king-addons / includes / widgets / Login_Register_Form / Social_Login_Handler.php

Social_Login_Handler.php in King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder 51.1.14, at includes/widgets/Login_Register_Form/Social_Login_Handler.php

332 lines 12.1 KB

Raw Download Zip

1	<?php
2
3	namespace King_Addons\Widgets\Login_Register_Form;
4
5	if (!defined('ABSPATH')) {
6	exit; // Exit if accessed directly.
7	}
8
9	// Include Security Manager
10	require_once KING_ADDONS_PATH . 'includes/widgets/Login_Register_Form/Security_Manager.php';
11
12	/**
13	* Social Login Handler for Login Register Form widget
14	*/
15	class Social_Login_Handler
16	{
17	/**
18	* Initialize social login handlers
19	*/
20	public static function init()
21	{
22	// Register AJAX handlers for social login callbacks
23	add_action('wp_ajax_nopriv_king_addons_google_callback', [__CLASS__, 'handle_google_callback']);
24	add_action('wp_ajax_king_addons_google_callback', [__CLASS__, 'handle_google_callback']);
25	add_action('wp_ajax_nopriv_king_addons_facebook_callback', [__CLASS__, 'handle_facebook_callback']);
26	add_action('wp_ajax_king_addons_facebook_callback', [__CLASS__, 'handle_facebook_callback']);
27
28	// Frontend AJAX handlers
29	add_action('wp_ajax_nopriv_king_addons_google_login', [__CLASS__, 'handle_google_login']);
30	add_action('wp_ajax_king_addons_google_login', [__CLASS__, 'handle_google_login']);
31	add_action('wp_ajax_nopriv_king_addons_facebook_login', [__CLASS__, 'handle_facebook_login']);
32	add_action('wp_ajax_king_addons_facebook_login', [__CLASS__, 'handle_facebook_login']);
33	}
34
35	/**
36	* Handle Google OAuth login
37	*/
38	public static function handle_google_login()
39	{
40	// Only allow social login for Pro users
41	if (!king_addons_freemius()->can_use_premium_code__premium_only()) {
42	wp_send_json_error(['message' => esc_html__('Social login is only available in King Addons Pro. Please upgrade to use this feature.', 'king-addons')]);
43	}
44
45	// Verify nonce
46	if (!wp_verify_nonce($_POST['nonce'], 'king_addons_social_login_action')) {
47	wp_send_json_error(['message' => esc_html__('Security check failed.', 'king-addons')]);
48	}
49
50	$google_token = sanitize_text_field($_POST['google_token'] ?? '');
51	$widget_settings = self::get_widget_settings($_POST['widget_id'] ?? '');
52
53	if (empty($google_token)) {
54	wp_send_json_error(['message' => esc_html__('Google token is required.', 'king-addons')]);
55	}
56
57	$google_client_id = $widget_settings['google_client_id'] ?? '';
58	if (empty($google_client_id)) {
59	wp_send_json_error(['message' => esc_html__('Google Client ID not configured.', 'king-addons')]);
60	}
61
62	// Verify Google token
63	$user_data = self::verify_google_token($google_token, $google_client_id);
64	if (!$user_data) {
65	wp_send_json_error(['message' => esc_html__('Google authentication failed.', 'king-addons')]);
66	}
67
68	// Process social login
69	$result = self::process_social_login($user_data, 'google');
70
71	if ($result['success']) {
72	wp_send_json_success([
73	'message' => esc_html__('Google login successful!', 'king-addons'),
74	'redirect' => $result['redirect']
75	]);
76	} else {
77	wp_send_json_error(['message' => $result['message']]);
78	}
79	}
80
81	/**
82	* Handle Facebook OAuth login
83	*/
84	public static function handle_facebook_login()
85	{
86	// Only allow social login for Pro users
87	if (!king_addons_freemius()->can_use_premium_code__premium_only()) {
88	wp_send_json_error(['message' => esc_html__('Social login is only available in King Addons Pro. Please upgrade to use this feature.', 'king-addons')]);
89	}
90
91	// Verify nonce
92	if (!wp_verify_nonce($_POST['nonce'], 'king_addons_social_login_action')) {
93	wp_send_json_error(['message' => esc_html__('Security check failed.', 'king-addons')]);
94	}
95
96	$facebook_token = sanitize_text_field($_POST['facebook_token'] ?? '');
97	$widget_settings = self::get_widget_settings($_POST['widget_id'] ?? '');
98
99	if (empty($facebook_token)) {
100	wp_send_json_error(['message' => esc_html__('Facebook token is required.', 'king-addons')]);
101	}
102
103	$facebook_app_id = $widget_settings['facebook_app_id'] ?? '';
104	$facebook_app_secret = $widget_settings['facebook_app_secret'] ?? '';
105
106	if (empty($facebook_app_id) \|\| empty($facebook_app_secret)) {
107	wp_send_json_error(['message' => esc_html__('Facebook App credentials not configured.', 'king-addons')]);
108	}
109
110	// Verify Facebook token
111	$user_data = self::verify_facebook_token($facebook_token, $facebook_app_id, $facebook_app_secret);
112	if (!$user_data) {
113	wp_send_json_error(['message' => esc_html__('Facebook authentication failed.', 'king-addons')]);
114	}
115
116	// Process social login
117	$result = self::process_social_login($user_data, 'facebook');
118
119	if ($result['success']) {
120	wp_send_json_success([
121	'message' => esc_html__('Facebook login successful!', 'king-addons'),
122	'redirect' => $result['redirect']
123	]);
124	} else {
125	wp_send_json_error(['message' => $result['message']]);
126	}
127	}
128
129	/**
130	* Verify Google OAuth token
131	*/
132	private static function verify_google_token($token, $client_id)
133	{
134	$url = 'https://oauth2.googleapis.com/tokeninfo?id_token=' . $token;
135
136	$response = wp_remote_get($url);
137	if (is_wp_error($response)) {
138	return false;
139	}
140
141	$body = wp_remote_retrieve_body($response);
142	$data = json_decode($body, true);
143
144	// Verify the token is for our app
145	if (!isset($data['aud']) \|\| $data['aud'] !== $client_id) {
146	return false;
147	}
148
149	// Return user data
150	return [
151	'email' => $data['email'] ?? '',
152	'first_name' => $data['given_name'] ?? '',
153	'last_name' => $data['family_name'] ?? '',
154	'name' => $data['name'] ?? '',
155	'picture' => $data['picture'] ?? '',
156	'provider_id' => $data['sub'] ?? '',
157	];
158	}
159
160	/**
161	* Verify Facebook OAuth token
162	*/
163	private static function verify_facebook_token($token, $app_id, $app_secret)
164	{
165	// First, verify the token
166	$verify_url = "https://graph.facebook.com/debug_token?input_token={$token}&access_token={$app_id}\|{$app_secret}";
167
168	$response = wp_remote_get($verify_url);
169	if (is_wp_error($response)) {
170	return false;
171	}
172
173	$verify_data = json_decode(wp_remote_retrieve_body($response), true);
174	if (!isset($verify_data['data']['is_valid']) \|\| !$verify_data['data']['is_valid']) {
175	return false;
176	}
177
178	// Get user data
179	$user_url = "https://graph.facebook.com/me?fields=id,name,email,first_name,last_name,picture&access_token={$token}";
180
181	$user_response = wp_remote_get($user_url);
182	if (is_wp_error($user_response)) {
183	return false;
184	}
185
186	$user_data = json_decode(wp_remote_retrieve_body($user_response), true);
187
188	return [
189	'email' => $user_data['email'] ?? '',
190	'first_name' => $user_data['first_name'] ?? '',
191	'last_name' => $user_data['last_name'] ?? '',
192	'name' => $user_data['name'] ?? '',
193	'picture' => $user_data['picture']['data']['url'] ?? '',
194	'provider_id' => $user_data['id'] ?? '',
195	];
196	}
197
198	/**
199	* Process social login (create user or login existing)
200	*/
201	private static function process_social_login($user_data, $provider)
202	{
203	// Sanitize social login data for security
204	$sanitized_data = Security_Manager::sanitize_social_data($user_data, $provider);
205
206	$email = $sanitized_data['email'];
207	if (empty($email)) {
208	return [
209	'success' => false,
210	'message' => esc_html__('Email is required for social login.', 'king-addons')
211	];
212	}
213
214	// Additional security checks for social login
215	if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
216	error_log("King Addons Security: Invalid email from {$provider}: {$email}");
217	return [
218	'success' => false,
219	'message' => esc_html__('Invalid email address from social provider.', 'king-addons')
220	];
221	}
222
223	// Check if user exists
224	$user = get_user_by('email', $email);
225
226	if ($user) {
227	// User exists, log them in
228	wp_set_current_user($user->ID);
229	wp_set_auth_cookie($user->ID);
230
231	// Update social provider info
232	update_user_meta($user->ID, 'king_addons_social_provider', $provider);
233	update_user_meta($user->ID, 'king_addons_social_provider_id', $user_data['provider_id']);
234
235	} else {
236	// Create new user with sanitized data
237	$username = self::generate_username($sanitized_data['name'] ?: $sanitized_data['email']);
238	$password = wp_generate_password(16, true); // Stronger password
239
240	$user_id = wp_create_user($username, $password, $email);
241	if (is_wp_error($user_id)) {
242	return [
243	'success' => false,
244	'message' => esc_html__('Unable to create user account.', 'king-addons')
245	];
246	}
247
248	// Update user meta with sanitized data
249	if (!empty($sanitized_data['first_name'])) {
250	update_user_meta($user_id, 'first_name', $sanitized_data['first_name']);
251	}
252	if (!empty($sanitized_data['last_name'])) {
253	update_user_meta($user_id, 'last_name', $sanitized_data['last_name']);
254	}
255
256	// Store social provider info
257	update_user_meta($user_id, 'king_addons_social_provider', $provider);
258	update_user_meta($user_id, 'king_addons_social_provider_id', $sanitized_data['provider_id']);
259	if (!empty($sanitized_data['picture'])) {
260	update_user_meta($user_id, 'king_addons_social_picture', $sanitized_data['picture']);
261	}
262
263	// Log in the new user
264	wp_set_current_user($user_id);
265	wp_set_auth_cookie($user_id);
266
267	// Send welcome email
268	wp_new_user_notification($user_id, null, 'user');
269	}
270
271	return [
272	'success' => true,
273	'redirect' => home_url()
274	];
275	}
276
277	/**
278	* Generate unique username
279	*/
280	private static function generate_username($base_name)
281	{
282	$username = sanitize_user($base_name);
283	$username = preg_replace('/[^a-zA-Z0-9._-]/', '', $username);
284
285	if (empty($username)) {
286	$username = 'user';
287	}
288
289	$original_username = $username;
290	$counter = 1;
291
292	while (username_exists($username)) {
293	$username = $original_username . $counter;
294	$counter++;
295	}
296
297	return $username;
298	}
299
300	/**
301	* Get widget settings from POST data
302	*/
303	private static function get_widget_settings($widget_id)
304	{
305	// This would be enhanced to get actual widget settings
306	// For now, return settings from POST data
307	return [
308	'google_client_id' => sanitize_text_field($_POST['google_client_id'] ?? ''),
309	'google_client_secret' => sanitize_text_field($_POST['google_client_secret'] ?? ''),
310	'facebook_app_id' => sanitize_text_field($_POST['facebook_app_id'] ?? ''),
311	'facebook_app_secret' => sanitize_text_field($_POST['facebook_app_secret'] ?? ''),
312	];
313	}
314
315	/**
316	* Handle Google OAuth callback (for future server-side flow)
317	*/
318	public static function handle_google_callback()
319	{
320	// Placeholder for server-side OAuth flow
321	wp_die('Google OAuth callback - not implemented yet');
322	}
323
324	/**
325	* Handle Facebook OAuth callback (for future server-side flow)
326	*/
327	public static function handle_facebook_callback()
328	{
329	// Placeholder for server-side OAuth flow
330	wp_die('Facebook OAuth callback - not implemented yet');
331	}
332	}