class-access-control.php — Jetpack – WP Security, Backup, Speed, & Growth 16.2-a.1

jetpack / jetpack_vendor / automattic / jetpack-videopress / src / class-access-control.php

jetpack / jetpack_vendor / automattic / jetpack-videopress / src Last commit date

class-access-control.php

647 lines

1	<?php
2	/**
3	* VideoPress Access Control.
4	*
5	* @package automattic/jetpack-videopress
6	*/
7
8	namespace Automattic\Jetpack\VideoPress;
9
10	use Automattic\Jetpack\Extensions\Premium_Content\Subscription_Service\Abstract_Token_Subscription_Service;
11	use Automattic\Jetpack\Modules;
12	use VIDEOPRESS_PRIVACY;
13	use WP_Post;
14
15	/**
16	* VideoPress video access control utilities.
17	*
18	* Note: this is also being used on WordPress.com.
19	* Use IS_WPCOM checks for functionality that is specific to WPCOM/Jetpack.
20	*/
21	class Access_Control {
22
23	/**
24	* Singleton Access_Control instance.
25	*
26	* @var Access_Control
27	**/
28	private static $instance = null;
29
30	/**
31	* Guid to subscription plan, store, for when used inline on a page.
32	*
33	* @var array
34	*/
35	private $guids_to_subscriptions = array();
36
37	/**
38	* Set that this guid is controlled by a subscription.
39	*
40	* @param string $guid The guid to set.
41	* @param string\|int $subscription_id The subscription to set.
42	*
43	* @return Access_Control
44	*/
45	public function set_guid_subscription( $guid, $subscription_id ) {
46	$this->guids_to_subscriptions[ $guid ] = $subscription_id;
47	return $this;
48	}
49
50	/**
51	* Get the subscription for a guid.
52	*
53	* @param string $guid The guid to get.
54	*
55	* @return string\|int\|false
56	*/
57	public function get_subscription_plan_id( $guid ) {
58	return $this->guids_to_subscriptions[ $guid ] ?? false;
59	}
60
61	/**
62	* Get the singleton instance.
63	*
64	* @return self
65	*/
66	public static function instance() {
67	if ( null === self::$instance ) {
68	self::$instance = new self();
69	}
70
71	return self::$instance;
72	}
73
74	/**
75	* Determines if Jetpack Memberships are available.
76	*
77	* @return bool
78	*/
79	private function jetpack_memberships_available() {
80	return class_exists( '\Jetpack_Memberships' );
81	}
82
83	/**
84	* Determines if Jetpack Subscriptions are available.
85	*
86	* @return bool
87	*/
88	private function jetpack_subscriptions_available() {
89	$is_module_active = ( new Modules() )->is_active( 'subscriptions' );
90	if ( ! $is_module_active ) {
91	return false;
92	}
93
94	if ( function_exists( '\Automattic\Jetpack\Extensions\Premium_Content\subscription_service' ) ) {
95	return true;
96	}
97
98	if ( ! defined( 'JETPACK__PLUGIN_DIR' ) ) {
99	return false;
100	}
101
102	$subscription_service_file_path = JETPACK__PLUGIN_DIR . 'extensions/blocks/premium-content/_inc/subscription-service/include.php';
103	if ( ! file_exists( $subscription_service_file_path ) ) {
104	return false;
105	}
106
107	require_once $subscription_service_file_path;
108
109	return function_exists( '\Automattic\Jetpack\Extensions\Premium_Content\subscription_service' );
110	}
111
112	/**
113	* Check default user access. By default, subscribers or higher can view videos.
114	*
115	* @param WP_Post $post_to_check The post to check.
116	*
117	* @return bool
118	**/
119	private function get_default_user_capability_for_post( $post_to_check ) {
120	if ( ! isset( $post_to_check->ID ) ) {
121	return false;
122	}
123
124	$default_auth = current_user_can( 'read_post', $post_to_check->ID );
125
126	return $default_auth;
127	}
128
129	/**
130	* Determines if the current user can access restricted content and builds the restriction_details array.
131	*
132	* @param string $guid the video guid.
133	* @param int $embedded_post_id the post id.
134	* @param int $selected_plan_id the selected plan id if applicable.
135	*
136	* @return array
137	*/
138	private function build_restriction_details( $guid, $embedded_post_id, $selected_plan_id ) {
139	$post_to_check = get_post( $embedded_post_id );
140
141	if ( empty( $post_to_check ) ) {
142	$restriction_details = $this->default_video_restriction_details( false );
143	return $this->filter_video_restriction_details( $restriction_details, $guid, $embedded_post_id, $selected_plan_id );
144	}
145
146	$default_auth = $this->get_default_user_capability_for_post( $post_to_check );
147	$restriction_details = $this->default_video_restriction_details( $default_auth );
148
149	if ( $this->jetpack_memberships_available() ) {
150	$post_access_level = \Jetpack_Memberships::get_post_access_level( $embedded_post_id );
151	if ( 'everybody' !== $post_access_level ) {
152	$memberships_can_view_post = \Jetpack_Memberships::user_can_view_post( $embedded_post_id );
153	$restriction_details = $this->get_subscriber_only_restriction_details( $default_auth );
154	$restriction_details['can_access'] = $memberships_can_view_post;
155	}
156	}
157
158	return $this->check_block_level_access(
159	$restriction_details,
160	$guid,
161	$embedded_post_id,
162	$selected_plan_id
163	);
164	}
165
166	/**
167	* Determines if the current user can access restricted block content and updates the restriction_details array.
168	*
169	* @param array $restriction_details the restriction details array.
170	* @param string $guid the video guid.
171	* @param int $embedded_post_id the post id.
172	* @param int $selected_plan_id the selected plan id if applicable.
173	*
174	* @return array
175	*/
176	private function check_block_level_access( $restriction_details, $guid, $embedded_post_id, $selected_plan_id ) {
177	if ( $this->jetpack_subscriptions_available() && $selected_plan_id > 0 ) {
178	$restriction_details = $this->get_subscriber_only_restriction_details( $restriction_details['can_access'] );
179	$paywall = \Automattic\Jetpack\Extensions\Premium_Content\subscription_service();
180
181	// Only paid subscribers should be granted access to the premium content.
182	$access_level = '';
183	if ( class_exists( Abstract_Token_Subscription_Service::class ) ) {
184	$access_level = Abstract_Token_Subscription_Service::POST_ACCESS_LEVEL_PAID_SUBSCRIBERS;
185	}
186
187	$can_view = $paywall->visitor_can_view_content( array( $selected_plan_id ), $access_level );
188	$restriction_details['can_access'] = $can_view \|\| current_user_can( 'edit_post', $embedded_post_id ); // Editors can always view the content.
189	}
190
191	return $this->filter_video_restriction_details(
192	$restriction_details,
193	$guid,
194	$embedded_post_id,
195	$selected_plan_id
196	);
197	}
198
199	/**
200	* Returns the default restriction_details for a video.
201	*
202	* @param bool $default_can_access The default auth.
203	*
204	* @return array
205	**/
206	private function get_subscriber_only_restriction_details( $default_can_access = false ) {
207	return array(
208	'provider' => 'jetpack_memberships',
209	'title' => __( 'This video is subscriber-only', 'jetpack-videopress-pkg' ),
210	'unauthorized_message' => __( 'You need to be subscribed to view this video', 'jetpack-videopress-pkg' ),
211	'can_access' => $default_can_access,
212	);
213	}
214
215	/**
216	* Filters restriction details.
217	*
218	* @param array $video_restriction_details The restriction details.
219	* @param string $guid The video guid.
220	* @param int $embedded_post_id The post id.
221	* @param int $selected_plan_id The selected plan id if applicable.
222	*
223	* @return array
224	*/
225	private function filter_video_restriction_details( $video_restriction_details, $guid, $embedded_post_id, $selected_plan_id ) {
226	/**
227	* Filters the video restriction details.
228	*
229	* @param array $video_restriction_details The restriction details.
230	* @param string $guid The video guid.
231	* @param int $embedded_post_id The post id.
232	* @param int $selected_plan_id The selected plan id if applicable.
233	*
234	* @return array
235	*/
236	return (array) apply_filters( 'videopress_video_restriction_details', $video_restriction_details, $guid, $embedded_post_id, $selected_plan_id );
237	}
238
239	/**
240	* Returns the default restriction_details for a video.
241	*
242	* @param bool $default_can_access The default auth.
243	*
244	* @return array
245	**/
246	private function default_video_restriction_details( $default_can_access = false ) {
247	$restriction_details = array(
248	'version' => '1',
249	'provider' => 'auth',
250	'title' => __( 'Unauthorized', 'jetpack-videopress-pkg' ),
251	'unauthorized_message' => __( 'Unauthorized', 'jetpack-videopress-pkg' ),
252	'can_access' => $default_can_access,
253	);
254
255	return $restriction_details;
256	}
257
258	/**
259	* Determines whether a given post actually embeds a given VideoPress GUID.
260	*
261	* Used to prevent the embedded post id — which arrives from request input — from being
262	* treated as an authorization context when it has no relationship to the requested video.
263	* Matching the attachment id itself is not treated as proof of embedding: attachment ids
264	* are enumerable via the media REST route and would otherwise provide a second path around
265	* this check whenever the attachment has no parent and falls back to the `read` capability.
266	*
267	* @param int $embedded_post_id The post id claimed as the embedding context.
268	* @param string $guid The video guid.
269	*
270	* @return bool
271	*/
272	private function post_embeds_videopress_guid( $embedded_post_id, $guid ) {
273	$post = get_post( $embedded_post_id );
274	if ( ! $post instanceof WP_Post \|\| empty( $post->post_content ) ) {
275	return false;
276	}
277
278	// If the guid is nowhere in the content, neither the block nor the shortcode scan can match.
279	if ( false === strpos( $post->post_content, $guid ) ) {
280	return false;
281	}
282
283	if ( $this->post_content_has_videopress_block( $post->post_content, $guid ) ) {
284	return true;
285	}
286
287	if ( $this->post_content_has_videopress_shortcode( $post->post_content, $guid ) ) {
288	return true;
289	}
290
291	return $this->post_content_has_videopress_url( $post->post_content, $guid );
292	}
293
294	/**
295	* Walk parsed blocks (including inner blocks) looking for a videopress/video block
296	* whose guid attribute matches.
297	*
298	* @param string $post_content The post content to scan.
299	* @param string $guid The video guid to match.
300	*
301	* @return bool
302	*/
303	private function post_content_has_videopress_block( $post_content, $guid ) {
304	if ( false === strpos( $post_content, 'wp:videopress/video' ) ) {
305	return false;
306	}
307
308	return $this->blocks_contain_videopress_guid( parse_blocks( $post_content ), $guid );
309	}
310
311	/**
312	* Recursively scans a parsed block tree for a videopress/video block whose guid attribute matches.
313	*
314	* @param array $blocks Parsed blocks (as returned by parse_blocks() or an innerBlocks array).
315	* @param string $guid The video guid to match.
316	*
317	* @return bool
318	*/
319	private function blocks_contain_videopress_guid( $blocks, $guid ) {
320	foreach ( $blocks as $block ) {
321	if (
322	isset( $block['blockName'] ) && 'videopress/video' === $block['blockName']
323	&& isset( $block['attrs']['guid'] ) && $block['attrs']['guid'] === $guid
324	) {
325	return true;
326	}
327
328	if ( ! empty( $block['innerBlocks'] ) && is_array( $block['innerBlocks'] )
329	&& $this->blocks_contain_videopress_guid( $block['innerBlocks'], $guid )
330	) {
331	return true;
332	}
333	}
334
335	return false;
336	}
337
338	/**
339	* Detect a [videopress GUID] or [wpvideo GUID] shortcode whose first positional
340	* argument matches the given guid.
341	*
342	* @param string $post_content The post content to scan.
343	* @param string $guid The video guid to match.
344	*
345	* @return bool
346	*/
347	private function post_content_has_videopress_shortcode( $post_content, $guid ) {
348	if ( false === stripos( $post_content, '[videopress' ) && false === stripos( $post_content, '[wpvideo' ) ) {
349	return false;
350	}
351
352	$pattern = get_shortcode_regex( array( 'videopress', 'wpvideo' ) );
353	$count = preg_match_all( '/' . $pattern . '/', $post_content, $matches, PREG_SET_ORDER );
354	if ( false === $count \|\| 0 === $count ) {
355	return false;
356	}
357
358	foreach ( $matches as $match ) {
359	$atts = shortcode_parse_atts( $match[3] );
360	if ( ! is_array( $atts ) ) {
361	continue;
362	}
363
364	// Only the positional argument identifies the video; named attributes must not satisfy the binding check.
365	if ( isset( $atts[0] ) && is_string( $atts[0] ) && $atts[0] === $guid ) {
366	return true;
367	}
368	}
369
370	return false;
371	}
372
373	/**
374	* Detect a canonical VideoPress URL referencing the given guid. Covers oEmbed
375	* inserts, core/embed blocks, core/video blocks, and core [video] shortcodes
376	* whose src/mp4 attributes resolve to a VideoPress URL.
377	*
378	* @param string $post_content The post content to scan.
379	* @param string $guid The video guid to match.
380	*
381	* @return bool
382	*/
383	private function post_content_has_videopress_url( $post_content, $guid ) {
384	if ( ! preg_match_all( '#https?://[^\s"\'<>)]+#i', $post_content, $matches ) ) {
385	return false;
386	}
387
388	foreach ( $matches[0] as $url ) {
389	$extracted_guid = Utils::extract_videopress_guid_from_url( $url );
390	if ( $extracted_guid === $guid ) {
391	return true;
392	}
393	}
394
395	return false;
396	}
397
398	/**
399	* Build and cache the list of VideoPress GUIDs present in a post.
400	*
401	* Scans the post content for VideoPress blocks (including those in synced patterns),
402	* shortcodes, and URLs, then caches the GUID list in a transient for fast lookup
403	* during authorization checks.
404	*
405	* @param int $post_id The post ID to scan.
406	* @return array Array of VideoPress GUIDs found in the post.
407	*/
408	public static function build_and_cache_post_guids( $post_id ) {
409	if ( empty( $post_id ) ) {
410	return array();
411	}
412
413	$post_id = absint( $post_id );
414	$transient_key = "videopress_guids_{$post_id}";
415
416	// Check if already cached.
417	$cached_guids = get_transient( $transient_key );
418	if ( false !== $cached_guids ) {
419	return (array) $cached_guids;
420	}
421
422	$post = get_post( $post_id );
423	if ( ! $post instanceof WP_Post \|\| empty( $post->post_content ) ) {
424	set_transient( $transient_key, array(), 12 * HOUR_IN_SECONDS );
425	return array();
426	}
427
428	$guids = array();
429
430	// Scan for VideoPress blocks (including those in synced patterns).
431	$guids = array_merge( $guids, self::collect_guids_from_blocks( parse_blocks( $post->post_content ) ) );
432
433	// Scan for VideoPress shortcodes and URLs (legacy embedding methods).
434	if ( preg_match_all( '#https?://[^\s"\'<>)]+#i', $post->post_content, $matches ) ) {
435	foreach ( $matches[0] as $url ) {
436	$guid = Utils::extract_videopress_guid_from_url( $url );
437	if ( $guid ) {
438	$guids[] = $guid;
439	}
440	}
441	}
442
443	// Scan for [videopress] and [wpvideo] shortcodes.
444	$pattern = get_shortcode_regex( array( 'videopress', 'wpvideo' ) );
445	$count = preg_match_all( '/' . $pattern . '/', $post->post_content, $matches, PREG_SET_ORDER );
446	if ( false !== $count && $count > 0 ) {
447	foreach ( $matches as $match ) {
448	$atts = shortcode_parse_atts( $match[3] );
449	if ( is_array( $atts ) && isset( $atts[0] ) && is_string( $atts[0] ) ) {
450	$guids[] = $atts[0];
451	}
452	}
453	}
454
455	// Cache for 12 hours and return unique GUIDs.
456	$unique_guids = array_unique( array_filter( $guids ) );
457	set_transient( $transient_key, $unique_guids, 12 * HOUR_IN_SECONDS );
458
459	return $unique_guids;
460	}
461
462	/**
463	* Recursively collect VideoPress GUIDs from parsed blocks.
464	*
465	* Handles both direct VideoPress blocks and those within synced patterns,
466	* which are automatically expanded by WordPress when parse_blocks() is called.
467	*
468	* @param array $blocks Array of parsed blocks.
469	* @return array Array of VideoPress GUIDs found.
470	*/
471	private static function collect_guids_from_blocks( $blocks ) {
472	$guids = array();
473
474	foreach ( $blocks as $block ) {
475	// Check if this is a VideoPress block with a GUID.
476	if (
477	isset( $block['blockName'] ) && 'videopress/video' === $block['blockName']
478	&& isset( $block['attrs']['guid'] ) && is_string( $block['attrs']['guid'] )
479	) {
480	$guids[] = $block['attrs']['guid'];
481	}
482
483	// Recursively check inner blocks (including synced patterns which have been expanded).
484	if ( ! empty( $block['innerBlocks'] ) && is_array( $block['innerBlocks'] ) ) {
485	$guids = array_merge( $guids, self::collect_guids_from_blocks( $block['innerBlocks'] ) );
486	}
487	}
488
489	return $guids;
490	}
491
492	/**
493	* Check if a post contains a VideoPress GUID, using cached GUID list for fast lookup.
494	*
495	* Falls back to detailed scanning only if cache misses. This is much faster than
496	* the previous implementation which always scanned post_content.
497	*
498	* @param int $embedded_post_id The post id to check.
499	* @param string $guid The video guid to find.
500	*
501	* @return bool
502	*/
503	private function post_embeds_videopress_guid_cached( $embedded_post_id, $guid ) {
504	if ( empty( $embedded_post_id ) \|\| empty( $guid ) ) {
505	return false;
506	}
507
508	// Try fast lookup from cache.
509	$transient_key = "videopress_guids_{$embedded_post_id}";
510	$cached_guids = get_transient( $transient_key );
511
512	if ( false !== $cached_guids ) {
513	return in_array( $guid, (array) $cached_guids, true );
514	}
515
516	// Cache miss: build and cache the GUID list, then check.
517	$guids = self::build_and_cache_post_guids( $embedded_post_id );
518	return in_array( $guid, $guids, true );
519	}
520
521	/**
522	* Determines if the current user can view the provided video. Only ever gets fired if site-wide private videos are enabled.
523	*
524	* Filterable for 3rd party plugins.
525	*
526	* @param string $guid The video id being checked.
527	* @param int $embedded_post_id The post id the video is embedded in or 0.
528	* @param int $selected_plan_id The plan id the earn block this video is embedded in has.
529	*/
530	public function is_current_user_authed_for_video( $guid, $embedded_post_id, $selected_plan_id = 0 ) {
531	if ( current_user_can( 'upload_files' ) ) {
532	return $this->filter_is_current_user_authed_for_video( true, $guid, $embedded_post_id );
533	}
534
535	$attachment = false;
536	if ( defined( 'IS_WPCOM' ) && IS_WPCOM ) {
537	$video_info = video_get_info_by_guid( $guid );
538	if ( ! empty( $video_info ) ) {
539	$attachment = get_blog_post( $video_info->blog_id, $video_info->post_id );
540	}
541	} else {
542	$attachment = videopress_get_post_by_guid( $guid );
543	}
544
545	if ( ! $attachment ) {
546	return false;
547	}
548
549	$video_info = video_get_info_by_blogpostid( get_current_blog_id(), $attachment->ID );
550	if ( null === $video_info->guid ) {
551	return false;
552	}
553
554	/*
555	* Default missing privacy_setting to SITE_DEFAULT to avoid an
556	* undefined-property warning and make the site-level fallback explicit.
557	*/
558	$privacy_setting = $video_info->privacy_setting ?? VIDEOPRESS_PRIVACY::SITE_DEFAULT;
559
560	$embedded_post_id = (int) $embedded_post_id;
561	if (
562	$embedded_post_id
563	&& VIDEOPRESS_PRIVACY::IS_PUBLIC !== $privacy_setting
564	&& ! $this->post_embeds_videopress_guid_cached( $embedded_post_id, $guid )
565	) {
566	$embedded_post_id = 0;
567	}
568
569	$is_user_authed = false;
570
571	// Determine if video is public, private or use site default.
572	switch ( $privacy_setting ) {
573	case VIDEOPRESS_PRIVACY::IS_PUBLIC:
574	$is_user_authed = true;
575	break;
576	case VIDEOPRESS_PRIVACY::IS_PRIVATE:
577	$restriction_details = $this->build_restriction_details( $guid, $embedded_post_id, $selected_plan_id );
578	$is_user_authed = $restriction_details['can_access'];
579	break;
580	case VIDEOPRESS_PRIVACY::SITE_DEFAULT:
581	default:
582	$is_videopress_private_for_site = Data::get_videopress_videos_private_for_site();
583	$is_user_authed = true;
584	if ( $is_videopress_private_for_site ) {
585	$restriction_details = $this->build_restriction_details( $guid, $embedded_post_id, $selected_plan_id );
586	$is_user_authed = $restriction_details['can_access'];
587	}
588	}
589
590	/**
591	* Overrides video view authorization for current user.
592	*
593	* Example of making all videos public:
594	*
595	* function jp_example_override_video_auth( $is_user_authed, $guid ) {
596	* return true
597	* };
598	* add_filter( 'videopress_is_current_user_authed_for_video', 'jp_example_override_video_auth', 10, 2 );
599	*
600	* @param bool $is_user_authed The current user authorization state.
601	* @param string $guid The video's unique identifier.
602	* @param int\|null $embedded_post_id The post the video is embedded..
603	*
604	* @return bool
605	*/
606	return $this->filter_is_current_user_authed_for_video( $is_user_authed, $guid, $embedded_post_id );
607	}
608
609	/**
610	* Overrides video view authorization for current user.
611	*
612	* @param bool $is_user_authed The current user authorization state.
613	* @param string $guid The video's unique identifier.
614	* @param int\|null $embedded_post_id The post the video is embedded..
615	*
616	* @return bool
617	*/
618	private function filter_is_current_user_authed_for_video( $is_user_authed, $guid, $embedded_post_id ) {
619	/**
620	* Overrides video view authorization for current user.
621	*
622	* Example of making all videos public:
623	*
624	* function jp_example_override_video_auth( $is_user_authed, $guid ) {
625	* return true
626	* };
627	* add_filter( 'videopress_is_current_user_authed_for_video', 'jp_example_override_video_auth', 10, 2 );
628	*
629	* @param bool $is_user_authed The current user authorization state.
630	* @param string $guid The video's unique identifier.
631	* @param int\|null $embedded_post_id The post the video is embedded..
632	*
633	* @return bool
634	*/
635	return (bool) apply_filters( 'videopress_is_current_user_authed_for_video', $is_user_authed, $guid, $embedded_post_id );
636	}
637
638	/**
639	* Returns the proper blog id depending on Jetpack or WP.com
640	*
641	* @return int the blog id
642	*/
643	public function get_videopress_blog_id() {
644	return \Jetpack_Options::get_option( 'id' );
645	}
646	}
647