Skip to content

Commit 5444bc5

Browse files
aaronwareaaronware
authored
Merge pull request #7 from linchpin/feature/add-click-to-view
Added the ability to click to view a secret instead of viewing it directly
2 parents 93f0ac0 + f966a43 commit 5444bc5

File tree

5 files changed

+190
-26
lines changed

5 files changed

+190
-26
lines changed

‎package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"name": "linchpin-psst",
33
"title": "Pretty Secure Secret Transmission",
4-
"version": "1.0.0",
4+
"version": "1.0.5",
55
"description": "A pretty secure and simple plugin to transmit messages secretly.",
66
"homepage": "https://linchpin.com",
77
"main": "gulp.babel.js",

‎psst.php‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
<?php
22
/*
33
* Plugin Name: psst (Pretty Secure Secret Transmission)
4-
* Description: As simple plugin to send a relatively secure message to an individuals.
4+
* Description: As simple plugin to send a relatively secure message to an individuals. Use at own risk
55
* Plugin URI: https://github.com/linchpin/psst
6-
* Version: 1.0.3
6+
* Version: 1.0.5
77
* License: GPL-2.0+
88
* Author URI: https://linchpin.com
99
* Text Domain: psst
@@ -38,7 +38,7 @@
3838
}
3939

4040
if ( ! defined( 'PSST_VERSION' ) ) {
41-
define( 'PSST_VERSION', '1.0.3' );
41+
define( 'PSST_VERSION', '1.0.5' );
4242
}
4343

4444
/**

‎src/Controller/Secret.php‎

Lines changed: 156 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ class Secret {
1818
public function register_actions() {
1919
add_action( 'init', [ $this, 'register_custom_post_type' ] );
2020
add_action( 'init', [ $this, 'add_rewrite_rules' ] );
21-
add_action( 'cmb2_admin_init', array( $this, 'register_fields' ) );
21+
add_action( 'cmb2_admin_init', [ $this, 'register_fields' ] );
2222

2323
// Handle Secret Creation
2424
add_action( 'admin_post_psst_create_secret', [ $this, 'create_secret' ] );
@@ -28,19 +28,24 @@ public function register_actions() {
2828
add_action( 'admin_post_psst_delete_secret', [ $this, 'delete_secret' ] );
2929
add_action( 'admin_post_nopriv_psst_delete_secret', [ $this, 'delete_secret' ] );
3030

31-
add_action( 'wp', [ $this, 'track_viewed_secret' ] );
32-
33-
add_filter( 'query_vars', [ $this, 'query_vars' ] );
34-
add_filter( 'post_password_required', [ $this, 'skip_password_on_confirm' ], 10, 2 );
31+
// Handle Secret View
32+
add_action( 'admin_post_psst_view_secret', [ $this, 'view_secret' ] );
33+
add_action( 'admin_post_nopriv_psst_view_secret', [ $this, 'view_secret' ] );
3534

3635
add_action( 'the_post', [ $this, 'the_post' ] );
37-
add_filter( 'the_content', [ $this, 'confirmation_content' ], 2, 1 );
3836
add_action( 'loop_end', [ $this, 'loop_end' ] );
37+
add_action( 'loop_end', [ $this, 'track_viewed_secret' ] );
3938

4039
add_action( 'pre_get_posts', [ $this, 'display_confirmation' ] );
4140
add_action( 'wp_enqueue_scripts', [ $this, 'wp_enqueue_scripts' ], 11 );
4241
add_action( 'after_setup_theme', [ $this, 'add_editor_styles' ] );
4342

43+
// Filters
44+
add_filter( 'query_vars', [ $this, 'query_vars' ] );
45+
add_filter( 'post_password_required', [ $this, 'skip_password_on_confirm' ], 10, 2 );
46+
add_filter( 'the_content', [ $this, 'display_secret_content' ], 2, 1 );
47+
48+
// Shortcodes
4449
add_shortcode( 'secret_form', [ $this, 'secret_form' ] );
4550
}
4651

@@ -95,28 +100,113 @@ public function wp_enqueue_scripts() {
95100
}
96101

97102
/**
98-
* When showing the confirmation page. Do not show the message, show the confirmation message for the message.
103+
* Check to see if we are viewing a secret creation confirmation page.
104+
*
105+
* @since 1.0.4
106+
* @return bool
107+
*/
108+
private function is_confirmation() {
109+
110+
global $post;
111+
112+
if ( 'secret' === $post->post_type &&
113+
is_single() &&
114+
in_the_loop() &&
115+
is_main_query() &&
116+
get_query_var( 'confirm_secret_key' )
117+
) {
118+
return true;
119+
}
120+
121+
return false;
122+
}
123+
124+
/**
125+
* Check to see if we are viewing the "click to view" page.
126+
*
127+
* Usage: This is used to determine if we are viewing the click to view page
128+
* vs the actual secret.
129+
*
130+
* @since 1.0.4
131+
* @return bool
132+
*/
133+
private function is_click_to_view() {
134+
global $post;
135+
136+
if ( 'secret' === $post->post_type &&
137+
is_single() &&
138+
in_the_loop() &&
139+
is_main_query() &&
140+
get_query_var( 'confirm_secret_click' )
141+
) {
142+
return true;
143+
}
144+
145+
return false;
146+
}
147+
148+
/**
149+
* Check to see if we clicked the view secret button
150+
*
151+
* @since 1.0.4
152+
* @return bool
153+
*/
154+
private function can_view_secret() {
155+
global $post;
156+
157+
if ( 'secret' === $post->post_type &&
158+
is_single() &&
159+
in_the_loop() &&
160+
is_main_query() &&
161+
'true' === get_query_var( 'confirm_secret_view' )
162+
) {
163+
return true;
164+
}
165+
166+
return false;
167+
}
168+
169+
/**
170+
* Determine when to show the confirmation page, view secret confirmation or the secret itself.
171+
*
99172
* @since 1.0.0
100173
*/
101-
public function confirmation_content( $content ) {
174+
public function display_secret_content( $content ) {
102175

103176
global $post;
104177

105-
if ( 'secret' === $post->post_type && is_single() && in_the_loop() && is_main_query() && get_query_var( 'confirm_secret_key' ) ) {
178+
// If it's not a secret then don't filter anything
179+
if ( 'secret' !== $post->post_type ) {
180+
return $content;
181+
}
182+
183+
if ( $this->is_confirmation() ) {
106184

107185
wp_enqueue_script( 'clipboard', PSST_PLUGIN_URL . 'js/clipboard.min.js', [], PSST_VERSION, true );
108186

109187
$confirmation = new View();
188+
$timestamp = get_post_meta( $post->ID, '_psst_secret_expiration', true );
189+
$date = date_i18n(
190+
get_option( 'date_format' ),
191+
$timestamp
192+
);
193+
$time = date_i18n(
194+
get_option( 'time_format' ),
195+
$timestamp
196+
);
197+
198+
$datetime = sprintf( '%1$s @ %2$s', $date, $time );
199+
$datetime = apply_filters( 'psst_date_time_format', $datetime );
200+
201+
$confirmation->assign( 'secret_expiration_date', $datetime );
110202
$confirmation->assign( 'secret_confirm_key', get_post_meta( $post->ID, '_psst_secret_confirm_key', true ) );
111203

112204
return $confirmation->get_text_view( 'secret-confirmation' );
113205
}
114206

115-
// Unencrypt our business
116-
if ( 'secret' === $post->post_type && is_single() && in_the_loop() && is_main_query() ) {
117-
118-
$refresh_warning = '';
207+
$refresh_warning = '';
119208

209+
if ( $this->can_view_secret() ) {
120210
if ( ! post_password_required() ) {
121211
$key = Key::loadFromAsciiSafeString( PSST_CRYPTO_KEY );
122212
$content = Crypto::decrypt( $content, $key );
@@ -125,10 +215,17 @@ public function confirmation_content( $content ) {
125215
$refresh_warning = $warning->get_text_view( 'secret-refresh-warning' );
126216
$refresh_warning = apply_filters( 'psst_refresh_warning', $refresh_warning );
127217
}
128-
129-
$content = $content . $refresh_warning;
218+
} else {
219+
// Show the OK button
220+
if ( ! post_password_required() ) {
221+
$secret_view = new View();
222+
$content = $secret_view->get_text_view( 'secret' );
223+
$content = apply_filters( 'psst_secret_view', $content );
224+
}
130225
}
131226

227+
$content = $content . $refresh_warning;
228+
132229
return $content;
133230
}
134231

@@ -141,7 +238,10 @@ public function display_confirmation( $query ) {
141238

142239
$secret_confirm_key = get_query_var( 'confirm_secret_key' );
143240

144-
if ( ! is_admin() && ( $query->is_main_query() && 'true' === get_query_var( 'confirm_secret' ) && 'secret' === $query->query_vars['post_type'] ) ) {
241+
if ( ! is_admin() &&
242+
( $query->is_main_query() &&
243+
'true' === get_query_var( 'confirm_secret' ) &&
244+
'secret' === $query->query_vars['post_type'] ) ) {
145245

146246
if ( ! empty( $secret_confirm_key ) ) {
147247

@@ -190,44 +290,61 @@ public function skip_password_on_confirm( $protect, $post ) {
190290
public function query_vars( $qvars ) {
191291
$qvars[] = 'confirm_secret';
192292
$qvars[] = 'confirm_secret_key';
293+
$qvars[] = 'confirm_secret_click';
294+
$qvars[] = 'confirm_secret_view';
193295
return $qvars;
194296
}
195297

196298
/**
197299
* Track that a secret has been viewed so it can be deleted.
198300
* Be sure to exclude if you are viewing the password protected form.
301+
*
199302
* @since 1.0.0
200303
*/
201304
public function track_viewed_secret() {
202305

203-
global $post;
306+
global $post, $wp_query;
204307

205308
if ( is_admin() ) {
206309
return;
207310
}
208311

312+
if ( empty( $post ) ) {
313+
return;
314+
}
315+
316+
// Don't track if our post isn't a secret
209317
if ( $post && 'secret' !== $post->post_type ) {
210318
return;
211319
}
212320

213-
// 'Slackbot-LinkExpanding 1.0'
321+
// Don't track if we're on the confirm click view
322+
if ( 'true' === get_query_var( 'confirm_secret_click' ) ) {
323+
return;
324+
}
214325

215326
// If the post isn't protected, delete it after it's been viewed.
216327
// Also make sure that we aren't viewing the confirmation page.
217-
if ( ! post_password_required() && 'true' !== get_query_var( 'confirm_secret' ) && ! is_404() ) {
218-
wp_delete_post( $post->ID, true );
328+
if ( ! post_password_required() &&
329+
'true' === get_query_var( 'confirm_secret_view' ) &&
330+
is_single() &&
331+
! is_404()
332+
) {
333+
wp_delete_post( $post->ID, true );
219334
}
220335
}
221336

222337
/**
223338
* Create custom rewrite rule for secrets.
339+
*
224340
* @since 1.0.0
225341
*/
226342
public function add_rewrite_rules() {
227343
add_rewrite_tag( '%secret_id%', '([0-9A-Za-z]+)' );
228344
add_rewrite_tag( '%confirm_secret_key%', '([0-9A-Za-z]+)' );
229345
add_rewrite_rule( 'secret/confirm/(.*)/?', 'index.php?&post_type=secret&confirm_secret=true&confirm_secret_key=$matches[1]', 'top' );
230-
add_rewrite_rule( 'secret/(.*)/?', 'index.php?&secret=$matches[1]', 'top' );
346+
add_rewrite_rule( 'secret/view/(.*)/?', 'index.php?&secret=$matches[1]&confirm_secret_view=true', 'top' );
347+
add_rewrite_rule( 'secret/(.*)/?', 'index.php?&secret=$matches[1]&confirm_secret_click=true', 'top' );
231348
add_rewrite_rule( 'secret/removed/?', 'index.php?&removed_secret=true', 'top' );
232349
}
233350

@@ -341,7 +458,7 @@ public function create_secret() {
341458
$expire_date = new \DateTime();
342459
date_add( $expire_date, new \DateInterval( "PT{$expiration}M" ) );
343460

344-
update_post_meta( $new_secret_id, '_secret_expiration', $expire_date->getTimestamp() );
461+
update_post_meta( $new_secret_id, '_psst_secret_expiration', $expire_date->getTimestamp() );
345462
}
346463

347464
$confirm_url = site_url( 'secret/confirm/' . $generated_confirm_key );
@@ -351,6 +468,23 @@ public function create_secret() {
351468
}
352469
}
353470

471+
/**
472+
* Create our secret Post on submission
473+
*
474+
* @since 1.0.0
475+
*/
476+
public function view_secret() {
477+
478+
wp_verify_nonce( 'view_secret_nonce', $_POST['view_secret_nonce'] );
479+
480+
$secret_key = trim( $_POST[ '_wp_http_referer' ], '/' ); // Get the key from the referrering page
481+
$secret_key = explode( '/', $secret_key );
482+
$secret = site_url( '/secret/view/' . $secret_key[1] );
483+
484+
wp_safe_redirect( $secret, 301, esc_attr__( 'Psst', 'psst' ) );
485+
exit();
486+
}
487+
354488
/**
355489
* Delete our secret Post on submission
356490
* @since 1.0.0

‎templates/secret-confirmation.php‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,9 @@
2424
</button>
2525
</div>
2626
</div>
27+
<div>
28+
<strong><?php printf( __( 'Expires: %s', 'psst' ), esc_html( $secret_expiration_date ) ); ?></strong>
29+
</div>
2730
</div>
2831
</div>
2932
</div>

‎templates/secret.php‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
<?php
2+
/**
3+
* Secret Confirm View Template
4+
*
5+
* This template holds the secret confirmation button
6+
* This should probably have a controller for an endpoint vs using admin-post.php
7+
*
8+
* @since 1.0.4
9+
*/
10+
?>
11+
<div class="grid-container">
12+
<div class="grid-x align-center">
13+
<div class="cell small-12 medium-centered">
14+
<form action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>" method="post" id="psst-secret-view">
15+
<div class="grid-x">
16+
<div class="cell small-12">
17+
<p><?php esc_html_e( 'Once you click view, your secret will be revealed, onced viewed it will be removed from the system', 'psst' ); ?></p>
18+
<input type="hidden" name="action" value="psst_view_secret" />
19+
<input type="hidden" name="confirm_secret" value="true" />
20+
<?php wp_nonce_field( 'view_secret', 'view_secret_nonce' ); ?>
21+
<button type="submit" class="button primary expanded"><?php esc_html_e( 'View Secret', 'psst' ); ?></button>
22+
</div>
23+
</div>
24+
</form>
25+
</div>
26+
</div>
27+
</div>

0 commit comments

Comments
 (0)