| @@ -186,12 +186,20 @@ | ||
| 186 | 186 | * @return void |
| 187 | 187 | */ |
| 188 | 188 | public static function load_current_user() { |
| 189 | 189 | |
| 190 | - global $current_user; | |
| 190 | + // Use wp_get_current_user() rather than the raw global - the | |
| 191 | + // global is only populated once something has actually called | |
| 192 | + // wp_get_current_user() (or a function that does, like | |
| 193 | + // is_user_logged_in()) earlier in the request. Nothing guarantees | |
| 194 | + // that has happened yet by the 'init' hook (where this runs), so | |
| 195 | + // reading the raw global directly can see an empty, not-yet-resolved | |
| 196 | + // WP_User and wrongly treat a logged-in visitor as a guest for the | |
| 197 | + // rest of the request. | |
| 198 | + $wp_user = wp_get_current_user(); | |
| 191 | 199 | |
| 192 | 200 | // wp logged-in user. |
| 193 | - $email = $current_user && $current_user->ID ? $current_user->user_email : ''; | |
| 201 | + $email = $wp_user && $wp_user->ID ? $wp_user->user_email : ''; | |
| 194 | 202 | if ( $email ) { |
| 195 | 203 | self::$current_user = new WPSC_Current_User( $email ); |
| 196 | 204 | self::$login_type = 'registered'; |
| 197 | 205 | return; |
| @@ -202,14 +210,14 @@ | ||
| 202 | 210 | |
| 203 | 211 | $login_auth = isset( $_COOKIE['wpsc_guest_login_auth'] ) ? sanitize_text_field( wp_unslash( $_COOKIE['wpsc_guest_login_auth'] ) ) : ''; |
| 204 | 212 | $login_auth = $login_auth ? json_decode( $login_auth ) : false; |
| 205 | 213 | |
| 206 | - if ( ! $login_auth ) { | |
| 214 | + if ( ! $login_auth || ! is_object( $login_auth ) || ! isset( $login_auth->token ) || ! is_string( $login_auth->token ) ) { | |
| 207 | 215 | self::$current_user = new WPSC_Current_User(); |
| 208 | 216 | return; |
| 209 | 217 | } |
| 210 | 218 | |
| 211 | - $login_auth->email = $login_auth->email ? sanitize_email( $login_auth->email ) : ''; | |
| 219 | + $login_auth->email = isset( $login_auth->email ) && is_string( $login_auth->email ) ? sanitize_email( $login_auth->email ) : ''; | |
| 212 | 220 | if ( ! $login_auth->email ) { |
| 213 | 221 | self::$current_user = new WPSC_Current_User(); |
| 214 | 222 | return; |
| 215 | 223 | } |
| @@ -1183,11 +1191,14 @@ | ||
| 1183 | 1191 | $now = new DateTime(); |
| 1184 | 1192 | $data = json_decode( $otp->data ); |
| 1185 | 1193 | |
| 1186 | 1194 | if ( |
| 1187 | - isset( $data->auth_type ) && | |
| 1195 | + isset( $data->auth_type, $data->auth_token, $login_auth->token ) && | |
| 1196 | + is_string( $data->auth_token ) && $data->auth_token !== '' && | |
| 1197 | + is_string( $login_auth->token ) && | |
| 1188 | 1198 | ( ( $data->auth_type == 'login' && $page_settings['otp-login'] && in_array( 'guest', $gs['allow-create-ticket'] ) ) || $data->auth_type == 'open-ticket' ) && |
| 1189 | - ( $otp->date_expiry > $now && $data->auth_token == $login_auth->token ) | |
| 1199 | + $otp->date_expiry > $now && | |
| 1200 | + hash_equals( $data->auth_token, $login_auth->token ) | |
| 1190 | 1201 | ) { |
| 1191 | 1202 | self::$login_type = 'guest'; |
| 1192 | 1203 | self::$guest_login_type = $data->auth_type; |
| 1193 | 1204 | return true; |
