← All changes | includes/class-wpsc-current-user.php +143 -24 3.4.4 → 3.5.4 View file →

		@@ -164,8 +164,24 @@
164	164	}
165	165	}
166	166
167	167	/**
	168	+ * Return customer object by WordPress user ID.
	169	+ *
	170	+ * @param int $user_id - WordPress user ID.
	171	+ * @return WPSC_Customer
	172	+ */
	173	+ public static function get_customer_by_user_id( $user_id ) {
	174	+
	175	+ $user_id = absint( $user_id );
	176	+ if ( ! $user_id ) {
	177	+ return new WPSC_Customer();
	178	+ }
	179	+
	180	+ return WPSC_Customer::get_by_user_id( $user_id );
	181	+ }
	182	+
	183	+ /**
168	184	* Load current wpsc user
169	185	*
170	186	* @return void
171	187	*/
		@@ -170,12 +186,20 @@
170	186	* @return void
171	187	*/
172	188	public static function load_current_user() {
173	189
174		- global $current_user;
	190	+ // Use wp_get_current_user() rather than the raw global - the
	191	+ // global is only populated once something has actually called
	192	+ // wp_get_current_user() (or a function that does, like
	193	+ // is_user_logged_in()) earlier in the request. Nothing guarantees
	194	+ // that has happened yet by the 'init' hook (where this runs), so
	195	+ // reading the raw global directly can see an empty, not-yet-resolved
	196	+ // WP_User and wrongly treat a logged-in visitor as a guest for the
	197	+ // rest of the request.
	198	+ $wp_user = wp_get_current_user();
175	199
176	200	// wp logged-in user.
177		- $email = $current_user && $current_user->ID ? $current_user->user_email : '';
	201	+ $email = $wp_user && $wp_user->ID ? $wp_user->user_email : '';
178	202	if ( $email ) {
179	203	self::$current_user = new WPSC_Current_User( $email );
180	204	self::$login_type = 'registered';
181	205	return;
		@@ -186,14 +210,14 @@
186	210
187	211	$login_auth = isset( $_COOKIE['wpsc_guest_login_auth'] ) ? sanitize_text_field( wp_unslash( $_COOKIE['wpsc_guest_login_auth'] ) ) : '';
188	212	$login_auth = $login_auth ? json_decode( $login_auth ) : false;
189	213
190		- if ( ! $login_auth ) {
	214	+ if ( ! $login_auth || ! is_object( $login_auth ) || ! isset( $login_auth->token ) || ! is_string( $login_auth->token ) ) {
191	215	self::$current_user = new WPSC_Current_User();
192	216	return;
193	217	}
194	218
195		- $login_auth->email = $login_auth->email ? sanitize_email( $login_auth->email ) : '';
	219	+ $login_auth->email = isset( $login_auth->email ) && is_string( $login_auth->email ) ? sanitize_email( $login_auth->email ) : '';
196	220	if ( ! $login_auth->email ) {
197	221	self::$current_user = new WPSC_Current_User();
198	222	return;
199	223	}
		@@ -521,13 +545,12 @@
521	545	</div>
522	546
523	547	<div style="margin: 0 0 5px !important;">
524	548	<input id="wpsc-email" type="text" name="email_address" style="margin-bottom: 0px !important;" placeholder="<?php esc_attr_e( 'Email Address', 'supportcandy' ); ?>" autocomplete="off"/>
525		- <small id="wpsc-email-unavailable" style="color: #e84118;font-style:italic;display:none;"><?php esc_attr_e( 'Email is already taken!', 'supportcandy' ); ?></small>
	549	+ <small id="wpsc-email-unavailable" style="color: #e84118;font-style:italic;display:none;"><?php esc_attr_e( 'Email is already taken or not allowed!', 'supportcandy' ); ?></small>
526	550	<small id="wpsc-email-available" style="color: #4cd137;font-style:italic;display:none;"><?php esc_attr_e( 'Email is available!', 'supportcandy' ); ?></small>
527	551	<script>
528	552	jQuery('#wpsc-email').change(function(){
529		- console.log('email changed');
530	553	jQuery('#wpsc-email-available').hide();
531	554	jQuery('#wpsc-email-unavailable').hide();
532	555	var email = jQuery(this).val().trim();
533	556	const data = { action: 'wpsc_check_user_availability', type: 'email', email, _ajax_nonce: '<?php echo esc_attr( wp_create_nonce( 'wpsc_check_user_availability' ) ); ?>' };
		@@ -548,31 +571,104 @@
548	571	<input type="password" name="confirm_password" placeholder="<?php esc_attr_e( 'Confirm Password', 'supportcandy' ); ?>"/>
549	572	<?php
550	573
551	574	// recaptcha.
552		- if ( $recaptcha['allow-recaptcha'] === 1 && $recaptcha['recaptcha-version'] == 2 && $recaptcha['recaptcha-site-key'] && $recaptcha['recaptcha-secret-key'] ) {
	575	+ if ( $recaptcha['captcha-provider'] === 'google-recaptcha' && $recaptcha['recaptcha-version'] == 2 && $recaptcha['recaptcha-site-key'] && $recaptcha['recaptcha-secret-key'] ) {
553	576	$unique_id = uniqid( 'wpsc_' );
554	577	?>
555		- <script src="https://www.google.com/recaptcha/api.js?onload=recaptchaCallback&render=explicit" async defer></script> <?php // phpcs:ignore ?>
556		- <div id="<?php echo esc_attr( $unique_id ); ?>" data-sitekey="" style="margin-bottom: 5px;"></div>
557		- <script>
558		- var recaptchaCallback = function() {
559		- var obj = jQuery('#<?php echo esc_attr( $unique_id ); ?>');
560		- grecaptcha.render(obj.attr("id"), {
561		- "sitekey" : "<?php echo esc_attr( $recaptcha['recaptcha-site-key'] ); ?>",
562		- "callback" : function(token) {
563		- obj.closest('form').find(".g-recaptcha-response").val(token);
564		- }
565		- });
566		- }
567		- </script>
	578	+ <script src="https://www.google.com/recaptcha/api.js?onload=recaptchaCallback&render=explicit" async defer></script> <?php // phpcs:ignore ?>
	579	+ <div id="<?php echo esc_attr( $unique_id ); ?>" data-sitekey="" style="margin-bottom: 5px;"></div>
	580	+ <script>
	581	+ var recaptchaCallback = function() {
	582	+ var obj = jQuery('#<?php echo esc_attr( $unique_id ); ?>');
	583	+ grecaptcha.render(obj.attr("id"), {
	584	+ "sitekey" : "<?php echo esc_attr( $recaptcha['recaptcha-site-key'] ); ?>",
	585	+ "callback" : function(token) {
	586	+ obj.closest('form').find(".g-recaptcha-response").val(token);
	587	+ }
	588	+ });
	589	+ }
	590	+ </script>
568	591	<?php
569	592	}
570		- if ( $recaptcha['allow-recaptcha'] === 1 && $recaptcha['recaptcha-version'] == 3 && $recaptcha['recaptcha-site-key'] && $recaptcha['recaptcha-secret-key'] ) {
	593	+ if ( $recaptcha['captcha-provider'] === 'google-recaptcha' && $recaptcha['recaptcha-version'] == 3 && $recaptcha['recaptcha-site-key'] && $recaptcha['recaptcha-secret-key'] ) {
571	594	?>
572	595	<script src="https://www.google.com/recaptcha/api.js?render=<?php echo esc_attr( $recaptcha['recaptcha-site-key'] ); ?>"></script> <?php // phpcs:ignore ?>
573	596	<?php
574	597	}
	598	+ if ( $recaptcha['captcha-provider'] === 'cloudflare-turnstile' && $recaptcha['cloudflare-site-key'] && $recaptcha['cloudflare-secret-key'] ) {
	599	+ ?>
	600	+ <script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script> <?php // phpcs:ignore ?>
	601	+ <div class="wpsc-tff turnstile wpsc-xs-12 wpsc-sm-12 wpsc-md-12 wpsc-lg-12 required wpsc-visible" data-cft="turnstile">
	602	+ <div class="cf-turnstile" data-sitekey="<?php echo esc_attr( $recaptcha['cloudflare-site-key'] ); ?>"></div>
	603	+ </div>
	604	+ <script>
	605	+ jQuery(document).ready(function() {
	606	+
	607	+ function wpscInitTurnstileWidgets() {
	608	+
	609	+ if (
	610	+ typeof window.turnstile === 'undefined' ||
	611	+ typeof window.turnstile.render !== 'function'
	612	+ ) {
	613	+ return false;
	614	+ }
	615	+
	616	+ jQuery('.cf-turnstile').each(function() {
	617	+
	618	+ var widget = jQuery(this);
	619	+
	620	+ if (
	621	+ widget.find('input[name="cf-turnstile-response"]').length ||
	622	+ widget.find('iframe').length ||
	623	+ widget.attr('data-wpsc-rendered') === '1'
	624	+ ) {
	625	+
	626	+ widget.attr('data-wpsc-rendered', '1');
	627	+
	628	+ return;
	629	+ }
	630	+
	631	+ window.turnstile.render(
	632	+ this,
	633	+ {
	634	+ sitekey: widget.data('sitekey')
	635	+ }
	636	+ );
	637	+
	638	+ widget.attr('data-wpsc-rendered', '1');
	639	+ });
	640	+
	641	+ return true;
	642	+ }
	643	+
	644	+ if (wpscInitTurnstileWidgets()) {
	645	+ return;
	646	+ }
	647	+
	648	+ var attempts = 0;
	649	+
	650	+ var timer = setInterval(
	651	+ function() {
	652	+
	653	+ attempts++;
	654	+
	655	+ if (
	656	+ wpscInitTurnstileWidgets() ||
	657	+ attempts > 50
	658	+ ) {
	659	+
	660	+ clearInterval(timer);
	661	+ }
	662	+
	663	+ },
	664	+ 100
	665	+ );
	666	+
	667	+ });
	668	+ </script>
	669	+ <?php
	670	+ }
575	671	do_action( 'wpsc_registration_form' );
576	672	?>
577	673	<div class="wpsc-reg-user">
578	674	<?php
		@@ -605,9 +701,9 @@
605	701	</div>
606	702	<?php
607	703	}
608	704	?>
609		- <div>
	705	+ </div>
610	706
611	707	<button class="wpsc-button normal primary" onclick="wpsc_set_default_registration(this)"><?php esc_attr_e( 'Sign Up', 'supportcandy' ); ?></button>
612	708	<button class="wpsc-button normal secondary" onclick="window.location.reload();"><?php esc_attr_e( 'Cancel', 'supportcandy' ); ?></button>
613	709	<input type="hidden" name="action" value="wpsc_authenticate_registration"/>
		@@ -761,8 +857,15 @@
761	857	*/
762	858	public static function is_email_available( $email ) {
763	859
764	860	$user = get_user_by( 'email', $email );
	861	+
	862	+ // check allowed email domains.
	863	+ $allowed_domains = apply_filters( 'wpsc_registration_allowed_email_domains', array() );
	864	+ $domain = substr( strrchr( $email, '@' ), 1 );
	865	+ if ( $allowed_domains && ! in_array( $domain, $allowed_domains, true ) ) {
	866	+ return true;
	867	+ }
765	868	return $user ? true : false;
766	869	}
767	870
768	871	/**
		@@ -802,8 +905,21 @@
802	905	}
803	906
804	907	$data = json_decode( $otp->data );
805	908
	909	+ // check allowed email domains.
	910	+ $allowed_domains = apply_filters( 'wpsc_registration_allowed_email_domains', array() );
	911	+ $domain = substr( strrchr( $data->email_address, '@' ), 1 );
	912	+ if ( $allowed_domains && ! in_array( $domain, $allowed_domains, true ) ) {
	913	+ wp_send_json_error(
	914	+ array(
	915	+ 'isSuccess' => 0,
	916	+ 'message' => __( 'Email domain is not allowed.', 'supportcandy' ),
	917	+ ),
	918	+ 403
	919	+ );
	920	+ }
	921	+
806	922	// insert user.
807	923	$display_name = $data->firstname . ' ' . $data->lastname;
808	924	$user_id = wp_insert_user(
809	925	array(
		@@ -1075,11 +1191,14 @@
1075	1191	$now = new DateTime();
1076	1192	$data = json_decode( $otp->data );
1077	1193
1078	1194	if (
1079		- isset( $data->auth_type ) &&
	1195	+ isset( $data->auth_type, $data->auth_token, $login_auth->token ) &&
	1196	+ is_string( $data->auth_token ) && $data->auth_token !== '' &&
	1197	+ is_string( $login_auth->token ) &&
1080	1198	( ( $data->auth_type == 'login' && $page_settings['otp-login'] && in_array( 'guest', $gs['allow-create-ticket'] ) ) || $data->auth_type == 'open-ticket' ) &&
1081		- ( $otp->date_expiry > $now && $data->auth_token == $login_auth->token )
	1199	+ $otp->date_expiry > $now &&
	1200	+ hash_equals( $data->auth_token, $login_auth->token )
1082	1201	) {
1083	1202	self::$login_type = 'guest';
1084	1203	self::$guest_login_type = $data->auth_type;
1085	1204	return true;