| 1 |
<?php |
| 2 |
/** |
| 3 |
* Redirect related callbacks. |
| 4 |
* |
| 5 |
* @package FaustWP |
| 6 |
*/ |
| 7 |
|
| 8 |
namespace WPE\FaustWP\Auth; |
| 9 |
|
| 10 |
use function WPE\FaustWP\Settings\faustwp_get_setting; |
| 11 |
|
| 12 |
if ( ! defined( 'ABSPATH' ) ) { |
| 13 |
exit; |
| 14 |
} |
| 15 |
|
| 16 |
add_action( 'parse_request', __NAMESPACE__ . '\\handle_generate_endpoint' ); |
| 17 |
/** |
| 18 |
* Callback for WordPress 'parse_request' action. |
| 19 |
* |
| 20 |
* Generate an authorization code and redirect to the requested url. |
| 21 |
* |
| 22 |
* Note: matches REQUEST_URI against the filtered output of home_url(). Plugins |
| 23 |
* that filter home_url() to prepend locale paths (WPML, Polylang, TranslatePress) |
| 24 |
* may cause this match to fail when the frontend calls '/generate' directly |
| 25 |
* without a locale prefix. If that combination surfaces in support, the |
| 26 |
* follow-up will likely migrate '/generate' to a proper REST route so locale |
| 27 |
* filters cannot affect the match. |
| 28 |
* |
| 29 |
* @return void |
| 30 |
*/ |
| 31 |
function handle_generate_endpoint() { |
| 32 |
$search_pattern = ':^' . home_url( '/generate', 'relative' ) . ':'; |
| 33 |
|
| 34 |
if ( ! preg_match( $search_pattern, $_SERVER['REQUEST_URI'] ) ) { // phpcs:ignore WordPress.Security |
| 35 |
return; |
| 36 |
} |
| 37 |
|
| 38 |
if ( empty( $_GET['redirect_uri'] ) ) { // phpcs:ignore WordPress.Security |
| 39 |
return; |
| 40 |
} |
| 41 |
|
| 42 |
$redirect_uri = wp_unslash( $_GET['redirect_uri'] ); // phpcs:ignore WordPress.Security |
| 43 |
|
| 44 |
if ( ! is_user_logged_in() ) { |
| 45 |
wp_safe_redirect( |
| 46 |
wp_login_url( '/generate/?redirect_uri=' . rawurlencode( $redirect_uri ) ) |
| 47 |
); |
| 48 |
|
| 49 |
exit; |
| 50 |
} |
| 51 |
|
| 52 |
$auth_code = generate_authorization_code( |
| 53 |
wp_get_current_user(), |
| 54 |
MINUTE_IN_SECONDS * 1 |
| 55 |
); |
| 56 |
|
| 57 |
$redirect_uri = add_query_arg( 'code', rawurlencode( $auth_code ), $redirect_uri ); |
| 58 |
|
| 59 |
wp_safe_redirect( $redirect_uri ); |
| 60 |
|
| 61 |
exit; |
| 62 |
} |
| 63 |
|
| 64 |
add_filter( 'allowed_redirect_hosts', __NAMESPACE__ . '\\allowed_redirect_hosts', 10, 2 ); |
| 65 |
/** |
| 66 |
* Callback for WordPress 'allowed_redirect_hosts' filter. |
| 67 |
* |
| 68 |
* Add frontend_uri host and development domains to allowed redirects. |
| 69 |
* |
| 70 |
* @link https://developer.wordpress.org/reference/hooks/allowed_redirect_hosts/ |
| 71 |
* |
| 72 |
* @param string[] $hosts An array of allowed host names. |
| 73 |
* @param string $host The host name of the redirect destination; empty string if not set. |
| 74 |
* |
| 75 |
* @return string[] An array of allowed host names. |
| 76 |
*/ |
| 77 |
function allowed_redirect_hosts( $hosts, $host ) { |
| 78 |
$hosts = wp_parse_args( $hosts, array( 'localhost', '0.0.0.0' ) ); |
| 79 |
$frontend_host = wp_parse_url( faustwp_get_setting( 'frontend_uri' ), PHP_URL_HOST ); |
| 80 |
|
| 81 |
if ( $frontend_host ) { |
| 82 |
$hosts[] = $frontend_host; |
| 83 |
} |
| 84 |
|
| 85 |
return $hosts; |
| 86 |
} |
| 87 |
|
