elementor / core / common / modules / connect / apps / base-app.php

base-app.php in Elementor Website Builder – more than just a page builder 3.19.4, at core/common/modules/connect/apps/base-app.php

828 lines 19.6 KB

Raw Download Zip

1	<?php
2	namespace Elementor\Core\Common\Modules\Connect\Apps;
3
4	use Elementor\Core\Admin\Admin_Notices;
5	use Elementor\Core\Common\Modules\Connect\Admin;
6	use Elementor\Core\Utils\Collection;
7	use Elementor\Core\Utils\Http;
8	use Elementor\Core\Utils\Str;
9	use Elementor\Plugin;
10	use Elementor\Tracker;
11	use Elementor\Utils;
12
13	if ( ! defined( 'ABSPATH' ) ) {
14	exit; // Exit if accessed directly
15	}
16
17	abstract class Base_App {
18
19	const OPTION_NAME_PREFIX = 'elementor_connect_';
20
21	const OPTION_CONNECT_SITE_KEY = self::OPTION_NAME_PREFIX . 'site_key';
22
23	const SITE_URL = 'https://my.elementor.com/connect/v1';
24
25	const API_URL = 'https://my.elementor.com/api/connect/v1';
26
27	const HTTP_RETURN_TYPE_OBJECT = 'object';
28	const HTTP_RETURN_TYPE_ARRAY = 'array';
29
30	protected $data = [];
31
32	protected $auth_mode = '';
33
34	/**
35	* @var Http
36	*/
37	protected $http;
38
39	/**
40	* @since 2.3.0
41	* @access protected
42	* @abstract
43	* TODO: make it public.
44	*/
45	abstract protected function get_slug();
46
47	/**
48	* @since 2.8.0
49	* @access public
50	* TODO: make it abstract.
51	*/
52	public function get_title() {
53	return $this->get_slug();
54	}
55
56	/**
57	* @since 2.3.0
58	* @access protected
59	* @abstract
60	*/
61	abstract protected function update_settings();
62
63	/**
64	* @since 2.3.0
65	* @access public
66	* @static
67	*/
68	public static function get_class_name() {
69	return get_called_class();
70	}
71
72	/**
73	* @access public
74	* @abstract
75	*/
76	public function render_admin_widget() {
77	// PHPCS - the method get_title return a plain string.
78	echo '<h2>' . $this->get_title() . '</h2>'; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
79
80	if ( $this->is_connected() ) {
81	$remote_user = $this->get( 'user' );
82	/* translators: %s: Remote user. */
83	$title = sprintf( esc_html__( 'Connected as %s', 'elementor' ), '<strong>' . esc_html( $remote_user->email ) . '</strong>' );
84	$label = esc_html__( 'Disconnect', 'elementor' );
85	$url = $this->get_admin_url( 'disconnect' );
86	$attr = '';
87
88	echo sprintf(
89	'%s <a %s href="%s">%s</a>',
90	// PHPCS - the variable $title is already escaped above.
91	$title, // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
92	// PHPCS - the variable $attr is a plain string.
93	$attr, // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
94	esc_attr( $url ),
95	esc_html( $label )
96	);
97	} else {
98	echo 'Not Connected';
99	}
100
101	echo '<hr>';
102
103	$this->print_app_info();
104
105	if ( current_user_can( 'manage_options' ) ) {
106	printf( '<div><a href="%s">%s</a></div>', esc_url( $this->get_admin_url( 'reset' ) ), esc_html__( 'Reset Data', 'elementor' ) );
107	}
108
109	echo '<hr>';
110	}
111
112
113	/**
114	* @since 2.3.0
115	* @access protected
116	*/
117	protected function get_option_name() {
118	return static::OPTION_NAME_PREFIX . $this->get_slug();
119	}
120
121	/**
122	* @since 2.3.0
123	* @access public
124	*/
125	public function admin_notice() {
126	$notices = $this->get( 'notices' );
127
128	if ( ! $notices ) {
129	return;
130	}
131
132	$this->print_notices( $notices );
133
134	$this->delete( 'notices' );
135	}
136
137
138	public function get_app_token_from_cli_token( $cli_token ) {
139	$response = $this->request( 'get_app_token_from_cli_token', [
140	'cli_token' => $cli_token,
141	] );
142
143	if ( is_wp_error( $response ) ) {
144	// PHPCS - the variable $response does not contain a user input value.
145	wp_die( $response, $response->get_error_message() ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
146	}
147
148	// Use state as usual.
149	$_REQUEST['state'] = $this->get( 'state' );
150	$_REQUEST['code'] = $response->code;
151	}
152	/**
153	* @since 2.3.0
154	* @access public
155	*/
156	public function action_authorize() {
157	if ( $this->is_connected() ) {
158	$this->add_notice( esc_html__( 'Already connected.', 'elementor' ), 'info' );
159	$this->redirect_to_admin_page();
160	return;
161	}
162
163	$this->set_client_id();
164	$this->set_request_state();
165
166	$this->redirect_to_remote_authorize_url();
167	}
168
169	public function action_reset() {
170	if ( current_user_can( 'manage_options' ) ) {
171	delete_option( static::OPTION_CONNECT_SITE_KEY );
172	delete_option( 'elementor_remote_info_library' );
173	}
174
175	$this->redirect_to_admin_page();
176	}
177
178	/**
179	* @since 2.3.0
180	* @access public
181	*/
182	public function action_get_token() {
183	if ( $this->is_connected() ) {
184	$this->redirect_to_admin_page();
185	}
186
187	//phpcs:ignore WordPress.Security.NonceVerification.Recommended - The user as been authorized before in 'connect'.
188	$state = Utils::get_super_global_value( $_REQUEST, 'state' );
189
190	if ( $state !== $this->get( 'state' ) ) {
191	$this->add_notice( 'Get Token: Invalid Request.', 'error' );
192	$this->redirect_to_admin_page();
193	}
194
195	$response = $this->request( 'get_token', [
196	'grant_type' => 'authorization_code',
197	'code' => Utils::get_super_global_value( $_REQUEST, 'code' ), //phpcs:ignore WordPress.Security.NonceVerification.Recommended
198	'redirect_uri' => rawurlencode( $this->get_admin_url( 'get_token' ) ),
199	'client_id' => $this->get( 'client_id' ),
200	] );
201
202	if ( is_wp_error( $response ) ) {
203	$notice = 'Cannot Get Token:' . $response->get_error_message();
204	$this->add_notice( $notice, 'error' );
205	$this->redirect_to_admin_page();
206	}
207
208	$this->delete( 'state' );
209	$this->set( (array) $response );
210
211	if ( ! empty( $response->data_share_opted_in ) && current_user_can( 'manage_options' ) ) {
212	Tracker::set_opt_in( true );
213	}
214
215	$this->after_connect();
216
217	// Add the notice after the method `after_connect`, so an app can redirect without the notice.
218	$this->add_notice( esc_html__( 'Connected successfully.', 'elementor' ) );
219
220	$this->redirect_to_admin_page();
221	}
222
223	/**
224	* @since 2.3.0
225	* @access public
226	*/
227	public function action_disconnect() {
228	if ( $this->is_connected() ) {
229	$this->disconnect();
230	$this->add_notice( esc_html__( 'Disconnected successfully.', 'elementor' ) );
231	}
232
233	$this->redirect_to_admin_page();
234	}
235
236	/**
237	* @since 2.8.0
238	* @access public
239	*/
240	public function action_reconnect() {
241	$this->disconnect();
242
243	$this->action_authorize();
244	}
245
246	/**
247	* @since 2.3.0
248	* @access public
249	*/
250	public function get_admin_url( $action, $params = [] ) {
251	$params = [
252	'app' => $this->get_slug(),
253	'action' => $action,
254	'nonce' => wp_create_nonce( $this->get_slug() . $action ),
255	] + $params;
256
257	$admin_url = Str::encode_idn_url( get_admin_url() );
258	$admin_url .= 'admin.php?page=' . Admin::PAGE_ID;
259
260	return add_query_arg( $params, $admin_url );
261	}
262
263	/**
264	* @since 2.3.0
265	* @access public
266	*/
267	public function is_connected() {
268	return (bool) $this->get( 'access_token' );
269	}
270
271	/**
272	* @since 2.3.0
273	* @access protected
274	*/
275	protected function init() {}
276
277	/**
278	* @since 2.3.0
279	* @access protected
280	*/
281	protected function init_data() {}
282
283	/**
284	* @since 2.3.0
285	* @access protected
286	*/
287	protected function after_connect() {}
288
289	/**
290	* @since 2.3.0
291	* @access public
292	*/
293	public function get( $key, $default = null ) {
294	$this->init_data();
295
296	return isset( $this->data[ $key ] ) ? $this->data[ $key ] : $default;
297	}
298
299	/**
300	* @since 2.3.0
301	* @access protected
302	*/
303	protected function set( $key, $value = null ) {
304	$this->init_data();
305
306	if ( is_array( $key ) ) {
307	$this->data = array_replace_recursive( $this->data, $key );
308	} else {
309	$this->data[ $key ] = $value;
310	}
311
312	$this->update_settings();
313	}
314
315	/**
316	* @since 2.3.0
317	* @access protected
318	*/
319	protected function delete( $key = null ) {
320	$this->init_data();
321
322	if ( $key ) {
323	unset( $this->data[ $key ] );
324	} else {
325	$this->data = [];
326	}
327
328	$this->update_settings();
329	}
330
331	/**
332	* @since 2.3.0
333	* @access protected
334	*/
335	protected function add( $key, $value, $default = '' ) {
336	$new_value = $this->get( $key, $default );
337
338	if ( is_array( $new_value ) ) {
339	$new_value[] = $value;
340	} elseif ( is_string( $new_value ) ) {
341	$new_value .= $value;
342	} elseif ( is_numeric( $new_value ) ) {
343	$new_value += $value;
344	}
345
346	$this->set( $key, $new_value );
347	}
348
349	/**
350	* @since 2.3.0
351	* @access protected
352	*/
353	protected function add_notice( $content, $type = 'success' ) {
354	$this->add( 'notices', compact( 'content', 'type' ), [] );
355	}
356
357	/**
358	* @param $action
359	* @param array $request_body
360	* @param false $as_array
361	*
362	* @return mixed\|\WP_Error
363	*/
364	protected function request( $action, $request_body = [], $as_array = false ) {
365	$request_body = $this->get_connect_info() + $request_body;
366
367	return $this->http_request(
368	'POST',
369	$action,
370	[
371	'timeout' => 25,
372	'body' => $request_body,
373	'headers' => $this->is_connected() ?
374	[ 'X-Elementor-Signature' => $this->generate_signature( $request_body ) ] :
375	[],
376	],
377	[
378	'return_type' => $as_array ? static::HTTP_RETURN_TYPE_ARRAY : static::HTTP_RETURN_TYPE_OBJECT,
379	]
380	);
381	}
382
383	/**
384	* Get Base Connect Info
385	*
386	* Returns an array of connect info.
387	*
388	* @return array
389	*/
390	protected function get_base_connect_info() {
391	return [
392	'app' => $this->get_slug(),
393	'access_token' => $this->get( 'access_token' ),
394	'client_id' => $this->get( 'client_id' ),
395	'local_id' => get_current_user_id(),
396	'site_key' => $this->get_site_key(),
397	'home_url' => trailingslashit( home_url() ),
398	];
399	}
400
401	/**
402	* Get all the connect information
403	*
404	* @return array
405	*/
406	protected function get_connect_info() {
407	$connect_info = $this->get_base_connect_info();
408
409	$additional_info = [];
410
411	/**
412	* Additional connect info.
413	*
414	* Filters the connection information when connecting to Elementor servers.
415	* This hook can be used to add more information or add more data.
416	*
417	* @param array $additional_info Additional connecting information array.
418	* @param Base_App $this The base app instance.
419	*/
420	$additional_info = apply_filters( 'elementor/connect/additional-connect-info', $additional_info, $this );
421
422	return array_merge( $connect_info, $additional_info );
423	}
424
425	/**
426	* @param $endpoint
427	*
428	* @return array
429	*/
430	protected function generate_authentication_headers( $endpoint ) {
431	$connect_info = ( new Collection( $this->get_connect_info() ) )
432	->map_with_keys( function ( $value, $key ) {
433	// For bc `get_connect_info` returns the connect info with underscore,
434	// headers with underscore are not valid, so all the keys with underscore will be replaced to hyphen.
435	return [ str_replace( '_', '-', $key ) => $value ];
436	} )
437	->replace_recursive( [ 'endpoint' => $endpoint ] )
438	->sort_keys();
439
440	return $connect_info
441	->merge( [ 'X-Elementor-Signature' => $this->generate_signature( $connect_info->all() ) ] )
442	->all();
443	}
444
445	/**
446	* Send an http request
447	*
448	* @param $method
449	* @param $endpoint
450	* @param array $args
451	* @param array $options
452	*
453	* @return mixed\|\WP_Error
454	*/
455	protected function http_request( $method, $endpoint, $args = [], $options = [] ) {
456	$options = wp_parse_args( $options, [
457	'return_type' => static::HTTP_RETURN_TYPE_OBJECT,
458	] );
459
460	$args = array_replace_recursive( [
461	'headers' => $this->is_connected() ? $this->generate_authentication_headers( $endpoint ) : [],
462	'method' => $method,
463	'timeout' => 10,
464	], $args );
465
466	$response = $this->http->request_with_fallback(
467	$this->get_generated_urls( $endpoint ),
468	$args
469	);
470
471	if ( is_wp_error( $response ) ) {
472	// PHPCS - the variable $response does not contain a user input value.
473	wp_die( $response, [ 'back_link' => true ] ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
474	}
475
476	$body = wp_remote_retrieve_body( $response );
477	$response_code = (int) wp_remote_retrieve_response_code( $response );
478
479	if ( ! $response_code ) {
480	return new \WP_Error( 500, 'No Response' );
481	}
482
483	// Server sent a success message without content.
484	if ( 'null' === $body ) {
485	$body = true;
486	}
487
488	$body = json_decode( $body, static::HTTP_RETURN_TYPE_ARRAY === $options['return_type'] );
489
490	if ( false === $body ) {
491	return new \WP_Error( 422, 'Wrong Server Response' );
492	}
493
494	if ( 200 !== $response_code ) {
495	// In case $as_array = true.
496	$body = (object) $body;
497
498	$message = isset( $body->message ) ? $body->message : wp_remote_retrieve_response_message( $response );
499	$code = (int) ( isset( $body->code ) ? $body->code : $response_code );
500
501	if ( ! $code ) {
502	$code = $response_code;
503	}
504
505	if ( 401 === $code ) {
506	$this->delete();
507
508	$should_retry = ! in_array( $this->auth_mode, [ 'xhr', 'cli' ], true );
509
510	if ( $should_retry ) {
511	$this->action_authorize();
512	}
513	}
514
515	return new \WP_Error( $code, $message );
516	}
517
518	return $body;
519	}
520
521	/**
522	* Create a signature for the http request
523	*
524	* @param array $payload
525	*
526	* @return false\|string
527	*/
528	private function generate_signature( $payload = [] ) {
529	return hash_hmac(
530	'sha256',
531	wp_json_encode( $payload, JSON_NUMERIC_CHECK ),
532	$this->get( 'access_token_secret' )
533	);
534	}
535
536	/**
537	* @since 2.3.0
538	* @access protected
539	*/
540	protected function get_api_url() {
541	return static::API_URL . '/' . $this->get_slug();
542	}
543	/**
544	* @since 2.3.0
545	* @access protected
546	*/
547	protected function get_remote_site_url() {
548	return static::SITE_URL . '/' . $this->get_slug();
549	}
550
551	/**
552	* @since 2.3.0
553	* @access protected
554	*/
555	protected function get_remote_authorize_url() {
556	$redirect_uri = $this->get_auth_redirect_uri();
557
558	$allowed_query_params_to_propagate = [
559	'utm_source',
560	'utm_medium',
561	'utm_campaign',
562	'utm_term',
563	'utm_content',
564	'source',
565	'screen_hint',
566	];
567
568	$query_params = ( new Collection( $_GET ) ) // phpcs:ignore
569	->only( $allowed_query_params_to_propagate )
570	->merge( [
571	'action' => 'authorize',
572	'response_type' => 'code',
573	'client_id' => $this->get( 'client_id' ),
574	'auth_secret' => $this->get( 'auth_secret' ),
575	'state' => $this->get( 'state' ),
576	'redirect_uri' => rawurlencode( $redirect_uri ),
577	'may_share_data' => current_user_can( 'manage_options' ) && ! Tracker::is_allow_track(),
578	'reconnect_nonce' => wp_create_nonce( $this->get_slug() . 'reconnect' ),
579	] );
580
581	return add_query_arg( $query_params->all(), $this->get_remote_site_url() );
582	}
583
584	/**
585	* @since 2.3.0
586	* @access protected
587	*/
588	protected function redirect_to_admin_page( $url = '' ) {
589	if ( ! $url ) {
590	$url = Admin::$url;
591	}
592
593	switch ( $this->auth_mode ) {
594	case 'popup':
595	$this->print_popup_close_script( $url );
596	break;
597
598	case 'cli':
599	$this->admin_notice();
600	die;
601
602	default:
603	wp_safe_redirect( $url );
604	die;
605	}
606	}
607
608	/**
609	* @since 2.3.0
610	* @access protected
611	*/
612	protected function set_client_id() {
613	$source = Utils::get_super_global_value( $_REQUEST, 'source' ) ?? ''; //phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Nonce verification is not required here.
614	$response = $this->request(
615	'get_client_id',
616	[
617	'source' => esc_attr( $source ),
618	]
619	);
620
621	if ( is_wp_error( $response ) ) {
622	// PHPCS - the variable $response does not contain a user input value.
623	wp_die( $response, $response->get_error_message() ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
624	}
625
626	$this->set( 'client_id', $response->client_id );
627	$this->set( 'auth_secret', $response->auth_secret );
628	}
629
630	/**
631	* @since 2.3.0
632	* @access protected
633	*/
634	protected function set_request_state() {
635	$this->set( 'state', wp_generate_password( 12, false ) );
636	}
637
638	protected function get_popup_success_event_data() {
639	return [];
640	}
641
642	/**
643	* @since 2.3.0
644	* @access protected
645	*/
646	protected function print_popup_close_script( $url ) {
647	$data = $this->get_popup_success_event_data();
648
649	?>
650	<script>
651	if ( opener && opener !== window ) {
652	opener.jQuery( 'body' ).trigger(
653	'elementor/connect/success/<?php echo esc_attr( Utils::get_super_global_value( $_REQUEST, 'callback_id' ) ); //phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Nonce verification is not required here. ?>',
654	<?php echo wp_json_encode( $data ); ?>
655	);
656
657	window.close();
658	opener.focus();
659	} else {
660	location = '<?php echo esc_url( $url ); ?>';
661	}
662	</script>
663	<?php
664	die;
665	}
666
667	/**
668	* @since 2.3.0
669	* @access protected
670	*/
671	protected function disconnect() {
672	if ( $this->is_connected() ) {
673	// Try update the server, but not needed to handle errors.
674	$this->request( 'disconnect' );
675	}
676
677	$this->delete();
678	}
679
680	/**
681	* @since 2.3.0
682	* @access protected
683	*/
684	public function get_site_key() {
685	$site_key = get_option( static::OPTION_CONNECT_SITE_KEY );
686
687	if ( ! $site_key ) {
688	$site_key = md5( uniqid( wp_generate_password() ) );
689	update_option( static::OPTION_CONNECT_SITE_KEY, $site_key );
690	}
691
692	return $site_key;
693	}
694
695	protected function redirect_to_remote_authorize_url() {
696	switch ( $this->auth_mode ) {
697	case 'cli':
698	$this->get_app_token_from_cli_token( Utils::get_super_global_value( $_REQUEST, 'token' ) ); //phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Nonce verification is not required here.
699	return;
700	default:
701	wp_redirect( $this->get_remote_authorize_url() ); //phpcs:ignore WordPress.Security.SafeRedirect.wp_redirect_wp_redirect -- Safe redirect is used here.
702	die;
703	}
704	}
705
706	protected function get_auth_redirect_uri() {
707	$redirect_uri = $this->get_admin_url( 'get_token' );
708
709	switch ( $this->auth_mode ) {
710	case 'popup':
711	$redirect_uri = add_query_arg( [
712	'mode' => 'popup',
713	'callback_id' => esc_attr( Utils::get_super_global_value( $_REQUEST, 'callback_id' ) ), //phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Nonce verification is not required here.
714	], $redirect_uri );
715	break;
716	}
717
718	return $redirect_uri;
719	}
720
721
722	protected function print_notices( $notices ) {
723	switch ( $this->auth_mode ) {
724	case 'cli':
725	foreach ( $notices as $notice ) {
726	printf( '[%s] %s', wp_kses_post( $notice['type'] ), wp_kses_post( $notice['content'] ) );
727	}
728	break;
729	default:
730	/**
731	* @var Admin_Notices $admin_notices
732	*/
733	$admin_notices = Plugin::$instance->admin->get_component( 'admin-notices' );
734
735	foreach ( $notices as $notice ) {
736	$options = [
737	'description' => wp_kses_post( wpautop( $notice['content'] ) ),
738	'type' => $notice['type'],
739	'icon' => false,
740	];
741
742	$admin_notices->print_admin_notice( $options );
743	}
744	}
745	}
746
747	protected function get_app_info() {
748	return [];
749	}
750
751	protected function print_app_info() {
752	$app_info = $this->get_app_info();
753
754	foreach ( $app_info as $key => $item ) {
755	if ( $item['value'] ) {
756	$status = 'Exist';
757	$color = 'green';
758	} else {
759	$status = 'Empty';
760	$color = 'red';
761	}
762
763	// PHPCS - the values of $item['label'], $color, $status are plain strings.
764	printf( '%s: <strong style="color:%s">%s</strong><br>', $item['label'], $color, $status ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
765	}
766
767	}
768
769	private function get_generated_urls( $endpoint ) {
770	$base_urls = $this->get_api_url();
771
772	if ( ! is_array( $base_urls ) ) {
773	$base_urls = [ $base_urls ];
774	}
775
776	return array_map( function ( $base_url ) use ( $endpoint ) {
777	return trailingslashit( $base_url ) . $endpoint;
778	}, $base_urls );
779	}
780
781	private function init_auth_mode() {
782	$is_rest = defined( 'REST_REQUEST' ) && REST_REQUEST;
783	$is_ajax = wp_doing_ajax();
784
785	if ( $is_rest \|\| $is_ajax ) {
786	// Set default to 'xhr' if rest or ajax request.
787	$this->set_auth_mode( 'xhr' );
788	}
789
790	$mode = Utils::get_super_global_value( $_REQUEST, 'mode' ); //phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Nonce verification is not required here.
791
792	if ( $mode ) {
793	$allowed_auth_modes = [
794	'popup',
795	];
796
797	if ( defined( 'WP_CLI' ) && WP_CLI ) {
798	$allowed_auth_modes[] = 'cli';
799	}
800
801	if ( in_array( $mode, $allowed_auth_modes, true ) ) {
802	$this->set_auth_mode( $mode );
803	}
804	}
805	}
806
807	public function set_auth_mode( $mode ) {
808	$this->auth_mode = $mode;
809	}
810
811	/**
812	* @since 2.3.0
813	* @access public
814	*/
815	public function __construct() {
816	add_action( 'admin_notices', [ $this, 'admin_notice' ] );
817
818	$this->init_auth_mode();
819
820	$this->http = new Http();
821
822	/**
823	* Allow extended apps to customize the __construct without call parent::__construct.
824	*/
825	$this->init();
826	}
827	}
828