admin-pages
1 year ago
core-api
1 year ago
debugger
1 year ago
markdown
1 year ago
class-jetpack-ai-helper.php
1 year ago
class-jetpack-currencies.php
2 years ago
class-jetpack-instagram-gallery-helper.php
2 years ago
class-jetpack-mapbox-helper.php
3 years ago
class-jetpack-podcast-feed-locator.php
1 year ago
class-jetpack-podcast-helper.php
1 year ago
class-jetpack-recommendations.php
2 years ago
class-jetpack-top-posts-helper.php
2 years ago
class-unauth-file-upload-handler.php
1 year ago
class.color.php
2 years ago
class.core-rest-api-endpoints.php
1 year ago
class.jetpack-automatic-install-skin.php
2 years ago
class.jetpack-iframe-embed.php
3 years ago
class.jetpack-password-checker.php
2 years ago
class.jetpack-search-performance-logger.php
4 years ago
class.media-extractor.php
2 years ago
class.media-summary.php
1 year ago
class.media.php
2 years ago
components.php
3 years ago
debugger.php
2 years ago
forms-integration.php
1 year ago
functions.wp-notify.php
1 year ago
icalendar-reader.php
1 year ago
jp-simplepie-alias-new.php
1 year ago
jp-simplepie-alias-old.php
1 year ago
jp-simplepie-alias.php
1 year ago
markdown.php
3 years ago
plans.php
4 years ago
plugins.php
4 years ago
tonesque.php
2 years ago
widgets.php
2 years ago
class-unauth-file-upload-handler.php
73 lines
| 1 | <?php |
| 2 | /** |
| 3 | * Unauthenticated File Upload Handler for Jetpack Forms. |
| 4 | * |
| 5 | * @package automattic/jetpack |
| 6 | */ |
| 7 | |
| 8 | namespace Automattic\Jetpack; |
| 9 | |
| 10 | use Automattic\Jetpack\Connection\Tokens; |
| 11 | use Automattic\Jetpack\Extensions\Premium_Content\JWT; |
| 12 | use Automattic\Jetpack\Status\Host; |
| 13 | |
| 14 | /** |
| 15 | * Handles temporary file uploads from unauthenticated users. |
| 16 | */ |
| 17 | class Unauth_File_Upload_Handler { |
| 18 | /** |
| 19 | * Generate a JWT token for file upload authorization. |
| 20 | * |
| 21 | * @param array $claims The claims to include in the token. |
| 22 | * @return string The generated JWT token. |
| 23 | */ |
| 24 | public function generate_upload_token( $claims = array() ) { |
| 25 | $default_claims = array( |
| 26 | 'exp' => time() + 3600, // 1 hour expiration |
| 27 | 'ip' => isset( $_SERVER['REMOTE_ADDR'] ) ? sanitize_text_field( wp_unslash( $_SERVER['REMOTE_ADDR'] ) ) : '', |
| 28 | 'iat' => time(), |
| 29 | ); |
| 30 | |
| 31 | $claims = wp_parse_args( $claims, $default_claims ); |
| 32 | |
| 33 | // Get the secret key for signing |
| 34 | $secret = $this->get_upload_token_secret(); |
| 35 | |
| 36 | // Generate and return the token |
| 37 | return JWT::encode( $claims, $secret, 'HS256' ); |
| 38 | } |
| 39 | |
| 40 | /** |
| 41 | * Get the secret key for signing upload tokens. |
| 42 | * |
| 43 | * @return string|false The secret key or false if not available. |
| 44 | */ |
| 45 | private function get_upload_token_secret() { |
| 46 | if ( ( new Host() )->is_wpcom_simple() ) { |
| 47 | // phpcs:ignore ImportDetection.Imports.RequireImports.Symbol |
| 48 | // TODO: This is a temporary solution to get the secret key for the upload token. |
| 49 | return defined( 'EARN_JWT_SIGNING_KEY' ) ? EARN_JWT_SIGNING_KEY : false; |
| 50 | } |
| 51 | $token = ( new Tokens() )->get_access_token(); |
| 52 | if ( ! isset( $token->secret ) ) { |
| 53 | return false; |
| 54 | } |
| 55 | return $token->secret; |
| 56 | } |
| 57 | |
| 58 | /** |
| 59 | * Verify a JWT upload token. |
| 60 | * |
| 61 | * @param string $token The JWT token to verify. |
| 62 | * @return object|false The token claims if valid, false if invalid. |
| 63 | */ |
| 64 | public function verify_upload_token( $token ) { |
| 65 | try { |
| 66 | $secret = $this->get_upload_token_secret(); |
| 67 | return JWT::decode( $token, $secret, array( 'HS256' ) ); |
| 68 | } catch ( \Exception $e ) { |
| 69 | return false; |
| 70 | } |
| 71 | } |
| 72 | } |
| 73 |