Endpoint.php
171 lines
| 1 | <?php |
| 2 | /** |
| 3 | * Email unsubscribes Endpoint class file. |
| 4 | */ |
| 5 | |
| 6 | declare( strict_types = 1 ); |
| 7 | |
| 8 | namespace Automattic\WooCommerce\Internal\Email\Unsubscribes; |
| 9 | |
| 10 | /** |
| 11 | * Public-facing endpoint that handles the unsubscribe links embedded in |
| 12 | * customer emails. |
| 13 | * |
| 14 | * URL shape: `?wc-email-unsubscribe=<order_id>&kind=<email_kind>&email_hash=<sha256>&sig=<hmac>` |
| 15 | * |
| 16 | * Signature: HMAC-SHA-256 of `"{order_id}|{email_hash}|{kind}"` using |
| 17 | * `wp_salt('nonce')` as the key. The kind is part of the payload so a link |
| 18 | * issued for one email type can't be replayed to opt out of another. |
| 19 | * |
| 20 | * No expiry on the link — CAN-SPAM expects unsubscribes to remain valid. |
| 21 | * |
| 22 | * @internal Just for internal use. |
| 23 | * |
| 24 | * @since 11.0.0 |
| 25 | */ |
| 26 | class Endpoint { |
| 27 | |
| 28 | /** |
| 29 | * Query var carrying the order id. The presence of this var is what |
| 30 | * triggers the endpoint; the value is informational only (lookup is by |
| 31 | * email hash + kind, not order). |
| 32 | */ |
| 33 | public const QUERY_VAR = 'wc-email-unsubscribe'; |
| 34 | |
| 35 | /** |
| 36 | * Query var carrying the SHA-256 hash of the recipient's normalized email. |
| 37 | */ |
| 38 | public const QUERY_VAR_HASH = 'email_hash'; |
| 39 | |
| 40 | /** |
| 41 | * Storage layer. |
| 42 | * |
| 43 | * @var Storage |
| 44 | */ |
| 45 | private Storage $storage; |
| 46 | |
| 47 | /** |
| 48 | * Container-injected dependencies. |
| 49 | * |
| 50 | * @internal |
| 51 | * |
| 52 | * @param Storage $storage Storage layer. |
| 53 | */ |
| 54 | final public function init( Storage $storage ): void { |
| 55 | $this->storage = $storage; |
| 56 | add_action( 'template_redirect', array( $this, 'maybe_handle' ) ); |
| 57 | } |
| 58 | |
| 59 | /** |
| 60 | * Build the URL the email's unsubscribe link should point to. |
| 61 | * |
| 62 | * The raw email is hashed before it ever lands in the URL — see the class |
| 63 | * docblock for why. Callers pass the raw address (so the API stays |
| 64 | * ergonomic and signing stays in one place), but the rendered link only |
| 65 | * contains the hash. |
| 66 | * |
| 67 | * @param int $order_id Order id (informational; lookup is by email hash + kind). |
| 68 | * @param string $email Billing email. |
| 69 | * @param string $kind Email-kind identifier (the email class's `$this->id`). |
| 70 | * @return string |
| 71 | */ |
| 72 | public static function url_for( int $order_id, string $email, string $kind ): string { |
| 73 | $hash = Storage::hash_email( $email ); |
| 74 | if ( '' === $hash ) { |
| 75 | return ''; |
| 76 | } |
| 77 | $sig = self::sign( $order_id, $hash, $kind ); |
| 78 | |
| 79 | return add_query_arg( |
| 80 | array( |
| 81 | self::QUERY_VAR => $order_id, |
| 82 | 'kind' => $kind, |
| 83 | self::QUERY_VAR_HASH => $hash, |
| 84 | 'sig' => $sig, |
| 85 | ), |
| 86 | home_url( '/' ) |
| 87 | ); |
| 88 | } |
| 89 | |
| 90 | /** |
| 91 | * Fired on `template_redirect`. Quick-bail when the query var is absent so |
| 92 | * normal requests are unaffected. |
| 93 | * |
| 94 | * @internal |
| 95 | */ |
| 96 | public function maybe_handle(): void { |
| 97 | // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- signature replaces nonce here; verified below. |
| 98 | if ( ! isset( $_GET[ self::QUERY_VAR ] ) ) { |
| 99 | return; |
| 100 | } |
| 101 | |
| 102 | // phpcs:disable WordPress.Security.NonceVerification.Recommended -- signature verified below. |
| 103 | $order_id = absint( $_GET[ self::QUERY_VAR ] ); |
| 104 | $kind = isset( $_GET['kind'] ) ? sanitize_key( wp_unslash( $_GET['kind'] ) ) : ''; |
| 105 | $hash = isset( $_GET[ self::QUERY_VAR_HASH ] ) ? sanitize_text_field( wp_unslash( $_GET[ self::QUERY_VAR_HASH ] ) ) : ''; |
| 106 | $sig = isset( $_GET['sig'] ) ? sanitize_text_field( wp_unslash( $_GET['sig'] ) ) : ''; |
| 107 | // phpcs:enable |
| 108 | |
| 109 | // Reject anything that doesn't match `Storage::HASH_PATTERN` before we |
| 110 | // even hash-compare — a malformed hash can't possibly verify, and the |
| 111 | // shared constant means the endpoint and storage agree on what valid |
| 112 | // means. |
| 113 | if ( '' === $hash || '' === $kind || '' === $sig || 1 !== preg_match( Storage::HASH_PATTERN, $hash ) || ! self::verify( $order_id, $hash, $kind, $sig ) ) { |
| 114 | $this->render_invalid(); |
| 115 | return; |
| 116 | } |
| 117 | |
| 118 | $this->storage->mark_unsubscribed_by_hash( $hash, $kind ); |
| 119 | $this->render_unsubscribed(); |
| 120 | } |
| 121 | |
| 122 | /** |
| 123 | * Compute the HMAC signature for a (order, hash, kind) triple. |
| 124 | * |
| 125 | * @param int $order_id Order id. |
| 126 | * @param string $hash SHA-256 hash of the normalized email. |
| 127 | * @param string $kind Email-kind identifier. |
| 128 | * @return string Hex digest. |
| 129 | */ |
| 130 | private static function sign( int $order_id, string $hash, string $kind ): string { |
| 131 | return hash_hmac( 'sha256', $order_id . '|' . $hash . '|' . $kind, wp_salt( 'nonce' ) ); |
| 132 | } |
| 133 | |
| 134 | /** |
| 135 | * Constant-time signature verification. |
| 136 | * |
| 137 | * @param int $order_id Order id from the URL. |
| 138 | * @param string $hash Email hash from the URL (already shape-validated). |
| 139 | * @param string $kind Kind from the URL (sanitized). |
| 140 | * @param string $signature Signature from the URL. |
| 141 | * @return bool |
| 142 | */ |
| 143 | private static function verify( int $order_id, string $hash, string $kind, string $signature ): bool { |
| 144 | $expected = self::sign( $order_id, $hash, $kind ); |
| 145 | return hash_equals( $expected, $signature ); |
| 146 | } |
| 147 | |
| 148 | /** |
| 149 | * Render the "you've been unsubscribed" page. |
| 150 | */ |
| 151 | private function render_unsubscribed(): void { |
| 152 | wp_die( |
| 153 | wp_kses_post( '<p>' . esc_html__( 'You won\'t receive any more of these emails from us.', 'woocommerce' ) . '</p>' ), |
| 154 | esc_html__( 'Unsubscribed', 'woocommerce' ), |
| 155 | array( 'response' => 200 ) |
| 156 | ); |
| 157 | } |
| 158 | |
| 159 | /** |
| 160 | * Render the "we couldn't verify this link" page. Same status code as |
| 161 | * success so the response shape doesn't leak whether the email exists. |
| 162 | */ |
| 163 | private function render_invalid(): void { |
| 164 | wp_die( |
| 165 | wp_kses_post( '<p>' . esc_html__( 'This unsubscribe link could not be verified. It may have been altered or copied incompletely.', 'woocommerce' ) . '</p>' ), |
| 166 | esc_html__( 'Link not valid', 'woocommerce' ), |
| 167 | array( 'response' => 200 ) |
| 168 | ); |
| 169 | } |
| 170 | } |
| 171 |