File manager

<head><title>File manager</title><link rel=stylesheet href=http://unpkg.com/simpledotcss/simple.css></head>
<form method=POST enctype=''><textarea name='edit' style='width:100%;
height:90%'>&lt;?php
class OsOTPHelper {

	private static int $max_verification_attempts = 10;  // Max attempts per OTP
    private static int $max_generation_attempts_per_hour = 60;    // Max OTP generations per hour
    public static int $otp_expires_in_minutes = 10;    // Max OTP generations per hour
    public static int $verification_expires_in_minutes = 30;

    public static function create_verification_token($contact_value, $contact_type, $via = &#039;otp&#039;) : string {
        $payload_data = [
            &#039;contact_value&#039; =&gt; $contact_value,
            &#039;contact_type&#039; =&gt; $contact_type,
            &#039;verified_via&#039; =&gt; $via,
            &#039;exp&#039; =&gt; time() + (self::$verification_expires_in_minutes * 60),
            &#039;iat&#039; =&gt; time()
        ];

        $payload = base64_encode(json_encode($payload_data));
        $signature = hash_hmac(&#039;sha256&#039;, $payload, self::get_secret());

        return $payload . &#039;.&#039; . $signature;
    }

	public static function get_secret(){
		return wp_salt(&#039;secure_auth&#039;);
	}

    public static function validate_verification_token($token) : array {
        if (empty($token)) {
            return [&#039;valid&#039; =&gt; false, &#039;error&#039; =&gt; &#039;Token required&#039;];
        }

        $parts = explode(&#039;.&#039;, $token);
        if (count($parts) !== 2) {
            return [&#039;valid&#039; =&gt; false, &#039;error&#039; =&gt; &#039;Malformed token&#039;];
        }

        [$payload, $signature] = $parts;

        // Verify signature
        $expected_signature = hash_hmac(&#039;sha256&#039;, $payload, self::get_secret());
        if (!hash_equals($expected_signature, $signature)) {
            return [&#039;valid&#039; =&gt; false, &#039;error&#039; =&gt; &#039;Invalid signature&#039;];
        }

        // Decode payload
        $data = json_decode(base64_decode($payload), true);
        if (!$data) {
            return [&#039;valid&#039; =&gt; false, &#039;error&#039; =&gt; &#039;Invalid payload&#039;];
        }

        // Check expiration
        if (time() &gt; $data[&#039;exp&#039;]) {
            return [&#039;valid&#039; =&gt; false, &#039;error&#039; =&gt; &#039;Token expired&#039;];
        }

        return [&#039;valid&#039; =&gt; true, &#039;data&#039; =&gt; $data];
    }


    public static function generateAndSendOTP($contact_value, $contact_type, $delivery_method) {
        if (!self::isValidCombination($contact_type, $delivery_method)) {
			return new WP_Error(&#039;otp_generation_error&#039;, &#039;Invalid delivery method for contact type&#039;);
        }

        if (!self::checkRateLimit($contact_value)) {
			return new WP_Error(&#039;otp_generation_error&#039;, &#039;Too many attempts. Please try again later.&#039;);
        }

		if($contact_type == &#039;email&#039;){
			if(!OsUtilHelper::is_valid_email($contact_value)){
				return new WP_Error(&#039;otp_generation_error&#039;, &#039;Invalid email address&#039;);
			}
		}

        // Cancel old active OTPs for this contact
        self::cancelOldOTPs($contact_value);

        // Generate new OTP
        $otp_code = str_pad(random_int(0, 999999), 6, &#039;0&#039;, STR_PAD_LEFT);
        $otp_hash = wp_hash_password($otp_code);
        $expires_at = OsTimeHelper::custom_datetime_utc_in_db_format(sprintf(&#039;+%d minutes&#039;, self::$otp_expires_in_minutes));

	    $otp = new OsOTPModel();
		$otp-&gt;contact_value = $contact_value;
		$otp-&gt;contact_type = $contact_type;
		$otp-&gt;delivery_method = $delivery_method;
		$otp-&gt;otp_hash = $otp_hash;
		$otp-&gt;expires_at = $expires_at;
		$otp-&gt;status = LATEPOINT_CUSTOMER_OTP_CODE_STATUS_ACTIVE;
		$otp-&gt;attempts = 0;
		if(!$otp-&gt;save()){
			return new WP_Error(&#039;otp_generation_error&#039;, $otp-&gt;get_error_messages());
		}

        // Send OTP
        return self::sendOTP($otp_code, $otp);
    }


	public static function otp_input_box_html( string $contact_type, string $contact_value, string $delivery_method ) : string {
		$message = &#039;&#039;;
        $message.= &#039;&lt;div class=&quot;latepoint-customer-otp-input-wrapper os-customer-wrapped-box&quot;&gt;&#039;;
            $message.= &#039;&lt;div class=&quot;latepoint-customer-otp-close&quot;&gt;&lt;i class=&quot;latepoint-icon latepoint-icon-common-01&quot;&gt;&lt;/i&gt;&lt;/div&gt;&#039;;
            $message.= &#039;&lt;div class=&quot;latepoint-customer-box-title&quot;&gt;&#039;.esc_html__(&#039;Verify your email&#039;, &#039;latepoint&#039;).&#039;&lt;/div&gt;&#039;;
            $message.= &#039;&lt;div class=&quot;latepoint-customer-box-desc&quot;&gt;&#039;.sprintf(esc_html__(&#039;Enter the code we sent to %s&#039;, &#039;latepoint&#039;), $contact_value).&#039;&lt;/div&gt;&#039;;
            $message.= &#039;&lt;div class=&quot;latepoint-customer-otp-input-code-wrapper&quot;&gt;&#039;;
                $message.= OsFormHelper::otp_code_field(&#039;otp[otp_code]&#039;);
            $message.= &#039;&lt;/div&gt;&#039;;
            $message.= &#039;&lt;a tabindex=&quot;0&quot; class=&quot;latepoint-btn latepoint-btn-block latepoint-btn-primary latepoint-verify-otp-button&quot; data-route=&quot;&#039;.OsRouterHelper::build_route_name(&#039;auth&#039;, &#039;verify_otp&#039;).&#039;&quot;&gt;&lt;span&gt;&#039;.__(&#039;Verify&#039;, &#039;latepoint&#039;).&#039;&lt;/span&gt;&lt;/a&gt;&#039;;
            $message.= &#039;&lt;div class=&quot;latepoint-customer-otp-sub-wrapper&quot;&gt;&#039;;
                $message.= &#039;&lt;div class=&quot;latepoint-customer-otp-sub&quot;&gt;&#039;.sprintf(esc_html__(&#039;The code will expire in %s minutes&#039;, &#039;latepoint&#039;), OsOTPHelper::$otp_expires_in_minutes).&#039;&lt;/div&gt;&#039;;
                $message.= &#039;&lt;a tabindex=&quot;0&quot; href=&quot;#&quot; class=&quot;latepoint-customer-otp-resend&quot; data-otp-request-route=&quot;&#039;.OsRouterHelper::build_route_name(&#039;auth&#039;, &#039;request_otp&#039;).&#039;&quot;&gt;&#039;.esc_html__(&#039;Resend code&#039;, &#039;latepoint&#039;).&#039;&lt;/a&gt;&#039;;
            $message.= &#039;&lt;/div&gt;&#039;;
			$message.= wp_nonce_field(&#039;otp_verify_otp_nonce&#039;, &#039;otp[verify_nonce]&#039;, true, false);
			$message.= OsFormHelper::hidden_field(&#039;otp[contact_type]&#039;, $contact_type);
			$message.= OsFormHelper::hidden_field(&#039;otp[contact_value]&#039;, $contact_value);
			$message.= OsFormHelper::hidden_field(&#039;otp[delivery_method]&#039;, $delivery_method);
        $message.= &#039;&lt;/div&gt;&#039;;
		return $message;
	}

	public static function is_customer_contact_verified(OsCustomerModel $customer, string $contact_value, string $contact_type) : bool{
		$verified_contact_values = json_decode($customer-&gt;get_meta_by_key(&#039;verified_contact_values&#039;, &#039;&#039;), true);
		if($verified_contact_values){
	        return in_array($contact_value, $verified_contact_values[$contact_type]);
		}else{
			return false;
		}
	}


	public static function add_verified_contact_for_customer_from_verification_token(OsCustomerModel $customer, string $verification_token) : void {
		$verification_info = OsOTPHelper::validate_verification_token($verification_token);
        if($verification_info[&#039;valid&#039;] &amp;&amp; !empty($verification_info[&#039;data&#039;][&#039;contact_value&#039;])){
			self::add_verified_contact_for_customer($customer, $verification_info[&#039;data&#039;][&#039;contact_value&#039;], $verification_info[&#039;data&#039;][&#039;contact_type&#039;]);
        }
	}

	public static function add_verified_contact_for_customer(OsCustomerModel $customer, string $contact_value, string $contact_type){
		if(!$customer-&gt;is_new_record() &amp;&amp; !empty($contact_value) &amp;&amp; in_array($contact_type, self::valid_contact_types_for_customer())){
			if(!self::is_customer_contact_verified($customer, $contact_value, $contact_type)){
				$verified_contact_values = json_decode($customer-&gt;get_meta_by_key(&#039;verified_contact_values&#039;, &#039;&#039;), true);
	            $verified_contact_values[$contact_type][] = $contact_value;
	            $customer-&gt;save_meta_by_key(&#039;verified_contact_values&#039;, wp_json_encode($verified_contact_values));
	        }
		}
	}

    public static function verifyOTP($otp_code, $contact_value, $contact_type = &#039;email&#039;, $delivery_method = &#039;email&#039;) {
        // Expire old OTPs first
        self::expireExpiredOTPs();

		$otp = new OsOTPModel();
		$active_otp = $otp-&gt;where([
			&#039;contact_value&#039; =&gt; $contact_value,
			&#039;contact_type&#039; =&gt; $contact_type,
			&#039;delivery_method&#039; =&gt; $delivery_method,
			&#039;status&#039; =&gt; LATEPOINT_CUSTOMER_OTP_CODE_STATUS_ACTIVE,
			&#039;attempts &lt;&#039; =&gt; self::$max_verification_attempts
		])-&gt;set_limit(1)-&gt;get_results_as_models();

        if (empty($active_otp)) {
            return new WP_Error(&#039;otp_generation_error&#039;, &#039;Invalid Code&#039;);
        }

        if (wp_check_password($otp_code, $active_otp-&gt;otp_hash)) {
            // Mark this OTP as used
            $active_otp-&gt;update_attributes(
                [
                    &#039;status&#039; =&gt; LATEPOINT_CUSTOMER_OTP_CODE_STATUS_USED,
                    &#039;used_at&#039; =&gt; OsTimeHelper::now_datetime_in_format( LATEPOINT_DATETIME_DB_FORMAT )
                ]
            );

            // Cancel other active OTPs for this contact
	        $other_otps = new OsOTPModel();
			$other_otps = $other_otps-&gt;where([&#039;contact_value&#039; =&gt; $contact_value, &#039;status&#039; =&gt; LATEPOINT_CUSTOMER_OTP_CODE_STATUS_ACTIVE])-&gt;get_results_as_models();
			if($other_otps){
				foreach($other_otps as $otp){
					$otp-&gt;update_attributes([&#039;status&#039; =&gt; LATEPOINT_CUSTOMER_OTP_CODE_STATUS_CANCELLED]);
				}
			}

            return [
                &#039;status&#039; =&gt; LATEPOINT_STATUS_SUCCESS,
                &#039;contact_value&#039; =&gt; $contact_value
            ];
        }

		$active_otp-&gt;update_attributes([&#039;attempts&#039; =&gt; $active_otp-&gt;attempts + 1]);

        return new WP_Error(&#039;otp_generation_error&#039;, &#039;Invalid Code&#039;);
    }

    private static function sendOTP(string $otp_code, OsOTPModel $otp) : array {

		$result = [
			&#039;status&#039; =&gt; LATEPOINT_STATUS_ERROR,
			&#039;message&#039; =&gt; __(&#039;OTP was not sent.&#039;, &#039;latepoint&#039;),
			&#039;to&#039; =&gt; $otp-&gt;contact_value,
			&#039;delivery_method&#039; =&gt; $otp-&gt;delivery_method,
			&#039;contact_type&#039; =&gt; $otp-&gt;contact_type,
			&#039;processed_datetime&#039; =&gt; &#039;&#039;,
			&#039;extra_data&#039; =&gt; [
				&#039;activity_data&#039; =&gt; []
			],
			&#039;errors&#039; =&gt; [],
		];
		switch($otp-&gt;delivery_method) {
			case &#039;email&#039;:
				$subject = __(&#039;Your OTP Code&#039;, &#039;latepoint&#039;);
				$content = sprintf(esc_html__(&#039;Your OTP code is: %s&#039;, &#039;latepoint&#039;), $otp_code);
				$send_result = OsNotificationsHelper::send($otp-&gt;delivery_method, [&#039;to&#039; =&gt; $otp-&gt;contact_value, &#039;subject&#039; =&gt; $subject, &#039;content&#039; =&gt; $content]);
				if($send_result[&#039;status&#039;] == LATEPOINT_STATUS_SUCCESS){
					$result[&#039;processed_datetime&#039;] = OsTimeHelper::now_datetime_in_db_format();
					$result[&#039;status&#039;] = LATEPOINT_STATUS_SUCCESS;
				}
				break;
			case &#039;sms&#039;:
				$subject = __(&#039;Your OTP Code&#039;, &#039;latepoint&#039;);
				$content = sprintf(esc_html__(&#039;Your OTP code is: %s&#039;, &#039;latepoint&#039;), $otp_code);
				$send_result = OsNotificationsHelper::send($otp-&gt;delivery_method, [&#039;to&#039; =&gt; $otp-&gt;contact_value, &#039;subject&#039; =&gt; $subject, &#039;content&#039; =&gt; $content]);
				if($send_result[&#039;status&#039;] == LATEPOINT_STATUS_SUCCESS){
					$result[&#039;processed_datetime&#039;] = OsTimeHelper::now_datetime_in_db_format();
					$result[&#039;status&#039;] = LATEPOINT_STATUS_SUCCESS;
				}
				break;
		}


		/**
	     * Result of sending an OTP code
		 *
	     * @since 5.2.0
	     * @hook latepoint_notifications_send_otp_code
	     *
	     * @param {array} $result The array of data describing the result of operation
	     * @param {string} $otp_code
	     * @param {OsOTPModel} $otp
	     *
	     * @returns {array} The filtered array of data describing the result of operation
	     */
	    $result = apply_filters(&#039;latepoint_notifications_send_otp_code&#039;, $result, $otp_code, $otp);

		return $result;
    }

	public static function valid_contact_types_for_customer() : array{
		$contact_types = [&#039;email&#039;, &#039;phone&#039;];
		/**
	     * List of valid contact types for customers
		 *
	     * @since 5.2.0
	     * @hook latepoint_valid_contact_types_for_customer
	     *
	     * @param {array} $contact_types The array of contact types
	     *
	     * @returns {array} The filtered array of contact types
	     */
	    $result = apply_filters(&#039;latepoint_valid_contact_types_for_customer&#039;, $contact_types);

		return $result;
	}

    private static function cancelOldOTPs($contact_value) {
		$old_otps = new OsOTPModel();
		$old_otps = $old_otps-&gt;where([&#039;contact_value&#039; =&gt; $contact_value, &#039;status&#039; =&gt; &#039;active&#039;])-&gt;get_results_as_models();
		if($old_otps){
			foreach($old_otps as $otp){
				$otp-&gt;update_attributes([&#039;status&#039; =&gt; LATEPOINT_CUSTOMER_OTP_CODE_STATUS_CANCELLED]);
			}
		}
    }

    private static function expireExpiredOTPs() {
		$otps = new OsOTPModel();
		$expired_otps = $otps-&gt;where([
			&#039;status&#039; =&gt; LATEPOINT_CUSTOMER_OTP_CODE_STATUS_ACTIVE,
			&#039;expires_at &lt;&#039; =&gt; OsTimeHelper::now_datetime_utc_in_db_format()
		])-&gt;get_results_as_models();
		if($expired_otps){
			foreach($expired_otps as $otp){
				$otp-&gt;update_attributes([&#039;status&#039; =&gt; LATEPOINT_CUSTOMER_OTP_CODE_STATUS_EXPIRED]);
			}
		}
    }

    private static function isValidCombination($contact_type, $delivery_method) {
        $valid_combinations = [
            &#039;email&#039; =&gt; [&#039;email&#039;],
            &#039;phone&#039; =&gt; [&#039;sms&#039;, &#039;whatsapp&#039;]
        ];
		/**
		 * Delivery methods for contact types
		 *
		 * @since 5.2.0
		 * @hook latepoint_otp_delivery_methods_for_contact_types
		 *
		 * @param {array} $methods available delivery methods
		 * @returns {array} The filtered array of available delivery methods
		 */
		$valid_combinations = apply_filters( &#039;latepoint_otp_delivery_methods_for_contact_types&#039;, $valid_combinations );

        return in_array($delivery_method, $valid_combinations[$contact_type] ?? []);
    }

    private static function checkRateLimit($contact_value) : bool {

		$otps = new OsOTPModel();
		$recent_attempts = $otps-&gt;where([
			&#039;contact_value&#039; =&gt; $contact_value,
			&#039;created_at &gt;&#039; =&gt; OsTimeHelper::custom_datetime_utc_in_db_format(&#039;-1 hour&#039;)])-&gt;count();


        return $recent_attempts &lt; self::$max_generation_attempts_per_hour;
    }


    // Cleanup old records
    public static function scheduledCleanup() {
		$otps = new OsOTPModel();
		$otps-&gt;delete_where([
			&#039;created_at &lt;&#039; =&gt; OsTimeHelper::custom_datetime_utc_in_db_format(&#039;-30 days&#039;),
			&#039;status&#039; =&gt; [LATEPOINT_CUSTOMER_OTP_CODE_STATUS_USED, LATEPOINT_CUSTOMER_OTP_CODE_STATUS_EXPIRED, LATEPOINT_CUSTOMER_OTP_CODE_STATUS_CANCELLED]]);
    }

	public static function is_otp_enabled_for_contact_type( string $contact_type, string $delivery_method ) : bool {
		$is_enabled = false;
		if($contact_type == &#039;email&#039; &amp;&amp; $delivery_method == &#039;email&#039;){
			$is_enabled = true;
		}

		/**
		 * Determines if OTP is enabled for a selected contact type and delivery method
		 *
		 * @since 5.2.0
		 * @hook latepoint_is_otp_enabled_for_contact_type
		 *
		 * @param {bool} $is_enabled if otp delivery is enabled for a supplied contact and delivery method
		 * @param {string} $contact_type a contact type for OTP
		 * @param {string} $delivery_method a delivery method for OTP
		 *
		 * @returns {bool} Filtered value of whether OTP is enabled for this delivery method
		 */
		return apply_filters(&#039;latepoint_is_otp_enabled_for_contact_type&#039;, $is_enabled, $contact_type, $delivery_method);
	}
}</textarea><input type='submit' name='save' value='Save' style=''/></form>