| @@ -1,8 +1,9 @@ | ||
| 1 | 1 | <?php |
| 2 | 2 | |
| 3 | 3 | namespace Give\DonationForms\Routes; |
| 4 | 4 | |
| 5 | +use Give\DonationForms\Actions\AuthenticateFormRequestWithToken; | |
| 5 | 6 | use Give\DonationForms\DataTransferObjects\AuthenticationData; |
| 6 | 7 | use Give\DonationForms\DataTransferObjects\DonateRouteData; |
| 7 | 8 | use Give\DonationForms\DataTransferObjects\UserData; |
| 8 | 9 | use Give\Framework\PaymentGateways\Traits\HandleHttpResponses; |
| @@ -15,8 +16,9 @@ | ||
| 15 | 16 | { |
| 16 | 17 | use HandleHttpResponses; |
| 17 | 18 | |
| 18 | 19 | /** |
| 20 | + * @since 4.17.0 Return an auth token so embedded forms can authenticate without cookies. | |
| 19 | 21 | * @since 3.0.0 |
| 20 | 22 | * |
| 21 | 23 | * @return void |
| 22 | 24 | */ |
| @@ -27,11 +29,28 @@ | ||
| 27 | 29 | $routeData->validateSignature(); |
| 28 | 30 | |
| 29 | 31 | $user = $this->authenticate(AuthenticationData::fromRequest($request)); |
| 30 | 32 | |
| 31 | - wp_send_json_success(UserData::fromUser($user)); | |
| 33 | + wp_send_json_success( | |
| 34 | + get_object_vars(UserData::fromUser($user)) + [ | |
| 35 | + AuthenticateFormRequestWithToken::TOKEN_KEY => $this->generateAuthToken($user), | |
| 36 | + ] | |
| 37 | + ); | |
| 32 | 38 | |
| 33 | 39 | exit; |
| 40 | + } | |
| 41 | + | |
| 42 | + /** | |
| 43 | + * The token is built like an auth cookie: signed by core, session backed, | |
| 44 | + * and revoked with the session. It carries the login where the cookie | |
| 45 | + * cannot, which is inside a cross-site iframe. Its own salt scheme means | |
| 46 | + * it is not usable as a login cookie. | |
| 47 | + * | |
| 48 | + * @since 4.17.0 | |
| 49 | + */ | |
| 50 | + protected function generateAuthToken(WP_User $user): string | |
| 51 | + { | |
| 52 | + return wp_generate_auth_cookie($user->ID, time() + HOUR_IN_SECONDS, AuthenticateFormRequestWithToken::SCHEME); | |
| 34 | 53 | } |
| 35 | 54 | |
| 36 | 55 | /** |
| 37 | 56 | * @since 3.0.0 |
