← All changes | includes/widgets/Login_Register_Form/Social_Login_Handler.php +353 -0 51.1.2 → 51.1.86 View file →

		@@ -1,0 +1,353 @@
	1	+<?php
	2	+
	3	+namespace King_Addons\Widgets\Login_Register_Form;
	4	+
	5	+if (!defined('ABSPATH')) {
	6	+ exit; // Exit if accessed directly.
	7	+}
	8	+
	9	+// Include Security Manager
	10	+require_once KING_ADDONS_PATH . 'includes/widgets/Login_Register_Form/Security_Manager.php';
	11	+require_once KING_ADDONS_PATH . 'includes/widgets/Login_Register_Form/Widget_Settings_Resolver.php';
	12	+
	13	+/**
	14	+ * Social Login Handler for Login Register Form widget
	15	+ */
	16	+class Social_Login_Handler
	17	+{
	18	+ /**
	19	+ * Initialize social login handlers
	20	+ */
	21	+ public static function init()
	22	+ {
	23	+ // Register AJAX handlers for social login callbacks
	24	+ add_action('wp_ajax_nopriv_king_addons_google_callback', [__CLASS__, 'handle_google_callback']);
	25	+ add_action('wp_ajax_king_addons_google_callback', [__CLASS__, 'handle_google_callback']);
	26	+ add_action('wp_ajax_nopriv_king_addons_facebook_callback', [__CLASS__, 'handle_facebook_callback']);
	27	+ add_action('wp_ajax_king_addons_facebook_callback', [__CLASS__, 'handle_facebook_callback']);
	28	+
	29	+ // Frontend AJAX handlers
	30	+ add_action('wp_ajax_nopriv_king_addons_google_login', [__CLASS__, 'handle_google_login']);
	31	+ add_action('wp_ajax_king_addons_google_login', [__CLASS__, 'handle_google_login']);
	32	+ add_action('wp_ajax_nopriv_king_addons_facebook_login', [__CLASS__, 'handle_facebook_login']);
	33	+ add_action('wp_ajax_king_addons_facebook_login', [__CLASS__, 'handle_facebook_login']);
	34	+ }
	35	+
	36	+ /**
	37	+ * Handle Google OAuth login
	38	+ */
	39	+ public static function handle_google_login()
	40	+ {
	41	+ // Only allow social login for Pro users
	42	+ if (!king_addons_freemius()->can_use_premium_code__premium_only()) {
	43	+ wp_send_json_error(['message' => esc_html__('Social login is only available in King Addons Pro. Please upgrade to use this feature.', 'king-addons')]);
	44	+ }
	45	+
	46	+ // Verify nonce
	47	+ if (!wp_verify_nonce($_POST['nonce'], 'king_addons_social_login_action')) {
	48	+ wp_send_json_error(['message' => esc_html__('Security check failed.', 'king-addons')]);
	49	+ }
	50	+
	51	+ $google_token = sanitize_text_field($_POST['google_token'] ?? '');
	52	+ $widget_id = sanitize_text_field($_POST['widget_id'] ?? '');
	53	+ $post_id = absint($_POST['post_id'] ?? 0);
	54	+ $widget_settings = Widget_Settings_Resolver::resolve($post_id, $widget_id);
	55	+
	56	+ if (empty($google_token)) {
	57	+ wp_send_json_error(['message' => esc_html__('Google token is required.', 'king-addons')]);
	58	+ }
	59	+
	60	+ $google_client_id = $widget_settings['google_client_id'] ?? '';
	61	+ if (empty($google_client_id)) {
	62	+ wp_send_json_error(['message' => esc_html__('Google Client ID not configured.', 'king-addons')]);
	63	+ }
	64	+
	65	+ // Verify Google token
	66	+ $user_data = self::verify_google_token($google_token, $google_client_id);
	67	+ if (!$user_data) {
	68	+ wp_send_json_error(['message' => esc_html__('Google authentication failed.', 'king-addons')]);
	69	+ }
	70	+
	71	+ // Process social login
	72	+ $result = self::process_social_login($user_data, 'google');
	73	+
	74	+ if ($result['success']) {
	75	+ wp_send_json_success([
	76	+ 'message' => esc_html__('Google login successful!', 'king-addons'),
	77	+ 'redirect' => $result['redirect']
	78	+ ]);
	79	+ } else {
	80	+ wp_send_json_error(['message' => $result['message']]);
	81	+ }
	82	+ }
	83	+
	84	+ /**
	85	+ * Handle Facebook OAuth login
	86	+ */
	87	+ public static function handle_facebook_login()
	88	+ {
	89	+ // Only allow social login for Pro users
	90	+ if (!king_addons_freemius()->can_use_premium_code__premium_only()) {
	91	+ wp_send_json_error(['message' => esc_html__('Social login is only available in King Addons Pro. Please upgrade to use this feature.', 'king-addons')]);
	92	+ }
	93	+
	94	+ // Verify nonce
	95	+ if (!wp_verify_nonce($_POST['nonce'], 'king_addons_social_login_action')) {
	96	+ wp_send_json_error(['message' => esc_html__('Security check failed.', 'king-addons')]);
	97	+ }
	98	+
	99	+ $facebook_token = sanitize_text_field($_POST['facebook_token'] ?? '');
	100	+ $widget_id = sanitize_text_field($_POST['widget_id'] ?? '');
	101	+ $post_id = absint($_POST['post_id'] ?? 0);
	102	+ $widget_settings = Widget_Settings_Resolver::resolve($post_id, $widget_id);
	103	+
	104	+ if (empty($facebook_token)) {
	105	+ wp_send_json_error(['message' => esc_html__('Facebook token is required.', 'king-addons')]);
	106	+ }
	107	+
	108	+ $facebook_app_id = $widget_settings['facebook_app_id'] ?? '';
	109	+ $facebook_app_secret = $widget_settings['facebook_app_secret'] ?? '';
	110	+
	111	+ if (empty($facebook_app_id) || empty($facebook_app_secret)) {
	112	+ wp_send_json_error(['message' => esc_html__('Facebook App credentials not configured.', 'king-addons')]);
	113	+ }
	114	+
	115	+ // Verify Facebook token
	116	+ $user_data = self::verify_facebook_token($facebook_token, $facebook_app_id, $facebook_app_secret);
	117	+ if (!$user_data) {
	118	+ wp_send_json_error(['message' => esc_html__('Facebook authentication failed.', 'king-addons')]);
	119	+ }
	120	+
	121	+ // Process social login
	122	+ $result = self::process_social_login($user_data, 'facebook');
	123	+
	124	+ if ($result['success']) {
	125	+ wp_send_json_success([
	126	+ 'message' => esc_html__('Facebook login successful!', 'king-addons'),
	127	+ 'redirect' => $result['redirect']
	128	+ ]);
	129	+ } else {
	130	+ wp_send_json_error(['message' => $result['message']]);
	131	+ }
	132	+ }
	133	+
	134	+ /**
	135	+ * Verify Google OAuth token
	136	+ */
	137	+ private static function verify_google_token($token, $client_id)
	138	+ {
	139	+ // Security fix: Validate token format
	140	+ if (empty($token) || strlen($token) > 2048) {
	141	+ return false;
	142	+ }
	143	+
	144	+ $url = 'https://oauth2.googleapis.com/tokeninfo?id_token=' . urlencode($token);
	145	+
	146	+ $response = wp_remote_get($url, [
	147	+ 'timeout' => 15,
	148	+ 'user-agent' => 'King Addons Social Login/1.0'
	149	+ ]);
	150	+
	151	+ if (is_wp_error($response)) {
	152	+ // error_log('King Addons Social Login: Google token verification failed: ' . $response->get_error_message());
	153	+ return false;
	154	+ }
	155	+
	156	+ $body = wp_remote_retrieve_body($response);
	157	+ $data = json_decode($body, true);
	158	+
	159	+ // Verify the token is for our app
	160	+ if (!isset($data['aud']) || $data['aud'] !== $client_id) {
	161	+ return false;
	162	+ }
	163	+
	164	+ // Return user data
	165	+ return [
	166	+ 'email' => $data['email'] ?? '',
	167	+ 'first_name' => $data['given_name'] ?? '',
	168	+ 'last_name' => $data['family_name'] ?? '',
	169	+ 'name' => $data['name'] ?? '',
	170	+ 'picture' => $data['picture'] ?? '',
	171	+ 'provider_id' => $data['sub'] ?? '',
	172	+ ];
	173	+ }
	174	+
	175	+ /**
	176	+ * Verify Facebook OAuth token
	177	+ */
	178	+ private static function verify_facebook_token($token, $app_id, $app_secret)
	179	+ {
	180	+ // Security fix: Validate inputs
	181	+ if (empty($token) || empty($app_id) || empty($app_secret) || strlen($token) > 1024) {
	182	+ return false;
	183	+ }
	184	+
	185	+ // First, verify the token
	186	+ $verify_url = "https://graph.facebook.com/debug_token?" . http_build_query([
	187	+ 'input_token' => $token,
	188	+ 'access_token' => $app_id . '|' . $app_secret
	189	+ ]);
	190	+
	191	+ $response = wp_remote_get($verify_url, [
	192	+ 'timeout' => 15,
	193	+ 'user-agent' => 'King Addons Social Login/1.0'
	194	+ ]);
	195	+
	196	+ if (is_wp_error($response)) {
	197	+ // error_log('King Addons Social Login: Facebook token verification failed: ' . $response->get_error_message());
	198	+ return false;
	199	+ }
	200	+
	201	+ $verify_data = json_decode(wp_remote_retrieve_body($response), true);
	202	+ if (!isset($verify_data['data']['is_valid']) || !$verify_data['data']['is_valid']) {
	203	+ return false;
	204	+ }
	205	+
	206	+ // Get user data
	207	+ $user_url = "https://graph.facebook.com/me?" . http_build_query([
	208	+ 'fields' => 'id,name,email,first_name,last_name,picture',
	209	+ 'access_token' => $token
	210	+ ]);
	211	+
	212	+ $user_response = wp_remote_get($user_url, [
	213	+ 'timeout' => 15,
	214	+ 'user-agent' => 'King Addons Social Login/1.0'
	215	+ ]);
	216	+
	217	+ if (is_wp_error($user_response)) {
	218	+ // error_log('King Addons Social Login: Facebook user data request failed: ' . $user_response->get_error_message());
	219	+ return false;
	220	+ }
	221	+
	222	+ $user_data = json_decode(wp_remote_retrieve_body($user_response), true);
	223	+
	224	+ return [
	225	+ 'email' => $user_data['email'] ?? '',
	226	+ 'first_name' => $user_data['first_name'] ?? '',
	227	+ 'last_name' => $user_data['last_name'] ?? '',
	228	+ 'name' => $user_data['name'] ?? '',
	229	+ 'picture' => $user_data['picture']['data']['url'] ?? '',
	230	+ 'provider_id' => $user_data['id'] ?? '',
	231	+ ];
	232	+ }
	233	+
	234	+ /**
	235	+ * Process social login (create user or login existing)
	236	+ */
	237	+ private static function process_social_login($user_data, $provider)
	238	+ {
	239	+ // Sanitize social login data for security
	240	+ $sanitized_data = Security_Manager::sanitize_social_data($user_data, $provider);
	241	+
	242	+ $email = $sanitized_data['email'];
	243	+ if (empty($email)) {
	244	+ return [
	245	+ 'success' => false,
	246	+ 'message' => esc_html__('Email is required for social login.', 'king-addons')
	247	+ ];
	248	+ }
	249	+
	250	+ // Additional security checks for social login
	251	+ if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
	252	+ // error_log("King Addons Security: Invalid email from {$provider}: {$email}");
	253	+ return [
	254	+ 'success' => false,
	255	+ 'message' => esc_html__('Invalid email address from social provider.', 'king-addons')
	256	+ ];
	257	+ }
	258	+
	259	+ // Check if user exists
	260	+ $user = get_user_by('email', $email);
	261	+
	262	+ if ($user) {
	263	+ // User exists, log them in
	264	+ wp_set_current_user($user->ID);
	265	+ wp_set_auth_cookie($user->ID);
	266	+
	267	+ // Update social provider info with sanitized data
	268	+ update_user_meta($user->ID, 'king_addons_social_provider', sanitize_text_field($provider));
	269	+ update_user_meta($user->ID, 'king_addons_social_provider_id', sanitize_text_field($sanitized_data['provider_id']));
	270	+
	271	+ } else {
	272	+ // Create new user with sanitized data
	273	+ $username = self::generate_username($sanitized_data['name'] ?: $sanitized_data['email']);
	274	+ $password = wp_generate_password(16, true); // Stronger password
	275	+
	276	+ $user_id = wp_create_user($username, $password, $email);
	277	+ if (is_wp_error($user_id)) {
	278	+ return [
	279	+ 'success' => false,
	280	+ 'message' => esc_html__('Unable to create user account.', 'king-addons')
	281	+ ];
	282	+ }
	283	+
	284	+ // Update user meta with sanitized data
	285	+ if (!empty($sanitized_data['first_name'])) {
	286	+ update_user_meta($user_id, 'first_name', $sanitized_data['first_name']);
	287	+ }
	288	+ if (!empty($sanitized_data['last_name'])) {
	289	+ update_user_meta($user_id, 'last_name', $sanitized_data['last_name']);
	290	+ }
	291	+
	292	+ // Store social provider info
	293	+ update_user_meta($user_id, 'king_addons_social_provider', $provider);
	294	+ update_user_meta($user_id, 'king_addons_social_provider_id', $sanitized_data['provider_id']);
	295	+ if (!empty($sanitized_data['picture'])) {
	296	+ update_user_meta($user_id, 'king_addons_social_picture', $sanitized_data['picture']);
	297	+ }
	298	+
	299	+ // Log in the new user
	300	+ wp_set_current_user($user_id);
	301	+ wp_set_auth_cookie($user_id);
	302	+
	303	+ // Send welcome email
	304	+ wp_new_user_notification($user_id, null, 'user');
	305	+ }
	306	+
	307	+ return [
	308	+ 'success' => true,
	309	+ 'redirect' => home_url()
	310	+ ];
	311	+ }
	312	+
	313	+ /**
	314	+ * Generate unique username
	315	+ */
	316	+ private static function generate_username($base_name)
	317	+ {
	318	+ $username = sanitize_user($base_name);
	319	+ $username = preg_replace('/[^a-zA-Z0-9._-]/', '', $username);
	320	+
	321	+ if (empty($username)) {
	322	+ $username = 'user';
	323	+ }
	324	+
	325	+ $original_username = $username;
	326	+ $counter = 1;
	327	+
	328	+ while (username_exists($username)) {
	329	+ $username = $original_username . $counter;
	330	+ $counter++;
	331	+ }
	332	+
	333	+ return $username;
	334	+ }
	335	+
	336	+ /**
	337	+ * Handle Google OAuth callback (for future server-side flow)
	338	+ */
	339	+ public static function handle_google_callback()
	340	+ {
	341	+ // Placeholder for server-side OAuth flow
	342	+ wp_die('Google OAuth callback - not implemented yet');
	343	+ }
	344	+
	345	+ /**
	346	+ * Handle Facebook OAuth callback (for future server-side flow)
	347	+ */
	348	+ public static function handle_facebook_callback()
	349	+ {
	350	+ // Placeholder for server-side OAuth flow
	351	+ wp_die('Facebook OAuth callback - not implemented yet');
	352	+ }
	353	+}