Analytics.php
1 month ago
AutomatedLatestContent.php
3 months ago
AutomaticEmails.php
3 years ago
Captcha.php
1 day ago
Coupons.php
2 years ago
CustomFields.php
3 months ago
DynamicProducts.php
1 year ago
DynamicSegments.php
3 months ago
FeatureFlags.php
3 years ago
Forms.php
3 months ago
Help.php
1 year ago
ImportExport.php
3 months ago
Mailer.php
2 weeks ago
NewsletterLinks.php
1 day ago
NewsletterTemplates.php
3 months ago
Newsletters.php
3 months ago
Premium.php
1 year ago
RedirectResponse.php
1 day ago
Segments.php
1 month ago
SendingQueue.php
3 months ago
Services.php
7 months ago
Settings.php
3 months ago
Setup.php
1 year ago
StatisticsExport.php
4 months ago
SubscriberStats.php
3 months ago
Subscribers.php
3 months ago
Tags.php
3 years ago
UserFlags.php
2 years ago
WoocommerceProductVariations.php
3 months ago
WoocommerceSettings.php
3 years ago
index.php
3 years ago
Captcha.php
61 lines
| 1 | <?php declare(strict_types = 1); |
| 2 | |
| 3 | namespace MailPoet\API\JSON\v1; |
| 4 | |
| 5 | if (!defined('ABSPATH')) exit; |
| 6 | |
| 7 | |
| 8 | use MailPoet\API\JSON\Endpoint as APIEndpoint; |
| 9 | use MailPoet\Captcha\CaptchaSession; |
| 10 | use MailPoet\Captcha\CaptchaUrlFactory; |
| 11 | use MailPoet\Config\AccessControl; |
| 12 | use MailPoet\WP\Functions as WPFunctions; |
| 13 | |
| 14 | class Captcha extends APIEndpoint { |
| 15 | private CaptchaSession $captchaSession; |
| 16 | private CaptchaUrlFactory $urlFactory; |
| 17 | private WPFunctions $wp; |
| 18 | |
| 19 | public $permissions = [ |
| 20 | 'global' => AccessControl::NO_ACCESS_RESTRICTION, |
| 21 | ]; |
| 22 | |
| 23 | public function __construct( |
| 24 | CaptchaSession $captchaSession, |
| 25 | CaptchaUrlFactory $urlFactory, |
| 26 | WPFunctions $wp |
| 27 | ) { |
| 28 | $this->captchaSession = $captchaSession; |
| 29 | $this->urlFactory = $urlFactory; |
| 30 | $this->wp = $wp; |
| 31 | } |
| 32 | |
| 33 | public function render(array $data = []) { |
| 34 | $sessionId = $this->captchaSession->generateSessionId(); |
| 35 | $data = array_merge($data, ['captcha_session_id' => $sessionId]); |
| 36 | $captchaUrl = $this->urlFactory->getCaptchaUrl($data); |
| 37 | $this->allowCaptchaPageHost($captchaUrl); |
| 38 | |
| 39 | return $this->redirectResponse($captchaUrl); |
| 40 | } |
| 41 | |
| 42 | /** |
| 43 | * The captcha page permalink may live on a different host than home_url() |
| 44 | * (multilingual domains, mapped domains). The host comes from the configured |
| 45 | * page's permalink, not from request data, so it is safe to allow. |
| 46 | */ |
| 47 | private function allowCaptchaPageHost(string $captchaUrl): void { |
| 48 | $host = $this->wp->wpParseUrl($captchaUrl, PHP_URL_HOST); |
| 49 | if (!is_string($host) || $host === '') { |
| 50 | return; |
| 51 | } |
| 52 | $this->wp->addFilter('allowed_redirect_hosts', function ($hosts) use ($host) { |
| 53 | $hosts = is_array($hosts) ? $hosts : []; |
| 54 | if (!in_array($host, $hosts, true)) { |
| 55 | $hosts[] = $host; |
| 56 | } |
| 57 | return $hosts; |
| 58 | }); |
| 59 | } |
| 60 | } |
| 61 |