class.jetpack-keyring-service-helper.php — Jetpack – WP Security, Backup, Speed, & Growth 12.1.3

jetpack / _inc / lib / class.jetpack-keyring-service-helper.php

jetpack / _inc / lib Last commit date

class.jetpack-keyring-service-helper.php

316 lines

1	<?php // phpcs:ignore WordPress.Files.FileName.InvalidClassFileName
2	/**
3	* Utilities to interact with a Keyring instance.
4	* Used for Publicize as well as the Site Verification tools.
5	*
6	* @package automattic/jetpack
7	*/
8
9	use Automattic\Jetpack\Connection\Secrets;
10
11	/**
12	* A series of utilities to interact with a Keyring instance.
13	*/
14	class Jetpack_Keyring_Service_Helper {
15	/**
16	* Class instance
17	*
18	* @var Jetpack_Keyring_Service_Helper
19	*/
20	private static $instance = null;
21
22	/**
23	* Whether the `sharing` page is registered.
24	*
25	* @var bool
26	*/
27	private static $is_sharing_page_registered = false;
28
29	/**
30	* Initialize instance.
31	*/
32	public static function init() {
33	if ( self::$instance === null ) {
34	self::$instance = new Jetpack_Keyring_Service_Helper();
35	}
36
37	return self::$instance;
38	}
39
40	const SERVICES = array(
41	'facebook' => array(
42	'for' => 'publicize',
43	),
44	'twitter' => array(
45	'for' => 'publicize',
46	),
47	'linkedin' => array(
48	'for' => 'publicize',
49	),
50	'tumblr' => array(
51	'for' => 'publicize',
52	),
53	'path' => array(
54	'for' => 'publicize',
55	),
56	'google_plus' => array(
57	'for' => 'publicize',
58	),
59	'google_site_verification' => array(
60	'for' => 'other',
61	),
62	);
63
64	/**
65	* Constructor
66	*/
67	private function __construct() {
68	add_action( 'admin_menu', array( __CLASS__, 'register_sharing_page' ) );
69
70	add_action( 'load-settings_page_sharing', array( __CLASS__, 'admin_page_load' ), 9 );
71	}
72
73	/**
74	* We need a `sharing` page to be able to connect and disconnect services.
75	*/
76	public static function register_sharing_page() {
77	if ( self::$is_sharing_page_registered ) {
78	return;
79	}
80
81	self::$is_sharing_page_registered = true;
82
83	if ( ! current_user_can( 'manage_options' ) ) {
84	return;
85	}
86
87	global $_registered_pages;
88
89	require_once ABSPATH . 'wp-admin/includes/plugin.php';
90
91	$hookname = get_plugin_page_hookname( 'sharing', 'options-general.php' );
92	add_action( $hookname, array( __CLASS__, 'admin_page_load' ) );
93	$_registered_pages[ $hookname ] = true; // phpcs:ignore WordPress.WP.GlobalVariablesOverride.Prohibited
94	}
95
96	/**
97	* Return a list of services.
98	*
99	* @param string $filter Choose 'all' to get all connected services, vs. just the connected ones.
100	*/
101	public function get_services( $filter = 'all' ) {
102	$services = array();
103
104	if ( 'all' === $filter ) {
105	return $services;
106	} else {
107	$connected_services = array();
108	foreach ( $services as $service => $empty ) {
109	$connections = $this->get_connections( $service );
110	if ( $connections ) {
111	$connected_services[ $service ] = $connections;
112	}
113	}
114	return $connected_services;
115	}
116	}
117
118	/**
119	* Gets a URL to the public-api actions. Works like WP's admin_url.
120	* On WordPress.com this is/calls Keyring::admin_url.
121	*
122	* @param string $service Shortname of a specific service.
123	* @param array $params Parameters to append to an API connection URL.
124	*
125	* @return URL to specific public-api process
126	*/
127	private static function api_url( $service = false, $params = array() ) {
128	/**
129	* Filters the API URL used to interact with WordPress.com.
130	*
131	* @since 2.0.0
132	*
133	* @param string https://public-api.wordpress.com/connect/?jetpack=publicize Default Publicize API URL.
134	*/
135	$url = apply_filters( 'publicize_api_url', 'https://public-api.wordpress.com/connect/?jetpack=publicize' );
136
137	if ( $service ) {
138	$url = add_query_arg( array( 'service' => $service ), $url );
139	}
140
141	if ( count( $params ) ) {
142	$url = add_query_arg( $params, $url );
143	}
144
145	return $url;
146	}
147
148	/**
149	* Build a connection URL (sharing settings page with unique query args to create a connection).
150	*
151	* @param string $service_name Service name.
152	* @param string $for Feature name.
153	*/
154	public static function connect_url( $service_name, $for ) {
155	return add_query_arg(
156	array(
157	'action' => 'request',
158	'service' => $service_name,
159	'kr_nonce' => wp_create_nonce( 'keyring-request' ),
160	'nonce' => wp_create_nonce( "keyring-request-$service_name" ),
161	'for' => $for,
162	),
163	admin_url( 'options-general.php?page=sharing' )
164	);
165	}
166
167	/**
168	* Build a URL to refresh a connection (sharing settings page with unique query args to refresh a connection).
169	* Similar to connect_url, but with a refresh parameter.
170	*
171	* @param string $service_name Service name.
172	* @param string $for Feature name.
173	*/
174	public static function refresh_url( $service_name, $for ) {
175	return add_query_arg(
176	array(
177	'action' => 'request',
178	'service' => $service_name,
179	'kr_nonce' => wp_create_nonce( 'keyring-request' ),
180	'refresh' => 1,
181	'for' => $for,
182	'nonce' => wp_create_nonce( "keyring-request-$service_name" ),
183	),
184	admin_url( 'options-general.php?page=sharing' )
185	);
186	}
187
188	/**
189	* Build a URL to delete a connection (sharing settings page with unique query args to delete a connection).
190	*
191	* @param string $service_name Service name.
192	* @param string $id Connection ID.
193	*/
194	public static function disconnect_url( $service_name, $id ) {
195	return add_query_arg(
196	array(
197	'action' => 'delete',
198	'service' => $service_name,
199	'id' => $id,
200	'kr_nonce' => wp_create_nonce( 'keyring-request' ),
201	'nonce' => wp_create_nonce( "keyring-request-$service_name" ),
202	),
203	admin_url( 'options-general.php?page=sharing' )
204	);
205	}
206
207	/**
208	* Build contents handling Keyring connection management into Sharing settings screen.
209	*/
210	public static function admin_page_load() {
211	if ( isset( $_GET['action'] ) ) {
212	if ( isset( $_GET['service'] ) ) {
213	$service_name = sanitize_text_field( wp_unslash( $_GET['service'] ) ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- We verify below.
214	}
215
216	switch ( $_GET['action'] ) {
217
218	case 'request':
219	check_admin_referer( 'keyring-request', 'kr_nonce' );
220	check_admin_referer( "keyring-request-$service_name", 'nonce' );
221
222	$verification = ( new Secrets() )->generate( 'publicize' );
223	if ( ! $verification ) {
224	$url = Jetpack::admin_url( 'jetpack#/settings' );
225	wp_die(
226	sprintf(
227	wp_kses(
228	/* Translators: placeholder is a URL to a Settings page. */
229	__( "Jetpack is not connected. Please connect Jetpack by visiting <a href='%s'>Settings</a>.", 'jetpack' ),
230	array(
231	'a' => array(
232	'href' => array(),
233	),
234	)
235	),
236	esc_url( $url )
237	)
238	);
239
240	}
241	$stats_options = get_option( 'stats_options' );
242	$wpcom_blog_id = Jetpack_Options::get_option( 'id' );
243	$wpcom_blog_id = ! empty( $wpcom_blog_id ) ? $wpcom_blog_id : $stats_options['blog_id'];
244
245	$user = wp_get_current_user();
246	$redirect = self::api_url(
247	$service_name,
248	urlencode_deep(
249	array(
250	'action' => 'request',
251	'redirect_uri' => add_query_arg( array( 'action' => 'done' ), menu_page_url( 'sharing', false ) ),
252	'for' => 'publicize',
253	// required flag that says this connection is intended for publicize.
254	'siteurl' => site_url(),
255	'state' => $user->ID,
256	'blog_id' => $wpcom_blog_id,
257	'secret_1' => $verification['secret_1'],
258	'secret_2' => $verification['secret_2'],
259	'eol' => $verification['exp'],
260	)
261	)
262	);
263	wp_redirect( $redirect ); // phpcs:ignore WordPress.Security.SafeRedirect.wp_redirect_wp_redirect -- The API URL is an external URL and is filterable.
264	exit;
265
266	case 'completed':
267	/*
268	* We do not use a nonce here,
269	* since we're populating a local cache of
270	* the Publicize connections that were created and stored on WordPress.com.
271	*/
272	$xml = new Jetpack_IXR_Client();
273	$xml->query( 'jetpack.fetchPublicizeConnections' );
274
275	if ( ! $xml->isError() ) {
276	$response = $xml->getResponse();
277	Jetpack_Options::update_option( 'publicize_connections', $response );
278	}
279
280	break;
281
282	case 'delete':
283	$id = isset( $_GET['id'] ) ? sanitize_text_field( wp_unslash( $_GET['id'] ) ) : null;
284
285	check_admin_referer( 'keyring-request', 'kr_nonce' );
286	check_admin_referer( "keyring-request-$service_name", 'nonce' );
287
288	self::disconnect( $service_name, $id );
289
290	do_action( 'connection_disconnected', $service_name );
291	break;
292	}
293	}
294	}
295
296	/**
297	* Remove a Publicize connection
298	*
299	* @param string $service_name Service name.
300	* @param string $connection_id Connection ID.
301	* @param int\|bool $_blog_id Blog ID.
302	* @param int\|bool $_user_id User ID.
303	* @param bool $force_delete Force delete the connection.
304	*/
305	public static function disconnect( $service_name, $connection_id, $_blog_id = false, $_user_id = false, $force_delete = false ) { // phpcs:ignore VariableAnalysis.CodeAnalysis.VariableAnalysis.UnusedVariable
306	$xml = new Jetpack_IXR_Client();
307	$xml->query( 'jetpack.deletePublicizeConnection', $connection_id );
308
309	if ( ! $xml->isError() ) {
310	Jetpack_Options::update_option( 'publicize_connections', $xml->getResponse() );
311	} else {
312	return false;
313	}
314	}
315	}
316