← All changes | includes/Plugin.php +8 -52 3.7.5 → 3.6.8 View file →

		@@ -17,11 +17,9 @@
17	17	use Templately\API\Conditions;
18	18	use Templately\API\ThemeBuilderApi;
19	19	use Templately\Builder\ThemeBuilder;
20	20	use Templately\Core\Importer\FullSiteImport;
21		-use Templately\Utils\AuthErrorCode;
22	21	use Templately\Utils\Base;
23		-use Templately\Utils\Database;
24	22	use Templately\Utils\Enqueue;
25	23
26	24	use Templately\Core\Admin;
27	25	use Templately\Core\Module;
		@@ -30,9 +28,8 @@
30	28	use Templately\API\Items;
31	29	use Templately\API\Login;
32	30	use Templately\API\Checkout;
33	31	use Templately\API\SignUp;
34		-use Templately\API\AiCredit;
35	32	use Templately\API\Profile;
36	33	use Templately\API\Import;
37	34	use Templately\API\MyClouds;
38	35	use Templately\API\WorkSpaces;
		@@ -41,9 +38,8 @@
41	38	use Templately\API\TemplateTypes;
42	39	use Templately\API\SavedTemplates;
43	40	use Templately\API\Sites;
44	41	use Templately\API\Tour;
45		-use Templately\Core\DeactivationSurvey;
46	42	use Templately\Core\Maintenance;
47	43	use Templately\Core\Migrator;
48	44	use Templately\Core\Platform\Gutenberg;
49	45	use Templately\Core\Platform\Elementor;
		@@ -48,9 +44,9 @@
48	44	use Templately\Core\Platform\Gutenberg;
49	45	use Templately\Core\Platform\Elementor;
50	46
51	47	final class Plugin extends Base {
52		- public $version = '3.7.5';
	48	+ public $version = '3.6.8';
53	49
54	50	public $admin;
55	51	public $settings;
56	52	/**
		@@ -79,9 +75,8 @@
79	75	$this->define_constants();
80	76	$this->set_locale();
81	77
82	78	Maintenance::init();
83		- DeactivationSurvey::init();
84	79
85	80	$this->assets = Enqueue::get_instance( TEMPLATELY_URL, TEMPLATELY_PATH, $this->version );
86	81	$this->admin = Admin::get_instance();
87	82	$this->settings = Settings::get_instance();
		@@ -200,9 +195,8 @@
200	195	Checkout::get_instance();
201	196	SignUp::get_instance();
202	197	Import::get_instance();
203	198	Profile::get_instance();
204		- AiCredit::get_instance();
205	199	MyClouds::get_instance();
206	200	WorkSpaces::get_instance();
207	201	Sites::get_instance();
208	202	Tour::get_instance();
		@@ -276,46 +270,12 @@
276	270	if ( empty( $_GET['templately_google_login'] ) ) {
277	271	return;
278	272	}
279	273
280		- if ( wp_doing_ajax() || wp_doing_cron() || ( defined( 'REST_REQUEST' ) && REST_REQUEST ) ) {
281		- return;
282		- }
	274	+ $redirect_url = remove_query_arg( [ 'templately_google_login', 'api_key', 'error', 'state', 'redirect-to' ] );
283	275
284		- // Checked before the token is consumed: the callback can land while the
285		- // auth cookie is missing (expired session, cookie not yet set), and WP
286		- // will bounce the user through wp-login and back to this same URL.
287		- // Burning the token here would fail that legitimate retry.
288		- if ( ! is_user_logged_in() ) {
289		- return;
290		- }
291		-
292		- $state = '';
293		- if ( ! empty( $_GET['templately_state'] ) ) {
294		- $state = sanitize_text_field( wp_unslash( $_GET['templately_state'] ) );
295		- } elseif ( ! empty( $_GET['state'] ) ) {
296		- $state = sanitize_text_field( wp_unslash( $_GET['state'] ) );
297		- }
298		-
299		- $state_user_id = false;
300		- if ( ! empty( $state ) ) {
301		- $state_user_id = Database::get_transient( 'google_state_' . $state );
302		- Database::delete_transient( 'google_state_' . $state );
303		- }
304		-
305		- $is_authorized = false !== $state_user_id
306		- && intval( $state_user_id ) === get_current_user_id()
307		- && current_user_can( 'delete_posts' );
308		-
309		- $redirect_url = remove_query_arg( [ 'templately_google_login', 'templately_state', 'api_key', 'error', 'state', 'redirect-to' ] );
310		-
311		- if ( ! $is_authorized ) {
312		- $error_code = AuthErrorCode::AUTH_STATE_INVALID;
313		- } elseif ( ! empty( $_GET['error'] ) ) {
314		- // Google's own reason is deliberately dropped rather than forwarded:
315		- // everything on this query string is attacker-controlled, and the
316		- // screen that displays it must never be handed prose from the URL.
317		- $error_code = AuthErrorCode::AUTH_PROVIDER_FAILED;
	276	+ if ( ! empty( $_GET['error'] ) ) {
	277	+ $error_message = sanitize_text_field( $_GET['error'] );
318	278	} elseif ( ! empty( $_GET['api_key'] ) ) {
319	279	$request = new \WP_REST_Request( 'POST', '/templately/v1/login' );
320	280	$request->set_param( 'viaAPI', true );
321	281	$request->set_param( 'api_key', sanitize_text_field( $_GET['api_key'] ) );
		@@ -324,11 +284,8 @@
324	284	* @var Login $login
325	285	*/
326	286	$login = Login::get_instance();
327	287	$login->permission_check( $request );
328		-
329		- // login() pins the write target to the acting user itself — no pin
330		- // here, or its finally would release ours mid-request.
331	288	$response = $login->login();
332	289
333	290	if ( ! is_wp_error( $response ) && ! empty( $response['user'] ) ) {
334	291	$redirect_path = ! empty( $_GET['redirect-to'] ) ? sanitize_text_field( wp_unslash( $_GET['redirect-to'] ) ) : '';
		@@ -354,18 +311,17 @@
354	311
355	312	wp_safe_redirect( $redirect_url );
356	313	exit;
357	314	} else {
358		- // The cloud's own wording stays server-side; the screen resolves
359		- // its copy from the code.
360		- $error_code = AuthErrorCode::INVALID_API_KEY;
	315	+ $error_message = ( is_wp_error( $response ) ) ? $response->get_error_message() : __( 'Login failed.', 'templately' );
361	316	}
362	317	} else {
363		- $error_code = AuthErrorCode::AUTH_MISSING_API_KEY;
	318	+ $error_message = __( 'Missing API Key.', 'templately' );
364	319	}
365	320
366	321	$redirect_url = add_query_arg( [
367		- 'templately_error' => $error_code,
	322	+ 'templately_error' => 'login_failed',
	323	+ 'error_message' => urlencode( $error_message ),
368	324	], $redirect_url );
369	325
370	326	wp_safe_redirect( $redirect_url );
371	327	exit;