← All changes | includes/Plugin.php +8 -52 3.7.2 → 3.5.3 View file →

		@@ -17,11 +17,9 @@
17	17	use Templately\API\Conditions;
18	18	use Templately\API\ThemeBuilderApi;
19	19	use Templately\Builder\ThemeBuilder;
20	20	use Templately\Core\Importer\FullSiteImport;
21		-use Templately\Utils\AuthErrorCode;
22	21	use Templately\Utils\Base;
23		-use Templately\Utils\Database;
24	22	use Templately\Utils\Enqueue;
25	23
26	24	use Templately\Core\Admin;
27	25	use Templately\Core\Module;
		@@ -28,9 +26,8 @@
28	26
29	27	use Templately\API\Tags;
30	28	use Templately\API\Items;
31	29	use Templately\API\Login;
32		-use Templately\API\Checkout;
33	30	use Templately\API\SignUp;
34	31	use Templately\API\Profile;
35	32	use Templately\API\Import;
36	33	use Templately\API\MyClouds;
		@@ -39,9 +36,8 @@
39	36	use Templately\API\Dependencies;
40	37	use Templately\API\TemplateTypes;
41	38	use Templately\API\SavedTemplates;
42	39	use Templately\API\Sites;
43		-use Templately\API\Tour;
44	40	use Templately\Core\Maintenance;
45	41	use Templately\Core\Migrator;
46	42	use Templately\Core\Platform\Gutenberg;
47	43	use Templately\Core\Platform\Elementor;
		@@ -46,9 +42,9 @@
46	42	use Templately\Core\Platform\Gutenberg;
47	43	use Templately\Core\Platform\Elementor;
48	44
49	45	final class Plugin extends Base {
50		- public $version = '3.7.2';
	46	+ public $version = '3.5.3';
51	47
52	48	public $admin;
53	49	public $settings;
54	50	/**
		@@ -193,9 +189,8 @@
193	189	Items::get_instance();
194	190	SavedTemplates::get_instance();
195	191
196	192	Login::get_instance();
197		- Checkout::get_instance();
198	193	SignUp::get_instance();
199	194	Import::get_instance();
200	195	Profile::get_instance();
201	196	MyClouds::get_instance();
		@@ -200,9 +195,8 @@
200	195	Profile::get_instance();
201	196	MyClouds::get_instance();
202	197	WorkSpaces::get_instance();
203	198	Sites::get_instance();
204		- Tour::get_instance();
205	199
206	200	APISettings::get_instance();
207	201	// Note: DeveloperSettings::get_instance() is called in Developer::init_modules() when developer functionality is available and enabled
208	202	}
		@@ -272,46 +266,12 @@
272	266	if ( empty( $_GET['templately_google_login'] ) ) {
273	267	return;
274	268	}
275	269
276		- if ( wp_doing_ajax() || wp_doing_cron() || ( defined( 'REST_REQUEST' ) && REST_REQUEST ) ) {
277		- return;
278		- }
	270	+ $redirect_url = remove_query_arg( [ 'templately_google_login', 'api_key', 'error', 'state', 'redirect-to' ] );
279	271
280		- // Checked before the token is consumed: the callback can land while the
281		- // auth cookie is missing (expired session, cookie not yet set), and WP
282		- // will bounce the user through wp-login and back to this same URL.
283		- // Burning the token here would fail that legitimate retry.
284		- if ( ! is_user_logged_in() ) {
285		- return;
286		- }
287		-
288		- $state = '';
289		- if ( ! empty( $_GET['templately_state'] ) ) {
290		- $state = sanitize_text_field( wp_unslash( $_GET['templately_state'] ) );
291		- } elseif ( ! empty( $_GET['state'] ) ) {
292		- $state = sanitize_text_field( wp_unslash( $_GET['state'] ) );
293		- }
294		-
295		- $state_user_id = false;
296		- if ( ! empty( $state ) ) {
297		- $state_user_id = Database::get_transient( 'google_state_' . $state );
298		- Database::delete_transient( 'google_state_' . $state );
299		- }
300		-
301		- $is_authorized = false !== $state_user_id
302		- && intval( $state_user_id ) === get_current_user_id()
303		- && current_user_can( 'delete_posts' );
304		-
305		- $redirect_url = remove_query_arg( [ 'templately_google_login', 'templately_state', 'api_key', 'error', 'state', 'redirect-to' ] );
306		-
307		- if ( ! $is_authorized ) {
308		- $error_code = AuthErrorCode::AUTH_STATE_INVALID;
309		- } elseif ( ! empty( $_GET['error'] ) ) {
310		- // Google's own reason is deliberately dropped rather than forwarded:
311		- // everything on this query string is attacker-controlled, and the
312		- // screen that displays it must never be handed prose from the URL.
313		- $error_code = AuthErrorCode::AUTH_PROVIDER_FAILED;
	272	+ if ( ! empty( $_GET['error'] ) ) {
	273	+ $error_message = sanitize_text_field( $_GET['error'] );
314	274	} elseif ( ! empty( $_GET['api_key'] ) ) {
315	275	$request = new \WP_REST_Request( 'POST', '/templately/v1/login' );
316	276	$request->set_param( 'viaAPI', true );
317	277	$request->set_param( 'api_key', sanitize_text_field( $_GET['api_key'] ) );
		@@ -320,11 +280,8 @@
320	280	* @var Login $login
321	281	*/
322	282	$login = Login::get_instance();
323	283	$login->permission_check( $request );
324		-
325		- // login() pins the write target to the acting user itself — no pin
326		- // here, or its finally would release ours mid-request.
327	284	$response = $login->login();
328	285
329	286	if ( ! is_wp_error( $response ) && ! empty( $response['user'] ) ) {
330	287	$redirect_path = ! empty( $_GET['redirect-to'] ) ? sanitize_text_field( wp_unslash( $_GET['redirect-to'] ) ) : '';
		@@ -350,18 +307,17 @@
350	307
351	308	wp_safe_redirect( $redirect_url );
352	309	exit;
353	310	} else {
354		- // The cloud's own wording stays server-side; the screen resolves
355		- // its copy from the code.
356		- $error_code = AuthErrorCode::INVALID_API_KEY;
	311	+ $error_message = ( is_wp_error( $response ) ) ? $response->get_error_message() : __( 'Login failed.', 'templately' );
357	312	}
358	313	} else {
359		- $error_code = AuthErrorCode::AUTH_MISSING_API_KEY;
	314	+ $error_message = __( 'Missing API Key.', 'templately' );
360	315	}
361	316
362	317	$redirect_url = add_query_arg( [
363		- 'templately_error' => $error_code,
	318	+ 'templately_error' => 'login_failed',
	319	+ 'error_message' => urlencode( $error_message ),
364	320	], $redirect_url );
365	321
366	322	wp_safe_redirect( $redirect_url );
367	323	exit;