mainwp / pages / page-mainwp-site-open.php

page-mainwp-site-open.php in MainWP Dashboard: Self-hosted WordPress Management for Agencies 4.6.0.1, at pages/page-mainwp-site-open.php

253 lines 7.6 KB

Raw Download Zip

1	<?php
2	/**
3	* This Class takes the requested Child Sites,
4	* and then redirects to child site WP Admin.
5	*
6	* @package MainWP/Site_Open
7	*/
8
9	namespace MainWP\Dashboard;
10
11	/**
12	* Class MainWP_Site_Open
13	*
14	* @package MainWP\Dashboard
15	*/
16	class MainWP_Site_Open {
17
18	/**
19	* Get Class Name
20	*
21	* @return string __CLASS__
22	*/
23	public static function get_class_name() {
24	return __CLASS__;
25	}
26
27	/**
28	* Child Site Dashboard Link redirect handler.
29	*
30	* This method checks to see if the current user is allow to access the
31	* Child Site, then grabs the websiteid, location, openurl & passes it onto
32	* either open_site_location or open_site methods.
33	*
34	* @uses \MainWP\Dashboard\MainWP_DB::get_website_by_id()
35	* @uses \MainWP\Dashboard\MainWP_System_Utility::can_edit_website()
36	*/
37	public static function render() {
38
39	self::verify_open_nonce();
40
41	if ( ! mainwp_current_user_have_right( 'dashboard', 'access_wpadmin_on_child_sites' ) ) {
42	mainwp_do_not_have_permissions( esc_html__( 'WP-Admin on child sites', 'mainwp' ) );
43
44	return;
45	}
46	// phpcs:disable WordPress.Security.NonceVerification,WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
47	if ( ! isset( $_GET['websiteid'] ) ) {
48	exit();
49	}
50
51	$id = intval( $_GET['websiteid'] );
52	$website = MainWP_DB::instance()->get_website_by_id( $id );
53
54	if ( ! MainWP_System_Utility::can_edit_website( $website ) ) {
55	exit();
56	}
57
58	$location = '';
59	if ( isset( $_GET['location'] ) ) {
60	$location = base64_decode( wp_unslash( $_GET['location'] ) ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions -- base64_decode used for HTTP compatible char.
61	}
62
63	if ( isset( $_GET['openUrl'] ) && 'yes' === $_GET['openUrl'] ) {
64	self::open_site_location( $website, $location );
65	} else {
66	self::open_site( $website, $location, ( isset( $_GET['newWindow'] ) ? sanitize_text_field( wp_unslash( $_GET['newWindow'] ) ) : null ) );
67	}
68	// phpcs:enable
69	}
70
71	/**
72	* This method opens the requested Child Site Admin.
73	*
74	* @param mixed $website Website ID.
75	* @param mixed $location Website Location.
76	*
77	* @uses \MainWP\Dashboard\MainWP_Connect::get_get_data_authed()
78	*/
79	public static function open_site( $website, $location ) {
80	if ( MainWP_Demo_Handle::get_instance()->is_demo_website( $website ) ) {
81	$action = $website->url . 'wp-admin.html';
82	} else {
83	$action = MainWP_Connect::get_get_data_authed( $website, ( null === $location \|\| '' === $location ) ? 'index.php' : $location );
84	}
85	?>
86	<div class="ui segment" style="padding: 25rem">
87	<div class="ui active inverted dimmer">
88	<div class="ui massive text loader"><?php esc_html_e( 'Redirecting...', 'mainwp' ); ?></div>
89	</div>
90	<form method="POST" action="<?php echo $action; // phpcs:ignore WordPress.Security.EscapeOutput ?>" id="redirectForm">
91	<?php wp_nonce_field( 'mainwp-admin-nonce' ); ?>
92	</form>
93	</div>
94	<?php
95	}
96
97	/**
98	* This renders the method open_site _restore()
99	*
100	* @uses \MainWP\Dashboard\MainWP_DB::get_website_by_id()
101	* @uses \MainWP\Dashboard\MainWP_System_Utility::can_edit_website()
102	*/
103	public static function render_restore() {
104
105	self::verify_open_nonce();
106
107	// phpcs:disable WordPress.Security.NonceVerification,WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
108	if ( ! isset( $_GET['websiteid'] ) ) {
109	exit();
110	}
111
112	$id = intval( $_GET['websiteid'] );
113	$website = MainWP_DB::instance()->get_website_by_id( $id );
114
115	if ( ! MainWP_System_Utility::can_edit_website( $website ) ) {
116	exit();
117	}
118
119	$file = '';
120	if ( isset( $_GET['f'] ) ) {
121	$file = base64_decode( esc_html( wp_unslash( $_GET['f'] ) ) ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions -- base64_encode used for http encoding compatible.
122	}
123
124	$site = isset( $_GET['size'] ) ? esc_html( wp_unslash( $_GET['size'] ) ) : '';
125	// phpcs:enable
126
127	self::open_site_restore( $website, $file, $site );
128	}
129
130	/**
131	* This opens the site restore.
132	*
133	* @param mixed $website Website ID.
134	* @param mixed $file Restore File.
135	* @param mixed $size Post data size.
136	*
137	* @uses \MainWP\Dashboard\MainWP_Connect::get_get_data_authed()
138	*/
139	public static function open_site_restore( $website, $file, $size ) {
140	?>
141	<div class="ui segment" style="padding: 25rem">
142	<div class="ui active inverted dimmer">
143	<div class="ui massive text loader"><?php esc_html_e( 'Redirecting...', 'mainwp' ); ?></div>
144	</div>
145	<?php
146
147	$url = ( isset( $website->url ) && '' !== $website->url ? $website->url : $website->siteurl );
148	$url .= ( '/' !== substr( $url, - 1 ) ? '/' : '' );
149
150	$postdata = MainWP_Connect::get_get_data_authed( $website, $file, 'f', true );
151	$postdata['size'] = $size;
152	?>
153	<form method="POST" action="<?php echo esc_url( $url ); ?>" id="redirectForm">
154	<?php wp_nonce_field( 'mainwp-admin-nonce' ); ?>
155	<?php
156	foreach ( $postdata as $name => $value ) {
157	echo '<input type="hidden" name="' . esc_attr( $name ) . '" value="' . esc_attr( $value ) . '" />';
158	}
159	?>
160	</form>
161	</div>
162	<?php
163	}
164
165	/**
166	* This verify opens the site nonce.
167	*/
168	public static function verify_open_nonce() {
169	$nonce = '_opennonce';
170	if ( isset( $_GET[ $nonce ] ) && wp_verify_nonce( sanitize_key( $_GET[ $nonce ] ), 'mainwp-admin-nonce' ) ) {
171	return true;
172	} else {
173	wp_die( esc_html__( 'Unauthorized request. Invalid or missing nonce, be sure you are using the current version of the MainWP Dashboard and Extensions.', 'mainwp' ) );
174	}
175	}
176
177	/**
178	* This opens the site location.
179	*
180	* @param mixed $website Website ID.
181	* @param mixed $open_location Website URL.
182	*
183	* @uses \MainWP\Dashboard\MainWP_Connect::get_get_data_authed()
184	*/
185	public static function open_site_location( $website, $open_location ) {
186	?>
187	<div class="ui segment" style="padding: 25rem">
188	<div class="ui active inverted dimmer">
189	<div class="ui massive text loader"><?php esc_html_e( 'Redirecting...', 'mainwp' ); ?></div>
190	</div>
191	<?php
192
193	$url = ( isset( $website->url ) && '' !== $website->url ? $website->url : $website->siteurl );
194	$url .= ( '/' !== substr( $url, - 1 ) ? '/' : '' );
195
196	$postdata = MainWP_Connect::get_get_data_authed( $website, 'index.php', 'where', true );
197	$postdata['open_location'] = base64_encode( $open_location ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions -- base64_encode used for http encoding compatible.
198	?>
199	<form method="POST" action="<?php echo esc_url( $url ); ?>" id="redirectForm">
200	<?php wp_nonce_field( 'mainwp-admin-nonce' ); ?>
201	<?php
202	foreach ( $postdata as $name => $value ) {
203	echo '<input type="hidden" name="' . esc_attr( $name ) . '" value="' . esc_attr( $value ) . '" />';
204	}
205	?>
206	</form>
207	</div>
208	<?php
209	}
210
211
212	/**
213	* Method get_open_site_url()
214	*
215	* Render render open site url.
216	*
217	* @param mixed $website Website ID.
218	* @param mixed $location open location.
219	* @param bool $echo_out Echo or not.
220	*
221	* @return mixed Render modal window for themes selection.
222	*/
223	public static function get_open_site_url( $website, $location = '', $echo_out = true ) {
224
225	$site_id = 0;
226
227	if ( is_numeric( $website ) ) {
228	$site_id = $website;
229	} elseif ( is_object( $website ) ) {
230	$site_id = $website->id;
231	} else {
232	return '';
233	}
234
235	$open_url = '';
236
237	if ( MainWP_Demo_Handle::get_instance()->is_demo_website( $site_id ) ) {
238	$open_url = MainWP_Demo_Handle::get_instance()->get_open_site_demo_url( $site_id );
239	} else {
240	$open_url = 'admin.php?page=SiteOpen&newWindow=yes&websiteid=' . $site_id . '&_opennonce=' . esc_html( wp_create_nonce( 'mainwp-admin-nonce' ) );
241	if ( ! empty( $location ) ) {
242	$open_url .= '&location=' . $location;
243	}
244	}
245
246	if ( $echo_out ) {
247	echo $open_url; //phpcs:ignore WordPress.Security.EscapeOutput
248	}
249
250	return $open_url;
251	}
252	}
253