← All changes | includes/Core/Integration/GoogleSheet/GoogleSheetHandler.php +43 -13 2.10.0 → 3.3.1 View file →

		@@ -6,11 +6,16 @@
6	6	*/
7	7
8	8	namespace BitCode\BitForm\Core\Integration\GoogleSheet;
9	9
	10	+if (!defined('ABSPATH')) {
	11	+ exit;
	12	+}
	13	+
10	14	use BitCode\BitForm\Core\Integration\IntegrationHandler;
11	15	use BitCode\BitForm\Core\Util\HttpHelper;
12	16	use BitCode\BitForm\Core\Util\IpTool;
	17	+use BitCode\BitForm\GlobalHelper;
13	18	use WP_Error;
14	19
15	20	/**
16	21	* Provide functionality for ZohoCrm integration
		@@ -45,12 +50,19 @@
45	50	* @return string json api response and status
46	51	*/
47	52	public static function generateTokens()
48	53	{
49		- if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce($_REQUEST['_ajax_nonce'], 'bitforms_save')) {
	54	+ if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
50	55	$authorizationHeader = null;
51		- $inputJSON = file_get_contents('php://input');
52		- $requestsParams = json_decode($inputJSON);
	56	+
	57	+ GlobalHelper::requirePostMethod();
	58	+
	59	+ try {
	60	+ $requestsParams = GlobalHelper::formatRequestData();
	61	+ } catch (\InvalidArgumentException $e) {
	62	+ wp_send_json_error($e->getMessage(), 400);
	63	+ }
	64	+
53	65	if (
54	66	empty($requestsParams->clientId)
55	67	|| empty($requestsParams->clientSecret)
56	68	|| empty($requestsParams->redirectURI)
		@@ -101,12 +113,18 @@
101	113	* @return string json crm module data
102	114	*/
103	115	public static function refreshSpreadsheetsAjaxHelper()
104	116	{
105		- if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce($_REQUEST['_ajax_nonce'], 'bitforms_save')) {
	117	+ if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
106	118	$authorizationHeader = null;
107		- $inputJSON = file_get_contents('php://input');
108		- $queryParams = json_decode($inputJSON);
	119	+
	120	+ GlobalHelper::requirePostMethod();
	121	+ try {
	122	+ $queryParams = GlobalHelper::formatRequestData();
	123	+ } catch (\InvalidArgumentException $e) {
	124	+ wp_send_json_error($e->getMessage(), 400);
	125	+ }
	126	+
109	127	if (
110	128	empty($queryParams->tokenDetails)
111	129	|| empty($queryParams->clientId)
112	130	|| empty($queryParams->clientSecret)
		@@ -168,13 +186,19 @@
168	186	* @return JSON data
169	187	*/
170	188	public static function refreshWorksheetsAjaxHelper()
171	189	{
172		- if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce($_REQUEST['_ajax_nonce'], 'bitforms_save')) {
	190	+ if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
173	191	$authorizationHeader = null;
174		- $inputJSON = file_get_contents('php://input');
175		- $queryParams = json_decode($inputJSON);
176	192
	193	+ GlobalHelper::requirePostMethod();
	194	+
	195	+ try {
	196	+ $queryParams = GlobalHelper::formatRequestData();
	197	+ } catch (\InvalidArgumentException $e) {
	198	+ wp_send_json_error($e->getMessage(), 400);
	199	+ }
	200	+
177	201	if (
178	202	empty($queryParams->clientId)
179	203	|| empty($queryParams->clientSecret)
180	204	|| empty($queryParams->spreadsheetId)
		@@ -228,13 +252,18 @@
228	252	* @return JSON data
229	253	*/
230	254	public static function refreshWorksheetHeadersAjaxHelper()
231	255	{
232		- if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce($_REQUEST['_ajax_nonce'], 'bitforms_save')) {
	256	+ if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
233	257	$authorizationHeader = null;
234		- $inputJSON = file_get_contents('php://input');
235		- $queryParams = json_decode($inputJSON);
236	258
	259	+ GlobalHelper::requirePostMethod();
	260	+ try {
	261	+ $queryParams = GlobalHelper::formatRequestData();
	262	+ } catch (\InvalidArgumentException $e) {
	263	+ wp_send_json_error($e->getMessage(), 400);
	264	+ }
	265	+
237	266	if (
238	267	empty($queryParams->worksheetName)
239	268	|| empty($queryParams->tokenDetails)
240	269	|| empty($queryParams->clientId)
		@@ -411,9 +440,10 @@
411	440	$header,
412	441	$actions,
413	442	$defaultDataConf,
414	443	$fieldValues,
415		- $fieldMap
	444	+ $fieldMap,
	445	+ $this->_formID
416	446	);
417	447
418	448	if (is_wp_error($gsheetApiResponse)) {
419	449	return $gsheetApiResponse;