class.jetpack-keyring-service-helper.php — Jetpack – WP Security, Backup, Speed, & Growth 12.6.4

jetpack / _inc / lib / class.jetpack-keyring-service-helper.php

jetpack / _inc / lib Last commit date

class.jetpack-keyring-service-helper.php

317 lines

1	<?php // phpcs:ignore WordPress.Files.FileName.InvalidClassFileName
2	/**
3	* Utilities to interact with a Keyring instance.
4	* Used for Publicize as well as the Site Verification tools.
5	*
6	* @package automattic/jetpack
7	*/
8
9	use Automattic\Jetpack\Connection\Secrets;
10
11	/**
12	* A series of utilities to interact with a Keyring instance.
13	*/
14	class Jetpack_Keyring_Service_Helper {
15	/**
16	* Class instance
17	*
18	* @var Jetpack_Keyring_Service_Helper
19	*/
20	private static $instance = null;
21
22	/**
23	* Whether the `sharing` page is registered.
24	*
25	* @var bool
26	*/
27	private static $is_sharing_page_registered = false;
28
29	/**
30	* Initialize instance.
31	*/
32	public static function init() {
33	if ( self::$instance === null ) {
34	self::$instance = new Jetpack_Keyring_Service_Helper();
35	}
36
37	return self::$instance;
38	}
39
40	const SERVICES = array(
41	'facebook' => array(
42	'for' => 'publicize',
43	),
44	// @todo Remove when Twitter has been dropped from Publicize.
45	'twitter' => array(
46	'for' => 'publicize',
47	),
48	'linkedin' => array(
49	'for' => 'publicize',
50	),
51	'tumblr' => array(
52	'for' => 'publicize',
53	),
54	'path' => array(
55	'for' => 'publicize',
56	),
57	'google_plus' => array(
58	'for' => 'publicize',
59	),
60	'google_site_verification' => array(
61	'for' => 'other',
62	),
63	);
64
65	/**
66	* Constructor
67	*/
68	private function __construct() {
69	add_action( 'admin_menu', array( __CLASS__, 'register_sharing_page' ) );
70
71	add_action( 'load-settings_page_sharing', array( __CLASS__, 'admin_page_load' ), 9 );
72	}
73
74	/**
75	* We need a `sharing` page to be able to connect and disconnect services.
76	*/
77	public static function register_sharing_page() {
78	if ( self::$is_sharing_page_registered ) {
79	return;
80	}
81
82	self::$is_sharing_page_registered = true;
83
84	if ( ! current_user_can( 'manage_options' ) ) {
85	return;
86	}
87
88	global $_registered_pages;
89
90	require_once ABSPATH . 'wp-admin/includes/plugin.php';
91
92	$hookname = get_plugin_page_hookname( 'sharing', 'options-general.php' );
93	add_action( $hookname, array( __CLASS__, 'admin_page_load' ) );
94	$_registered_pages[ $hookname ] = true; // phpcs:ignore WordPress.WP.GlobalVariablesOverride.Prohibited
95	}
96
97	/**
98	* Return a list of services.
99	*
100	* @param string $filter Choose 'all' to get all connected services, vs. just the connected ones.
101	*/
102	public function get_services( $filter = 'all' ) {
103	$services = array();
104
105	if ( 'all' === $filter ) {
106	return $services;
107	} else {
108	$connected_services = array();
109	foreach ( $services as $service => $empty ) {
110	$connections = $this->get_connections( $service );
111	if ( $connections ) {
112	$connected_services[ $service ] = $connections;
113	}
114	}
115	return $connected_services;
116	}
117	}
118
119	/**
120	* Gets a URL to the public-api actions. Works like WP's admin_url.
121	* On WordPress.com this is/calls Keyring::admin_url.
122	*
123	* @param string $service Shortname of a specific service.
124	* @param array $params Parameters to append to an API connection URL.
125	*
126	* @return URL to specific public-api process
127	*/
128	private static function api_url( $service = false, $params = array() ) {
129	/**
130	* Filters the API URL used to interact with WordPress.com.
131	*
132	* @since 2.0.0
133	*
134	* @param string https://public-api.wordpress.com/connect/?jetpack=publicize Default Publicize API URL.
135	*/
136	$url = apply_filters( 'publicize_api_url', 'https://public-api.wordpress.com/connect/?jetpack=publicize' );
137
138	if ( $service ) {
139	$url = add_query_arg( array( 'service' => $service ), $url );
140	}
141
142	if ( count( $params ) ) {
143	$url = add_query_arg( $params, $url );
144	}
145
146	return $url;
147	}
148
149	/**
150	* Build a connection URL (sharing settings page with unique query args to create a connection).
151	*
152	* @param string $service_name Service name.
153	* @param string $for Feature name.
154	*/
155	public static function connect_url( $service_name, $for ) {
156	return add_query_arg(
157	array(
158	'action' => 'request',
159	'service' => $service_name,
160	'kr_nonce' => wp_create_nonce( 'keyring-request' ),
161	'nonce' => wp_create_nonce( "keyring-request-$service_name" ),
162	'for' => $for,
163	),
164	admin_url( 'options-general.php?page=sharing' )
165	);
166	}
167
168	/**
169	* Build a URL to refresh a connection (sharing settings page with unique query args to refresh a connection).
170	* Similar to connect_url, but with a refresh parameter.
171	*
172	* @param string $service_name Service name.
173	* @param string $for Feature name.
174	*/
175	public static function refresh_url( $service_name, $for ) {
176	return add_query_arg(
177	array(
178	'action' => 'request',
179	'service' => $service_name,
180	'kr_nonce' => wp_create_nonce( 'keyring-request' ),
181	'refresh' => 1,
182	'for' => $for,
183	'nonce' => wp_create_nonce( "keyring-request-$service_name" ),
184	),
185	admin_url( 'options-general.php?page=sharing' )
186	);
187	}
188
189	/**
190	* Build a URL to delete a connection (sharing settings page with unique query args to delete a connection).
191	*
192	* @param string $service_name Service name.
193	* @param string $id Connection ID.
194	*/
195	public static function disconnect_url( $service_name, $id ) {
196	return add_query_arg(
197	array(
198	'action' => 'delete',
199	'service' => $service_name,
200	'id' => $id,
201	'kr_nonce' => wp_create_nonce( 'keyring-request' ),
202	'nonce' => wp_create_nonce( "keyring-request-$service_name" ),
203	),
204	admin_url( 'options-general.php?page=sharing' )
205	);
206	}
207
208	/**
209	* Build contents handling Keyring connection management into Sharing settings screen.
210	*/
211	public static function admin_page_load() {
212	if ( isset( $_GET['action'] ) ) {
213	if ( isset( $_GET['service'] ) ) {
214	$service_name = sanitize_text_field( wp_unslash( $_GET['service'] ) ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- We verify below.
215	}
216
217	switch ( $_GET['action'] ) {
218
219	case 'request':
220	check_admin_referer( 'keyring-request', 'kr_nonce' );
221	check_admin_referer( "keyring-request-$service_name", 'nonce' );
222
223	$verification = ( new Secrets() )->generate( 'publicize' );
224	if ( ! $verification ) {
225	$url = Jetpack::admin_url( 'jetpack#/settings' );
226	wp_die(
227	sprintf(
228	wp_kses(
229	/* Translators: placeholder is a URL to a Settings page. */
230	__( "Jetpack is not connected. Please connect Jetpack by visiting <a href='%s'>Settings</a>.", 'jetpack' ),
231	array(
232	'a' => array(
233	'href' => array(),
234	),
235	)
236	),
237	esc_url( $url )
238	)
239	);
240
241	}
242	$stats_options = get_option( 'stats_options' );
243	$wpcom_blog_id = Jetpack_Options::get_option( 'id' );
244	$wpcom_blog_id = ! empty( $wpcom_blog_id ) ? $wpcom_blog_id : $stats_options['blog_id'];
245
246	$user = wp_get_current_user();
247	$redirect = self::api_url(
248	$service_name,
249	urlencode_deep(
250	array(
251	'action' => 'request',
252	'redirect_uri' => add_query_arg( array( 'action' => 'done' ), menu_page_url( 'sharing', false ) ),
253	'for' => 'publicize',
254	// required flag that says this connection is intended for publicize.
255	'siteurl' => site_url(),
256	'state' => $user->ID,
257	'blog_id' => $wpcom_blog_id,
258	'secret_1' => $verification['secret_1'],
259	'secret_2' => $verification['secret_2'],
260	'eol' => $verification['exp'],
261	)
262	)
263	);
264	wp_redirect( $redirect ); // phpcs:ignore WordPress.Security.SafeRedirect.wp_redirect_wp_redirect -- The API URL is an external URL and is filterable.
265	exit;
266
267	case 'completed':
268	/*
269	* We do not use a nonce here,
270	* since we're populating a local cache of
271	* the Publicize connections that were created and stored on WordPress.com.
272	*/
273	$xml = new Jetpack_IXR_Client();
274	$xml->query( 'jetpack.fetchPublicizeConnections' );
275
276	if ( ! $xml->isError() ) {
277	$response = $xml->getResponse();
278	Jetpack_Options::update_option( 'publicize_connections', $response );
279	}
280
281	break;
282
283	case 'delete':
284	$id = isset( $_GET['id'] ) ? sanitize_text_field( wp_unslash( $_GET['id'] ) ) : null;
285
286	check_admin_referer( 'keyring-request', 'kr_nonce' );
287	check_admin_referer( "keyring-request-$service_name", 'nonce' );
288
289	self::disconnect( $service_name, $id );
290
291	do_action( 'connection_disconnected', $service_name );
292	break;
293	}
294	}
295	}
296
297	/**
298	* Remove a Publicize connection
299	*
300	* @param string $service_name Service name.
301	* @param string $connection_id Connection ID.
302	* @param int\|bool $_blog_id Blog ID.
303	* @param int\|bool $_user_id User ID.
304	* @param bool $force_delete Force delete the connection.
305	*/
306	public static function disconnect( $service_name, $connection_id, $_blog_id = false, $_user_id = false, $force_delete = false ) { // phpcs:ignore VariableAnalysis.CodeAnalysis.VariableAnalysis.UnusedVariable
307	$xml = new Jetpack_IXR_Client();
308	$xml->query( 'jetpack.deletePublicizeConnection', $connection_id );
309
310	if ( ! $xml->isError() ) {
311	Jetpack_Options::update_option( 'publicize_connections', $xml->getResponse() );
312	} else {
313	return false;
314	}
315	}
316	}
317