king-addons / includes / widgets / Login_Register_Form / Social_Login_Handler.php

Social_Login_Handler.php in King Addons for Elementor – 80+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce, Mega Menu, Popup Builder 51.1.37, at includes/widgets/Login_Register_Form/Social_Login_Handler.php

363 lines 13.3 KB

Raw Download Zip

1	<?php
2
3	namespace King_Addons\Widgets\Login_Register_Form;
4
5	if (!defined('ABSPATH')) {
6	exit; // Exit if accessed directly.
7	}
8
9	// Include Security Manager
10	require_once KING_ADDONS_PATH . 'includes/widgets/Login_Register_Form/Security_Manager.php';
11
12	/**
13	* Social Login Handler for Login Register Form widget
14	*/
15	class Social_Login_Handler
16	{
17	/**
18	* Initialize social login handlers
19	*/
20	public static function init()
21	{
22	// Register AJAX handlers for social login callbacks
23	add_action('wp_ajax_nopriv_king_addons_google_callback', [__CLASS__, 'handle_google_callback']);
24	add_action('wp_ajax_king_addons_google_callback', [__CLASS__, 'handle_google_callback']);
25	add_action('wp_ajax_nopriv_king_addons_facebook_callback', [__CLASS__, 'handle_facebook_callback']);
26	add_action('wp_ajax_king_addons_facebook_callback', [__CLASS__, 'handle_facebook_callback']);
27
28	// Frontend AJAX handlers
29	add_action('wp_ajax_nopriv_king_addons_google_login', [__CLASS__, 'handle_google_login']);
30	add_action('wp_ajax_king_addons_google_login', [__CLASS__, 'handle_google_login']);
31	add_action('wp_ajax_nopriv_king_addons_facebook_login', [__CLASS__, 'handle_facebook_login']);
32	add_action('wp_ajax_king_addons_facebook_login', [__CLASS__, 'handle_facebook_login']);
33	}
34
35	/**
36	* Handle Google OAuth login
37	*/
38	public static function handle_google_login()
39	{
40	// Only allow social login for Pro users
41	if (!king_addons_freemius()->can_use_premium_code__premium_only()) {
42	wp_send_json_error(['message' => esc_html__('Social login is only available in King Addons Pro. Please upgrade to use this feature.', 'king-addons')]);
43	}
44
45	// Verify nonce
46	if (!wp_verify_nonce($_POST['nonce'], 'king_addons_social_login_action')) {
47	wp_send_json_error(['message' => esc_html__('Security check failed.', 'king-addons')]);
48	}
49
50	$google_token = sanitize_text_field($_POST['google_token'] ?? '');
51	$widget_settings = self::get_widget_settings($_POST['widget_id'] ?? '');
52
53	if (empty($google_token)) {
54	wp_send_json_error(['message' => esc_html__('Google token is required.', 'king-addons')]);
55	}
56
57	$google_client_id = $widget_settings['google_client_id'] ?? '';
58	if (empty($google_client_id)) {
59	wp_send_json_error(['message' => esc_html__('Google Client ID not configured.', 'king-addons')]);
60	}
61
62	// Verify Google token
63	$user_data = self::verify_google_token($google_token, $google_client_id);
64	if (!$user_data) {
65	wp_send_json_error(['message' => esc_html__('Google authentication failed.', 'king-addons')]);
66	}
67
68	// Process social login
69	$result = self::process_social_login($user_data, 'google');
70
71	if ($result['success']) {
72	wp_send_json_success([
73	'message' => esc_html__('Google login successful!', 'king-addons'),
74	'redirect' => $result['redirect']
75	]);
76	} else {
77	wp_send_json_error(['message' => $result['message']]);
78	}
79	}
80
81	/**
82	* Handle Facebook OAuth login
83	*/
84	public static function handle_facebook_login()
85	{
86	// Only allow social login for Pro users
87	if (!king_addons_freemius()->can_use_premium_code__premium_only()) {
88	wp_send_json_error(['message' => esc_html__('Social login is only available in King Addons Pro. Please upgrade to use this feature.', 'king-addons')]);
89	}
90
91	// Verify nonce
92	if (!wp_verify_nonce($_POST['nonce'], 'king_addons_social_login_action')) {
93	wp_send_json_error(['message' => esc_html__('Security check failed.', 'king-addons')]);
94	}
95
96	$facebook_token = sanitize_text_field($_POST['facebook_token'] ?? '');
97	$widget_settings = self::get_widget_settings($_POST['widget_id'] ?? '');
98
99	if (empty($facebook_token)) {
100	wp_send_json_error(['message' => esc_html__('Facebook token is required.', 'king-addons')]);
101	}
102
103	$facebook_app_id = $widget_settings['facebook_app_id'] ?? '';
104	$facebook_app_secret = $widget_settings['facebook_app_secret'] ?? '';
105
106	if (empty($facebook_app_id) \|\| empty($facebook_app_secret)) {
107	wp_send_json_error(['message' => esc_html__('Facebook App credentials not configured.', 'king-addons')]);
108	}
109
110	// Verify Facebook token
111	$user_data = self::verify_facebook_token($facebook_token, $facebook_app_id, $facebook_app_secret);
112	if (!$user_data) {
113	wp_send_json_error(['message' => esc_html__('Facebook authentication failed.', 'king-addons')]);
114	}
115
116	// Process social login
117	$result = self::process_social_login($user_data, 'facebook');
118
119	if ($result['success']) {
120	wp_send_json_success([
121	'message' => esc_html__('Facebook login successful!', 'king-addons'),
122	'redirect' => $result['redirect']
123	]);
124	} else {
125	wp_send_json_error(['message' => $result['message']]);
126	}
127	}
128
129	/**
130	* Verify Google OAuth token
131	*/
132	private static function verify_google_token($token, $client_id)
133	{
134	// Security fix: Validate token format
135	if (empty($token) \|\| strlen($token) > 2048) {
136	return false;
137	}
138
139	$url = 'https://oauth2.googleapis.com/tokeninfo?id_token=' . urlencode($token);
140
141	$response = wp_remote_get($url, [
142	'timeout' => 15,
143	'user-agent' => 'King Addons Social Login/1.0'
144	]);
145
146	if (is_wp_error($response)) {
147	error_log('King Addons Social Login: Google token verification failed: ' . $response->get_error_message());
148	return false;
149	}
150
151	$body = wp_remote_retrieve_body($response);
152	$data = json_decode($body, true);
153
154	// Verify the token is for our app
155	if (!isset($data['aud']) \|\| $data['aud'] !== $client_id) {
156	return false;
157	}
158
159	// Return user data
160	return [
161	'email' => $data['email'] ?? '',
162	'first_name' => $data['given_name'] ?? '',
163	'last_name' => $data['family_name'] ?? '',
164	'name' => $data['name'] ?? '',
165	'picture' => $data['picture'] ?? '',
166	'provider_id' => $data['sub'] ?? '',
167	];
168	}
169
170	/**
171	* Verify Facebook OAuth token
172	*/
173	private static function verify_facebook_token($token, $app_id, $app_secret)
174	{
175	// Security fix: Validate inputs
176	if (empty($token) \|\| empty($app_id) \|\| empty($app_secret) \|\| strlen($token) > 1024) {
177	return false;
178	}
179
180	// First, verify the token
181	$verify_url = "https://graph.facebook.com/debug_token?" . http_build_query([
182	'input_token' => $token,
183	'access_token' => $app_id . '\|' . $app_secret
184	]);
185
186	$response = wp_remote_get($verify_url, [
187	'timeout' => 15,
188	'user-agent' => 'King Addons Social Login/1.0'
189	]);
190
191	if (is_wp_error($response)) {
192	error_log('King Addons Social Login: Facebook token verification failed: ' . $response->get_error_message());
193	return false;
194	}
195
196	$verify_data = json_decode(wp_remote_retrieve_body($response), true);
197	if (!isset($verify_data['data']['is_valid']) \|\| !$verify_data['data']['is_valid']) {
198	return false;
199	}
200
201	// Get user data
202	$user_url = "https://graph.facebook.com/me?" . http_build_query([
203	'fields' => 'id,name,email,first_name,last_name,picture',
204	'access_token' => $token
205	]);
206
207	$user_response = wp_remote_get($user_url, [
208	'timeout' => 15,
209	'user-agent' => 'King Addons Social Login/1.0'
210	]);
211
212	if (is_wp_error($user_response)) {
213	error_log('King Addons Social Login: Facebook user data request failed: ' . $user_response->get_error_message());
214	return false;
215	}
216
217	$user_data = json_decode(wp_remote_retrieve_body($user_response), true);
218
219	return [
220	'email' => $user_data['email'] ?? '',
221	'first_name' => $user_data['first_name'] ?? '',
222	'last_name' => $user_data['last_name'] ?? '',
223	'name' => $user_data['name'] ?? '',
224	'picture' => $user_data['picture']['data']['url'] ?? '',
225	'provider_id' => $user_data['id'] ?? '',
226	];
227	}
228
229	/**
230	* Process social login (create user or login existing)
231	*/
232	private static function process_social_login($user_data, $provider)
233	{
234	// Sanitize social login data for security
235	$sanitized_data = Security_Manager::sanitize_social_data($user_data, $provider);
236
237	$email = $sanitized_data['email'];
238	if (empty($email)) {
239	return [
240	'success' => false,
241	'message' => esc_html__('Email is required for social login.', 'king-addons')
242	];
243	}
244
245	// Additional security checks for social login
246	if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
247	error_log("King Addons Security: Invalid email from {$provider}: {$email}");
248	return [
249	'success' => false,
250	'message' => esc_html__('Invalid email address from social provider.', 'king-addons')
251	];
252	}
253
254	// Check if user exists
255	$user = get_user_by('email', $email);
256
257	if ($user) {
258	// User exists, log them in
259	wp_set_current_user($user->ID);
260	wp_set_auth_cookie($user->ID);
261
262	// Update social provider info with sanitized data
263	update_user_meta($user->ID, 'king_addons_social_provider', sanitize_text_field($provider));
264	update_user_meta($user->ID, 'king_addons_social_provider_id', sanitize_text_field($sanitized_data['provider_id']));
265
266	} else {
267	// Create new user with sanitized data
268	$username = self::generate_username($sanitized_data['name'] ?: $sanitized_data['email']);
269	$password = wp_generate_password(16, true); // Stronger password
270
271	$user_id = wp_create_user($username, $password, $email);
272	if (is_wp_error($user_id)) {
273	return [
274	'success' => false,
275	'message' => esc_html__('Unable to create user account.', 'king-addons')
276	];
277	}
278
279	// Update user meta with sanitized data
280	if (!empty($sanitized_data['first_name'])) {
281	update_user_meta($user_id, 'first_name', $sanitized_data['first_name']);
282	}
283	if (!empty($sanitized_data['last_name'])) {
284	update_user_meta($user_id, 'last_name', $sanitized_data['last_name']);
285	}
286
287	// Store social provider info
288	update_user_meta($user_id, 'king_addons_social_provider', $provider);
289	update_user_meta($user_id, 'king_addons_social_provider_id', $sanitized_data['provider_id']);
290	if (!empty($sanitized_data['picture'])) {
291	update_user_meta($user_id, 'king_addons_social_picture', $sanitized_data['picture']);
292	}
293
294	// Log in the new user
295	wp_set_current_user($user_id);
296	wp_set_auth_cookie($user_id);
297
298	// Send welcome email
299	wp_new_user_notification($user_id, null, 'user');
300	}
301
302	return [
303	'success' => true,
304	'redirect' => home_url()
305	];
306	}
307
308	/**
309	* Generate unique username
310	*/
311	private static function generate_username($base_name)
312	{
313	$username = sanitize_user($base_name);
314	$username = preg_replace('/[^a-zA-Z0-9._-]/', '', $username);
315
316	if (empty($username)) {
317	$username = 'user';
318	}
319
320	$original_username = $username;
321	$counter = 1;
322
323	while (username_exists($username)) {
324	$username = $original_username . $counter;
325	$counter++;
326	}
327
328	return $username;
329	}
330
331	/**
332	* Get widget settings from POST data
333	*/
334	private static function get_widget_settings($widget_id)
335	{
336	// This would be enhanced to get actual widget settings
337	// For now, return settings from POST data
338	return [
339	'google_client_id' => sanitize_text_field($_POST['google_client_id'] ?? ''),
340	'google_client_secret' => sanitize_text_field($_POST['google_client_secret'] ?? ''),
341	'facebook_app_id' => sanitize_text_field($_POST['facebook_app_id'] ?? ''),
342	'facebook_app_secret' => sanitize_text_field($_POST['facebook_app_secret'] ?? ''),
343	];
344	}
345
346	/**
347	* Handle Google OAuth callback (for future server-side flow)
348	*/
349	public static function handle_google_callback()
350	{
351	// Placeholder for server-side OAuth flow
352	wp_die('Google OAuth callback - not implemented yet');
353	}
354
355	/**
356	* Handle Facebook OAuth callback (for future server-side flow)
357	*/
358	public static function handle_facebook_callback()
359	{
360	// Placeholder for server-side OAuth flow
361	wp_die('Facebook OAuth callback - not implemented yet');
362	}
363	}