| @@ -18,23 +18,8 @@ | ||
| 18 | 18 | } |
| 19 | 19 | |
| 20 | 20 | public function checkout() { |
| 21 | 21 | $purchase_type = $this->get_param( 'purchase_type', 'template' ); |
| 22 | - | |
| 23 | - /** | |
| 24 | - * Buying a template is a content decision any contributor may make, but a | |
| 25 | - * subscription is bought *for the account* and changes what everyone on it | |
| 26 | - * pays. The base gate is `delete_posts`, so without this a Contributor | |
| 27 | - * could start a plan purchase against the site owner's account. | |
| 28 | - */ | |
| 29 | - if ( 'subscription' === $purchase_type && ! current_user_can( 'manage_options' ) ) { | |
| 30 | - return $this->error( | |
| 31 | - 'insufficient_permission', | |
| 32 | - __( 'Only administrators can change the subscription.', 'templately' ), | |
| 33 | - 'checkout', | |
| 34 | - rest_authorization_required_code() | |
| 35 | - ); | |
| 36 | - } | |
| 37 | 22 | $id = $this->get_param( 'id', 0, 'intval' ); |
| 38 | 23 | $return_url = $this->get_param( 'return_url', admin_url( 'admin.php?page=templately' ), 'esc_url_raw' ); |
| 39 | 24 | |
| 40 | 25 | if ( empty( $id ) ) { |
| @@ -64,24 +49,9 @@ | ||
| 64 | 49 | $data = ! empty( $response['data'] ) ? json_decode( $response['data'], true ) : []; |
| 65 | 50 | |
| 66 | 51 | // Frontend checkout URL created — the app redirects the buyer to it. |
| 67 | 52 | if ( ! empty( $data['url'] ) ) { |
| 68 | - /** | |
| 69 | - * The client assigns this straight to `window.location.href`, so verify | |
| 70 | - * it is an https URL on a Templately host before handing it over. The | |
| 71 | - * response is our own API's, but a redirect target that arrives over the | |
| 72 | - * wire and is followed unchecked is an open redirect waiting to happen. | |
| 73 | - */ | |
| 74 | - $url = esc_url_raw( $data['url'] ); | |
| 75 | - $host = wp_parse_url( $url, PHP_URL_HOST ); | |
| 76 | - | |
| 77 | - $allowed = $host && ( 'templately.com' === $host || 'templately.dev' === $host || str_ends_with( $host, '.templately.com' ) || str_ends_with( $host, '.templately.dev' ) ); | |
| 78 | - | |
| 79 | - if ( ! $allowed || 'https' !== wp_parse_url( $url, PHP_URL_SCHEME ) ) { | |
| 80 | - return $this->error( 'invalid_checkout_url', __( 'The checkout could not be verified. Please try again.', 'templately' ), 'checkout' ); | |
| 81 | - } | |
| 82 | - | |
| 83 | - return $this->success( [ 'url' => $url ] ); | |
| 53 | + return $this->success( [ 'url' => $data['url'] ] ); | |
| 84 | 54 | } |
| 85 | 55 | |
| 86 | 56 | $message = ! empty( $response['message'] ) ? $response['message'] : __( 'Could not start the checkout. Please try again.', 'templately' ); |
| 87 | 57 | |
