← All changes | includes/Core/Integration/ZohoDesk/ZohoDeskHandler.php +65 -19 2.10.0 → 3.3.1 View file →

		@@ -6,11 +6,17 @@
6	6	*/
7	7
8	8	namespace BitCode\BitForm\Core\Integration\ZohoDesk;
9	9
	10	+if (!defined('ABSPATH')) {
	11	+ exit;
	12	+}
	13	+
10	14	use BitCode\BitForm\Core\Integration\IntegrationHandler;
11	15	use BitCode\BitForm\Core\Util\HttpHelper;
12	16	use BitCode\BitForm\Core\Util\IpTool;
	17	+use BitCode\BitForm\GlobalHelper;
	18	+use WP_Error;
13	19
14	20	/**
15	21	* Provide functionality for ZohoCrm integration
16	22	*/
		@@ -46,11 +52,17 @@
46	52	* @return string | boolean zoho crm api response and status
47	53	*/
48	54	public static function generateTokens()
49	55	{
50		- if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce($_REQUEST['_ajax_nonce'], 'bitforms_save')) {
51		- $inputJSON = file_get_contents('php://input');
52		- $requestsParams = json_decode($inputJSON);
	56	+ if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
	57	+ GlobalHelper::requirePostMethod();
	58	+
	59	+ try {
	60	+ $requestsParams = GlobalHelper::formatRequestData();
	61	+ } catch (\InvalidArgumentException $e) {
	62	+ wp_send_json_error($e->getMessage(), 400);
	63	+ }
	64	+
53	65	if (
54	66	empty($requestsParams->{'accounts-server'})
55	67	|| empty($requestsParams->dataCenter)
56	68	|| empty($requestsParams->clientId)
		@@ -97,12 +109,19 @@
97	109	}
98	110
99	111	public static function refreshOrganizationsAjaxHelper()
100	112	{
101		- if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce($_REQUEST['_ajax_nonce'], 'bitforms_save')) {
	113	+ if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
102	114	$authorizationHeader = null;
103		- $inputJSON = file_get_contents('php://input');
104		- $queryParams = json_decode($inputJSON);
	115	+
	116	+ GlobalHelper::requirePostMethod();
	117	+
	118	+ try {
	119	+ $queryParams = GlobalHelper::formatRequestData();
	120	+ } catch (\InvalidArgumentException $e) {
	121	+ wp_send_json_error($e->getMessage(), 400);
	122	+ }
	123	+
105	124	if (
106	125	empty($queryParams->tokenDetails)
107	126	|| empty($queryParams->dataCenter)
108	127	|| empty($queryParams->clientId)
		@@ -167,12 +186,19 @@
167	186	* @return JSON crm module data
168	187	*/
169	188	public static function refreshDepartmentsAjaxHelper()
170	189	{
171		- if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce($_REQUEST['_ajax_nonce'], 'bitforms_save')) {
	190	+ if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
172	191	$authorizationHeader = null;
173		- $inputJSON = file_get_contents('php://input');
174		- $queryParams = json_decode($inputJSON);
	192	+
	193	+ GlobalHelper::requirePostMethod();
	194	+
	195	+ try {
	196	+ $queryParams = GlobalHelper::formatRequestData();
	197	+ } catch (\InvalidArgumentException $e) {
	198	+ wp_send_json_error($e->getMessage(), 400);
	199	+ }
	200	+
175	201	if (
176	202	empty($queryParams->tokenDetails)
177	203	|| empty($queryParams->dataCenter)
178	204	|| empty($queryParams->clientId)
		@@ -239,12 +265,19 @@
239	265	* @return JSON crm layout data
240	266	*/
241	267	public static function refreshFieldsAjaxHelper()
242	268	{
243		- if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce($_REQUEST['_ajax_nonce'], 'bitforms_save')) {
	269	+ if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
244	270	$authorizationHeader = null;
245		- $inputJSON = file_get_contents('php://input');
246		- $queryParams = json_decode($inputJSON);
	271	+
	272	+ GlobalHelper::requirePostMethod();
	273	+
	274	+ try {
	275	+ $queryParams = GlobalHelper::formatRequestData();
	276	+ } catch (\InvalidArgumentException $e) {
	277	+ wp_send_json_error($e->getMessage(), 400);
	278	+ }
	279	+
247	280	if (
248	281	empty($queryParams->tokenDetails)
249	282	|| empty($queryParams->dataCenter)
250	283	|| empty($queryParams->clientId)
		@@ -333,12 +366,18 @@
333	366	* @return JSON crm module data
334	367	*/
335	368	public static function refreshTicketOwnersAjaxHelper()
336	369	{
337		- if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce($_REQUEST['_ajax_nonce'], 'bitforms_save')) {
	370	+ if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
338	371	$authorizationHeader = null;
339		- $inputJSON = file_get_contents('php://input');
340		- $queryParams = json_decode($inputJSON);
	372	+
	373	+ GlobalHelper::requirePostMethod();
	374	+
	375	+ try {
	376	+ $queryParams = GlobalHelper::formatRequestData();
	377	+ } catch (\InvalidArgumentException $e) {
	378	+ wp_send_json_error($e->getMessage(), 400);
	379	+ }
341	380	if (
342	381	empty($queryParams->tokenDetails)
343	382	|| empty($queryParams->dataCenter)
344	383	|| empty($queryParams->clientId)
		@@ -402,12 +441,19 @@
402	441	* @return JSON crm module data
403	442	*/
404	443	public static function refreshProductsAjaxHelper()
405	444	{
406		- if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce($_REQUEST['_ajax_nonce'], 'bitforms_save')) {
	445	+ if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
407	446	$authorizationHeader = null;
408		- $inputJSON = file_get_contents('php://input');
409		- $queryParams = json_decode($inputJSON);
	447	+
	448	+ GlobalHelper::requirePostMethod();
	449	+
	450	+ try {
	451	+ $queryParams = GlobalHelper::formatRequestData();
	452	+ } catch (\InvalidArgumentException $e) {
	453	+ wp_send_json_error($e->getMessage(), 400);
	454	+ }
	455	+
410	456	if (
411	457	empty($queryParams->tokenDetails)
412	458	|| empty($queryParams->dataCenter)
413	459	|| empty($queryParams->clientId)
		@@ -585,5 +631,5 @@
585	631	return $zdeskApiResponse;
586	632	}
587	633	return $zdeskApiResponse;
588	634	}
589		-}
	635	+}