← All changes | includes/class-ph-licenses.php +72 -30 2.2.6 → 2.3.1 View file →

		@@ -43,9 +43,9 @@
43	43	*
44	44	* @since 1.0.0
45	45	*/
46	46	public function __clone() {
47		- _doing_it_wrong( __FUNCTION__, __( 'Cheatin’ huh?', 'propertyhive' ), '1.0.0' );
	47	+ _doing_it_wrong( __FUNCTION__, esc_html__( 'Cheatin’ huh?', 'propertyhive' ), '1.0.0' );
48	48	}
49	49
50	50	/**
51	51	* Unserializing instances of this class is forbidden.
		@@ -52,9 +52,9 @@
52	52	*
53	53	* @since 1.0.0
54	54	*/
55	55	public function __wakeup() {
56		- _doing_it_wrong( __FUNCTION__, __( 'Cheatin’ huh?', 'propertyhive' ), '1.0.0' );
	56	+ _doing_it_wrong( __FUNCTION__, esc_html__( 'Cheatin’ huh?', 'propertyhive' ), '1.0.0' );
57	57	}
58	58
59	59	/**
60	60	* Constructor for the licenses class
		@@ -150,8 +150,13 @@
150	150	$product_id_and_package = PH()->license->get_pro_license_product_id_and_package();
151	151
152	152	if ( isset($product_id_and_package['success']) && $product_id_and_package['success'] === true )
153	153	{
	154	+ if ( ( $product_id_and_package['is_trial'] ?? null ) !== false )
	155	+ {
	156	+ return false;
	157	+ }
	158	+
154	159	if (
155	160	isset($feature['plans']) &&
156	161	isset($product_id_and_package['package']) &&
157	162	in_array($product_id_and_package['package'], $feature['plans'])
		@@ -211,14 +216,14 @@
211	216
212	217	$data['php_version'] = phpversion();
213	218	$data['ph_version'] = PH_VERSION;
214	219	$data['wp_version'] = get_bloginfo( 'version' );
215		- $data['server'] = isset( $_SERVER['SERVER_SOFTWARE'] ) ? $_SERVER['SERVER_SOFTWARE'] : '';
	220	+ $data['server'] = isset( $_SERVER['SERVER_SOFTWARE'] ) && is_string( $_SERVER['SERVER_SOFTWARE'] ) ? sanitize_text_field( wp_unslash( $_SERVER['SERVER_SOFTWARE'] ) ) : '';
216	221
217	222	$data['install_date'] = get_option('propertyhive_install_timestamp', '');
218	223	if ( $data['install_date'] != '' && $data['install_date'] != 0 )
219	224	{
220		- $data['install_date'] = date("jS F Y", $data['install_date']);
	225	+ $data['install_date'] = gmdate("jS F Y", $data['install_date']);
221	226	}
222	227
223	228	$data['multisite'] = is_multisite();
224	229	$data['theme'] = $theme;
		@@ -350,10 +355,10 @@
350	355	$data['locrating_enabled'] = ( $locrating_settings['enabled'] == 1 ? $locrating_settings['enabled'] : 0 );
351	356	}
352	357
353	358	// Search analytics
354		- $table_name = $wpdb->prefix . 'ph_search_log';
355	359
	360	+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching -- Aggregate current custom-table analytics for the license report; new search events and retention change these counts independently.
356	361	$counts = $wpdb->get_row(
357	362	"SELECT
358	363	COALESCE(
359	364	SUM(searched_at >= UTC_TIMESTAMP() - INTERVAL 7 DAY),
		@@ -363,9 +368,9 @@
363	368	SUM(searched_at >= UTC_TIMESTAMP() - INTERVAL 30 DAY),
364	369	0
365	370	) AS last_30_days,
366	371	COUNT(*) AS last_90_days
367		- FROM {$table_name}
	372	+ FROM {$wpdb->prefix}ph_search_log
368	373	WHERE searched_at >= UTC_TIMESTAMP() - INTERVAL 90 DAY",
369	374	ARRAY_A
370	375	);
371	376
		@@ -382,13 +387,14 @@
382	387	{
383	388	$args = array(
384	389	'post_type' => $post_type,
385	390	'fields' => 'ids',
386		- 'nopaging' => TRUE,
	391	+ 'posts_per_page' => 1,
387	392	'post_status' => 'publish'
388	393	);
389	394	if ( $post_type == 'property' )
390	395	{
	396	+ // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_query -- On-market state is stored in property metadata; retrieve one ID and use found_posts for the aggregate count.
391	397	$args['meta_query'] = array(
392	398	array(
393	399	'key' => '_on_market',
394	400	'value' => 'yes'
		@@ -402,8 +408,42 @@
402	408
403	409	wp_reset_postdata();
404	410	}
405	411
	412	+ $departments = array_keys( ph_get_departments() );
	413	+ foreach ( $departments as $department )
	414	+ {
	415	+ $department_option = 'propertyhive_active_departments_' . str_replace( 'residential-', '', $department );
	416	+ if ( get_option( $department_option ) != 'yes' )
	417	+ {
	418	+ continue;
	419	+ }
	420	+
	421	+ $args = array(
	422	+ 'post_type' => 'property',
	423	+ 'fields' => 'ids',
	424	+ 'posts_per_page' => 1,
	425	+ 'post_status' => 'publish',
	426	+ // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_query -- Department and on-market state use property metadata; retrieve one ID and use found_posts for the opted-in aggregate count.
	427	+ 'meta_query' => array(
	428	+ array(
	429	+ 'key' => '_on_market',
	430	+ 'value' => 'yes'
	431	+ ),
	432	+ array(
	433	+ 'key' => '_department',
	434	+ 'value' => $department
	435	+ )
	436	+ )
	437	+ );
	438	+
	439	+ $post_query = new WP_Query( $args );
	440	+
	441	+ $data['property_count_by_department_' . $department] = $post_query->found_posts;
	442	+
	443	+ wp_reset_postdata();
	444	+ }
	445	+
406	446	$data = apply_filters( 'propertyhive_license_check_data', $data );
407	447	}
408	448
409	449	return $data;
		@@ -422,10 +462,9 @@
422	462	}
423	463
424	464	update_option( 'propertyhive_last_license_check', time() );
425	465
426		- // Start by removing what we already know about the license
427		- update_option( 'propertyhive_license_key_details', '', 'no' );
	466	+ // Retain last-known license details during outages; replace them only with a valid HTTPS response.
428	467	update_option( 'propertyhive_license_key_error', '', 'no' );
429	468
430	469	$data = $this->get_data_for_license_check();
431	470
		@@ -431,9 +470,9 @@
431	470
432	471	$request = wp_remote_post( 'http://license.wp-property-hive.com/check-license.php', array(
433	472	'method' => 'POST',
434	473	'timeout' => 20,
435		- 'redirection' => 5,
	474	+ 'redirection' => 1,
436	475	'httpversion' => '1.1',
437	476	'blocking' => true,
438	477	'body' => $data,
439	478	'user-agent' => 'PH/' . PH_VERSION . '; ' . get_bloginfo( 'url' )
		@@ -440,29 +479,26 @@
440	479	) );
441	480
442	481	if ( is_wp_error( $request ) )
443	482	{
444		- update_option( 'propertyhive_license_key_details', array(), 'no' );
445		- update_option( 'propertyhive_license_key_error', $request->get_error_message(), 'no' );
	483	+ update_option( 'propertyhive_license_key_error', __( 'The license service could not be reached securely. Your saved license details have been retained.', 'propertyhive' ) . ' ' . $request->get_error_message(), 'no' );
446	484	return false;
447	485	}
448	486
449		- if ( isset($request['body']) && $request['body'] == '' )
	487	+ if ( 200 !== wp_remote_retrieve_response_code( $request ) || '' === wp_remote_retrieve_body( $request ) )
450	488	{
451		- update_option( 'propertyhive_license_key_details', array(), 'no' );
452		- update_option( 'propertyhive_license_key_error', 'No response received when checking license', 'no' );
	489	+ update_option( 'propertyhive_license_key_error', __( 'The license service returned an invalid response.', 'propertyhive' ) . ' ' . wp_remote_retrieve_response_code( $request ), 'no' );
453	490	return false;
454	491	}
455	492
456	493	$body = @unserialize($request['body'], ['allowed_classes' => false]);
457		- if ( $body !== FALSE && is_array($body) && !empty($body) )
	494	+ if ( $body !== FALSE && is_array($body) )
458	495	{
459	496	update_option( 'propertyhive_license_key_details', $body, 'no' );
460	497	}
461	498	else
462	499	{
463		- update_option( 'propertyhive_license_key_details', array(), 'no' );
464		- update_option( 'propertyhive_license_key_error', 'Failed to process response data: ' . print_r($request['body'], true), 'no' );
	500	+ update_option( 'propertyhive_license_key_error', __( 'The license service returned invalid license data.', 'propertyhive' ) . ' ' . print_r($body, true), 'no' );
465	501	}
466	502	}
467	503
468	504	public function get_current_license()
		@@ -507,9 +543,9 @@
507	543	$url = 'https://wp-property-hive.com/?';
508	544	$url .= 'wc-api=wc-am-api&';
509	545	$url .= 'wc_am_action=activate&';
510	546	$url .= 'instance=' . $instance_id . '&';
511		- $url .= 'object=' . parse_url( get_site_url(), PHP_URL_HOST ) . '&';
	547	+ $url .= 'object=' . wp_parse_url( get_site_url(), PHP_URL_HOST ) . '&';
512	548	$url .= 'product_id=' . $license['product_id'] . '&';
513	549	$url .= 'api_key=' . $license_key;
514	550
515	551	$response = wp_remote_post( $url, array(
		@@ -545,9 +581,9 @@
545	581	if ( json_last_error() !== JSON_ERROR_NONE )
546	582	{
547	583	$return = array(
548	584	'success' => false,
549		- 'error' => __( 'Failed to decode response when activating license key status. Please try again', 'propertyhive' ) . ': ' . print_r( $result, true )
	585	+ 'error' => __( 'Failed to decode response when activating license key status. Please try again', 'propertyhive' ) . ': ' . wp_json_encode( $result )
550	586	);
551	587	return $return;
552	588	}
553	589
		@@ -572,9 +608,9 @@
572	608	else
573	609	{
574	610	$return = array(
575	611	'success' => false,
576		- 'error' => __( 'Something went wrong when trying to activate license key', 'propertyhive' ) . ': ' . print_r($body, true)
	612	+ 'error' => __( 'Something went wrong when trying to activate license key', 'propertyhive' ) . ': ' . wp_json_encode( $body )
577	613	);
578	614	return $return;
579	615	}
580	616	}
		@@ -606,9 +642,9 @@
606	642	$url = 'https://wp-property-hive.com/?';
607	643	$url .= 'wc-api=wc-am-api&';
608	644	$url .= 'wc_am_action=deactivate&';
609	645	$url .= 'instance=' . $instance_id . '&';
610		- $url .= 'object=' . parse_url( get_site_url(), PHP_URL_HOST ) . '&';
	646	+ $url .= 'object=' . wp_parse_url( get_site_url(), PHP_URL_HOST ) . '&';
611	647	$url .= 'product_id=' . $license['product_id'] . '&';
612	648	$url .= 'api_key=' . $license_key;
613	649
614	650	$response = wp_remote_post( $url, array(
		@@ -644,9 +680,9 @@
644	680	if ( json_last_error() !== JSON_ERROR_NONE )
645	681	{
646	682	$return = array(
647	683	'success' => false,
648		- 'error' => __( 'Failed to decode response when deactivating license key status. Please try again', 'propertyhive' ) . ': ' . print_r( $result, true )
	684	+ 'error' => __( 'Failed to decode response when deactivating license key status. Please try again', 'propertyhive' ) . ': ' . wp_json_encode( $result )
649	685	);
650	686	return $return;
651	687	}
652	688
		@@ -671,9 +707,9 @@
671	707	else
672	708	{
673	709	$return = array(
674	710	'success' => false,
675		- 'error' => __( 'Something went wrong when trying to deactivate license key', 'propertyhive' ) . ': ' . print_r($body, true)
	711	+ 'error' => __( 'Something went wrong when trying to deactivate license key', 'propertyhive' ) . ': ' . wp_json_encode( $body )
676	712	);
677	713	return $return;
678	714	}
679	715	}
		@@ -774,9 +810,9 @@
774	810	if ( json_last_error() !== JSON_ERROR_NONE )
775	811	{
776	812	$return = array(
777	813	'success' => false,
778		- 'error' => __( 'Failed to decode response when requesting license key product list. Please try again', 'propertyhive' ) . ': ' . print_r( $result, true )
	814	+ 'error' => __( 'Failed to decode response when requesting license key product list. Please try again', 'propertyhive' ) . ': ' . wp_json_encode( $result )
779	815	);
780	816
781	817	$last_known = get_option('ph_pro_last_known_license_product_id_and_package', array());
782	818	if ( !empty($last_known) )
		@@ -795,8 +831,9 @@
795	831	if ( isset($body['data']['product_list']['wc_subs_resources']) && !empty($body['data']['product_list']['wc_subs_resources']) )
796	832	{
797	833	$package = false;
798	834	$product_id = '';
	835	+ $is_trial = null;
799	836
800	837	foreach ( $body['data']['product_list']['wc_subs_resources'] as $resource )
801	838	{
802	839	if ( isset($resource['product_id']) )
		@@ -809,8 +846,12 @@
809	846	{
810	847	$package = 'complete';
811	848	}
812	849	$product_id = $resource['product_id'];
	850	+ $is_trial = isset( $resource['is_trial'] )
	851	+ && is_bool( $resource['is_trial'] )
	852	+ ? $resource['is_trial']
	853	+ : null;
813	854	}
814	855	}
815	856
816	857	if ( $package !== FALSE )
		@@ -817,9 +858,10 @@
817	858	{
818	859	$return = array(
819	860	'success' => true,
820	861	'package' => $package,
821		- 'product_id' => $product_id
	862	+ 'product_id' => $product_id,
	863	+ 'is_trial' => $is_trial,
822	864	);
823	865	}
824	866	else
825	867	{
		@@ -832,9 +874,9 @@
832	874	else
833	875	{
834	876	$return = array(
835	877	'success' => false,
836		- 'error' => __( 'API key doesn\'t appear to belong to any orders', 'propertyhive' ) . ': ' . print_r($body, true)
	878	+ 'error' => __( 'API key doesn\'t appear to belong to any orders', 'propertyhive' ) . ': ' . wp_json_encode( $body )
837	879	);
838	880	}
839	881	}
840	882	else
		@@ -852,9 +894,9 @@
852	894	else
853	895	{
854	896	$return = array(
855	897	'success' => false,
856		- 'error' => __( 'Something went wrong when requesting license key product list', 'propertyhive' ) . ': ' . print_r($body, true)
	898	+ 'error' => __( 'Something went wrong when requesting license key product list', 'propertyhive' ) . ': ' . wp_json_encode( $body )
857	899	);
858	900
859	901	$last_known = get_option('ph_pro_last_known_license_product_id_and_package', array());
860	902	if ( !empty($last_known) )
		@@ -967,9 +1009,9 @@
967	1009	if ( json_last_error() !== JSON_ERROR_NONE )
968	1010	{
969	1011	$return = array(
970	1012	'success' => false,
971		- 'error' => __( 'Failed to decode response when requesting license key status. Please try again', 'propertyhive' ) . ': ' . print_r( $result, true )
	1013	+ 'error' => __( 'Failed to decode response when requesting license key status. Please try again', 'propertyhive' ) . ': ' . wp_json_encode( $result )
972	1014	);
973	1015
974	1016	// error for some reason. Return last known status
975	1017	$previous_license_key_status = get_option( 'propertyhive_pro_license_key_status', '' );
		@@ -1017,9 +1059,9 @@
1017	1059	else
1018	1060	{
1019	1061	$return = array(
1020	1062	'success' => false,
1021		- 'error' => __( 'Something went wrong when requesting license key status', 'propertyhive' ) . ': ' . print_r($body, true)
	1063	+ 'error' => __( 'Something went wrong when requesting license key status', 'propertyhive' ) . ': ' . wp_json_encode( $body )
1022	1064	);
1023	1065
1024	1066	// error for some reason. Return last known status
1025	1067	$previous_license_key_status = get_option( 'propertyhive_pro_license_key_status', '' );