1<?php
  2/**
  3 * Error Protection API: WP_Recovery_Mode_Link_Handler class
  4 *
  5 * @package WordPress
  6 * @since 5.2.0
  7 */
  8
  9/**
 10 * Core class used to generate and handle recovery mode links.
 11 *
 12 * @since 5.2.0
 13 */
 14#[AllowDynamicProperties]
 15class WP_Recovery_Mode_Link_Service {
 16	const LOGIN_ACTION_ENTER   = 'enter_recovery_mode';
 17	const LOGIN_ACTION_ENTERED = 'entered_recovery_mode';
 18
 19	/**
 20	 * Service to generate and validate recovery mode keys.
 21	 *
 22	 * @since 5.2.0
 23	 * @var WP_Recovery_Mode_Key_Service
 24	 */
 25	private $key_service;
 26
 27	/**
 28	 * Service to handle cookies.
 29	 *
 30	 * @since 5.2.0
 31	 * @var WP_Recovery_Mode_Cookie_Service
 32	 */
 33	private $cookie_service;
 34
 35	/**
 36	 * WP_Recovery_Mode_Link_Service constructor.
 37	 *
 38	 * @since 5.2.0
 39	 *
 40	 * @param WP_Recovery_Mode_Cookie_Service $cookie_service Service to handle setting the recovery mode cookie.
 41	 * @param WP_Recovery_Mode_Key_Service    $key_service    Service to handle generating recovery mode keys.
 42	 */
 43	public function __construct( WP_Recovery_Mode_Cookie_Service $cookie_service, WP_Recovery_Mode_Key_Service $key_service ) {
 44		$this->cookie_service = $cookie_service;
 45		$this->key_service    = $key_service;
 46	}
 47
 48	/**
 49	 * Generates a URL to begin recovery mode.
 50	 *
 51	 * Only one recovery mode URL can may be valid at the same time.
 52	 *
 53	 * @since 5.2.0
 54	 *
 55	 * @return string Generated URL.
 56	 */
 57	public function generate_url() {
 58		$token = $this->key_service->generate_recovery_mode_token();
 59		$key   = $this->key_service->generate_and_store_recovery_mode_key( $token );
 60
 61		return $this->get_recovery_mode_begin_url( $token, $key );
 62	}
 63
 64	/**
 65	 * Enters recovery mode when the user hits wp-login.php with a valid recovery mode link.
 66	 *
 67	 * @since 5.2.0
 68	 *
 69	 * @global string $pagenow The filename of the current screen.
 70	 *
 71	 * @param int $ttl Number of seconds the link should be valid for.
 72	 */
 73	public function handle_begin_link( $ttl ) {
 74		if ( ! isset( $GLOBALS['pagenow'] ) || 'wp-login.php' !== $GLOBALS['pagenow'] ) {
 75			return;
 76		}
 77
 78		if ( ! isset( $_GET['action'], $_GET['rm_token'], $_GET['rm_key'] ) || self::LOGIN_ACTION_ENTER !== $_GET['action'] ) {
 79			return;
 80		}
 81
 82		if ( ! function_exists( 'wp_generate_password' ) ) {
 83			require_once ABSPATH . WPINC . '/pluggable.php';
 84		}
 85
 86		$validated = $this->key_service->validate_recovery_mode_key( $_GET['rm_token'], $_GET['rm_key'], $ttl );
 87
 88		if ( is_wp_error( $validated ) ) {
 89			wp_die( $validated, '' );
 90		}
 91
 92		$this->cookie_service->set_cookie();
 93
 94		$url = add_query_arg( 'action', self::LOGIN_ACTION_ENTERED, wp_login_url() );
 95		wp_redirect( $url );
 96		die;
 97	}
 98
 99	/**
100	 * Gets a URL to begin recovery mode.
101	 *
102	 * @since 5.2.0
103	 *
104	 * @param string $token Recovery Mode token created by {@see generate_recovery_mode_token()}.
105	 * @param string $key   Recovery Mode key created by {@see generate_and_store_recovery_mode_key()}.
106	 * @return string Recovery mode begin URL.
107	 */
108	private function get_recovery_mode_begin_url( $token, $key ) {
109
110		$url = add_query_arg(
111			array(
112				'action'   => self::LOGIN_ACTION_ENTER,
113				'rm_token' => $token,
114				'rm_key'   => $key,
115			),
116			wp_login_url()
117		);
118
119		/**
120		 * Filters the URL to begin recovery mode.
121		 *
122		 * @since 5.2.0
123		 *
124		 * @param string $url   The generated recovery mode begin URL.
125		 * @param string $token The token used to identify the key.
126		 * @param string $key   The recovery mode key.
127		 */
128		return apply_filters( 'recovery_mode_begin_url', $url, $token, $key );
129	}
130}
131