JezK
Edit File: zoho-update-lead.php
<?php error_reporting(E_ALL); ini_set('display_errors', 1); // Start session with secure parameters if (!session_id() && !headers_sent()) { ini_set('session.cookie_httponly', 1); if (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] === 'on') { ini_set('session.cookie_secure', 1); } ini_set('session.use_only_cookies', 1); ini_set('session.cookie_samesite', 'Strict'); session_start(); } require_once('/home/authentica.com/public_html/wp-content/plugins/zoho-crm-api/zoho-auth.php'); // Ensure this file is accessed within WordPress if (!defined('ABSPATH')) { exit; } // Sanitization helper function sanitizeInput($input) { if (is_array($input)) { $out = []; foreach ($input as $k => $v) { $key = preg_replace('/[^a-zA-Z0-9_]/', '', (string)$k); if (is_array($v)) { $out[$key] = sanitizeInput($v); } else { $val = trim(strip_tags((string)$v)); $out[$key] = $val; } } return $out; } return trim(strip_tags((string)$input)); } // Read JSON $request_body = file_get_contents("php://input"); $decoded_input = json_decode($request_body, true); if (is_array($decoded_input)) { $decoded_input = sanitizeInput($decoded_input); } // CSRF (for PUT/POST) if ($_SERVER['REQUEST_METHOD'] === 'PUT' || $_SERVER['REQUEST_METHOD'] === 'POST') { if (!isset($decoded_input['csrf_token'])) { header('Content-Type: application/json'); header('X-Content-Type-Options: nosniff'); http_response_code(403); echo json_encode(['error' => 'Missing CSRF token', 'http_code' => 403]); exit; } if (!isset($_SESSION['csrf_token']) || !isset($_SESSION['csrf_token_hash']) || $decoded_input['csrf_token'] !== $_SESSION['csrf_token'] || $_SESSION['csrf_token_hash'] !== hash('sha256', $decoded_input['csrf_token'] . ($_SERVER['HTTP_USER_AGENT'] ?? '') . ($_SERVER['REMOTE_ADDR'] ?? '')) ) { header('Content-Type: application/json'); header('X-Content-Type-Options: nosniff'); http_response_code(403); echo json_encode(['error' => 'Invalid CSRF token', 'http_code' => 403]); exit; } if (!isset($_SESSION['csrf_token_time']) || (time() - $_SESSION['csrf_token_time'] > 1800)) { header('Content-Type: application/json'); header('X-Content-Type-Options: nosniff'); http_response_code(403); echo json_encode(['error' => 'Expired CSRF token', 'http_code' => 403]); exit; } } // Access Token $auth_response = get_zoho_access_token(); if (!isset($auth_response['response']['access_token'])) { header('Content-Type: application/json'); header('X-Content-Type-Options: nosniff'); echo json_encode(['error' => 'Failed to fetch access token', 'details' => $auth_response]); exit; } $access_token = $auth_response['response']['access_token']; // Require Lead_ID if (empty($decoded_input['Lead_ID'])) { header('Content-Type: application/json'); header('X-Content-Type-Options: nosniff'); echo json_encode(['error' => 'Missing Lead_ID in request']); exit; } $lead_id = $decoded_input['Lead_ID']; unset($decoded_input['Lead_ID']); unset($decoded_input['csrf_token']); // If Email present, allow update (no uniqueness checks) if (isset($decoded_input['Email']) && !empty($decoded_input['Email'])) { if (!filter_var($decoded_input['Email'], FILTER_VALIDATE_EMAIL)) { header('Content-Type: application/json'); header('X-Content-Type-Options: nosniff'); echo json_encode(['error' => 'Invalid email format']); exit; } } // Quick existence check (HEAD not supported—use GET one record) $verify_url = "https://www.zohoapis.com/crm/v2/Leads/" . urlencode($lead_id); $vh = curl_init(); curl_setopt($vh, CURLOPT_URL, $verify_url); curl_setopt($vh, CURLOPT_RETURNTRANSFER, true); curl_setopt($vh, CURLOPT_HTTPHEADER, [ "Authorization: Bearer $access_token", "Content-Type: application/json" ]); curl_setopt($vh, CURLOPT_SSL_VERIFYPEER, true); $vres = curl_exec($vh); $vcode = curl_getinfo($vh, CURLINFO_HTTP_CODE); curl_close($vh); if ($vcode !== 200) { header('Content-Type: application/json'); header('X-Content-Type-Options: nosniff'); http_response_code(404); echo json_encode(['error' => 'Lead_ID not found or inaccessible', 'http_code' => $vcode]); exit; } // Build update payload $update_data = ["data" => [ [] ]]; foreach ($decoded_input as $key => $value) { $update_data['data'][0][$key] = $value; } // PUT to Zoho $zoho_api_url = "https://www.zohoapis.com/crm/v2/Leads/" . urlencode($lead_id); $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, $zoho_api_url); curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "PUT"); curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($update_data)); curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); curl_setopt($ch, CURLOPT_HTTPHEADER, [ "Authorization: Bearer $access_token", "Content-Type: application/json" ]); curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, true); $response = curl_exec($ch); $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE); $error_msg = curl_error($ch); curl_close($ch); $decoded_response = json_decode($response, true); header('Content-Type: application/json'); header('X-Content-Type-Options: nosniff'); echo json_encode([ 'http_code' => $http_code, 'error' => $error_msg, 'response' => $decoded_response ]); exit;