| @@ -23,20 +23,18 @@ | ||
| 23 | 23 | |
| 24 | 24 | //FixIn: Flex TimeLine 1.0 |
| 25 | 25 | function wpbc_ajax_WPBC_FLEXTIMELINE_NAV() { |
| 26 | 26 | |
| 27 | - // if ( ! wpbc_check_nonce_in_admin_panel( $_POST['action'] ) ) return false; //FixIn: 7.2.1.10 // This line for admin panel | |
| 27 | + // Timeline markup always includes this action-specific nonce. Unlike the | |
| 28 | + // optional booking-form nonce policy, public timeline navigation must never | |
| 29 | + // process or reflect a cross-origin request without verifying it. | |
| 30 | + $nonce = isset( $_POST['wpbc_nonce'] ) && is_scalar( $_POST['wpbc_nonce'] ) | |
| 31 | + ? sanitize_text_field( wp_unslash( (string) $_POST['wpbc_nonce'] ) ) | |
| 32 | + : ''; | |
| 33 | + if ( ! wp_verify_nonce( $nonce, 'WPBC_FLEXTIMELINE_NAV' ) ) { | |
| 34 | + wp_die( '', '', array( 'response' => 403 ) ); | |
| 35 | + } | |
| 28 | 36 | |
| 29 | - if ( wpbc_is_use_nonce_at_front_end() ) { // FixIn: 10.1.1.2. | |
| 30 | - // phpcs:ignore WordPress.Security.NonceVerification.Recommended, WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized | |
| 31 | - $nonce = ( isset( $_REQUEST['wpbc_nonce'] ) ) ? $_REQUEST['wpbc_nonce'] : ''; | |
| 32 | - // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotValidated, WordPress.Security.NonceVerification.Recommended, WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized | |
| 33 | - if ( ! wp_verify_nonce( $nonce, $_POST['action'] ) ) { // This nonce is not valid. | |
| 34 | - /* translators: 1: ... */ | |
| 35 | - wp_die( wp_kses_post( sprintf( __( '%1$sError!%2$s Request do not pass security check! Please refresh the page and try one more time.', 'booking' ), '<strong>', '</strong>' ) . '<br/>' . sprintf( __( 'Please check more %1$shere%2$s', 'booking' ), '<a href="https://wpbookingcalendar.com/faq/request-do-not-pass-security-check/?after_update=10.1.1" target="_blank">', '</a>.' ) // FixIn: 8.8.3.6. | |
| 36 | - ) ); // Its prevent of showing '0' et the end of request. | |
| 37 | - } | |
| 38 | - } | |
| 39 | 37 | make_bk_action( 'wpbc_ajax_flex_timeline' ); |
| 40 | 38 | wp_die( '' ); // Its prevent of showing '0' et the end of request. |
| 41 | 39 | } |
| 42 | 40 | |
| @@ -478,5 +476,5 @@ | ||
| 478 | 476 | if ( ( $wpbc_action_where == 'both' ) || ( $wpbc_action_where == 'client' ) ) |
| 479 | 477 | add_action( 'wp_ajax_nopriv_' . $wpbc_action_name, 'wpbc_ajax_' . $wpbc_action_name); // Client (not logged in) |
| 480 | 478 | } |
| 481 | 479 | } |
| 482 | -} | |
| 480 | +} | |
