mainwp / response / api.php

api.php in MainWP Dashboard: Self-hosted WordPress Management for Agencies 4.0.5, at response/api.php

271 lines 12.5 KB

Raw Download Zip

1	<?php
2
3	function liveReportsResponderClasses() {
4	if ( file_exists( '../class/class-mainwp-creport.php' ) ) {
5	include_once '../class/class-mainwp-creport.php';
6	}
7	}
8
9	function checkLiveReportingAccess( $siteurl ) {
10	$access = get_option( 'live-report-responder-provideaccess' );
11	return ( ( 'yes' == $access ) && ( get_option( 'live-report-responder-siteurl' ) == $siteurl ) );
12	}
13
14	function LiveReportsResponderSecureConnection( $siteurl = null, $securitykey = null, $signature = null, $action = null,
15	$timestamp = null, $pubkey = null ) {
16	if ( ( $siteurl == null ) \|\| ( $signature == null ) \|\| ( $action == null ) \|\| ( $timestamp == null ) ) {
17	return array( 'error' => 'Invalid request.' );
18	}
19
20	$access = get_option( 'live-report-responder-provideaccess' );
21	if ( ( 'yes' != $access ) \|\| ( get_option( 'live-report-responder-siteurl' ) != $siteurl ) ) {
22	return array( 'error' => 'Error - Connection not allowed in the Managed Client Reports for WooCommerce Responder settings' );
23	}
24
25	if ( $timestamp < ( time() - 48 * 60 * 60 ) ) {
26	return array( 'error' => 'Outdated request.' );
27	}
28
29	$current_key = get_option( 'live-report-responder-pubkey' );
30	if ( ( $pubkey !== null ) ) {
31	if ( !empty( $current_key ) ) {
32	return array( 'error' => 'The dashboard is already connected, release the connection on the dashboard please.' );
33	}
34
35	MainWP_Utility::update_option( 'live-report-responder-pubkey', $pubkey );
36	$current_key = $pubkey;
37	}
38
39	if ( empty( $current_key ) ) {
40	return array( 'error' => 'The dashboard is not connected, please reconnect to establish a secure connection.' );
41	}
42
43	$auth = openssl_verify( $action . $securitykey . $timestamp, base64_decode( $signature ), base64_decode( $current_key ) );
44	if ( 0 === $auth ) {
45	return array( 'error' => 'An error occured while verifying the secure signature.' );
46	} else if ( -1 === $auth ) {
47	return array( 'error' => 'Authentication failed, please reconnect the dashboard.' );
48	}
49
50	if ( ( get_option( 'live-reports-responder-security-id' ) == 'on' ) && ( get_option( 'live-reports-responder-security-code' ) !== base64_decode( $securitykey ) ) ) {
51	return array( 'error' => 'Invalid security ID.' );
52	}
53
54	// to fix conflict with divi theme
55	define('DOING_CRON', true); // to fix conflict issue with the team control extension
56
57	return TRUE;
58	}
59
60	function checkifvalidclient( $email, $siteid ) {
61	$checkPermission = checkLiveReportingAccess( $_POST[ 'livereportingurl' ] );
62	$result = array();
63	if ( $checkPermission ) {
64	liveReportsResponderClasses();
65	global $wpdb;
66
67	$get_site_url = $wpdb->get_row( $wpdb->prepare( "SELECT `url` FROM {$wpdb->prefix}mainwp_wp WHERE id=%d", $siteid ) );
68	if ( !empty( $get_site_url ) ) {
69	$get_site_details = $wpdb->get_row( $wpdb->prepare( "SELECT * FROM {$wpdb->prefix}mainwp_client_report_site_token WHERE token_id=%d AND token_value='%s' AND site_url='" . $get_site_url->url . "'", 12, $email ) );
70	if ( $get_site_details ) {
71	$result[ 'result' ] = 'success';
72	$result[ 'data' ] = $get_site_details;
73	}
74	}
75	}
76
77	return $result;
78	}
79
80	if ( isset( $_POST[ 'content' ] ) && isset( $_POST[ 'action' ] ) && ( 'displaycontent' == $_POST[ 'action' ] ) ) {
81	$secureconnection = LiveReportsResponderSecureConnection( $_POST[ 'livereportingurl' ], ( isset( $_POST[ 'securitykey' ] ) ) ? $_POST[ 'securitykey' ] : '', isset( $_POST[ 'signature' ] ) ? $_POST[ 'signature' ] : null, isset( $_POST[ 'action' ] ) ? $_POST[ 'action' ] : null, isset( $_POST[ 'timestamp' ] ) ? $_POST[ 'timestamp' ] : null );
82	if ( $secureconnection === true ) {
83	$checkPermission = checkLiveReportingAccess( $_POST[ 'livereportingurl' ] );
84	if ( $checkPermission ) {
85	liveReportsResponderClasses();
86	$report = new stdClass();
87	$report->title = 'Live Reports';
88	$report->date_from = strtotime( date( "Y-m-01" ) );
89	$report->date_to = strtotime( date( 'Y-m-d' ) );
90	$report->client = "";
91	$report->client_id = 0;
92	$report->fname = "";
93	$report->fcompany = "";
94	$report->femail = "";
95	$report->name = "[client.name]";
96	$report->company = "";
97	$report->email = "";
98	$report->subject = "Report for [client.site.name]";
99	$report->recurring_schedule = "";
100	$report->schedule_bcc_me = 0;
101	$report->header = $_POST[ 'content' ];
102	$report->body = "";
103	$report->footer = "";
104	$report->type = 0;
105	$sites = base64_encode( serialize( array( $_POST[ 'siteid' ] ) ) );
106	$report->sites = $sites;
107	$report->groups = "";
108	$report->schedule_nextsend = 0;
109	$filtered_reports = MainWP_Live_Reports_Class::filter_report( $report, '' );
110	echo json_encode( array(
111	"result" => "success",
112	"data" => html_entity_decode( stripslashes( $filtered_reports[ $_POST[ 'siteid' ] ]->filtered_header ) )
113	) );
114	exit;
115	} else {
116	echo json_encode( array( "result" => "error", "message" => "Permission Denied" ) );
117	exit;
118	}
119	} else if ( isset( $secureconnection[ 'error' ] ) ) {
120	echo json_encode( array( 'result' => "error", "message" => $secureconnection[ 'error' ] ) );
121	exit;
122	} else {
123	echo json_encode( array( 'result' => "error", "message" => "Error - Invalid Request" ) );
124	exit;
125	}
126	}
127	if ( isset( $_POST[ 'content' ] ) && isset( $_POST[ 'action' ] ) && ( 'livereport' == $_POST[ 'action' ] ) ) {
128	$secureconnection = LiveReportsResponderSecureConnection( $_POST[ 'livereportingurl' ], ( isset( $_POST[ 'securitykey' ] ) ) ? $_POST[ 'securitykey' ] : '', isset( $_POST[ 'signature' ] ) ? $_POST[ 'signature' ] : null, isset( $_POST[ 'action' ] ) ? $_POST[ 'action' ] : null, isset( $_POST[ 'timestamp' ] ) ? $_POST[ 'timestamp' ] : null );
129	if ( $secureconnection === true ) {
130	$checkPermission = checkLiveReportingAccess( $_POST[ 'livereportingurl' ] );
131	if ( $checkPermission ) {
132	liveReportsResponderClasses();
133	$checkifvalidclient = checkifvalidclient( $_POST[ 'email' ], $_POST[ 'siteid' ] );
134	$allAccess = isset( $_POST[ 'allAccess' ] ) ? $_POST[ 'allAccess' ] : false;
135	if ( ( isset( $checkifvalidclient[ 'result' ] ) && 'success' == $checkifvalidclient[ 'result' ] ) \|\| $allAccess ) {
136	$report = new stdClass();
137	$report->title = "Live Report";
138	$report->date_from = $_POST[ 'date_from' ];
139	$report->date_to = $_POST[ 'date_to' ];
140	$report->client = "";
141	$report->client_id = 0;
142	$report->fname = "";
143	$report->fcompany = "";
144	$report->femail = "";
145	$report->name = "[client.name]";
146	$report->company = "";
147	$report->email = "";
148	$report->subject = "Report for [client.site.name]";
149	$report->recurring_schedule = "";
150	$report->schedule_bcc_me = 0;
151	$report->header = $_POST[ 'content' ];
152	$report->body = "";
153	$report->footer = "";
154	$report->type = 0;
155	$sites = base64_encode( serialize( array( $_POST[ 'siteid' ] ) ) );
156	$report->sites = $sites;
157	$report->groups = "";
158	$report->schedule_nextsend = 0;
159	$filtered_reports = MainWP_Live_Reports_Class::filter_report( $report, $_POST[ 'allowed_tokens' ] );
160	echo json_encode( array( "result" => "success", "data" => html_entity_decode( stripslashes( $filtered_reports[ $_POST[ 'siteid' ] ]->filtered_header ) ) ) );
161	exit;
162	} else {
163	echo json_encode( array( "result" => "error", "message" => "No Report Found" ) );
164	exit;
165	}
166	} else {
167	echo json_encode( array( "result" => "error", "message" => "Permission Denied" ) );
168	exit;
169	}
170	} else if ( isset( $secureconnection[ 'error' ] ) ) {
171	echo json_encode( array( 'result' => "error", "message" => $secureconnection[ 'error' ] ) );
172	exit;
173	} else {
174	echo json_encode( array( 'result' => "error", "message" => "Error - Invalid Request" ) );
175	exit;
176	}
177	}
178	if ( isset( $_POST[ 'email' ] ) && isset( $_POST[ 'action' ] ) && ( 'getallsitesbyemail' == $_POST[ 'action' ] ) && !empty( $_POST[ 'email' ] ) ) {
179	$secureconnection = LiveReportsResponderSecureConnection( $_POST[ 'livereportingurl' ], ( isset( $_POST[ 'securitykey' ] ) ) ? $_POST[ 'securitykey' ] : '', isset( $_POST[ 'signature' ] ) ? $_POST[ 'signature' ] : null, isset( $_POST[ 'action' ] ) ? $_POST[ 'action' ] : null, isset( $_POST[ 'timestamp' ] ) ? $_POST[ 'timestamp' ] : null );
180	if ( $secureconnection ) {
181	$checkPermission = checkLiveReportingAccess( $_POST[ 'livereportingurl' ] );
182	if ( $checkPermission ) {
183	liveReportsResponderClasses();
184	global $wpdb;
185	$result = array();
186	$get_allsites = $wpdb->get_results( $wpdb->prepare( "SELECT `site_url` FROM `{$wpdb->prefix}mainwp_client_report_site_token` WHERE token_id= %d AND token_value=%s ORDER BY `id` DESC", 12, $_POST[ 'email' ] ) );
187
188	if ( $get_allsites ) {
189	foreach ( $get_allsites as $site ) {
190	$get_site_details = $wpdb->get_row( $wpdb->prepare( "SELECT `id`,`name`,`url` FROM `{$wpdb->prefix}mainwp_wp` WHERE `url`=%s", $site->site_url ) );
191
192	if ( $get_site_details ) {
193	$result[ 'result' ] = 'success';
194	$result[ 'data' ][] = $get_site_details;
195	}
196	}
197	} else {
198	$result[ 'result' ] = 'error';
199	$result[ 'message' ] = 'No Site Found';
200	}
201	echo json_encode( $result );
202	exit;
203	} else {
204	echo json_encode( array( "result" => "error", "message" => "Permission Denied" ) );
205	exit;
206	}
207	} else if ( isset( $secureconnection[ 'error' ] ) ) {
208	echo json_encode( array( 'result' => "error", "message" => $secureconnection[ 'error' ] ) );
209	exit;
210	} else {
211	echo json_encode( array( 'result' => "error", "message" => "Error - Invalid Request" ) );
212	exit;
213	}
214	}
215	if ( isset( $_POST[ 'action' ] ) && ( 'getallsites' == $_POST[ 'action' ] ) ) {
216	$secureconnection = LiveReportsResponderSecureConnection( $_POST[ 'livereportingurl' ], ( isset( $_POST[ 'securitykey' ] ) ) ? $_POST[ 'securitykey' ] : '', isset( $_POST[ 'signature' ] ) ? $_POST[ 'signature' ] : null, isset( $_POST[ 'action' ] ) ? $_POST[ 'action' ] : null, isset( $_POST[ 'timestamp' ] ) ? $_POST[ 'timestamp' ] : null );
217	if ( $secureconnection === true ) {
218	$checkPermission = checkLiveReportingAccess( $_POST[ 'livereportingurl' ] );
219	if ( $checkPermission ) {
220	liveReportsResponderClasses();
221	global $wpdb;
222	$result = array();
223	$get_allsites = $wpdb->get_results( $wpdb->prepare( "SELECT `site_url` FROM `{$wpdb->prefix}mainwp_client_report_site_token` WHERE token_id= %d ORDER BY `id` DESC", 12 ) );
224
225	if ( $get_allsites ) {
226	foreach ( $get_allsites as $site ) {
227	$get_site_details = $wpdb->get_row( $wpdb->prepare( "SELECT `id`,`name`,`url` FROM `{$wpdb->prefix}mainwp_wp` WHERE `url`=%s", $site->site_url ) );
228
229	if ( $get_site_details ) {
230	$result[ 'result' ] = 'success';
231	$result[ 'data' ][] = $get_site_details;
232	}
233	}
234	} else {
235	$result[ 'result' ] = 'error';
236	$result[ 'message' ] = 'No Site Found';
237	}
238	echo json_encode( $result );
239	exit;
240	} else {
241	echo json_encode( array( 'result' => "error", "message" => "Permission Denied" ) );
242	exit;
243	}
244	} else if ( isset( $secureconnection[ 'error' ] ) ) {
245	echo json_encode( array( 'result' => "error", "message" => $secureconnection[ 'error' ] ) );
246	exit;
247	} else {
248	echo json_encode( array( 'result' => "error", "message" => "Error - Invalid Request" ) );
249	exit;
250	}
251	}
252	if ( isset( $_POST[ 'action' ] ) && ('checkvalid_live_reports_responder_url' == $_POST[ 'action' ] ) ) {
253	$secureconnection = LiveReportsResponderSecureConnection( $_POST[ 'livereportingurl' ], ( isset( $_POST[ 'securitykey' ] ) ) ? $_POST[ 'securitykey' ] : '', isset( $_POST[ 'signature' ] ) ? $_POST[ 'signature' ] : null, isset( $_POST[ 'action' ] ) ? $_POST[ 'action' ] : null, isset( $_POST[ 'timestamp' ] ) ? $_POST[ 'timestamp' ] : null, isset( $_POST[ 'pubkey' ] ) ? $_POST[ 'pubkey' ] : null );
254	if ( $secureconnection === true ) {
255	$checkPermission = checkLiveReportingAccess( $_POST[ 'livereportingurl' ] );
256	if ( $checkPermission ) {
257	echo json_encode( array( 'result' => "success", "message" => "Access has been granted" ) );
258	exit;
259	} else {
260	echo json_encode( array( 'result' => "error", "message" => "Error - Connection not allowed in the Managed Client Reports for WooCommerce Responder settings" ) );
261	exit;
262	}
263	} else if ( isset( $secureconnection[ 'error' ] ) ) {
264	echo json_encode( array( 'result' => "error", "message" => $secureconnection[ 'error' ] ) );
265	exit;
266	} else {
267	echo json_encode( array( 'result' => "error", "message" => "Error - Invalid Request" ) );
268	exit;
269	}
270	}
271	?>