| @@ -1,9 +1,11 @@ | ||
| 1 | 1 | <?php |
| 2 | 2 | |
| 3 | 3 | namespace FluentSupport\App\Services; |
| 4 | 4 | |
| 5 | +use FluentSupport\App\Models\Activity; | |
| 5 | 6 | use FluentSupport\App\Models\Customer; |
| 7 | +use FluentSupport\App\Models\Ticket; | |
| 6 | 8 | |
| 7 | 9 | class ProfileInfoService |
| 8 | 10 | { |
| 9 | 11 | public static function getProfileExtraWidgets( $customer ) |
| @@ -22,33 +24,352 @@ | ||
| 22 | 24 | return $widgets; |
| 23 | 25 | } |
| 24 | 26 | |
| 25 | 27 | // This method is linked with 'profile_update' action & it will trigger when user update profile |
| 26 | - public function onWPProfileUpdate( $userId, $userOldData, $userUpdatedData ) | |
| 28 | + public function onWPProfileUpdate($userId, $userOldData, $userUpdatedData) | |
| 27 | 29 | { |
| 28 | - if ( !$userId ) { | |
| 30 | + if (!$userId || !is_array($userUpdatedData)) { | |
| 29 | 31 | return false; |
| 30 | 32 | } |
| 31 | 33 | |
| 32 | - $customer = Customer::where( 'user_id', $userId ); | |
| 34 | + // Matching on user_id only is what keeps this safe: a WordPress account | |
| 35 | + // can never reach a customer row it is not already linked to, so this | |
| 36 | + // can only ever rewrite the requester's own record. | |
| 37 | + $customers = Customer::where('user_id', $userId)->get(); | |
| 33 | 38 | |
| 34 | - if ( $customer->count() == 0 ) { | |
| 39 | + if (!$customers || count($customers) === 0) { | |
| 35 | 40 | return false; |
| 36 | 41 | } |
| 37 | 42 | |
| 38 | 43 | $keys = ['first_name', 'last_name', 'user_email']; |
| 39 | - $data = []; | |
| 40 | 44 | |
| 41 | - if( !array_diff_key( array_flip($keys), $userUpdatedData ) ) { | |
| 45 | + if (array_diff_key(array_flip($keys), $userUpdatedData)) { | |
| 46 | + return false; | |
| 47 | + } | |
| 48 | + | |
| 49 | + // wp_insert_user() takes slashed data, and profile_update hands that same | |
| 50 | + // array straight on, so a name like O'Brien arrives as O\'Brien. Written | |
| 51 | + // through unchanged it reaches the customer record with a literal | |
| 52 | + // backslash, which is what the customer then sees in the portal and on | |
| 53 | + // every notification addressed to them. | |
| 54 | + $userUpdatedData = wp_unslash($userUpdatedData); | |
| 55 | + | |
| 56 | + $email = $userUpdatedData['user_email']; | |
| 57 | + | |
| 58 | + // Any plugin calling wp_update_user() for any reason fires this hook, so | |
| 59 | + // most of the time the account address has not moved at all. Reading the | |
| 60 | + // pending-change meta and running a capability check on every one of | |
| 61 | + // those is work for nothing. | |
| 62 | + // | |
| 63 | + // It also keeps the administrator path honest. Without this, an | |
| 64 | + // administrator editing somebody's first name would move the support | |
| 65 | + // address onto whatever unverified address the account happened to be | |
| 66 | + // carrying, because the check below only compares the customer record to | |
| 67 | + // the account. Authority is granted for the change the actor actually | |
| 68 | + // made, not for a divergence somebody else created earlier. | |
| 69 | + // Unslashed on both sides. wp_insert_user() slashes the previous address | |
| 70 | + // on purpose -- "Slash current user email to compare it later with | |
| 71 | + // slashed new user email" -- so comparing it against the unslashed new | |
| 72 | + // one reads an address like o'brien@example.com as changed on every | |
| 73 | + // update, and an administrator editing only a name would move the | |
| 74 | + // support address onto it. | |
| 75 | + $previousAccountEmail = is_object($userOldData) && isset($userOldData->user_email) | |
| 76 | + ? wp_unslash($userOldData->user_email) | |
| 77 | + : ''; | |
| 78 | + | |
| 79 | + // An unknown previous address falls through to the full check rather | |
| 80 | + // than silently skipping it. | |
| 81 | + $accountEmailMoved = !$previousAccountEmail | |
| 82 | + || !self::isSameEmail($previousAccountEmail, $email); | |
| 83 | + | |
| 84 | + // Only a proven change may move the address that support notifications | |
| 85 | + // and signed ticket links are delivered to. Names are cosmetic and are | |
| 86 | + // always synced. | |
| 87 | + $changeReason = $accountEmailMoved ? self::provenEmailChangeReason($userId, $email) : ''; | |
| 88 | + $emailIsProven = (bool) $changeReason; | |
| 89 | + | |
| 90 | + foreach ($customers as $customer) { | |
| 42 | 91 | $data = [ |
| 43 | 92 | 'first_name' => $userUpdatedData['first_name'], |
| 44 | - 'last_name' => $userUpdatedData['last_name'], | |
| 45 | - 'email' => $userUpdatedData['user_email'], | |
| 93 | + 'last_name' => $userUpdatedData['last_name'], | |
| 46 | 94 | ]; |
| 47 | - }; | |
| 48 | 95 | |
| 49 | - if ( count($data) > 0 ) { | |
| 50 | - $customer->update($data); | |
| 96 | + $previousEmail = $customer->email; | |
| 97 | + | |
| 98 | + // Never move this row onto an address another customer already | |
| 99 | + // holds. Duplicate emails make every later email-based match | |
| 100 | + // ambiguous, and mail piping would then thread onto whichever row | |
| 101 | + // happens to have the lower id. | |
| 102 | + $emailMoved = $emailIsProven | |
| 103 | + && !self::isSameEmail($previousEmail, $email) | |
| 104 | + && !self::isEmailHeldByAnotherCustomer($email, $customer->id); | |
| 105 | + | |
| 106 | + if ($emailMoved) { | |
| 107 | + $data['email'] = $email; | |
| 108 | + } | |
| 109 | + | |
| 110 | + $customer->fill($data); | |
| 111 | + $customer->save(); | |
| 112 | + | |
| 113 | + if ($emailMoved) { | |
| 114 | + self::onProvenEmailChange($customer, $previousEmail, $changeReason); | |
| 115 | + } | |
| 51 | 116 | } |
| 52 | 117 | |
| 118 | + return true; | |
| 119 | + } | |
| 120 | + | |
| 121 | + /** | |
| 122 | + * How the email change being applied right now was authorised, or an empty | |
| 123 | + * string when it was not. | |
| 124 | + * | |
| 125 | + * Two paths count. The account holder can prove the new address by opening | |
| 126 | + * WordPress's confirmation link, and somebody with authority over the | |
| 127 | + * account can change it on their behalf. Everything else, which is most | |
| 128 | + * things, leaves the customer's contact address where it is. | |
| 129 | + * | |
| 130 | + * @param int $userId | |
| 131 | + * @param string $newEmail | |
| 132 | + * @return string 'verified', 'administrator', or '' | |
| 133 | + */ | |
| 134 | + public static function provenEmailChangeReason($userId, $newEmail) | |
| 135 | + { | |
| 136 | + if (self::isWpConfirmedEmailChange($userId, $newEmail)) { | |
| 137 | + return 'verified'; | |
| 138 | + } | |
| 139 | + | |
| 140 | + if (self::isAdminAuthorizedEmailChange($userId)) { | |
| 141 | + return 'administrator'; | |
| 142 | + } | |
| 143 | + | |
| 144 | + return ''; | |
| 145 | + } | |
| 146 | + | |
| 147 | + /** | |
| 148 | + * Whether an administrator is changing this account's address on its | |
| 149 | + * owner's behalf. | |
| 150 | + * | |
| 151 | + * Authority over the WordPress account is the test. Someone who may edit | |
| 152 | + * that account may also move the address Fluent Support writes to, on the | |
| 153 | + * basis that the customer record's address is derived from the account in | |
| 154 | + * the first place. | |
| 155 | + * | |
| 156 | + * Worth knowing what that admits on a WooCommerce store. WooCommerce grants | |
| 157 | + * edit_users to shop_manager through a user_has_cap filter and then narrows | |
| 158 | + * it, in wc_modify_map_meta_cap(), to accounts holding the 'customer' role, | |
| 159 | + * which is the population Fluent Support serves. A shop manager therefore | |
| 160 | + * passes this check for any customer, whether or not they hold a single | |
| 161 | + * Fluent Support permission, and can redirect that customer's support | |
| 162 | + * notifications. Narrowing this to holders of fst_sensitive_data, the | |
| 163 | + * permission CustomerPolicy uses to gate editing a customer record, would | |
| 164 | + * close that; it is a one-line change here. | |
| 165 | + * | |
| 166 | + * The address is authorised but still unproven, which is why this path | |
| 167 | + * rotates ticket hashes exactly as the verified one does, so links already | |
| 168 | + * delivered to the previous inbox stop working. | |
| 169 | + * | |
| 170 | + * Excluding the actor's own account matters: an administrator changing their | |
| 171 | + * own address goes through the same unverified endpoints as anybody else and | |
| 172 | + * gets no special treatment. | |
| 173 | + * | |
| 174 | + * @param int $userId | |
| 175 | + * @return bool | |
| 176 | + */ | |
| 177 | + public static function isAdminAuthorizedEmailChange($userId) | |
| 178 | + { | |
| 179 | + $actorId = get_current_user_id(); | |
| 180 | + | |
| 181 | + if (!$actorId || $actorId === (int) $userId) { | |
| 182 | + return false; | |
| 183 | + } | |
| 184 | + | |
| 185 | + return current_user_can('edit_user', (int) $userId); | |
| 186 | + } | |
| 187 | + | |
| 188 | + /** | |
| 189 | + * Whether the email change being applied to this user right now went through | |
| 190 | + * WordPress's own click-through confirmation. | |
| 191 | + * | |
| 192 | + * wp-admin/user-edit.php calls wp_update_user() and only deletes the | |
| 193 | + * _new_email meta afterwards, so the pending record is still readable while | |
| 194 | + * profile_update fires. The record on its own proves nothing: submitting the | |
| 195 | + * profile form writes it without any click, so an unverified change made | |
| 196 | + * through REST could arrive with a matching address already sitting in meta. | |
| 197 | + * Only the hash coming back in the request shows the link was opened from | |
| 198 | + * the inbox the mail was delivered to. | |
| 199 | + * | |
| 200 | + * @param int $userId | |
| 201 | + * @param string $newEmail | |
| 202 | + * @return bool | |
| 203 | + */ | |
| 204 | + public static function isWpConfirmedEmailChange($userId, $newEmail) | |
| 205 | + { | |
| 206 | + // Mirrors the condition core applies the confirmed change under. | |
| 207 | + // wp-admin/user-edit.php runs the confirmation branch only when | |
| 208 | + // IS_PROFILE_PAGE is truthy, and that constant is defined nowhere but | |
| 209 | + // profile.php and user-edit.php, where it means "the user is editing | |
| 210 | + // their own account". Requiring it here means a replayed hash cannot be | |
| 211 | + // honoured from REST, WP-CLI, or an administrator editing somebody else. | |
| 212 | + if (!defined('IS_PROFILE_PAGE') || !IS_PROFILE_PAGE) { | |
| 213 | + return false; | |
| 214 | + } | |
| 215 | + | |
| 216 | + $pending = get_user_meta($userId, '_new_email', true); | |
| 217 | + | |
| 218 | + if (!is_array($pending) || empty($pending['hash']) || empty($pending['newemail'])) { | |
| 219 | + return false; | |
| 220 | + } | |
| 221 | + | |
| 222 | + if (!self::isSameEmail($pending['newemail'], $newEmail)) { | |
| 223 | + return false; | |
| 224 | + } | |
| 225 | + | |
| 226 | + // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- this compares a secret delivered to the user's own inbox; it does not act on request state | |
| 227 | + $submitted = isset($_GET['newuseremail']) | |
| 228 | + ? sanitize_text_field(wp_unslash($_GET['newuseremail'])) | |
| 229 | + : ''; | |
| 230 | + | |
| 231 | + return $submitted && hash_equals($pending['hash'], $submitted); | |
| 232 | + } | |
| 233 | + | |
| 234 | + /** | |
| 235 | + * Apply the consequences of a customer's contact address moving to one that | |
| 236 | + * has been proven. | |
| 237 | + * | |
| 238 | + * Shared by every path that is allowed to move an address -- WordPress's own | |
| 239 | + * confirmation, an administrator with rights over the account, and the | |
| 240 | + * portal claim flow in EmailClaimService -- so a proven move has exactly one | |
| 241 | + * set of consequences however it was proven. | |
| 242 | + * | |
| 243 | + * @param \FluentSupport\App\Models\Customer $customer | |
| 244 | + * @param string $previousEmail | |
| 245 | + * @param string $reason 'verified', 'administrator', 'claimed' or 'agent' | |
| 246 | + * @return void | |
| 247 | + */ | |
| 248 | + public static function onProvenEmailChange($customer, $previousEmail, $reason = 'verified') | |
| 249 | + { | |
| 250 | + // Signed ticket links already delivered to the previous inbox keep | |
| 251 | + // authorizing read, reply, close and reopen on these tickets until the | |
| 252 | + // hash they carry stops matching. | |
| 253 | + $tickets = Ticket::where('customer_id', $customer->id)->get(); | |
| 254 | + | |
| 255 | + foreach ($tickets as $ticket) { | |
| 256 | + $ticket->hash = bin2hex(random_bytes(16)); | |
| 257 | + $ticket->save(); | |
| 258 | + } | |
| 259 | + | |
| 260 | + Activity::create([ | |
| 261 | + 'event_type' => 'fluent_support/customer_email_changed', | |
| 262 | + 'person_id' => $customer->id, | |
| 263 | + 'person_type' => 'customer', | |
| 264 | + 'object_id' => $customer->id, | |
| 265 | + 'object_type' => 'customer', | |
| 266 | + 'description' => sprintf( | |
| 267 | + self::emailChangeDescription($reason), | |
| 268 | + $previousEmail, | |
| 269 | + $customer->email | |
| 270 | + ) | |
| 271 | + ]); | |
| 272 | + | |
| 273 | + /* | |
| 274 | + * Fires after a customer's contact address moves to a newly proven one. | |
| 275 | + * | |
| 276 | + * @since v2.4.1 | |
| 277 | + * @param \FluentSupport\App\Models\Customer $customer | |
| 278 | + * @param string $previousEmail | |
| 279 | + * @param string $reason | |
| 280 | + */ | |
| 281 | + do_action('fluent_support/customer_email_verified_change', $customer, $previousEmail, $reason); | |
| 282 | + } | |
| 283 | + | |
| 284 | + /** | |
| 285 | + * Activity log wording for each way an address can be proven. | |
| 286 | + * | |
| 287 | + * @param string $reason | |
| 288 | + * @return string A sprintf format taking the previous and new addresses | |
| 289 | + */ | |
| 290 | + protected static function emailChangeDescription($reason) | |
| 291 | + { | |
| 292 | + if ($reason === 'administrator') { | |
| 293 | + // translators: 1: previous email address, 2: new email address | |
| 294 | + return __('Contact email changed from %1$s to %2$s by an administrator editing the WordPress account.', 'fluent-support'); | |
| 295 | + } | |
| 296 | + | |
| 297 | + if ($reason === 'agent') { | |
| 298 | + // translators: 1: previous email address, 2: new email address | |
| 299 | + return __('Contact email changed from %1$s to %2$s by a support agent editing the customer.', 'fluent-support'); | |
| 300 | + } | |
| 301 | + | |
| 302 | + if ($reason === 'claimed') { | |
| 303 | + // translators: 1: previous email address, 2: new email address | |
| 304 | + return __('Contact email changed from %1$s to %2$s, confirmed by the account holder from the support portal.', 'fluent-support'); | |
| 305 | + } | |
| 306 | + | |
| 307 | + // translators: 1: previous email address, 2: new email address | |
| 308 | + return __('Contact email changed from %1$s to %2$s, confirmed through WordPress email verification.', 'fluent-support'); | |
| 309 | + } | |
| 310 | + | |
| 311 | + /** | |
| 312 | + * @param string $left | |
| 313 | + * @param string $right | |
| 314 | + * @return bool | |
| 315 | + */ | |
| 316 | + protected static function isSameEmail($left, $right) | |
| 317 | + { | |
| 318 | + return strtolower(trim((string) $left)) === strtolower(trim((string) $right)); | |
| 319 | + } | |
| 320 | + | |
| 321 | + /** | |
| 322 | + * Adopt customer rows that already carry this address but are not linked to | |
| 323 | + * a WordPress account yet. | |
| 324 | + * | |
| 325 | + * Registration is one of the few moments where an address may be treated as | |
| 326 | + * belonging to the account: WordPress refuses to register an address that | |
| 327 | + * another user already holds, and the credentials it sends go to that inbox. | |
| 328 | + * A later email change carries no such proof, which is why binding is done | |
| 329 | + * here rather than on every profile update. | |
| 330 | + * | |
| 331 | + * @param int $userId | |
| 332 | + * @return void | |
| 333 | + */ | |
| 334 | + public function onWPUserRegister($userId) | |
| 335 | + { | |
| 336 | + $user = $userId ? get_user_by('ID', $userId) : false; | |
| 337 | + | |
| 338 | + if (!$user || !$user->user_email) { | |
| 339 | + return; | |
| 340 | + } | |
| 341 | + | |
| 342 | + /* | |
| 343 | + * Filter whether a newly registered WordPress account adopts unlinked | |
| 344 | + * customer rows that already carry its email address. Sites that let | |
| 345 | + * visitors register with a self-chosen password may want this off. | |
| 346 | + * | |
| 347 | + * @since v2.4.1 | |
| 348 | + * @param bool $shouldLink | |
| 349 | + * @param \WP_User $user | |
| 350 | + */ | |
| 351 | + if (!apply_filters('fluent_support/link_customer_on_user_register', true, $user)) { | |
| 352 | + return; | |
| 353 | + } | |
| 354 | + | |
| 355 | + Customer::where('email', $user->user_email) | |
| 356 | + ->unclaimed() | |
| 357 | + ->update(['user_id' => $user->ID]); | |
| 358 | + } | |
| 359 | + | |
| 360 | + /** | |
| 361 | + * @param string $email | |
| 362 | + * @param int $customerId | |
| 363 | + * @return bool | |
| 364 | + */ | |
| 365 | + protected static function isEmailHeldByAnotherCustomer($email, $customerId) | |
| 366 | + { | |
| 367 | + if (!$email) { | |
| 368 | + return true; | |
| 369 | + } | |
| 370 | + | |
| 371 | + return (bool) Customer::where('email', $email) | |
| 372 | + ->where('id', '!=', $customerId) | |
| 373 | + ->first(); | |
| 53 | 374 | } |
| 54 | 375 | } |
