| 1 |
<?php |
| 2 |
|
| 3 |
namespace FluentMail\App\Http\Controllers; |
| 4 |
|
| 5 |
use FluentMail\App\App; |
| 6 |
|
| 7 |
abstract class Controller |
| 8 |
{ |
| 9 |
/** |
| 10 |
* @var \FluentMail\App\Plugin |
| 11 |
*/ |
| 12 |
protected $app = null; |
| 13 |
|
| 14 |
/** |
| 15 |
* @var \FluentMail\Includes\Request\Request |
| 16 |
*/ |
| 17 |
protected $request = null; |
| 18 |
|
| 19 |
/** |
| 20 |
* @var \FluentMail\Includes\Response\Response |
| 21 |
*/ |
| 22 |
protected $response = null; |
| 23 |
|
| 24 |
public function __construct() |
| 25 |
{ |
| 26 |
$this->app = App::getInstance(); |
| 27 |
$this->request = $this->app['request']; |
| 28 |
$this->response = $this->app['response']; |
| 29 |
} |
| 30 |
|
| 31 |
public function send($data = null, $code = 200) |
| 32 |
{ |
| 33 |
return $this->response->send($data, $code); |
| 34 |
} |
| 35 |
|
| 36 |
public function sendSuccess($data = null, $code = 200) |
| 37 |
{ |
| 38 |
return $this->response->sendSuccess($data, $code); |
| 39 |
} |
| 40 |
|
| 41 |
public function sendError($data = null, $code = 422) |
| 42 |
{ |
| 43 |
return $this->response->sendError($data, $code); |
| 44 |
} |
| 45 |
|
| 46 |
/* |
| 47 |
* Both failures carry 403. |
| 48 |
* |
| 49 |
* wp_send_json_error() defaults to HTTP 200, so a rejected request used to arrive |
| 50 |
* looking exactly like a successful one: jQuery resolved it, the frontend read the |
| 51 |
* error object as data, and an expired nonce was reported to the user as a green |
| 52 |
* success reading "Security check failed". Every other error path in the plugin already |
| 53 |
* carries a status - sendError() defaults to 422 and the exception handler sends |
| 54 |
* 403/422 - and the frontend is written against that, with two dozen handlers |
| 55 |
* reading responseJSON.data.message on failure. These two were the exception. |
| 56 |
* |
| 57 |
* The status is the only thing that changes: wp_send_json_error() builds the same |
| 58 |
* {success: false, data: {...}} body either way, so nothing reading the response |
| 59 |
* has to change with it. |
| 60 |
*/ |
| 61 |
public function verify() |
| 62 |
{ |
| 63 |
$permission = fluentMailManageCapability(); |
| 64 |
if(!current_user_can($permission)) { |
| 65 |
wp_send_json_error([ |
| 66 |
'message' => __('You do not have permission to do this.', 'fluent-smtp') |
| 67 |
], 403); |
| 68 |
die(); |
| 69 |
} |
| 70 |
|
| 71 |
$nonce = $this->request->get('nonce'); |
| 72 |
if(!wp_verify_nonce($nonce, FLUENTMAIL)) { |
| 73 |
wp_send_json_error([ |
| 74 |
'message' => __('Security check failed. Please reload the page.', 'fluent-smtp') |
| 75 |
], 403); |
| 76 |
die(); |
| 77 |
} |
| 78 |
|
| 79 |
return true; |
| 80 |
} |
| 81 |
} |
| 82 |
|
