s2member / src / includes / classes / sp-access.inc.php

sp-access.inc.php in s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions trunk, at src/includes/classes/sp-access.inc.php

186 lines 10.1 KB

Raw Download Zip

1	<?php
2	// @codingStandardsIgnoreFile
3	/**
4	* Specific Post/Page Access routines.
5	*
6	* Copyright: © 2009-2011
7	* {@link http://websharks-inc.com/ WebSharks, Inc.}
8	* (coded in the USA)
9	*
10	* Released under the terms of the GNU General Public License.
11	* You should have received a copy of the GNU General Public License,
12	* along with this software. In the main directory, see: /licensing/
13	* If not, see: {@link http://www.gnu.org/licenses/}.
14	*
15	* @package s2Member\SP_Access
16	* @since 3.5
17	*/
18	if(!defined('WPINC')) // MUST have WordPress.
19	exit ("Do not access this file directly.");
20
21	if (!class_exists ("c_ws_plugin__s2member_sp_access"))
22	{
23	/**
24	* Specific Post/Page Access routines.
25	*
26	* @package s2Member\SP_Access
27	* @since 3.5
28	*/
29	class c_ws_plugin__s2member_sp_access
30	{
31	/**
32	* Generates Specific Post/Page Access links.
33	*
34	* @package s2Member\SP_Access
35	* @since 3.5
36	*
37	* @param string\|int $sp_ids Comma-delimited list of Specific Post/Page IDs (numerical).
38	* @param int\|string $hours Optional. A numeric expiration time for this link, in hours. Defaults to `72`.
39	* @param bool $shrink Optional. Defaults to true. If false, the raw link will NOT be processed by s2Member's URL shortening system.
40	* @return str\|bool A Specific Post/Page Access Link, or false on failure.
41	*/
42	public static function sp_access_link_gen ($sp_ids = FALSE, $hours = 72, $shrink = TRUE)
43	{
44	foreach(array_keys(get_defined_vars())as$__v)$__refs[$__v]=&$$__v;
45	do_action("ws_plugin__s2member_before_sp_access_link_gen", get_defined_vars ());
46	unset($__refs, $__v);
47
48	if ((is_string ($sp_ids) \|\| is_numeric ($sp_ids)) && ($sp_ids = preg_replace ("/[^0-9;,]/", "", $sp_ids)) && ($leading_id = preg_replace ("/^([0-9]+).*$/", "$1", $sp_ids)) && is_numeric ($hours))
49	{
50	$sp_access = c_ws_plugin__s2member_utils_encryption::encrypt ("sp_time_hours:.:\|:.:" . $sp_ids . ":.:\|:.:" . strtotime ("now") . ":.:\|:.:" . $hours);
51
52	$sp_access_link = add_query_arg ("s2member_sp_access", urlencode ($sp_access), get_permalink ($leading_id)); // Generate long URL/link.
53
54	if ($shrink && ($shorter_url = c_ws_plugin__s2member_utils_urls::shorten ($sp_access_link, "", TRUE, ((int)$hours * HOUR_IN_SECONDS) + DAY_IN_SECONDS)))
55	{
56	$shorter_url_host = c_ws_plugin__s2member_utils_urls::parse_url($shorter_url, PHP_URL_HOST);
57	$home_url_host = c_ws_plugin__s2member_utils_urls::parse_url(home_url('/'), PHP_URL_HOST);
58	$domain_tag = ($shorter_url_host && $home_url_host && strcasecmp($shorter_url_host, $home_url_host) !== 0) ? "#" . $home_url_host : ""; //260612 Personalize external short links only.
59	$sp_access_link = $shorter_url . $domain_tag;
60	}
61	}
62	return apply_filters("ws_plugin__s2member_sp_access_link_gen", ((!empty($sp_access_link)) ? $sp_access_link : false), get_defined_vars ());
63	}
64	/**
65	* Generates Specific Post/Page Access links via AJAX.
66	*
67	* @package s2Member\SP_Access
68	* @since 3.5
69	*
70	* @attaches-to ``add_action("wp_ajax_ws_plugin__s2member_sp_access_link_via_ajax");``
71	*
72	* @return null Exits script execution after returning data for AJAX caller.
73	*/
74	public static function sp_access_link_via_ajax ()
75	{
76	do_action("ws_plugin__s2member_before_sp_access_link_via_ajax", get_defined_vars ());
77
78	status_header (200); // Send a 200 OK status header.
79	header ("Content-Type: text/plain; charset=UTF-8"); // Content-Type with UTF-8.
80	while (@ob_end_clean ()); // Clean any existing output buffers.
81
82	if (current_user_can ("create_users")) // Check privileges as well. Ability to create Users?
83
84	if (!empty($_POST["ws_plugin__s2member_sp_access_link_via_ajax"]) && is_string ($nonce = $_POST["ws_plugin__s2member_sp_access_link_via_ajax"]) && wp_verify_nonce ($nonce, "ws-plugin--s2member-sp-access-link-via-ajax"))
85
86	if (($_p = c_ws_plugin__s2member_utils_strings::trim_deep (stripslashes_deep ($_POST))) && isset ($_p["s2member_sp_access_link_ids"], $_p["s2member_sp_access_link_hours"]))
87	$sp_access_link = c_ws_plugin__s2member_sp_access::sp_access_link_gen ((string)$_p["s2member_sp_access_link_ids"], (string)$_p["s2member_sp_access_link_hours"]);
88
89	exit (apply_filters("ws_plugin__s2member_sp_access_link_via_ajax", ((!empty($sp_access_link)) ? $sp_access_link : ""), get_defined_vars ()));
90	}
91	/**
92	* Handles Specific Post/Page Access authentication.
93	*
94	* @package s2Member\SP_Access
95	* @since 3.5
96	*
97	* @param int\|string $sp_id Numeric Post/Page ID in WordPress.
98	* @param bool $read_only Optional. Defaults to false. If ``$read_only = true``,
99	* no session cookies are set, no IP Restrictions are checked, and script execution is not exited on Link failure.
100	* In other words, with ``$read_only = true``, this function will simply return true or false.
101	* @return null\|bool\|string Returns `true` (or the SP access string), if access is indeed allowed in one way or another.
102	* If access is denied with ``$read_only = true`` simply return false. If access is denied with ``$read_only = false``, return false; but if a Specific Post/Page Access Link is currently being used, we exit with a warning about Access Link expiration here.
103	*/
104	public static function sp_access ($sp_id = FALSE, $read_only = FALSE)
105	{
106	do_action("ws_plugin__s2member_before_sp_access", get_defined_vars ());
107
108	$excluded = apply_filters("ws_plugin__s2member_sp_access_excluded", false, get_defined_vars ());
109
110	if ($excluded \|\| current_user_can (apply_filters("ws_plugin__s2member_sp_access_excluded_cap", "edit_posts", get_defined_vars ())))
111	return apply_filters("ws_plugin__s2member_sp_access", true, get_defined_vars (), "auth-via-exclusion");
112
113	else if ($sp_id && is_numeric ($sp_id) && ((!empty($_GET["s2member_sp_access"]) && ($_g["s2member_sp_access"] = trim (stripslashes ((string)$_GET["s2member_sp_access"]))) && is_array($sp_access_values = array($_g["s2member_sp_access"]))) \|\| is_array($sp_access_values = c_ws_plugin__s2member_sp_access::sp_access_session ())) && !empty($sp_access_values))
114	{
115	foreach ($sp_access_values as $sp_access_value) // Supports multiple access values in a session. We go through each of them.
116	{
117	if (is_array($sp_access = preg_split ("/\:\.\:\\|\:\.\:/", c_ws_plugin__s2member_utils_encryption::decrypt ($sp_access_value))))
118	{
119	if (count ($sp_access) === 4 && $sp_access[0] === "sp_time_hours" && in_array($sp_id, preg_split ("/[\r\n\t\s;,]+/", $sp_access[1])))
120	{
121	if (is_numeric ($sp_access[2]) && is_numeric ($sp_access[3]) && $sp_access[2] <= strtotime ("now") && ($sp_access[2] + ($sp_access[3] * 3600)) >= strtotime ("now"))
122	{
123	if (!$read_only && !empty($_g["s2member_sp_access"])) // Add to session?
124	c_ws_plugin__s2member_sp_access::sp_access_session ($_g["s2member_sp_access"]);
125
126	if ($read_only \|\| c_ws_plugin__s2member_ip_restrictions::ip_restrictions_ok (c_ws_plugin__s2member_utils_ip::current(), $sp_access_value))
127	return apply_filters("ws_plugin__s2member_sp_access", $sp_access_value, get_defined_vars (), "auth-via-link-session");
128	}
129	}
130	}
131	}
132	// Otherwise, authentication was NOT possible via link or session.
133	if (!$read_only && /* A Specific Post/Page Access Link? */ !empty($_g["s2member_sp_access"]))
134	{
135	status_header (503);
136	header ("Content-Type: text/html; charset=UTF-8");
137	while (@ob_end_clean ()); // Clean any existing output buffers.
138	exit (_x ('<strong>Your Link Expired:</strong><br />Please contact Support if you need assistance.', "s2member-front", "s2member"));
139	}
140	else // Else return false here.
141	return apply_filters("ws_plugin__s2member_sp_access", false, get_defined_vars (), "no-auth-via-link-session");
142	}
143
144	else // Else return false here.
145	return apply_filters("ws_plugin__s2member_sp_access", false, get_defined_vars (), "no-auth-no-link-session");
146	}
147	/**
148	* Handles Specific Post/Page sessions, by writing access values into a cookie.
149	*
150	* Can be used to add a new value to the session, and/or to return the current set of values in the session.
151	*
152	* @package s2Member\SP_Access
153	* @since 3.5
154	*
155	* @param string $add_sp_access_value Encrypted Specific Post/Page Access value.
156	* @return array Array of Specific Post/Page Access values.
157	*/
158	public static function sp_access_session ($add_sp_access_value = FALSE)
159	{
160	foreach(array_keys(get_defined_vars())as$__v)$__refs[$__v]=&$$__v;
161	do_action("ws_plugin__s2member_before_sp_access_session", get_defined_vars ());
162	unset($__refs, $__v);
163
164	$sp_access_values = (!empty($_COOKIE["s2member_sp_access"])) ? preg_split ("/\:\.\:\\|\:\.\:/", (string)$_COOKIE["s2member_sp_access"]) : array();
165
166	if ($add_sp_access_value && is_string ($add_sp_access_value) && !in_array /* Not in session? */ ($add_sp_access_value, $sp_access_values))
167	{
168	$sp_access_values[] = $add_sp_access_value; // Add an access value, and update the delimited session cookie.
169	$sp_access_values = array_unique ($sp_access_values); // Keep this array unique; disallow double-stacking.
170
171	$cookie = implode (":.:\|:.:", $sp_access_values); // Implode the access values into a delimited string.
172	$cookie = (strlen ($cookie) >= 4096) ? $add_sp_access_value : $cookie; // Max cookie size is 4kbs.
173
174	setcookie ("s2member_sp_access", $cookie, time () + 31556926, COOKIEPATH, COOKIE_DOMAIN);
175	setcookie ("s2member_sp_access", $cookie, time () + 31556926, SITECOOKIEPATH, COOKIE_DOMAIN);
176	$_COOKIE["s2member_sp_access"] = $cookie; // Real-time cookie updates.
177
178	foreach(array_keys(get_defined_vars())as$__v)$__refs[$__v]=&$$__v;
179	do_action("ws_plugin__s2member_during_sp_access_session", get_defined_vars ());
180	unset($__refs, $__v);
181	}
182	return apply_filters("ws_plugin__s2member_sp_access_session", $sp_access_values, get_defined_vars ());
183	}
184	}
185	}
186