elementor / core / common / modules / connect / apps / base-app.php

base-app.php in Elementor Website Builder – more than just a page builder 3.4.0, at core/common/modules/connect/apps/base-app.php

779 lines 17.6 KB

Raw Download Zip

1	<?php
2	namespace Elementor\Core\Common\Modules\Connect\Apps;
3
4	use Elementor\Core\Utils\Http;
5	use Elementor\Core\Utils\Collection;
6	use Elementor\Core\Admin\Admin_Notices;
7	use Elementor\Core\Common\Modules\Connect\Admin;
8	use Elementor\Plugin;
9	use Elementor\Tracker;
10
11	if ( ! defined( 'ABSPATH' ) ) {
12	exit; // Exit if accessed directly
13	}
14
15	abstract class Base_App {
16
17	const OPTION_NAME_PREFIX = 'elementor_connect_';
18
19	const SITE_URL = 'https://my.elementor.com/connect/v1';
20
21	const API_URL = 'https://my.elementor.com/api/connect/v1';
22
23	const HTTP_RETURN_TYPE_OBJECT = 'object';
24	const HTTP_RETURN_TYPE_ARRAY = 'array';
25
26	protected $data = [];
27
28	protected $auth_mode = '';
29
30	/**
31	* @var Http
32	*/
33	protected $http;
34
35	/**
36	* @since 2.3.0
37	* @access protected
38	* @abstract
39	* TODO: make it public.
40	*/
41	abstract protected function get_slug();
42
43	/**
44	* @since 2.8.0
45	* @access public
46	* TODO: make it abstract.
47	*/
48	public function get_title() {
49	return $this->get_slug();
50	}
51
52	/**
53	* @since 2.3.0
54	* @access protected
55	* @abstract
56	*/
57	abstract protected function update_settings();
58
59	/**
60	* @since 2.3.0
61	* @access public
62	* @static
63	*/
64	public static function get_class_name() {
65	return get_called_class();
66	}
67
68	/**
69	* @access public
70	* @abstract
71	*/
72	public function render_admin_widget() {
73	// PHPCS - the method get_title return a plain string.
74	echo '<h2>' . $this->get_title() . '</h2>'; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
75
76	if ( $this->is_connected() ) {
77	$remote_user = $this->get( 'user' );
78	$title = sprintf( esc_html__( 'Connected as %s', 'elementor' ), '<strong>' . esc_html( $remote_user->email ) . '</strong>' );
79	$label = esc_html__( 'Disconnect', 'elementor' );
80	$url = $this->get_admin_url( 'disconnect' );
81	$attr = '';
82
83	echo sprintf(
84	'%s <a %s href="%s">%s</a>',
85	// PHPCS - the variable $title is already escaped above.
86	$title, // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
87	// PHPCS - the variable $attr is a plain string.
88	$attr, // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
89	esc_attr( $url ),
90	esc_html( $label )
91	);
92	} else {
93	echo 'Not Connected';
94	}
95
96	echo '<hr>';
97
98	$this->print_app_info();
99
100	if ( current_user_can( 'manage_options' ) ) {
101	printf( '<div><a href="%s">%s</a></div>', esc_url( $this->get_admin_url( 'reset' ) ), esc_html__( 'Reset Data', 'elementor' ) );
102	}
103
104	echo '<hr>';
105	}
106
107
108	/**
109	* @since 2.3.0
110	* @access protected
111	*/
112	protected function get_option_name() {
113	return static::OPTION_NAME_PREFIX . $this->get_slug();
114	}
115
116	/**
117	* @since 2.3.0
118	* @access public
119	*/
120	public function admin_notice() {
121	$notices = $this->get( 'notices' );
122
123	if ( ! $notices ) {
124	return;
125	}
126
127	$this->print_notices( $notices );
128
129	$this->delete( 'notices' );
130	}
131
132
133	public function get_app_token_from_cli_token( $cli_token ) {
134	$response = $this->request( 'get_app_token_from_cli_token', [
135	'cli_token' => $cli_token,
136	] );
137
138	if ( is_wp_error( $response ) ) {
139	// PHPCS - the variable $response does not contain a user input value.
140	wp_die( $response, $response->get_error_message() ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
141	}
142
143	// Use state as usual.
144	$_REQUEST['state'] = $this->get( 'state' );
145	$_REQUEST['code'] = $response->code;
146	}
147	/**
148	* @since 2.3.0
149	* @access public
150	*/
151	public function action_authorize() {
152	if ( $this->is_connected() ) {
153	$this->add_notice( esc_html__( 'Already connected.', 'elementor' ), 'info' );
154	$this->redirect_to_admin_page();
155	return;
156	}
157
158	$this->set_client_id();
159	$this->set_request_state();
160
161	$this->redirect_to_remote_authorize_url();
162	}
163
164	public function action_reset() {
165	delete_user_option( get_current_user_id(), 'elementor_connect_common_data' );
166
167	if ( current_user_can( 'manage_options' ) ) {
168	delete_option( 'elementor_connect_site_key' );
169	delete_option( 'elementor_remote_info_library' );
170	}
171
172	$this->redirect_to_admin_page();
173	}
174
175	/**
176	* @since 2.3.0
177	* @access public
178	*/
179	public function action_get_token() {
180	if ( $this->is_connected() ) {
181	$this->redirect_to_admin_page();
182	}
183
184	if ( empty( $_REQUEST['state'] ) \|\| $_REQUEST['state'] !== $this->get( 'state' ) ) {
185	$this->add_notice( 'Get Token: Invalid Request.', 'error' );
186	$this->redirect_to_admin_page();
187	}
188
189	$response = $this->request( 'get_token', [
190	'grant_type' => 'authorization_code',
191	'code' => $_REQUEST['code'],
192	'redirect_uri' => rawurlencode( $this->get_admin_url( 'get_token' ) ),
193	'client_id' => $this->get( 'client_id' ),
194	] );
195
196	if ( is_wp_error( $response ) ) {
197	$notice = 'Cannot Get Token:' . $response->get_error_message();
198	$this->add_notice( $notice, 'error' );
199	$this->redirect_to_admin_page();
200	}
201
202	if ( ! empty( $response->data_share_opted_in ) && current_user_can( 'manage_options' ) ) {
203	Tracker::set_opt_in( true );
204	}
205
206	$this->delete( 'state' );
207	$this->set( (array) $response );
208
209	$this->after_connect();
210
211	// Add the notice after the method `after_connect`, so an app can redirect without the notice.
212	$this->add_notice( esc_html__( 'Connected Successfully.', 'elementor' ) );
213
214	$this->redirect_to_admin_page();
215	}
216
217	/**
218	* @since 2.3.0
219	* @access public
220	*/
221	public function action_disconnect() {
222	if ( $this->is_connected() ) {
223	$this->disconnect();
224	$this->add_notice( esc_html__( 'Disconnected Successfully.', 'elementor' ) );
225	}
226
227	$this->redirect_to_admin_page();
228	}
229
230	/**
231	* @since 2.8.0
232	* @access public
233	*/
234	public function action_reconnect() {
235	$this->disconnect();
236
237	$this->action_authorize();
238	}
239
240	/**
241	* @since 2.3.0
242	* @access public
243	*/
244	public function get_admin_url( $action, $params = [] ) {
245	$params = [
246	'app' => $this->get_slug(),
247	'action' => $action,
248	'nonce' => wp_create_nonce( $this->get_slug() . $action ),
249	] + $params;
250
251	// Encode base url, the encode is limited to 64 chars.
252	$admin_url = \Requests_IDNAEncoder::encode( get_admin_url() );
253
254	$admin_url .= 'admin.php?page=' . Admin::PAGE_ID;
255
256	return add_query_arg( $params, $admin_url );
257	}
258
259	/**
260	* @since 2.3.0
261	* @access public
262	*/
263	public function is_connected() {
264	return (bool) $this->get( 'access_token' );
265	}
266
267	/**
268	* @since 2.3.0
269	* @access protected
270	*/
271	protected function init() {}
272
273	/**
274	* @since 2.3.0
275	* @access protected
276	*/
277	protected function init_data() {}
278
279	/**
280	* @since 2.3.0
281	* @access protected
282	*/
283	protected function after_connect() {}
284
285	/**
286	* @since 2.3.0
287	* @access public
288	*/
289	public function get( $key, $default = null ) {
290	$this->init_data();
291
292	return isset( $this->data[ $key ] ) ? $this->data[ $key ] : $default;
293	}
294
295	/**
296	* @since 2.3.0
297	* @access protected
298	*/
299	protected function set( $key, $value = null ) {
300	$this->init_data();
301
302	if ( is_array( $key ) ) {
303	$this->data = array_replace_recursive( $this->data, $key );
304	} else {
305	$this->data[ $key ] = $value;
306	}
307
308	$this->update_settings();
309	}
310
311	/**
312	* @since 2.3.0
313	* @access protected
314	*/
315	protected function delete( $key = null ) {
316	$this->init_data();
317
318	if ( $key ) {
319	unset( $this->data[ $key ] );
320	} else {
321	$this->data = [];
322	}
323
324	$this->update_settings();
325	}
326
327	/**
328	* @since 2.3.0
329	* @access protected
330	*/
331	protected function add( $key, $value, $default = '' ) {
332	$new_value = $this->get( $key, $default );
333
334	if ( is_array( $new_value ) ) {
335	$new_value[] = $value;
336	} elseif ( is_string( $new_value ) ) {
337	$new_value .= $value;
338	} elseif ( is_numeric( $new_value ) ) {
339	$new_value += $value;
340	}
341
342	$this->set( $key, $new_value );
343	}
344
345	/**
346	* @since 2.3.0
347	* @access protected
348	*/
349	protected function add_notice( $content, $type = 'success' ) {
350	$this->add( 'notices', compact( 'content', 'type' ), [] );
351	}
352
353	/**
354	* @param $action
355	* @param array $request_body
356	* @param false $as_array
357	*
358	* @return mixed\|\WP_Error
359	*/
360	protected function request( $action, $request_body = [], $as_array = false ) {
361	$request_body = $this->get_connect_info() + $request_body;
362
363	return $this->http_request(
364	'POST',
365	$action,
366	[
367	'timeout' => 25,
368	'body' => $request_body,
369	'headers' => $this->is_connected() ?
370	[ 'X-Elementor-Signature' => $this->generate_signature( $request_body ) ] :
371	[],
372	],
373	[
374	'return_type' => $as_array ? static::HTTP_RETURN_TYPE_ARRAY : static::HTTP_RETURN_TYPE_OBJECT,
375	]
376	);
377	}
378
379	/**
380	* Get all the connect info
381	*
382	* @return array
383	*/
384	protected function get_connect_info() {
385	$additional_info = apply_filters( 'elementor/connect/additional-connect-info', [], $this );
386
387	return array_merge(
388	[
389	'app' => $this->get_slug(),
390	'access_token' => $this->get( 'access_token' ),
391	'client_id' => $this->get( 'client_id' ),
392	'local_id' => get_current_user_id(),
393	'site_key' => $this->get_site_key(),
394	'home_url' => trailingslashit( home_url() ),
395	],
396	$additional_info
397	);
398	}
399
400	/**
401	* @param $endpoint
402	*
403	* @return array
404	*/
405	protected function generate_authentication_headers( $endpoint ) {
406	$connect_info = ( new Collection( $this->get_connect_info() ) )
407	->map_with_keys( function ( $value, $key ) {
408	// For bc `get_connect_info` returns the connect info with underscore,
409	// headers with underscore are not valid, so all the keys with underscore will be replaced to hyphen.
410	return [ str_replace( '_', '-', $key ) => $value ];
411	} )
412	->replace_recursive( [ 'endpoint' => $endpoint ] )
413	->sort_keys();
414
415	return $connect_info
416	->merge( [ 'X-Elementor-Signature' => $this->generate_signature( $connect_info->all() ) ] )
417	->all();
418	}
419
420	/**
421	* Send an http request
422	*
423	* @param $method
424	* @param $endpoint
425	* @param array $args
426	* @param array $options
427	*
428	* @return mixed\|\WP_Error
429	*/
430	protected function http_request( $method, $endpoint, $args = [], $options = [] ) {
431	$options = wp_parse_args( $options, [
432	'return_type' => static::HTTP_RETURN_TYPE_OBJECT,
433	] );
434
435	$args = array_replace_recursive( [
436	'headers' => $this->is_connected() ? $this->generate_authentication_headers( $endpoint ) : [],
437	'method' => $method,
438	'timeout' => 10,
439	], $args );
440
441	$response = $this->http->request_with_fallback(
442	$this->get_generated_urls( $endpoint ),
443	$args
444	);
445
446	if ( is_wp_error( $response ) ) {
447	// PHPCS - the variable $response does not contain a user input value.
448	wp_die( $response, [ 'back_link' => true ] ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
449	}
450
451	$body = wp_remote_retrieve_body( $response );
452	$response_code = (int) wp_remote_retrieve_response_code( $response );
453
454	if ( ! $response_code ) {
455	return new \WP_Error( 500, 'No Response' );
456	}
457
458	// Server sent a success message without content.
459	if ( 'null' === $body ) {
460	$body = true;
461	}
462
463	$body = json_decode( $body, static::HTTP_RETURN_TYPE_ARRAY === $options['return_type'] );
464
465	if ( false === $body ) {
466	return new \WP_Error( 422, 'Wrong Server Response' );
467	}
468
469	if ( 200 !== $response_code ) {
470	// In case $as_array = true.
471	$body = (object) $body;
472
473	$message = isset( $body->message ) ? $body->message : wp_remote_retrieve_response_message( $response );
474	$code = (int) ( isset( $body->code ) ? $body->code : $response_code );
475
476	if ( 401 === $code ) {
477	$this->delete();
478
479	if ( 'xhr' !== $this->auth_mode ) {
480	$this->action_authorize();
481	}
482	}
483
484	return new \WP_Error( $code, $message );
485	}
486
487	return $body;
488	}
489
490	/**
491	* Create a signature for the http request
492	*
493	* @param array $payload
494	*
495	* @return false\|string
496	*/
497	private function generate_signature( $payload = [] ) {
498	return hash_hmac(
499	'sha256',
500	wp_json_encode( $payload, JSON_NUMERIC_CHECK ),
501	$this->get( 'access_token_secret' )
502	);
503	}
504
505	/**
506	* @since 2.3.0
507	* @access protected
508	*/
509	protected function get_api_url() {
510	return static::API_URL . '/' . $this->get_slug();
511	}
512	/**
513	* @since 2.3.0
514	* @access protected
515	*/
516	protected function get_remote_site_url() {
517	return static::SITE_URL . '/' . $this->get_slug();
518	}
519
520	/**
521	* @since 2.3.0
522	* @access protected
523	*/
524	protected function get_remote_authorize_url() {
525	$redirect_uri = $this->get_auth_redirect_uri();
526
527	$url = add_query_arg( [
528	'action' => 'authorize',
529	'response_type' => 'code',
530	'client_id' => $this->get( 'client_id' ),
531	'auth_secret' => $this->get( 'auth_secret' ),
532	'state' => $this->get( 'state' ),
533	'redirect_uri' => rawurlencode( $redirect_uri ),
534	'may_share_data' => current_user_can( 'manage_options' ) && ! Tracker::is_allow_track(),
535	'reconnect_nonce' => wp_create_nonce( $this->get_slug() . 'reconnect' ),
536	], $this->get_remote_site_url() );
537
538	return $url;
539	}
540
541	/**
542	* @since 2.3.0
543	* @access protected
544	*/
545	protected function redirect_to_admin_page( $url = '' ) {
546	if ( ! $url ) {
547	$url = Admin::$url;
548	}
549
550	switch ( $this->auth_mode ) {
551	case 'popup':
552	$this->print_popup_close_script( $url );
553	break;
554
555	case 'cli':
556	$this->admin_notice();
557	die;
558
559	default:
560	wp_safe_redirect( $url );
561	die;
562	}
563	}
564
565	/**
566	* @since 2.3.0
567	* @access protected
568	*/
569	protected function set_client_id() {
570	if ( $this->get( 'client_id' ) ) {
571	return;
572	}
573
574	$response = $this->request( 'get_client_id' );
575
576	if ( is_wp_error( $response ) ) {
577	// PHPCS - the variable $response does not contain a user input value.
578	wp_die( $response, $response->get_error_message() ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
579	}
580
581	$this->set( 'client_id', $response->client_id );
582	$this->set( 'auth_secret', $response->auth_secret );
583	}
584
585	/**
586	* @since 2.3.0
587	* @access protected
588	*/
589	protected function set_request_state() {
590	$this->set( 'state', wp_generate_password( 12, false ) );
591	}
592
593	protected function get_popup_success_event_data() {
594	return [];
595	}
596
597	/**
598	* @since 2.3.0
599	* @access protected
600	*/
601	protected function print_popup_close_script( $url ) {
602	$data = $this->get_popup_success_event_data();
603
604	?>
605	<script>
606	if ( opener && opener !== window ) {
607	opener.jQuery( 'body' ).trigger(
608	'elementor/connect/success/<?php echo esc_attr( $_REQUEST['callback_id'] ); ?>',
609	<?php echo wp_json_encode( $data ); ?>
610	);
611
612	window.close();
613	opener.focus();
614	} else {
615	location = '<?php echo esc_url( $url ); ?>';
616	}
617	</script>
618	<?php
619	die;
620	}
621
622	/**
623	* @since 2.3.0
624	* @access protected
625	*/
626	protected function disconnect() {
627	if ( $this->is_connected() ) {
628	// Try update the server, but not needed to handle errors.
629	$this->request( 'disconnect' );
630	}
631
632	$this->delete();
633	}
634
635	/**
636	* @since 2.3.0
637	* @access protected
638	*/
639	public function get_site_key() {
640	$site_key = get_option( 'elementor_connect_site_key' );
641
642	if ( ! $site_key ) {
643	$site_key = md5( uniqid( wp_generate_password() ) );
644	update_option( 'elementor_connect_site_key', $site_key );
645	}
646
647	return $site_key;
648	}
649
650	protected function redirect_to_remote_authorize_url() {
651	switch ( $this->auth_mode ) {
652	case 'cli':
653	$this->get_app_token_from_cli_token( $_REQUEST['token'] );
654	return;
655	default:
656	wp_redirect( $this->get_remote_authorize_url() );
657	die;
658	}
659	}
660
661	protected function get_auth_redirect_uri() {
662	$redirect_uri = $this->get_admin_url( 'get_token' );
663
664	switch ( $this->auth_mode ) {
665	case 'popup':
666	$redirect_uri = add_query_arg( [
667	'mode' => 'popup',
668	'callback_id' => esc_attr( $_REQUEST['callback_id'] ),
669	], $redirect_uri );
670	break;
671	}
672
673	return $redirect_uri;
674	}
675
676
677	protected function print_notices( $notices ) {
678	switch ( $this->auth_mode ) {
679	case 'cli':
680	foreach ( $notices as $notice ) {
681	printf( '[%s] %s', wp_kses_post( $notice['type'] ), wp_kses_post( $notice['content'] ) );
682	}
683	break;
684	default:
685	/**
686	* @var Admin_Notices $admin_notices
687	*/
688	$admin_notices = Plugin::$instance->admin->get_component( 'admin-notices' );
689
690	foreach ( $notices as $notice ) {
691	$options = [
692	'description' => wp_kses_post( wpautop( $notice['content'] ) ),
693	'type' => $notice['type'],
694	'icon' => false,
695	];
696
697	$admin_notices->print_admin_notice( $options );
698	}
699	}
700	}
701
702	protected function get_app_info() {
703	return [];
704	}
705
706	protected function print_app_info() {
707	$app_info = $this->get_app_info();
708
709	foreach ( $app_info as $key => $item ) {
710	if ( $item['value'] ) {
711	$status = 'Exist';
712	$color = 'green';
713	} else {
714	$status = 'Empty';
715	$color = 'red';
716	}
717
718	// PHPCS - the values of $item['label'], $color, $status are plain strings.
719	printf( '%s: <strong style="color:%s">%s</strong><br>', $item['label'], $color, $status ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
720	}
721
722	}
723
724	private function get_generated_urls( $endpoint ) {
725	$base_urls = $this->get_api_url();
726
727	if ( ! is_array( $base_urls ) ) {
728	$base_urls = [ $base_urls ];
729	}
730
731	return array_map( function ( $base_url ) use ( $endpoint ) {
732	return trailingslashit( $base_url ) . $endpoint;
733	}, $base_urls );
734	}
735
736	private function init_auth_mode() {
737	$is_rest = defined( 'REST_REQUEST' ) && REST_REQUEST;
738	$is_ajax = wp_doing_ajax();
739
740	if ( $is_rest \|\| $is_ajax ) {
741	// Set default to 'xhr' if rest or ajax request.
742	$this->auth_mode = 'xhr';
743	}
744
745	if ( isset( $_REQUEST['mode'] ) ) { // phpcs:ignore -- nonce validation is not require here.
746	$allowed_auth_modes = [
747	'popup',
748	];
749
750	if ( defined( 'WP_CLI' ) && WP_CLI ) {
751	$allowed_auth_modes[] = 'cli';
752	}
753
754	$mode = $_REQUEST['mode']; // phpcs:ignore -- nonce validation is not require here.
755
756	if ( in_array( $mode, $allowed_auth_modes, true ) ) {
757	$this->auth_mode = $mode;
758	}
759	}
760	}
761
762	/**
763	* @since 2.3.0
764	* @access public
765	*/
766	public function __construct() {
767	add_action( 'admin_notices', [ $this, 'admin_notice' ] );
768
769	$this->init_auth_mode();
770
771	$this->http = new Http();
772
773	/**
774	* Allow extended apps to customize the __construct without call parent::__construct.
775	*/
776	$this->init();
777	}
778	}
779