← All changes | includes/frontend/class-wpsc-frontend.php +74 -15 3.3.6 → 3.5.4 View file →

		@@ -37,8 +37,16 @@
37	37	if ( ! $ticket->id ) {
38	38	return;
39	39	}
40	40
	41	+ // Validate the submitted auth code against the stored one before
	42	+ // doing anything with the ticket. Never redirect to (and thereby
	43	+ // disclose) the real ticket URL/auth code for an invalid guess.
	44	+ $submitted_auth_code = sanitize_text_field( wp_unslash( $_REQUEST['auth_code'] ) ); // phpcs:ignore
	45	+ if ( ! $ticket->auth_code || ! $submitted_auth_code || ! hash_equals( (string) $ticket->auth_code, $submitted_auth_code ) ) {
	46	+ return;
	47	+ }
	48	+
41	49	wp_safe_redirect( $ticket->get_url() );
42	50	exit;
43	51	}
44	52	}
		@@ -50,10 +58,9 @@
50	58	*/
51	59	public static function load_scripts() {
52	60
53	61	// Check load scripts setting to load script on perticular page.
54		- $page_settings = get_option( 'wpsc-gs-page-settings' );
55		- if ( $page_settings['load-scripts'] == 'custom' && ! in_array( get_the_id(), $page_settings['load-script-pages'] ) ) {
	62	+ if ( ! WPSC_Functions::is_load_scripts_page() ) {
56	63	return;
57	64	}
58	65
59	66	// jquery.
		@@ -205,10 +212,10 @@
205	212	</div>
206	213	<?php
207	214
208	215	// recaptcha.
209		- if ( $recaptcha['allow-recaptcha'] === 1 && $recaptcha['recaptcha-version'] == 2 && $recaptcha['recaptcha-site-key'] && $recaptcha['recaptcha-secret-key'] ) :
210		- $unique_id = uniqid( 'wpsc_' )
	216	+ if ( $recaptcha['captcha-provider'] === 'google-recaptcha' && $recaptcha['recaptcha-version'] == 2 && $recaptcha['recaptcha-site-key'] && $recaptcha['recaptcha-secret-key'] ) :
	217	+ $unique_id = uniqid( 'wpsc_' );
211	218	?>
212	219	<script src="https://www.google.com/recaptcha/api.js?onload=recaptchaCallback&render=explicit" async defer></script> <?php // phpcs:ignore ?>
213	220	<div id="<?php echo esc_attr( $unique_id ); ?>" style="margin-bottom: 5px;"></div>
214	221	<script>
		@@ -223,13 +230,21 @@
223	230	}
224	231	</script>
225	232	<?php
226	233	endif;
227		- if ( $recaptcha['allow-recaptcha'] === 1 && $recaptcha['recaptcha-version'] == 3 && $recaptcha['recaptcha-site-key'] && $recaptcha['recaptcha-secret-key'] ) :
	234	+ if ( $recaptcha['captcha-provider'] === 'google-recaptcha' && $recaptcha['recaptcha-version'] == 3 && $recaptcha['recaptcha-site-key'] && $recaptcha['recaptcha-secret-key'] ) :
228	235	?>
229	236	<script src="https://www.google.com/recaptcha/api.js?render=<?php echo esc_attr( $recaptcha['recaptcha-site-key'] ); ?>"></script> <?php // phpcs:ignore ?>
230	237	<?php
231	238	endif;
	239	+ if ( $recaptcha['captcha-provider'] === 'cloudflare-turnstile' && $recaptcha['cloudflare-site-key'] && $recaptcha['cloudflare-secret-key'] ) :
	240	+ ?>
	241	+ <script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script> <?php // phpcs:ignore ?>
	242	+ <div class="wpsc-tff turnstile wpsc-xs-12 wpsc-sm-12 wpsc-md-12 wpsc-lg-12 required wpsc-visible" data-cft="turnstile">
	243	+ <div class="cf-turnstile" data-sitekey="<?php echo esc_attr( $recaptcha['cloudflare-site-key'] ); ?>"></div>
	244	+ </div>
	245	+ <?php
	246	+ endif;
232	247	?>
233	248
234	249	<button class="wpsc-button normal primary" onclick="wpsc_submit_login_form(this)"><?php esc_attr_e( 'Sign In', 'supportcandy' ); ?></button>
235	250	<input type="hidden" name="action" value="wpsc_default_login"/>
		@@ -277,15 +292,15 @@
277	292	<?php
278	293	}
279	294	if ( $otp_login && $page_settings['otp-login'] && in_array( 'guest', $gs['allow-create-ticket'] ) ) :
280	295	?>
281		- <a class="wpsc-link wpsc-otp-signin" href="javascript:wpsc_get_guest_sign_in();"><?php esc_attr_e( 'Sign-in using one time password', 'supportcandy' ); ?></a>
	296	+ <span class="wpsc-link wpsc-otp-signin" onclick="wpsc_get_guest_sign_in();"><?php esc_attr_e( 'Sign-in using one time password', 'supportcandy' ); ?></span>
282	297	<?php
283	298	endif;
284	299
285	300	if ( $additional_links && in_array( 'guest', $gs['allow-create-ticket'] ) ) :
286	301	?>
287		- <a class="wpsc-link wpsc-guest-create-ticket" href="javascript:wpsc_get_guest_ticket_form();"><?php esc_attr_e( 'Create new ticket as guest', 'supportcandy' ); ?></a>
	302	+ <span class="wpsc-link wpsc-guest-create-ticket" onclick="wpsc_get_guest_ticket_form();"><?php esc_attr_e( 'Create new ticket as guest', 'supportcandy' ); ?></span>
288	303	<?php
289	304	endif;
290	305
291	306	if ( $additional_links && $page_settings['open-ticket-page'] ) :
		@@ -309,9 +324,9 @@
309	324	alert(supportcandy.translations.req_fields_missing);
310	325	return;
311	326	}
312	327	<?php
313		- if ( $recaptcha['allow-recaptcha'] === 1 && $recaptcha['recaptcha-version'] == 3 && $recaptcha['recaptcha-site-key'] && $recaptcha['recaptcha-secret-key'] ) {
	328	+ if ( $recaptcha['captcha-provider'] === 'google-recaptcha' && $recaptcha['recaptcha-version'] == 3 && $recaptcha['recaptcha-site-key'] && $recaptcha['recaptcha-secret-key'] ) {
314	329	?>
315	330	grecaptcha.ready(function() {
316	331	grecaptcha.execute('<?php echo esc_attr( $recaptcha['recaptcha-site-key'] ); ?>', {action: 'submit_login'}).then(function(token) {
317	332	dataform.append('g-recaptcha-response', token);
		@@ -318,13 +333,13 @@
318	333	wpsc_post_login_form(el, dataform);
319	334	});
320	335	});
321	336	<?php
322		- } elseif ( $recaptcha['allow-recaptcha'] === 1 && $recaptcha['recaptcha-version'] == 2 && $recaptcha['recaptcha-site-key'] && $recaptcha['recaptcha-secret-key'] ) {
	337	+ } elseif ( $recaptcha['captcha-provider'] === 'google-recaptcha' && $recaptcha['recaptcha-version'] == 2 && $recaptcha['recaptcha-site-key'] && $recaptcha['recaptcha-secret-key'] ) {
323	338	?>
324	339	var token = dataform.get('g-recaptcha-response');
325	340	if (!token) {
326		- alert("<?php esc_attr_e( 'Captcha not set!', 'supportcandy' ); ?>");
	341	+ alert("<?php esc_attr_e( 'Security verification failed. Please refresh the page and try again.', 'supportcandy' ); ?>");
327	342	return;
328	343	}
329	344	wpsc_post_login_form(el, dataform);
330	345	<?php
		@@ -349,11 +364,34 @@
349	364	data: dataform,
350	365	processData: false,
351	366	contentType: false
352	367	}).done(function (response) {
353		- if (response.success != 1) alert(supportcandy.translations.incorrect_login);
354		- }).fail(function (res) {
355		- alert(supportcandy.translations.something_wrong);
	368	+ if (response.success) {
	369	+ window.location.reload();
	370	+ return;
	371	+ }
	372	+
	373	+ if (response.data) {
	374	+ if (typeof response.data === 'string') {
	375	+ message = response.data;
	376	+ } else if (response.data.message) {
	377	+ message = response.data.message;
	378	+ }
	379	+ }
	380	+ alert(message);
	381	+ }).fail(function (xhr, status, error) {
	382	+ let message = supportcandy.translations.something_wrong;
	383	+
	384	+ // Handle WP JSON errors (401, 403, 400)
	385	+ if (xhr.responseJSON && xhr.responseJSON.data) {
	386	+ if (typeof xhr.responseJSON.data === 'string') {
	387	+ message = xhr.responseJSON.data;
	388	+ } else if (xhr.responseJSON.data.message) {
	389	+ message = xhr.responseJSON.data.message;
	390	+ }
	391	+ }
	392	+
	393	+ alert(message);
356	394	}).always(function () {
357	395	window.location.reload();
358	396	});
359	397	}
		@@ -391,8 +429,9 @@
391	429	var email_address = dataform.get('email_address').trim();
392	430	var password = dataform.get('password').trim();
393	431	var confirm_password = dataform.get('confirm_password').trim();
394	432	var isUsername = dataform.get('is_username').trim();
	433	+ var isEmail = dataform.get('is_email').trim();
395	434
396	435	<?php
397	436	if ( $tc['allow-term-and-conditions-reg-user'] ) {
398	437	?>
		@@ -428,8 +467,13 @@
428	467	alert(supportcandy.translations.unsername_unavailable);
429	468	return;
430	469	}
431	470
	471	+ if (isEmail != 1) {
	472	+ alert(supportcandy.translations.email_unavailable);
	473	+ return;
	474	+ }
	475	+
432	476	if (password !== confirm_password) {
433	477	alert(supportcandy.translations.incorrect_password);
434	478	return;
435	479	}
		@@ -434,9 +478,9 @@
434	478	return;
435	479	}
436	480
437	481	<?php
438		- if ( $recaptcha['allow-recaptcha'] === 1 && $recaptcha['recaptcha-version'] == 3 && $recaptcha['recaptcha-site-key'] && $recaptcha['recaptcha-secret-key'] ) {
	482	+ if ( $recaptcha['captcha-provider'] === 'google-recaptcha' && $recaptcha['recaptcha-version'] == 3 && $recaptcha['recaptcha-site-key'] && $recaptcha['recaptcha-secret-key'] ) {
439	483	?>
440	484	grecaptcha.ready(function() {
441	485	grecaptcha.execute('<?php echo esc_attr( $recaptcha['recaptcha-site-key'] ); ?>', {action: 'submit_registration'}).then(function(token) {
442	486	dataform.append('g-recaptcha-response', token);
		@@ -443,9 +487,9 @@
443	487	wpsc_authenticate_registration(el, dataform);
444	488	});
445	489	});
446	490	<?php
447		- } elseif ( $recaptcha['allow-recaptcha'] === 1 && $recaptcha['recaptcha-version'] == 2 && $recaptcha['recaptcha-site-key'] && $recaptcha['recaptcha-secret-key'] ) {
	491	+ } elseif ( $recaptcha['captcha-provider'] === 'google-recaptcha' && $recaptcha['recaptcha-version'] == 2 && $recaptcha['recaptcha-site-key'] && $recaptcha['recaptcha-secret-key'] ) {
448	492	?>
449	493	var token = dataform.get('g-recaptcha-response');
450	494	if (!token) {
451	495	alert("<?php esc_attr_e( 'Captcha not set!', 'supportcandy' ); ?>");
		@@ -452,8 +496,23 @@
452	496	return;
453	497	}
454	498	wpsc_authenticate_registration(el, dataform);
455	499	<?php
	500	+ } elseif ( $recaptcha['captcha-provider'] === 'cloudflare-turnstile' && $recaptcha['cloudflare-site-key'] && $recaptcha['cloudflare-secret-key'] ) {
	501	+ ?>
	502	+ var token = dataform.get('cf-turnstile-response');
	503	+ if (!token) {
	504	+ alert("<?php esc_attr_e( 'Security verification failed. Please refresh the page and try again.', 'supportcandy' ); ?>");
	505	+ return;
	506	+ }
	507	+
	508	+ dataform.set(
	509	+ 'cf-turnstile-response',
	510	+ token
	511	+ );
	512	+ wpsc_authenticate_registration(el, dataform);
	513	+ <?php
	514	+
456	515	} else {
457	516	?>
458	517
459	518	wpsc_authenticate_registration(el, dataform);