mainwp / includes / api.php

api.php in MainWP Dashboard: Self-hosted WordPress Management for Agencies 4.2.4, at includes/api.php

425 lines 13.6 KB

Raw Download Zip

1	<?php
2	/**
3	* MainWP Client Live Report Responder
4	*
5	* Legacy Client Reports Extension.
6	*
7	* @package MainWP/Dashboard
8	*/
9
10	namespace MainWP\Dashboard;
11
12	/**
13	* MainWP Client Live Report Responder
14	*
15	* Legacy Client Reports Extension.
16	*
17	* @deprecated Moved to external Extension ( unprepared SQL ok )
18	* @see MainWP-Client-Reports-Extension
19	*/
20
21	/**
22	* Check if user has access.
23	*
24	* @param $siteurl Child Site URL.
25	*/
26	function check_live_reporting_access( $siteurl ) {
27	$siteurl = isset( $_POST['livereportingurl'] ) ? sanitize_text_field( wp_unslash( $_POST['livereportingurl'] ) ) : '';
28	$access = get_option( 'live-report-responder-provideaccess' );
29	return ( ( 'yes' == $access ) && ( get_option( 'live-report-responder-siteurl' ) == $siteurl ) );
30	}
31
32	/**
33	* Live Reports secure connection.
34	*
35	* @uses \MainWP\Dashboard\MainWP_Utility::update_option()
36	*/
37	function live_reports_responder_secure_connection() {
38
39	$siteurl = isset( $_POST['livereportingurl'] ) ? sanitize_text_field( wp_unslash( $_POST['livereportingurl'] ) ) : '';
40	$securitykey = isset( $_POST['securitykey'] ) ? sanitize_text_field( wp_unslash( $_POST['securitykey'] ) ) : '';
41	$signature = isset( $_POST['signature'] ) ? sanitize_text_field( wp_unslash( $_POST['signature'] ) ) : '';
42	$action = isset( $_POST['action'] ) ? sanitize_text_field( wp_unslash( $_POST['action'] ) ) : '';
43	$timestamp = isset( $_POST['timestamp'] ) ? sanitize_text_field( wp_unslash( $_POST['timestamp'] ) ) : '';
44	$pubkey = isset( $_POST['pubkey'] ) ? sanitize_text_field( wp_unslash( $_POST['pubkey'] ) ) : null;
45
46	if ( ( null == $siteurl ) \|\| ( null == $signature ) \|\| ( null == $action ) \|\| ( null == $timestamp ) ) {
47	return array( 'error' => 'Required data missing. Please reload the page and try again.' );
48	}
49
50	$access = get_option( 'live-report-responder-provideaccess' );
51	if ( ( 'yes' != $access ) \|\| ( get_option( 'live-report-responder-siteurl' ) != $siteurl ) ) {
52	return array( 'error' => 'Error - Connection not allowed in the Managed Client Reports for WooCommerce Responder settings' );
53	}
54
55	if ( $timestamp < ( time() - 48 * 60 * 60 ) ) {
56	return array( 'error' => 'Outdated request.' );
57	}
58
59	$current_key = get_option( 'live-report-responder-pubkey' );
60	if ( ( null !== $pubkey ) ) {
61	if ( ! empty( $current_key ) ) {
62	return array( 'error' => 'The dashboard is already connected, release the connection on the dashboard please.' );
63	}
64
65	MainWP_Utility::update_option( 'live-report-responder-pubkey', $pubkey );
66	$current_key = $pubkey;
67	}
68
69	if ( empty( $current_key ) ) {
70	return array( 'error' => 'The dashboard is not connected, please reconnect to establish a secure connection.' );
71	}
72
73	$auth = openssl_verify( $action . $securitykey . $timestamp, base64_decode( $signature ), base64_decode( $current_key ) ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions -- base64_encode used for http encoding compatible.
74	if ( 0 === $auth ) {
75	return array( 'error' => 'An error occured while verifying the secure signature.' );
76	} elseif ( -1 === $auth ) {
77	return array( 'error' => 'Authentication failed, please reconnect the dashboard.' );
78	}
79
80	if ( ( 'on' == get_option( 'live-reports-responder-security-id' ) ) && ( get_option( 'live-reports-responder-security-code' ) !== base64_decode( $securitykey ) ) ) { // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions -- base64_encode used for http encoding compatible.
81	return array( 'error' => 'Invalid security ID.' );
82	}
83
84	define( 'DOING_CRON', true );
85
86	return true;
87	}
88
89	/**
90	* Check database to see if client exists.
91	*
92	* @param string $email Email address to check for.
93	* @param string $siteid Child Site ID.
94	*
95	* @return array
96	*
97	* @uses \MainWP\Dashboard\MainWP_Live_Reports::filter_report()
98	*/
99	function check_if_valid_client( $email, $siteid ) {
100
101	$email = isset( $_POST['email'] ) ? sanitize_text_field( wp_unslash( $_POST['email'] ) ) : '';
102	$siteid = isset( $_POST['siteid'] ) ? sanitize_text_field( wp_unslash( $_POST['siteid'] ) ) : false;
103
104	$checkPermission = check_live_reporting_access();
105	$result = array();
106	if ( $checkPermission ) {
107
108	/**
109	* WordPress database instance.
110	*
111	* @global object
112	*/
113	global $wpdb;
114
115	$get_site_url = $wpdb->get_row( $wpdb->prepare( "SELECT `url` FROM {$wpdb->prefix}mainwp_wp WHERE id=%d", $siteid ) );
116	if ( ! empty( $get_site_url ) ) {
117	$get_site_details = $wpdb->get_row( $wpdb->prepare( "SELECT * FROM {$wpdb->prefix}mainwp_client_report_site_token WHERE token_id=%d AND token_value=%s AND site_url=%s", 12, $email, $get_site_url->url ) );
118	if ( $get_site_details ) {
119	$result['result'] = 'success';
120	$result['data'] = $get_site_details;
121	}
122	}
123	}
124
125	return $result;
126	}
127	$sites = ! empty( $siteid ) ? base64_encode( serialize( array( $siteid ) ) ) : ''; // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions -- base64_encode used for http encoding compatible.
128	if ( isset( $_POST['content'] ) && isset( $_POST['action'] ) && ( 'displaycontent' == $_POST['action'] ) ) {
129	$secureconnection = live_reports_responder_secure_connection();
130	if ( true === $secureconnection ) {
131	$checkPermission = check_live_reporting_access();
132	if ( $checkPermission ) {
133	$report = new \stdClass();
134	$report->title = 'Live Reports';
135	$report->date_from = strtotime( gmdate( 'Y-m-01' ) );
136	$report->date_to = strtotime( gmdate( 'Y-m-d' ) );
137	$report->client = '';
138	$report->client_id = 0;
139	$report->fname = '';
140	$report->fcompany = '';
141	$report->femail = '';
142	$report->name = '[client.name]';
143	$report->company = '';
144	$report->email = '';
145	$report->subject = 'Report for [client.site.name]';
146	$report->recurring_schedule = '';
147	$report->schedule_bcc_me = 0;
148	$report->header = wp_unslash( $_POST['content'] );
149	$report->body = '';
150	$report->footer = '';
151	$report->type = 0;
152	$report->sites = $sites;
153	$report->groups = '';
154	$report->schedule_nextsend = 0;
155	$filtered_reports = MainWP_Live_Reports::filter_report( $report, '' );
156	$site_id = isset( $_POST['siteid'] ) ? intval( $_POST['siteid'] ) : 0;
157	if ( ! empty( $site_id ) ) {
158	echo wp_json_encode(
159	array(
160	'result' => 'success',
161	'data' => html_entity_decode( stripslashes( $filtered_reports[ $site_id ]->filtered_header ) ),
162	)
163	);
164	}
165	exit;
166	} else {
167	echo wp_json_encode(
168	array(
169	'result' => 'error',
170	'message' => 'Permission Denied',
171	)
172	);
173	exit;
174	}
175	} elseif ( isset( $secureconnection['error'] ) ) {
176	echo wp_json_encode(
177	array(
178	'result' => 'error',
179	'message' => $secureconnection['error'],
180	)
181	);
182	exit;
183	} else {
184	echo wp_json_encode(
185	array(
186	'result' => 'error',
187	'message' => 'Required request data not found. Please try again.',
188	)
189	);
190	exit;
191	}
192	}
193	if ( isset( $_POST['content'] ) && isset( $_POST['action'] ) && ( 'livereport' == $_POST['action'] ) ) {
194	$secureconnection = live_reports_responder_secure_connection();
195	if ( true === $secureconnection ) {
196	$checkPermission = check_live_reporting_access();
197	if ( $checkPermission ) {
198	$checkifvalidclient = check_if_valid_client();
199	$allAccess = isset( $_POST['allAccess'] ) ? sanitize_text_field( wp_unslash( $_POST['allAccess'] ) ) : false;
200	if ( ( isset( $checkifvalidclient['result'] ) && 'success' == $checkifvalidclient['result'] ) \|\| $allAccess ) {
201	$report = new \stdClass();
202	$report->title = 'Live Report';
203	$report->date_from = isset( $_POST['date_from'] ) ? sanitize_text_field( wp_unslash( $_POST['date_from'] ) ) : '';
204	$report->date_to = isset( $_POST['date_to'] ) ? sanitize_text_field( wp_unslash( $_POST['date_to'] ) ) : '';
205	$report->client = '';
206	$report->client_id = 0;
207	$report->fname = '';
208	$report->fcompany = '';
209	$report->femail = '';
210	$report->name = '[client.name]';
211	$report->company = '';
212	$report->email = '';
213	$report->subject = 'Report for [client.site.name]';
214	$report->recurring_schedule = '';
215	$report->schedule_bcc_me = 0;
216	$report->header = wp_unslash( $_POST['content'] );
217	$report->body = '';
218	$report->footer = '';
219	$report->type = 0;
220	$report->sites = $sites;
221	$report->groups = '';
222	$report->schedule_nextsend = 0;
223	$allowed_tokens = isset( $_POST['allowed_tokens'] ) && is_array( $_POST['allowed_tokens'] ) ? sanitize_text_field( wp_unslash( $_POST['allowed_tokens'] ) ) : '';
224	$filtered_reports = MainWP_Live_Reports::filter_report( $report, $allowed_tokens );
225	echo wp_json_encode(
226	array(
227	'result' => 'success',
228	'data' => html_entity_decode( stripslashes( $filtered_reports[ $_POST['siteid'] ]->filtered_header ) ),
229	)
230	);
231	exit;
232	} else {
233	echo wp_json_encode(
234	array(
235	'result' => 'error',
236	'message' => 'No Report Found',
237	)
238	);
239	exit;
240	}
241	} else {
242	echo wp_json_encode(
243	array(
244	'result' => 'error',
245	'message' => 'Permission Denied',
246	)
247	);
248	exit;
249	}
250	} elseif ( isset( $secureconnection['error'] ) ) {
251	echo wp_json_encode(
252	array(
253	'result' => 'error',
254	'message' => $secureconnection['error'],
255	)
256	);
257	exit;
258	} else {
259	echo wp_json_encode(
260	array(
261	'result' => 'error',
262	'message' => 'Required request data not found. Please try again.',
263	)
264	);
265	exit;
266	}
267	}
268	if ( isset( $_POST['email'] ) && isset( $_POST['action'] ) && ( 'getallsitesbyemail' == $_POST['action'] ) && ! empty( $_POST['email'] ) ) {
269	$secureconnection = live_reports_responder_secure_connection();
270	if ( $secureconnection ) {
271	$checkPermission = check_live_reporting_access();
272	if ( $checkPermission ) {
273
274	/**
275	* WordPress database instance.
276	*
277	* @global object
278	*/
279	global $wpdb;
280
281	$result = array();
282	$get_allsites = $wpdb->get_results( $wpdb->prepare( "SELECT `site_url` FROM `{$wpdb->prefix}mainwp_client_report_site_token` WHERE token_id= %d AND token_value=%s ORDER BY `id` DESC", 12, sanitize_email( wp_unslash( $_POST['email'] ) ) ) );
283
284	if ( $get_allsites ) {
285	foreach ( $get_allsites as $site ) {
286	$get_site_details = $wpdb->get_row( $wpdb->prepare( "SELECT `id`,`name`,`url` FROM `{$wpdb->prefix}mainwp_wp` WHERE `url`=%s", $site->site_url ) );
287
288	if ( $get_site_details ) {
289	$result['result'] = 'success';
290	$result['data'][] = $get_site_details;
291	}
292	}
293	} else {
294	$result['result'] = 'error';
295	$result['message'] = 'No Site Found';
296	}
297	echo wp_json_encode( $result );
298	exit;
299	} else {
300	echo wp_json_encode(
301	array(
302	'result' => 'error',
303	'message' => 'Permission Denied',
304	)
305	);
306	exit;
307	}
308	} elseif ( isset( $secureconnection['error'] ) ) {
309	echo wp_json_encode(
310	array(
311	'result' => 'error',
312	'message' => $secureconnection['error'],
313	)
314	);
315	exit;
316	} else {
317	echo wp_json_encode(
318	array(
319	'result' => 'error',
320	'message' => 'Required request data not found. Please try again.',
321	)
322	);
323	exit;
324	}
325	}
326	if ( isset( $_POST['action'] ) && ( 'getallsites' == $_POST['action'] ) ) {
327	$secureconnection = live_reports_responder_secure_connection();
328	if ( true === $secureconnection ) {
329	$checkPermission = check_live_reporting_access();
330	if ( $checkPermission ) {
331
332	/**
333	* WordPress database instance.
334	*
335	* @global object
336	*/
337	global $wpdb;
338
339	$result = array();
340	$get_allsites = $wpdb->get_results( $wpdb->prepare( "SELECT `site_url` FROM `{$wpdb->prefix}mainwp_client_report_site_token` WHERE token_id= %d ORDER BY `id` DESC", 12 ) );
341
342	if ( $get_allsites ) {
343	foreach ( $get_allsites as $site ) {
344	$get_site_details = $wpdb->get_row( $wpdb->prepare( "SELECT `id`,`name`,`url` FROM `{$wpdb->prefix}mainwp_wp` WHERE `url`=%s", $site->site_url ) );
345
346	if ( $get_site_details ) {
347	$result['result'] = 'success';
348	$result['data'][] = $get_site_details;
349	}
350	}
351	} else {
352	$result['result'] = 'error';
353	$result['message'] = 'No Site Found';
354	}
355	echo wp_json_encode( $result );
356	exit;
357	} else {
358	echo wp_json_encode(
359	array(
360	'result' => 'error',
361	'message' => 'Permission Denied',
362	)
363	);
364	exit;
365	}
366	} elseif ( isset( $secureconnection['error'] ) ) {
367	echo wp_json_encode(
368	array(
369	'result' => 'error',
370	'message' => $secureconnection['error'],
371	)
372	);
373	exit;
374	} else {
375	echo wp_json_encode(
376	array(
377	'result' => 'error',
378	'message' => 'Required request data not found. Please try again.',
379	)
380	);
381	exit;
382	}
383	}
384	if ( isset( $_POST['action'] ) && ( 'checkvalid_live_reports_responder_url' == $_POST['action'] ) ) {
385	$secureconnection = live_reports_responder_secure_connection();
386	if ( true === $secureconnection ) {
387	$checkPermission = check_live_reporting_access();
388	if ( $checkPermission ) {
389	echo wp_json_encode(
390	array(
391	'result' => 'success',
392	'message' => 'Access has been granted',
393	)
394	);
395	exit;
396	} else {
397	echo wp_json_encode(
398	array(
399	'result' => 'error',
400	'message' => 'Error - Connection not allowed in the Managed Client Reports for WooCommerce Responder settings',
401	)
402	);
403	exit;
404	}
405	} elseif ( isset( $secureconnection['error'] ) ) {
406	echo wp_json_encode(
407	array(
408	'result' => 'error',
409	'message' => $secureconnection['error'],
410	)
411	);
412	exit;
413	} else {
414	echo wp_json_encode(
415	array(
416	'result' => 'error',
417	'message' => 'Required request data not found. Please try again.',
418	)
419	);
420	exit;
421	}
422	}
423
424	// phpcs:enable
425