← All changes | includes/class-wpsc-current-user.php +183 -32 3.4.3 → 3.5.4 View file →

		@@ -164,8 +164,24 @@
164	164	}
165	165	}
166	166
167	167	/**
	168	+ * Return customer object by WordPress user ID.
	169	+ *
	170	+ * @param int $user_id - WordPress user ID.
	171	+ * @return WPSC_Customer
	172	+ */
	173	+ public static function get_customer_by_user_id( $user_id ) {
	174	+
	175	+ $user_id = absint( $user_id );
	176	+ if ( ! $user_id ) {
	177	+ return new WPSC_Customer();
	178	+ }
	179	+
	180	+ return WPSC_Customer::get_by_user_id( $user_id );
	181	+ }
	182	+
	183	+ /**
168	184	* Load current wpsc user
169	185	*
170	186	* @return void
171	187	*/
		@@ -170,12 +186,20 @@
170	186	* @return void
171	187	*/
172	188	public static function load_current_user() {
173	189
174		- global $current_user;
	190	+ // Use wp_get_current_user() rather than the raw global - the
	191	+ // global is only populated once something has actually called
	192	+ // wp_get_current_user() (or a function that does, like
	193	+ // is_user_logged_in()) earlier in the request. Nothing guarantees
	194	+ // that has happened yet by the 'init' hook (where this runs), so
	195	+ // reading the raw global directly can see an empty, not-yet-resolved
	196	+ // WP_User and wrongly treat a logged-in visitor as a guest for the
	197	+ // rest of the request.
	198	+ $wp_user = wp_get_current_user();
175	199
176	200	// wp logged-in user.
177		- $email = $current_user && $current_user->ID ? $current_user->user_email : '';
	201	+ $email = $wp_user && $wp_user->ID ? $wp_user->user_email : '';
178	202	if ( $email ) {
179	203	self::$current_user = new WPSC_Current_User( $email );
180	204	self::$login_type = 'registered';
181	205	return;
		@@ -186,14 +210,14 @@
186	210
187	211	$login_auth = isset( $_COOKIE['wpsc_guest_login_auth'] ) ? sanitize_text_field( wp_unslash( $_COOKIE['wpsc_guest_login_auth'] ) ) : '';
188	212	$login_auth = $login_auth ? json_decode( $login_auth ) : false;
189	213
190		- if ( ! $login_auth ) {
	214	+ if ( ! $login_auth || ! is_object( $login_auth ) || ! isset( $login_auth->token ) || ! is_string( $login_auth->token ) ) {
191	215	self::$current_user = new WPSC_Current_User();
192	216	return;
193	217	}
194	218
195		- $login_auth->email = $login_auth->email ? sanitize_email( $login_auth->email ) : '';
	219	+ $login_auth->email = isset( $login_auth->email ) && is_string( $login_auth->email ) ? sanitize_email( $login_auth->email ) : '';
196	220	if ( ! $login_auth->email ) {
197	221	self::$current_user = new WPSC_Current_User();
198	222	return;
199	223	}
		@@ -235,8 +259,13 @@
235	259	// default filters.
236	260	$default_filters = get_option( $this->is_agent ? 'wpsc-atl-default-filters' : 'wpsc-ctl-default-filters' );
237	261	foreach ( $default_filters as $index => $filter ) {
238	262
	263	+ // exclude if current user does not have access to deleted filter.
	264	+ if ( $index === 'deleted' && ! $this->agent->has_cap( 'dtt-access' ) ) {
	265	+ continue;
	266	+ }
	267	+
239	268	// exclude if filter is not enabled.
240	269	if ( ! $filter['is_enable'] ) {
241	270	continue;
242	271	}
		@@ -414,9 +443,9 @@
414	443	*/
415	444	public static function check_user_login() {
416	445
417	446	if ( check_ajax_referer( 'wpsc_default_login', '_ajax_nonce', false ) != 1 ) {
418		- wp_send_json_error( 'Unauthorised request!', 401 );
	447	+ wp_send_json_error( 'Unauthorized request!', 401 );
419	448	}
420	449
421	450	WPSC_MS_Recaptcha::validate( 'submit_login' );
422	451
		@@ -439,10 +468,37 @@
439	468	'remember' => $remember_me,
440	469	)
441	470	);
442	471
443		- $success = is_wp_error( $user ) ? 0 : 1;
444		- wp_send_json( array( 'success' => $success ) );
	472	+ if ( is_wp_error( $user ) ) {
	473	+
	474	+ $auth_errors = array(
	475	+ 'incorrect_password',
	476	+ 'invalid_username',
	477	+ 'empty_username',
	478	+ 'empty_password',
	479	+ );
	480	+ $code = $user->get_error_code();
	481	+ if ( in_array( $code, $auth_errors, true ) ) {
	482	+
	483	+ wp_send_json_error(
	484	+ array(
	485	+ 'code' => 'invalid_login',
	486	+ 'message' => __( 'Invalid username or password.', 'supportcandy' ),
	487	+ ),
	488	+ 401
	489	+ );
	490	+ }
	491	+
	492	+ wp_send_json_error(
	493	+ array(
	494	+ 'code' => $code,
	495	+ 'message' => wp_strip_all_tags( $user->get_error_message() ),
	496	+ ),
	497	+ 400
	498	+ );
	499	+ }
	500	+ wp_send_json_success();
445	501	}
446	502
447	503	/**
448	504	* Get user registration
		@@ -489,13 +545,12 @@
489	545	</div>
490	546
491	547	<div style="margin: 0 0 5px !important;">
492	548	<input id="wpsc-email" type="text" name="email_address" style="margin-bottom: 0px !important;" placeholder="<?php esc_attr_e( 'Email Address', 'supportcandy' ); ?>" autocomplete="off"/>
493		- <small id="wpsc-email-unavailable" style="color: #e84118;font-style:italic;display:none;"><?php esc_attr_e( 'Email is already taken!', 'supportcandy' ); ?></small>
	549	+ <small id="wpsc-email-unavailable" style="color: #e84118;font-style:italic;display:none;"><?php esc_attr_e( 'Email is already taken or not allowed!', 'supportcandy' ); ?></small>
494	550	<small id="wpsc-email-available" style="color: #4cd137;font-style:italic;display:none;"><?php esc_attr_e( 'Email is available!', 'supportcandy' ); ?></small>
495	551	<script>
496	552	jQuery('#wpsc-email').change(function(){
497		- console.log('email changed');
498	553	jQuery('#wpsc-email-available').hide();
499	554	jQuery('#wpsc-email-unavailable').hide();
500	555	var email = jQuery(this).val().trim();
501	556	const data = { action: 'wpsc_check_user_availability', type: 'email', email, _ajax_nonce: '<?php echo esc_attr( wp_create_nonce( 'wpsc_check_user_availability' ) ); ?>' };
		@@ -516,31 +571,104 @@
516	571	<input type="password" name="confirm_password" placeholder="<?php esc_attr_e( 'Confirm Password', 'supportcandy' ); ?>"/>
517	572	<?php
518	573
519	574	// recaptcha.
520		- if ( $recaptcha['allow-recaptcha'] === 1 && $recaptcha['recaptcha-version'] == 2 && $recaptcha['recaptcha-site-key'] && $recaptcha['recaptcha-secret-key'] ) {
	575	+ if ( $recaptcha['captcha-provider'] === 'google-recaptcha' && $recaptcha['recaptcha-version'] == 2 && $recaptcha['recaptcha-site-key'] && $recaptcha['recaptcha-secret-key'] ) {
521	576	$unique_id = uniqid( 'wpsc_' );
522	577	?>
523		- <script src="https://www.google.com/recaptcha/api.js?onload=recaptchaCallback&render=explicit" async defer></script> <?php // phpcs:ignore ?>
524		- <div id="<?php echo esc_attr( $unique_id ); ?>" data-sitekey="" style="margin-bottom: 5px;"></div>
525		- <script>
526		- var recaptchaCallback = function() {
527		- var obj = jQuery('#<?php echo esc_attr( $unique_id ); ?>');
528		- grecaptcha.render(obj.attr("id"), {
529		- "sitekey" : "<?php echo esc_attr( $recaptcha['recaptcha-site-key'] ); ?>",
530		- "callback" : function(token) {
531		- obj.closest('form').find(".g-recaptcha-response").val(token);
532		- }
533		- });
534		- }
535		- </script>
	578	+ <script src="https://www.google.com/recaptcha/api.js?onload=recaptchaCallback&render=explicit" async defer></script> <?php // phpcs:ignore ?>
	579	+ <div id="<?php echo esc_attr( $unique_id ); ?>" data-sitekey="" style="margin-bottom: 5px;"></div>
	580	+ <script>
	581	+ var recaptchaCallback = function() {
	582	+ var obj = jQuery('#<?php echo esc_attr( $unique_id ); ?>');
	583	+ grecaptcha.render(obj.attr("id"), {
	584	+ "sitekey" : "<?php echo esc_attr( $recaptcha['recaptcha-site-key'] ); ?>",
	585	+ "callback" : function(token) {
	586	+ obj.closest('form').find(".g-recaptcha-response").val(token);
	587	+ }
	588	+ });
	589	+ }
	590	+ </script>
536	591	<?php
537	592	}
538		- if ( $recaptcha['allow-recaptcha'] === 1 && $recaptcha['recaptcha-version'] == 3 && $recaptcha['recaptcha-site-key'] && $recaptcha['recaptcha-secret-key'] ) {
	593	+ if ( $recaptcha['captcha-provider'] === 'google-recaptcha' && $recaptcha['recaptcha-version'] == 3 && $recaptcha['recaptcha-site-key'] && $recaptcha['recaptcha-secret-key'] ) {
539	594	?>
540	595	<script src="https://www.google.com/recaptcha/api.js?render=<?php echo esc_attr( $recaptcha['recaptcha-site-key'] ); ?>"></script> <?php // phpcs:ignore ?>
541	596	<?php
542	597	}
	598	+ if ( $recaptcha['captcha-provider'] === 'cloudflare-turnstile' && $recaptcha['cloudflare-site-key'] && $recaptcha['cloudflare-secret-key'] ) {
	599	+ ?>
	600	+ <script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script> <?php // phpcs:ignore ?>
	601	+ <div class="wpsc-tff turnstile wpsc-xs-12 wpsc-sm-12 wpsc-md-12 wpsc-lg-12 required wpsc-visible" data-cft="turnstile">
	602	+ <div class="cf-turnstile" data-sitekey="<?php echo esc_attr( $recaptcha['cloudflare-site-key'] ); ?>"></div>
	603	+ </div>
	604	+ <script>
	605	+ jQuery(document).ready(function() {
	606	+
	607	+ function wpscInitTurnstileWidgets() {
	608	+
	609	+ if (
	610	+ typeof window.turnstile === 'undefined' ||
	611	+ typeof window.turnstile.render !== 'function'
	612	+ ) {
	613	+ return false;
	614	+ }
	615	+
	616	+ jQuery('.cf-turnstile').each(function() {
	617	+
	618	+ var widget = jQuery(this);
	619	+
	620	+ if (
	621	+ widget.find('input[name="cf-turnstile-response"]').length ||
	622	+ widget.find('iframe').length ||
	623	+ widget.attr('data-wpsc-rendered') === '1'
	624	+ ) {
	625	+
	626	+ widget.attr('data-wpsc-rendered', '1');
	627	+
	628	+ return;
	629	+ }
	630	+
	631	+ window.turnstile.render(
	632	+ this,
	633	+ {
	634	+ sitekey: widget.data('sitekey')
	635	+ }
	636	+ );
	637	+
	638	+ widget.attr('data-wpsc-rendered', '1');
	639	+ });
	640	+
	641	+ return true;
	642	+ }
	643	+
	644	+ if (wpscInitTurnstileWidgets()) {
	645	+ return;
	646	+ }
	647	+
	648	+ var attempts = 0;
	649	+
	650	+ var timer = setInterval(
	651	+ function() {
	652	+
	653	+ attempts++;
	654	+
	655	+ if (
	656	+ wpscInitTurnstileWidgets() ||
	657	+ attempts > 50
	658	+ ) {
	659	+
	660	+ clearInterval(timer);
	661	+ }
	662	+
	663	+ },
	664	+ 100
	665	+ );
	666	+
	667	+ });
	668	+ </script>
	669	+ <?php
	670	+ }
543	671	do_action( 'wpsc_registration_form' );
544	672	?>
545	673	<div class="wpsc-reg-user">
546	674	<?php
		@@ -573,9 +701,9 @@
573	701	</div>
574	702	<?php
575	703	}
576	704	?>
577		- <div>
	705	+ </div>
578	706
579	707	<button class="wpsc-button normal primary" onclick="wpsc_set_default_registration(this)"><?php esc_attr_e( 'Sign Up', 'supportcandy' ); ?></button>
580	708	<button class="wpsc-button normal secondary" onclick="window.location.reload();"><?php esc_attr_e( 'Cancel', 'supportcandy' ); ?></button>
581	709	<input type="hidden" name="action" value="wpsc_authenticate_registration"/>
		@@ -594,9 +722,9 @@
594	722	*/
595	723	public static function check_user_availability() {
596	724
597	725	if ( check_ajax_referer( 'wpsc_check_user_availability', '_ajax_nonce', false ) != 1 ) {
598		- wp_send_json_error( 'Unauthorised request!', 401 );
	726	+ wp_send_json_error( 'Unauthorized request!', 401 );
599	727	}
600	728
601	729	$page_settings = get_option( 'wpsc-gs-page-settings' );
602	730	if ( $page_settings['user-registration'] !== 'default' ) {
		@@ -631,9 +759,9 @@
631	759	*/
632	760	public static function send_registration_otp() {
633	761
634	762	if ( check_ajax_referer( 'wpsc_authenticate_registration', '_ajax_nonce', false ) != 1 ) {
635		- wp_send_json_error( 'Unauthorised request!', 401 );
	763	+ wp_send_json_error( 'Unauthorized request!', 401 );
636	764	}
637	765	$page_settings = get_option( 'wpsc-gs-page-settings' );
638	766	if ( $page_settings['user-registration'] !== 'default' ) {
639	767	wp_send_json_error( __( 'Unauthorized', 'supportcandy' ), 401 );
		@@ -729,8 +857,15 @@
729	857	*/
730	858	public static function is_email_available( $email ) {
731	859
732	860	$user = get_user_by( 'email', $email );
	861	+
	862	+ // check allowed email domains.
	863	+ $allowed_domains = apply_filters( 'wpsc_registration_allowed_email_domains', array() );
	864	+ $domain = substr( strrchr( $email, '@' ), 1 );
	865	+ if ( $allowed_domains && ! in_array( $domain, $allowed_domains, true ) ) {
	866	+ return true;
	867	+ }
733	868	return $user ? true : false;
734	869	}
735	870
736	871	/**
		@@ -740,9 +875,9 @@
740	875	*/
741	876	public static function register_user() {
742	877
743	878	if ( check_ajax_referer( 'wpsc_confirm_registration', '_ajax_nonce', false ) != 1 ) {
744		- wp_send_json_error( 'Unauthorised request!', 401 );
	879	+ wp_send_json_error( 'Unauthorized request!', 401 );
745	880	}
746	881
747	882	$page_settings = get_option( 'wpsc-gs-page-settings' );
748	883	if ( $page_settings['user-registration'] !== 'default' ) {
		@@ -770,8 +905,21 @@
770	905	}
771	906
772	907	$data = json_decode( $otp->data );
773	908
	909	+ // check allowed email domains.
	910	+ $allowed_domains = apply_filters( 'wpsc_registration_allowed_email_domains', array() );
	911	+ $domain = substr( strrchr( $data->email_address, '@' ), 1 );
	912	+ if ( $allowed_domains && ! in_array( $domain, $allowed_domains, true ) ) {
	913	+ wp_send_json_error(
	914	+ array(
	915	+ 'isSuccess' => 0,
	916	+ 'message' => __( 'Email domain is not allowed.', 'supportcandy' ),
	917	+ ),
	918	+ 403
	919	+ );
	920	+ }
	921	+
774	922	// insert user.
775	923	$display_name = $data->firstname . ' ' . $data->lastname;
776	924	$user_id = wp_insert_user(
777	925	array(
		@@ -850,9 +998,9 @@
850	998	*/
851	999	public static function get_guest_sign_in_auth() {
852	1000
853	1001	if ( check_ajax_referer( 'wpsc_authenticate_guest_login', '_ajax_nonce', false ) != 1 ) {
854		- wp_send_json_error( 'Unauthorised request!', 401 );
	1002	+ wp_send_json_error( 'Unauthorized request!', 401 );
855	1003	}
856	1004	$gs = get_option( 'wpsc-gs-general' );
857	1005	$page_settings = get_option( 'wpsc-gs-page-settings' );
858	1006	if ( ! ( $page_settings['otp-login'] && in_array( 'guest', $gs['allow-create-ticket'] ) ) ) {
		@@ -916,9 +1064,9 @@
916	1064	wp_send_json_error( 'Too many attempts. Please try again later.', 429 );
917	1065	}
918	1066
919	1067	if ( check_ajax_referer( 'wpsc_confirm_guest_login', '_ajax_nonce', false ) != 1 ) {
920		- wp_send_json_error( 'Unauthorised request!', 401 );
	1068	+ wp_send_json_error( 'Unauthorized request!', 401 );
921	1069	}
922	1070
923	1071	$gs = get_option( 'wpsc-gs-general' );
924	1072	$page_settings = get_option( 'wpsc-gs-page-settings' );
		@@ -1043,11 +1191,14 @@
1043	1191	$now = new DateTime();
1044	1192	$data = json_decode( $otp->data );
1045	1193
1046	1194	if (
1047		- isset( $data->auth_type ) &&
	1195	+ isset( $data->auth_type, $data->auth_token, $login_auth->token ) &&
	1196	+ is_string( $data->auth_token ) && $data->auth_token !== '' &&
	1197	+ is_string( $login_auth->token ) &&
1048	1198	( ( $data->auth_type == 'login' && $page_settings['otp-login'] && in_array( 'guest', $gs['allow-create-ticket'] ) ) || $data->auth_type == 'open-ticket' ) &&
1049		- ( $otp->date_expiry > $now && $data->auth_token == $login_auth->token )
	1199	+ $otp->date_expiry > $now &&
	1200	+ hash_equals( $data->auth_token, $login_auth->token )
1050	1201	) {
1051	1202	self::$login_type = 'guest';
1052	1203	self::$guest_login_type = $data->auth_type;
1053	1204	return true;