gdpr-framework / src / Router.php

Router.php in The GDPR Framework By Data443 2.1.0, at src/Router.php

167 lines 4.9 KB

Raw Download Zip

1	<?php
2
3	namespace Codelight\GDPR;
4
5	use Codelight\GDPR\DataSubject\DataSubjectAuthenticator;
6
7	/**
8	* Handles automatically identifying context and triggering actions based on $_REQUEST['gdpr_action']
9	*
10	* Class Router
11	*
12	* @package Codelight\GDPR
13	*/
14	class Router
15	{
16	/* @var DataSubjectAuthenticator $authenticator */
17	protected $authenticator;
18
19	/**
20	* Router constructor.
21	*
22	* @param DataSubjectAuthenticator $authenticator
23	*/
24	public function __construct(DataSubjectAuthenticator $authenticator)
25	{
26	$this->authenticator = $authenticator;
27
28	// Routing happens at priority 20 to allow other 'init' actions to complete before
29	add_action('init', [$this, 'routeFrontendRequest'], 20);
30	add_action('admin_init', [$this, 'routeAdminRequest'], 20);
31	}
32
33	/**
34	* Get and sanitize the action parameter
35	*
36	* @return bool\|mixed
37	*/
38	protected function getAction()
39	{
40	if (!isset($_REQUEST['gdpr_action'])) {
41	return false;
42	}
43
44	// Simple sanitization: allowed chars are alphanumeric, dash, underscore and forward slash.
45	return preg_replace("/[^a-zA-Z0-9_\-\/]/", "", sanitize_key($_REQUEST['gdpr_action']));
46	}
47
48	/**
49	* Detect and trigger proper action in front-end
50	*
51	* @param $action
52	*/
53	public function routeFrontendRequest()
54	{
55	// Since the 'init' hooks runs in both admin and non-admin requests, double-check where we are
56	if (is_admin()) {
57	return;
58	}
59
60	// Handle identification by email
61	$this->authenticator->identify();
62
63	$action = $this->getAction();
64	$nonce = isset($_REQUEST['gdpr_nonce']) ? sanitize_key($_REQUEST['gdpr_nonce']) : null;
65
66	if (!$action) {
67	return;
68	}
69
70	$dataSubject = $this->authenticator->authenticate();
71
72	if ($dataSubject) {
73	$tag = "gdpr/frontend/privacy-tools-page/action/{$action}";
74	if (wp_verify_nonce($nonce, $tag)) {
75	$key = isset($_REQUEST['gdpr_key']) ? sanitize_key($_REQUEST['gdpr_key']) : null;
76	do_action($tag, $dataSubject, $key);
77	} else {
78	wp_die(
79	sprintf(
80	__('Nonce error for action "%s". Please go back and try again!', 'gdpr-framework'),
81	esc_html($action)
82	)
83	);
84	}
85	} else {
86	$tag = "gdpr/frontend/action/{$action}";
87	if (wp_verify_nonce($nonce, $tag)) {
88	do_action($tag);
89	} else {
90	wp_die(
91	sprintf(
92	__('Nonce error for action "%s". Please go back and try again!', 'gdpr-framework'),
93	esc_html($action)
94	)
95	);
96	}
97	}
98	}
99
100	/**
101	* Detect and trigger proper action in admin
102	*
103	* @param $action
104	*/
105	public function routeAdminRequest()
106	{
107	$action = $this->getAction();
108	$nonce = isset($_REQUEST['gdpr_nonce']) ? sanitize_key($_REQUEST['gdpr_nonce']) : null;
109
110	if (!$action) {
111	return;
112	}
113
114	if (isset($_GET['page']) && 'gdpr-profile' === sanitize_key($_GET['page'])) {
115
116	$dataSubject = $this->authenticator->authenticate();
117	if ($dataSubject) {
118	$tag = "gdpr/dashboard/privacy-tools/action/{$action}";
119
120	if (wp_verify_nonce($nonce, $tag)) {
121	do_action($tag, $dataSubject);
122	} else {
123	wp_die(
124	sprintf(
125	__('Nonce error for action "%s". Please go back and try again!', 'gdpr-framework'),
126	esc_html($action)
127	)
128	);
129	}
130	}
131	} else {
132	if ($this->checkAdminPermissions()) {
133
134	$tag = "gdpr/admin/action/{$action}";
135
136	if (wp_verify_nonce($nonce, $tag)) {
137	do_action($tag);
138	} else {
139	wp_die(
140	sprintf(
141	__('Nonce error for action "%s". Please go back and try again!', 'gdpr-framework'),
142	esc_html($action)
143	)
144	);
145	}
146	} else {
147	wp_die(
148	sprintf(
149	_x('You do not have the required permissions to perform this action!', '(Admin)', 'gdpr-framework'),
150	esc_html($action)
151	)
152	);
153	}
154	}
155	}
156
157	/**
158	* Check if the current user has the correct capability to perform an admin action
159	*
160	* @return bool
161	*/
162	protected function checkAdminPermissions()
163	{
164	return current_user_can(apply_filters('gdpr/capability', 'manage_options'));
165	}
166	}
167