webfinger / includes / class-admin.php

class-admin.php in WebFinger trunk, at includes/class-admin.php

157 lines 4.4 KB

Raw Download Zip

1	<?php
2	/**
3	* Admin class file.
4	*
5	* @package Webfinger
6	*/
7
8	namespace Webfinger;
9
10	/**
11	* Admin class.
12	*
13	* Handles the registration of WordPress hooks and user profile settings
14	* for the Webfinger plugin admin functionality.
15	*
16	* This class adds custom fields to user profiles, manages their saving,
17	* and validates user meta related to Webfinger resources.
18	*/
19	class Admin {
20
21	/**
22	* Initialize the class, registering WordPress hooks.
23	*/
24	public static function init() {
25	\add_action( 'show_user_profile', array( static::class, 'add_profile' ) );
26	\add_action( 'edit_user_profile', array( static::class, 'add_profile' ) );
27
28	// Add the save action to user's own profile editing screen update.
29	\add_action(
30	'personal_options_update',
31	array( static::class, 'update_user_meta' )
32	);
33
34	// Add the save action to user profile editing screen update.
35	\add_action(
36	'edit_user_profile_update',
37	array( static::class, 'update_user_meta' )
38	);
39
40	\add_filter(
41	'user_profile_update_errors',
42	array( static::class, 'maybe_show_errors' ),
43	10,
44	3
45	);
46	}
47
48	/**
49	* Load settings template.
50	*
51	* @param \WP_User $user The WordPress user.
52	*
53	* @return void
54	*/
55	public static function add_profile( $user ) {
56	\load_template( WEBFINGER_PLUGIN_DIR . 'templates/profile-settings.php', true, array( 'user' => $user ) );
57	}
58
59	/**
60	* The save action.
61	*
62	* @param int $user_id The ID of the current user.
63	*
64	* @return bool\|string Meta ID if the key didn't exist, true on successful update, false on failure.
65	*/
66	public static function update_user_meta( $user_id ) {
67	// Check that the current user have the capability to edit the $user_id.
68	if ( ! \current_user_can( 'edit_user', $user_id ) ) {
69	return false;
70	}
71
72	// Verify nonce to prevent CSRF.
73	$nonce = isset( $_POST['webfinger_profile_nonce'] ) ? \sanitize_text_field( \wp_unslash( $_POST['webfinger_profile_nonce'] ) ) : '';
74	if ( empty( $nonce ) \|\| ! \wp_verify_nonce( $nonce, 'webfinger_profile_settings' ) ) {
75	return false;
76	}
77
78	if ( ! isset( $_POST['webfinger_resource'] ) ) {
79	return false;
80	}
81	if ( empty( $_POST['webfinger_resource'] ) ) {
82	\delete_user_meta( $user_id, 'webfinger_resource' );
83	return false;
84	}
85
86	$webfinger = \sanitize_title( \wp_unslash( $_POST['webfinger_resource'] ) );
87	$valid = self::is_valid_webfinger_resource( $webfinger, $user_id );
88
89	if ( ! $valid ) {
90	return false;
91	}
92
93	// Create/update user meta for the $user_id.
94	\update_user_meta(
95	$user_id,
96	'webfinger_resource',
97	$webfinger
98	);
99
100	return $webfinger;
101	}
102
103	/**
104	* Check if an error should be shown.
105	*
106	* @param \WP_Error $errors WP_Error object (passed by reference).
107	* @param bool $update Whether this is a user update.
108	* @param \WP_User $user User object (passed by reference).
109	*
110	* @return \WP_Error Updated list of errors.
111	*/
112	public static function maybe_show_errors( $errors, $update, $user ) {
113	// Verify nonce for CSRF protection.
114	$nonce = isset( $_POST['webfinger_profile_nonce'] ) ? \sanitize_text_field( \wp_unslash( $_POST['webfinger_profile_nonce'] ) ) : '';
115	if ( empty( $nonce ) \|\| ! \wp_verify_nonce( $nonce, 'webfinger_profile_settings' ) ) {
116	return $errors;
117	}
118	if ( ! isset( $_POST['webfinger_resource'] ) ) {
119	return $errors;
120	}
121
122	$webfinger_resource = \sanitize_text_field( \wp_unslash( $_POST['webfinger_resource'] ) );
123	$valid = self::is_valid_webfinger_resource( $webfinger_resource, $user->ID );
124
125	if ( ! $valid ) {
126	$errors->add( 'webfinger_resource', \__( 'WebFinger resource is already in use by a different user', 'webfinger' ) );
127	}
128
129	return $errors;
130	}
131
132	/**
133	* Check if the WebFinger resource is valid.
134	*
135	* @param string $webfinger_resource The WebFinger resource.
136	* @param int $user_id The user ID.
137	*
138	* @return bool True if valid, false otherwise.
139	*/
140	public static function is_valid_webfinger_resource( $webfinger_resource, $user_id ) {
141	$webfinger = \sanitize_title( $webfinger_resource, true );
142
143	$args = array(
144	'meta_key' => 'webfinger_resource', // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_key
145	'meta_value' => $webfinger, // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_value
146	'meta_compare' => '=',
147	'exclude' => $user_id,
148	);
149
150	// Check if already exists.
151	$user_query = new \WP_User_Query( $args );
152	$results = $user_query->get_results();
153
154	return empty( $results );
155	}
156	}
157