mainwp / pages / page-mainwp-site-open.php

page-mainwp-site-open.php in MainWP Dashboard: Self-hosted WordPress Management for Agencies 6.2.2, at pages/page-mainwp-site-open.php

392 lines 14.4 KB

Raw Download Zip

1	<?php
2	/**
3	* This Class takes the requested Child Sites,
4	* and then redirects to child site WP Admin.
5	*
6	* @package MainWP/Site_Open
7	*/
8
9	namespace MainWP\Dashboard;
10
11	// Exit if accessed directly.
12	if ( ! defined( 'ABSPATH' ) ) {
13	exit;
14	}
15
16	/**
17	* Class MainWP_Site_Open
18	*
19	* @package MainWP\Dashboard
20	*/
21	class MainWP_Site_Open { // phpcs:ignore Generic.Classes.OpeningBraceSameLine.ContentAfterBrace -- NOSONAR.
22
23	/**
24	* Get Class Name
25	*
26	* @return string __CLASS__
27	*/
28	public static function get_class_name() {
29	return __CLASS__;
30	}
31
32	/**
33	* Method get_open_site_admin_link()
34	*
35	* @param mixed $siteId Site ID.
36	* @param mixed $prt_content Print url or not.
37	* @param mixed $newWindow Open in new window.
38	* @param mixed $opennonce Open nonce.
39	* @param mixed $addition Additional parameters.
40	*
41	* @return string Link to open site.
42	*/
43	public static function get_open_site_admin_link( $siteId, $prt_content = false, $newWindow = true, $opennonce = '', $addition = '' ) {
44
45	/**
46	* Filter: mainwp_open_site_addition_url
47	* Filter additional URL parameters for open site URL.
48	*
49	* @since 6.0
50	*/
51	$addition = apply_filters( 'mainwp_open_site_addition_url', $addition, $siteId, $newWindow, $opennonce );
52
53	$url = 'admin.php?page=SiteOpen&newWindow=' . ( $newWindow ? 'yes' : 'no' ) . '&websiteid=' . intval( $siteId ) . '&_opennonce=' . ( empty( $opennonce ) ? esc_attr( wp_create_nonce( 'mainwp-admin-nonce' ) ) : esc_attr( $opennonce ) ) . $addition;
54
55	if ( $prt_content ) {
56	echo esc_url( $url );
57	}
58
59	return $url;
60	}
61
62	/**
63	* Child Site Dashboard Link redirect handler.
64	*
65	* This method checks to see if the current user is allow to access the
66	* Child Site, then grabs the websiteid, location, openurl & passes it onto
67	* either open_site_location or open_site methods.
68	*
69	* @uses \MainWP\Dashboard\MainWP_DB::get_website_by_id()
70	* @uses \MainWP\Dashboard\MainWP_System_Utility::can_edit_website()
71	*/
72	public static function render() { // phpcs:ignore -- NOSONAR - complex.
73
74	static::verify_open_nonce();
75
76	if ( ! \mainwp_current_user_can( 'dashboard', 'access_wpadmin_on_child_sites' ) ) {
77	\mainwp_do_not_have_permissions( esc_html__( 'WP-Admin on child sites', 'mainwp' ) );
78
79	return;
80	}
81	// phpcs:disable WordPress.Security.NonceVerification,WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
82	if ( ! isset( $_GET['websiteid'] ) ) {
83	exit();
84	}
85
86	$id = intval( $_GET['websiteid'] );
87	$website = MainWP_DB::instance()->get_website_by_id( $id );
88
89	if ( ! MainWP_System_Utility::can_edit_website( $website ) ) {
90	exit();
91	}
92
93	$location = '';
94	if ( isset( $_GET['location'] ) ) {
95	$location = base64_decode( wp_unslash( $_GET['location'] ) ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions -- base64_decode used for HTTP compatible char.
96	}
97
98	$request_uri = isset( $_SERVER['REQUEST_URI'] ) ? wp_unslash( $_SERVER['REQUEST_URI'] ) : '';
99
100	$query = wp_parse_url( $request_uri, PHP_URL_QUERY );
101
102	$add_params = array();
103
104	if ( $query ) {
105	parse_str( $query, $add_params );
106	}
107
108	$exclude_keys = array( 'page', 'websiteid', 'location', '_opennonce', '_opennonce', 'openUrl', 'filedl', 'dirdl', 'closeWindow' );
109
110	if ( isset( $_GET['openUrl'] ) && 'yes' === $_GET['openUrl'] ) {
111
112	$postdata = MainWP_Connect::get_get_data_authed( $website, 'index.php', 'where', true, array( 'verify_signature' => true ) );
113	$postdata['open_location'] = $location; // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions -- base64_encode used for http encoding compatible.
114	?>
115	<div class="ui segment" style="padding: 25rem">
116	<div class="ui active dimmer">
117	<div class="ui massive double text loader"><?php esc_html_e( 'Redirecting...', 'mainwp' ); ?></div>
118	</div>
119	<?php
120	$url = MainWP_Site_Url_Corrector::browser_target_url( $website );
121	$url .= ( '/' !== substr( $url, - 1 ) ? '/' : '' );
122	?>
123	<form method="POST" action="<?php echo esc_url( $url ); ?>" id="redirectForm"> <?php // phpcs:ignore -- NOSONAR - dublicate id ok. ?>
124	<?php MainWP_UI::generate_wp_nonce( 'mainwp-admin-nonce' ); ?>
125	<?php
126	foreach ( $postdata as $name => $value ) {
127	echo '<input type="hidden" name="' . esc_attr( $name ) . '" value="' . esc_attr( $value ) . '" />';
128	}
129
130	if ( is_array( $add_params ) ) {
131	foreach ( $add_params as $name => $value ) {
132	if ( in_array( $name, $exclude_keys, true ) ) {
133	continue;
134	}
135	echo '<input type="hidden" name="' . esc_attr( $name ) . '" value="' . esc_attr( $value ) . '" />';
136	}
137	}
138
139	?>
140	</form>
141	</div>
142	<?php
143	} else {
144	$allow_params = array();
145
146	if ( is_array( $add_params ) ) {
147	foreach ( $add_params as $name => $value ) {
148	if ( in_array( $name, $exclude_keys, true ) ) {
149	continue;
150	}
151	$allow_params[ $name ] = $value;
152	}
153	}
154
155	$allow_vars = array(
156	'filedl',
157	'dirdl',
158	);
159
160	$allow_vars = apply_filters( 'mainwp_open_site_allow_vars', $allow_vars );
161	if ( is_array( $allow_vars ) ) {
162	foreach ( $allow_vars as $var ) {
163	if ( is_string( $var ) && isset( $_GET[ $var ] ) ) {
164	$allow_params[ $var ] = $_GET[ $var ]; // phpcs:ignore -- ok.
165	}
166	}
167	}
168
169	static::open_site( $website, $location, $allow_params );
170	}
171	// phpcs:enable
172	}
173
174	/**
175	* This method opens the requested Child Site Admin.
176	*
177	* @param mixed $website Website ID.
178	* @param mixed $location Website Location.
179	* @param array $params others params.
180	*
181	* @uses \MainWP\Dashboard\MainWP_Connect::get_get_data_authed()
182	*/
183	private static function open_site( $website, $location, $params = array() ) {
184	if ( ! is_array( $params ) ) {
185	$params = array();
186	}
187
188	$action_url = '';
189	if ( MainWP_Demo_Handle::get_instance()->is_demo_website( $website ) ) {
190	$action_url = $website->url . 'wp-admin.html';
191	} else {
192	if ( ! isset( $params['verify_signature'] ) ) {
193	$params['verify_signature'] = true; // enable for open site.
194	}
195	$action_url = MainWP_Connect::get_get_data_authed( $website, ( null === $location \|\| '' === $location ) ? 'index.php' : $location, 'where', false, $params, MainWP_Site_Url_Corrector::browser_target_url( $website ) );
196	}
197
198	$open_download = ! empty( $params['filedl'] ) ? true : false;
199	$close_window = ! empty( $_GET['closeWindow'] ) ? true : false; //phpcs:ignore -- ok.
200
201	/**
202	* Action: mainwp_site_go_to_wpadmin
203	*
204	* Fire before go to wp admin child site.
205	*
206	* @since 5.5
207	*/
208	do_action( 'mainwp_site_go_to_wpadmin', $website, $location, $params, $action_url );
209
210	MainWP_Logger::instance()->debug_for_website( $website, 'open site', 'action [' . $action_url . ']' );
211
212	?>
213	<div class="ui segment">
214	<div class="ui active page dimmer <?php echo $open_download \|\| $close_window ? 'open-site-close-window' : ''; ?>" style="margin: 0 !important;">
215	<?php
216	if ( $open_download ) {
217	?>
218	<div class="ui double text loader"><?php esc_html_e( 'Downloading...', 'mainwp' ); ?></div>
219	<?php
220	} else {
221	?>
222	<div class="ui double text loader"><?php esc_html_e( 'Redirecting...', 'mainwp' ); ?></div>
223	<?php
224	}
225	?>
226	</div>
227	<form method="POST" action="<?php echo $action_url; // phpcs:ignore WordPress.Security.EscapeOutput ?>" id="redirectForm">
228	<?php MainWP_UI::generate_wp_nonce( 'mainwp-admin-nonce' ); ?>
229	</form>
230	</div>
231	<?php
232	}
233
234	/**
235	* This renders the method open_site _restore()
236	*
237	* @uses \MainWP\Dashboard\MainWP_DB::get_website_by_id()
238	* @uses \MainWP\Dashboard\MainWP_System_Utility::can_edit_website()
239	*/
240	public static function render_restore() {
241
242	static::verify_open_nonce();
243
244	// phpcs:disable WordPress.Security.NonceVerification,WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
245	if ( ! isset( $_GET['websiteid'] ) ) {
246	exit();
247	}
248
249	$id = intval( $_GET['websiteid'] );
250	$website = MainWP_DB::instance()->get_website_by_id( $id );
251
252	if ( ! MainWP_System_Utility::can_edit_website( $website ) ) {
253	exit();
254	}
255
256	$file = '';
257	if ( isset( $_GET['f'] ) ) {
258	$file = base64_decode( esc_html( wp_unslash( $_GET['f'] ) ) ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions -- base64_encode used for http encoding compatible.
259	}
260
261	$site = isset( $_GET['size'] ) ? esc_html( wp_unslash( $_GET['size'] ) ) : '';
262	// phpcs:enable
263
264	static::open_site_restore( $website, $file, $site );
265	}
266
267	/**
268	* This opens the site restore.
269	*
270	* @param mixed $website Website ID.
271	* @param mixed $file Restore File.
272	* @param mixed $size Post data size.
273	*
274	* @uses \MainWP\Dashboard\MainWP_Connect::get_get_data_authed()
275	*/
276	public static function open_site_restore( $website, $file, $size ) {
277	?>
278	<div class="ui segment" style="padding: 25rem">
279	<div class="ui active dimmer">
280	<div class="ui massive double text loader"><?php esc_html_e( 'Redirecting...', 'mainwp' ); ?></div>
281	</div>
282	<?php
283
284	$url = MainWP_Site_Url_Corrector::browser_target_url( $website );
285	$url .= ( '/' !== substr( $url, - 1 ) ? '/' : '' );
286
287	$postdata = MainWP_Connect::get_get_data_authed( $website, $file, 'f', true, array( 'verify_signature' => true ) );
288	$postdata['size'] = $size;
289	?>
290	<form method="POST" action="<?php echo esc_url( $url ); ?>" id="redirectForm">
291	<?php MainWP_UI::generate_wp_nonce( 'mainwp-admin-nonce' ); ?>
292	<?php
293	foreach ( $postdata as $name => $value ) {
294	echo '<input type="hidden" name="' . esc_attr( $name ) . '" value="' . esc_attr( $value ) . '" />';
295	}
296	?>
297	</form>
298	</div>
299	<?php
300	}
301
302	/**
303	* This verify opens the site nonce.
304	*/
305	public static function verify_open_nonce() {
306	$nonce = '_opennonce';
307	if ( isset( $_GET[ $nonce ] ) && wp_verify_nonce( sanitize_key( $_GET[ $nonce ] ), 'mainwp-admin-nonce' ) ) {
308	return true;
309	} else {
310	wp_die( esc_html__( 'Unauthorized request. Invalid or missing nonce, be sure you are using the current version of the MainWP Dashboard and Extensions.', 'mainwp' ) );
311	}
312	}
313
314	/**
315	* This opens the site location.
316	*
317	* @outdated
318	*
319	* @param mixed $website Website ID.
320	* @param mixed $open_location Website URL.
321	*
322	* @uses \MainWP\Dashboard\MainWP_Connect::get_get_data_authed()
323	*/
324	public static function open_site_location( $website, $open_location ) {
325	?>
326	<div class="ui segment" style="padding: 25rem">
327	<div class="ui active dimmer">
328	<div class="ui massive double text loader"><?php esc_html_e( 'Redirecting...', 'mainwp' ); ?></div>
329	</div>
330	<?php
331
332	$url = MainWP_Site_Url_Corrector::browser_target_url( $website );
333	$url .= ( '/' !== substr( $url, - 1 ) ? '/' : '' );
334
335	$postdata = MainWP_Connect::get_get_data_authed( $website, 'index.php', 'where', true, array( 'verify_signature' => true ) );
336	$postdata['open_location'] = $open_location; // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions -- base64_encode used for http encoding compatible.
337	?>
338	<form method="POST" action="<?php echo esc_url( $url ); ?>" id="redirectForm">
339	<?php MainWP_UI::generate_wp_nonce( 'mainwp-admin-nonce' ); ?>
340	<?php
341	foreach ( $postdata as $name => $value ) {
342	echo '<input type="hidden" name="' . esc_attr( $name ) . '" value="' . esc_attr( $value ) . '" />';
343	}
344	?>
345	</form>
346	</div>
347	<?php
348	}
349
350
351	/**
352	* Method get_open_site_url()
353	*
354	* Render render open site url.
355	*
356	* @param mixed $website Website ID.
357	* @param mixed $location open location.
358	* @param bool $echo_out Echo or not.
359	*
360	* @return mixed Render modal window for themes selection.
361	*/
362	public static function get_open_site_url( $website, $location = '', $echo_out = true ) {
363
364	$site_id = 0;
365
366	if ( is_numeric( $website ) ) {
367	$site_id = $website;
368	} elseif ( is_object( $website ) ) {
369	$site_id = $website->id;
370	} else {
371	return '';
372	}
373
374	$open_url = '';
375
376	if ( MainWP_Demo_Handle::get_instance()->is_demo_website( $site_id ) ) {
377	$open_url = MainWP_Demo_Handle::get_instance()->get_open_site_demo_url( $site_id );
378	} else {
379	$open_url = self::get_open_site_admin_link( $site_id );
380	if ( ! empty( $location ) ) {
381	$open_url .= '&location=' . $location;
382	}
383	}
384
385	if ( $echo_out ) {
386	echo $open_url; //phpcs:ignore WordPress.Security.EscapeOutput
387	}
388
389	return $open_url;
390	}
391	}
392