| 1 |
<?php |
| 2 |
|
| 3 |
namespace FluentSupport\App\Hooks\Handlers; |
| 4 |
|
| 5 |
|
| 6 |
use FluentSupport\App\Models\Attachment; |
| 7 |
use FluentSupport\App\Models\Ticket; |
| 8 |
use FluentSupport\App\Services\Helper; |
| 9 |
use FluentSupport\Framework\Support\Arr; |
| 10 |
|
| 11 |
class ExternalPages |
| 12 |
{ |
| 13 |
|
| 14 |
public function route() |
| 15 |
{ |
| 16 |
$route = sanitize_text_field($_REQUEST['fs_view']); |
| 17 |
|
| 18 |
$methodMaps = [ |
| 19 |
'ticket' => 'handleTicketView' |
| 20 |
]; |
| 21 |
|
| 22 |
if(isset($methodMaps[$route])) { |
| 23 |
$this->{$methodMaps[$route]}(); |
| 24 |
} |
| 25 |
|
| 26 |
} |
| 27 |
|
| 28 |
public function handleTicketView() |
| 29 |
{ |
| 30 |
|
| 31 |
|
| 32 |
if(!Helper::isPublicSignedTicketEnabled()) { |
| 33 |
$ticketId = absint(Arr::get($_REQUEST, 'ticket_id')); |
| 34 |
$ticket = Ticket::where('id', $ticketId)->first(); |
| 35 |
|
| 36 |
if(!$ticket) { |
| 37 |
// Sorry no ticket found; |
| 38 |
echo '<h3 style="text-align: center; margin: 50px 0;">'.__('Invalid Support Portal URL', 'fluent-support').'</h3>'; |
| 39 |
die(); |
| 40 |
} |
| 41 |
|
| 42 |
$redirectUrl = Helper::getTicketViewUrl($ticket); |
| 43 |
wp_redirect($redirectUrl, 307); |
| 44 |
exit(); |
| 45 |
} |
| 46 |
|
| 47 |
$ticketHash = sanitize_text_field(Arr::get($_REQUEST, 'support_hash')); |
| 48 |
$ticketId = absint(Arr::get($_REQUEST, 'ticket_id')); |
| 49 |
$ticket = Ticket::where('hash', $ticketHash)->where('id', $ticketId)->first(); |
| 50 |
|
| 51 |
if(!$ticket) { |
| 52 |
// Sorry no ticket found; |
| 53 |
echo '<h3 style="text-align: center; margin: 50px 0;">'.__('Invalid Support Portal URL', 'fluent-support').'</h3>'; |
| 54 |
die(); |
| 55 |
} |
| 56 |
|
| 57 |
if(get_current_user_id()) { |
| 58 |
// We have to re-route the URL |
| 59 |
$redirectUrl = Helper::getTicketViewUrl($ticket); |
| 60 |
wp_redirect($redirectUrl, 307); |
| 61 |
exit(); |
| 62 |
} |
| 63 |
|
| 64 |
} |
| 65 |
|
| 66 |
/** |
| 67 |
* Display the attachment. |
| 68 |
* |
| 69 |
* Uses the new rewrite endpoint to get an attachment ID |
| 70 |
* and display the attachment if the currently logged in user |
| 71 |
* has the authorization to. |
| 72 |
* |
| 73 |
* @return void |
| 74 |
* @since 3.2.0 |
| 75 |
*/ |
| 76 |
public function view_attachment() |
| 77 |
{ |
| 78 |
|
| 79 |
$attachmentHash = sanitize_text_field($_REQUEST['fst_file']); |
| 80 |
|
| 81 |
|
| 82 |
if (!empty($attachmentHash)) { |
| 83 |
|
| 84 |
$attachment = Attachment::where('file_hash', $attachmentHash)->first(); |
| 85 |
|
| 86 |
/** |
| 87 |
* Return a 404 page if the attachment ID |
| 88 |
* does not match any attachment in the database. |
| 89 |
*/ |
| 90 |
if (empty($attachment)) { |
| 91 |
|
| 92 |
/** |
| 93 |
* @var WP_Query $wp_query WordPress main query |
| 94 |
*/ |
| 95 |
global $wp_query; |
| 96 |
|
| 97 |
$wp_query->set_404(); |
| 98 |
|
| 99 |
status_header(404); |
| 100 |
include(get_query_template('404')); |
| 101 |
|
| 102 |
die(); |
| 103 |
} |
| 104 |
|
| 105 |
// check signature hash |
| 106 |
$sign = md5($attachment->id . date('YmdH')); |
| 107 |
if($sign != $_REQUEST['secure_sign']) { |
| 108 |
$dieMessage = __('Sorry, Your secure sign is invalid, Please reload the previous page and get new signed url', 'fluent-support'); |
| 109 |
die($dieMessage); |
| 110 |
} |
| 111 |
|
| 112 |
ob_clean(); |
| 113 |
ob_end_flush(); |
| 114 |
|
| 115 |
ini_set('user_agent', 'Fluent Support/' . FLUENT_SUPPORT_VERSION . '; ' . get_bloginfo('url')); |
| 116 |
header("Content-Type: $attachment->file_type"); |
| 117 |
header("Content-Disposition: inline; filename=\"$attachment->title\""); |
| 118 |
|
| 119 |
echo readfile( $attachment->file_path ); |
| 120 |
die(); |
| 121 |
} |
| 122 |
|
| 123 |
} |
| 124 |
|
| 125 |
|
| 126 |
} |
| 127 |
|
