From b1e6ffc7003c92a6de9f2fd243bd514c3d33b461 Mon Sep 17 00:00:00 2001 From: Tetrakern <26898880+Tetrakern@users.noreply.github.com> Date: Sun, 27 Aug 2023 12:29:24 +0200 Subject: [PATCH] Refactor AJAX user authentication --- DEVELOPMENT.md | 4 +- INSTALLATION.md | 9 +- includes/functions/_fast_requests.php | 4 +- includes/functions/_roles.php | 2 +- includes/functions/_theme_setup.php | 5 +- includes/functions/_utility.php | 58 +--- .../functions/settings/_register_settings.php | 7 - .../settings/_settings_page_general.php | 8 - includes/functions/users/_user_data.php | 5 +- js/admin.min.js | 2 +- js/ajax-bookshelf.min.js | 2 +- js/ajax-comments.min.js | 2 +- js/application.min.js | 2 +- js/comments.min.js | 2 +- js/follows.min.js | 2 +- js/reminders.min.js | 2 +- js/user.min.js | 2 +- js/utility.min.js | 2 +- src/js/admin.js | 3 +- src/js/ajax-bookshelf.js | 17 +- src/js/ajax-comments.js | 12 +- src/js/application.js | 276 +++++++++--------- src/js/comments.js | 6 +- src/js/follows.js | 2 +- src/js/reminders.js | 2 +- src/js/user.js | 10 +- src/js/utility.js | 30 +- 27 files changed, 201 insertions(+), 277 deletions(-) diff --git a/DEVELOPMENT.md b/DEVELOPMENT.md index cab4c97c..f5da371a 100644 --- a/DEVELOPMENT.md +++ b/DEVELOPMENT.md @@ -246,8 +246,8 @@ Fictioneer customizes WordPress by using as many standard action and filter hook | `template_redirect` | `fictioneer_disable_date_archives`, `fictioneer_generate_epub`, `fictioneer_handle_oauth`, `fictioneer_logout`, `fictioneer_disable_attachment_pages`, `fictioneer_gate_unpublished_content` | `trashed_post` | `fictioneer_refresh_post_caches`, `fictioneer_track_chapter_and_story_updates`, `fictioneer_update_modified_date_on_story_for_chapter`, `fictioneer_purge_transients`, `fictioneer_flush_object_cache` | `untrash_post` | `fictioneer_refresh_post_caches`, `fictioneer_track_chapter_and_story_updates`, `fictioneer_update_modified_date_on_story_for_chapter`, `fictioneer_purge_transients`, `fictioneer_flush_object_cache` -| `wp_ajax_*` | `fictioneer_ajax_clear_my_checkmarks`, `fictioneer_ajax_clear_my_comments`, `fictioneer_ajax_clear_my_comment_subscriptions`, `fictioneer_ajax_clear_my_follows`, `fictioneer_ajax_clear_my_reminders`, `fictioneer_ajax_delete_epub`, `fictioneer_ajax_delete_my_account`, `fictioneer_ajax_delete_my_comment`, `fictioneer_ajax_edit_comment`, `fictioneer_ajax_get_avatar`, `fictioneer_ajax_get_comment_form`, `fictioneer_ajax_get_comment_section`, `fictioneer_ajax_get_finished_checkmarks_list`, `fictioneer_ajax_get_follows_list`, `fictioneer_ajax_get_follows_notifications`, `fictioneer_ajax_get_nonce`, `fictioneer_ajax_get_reminders_list`, `fictioneer_ajax_is_user_logged_in`, `fictioneer_ajax_mark_follows_read`, `fictioneer_ajax_moderate_comment`, `fictioneer_ajax_purge_schema`, `fictioneer_ajax_report_comment`, `fictioneer_ajax_save_bookmarks`, `fictioneer_ajax_set_checkmark`, `fictioneer_ajax_submit_comment`, `fictioneer_ajax_toggle_follow`, `fictioneer_ajax_toggle_reminder`, `fictioneer_ajax_unset_my_oauth`, `fictioneer_ajax_get_user_data` -| `wp_ajax_nopriv_*` | `fictioneer_ajax_get_comment_form`, `fictioneer_ajax_get_comment_section`, `fictioneer_ajax_get_nonce`, `fictioneer_ajax_is_user_logged_in`, `fictioneer_ajax_submit_comment` +| `wp_ajax_*` | `fictioneer_ajax_clear_my_checkmarks`, `fictioneer_ajax_clear_my_comments`, `fictioneer_ajax_clear_my_comment_subscriptions`, `fictioneer_ajax_clear_my_follows`, `fictioneer_ajax_clear_my_reminders`, `fictioneer_ajax_delete_epub`, `fictioneer_ajax_delete_my_account`, `fictioneer_ajax_delete_my_comment`, `fictioneer_ajax_edit_comment`, `fictioneer_ajax_get_avatar`, `fictioneer_ajax_get_comment_form`, `fictioneer_ajax_get_comment_section`, `fictioneer_ajax_get_finished_checkmarks_list`, `fictioneer_ajax_get_follows_list`, `fictioneer_ajax_get_follows_notifications`, `fictioneer_ajax_get_reminders_list`, `fictioneer_ajax_mark_follows_read`, `fictioneer_ajax_moderate_comment`, `fictioneer_ajax_purge_schema`, `fictioneer_ajax_report_comment`, `fictioneer_ajax_save_bookmarks`, `fictioneer_ajax_set_checkmark`, `fictioneer_ajax_submit_comment`, `fictioneer_ajax_toggle_follow`, `fictioneer_ajax_toggle_reminder`, `fictioneer_ajax_unset_my_oauth`, `fictioneer_ajax_get_user_data`, `fictioneer_ajax_get_auth` +| `wp_ajax_nopriv_*` | `fictioneer_ajax_get_comment_form`, `fictioneer_ajax_get_comment_section`, `fictioneer_ajax_submit_comment`, `fictioneer_ajax_get_auth` | `wp_before_admin_bar_render` | `fictioneer_remove_admin_bar_links`, `fictioneer_remove_dashboard_from_admin_bar` | `wp_dashboard_setup` | `fictioneer_remove_dashboard_widgets` | `wp_default_scripts` | `fictioneer_remove_jquery_migrate` diff --git a/INSTALLATION.md b/INSTALLATION.md index 5b203d4e..cf0c67ff 100644 --- a/INSTALLATION.md +++ b/INSTALLATION.md @@ -314,7 +314,7 @@ The [plugin ecosystem](https://wordpress.org/plugins/) of WordPress is vast and

[Fictioneer: General] Compatibility:

@@ -450,7 +450,6 @@ Technically just another plugin, but one that will make your site significantly

[General] Compatibility:

@@ -582,10 +581,10 @@ Most of the theme’s configuration is found here, the options being largely sel * **Contact Form Receivers:** Submitted contact forms are sent to those email addresses. One per line. * **Add consent wrappers to embedded content:** Required to be GDPR compliant if you use embeds. * **Page Assignments:** Only set what you actually need. Used for breadcrumbs and menu items. -* **Enable Storygraph API:** Allow external services to index and search your site to reach a larger audience. Recommended. -* **Enable OAuth 2.0 authentication:** Allow visitors to register with social media accounts, but be aware of the implications! +* **Enable Storygraph API:** Allows external services to index and search your site to reach a larger audience. Recommended. +* **Enable OAuth 2.0 authentication:** Allows visitors to register with social media accounts, but be aware of the implications! * **Enable AJAX comment form/section:** If you have trouble with caching. Try the form first to save resources. -* **Enable AJAX nonce deferment:** [Nonces](https://developer.wordpress.org/apis/security/nonces/) can conflict with caching. Use this as *last resort* to bypass the cache. +* **Enable AJAX user authentication:** If you have trouble with [Nonces](https://developer.wordpress.org/apis/security/nonces/) and/or users not being properly logged-in. Use this as *last resort* to bypass the cache. * **Disable theme comment {…}:** If you want to use different comments. Disables most of the other comment options as well.
diff --git a/includes/functions/_fast_requests.php b/includes/functions/_fast_requests.php index 8dadc40b..4852147b 100644 --- a/includes/functions/_fast_requests.php +++ b/includes/functions/_fast_requests.php @@ -8,9 +8,6 @@ if ( ! defined( 'FICTIONEER_FAST_AJAX_FUNCTIONS' ) ) { define( 'FICTIONEER_FAST_AJAX_FUNCTIONS', array( - // System - 'fictioneer_ajax_is_user_logged_in', - 'fictioneer_ajax_get_nonce', // Bookmarks 'fictioneer_ajax_save_bookmarks', // Follows @@ -28,6 +25,7 @@ if ( ! defined( 'FICTIONEER_FAST_AJAX_FUNCTIONS' ) ) { 'fictioneer_ajax_clear_my_checkmarks', 'fictioneer_ajax_get_finished_checkmarks_list', // User + 'fictioneer_ajax_get_auth', 'fictioneer_ajax_get_user_data', 'fictioneer_ajax_get_avatar' ) diff --git a/includes/functions/_roles.php b/includes/functions/_roles.php index ed07888c..a244b3c4 100644 --- a/includes/functions/_roles.php +++ b/includes/functions/_roles.php @@ -1075,7 +1075,7 @@ if ( ! current_user_can( 'manage_options' ) ) { echo ''; // Add JS to remove blocks... - echo ''; + echo ''; } if ( current_user_can( 'fcn_reduced_profile' ) ) { diff --git a/includes/functions/_theme_setup.php b/includes/functions/_theme_setup.php index 307f6c0c..ee13b3b3 100644 --- a/includes/functions/_theme_setup.php +++ b/includes/functions/_theme_setup.php @@ -13,10 +13,10 @@ function fictioneer_bring_out_legacy_trash() { // Setup $options = wp_cache_get( 'alloptions', 'options' ); - $obsolete = ['fictioneer_disable_html_in_comments', 'fictioneer_block_subscribers_from_admin', 'fictioneer_admin_restrict_menus', 'fictioneer_admin_restrict_private_data', 'fictioneer_admin_reduce_subscriber_profile', 'fictioneer_enable_subscriber_self_delete', 'fictioneer_strip_shortcodes_for_non_administrators', 'fictioneer_restrict_media_access', 'fictioneer_subscription_enabled', 'fictioneer_patreon_badge_map', 'fictioneer_patreon_tier_as_badge', 'fictioneer_patreon_campaign_ids', 'fictioneer_patreon_campaign_id', 'fictioneer_mount_wpdiscuz_theme_styles', 'fictioneer_base_site_width', 'fictioneer_comment_form_selector', 'fictioneer_featherlight_enabled', 'fictioneer_tts_enabled', 'fictioneer_log']; + $obsolete = ['fictioneer_disable_html_in_comments', 'fictioneer_block_subscribers_from_admin', 'fictioneer_admin_restrict_menus', 'fictioneer_admin_restrict_private_data', 'fictioneer_admin_reduce_subscriber_profile', 'fictioneer_enable_subscriber_self_delete', 'fictioneer_strip_shortcodes_for_non_administrators', 'fictioneer_restrict_media_access', 'fictioneer_subscription_enabled', 'fictioneer_patreon_badge_map', 'fictioneer_patreon_tier_as_badge', 'fictioneer_patreon_campaign_ids', 'fictioneer_patreon_campaign_id', 'fictioneer_mount_wpdiscuz_theme_styles', 'fictioneer_base_site_width', 'fictioneer_comment_form_selector', 'fictioneer_featherlight_enabled', 'fictioneer_tts_enabled', 'fictioneer_log', 'fictioneer_enable_ajax_nonce']; // Check for most recent obsolete option... - if ( isset( $options['fictioneer_disable_html_in_comments'] ) ) { + if ( isset( $options['fictioneer_enable_ajax_nonce'] ) ) { // Looping everything is not great but it only happens once! foreach ( $obsolete as $trash ) { delete_option( $trash ); @@ -249,7 +249,6 @@ function fictioneer_root_attributes() { $conditions = array( 'data-ajax-submit' => get_option( 'fictioneer_enable_ajax_comment_submit', false ), 'data-force-child-theme' => ! FICTIONEER_THEME_SWITCH, - 'data-ajax-nonce' => get_option( 'fictioneer_enable_ajax_nonce', false ), 'data-public-caching' => get_option( 'fictioneer_enable_public_cache_compatibility', false ), 'data-ajax-auth' => get_option( 'fictioneer_enable_ajax_authentication', false ), 'data-edit-time' => get_option( 'fictioneer_enable_user_comment_editing', false ) ? diff --git a/includes/functions/_utility.php b/includes/functions/_utility.php index 3b5631fe..caa7d470 100644 --- a/includes/functions/_utility.php +++ b/includes/functions/_utility.php @@ -960,17 +960,16 @@ function fictioneer_show_auth_content() { } // ============================================================================= -// GET LOGIN STATUS VIA AJAX +// AJAX AUTHENTICATION // ============================================================================= /** - * Sends login status via AJAX + * Send user authentication status via AJAX * - * @since 5.0 - * @link https://developer.wordpress.org/reference/functions/wp_send_json_success/ + * @since 5.7.0 */ -function fictioneer_ajax_is_user_logged_in() { +function fictioneer_ajax_get_auth() { // Enabled? if ( ! get_option( 'fictioneer_enable_ajax_authentication' ) ) { wp_send_json_error( @@ -979,60 +978,27 @@ function fictioneer_ajax_is_user_logged_in() { ); } - // Nonce - check_ajax_referer( 'fictioneer_nonce', 'nonce' ); - // Setup $user = wp_get_current_user(); + $nonce = wp_create_nonce( 'fictioneer_nonce' ); + $nonce_html = ''; - // Send login status + // Response wp_send_json_success( array( 'loggedIn' => is_user_logged_in(), 'isAdmin' => fictioneer_is_admin( $user->ID ), 'isModerator' => fictioneer_is_moderator( $user->ID ), 'isAuthor' => fictioneer_is_author( $user->ID ), - 'isEditor' => fictioneer_is_editor( $user->ID ) + 'isEditor' => fictioneer_is_editor( $user->ID ), + 'nonce' => $nonce, + 'nonceHtml' => $nonce_html ) ); } - if ( get_option( 'fictioneer_enable_ajax_authentication' ) ) { - add_action( 'wp_ajax_fictioneer_ajax_is_user_logged_in', 'fictioneer_ajax_is_user_logged_in' ); - add_action( 'wp_ajax_nopriv_fictioneer_ajax_is_user_logged_in', 'fictioneer_ajax_is_user_logged_in' ); -} - -// ============================================================================= -// GET NONCE VIA AJAX -// ============================================================================= - -/** - * Sends valid nonce via AJAX - * - * @since 5.0 - * @link https://developer.wordpress.org/reference/functions/wp_send_json_success/ - */ - -function fictioneer_ajax_get_nonce() { - // Enabled? - if ( ! get_option( 'fictioneer_enable_ajax_nonce' ) ) { - wp_send_json_error( - array( 'error' => __( 'Not allowed.', 'fictioneer' ) ), - 403 - ); - } - - // Prepare nonce field - $nonce = wp_create_nonce( 'fictioneer_nonce' ); - $nonce_html = ''; - - // Send nonce field - wp_send_json_success( array( 'nonce' => $nonce, 'nonceHtml' => $nonce_html ) ); -} - -if ( get_option( 'fictioneer_enable_ajax_nonce' ) ) { - add_action( 'wp_ajax_fictioneer_ajax_get_nonce', 'fictioneer_ajax_get_nonce' ); - add_action( 'wp_ajax_nopriv_fictioneer_ajax_get_nonce', 'fictioneer_ajax_get_nonce' ); + add_action( 'wp_ajax_fictioneer_ajax_get_auth', 'fictioneer_ajax_get_auth' ); + add_action( 'wp_ajax_nopriv_fictioneer_ajax_get_auth', 'fictioneer_ajax_get_auth' ); } // ============================================================================= diff --git a/includes/functions/settings/_register_settings.php b/includes/functions/settings/_register_settings.php index e8502846..04c3170d 100644 --- a/includes/functions/settings/_register_settings.php +++ b/includes/functions/settings/_register_settings.php @@ -502,13 +502,6 @@ define( 'FICTIONEER_OPTIONS', array( 'sanitize_callback' => 'fictioneer_sanitize_checkbox', 'label' => __( 'Enable all Gutenberg block styles', 'fictioneer' ), 'default' => false - ), - 'fictioneer_enable_ajax_nonce' => array( - 'name' => 'fictioneer_enable_ajax_nonce', - 'group' => 'fictioneer-settings-general-group', - 'sanitize_callback' => 'fictioneer_sanitize_checkbox', - 'label' => __( 'Enable AJAX nonce deferment', 'fictioneer' ), - 'default' => false ), 'fictioneer_enable_ajax_authentication' => array( 'name' => 'fictioneer_enable_ajax_authentication', diff --git a/includes/functions/settings/_settings_page_general.php b/includes/functions/settings/_settings_page_general.php index faf23f4e..a54a1796 100644 --- a/includes/functions/settings/_settings_page_general.php +++ b/includes/functions/settings/_settings_page_general.php @@ -931,14 +931,6 @@ - -