subscriptions->subscribe( $email, $subject_type, $subject_id ); $this->redirect( 'senti_subscription_pending' ); } catch ( SubscriptionException ) { $this->redirect( 'senti_subscription_error' ); } } /** * @internal */ public function verify(): void { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The verification link's opaque, single-use token authorizes this public action. $verified = $this->subscriptions->verify( isset( $_GET['token'] ) && is_string( $_GET['token'] ) ? sanitize_text_field( wp_unslash( $_GET['token'] ) ) : '' ); $this->redirect( $verified ? 'senti_subscription_verified' : 'senti_subscription_error' ); } /** * @internal */ public function unsubscribe(): void { if ( ! isset( $_SERVER['REQUEST_METHOD'] ) || strtoupper( sanitize_text_field( wp_unslash( $_SERVER['REQUEST_METHOD'] ) ) ) !== 'POST' ) { // Mail scanners often open links automatically; only show a confirmation form on GET. // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The opaque token only authorizes rendering a confirmation form. $token = isset( $_GET['token'] ) && is_string( $_GET['token'] ) ? sanitize_text_field( wp_unslash( $_GET['token'] ) ) : ''; if ( ! $this->subscriptions->unsubscribe_token_is_valid( $token ) ) { $this->redirect( 'senti_subscription_error' ); } $form = '

'; $form .= wp_nonce_field( 'senti_unsubscribe', '_wpnonce', true, false ); $form .= '' . esc_html__( 'Unsubscribe', 'senti-feedback' ) . '

'; wp_die( wp_kses( $form, [ 'form' => [ 'method' => true, 'action' => true, ], 'input' => [ 'type' => true, 'name' => true, 'value' => true, 'id' => true, ], 'button' => [ 'type' => true ], ] ), esc_html__( 'Unsubscribe from updates', 'senti-feedback' ) ); } check_admin_referer( 'senti_unsubscribe' ); $token = isset( $_POST['token'] ) && is_string( $_POST['token'] ) ? sanitize_text_field( wp_unslash( $_POST['token'] ) ) : ''; $unsubscribed = $this->subscriptions->unsubscribe( $token ); $this->redirect( $unsubscribed ? 'senti_unsubscribed' : 'senti_subscription_error' ); } private function redirect( string $notice ): void { $referer = wp_get_referer(); $url = is_string( $referer ) ? $referer : home_url( '/' ); wp_safe_redirect( add_query_arg( $notice, '1', $url ) ); exit; } }