Reverse proxy fix

README.md

@@ -18,7 +18,7 @@
 <p align="center">
   <a href="https://github.com/superdav42/wp-multisite-waas/actions/workflows/tests.yml"><img src="https://github.com/superdav42/wp-multisite-waas/actions/workflows/tests.yml/badge.svg" alt="Unit & Integration Tests"></a>
   <a href="https://github.com/superdav42/wp-multisite-waas/actions/workflows/e2e.yml"><img src="https://github.com/superdav42/wp-multisite-waas/actions/workflows/e2e.yml/badge.svg" alt="E2E Tests"></a>
-  <a href="https://img.shields.io/coderabbit/prs/github/superdav42/wp-multisite-waas?utm_source=oss&utm_medium=github&utm_campaign=superdav42%2Fwp-multisite-waas&labelColor=171717&color=FF570A&link=https%3A%2F%2Fcoderabbit.ai&label=CodeRabbit+Reviews"><img src="https://img.shields.io/coderabbit/prs/github/superdav42/wp-multisite-waas?utm_source=oss&utm_medium=github&utm_campaign=superdav42%2Fwp-multisite-waas&labelColor=171717&color=FF570A&link=https%3A%2F%2Fcoderabbit.ai&label=CodeRabbit+Reviews" alt="E2E Tests"></a>
+  <a href="https://img.shields.io/coderabbit/prs/github/Multisite-Ultimate/multisite-ultimate?utm_source=oss&utm_medium=github&utm_campaign=Multisite-Ultimate%2Fmultisite-ultimate&labelColor=171717&color=FF570A&link=https%3A%2F%2Fcoderabbit.ai&label=CodeRabbit+Reviews"><img src="https://img.shields.io/coderabbit/prs/github/Multisite-Ultimate/multisite-ultimate?utm_source=oss&utm_medium=github&utm_campaign=Multisite-Ultimate%2Fmultisite-ultimate&labelColor=171717&color=FF570A&link=https%3A%2F%2Fcoderabbit.ai&label=CodeRabbit+Reviews" alt="Code Rabbit"></a>
 </p>
 
 ## 🌟 Overview

inc/limits/class-customer-user-role-limits.php

@@ -135,7 +135,11 @@ public function update_site_user_roles($membership_id): void {
 			$role = $membership->get_limitations()->customer_user_role->get_limit();
 
 			foreach ($sites as $site) {
-				add_user_to_blog($site->get_id(), $customer->get_user_id(), $role);
+				// only add user to blog if they are not already a member, or we are downgrading their role.
+				// Without this check the user could lose additional roles added manually or with hooks.
+				if ('administrator' !== $role || ! is_user_member_of_blog($customer->get_user_id(), $site->get_id())) {
+					add_user_to_blog($site->get_id(), $customer->get_user_id(), $role);
+				}
 			}
 		}
 	}

inc/managers/class-domain-manager.php

@@ -904,4 +904,154 @@ public function load_integrations(): void {
 		 */
 		do_action('wp_ultimo_host_providers_load');
 	}
+
+	/**
+	 * Register the domain verification endpoint.
+	 *
+	 * @since 2.0.0
+	 * @return void
+	 */
+	public function register_domain_verification_endpoint(): void {
+
+		register_rest_route(
+			'wu/v1',
+			'/domain-verification/(?P<domain>[a-zA-Z0-9.-]+)',
+			array(
+				'methods'             => \WP_REST_Server::READABLE,
+				'callback'            => array($this, 'domain_verification_endpoint'),
+				'permission_callback' => '__return_true',
+				'args'                => array(
+					'domain' => array(
+						'required'          => true,
+						'sanitize_callback' => 'sanitize_text_field',
+					),
+				),
+			)
+		);
+	}
+
+	/**
+	 * Domain verification endpoint that returns a shared secret.
+	 *
+	 * @since 2.0.0
+	 *
+	 * @param \WP_REST_Request $request The request object.
+	 * @return \WP_REST_Response|\WP_Error
+	 */
+	public function domain_verification_endpoint($request) {
+
+		$domain = $request->get_param('domain');
+
+		if ( empty($domain) ) {
+			return new \WP_Error('missing_domain', __('Domain parameter is required.', 'multisite-ultimate'), array('status' => 400));
+		}
+
+		$secret = $this->get_domain_verification_secret($domain);
+
+		return rest_ensure_response(
+			array(
+				'domain' => $domain,
+				'secret' => $secret,
+			)
+		);
+	}
+
+	/**
+	 * Generate and store a verification secret for a domain.
+	 *
+	 * @since 2.0.0
+	 *
+	 * @param string $domain The domain to generate a secret for.
+	 * @return string The generated secret.
+	 */
+	private function generate_domain_verification_secret($domain) {
+
+		$secret = wp_generate_password(32, false);
+
+		set_site_transient("wu_domain_verification_{$domain}", $secret, 5 * MINUTE_IN_SECONDS);
+
+		return $secret;
+	}
+
+	/**
+	 * Get the verification secret for a domain.
+	 *
+	 * @since 2.0.0
+	 *
+	 * @param string $domain The domain to get the secret for.
+	 * @return string The verification secret.
+	 */
+	private function get_domain_verification_secret($domain) {
+
+		$secret = get_site_transient("wu_domain_verification_{$domain}");
+
+		if ( false === $secret ) {
+			$secret = $this->generate_domain_verification_secret($domain);
+		}
+
+		return $secret;
+	}
+
+	/**
+	 * Verify domain ownership using the secret-based method.
+	 *
+	 * @since 2.0.0
+	 *
+	 * @param string $domain The domain to verify.
+	 * @return bool True if verification succeeds, false otherwise.
+	 */
+	public function verify_domain_with_secret($domain) {
+
+		$expected_secret = $this->generate_domain_verification_secret($domain);
+
+		$verification_url = "https://{$domain}/wp-json/wu/v1/domain-verification/{$domain}";
+
+		$response = wp_remote_get(
+			$verification_url,
+			array(
+				'timeout'   => 10,
+				'sslverify' => false,
+			)
+		);
+
+		if ( is_wp_error($response) ) {
+			wu_log_add(
+				"domain-verification-{$domain}",
+				// translators: %s url of the endpoint.
+				sprintf(__('Failed to connect to verification endpoint: %s', 'multisite-ultimate'), $response->get_error_message()),
+				LogLevel::WARNING
+			);
+			return false;
+		}
+
+		$body = wp_remote_retrieve_body($response);
+		$data = json_decode($body, true);
+
+		if ( ! isset($data['secret']) ) {
+			wu_log_add(
+				"domain-verification-{$domain}",
+				__('Verification endpoint did not return a secret.', 'multisite-ultimate'),
+				LogLevel::WARNING
+			);
+			return false;
+		}
+
+		$received_secret = $data['secret'];
+
+		if ( hash_equals($expected_secret, $received_secret) ) {
+			wu_log_add(
+				"domain-verification-{$domain}",
+				__('Domain verification successful using secret method.', 'multisite-ultimate')
+			);
+			return true;
+		}
+
+		wu_log_add(
+			"domain-verification-{$domain}",
+			__('Domain verification failed: secrets do not match.', 'multisite-ultimate'),
+			LogLevel::WARNING
+		);
+
+		return false;
+	}
 }

inc/models/class-domain.php

@@ -397,6 +397,18 @@ public function has_correct_dns() {
 
 		$domain_url = $this->get_domain();
 
+		$domain_manager = \WP_Ultimo\Managers\Domain_Manager::get_instance();
+
+		$secret_verification_enabled = apply_filters('wu_enable_secret_domain_verification', true, $this);
+
+		if ( $secret_verification_enabled ) {
+			$secret_result = $domain_manager->verify_domain_with_secret($domain_url);
+
+			if ( $secret_result ) {
+				return true;
+			}
+		}
+
 		$network_ip_address = Helper::get_network_public_ip();
 
 		$results = \WP_Ultimo\Managers\Domain_Manager::dns_get_record($domain_url);

inc/models/class-site.php

@@ -1679,7 +1679,11 @@ public function save() {
 
 			$user_id = $customer->get_user_id();
 
-			add_user_to_blog($this->get_id(), $user_id, $role);
+			// only add user to blog if they are not already a member, or we are downgrading their role.
+			// Without this check the user could lose additional roles added manually or with hooks.
+			if ('administrator' !== $role || ! is_user_member_of_blog($user_id, $this->get_id())) {
+				add_user_to_blog($this->get_id(), $user_id, $role);
+			}
 		} elseif ($this->get_type() !== Site_Type::CUSTOMER_OWNED && $original_customer_id) {
 			$user_id = wu_get_customer($original_customer_id)->get_user_id();
 

inc/objects/class-limitations.php

@@ -67,7 +67,7 @@ class Limitations {
 	 */
 	public function __construct($modules_data = []) {
 
-		$this->build_modules($modules_data);
+		$this->raw_module_data = $modules_data;
 	}
 
 	/**
@@ -83,16 +83,10 @@ public function __get($name) {
 		$module = wu_get_isset($this->modules, $name, false);
 
 		if (false === $module) {
-			$repo = self::repository();
-
-			$class_name = wu_get_isset($repo, $name, false);
-
-			if (class_exists($class_name)) {
-				$module = new $class_name($this->raw_module_data[ $name ] ?? []);
-
+			$module = self::build($this->raw_module_data[ $name ] ?? [], $name);
+			if ($module) {
 				$this->modules[ $name ] = $module;
-
-				return $module;
+				return $this->modules[ $name ];
 			}
 		}
 
@@ -121,7 +115,7 @@ public function __serialize() {
 	 * @return void
 	 */
 	public function __unserialize($modules_data) {
-		$this->build_modules($modules_data);
+		$this->raw_module_data = $modules_data;
 	}
 
 	/**
@@ -136,14 +130,6 @@ public function build_modules($modules_data) {
 
 		$this->raw_module_data = $modules_data;
 
-		foreach ($modules_data as $type => $data) {
-			$module = self::build($data, $type);
-
-			if ($module) {
-				$this->modules[ $type ] = $module;
-			}
-		}
-
 		return $this;
 	}
 
@@ -181,7 +167,7 @@ public static function build($data, $module_name) {
 	 */
 	public function exists($module) {
 
-		return wu_get_isset($this->modules, $module, false);
+		return (bool) wu_get_isset($this->raw_module_data, $module, false);
 	}
 
 	/**
@@ -192,15 +178,13 @@ public function exists($module) {
 	 */
 	public function has_limitations() {
 
-		$has_limitations = false;
-
-		foreach ($this->modules as $module) {
-			if ($module->is_enabled()) {
+		foreach ($this->raw_module_data as $module) {
+			if ($module['enabled']) {
 				return true;
 			}
 		}
 
-		return $has_limitations;
+		return false;
 	}
 
 	/**
@@ -213,9 +197,7 @@ public function has_limitations() {
 	 */
 	public function is_module_enabled($module_name) {
 
-		$module = $this->{$module_name};
-
-		return $module ? $module->is_enabled() : false;
+		return $this->raw_module_data[ $module_name ]['enabled'] ?? false;
 	}
 
 	/**
@@ -374,8 +356,7 @@ protected function merge_recursive(array &$array1, array &$array2, $should_sum =
 	 * @since 2.0.0
 	 */
 	public function to_array(): array {
-
-		return array_map(fn($module) => method_exists($module, 'to_array') ? $module->to_array() : (array) $module, $this->modules);
+		return $this->raw_module_data;
 	}
 
 	/**

tests/WP_Ultimo/Objects/Limitations_Test.php

@@ -78,7 +78,7 @@ public function test_constructor(array $modules_data, int $expected_modules_coun
 
 		// Use reflection to access protected modules property
 		$reflection = new \ReflectionClass($limitations);
-		$modules_property = $reflection->getProperty('modules');
+		$modules_property = $reflection->getProperty('raw_module_data');
 		$modules_property->setAccessible(true);
 		$modules = $modules_property->getValue($limitations);
 
@@ -199,11 +199,11 @@ public function test_build_modules(array $modules_data, int $expected_count): vo
 
 		// Use reflection to access protected modules property
 		$reflection = new \ReflectionClass($limitations);
-		$modules_property = $reflection->getProperty('modules');
+		$modules_property = $reflection->getProperty('raw_module_data');
 		$modules_property->setAccessible(true);
 		$modules = $modules_property->getValue($limitations);
 
-		$this->assertCount($expected_count, $modules);
+		$this->assertEquals($modules_data, $modules);
 	}
 
 	/**
@@ -284,11 +284,11 @@ public function existsMethodDataProvider(): array {
 	 */
 	public function test_exists_method(array $modules_data, string $module_name, bool $should_exist): void {
 		$limitations = new Limitations($modules_data);
-		$result = $limitations->exists($module_name);
+		$result      = $limitations->exists($module_name);
 
 		if ($should_exist) {
 			$this->assertNotFalse($result);
-			$this->assertIsObject($result);
+			$this->assertTrue($result);
 		} else {
 			$this->assertFalse($result);
 		}

views/admin-notices.php

@@ -18,7 +18,7 @@
 
 	<?php else : ?>
 
-	<p class="wu-py-2"><?php echo esc_html($notice['message']); ?></p>
+	<p class="wu-py-2"><?php echo wp_kses_post($notice['message']); ?></p>
 
 <?php endif; ?>
 

views/domain/dns-table.php

@@ -75,6 +75,11 @@
 		<td colspan="2" class="wu-text-left">{{ results.network_ip }}</td>
 		</tr>
 
+		<tr>
+			<td colspan="2"><?php esc_html_e('Domain connected to site?', 'multisite-ultimate'); ?></td>
+			<td colspan="2" class="wu-text-left">{{ results.has_correct_dns }}</td>
+		</tr>
+
 	</tbody>
 
 	</table>