← All changes | includes/Plugin.php +48 -8 3.6.6 → 3.7.2 View file →

		@@ -17,9 +17,11 @@
17	17	use Templately\API\Conditions;
18	18	use Templately\API\ThemeBuilderApi;
19	19	use Templately\Builder\ThemeBuilder;
20	20	use Templately\Core\Importer\FullSiteImport;
	21	+use Templately\Utils\AuthErrorCode;
21	22	use Templately\Utils\Base;
	23	+use Templately\Utils\Database;
22	24	use Templately\Utils\Enqueue;
23	25
24	26	use Templately\Core\Admin;
25	27	use Templately\Core\Module;
		@@ -44,9 +46,9 @@
44	46	use Templately\Core\Platform\Gutenberg;
45	47	use Templately\Core\Platform\Elementor;
46	48
47	49	final class Plugin extends Base {
48		- public $version = '3.6.6';
	50	+ public $version = '3.7.2';
49	51
50	52	public $admin;
51	53	public $settings;
52	54	/**
		@@ -270,12 +272,46 @@
270	272	if ( empty( $_GET['templately_google_login'] ) ) {
271	273	return;
272	274	}
273	275
274		- $redirect_url = remove_query_arg( [ 'templately_google_login', 'api_key', 'error', 'state', 'redirect-to' ] );
	276	+ if ( wp_doing_ajax() || wp_doing_cron() || ( defined( 'REST_REQUEST' ) && REST_REQUEST ) ) {
	277	+ return;
	278	+ }
275	279
276		- if ( ! empty( $_GET['error'] ) ) {
277		- $error_message = sanitize_text_field( $_GET['error'] );
	280	+ // Checked before the token is consumed: the callback can land while the
	281	+ // auth cookie is missing (expired session, cookie not yet set), and WP
	282	+ // will bounce the user through wp-login and back to this same URL.
	283	+ // Burning the token here would fail that legitimate retry.
	284	+ if ( ! is_user_logged_in() ) {
	285	+ return;
	286	+ }
	287	+
	288	+ $state = '';
	289	+ if ( ! empty( $_GET['templately_state'] ) ) {
	290	+ $state = sanitize_text_field( wp_unslash( $_GET['templately_state'] ) );
	291	+ } elseif ( ! empty( $_GET['state'] ) ) {
	292	+ $state = sanitize_text_field( wp_unslash( $_GET['state'] ) );
	293	+ }
	294	+
	295	+ $state_user_id = false;
	296	+ if ( ! empty( $state ) ) {
	297	+ $state_user_id = Database::get_transient( 'google_state_' . $state );
	298	+ Database::delete_transient( 'google_state_' . $state );
	299	+ }
	300	+
	301	+ $is_authorized = false !== $state_user_id
	302	+ && intval( $state_user_id ) === get_current_user_id()
	303	+ && current_user_can( 'delete_posts' );
	304	+
	305	+ $redirect_url = remove_query_arg( [ 'templately_google_login', 'templately_state', 'api_key', 'error', 'state', 'redirect-to' ] );
	306	+
	307	+ if ( ! $is_authorized ) {
	308	+ $error_code = AuthErrorCode::AUTH_STATE_INVALID;
	309	+ } elseif ( ! empty( $_GET['error'] ) ) {
	310	+ // Google's own reason is deliberately dropped rather than forwarded:
	311	+ // everything on this query string is attacker-controlled, and the
	312	+ // screen that displays it must never be handed prose from the URL.
	313	+ $error_code = AuthErrorCode::AUTH_PROVIDER_FAILED;
278	314	} elseif ( ! empty( $_GET['api_key'] ) ) {
279	315	$request = new \WP_REST_Request( 'POST', '/templately/v1/login' );
280	316	$request->set_param( 'viaAPI', true );
281	317	$request->set_param( 'api_key', sanitize_text_field( $_GET['api_key'] ) );
		@@ -284,8 +320,11 @@
284	320	* @var Login $login
285	321	*/
286	322	$login = Login::get_instance();
287	323	$login->permission_check( $request );
	324	+
	325	+ // login() pins the write target to the acting user itself — no pin
	326	+ // here, or its finally would release ours mid-request.
288	327	$response = $login->login();
289	328
290	329	if ( ! is_wp_error( $response ) && ! empty( $response['user'] ) ) {
291	330	$redirect_path = ! empty( $_GET['redirect-to'] ) ? sanitize_text_field( wp_unslash( $_GET['redirect-to'] ) ) : '';
		@@ -311,17 +350,18 @@
311	350
312	351	wp_safe_redirect( $redirect_url );
313	352	exit;
314	353	} else {
315		- $error_message = ( is_wp_error( $response ) ) ? $response->get_error_message() : __( 'Login failed.', 'templately' );
	354	+ // The cloud's own wording stays server-side; the screen resolves
	355	+ // its copy from the code.
	356	+ $error_code = AuthErrorCode::INVALID_API_KEY;
316	357	}
317	358	} else {
318		- $error_message = __( 'Missing API Key.', 'templately' );
	359	+ $error_code = AuthErrorCode::AUTH_MISSING_API_KEY;
319	360	}
320	361
321	362	$redirect_url = add_query_arg( [
322		- 'templately_error' => 'login_failed',
323		- 'error_message' => urlencode( $error_message ),
	363	+ 'templately_error' => $error_code,
324	364	], $redirect_url );
325	365
326	366	wp_safe_redirect( $redirect_url );
327	367	exit;