| @@ -825,14 +825,20 @@ | ||
| 825 | 825 | */ |
| 826 | 826 | public function deactivate_reasons_form_submit() |
| 827 | 827 | { |
| 828 | 828 | check_ajax_referer('wpins_deactivation_nonce', 'security'); |
| 829 | + // Better Payment hardening (not upstream): a nonce is not a permission, so only a user | |
| 830 | + // who can deactivate plugins may write these options — and what they write is stored as | |
| 831 | + // plain text, never as whatever structure the request carried. | |
| 832 | + if ( ! current_user_can( 'activate_plugins' ) ) { | |
| 833 | + wp_send_json_error( null, 403 ); | |
| 834 | + } | |
| 829 | 835 | if (isset($_POST['values'])) { |
| 830 | - $values = $_POST['values']; | |
| 836 | + $values = is_scalar( $_POST['values'] ) ? sanitize_text_field( wp_unslash( $_POST['values'] ) ) : ''; | |
| 831 | 837 | update_option('wpins_deactivation_reason_' . $this->plugin_name, $values); |
| 832 | 838 | } |
| 833 | 839 | if (isset($_POST['details'])) { |
| 834 | - $details = sanitize_text_field($_POST['details']); | |
| 840 | + $details = is_scalar( $_POST['details'] ) ? sanitize_text_field( wp_unslash( $_POST['details'] ) ) : ''; | |
| 835 | 841 | update_option('wpins_deactivation_details_' . $this->plugin_name, $details); |
| 836 | 842 | } |
| 837 | 843 | echo 'success'; |
| 838 | 844 | wp_die(); |
