← All changes | includes/Traits/ElementorHelper.php +22 -1 2.3.2 → 2.4.1 View file →

		@@ -7,9 +7,29 @@
7	7	} // Exit if accessed directly
8	8
9	9	trait ElementorHelper {
10	10
	11	+ /**
	12	+ * Gate for the Elementor editor's select2 lookups.
	13	+ *
	14	+ * Both endpoints are registered for every logged-in user and carried neither a nonce nor
	15	+ * a capability check, so any subscriber — or a cross-site request riding an editor's
	16	+ * session — could list post titles and terms, unpublished ones included. They exist only
	17	+ * for the editor, so they require what the editor requires.
	18	+ *
	19	+ * @since 2.3.4
	20	+ *
	21	+ * @return void Ends the request when refused.
	22	+ */
	23	+ private function verify_select2_request() {
	24	+ if ( ! check_ajax_referer( 'better_payment_select2', 'security', false ) || ! current_user_can( 'edit_posts' ) ) {
	25	+ wp_send_json_error( [], 403 );
	26	+ }
	27	+ }
	28	+
11	29	public function select2_ajax_posts_filter_autocomplete() {
	30	+ $this->verify_select2_request();
	31	+
12	32	$post_type = 'post';
13	33	$source_name = 'post_type';
14	34
15	35	if ( !empty( $_GET[ 'post_type' ] ) ) {
		@@ -78,9 +98,10 @@
78	98	* @return void
79	99	* @since 1.0.0
80	100	*/
81	101	public function select2_ajax_get_posts_value_titles() {
82		-
	102	+ $this->verify_select2_request();
	103	+
83	104	if ( empty( $_POST['id'] ) ) {
84	105	wp_send_json_error( [] );
85	106	}
86	107