// ------------------------------------------------------------- // SECURE REVIEWS SYSTEM // ------------------------------------------------------------- // 1. Create DB table on init add_action('init', 'folkhub_init_review_tokens_table'); function folkhub_init_review_tokens_table() { $version = get_option('fh_review_tokens_db_version', '0'); if ($version !== '1.0') { global $wpdb; $table_name = $wpdb->prefix . 'fh_review_tokens'; $charset_collate = $wpdb->get_charset_collate(); $sql = "CREATE TABLE $table_name ( id mediumint(9) NOT NULL AUTO_INCREMENT, performer_id bigint(20) NOT NULL, client_name varchar(255) NOT NULL, client_email varchar(255) NOT NULL, event_date varchar(100) DEFAULT '' NOT NULL, token varchar(32) NOT NULL, status varchar(20) DEFAULT 'pending' NOT NULL, created_at datetime DEFAULT CURRENT_TIMESTAMP NOT NULL, PRIMARY KEY (id), UNIQUE KEY token (token) ) $charset_collate;"; require_once(ABSPATH . 'wp-admin/includes/upgrade.php'); dbDelta($sql); update_option('fh_review_tokens_db_version', '1.0'); } } 2// 2. Handle AJAX request from Performer Dashboard add_action('wp_ajax_fh_send_review_request', 'fh_handle_send_review_request'); function fh_handle_send_review_request() { check_ajax_referer('fh_review_request_nonce', 'fh_security'); $user_id = get_current_user_id(); $performer_id = get_user_meta($user_id, '_fh_performer_post_id', true); if (!$performer_id) { wp_send_json_error(['message' => 'Nerastas atlikejo profilis.']); } $client_name = sanitize_text_field($_POST['client_name'] ?? ''); $client_email = sanitize_email($_POST['client_email'] ?? ''); $event_date = sanitize_text_field($_POST['event_date'] ?? ''); if (empty($client_name) || empty($client_email)) { wp_send_json_error(['message' => 'Prasome uzpildyti visus privalomus laukus.']); } global $wpdb; $table_name = $wpdb->prefix . 'fh_review_tokens'; // Rate limiting: 10 per month per performer $current_month = date('Y-m'); $count = $wpdb->get_var($wpdb->prepare("SELECT COUNT(*) FROM $table_name WHERE performer_id = %d AND created_at LIKE %s", $performer_id, $current_month . '%')); if ($count >= 10) { wp_send_json_error(['message' => 'Pasiektas limitas: issiuntete 10 prasymu si menesi.']); } // Generate token $token = wp_generate_password(32, false); // Insert into DB $wpdb->insert($table_name, [ 'performer_id' => $performer_id, 'client_name' => $client_name, 'client_email' => $client_email, 'event_date' => $event_date, 'token' => $token, 'status' => 'pending' ]); // Send email $performer_name = get_the_title($performer_id); $review_link = home_url('/palikti-atsiliepima/?token=' . $token); $subject = "Kaip sekesi renginyje su $performer_name? Palikite atsiliepima!"; $body = "Sveiki, $client_name!\n\n"; $body .= "Neseniai bendravote arba jusu renginyje dalyvavo atlikejas/grupe „{$performer_name}”.\n"; $body .= "Atlikejas praso jusu ivertinti jo pasirodyma ir palikti atsiliepima FolkHub platformoje.\n\n"; $body .= "Prasome paspausti sia saugia, vienkartine nuoroda ir palikti savo ivertinima:\n"; $body .= $review_link . "\n\n"; $body .= "Jusu nuomone labai svarbi atlikejui ir kitiems platformos klientams!\n\n"; $body .= "Pagarbiai,\nFolkHub sistema"; wp_mail($client_email, $subject, $body); wp_send_json_success(['message' => 'Prasymas sekmingai issiustas klientui!']); } // 3. Shortcode for the Review Page add_shortcode('folkhub_leave_review', 'folkhub_render_leave_review_page'); function folkhub_render_leave_review_page() { $token = sanitize_text_field($_GET['token'] ?? ''); // Fallback to cookie if page was reloaded after validation or during ajax submit if (!$token && isset($_COOKIE['hh_review_token'])) { $token = sanitize_text_field($_COOKIE['hh_review_token']); } if (!$token) { return "

Klaida

Neteisinga arba nebegaliojanti nuoroda.

"; } global $wpdb; $table_name = $wpdb->prefix . 'fh_review_tokens'; $row = $wpdb->get_row($wpdb->prepare("SELECT * FROM $table_name WHERE token = %s AND status = 'pending'", $token)); if (!$row) { return "

Klaida

ši atsiliepimo nuoroda jau panaudota arba neegzistuoja.

"; } // Set cookie so AJAX submission can read it and burn it if (!isset($_COOKIE['fh_review_token']) || $_COOKIE['fh_review_token'] !== $token) { setcookie('fh_review_token', $token, time() + 3600, '/'); } $performer_name = get_the_title($row->performer_id); $out = "
"; $out .= "

Palikite atsiliepimĆ

"; $out .= "

Jũs vertinate atlikėją/grupę: " . esc_html($performer_name) . "

"; $out .= "
"; $out .= do_shortcode('[site_reviews_form assign_to="'.$row->performer_id.'" hide="title"]'); $out .= "
"; return $out; } // 4. Burn the token after successful review submission add_action('site-reviews/review/created', 'folkhub_burn_review_token', 10, 1); function folkhub_burn_review_token($review) { if (isset($_COOKIE['hh_review_token'])) { $token = sanitize_text_field($_COOKIE['hh_review_token']); global $wpdb; $table_name = $wpdb->prefix . 'fh_review_tokens'; $wpdb->update($table_name, ['status' => 'used'], ['token' => $token]); // Clear cookie setcookie('fh_review_token', '', time() - 3600, '/'); } } https://folkhub.lt/wp-sitemap-posts-post-1.xmlhttps://folkhub.lt/wp-sitemap-posts-page-1.xmlhttps://folkhub.lt/wp-sitemap-posts-performer-1.xmlhttps://folkhub.lt/wp-sitemap-taxonomies-category-1.xmlhttps://folkhub.lt/wp-sitemap-taxonomies-activity_type-1.xmlhttps://folkhub.lt/wp-sitemap-taxonomies-instrument-1.xmlhttps://folkhub.lt/wp-sitemap-users-1.xmlhttps://folkhub.lt/en/wp-sitemap-users-1.xmlhttps://folkhub.lt/lv/wp-sitemap-users-1.xmlhttps://folkhub.lt/et/wp-sitemap-users-1.xmlhttps://folkhub.lt/pl/wp-sitemap-users-1.xmlhttps://folkhub.lt/uk/wp-sitemap-users-1.xml