JezK
Edit File: zoho-lookup-lead.php
<?php error_reporting(E_ALL); ini_set('display_errors', 1); // Start session with secure parameters if (!session_id() && !headers_sent()) { ini_set('session.cookie_httponly', 1); if (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] === 'on') { ini_set('session.cookie_secure', 1); } ini_set('session.use_only_cookies', 1); ini_set('session.cookie_samesite', 'Strict'); session_start(); } // Include authentication file to get access token require_once('/home/authentica.com/public_html/wp-content/plugins/zoho-crm-api/zoho-auth.php'); // Ensure this file is accessed within WordPress if (!defined('ABSPATH')) { exit; // Prevent direct access } // Input sanitization function function sanitizeInput($input) { if (is_array($input)) { $sanitized = []; foreach ($input as $key => $value) { $sanitizedKey = preg_replace('/[^a-zA-Z0-9_]/', '', $key); if (is_array($value)) { $sanitized[$sanitizedKey] = sanitizeInput($value); } else { $sanitized[$sanitizedKey] = filter_var($value, FILTER_SANITIZE_STRING); if (is_string($sanitized[$sanitizedKey])) { $sanitized[$sanitizedKey] = trim($sanitized[$sanitizedKey]); } } } return $sanitized; } else { return filter_var($input, FILTER_SANITIZE_STRING); } } // Get JSON input from the request $request_body = file_get_contents("php://input"); $decoded_input = json_decode($request_body, true); // Sanitize input data if (is_array($decoded_input)) { $decoded_input = sanitizeInput($decoded_input); } // For POST requests, check for token if ($_SERVER['REQUEST_METHOD'] === 'POST') { if (!isset($decoded_input['csrf_token'])) { header('Content-Type: application/json'); header('X-Content-Type-Options: nosniff'); http_response_code(403); echo json_encode([ 'error' => 'Missing CSRF token', 'http_code' => 403 ]); exit; } if (!isset($_SESSION['csrf_token']) || !isset($_SESSION['csrf_token_hash']) || $decoded_input['csrf_token'] !== $_SESSION['csrf_token'] || $_SESSION['csrf_token_hash'] !== hash('sha256', $decoded_input['csrf_token'] . $_SERVER['HTTP_USER_AGENT'] . $_SERVER['REMOTE_ADDR'])) { header('Content-Type: application/json'); header('X-Content-Type-Options: nosniff'); http_response_code(403); echo json_encode([ 'error' => 'Invalid CSRF token', 'http_code' => 403 ]); exit; } if (!isset($_SESSION['csrf_token_time']) || (time() - $_SESSION['csrf_token_time'] > 1800)) { header('Content-Type: application/json'); header('X-Content-Type-Options: nosniff'); http_response_code(403); echo json_encode([ 'error' => 'Expired CSRF token', 'http_code' => 403 ]); exit; } } // Fetch Access Token $auth_response = get_zoho_access_token(); if (!isset($auth_response['response']['access_token'])) { header('Content-Type: application/json'); header('X-Content-Type-Options: nosniff'); echo json_encode(['error' => 'Failed to fetch access token', 'details' => $auth_response]); exit; } $access_token = $auth_response['response']['access_token']; // Determine lookup method (by email or by lead ID) $lookup_method = ''; $lookup_value = ''; if (isset($decoded_input['email']) && !empty($decoded_input['email'])) { $lookup_method = 'email'; $lookup_value = $decoded_input['email']; // Validate email format if (!filter_var($lookup_value, FILTER_VALIDATE_EMAIL)) { header('Content-Type: application/json'); header('X-Content-Type-Options: nosniff'); echo json_encode(['error' => 'Invalid email format']); exit; } } elseif (isset($decoded_input['lead_id']) && !empty($decoded_input['lead_id'])) { $lookup_method = 'lead_id'; $lookup_value = $decoded_input['lead_id']; // Validate Lead ID format if (!preg_match('/^[a-zA-Z0-9]+$/', $lookup_value)) { header('Content-Type: application/json'); header('X-Content-Type-Options: nosniff'); echo json_encode(['error' => 'Invalid Lead ID format']); exit; } } else { header('Content-Type: application/json'); header('X-Content-Type-Options: nosniff'); echo json_encode(['error' => 'Either email or lead_id is required for lookup']); exit; } // Build API URL based on lookup method if ($lookup_method === 'email') { // Search by email using COQL (Zoho Query Language) $zoho_api_url = "https://www.zohoapis.com/crm/v2/coql"; $query_data = [ "select_query" => "SELECT id, First_Name, Last_Name, Email, Phone, Name_of_Home_Institution, Major, Year_of_Study, Country_of_Home_Institution1, Country_of_Citizenship1, Program_Location, Program_Name, Session_of_Interest, Program_Date FROM Leads WHERE Email = '{$lookup_value}'" ]; } else { // Direct lookup by Lead ID $zoho_api_url = "https://www.zohoapis.com/crm/v2/Leads/{$lookup_value}"; $query_data = null; } // Make the API request $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, $zoho_api_url); if ($lookup_method === 'email') { // POST request for COQL query curl_setopt($ch, CURLOPT_POST, true); curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($query_data)); } else { // GET request for direct lead lookup curl_setopt($ch, CURLOPT_HTTPGET, true); } curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); curl_setopt($ch, CURLOPT_HTTPHEADER, [ "Authorization: Bearer $access_token", "Content-Type: application/json" ]); curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, true); $response = curl_exec($ch); $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE); $error_msg = curl_error($ch); curl_close($ch); // Decode response $decoded_response = json_decode($response, true); // Process response based on lookup method $lead_found = false; $lead_data = null; if ($lookup_method === 'email') { // For COQL query, check if any records were found if ($http_code === 200 && isset($decoded_response['data']) && !empty($decoded_response['data'])) { $lead_found = true; $lead_data = $decoded_response['data'][0]; // Get first matching lead } } else { // For direct lookup, check if lead exists if ($http_code === 200 && isset($decoded_response['data']) && !empty($decoded_response['data'])) { $lead_found = true; $lead_data = $decoded_response['data'][0]; } } // Return standardized response header('Content-Type: application/json'); header('X-Content-Type-Options: nosniff'); echo json_encode([ 'http_code' => $http_code, 'error' => $error_msg, 'lead_found' => $lead_found, 'lead_data' => $lead_data, 'lookup_method' => $lookup_method, 'response' => $decoded_response ]); exit;