ResponseBuilders
2 days ago
v1
2 days ago
API.php
2 days ago
Endpoint.php
1 year ago
Error.php
3 months ago
ErrorHandler.php
1 year ago
ErrorResponse.php
3 years ago
Response.php
3 months ago
SuccessResponse.php
3 years ago
index.php
3 years ago
API.php
373 lines
| 1 | <?php // phpcs:ignore SlevomatCodingStandard.TypeHints.DeclareStrictTypes.DeclareStrictTypesMissing |
| 2 | |
| 3 | namespace MailPoet\API\JSON; |
| 4 | |
| 5 | if (!defined('ABSPATH')) exit; |
| 6 | |
| 7 | |
| 8 | use MailPoet\Captcha\CaptchaConstants; |
| 9 | use MailPoet\Config\AccessControl; |
| 10 | use MailPoet\Exception; |
| 11 | use MailPoet\Logging\LoggerFactory; |
| 12 | use MailPoet\Settings\SettingsController; |
| 13 | use MailPoet\Tracy\ApiPanel\ApiPanel; |
| 14 | use MailPoet\Tracy\DIPanel\DIPanel; |
| 15 | use MailPoet\Util\Helpers; |
| 16 | use MailPoet\WP\Functions as WPFunctions; |
| 17 | use MailPoetVendor\Psr\Container\ContainerInterface; |
| 18 | use Throwable; |
| 19 | use Tracy\Debugger; |
| 20 | use Tracy\ILogger; |
| 21 | |
| 22 | class API { |
| 23 | private $requestApiVersion; |
| 24 | private $requestEndpoint; |
| 25 | private $requestMethod; |
| 26 | private $requestToken; |
| 27 | private $requestType; |
| 28 | private $requestEndpointClass; |
| 29 | private $requestData = []; |
| 30 | private $endpointNamespaces = []; |
| 31 | private $availableApiVersions = [ |
| 32 | 'v1', |
| 33 | ]; |
| 34 | |
| 35 | /** @var ContainerInterface */ |
| 36 | private $container; |
| 37 | |
| 38 | /** @var AccessControl */ |
| 39 | private $accessControl; |
| 40 | |
| 41 | /** @var ErrorHandler */ |
| 42 | private $errorHandler; |
| 43 | |
| 44 | /** @var WPFunctions */ |
| 45 | private $wp; |
| 46 | |
| 47 | /** @var SettingsController */ |
| 48 | private $settings; |
| 49 | |
| 50 | /** @var LoggerFactory */ |
| 51 | private $loggerFactory; |
| 52 | |
| 53 | const CURRENT_VERSION = 'v1'; |
| 54 | |
| 55 | public function __construct( |
| 56 | ContainerInterface $container, |
| 57 | AccessControl $accessControl, |
| 58 | ErrorHandler $errorHandler, |
| 59 | SettingsController $settings, |
| 60 | LoggerFactory $loggerFactory, |
| 61 | WPFunctions $wp |
| 62 | ) { |
| 63 | $this->container = $container; |
| 64 | $this->accessControl = $accessControl; |
| 65 | $this->errorHandler = $errorHandler; |
| 66 | $this->settings = $settings; |
| 67 | $this->wp = $wp; |
| 68 | foreach ($this->availableApiVersions as $availableApiVersion) { |
| 69 | $this->addEndpointNamespace( |
| 70 | sprintf('%s\%s', __NAMESPACE__, $availableApiVersion), |
| 71 | $availableApiVersion |
| 72 | ); |
| 73 | } |
| 74 | $this->loggerFactory = $loggerFactory; |
| 75 | } |
| 76 | |
| 77 | public function init() { |
| 78 | // admin security token and API version |
| 79 | WPFunctions::get()->addAction( |
| 80 | 'admin_head', |
| 81 | [$this, 'setTokenAndAPIVersion'] |
| 82 | ); |
| 83 | |
| 84 | // ajax (logged in users) |
| 85 | WPFunctions::get()->addAction( |
| 86 | 'wp_ajax_mailpoet', |
| 87 | [$this, 'setupAjax'] |
| 88 | ); |
| 89 | |
| 90 | // ajax (logged out users) |
| 91 | WPFunctions::get()->addAction( |
| 92 | 'wp_ajax_nopriv_mailpoet', |
| 93 | [$this, 'setupAjax'] |
| 94 | ); |
| 95 | |
| 96 | // fresh-token endpoint for cached pages (e.g. edge-cached signup forms); |
| 97 | // intentionally separate from setupAjax() to break the chicken-and-egg of needing a token to fetch a token |
| 98 | WPFunctions::get()->addAction( |
| 99 | 'wp_ajax_mailpoet_token', |
| 100 | [$this, 'getToken'] |
| 101 | ); |
| 102 | WPFunctions::get()->addAction( |
| 103 | 'wp_ajax_nopriv_mailpoet_token', |
| 104 | [$this, 'getToken'] |
| 105 | ); |
| 106 | |
| 107 | // nonce refreshing via heartbeats |
| 108 | WPFunctions::get()->addAction( |
| 109 | 'wp_refresh_nonces', |
| 110 | [$this, 'addTokenToHeartbeatResponse'] |
| 111 | ); |
| 112 | } |
| 113 | |
| 114 | public function setupAjax() { |
| 115 | $this->wp->doAction('mailpoet_api_setup', [$this]); |
| 116 | |
| 117 | if (isset($_POST['api_version'])) { |
| 118 | $this->setRequestData($_POST, Endpoint::TYPE_POST); |
| 119 | } else { |
| 120 | $this->setRequestData($_GET, Endpoint::TYPE_GET); |
| 121 | } |
| 122 | |
| 123 | $ignoreToken = ( |
| 124 | $this->settings->get('captcha.type') != CaptchaConstants::TYPE_DISABLED && |
| 125 | $this->requestEndpoint === 'subscribers' && |
| 126 | $this->requestMethod === 'subscribe' |
| 127 | ) || ( |
| 128 | $this->requestEndpoint === 'captcha' |
| 129 | ); |
| 130 | |
| 131 | if (!$ignoreToken && $this->wp->wpVerifyNonce($this->requestToken, 'mailpoet_token') === false) { |
| 132 | $errorMessage = __("Sorry, but we couldn't connect to the MailPoet server. Please refresh the web page and try again.", 'mailpoet'); |
| 133 | $errorResponse = $this->createErrorResponse(Error::UNAUTHORIZED, $errorMessage, Response::STATUS_UNAUTHORIZED); |
| 134 | return $errorResponse->send(); |
| 135 | } |
| 136 | |
| 137 | $response = $this->processRoute(); |
| 138 | $response->send(); |
| 139 | } |
| 140 | |
| 141 | public function setRequestData($data, $requestType) { |
| 142 | $this->requestApiVersion = (!empty($data['api_version']) && is_string($data['api_version'])) ? $data['api_version'] : false; |
| 143 | |
| 144 | $this->requestEndpoint = (isset($data['endpoint']) && is_string($data['endpoint'])) |
| 145 | ? Helpers::underscoreToCamelCase(trim($data['endpoint'])) |
| 146 | : null; |
| 147 | |
| 148 | // JS part of /wp-admin/customize.php does not like a 'method' field in a form widget |
| 149 | $methodParamName = isset($data['mailpoet_method']) ? 'mailpoet_method' : 'method'; |
| 150 | $this->requestMethod = (isset($data[$methodParamName]) && is_string($data[$methodParamName])) |
| 151 | ? Helpers::underscoreToCamelCase(trim($data[$methodParamName])) |
| 152 | : null; |
| 153 | $this->requestType = $requestType; |
| 154 | |
| 155 | $this->requestToken = (isset($data['token']) && is_string($data['token'])) |
| 156 | ? trim($data['token']) |
| 157 | : null; |
| 158 | |
| 159 | if (!$this->requestEndpoint || !$this->requestMethod || !$this->requestApiVersion) { |
| 160 | $errorMessage = __('Invalid API request.', 'mailpoet'); |
| 161 | $errorResponse = $this->createErrorResponse(Error::BAD_REQUEST, $errorMessage, Response::STATUS_BAD_REQUEST); |
| 162 | return $errorResponse; |
| 163 | } else if (!empty($this->endpointNamespaces[$this->requestApiVersion])) { |
| 164 | foreach ($this->endpointNamespaces[$this->requestApiVersion] as $namespace) { |
| 165 | $endpointClass = sprintf( |
| 166 | '%s\%s', |
| 167 | $namespace, |
| 168 | ucfirst($this->requestEndpoint) |
| 169 | ); |
| 170 | if ($this->container->has($endpointClass)) { |
| 171 | $this->requestEndpointClass = $endpointClass; |
| 172 | break; |
| 173 | } |
| 174 | } |
| 175 | $this->requestData = isset($data['data']) |
| 176 | ? WPFunctions::get()->stripslashesDeep($data['data']) |
| 177 | : []; |
| 178 | |
| 179 | // remove reserved keywords from data |
| 180 | if (is_array($this->requestData) && !empty($this->requestData)) { |
| 181 | // filter out reserved keywords from data |
| 182 | $reservedKeywords = [ |
| 183 | 'token', |
| 184 | 'endpoint', |
| 185 | 'method', |
| 186 | 'api_version', |
| 187 | 'mailpoet_method', // alias of 'method' |
| 188 | 'mailpoet_redirect', |
| 189 | ]; |
| 190 | $this->requestData = array_diff_key( |
| 191 | $this->requestData, |
| 192 | array_flip($reservedKeywords) |
| 193 | ); |
| 194 | } |
| 195 | } |
| 196 | } |
| 197 | |
| 198 | public function processRoute() { |
| 199 | try { |
| 200 | if ( |
| 201 | empty($this->requestEndpointClass) || |
| 202 | !$this->container->has($this->requestEndpointClass) |
| 203 | ) { |
| 204 | throw new \Exception(__('Invalid API endpoint.', 'mailpoet')); |
| 205 | } |
| 206 | |
| 207 | $endpoint = $this->container->get($this->requestEndpointClass); |
| 208 | if (!$endpoint instanceof Endpoint) { |
| 209 | throw new \Exception(__('Invalid API endpoint.', 'mailpoet')); |
| 210 | } |
| 211 | if ( |
| 212 | !method_exists($endpoint, $this->requestMethod) |
| 213 | || !$this->isDispatchableEndpointMethod($endpoint, $this->requestMethod) |
| 214 | ) { |
| 215 | throw new \Exception(__('Invalid API endpoint method.', 'mailpoet')); |
| 216 | } |
| 217 | |
| 218 | if (!$endpoint->isMethodAllowed($this->requestMethod, $this->requestType)) { |
| 219 | throw new \Exception(__('HTTP request method not allowed.', 'mailpoet')); |
| 220 | } |
| 221 | |
| 222 | if ( |
| 223 | class_exists(Debugger::class) |
| 224 | && class_exists(DIPanel::class) |
| 225 | && class_exists(ApiPanel::class) |
| 226 | ) { |
| 227 | ApiPanel::init($endpoint, $this->requestMethod, $this->requestData); |
| 228 | DIPanel::init(); |
| 229 | } |
| 230 | |
| 231 | // check the accessibility of the requested endpoint's action |
| 232 | // by default, an endpoint's action is considered "private" |
| 233 | if (!$this->validatePermissions($this->requestMethod, $endpoint->permissions)) { |
| 234 | $errorMessage = __('You do not have the required permissions.', 'mailpoet'); |
| 235 | $errorResponse = $this->createErrorResponse(Error::FORBIDDEN, $errorMessage, Response::STATUS_FORBIDDEN); |
| 236 | return $errorResponse; |
| 237 | } |
| 238 | $response = $endpoint->{$this->requestMethod}($this->requestData); |
| 239 | if (!$response instanceof Response) { |
| 240 | throw new \Exception(__('Invalid API endpoint method.', 'mailpoet')); |
| 241 | } |
| 242 | return $response; |
| 243 | } catch (Exception $e) { |
| 244 | $this->logError($e); |
| 245 | return $this->errorHandler->convertToResponse($e); |
| 246 | } catch (Throwable $e) { |
| 247 | if (class_exists(Debugger::class) && Debugger::$logDirectory) { |
| 248 | Debugger::log($e, ILogger::EXCEPTION); |
| 249 | } |
| 250 | $this->logError($e); |
| 251 | $errorMessage = $e->getMessage(); |
| 252 | $errorResponse = $this->createErrorResponse(Error::BAD_REQUEST, $errorMessage, Response::STATUS_BAD_REQUEST); |
| 253 | return $errorResponse; |
| 254 | } |
| 255 | } |
| 256 | |
| 257 | /** |
| 258 | * The response-builder helpers on the Endpoint base class are framework plumbing, |
| 259 | * blocked by name so that a subclass override cannot re-expose them. Non-public |
| 260 | * methods are never dispatchable. |
| 261 | */ |
| 262 | private function isDispatchableEndpointMethod(Endpoint $endpoint, string $requestMethod): bool { |
| 263 | // Magic methods (__construct, __call, __get, __invoke, ...) are never actions. |
| 264 | if (strpos($requestMethod, '__') === 0) { |
| 265 | return false; |
| 266 | } |
| 267 | if (method_exists(Endpoint::class, $requestMethod)) { |
| 268 | return false; |
| 269 | } |
| 270 | $method = new \ReflectionMethod($endpoint, $requestMethod); |
| 271 | // PHP resolves method names case-insensitively; require the exact declared casing |
| 272 | // so that every name-keyed lookup downstream matches the method that runs. |
| 273 | if ($method->getName() !== $requestMethod) { |
| 274 | return false; |
| 275 | } |
| 276 | return $method->isPublic(); |
| 277 | } |
| 278 | |
| 279 | public function validatePermissions($requestMethod, $permissions) { |
| 280 | // validate method permission if defined, otherwise validate global permission |
| 281 | return(!empty($permissions['methods'][$requestMethod])) ? |
| 282 | $this->accessControl->validatePermission($permissions['methods'][$requestMethod]) : |
| 283 | $this->accessControl->validatePermission($permissions['global']); |
| 284 | } |
| 285 | |
| 286 | public function setTokenAndAPIVersion() { |
| 287 | echo sprintf( |
| 288 | '<script type="text/javascript">' . |
| 289 | 'var mailpoet_token = "%s";' . |
| 290 | 'var mailpoet_api_version = "%s";' . |
| 291 | '</script>', |
| 292 | esc_js($this->wp->wpCreateNonce('mailpoet_token')), |
| 293 | esc_js(self::CURRENT_VERSION) |
| 294 | ); |
| 295 | } |
| 296 | |
| 297 | public function getToken() { |
| 298 | // Bypass intermediate caches so the token is always fresh; the embedded form |
| 299 | // token in HTML can be served stale by edge caches and expire by submit time. |
| 300 | if (!headers_sent()) { |
| 301 | header('Cache-Control: no-store, max-age=0'); |
| 302 | header('Content-Type: application/json; charset=UTF-8'); |
| 303 | } |
| 304 | |
| 305 | echo wp_json_encode([ |
| 306 | 'token' => $this->wp->wpCreateNonce('mailpoet_token'), |
| 307 | 'api_version' => self::CURRENT_VERSION, |
| 308 | ]); |
| 309 | $this->wp->wpDie(); |
| 310 | } |
| 311 | |
| 312 | public function addTokenToHeartbeatResponse($response) { |
| 313 | $response['mailpoet_token'] = $this->wp->wpCreateNonce('mailpoet_token'); |
| 314 | return $response; |
| 315 | } |
| 316 | |
| 317 | public function addEndpointNamespace($namespace, $version) { |
| 318 | if (!empty($this->endpointNamespaces[$version][$namespace])) return; |
| 319 | $this->endpointNamespaces[$version][] = $namespace; |
| 320 | } |
| 321 | |
| 322 | public function getEndpointNamespaces() { |
| 323 | return $this->endpointNamespaces; |
| 324 | } |
| 325 | |
| 326 | public function getRequestedEndpointClass() { |
| 327 | return $this->requestEndpointClass; |
| 328 | } |
| 329 | |
| 330 | public function getRequestedAPIVersion() { |
| 331 | return $this->requestApiVersion; |
| 332 | } |
| 333 | |
| 334 | public function createErrorResponse($errorType, $errorMessage, $responseStatus) { |
| 335 | $errorMessages = [ |
| 336 | $errorType => $errorMessage, |
| 337 | ]; |
| 338 | |
| 339 | if ($errorType === Error::BAD_REQUEST) { |
| 340 | $mpReinstallErrorMessage = __('The plugin has encountered an unexpected error. Please reload the page. If that does not help, [link]re-install the MailPoet Plugin.[/link]', 'mailpoet'); |
| 341 | $mpReinstallErrorMessage = Helpers::replaceLinkTags( |
| 342 | $mpReinstallErrorMessage, |
| 343 | 'https://kb.mailpoet.com/article/258-re-installing-updating-the-plugin-via-ftp', |
| 344 | ['target' => '_blank'] |
| 345 | ); |
| 346 | $errorMessages[Error::REINSTALL_PLUGIN] = $mpReinstallErrorMessage; |
| 347 | } |
| 348 | |
| 349 | $errorResponse = new ErrorResponse( |
| 350 | $errorMessages, |
| 351 | [], |
| 352 | $responseStatus |
| 353 | ); |
| 354 | return $errorResponse; |
| 355 | } |
| 356 | |
| 357 | private function logError(Throwable $e): void { |
| 358 | // logging to the php log |
| 359 | if (function_exists('error_log')) { |
| 360 | // phpcs:disable QITStandard.PHP.DebugCode.DebugFunctionFound |
| 361 | error_log((string)$e); // phpcs:ignore Squiz.PHP.DiscouragedFunctions |
| 362 | // phpcs:enable QITStandard.PHP.DebugCode.DebugFunctionFound |
| 363 | } |
| 364 | // logging to the MailPoet table |
| 365 | $this->loggerFactory->getLogger(LoggerFactory::TOPIC_API)->warning($e->getMessage(), [ |
| 366 | 'requestMethod' => $this->requestMethod, |
| 367 | 'requestEndpoint' => $this->requestEndpoint, |
| 368 | 'exceptionMessage' => $e->getMessage(), |
| 369 | 'exceptionTrace' => $e->getTrace(), |
| 370 | ]); |
| 371 | } |
| 372 | } |
| 373 |