mainwp / pages / page-mainwp-site-open.php

page-mainwp-site-open.php in MainWP Dashboard: Self-hosted WordPress Management for Agencies 5.2.1, at pages/page-mainwp-site-open.php

280 lines 10.1 KB

Raw Download Zip

1	<?php
2	/**
3	* This Class takes the requested Child Sites,
4	* and then redirects to child site WP Admin.
5	*
6	* @package MainWP/Site_Open
7	*/
8
9	namespace MainWP\Dashboard;
10
11	/**
12	* Class MainWP_Site_Open
13	*
14	* @package MainWP\Dashboard
15	*/
16	class MainWP_Site_Open { // phpcs:ignore Generic.Classes.OpeningBraceSameLine.ContentAfterBrace -- NOSONAR.
17
18	/**
19	* Get Class Name
20	*
21	* @return string __CLASS__
22	*/
23	public static function get_class_name() {
24	return __CLASS__;
25	}
26
27	/**
28	* Child Site Dashboard Link redirect handler.
29	*
30	* This method checks to see if the current user is allow to access the
31	* Child Site, then grabs the websiteid, location, openurl & passes it onto
32	* either open_site_location or open_site methods.
33	*
34	* @uses \MainWP\Dashboard\MainWP_DB::get_website_by_id()
35	* @uses \MainWP\Dashboard\MainWP_System_Utility::can_edit_website()
36	*/
37	public static function render() { // phpcs:ignore -- NOSONAR - complex.
38
39	static::verify_open_nonce();
40
41	if ( ! mainwp_current_user_have_right( 'dashboard', 'access_wpadmin_on_child_sites' ) ) {
42	mainwp_do_not_have_permissions( esc_html__( 'WP-Admin on child sites', 'mainwp' ) );
43
44	return;
45	}
46	// phpcs:disable WordPress.Security.NonceVerification,WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
47	if ( ! isset( $_GET['websiteid'] ) ) {
48	exit();
49	}
50
51	$id = intval( $_GET['websiteid'] );
52	$website = MainWP_DB::instance()->get_website_by_id( $id );
53
54	if ( ! MainWP_System_Utility::can_edit_website( $website ) ) {
55	exit();
56	}
57
58	$location = '';
59	if ( isset( $_GET['location'] ) ) {
60	$location = base64_decode( wp_unslash( $_GET['location'] ) ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions -- base64_decode used for HTTP compatible char.
61	}
62
63	if ( isset( $_GET['openUrl'] ) && 'yes' === $_GET['openUrl'] ) {
64	static::open_site_location( $website, $location );
65	} else {
66	$allow_params = array();
67
68	$allow_vars = array(
69	'filedl',
70	'dirdl',
71	);
72	$allow_vars = apply_filters( 'mainwp_open_site_allow_vars', $allow_vars );
73	if ( is_array( $allow_vars ) ) {
74	foreach ( $allow_vars as $var ) {
75	if ( is_string( $var ) && isset( $_GET[ $var ] ) ) {
76	$allow_params[ $var ] = $_GET[ $var ]; // phpcs:ignore -- ok.
77	}
78	}
79	}
80	static::open_site( $website, $location, $allow_params );
81	}
82	// phpcs:enable
83	}
84
85	/**
86	* This method opens the requested Child Site Admin.
87	*
88	* @param mixed $website Website ID.
89	* @param mixed $location Website Location.
90	* @param array $params others params.
91	*
92	* @uses \MainWP\Dashboard\MainWP_Connect::get_get_data_authed()
93	*/
94	private static function open_site( $website, $location, $params = array() ) {
95	if ( MainWP_Demo_Handle::get_instance()->is_demo_website( $website ) ) {
96	$action = $website->url . 'wp-admin.html';
97	} else {
98	$action = MainWP_Connect::get_get_data_authed( $website, ( null === $location \|\| '' === $location ) ? 'index.php' : $location, 'where', false, $params );
99	}
100	$open_download = ! empty( $params['filedl'] ) ? true : false;
101	$close_window = ! empty( $_GET['closeWindow'] ) ? true : false; //phpcs:ignore -- ok.
102	?>
103	<div class="ui segment" style="padding: 25rem">
104	<div class="ui active inverted dimmer <?php echo $open_download \|\| $close_window ? 'open-site-close-window' : ''; ?>">
105	<?php
106	if ( $open_download ) {
107	?>
108	<div class="ui massive text loader"><?php esc_html_e( 'Downloading...', 'mainwp' ); ?></div>
109	<?php
110	} else {
111	?>
112	<div class="ui massive text loader"><?php esc_html_e( 'Redirecting...', 'mainwp' ); ?></div>
113	<?php
114	}
115	?>
116	</div>
117	<form method="POST" action="<?php echo $action; // phpcs:ignore WordPress.Security.EscapeOutput ?>" id="redirectForm">
118	<?php wp_nonce_field( 'mainwp-admin-nonce' ); ?>
119	</form>
120	</div>
121	<?php
122	}
123
124	/**
125	* This renders the method open_site _restore()
126	*
127	* @uses \MainWP\Dashboard\MainWP_DB::get_website_by_id()
128	* @uses \MainWP\Dashboard\MainWP_System_Utility::can_edit_website()
129	*/
130	public static function render_restore() {
131
132	static::verify_open_nonce();
133
134	// phpcs:disable WordPress.Security.NonceVerification,WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
135	if ( ! isset( $_GET['websiteid'] ) ) {
136	exit();
137	}
138
139	$id = intval( $_GET['websiteid'] );
140	$website = MainWP_DB::instance()->get_website_by_id( $id );
141
142	if ( ! MainWP_System_Utility::can_edit_website( $website ) ) {
143	exit();
144	}
145
146	$file = '';
147	if ( isset( $_GET['f'] ) ) {
148	$file = base64_decode( esc_html( wp_unslash( $_GET['f'] ) ) ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions -- base64_encode used for http encoding compatible.
149	}
150
151	$site = isset( $_GET['size'] ) ? esc_html( wp_unslash( $_GET['size'] ) ) : '';
152	// phpcs:enable
153
154	static::open_site_restore( $website, $file, $site );
155	}
156
157	/**
158	* This opens the site restore.
159	*
160	* @param mixed $website Website ID.
161	* @param mixed $file Restore File.
162	* @param mixed $size Post data size.
163	*
164	* @uses \MainWP\Dashboard\MainWP_Connect::get_get_data_authed()
165	*/
166	public static function open_site_restore( $website, $file, $size ) {
167	?>
168	<div class="ui segment" style="padding: 25rem">
169	<div class="ui active inverted dimmer">
170	<div class="ui massive text loader"><?php esc_html_e( 'Redirecting...', 'mainwp' ); ?></div>
171	</div>
172	<?php
173
174	$url = ( isset( $website->url ) && '' !== $website->url ? $website->url : $website->siteurl );
175	$url .= ( '/' !== substr( $url, - 1 ) ? '/' : '' );
176
177	$postdata = MainWP_Connect::get_get_data_authed( $website, $file, 'f', true );
178	$postdata['size'] = $size;
179	?>
180	<form method="POST" action="<?php echo esc_url( $url ); ?>" id="redirectForm">
181	<?php wp_nonce_field( 'mainwp-admin-nonce' ); ?>
182	<?php
183	foreach ( $postdata as $name => $value ) {
184	echo '<input type="hidden" name="' . esc_attr( $name ) . '" value="' . esc_attr( $value ) . '" />';
185	}
186	?>
187	</form>
188	</div>
189	<?php
190	}
191
192	/**
193	* This verify opens the site nonce.
194	*/
195	public static function verify_open_nonce() {
196	$nonce = '_opennonce';
197	if ( isset( $_GET[ $nonce ] ) && wp_verify_nonce( sanitize_key( $_GET[ $nonce ] ), 'mainwp-admin-nonce' ) ) {
198	return true;
199	} else {
200	wp_die( esc_html__( 'Unauthorized request. Invalid or missing nonce, be sure you are using the current version of the MainWP Dashboard and Extensions.', 'mainwp' ) );
201	}
202	}
203
204	/**
205	* This opens the site location.
206	*
207	* @param mixed $website Website ID.
208	* @param mixed $open_location Website URL.
209	*
210	* @uses \MainWP\Dashboard\MainWP_Connect::get_get_data_authed()
211	*/
212	public static function open_site_location( $website, $open_location ) {
213	?>
214	<div class="ui segment" style="padding: 25rem">
215	<div class="ui active inverted dimmer">
216	<div class="ui massive text loader"><?php esc_html_e( 'Redirecting...', 'mainwp' ); ?></div>
217	</div>
218	<?php
219
220	$url = ( isset( $website->url ) && '' !== $website->url ? $website->url : $website->siteurl );
221	$url .= ( '/' !== substr( $url, - 1 ) ? '/' : '' );
222
223	$postdata = MainWP_Connect::get_get_data_authed( $website, 'index.php', 'where', true );
224	$postdata['open_location'] = base64_encode( $open_location ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions -- base64_encode used for http encoding compatible.
225	?>
226	<form method="POST" action="<?php echo esc_url( $url ); ?>" id="redirectForm">
227	<?php wp_nonce_field( 'mainwp-admin-nonce' ); ?>
228	<?php
229	foreach ( $postdata as $name => $value ) {
230	echo '<input type="hidden" name="' . esc_attr( $name ) . '" value="' . esc_attr( $value ) . '" />';
231	}
232	?>
233	</form>
234	</div>
235	<?php
236	}
237
238
239	/**
240	* Method get_open_site_url()
241	*
242	* Render render open site url.
243	*
244	* @param mixed $website Website ID.
245	* @param mixed $location open location.
246	* @param bool $echo_out Echo or not.
247	*
248	* @return mixed Render modal window for themes selection.
249	*/
250	public static function get_open_site_url( $website, $location = '', $echo_out = true ) {
251
252	$site_id = 0;
253
254	if ( is_numeric( $website ) ) {
255	$site_id = $website;
256	} elseif ( is_object( $website ) ) {
257	$site_id = $website->id;
258	} else {
259	return '';
260	}
261
262	$open_url = '';
263
264	if ( MainWP_Demo_Handle::get_instance()->is_demo_website( $site_id ) ) {
265	$open_url = MainWP_Demo_Handle::get_instance()->get_open_site_demo_url( $site_id );
266	} else {
267	$open_url = 'admin.php?page=SiteOpen&newWindow=yes&websiteid=' . $site_id . '&_opennonce=' . esc_html( wp_create_nonce( 'mainwp-admin-nonce' ) );
268	if ( ! empty( $location ) ) {
269	$open_url .= '&location=' . $location;
270	}
271	}
272
273	if ( $echo_out ) {
274	echo $open_url; //phpcs:ignore WordPress.Security.EscapeOutput
275	}
276
277	return $open_url;
278	}
279	}
280