WordPress.org
Get WordPress

Plugin Directory

Changeset 2944257


Ignore:
Timestamp:
07/27/2023 02:31:14 PM (3 years ago)
Author:
integrationdevpaytm
Message:

Security Updates

Location:
paytm-donation/trunk
Files:
9 added
1 deleted
4 edited

Legend:

Unmodified
Added
Removed

  • paytm-donation/trunk/includes/PaytmConstantsDonation.php

    r2939944 r2944257  
    1515    CONST APPEND_TIMESTAMP                      = true;
    1616    CONST X_REQUEST_ID                          = "PLUGIN_WORDPRESS_";
    17     CONST PLUGIN_VERSION_FOLDER                 = "220";
     17    CONST PLUGIN_VERSION_FOLDER                 = "221";
    1818
    1919    CONST MAX_RETRY_COUNT                       = 3;
    … …  
    2121    CONST TIMEOUT                               = 10;
    2222
    23     CONST LAST_UPDATED                          = "20230718";
    24     CONST PLUGIN_VERSION                        = "2.2.0";
     23    CONST LAST_UPDATED                          = "20230727";
     24    CONST PLUGIN_VERSION                        = "2.2.1";
    2525    CONST PLUGIN_DOC_URL                        = "https://business.paytm.com/docs/wordpress/";
    2626

  • paytm-donation/trunk/paytm-donation-user-field.php

    r2939944 r2944257  
    128128 
    129129    <?php $post_paytmCustomField = get_queried_object_id();
    130     echo '<input type="button" value="Save Changes" class="button-primary" id="paytm-paytmCustomFieldSave" data-action="'.admin_url('admin-ajax.php').'?action=initiate_paytmCustomFieldSave" data-id="'.$post_paytmCustomField.'" />';
     130
     131    //$nonce_field = wp_nonce_field(plugin_basename(__FILE__),'hide_form_field_for_admin_nonce');
     132
     133    echo '<input type="button" value="Save Changes" class="button-primary" id="paytm-paytmCustomFieldSave" data-action="'.admin_url('admin-ajax.php').'?action=initiate_paytmCustomFieldSave&nonce='.wp_create_nonce( 'hide_form_field_for_admin_nonce' ).'" data-id="'.$post_paytmCustomField.'" />';
    131134    ?>
    132135</form>
    … …  
    223226    var id = jQuery(this).data('id');
    224227    jQuery.ajax({
    225          data: data,
     228         data:data,
    226229         method: "POST",
    227230         url: url,
    228231         dataType: 'JSON',
    229232         success: function(result) {
    230             alert("Record Saved Successfully!");
    231               location.reload();
     233            if (result.success == true) {
     234                alert("Record Saved Successfully!");
     235                location.reload();
     236            }else if(result.error == true){
     237                alert(result.message);
     238                location.reload();
     239            } else {
     240                alert('Something went wrong. Please try again!');
     241                location.reload();
     242            }
    232243        }
    233244    });

  • paytm-donation/trunk/paytm-donation.php

    r2939944 r2944257  
    44 * Plugin URI: https://business.paytm.com/docs/wordpress/
    55 * Description: This plugin allow you to accept donation payments using Paytm. This plugin will add a simple form that user will fill, when he clicks on submit he will redirected to Paytm website to complete his transaction and on completion his payment, paytm will send that user back to your website along with transactions details. This plugin uses server-to-server verification to add additional security layer for validating transactions. Admin can also see all transaction details with payment status by going to "Paytm Payment Details" from menu in admin.
    6  * Version: 2.2.0
     6 * Version: 2.2.1
    77 * Author: Paytm
    88 * Author URI: https://business.paytm.com/payment-gateway
    … …  
    529529        }               
    530530    endforeach;
    531     // echo $dynamic_html;
    532 
     531
     532    $nonce_field = wp_nonce_field(plugin_basename(__FILE__),'hide_form_field_for_nonce');
     533   
    533534    $current_url = esc_url("//".$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI']);
    534535    //$html = PaytmHelperDonation::getCallbackMsgPaytm();
    … …  
    569570    <div class="paytm-pg-donar-info">'
    570571                    .$dynamic_html.
     572                     $nonce_field.
    571573                    '</div>
    572574
    … …  
    585587    $paytmParams = array();
    586588    $txntoken = '';
     589    $token_val = $_POST['token'];
     590   
     591    if (!isset($_POST['token'])  || !wp_verify_nonce( $_POST['token'], plugin_basename(__FILE__))){
     592    // Actions to do should the nonce is invalid
     593        $error = array(
     594                        "error"=>true,
     595                        "message" => "Sorry, your request did not verified"
     596                    );
     597            echo json_encode($error);
     598            wp_die();
     599
     600    }
    587601
    588602    /*added code for validate  data*/
    … …  
    598612        }
    599613    }
     614
     615
    600616    /*End code for validate  data*/
    601617
    … …  
    896912
    897913    function initiate_paytmCustomFieldSave(){
    898     echo json_encode($_POST);
    899     update_option('paytm_user_field', json_encode($_POST));
    900     wp_die();
     914        if (isset($_GET['nonce'])){
     915            if (  !wp_verify_nonce( $_GET['nonce'], 'hide_form_field_for_admin_nonce' ) ){
     916                 $error = array(
     917                "error"   => true,
     918                "message" => "Sorry, your request was not verified."
     919            );
     920            echo json_encode( $error );
     921            wp_die();
     922            }
     923        }
     924 
     925        //echo json_encode($_POST);wp_die();
     926        update_option('paytm_user_field', json_encode($_POST));
     927        echo json_encode(array('success'=> true));
     928        wp_die();
    901929    }   
    902930

  • paytm-donation/trunk/readme.txt

    r2939944 r2944257  
    44Requires PHP: 7.4
    55Requires at least: 4.9
    6 Tested up to: 6.2
    7 Stable tag: 2.2.0
     6Tested up to: 6.2.2
     7Stable tag: 2.2.1
    88License: GPLv2 or later
    99License URI: http://www.gnu.org/licenses/gpl-2.0.html
    … …  
    2929== Changelog ==
    3030
     31= 2.2.1 =
     32* Security Fixes
     33
    3134= 2.2.0 =
    3235* Update in manage donation form setting
Note: See TracChangeset for help on using the changeset viewer.