File Manager

Editing File: /usr/local/cpanel/3rdparty/wpinstaller/files/wpforms-lite/wpforms-lite/src/SetupWizard/RestApi.php

<?php

namespace WPForms\SetupWizard;

use WP_Error;
use WP_REST_Request;
use WP_REST_Response;
use WPForms\SetupChecklist\Page;
use WPForms\SetupWizard\Service\StateManager;

/**
 * Setup Wizard REST API.
 *
 * Exposes the endpoints the SPA calls back into:
 * - `GET  /hydrate`              Initial fetch of settings + wizard_settings.
 * - `POST /update`               Persist wizard step state.
 * - `POST /install-plugins`      License-gated install of addons/cross-product plugins.
 * - `POST /complete`             Finalize the wizard.
 * - `GET  /license/key`          Fetch the configured license key.
 * - `POST /license/verify`       Validate and activate a license key.
 *
 * Every route uses `validate_request()` as its `permission_callback`. The
 * permission callback also hydrates the bound user into the current request
 * via `wp_set_current_user()` so downstream calls behave as if the admin were
 * logged in on the WP host.
 *
 * @since 2.0.0
 */
class RestApi {

/**
	 * REST namespace.
	 *
	 * @since 2.0.0
	 *
	 * @var string
	 */
	private const ROUTE_NAMESPACE = 'wpforms/v1';

/**
	 * Route prefix shared by all wizard routes.
	 *
	 * @since 2.0.0
	 *
	 * @var string
	 */
	private const ROUTE_BASE = '/setup-wizard';

/**
	 * License API base URL, used when the Pro `WPFORMS_UPDATER_API` constant is
	 * not defined (i.e. in Lite).
	 *
	 * @since 2.0.0
	 *
	 * @var string
	 */
	private const LICENSE_API_URL_FALLBACK = 'https://wpformsapi.com/license/v1';

/**
	 * Minimum accepted license-key length (anti-abuse guard).
	 *
	 * @since 2.0.0
	 *
	 * @var int
	 */
	private const LICENSE_MIN_KEY_LENGTH = 16;

/**
	 * Maximum accepted license-key length (anti-abuse guard).
	 *
	 * @since 2.0.0
	 *
	 * @var int
	 */
	private const LICENSE_MAX_KEY_LENGTH = 255;

/**
	 * Auth service.
	 *
	 * @since 2.0.0
	 *
	 * @var Auth
	 */
	private $auth;

/**
	 * Setup Wizard state service.
	 *
	 * @since 2.0.0
	 *
	 * @var StateManager
	 */
	private $service;

/**
	 * Constructor.
	 *
	 * @since 2.0.0
	 *
	 * @param Auth         $auth    Auth service.
	 * @param StateManager $service State manager.
	 */
	public function __construct( Auth $auth, StateManager $service ) {

$this->auth    = $auth;
		$this->service = $service;
	}

/**
	 * Register REST routes.
	 *
	 * @since 2.0.0
	 */
	public function register_routes(): void {

$permission = [ $this, 'validate_request' ];

register_rest_route(
			self::ROUTE_NAMESPACE,
			self::ROUTE_BASE . '/hydrate',
			[
				'methods'             => 'GET',
				'callback'            => [ $this, 'hydrate' ],
				'permission_callback' => $permission,
			]
		);

register_rest_route(
			self::ROUTE_NAMESPACE,
			self::ROUTE_BASE . '/update',
			[
				'methods'             => 'POST',
				'callback'            => [ $this, 'update' ],
				'permission_callback' => $permission,
			]
		);

register_rest_route(
			self::ROUTE_NAMESPACE,
			self::ROUTE_BASE . '/install-plugins',
			[
				'methods'             => 'POST',
				'callback'            => [ $this, 'install_plugins' ],
				'permission_callback' => $permission,
				'args'                => [
					'plugins' => [
						'type'              => 'array',
						'required'          => true,
						'default'           => [],
						'items'             => [
							'type' => 'string',
						],
						'sanitize_callback' => [ $this, 'sanitize_plugin_files' ],
					],
				],
			]
		);

register_rest_route(
			self::ROUTE_NAMESPACE,
			self::ROUTE_BASE . '/complete',
			[
				'methods'             => 'POST',
				'callback'            => [ $this, 'complete' ],
				'permission_callback' => $permission,
				'args'                => [
					'outcome' => [
						'type'              => 'string',
						'default'           => 'build',
						'enum'              => [ 'build', 'import', 'exit', 'forms' ],
						'sanitize_callback' => 'sanitize_key',
					],
				],
			]
		);

register_rest_route(
			self::ROUTE_NAMESPACE,
			self::ROUTE_BASE . '/stripe/connect-url',
			[
				'methods'             => 'POST',
				'callback'            => [ $this, 'stripe_connect_url' ],
				'permission_callback' => $permission,
			]
		);

register_rest_route(
			self::ROUTE_NAMESPACE,
			self::ROUTE_BASE . '/license/key',
			[
				'methods'             => 'GET',
				'callback'            => [ $this, 'license_key' ],
				'permission_callback' => $permission,
			]
		);

register_rest_route(
			self::ROUTE_NAMESPACE,
			self::ROUTE_BASE . '/license/verify',
			[
				'methods'             => 'POST',
				'callback'            => [ $this, 'verify_license' ],
				'permission_callback' => $permission,
				'args'                => [
					'key' => [
						'type'              => 'string',
						'required'          => true,
						'sanitize_callback' => 'sanitize_text_field',
					],
				],
			]
		);
	}

/**
	 * Whether the current request is the Setup Wizard's install-plugins REST call.
	 *
	 * Evaluated as early as `wpforms_loaded`, before the REST route is dispatched
	 * and before the session is authenticated, so it matches the namespaced route
	 * against the request URI rather than relying on the REST dispatcher. Pretty
	 * permalinks carry the route in the URL path; plain permalinks carry it in the
	 * `rest_route` query var, so both forms are checked. The Addons handler reads
	 * this to load its addon and license data in this otherwise non-admin context;
	 * the install action itself stays gated by `validate_request()` and
	 * `wpforms_can_install()`.
	 *
	 * @since 2.0.0
	 *
	 * @return bool
	 */
	public static function is_install_request(): bool {

if ( ! wpforms_is_rest() ) {
			return false;
		}

$route = self::ROUTE_NAMESPACE . self::ROUTE_BASE . '/install-plugins';

// Plain permalinks route REST through the `rest_route` query var
		// (e.g. `/index.php?rest_route=/wpforms/v1/...`), leaving the route out of
		// the URL path, so match it there first. An exact match keeps an unrelated
		// longer route from triggering the early load.
		// phpcs:ignore WordPress.Security.NonceVerification.Recommended
		$rest_route = isset( $_GET['rest_route'] ) ? sanitize_text_field( wp_unslash( $_GET['rest_route'] ) ) : '';

if ( $rest_route !== '' ) {
			return untrailingslashit( $rest_route ) === '/' . $route;
		}

$request_uri = isset( $_SERVER['REQUEST_URI'] ) ? esc_url_raw( wp_unslash( $_SERVER['REQUEST_URI'] ) ) : '';
		$path        = untrailingslashit( (string) wp_parse_url( $request_uri, PHP_URL_PATH ) );

// Match the route as the trailing path segment (REST adds a `/wp-json` prefix),
		// not merely a substring, so an unrelated longer route cannot trigger the early load.
		return $path === $route || substr( $path, - strlen( '/' . $route ) ) === '/' . $route;
	}

/**
	 * Sanitize the `plugins` argument for the install-plugins route.
	 *
	 * Coerces to an array of plugin-file strings (`{directory}/{main-file.php}`);
	 * non-string entries and empty values are dropped. `wpforms_sanitize_key()`
	 * preserves the `/` and `.` a plugin file needs. The catalog whitelist in
	 * `PluginCatalog::main_file()` remains the guard against installing an
	 * arbitrary path.
	 *
	 * @since 2.0.0
	 *
	 * @param mixed $value Raw argument value supplied by the SPA.
	 *
	 * @return array
	 */
	public function sanitize_plugin_files( $value ): array {

if ( ! is_array( $value ) ) {
			return [];
		}

return array_values( array_filter( array_map( 'wpforms_sanitize_key', $value ) ) );
	}

/**
	 * Permission callback for every wizard route.
	 *
	 * Verifies the session token via Auth, hydrates the bound user with
	 * `wp_set_current_user()`, and refreshes the token TTL on success.
	 *
	 * @since 2.0.0
	 *
	 * @param WP_REST_Request $request REST request.
	 *
	 * @return bool|WP_Error True when the request is allowed.
	 */
	public function validate_request( WP_REST_Request $request ) {

$user_id = $this->auth->validate_request( $request );

if ( $user_id <= 0 ) {
			return new WP_Error(
				'rest_forbidden',
				esc_html__( 'Invalid Setup Wizard session.', 'wpforms-lite' ),
				[ 'status' => 401 ]
			);
		}

wp_set_current_user( $user_id );

if ( ! current_user_can( 'manage_options' ) ) {
			return new WP_Error(
				'rest_forbidden',
				esc_html__( 'Insufficient capability.', 'wpforms-lite' ),
				[ 'status' => 403 ]
			);
		}

return true;
	}

/**
	 * `GET /hydrate` Initial fetch of the wizard state.
	 *
	 * @since 2.0.0
	 *
	 * @param WP_REST_Request $request REST request.
	 *
	 * @return WP_REST_Response
	 * @noinspection PhpUnusedParameterInspection
	 */
	public function hydrate( WP_REST_Request $request ): WP_REST_Response { // phpcs:ignore Generic.CodeAnalysis.UnusedFunctionParameter.Found

return new WP_REST_Response( $this->service->get_hydrate_payload(), 200 );
	}

/**
	 * `POST /update` Replace the wizard_settings blob.
	 *
	 * The request body is the new `wizard_settings` snapshot. The server treats
	 * the contents as opaque and overwrites the previous value wholesale. The
	 * single exception, on Pro, is the `lite_connect.consent` flag: when truthy,
	 * the state manager schedules the Lite Connect entries restore in the
	 * background (see {@see \WPForms\Pro\SetupWizard\Service\StateManager}).
	 *
	 * @since 2.0.0
	 *
	 * @param WP_REST_Request $request REST request.
	 *
	 * @return WP_REST_Response
	 */
	public function update( WP_REST_Request $request ): WP_REST_Response {

$payload = (array) $request->get_json_params();
		$state   = $this->service->save_wizard_settings( $payload );

return new WP_REST_Response( $state, 200 );
	}

/**
	 * `POST /install-plugins` Install queued plugins/addons.
	 *
	 * @since 2.0.0
	 *
	 * @param WP_REST_Request $request REST request.
	 *
	 * @return WP_REST_Response
	 */
	public function install_plugins( WP_REST_Request $request ): WP_REST_Response {

$plugins = (array) $request->get_param( 'plugins' );

return new WP_REST_Response( $this->service->install_plugins( $plugins ), 200 );
	}

/**
	 * `POST /complete` Finalize the wizard and resolve every redirect target.
	 *
	 * Now fired once on the SPA's Complete-page mount rather than per-CTA, so
	 * the response carries the redirect URLs for all outcomes up front. The
	 * CTAs navigate using the stored URLs without re-calling the endpoint.
	 *
	 * Delegates to `StateManager::complete()` so the manager can refresh
	 * its `settings` snapshot once post-wizard side effects exist. The SPA owns
	 * the `wizard_settings` blob and is expected to send any completion
	 * metadata (`completed_at`, cleared queues) through `/update` before
	 * invoking this route.
	 *
	 * @since 2.0.0
	 *
	 * @param WP_REST_Request $request REST request.
	 *
	 * @return WP_REST_Response
	 */
	public function complete( WP_REST_Request $request ): WP_REST_Response {

$outcome = (string) $request->get_param( 'outcome' );

$this->service->complete( $outcome );
		$this->auth->revoke();

$state = $this->service->get_state();

return new WP_REST_Response(
			[
				'redirect_urls'   => [
					'build'  => $this->get_redirect_url( 'build' ),
					'import' => $this->get_redirect_url( 'import' ),
					'exit'   => $this->get_redirect_url( 'exit' ),
					'forms'  => $this->get_redirect_url( 'forms' ),
				],
				'wizard_settings' => $state['wizard_settings'],
			],
			200
		);
	}

/**
	 * `POST /stripe/connect-url` Get the Stripe Connect URL for the wizard.
	 *
	 * Returns a kickoff URL that defers OAuth URL generation to wp-admin context
	 * so the nonce is bound to the correct session.
	 *
	 * @since 2.0.0
	 *
	 * @param WP_REST_Request $request REST request.
	 *
	 * @return WP_REST_Response
	 * @noinspection PhpUnusedParameterInspection
	 */
	public function stripe_connect_url( WP_REST_Request $request ): WP_REST_Response { // phpcs:ignore Generic.CodeAnalysis.UnusedFunctionParameter.Found

$result = $this->service->get_stripe_connect_url();

if ( is_wp_error( $result ) ) {
			return $this->error_response( $result );
		}

return new WP_REST_Response( $result, 200 );
	}

/**
	 * `GET /license/key` Fetch the configured license key only.
	 *
	 * @since 2.0.0
	 *
	 * @param WP_REST_Request $request REST request.
	 *
	 * @return WP_REST_Response
	 * @noinspection PhpUnusedParameterInspection
	 */
	public function license_key( WP_REST_Request $request ): WP_REST_Response { // phpcs:ignore Generic.CodeAnalysis.UnusedFunctionParameter.Found

return new WP_REST_Response( [ 'key' => wpforms_get_license_key() ], 200 );
	}

/**
	 * `POST /license/verify` Validate and activate a license key.
	 *
	 * Verifies the key against the license API and runs the edition-specific
	 * completion step: Pro only stores the verified key, while Lite upgrades
	 * the site to WPForms Pro (install, activate, deactivate Lite).
	 *
	 * @since 2.0.0
	 *
	 * @param WP_REST_Request $request REST request.
	 *
	 * @return WP_REST_Response
	 */
	public function verify_license( WP_REST_Request $request ): WP_REST_Response {

$key    = (string) $request->get_param( 'key' );
		$result = $this->activate_license( $key );

if ( is_wp_error( $result ) ) {
			return $this->error_response( $result );
		}

return new WP_REST_Response( $result, 200 );
	}

/**
	 * Validate a key against the license API and run the edition-specific
	 * completion step.
	 *
	 * The validated key is persisted before the completion step runs, so a valid
	 * key is never lost if a subsequent edition-specific action (e.g. the Lite
	 * Pro install) fails. The Lite and Pro controllers override this seam; the
	 * shared base only verifies and stores the key.
	 *
	 * @since 2.0.0
	 *
	 * @param string $key License key.
	 *
	 * @return array|WP_Error
	 */
	protected function activate_license( string $key ) {

$verify = $this->verify_key( $key );

if ( is_wp_error( $verify ) ) {
			return $verify;
		}

update_option(
			'wpforms_license',
			[
				'key'              => $key,
				'type'             => (string) $verify['type'],
				'is_expired'       => false,
				'is_disabled'      => false,
				'is_invalid'       => false,
				'is_limit_reached' => false,
				'is_flagged'       => false,
			]
		);

return [
			'success'   => true,
			'installed' => true,
			'activated' => true,
			'message'   => esc_html__( 'License activated.', 'wpforms-lite' ),
		];
	}

/**
	 * Verify a key against the license API without persisting anything.
	 *
	 * @since 2.0.0
	 *
	 * @param string $key License key.
	 *
	 * @return array|WP_Error Decoded verification response, or `WP_Error` when
	 *                        the key is rejected, the API is unreachable, or the
	 *                        response is malformed.
	 */
	private function verify_key( string $key ) {

$size_error = $this->validate_license_key_size( $key );

if ( $size_error !== null ) {
			return $size_error;
		}

$verify = $this->license_api_request( 'verify-key', $key );

if ( $verify === null ) {
			return new WP_Error(
				'wpforms_setup_wizard_license_connection',
				esc_html__( 'There was an error connecting to the license server. Please try again later.', 'wpforms-lite' ),
				[ 'status' => 503 ]
			);
		}

if ( ! empty( $verify['error'] ) ) {
			return new WP_Error(
				'wpforms_setup_wizard_license_rejected',
				(string) $verify['error'],
				[ 'status' => 400 ]
			);
		}

// A success response without a license type is malformed and must not be treated as a valid activation.
		if ( empty( $verify['type'] ) ) {
			return new WP_Error(
				'wpforms_setup_wizard_license_invalid_response',
				esc_html__( 'There was an error connecting to the license server. Please try again later.', 'wpforms-lite' ),
				[ 'status' => 502 ]
			);
		}

return $verify;
	}

/**
	 * Perform a live GET request against the license API.
	 *
	 * Replicates the essentials of the Pro `perform_remote_request()` without
	 * the Pro `License` class or any caching layer.
	 *
	 * @since 2.0.0
	 *
	 * @param string $action API action slug appended to the base URL.
	 * @param string $key    License key.
	 * @param array  $extra  Extra query args merged over the defaults.
	 *
	 * @return array|null Decoded JSON as an associative array, or null on transport/HTTP error.
	 */
	protected function license_api_request( string $action, string $key, array $extra = [] ): ?array {

$args = array_merge(
			[
				'tgm-updater-action'      => $action,
				'tgm-updater-key'         => $key,
				'tgm-updater-wp-version'  => get_bloginfo( 'version' ),
				'tgm-updater-php-version' => PHP_VERSION,
				'tgm-updater-referer'     => site_url(),
				'wpforms_refresh_key'     => 1,
			],
			$extra
		);

$response = wp_remote_get(
			add_query_arg( $args, $this->license_api_url() . '/' . $action ),
			[
				'user-agent' => wpforms_get_default_user_agent(),
				'timeout'    => 30,
			]
		);

if ( is_wp_error( $response ) || (int) wp_remote_retrieve_response_code( $response ) !== 200 ) {
			return null;
		}

$body = json_decode( wp_remote_retrieve_body( $response ), true );

return is_array( $body ) ? $body : null;
	}

/**
	 * Resolve the license API base URL.
	 *
	 * @since 2.0.0
	 *
	 * @return string
	 */
	private function license_api_url(): string {

return defined( 'WPFORMS_UPDATER_API' ) ? WPFORMS_UPDATER_API : self::LICENSE_API_URL_FALLBACK;
	}

/**
	 * Guard the key length to block empty, garbage, or oversized payloads.
	 *
	 * @since 2.0.0
	 *
	 * @param string $key License key.
	 *
	 * @return WP_Error|null `WP_Error` when out of bounds, null when acceptable.
	 */
	private function validate_license_key_size( string $key ): ?WP_Error {

$length = strlen( $key );

if ( $length < self::LICENSE_MIN_KEY_LENGTH || $length > self::LICENSE_MAX_KEY_LENGTH ) {
			return new WP_Error(
				'wpforms_setup_wizard_license_invalid_size',
				esc_html__( 'Please enter a valid license key.', 'wpforms-lite' ),
				[ 'status' => 400 ]
			);
		}

return null;
	}

/**
	 * Build an error response from a WP_Error, using its `status` data as the HTTP code.
	 *
	 * @since 2.0.0
	 *
	 * @param WP_Error $error Error to surface to the SPA.
	 *
	 * @return WP_REST_Response
	 */
	private function error_response( WP_Error $error ): WP_REST_Response {

$status = (int) ( ( (array) $error->get_error_data() )['status'] ?? 500 );

return new WP_REST_Response( [ 'error' => $error->get_error_message() ], $status );
	}

/**
	 * Resolve the post-wizard redirect target for a given outcome.
	 *
	 * @since 2.0.0
	 *
	 * @param string $outcome Outcome page: `build`, `import`, `exit`, or `forms`.
	 *
	 * @return string
	 */
	private function get_redirect_url( string $outcome ): string {

if ( $outcome === 'import' ) {
			return admin_url( 'admin.php?page=wpforms-tools&view=import&tab=forms' );
		}

if ( $outcome === 'exit' ) {
			return Page::get_url();
		}

if ( $outcome === 'forms' ) {
			return admin_url( 'admin.php?page=wpforms-overview' );
		}

return admin_url( 'admin.php?page=wpforms-builder' );
	}
}

Back to Directory File Manager