| @@ -17,11 +17,9 @@ | ||
| 17 | 17 | use Templately\API\Conditions; |
| 18 | 18 | use Templately\API\ThemeBuilderApi; |
| 19 | 19 | use Templately\Builder\ThemeBuilder; |
| 20 | 20 | use Templately\Core\Importer\FullSiteImport; |
| 21 | -use Templately\Utils\AuthErrorCode; | |
| 22 | 21 | use Templately\Utils\Base; |
| 23 | -use Templately\Utils\Database; | |
| 24 | 22 | use Templately\Utils\Enqueue; |
| 25 | 23 | |
| 26 | 24 | use Templately\Core\Admin; |
| 27 | 25 | use Templately\Core\Module; |
| @@ -46,9 +44,9 @@ | ||
| 46 | 44 | use Templately\Core\Platform\Gutenberg; |
| 47 | 45 | use Templately\Core\Platform\Elementor; |
| 48 | 46 | |
| 49 | 47 | final class Plugin extends Base { |
| 50 | - public $version = '3.7.2'; | |
| 48 | + public $version = '3.6.8'; | |
| 51 | 49 | |
| 52 | 50 | public $admin; |
| 53 | 51 | public $settings; |
| 54 | 52 | /** |
| @@ -272,46 +270,12 @@ | ||
| 272 | 270 | if ( empty( $_GET['templately_google_login'] ) ) { |
| 273 | 271 | return; |
| 274 | 272 | } |
| 275 | 273 | |
| 276 | - if ( wp_doing_ajax() || wp_doing_cron() || ( defined( 'REST_REQUEST' ) && REST_REQUEST ) ) { | |
| 277 | - return; | |
| 278 | - } | |
| 274 | + $redirect_url = remove_query_arg( [ 'templately_google_login', 'api_key', 'error', 'state', 'redirect-to' ] ); | |
| 279 | 275 | |
| 280 | - // Checked before the token is consumed: the callback can land while the | |
| 281 | - // auth cookie is missing (expired session, cookie not yet set), and WP | |
| 282 | - // will bounce the user through wp-login and back to this same URL. | |
| 283 | - // Burning the token here would fail that legitimate retry. | |
| 284 | - if ( ! is_user_logged_in() ) { | |
| 285 | - return; | |
| 286 | - } | |
| 287 | - | |
| 288 | - $state = ''; | |
| 289 | - if ( ! empty( $_GET['templately_state'] ) ) { | |
| 290 | - $state = sanitize_text_field( wp_unslash( $_GET['templately_state'] ) ); | |
| 291 | - } elseif ( ! empty( $_GET['state'] ) ) { | |
| 292 | - $state = sanitize_text_field( wp_unslash( $_GET['state'] ) ); | |
| 293 | - } | |
| 294 | - | |
| 295 | - $state_user_id = false; | |
| 296 | - if ( ! empty( $state ) ) { | |
| 297 | - $state_user_id = Database::get_transient( 'google_state_' . $state ); | |
| 298 | - Database::delete_transient( 'google_state_' . $state ); | |
| 299 | - } | |
| 300 | - | |
| 301 | - $is_authorized = false !== $state_user_id | |
| 302 | - && intval( $state_user_id ) === get_current_user_id() | |
| 303 | - && current_user_can( 'delete_posts' ); | |
| 304 | - | |
| 305 | - $redirect_url = remove_query_arg( [ 'templately_google_login', 'templately_state', 'api_key', 'error', 'state', 'redirect-to' ] ); | |
| 306 | - | |
| 307 | - if ( ! $is_authorized ) { | |
| 308 | - $error_code = AuthErrorCode::AUTH_STATE_INVALID; | |
| 309 | - } elseif ( ! empty( $_GET['error'] ) ) { | |
| 310 | - // Google's own reason is deliberately dropped rather than forwarded: | |
| 311 | - // everything on this query string is attacker-controlled, and the | |
| 312 | - // screen that displays it must never be handed prose from the URL. | |
| 313 | - $error_code = AuthErrorCode::AUTH_PROVIDER_FAILED; | |
| 276 | + if ( ! empty( $_GET['error'] ) ) { | |
| 277 | + $error_message = sanitize_text_field( $_GET['error'] ); | |
| 314 | 278 | } elseif ( ! empty( $_GET['api_key'] ) ) { |
| 315 | 279 | $request = new \WP_REST_Request( 'POST', '/templately/v1/login' ); |
| 316 | 280 | $request->set_param( 'viaAPI', true ); |
| 317 | 281 | $request->set_param( 'api_key', sanitize_text_field( $_GET['api_key'] ) ); |
| @@ -320,11 +284,8 @@ | ||
| 320 | 284 | * @var Login $login |
| 321 | 285 | */ |
| 322 | 286 | $login = Login::get_instance(); |
| 323 | 287 | $login->permission_check( $request ); |
| 324 | - | |
| 325 | - // login() pins the write target to the acting user itself — no pin | |
| 326 | - // here, or its finally would release ours mid-request. | |
| 327 | 288 | $response = $login->login(); |
| 328 | 289 | |
| 329 | 290 | if ( ! is_wp_error( $response ) && ! empty( $response['user'] ) ) { |
| 330 | 291 | $redirect_path = ! empty( $_GET['redirect-to'] ) ? sanitize_text_field( wp_unslash( $_GET['redirect-to'] ) ) : ''; |
| @@ -350,18 +311,17 @@ | ||
| 350 | 311 | |
| 351 | 312 | wp_safe_redirect( $redirect_url ); |
| 352 | 313 | exit; |
| 353 | 314 | } else { |
| 354 | - // The cloud's own wording stays server-side; the screen resolves | |
| 355 | - // its copy from the code. | |
| 356 | - $error_code = AuthErrorCode::INVALID_API_KEY; | |
| 315 | + $error_message = ( is_wp_error( $response ) ) ? $response->get_error_message() : __( 'Login failed.', 'templately' ); | |
| 357 | 316 | } |
| 358 | 317 | } else { |
| 359 | - $error_code = AuthErrorCode::AUTH_MISSING_API_KEY; | |
| 318 | + $error_message = __( 'Missing API Key.', 'templately' ); | |
| 360 | 319 | } |
| 361 | 320 | |
| 362 | 321 | $redirect_url = add_query_arg( [ |
| 363 | - 'templately_error' => $error_code, | |
| 322 | + 'templately_error' => 'login_failed', | |
| 323 | + 'error_message' => urlencode( $error_message ), | |
| 364 | 324 | ], $redirect_url ); |
| 365 | 325 | |
| 366 | 326 | wp_safe_redirect( $redirect_url ); |
| 367 | 327 | exit; |
