yatra / app / Shortcodes / LoginShortcode.php

LoginShortcode.php in Yatra – Travel Booking & Tour Operator Software 3.0.13, at app/Shortcodes/LoginShortcode.php

230 lines 7.9 KB

Raw Download Zip

1	<?php
2
3	declare(strict_types=1);
4
5	namespace Yatra\Shortcodes;
6
7	use Yatra\Services\SettingsService;
8
9	/**
10	* Login Shortcode
11	*
12	* Displays customer login form
13	*/
14	class LoginShortcode extends BaseShortcode
15	{
16	public function __construct()
17	{
18	parent::__construct('yatra_login', [
19	'show_register' => 'yes',
20	'show_forgot_password' => 'yes',
21	'redirect_url' => '',
22	'remember_me' => 'yes',
23	'title' => 'Customer Login',
24	'subtitle' => 'Login to access your bookings and account'
25	]);
26
27	// Enqueue assets
28	add_action('wp_enqueue_scripts', [$this, 'enqueueAssets']);
29	}
30
31	/**
32	* Enqueue shortcode-specific assets
33	*/
34	public function enqueueAssets(): void
35	{
36	// Only enqueue assets if shortcode is present on the page
37	global $post;
38	if (!$post \|\| !has_shortcode($post->post_content, 'yatra_login') && !is_page_template('login-page.php')) {
39	return;
40	}
41
42	// Enqueue CSS
43	wp_enqueue_style(
44	'yatra-login-shortcode',
45	YATRA_PLUGIN_URL . 'assets/css/shortcodes/login-shortcode.css',
46	[],
47	YATRA_VERSION
48	);
49
50	// Enqueue JavaScript
51	wp_enqueue_script(
52	'yatra-login-shortcode',
53	YATRA_PLUGIN_URL . 'assets/js/login-shortcode.js',
54	['jquery', 'wp-i18n'],
55	YATRA_VERSION,
56	true
57	);
58	if (function_exists('wp_set_script_translations')) {
59	wp_set_script_translations(
60	'yatra-login-shortcode',
61	'yatra',
62	YATRA_PLUGIN_PATH . 'i18n/languages'
63	);
64	}
65
66	// Localize script for AJAX with security and debugging
67	wp_localize_script('yatra-login-shortcode', 'yatra_ajax', [
68	'ajax_url' => admin_url('admin-ajax.php'),
69	'nonce' => wp_create_nonce('yatra_login_nonce'),
70	'rest_url' => esc_url_raw(rest_url('yatra/v1')),
71	'rest_nonce' => wp_create_nonce('wp_rest'),
72	'debug' => defined('WP_DEBUG') && WP_DEBUG,
73	'strings' => [
74	'login_error' => __('Login failed. Please try again.', 'yatra'),
75	'network_error' => __('Network error. Please check your connection.', 'yatra'),
76	'validation_error' => __('Please fill in all required fields.', 'yatra')
77	]
78	]);
79	}
80
81	/**
82	* Render the login shortcode content
83	*/
84	protected function renderContent(array $atts): string
85	{
86	$atts = shortcode_atts($this->default_attributes, $atts, $this->tag);
87
88	// Sanitize and validate attributes
89	$atts = $this->sanitizeAttributes($atts);
90
91	// Translate the built-in default title/subtitle at render time. The
92	// defaults are stored as raw English in the constructor because __()
93	// must not run that early (before init) — doing so triggers WordPress's
94	// just-in-time textdomain notice. A custom title/subtitle set by the
95	// operator on the shortcode passes through unchanged.
96	if ($atts['title'] === 'Customer Login') {
97	$atts['title'] = __('Customer Login', 'yatra');
98	}
99	if ($atts['subtitle'] === 'Login to access your bookings and account') {
100	$atts['subtitle'] = __('Login to access your bookings and account', 'yatra');
101	}
102
103	// Check if user is already logged in
104	if (is_user_logged_in()) {
105	return $this->renderLoggedInMessage($atts);
106	}
107
108	// Set secure redirect URL
109	$redirect_url = $this->getSecureRedirectUrl($atts['redirect_url']);
110
111	// Make variables available to template
112	set_query_var('yatra_login_atts', $atts);
113	set_query_var('yatra_redirect_url', $redirect_url);
114
115	// Load the login template with error handling
116	$template_path = YATRA_PLUGIN_PATH . 'templates/shortcodes/login.php';
117
118	if (!file_exists($template_path)) {
119	return $this->renderFallbackError();
120	}
121
122	ob_start();
123	try {
124	include $template_path;
125	$content = ob_get_clean();
126	} catch (\Exception $e) {
127	ob_end_clean();
128
129	$content = $this->renderFallbackError();
130	}
131
132	// Clean up query vars
133	set_query_var('yatra_login_atts', null);
134	set_query_var('yatra_redirect_url', null);
135
136	return $content;
137	}
138
139	/**
140	* Render message for logged in users
141	*/
142	private function renderLoggedInMessage(array $atts): string
143	{
144	$user = wp_get_current_user();
145	$account_url = home_url('/' . SettingsService::getAccountBase());
146
147	ob_start();
148	?>
149	<div class="yatra-login-logged-in">
150	<div class="yatra-logged-in-content">
151	<div class="yatra-logged-in-icon">
152	<?php echo yatra_svg_icon('user', 'yatra-logged-in-icon-svg'); ?>
153	</div>
154	<h3><?php esc_html_e('Already Logged In', 'yatra'); ?></h3>
155	<p>
156	<?php
157	printf(
158	/* translators: %s: logged-in user's display name. */
159	esc_html__('You are logged in as %s.', 'yatra'),
160	'<strong>' . esc_html($user->display_name) . '</strong>'
161	);
162	?>
163	</p>
164	<div class="yatra-logged-in-actions">
165	<a href="<?php echo esc_url($account_url); ?>" class="yatra-btn yatra-btn-primary">
166	<?php esc_html_e('My Account', 'yatra'); ?>
167	</a>
168	<a href="<?php echo esc_url(wp_logout_url(get_permalink())); ?>" class="yatra-btn yatra-btn-outline">
169	<?php esc_html_e('Logout', 'yatra'); ?>
170	</a>
171	</div>
172	</div>
173	</div>
174	<?php
175	return ob_get_clean();
176	}
177
178	/**
179	* Sanitize and validate shortcode attributes
180	*/
181	private function sanitizeAttributes(array $atts): array
182	{
183	return [
184	'show_register' => in_array($atts['show_register'], ['yes', 'no'], true) ? $atts['show_register'] : 'yes',
185	'show_forgot_password' => in_array($atts['show_forgot_password'], ['yes', 'no'], true) ? $atts['show_forgot_password'] : 'yes',
186	'redirect_url' => sanitize_url($atts['redirect_url'] ?? ''),
187	'remember_me' => in_array($atts['remember_me'], ['yes', 'no'], true) ? $atts['remember_me'] : 'yes',
188	'title' => sanitize_text_field($atts['title'] ?? 'Customer Login'),
189	'subtitle' => sanitize_text_field($atts['subtitle'] ?? 'Login to access your bookings and account')
190	];
191	}
192
193	/**
194	* Get secure redirect URL
195	*/
196	private function getSecureRedirectUrl(string $redirect_url): string
197	{
198	if (!empty($redirect_url)) {
199	// Validate URL is safe
200	if (wp_http_validate_url($redirect_url)) {
201	$redirect_host = parse_url($redirect_url, PHP_URL_HOST);
202	$site_host = parse_url(home_url(), PHP_URL_HOST);
203
204	// Only allow redirects to same host
205	if ($redirect_host === $site_host) {
206	return $redirect_url;
207	}
208	}
209	}
210
211	// Default: always send users to the account area after login.
212	// Avoid wp_get_referer() here to prevent redirect loops back to the login form.
213	return home_url('/' . SettingsService::getAccountBase());
214	}
215
216	/**
217	* Render fallback error message
218	*/
219	private function renderFallbackError(): string
220	{
221	ob_start();
222	?>
223	<div class="yatra-login-error">
224	<p><?php esc_html_e('Login form is currently unavailable. Please try again later.', 'yatra'); ?></p>
225	</div>
226	<?php
227	return ob_get_clean();
228	}
229	}
230