booking / includes / _functions / nonce_func.php

nonce_func.php in Booking Calendar 10.15.7, at includes/_functions/nonce_func.php

218 lines 9.3 KB

Raw Download Zip

1	<?php
2	/**
3	* @version 1.0
4	* @package Booking Calendar
5	* @subpackage Nonce functions - excluding from front-end
6	* @category Functions
7	*
8	* @author wpdevelop
9	* @link https://wpbookingcalendar.com/
10	* @email info@wpbookingcalendar.com
11	*
12	* @modified 2024-06-14
13	*/
14
15	if ( ! defined( 'ABSPATH' ) ) exit; // Exit if accessed directly
16
17	// FixIn: 10.1.1.2.
18
19	// =====================================================================================================================
20	// == Nonce functions ==
21	// =====================================================================================================================
22
23	/**
24	* Is use nonce fields at Front-Edn side in king forms
25	* If we do not use nonce, then it can prevent issues on websites with cache plugins regarding these Errors: Forbidden (403) Probably nonce for this page has been expired.
26	* or Error: Request do not pass security check! Please refresh the page and try one more time. Please check more here https://wpbookingcalendar.com/faq/request-do-not-pass-security-check/
27	* Find more information at these pages: https://konstantin.blog/2012/nonces-on-the-front-end-is-a-bad-idea/
28	* https://contactform7.com/2017/08/18/contact-form-7-49/
29	* https://developer.wordpress.org/apis/security/nonces/
30	*
31	* @return bool
32	*/
33	function wpbc_is_use_nonce_at_front_end() {
34	return( 'On' === get_bk_option( 'booking_is_nonce_at_front_end' ) );
35	}
36
37	// ---------------------------------------------------------------------------------------------------------------------
38	// S u p p o r t f u n c t i o n s f o r A j a x ///////////////
39	// ---------------------------------------------------------------------------------------------------------------------
40
41	/**
42	* Verify the nonce in Admin Panel - during Ajax request
43	*
44	* @param $action_check
45	*
46	* @return bool\|void
47	*/
48	function wpbc_check_nonce_in_admin_panel( $action_check = 'wpbc_ajax_admin_nonce' ){
49	// phpcs:ignore WordPress.Security.NonceVerification.Recommended, WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
50	$nonce = ( isset($_REQUEST['wpbc_nonce']) ) ? $_REQUEST['wpbc_nonce'] : '';
51
52	if ( '' === $nonce ) return false; // Its was request from some other plugin // FixIn: 7.2.1.10.
53
54	if ( ! wp_verify_nonce( $nonce, $action_check ) ) { // This nonce is not valid.
55	?>
56	<script type="text/javascript">
57	if (jQuery("#ajax_respond").length > 0 ){
58	jQuery( "#ajax_respond" ).after( "<div class='wpdevelop'><div style='margin: 0 0 40px;' class='wpbc-general-settings-notice wpbc-settings-notice notice-error 0alert 0alert-warning 0alert-danger'><?php
59
60	echo '<strong>' . esc_js( __( 'Error' , 'booking') ) . '!</strong> ';
61
62	/* translators: 1: ... */
63	echo esc_js( sprintf( __( 'Probably nonce for this page has been expired. Please %1$sreload the page%2$s.', 'booking' ), "<a href='javascript:void(0)' onclick='javascript:location.reload();'>", "</a>" ) );
64	// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped, WordPress.WP.I18n.MissingTranslatorsComment
65	echo '<br/>' . sprintf( esc_js( __( 'Please check more here %s', 'booking' ) ), "<a href='https://wpbookingcalendar.com/faq/request-do-not-pass-security-check/?update=" . esc_attr( WP_BK_VERSION_NUM ) . '&ver=' . wpbc_get_version_type__and_mu() . "'>FAQ</a>" ); // FixIn: 8.8.3.6.
66
67	?></div></div>" );
68	} else if (jQuery(".ajax_respond_insert").length > 0 ){
69	jQuery( ".ajax_respond_insert" ).after( "<div class='wpdevelop'><div class='alert alert-warning alert-danger'><?php
70	// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped, WordPress.WP.I18n.MissingTranslatorsComment
71	printf( __( '%1$sError!%2$s Request do not pass security check! Please refresh the page and try one more time.', 'booking' ), '<strong>', '</strong>' );
72	// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped, WordPress.WP.I18n.MissingTranslatorsComment
73	echo '<br/>' . sprintf( __( 'Please check more here %s', 'booking' ), 'https://wpbookingcalendar.com/faq/request-do-not-pass-security-check/?update=' . esc_attr( WP_BK_VERSION_NUM ) . '&ver=' . wpbc_get_version_type__and_mu() ); // FixIn: 8.8.3.6.
74	?></div></div>" );
75	}
76	if ( jQuery( "#ajax_message" ).length ){
77	jQuery( "#ajax_message" ).slideUp();
78	}
79	</script>
80	<?php
81	die;
82	}
83	return true; // FixIn: 7.2.1.10.
84	}
85
86
87	// ---------------------------------------------------------------------------------------------------------------------
88	// For test only, where Nonce time can be adjusted
89	// ---------------------------------------------------------------------------------------------------------------------
90	// add_filter( 'nonce_life', 'wpbc_nonce_life_test' );
91	//function wpbc_nonce_life_test( $lifespan ) {
92	// return 60; //4 * HOUR_IN_SECONDS;
93	//}
94
95
96	function wpbc_do_not_cache() {
97
98	if ( ! defined( 'DONOTCACHEPAGE' ) ) {
99	define( 'DONOTCACHEPAGE', true ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedConstantFound
100	}
101
102	if ( ! defined( 'DONOTCACHEDB' ) ) {
103	define( 'DONOTCACHEDB', true ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedConstantFound
104	}
105
106	if ( ! defined( 'DONOTMINIFY' ) ) {
107	define( 'DONOTMINIFY', true ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedConstantFound
108	}
109
110	if ( ! defined( 'DONOTCDN' ) ) {
111	define( 'DONOTCDN', true ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedConstantFound
112	}
113
114	if ( ! defined( 'DONOTCACHEOBJECT' ) ) {
115	define( 'DONOTCACHEOBJECT', true ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedConstantFound
116	}
117
118	// Set the headers to prevent caching for the different browsers.
119	nocache_headers();
120	}
121	//wpbc_do_not_cache();
122
123
124	// =====================================================================================================================
125	// Exclude from Minify and caching from different CACHE Plugins
126	// =====================================================================================================================
127
128	/**
129	* Add exclusion of minify JS files in 'WP-Optimize' plugin // FixIn: 10.1.3.3.
130	*
131	* Otherwise default rules:
132	* plugins/booking
133	* *jquery/jquery.min.js
134	* *jquery/jquery-migrate.min.js
135	*
136	* @param $excluded_filter_arr
137	*
138	* @return mixed
139	*/
140	function wpbc_exclude_for_wp_optimize( $excluded_filter_arr ) {
141
142	if ( is_array( $excluded_filter_arr ) ) {
143	$excluded_filter_arr[] = '/plugins/booking';
144	$excluded_filter_arr[] = '*/jquery/jquery.min.js';
145	$excluded_filter_arr[] = '*/jquery/jquery-migrate.min.js';
146	}
147
148	return $excluded_filter_arr;
149	}
150	add_filter( 'wp-optimize-minify-default-exclusions', 'wpbc_exclude_for_wp_optimize', 10, 1 );
151
152	// FixIn: 10.14.4.2. (loader made cache-proof)
153	function wpbc_get_exclude_scripts_arr_for_wp_rocket() {
154
155	$plugin_path = wpbc_make_link_relative( WPBC_PLUGIN_URL );
156
157	$exclusions = array();
158	// Exclude jQuery
159	$exclusions[] = '/jquery(-migrate)?-?([0-9.]+)?(.min\|.slim\|.slim.min)?.js(\?(.*))?( \|\'\|"\|>)';
160
161	// Exclude plugin JS files
162	$exclusions[] = $plugin_path . '/(.*)';
163
164	/*
165	$exclusions[] = '/wp-content/plugins/booking(.*)/_dist/all/_out/wpbc_all.js';
166	$exclusions[] = '/wp-content/plugins/booking(.*)/js/datepick/jquery.datepick.wpbc.9.0.js';
167	$exclusions[] = '/wp-content/plugins/booking(.*)/js/wpbc_time-selector.js';
168	$exclusions[] = '/wp-content/plugins/booking(.*)/vendors/_custom/tippy.js';
169	$exclusions[] = '/wp-content/plugins/booking(.*)/vendors/_custom/popper/popper.js';
170	$exclusions[] = '/wp-content/plugins/booking(.*)/inc/js/biz_m.js';
171	*/
172
173	// Exclude some important plugin JS vars
174	$exclusions[] = 'wpbc_init__head';
175	$exclusions[] = 'wpbc_url_ajax';
176	$exclusions[] = 'booking_max_monthes_in_calendar';
177	$exclusions[] = 'wpbc_define_tippy_popover';
178	$exclusions[] = 'flex_tl_table_loading';
179
180	$exclusions[] = '(.)_wpbc.(.)';
181	$exclusions[] = 'moveOptionalElementsToGarbage';
182	$exclusions[] = ' wpbc_(.*)';
183
184
185	// Old way to exclude all
186	$exclusions[] = '/wp-content/plugins/booking(.)/(.)';
187	$exclusions[] = '(.)wpbc(.)';
188
189	return $exclusions;
190	}
191
192	/**
193	* Exclude JS scripts from Delay JS in the WP Rocket plugin
194	*
195	* @param $exclusions
196	*
197	* @return mixed
198	*/
199	function wpbc_exclude_from_delay_for_wp_rocket( $other_exclusions ) {
200	// return $exclusions;
201	$wpbc_exclusions = wpbc_get_exclude_scripts_arr_for_wp_rocket();
202
203	$exclusions = array_merge( $other_exclusions, $wpbc_exclusions );
204
205	return $exclusions;
206	}
207	add_filter( 'rocket_delay_js_exclusions', 'wpbc_exclude_from_delay_for_wp_rocket' );
208
209	/**
210	* Don't defer our plugin scripts
211	*/
212	add_filter( 'rocket_defer_js_exclusions', 'wpbc_exclude_from_delay_for_wp_rocket' );
213
214	/**
215	* If WP Rocket is deferring inline JS, exclude our initializer by a unique key
216	*/
217	add_filter( 'rocket_defer_inline_exclusions', 'wpbc_exclude_from_delay_for_wp_rocket' );
218