
159	return false;
160	}
161
162	return true;
163	}
164
165	/**
166	* Get type value
167	*
168	* @since 1.4
169	* @access public
170	*/
171	public static function verify_type() {
172	if ( empty( $_REQUEST[ self::TYPE ] ) \|\| ! is_string( $_REQUEST[ self::TYPE ] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- nonce verified by verify_nonce() during action dispatch.
173	defined( 'debug' ) && debug( 'no type', 2 );
174	return false;
175	}
176
177	defined( 'debug' ) && debug( 'parsed type: ' . sanitize_text_field( wp_unslash( $_REQUEST[ self::TYPE ] ) ), 2 ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- nonce verified by verify_nonce() during action dispatch.
178
179	return sanitize_text_field( wp_unslash( $_REQUEST[ self::TYPE ] ) ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- nonce verified by verify_nonce() during action dispatch.
180	}
181	}
182