| @@ -164,8 +164,24 @@ | ||
| 164 | 164 | } |
| 165 | 165 | } |
| 166 | 166 | |
| 167 | 167 | /** |
| 168 | + * Return customer object by WordPress user ID. | |
| 169 | + * | |
| 170 | + * @param int $user_id - WordPress user ID. | |
| 171 | + * @return WPSC_Customer | |
| 172 | + */ | |
| 173 | + public static function get_customer_by_user_id( $user_id ) { | |
| 174 | + | |
| 175 | + $user_id = absint( $user_id ); | |
| 176 | + if ( ! $user_id ) { | |
| 177 | + return new WPSC_Customer(); | |
| 178 | + } | |
| 179 | + | |
| 180 | + return WPSC_Customer::get_by_user_id( $user_id ); | |
| 181 | + } | |
| 182 | + | |
| 183 | + /** | |
| 168 | 184 | * Load current wpsc user |
| 169 | 185 | * |
| 170 | 186 | * @return void |
| 171 | 187 | */ |
| @@ -170,12 +186,20 @@ | ||
| 170 | 186 | * @return void |
| 171 | 187 | */ |
| 172 | 188 | public static function load_current_user() { |
| 173 | 189 | |
| 174 | - global $current_user; | |
| 190 | + // Use wp_get_current_user() rather than the raw global - the | |
| 191 | + // global is only populated once something has actually called | |
| 192 | + // wp_get_current_user() (or a function that does, like | |
| 193 | + // is_user_logged_in()) earlier in the request. Nothing guarantees | |
| 194 | + // that has happened yet by the 'init' hook (where this runs), so | |
| 195 | + // reading the raw global directly can see an empty, not-yet-resolved | |
| 196 | + // WP_User and wrongly treat a logged-in visitor as a guest for the | |
| 197 | + // rest of the request. | |
| 198 | + $wp_user = wp_get_current_user(); | |
| 175 | 199 | |
| 176 | 200 | // wp logged-in user. |
| 177 | - $email = $current_user && $current_user->ID ? $current_user->user_email : ''; | |
| 201 | + $email = $wp_user && $wp_user->ID ? $wp_user->user_email : ''; | |
| 178 | 202 | if ( $email ) { |
| 179 | 203 | self::$current_user = new WPSC_Current_User( $email ); |
| 180 | 204 | self::$login_type = 'registered'; |
| 181 | 205 | return; |
| @@ -186,14 +210,14 @@ | ||
| 186 | 210 | |
| 187 | 211 | $login_auth = isset( $_COOKIE['wpsc_guest_login_auth'] ) ? sanitize_text_field( wp_unslash( $_COOKIE['wpsc_guest_login_auth'] ) ) : ''; |
| 188 | 212 | $login_auth = $login_auth ? json_decode( $login_auth ) : false; |
| 189 | 213 | |
| 190 | - if ( ! $login_auth ) { | |
| 214 | + if ( ! $login_auth || ! is_object( $login_auth ) || ! isset( $login_auth->token ) || ! is_string( $login_auth->token ) ) { | |
| 191 | 215 | self::$current_user = new WPSC_Current_User(); |
| 192 | 216 | return; |
| 193 | 217 | } |
| 194 | 218 | |
| 195 | - $login_auth->email = $login_auth->email ? sanitize_email( $login_auth->email ) : ''; | |
| 219 | + $login_auth->email = isset( $login_auth->email ) && is_string( $login_auth->email ) ? sanitize_email( $login_auth->email ) : ''; | |
| 196 | 220 | if ( ! $login_auth->email ) { |
| 197 | 221 | self::$current_user = new WPSC_Current_User(); |
| 198 | 222 | return; |
| 199 | 223 | } |
| @@ -1167,11 +1191,14 @@ | ||
| 1167 | 1191 | $now = new DateTime(); |
| 1168 | 1192 | $data = json_decode( $otp->data ); |
| 1169 | 1193 | |
| 1170 | 1194 | if ( |
| 1171 | - isset( $data->auth_type ) && | |
| 1195 | + isset( $data->auth_type, $data->auth_token, $login_auth->token ) && | |
| 1196 | + is_string( $data->auth_token ) && $data->auth_token !== '' && | |
| 1197 | + is_string( $login_auth->token ) && | |
| 1172 | 1198 | ( ( $data->auth_type == 'login' && $page_settings['otp-login'] && in_array( 'guest', $gs['allow-create-ticket'] ) ) || $data->auth_type == 'open-ticket' ) && |
| 1173 | - ( $otp->date_expiry > $now && $data->auth_token == $login_auth->token ) | |
| 1199 | + $otp->date_expiry > $now && | |
| 1200 | + hash_equals( $data->auth_token, $login_auth->token ) | |
| 1174 | 1201 | ) { |
| 1175 | 1202 | self::$login_type = 'guest'; |
| 1176 | 1203 | self::$guest_login_type = $data->auth_type; |
| 1177 | 1204 | return true; |
