magic-login / includes / classes / CodeLogin.php

CodeLogin.php in Magic Login – Magic Link & Passwordless Authentication for WordPress – Login Without Password 2.4, at includes/classes/CodeLogin.php

227 lines 6.5 KB

Raw Download Zip

1	<?php
2	/**
3	* Code based login functionality.
4	*
5	* @package MagicLogin
6	*/
7
8	namespace MagicLogin;
9
10	use function MagicLogin\Utils\get_user_by_log_input;
11	use \WP_Error as WP_Error;
12	use function MagicLogin\Utils\get_wp_login_url;
13
14	if ( ! defined( 'ABSPATH' ) ) {
15	exit; // Exit if accessed directly.
16	}
17
18	/**
19	* Class CodeLogin
20	*/
21	class CodeLogin {
22	/**
23	* Return an instance of the current class
24	*
25	* @since
26	*/
27	public static function setup() {
28	static $instance = false;
29
30	if ( ! $instance ) {
31	$instance = new self();
32	}
33
34	return $instance;
35	}
36
37	/**
38	* Constructor.
39	*/
40	public function __construct() {
41	add_action( 'init', [ $this, 'handle_code_login' ] );
42	add_action( 'wp_ajax_magic_login_code_login', [ $this, 'handle_code_login' ] );
43	add_action( 'wp_ajax_nopriv_magic_login_code_login', [ $this, 'handle_code_login' ] );
44	}
45
46
47	/**
48	* Handle code login
49	*
50	* @return void\|string\|WP_Error
51	* @since 2.4
52	*/
53	public function handle_code_login() {
54	global $magic_login_code_login_result;
55
56	if ( ! isset( $_POST['magic_login_token'], $_POST['log'] ) ) {
57	return;
58	}
59
60	if ( ! isset( $_POST['magic_login_code_form_nonce'] ) \|\| ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['magic_login_code_form_nonce'] ) ), 'magic-login-code-login' ) ) {
61	$nonce_err = new WP_Error( 'invalid_nonce', esc_html__( 'Invalid nonce', 'magic-login' ) );
62
63	if ( defined( 'DOING_AJAX' ) && DOING_AJAX ) {
64	wp_send_json_error( [ 'message' => $nonce_err->get_error_message() ] );
65	}
66
67	$magic_login_code_login_result = $nonce_err;
68
69	return $nonce_err;
70	}
71
72	/**
73	* Pre process code login request
74	*
75	* @hook magic_login_pre_process_code_login_request
76	* @return WP_Error\|null
77	* @since 2.4
78	*/
79	$result = apply_filters( 'magic_login_pre_process_code_login_request', null );
80
81	if ( is_wp_error( $result ) ) {
82	if ( defined( 'DOING_AJAX' ) && DOING_AJAX ) {
83	wp_send_json_error( [ 'message' => $result->get_error_message() ] );
84	}
85
86	$magic_login_code_login_result = $result;
87
88	return $result;
89	}
90
91	$log = isset( $_POST['log'] ) ? sanitize_user( wp_unslash( $_POST['log'] ) ) : ''; // phpcs:ignore
92	$user = get_user_by_log_input( $log );
93	$token = sanitize_text_field( wp_unslash( $_POST['magic_login_token'] ) );
94
95	/**
96	* Pre authenticate code login
97	*
98	* @hook magic_login_pre_code_login
99	*
100	* @param {boolean} $do_authenticate Authenticate or not
101	* @param {object} $user User object
102	* @param {string} $token Token
103	*
104	* @return {bool\|WP_Error}
105	* @since 2.4
106	*/
107	$do_login = apply_filters( 'magic_login_pre_code_login', true, $user, $token );
108
109	if ( is_wp_error( $do_login ) ) {
110	if ( defined( 'DOING_AJAX' ) && DOING_AJAX ) {
111	wp_send_json_error( [ 'message' => $do_login->get_error_message() ] );
112	}
113
114	$magic_login_code_login_result = $do_login;
115
116	return $do_login;
117	}
118
119	$magic_login_code_login_result = LoginManager::authenticate_user_token( $user->ID, $token, true );
120
121	if ( ! empty( $magic_login_code_login_result ) && ! is_array( $magic_login_code_login_result ) ) { // check if it's url
122
123	/**
124	* Fires when the code login is invalid
125	*
126	* @hook magic_login_invalid_code
127	* @since 2.4
128	*/
129	do_action( 'magic_login_invalid_code' );
130
131	if ( defined( 'DOING_AJAX' ) && DOING_AJAX ) {
132	wp_send_json_error( [ 'message' => $magic_login_code_login_result ] );
133	}
134
135	$magic_login_code_login_result = new WP_Error( 'invalid_code', $magic_login_code_login_result );
136
137	return $magic_login_code_login_result;
138	}
139
140	/**
141	* Apply login action
142	*
143	* @hook magic_login_code_login
144	* @since 2.4
145	*/
146	do_action( 'magic_login_code_login' );
147
148	if ( defined( 'DOING_AJAX' ) && DOING_AJAX ) {
149	$redirect_to = $magic_login_code_login_result['redirect_to'] ?? get_wp_login_url();
150	wp_send_json_success(
151	[
152	'message' => esc_html__( 'Login successful! You will be redirected shortly.', 'magic-login' ),
153	'redirect_to' => $redirect_to,
154	]
155	);
156	}
157
158	wp_safe_redirect( $magic_login_code_login_result['redirect_to'] );
159	exit;
160	}
161
162	/**
163	* Code based login form
164	*
165	* @return void
166	*/
167	public static function code_form() {
168	$log = '';
169	$cancel_url = '';
170
171	if ( isset( $_SERVER['REQUEST_URI'] ) ) {
172	$cancel_url = esc_url_raw( wp_unslash( $_SERVER['REQUEST_URI'] ) );
173	}
174
175	if ( isset( $_POST['log'] ) && is_string( $_POST['log'] ) ) {
176	$log = wp_unslash( $_POST['log'] ); // phpcs:ignore
177	}
178	?>
179	<form
180	name="magiclogincodeform"
181	id="magiclogincodeform"
182	class="magic-login-code-form"
183	method="post"
184	autocomplete="off"
185	data-ajax-url="<?php echo esc_url( admin_url( 'admin-ajax.php' ) ); ?>"
186	data-ajax-spinner="<?php echo esc_url( get_admin_url() . 'images/spinner.gif' ); ?>"
187	data-ajax-sending-msg="<?php esc_attr_e( 'Sending...', 'magic-login' ); ?>"
188	data-spam-protection-msg="<?php esc_attr_e( 'Please verify that you are not a robot.', 'magic-login' ); ?>"
189	>
190	<div class="magic-login-code-form-header">
191	<div class="info" style="display: none;"></div>
192	<div class="ajax-result" style="display: none;"></div>
193	<div class="spinner" style="display: none;"></div>
194	</div>
195	<p>
196	<label for="magic_login_token"><?php esc_html_e( 'Code', 'magic-login' ); ?></label>
197	<input type="text" name="magic_login_token" id="magic_login_token" class="input" value="" size="20" autocapitalize="off" required />
198	</p>
199	<?php
200
201	/**
202	* Fires following the 'code' field in the login form.
203	*
204	* @since 2.4
205	*/
206	do_action( 'magic_login_code_form' );
207
208	?>
209	<p class="submit">
210	<input type="submit" name="wp-submit" id="wp-submit" style="float: none;width: 100%;" class="magic-login-code-submit button button-primary button-hero" value="<?php esc_attr_e( 'Submit', 'magic-login' ); ?>" />
211	<?php if ( ! empty( $cancel_url ) ) : ?>
212	<a href="<?php echo esc_url( $cancel_url ); ?>" class="button button-secondary button-hero magic-login-code-cancel" style="float: none;width: 100%;margin-top: 10px;text-align:center;"><?php esc_html_e( 'Cancel', 'magic-login' ); ?></a>
213	<?php endif; ?>
214
215	<?php if ( isset( $_POST['redirect_to'] ) ) : // phpcs:ignore WordPress.Security.NonceVerification.Recommended ?>
216	<input type="hidden" name="redirect_to" value="<?php echo esc_url( $_POST['redirect_to'] ); // phpcs:ignore ?>">
217	<?php endif; ?>
218	<input type="hidden" name="log" value="<?php echo esc_attr( $log ); ?>" />
219	<input type="hidden" name="testcookie" value="1" />
220	<?php wp_nonce_field( 'magic-login-code-login', 'magic_login_code_form_nonce' ); ?>
221	</p>
222	</form>
223	<?php
224	}
225
226	}
227