← All changes | includes/Utils/Http.php +10 -34 3.7.2 → 3.5.2 View file →

		@@ -61,53 +61,30 @@
61	61	*
62	62	* @param string $redirect_to Optional redirect path after authentication
63	63	* @return string The Google auth URL with query parameters
64	64	*/
65		-public function google_auth_url($redirect_to = '', $current_url = '') {
	65	+public function google_auth_url($redirect_to = '') {
66	66	$base_url = $this->url();
67	67	// Replace /api/plugin with /api/auth/plugin/google
68	68	$auth_url = str_replace('/api/plugin', '/api/auth/plugin/google', $base_url);
69	69
70		- // Get the referer to return to the exact same page we initiated login from securely
71		- if ( ! empty( $current_url ) ) {
72		- $referer = esc_url_raw( $current_url );
73		- } else {
74		- $referer = isset( $_SERVER['HTTP_REFERER'] ) ? esc_url_raw( wp_unslash( $_SERVER['HTTP_REFERER'] ) ) : '';
75		- }
76		-
77		- $return_url = wp_validate_redirect( $referer, '' );
78		-
79		- if ( empty( $return_url ) ) {
80		- $return_url = admin_url( 'admin.php?page=templately' );
81		- }
82		-
83		- // Unique random state — doubles as cache busting and as the CSRF token the
84		- // callback validates. Only minted into a transient for a logged-in user:
85		- // this endpoint is public, and an anonymous caller could otherwise flood
86		- // wp_options with tokens that can never authorize anything.
87		- $state = wp_generate_password( 32, false );
88		- $state_owner = get_current_user_id();
89		-
90		- if ( $state_owner > 0 ) {
91		- Database::set_transient( 'google_state_' . $state, $state_owner, 15 * MINUTE_IN_SECONDS );
92		- }
93		-
94		- $return_params = [
95		- 'templately_google_login' => '1',
96		- 'templately_state' => $state,
	70	+ // Build the site_url with admin-ajax path
	71	+ $admin_url = admin_url('admin-ajax.php');
	72	+ $admin_params = [
	73	+ 'action' => 'templately_google_login',
97	74	];
98	75
99	76	// Add redirect-to parameter if provided
100	77	if (!empty($redirect_to)) {
101		- $return_params['redirect-to'] = $redirect_to;
	78	+ $admin_params['redirect-to'] = $redirect_to;
102	79	}
103	80
104		- $site_url_with_params = add_query_arg($return_params, $return_url);
	81	+ $site_url_with_params = add_query_arg($admin_params, $admin_url);
105	82
106	83	$query_params = [
107	84	'site_url' => urlencode($site_url_with_params),
108	85	'site_ip' => Helper::get_ip(),
109		- 'state' => $state,
	86	+ 'state' => wp_generate_password(32, false) // Add unique random state for cache busting
110	87	];
111	88
112	89	return add_query_arg($query_params, $auth_url);
113	90	}
		@@ -125,9 +102,9 @@
125	102	case is_string( $value ) && ( $value === 'true' || $value === 'false' ):
126	103	$prepareArgs .= "$key:" . $value . ",";
127	104	break;
128	105	default:
129		- $prepareArgs .= "$key:" . '"' . Helper::esc_json_string( $value ) . '"' . ",";
	106	+ $prepareArgs .= "$key:" . '"' . $value . '"' . ",";
130	107	break;
131	108	}
132	109	}
133	110
		@@ -192,9 +169,8 @@
192	169	}
193	170
194	171	$headers = [
195	172	'Content-Type' => 'application/json',
196		- 'Accept' => 'application/json',
197	173	'x-templately-ip' => Helper::get_ip(),
198	174	'x-templately-url' => home_url( '/' ),
199	175	'x-templately-version' => TEMPLATELY_VERSION,
200	176	];
		@@ -209,9 +185,9 @@
209	185	Helper::log( 'QUERY: ' . $query );
210	186	}
211	187
212	188	$_default_args = [
213		- 'timeout' => $this->dev_mode ? 120 : 30,
	189	+ 'timeout' => $this->dev_mode ? 40 : 30,
214	190	'headers' => $headers,
215	191	'body' => wp_json_encode( [
216	192	'query' => $query
217	193	] )