field( $page_id ); // get and store a current access token for the configured page $page_access_token = $this->retrieve_page_access_token( $page_id ); $this->update_page_access_token( $page_access_token ); $log_data[ self::OPTION_PAGE_ACCESS_TOKEN ] = sanitize_text_field( $page_access_token ); } catch ( \Exception $e ) { $this->get_plugin()->log( 'Could not request Page Token: ' . $e->getMessage() ); } }//end if $this->get_plugin()->log( 'WebHook User event saved data' ); // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_print_r $this->get_plugin()->log( print_r( $log_data, true ) ); } /** * Register Extras REST API endpoint * * @since 2.3.0 */ public function init_extras_endpoint() { register_rest_route( 'wc-facebook/v1', 'extras', array( array( 'methods' => array( 'GET', 'POST' ), 'callback' => array( $this, 'extras_callback' ), 'permission_callback' => array( $this, 'extras_permission_callback' ), ), ) ); } /** * FBE Extras endpoint permissions * * @since 2.3.0 * * @return boolean */ public function extras_permission_callback() { return current_user_can( 'manage_woocommerce' ); } /** * Return FBE extras * * @since 2.3.0 * * @return \WP_REST_Response */ public function extras_callback() { $extras = $this->get_connect_parameters_extras(); if ( empty( $extras ) ) { return new \WP_REST_Response( null, 204 ); } return new \WP_REST_Response( $extras, 200 ); } /** * Process FBE App Store login flow redirection * * @since 2.3.0 */ public function handle_fbe_redirect() { if ( ! current_user_can( 'manage_woocommerce' ) ) { wp_die( esc_html__( 'You do not have permission to finish App Store login.', 'facebook-for-woocommerce' ) ); } $redirect_uri = isset( $_REQUEST['redirect_uri'] ) ? base64_decode( wc_clean( wp_unslash( $_REQUEST['redirect_uri'] ) ) ) : ''; //phpcs:ignore // To ensure that we are not sharing any user data with other parties, only redirect to the // redirect_uri if its parsed host matches a known Meta host used by this flow. $host = strtolower( (string) wp_parse_url( $redirect_uri, PHP_URL_HOST ) ); $scheme = strtolower( (string) wp_parse_url( $redirect_uri, PHP_URL_SCHEME ) ); $host_allowed = 'https' === $scheme && 1 === preg_match( '/^(?:(?:www|m|l)\.)?(?:\d{5}\.od\.)?(?:facebook|instagram|whatsapp|commercepartnerhub)\.com$/', $host ); if ( empty( $redirect_uri ) || ! $host_allowed ) { wp_safe_redirect( site_url() ); exit; } if ( empty( $_REQUEST['success'] ) ) { //phpcs:ignore WordPress.Security.NonceVerification.Recommended $url_params = array( 'store_url' => '', 'redirect_uri' => rawurlencode( $redirect_uri ), 'errors' => array( 'You need to grant access to WooCommerce.' ), ); $redirect_url = add_query_arg( $url_params, $this->get_app_store_login_url() ); } else { $redirect_url = $redirect_uri . '&extras=' . rawurlencode_deep( wp_json_encode( $this->get_connect_parameters_extras() ) ); } // $redirect_url now points either to a Meta domain (validated above) or to the trusted App // Store login URL. Register its host so the core safe-redirect guarantee is enforced for this // otherwise cross-domain redirect. $redirect_host = strtolower( (string) wp_parse_url( $redirect_url, PHP_URL_HOST ) ); $allow_redirect = static function ( $hosts ) use ( $redirect_host ) { $hosts[] = $redirect_host; return $hosts; }; add_filter( 'allowed_redirect_hosts', $allow_redirect ); wp_safe_redirect( $redirect_url ); remove_filter( 'allowed_redirect_hosts', $allow_redirect ); exit; } /** * Stores the given Commerce Partner Integration ID. * * @since 3.4. * * @param string $id the ID */ public function update_commerce_partner_integration_id( $id ) { update_option( self::OPTION_COMMERCE_PARTNER_INTEGRATION_ID, $id ); } }