← All changes | includes/Plugin.php +50 -8 3.6.1 → 3.7.2 View file →

		@@ -17,9 +17,11 @@
17	17	use Templately\API\Conditions;
18	18	use Templately\API\ThemeBuilderApi;
19	19	use Templately\Builder\ThemeBuilder;
20	20	use Templately\Core\Importer\FullSiteImport;
	21	+use Templately\Utils\AuthErrorCode;
21	22	use Templately\Utils\Base;
	23	+use Templately\Utils\Database;
22	24	use Templately\Utils\Enqueue;
23	25
24	26	use Templately\Core\Admin;
25	27	use Templately\Core\Module;
		@@ -26,8 +28,9 @@
26	28
27	29	use Templately\API\Tags;
28	30	use Templately\API\Items;
29	31	use Templately\API\Login;
	32	+use Templately\API\Checkout;
30	33	use Templately\API\SignUp;
31	34	use Templately\API\Profile;
32	35	use Templately\API\Import;
33	36	use Templately\API\MyClouds;
		@@ -43,9 +46,9 @@
43	46	use Templately\Core\Platform\Gutenberg;
44	47	use Templately\Core\Platform\Elementor;
45	48
46	49	final class Plugin extends Base {
47		- public $version = '3.6.1';
	50	+ public $version = '3.7.2';
48	51
49	52	public $admin;
50	53	public $settings;
51	54	/**
		@@ -190,8 +193,9 @@
190	193	Items::get_instance();
191	194	SavedTemplates::get_instance();
192	195
193	196	Login::get_instance();
	197	+ Checkout::get_instance();
194	198	SignUp::get_instance();
195	199	Import::get_instance();
196	200	Profile::get_instance();
197	201	MyClouds::get_instance();
		@@ -268,12 +272,46 @@
268	272	if ( empty( $_GET['templately_google_login'] ) ) {
269	273	return;
270	274	}
271	275
272		- $redirect_url = remove_query_arg( [ 'templately_google_login', 'api_key', 'error', 'state', 'redirect-to' ] );
	276	+ if ( wp_doing_ajax() || wp_doing_cron() || ( defined( 'REST_REQUEST' ) && REST_REQUEST ) ) {
	277	+ return;
	278	+ }
273	279
274		- if ( ! empty( $_GET['error'] ) ) {
275		- $error_message = sanitize_text_field( $_GET['error'] );
	280	+ // Checked before the token is consumed: the callback can land while the
	281	+ // auth cookie is missing (expired session, cookie not yet set), and WP
	282	+ // will bounce the user through wp-login and back to this same URL.
	283	+ // Burning the token here would fail that legitimate retry.
	284	+ if ( ! is_user_logged_in() ) {
	285	+ return;
	286	+ }
	287	+
	288	+ $state = '';
	289	+ if ( ! empty( $_GET['templately_state'] ) ) {
	290	+ $state = sanitize_text_field( wp_unslash( $_GET['templately_state'] ) );
	291	+ } elseif ( ! empty( $_GET['state'] ) ) {
	292	+ $state = sanitize_text_field( wp_unslash( $_GET['state'] ) );
	293	+ }
	294	+
	295	+ $state_user_id = false;
	296	+ if ( ! empty( $state ) ) {
	297	+ $state_user_id = Database::get_transient( 'google_state_' . $state );
	298	+ Database::delete_transient( 'google_state_' . $state );
	299	+ }
	300	+
	301	+ $is_authorized = false !== $state_user_id
	302	+ && intval( $state_user_id ) === get_current_user_id()
	303	+ && current_user_can( 'delete_posts' );
	304	+
	305	+ $redirect_url = remove_query_arg( [ 'templately_google_login', 'templately_state', 'api_key', 'error', 'state', 'redirect-to' ] );
	306	+
	307	+ if ( ! $is_authorized ) {
	308	+ $error_code = AuthErrorCode::AUTH_STATE_INVALID;
	309	+ } elseif ( ! empty( $_GET['error'] ) ) {
	310	+ // Google's own reason is deliberately dropped rather than forwarded:
	311	+ // everything on this query string is attacker-controlled, and the
	312	+ // screen that displays it must never be handed prose from the URL.
	313	+ $error_code = AuthErrorCode::AUTH_PROVIDER_FAILED;
276	314	} elseif ( ! empty( $_GET['api_key'] ) ) {
277	315	$request = new \WP_REST_Request( 'POST', '/templately/v1/login' );
278	316	$request->set_param( 'viaAPI', true );
279	317	$request->set_param( 'api_key', sanitize_text_field( $_GET['api_key'] ) );
		@@ -282,8 +320,11 @@
282	320	* @var Login $login
283	321	*/
284	322	$login = Login::get_instance();
285	323	$login->permission_check( $request );
	324	+
	325	+ // login() pins the write target to the acting user itself — no pin
	326	+ // here, or its finally would release ours mid-request.
286	327	$response = $login->login();
287	328
288	329	if ( ! is_wp_error( $response ) && ! empty( $response['user'] ) ) {
289	330	$redirect_path = ! empty( $_GET['redirect-to'] ) ? sanitize_text_field( wp_unslash( $_GET['redirect-to'] ) ) : '';
		@@ -309,17 +350,18 @@
309	350
310	351	wp_safe_redirect( $redirect_url );
311	352	exit;
312	353	} else {
313		- $error_message = ( is_wp_error( $response ) ) ? $response->get_error_message() : __( 'Login failed.', 'templately' );
	354	+ // The cloud's own wording stays server-side; the screen resolves
	355	+ // its copy from the code.
	356	+ $error_code = AuthErrorCode::INVALID_API_KEY;
314	357	}
315	358	} else {
316		- $error_message = __( 'Missing API Key.', 'templately' );
	359	+ $error_code = AuthErrorCode::AUTH_MISSING_API_KEY;
317	360	}
318	361
319	362	$redirect_url = add_query_arg( [
320		- 'templately_error' => 'login_failed',
321		- 'error_message' => urlencode( $error_message ),
	363	+ 'templately_error' => $error_code,
322	364	], $redirect_url );
323	365
324	366	wp_safe_redirect( $redirect_url );
325	367	exit;