| @@ -90,9 +90,9 @@ | ||
| 90 | 90 | add_action( 'wp_ajax_nopriv_wpsc_default_login', array( __CLASS__, 'check_user_login' ) ); |
| 91 | 91 | |
| 92 | 92 | // default registration. |
| 93 | 93 | add_action( 'wp_ajax_nopriv_wpsc_get_default_registration', array( __CLASS__, 'get_user_registration' ) ); |
| 94 | - add_action( 'wp_ajax_nopriv_wpsc_check_username_availability', array( __CLASS__, 'check_username_availability' ) ); | |
| 94 | + add_action( 'wp_ajax_nopriv_wpsc_check_user_availability', array( __CLASS__, 'check_user_availability' ) ); | |
| 95 | 95 | add_action( 'wp_ajax_nopriv_wpsc_authenticate_registration', array( __CLASS__, 'send_registration_otp' ) ); |
| 96 | 96 | add_action( 'wp_ajax_nopriv_wpsc_confirm_registration', array( __CLASS__, 'register_user' ) ); |
| 97 | 97 | |
| 98 | 98 | // sign-in using otp. |
| @@ -164,8 +164,24 @@ | ||
| 164 | 164 | } |
| 165 | 165 | } |
| 166 | 166 | |
| 167 | 167 | /** |
| 168 | + * Return customer object by WordPress user ID. | |
| 169 | + * | |
| 170 | + * @param int $user_id - WordPress user ID. | |
| 171 | + * @return WPSC_Customer | |
| 172 | + */ | |
| 173 | + public static function get_customer_by_user_id( $user_id ) { | |
| 174 | + | |
| 175 | + $user_id = absint( $user_id ); | |
| 176 | + if ( ! $user_id ) { | |
| 177 | + return new WPSC_Customer(); | |
| 178 | + } | |
| 179 | + | |
| 180 | + return WPSC_Customer::get_by_user_id( $user_id ); | |
| 181 | + } | |
| 182 | + | |
| 183 | + /** | |
| 168 | 184 | * Load current wpsc user |
| 169 | 185 | * |
| 170 | 186 | * @return void |
| 171 | 187 | */ |
| @@ -170,12 +186,20 @@ | ||
| 170 | 186 | * @return void |
| 171 | 187 | */ |
| 172 | 188 | public static function load_current_user() { |
| 173 | 189 | |
| 174 | - global $current_user; | |
| 190 | + // Use wp_get_current_user() rather than the raw global - the | |
| 191 | + // global is only populated once something has actually called | |
| 192 | + // wp_get_current_user() (or a function that does, like | |
| 193 | + // is_user_logged_in()) earlier in the request. Nothing guarantees | |
| 194 | + // that has happened yet by the 'init' hook (where this runs), so | |
| 195 | + // reading the raw global directly can see an empty, not-yet-resolved | |
| 196 | + // WP_User and wrongly treat a logged-in visitor as a guest for the | |
| 197 | + // rest of the request. | |
| 198 | + $wp_user = wp_get_current_user(); | |
| 175 | 199 | |
| 176 | 200 | // wp logged-in user. |
| 177 | - $email = $current_user && $current_user->ID ? $current_user->user_email : ''; | |
| 201 | + $email = $wp_user && $wp_user->ID ? $wp_user->user_email : ''; | |
| 178 | 202 | if ( $email ) { |
| 179 | 203 | self::$current_user = new WPSC_Current_User( $email ); |
| 180 | 204 | self::$login_type = 'registered'; |
| 181 | 205 | return; |
| @@ -186,14 +210,14 @@ | ||
| 186 | 210 | |
| 187 | 211 | $login_auth = isset( $_COOKIE['wpsc_guest_login_auth'] ) ? sanitize_text_field( wp_unslash( $_COOKIE['wpsc_guest_login_auth'] ) ) : ''; |
| 188 | 212 | $login_auth = $login_auth ? json_decode( $login_auth ) : false; |
| 189 | 213 | |
| 190 | - if ( ! $login_auth ) { | |
| 214 | + if ( ! $login_auth || ! is_object( $login_auth ) || ! isset( $login_auth->token ) || ! is_string( $login_auth->token ) ) { | |
| 191 | 215 | self::$current_user = new WPSC_Current_User(); |
| 192 | 216 | return; |
| 193 | 217 | } |
| 194 | 218 | |
| 195 | - $login_auth->email = $login_auth->email ? sanitize_email( $login_auth->email ) : ''; | |
| 219 | + $login_auth->email = isset( $login_auth->email ) && is_string( $login_auth->email ) ? sanitize_email( $login_auth->email ) : ''; | |
| 196 | 220 | if ( ! $login_auth->email ) { |
| 197 | 221 | self::$current_user = new WPSC_Current_User(); |
| 198 | 222 | return; |
| 199 | 223 | } |
| @@ -236,9 +260,9 @@ | ||
| 236 | 260 | $default_filters = get_option( $this->is_agent ? 'wpsc-atl-default-filters' : 'wpsc-ctl-default-filters' ); |
| 237 | 261 | foreach ( $default_filters as $index => $filter ) { |
| 238 | 262 | |
| 239 | 263 | // exclude if current user does not have access to deleted filter. |
| 240 | - if ( $index == 'deleted' && ! $this->agent->has_cap( 'dtt-access' ) ) { | |
| 264 | + if ( $index === 'deleted' && ! $this->agent->has_cap( 'dtt-access' ) ) { | |
| 241 | 265 | continue; |
| 242 | 266 | } |
| 243 | 267 | |
| 244 | 268 | // exclude if filter is not enabled. |
| @@ -366,8 +390,54 @@ | ||
| 366 | 390 | return apply_filters( 'wpsc_tl_current_user_system_query', $system_query, $filters, $this ); |
| 367 | 391 | } |
| 368 | 392 | |
| 369 | 393 | /** |
| 394 | + * Return system query for the current user for ticket list | |
| 395 | + * | |
| 396 | + * @param array $filters - filters. | |
| 397 | + * @return array | |
| 398 | + */ | |
| 399 | + public function get_atl_system_query( $filters ) { | |
| 400 | + | |
| 401 | + $system_query = array( 'relation' => 'OR' ); | |
| 402 | + | |
| 403 | + $system_query[] = array( | |
| 404 | + 'slug' => 'customer', | |
| 405 | + 'compare' => '=', | |
| 406 | + 'val' => $this->customer->id, | |
| 407 | + ); | |
| 408 | + | |
| 409 | + if ( $this->is_agent ) { | |
| 410 | + | |
| 411 | + if ( $this->agent->has_cap( 'at-assigned-me' ) ) { | |
| 412 | + $system_query[] = array( | |
| 413 | + 'slug' => 'assigned_agent', | |
| 414 | + 'compare' => '=', | |
| 415 | + 'val' => $this->agent->id, | |
| 416 | + ); | |
| 417 | + } | |
| 418 | + | |
| 419 | + if ( $this->agent->has_cap( 'at-unassigned' ) ) { | |
| 420 | + $system_query[] = array( | |
| 421 | + 'slug' => 'assigned_agent', | |
| 422 | + 'compare' => '=', | |
| 423 | + 'val' => '', | |
| 424 | + ); | |
| 425 | + } | |
| 426 | + | |
| 427 | + if ( $this->agent->has_cap( 'at-assigned-others' ) ) { | |
| 428 | + $system_query[] = array( | |
| 429 | + 'slug' => 'assigned_agent', | |
| 430 | + 'compare' => 'NOT IN', | |
| 431 | + 'val' => array( $this->agent->id, '' ), | |
| 432 | + ); | |
| 433 | + } | |
| 434 | + } | |
| 435 | + | |
| 436 | + return apply_filters( 'wpsc_atl_current_user_system_query', $system_query, $filters, $this ); | |
| 437 | + } | |
| 438 | + | |
| 439 | + /** | |
| 370 | 440 | * Check login for default login form |
| 371 | 441 | * |
| 372 | 442 | * @return void |
| 373 | 443 | */ |
| @@ -373,9 +443,9 @@ | ||
| 373 | 443 | */ |
| 374 | 444 | public static function check_user_login() { |
| 375 | 445 | |
| 376 | 446 | if ( check_ajax_referer( 'wpsc_default_login', '_ajax_nonce', false ) != 1 ) { |
| 377 | - wp_send_json_error( 'Unauthorised request!', 401 ); | |
| 447 | + wp_send_json_error( 'Unauthorized request!', 401 ); | |
| 378 | 448 | } |
| 379 | 449 | |
| 380 | 450 | WPSC_MS_Recaptcha::validate( 'submit_login' ); |
| 381 | 451 | |
| @@ -398,10 +468,37 @@ | ||
| 398 | 468 | 'remember' => $remember_me, |
| 399 | 469 | ) |
| 400 | 470 | ); |
| 401 | 471 | |
| 402 | - $success = is_wp_error( $user ) ? 0 : 1; | |
| 403 | - wp_send_json( array( 'success' => $success ) ); | |
| 472 | + if ( is_wp_error( $user ) ) { | |
| 473 | + | |
| 474 | + $auth_errors = array( | |
| 475 | + 'incorrect_password', | |
| 476 | + 'invalid_username', | |
| 477 | + 'empty_username', | |
| 478 | + 'empty_password', | |
| 479 | + ); | |
| 480 | + $code = $user->get_error_code(); | |
| 481 | + if ( in_array( $code, $auth_errors, true ) ) { | |
| 482 | + | |
| 483 | + wp_send_json_error( | |
| 484 | + array( | |
| 485 | + 'code' => 'invalid_login', | |
| 486 | + 'message' => __( 'Invalid username or password.', 'supportcandy' ), | |
| 487 | + ), | |
| 488 | + 401 | |
| 489 | + ); | |
| 490 | + } | |
| 491 | + | |
| 492 | + wp_send_json_error( | |
| 493 | + array( | |
| 494 | + 'code' => $code, | |
| 495 | + 'message' => wp_strip_all_tags( $user->get_error_message() ), | |
| 496 | + ), | |
| 497 | + 400 | |
| 498 | + ); | |
| 499 | + } | |
| 500 | + wp_send_json_success(); | |
| 404 | 501 | } |
| 405 | 502 | |
| 406 | 503 | /** |
| 407 | 504 | * Get user registration |
| @@ -431,9 +528,9 @@ | ||
| 431 | 528 | jQuery('#wpsc-username').change(function(){ |
| 432 | 529 | jQuery('#wpsc-username-available').hide(); |
| 433 | 530 | jQuery('#wpsc-username-unavailable').hide(); |
| 434 | 531 | var username = jQuery(this).val().trim(); |
| 435 | - const data = { action: 'wpsc_check_username_availability', username, _ajax_nonce: '<?php echo esc_attr( wp_create_nonce( 'wpsc_check_username_availability' ) ); ?>' }; | |
| 532 | + const data = { action: 'wpsc_check_user_availability', type : 'username', username, _ajax_nonce: '<?php echo esc_attr( wp_create_nonce( 'wpsc_check_user_availability' ) ); ?>' }; | |
| 436 | 533 | jQuery.post(supportcandy.ajax_url, data, function (response) { |
| 437 | 534 | jQuery('input[name=is_username]').val(response.isAvailable); |
| 438 | 535 | if (response.isAvailable == 1) { |
| 439 | 536 | jQuery('#wpsc-username-unavailable').hide(); |
| @@ -446,37 +543,132 @@ | ||
| 446 | 543 | }); |
| 447 | 544 | </script> |
| 448 | 545 | </div> |
| 449 | 546 | |
| 450 | - <input type="text" name="email_address" placeholder="<?php esc_attr_e( 'Email Address', 'supportcandy' ); ?>" autocomplete="off"/> | |
| 547 | + <div style="margin: 0 0 5px !important;"> | |
| 548 | + <input id="wpsc-email" type="text" name="email_address" style="margin-bottom: 0px !important;" placeholder="<?php esc_attr_e( 'Email Address', 'supportcandy' ); ?>" autocomplete="off"/> | |
| 549 | + <small id="wpsc-email-unavailable" style="color: #e84118;font-style:italic;display:none;"><?php esc_attr_e( 'Email is already taken or not allowed!', 'supportcandy' ); ?></small> | |
| 550 | + <small id="wpsc-email-available" style="color: #4cd137;font-style:italic;display:none;"><?php esc_attr_e( 'Email is available!', 'supportcandy' ); ?></small> | |
| 551 | + <script> | |
| 552 | + jQuery('#wpsc-email').change(function(){ | |
| 553 | + jQuery('#wpsc-email-available').hide(); | |
| 554 | + jQuery('#wpsc-email-unavailable').hide(); | |
| 555 | + var email = jQuery(this).val().trim(); | |
| 556 | + const data = { action: 'wpsc_check_user_availability', type: 'email', email, _ajax_nonce: '<?php echo esc_attr( wp_create_nonce( 'wpsc_check_user_availability' ) ); ?>' }; | |
| 557 | + jQuery.post(supportcandy.ajax_url, data, function (response) { | |
| 558 | + jQuery('input[name=is_email]').val(response.isAvailable); | |
| 559 | + if (response.isAvailable == 1) { | |
| 560 | + jQuery('#wpsc-email-unavailable').hide(); | |
| 561 | + jQuery('#wpsc-email-available').show(); | |
| 562 | + } else { | |
| 563 | + jQuery('#wpsc-email-available').hide(); | |
| 564 | + jQuery('#wpsc-email-unavailable').show(); | |
| 565 | + } | |
| 566 | + }); | |
| 567 | + }); | |
| 568 | + </script> | |
| 569 | + </div> | |
| 451 | 570 | <input type="password" name="password" placeholder="<?php esc_attr_e( 'Password', 'supportcandy' ); ?>"/> |
| 452 | 571 | <input type="password" name="confirm_password" placeholder="<?php esc_attr_e( 'Confirm Password', 'supportcandy' ); ?>"/> |
| 453 | 572 | <?php |
| 454 | 573 | |
| 455 | 574 | // recaptcha. |
| 456 | - if ( $recaptcha['allow-recaptcha'] === 1 && $recaptcha['recaptcha-version'] == 2 && $recaptcha['recaptcha-site-key'] && $recaptcha['recaptcha-secret-key'] ) { | |
| 575 | + if ( $recaptcha['captcha-provider'] === 'google-recaptcha' && $recaptcha['recaptcha-version'] == 2 && $recaptcha['recaptcha-site-key'] && $recaptcha['recaptcha-secret-key'] ) { | |
| 457 | 576 | $unique_id = uniqid( 'wpsc_' ); |
| 458 | 577 | ?> |
| 459 | - <script src="https://www.google.com/recaptcha/api.js?onload=recaptchaCallback&render=explicit" async defer></script> <?php // phpcs:ignore ?> | |
| 460 | - <div id="<?php echo esc_attr( $unique_id ); ?>" data-sitekey="" style="margin-bottom: 5px;"></div> | |
| 461 | - <script> | |
| 462 | - var recaptchaCallback = function() { | |
| 463 | - var obj = jQuery('#<?php echo esc_attr( $unique_id ); ?>'); | |
| 464 | - grecaptcha.render(obj.attr("id"), { | |
| 465 | - "sitekey" : "<?php echo esc_attr( $recaptcha['recaptcha-site-key'] ); ?>", | |
| 466 | - "callback" : function(token) { | |
| 467 | - obj.closest('form').find(".g-recaptcha-response").val(token); | |
| 468 | - } | |
| 469 | - }); | |
| 470 | - } | |
| 471 | - </script> | |
| 578 | + <script src="https://www.google.com/recaptcha/api.js?onload=recaptchaCallback&render=explicit" async defer></script> <?php // phpcs:ignore ?> | |
| 579 | + <div id="<?php echo esc_attr( $unique_id ); ?>" data-sitekey="" style="margin-bottom: 5px;"></div> | |
| 580 | + <script> | |
| 581 | + var recaptchaCallback = function() { | |
| 582 | + var obj = jQuery('#<?php echo esc_attr( $unique_id ); ?>'); | |
| 583 | + grecaptcha.render(obj.attr("id"), { | |
| 584 | + "sitekey" : "<?php echo esc_attr( $recaptcha['recaptcha-site-key'] ); ?>", | |
| 585 | + "callback" : function(token) { | |
| 586 | + obj.closest('form').find(".g-recaptcha-response").val(token); | |
| 587 | + } | |
| 588 | + }); | |
| 589 | + } | |
| 590 | + </script> | |
| 472 | 591 | <?php |
| 473 | 592 | } |
| 474 | - if ( $recaptcha['allow-recaptcha'] === 1 && $recaptcha['recaptcha-version'] == 3 && $recaptcha['recaptcha-site-key'] && $recaptcha['recaptcha-secret-key'] ) { | |
| 593 | + if ( $recaptcha['captcha-provider'] === 'google-recaptcha' && $recaptcha['recaptcha-version'] == 3 && $recaptcha['recaptcha-site-key'] && $recaptcha['recaptcha-secret-key'] ) { | |
| 475 | 594 | ?> |
| 476 | 595 | <script src="https://www.google.com/recaptcha/api.js?render=<?php echo esc_attr( $recaptcha['recaptcha-site-key'] ); ?>"></script> <?php // phpcs:ignore ?> |
| 477 | 596 | <?php |
| 478 | 597 | } |
| 598 | + if ( $recaptcha['captcha-provider'] === 'cloudflare-turnstile' && $recaptcha['cloudflare-site-key'] && $recaptcha['cloudflare-secret-key'] ) { | |
| 599 | + ?> | |
| 600 | + <script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script> <?php // phpcs:ignore ?> | |
| 601 | + <div class="wpsc-tff turnstile wpsc-xs-12 wpsc-sm-12 wpsc-md-12 wpsc-lg-12 required wpsc-visible" data-cft="turnstile"> | |
| 602 | + <div class="cf-turnstile" data-sitekey="<?php echo esc_attr( $recaptcha['cloudflare-site-key'] ); ?>"></div> | |
| 603 | + </div> | |
| 604 | + <script> | |
| 605 | + jQuery(document).ready(function() { | |
| 606 | + | |
| 607 | + function wpscInitTurnstileWidgets() { | |
| 608 | + | |
| 609 | + if ( | |
| 610 | + typeof window.turnstile === 'undefined' || | |
| 611 | + typeof window.turnstile.render !== 'function' | |
| 612 | + ) { | |
| 613 | + return false; | |
| 614 | + } | |
| 615 | + | |
| 616 | + jQuery('.cf-turnstile').each(function() { | |
| 617 | + | |
| 618 | + var widget = jQuery(this); | |
| 619 | + | |
| 620 | + if ( | |
| 621 | + widget.find('input[name="cf-turnstile-response"]').length || | |
| 622 | + widget.find('iframe').length || | |
| 623 | + widget.attr('data-wpsc-rendered') === '1' | |
| 624 | + ) { | |
| 625 | + | |
| 626 | + widget.attr('data-wpsc-rendered', '1'); | |
| 627 | + | |
| 628 | + return; | |
| 629 | + } | |
| 630 | + | |
| 631 | + window.turnstile.render( | |
| 632 | + this, | |
| 633 | + { | |
| 634 | + sitekey: widget.data('sitekey') | |
| 635 | + } | |
| 636 | + ); | |
| 637 | + | |
| 638 | + widget.attr('data-wpsc-rendered', '1'); | |
| 639 | + }); | |
| 640 | + | |
| 641 | + return true; | |
| 642 | + } | |
| 643 | + | |
| 644 | + if (wpscInitTurnstileWidgets()) { | |
| 645 | + return; | |
| 646 | + } | |
| 647 | + | |
| 648 | + var attempts = 0; | |
| 649 | + | |
| 650 | + var timer = setInterval( | |
| 651 | + function() { | |
| 652 | + | |
| 653 | + attempts++; | |
| 654 | + | |
| 655 | + if ( | |
| 656 | + wpscInitTurnstileWidgets() || | |
| 657 | + attempts > 50 | |
| 658 | + ) { | |
| 659 | + | |
| 660 | + clearInterval(timer); | |
| 661 | + } | |
| 662 | + | |
| 663 | + }, | |
| 664 | + 100 | |
| 665 | + ); | |
| 666 | + | |
| 667 | + }); | |
| 668 | + </script> | |
| 669 | + <?php | |
| 670 | + } | |
| 479 | 671 | do_action( 'wpsc_registration_form' ); |
| 480 | 672 | ?> |
| 481 | 673 | <div class="wpsc-reg-user"> |
| 482 | 674 | <?php |
| @@ -509,14 +701,15 @@ | ||
| 509 | 701 | </div> |
| 510 | 702 | <?php |
| 511 | 703 | } |
| 512 | 704 | ?> |
| 513 | - <div> | |
| 705 | + </div> | |
| 514 | 706 | |
| 515 | 707 | <button class="wpsc-button normal primary" onclick="wpsc_set_default_registration(this)"><?php esc_attr_e( 'Sign Up', 'supportcandy' ); ?></button> |
| 516 | 708 | <button class="wpsc-button normal secondary" onclick="window.location.reload();"><?php esc_attr_e( 'Cancel', 'supportcandy' ); ?></button> |
| 517 | 709 | <input type="hidden" name="action" value="wpsc_authenticate_registration"/> |
| 518 | 710 | <input type="hidden" name="is_username" value="0"/> |
| 711 | + <input type="hidden" name="is_email" value="0"/> | |
| 519 | 712 | <input type="hidden" name="_ajax_nonce" value="<?php echo esc_attr( wp_create_nonce( 'wpsc_authenticate_registration' ) ); ?>"> |
| 520 | 713 | </form> |
| 521 | 714 | <?php |
| 522 | 715 | wp_die(); |
| @@ -526,12 +719,12 @@ | ||
| 526 | 719 | * Check username availability |
| 527 | 720 | * |
| 528 | 721 | * @return void |
| 529 | 722 | */ |
| 530 | - public static function check_username_availability() { | |
| 723 | + public static function check_user_availability() { | |
| 531 | 724 | |
| 532 | - if ( check_ajax_referer( 'wpsc_check_username_availability', '_ajax_nonce', false ) != 1 ) { | |
| 533 | - wp_send_json_error( 'Unauthorised request!', 401 ); | |
| 725 | + if ( check_ajax_referer( 'wpsc_check_user_availability', '_ajax_nonce', false ) != 1 ) { | |
| 726 | + wp_send_json_error( 'Unauthorized request!', 401 ); | |
| 534 | 727 | } |
| 535 | 728 | |
| 536 | 729 | $page_settings = get_option( 'wpsc-gs-page-settings' ); |
| 537 | 730 | if ( $page_settings['user-registration'] !== 'default' ) { |
| @@ -537,14 +730,25 @@ | ||
| 537 | 730 | if ( $page_settings['user-registration'] !== 'default' ) { |
| 538 | 731 | wp_send_json_error( __( 'Unauthorized', 'supportcandy' ), 401 ); |
| 539 | 732 | } |
| 540 | 733 | |
| 541 | - $username = isset( $_POST['username'] ) ? sanitize_text_field( wp_unslash( $_POST['username'] ) ) : ''; | |
| 542 | - if ( ! $username ) { | |
| 734 | + $type = isset( $_POST['type'] ) ? sanitize_text_field( wp_unslash( $_POST['type'] ) ) : ''; | |
| 735 | + if ( in_array( $type, array( 'username', 'email' ) ) === false ) { | |
| 543 | 736 | wp_send_json_error( 'Something went wrong', 400 ); |
| 544 | 737 | } |
| 545 | 738 | |
| 546 | - $flag = self::is_username_available( $username ); | |
| 739 | + if ( $type === 'username' ) { | |
| 740 | + $username = isset( $_POST['username'] ) ? sanitize_user( wp_unslash( $_POST['username'] ) ) : ''; | |
| 741 | + if ( ! $username ) { | |
| 742 | + wp_send_json_error( 'Something went wrong', 400 ); | |
| 743 | + } | |
| 744 | + } elseif ( $type === 'email' ) { | |
| 745 | + $email = isset( $_POST['email'] ) && filter_var( wp_unslash( $_POST['email'] ), FILTER_VALIDATE_EMAIL ) ? sanitize_email( wp_unslash( $_POST['email'] ) ) : ''; | |
| 746 | + if ( ! $email ) { | |
| 747 | + wp_send_json_error( 'Something went wrong', 400 ); | |
| 748 | + } | |
| 749 | + } | |
| 750 | + $flag = $type === 'username' ? self::is_username_available( $username ) : self::is_email_available( $email ); | |
| 547 | 751 | |
| 548 | 752 | wp_send_json( array( 'isAvailable' => $flag ? 0 : 1 ) ); |
| 549 | 753 | } |
| 550 | 754 | |
| @@ -555,9 +759,9 @@ | ||
| 555 | 759 | */ |
| 556 | 760 | public static function send_registration_otp() { |
| 557 | 761 | |
| 558 | 762 | if ( check_ajax_referer( 'wpsc_authenticate_registration', '_ajax_nonce', false ) != 1 ) { |
| 559 | - wp_send_json_error( 'Unauthorised request!', 401 ); | |
| 763 | + wp_send_json_error( 'Unauthorized request!', 401 ); | |
| 560 | 764 | } |
| 561 | 765 | $page_settings = get_option( 'wpsc-gs-page-settings' ); |
| 562 | 766 | if ( $page_settings['user-registration'] !== 'default' ) { |
| 563 | 767 | wp_send_json_error( __( 'Unauthorized', 'supportcandy' ), 401 ); |
| @@ -574,9 +778,9 @@ | ||
| 574 | 778 | if ( ! $lastname ) { |
| 575 | 779 | wp_send_json_error( 'Bad request', 400 ); |
| 576 | 780 | } |
| 577 | 781 | |
| 578 | - $username = isset( $_POST['username'] ) ? sanitize_text_field( wp_unslash( $_POST['username'] ) ) : ''; | |
| 782 | + $username = isset( $_POST['username'] ) ? sanitize_user( wp_unslash( $_POST['username'] ) ) : ''; | |
| 579 | 783 | if ( ! $username ) { |
| 580 | 784 | wp_send_json_error( 'Bad request', 400 ); |
| 581 | 785 | } |
| 582 | 786 | |
| @@ -583,15 +787,14 @@ | ||
| 583 | 787 | if ( self::is_username_available( $username ) ) { |
| 584 | 788 | wp_send_json_error( 'Bad request', 400 ); |
| 585 | 789 | } |
| 586 | 790 | |
| 587 | - $email_address = isset( $_POST['email_address'] ) && filter_var( wp_unslash( $_POST['email_address'] ), FILTER_VALIDATE_EMAIL ) ? sanitize_text_field( wp_unslash( $_POST['email_address'] ) ) : ''; | |
| 791 | + $email_address = isset( $_POST['email_address'] ) && filter_var( wp_unslash( $_POST['email_address'] ), FILTER_VALIDATE_EMAIL ) ? sanitize_email( wp_unslash( $_POST['email_address'] ) ) : ''; | |
| 588 | 792 | if ( ! $email_address ) { |
| 589 | 793 | wp_send_json_error( 'Bad request', 400 ); |
| 590 | 794 | } |
| 591 | 795 | |
| 592 | - $user = get_user_by( 'email', $email_address ); | |
| 593 | - if ( $user ) { | |
| 796 | + if ( self::is_email_available( $email_address ) ) { | |
| 594 | 797 | wp_send_json_error( 'Bad request', 400 ); |
| 595 | 798 | } |
| 596 | 799 | |
| 597 | 800 | $password = isset( $_POST['password'] ) ? wp_unslash( $_POST['password'] ) : ''; // phpcs:ignore |
| @@ -621,9 +824,9 @@ | ||
| 621 | 824 | WPSC_EN_User_Reg_OTP::send_otp( $otp ); |
| 622 | 825 | ?> |
| 623 | 826 | |
| 624 | 827 | <h2><?php esc_attr_e( 'Please sign up', 'supportcandy' ); ?></h2> |
| 625 | - <small style="margin: 0 0 5px;"><?php esc_attr_e( 'We have sent a 6-digit one-time pass code to the email address you provided.', 'supportcandy' ); ?></small> | |
| 828 | + <small style="margin: 0 0 5px;"><?php esc_attr_e( 'We have sent a one-time verification code to your email address.', 'supportcandy' ); ?></small> | |
| 626 | 829 | <form onsubmit="return false;" class="wpsc-login wpsc-confirm-registration"> |
| 627 | 830 | <input type="text" name="otp" autocomplete="off"/> |
| 628 | 831 | <button class="wpsc-button normal primary" onclick="wpsc_confirm_registration(this)"><?php esc_attr_e( 'Submit', 'supportcandy' ); ?></button> |
| 629 | 832 | <input type="hidden" name="action" value="wpsc_confirm_registration"/> |
| @@ -646,8 +849,27 @@ | ||
| 646 | 849 | return $user ? true : false; |
| 647 | 850 | } |
| 648 | 851 | |
| 649 | 852 | /** |
| 853 | + * Checks whether email is available or not | |
| 854 | + * | |
| 855 | + * @param string $email - email string. | |
| 856 | + * @return boolean | |
| 857 | + */ | |
| 858 | + public static function is_email_available( $email ) { | |
| 859 | + | |
| 860 | + $user = get_user_by( 'email', $email ); | |
| 861 | + | |
| 862 | + // check allowed email domains. | |
| 863 | + $allowed_domains = apply_filters( 'wpsc_registration_allowed_email_domains', array() ); | |
| 864 | + $domain = substr( strrchr( $email, '@' ), 1 ); | |
| 865 | + if ( $allowed_domains && ! in_array( $domain, $allowed_domains, true ) ) { | |
| 866 | + return true; | |
| 867 | + } | |
| 868 | + return $user ? true : false; | |
| 869 | + } | |
| 870 | + | |
| 871 | + /** | |
| 650 | 872 | * Register user after OTP matched |
| 651 | 873 | * |
| 652 | 874 | * @return void |
| 653 | 875 | */ |
| @@ -653,9 +875,9 @@ | ||
| 653 | 875 | */ |
| 654 | 876 | public static function register_user() { |
| 655 | 877 | |
| 656 | 878 | if ( check_ajax_referer( 'wpsc_confirm_registration', '_ajax_nonce', false ) != 1 ) { |
| 657 | - wp_send_json_error( 'Unauthorised request!', 401 ); | |
| 879 | + wp_send_json_error( 'Unauthorized request!', 401 ); | |
| 658 | 880 | } |
| 659 | 881 | |
| 660 | 882 | $page_settings = get_option( 'wpsc-gs-page-settings' ); |
| 661 | 883 | if ( $page_settings['user-registration'] !== 'default' ) { |
| @@ -683,8 +905,21 @@ | ||
| 683 | 905 | } |
| 684 | 906 | |
| 685 | 907 | $data = json_decode( $otp->data ); |
| 686 | 908 | |
| 909 | + // check allowed email domains. | |
| 910 | + $allowed_domains = apply_filters( 'wpsc_registration_allowed_email_domains', array() ); | |
| 911 | + $domain = substr( strrchr( $data->email_address, '@' ), 1 ); | |
| 912 | + if ( $allowed_domains && ! in_array( $domain, $allowed_domains, true ) ) { | |
| 913 | + wp_send_json_error( | |
| 914 | + array( | |
| 915 | + 'isSuccess' => 0, | |
| 916 | + 'message' => __( 'Email domain is not allowed.', 'supportcandy' ), | |
| 917 | + ), | |
| 918 | + 403 | |
| 919 | + ); | |
| 920 | + } | |
| 921 | + | |
| 687 | 922 | // insert user. |
| 688 | 923 | $display_name = $data->firstname . ' ' . $data->lastname; |
| 689 | 924 | $user_id = wp_insert_user( |
| 690 | 925 | array( |
| @@ -763,9 +998,9 @@ | ||
| 763 | 998 | */ |
| 764 | 999 | public static function get_guest_sign_in_auth() { |
| 765 | 1000 | |
| 766 | 1001 | if ( check_ajax_referer( 'wpsc_authenticate_guest_login', '_ajax_nonce', false ) != 1 ) { |
| 767 | - wp_send_json_error( 'Unauthorised request!', 401 ); | |
| 1002 | + wp_send_json_error( 'Unauthorized request!', 401 ); | |
| 768 | 1003 | } |
| 769 | 1004 | $gs = get_option( 'wpsc-gs-general' ); |
| 770 | 1005 | $page_settings = get_option( 'wpsc-gs-page-settings' ); |
| 771 | 1006 | if ( ! ( $page_settings['otp-login'] && in_array( 'guest', $gs['allow-create-ticket'] ) ) ) { |
| @@ -799,9 +1034,9 @@ | ||
| 799 | 1034 | WPSC_EN_Guest_Login_OTP::send_otp( $otp ); |
| 800 | 1035 | ?> |
| 801 | 1036 | |
| 802 | 1037 | <h2><?php esc_attr_e( 'Please sign in', 'supportcandy' ); ?></h2> |
| 803 | - <small style="margin: 0 0 5px;"><?php esc_attr_e( 'We have sent a 6-digit one-time pass code to the email address you provided.', 'supportcandy' ); ?></small> | |
| 1038 | + <small style="margin: 0 0 5px;"><?php esc_attr_e( 'We have sent a one-time verification code to your email address.', 'supportcandy' ); ?></small> | |
| 804 | 1039 | <form onsubmit="return false;" class="wpsc-login wpsc-confirm-guest-login"> |
| 805 | 1040 | <input type="text" name="otp" autocomplete="off"/> |
| 806 | 1041 | <button class="wpsc-button normal primary" onclick="wpsc_confirm_guest_login(this)"><?php esc_attr_e( 'Submit', 'supportcandy' ); ?></button> |
| 807 | 1042 | <input type="hidden" name="action" value="wpsc_confirm_guest_login"/> |
| @@ -829,9 +1064,9 @@ | ||
| 829 | 1064 | wp_send_json_error( 'Too many attempts. Please try again later.', 429 ); |
| 830 | 1065 | } |
| 831 | 1066 | |
| 832 | 1067 | if ( check_ajax_referer( 'wpsc_confirm_guest_login', '_ajax_nonce', false ) != 1 ) { |
| 833 | - wp_send_json_error( 'Unauthorised request!', 401 ); | |
| 1068 | + wp_send_json_error( 'Unauthorized request!', 401 ); | |
| 834 | 1069 | } |
| 835 | 1070 | |
| 836 | 1071 | $gs = get_option( 'wpsc-gs-general' ); |
| 837 | 1072 | $page_settings = get_option( 'wpsc-gs-page-settings' ); |
| @@ -956,11 +1191,14 @@ | ||
| 956 | 1191 | $now = new DateTime(); |
| 957 | 1192 | $data = json_decode( $otp->data ); |
| 958 | 1193 | |
| 959 | 1194 | if ( |
| 960 | - isset( $data->auth_type ) && | |
| 1195 | + isset( $data->auth_type, $data->auth_token, $login_auth->token ) && | |
| 1196 | + is_string( $data->auth_token ) && $data->auth_token !== '' && | |
| 1197 | + is_string( $login_auth->token ) && | |
| 961 | 1198 | ( ( $data->auth_type == 'login' && $page_settings['otp-login'] && in_array( 'guest', $gs['allow-create-ticket'] ) ) || $data->auth_type == 'open-ticket' ) && |
| 962 | - ( $otp->date_expiry > $now && $data->auth_token == $login_auth->token ) | |
| 1199 | + $otp->date_expiry > $now && | |
| 1200 | + hash_equals( $data->auth_token, $login_auth->token ) | |
| 963 | 1201 | ) { |
| 964 | 1202 | self::$login_type = 'guest'; |
| 965 | 1203 | self::$guest_login_type = $data->auth_type; |
| 966 | 1204 | return true; |
