| 1 |
<?php |
| 2 |
if ( ! defined( 'ABSPATH' ) ) { |
| 3 |
exit; // Exit if accessed directly! |
| 4 |
} |
| 5 |
|
| 6 |
if ( ! class_exists( 'WPSC_Current_User' ) ) : |
| 7 |
|
| 8 |
final class WPSC_Current_User { |
| 9 |
|
| 10 |
/** |
| 11 |
* Current user object to access |
| 12 |
* |
| 13 |
* @var WPSC_Current_User |
| 14 |
*/ |
| 15 |
public static $current_user; |
| 16 |
|
| 17 |
/** |
| 18 |
* Login type |
| 19 |
* |
| 20 |
* @var string |
| 21 |
*/ |
| 22 |
public static $login_type = ''; |
| 23 |
|
| 24 |
/** |
| 25 |
* Guest login type |
| 26 |
* |
| 27 |
* @var string |
| 28 |
*/ |
| 29 |
public static $guest_login_type = ''; |
| 30 |
|
| 31 |
/** |
| 32 |
* Current user WP object |
| 33 |
* |
| 34 |
* @var WP_User |
| 35 |
*/ |
| 36 |
public $user; |
| 37 |
|
| 38 |
/** |
| 39 |
* Check whether user is guest |
| 40 |
* |
| 41 |
* @var boolean |
| 42 |
*/ |
| 43 |
public $is_guest = false; |
| 44 |
|
| 45 |
/** |
| 46 |
* Check whether user is customer or not |
| 47 |
* |
| 48 |
* @var boolean |
| 49 |
*/ |
| 50 |
public $is_customer = false; |
| 51 |
|
| 52 |
/** |
| 53 |
* Customer object for current user |
| 54 |
* |
| 55 |
* @var WPSC_Customer |
| 56 |
*/ |
| 57 |
public $customer; |
| 58 |
|
| 59 |
/** |
| 60 |
* Check whether user is an agent or not |
| 61 |
* |
| 62 |
* @var boolean |
| 63 |
*/ |
| 64 |
public $is_agent = false; |
| 65 |
|
| 66 |
/** |
| 67 |
* Agent object for current user |
| 68 |
* |
| 69 |
* @var WPSC_Agent |
| 70 |
*/ |
| 71 |
public $agent; |
| 72 |
|
| 73 |
/** |
| 74 |
* Current user level. e.g. customer, agent or admin |
| 75 |
* |
| 76 |
* @var string |
| 77 |
*/ |
| 78 |
public $level; |
| 79 |
|
| 80 |
/** |
| 81 |
* Initialize this class |
| 82 |
* |
| 83 |
* @return void |
| 84 |
*/ |
| 85 |
public static function init() { |
| 86 |
|
| 87 |
add_action( 'init', array( __CLASS__, 'load_current_user' ) ); |
| 88 |
|
| 89 |
// default login. |
| 90 |
add_action( 'wp_ajax_nopriv_wpsc_default_login', array( __CLASS__, 'check_user_login' ) ); |
| 91 |
|
| 92 |
// default registration. |
| 93 |
add_action( 'wp_ajax_nopriv_wpsc_get_default_registration', array( __CLASS__, 'get_user_registration' ) ); |
| 94 |
add_action( 'wp_ajax_nopriv_wpsc_check_user_availability', array( __CLASS__, 'check_user_availability' ) ); |
| 95 |
add_action( 'wp_ajax_nopriv_wpsc_authenticate_registration', array( __CLASS__, 'send_registration_otp' ) ); |
| 96 |
add_action( 'wp_ajax_nopriv_wpsc_confirm_registration', array( __CLASS__, 'register_user' ) ); |
| 97 |
|
| 98 |
// sign-in using otp. |
| 99 |
add_action( 'wp_ajax_nopriv_wpsc_get_guest_sign_in', array( __CLASS__, 'get_guest_sign_in' ) ); |
| 100 |
add_action( 'wp_ajax_nopriv_wpsc_authenticate_guest_login', array( __CLASS__, 'get_guest_sign_in_auth' ) ); |
| 101 |
add_action( 'wp_ajax_nopriv_wpsc_confirm_guest_login', array( __CLASS__, 'confirm_guest_login' ) ); |
| 102 |
|
| 103 |
// user registration email template. |
| 104 |
add_filter( 'wpsc_email_notification_page_sections', array( __CLASS__, 'registration_email_template_section' ) ); |
| 105 |
|
| 106 |
// guest login email template. |
| 107 |
add_filter( 'wpsc_email_notification_page_sections', array( __CLASS__, 'guest_login_email_template_section' ) ); |
| 108 |
} |
| 109 |
|
| 110 |
/** |
| 111 |
* Initialize the object |
| 112 |
* |
| 113 |
* @param string $email - email address. |
| 114 |
*/ |
| 115 |
public function __construct( $email = '' ) { |
| 116 |
|
| 117 |
$user = $email ? get_user_by( 'email', $email ) : new WP_User(); |
| 118 |
if ( $user === false ) { |
| 119 |
$user = new WP_User(); |
| 120 |
} |
| 121 |
$this->user = $user; |
| 122 |
|
| 123 |
// is guest. |
| 124 |
$this->is_guest = $this->user->ID ? false : true; |
| 125 |
|
| 126 |
// Set customer object. |
| 127 |
if ( $this->user->ID ) { |
| 128 |
|
| 129 |
$this->is_customer = true; |
| 130 |
$customer = WPSC_Customer::get_by_email( $this->user->user_email ); |
| 131 |
if ( $customer->id ) { |
| 132 |
$this->customer = $customer; |
| 133 |
} else { |
| 134 |
$this->customer = WPSC_Customer::insert( |
| 135 |
array( |
| 136 |
'user' => $this->user->ID, |
| 137 |
'name' => $this->user->display_name, |
| 138 |
'email' => $this->user->user_email, |
| 139 |
) |
| 140 |
); |
| 141 |
} |
| 142 |
} elseif ( $email ) { |
| 143 |
|
| 144 |
$this->is_customer = true; |
| 145 |
$this->customer = WPSC_Customer::get_by_email( $email ); |
| 146 |
} |
| 147 |
|
| 148 |
// Set agent object. |
| 149 |
$agent = WPSC_Agent::get_by_user_id( $this->user->ID ); |
| 150 |
if ( $agent->id && $agent->is_active ) { |
| 151 |
$this->is_agent = true; |
| 152 |
$this->agent = $agent; |
| 153 |
} |
| 154 |
|
| 155 |
// set leval. |
| 156 |
if ( WPSC_Functions::is_site_admin() ) { |
| 157 |
$this->level = 'admin'; |
| 158 |
} elseif ( $this->is_agent ) { |
| 159 |
$this->level = 'agent'; |
| 160 |
} elseif ( $this->is_customer ) { |
| 161 |
$this->level = 'customer'; |
| 162 |
} else { |
| 163 |
$this->level = 'none'; |
| 164 |
} |
| 165 |
} |
| 166 |
|
| 167 |
/** |
| 168 |
* Load current wpsc user |
| 169 |
* |
| 170 |
* @return void |
| 171 |
*/ |
| 172 |
public static function load_current_user() { |
| 173 |
|
| 174 |
global $current_user; |
| 175 |
|
| 176 |
// wp logged-in user. |
| 177 |
$email = $current_user && $current_user->ID ? $current_user->user_email : ''; |
| 178 |
if ( $email ) { |
| 179 |
self::$current_user = new WPSC_Current_User( $email ); |
| 180 |
self::$login_type = 'registered'; |
| 181 |
return; |
| 182 |
} |
| 183 |
|
| 184 |
// guest login. |
| 185 |
$gs = get_option( 'wpsc-gs-general' ); |
| 186 |
|
| 187 |
$login_auth = isset( $_COOKIE['wpsc_guest_login_auth'] ) ? sanitize_text_field( wp_unslash( $_COOKIE['wpsc_guest_login_auth'] ) ) : ''; |
| 188 |
$login_auth = $login_auth ? json_decode( $login_auth ) : false; |
| 189 |
|
| 190 |
if ( ! $login_auth ) { |
| 191 |
self::$current_user = new WPSC_Current_User(); |
| 192 |
return; |
| 193 |
} |
| 194 |
|
| 195 |
$login_auth->email = $login_auth->email ? sanitize_email( $login_auth->email ) : ''; |
| 196 |
if ( ! $login_auth->email ) { |
| 197 |
self::$current_user = new WPSC_Current_User(); |
| 198 |
return; |
| 199 |
} |
| 200 |
|
| 201 |
if ( $login_auth && self::validate_guest_login( $login_auth ) ) { |
| 202 |
self::$current_user = new WPSC_Current_User( $login_auth->email ); |
| 203 |
return; |
| 204 |
} |
| 205 |
|
| 206 |
self::$current_user = new WPSC_Current_User(); |
| 207 |
} |
| 208 |
|
| 209 |
/** |
| 210 |
* Change current user |
| 211 |
* |
| 212 |
* @param string $email - email string. |
| 213 |
* |
| 214 |
* @return string |
| 215 |
*/ |
| 216 |
public static function change_current_user( $email ) { |
| 217 |
|
| 218 |
$current_user = new WPSC_Current_User( $email ); |
| 219 |
self::$current_user = $current_user; |
| 220 |
return self::$current_user; |
| 221 |
} |
| 222 |
|
| 223 |
/** |
| 224 |
* Return ticket list filters for the user. |
| 225 |
* |
| 226 |
* @return array |
| 227 |
*/ |
| 228 |
public function get_tl_filters() { |
| 229 |
|
| 230 |
$filters = array( |
| 231 |
'default' => array(), |
| 232 |
'saved' => array(), |
| 233 |
); |
| 234 |
|
| 235 |
// default filters. |
| 236 |
$default_filters = get_option( $this->is_agent ? 'wpsc-atl-default-filters' : 'wpsc-ctl-default-filters' ); |
| 237 |
foreach ( $default_filters as $index => $filter ) { |
| 238 |
|
| 239 |
// exclude if current user does not have access to deleted filter. |
| 240 |
if ( $index === 'deleted' && ! $this->agent->has_cap( 'dtt-access' ) ) { |
| 241 |
continue; |
| 242 |
} |
| 243 |
|
| 244 |
// exclude if filter is not enabled. |
| 245 |
if ( ! $filter['is_enable'] ) { |
| 246 |
continue; |
| 247 |
} |
| 248 |
|
| 249 |
$filters['default'][ $index ] = $filter; |
| 250 |
} |
| 251 |
|
| 252 |
// saved filters. |
| 253 |
$filters['saved'] = $this->get_saved_filters(); |
| 254 |
|
| 255 |
// return filters. |
| 256 |
return $filters; |
| 257 |
} |
| 258 |
|
| 259 |
/** |
| 260 |
* Return all saved filters for current user |
| 261 |
* |
| 262 |
* @return array |
| 263 |
*/ |
| 264 |
public function get_saved_filters() { |
| 265 |
|
| 266 |
$saved_filters = ! $this->is_guest && $this->user->ID ? get_user_meta( $this->user->ID, get_current_blog_id() . '-wpsc-tl-saved-filters', true ) : array(); |
| 267 |
return $saved_filters ? $saved_filters : array(); |
| 268 |
} |
| 269 |
|
| 270 |
/** |
| 271 |
* Return attachment auth for URLs created in rest api |
| 272 |
* |
| 273 |
* @return string |
| 274 |
*/ |
| 275 |
public function get_attachment_auth() { |
| 276 |
|
| 277 |
$now = new DateTime(); |
| 278 |
$diff = new DateInterval( 'PT1H' ); |
| 279 |
|
| 280 |
$auth = get_user_meta( $this->user->ID, get_current_blog_id() . '-wpsc-rest-attachment-auth', true ); |
| 281 |
if ( $auth ) { |
| 282 |
$dt = new DateTime( $auth['date'] ); |
| 283 |
if ( $now < $dt->add( $diff ) ) { |
| 284 |
return $auth['key']; |
| 285 |
} |
| 286 |
} |
| 287 |
|
| 288 |
$auth = array( |
| 289 |
'key' => WPSC_Functions::get_random_string( 12 ), |
| 290 |
'date' => $now->format( 'Y-m-d H:i:s' ), |
| 291 |
); |
| 292 |
update_user_meta( $this->user->ID, get_current_blog_id() . '-wpsc-rest-attachment-auth', $auth ); |
| 293 |
return $auth['key']; |
| 294 |
} |
| 295 |
|
| 296 |
/** |
| 297 |
* Get ticket list items |
| 298 |
* |
| 299 |
* @return array |
| 300 |
*/ |
| 301 |
public function get_tl_list_items() { |
| 302 |
|
| 303 |
return $this->is_agent ? get_option( 'wpsc-atl-list-items' ) : get_option( 'wpsc-ctl-list-items' ); |
| 304 |
} |
| 305 |
|
| 306 |
/** |
| 307 |
* Get default orderby |
| 308 |
* |
| 309 |
* @return array |
| 310 |
*/ |
| 311 |
public function get_tl_default_settings() { |
| 312 |
|
| 313 |
return $this->is_agent ? get_option( 'wpsc-tl-ms-agent-view' ) : get_option( 'wpsc-tl-ms-customer-view' ); |
| 314 |
} |
| 315 |
|
| 316 |
/** |
| 317 |
* Return system query for the current user for ticket list |
| 318 |
* |
| 319 |
* @param array $filters - filters. |
| 320 |
* @return array |
| 321 |
*/ |
| 322 |
public function get_tl_system_query( $filters ) { |
| 323 |
|
| 324 |
$current_user = self::$current_user; |
| 325 |
|
| 326 |
$adv_setting = get_option( 'wpsc-ms-advanced-settings' ); |
| 327 |
if ( $adv_setting['public-mode'] && ! $current_user->is_agent ) { |
| 328 |
return $filters; |
| 329 |
} |
| 330 |
|
| 331 |
$system_query = array( 'relation' => 'OR' ); |
| 332 |
|
| 333 |
$system_query[] = array( |
| 334 |
'slug' => 'customer', |
| 335 |
'compare' => '=', |
| 336 |
'val' => $this->customer->id, |
| 337 |
); |
| 338 |
|
| 339 |
if ( $this->is_agent ) { |
| 340 |
|
| 341 |
if ( $this->agent->has_cap( 'view-assigned-me' ) ) { |
| 342 |
$system_query[] = array( |
| 343 |
'slug' => 'assigned_agent', |
| 344 |
'compare' => '=', |
| 345 |
'val' => $this->agent->id, |
| 346 |
); |
| 347 |
} |
| 348 |
|
| 349 |
if ( $this->agent->has_cap( 'view-unassigned' ) ) { |
| 350 |
$system_query[] = array( |
| 351 |
'slug' => 'assigned_agent', |
| 352 |
'compare' => '=', |
| 353 |
'val' => '', |
| 354 |
); |
| 355 |
} |
| 356 |
|
| 357 |
if ( $this->agent->has_cap( 'view-assigned-others' ) ) { |
| 358 |
$system_query[] = array( |
| 359 |
'slug' => 'assigned_agent', |
| 360 |
'compare' => 'NOT IN', |
| 361 |
'val' => array( $this->agent->id, '' ), |
| 362 |
); |
| 363 |
} |
| 364 |
} |
| 365 |
|
| 366 |
return apply_filters( 'wpsc_tl_current_user_system_query', $system_query, $filters, $this ); |
| 367 |
} |
| 368 |
|
| 369 |
/** |
| 370 |
* Return system query for the current user for ticket list |
| 371 |
* |
| 372 |
* @param array $filters - filters. |
| 373 |
* @return array |
| 374 |
*/ |
| 375 |
public function get_atl_system_query( $filters ) { |
| 376 |
|
| 377 |
$system_query = array( 'relation' => 'OR' ); |
| 378 |
|
| 379 |
$system_query[] = array( |
| 380 |
'slug' => 'customer', |
| 381 |
'compare' => '=', |
| 382 |
'val' => $this->customer->id, |
| 383 |
); |
| 384 |
|
| 385 |
if ( $this->is_agent ) { |
| 386 |
|
| 387 |
if ( $this->agent->has_cap( 'at-assigned-me' ) ) { |
| 388 |
$system_query[] = array( |
| 389 |
'slug' => 'assigned_agent', |
| 390 |
'compare' => '=', |
| 391 |
'val' => $this->agent->id, |
| 392 |
); |
| 393 |
} |
| 394 |
|
| 395 |
if ( $this->agent->has_cap( 'at-unassigned' ) ) { |
| 396 |
$system_query[] = array( |
| 397 |
'slug' => 'assigned_agent', |
| 398 |
'compare' => '=', |
| 399 |
'val' => '', |
| 400 |
); |
| 401 |
} |
| 402 |
|
| 403 |
if ( $this->agent->has_cap( 'at-assigned-others' ) ) { |
| 404 |
$system_query[] = array( |
| 405 |
'slug' => 'assigned_agent', |
| 406 |
'compare' => 'NOT IN', |
| 407 |
'val' => array( $this->agent->id, '' ), |
| 408 |
); |
| 409 |
} |
| 410 |
} |
| 411 |
|
| 412 |
return apply_filters( 'wpsc_atl_current_user_system_query', $system_query, $filters, $this ); |
| 413 |
} |
| 414 |
|
| 415 |
/** |
| 416 |
* Check login for default login form |
| 417 |
* |
| 418 |
* @return void |
| 419 |
*/ |
| 420 |
public static function check_user_login() { |
| 421 |
|
| 422 |
if ( check_ajax_referer( 'wpsc_default_login', '_ajax_nonce', false ) != 1 ) { |
| 423 |
wp_send_json_error( 'Unauthorized request!', 401 ); |
| 424 |
} |
| 425 |
|
| 426 |
WPSC_MS_Recaptcha::validate( 'submit_login' ); |
| 427 |
|
| 428 |
$username = isset( $_POST['username'] ) ? sanitize_text_field( wp_unslash( $_POST['username'] ) ) : ''; |
| 429 |
if ( ! $username ) { |
| 430 |
wp_send_json_error( 'Bad request', 400 ); |
| 431 |
} |
| 432 |
|
| 433 |
$password = isset( $_POST['password'] ) ? $_POST['password'] : ''; // phpcs:ignore |
| 434 |
if ( ! $password ) { |
| 435 |
wp_send_json_error( 'Bad request', 400 ); |
| 436 |
} |
| 437 |
|
| 438 |
$remember_me = isset( $_POST['remember_me'] ) ? true : false; |
| 439 |
|
| 440 |
$user = wp_signon( |
| 441 |
array( |
| 442 |
'user_login' => $username, |
| 443 |
'user_password' => $password, |
| 444 |
'remember' => $remember_me, |
| 445 |
) |
| 446 |
); |
| 447 |
|
| 448 |
if ( is_wp_error( $user ) ) { |
| 449 |
|
| 450 |
$auth_errors = array( |
| 451 |
'incorrect_password', |
| 452 |
'invalid_username', |
| 453 |
'empty_username', |
| 454 |
'empty_password', |
| 455 |
); |
| 456 |
$code = $user->get_error_code(); |
| 457 |
if ( in_array( $code, $auth_errors, true ) ) { |
| 458 |
|
| 459 |
wp_send_json_error( |
| 460 |
array( |
| 461 |
'code' => 'invalid_login', |
| 462 |
'message' => __( 'Invalid username or password.', 'supportcandy' ), |
| 463 |
), |
| 464 |
401 |
| 465 |
); |
| 466 |
} |
| 467 |
|
| 468 |
wp_send_json_error( |
| 469 |
array( |
| 470 |
'code' => $code, |
| 471 |
'message' => wp_strip_all_tags( $user->get_error_message() ), |
| 472 |
), |
| 473 |
400 |
| 474 |
); |
| 475 |
} |
| 476 |
wp_send_json_success(); |
| 477 |
} |
| 478 |
|
| 479 |
/** |
| 480 |
* Get user registration |
| 481 |
* |
| 482 |
* @return void |
| 483 |
*/ |
| 484 |
public static function get_user_registration() { |
| 485 |
|
| 486 |
$page_settings = get_option( 'wpsc-gs-page-settings' ); |
| 487 |
$recaptcha = get_option( 'wpsc-recaptcha-settings' ); |
| 488 |
$tc = get_option( 'wpsc-term-and-conditions' ); |
| 489 |
$gdpr = get_option( 'wpsc-gdpr-settings' ); |
| 490 |
if ( $page_settings['user-registration'] !== 'default' ) { |
| 491 |
wp_send_json_error( __( 'Unauthorized', 'supportcandy' ), 401 ); |
| 492 |
}?> |
| 493 |
|
| 494 |
<h2><?php esc_attr_e( 'Please sign up', 'supportcandy' ); ?></h2> |
| 495 |
<form onsubmit="return false;" class="wpsc-login wpsc-authenticate-registration"> |
| 496 |
<input type="text" name="firstname" placeholder="<?php esc_attr_e( 'First Name', 'supportcandy' ); ?>" autocomplete="off"/> |
| 497 |
<input type="text" name="lastname" placeholder="<?php esc_attr_e( 'Last Name', 'supportcandy' ); ?>" autocomplete="off"/> |
| 498 |
|
| 499 |
<div style="margin: 0 0 5px !important;"> |
| 500 |
<input id="wpsc-username" type="text" name="username" style="margin-bottom: 0px !important;" placeholder="<?php esc_attr_e( 'Username', 'supportcandy' ); ?>" autocomplete="off"/> |
| 501 |
<small id="wpsc-username-unavailable" style="color: #e84118;font-style:italic;display:none;"><?php esc_attr_e( 'Username is already taken!', 'supportcandy' ); ?></small> |
| 502 |
<small id="wpsc-username-available" style="color: #4cd137;font-style:italic;display:none;"><?php esc_attr_e( 'Username is available!', 'supportcandy' ); ?></small> |
| 503 |
<script> |
| 504 |
jQuery('#wpsc-username').change(function(){ |
| 505 |
jQuery('#wpsc-username-available').hide(); |
| 506 |
jQuery('#wpsc-username-unavailable').hide(); |
| 507 |
var username = jQuery(this).val().trim(); |
| 508 |
const data = { action: 'wpsc_check_user_availability', type : 'username', username, _ajax_nonce: '<?php echo esc_attr( wp_create_nonce( 'wpsc_check_user_availability' ) ); ?>' }; |
| 509 |
jQuery.post(supportcandy.ajax_url, data, function (response) { |
| 510 |
jQuery('input[name=is_username]').val(response.isAvailable); |
| 511 |
if (response.isAvailable == 1) { |
| 512 |
jQuery('#wpsc-username-unavailable').hide(); |
| 513 |
jQuery('#wpsc-username-available').show(); |
| 514 |
} else { |
| 515 |
jQuery('#wpsc-username-available').hide(); |
| 516 |
jQuery('#wpsc-username-unavailable').show(); |
| 517 |
} |
| 518 |
}); |
| 519 |
}); |
| 520 |
</script> |
| 521 |
</div> |
| 522 |
|
| 523 |
<div style="margin: 0 0 5px !important;"> |
| 524 |
<input id="wpsc-email" type="text" name="email_address" style="margin-bottom: 0px !important;" placeholder="<?php esc_attr_e( 'Email Address', 'supportcandy' ); ?>" autocomplete="off"/> |
| 525 |
<small id="wpsc-email-unavailable" style="color: #e84118;font-style:italic;display:none;"><?php esc_attr_e( 'Email is already taken or not allowed!', 'supportcandy' ); ?></small> |
| 526 |
<small id="wpsc-email-available" style="color: #4cd137;font-style:italic;display:none;"><?php esc_attr_e( 'Email is available!', 'supportcandy' ); ?></small> |
| 527 |
<script> |
| 528 |
jQuery('#wpsc-email').change(function(){ |
| 529 |
console.log('email changed'); |
| 530 |
jQuery('#wpsc-email-available').hide(); |
| 531 |
jQuery('#wpsc-email-unavailable').hide(); |
| 532 |
var email = jQuery(this).val().trim(); |
| 533 |
const data = { action: 'wpsc_check_user_availability', type: 'email', email, _ajax_nonce: '<?php echo esc_attr( wp_create_nonce( 'wpsc_check_user_availability' ) ); ?>' }; |
| 534 |
jQuery.post(supportcandy.ajax_url, data, function (response) { |
| 535 |
jQuery('input[name=is_email]').val(response.isAvailable); |
| 536 |
if (response.isAvailable == 1) { |
| 537 |
jQuery('#wpsc-email-unavailable').hide(); |
| 538 |
jQuery('#wpsc-email-available').show(); |
| 539 |
} else { |
| 540 |
jQuery('#wpsc-email-available').hide(); |
| 541 |
jQuery('#wpsc-email-unavailable').show(); |
| 542 |
} |
| 543 |
}); |
| 544 |
}); |
| 545 |
</script> |
| 546 |
</div> |
| 547 |
<input type="password" name="password" placeholder="<?php esc_attr_e( 'Password', 'supportcandy' ); ?>"/> |
| 548 |
<input type="password" name="confirm_password" placeholder="<?php esc_attr_e( 'Confirm Password', 'supportcandy' ); ?>"/> |
| 549 |
<?php |
| 550 |
|
| 551 |
// recaptcha. |
| 552 |
if ( $recaptcha['allow-recaptcha'] === 1 && $recaptcha['recaptcha-version'] == 2 && $recaptcha['recaptcha-site-key'] && $recaptcha['recaptcha-secret-key'] ) { |
| 553 |
$unique_id = uniqid( 'wpsc_' ); |
| 554 |
?> |
| 555 |
<script src="https://www.google.com/recaptcha/api.js?onload=recaptchaCallback&render=explicit" async defer></script> <?php // phpcs:ignore ?> |
| 556 |
<div id="<?php echo esc_attr( $unique_id ); ?>" data-sitekey="" style="margin-bottom: 5px;"></div> |
| 557 |
<script> |
| 558 |
var recaptchaCallback = function() { |
| 559 |
var obj = jQuery('#<?php echo esc_attr( $unique_id ); ?>'); |
| 560 |
grecaptcha.render(obj.attr("id"), { |
| 561 |
"sitekey" : "<?php echo esc_attr( $recaptcha['recaptcha-site-key'] ); ?>", |
| 562 |
"callback" : function(token) { |
| 563 |
obj.closest('form').find(".g-recaptcha-response").val(token); |
| 564 |
} |
| 565 |
}); |
| 566 |
} |
| 567 |
</script> |
| 568 |
<?php |
| 569 |
} |
| 570 |
if ( $recaptcha['allow-recaptcha'] === 1 && $recaptcha['recaptcha-version'] == 3 && $recaptcha['recaptcha-site-key'] && $recaptcha['recaptcha-secret-key'] ) { |
| 571 |
?> |
| 572 |
<script src="https://www.google.com/recaptcha/api.js?render=<?php echo esc_attr( $recaptcha['recaptcha-site-key'] ); ?>"></script> <?php // phpcs:ignore ?> |
| 573 |
<?php |
| 574 |
} |
| 575 |
do_action( 'wpsc_registration_form' ); |
| 576 |
?> |
| 577 |
<div class="wpsc-reg-user"> |
| 578 |
<?php |
| 579 |
if ( $tc['allow-term-and-conditions-reg-user'] ) : |
| 580 |
?> |
| 581 |
<div class="wpsc-tff term-and-conditions wpsc-xs-12 wpsc-sm-12 wpsc-md-12 wpsc-lg-12 required wpsc-visible" data-cft="term-and-conditions-reg-user"> |
| 582 |
<div class="checkbox-container"> |
| 583 |
<?php $unique_id = uniqid( 'wpsc_' ); ?> |
| 584 |
<input name="wpsc-tandc-reg-user" id="<?php echo esc_attr( $unique_id ); ?>" type="checkbox" value="1"/> |
| 585 |
<?php |
| 586 |
$name = WPSC_Translations::get( 'wpsc-term-and-conditions-reg-user', stripslashes( $tc['tandc-text-reg-user'] ) ); |
| 587 |
?> |
| 588 |
<label for="<?php echo esc_attr( $unique_id ); ?>"><?php echo wp_kses_post( $name ); ?></label> |
| 589 |
</div> |
| 590 |
</div> |
| 591 |
<?php |
| 592 |
endif; |
| 593 |
|
| 594 |
if ( $gdpr['allow-gdpr-reg-user'] ) { |
| 595 |
?> |
| 596 |
<div class="wpsc-tff wpsc-gdpr wpsc-xs-12 wpsc-sm-12 wpsc-md-12 wpsc-lg-12 required wpsc-visible" data-cft="gdpr-reg-user"> |
| 597 |
<div class="checkbox-container"> |
| 598 |
<?php $unique_id = uniqid( 'wpsc_' ); ?> |
| 599 |
<input name="wpsc-gdpr-reg-user" id="<?php echo esc_attr( $unique_id ); ?>" type="checkbox" value="1"/> |
| 600 |
<?php |
| 601 |
$name = WPSC_Translations::get( 'wpsc-gdpr-reg-user', stripslashes( $gdpr['gdpr-text-reg-user'] ) ); |
| 602 |
?> |
| 603 |
<label for="<?php echo esc_attr( $unique_id ); ?>"><?php echo wp_kses_post( $name ); ?></label> |
| 604 |
</div> |
| 605 |
</div> |
| 606 |
<?php |
| 607 |
} |
| 608 |
?> |
| 609 |
<div> |
| 610 |
|
| 611 |
<button class="wpsc-button normal primary" onclick="wpsc_set_default_registration(this)"><?php esc_attr_e( 'Sign Up', 'supportcandy' ); ?></button> |
| 612 |
<button class="wpsc-button normal secondary" onclick="window.location.reload();"><?php esc_attr_e( 'Cancel', 'supportcandy' ); ?></button> |
| 613 |
<input type="hidden" name="action" value="wpsc_authenticate_registration"/> |
| 614 |
<input type="hidden" name="is_username" value="0"/> |
| 615 |
<input type="hidden" name="is_email" value="0"/> |
| 616 |
<input type="hidden" name="_ajax_nonce" value="<?php echo esc_attr( wp_create_nonce( 'wpsc_authenticate_registration' ) ); ?>"> |
| 617 |
</form> |
| 618 |
<?php |
| 619 |
wp_die(); |
| 620 |
} |
| 621 |
|
| 622 |
/** |
| 623 |
* Check username availability |
| 624 |
* |
| 625 |
* @return void |
| 626 |
*/ |
| 627 |
public static function check_user_availability() { |
| 628 |
|
| 629 |
if ( check_ajax_referer( 'wpsc_check_user_availability', '_ajax_nonce', false ) != 1 ) { |
| 630 |
wp_send_json_error( 'Unauthorized request!', 401 ); |
| 631 |
} |
| 632 |
|
| 633 |
$page_settings = get_option( 'wpsc-gs-page-settings' ); |
| 634 |
if ( $page_settings['user-registration'] !== 'default' ) { |
| 635 |
wp_send_json_error( __( 'Unauthorized', 'supportcandy' ), 401 ); |
| 636 |
} |
| 637 |
|
| 638 |
$type = isset( $_POST['type'] ) ? sanitize_text_field( wp_unslash( $_POST['type'] ) ) : ''; |
| 639 |
if ( in_array( $type, array( 'username', 'email' ) ) === false ) { |
| 640 |
wp_send_json_error( 'Something went wrong', 400 ); |
| 641 |
} |
| 642 |
|
| 643 |
if ( $type === 'username' ) { |
| 644 |
$username = isset( $_POST['username'] ) ? sanitize_user( wp_unslash( $_POST['username'] ) ) : ''; |
| 645 |
if ( ! $username ) { |
| 646 |
wp_send_json_error( 'Something went wrong', 400 ); |
| 647 |
} |
| 648 |
} elseif ( $type === 'email' ) { |
| 649 |
$email = isset( $_POST['email'] ) && filter_var( wp_unslash( $_POST['email'] ), FILTER_VALIDATE_EMAIL ) ? sanitize_email( wp_unslash( $_POST['email'] ) ) : ''; |
| 650 |
if ( ! $email ) { |
| 651 |
wp_send_json_error( 'Something went wrong', 400 ); |
| 652 |
} |
| 653 |
} |
| 654 |
$flag = $type === 'username' ? self::is_username_available( $username ) : self::is_email_available( $email ); |
| 655 |
|
| 656 |
wp_send_json( array( 'isAvailable' => $flag ? 0 : 1 ) ); |
| 657 |
} |
| 658 |
|
| 659 |
/** |
| 660 |
* Send registration OTP for email authentication |
| 661 |
* |
| 662 |
* @return void |
| 663 |
*/ |
| 664 |
public static function send_registration_otp() { |
| 665 |
|
| 666 |
if ( check_ajax_referer( 'wpsc_authenticate_registration', '_ajax_nonce', false ) != 1 ) { |
| 667 |
wp_send_json_error( 'Unauthorized request!', 401 ); |
| 668 |
} |
| 669 |
$page_settings = get_option( 'wpsc-gs-page-settings' ); |
| 670 |
if ( $page_settings['user-registration'] !== 'default' ) { |
| 671 |
wp_send_json_error( __( 'Unauthorized', 'supportcandy' ), 401 ); |
| 672 |
} |
| 673 |
|
| 674 |
WPSC_MS_Recaptcha::validate( 'submit_registration' ); |
| 675 |
|
| 676 |
$firstname = isset( $_POST['firstname'] ) ? sanitize_text_field( wp_unslash( $_POST['firstname'] ) ) : ''; |
| 677 |
if ( ! $firstname ) { |
| 678 |
wp_send_json_error( 'Bad request', 400 ); |
| 679 |
} |
| 680 |
|
| 681 |
$lastname = isset( $_POST['lastname'] ) ? sanitize_text_field( wp_unslash( $_POST['lastname'] ) ) : ''; |
| 682 |
if ( ! $lastname ) { |
| 683 |
wp_send_json_error( 'Bad request', 400 ); |
| 684 |
} |
| 685 |
|
| 686 |
$username = isset( $_POST['username'] ) ? sanitize_user( wp_unslash( $_POST['username'] ) ) : ''; |
| 687 |
if ( ! $username ) { |
| 688 |
wp_send_json_error( 'Bad request', 400 ); |
| 689 |
} |
| 690 |
|
| 691 |
if ( self::is_username_available( $username ) ) { |
| 692 |
wp_send_json_error( 'Bad request', 400 ); |
| 693 |
} |
| 694 |
|
| 695 |
$email_address = isset( $_POST['email_address'] ) && filter_var( wp_unslash( $_POST['email_address'] ), FILTER_VALIDATE_EMAIL ) ? sanitize_email( wp_unslash( $_POST['email_address'] ) ) : ''; |
| 696 |
if ( ! $email_address ) { |
| 697 |
wp_send_json_error( 'Bad request', 400 ); |
| 698 |
} |
| 699 |
|
| 700 |
if ( self::is_email_available( $email_address ) ) { |
| 701 |
wp_send_json_error( 'Bad request', 400 ); |
| 702 |
} |
| 703 |
|
| 704 |
$password = isset( $_POST['password'] ) ? wp_unslash( $_POST['password'] ) : ''; // phpcs:ignore |
| 705 |
if ( ! $password ) { |
| 706 |
wp_send_json_error( 'Bad request', 400 ); |
| 707 |
} |
| 708 |
|
| 709 |
$data = array( |
| 710 |
'firstname' => $firstname, |
| 711 |
'lastname' => $lastname, |
| 712 |
'username' => $username, |
| 713 |
'email_address' => $email_address, |
| 714 |
'password' => $password, |
| 715 |
); |
| 716 |
|
| 717 |
$data = apply_filters( 'wpsc_register_user_data', $data ); |
| 718 |
|
| 719 |
$otp = WPSC_Email_OTP::insert( |
| 720 |
array( |
| 721 |
'email' => $email_address, |
| 722 |
'date_expiry' => ( new DateTime() )->add( new DateInterval( 'PT1H' ) )->format( 'Y-m-d H:i:s' ), |
| 723 |
'data' => wp_json_encode( $data ), |
| 724 |
) |
| 725 |
); |
| 726 |
|
| 727 |
// send email notification. |
| 728 |
WPSC_EN_User_Reg_OTP::send_otp( $otp ); |
| 729 |
?> |
| 730 |
|
| 731 |
<h2><?php esc_attr_e( 'Please sign up', 'supportcandy' ); ?></h2> |
| 732 |
<small style="margin: 0 0 5px;"><?php esc_attr_e( 'We have sent a one-time verification code to your email address.', 'supportcandy' ); ?></small> |
| 733 |
<form onsubmit="return false;" class="wpsc-login wpsc-confirm-registration"> |
| 734 |
<input type="text" name="otp" autocomplete="off"/> |
| 735 |
<button class="wpsc-button normal primary" onclick="wpsc_confirm_registration(this)"><?php esc_attr_e( 'Submit', 'supportcandy' ); ?></button> |
| 736 |
<input type="hidden" name="action" value="wpsc_confirm_registration"/> |
| 737 |
<input type="hidden" name="otp_id" value="<?php echo esc_attr( $otp->id ); ?>"> |
| 738 |
<input type="hidden" name="_ajax_nonce" value="<?php echo esc_attr( wp_create_nonce( 'wpsc_confirm_registration' ) ); ?>"/> |
| 739 |
</form> |
| 740 |
<?php |
| 741 |
wp_die(); |
| 742 |
} |
| 743 |
|
| 744 |
/** |
| 745 |
* Checks whether username is available or not |
| 746 |
* |
| 747 |
* @param string $username - user name string. |
| 748 |
* @return boolean |
| 749 |
*/ |
| 750 |
public static function is_username_available( $username ) { |
| 751 |
|
| 752 |
$user = get_user_by( 'login', $username ); |
| 753 |
return $user ? true : false; |
| 754 |
} |
| 755 |
|
| 756 |
/** |
| 757 |
* Checks whether email is available or not |
| 758 |
* |
| 759 |
* @param string $email - email string. |
| 760 |
* @return boolean |
| 761 |
*/ |
| 762 |
public static function is_email_available( $email ) { |
| 763 |
|
| 764 |
$user = get_user_by( 'email', $email ); |
| 765 |
|
| 766 |
// check allowed email domains. |
| 767 |
$allowed_domains = apply_filters( 'wpsc_registration_allowed_email_domains', array() ); |
| 768 |
$domain = substr( strrchr( $email, '@' ), 1 ); |
| 769 |
if ( $allowed_domains && ! in_array( $domain, $allowed_domains, true ) ) { |
| 770 |
return true; |
| 771 |
} |
| 772 |
return $user ? true : false; |
| 773 |
} |
| 774 |
|
| 775 |
/** |
| 776 |
* Register user after OTP matched |
| 777 |
* |
| 778 |
* @return void |
| 779 |
*/ |
| 780 |
public static function register_user() { |
| 781 |
|
| 782 |
if ( check_ajax_referer( 'wpsc_confirm_registration', '_ajax_nonce', false ) != 1 ) { |
| 783 |
wp_send_json_error( 'Unauthorized request!', 401 ); |
| 784 |
} |
| 785 |
|
| 786 |
$page_settings = get_option( 'wpsc-gs-page-settings' ); |
| 787 |
if ( $page_settings['user-registration'] !== 'default' ) { |
| 788 |
wp_send_json_error( __( 'Unauthorized', 'supportcandy' ), 401 ); |
| 789 |
} |
| 790 |
|
| 791 |
$verification_otp = isset( $_POST['otp'] ) ? sanitize_text_field( wp_unslash( $_POST['otp'] ) ) : ''; |
| 792 |
if ( ! $verification_otp ) { |
| 793 |
wp_send_json_error( 'Bad request', 400 ); |
| 794 |
} |
| 795 |
|
| 796 |
$id = isset( $_POST['otp_id'] ) ? intval( $_POST['otp_id'] ) : ''; |
| 797 |
if ( ! $id ) { |
| 798 |
wp_send_json_error( 'Bad request', 400 ); |
| 799 |
} |
| 800 |
|
| 801 |
$otp = new WPSC_Email_OTP( $id ); |
| 802 |
if ( ! $otp->id ) { |
| 803 |
wp_send_json_error( 'Bad request', 400 ); |
| 804 |
} |
| 805 |
|
| 806 |
if ( ! $otp->is_valid( $verification_otp ) ) { |
| 807 |
wp_send_json( array( 'isSuccess' => 0 ) ); |
| 808 |
wp_die(); |
| 809 |
} |
| 810 |
|
| 811 |
$data = json_decode( $otp->data ); |
| 812 |
|
| 813 |
// check allowed email domains. |
| 814 |
$allowed_domains = apply_filters( 'wpsc_registration_allowed_email_domains', array() ); |
| 815 |
$domain = substr( strrchr( $data->email_address, '@' ), 1 ); |
| 816 |
if ( $allowed_domains && ! in_array( $domain, $allowed_domains, true ) ) { |
| 817 |
wp_send_json_error( |
| 818 |
array( |
| 819 |
'isSuccess' => 0, |
| 820 |
'message' => __( 'Email domain is not allowed.', 'supportcandy' ), |
| 821 |
), |
| 822 |
403 |
| 823 |
); |
| 824 |
} |
| 825 |
|
| 826 |
// insert user. |
| 827 |
$display_name = $data->firstname . ' ' . $data->lastname; |
| 828 |
$user_id = wp_insert_user( |
| 829 |
array( |
| 830 |
'user_login' => $data->username, |
| 831 |
'user_pass' => $data->password, |
| 832 |
'user_email' => $data->email_address, |
| 833 |
'first_name' => $data->firstname, |
| 834 |
'last_name' => $data->lastname, |
| 835 |
'display_name' => $display_name, |
| 836 |
'role' => 'subscriber', |
| 837 |
) |
| 838 |
); |
| 839 |
if ( is_wp_error( $user_id ) ) { |
| 840 |
wp_send_json( array( 'isSuccess' => 0 ) ); |
| 841 |
wp_die(); |
| 842 |
} |
| 843 |
|
| 844 |
$user = wp_signon( |
| 845 |
array( |
| 846 |
'user_login' => $data->username, |
| 847 |
'user_password' => $data->password, |
| 848 |
) |
| 849 |
); |
| 850 |
wp_new_user_notification( $user_id, null, 'admin' ); |
| 851 |
do_action( 'wpsc_after_user_registration', $user, $data ); |
| 852 |
wp_send_json( array( 'isSuccess' => 1 ) ); |
| 853 |
} |
| 854 |
|
| 855 |
/** |
| 856 |
* User registrstion OTP email template section |
| 857 |
* |
| 858 |
* @param array $sections - section name. |
| 859 |
* @return array |
| 860 |
*/ |
| 861 |
public static function registration_email_template_section( $sections ) { |
| 862 |
|
| 863 |
$sections['registration-otp'] = array( |
| 864 |
'slug' => 'registration_otp', |
| 865 |
'icon' => 'unlock', |
| 866 |
'label' => esc_attr__( 'User Registration OTP', 'supportcandy' ), |
| 867 |
'callback' => 'wpsc_get_en_user_reg_otp', |
| 868 |
); |
| 869 |
return $sections; |
| 870 |
} |
| 871 |
|
| 872 |
/** |
| 873 |
* Get guest sign in screen |
| 874 |
* |
| 875 |
* @return void |
| 876 |
*/ |
| 877 |
public static function get_guest_sign_in() { |
| 878 |
|
| 879 |
$gs = get_option( 'wpsc-gs-general' ); |
| 880 |
$page_settings = get_option( 'wpsc-gs-page-settings' ); |
| 881 |
if ( ! ( $page_settings['otp-login'] && in_array( 'guest', $gs['allow-create-ticket'] ) ) ) { |
| 882 |
wp_send_json_error( 'Unauthorozed', 400 ); |
| 883 |
} |
| 884 |
?> |
| 885 |
|
| 886 |
<h2><?php esc_attr_e( 'Please sign in', 'supportcandy' ); ?></h2> |
| 887 |
<form onsubmit="return false;" class="wpsc-login authenticate-guest-login"> |
| 888 |
<input type="text" name="email_address" placeholder="<?php esc_attr_e( 'Email Address', 'supportcandy' ); ?>" autocomplete="off"/> |
| 889 |
<button class="wpsc-button normal primary" onclick="wpsc_authenticate_guest_login(this)"><?php esc_attr_e( 'Sign In', 'supportcandy' ); ?></button> |
| 890 |
<button class="wpsc-button normal secondary" onclick="window.location.reload();"><?php esc_attr_e( 'Cancel', 'supportcandy' ); ?></button> |
| 891 |
<input type="hidden" name="action" value="wpsc_authenticate_guest_login"/> |
| 892 |
<input type="hidden" name="_ajax_nonce" value="<?php echo esc_attr( wp_create_nonce( 'wpsc_authenticate_guest_login' ) ); ?>"> |
| 893 |
</form> |
| 894 |
<?php |
| 895 |
wp_die(); |
| 896 |
} |
| 897 |
|
| 898 |
/** |
| 899 |
* Get OTP screen |
| 900 |
* |
| 901 |
* @return void |
| 902 |
*/ |
| 903 |
public static function get_guest_sign_in_auth() { |
| 904 |
|
| 905 |
if ( check_ajax_referer( 'wpsc_authenticate_guest_login', '_ajax_nonce', false ) != 1 ) { |
| 906 |
wp_send_json_error( 'Unauthorized request!', 401 ); |
| 907 |
} |
| 908 |
$gs = get_option( 'wpsc-gs-general' ); |
| 909 |
$page_settings = get_option( 'wpsc-gs-page-settings' ); |
| 910 |
if ( ! ( $page_settings['otp-login'] && in_array( 'guest', $gs['allow-create-ticket'] ) ) ) { |
| 911 |
wp_send_json_error( 'Unauthorozed', 400 ); |
| 912 |
} |
| 913 |
|
| 914 |
$email_address = isset( $_POST['email_address'] ) && filter_var( wp_unslash( $_POST['email_address'] ), FILTER_VALIDATE_EMAIL ) ? sanitize_text_field( wp_unslash( $_POST['email_address'] ) ) : ''; |
| 915 |
if ( ! $email_address ) { |
| 916 |
wp_send_json_error( 'Bad request', 400 ); |
| 917 |
} |
| 918 |
|
| 919 |
$customer = WPSC_Customer::get_by_email( $email_address ); |
| 920 |
if ( ! $customer->id ) { |
| 921 |
esc_attr_e( 'Invalid email address!', 'supportcandy' ); |
| 922 |
wp_die(); |
| 923 |
} |
| 924 |
|
| 925 |
$otp = WPSC_Email_OTP::insert( |
| 926 |
array( |
| 927 |
'email' => $email_address, |
| 928 |
'date_expiry' => ( new DateTime() )->add( new DateInterval( 'P1D' ) )->format( 'Y-m-d H:i:s' ), |
| 929 |
'data' => wp_json_encode( |
| 930 |
array( |
| 931 |
'email' => $email_address, |
| 932 |
) |
| 933 |
), |
| 934 |
) |
| 935 |
); |
| 936 |
|
| 937 |
// Send OTP for login. |
| 938 |
WPSC_EN_Guest_Login_OTP::send_otp( $otp ); |
| 939 |
?> |
| 940 |
|
| 941 |
<h2><?php esc_attr_e( 'Please sign in', 'supportcandy' ); ?></h2> |
| 942 |
<small style="margin: 0 0 5px;"><?php esc_attr_e( 'We have sent a one-time verification code to your email address.', 'supportcandy' ); ?></small> |
| 943 |
<form onsubmit="return false;" class="wpsc-login wpsc-confirm-guest-login"> |
| 944 |
<input type="text" name="otp" autocomplete="off"/> |
| 945 |
<button class="wpsc-button normal primary" onclick="wpsc_confirm_guest_login(this)"><?php esc_attr_e( 'Submit', 'supportcandy' ); ?></button> |
| 946 |
<input type="hidden" name="action" value="wpsc_confirm_guest_login"/> |
| 947 |
<input type="hidden" name="otp_id" value="<?php echo esc_attr( $otp->id ); ?>"> |
| 948 |
<input type="hidden" name="_ajax_nonce" value="<?php echo esc_attr( wp_create_nonce( 'wpsc_confirm_guest_login' ) ); ?>"> |
| 949 |
</form> |
| 950 |
<?php |
| 951 |
wp_die(); |
| 952 |
} |
| 953 |
|
| 954 |
/** |
| 955 |
* Confirm guest login |
| 956 |
* |
| 957 |
* @return void |
| 958 |
*/ |
| 959 |
public static function confirm_guest_login() { |
| 960 |
|
| 961 |
// Add rate limiting. |
| 962 |
$ip_address = WPSC_DF_IP_Address::get_current_user_ip(); |
| 963 |
$attempt_key = 'wpsc_otp_attempts_' . md5( $ip_address ); |
| 964 |
$attempts = get_transient( $attempt_key ); |
| 965 |
$attempts = $attempts ? $attempts : 1; |
| 966 |
|
| 967 |
if ( $attempts >= 5 ) { |
| 968 |
wp_send_json_error( 'Too many attempts. Please try again later.', 429 ); |
| 969 |
} |
| 970 |
|
| 971 |
if ( check_ajax_referer( 'wpsc_confirm_guest_login', '_ajax_nonce', false ) != 1 ) { |
| 972 |
wp_send_json_error( 'Unauthorized request!', 401 ); |
| 973 |
} |
| 974 |
|
| 975 |
$gs = get_option( 'wpsc-gs-general' ); |
| 976 |
$page_settings = get_option( 'wpsc-gs-page-settings' ); |
| 977 |
if ( ! ( $page_settings['otp-login'] && in_array( 'guest', $gs['allow-create-ticket'] ) ) ) { |
| 978 |
wp_send_json_error( 'Unauthorozed', 400 ); |
| 979 |
} |
| 980 |
|
| 981 |
$verification_otp = isset( $_POST['otp'] ) ? sanitize_text_field( wp_unslash( $_POST['otp'] ) ) : ''; |
| 982 |
if ( ! $verification_otp ) { |
| 983 |
wp_send_json_error( 'Bad request', 400 ); |
| 984 |
} |
| 985 |
|
| 986 |
$id = isset( $_POST['otp_id'] ) ? intval( $_POST['otp_id'] ) : ''; |
| 987 |
if ( ! $id ) { |
| 988 |
wp_send_json_error( 'Bad request', 400 ); |
| 989 |
} |
| 990 |
|
| 991 |
$otp = new WPSC_Email_OTP( $id ); |
| 992 |
if ( ! $otp->id ) { |
| 993 |
wp_send_json_error( 'Bad request', 400 ); |
| 994 |
} |
| 995 |
|
| 996 |
if ( ! $otp->is_valid( $verification_otp ) ) { |
| 997 |
|
| 998 |
// Increment attempt counter. |
| 999 |
++$attempts; |
| 1000 |
set_transient( $attempt_key, $attempts, 300 ); // 5 minute lockout. |
| 1001 |
|
| 1002 |
// Add per-OTP attempt tracking. |
| 1003 |
$otp_attempt_key = 'wpsc_otp_' . $id . '_attempts'; |
| 1004 |
$otp_attempts = get_transient( $otp_attempt_key ); |
| 1005 |
$otp_attempts = $otp_attempts ? $otp_attempts + 1 : 1; |
| 1006 |
set_transient( $otp_attempt_key, $otp_attempts, 600 ); |
| 1007 |
|
| 1008 |
if ( $otp_attempts >= 3 ) { |
| 1009 |
WPSC_Email_OTP::destroy( $otp ); |
| 1010 |
wp_send_json_error( 'OTP has been invalidated due to too many failed attempts', 403 ); |
| 1011 |
} |
| 1012 |
|
| 1013 |
wp_send_json( array( 'isSuccess' => 0 ) ); |
| 1014 |
wp_die(); |
| 1015 |
} |
| 1016 |
|
| 1017 |
$data = json_decode( $otp->data, true ); |
| 1018 |
$data['auth_token'] = WPSC_Functions::get_random_string( 100 ); |
| 1019 |
$data['auth_type'] = 'login'; |
| 1020 |
$otp->data = wp_json_encode( $data ); |
| 1021 |
$otp->save(); |
| 1022 |
|
| 1023 |
// Clear rate limiting on success. |
| 1024 |
delete_transient( $attempt_key ); |
| 1025 |
|
| 1026 |
// add customer record if not set. |
| 1027 |
$customer = WPSC_Customer::get_by_email( $data['email'] ); |
| 1028 |
if ( ! $customer->id ) { |
| 1029 |
$user = get_user_by( 'email', $data['email'] ); |
| 1030 |
if ( $user ) { |
| 1031 |
|
| 1032 |
WPSC_Customer::insert( |
| 1033 |
array( |
| 1034 |
'user' => $user->ID, |
| 1035 |
'name' => $user->display_name, |
| 1036 |
'email' => $user->user_email, |
| 1037 |
) |
| 1038 |
); |
| 1039 |
|
| 1040 |
} else { |
| 1041 |
|
| 1042 |
WPSC_Customer::insert( |
| 1043 |
array( |
| 1044 |
'user' => 0, |
| 1045 |
'name' => $data['name'], |
| 1046 |
'email' => $data['email'], |
| 1047 |
) |
| 1048 |
); |
| 1049 |
} |
| 1050 |
} |
| 1051 |
|
| 1052 |
$auth = array( |
| 1053 |
'email' => $otp->email, |
| 1054 |
'token' => $data['auth_token'], |
| 1055 |
); |
| 1056 |
|
| 1057 |
setcookie( 'wpsc_guest_login_auth', wp_json_encode( $auth ), $otp->date_expiry->getTimestamp(), '/' ); |
| 1058 |
|
| 1059 |
wp_send_json( array( 'isSuccess' => 1 ) ); |
| 1060 |
} |
| 1061 |
|
| 1062 |
/** |
| 1063 |
* Validate login auth token |
| 1064 |
* |
| 1065 |
* @param object $login_auth - login auth details. |
| 1066 |
* @return boolean |
| 1067 |
*/ |
| 1068 |
public static function validate_guest_login( $login_auth ) { |
| 1069 |
|
| 1070 |
$gs = get_option( 'wpsc-gs-general' ); |
| 1071 |
$page_settings = get_option( 'wpsc-gs-page-settings' ); |
| 1072 |
|
| 1073 |
$results = WPSC_Email_OTP::find( |
| 1074 |
array( |
| 1075 |
'meta_query' => array( |
| 1076 |
'relation' => 'AND', |
| 1077 |
array( |
| 1078 |
'slug' => 'email', |
| 1079 |
'compare' => '=', |
| 1080 |
'val' => $login_auth->email, |
| 1081 |
), |
| 1082 |
), |
| 1083 |
) |
| 1084 |
)['results']; |
| 1085 |
|
| 1086 |
if ( ! $results ) { |
| 1087 |
return false; |
| 1088 |
} |
| 1089 |
|
| 1090 |
$otp = $results[0]; |
| 1091 |
if ( ! $otp->id ) { |
| 1092 |
return false; |
| 1093 |
} |
| 1094 |
|
| 1095 |
$now = new DateTime(); |
| 1096 |
$data = json_decode( $otp->data ); |
| 1097 |
|
| 1098 |
if ( |
| 1099 |
isset( $data->auth_type ) && |
| 1100 |
( ( $data->auth_type == 'login' && $page_settings['otp-login'] && in_array( 'guest', $gs['allow-create-ticket'] ) ) || $data->auth_type == 'open-ticket' ) && |
| 1101 |
( $otp->date_expiry > $now && $data->auth_token == $login_auth->token ) |
| 1102 |
) { |
| 1103 |
self::$login_type = 'guest'; |
| 1104 |
self::$guest_login_type = $data->auth_type; |
| 1105 |
return true; |
| 1106 |
} |
| 1107 |
|
| 1108 |
return false; |
| 1109 |
} |
| 1110 |
|
| 1111 |
/** |
| 1112 |
* Add guest login email template |
| 1113 |
* |
| 1114 |
* @param array $sections - section name. |
| 1115 |
* @return array |
| 1116 |
*/ |
| 1117 |
public static function guest_login_email_template_section( $sections ) { |
| 1118 |
|
| 1119 |
$sections['guest-login-otp'] = array( |
| 1120 |
'slug' => 'guest_login_otp', |
| 1121 |
'icon' => 'unlock', |
| 1122 |
'label' => esc_attr__( 'Guest Login OTP', 'supportcandy' ), |
| 1123 |
'callback' => 'wpsc_get_en_guest_login_otp', |
| 1124 |
); |
| 1125 |
return $sections; |
| 1126 |
} |
| 1127 |
|
| 1128 |
/** |
| 1129 |
* Logout current user |
| 1130 |
* |
| 1131 |
* @return void |
| 1132 |
*/ |
| 1133 |
public function logout() { |
| 1134 |
|
| 1135 |
global $current_user; |
| 1136 |
|
| 1137 |
$otp = WPSC_Email_OTP::find( |
| 1138 |
array( |
| 1139 |
'meta_query' => array( |
| 1140 |
'relation' => 'AND', |
| 1141 |
array( |
| 1142 |
'slug' => 'email', |
| 1143 |
'compare' => '=', |
| 1144 |
'val' => $this->customer->email, |
| 1145 |
), |
| 1146 |
), |
| 1147 |
) |
| 1148 |
)['results']; |
| 1149 |
|
| 1150 |
if ( $otp ) : |
| 1151 |
WPSC_Email_OTP::destroy( $otp[0] ); |
| 1152 |
@setcookie( 'wpsc_guest_login_auth', '', time(), '/' ); //phpcs:ignore |
| 1153 |
endif; |
| 1154 |
|
| 1155 |
if ( $current_user->ID ) { |
| 1156 |
wp_logout(); |
| 1157 |
} |
| 1158 |
} |
| 1159 |
} |
| 1160 |
endif; |
| 1161 |
|
| 1162 |
WPSC_Current_User::init(); |
| 1163 |
|
