← All changes | app/Http/Controllers/ChatMessageParserController.php +52 -6 1.10.4 → 2.4.0 View file →

		@@ -1,9 +1,10 @@
1	1	<?php
2	2
3	3	namespace FluentSupport\App\Http\Controllers;
4	4
5		-use FluentSupport\Framework\Request\Request;
	5	+use FluentSupport\Framework\Http\Request\Request;
	6	+use FluentSupport\App\Services\Helper;
6	7	use FluentSupport\App\Services\ThirdParty\HandleSlackEvent;
7	8	use FluentSupport\App\Services\ThirdParty\HandleTelegramEvent;
8	9
9	10	/**
		@@ -24,8 +25,15 @@
24	25	* @return mixed
25	26	*/
26	27	public function handleTelegramWebhook(Request $request, HandleTelegramEvent $handler, $token)
27	28	{
	29	+ if (!$this->verifyWebhookSignature('telegram', $request)) {
	30	+ return $this->sendError([
	31	+ 'message' => __('Invalid request signature.', 'fluent-support'),
	32	+ 'status' => false
	33	+ ], 403);
	34	+ }
	35	+
28	36	try {
29	37	return $this->sendSuccess([
30	38	'message' => __('Response has been successfully recorded', 'fluent-support'),
31	39	'status' => true,
		@@ -32,9 +40,9 @@
32	40	'data' => $handler->handleEvent($request->all(), $token)
33	41	]);
34	42	} catch (\Exception $e) {
35	43	return $this->sendError([
36		- 'message' => $e->getMessage(),
	44	+ 'message' => Helper::getSafeErrorMessage($e),
37	45	'status' => false
38	46	]);
39	47	}
40	48	}
		@@ -40,23 +48,61 @@
40	48	}
41	49
42	50	/**
43	51	* handleSlackEvent responsible for getting information from integrated slack request and response
	52	+ * @param Request $request
44	53	* @param HandleSlackEvent $handler
45	54	* @param $token
46	55	* @return array
47	56	*/
48		- public function handleSlackEvent(HandleSlackEvent $handler, $token)
	57	+ public function handleSlackEvent(Request $request, HandleSlackEvent $handler, $token)
49	58	{
50		- try{
51		- $this->sendSuccess([
	59	+ if (!$this->verifyWebhookSignature('slack', $request)) {
	60	+ return $this->sendError([
	61	+ 'message' => __('Invalid request signature.', 'fluent-support'),
	62	+ 'status' => false
	63	+ ], 403);
	64	+ }
	65	+
	66	+ if ($request->getSafe('type', 'sanitize_text_field') === 'url_verification') {
	67	+ return new \WP_REST_Response($request->getSafe('challenge', 'sanitize_text_field'), 200, [
	68	+ 'Content-Type' => 'text/plain; charset=utf-8'
	69	+ ]);
	70	+ }
	71	+
	72	+ try {
	73	+ return $this->sendSuccess([
52	74	'message' => 'received',
53	75	'result' => $handler->handleEvent($token)
54	76	]);
55	77	} catch (\Exception $e) {
56	78	return $this->sendError([
57		- 'message' => $e->getMessage(),
	79	+ 'message' => Helper::getSafeErrorMessage($e),
58	80	'status' => false
59	81	]);
60	82	}
	83	+ }
	84	+
	85	+ /**
	86	+ * Verify webhook signature using platform-specific logic.
	87	+ *
	88	+ * Pro plugin or third-party code may hook into the filter
	89	+ * 'fluent_support/verify_webhook_signature_{platform}' to enable
	90	+ * cryptographic signature verification. When no verifier is
	91	+ * registered, fall back to the existing token-based validation
	92	+ * handled by the downstream webhook handlers.
	93	+ *
	94	+ * @param string $platform 'telegram' or 'slack'
	95	+ * @param Request $request
	96	+ * @return bool
	97	+ */
	98	+ private function verifyWebhookSignature($platform, Request $request)
	99	+ {
	100	+ $hookName = 'fluent_support/verify_webhook_signature_' . $platform;
	101	+
	102	+ if (!has_filter($hookName)) {
	103	+ return true;
	104	+ }
	105	+
	106	+ return (bool) apply_filters($hookName, false, $request);
61	107	}
62	108	}