WordPress.org
Get WordPress

Plugin Directory

Changeset 2987863


Ignore:
Timestamp:
11/02/2023 07:36:20 AM (2 years ago)
Author:
mailmunch
Message:

add nonce validation

Location:
constant-contact-forms-by-mailmunch
Files:
11 edited
2 copied

Legend:

Unmodified
Added
Removed

  • constant-contact-forms-by-mailmunch/tags/2.0.11/admin/class-constantcontact-mailmunch-admin.php

    r2210436 r2987863  
    111111        wp_enqueue_script( $this->plugin_name, plugin_dir_url( __FILE__ ) . 'js/constantcontact-mailmunch-admin.js', array( 'jquery' ), $this->version, false );
    112112
     113        // Register the new script
     114        wp_register_script( 'mailchimp_mailmunch_script', plugin_dir_url( __FILE__ ) . 'js/constantcontact-mailmunch-admin.js', array( 'jquery' ), $this->version, false );
     115        // enqueue it
     116    wp_enqueue_script( 'mailchimp_mailmunch_script' );
     117        // localize it for ajax calls
     118        wp_localize_script( 'mailchimp_mailmunch_script', 'mailmunch_nonces', array(
     119            'delete_widget' => wp_create_nonce('mailmunch_delete_widget'),
     120            'change_email_status' => wp_create_nonce('mailmunch_change_email_status'),
     121            'delete_email' => wp_create_nonce('mailmunch_delete_email'),
     122        ));
     123
    113124    }
    114125
    … …  
    130141
    131142    public function delete_widget() {
    132         $this->initiate_api();
    133         echo json_encode($this->mailmunch_api->deleteWidget($_POST['widget_id']));
     143        // Check if nonce is set and valid and if the current user has 'manage_options' capability (typically administrators).
     144    if ( isset($_POST['nonce']) && wp_verify_nonce($_POST['nonce'], 'mailmunch_delete_widget') && current_user_can('manage_options') ) {
     145            $this->initiate_api();
     146            echo json_encode($this->mailmunch_api->deleteWidget($_POST['widget_id']));
     147    } else {
     148            echo json_encode(array('error' => 'Permission denied.')); // Optionally, you can return an error message.
     149    }
     150    exit;
     151    }
     152
     153    public function change_email_status() {
     154        // Check if nonce is set and valid and if the current user has 'manage_options' capability (typically administrators).
     155        if ( isset($_POST['nonce']) && wp_verify_nonce($_POST['nonce'], 'mailmunch_change_email_status') && current_user_can('manage_options') ) {
     156            $this->initiate_api();
     157            echo json_encode($this->mailmunch_api->changeEmailStatus($_POST['email_id'], $_POST['email_status']));
     158        } else {
     159            echo json_encode(array('error' => 'Permission denied.')); // Optionally, you can return an error message.
     160        }
    134161        exit;
    135162    }
    136    
    137     public function change_email_status() {
    138         $this->initiate_api();
    139         echo json_encode($this->mailmunch_api->changeEmailStatus($_POST['email_id'], $_POST['email_status']));
    140         exit;
    141     }
    142    
     163
    143164    public function delete_email() {
    144         $this->initiate_api();
    145         echo json_encode($this->mailmunch_api->deleteEmail($_POST['email_id']));
     165        // Check if nonce is set and valid and if the current user has 'manage_options' capability (typically administrators).
     166        if ( isset($_POST['nonce']) && wp_verify_nonce($_POST['nonce'], 'mailmunch_delete_email') && current_user_can('manage_options') ) {
     167            $this->initiate_api();
     168            echo json_encode($this->mailmunch_api->deleteEmail($_POST['email_id']));
     169        } else {
     170            echo json_encode(array('error' => 'Permission denied.')); // Optionally, you can return an error message.
     171        }
    146172        exit;
    147173    }
    … …  
    291317    public function settings_page() {
    292318        $this->initiate_api();
    293         if ($_POST) {
    294             $this->mailmunch_api->setSetting('auto_embed', $_POST['auto_embed']);
    295             $this->mailmunch_api->setSetting('landing_pages_enabled', $_POST['landing_pages_enabled']);
    296         }
     319
     320        // Add nonce check
     321    if (isset($_POST['mailmunch_settings_nonce']) && wp_verify_nonce($_POST['mailmunch_settings_nonce'], 'mailmunch_settings_action')) {
     322            // Nonce is valid; process the form data
     323            if (isset($_POST['auto_embed'])) {
     324                $this->mailmunch_api->setSetting('auto_embed', $_POST['auto_embed']);
     325            }
     326            if (isset($_POST['landing_pages_enabled'])) {
     327                $this->mailmunch_api->setSetting('landing_pages_enabled', $_POST['landing_pages_enabled']);
     328            }
     329    }
     330       
    297331        require_once(plugin_dir_path(__FILE__) . 'partials/constantcontact-mailmunch-settings.php');
    298332    }

  • constant-contact-forms-by-mailmunch/tags/2.0.11/admin/js/constantcontact-mailmunch-admin.js

    r1773625 r2987863  
    6262        url: ajaxurl,
    6363        type: 'POST',
    64         data: {action: 'delete_widget', widget_id: $(this).data('widget-id')},
     64        data: {action: 'delete_widget', widget_id: $(this).data('widget-id'), nonce: mailmunch_nonces.delete_widget},
    6565        dataType: 'json',
    6666        success: function(data) {
    … …  
    8484        url: ajaxurl,
    8585        type: 'POST',
    86         data: {action: 'change_email_status', email_status: $(this).data('email-status'), email_id: $(this).data('email-id')},
     86        data: {action: 'change_email_status', email_status: $(this).data('email-status'), email_id: $(this).data('email-id'), nonce: mailmunch_nonces.change_email_status},
    8787        dataType: 'json',
    8888        success: function(data) {
    … …  
    106106        url: ajaxurl,
    107107        type: 'POST',
    108         data: {action: 'delete_email', email_id: $(this).data('email-id')},
     108        data: {action: 'delete_email', email_id: $(this).data('email-id'), nonce: mailmunch_nonces.delete_email},
    109109        dataType: 'json',
    110110        success: function(data) {

  • constant-contact-forms-by-mailmunch/tags/2.0.11/admin/partials/constantcontact-mailmunch-settings.php

    r1768936 r2987863  
    11<form method="POST" id="mailmunch-settings">
     2  <?php wp_nonce_field('mailmunch_settings_action', 'mailmunch_settings_nonce'); ?>
    23  <?php
    34    $autoEmbed = $this->mailmunch_api->getSetting('auto_embed');

  • constant-contact-forms-by-mailmunch/tags/2.0.11/constantcontact-mailmunch.php

    r2210461 r2987863  
    1717 * Plugin URI:        http://connect.constantcontact.com/integrations/mailmunch-email-list-builder
    1818 * Description:       The Constant Contact plugin allows you to quickly and easily add signup forms for your Constant Contact lists. Popup, Embedded, Top Bar and a variety of different options available.
    19  * Version:           2.0.10
     19 * Version:           2.0.11
    2020 * Author:            MailMunch
    2121 * Author URI:        http://www.mailmunch.com

  • constant-contact-forms-by-mailmunch/tags/2.0.11/includes/class-constantcontact-mailmunch.php

    r2210461 r2987863  
    2424define( 'CONSTANTCONTACT_MAILMUNCH_POST_TYPE', 'mailmunch_page' );
    2525define( 'CONSTANTCONTACT_MAILMUNCH_PLUGIN_DIRECTORY', 'constant-contact-forms-by-mailmunch' );
    26 define( 'CONSTANTCONTACT_MAILMUNCH_VERSION', '2.0.10' );
     26define( 'CONSTANTCONTACT_MAILMUNCH_VERSION', '2.0.11' );
    2727
    2828/**

  • constant-contact-forms-by-mailmunch/tags/2.0.11/readme.txt

    r2791143 r2987863  
    33Tags: constant contact, constant contact form, constant contact newsletter, constant contact signup, constant contact signup form, constant contact widget, constantcontact, constant contact subscribe
    44Requires at least: 3.0.1
    5 Tested up to: 6.0.2
    6 Stable tag: 2.0.10
     5Tested up to: 6.2.2
     6Stable tag: 2.0.11
    77License: GPLv2 or later
    88License URI: http://www.gnu.org/licenses/gpl-2.0.html

  • constant-contact-forms-by-mailmunch/trunk/admin/class-constantcontact-mailmunch-admin.php

    r2210436 r2987863  
    111111        wp_enqueue_script( $this->plugin_name, plugin_dir_url( __FILE__ ) . 'js/constantcontact-mailmunch-admin.js', array( 'jquery' ), $this->version, false );
    112112
     113        // Register the new script
     114        wp_register_script( 'mailchimp_mailmunch_script', plugin_dir_url( __FILE__ ) . 'js/constantcontact-mailmunch-admin.js', array( 'jquery' ), $this->version, false );
     115        // enqueue it
     116    wp_enqueue_script( 'mailchimp_mailmunch_script' );
     117        // localize it for ajax calls
     118        wp_localize_script( 'mailchimp_mailmunch_script', 'mailmunch_nonces', array(
     119            'delete_widget' => wp_create_nonce('mailmunch_delete_widget'),
     120            'change_email_status' => wp_create_nonce('mailmunch_change_email_status'),
     121            'delete_email' => wp_create_nonce('mailmunch_delete_email'),
     122        ));
     123
    113124    }
    114125
    … …  
    130141
    131142    public function delete_widget() {
    132         $this->initiate_api();
    133         echo json_encode($this->mailmunch_api->deleteWidget($_POST['widget_id']));
     143        // Check if nonce is set and valid and if the current user has 'manage_options' capability (typically administrators).
     144    if ( isset($_POST['nonce']) && wp_verify_nonce($_POST['nonce'], 'mailmunch_delete_widget') && current_user_can('manage_options') ) {
     145            $this->initiate_api();
     146            echo json_encode($this->mailmunch_api->deleteWidget($_POST['widget_id']));
     147    } else {
     148            echo json_encode(array('error' => 'Permission denied.')); // Optionally, you can return an error message.
     149    }
     150    exit;
     151    }
     152
     153    public function change_email_status() {
     154        // Check if nonce is set and valid and if the current user has 'manage_options' capability (typically administrators).
     155        if ( isset($_POST['nonce']) && wp_verify_nonce($_POST['nonce'], 'mailmunch_change_email_status') && current_user_can('manage_options') ) {
     156            $this->initiate_api();
     157            echo json_encode($this->mailmunch_api->changeEmailStatus($_POST['email_id'], $_POST['email_status']));
     158        } else {
     159            echo json_encode(array('error' => 'Permission denied.')); // Optionally, you can return an error message.
     160        }
    134161        exit;
    135162    }
    136    
    137     public function change_email_status() {
    138         $this->initiate_api();
    139         echo json_encode($this->mailmunch_api->changeEmailStatus($_POST['email_id'], $_POST['email_status']));
    140         exit;
    141     }
    142    
     163
    143164    public function delete_email() {
    144         $this->initiate_api();
    145         echo json_encode($this->mailmunch_api->deleteEmail($_POST['email_id']));
     165        // Check if nonce is set and valid and if the current user has 'manage_options' capability (typically administrators).
     166        if ( isset($_POST['nonce']) && wp_verify_nonce($_POST['nonce'], 'mailmunch_delete_email') && current_user_can('manage_options') ) {
     167            $this->initiate_api();
     168            echo json_encode($this->mailmunch_api->deleteEmail($_POST['email_id']));
     169        } else {
     170            echo json_encode(array('error' => 'Permission denied.')); // Optionally, you can return an error message.
     171        }
    146172        exit;
    147173    }
    … …  
    291317    public function settings_page() {
    292318        $this->initiate_api();
    293         if ($_POST) {
    294             $this->mailmunch_api->setSetting('auto_embed', $_POST['auto_embed']);
    295             $this->mailmunch_api->setSetting('landing_pages_enabled', $_POST['landing_pages_enabled']);
    296         }
     319
     320        // Add nonce check
     321    if (isset($_POST['mailmunch_settings_nonce']) && wp_verify_nonce($_POST['mailmunch_settings_nonce'], 'mailmunch_settings_action')) {
     322            // Nonce is valid; process the form data
     323            if (isset($_POST['auto_embed'])) {
     324                $this->mailmunch_api->setSetting('auto_embed', $_POST['auto_embed']);
     325            }
     326            if (isset($_POST['landing_pages_enabled'])) {
     327                $this->mailmunch_api->setSetting('landing_pages_enabled', $_POST['landing_pages_enabled']);
     328            }
     329    }
     330       
    297331        require_once(plugin_dir_path(__FILE__) . 'partials/constantcontact-mailmunch-settings.php');
    298332    }

  • constant-contact-forms-by-mailmunch/trunk/admin/js/constantcontact-mailmunch-admin.js

    r1773625 r2987863  
    6262        url: ajaxurl,
    6363        type: 'POST',
    64         data: {action: 'delete_widget', widget_id: $(this).data('widget-id')},
     64        data: {action: 'delete_widget', widget_id: $(this).data('widget-id'), nonce: mailmunch_nonces.delete_widget},
    6565        dataType: 'json',
    6666        success: function(data) {
    … …  
    8484        url: ajaxurl,
    8585        type: 'POST',
    86         data: {action: 'change_email_status', email_status: $(this).data('email-status'), email_id: $(this).data('email-id')},
     86        data: {action: 'change_email_status', email_status: $(this).data('email-status'), email_id: $(this).data('email-id'), nonce: mailmunch_nonces.change_email_status},
    8787        dataType: 'json',
    8888        success: function(data) {
    … …  
    106106        url: ajaxurl,
    107107        type: 'POST',
    108         data: {action: 'delete_email', email_id: $(this).data('email-id')},
     108        data: {action: 'delete_email', email_id: $(this).data('email-id'), nonce: mailmunch_nonces.delete_email},
    109109        dataType: 'json',
    110110        success: function(data) {

  • constant-contact-forms-by-mailmunch/trunk/admin/partials/constantcontact-mailmunch-settings.php

    r1768936 r2987863  
    11<form method="POST" id="mailmunch-settings">
     2  <?php wp_nonce_field('mailmunch_settings_action', 'mailmunch_settings_nonce'); ?>
    23  <?php
    34    $autoEmbed = $this->mailmunch_api->getSetting('auto_embed');

  • constant-contact-forms-by-mailmunch/trunk/constantcontact-mailmunch.php

    r2210461 r2987863  
    1717 * Plugin URI:        http://connect.constantcontact.com/integrations/mailmunch-email-list-builder
    1818 * Description:       The Constant Contact plugin allows you to quickly and easily add signup forms for your Constant Contact lists. Popup, Embedded, Top Bar and a variety of different options available.
    19  * Version:           2.0.10
     19 * Version:           2.0.11
    2020 * Author:            MailMunch
    2121 * Author URI:        http://www.mailmunch.com

  • constant-contact-forms-by-mailmunch/trunk/includes/class-constantcontact-mailmunch.php

    r2210461 r2987863  
    2424define( 'CONSTANTCONTACT_MAILMUNCH_POST_TYPE', 'mailmunch_page' );
    2525define( 'CONSTANTCONTACT_MAILMUNCH_PLUGIN_DIRECTORY', 'constant-contact-forms-by-mailmunch' );
    26 define( 'CONSTANTCONTACT_MAILMUNCH_VERSION', '2.0.10' );
     26define( 'CONSTANTCONTACT_MAILMUNCH_VERSION', '2.0.11' );
    2727
    2828/**

  • constant-contact-forms-by-mailmunch/trunk/readme.txt

    r2937584 r2987863  
    44Requires at least: 3.0.1
    55Tested up to: 6.2.2
    6 Stable tag: 2.0.10
     6Stable tag: 2.0.11
    77License: GPLv2 or later
    88License URI: http://www.gnu.org/licenses/gpl-2.0.html
Note: See TracChangeset for help on using the changeset viewer.