'
. '' . esc_html(citami_t('Collega con un clic', 'Connect with one click')) . ' '
. '' . esc_html(citami_t('Entri (o crei un account gratuito con la tua mail) e la chiave arriva da sola.', 'Sign in (or create a free account with your email) and the key arrives by itself.')) . '';
}
/** The start goes through admin-post, so the state is made only on a click. */
function citami_connect_start() {
if (!current_user_can('manage_options')) wp_die(esc_html(citami_t('Permesso negato.', 'Permission denied.')));
check_admin_referer('citami_connect_start');
// phpcs:ignore WordPress.Security.SafeRedirect.wp_redirect_wp_redirect -- the dashboard is on the brand's own domain, outside this site
wp_redirect(citami_connect_url());
exit;
}
add_action('admin_post_citami_connect_start', 'citami_connect_start');
/**
* Back from the dashboard with ?citeproof_code=…&state=…: the state must be
* the one this site made; the code is traded for the key and saved.
* Returns the notice shown to the owner (null when the request is not ours).
*/
function citami_connect_finish(array $query) {
if (!isset($query['citeproof_code'], $query['state'])) return null;
if (!current_user_can('manage_options')) return null;
$code = sanitize_text_field((string) $query['citeproof_code']);
$state = sanitize_text_field((string) $query['state']);
$expected = get_transient(CITAMI_CONNECT_STATE);
delete_transient(CITAMI_CONNECT_STATE);
if (!is_string($expected) || $expected === '' || !hash_equals($expected, $state)) {
return array('type' => 'error', 'message' => citami_t('Collegamento non valido o scaduto: premi di nuovo «Collega con un clic».', 'Invalid or expired connection: press "Connect with one click" again.'));
}
$res = wp_remote_post(citami_get_endpoint() . '/api/plugin/connect', array(
'timeout' => 15,
'headers' => array('Content-Type' => 'application/json'),
'body' => wp_json_encode(array('code' => $code, 'site' => home_url('/'), 'woocommerce' => class_exists('WooCommerce'))),
));
$status = is_wp_error($res) ? 0 : (int) wp_remote_retrieve_response_code($res);
$body = is_wp_error($res) ? null : json_decode((string) wp_remote_retrieve_body($res), true);
$key = is_array($body) && isset($body['api_key']) ? (string) $body['api_key'] : '';
if ($status !== 200 || strpos($key, 'ctm_') !== 0) {
return array('type' => 'error', 'message' => citami_t('Il collegamento non è riuscito: riprova, oppure incolla la chiave a mano.', 'The connection did not go through: try again, or paste the key by hand.'));
}
update_option('citami_api_key', $key);
if (function_exists('citami_health_ping')) citami_health_ping();
// 2.77.0 — what the account already knows (a sheet filled in the dashboard) prefills "Your business".
if (function_exists('citami_sync_pull_handler')) citami_sync_pull_handler();
if (function_exists('citami_setup_mark')) citami_setup_mark('connect');
return array('type' => 'success', 'message' => citami_t('Collegato. La chiave è stata salvata da sola.', 'Connected. The key was saved by itself.'));
}
add_action('admin_init', function () {
// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- the one-time state (transient, hash_equals) is the check
if (!isset($_GET['page'], $_GET['citeproof_code']) || $_GET['page'] !== 'citami-connector') return;
// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- see above
$notice = citami_connect_finish(wp_unslash($_GET));
if ($notice === null) return;
set_transient('citami_action_notice', $notice, 30);
wp_safe_redirect($notice['type'] === 'success' && function_exists('citami_setup_url') ? citami_setup_url(2) : citami_connect_return_url());
exit;
});