elementor / core / common / modules / connect / apps / base-app.php

base-app.php in Elementor Website Builder – more than just a page builder 3.21.3, at core/common/modules/connect/apps/base-app.php

835 lines 19.8 KB

Raw Download Zip

1	<?php
2	namespace Elementor\Core\Common\Modules\Connect\Apps;
3
4	use Elementor\Core\Admin\Admin_Notices;
5	use Elementor\Core\Common\Modules\Connect\Admin;
6	use Elementor\Core\Utils\Collection;
7	use Elementor\Core\Utils\Http;
8	use Elementor\Core\Utils\Str;
9	use Elementor\Plugin;
10	use Elementor\Tracker;
11	use Elementor\Utils;
12
13	if ( ! defined( 'ABSPATH' ) ) {
14	exit; // Exit if accessed directly
15	}
16
17	abstract class Base_App {
18
19	const OPTION_NAME_PREFIX = 'elementor_connect_';
20
21	const OPTION_CONNECT_SITE_KEY = self::OPTION_NAME_PREFIX . 'site_key';
22
23	const SITE_URL = 'https://my.elementor.com/connect/v1';
24
25	const API_URL = 'https://my.elementor.com/api/connect/v1';
26
27	const HTTP_RETURN_TYPE_OBJECT = 'object';
28	const HTTP_RETURN_TYPE_ARRAY = 'array';
29
30	protected $data = [];
31
32	protected $auth_mode = '';
33
34	/**
35	* @var Http
36	*/
37	protected $http;
38
39	/**
40	* @since 2.3.0
41	* @access protected
42	* @abstract
43	* TODO: make it public.
44	*/
45	abstract protected function get_slug();
46
47	/**
48	* @since 2.8.0
49	* @access public
50	* TODO: make it abstract.
51	*/
52	public function get_title() {
53	return $this->get_slug();
54	}
55
56	/**
57	* @since 2.3.0
58	* @access protected
59	* @abstract
60	*/
61	abstract protected function update_settings();
62
63	/**
64	* @since 2.3.0
65	* @access public
66	* @static
67	*/
68	public static function get_class_name() {
69	return get_called_class();
70	}
71
72	/**
73	* @access public
74	* @abstract
75	*/
76	public function render_admin_widget() {
77	// PHPCS - the method get_title return a plain string.
78	echo '<h2>' . $this->get_title() . '</h2>'; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
79
80	if ( $this->is_connected() ) {
81	$remote_user = $this->get( 'user' );
82	$title = sprintf(
83	/* translators: %s: Remote user. */
84	esc_html__( 'Connected as %s', 'elementor' ),
85	'<strong>' . esc_html( $remote_user->email ) . '</strong>'
86	);
87	$label = esc_html__( 'Disconnect', 'elementor' );
88	$url = $this->get_admin_url( 'disconnect' );
89	$attr = '';
90
91	echo sprintf(
92	'%s <a %s href="%s">%s</a>',
93	// PHPCS - the variable $title is already escaped above.
94	$title, // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
95	// PHPCS - the variable $attr is a plain string.
96	$attr, // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
97	esc_attr( $url ),
98	esc_html( $label )
99	);
100	} else {
101	echo 'Not Connected';
102	}
103
104	echo '<hr>';
105
106	$this->print_app_info();
107
108	if ( current_user_can( 'manage_options' ) ) {
109	printf( '<div><a href="%s">%s</a></div>', esc_url( $this->get_admin_url( 'reset' ) ), esc_html__( 'Reset Data', 'elementor' ) );
110	}
111
112	echo '<hr>';
113	}
114
115
116	/**
117	* @since 2.3.0
118	* @access protected
119	*/
120	protected function get_option_name() {
121	return static::OPTION_NAME_PREFIX . $this->get_slug();
122	}
123
124	/**
125	* @since 2.3.0
126	* @access public
127	*/
128	public function admin_notice() {
129	$notices = $this->get( 'notices' );
130
131	if ( ! $notices ) {
132	return;
133	}
134
135	$this->print_notices( $notices );
136
137	$this->delete( 'notices' );
138	}
139
140
141	public function get_app_token_from_cli_token( $cli_token ) {
142	$response = $this->request( 'get_app_token_from_cli_token', [
143	'cli_token' => $cli_token,
144	] );
145
146	if ( is_wp_error( $response ) ) {
147	// PHPCS - the variable $response does not contain a user input value.
148	wp_die( $response, $response->get_error_message() ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
149	}
150
151	// Use state as usual.
152	$_REQUEST['state'] = $this->get( 'state' );
153	$_REQUEST['code'] = $response->code;
154	}
155	/**
156	* @since 2.3.0
157	* @access public
158	*/
159	public function action_authorize() {
160	if ( $this->is_connected() ) {
161	$this->add_notice( esc_html__( 'Already connected.', 'elementor' ), 'info' );
162	$this->redirect_to_admin_page();
163	return;
164	}
165
166	$this->set_client_id();
167	$this->set_request_state();
168
169	$this->redirect_to_remote_authorize_url();
170	}
171
172	public function action_reset() {
173	if ( current_user_can( 'manage_options' ) ) {
174	delete_option( static::OPTION_CONNECT_SITE_KEY );
175	delete_option( 'elementor_remote_info_library' );
176	}
177
178	$this->redirect_to_admin_page();
179	}
180
181	/**
182	* @since 2.3.0
183	* @access public
184	*/
185	public function action_get_token() {
186	if ( $this->is_connected() ) {
187	$this->redirect_to_admin_page();
188	}
189
190	//phpcs:ignore WordPress.Security.NonceVerification.Recommended - The user as been authorized before in 'connect'.
191	$state = Utils::get_super_global_value( $_REQUEST, 'state' );
192
193	if ( $state !== $this->get( 'state' ) ) {
194	$this->add_notice( 'Get Token: Invalid Request.', 'error' );
195	$this->redirect_to_admin_page();
196	}
197
198	$response = $this->request( 'get_token', [
199	'grant_type' => 'authorization_code',
200	'code' => Utils::get_super_global_value( $_REQUEST, 'code' ), //phpcs:ignore WordPress.Security.NonceVerification.Recommended
201	'redirect_uri' => rawurlencode( $this->get_admin_url( 'get_token' ) ),
202	'client_id' => $this->get( 'client_id' ),
203	] );
204
205	if ( is_wp_error( $response ) ) {
206	$notice = 'Cannot Get Token:' . $response->get_error_message();
207	$this->add_notice( $notice, 'error' );
208	$this->redirect_to_admin_page();
209	}
210
211	$this->delete( 'state' );
212	$this->set( (array) $response );
213
214	if ( ! empty( $response->data_share_opted_in ) && current_user_can( 'manage_options' ) ) {
215	Tracker::set_opt_in( true );
216	}
217
218	$this->after_connect();
219
220	// Add the notice after the method `after_connect`, so an app can redirect without the notice.
221	$this->add_notice( esc_html__( 'Connected successfully.', 'elementor' ) );
222
223	$this->redirect_to_admin_page();
224	}
225
226	/**
227	* @since 2.3.0
228	* @access public
229	*/
230	public function action_disconnect() {
231	if ( $this->is_connected() ) {
232	$this->disconnect();
233	$this->add_notice( esc_html__( 'Disconnected successfully.', 'elementor' ) );
234	}
235
236	$this->redirect_to_admin_page();
237	}
238
239	/**
240	* @since 2.8.0
241	* @access public
242	*/
243	public function action_reconnect() {
244	$this->disconnect();
245
246	$this->action_authorize();
247	}
248
249	/**
250	* @since 2.3.0
251	* @access public
252	*/
253	public function get_admin_url( $action, $params = [] ) {
254	$params = [
255	'app' => $this->get_slug(),
256	'action' => $action,
257	'nonce' => wp_create_nonce( $this->get_slug() . $action ),
258	] + $params;
259
260	$admin_url = Str::encode_idn_url( get_admin_url() );
261	$admin_url .= 'admin.php?page=' . Admin::PAGE_ID;
262
263	return add_query_arg( $params, $admin_url );
264	}
265
266	/**
267	* @since 2.3.0
268	* @access public
269	*/
270	public function is_connected() {
271	return (bool) $this->get( 'access_token' );
272	}
273
274	/**
275	* @since 2.3.0
276	* @access protected
277	*/
278	protected function init() {}
279
280	/**
281	* @since 2.3.0
282	* @access protected
283	*/
284	protected function init_data() {}
285
286	/**
287	* @since 2.3.0
288	* @access protected
289	*/
290	protected function after_connect() {}
291
292	/**
293	* @since 2.3.0
294	* @access public
295	*/
296	public function get( $key, $default = null ) {
297	$this->init_data();
298
299	return isset( $this->data[ $key ] ) ? $this->data[ $key ] : $default;
300	}
301
302	/**
303	* @since 2.3.0
304	* @access protected
305	*/
306	protected function set( $key, $value = null ) {
307	$this->init_data();
308
309	if ( is_array( $key ) ) {
310	$this->data = array_replace_recursive( $this->data, $key );
311	} else {
312	$this->data[ $key ] = $value;
313	}
314
315	$this->update_settings();
316	}
317
318	/**
319	* @since 2.3.0
320	* @access protected
321	*/
322	protected function delete( $key = null ) {
323	$this->init_data();
324
325	if ( $key ) {
326	unset( $this->data[ $key ] );
327	} else {
328	$this->data = [];
329	}
330
331	$this->update_settings();
332	}
333
334	/**
335	* @since 2.3.0
336	* @access protected
337	*/
338	protected function add( $key, $value, $default = '' ) {
339	$new_value = $this->get( $key, $default );
340
341	if ( is_array( $new_value ) ) {
342	$new_value[] = $value;
343	} elseif ( is_string( $new_value ) ) {
344	$new_value .= $value;
345	} elseif ( is_numeric( $new_value ) ) {
346	$new_value += $value;
347	}
348
349	$this->set( $key, $new_value );
350	}
351
352	/**
353	* @since 2.3.0
354	* @access protected
355	*/
356	protected function add_notice( $content, $type = 'success' ) {
357	$this->add( 'notices', compact( 'content', 'type' ), [] );
358	}
359
360	/**
361	* @param $action
362	* @param array $request_body
363	* @param false $as_array
364	*
365	* @return mixed\|\WP_Error
366	*/
367	protected function request( $action, $request_body = [], $as_array = false ) {
368	$request_body = $this->get_connect_info() + $request_body;
369
370	return $this->http_request(
371	'POST',
372	$action,
373	[
374	'timeout' => 25,
375	'body' => $request_body,
376	'headers' => $this->is_connected() ?
377	[ 'X-Elementor-Signature' => $this->generate_signature( $request_body ) ] :
378	[],
379	],
380	[
381	'return_type' => $as_array ? static::HTTP_RETURN_TYPE_ARRAY : static::HTTP_RETURN_TYPE_OBJECT,
382	]
383	);
384	}
385
386	/**
387	* Get Base Connect Info
388	*
389	* Returns an array of connect info.
390	*
391	* @return array
392	*/
393	protected function get_base_connect_info() {
394	return [
395	'app' => $this->get_slug(),
396	'access_token' => $this->get( 'access_token' ),
397	'client_id' => $this->get( 'client_id' ),
398	'local_id' => get_current_user_id(),
399	'site_key' => $this->get_site_key(),
400	'home_url' => trailingslashit( home_url() ),
401	];
402	}
403
404	/**
405	* Get all the connect information
406	*
407	* @return array
408	*/
409	protected function get_connect_info() {
410	$connect_info = $this->get_base_connect_info();
411
412	$additional_info = [];
413
414	/**
415	* Additional connect info.
416	*
417	* Filters the connection information when connecting to Elementor servers.
418	* This hook can be used to add more information or add more data.
419	*
420	* @param array $additional_info Additional connecting information array.
421	* @param Base_App $this The base app instance.
422	*/
423	$additional_info = apply_filters( 'elementor/connect/additional-connect-info', $additional_info, $this );
424
425	return array_merge( $connect_info, $additional_info );
426	}
427
428	/**
429	* @param $endpoint
430	*
431	* @return array
432	*/
433	protected function generate_authentication_headers( $endpoint ) {
434	$connect_info = ( new Collection( $this->get_connect_info() ) )
435	->map_with_keys( function ( $value, $key ) {
436	// For bc `get_connect_info` returns the connect info with underscore,
437	// headers with underscore are not valid, so all the keys with underscore will be replaced to hyphen.
438	return [ str_replace( '_', '-', $key ) => $value ];
439	} )
440	->replace_recursive( [ 'endpoint' => $endpoint ] )
441	->sort_keys();
442
443	return $connect_info
444	->merge( [ 'X-Elementor-Signature' => $this->generate_signature( $connect_info->all() ) ] )
445	->all();
446	}
447
448	/**
449	* Send an http request
450	*
451	* @param $method
452	* @param $endpoint
453	* @param array $args
454	* @param array $options
455	*
456	* @return mixed\|\WP_Error
457	*/
458	protected function http_request( $method, $endpoint, $args = [], $options = [] ) {
459	$options = wp_parse_args( $options, [
460	'return_type' => static::HTTP_RETURN_TYPE_OBJECT,
461	] );
462
463	$args = array_replace_recursive( [
464	'headers' => $this->is_connected() ? $this->generate_authentication_headers( $endpoint ) : [],
465	'method' => $method,
466	'timeout' => 10,
467	], $args );
468
469	$response = $this->http->request_with_fallback(
470	$this->get_generated_urls( $endpoint ),
471	$args
472	);
473
474	if ( is_wp_error( $response ) ) {
475	// PHPCS - the variable $response does not contain a user input value.
476	wp_die( $response, [ 'back_link' => true ] ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
477	}
478
479	$body = wp_remote_retrieve_body( $response );
480	$response_code = (int) wp_remote_retrieve_response_code( $response );
481
482	if ( ! $response_code ) {
483	return new \WP_Error( 500, 'No Response' );
484	}
485
486	// Server sent a success message without content.
487	if ( 'null' === $body ) {
488	$body = true;
489	}
490
491	$body = json_decode( $body, static::HTTP_RETURN_TYPE_ARRAY === $options['return_type'] );
492
493	if ( false === $body ) {
494	return new \WP_Error( 422, 'Wrong Server Response' );
495	}
496
497	if ( 200 !== $response_code ) {
498	// In case $as_array = true.
499	$body = (object) $body;
500
501	$message = isset( $body->message ) ? $body->message : wp_remote_retrieve_response_message( $response );
502	$code = (int) ( isset( $body->code ) ? $body->code : $response_code );
503
504	if ( ! $code ) {
505	$code = $response_code;
506	}
507
508	if ( 401 === $code ) {
509	$this->delete();
510
511	$should_retry = ! in_array( $this->auth_mode, [ 'xhr', 'cli' ], true );
512
513	if ( $should_retry ) {
514	$this->action_authorize();
515	}
516	}
517
518	if ( isset( $options['with_error_data'] ) && true === $options['with_error_data'] ) {
519	return new \WP_Error( $code, $message, $body );
520	}
521
522	return new \WP_Error( $code, $message );
523	}
524
525	return $body;
526	}
527
528	/**
529	* Create a signature for the http request
530	*
531	* @param array $payload
532	*
533	* @return false\|string
534	*/
535	private function generate_signature( $payload = [] ) {
536	return hash_hmac(
537	'sha256',
538	wp_json_encode( $payload, JSON_NUMERIC_CHECK ),
539	$this->get( 'access_token_secret' )
540	);
541	}
542
543	/**
544	* @since 2.3.0
545	* @access protected
546	*/
547	protected function get_api_url() {
548	return static::API_URL . '/' . $this->get_slug();
549	}
550	/**
551	* @since 2.3.0
552	* @access protected
553	*/
554	protected function get_remote_site_url() {
555	return static::SITE_URL . '/' . $this->get_slug();
556	}
557
558	/**
559	* @since 2.3.0
560	* @access protected
561	*/
562	protected function get_remote_authorize_url() {
563	$redirect_uri = $this->get_auth_redirect_uri();
564
565	$allowed_query_params_to_propagate = [
566	'utm_source',
567	'utm_medium',
568	'utm_campaign',
569	'utm_term',
570	'utm_content',
571	'source',
572	'screen_hint',
573	];
574
575	$query_params = ( new Collection( $_GET ) ) // phpcs:ignore
576	->only( $allowed_query_params_to_propagate )
577	->merge( [
578	'action' => 'authorize',
579	'response_type' => 'code',
580	'client_id' => $this->get( 'client_id' ),
581	'auth_secret' => $this->get( 'auth_secret' ),
582	'state' => $this->get( 'state' ),
583	'redirect_uri' => rawurlencode( $redirect_uri ),
584	'may_share_data' => current_user_can( 'manage_options' ) && ! Tracker::is_allow_track(),
585	'reconnect_nonce' => wp_create_nonce( $this->get_slug() . 'reconnect' ),
586	] );
587
588	return add_query_arg( $query_params->all(), $this->get_remote_site_url() );
589	}
590
591	/**
592	* @since 2.3.0
593	* @access protected
594	*/
595	protected function redirect_to_admin_page( $url = '' ) {
596	if ( ! $url ) {
597	$url = Admin::$url;
598	}
599
600	switch ( $this->auth_mode ) {
601	case 'popup':
602	$this->print_popup_close_script( $url );
603	break;
604
605	case 'cli':
606	$this->admin_notice();
607	die;
608
609	default:
610	wp_safe_redirect( $url );
611	die;
612	}
613	}
614
615	/**
616	* @since 2.3.0
617	* @access protected
618	*/
619	protected function set_client_id() {
620	$source = Utils::get_super_global_value( $_REQUEST, 'source' ) ?? ''; //phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Nonce verification is not required here.
621	$response = $this->request(
622	'get_client_id',
623	[
624	'source' => esc_attr( $source ),
625	]
626	);
627
628	if ( is_wp_error( $response ) ) {
629	// PHPCS - the variable $response does not contain a user input value.
630	wp_die( $response, $response->get_error_message() ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
631	}
632
633	$this->set( 'client_id', $response->client_id );
634	$this->set( 'auth_secret', $response->auth_secret );
635	}
636
637	/**
638	* @since 2.3.0
639	* @access protected
640	*/
641	protected function set_request_state() {
642	$this->set( 'state', wp_generate_password( 12, false ) );
643	}
644
645	protected function get_popup_success_event_data() {
646	return [];
647	}
648
649	/**
650	* @since 2.3.0
651	* @access protected
652	*/
653	protected function print_popup_close_script( $url ) {
654	$data = $this->get_popup_success_event_data();
655
656	?>
657	<script>
658	if ( opener && opener !== window ) {
659	opener.jQuery( 'body' ).trigger(
660	'elementor/connect/success/<?php echo esc_attr( Utils::get_super_global_value( $_REQUEST, 'callback_id' ) ); //phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Nonce verification is not required here. ?>',
661	<?php echo wp_json_encode( $data ); ?>
662	);
663
664	window.close();
665	opener.focus();
666	} else {
667	location = '<?php echo esc_url( $url ); ?>';
668	}
669	</script>
670	<?php
671	die;
672	}
673
674	/**
675	* @since 2.3.0
676	* @access protected
677	*/
678	protected function disconnect() {
679	if ( $this->is_connected() ) {
680	// Try update the server, but not needed to handle errors.
681	$this->request( 'disconnect' );
682	}
683
684	$this->delete();
685	}
686
687	/**
688	* @since 2.3.0
689	* @access protected
690	*/
691	public function get_site_key() {
692	$site_key = get_option( static::OPTION_CONNECT_SITE_KEY );
693
694	if ( ! $site_key ) {
695	$site_key = md5( uniqid( wp_generate_password() ) );
696	update_option( static::OPTION_CONNECT_SITE_KEY, $site_key );
697	}
698
699	return $site_key;
700	}
701
702	protected function redirect_to_remote_authorize_url() {
703	switch ( $this->auth_mode ) {
704	case 'cli':
705	$this->get_app_token_from_cli_token( Utils::get_super_global_value( $_REQUEST, 'token' ) ); //phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Nonce verification is not required here.
706	return;
707	default:
708	wp_redirect( $this->get_remote_authorize_url() ); //phpcs:ignore WordPress.Security.SafeRedirect.wp_redirect_wp_redirect -- Safe redirect is used here.
709	die;
710	}
711	}
712
713	protected function get_auth_redirect_uri() {
714	$redirect_uri = $this->get_admin_url( 'get_token' );
715
716	switch ( $this->auth_mode ) {
717	case 'popup':
718	$redirect_uri = add_query_arg( [
719	'mode' => 'popup',
720	'callback_id' => esc_attr( Utils::get_super_global_value( $_REQUEST, 'callback_id' ) ), //phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Nonce verification is not required here.
721	], $redirect_uri );
722	break;
723	}
724
725	return $redirect_uri;
726	}
727
728
729	protected function print_notices( $notices ) {
730	switch ( $this->auth_mode ) {
731	case 'cli':
732	foreach ( $notices as $notice ) {
733	printf( '[%s] %s', wp_kses_post( $notice['type'] ), wp_kses_post( $notice['content'] ) );
734	}
735	break;
736	default:
737	/**
738	* @var Admin_Notices $admin_notices
739	*/
740	$admin_notices = Plugin::$instance->admin->get_component( 'admin-notices' );
741
742	foreach ( $notices as $notice ) {
743	$options = [
744	'description' => wp_kses_post( wpautop( $notice['content'] ) ),
745	'type' => $notice['type'],
746	'icon' => false,
747	];
748
749	$admin_notices->print_admin_notice( $options );
750	}
751	}
752	}
753
754	protected function get_app_info() {
755	return [];
756	}
757
758	protected function print_app_info() {
759	$app_info = $this->get_app_info();
760
761	foreach ( $app_info as $key => $item ) {
762	if ( $item['value'] ) {
763	$status = 'Exist';
764	$color = 'green';
765	} else {
766	$status = 'Empty';
767	$color = 'red';
768	}
769
770	// PHPCS - the values of $item['label'], $color, $status are plain strings.
771	printf( '%s: <strong style="color:%s">%s</strong><br>', $item['label'], $color, $status ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
772	}
773
774	}
775
776	private function get_generated_urls( $endpoint ) {
777	$base_urls = $this->get_api_url();
778
779	if ( ! is_array( $base_urls ) ) {
780	$base_urls = [ $base_urls ];
781	}
782
783	return array_map( function ( $base_url ) use ( $endpoint ) {
784	return trailingslashit( $base_url ) . $endpoint;
785	}, $base_urls );
786	}
787
788	private function init_auth_mode() {
789	$is_rest = defined( 'REST_REQUEST' ) && REST_REQUEST;
790	$is_ajax = wp_doing_ajax();
791
792	if ( $is_rest \|\| $is_ajax ) {
793	// Set default to 'xhr' if rest or ajax request.
794	$this->set_auth_mode( 'xhr' );
795	}
796
797	$mode = Utils::get_super_global_value( $_REQUEST, 'mode' ); //phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Nonce verification is not required here.
798
799	if ( $mode ) {
800	$allowed_auth_modes = [
801	'popup',
802	];
803
804	if ( defined( 'WP_CLI' ) && WP_CLI ) {
805	$allowed_auth_modes[] = 'cli';
806	}
807
808	if ( in_array( $mode, $allowed_auth_modes, true ) ) {
809	$this->set_auth_mode( $mode );
810	}
811	}
812	}
813
814	public function set_auth_mode( $mode ) {
815	$this->auth_mode = $mode;
816	}
817
818	/**
819	* @since 2.3.0
820	* @access public
821	*/
822	public function __construct() {
823	add_action( 'admin_notices', [ $this, 'admin_notice' ] );
824
825	$this->init_auth_mode();
826
827	$this->http = new Http();
828
829	/**
830	* Allow extended apps to customize the __construct without call parent::__construct.
831	*/
832	$this->init();
833	}
834	}
835