← All changes | includes/API/Login.php +71 -14 3.6.2 → 3.7.2 View file →

		@@ -121,8 +121,30 @@
121	121	if ( empty( $response['user']['api_key'] ) ) {
122	122	return $this->error( 'login_error', $response['message'] ?? __('Invalid API key.', 'templately'), 'login', 400 );
123	123	}
124	124
	125	+ $options = $this->utils( 'options' );
	126	+ $options->use_current_user( true );
	127	+
	128	+ try {
	129	+ return $this->store_connection( $response, $global_signin, $_ip, $_site_url );
	130	+ } finally {
	131	+ $options->use_current_user( false );
	132	+ }
	133	+ }
	134	+
	135	+ /**
	136	+ * Persist an authenticated connection against the acting user.
	137	+ *
	138	+ * @param array $response Cloud response, already validated.
	139	+ * @param bool $global_signin Whether the user asked to sign in globally.
	140	+ * @param string $_ip Request IP, echoed back into the profile.
	141	+ * @param string $_site_url Site URL, echoed back into the profile.
	142	+ *
	143	+ * @return array
	144	+ */
	145	+ private function store_connection( $response, $global_signin, $_ip, $_site_url ) {
	146	+
125	147	if ( $global_signin && ! Login::is_globally_signed() ) {
126	148	Options::set_global_login();
127	149	}
128	150
		@@ -174,13 +196,28 @@
174	196	return $response;
175	197	}
176	198
177	199	public function logout() {
	200	+ // Read the key off the acting user's own record. Options::get() falls back to
	201	+ // the global-login administrator when no target is given, so $this->api_key
	202	+ // resolves to the administrator's key for any linked user — disconnecting the
	203	+ // administrator's account on the cloud as well as locally.
	204	+ $api_key = $this->utils( 'options' )->get( 'api_key', '', get_current_user_id() );
	205	+
	206	+ if ( empty( $api_key ) ) {
	207	+ return $this->error(
	208	+ 'logout_error',
	209	+ __( 'You are not connected to Templately.', 'templately' ),
	210	+ 'logout',
	211	+ 403
	212	+ );
	213	+ }
	214	+
178	215	$response = $this->http()->mutation(
179	216	'disconnect',
180	217	'status, message, data',
181	218	[
182		- 'api_key' => $this->api_key,
	219	+ 'api_key' => $api_key,
183	220	"site_url" => home_url( '/' )
184	221	]
185	222	)->post();
186	223
		@@ -207,22 +244,33 @@
207	244	return $response;
208	245	}
209	246
210	247	public function delete(){
211		- $this->utils( 'options' )
212		- ->remove( 'user' )
213		- ->remove( 'favourites' )
214		- ->remove( 'reviews' )
215		- ->remove( 'cloud_activity' )
216		- ->remove( 'api_key' )
217		- ->remove( 'global_login' )
218		- ->remove( 'total_download_counts' )
219		- ->remove( 'templates_in_clouds' );
	248	+ $options = $this->utils( 'options' );
220	249
221		- if ( $this->utils( 'options' )->who_am_i() === 'global' ) {
222		- $this->utils( 'options' )->remove_global_login();
223		- }
	250	+ // Pin the removals to the acting user. Without the pin, Options::user_id()
	251	+ // resolves a linked user to the global-login administrator and the delete
	252	+ // path wipes the administrator's connection instead of the caller's.
	253	+ $options->use_current_user( true );
224	254
	255	+ try {
	256	+ $options
	257	+ ->remove( 'user' )
	258	+ ->remove( 'favourites' )
	259	+ ->remove( 'reviews' )
	260	+ ->remove( 'cloud_activity' )
	261	+ ->remove( 'api_key' )
	262	+ ->remove( 'global_login' )
	263	+ ->remove( 'total_download_counts' )
	264	+ ->remove( 'templates_in_clouds' );
	265	+
	266	+ if ( $options->who_am_i() === 'global' ) {
	267	+ $options->remove_global_login();
	268	+ }
	269	+ } finally {
	270	+ $options->use_current_user( false );
	271	+ }
	272	+
225	273	$global_user_id = $this->utils( 'options' )->is_global();
226	274	$global_user = null;
227	275
228	276	if ( $global_user_id !== $this->utils( 'options' )->current_user_id() ) {
		@@ -228,8 +276,12 @@
228	276	if ( $global_user_id !== $this->utils( 'options' )->current_user_id() ) {
229	277	$global_user = $this->utils( 'options' )->get( 'user', false, $global_user_id );
230	278
231	279	if ( ! empty( $global_user ) ) {
	280	+ if ( is_array( $global_user ) ) {
	281	+ unset( $global_user['api_key'] );
	282	+ }
	283	+
232	284	$global_user['meta'] = $this->user_meta();
233	285	}
234	286	}
235	287
		@@ -243,8 +295,13 @@
243	295
244	296	$_user = ( new static )->utils( 'options' )->get( 'user', null );
245	297
246	298	if ( ! is_null( $_user ) ) {
	299	+ // Profiles stored before 3.7.1 may still carry the cloud API key.
	300	+ if ( is_array( $_user ) ) {
	301	+ unset( $_user['api_key'] );
	302	+ }
	303	+
247	304	$_user['meta'] = self::get_instance()->user_meta();
248	305	}
249	306
250	307	if ( empty( $_user ) ) {
		@@ -277,5 +334,5 @@
277	334
278	335	public static function signed_as_global(): bool {
279	336	return rest_sanitize_boolean( ( new static )->utils( 'options' )->signed_as_global() );
280	337	}
281		-}
	338	+}