← All changes | extensions/blocks/premium-content/login-button/login-button.php +88 -18 12.0.3 → 16.3-a.1 View file →

		@@ -7,11 +7,12 @@
7	7
8	8	namespace Automattic\Jetpack\Extensions\Premium_Content;
9	9
10	10	use Automattic\Jetpack\Blocks;
11		-use Automattic\Jetpack\Extensions\Premium_Content\Subscription_Service\Token_Subscription_Service;
	11	+use Automattic\Jetpack\Extensions\Premium_Content\Subscription_Service\Abstract_Token_Subscription_Service;
12	12	use Automattic\Jetpack\Status\Host;
13	13	use Jetpack_Gutenberg;
	14	+use Jetpack_Options;
14	15
15	16	require_once dirname( __DIR__ ) . '/_inc/subscription-service/include.php';
16	17
17	18	const LOGIN_BUTTON_NAME = 'premium-content/login-button';
		@@ -21,21 +22,77 @@
21	22	* This is done via an action so that we can disable
22	23	* registration if we need to.
23	24	*/
24	25	function register_login_button_block() {
25		- // Only load this block on WordPress.com.
26		- if ( ( defined( 'IS_WPCOM' ) && IS_WPCOM ) || ( new Host() )->is_woa_site() ) {
27		- Blocks::jetpack_register_block(
28		- LOGIN_BUTTON_NAME,
29		- array(
30		- 'render_callback' => __NAMESPACE__ . '\render_login_button_block',
31		- )
32		- );
	26	+ Blocks::jetpack_register_block(
	27	+ LOGIN_BUTTON_NAME,
	28	+ array(
	29	+ 'render_callback' => __NAMESPACE__ . '\render_login_button_block',
	30	+ 'render_email_callback' => __NAMESPACE__ . '\render_login_button_block_email',
	31	+ )
	32	+ );
	33	+}
	34	+add_action( 'init', __NAMESPACE__ . '\register_login_button_block' );
	35	+
	36	+/**
	37	+ * Returns current URL.
	38	+ *
	39	+ * @return string
	40	+ */
	41	+function get_current_url() {
	42	+ if ( ! isset( $_SERVER['HTTP_HOST'] ) || ! isset( $_SERVER['REQUEST_URI'] ) ) {
	43	+ return '';
33	44	}
	45	+
	46	+ return ( is_ssl() ? 'https://' : 'http://' ) . wp_unslash( $_SERVER['HTTP_HOST'] ) . wp_unslash( $_SERVER['REQUEST_URI'] ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
34	47	}
35		-add_action( 'init', __NAMESPACE__ . '\register_login_button_block' );
36	48
37	49	/**
	50	+ * Returns subscriber log in URL.
	51	+ *
	52	+ * @param string $redirect Path to redirect to on login.
	53	+ *
	54	+ * @return string
	55	+ */
	56	+function get_subscriber_login_url( $redirect ) {
	57	+ $redirect = ! empty( $redirect ) ? $redirect : get_site_url();
	58	+
	59	+ if ( ( new Host() )->is_wpcom_simple() ) {
	60	+ // On WPCOM we will redirect immediately
	61	+ return wpcom_logmein_redirect_url( $redirect, false, null, 'link', get_current_blog_id() );
	62	+ }
	63	+
	64	+ // On self-hosted we will save and hide the token.
	65	+ // rawurlencode the redirect before nesting it: it is already percent-encoded
	66	+ // (e.g. an emoji or non-ASCII slug comes through as %F0%9F%8C%91), and add_query_arg
	67	+ // does not encode the values it inserts. Without this extra layer the value is
	68	+ // over-decoded to raw bytes by the time it reaches the subscribers/auth endpoint,
	69	+ // which strips it and 404s. See NL-273.
	70	+ $redirect_url = get_site_url() . '/wp-json/jetpack/v4/subscribers/auth';
	71	+ $redirect_url = add_query_arg( 'redirect_url', rawurlencode( $redirect ), $redirect_url );
	72	+
	73	+ return add_query_arg(
	74	+ array(
	75	+ 'site_id' => intval( Jetpack_Options::get_option( 'id' ) ),
	76	+ 'redirect_url' => rawurlencode( $redirect_url ),
	77	+ ),
	78	+ 'https://subscribe.wordpress.com/memberships/jwt/'
	79	+ );
	80	+}
	81	+
	82	+/**
	83	+ * Determines whether the visitor has a subscriber session for the login UI.
	84	+ *
	85	+ * WordPress sessions count on Simple; other hosts require the subscriber cookie.
	86	+ * Content access validates the token separately.
	87	+ *
	88	+ * @return bool
	89	+ */
	90	+function is_subscriber_logged_in() {
	91	+ return ( ( new Host() )->is_wpcom_simple() && is_user_logged_in() ) || Abstract_Token_Subscription_Service::has_token_from_cookie();
	92	+}
	93	+
	94	+/**
38	95	* Render callback.
39	96	*
40	97	* @param array $attributes Array containing the block attributes.
41	98	* @param string $content String containing the block content.
		@@ -46,19 +103,32 @@
46	103	if ( ! pre_render_checks() ) {
47	104	return '';
48	105	}
49	106
50		- $has_auth_cookie = isset( $_COOKIE[ Token_Subscription_Service::JWT_AUTH_TOKEN_COOKIE_NAME ] );
51		- // phpcs:ignore WordPress.Security.NonceVerification.Recommended
52		- $has_token_parameter = isset( $_GET['token'] );
53		-
54		- if ( is_user_logged_in() || $has_auth_cookie || $has_token_parameter ) {
55		- // The viewer is logged it, so they shouldn't see the login button.
	107	+ // The viewer is logged it, so they shouldn't see the login button.
	108	+ if ( is_subscriber_logged_in() ) {
56	109	return '';
57	110	}
58	111
59	112	Jetpack_Gutenberg::load_styles_as_required( LOGIN_BUTTON_NAME );
60	113
61		- $url = subscription_service()->access_url();
	114	+ $redirect_url = get_current_url();
	115	+ $url = get_subscriber_login_url( $redirect_url );
62	116
63		- return preg_replace( '/(<a\b[^><]*)>/i', '$1 href="' . esc_url( $url ) . '">', $content );
	117	+ $content = preg_replace( '/(<a\b[^><]*)>/i', '$1 href="' . esc_url( $url ) . '">', $content );
	118	+
	119	+ // Defense in depth: the label is inner block content (KSES-filtered on save for
	120	+ // roles without `unfiltered_html`), but escape it again on output so a stored
	121	+ // payload can never render as live markup.
	122	+ return wp_kses_post( $content );
	123	+}
	124	+
	125	+/**
	126	+ * Render email callback.
	127	+ *
	128	+ * @return string
	129	+ */
	130	+function render_login_button_block_email() {
	131	+ // We don't want to render the login button in emails.
	132	+ // The subscriber is already considered logged in in emails.
	133	+ return '';
64	134	}