king-addons / includes / widgets / Login_Register_Form / Social_Login_Handler.php

Social_Login_Handler.php in King Addons for Elementor – 80+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce, Mega Menu, Popup Builder 51.1.83, at includes/widgets/Login_Register_Form/Social_Login_Handler.php

353 lines 13.0 KB

Raw Download Zip

1	<?php
2
3	namespace King_Addons\Widgets\Login_Register_Form;
4
5	if (!defined('ABSPATH')) {
6	exit; // Exit if accessed directly.
7	}
8
9	// Include Security Manager
10	require_once KING_ADDONS_PATH . 'includes/widgets/Login_Register_Form/Security_Manager.php';
11	require_once KING_ADDONS_PATH . 'includes/widgets/Login_Register_Form/Widget_Settings_Resolver.php';
12
13	/**
14	* Social Login Handler for Login Register Form widget
15	*/
16	class Social_Login_Handler
17	{
18	/**
19	* Initialize social login handlers
20	*/
21	public static function init()
22	{
23	// Register AJAX handlers for social login callbacks
24	add_action('wp_ajax_nopriv_king_addons_google_callback', [__CLASS__, 'handle_google_callback']);
25	add_action('wp_ajax_king_addons_google_callback', [__CLASS__, 'handle_google_callback']);
26	add_action('wp_ajax_nopriv_king_addons_facebook_callback', [__CLASS__, 'handle_facebook_callback']);
27	add_action('wp_ajax_king_addons_facebook_callback', [__CLASS__, 'handle_facebook_callback']);
28
29	// Frontend AJAX handlers
30	add_action('wp_ajax_nopriv_king_addons_google_login', [__CLASS__, 'handle_google_login']);
31	add_action('wp_ajax_king_addons_google_login', [__CLASS__, 'handle_google_login']);
32	add_action('wp_ajax_nopriv_king_addons_facebook_login', [__CLASS__, 'handle_facebook_login']);
33	add_action('wp_ajax_king_addons_facebook_login', [__CLASS__, 'handle_facebook_login']);
34	}
35
36	/**
37	* Handle Google OAuth login
38	*/
39	public static function handle_google_login()
40	{
41	// Only allow social login for Pro users
42	if (!king_addons_freemius()->can_use_premium_code__premium_only()) {
43	wp_send_json_error(['message' => esc_html__('Social login is only available in King Addons Pro. Please upgrade to use this feature.', 'king-addons')]);
44	}
45
46	// Verify nonce
47	if (!wp_verify_nonce($_POST['nonce'], 'king_addons_social_login_action')) {
48	wp_send_json_error(['message' => esc_html__('Security check failed.', 'king-addons')]);
49	}
50
51	$google_token = sanitize_text_field($_POST['google_token'] ?? '');
52	$widget_id = sanitize_text_field($_POST['widget_id'] ?? '');
53	$post_id = absint($_POST['post_id'] ?? 0);
54	$widget_settings = Widget_Settings_Resolver::resolve($post_id, $widget_id);
55
56	if (empty($google_token)) {
57	wp_send_json_error(['message' => esc_html__('Google token is required.', 'king-addons')]);
58	}
59
60	$google_client_id = $widget_settings['google_client_id'] ?? '';
61	if (empty($google_client_id)) {
62	wp_send_json_error(['message' => esc_html__('Google Client ID not configured.', 'king-addons')]);
63	}
64
65	// Verify Google token
66	$user_data = self::verify_google_token($google_token, $google_client_id);
67	if (!$user_data) {
68	wp_send_json_error(['message' => esc_html__('Google authentication failed.', 'king-addons')]);
69	}
70
71	// Process social login
72	$result = self::process_social_login($user_data, 'google');
73
74	if ($result['success']) {
75	wp_send_json_success([
76	'message' => esc_html__('Google login successful!', 'king-addons'),
77	'redirect' => $result['redirect']
78	]);
79	} else {
80	wp_send_json_error(['message' => $result['message']]);
81	}
82	}
83
84	/**
85	* Handle Facebook OAuth login
86	*/
87	public static function handle_facebook_login()
88	{
89	// Only allow social login for Pro users
90	if (!king_addons_freemius()->can_use_premium_code__premium_only()) {
91	wp_send_json_error(['message' => esc_html__('Social login is only available in King Addons Pro. Please upgrade to use this feature.', 'king-addons')]);
92	}
93
94	// Verify nonce
95	if (!wp_verify_nonce($_POST['nonce'], 'king_addons_social_login_action')) {
96	wp_send_json_error(['message' => esc_html__('Security check failed.', 'king-addons')]);
97	}
98
99	$facebook_token = sanitize_text_field($_POST['facebook_token'] ?? '');
100	$widget_id = sanitize_text_field($_POST['widget_id'] ?? '');
101	$post_id = absint($_POST['post_id'] ?? 0);
102	$widget_settings = Widget_Settings_Resolver::resolve($post_id, $widget_id);
103
104	if (empty($facebook_token)) {
105	wp_send_json_error(['message' => esc_html__('Facebook token is required.', 'king-addons')]);
106	}
107
108	$facebook_app_id = $widget_settings['facebook_app_id'] ?? '';
109	$facebook_app_secret = $widget_settings['facebook_app_secret'] ?? '';
110
111	if (empty($facebook_app_id) \|\| empty($facebook_app_secret)) {
112	wp_send_json_error(['message' => esc_html__('Facebook App credentials not configured.', 'king-addons')]);
113	}
114
115	// Verify Facebook token
116	$user_data = self::verify_facebook_token($facebook_token, $facebook_app_id, $facebook_app_secret);
117	if (!$user_data) {
118	wp_send_json_error(['message' => esc_html__('Facebook authentication failed.', 'king-addons')]);
119	}
120
121	// Process social login
122	$result = self::process_social_login($user_data, 'facebook');
123
124	if ($result['success']) {
125	wp_send_json_success([
126	'message' => esc_html__('Facebook login successful!', 'king-addons'),
127	'redirect' => $result['redirect']
128	]);
129	} else {
130	wp_send_json_error(['message' => $result['message']]);
131	}
132	}
133
134	/**
135	* Verify Google OAuth token
136	*/
137	private static function verify_google_token($token, $client_id)
138	{
139	// Security fix: Validate token format
140	if (empty($token) \|\| strlen($token) > 2048) {
141	return false;
142	}
143
144	$url = 'https://oauth2.googleapis.com/tokeninfo?id_token=' . urlencode($token);
145
146	$response = wp_remote_get($url, [
147	'timeout' => 15,
148	'user-agent' => 'King Addons Social Login/1.0'
149	]);
150
151	if (is_wp_error($response)) {
152	// error_log('King Addons Social Login: Google token verification failed: ' . $response->get_error_message());
153	return false;
154	}
155
156	$body = wp_remote_retrieve_body($response);
157	$data = json_decode($body, true);
158
159	// Verify the token is for our app
160	if (!isset($data['aud']) \|\| $data['aud'] !== $client_id) {
161	return false;
162	}
163
164	// Return user data
165	return [
166	'email' => $data['email'] ?? '',
167	'first_name' => $data['given_name'] ?? '',
168	'last_name' => $data['family_name'] ?? '',
169	'name' => $data['name'] ?? '',
170	'picture' => $data['picture'] ?? '',
171	'provider_id' => $data['sub'] ?? '',
172	];
173	}
174
175	/**
176	* Verify Facebook OAuth token
177	*/
178	private static function verify_facebook_token($token, $app_id, $app_secret)
179	{
180	// Security fix: Validate inputs
181	if (empty($token) \|\| empty($app_id) \|\| empty($app_secret) \|\| strlen($token) > 1024) {
182	return false;
183	}
184
185	// First, verify the token
186	$verify_url = "https://graph.facebook.com/debug_token?" . http_build_query([
187	'input_token' => $token,
188	'access_token' => $app_id . '\|' . $app_secret
189	]);
190
191	$response = wp_remote_get($verify_url, [
192	'timeout' => 15,
193	'user-agent' => 'King Addons Social Login/1.0'
194	]);
195
196	if (is_wp_error($response)) {
197	// error_log('King Addons Social Login: Facebook token verification failed: ' . $response->get_error_message());
198	return false;
199	}
200
201	$verify_data = json_decode(wp_remote_retrieve_body($response), true);
202	if (!isset($verify_data['data']['is_valid']) \|\| !$verify_data['data']['is_valid']) {
203	return false;
204	}
205
206	// Get user data
207	$user_url = "https://graph.facebook.com/me?" . http_build_query([
208	'fields' => 'id,name,email,first_name,last_name,picture',
209	'access_token' => $token
210	]);
211
212	$user_response = wp_remote_get($user_url, [
213	'timeout' => 15,
214	'user-agent' => 'King Addons Social Login/1.0'
215	]);
216
217	if (is_wp_error($user_response)) {
218	// error_log('King Addons Social Login: Facebook user data request failed: ' . $user_response->get_error_message());
219	return false;
220	}
221
222	$user_data = json_decode(wp_remote_retrieve_body($user_response), true);
223
224	return [
225	'email' => $user_data['email'] ?? '',
226	'first_name' => $user_data['first_name'] ?? '',
227	'last_name' => $user_data['last_name'] ?? '',
228	'name' => $user_data['name'] ?? '',
229	'picture' => $user_data['picture']['data']['url'] ?? '',
230	'provider_id' => $user_data['id'] ?? '',
231	];
232	}
233
234	/**
235	* Process social login (create user or login existing)
236	*/
237	private static function process_social_login($user_data, $provider)
238	{
239	// Sanitize social login data for security
240	$sanitized_data = Security_Manager::sanitize_social_data($user_data, $provider);
241
242	$email = $sanitized_data['email'];
243	if (empty($email)) {
244	return [
245	'success' => false,
246	'message' => esc_html__('Email is required for social login.', 'king-addons')
247	];
248	}
249
250	// Additional security checks for social login
251	if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
252	// error_log("King Addons Security: Invalid email from {$provider}: {$email}");
253	return [
254	'success' => false,
255	'message' => esc_html__('Invalid email address from social provider.', 'king-addons')
256	];
257	}
258
259	// Check if user exists
260	$user = get_user_by('email', $email);
261
262	if ($user) {
263	// User exists, log them in
264	wp_set_current_user($user->ID);
265	wp_set_auth_cookie($user->ID);
266
267	// Update social provider info with sanitized data
268	update_user_meta($user->ID, 'king_addons_social_provider', sanitize_text_field($provider));
269	update_user_meta($user->ID, 'king_addons_social_provider_id', sanitize_text_field($sanitized_data['provider_id']));
270
271	} else {
272	// Create new user with sanitized data
273	$username = self::generate_username($sanitized_data['name'] ?: $sanitized_data['email']);
274	$password = wp_generate_password(16, true); // Stronger password
275
276	$user_id = wp_create_user($username, $password, $email);
277	if (is_wp_error($user_id)) {
278	return [
279	'success' => false,
280	'message' => esc_html__('Unable to create user account.', 'king-addons')
281	];
282	}
283
284	// Update user meta with sanitized data
285	if (!empty($sanitized_data['first_name'])) {
286	update_user_meta($user_id, 'first_name', $sanitized_data['first_name']);
287	}
288	if (!empty($sanitized_data['last_name'])) {
289	update_user_meta($user_id, 'last_name', $sanitized_data['last_name']);
290	}
291
292	// Store social provider info
293	update_user_meta($user_id, 'king_addons_social_provider', $provider);
294	update_user_meta($user_id, 'king_addons_social_provider_id', $sanitized_data['provider_id']);
295	if (!empty($sanitized_data['picture'])) {
296	update_user_meta($user_id, 'king_addons_social_picture', $sanitized_data['picture']);
297	}
298
299	// Log in the new user
300	wp_set_current_user($user_id);
301	wp_set_auth_cookie($user_id);
302
303	// Send welcome email
304	wp_new_user_notification($user_id, null, 'user');
305	}
306
307	return [
308	'success' => true,
309	'redirect' => home_url()
310	];
311	}
312
313	/**
314	* Generate unique username
315	*/
316	private static function generate_username($base_name)
317	{
318	$username = sanitize_user($base_name);
319	$username = preg_replace('/[^a-zA-Z0-9._-]/', '', $username);
320
321	if (empty($username)) {
322	$username = 'user';
323	}
324
325	$original_username = $username;
326	$counter = 1;
327
328	while (username_exists($username)) {
329	$username = $original_username . $counter;
330	$counter++;
331	}
332
333	return $username;
334	}
335
336	/**
337	* Handle Google OAuth callback (for future server-side flow)
338	*/
339	public static function handle_google_callback()
340	{
341	// Placeholder for server-side OAuth flow
342	wp_die('Google OAuth callback - not implemented yet');
343	}
344
345	/**
346	* Handle Facebook OAuth callback (for future server-side flow)
347	*/
348	public static function handle_facebook_callback()
349	{
350	// Placeholder for server-side OAuth flow
351	wp_die('Facebook OAuth callback - not implemented yet');
352	}
353	}