1
|
|
|
<?php |
2
|
|
|
/** |
3
|
|
|
* Email Access |
4
|
|
|
* |
5
|
|
|
* @package Give |
6
|
|
|
* @subpackage Classes/Give_Email_Access |
7
|
|
|
* @copyright Copyright (c) 2016, GiveWP |
8
|
|
|
* @license https://opensource.org/licenses/gpl-license GNU Public License |
9
|
|
|
* @since 1.4 |
10
|
|
|
*/ |
11
|
|
|
|
12
|
|
|
// Exit if accessed directly. |
13
|
|
|
if ( ! defined( 'ABSPATH' ) ) { |
14
|
|
|
exit; |
15
|
|
|
} |
16
|
|
|
|
17
|
|
|
/** |
18
|
|
|
* Give_Email_Access class |
19
|
|
|
* |
20
|
|
|
* This class handles email access, allowing donors access to their donation w/o logging in; |
21
|
|
|
* |
22
|
|
|
* Based on the work from Matt Gibbs - https://github.com/FacetWP/edd-no-logins |
23
|
|
|
* |
24
|
|
|
* @since 1.0 |
25
|
|
|
*/ |
26
|
|
|
class Give_Email_Access { |
27
|
|
|
|
28
|
|
|
/** |
29
|
|
|
* Token exists |
30
|
|
|
* |
31
|
|
|
* @since 1.0 |
32
|
|
|
* @access public |
33
|
|
|
* |
34
|
|
|
* @var bool |
35
|
|
|
*/ |
36
|
|
|
public $token_exists = false; |
37
|
|
|
|
38
|
|
|
/** |
39
|
|
|
* Token email |
40
|
|
|
* |
41
|
|
|
* @since 1.0 |
42
|
|
|
* @access public |
43
|
|
|
* |
44
|
|
|
* @var bool |
45
|
|
|
*/ |
46
|
|
|
public $token_email = false; |
47
|
|
|
|
48
|
|
|
/** |
49
|
|
|
* Token |
50
|
|
|
* |
51
|
|
|
* @since 1.0 |
52
|
|
|
* @access public |
53
|
|
|
* |
54
|
|
|
* @var bool |
55
|
|
|
*/ |
56
|
|
|
public $token = false; |
57
|
|
|
|
58
|
|
|
/** |
59
|
|
|
* Error |
60
|
|
|
* |
61
|
|
|
* @since 1.0 |
62
|
|
|
* @access public |
63
|
|
|
* |
64
|
|
|
* @var string |
65
|
|
|
*/ |
66
|
|
|
public $error = ''; |
67
|
|
|
|
68
|
|
|
/** |
69
|
|
|
* Verify throttle |
70
|
|
|
* |
71
|
|
|
* @since 1.0 |
72
|
|
|
* @access public |
73
|
|
|
* |
74
|
|
|
* @var |
75
|
|
|
*/ |
76
|
|
|
public $verify_throttle; |
77
|
|
|
|
78
|
|
|
/** |
79
|
|
|
* Limit throttle |
80
|
|
|
* |
81
|
|
|
* @since 1.8.17 |
82
|
|
|
* @access public |
83
|
|
|
* |
84
|
|
|
* @var |
85
|
|
|
*/ |
86
|
|
|
public $limit_throttle; |
87
|
|
|
|
88
|
|
|
/** |
89
|
|
|
* Verify expiration |
90
|
|
|
* |
91
|
|
|
* @since 1.0 |
92
|
|
|
* @access private |
93
|
|
|
* |
94
|
|
|
* @var string |
95
|
|
|
*/ |
96
|
|
|
private $token_expiration; |
97
|
|
|
|
98
|
|
|
/** |
99
|
|
|
* Class Constructor |
100
|
|
|
* |
101
|
|
|
* Set up the Give Email Access Class. |
102
|
|
|
* |
103
|
|
|
* @since 1.0 |
104
|
|
|
* @access public |
105
|
|
|
*/ |
106
|
|
|
public function __construct() { |
107
|
|
|
|
108
|
|
|
// Get it started. |
109
|
|
|
add_action( 'wp', array( $this, 'setup' ) ); |
110
|
|
|
} |
111
|
|
|
|
112
|
|
|
/** |
113
|
|
|
* Setup hooks |
114
|
|
|
* |
115
|
|
|
* @since 2.4.0 |
116
|
|
|
*/ |
117
|
|
|
public function setup(){ |
118
|
|
|
|
119
|
|
|
$is_email_access_on_page = apply_filters( 'give_is_email_access_on_page', give_is_success_page() || give_is_history_page() ); |
120
|
|
|
|
121
|
|
|
if ( $is_email_access_on_page ){ |
122
|
|
|
// Get it started. |
123
|
|
|
add_action( 'wp', array( $this, 'init' ), 14 ); |
124
|
|
|
} |
125
|
|
|
} |
126
|
|
|
|
127
|
|
|
/** |
128
|
|
|
* Init |
129
|
|
|
* |
130
|
|
|
* Register defaults and filters |
131
|
|
|
* |
132
|
|
|
* @since 1.0 |
133
|
|
|
* @access public |
134
|
|
|
* |
135
|
|
|
* @return void |
136
|
|
|
*/ |
137
|
|
|
public function init() { |
138
|
|
|
|
139
|
|
|
// Bail Out, if user is logged in. |
140
|
|
|
if ( is_user_logged_in() ) { |
141
|
|
|
return; |
142
|
|
|
} |
143
|
|
|
|
144
|
|
|
// Are db columns setup? |
145
|
|
|
$column_exists = Give()->donors->does_column_exist( 'token' ); |
146
|
|
|
if ( ! $column_exists ) { |
147
|
|
|
$this->create_columns(); |
148
|
|
|
} |
149
|
|
|
|
150
|
|
|
// Timeouts. |
151
|
|
|
$this->verify_throttle = apply_filters( 'give_nl_verify_throttle', 300 ); |
152
|
|
|
$this->limit_throttle = apply_filters( 'give_nl_limit_throttle', 3 ); |
153
|
|
|
$this->token_expiration = apply_filters( 'give_nl_token_expiration', 7200 ); |
154
|
|
|
|
155
|
|
|
// Setup login. |
156
|
|
|
$this->check_for_token(); |
157
|
|
|
|
158
|
|
|
if ( $this->token_exists ) { |
159
|
|
|
add_filter( 'give_user_pending_verification', '__return_false' ); |
160
|
|
|
add_filter( 'give_get_users_donations_args', array( $this, 'users_donations_args' ) ); |
161
|
|
|
} |
162
|
|
|
|
163
|
|
|
} |
164
|
|
|
|
165
|
|
|
/** |
166
|
|
|
* Prevent email spamming. |
167
|
|
|
* |
168
|
|
|
* @param int $donor_id Donor ID. |
169
|
|
|
* |
170
|
|
|
* @since 1.0 |
171
|
|
|
* @access public |
172
|
|
|
* |
173
|
|
|
* @return bool |
174
|
|
|
*/ |
175
|
|
|
public function can_send_email( $donor_id ) { |
176
|
|
|
|
177
|
|
|
$donor = Give()->donors->get_donor_by( 'id', $donor_id ); |
178
|
|
|
|
179
|
|
|
if ( is_object( $donor ) ) { |
180
|
|
|
|
181
|
|
|
$email_throttle_count = (int) give_get_meta( $donor_id, '_give_email_throttle_count', true ); |
182
|
|
|
|
183
|
|
|
$cache_key = "give_cache_email_throttle_limit_exhausted_{$donor_id}"; |
184
|
|
|
if ( |
185
|
|
|
$email_throttle_count < $this->limit_throttle && |
186
|
|
|
true !== Give_Cache::get( $cache_key ) |
187
|
|
|
) { |
188
|
|
|
give_update_meta( $donor_id, '_give_email_throttle_count', $email_throttle_count + 1 ); |
189
|
|
|
} else { |
190
|
|
|
give_update_meta( $donor_id, '_give_email_throttle_count', 0 ); |
191
|
|
|
Give_Cache::set( $cache_key, true, $this->verify_throttle ); |
192
|
|
|
return false; |
193
|
|
|
} |
|
|
|
|
194
|
|
|
|
195
|
|
|
} |
196
|
|
|
|
197
|
|
|
return true; |
198
|
|
|
} |
199
|
|
|
|
200
|
|
|
/** |
201
|
|
|
* Send the user's token |
202
|
|
|
* |
203
|
|
|
* @param int $donor_id Donor id. |
204
|
|
|
* @param string $email Donor email. |
205
|
|
|
* |
206
|
|
|
* @since 1.0 |
207
|
|
|
* @access public |
208
|
|
|
* |
209
|
|
|
* @return bool |
210
|
|
|
*/ |
211
|
|
|
public function send_email( $donor_id, $email ) { |
212
|
|
|
return apply_filters( 'give_email-access_email_notification', $donor_id, $email ); |
213
|
|
|
} |
214
|
|
|
|
215
|
|
|
/** |
216
|
|
|
* This function is used to fetch the token value from query string or cookies based on availability. |
217
|
|
|
* |
218
|
|
|
* @since 2.4.1 |
219
|
|
|
* @access public |
220
|
|
|
* |
221
|
|
|
* @return string |
222
|
|
|
*/ |
223
|
|
|
public function get_token() { |
224
|
|
|
|
225
|
|
|
$token = isset( $_GET['give_nl'] ) ? give_clean( $_GET['give_nl'] ) : ''; |
|
|
|
|
226
|
|
|
|
227
|
|
|
// Check for cookie. |
228
|
|
|
if ( empty( $token ) ) { |
229
|
|
|
$token = isset( $_COOKIE['give_nl'] ) ? give_clean( $_COOKIE['give_nl'] ) : ''; |
|
|
|
|
230
|
|
|
} |
231
|
|
|
|
232
|
|
|
return $token; |
233
|
|
|
} |
234
|
|
|
|
235
|
|
|
/** |
236
|
|
|
* Has the user authenticated? |
237
|
|
|
* |
238
|
|
|
* @since 1.0 |
239
|
|
|
* @access public |
240
|
|
|
* |
241
|
|
|
* @return bool |
242
|
|
|
*/ |
243
|
|
|
public function check_for_token() { |
244
|
|
|
|
245
|
|
|
$token = $this->get_token(); |
246
|
|
|
|
247
|
|
|
// Must have a token. |
248
|
|
|
if ( ! empty( $token ) ) { |
249
|
|
|
|
250
|
|
|
if ( ! $this->is_valid_token( $token ) ) { |
251
|
|
|
if ( ! $this->is_valid_verify_key( $token ) ) { |
252
|
|
|
return false; |
253
|
|
|
} |
254
|
|
|
} |
255
|
|
|
|
256
|
|
|
// Set Receipt Access Session. |
257
|
|
|
Give()->session->set( 'receipt_access', true ); |
258
|
|
|
$this->token_exists = true; |
259
|
|
|
// Set cookie. |
260
|
|
|
$lifetime = current_time( 'timestamp' ) + Give()->session->set_expiration_time(); |
261
|
|
|
@setcookie( 'give_nl', $token, $lifetime, COOKIEPATH, COOKIE_DOMAIN, false ); |
|
|
|
|
262
|
|
|
|
263
|
|
|
return true; |
264
|
|
|
} |
265
|
|
|
} |
266
|
|
|
|
267
|
|
|
/** |
268
|
|
|
* Is this a valid token? |
269
|
|
|
* |
270
|
|
|
* @since 1.0 |
271
|
|
|
* @access public |
272
|
|
|
* |
273
|
|
|
* @param $token string The token. |
274
|
|
|
* |
275
|
|
|
* @return bool |
276
|
|
|
*/ |
277
|
|
|
public function is_valid_token( $token ) { |
278
|
|
|
|
279
|
|
|
global $wpdb; |
280
|
|
|
|
281
|
|
|
// Make sure token isn't expired. |
282
|
|
|
$expires = date( 'Y-m-d H:i:s', time() - $this->token_expiration ); |
283
|
|
|
|
284
|
|
|
$email = $wpdb->get_var( |
|
|
|
|
285
|
|
|
$wpdb->prepare( "SELECT email FROM {$wpdb->donors} WHERE verify_key = %s AND verify_throttle >= %s LIMIT 1", $token, $expires ) |
286
|
|
|
); |
287
|
|
|
|
288
|
|
|
if ( ! empty( $email ) ) { |
289
|
|
|
$this->token_email = $email; |
290
|
|
|
$this->token = $token; |
291
|
|
|
return true; |
292
|
|
|
} |
293
|
|
|
|
294
|
|
|
// Set error only if email access form isn't being submitted. |
295
|
|
|
if ( |
296
|
|
|
! isset( $_POST['give_email'] ) && |
|
|
|
|
297
|
|
|
! isset( $_POST['_wpnonce'] ) |
|
|
|
|
298
|
|
|
) { |
299
|
|
|
give_set_error( 'give_email_token_expired', apply_filters( 'give_email_token_expired_message', __( 'Your access token has expired. Please request a new one.', 'give' ) ) ); |
300
|
|
|
} |
301
|
|
|
|
302
|
|
|
return false; |
303
|
|
|
|
304
|
|
|
} |
305
|
|
|
|
306
|
|
|
/** |
307
|
|
|
* Add the verify key to DB |
308
|
|
|
* |
309
|
|
|
* @param int $donor_id Donor id. |
310
|
|
|
* @param string $email Donor email. |
311
|
|
|
* @param string $verify_key The verification key. |
312
|
|
|
* |
313
|
|
|
* @since 1.0 |
314
|
|
|
* @access public |
315
|
|
|
* |
316
|
|
|
* @return void |
317
|
|
|
*/ |
318
|
|
|
public function set_verify_key( $donor_id, $email, $verify_key ) { |
|
|
|
|
319
|
|
|
global $wpdb; |
320
|
|
|
|
321
|
|
|
$now = date( 'Y-m-d H:i:s' ); |
322
|
|
|
|
323
|
|
|
// Insert or update? |
324
|
|
|
$row_id = (int) $wpdb->get_var( |
|
|
|
|
325
|
|
|
$wpdb->prepare( "SELECT id FROM {$wpdb->donors} WHERE id = %d LIMIT 1", $donor_id ) |
326
|
|
|
); |
327
|
|
|
|
328
|
|
|
// Update. |
329
|
|
|
if ( ! empty( $row_id ) ) { |
330
|
|
|
$wpdb->query( |
|
|
|
|
331
|
|
|
$wpdb->prepare( "UPDATE {$wpdb->donors} SET verify_key = %s, verify_throttle = %s WHERE id = %d LIMIT 1", $verify_key, $now, $row_id ) |
332
|
|
|
); |
333
|
|
|
} // Insert. |
334
|
|
|
else { |
335
|
|
|
$wpdb->query( |
|
|
|
|
336
|
|
|
$wpdb->prepare( "INSERT INTO {$wpdb->donors} ( verify_key, verify_throttle) VALUES (%s, %s)", $verify_key, $now ) |
337
|
|
|
); |
338
|
|
|
} |
339
|
|
|
} |
340
|
|
|
|
341
|
|
|
/** |
342
|
|
|
* Is this a valid verify key? |
343
|
|
|
* |
344
|
|
|
* @since 1.0 |
345
|
|
|
* @access public |
346
|
|
|
* |
347
|
|
|
* @param $token string The token. |
348
|
|
|
* |
349
|
|
|
* @return bool |
350
|
|
|
*/ |
351
|
|
|
public function is_valid_verify_key( $token ) { |
352
|
|
|
/* @var WPDB $wpdb */ |
353
|
|
|
global $wpdb; |
354
|
|
|
|
355
|
|
|
// See if the verify_key exists. |
356
|
|
|
$row = $wpdb->get_row( |
|
|
|
|
357
|
|
|
$wpdb->prepare( "SELECT id, email FROM {$wpdb->donors} WHERE verify_key = %s LIMIT 1", $token ) |
358
|
|
|
); |
359
|
|
|
|
360
|
|
|
$now = date( 'Y-m-d H:i:s' ); |
361
|
|
|
|
362
|
|
|
// Set token and remove verify key. |
363
|
|
|
if ( ! empty( $row ) ) { |
364
|
|
|
$wpdb->query( |
|
|
|
|
365
|
|
|
$wpdb->prepare( "UPDATE {$wpdb->donors} SET verify_key = '', token = %s, verify_throttle = %s WHERE id = %d LIMIT 1", $token, $now, $row->id ) |
366
|
|
|
); |
367
|
|
|
|
368
|
|
|
$this->token_email = $row->email; |
369
|
|
|
$this->token = $token; |
370
|
|
|
|
371
|
|
|
return true; |
372
|
|
|
} |
373
|
|
|
|
374
|
|
|
return false; |
375
|
|
|
} |
376
|
|
|
|
377
|
|
|
/** |
378
|
|
|
* Users donations args |
379
|
|
|
* |
380
|
|
|
* Force Give to find donations by email, not user ID. |
381
|
|
|
* |
382
|
|
|
* @since 1.0 |
383
|
|
|
* @access public |
384
|
|
|
* |
385
|
|
|
* @param $args array User Donations arguments. |
386
|
|
|
* |
387
|
|
|
* @return mixed |
388
|
|
|
*/ |
389
|
|
|
public function users_donations_args( $args ) { |
390
|
|
|
$args['user'] = $this->token_email; |
391
|
|
|
|
392
|
|
|
return $args; |
393
|
|
|
} |
394
|
|
|
|
395
|
|
|
/** |
396
|
|
|
* Create required columns |
397
|
|
|
* |
398
|
|
|
* Create the necessary columns for email access |
399
|
|
|
* |
400
|
|
|
* @since 1.0 |
401
|
|
|
* @access public |
402
|
|
|
* |
403
|
|
|
* @return void |
404
|
|
|
*/ |
405
|
|
|
public function create_columns() { |
406
|
|
|
|
407
|
|
|
global $wpdb; |
408
|
|
|
|
409
|
|
|
// Create columns in donors table. |
410
|
|
|
$wpdb->query( "ALTER TABLE {$wpdb->donors} ADD `token` VARCHAR(255) CHARACTER SET utf8 NOT NULL, ADD `verify_key` VARCHAR(255) CHARACTER SET utf8 NOT NULL AFTER `token`, ADD `verify_throttle` DATETIME NOT NULL AFTER `verify_key`" ); |
|
|
|
|
411
|
|
|
} |
412
|
|
|
} |
413
|
|
|
|