customer_cabinet_controller.php — Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress 5.6.8

latepoint / lib / controllers / customer_cabinet_controller.php

latepoint / lib / controllers Last commit date

customer_cabinet_controller.php

593 lines

1	<?php
2	/*
3	* Copyright (c) 2023 LatePoint LLC. All rights reserved.
4	*/
5
6	if ( ! defined( 'ABSPATH' ) ) {
7	exit; // Exit if accessed directly.
8	}
9
10
11	if ( ! class_exists( 'OsCustomerCabinetController' ) ) :
12
13
14	class OsCustomerCabinetController extends OsController {
15
16	function __construct() {
17	parent::__construct();
18
19	$this->action_access['customer'] = array_merge(
20	$this->action_access['customer'],
21	[
22	'update',
23	'request_cancellation',
24	'print_booking_info',
25	'print_order_info',
26	'ical_download',
27	'process_reschedule_request',
28	'request_reschedule_calendar',
29	'view_order_summary_in_lightbox',
30	'view_booking_summary_in_lightbox',
31	'scheduling_summary_for_bundle',
32	'reload_booking_tile',
33	]
34	);
35	$this->action_access['public'] = array_merge(
36	$this->action_access['public'],
37	[
38	'logout',
39	'dashboard',
40	'login',
41	'do_login',
42	'password_reset_form',
43	'request_password_reset_token',
44	'change_password',
45	'set_account_password_on_booking_completion',
46	]
47	);
48	$this->views_folder = LATEPOINT_VIEWS_ABSPATH . 'customer_cabinet/';
49	}
50
51
52	public function scheduling_summary_for_bundle() {
53	if ( ! filter_var( $this->params['order_item_id'], FILTER_VALIDATE_INT ) ) {
54	exit();
55	}
56	$order_item = new OsOrderItemModel( $this->params['order_item_id'] );
57	$order = new OsOrderModel( $order_item->order_id );
58
59	if ( $order->is_new_record() \|\| ( $order->customer_id != OsAuthHelper::get_logged_in_customer_id() ) ) {
60	$this->send_json(
61	array(
62	'status' => LATEPOINT_STATUS_ERROR,
63	'message' => __( 'Not Allowed', 'latepoint' ),
64	)
65	);
66	}
67
68	$bundle = $order_item->build_original_object_from_item_data();
69	$this->vars['order_item'] = $order_item;
70	$this->vars['bundle'] = $bundle;
71	$this->format_render( __FUNCTION__ );
72	}
73
74	public function view_order_summary_in_lightbox() {
75	if ( ! filter_var( $this->params['order_id'], FILTER_VALIDATE_INT ) ) {
76	exit();
77	}
78	$order = new OsOrderModel( $this->params['order_id'] );
79
80	if ( $order->is_new_record() \|\| ( $order->customer_id != OsAuthHelper::get_logged_in_customer_id() ) ) {
81	$this->send_json(
82	array(
83	'status' => LATEPOINT_STATUS_ERROR,
84	'message' => __( 'Not Allowed', 'latepoint' ),
85	)
86	);
87	}
88
89	$this->vars['order'] = $order;
90	$this->vars['price_breakdown_rows'] = $order->generate_price_breakdown_rows();
91	$this->format_render( __FUNCTION__ );
92	}
93
94	public function view_booking_summary_in_lightbox() {
95	if ( ! filter_var( $this->params['booking_id'], FILTER_VALIDATE_INT ) ) {
96	exit();
97	}
98	$booking = new OsBookingModel( $this->params['booking_id'] );
99	$order_item = new OsOrderItemModel( $booking->order_item_id );
100	$order = new OsOrderModel( $order_item->order_id );
101
102	if ( $order->is_new_record() \|\| ( $order->customer_id != OsAuthHelper::get_logged_in_customer_id() ) ) {
103	$this->send_json(
104	array(
105	'status' => LATEPOINT_STATUS_ERROR,
106	'message' => __( 'Not Allowed', 'latepoint' ),
107	)
108	);
109	}
110
111	$this->vars['booking'] = $booking;
112	$this->vars['order_item'] = $order_item;
113	$this->vars['order'] = $order;
114	$this->format_render( __FUNCTION__ );
115	}
116
117
118	function print_order_info() {
119	if ( ! filter_var( $this->params['latepoint_order_id'], FILTER_VALIDATE_INT ) ) {
120	exit();
121	}
122	$order_id = $this->params['latepoint_order_id'];
123	if ( empty( $order_id ) ) {
124	return;
125	}
126	$order = new OsOrderModel( $order_id );
127	if ( $order->id && OsAuthHelper::is_customer_logged_in() && ( $order->customer_id == OsAuthHelper::get_logged_in_customer_id() ) ) {
128	$customer = $order->customer;
129	$this->vars['order'] = $order;
130	$this->vars['customer'] = $customer;
131	$this->set_layout( 'print' );
132	$content = $this->format_render_return( __FUNCTION__, [], [], true );
133	echo $content;
134	}
135	}
136
137	function print_booking_info() {
138	if ( ! filter_var( $this->params['latepoint_booking_id'], FILTER_VALIDATE_INT ) ) {
139	exit();
140	}
141	$booking_id = $this->params['latepoint_booking_id'];
142	if ( empty( $booking_id ) ) {
143	return;
144	}
145	$booking = new OsBookingModel( $booking_id );
146	if ( $booking->id && OsAuthHelper::is_customer_logged_in() && ( $booking->customer_id == OsAuthHelper::get_logged_in_customer_id() ) ) {
147	$customer = $booking->customer;
148	$this->vars['booking'] = $booking;
149	$this->vars['customer'] = $customer;
150	$this->set_layout( 'print' );
151	$content = $this->format_render_return( __FUNCTION__, [], [], true );
152	echo $content;
153	}
154	}
155
156	function ical_download() {
157	if ( ! filter_var( $this->params['latepoint_booking_id'], FILTER_VALIDATE_INT ) ) {
158	exit();
159	}
160	$booking_id = $this->params['latepoint_booking_id'];
161	if ( empty( $booking_id ) ) {
162	return;
163	}
164	$booking = new OsBookingModel( $booking_id );
165	if ( $booking->id && OsAuthHelper::is_customer_logged_in() && ( $booking->customer_id == OsAuthHelper::get_logged_in_customer_id() ) ) {
166
167	header( 'Content-Type: text/calendar; charset=utf-8' );
168	header( 'Content-Disposition: attachment; filename=booking_' . $booking->id . '.ics' );
169
170	echo OsBookingHelper::generate_ical_event_string( $booking );
171	}
172	}
173
174
175	function process_reschedule_request() {
176	if ( ! filter_var( $this->params['booking_id'], FILTER_VALIDATE_INT ) ) {
177	exit();
178	}
179	$booking = new OsBookingModel( $this->params['booking_id'] );
180
181	if ( empty( $booking->id ) \|\| empty( $this->params['start_date'] ) \|\| empty( $this->params['start_time'] ) ) {
182	return;
183	}
184
185	// Verify CSRF nonce
186	$this->check_nonce( 'reschedule_booking_' . $booking->id );
187
188	if ( ( OsAuthHelper::get_logged_in_customer_id() == $booking->customer_id ) && OsCustomerHelper::can_reschedule_booking( $booking ) ) {
189	$old_booking = clone $booking;
190	$booking->start_date = $this->params['start_date'];
191	$booking->start_time = $this->params['start_time'];
192
193	$booking->convert_start_datetime_into_server_timezone( $booking->get_customer_timezone_name() );
194
195	if ( $booking->is_start_date_and_time_set() ) {
196	$booking->calculate_end_date_and_time();
197	$booking->set_utc_datetimes();
198	}
199
200	// check if booking time is still available
201	if ( ! OsBookingHelper::is_booking_request_available( \LatePoint\Misc\BookingRequest::create_from_booking_model( $booking ), [ 'exclude_booking_ids' => [ $booking->id ] ] ) ) {
202	$response_html = __( 'Unfortunately the selected time slot is not available anymore, please select another timeslot.', 'latepoint' );
203	$status = LATEPOINT_STATUS_ERROR;
204	} else {
205	if ( OsSettingsHelper::is_on( 'change_status_on_customer_reschedule' ) ) {
206	$allowed_statuses = OsBookingHelper::get_statuses_list();
207	if ( isset( $allowed_statuses[ OsSettingsHelper::get_settings_value( 'status_to_set_after_customer_reschedule' ) ] ) ) {
208	$booking->status = OsSettingsHelper::get_settings_value( 'status_to_set_after_customer_reschedule' );
209	}
210	}
211	if ( $booking->save() ) {
212	/**
213	* Booking is updated
214	*
215	* @param {OsBookingModel} $this->>booking Updated instance of booking model
216	* @param {OsBookingModel} $old_booking Instance of booking model before it was updated
217	*
218	* @since 4.9.0
219	* @hook latepoint_booking_updated
220	*
221	*/
222	do_action( 'latepoint_booking_updated', $booking, $old_booking );
223	$this->vars['booking'] = $booking;
224	$this->vars['timezone_name'] = OsTimeHelper::get_timezone_name_from_session();
225	$this->vars['viewer'] = 'customer';
226	$status = LATEPOINT_STATUS_SUCCESS;
227	$this->set_layout( 'none' );
228	$response_html = $this->format_render_return( __FUNCTION__, [], [], true );
229	} else {
230	OsDebugHelper::log( 'Error rescheduling appointment', 'booking_reschedule_error', $booking->get_error_messages() );
231	$response_html = __( 'Error! Please try again later', 'latepoint' );
232	$status = LATEPOINT_STATUS_ERROR;
233	}
234	}
235	} else {
236	$status = LATEPOINT_STATUS_ERROR;
237	$response_html = __( 'Error! LKDFU343', 'latepoint' );
238	}
239
240	if ( $this->get_return_format() == 'json' ) {
241	$this->send_json(
242	array(
243	'status' => $status,
244	'message' => $response_html,
245	)
246	);
247	}
248	}
249
250	function request_reschedule_calendar() {
251	if ( ! filter_var( $this->params['booking_id'], FILTER_VALIDATE_INT ) ) {
252	exit();
253	}
254	$booking = new OsBookingModel( $this->params['booking_id'] );
255
256	if ( ! empty( $booking->id ) && ( OsAuthHelper::get_logged_in_customer_id() == $booking->customer_id ) && OsCustomerHelper::can_reschedule_booking( $booking ) ) {
257	$this->vars['booking'] = $booking;
258	$this->vars['calendar_start_date'] = ! empty( $this->params['calendar_start_date'] ) ? new OsWpDateTime( $this->params['calendar_start_date'] ) : new OsWpDateTime( 'today' );
259	$this->vars['timezone_name'] = $booking->get_customer_timezone_name();
260
261	$this->set_layout( 'none' );
262	$response_html = $this->format_render_return( __FUNCTION__, [], [], true );
263	} else {
264	$status = LATEPOINT_STATUS_ERROR;
265	$response_html = __( 'Reschedule is not allowed', 'latepoint' );
266	}
267	if ( $this->get_return_format() == 'json' ) {
268	$this->send_json(
269	array(
270	'status' => $status,
271	'message' => $response_html,
272	)
273	);
274	}
275	}
276
277	function request_cancellation() {
278	if ( ! filter_var( $this->params['id'], FILTER_VALIDATE_INT ) ) {
279	exit();
280	}
281
282	$booking_id = $this->params['id'];
283	$this->check_nonce( 'cancel_booking_' . $booking_id );
284	$booking = new OsBookingModel( $booking_id );
285	if ( ! empty( $booking->id ) && ( OsAuthHelper::get_logged_in_customer_id() == $booking->customer_id ) && OsCustomerHelper::can_cancel_booking( $booking ) ) {
286	if ( $booking->update_status( LATEPOINT_BOOKING_STATUS_CANCELLED ) ) {
287	$status = LATEPOINT_STATUS_SUCCESS;
288	$response_html = __( 'Appointment Status Updated', 'latepoint' );
289	} else {
290	$status = LATEPOINT_STATUS_ERROR;
291	$response_html = __( 'Error Updating Booking Status!', 'latepoint' ) . ' ' . implode( ',', $booking->get_error_messages() );
292	}
293	} else {
294	$status = LATEPOINT_STATUS_ERROR;
295	$response_html = __( 'Not allowed to cancel', 'latepoint' );
296	}
297	if ( $this->get_return_format() == 'json' ) {
298	$this->send_json(
299	array(
300	'status' => $status,
301	'message' => $response_html,
302	)
303	);
304	}
305	}
306
307	/*
308	Update profile
309	*/
310
311	public function update() {
312	$customer = OsAuthHelper::get_logged_in_customer();
313	if ( ! $customer ) {
314	exit();
315	}
316	$this->check_nonce( 'update_customer_' . $customer->get_uuid() );
317
318
319	if ( $customer ) {
320	$old_customer_data = $customer->get_data_vars();
321	$customer->set_data( $this->params['customer'], LATEPOINT_PARAMS_SCOPE_CUSTOMER );
322	if ( $customer->save() ) {
323	$response_html = __( 'Information Saved', 'latepoint' );
324	$status = LATEPOINT_STATUS_SUCCESS;
325	do_action( 'latepoint_customer_updated', $customer, $old_customer_data );
326	} else {
327	$response_html = $customer->get_error_messages();
328	$status = LATEPOINT_STATUS_ERROR;
329	}
330	} else {
331	$response_html = __( 'Customer not found', 'latepoint' );
332	$status = LATEPOINT_STATUS_ERROR;
333	}
334	if ( $this->get_return_format() == 'json' ) {
335	$this->send_json(
336	array(
337	'status' => $status,
338	'message' => $response_html,
339	)
340	);
341	}
342	}
343
344	public function reload_booking_tile() {
345	if ( ! filter_var( $this->params['booking_id'], FILTER_VALIDATE_INT ) ) {
346	exit();
347	}
348
349	$booking_id = $this->params['booking_id'];
350	$booking = new OsBookingModel( $booking_id );
351
352	if ( $booking->id && OsAuthHelper::get_logged_in_customer_id() == $booking->customer_id ) {
353	$this->vars['booking'] = $booking;
354	$this->vars['is_upcoming_booking'] = $booking->is_upcoming();
355	$this->set_layout( 'none' );
356	$response_html = $this->format_render_return( '_booking_tile' );
357	$status = LATEPOINT_STATUS_SUCCESS;
358	} else {
359	$response_html = __( 'Invalid Booking', 'latepoint' );
360	$status = LATEPOINT_STATUS_ERROR;
361	}
362
363	if ( $this->get_return_format() == 'json' ) {
364	$this->send_json(
365	array(
366	'status' => $status,
367	'message' => $response_html,
368	)
369	);
370	}
371	}
372
373	public function logout() {
374	OsAuthHelper::logout_customer();
375	nocache_headers();
376	wp_redirect( OsSettingsHelper::get_customer_dashboard_url(), 302 );
377	}
378
379	public function login() {
380	$this->set_layout( 'none' );
381
382	return $this->format_render_return( __FUNCTION__ );
383	}
384
385	public function do_login() {
386	$customer = OsAuthHelper::login_customer( sanitize_email( $this->params['auth']['email'] ), $this->params['auth']['password'] );
387	if ( $customer ) {
388	$response_html = OsSettingsHelper::get_customer_dashboard_url();
389	$status = LATEPOINT_STATUS_SUCCESS;
390	} else {
391	$status = LATEPOINT_STATUS_ERROR;
392	$response_html = __( 'Invalid password or email', 'latepoint' );
393	}
394	if ( $this->get_return_format() == 'json' ) {
395	$this->send_json(
396	array(
397	'status' => $status,
398	'message' => $response_html,
399	)
400	);
401	}
402	}
403
404
405	public function password_reset_form() {
406	$this->vars['from_booking'] = ( isset( $this->params['from_booking'] ) && $this->params['from_booking'] );
407	$this->set_layout( 'none' );
408
409	return $this->format_render_return( __FUNCTION__ );
410	}
411
412	public function request_password_reset_token() {
413	$this->set_layout( 'none' );
414	$this->vars['from_booking'] = ( isset( $this->params['from_booking'] ) && $this->params['from_booking'] );
415
416	if ( isset( $this->params['password_reset_email'] ) ) {
417	$customer_model = new OsCustomerModel();
418	$customer = $customer_model->where( [ 'email' => sanitize_email( $this->params['password_reset_email'] ) ] )->set_limit( 1 )->get_results_as_models();
419	$customer_mailer = new OsCustomerMailer();
420
421	if ( $customer ) {
422	$customer->account_nonse = sha1( wp_rand( 10000, 99999 ) . time() . wp_generate_password( 32, true, true ) );
423	$customer->save();
424	}
425
426	if ( $customer && $customer_mailer->password_reset_request( $customer, $customer->account_nonse ) ) {
427	// Save timestamp for token expiration tracking (Unix timestamp for consistency)
428	OsMetaHelper::save_customer_meta_by_key( 'password_reset_token_created_at', current_time( 'timestamp' ), $customer->id );
429	return $this->format_render_return( 'password_reset_form' );
430	} else {
431	$this->vars['reset_token_error'] = ( $customer ) ? __( 'Error! Email was not sent.', 'latepoint' ) : __( 'Email does not match any customer', 'latepoint' );
432
433	return $this->format_render_return( __FUNCTION__ );
434	}
435	} else {
436	return $this->format_render_return( __FUNCTION__ );
437	}
438	}
439
440	public function dashboard( array $params = [] ) {
441	if ( ! OsAuthHelper::is_customer_logged_in() ) {
442	$this->set_layout( 'none' );
443
444	return $this->format_render_return( 'login' );
445	} else {
446	$customer = OsAuthHelper::get_logged_in_customer();
447	$this->vars['customer'] = $customer;
448	$this->vars['orders'] = $customer->get_orders();
449
450	$this->vars['future_bookings'] = $customer->get_future_bookings();
451	$this->vars['past_bookings'] = $customer->get_past_bookings();
452	$this->vars['cancelled_bookings'] = $customer->get_cancelled_bookings();
453	$this->vars['not_scheduled_bundles'] = $customer->get_not_scheduled_bundles();
454
455	$this->vars['cart_not_empty'] = ( ! OsCartsHelper::is_current_cart_empty() && OsCartsHelper::can_checkout_multiple_items() );
456
457	$this->vars['hide_new_appointment_ui'] = $params['hide_new_appointment_ui'] ?? false;
458
459	$this->set_layout( 'none' );
460
461	return $this->format_render_return( __FUNCTION__ );
462	}
463	}
464
465	public function change_password() {
466	$params = OsParamsHelper::permit_params(
467	$this->params,
468	[
469	'password_reset_token',
470	'password',
471	'password_confirmation',
472	'change_password_nonce',
473	]
474	);
475
476	if ( empty( $params['password'] ) ) {
477	$this->send_json(
478	array(
479	'status' => LATEPOINT_STATUS_ERROR,
480	'message' => __( 'Password can not be blank', 'latepoint' ),
481	)
482	);
483	}
484
485	$status = LATEPOINT_STATUS_ERROR;
486	$response_html = __( 'Unknown Error', 'latepoint' );
487	$customer = false;
488
489	if ( OsAuthHelper::is_customer_logged_in() ) {
490	$this->check_nonce( 'change_password_' . OsAuthHelper::get_logged_in_customer_uuid(), $params['change_password_nonce'] );
491	$customer = OsAuthHelper::get_logged_in_customer();
492	} elseif ( ! empty( $params['password_reset_token'] ) ) {
493	$params['password_reset_token'] = sanitize_text_field( $params['password_reset_token'] );
494	$customer = OsCustomerHelper::get_by_account_nonse( $params['password_reset_token'] );
495
496	// Validate token expiration (15 minutes)
497	if ( $customer ) {
498	$created_at = OsMetaHelper::get_customer_meta_by_key( 'password_reset_token_created_at', $customer->id );
499
500	if ( empty( $created_at ) ) {
501	// No timestamp - reject for security (token created before fix)
502	$customer = false;
503	$status = LATEPOINT_STATUS_ERROR;
504	$response_html = __( 'Password token is invalid. Please request a new password reset.', 'latepoint' );
505	} else {
506	$age_seconds = current_time( 'timestamp' ) - intval( $created_at );
507	if ( $age_seconds > 900 ) { // 15 minutes = 900 seconds
508	// Clean up expired meta
509	OsMetaHelper::delete_customer_meta_by_key( 'password_reset_token_created_at', $customer->id );
510	$customer = false;
511	$status = LATEPOINT_STATUS_ERROR;
512	$response_html = __( 'Password token has expired. Please request a new password reset.', 'latepoint' );
513	}
514	}
515	}
516	}
517
518	if ( $customer ) {
519	if ( ! empty( $params['password'] ) && $params['password'] == $params['password_confirmation'] ) {
520	if ( $customer->update_password( $params['password'] ) ) {
521	// Invalidate token after successful password reset
522	if ( ! empty( $params['password_reset_token'] ) ) {
523	OsCustomerHelper::invalidate_password_reset_token( $customer );
524	}
525	$status = LATEPOINT_STATUS_SUCCESS;
526	$response_html = __( 'Your password was successfully updated.', 'latepoint' );
527	} else {
528	$response_html = __( 'Error! Message Code: KS723J', 'latepoint' );
529	$status = LATEPOINT_STATUS_ERROR;
530	}
531	} else {
532	$response_html = __( 'Error! Passwords do not match.', 'latepoint' );
533	$status = LATEPOINT_STATUS_ERROR;
534	}
535	} else {
536	$status = LATEPOINT_STATUS_ERROR;
537	$response_html = __( 'Customer Not Found', 'latepoint' );
538	}
539
540	if ( $this->get_return_format() == 'json' ) {
541	$this->send_json(
542	array(
543	'status' => $status,
544	'message' => $response_html,
545	)
546	);
547	}
548	}
549
550	public function set_account_password_on_booking_completion() {
551	$customer = OsAuthHelper::get_logged_in_customer();
552
553	if ( $customer ) {
554	$params = OsParamsHelper::permit_params(
555	$this->params,
556	[
557	'password',
558	'password_nonce',
559	]
560	);
561	$this->check_nonce( 'set_initial_password_for_customer_' . $customer->get_uuid(), $params['password_nonce'] );
562	if ( ! empty( $params['password'] ) ) {
563	if ( $customer->update_password( $params['password'] ) ) {
564	$status = LATEPOINT_STATUS_SUCCESS;
565	$response_html = __( 'Account Password Set', 'latepoint' );
566	} else {
567	$response_html = __( 'Error! Message Code: KS723J', 'latepoint' );
568	$status = LATEPOINT_STATUS_ERROR;
569	}
570	} else {
571	$status = LATEPOINT_STATUS_ERROR;
572	$response_html = __( 'Error! Password is empty.', 'latepoint' );
573	}
574	} else {
575	$response_html = __( 'Invalid request', 'latepoint' );
576	$status = LATEPOINT_STATUS_ERROR;
577	}
578
579
580	if ( $this->get_return_format() == 'json' ) {
581	$this->send_json(
582	array(
583	'status' => $status,
584	'message' => $response_html,
585	)
586	);
587	}
588	}
589	}
590
591
592	endif;
593