' . esc_html__( 'Settings', 'hemero' ) . '' );
return $links;
}
public static function page_url( $notice = '' ) {
$url = admin_url( 'options-general.php?page=' . self::PAGE );
return $notice ? add_query_arg( 'hemero_notice', $notice, $url ) : $url;
}
private static function guard( $nonce_action ) {
if ( ! current_user_can( 'manage_options' ) ) {
wp_die( esc_html__( 'You are not allowed to do this.', 'hemero' ), 403 );
}
check_admin_referer( $nonce_action );
}
/** Step 1: off to Hemero to confirm the connection. */
public static function connect() {
self::guard( 'hemero_connect' );
$state = wp_generate_password( 40, false, false );
set_transient( 'hemero_state_' . $state, get_current_user_id(), 15 * MINUTE_IN_SECONDS );
$payload = array(
'site' => Hemero_Client::site_url(),
'name' => wp_strip_all_tags( get_bloginfo( 'name' ) ),
'return' => admin_url( 'admin-post.php?action=hemero_connect_return' ),
'state' => $state,
);
$encoded = rtrim( strtr( base64_encode( wp_json_encode( $payload ) ), '+/', '-_' ), '=' );
// Hemero is on another host, so wp_safe_redirect does not apply
wp_redirect( untrailingslashit( HEMERO_APP_URL ) . '/integrations?wordpress=' . rawurlencode( $encoded ) ); // phpcs:ignore WordPress.Security.SafeRedirect.wp_redirect_wp_redirect
exit;
}
/** Step 2: back from Hemero with ?code&state; exchange the code for the site key. */
public static function connect_return() {
if ( ! current_user_can( 'manage_options' ) ) {
wp_die( esc_html__( 'You are not allowed to do this.', 'hemero' ), 403 );
}
// phpcs:disable WordPress.Security.NonceVerification.Recommended -- the random state (bound to this user) plays the nonce's role
$state = isset( $_GET['state'] ) ? sanitize_text_field( wp_unslash( $_GET['state'] ) ) : '';
$code = isset( $_GET['code'] ) ? sanitize_text_field( wp_unslash( $_GET['code'] ) ) : '';
// phpcs:enable
$owner = $state ? get_transient( 'hemero_state_' . $state ) : false;
if ( ! $code || (int) $owner !== get_current_user_id() ) {
wp_safe_redirect( self::page_url( 'expired' ) );
exit;
}
delete_transient( 'hemero_state_' . $state );
$result = Hemero_Client::request( 'POST', '/exchange', array( 'code' => $code, 'site' => Hemero_Client::site_url() ), false );
if ( is_wp_error( $result ) || empty( $result['key'] ) ) {
wp_safe_redirect( self::page_url( 'failed' ) );
exit;
}
update_option( Hemero_Client::KEY_OPTION, sanitize_text_field( $result['key'] ), false );
update_option( Hemero_Client::ORG_OPTION, sanitize_text_field( (string) ( $result['organization'] ?? '' ) ), false );
delete_option( Hemero_Client::INVALID_OPTION );
Hemero_Client::site( true );
wp_safe_redirect( self::page_url( 'connected' ) );
exit;
}
public static function save() {
self::guard( 'hemero_save' );
$forms = Hemero_Client::forms();
// phpcs:disable WordPress.Security.NonceVerification.Missing -- checked in guard()
$popup = isset( $_POST['popup_form'] ) ? sanitize_text_field( wp_unslash( $_POST['popup_form'] ) ) : '';
$list = isset( $_POST['list'] ) ? sanitize_text_field( wp_unslash( $_POST['list'] ) ) : '';
$woo = ! empty( $_POST['woo_opt_in'] );
$label = isset( $_POST['woo_label'] ) ? sanitize_text_field( wp_unslash( $_POST['woo_label'] ) ) : '';
// phpcs:enable
$body = array(
'popupFormId' => isset( $forms[ $popup ] ) ? $popup : null,
'wooOptIn' => $woo,
);
if ( '' !== $list && Hemero_Client::valid_form_id( $list ) ) {
$body['listId'] = $list;
}
update_option( self::LABEL_OPTION, $label, false );
$result = Hemero_Client::request( 'POST', '/settings', $body );
Hemero_Client::forget_site();
wp_safe_redirect( self::page_url( is_wp_error( $result ) ? 'failed' : 'saved' ) );
exit;
}
public static function disconnect() {
self::guard( 'hemero_disconnect' );
Hemero_Client::request( 'POST', '/disconnect', array() );
Hemero_Client::disconnect_locally();
wp_safe_redirect( self::page_url( 'disconnected' ) );
exit;
}
/** Checkbox text at checkout (the shopper's consent). */
public static function woo_label() {
$label = (string) get_option( self::LABEL_OPTION, '' );
return '' !== $label ? $label : __( 'Subscribe to our newsletter', 'hemero' );
}
private static function notice() {
// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- display only
$key = isset( $_GET['hemero_notice'] ) ? sanitize_key( wp_unslash( $_GET['hemero_notice'] ) ) : '';
$messages = array(
'connected' => array( 'success', __( 'This site is connected to Hemero.', 'hemero' ) ),
'saved' => array( 'success', __( 'Settings saved.', 'hemero' ) ),
'disconnected' => array( 'success', __( 'This site is no longer connected to Hemero.', 'hemero' ) ),
'expired' => array( 'error', __( 'The connection expired. Click Connect again.', 'hemero' ) ),
'failed' => array( 'error', __( 'Hemero could not be reached. Please try again.', 'hemero' ) ),
);
if ( isset( $messages[ $key ] ) ) {
printf( '', esc_attr( $messages[ $key ][0] ), esc_html( $messages[ $key ][1] ) );
}
}
public static function render() {
if ( ! current_user_can( 'manage_options' ) ) {
return;
}
// ask Hemero first: a key revoked there flips the page back to "Connect"
$site = Hemero_Client::connected() ? Hemero_Client::site( true ) : null;
$connected = Hemero_Client::connected();
echo 'Hemero
';
self::notice();
if ( ! $connected ) {
self::render_connect();
} else {
self::render_settings( $site );
}
echo '';
}
private static function render_connect() {
$was_connected = Hemero_Client::has_key();
?>
' . esc_html( $org ) . '' );
?>
| |
|---|
$name ) : ?>
|
[hemero_form id=""] |