ConfirmationEmailTemplate
2 months ago
ImportExport
1 month ago
RestApi
1 month ago
Statistics
2 months ago
BulkActionController.php
1 month ago
BulkActionException.php
3 months ago
BulkConfirmationEmailResender.php
3 months ago
ConfirmationEmailCustomizer.php
3 months ago
ConfirmationEmailMailer.php
3 months ago
ConfirmationEmailResolver.php
3 months ago
EngagementDataBackfiller.php
3 months ago
InactiveSubscribersController.php
1 month ago
LinkTokens.php
3 months ago
NewSubscriberNotificationMailer.php
3 months ago
RequiredCustomFieldValidator.php
3 months ago
SegmentsCountRecalculator.php
1 month ago
Source.php
3 months ago
SubscriberActions.php
3 months ago
SubscriberCustomFieldRepository.php
3 years ago
SubscriberIPsRepository.php
2 years ago
SubscriberLimitNotificationEvaluator.php
3 months ago
SubscriberLimitNotificationMailer.php
3 months ago
SubscriberLimitNotificationScheduler.php
3 months ago
SubscriberListingRepository.php
1 month ago
SubscriberPersonalDataEraser.php
3 months ago
SubscriberSaveController.php
1 month ago
SubscriberSegmentRepository.php
1 month ago
SubscriberSubscribeController.php
1 week ago
SubscriberTagRepository.php
4 years ago
SubscribersCountsController.php
1 month ago
SubscribersEmailCountsController.php
1 month ago
SubscribersRepository.php
1 month ago
TrackingConsentCapture.php
1 week ago
TrackingConsentController.php
2 weeks ago
index.php
3 years ago
LinkTokens.php
57 lines
| 1 | <?php declare(strict_types = 1); |
| 2 | |
| 3 | namespace MailPoet\Subscribers; |
| 4 | |
| 5 | if (!defined('ABSPATH')) exit; |
| 6 | |
| 7 | |
| 8 | use MailPoet\Entities\SubscriberEntity; |
| 9 | |
| 10 | class LinkTokens { |
| 11 | private const OBSOLETE_LINK_TOKEN_LENGTH = 6; |
| 12 | |
| 13 | /** @var SubscribersRepository */ |
| 14 | private $subscribersRepository; |
| 15 | |
| 16 | public function __construct( |
| 17 | SubscribersRepository $subscribersRepository |
| 18 | ) { |
| 19 | $this->subscribersRepository = $subscribersRepository; |
| 20 | } |
| 21 | |
| 22 | public function getToken(SubscriberEntity $subscriber): string { |
| 23 | if ($subscriber->getLinkToken() === null) { |
| 24 | $subscriber->setLinkToken($this->generateToken($subscriber->getEmail())); |
| 25 | $this->subscribersRepository->flush(); |
| 26 | } |
| 27 | return (string)$subscriber->getLinkToken(); |
| 28 | } |
| 29 | |
| 30 | public function verifyToken(SubscriberEntity $subscriber, string $token) { |
| 31 | $databaseToken = $this->getToken($subscriber); |
| 32 | // Fail closed: an empty stored token means the subscriber has no |
| 33 | // generatable token (e.g. missing email). hash_equals('', substr($x, 0, 0)) |
| 34 | // would otherwise accept any input here. |
| 35 | if ($databaseToken === '') { |
| 36 | return false; |
| 37 | } |
| 38 | $requestToken = substr($token, 0, strlen($databaseToken)); |
| 39 | return hash_equals($databaseToken, $requestToken); |
| 40 | } |
| 41 | |
| 42 | /** |
| 43 | * Only for backward compatibility for old tokens |
| 44 | */ |
| 45 | private function generateToken(?string $email, int $length = self::OBSOLETE_LINK_TOKEN_LENGTH): ?string { |
| 46 | if ($email === null || $email === '') { |
| 47 | return null; |
| 48 | } |
| 49 | $authKey = ''; |
| 50 | if (defined('AUTH_KEY')) { |
| 51 | $authKey = AUTH_KEY; |
| 52 | } |
| 53 | $token = substr(md5((string)$authKey . $email), 0, $length); |
| 54 | return is_string($token) && $token !== '' ? $token : null; |
| 55 | } |
| 56 | } |
| 57 |