← All changes | core/lib/wpbc-ajax.php +28 -30 10.10 → 11.8.4 View file →

		@@ -23,20 +23,18 @@
23	23
24	24	//FixIn: Flex TimeLine 1.0
25	25	function wpbc_ajax_WPBC_FLEXTIMELINE_NAV() {
26	26
27		- // if ( ! wpbc_check_nonce_in_admin_panel( $_POST['action'] ) ) return false; //FixIn: 7.2.1.10 // This line for admin panel
	27	+ // Timeline markup always includes this action-specific nonce. Unlike the
	28	+ // optional booking-form nonce policy, public timeline navigation must never
	29	+ // process or reflect a cross-origin request without verifying it.
	30	+ $nonce = isset( $_POST['wpbc_nonce'] ) && is_scalar( $_POST['wpbc_nonce'] )
	31	+ ? sanitize_text_field( wp_unslash( (string) $_POST['wpbc_nonce'] ) )
	32	+ : '';
	33	+ if ( ! wp_verify_nonce( $nonce, 'WPBC_FLEXTIMELINE_NAV' ) ) {
	34	+ wp_die( '', '', array( 'response' => 403 ) );
	35	+ }
28	36
29		- if ( wpbc_is_use_nonce_at_front_end() ) { // FixIn: 10.1.1.2.
30		- // phpcs:ignore WordPress.Security.NonceVerification.Recommended, WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
31		- $nonce = ( isset( $_REQUEST['wpbc_nonce'] ) ) ? $_REQUEST['wpbc_nonce'] : '';
32		- // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotValidated, WordPress.Security.NonceVerification.Recommended, WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
33		- if ( ! wp_verify_nonce( $nonce, $_POST['action'] ) ) { // This nonce is not valid.
34		- /* translators: 1: ... */
35		- wp_die( wp_kses_post( sprintf( __( '%1$sError!%2$s Request do not pass security check! Please refresh the page and try one more time.', 'booking' ), '<strong>', '</strong>' ) . '<br/>' . sprintf( __( 'Please check more %1$shere%2$s', 'booking' ), '<a href="https://wpbookingcalendar.com/faq/request-do-not-pass-security-check/?after_update=10.1.1" target="_blank">', '</a>.' ) // FixIn: 8.8.3.6.
36		- ) ); // Its prevent of showing '0' et the end of request.
37		- }
38		- }
39	37	make_bk_action( 'wpbc_ajax_flex_timeline' );
40	38	wp_die( '' ); // Its prevent of showing '0' et the end of request.
41	39	}
42	40
		@@ -83,9 +81,9 @@
83	81
84	82	$approved_id_str = join( ',', $approved_id );
85	83	$approved_id_str = wpbc_clean_digit_or_csd( $approved_id_str );
86	84
87		- // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQL.InterpolatedNotPrepared
	85	+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared, PluginCheck.Security.DirectDB.UnescapedDBParameter, WordPress.DB.PreparedSQL.InterpolatedNotPrepared
88	86	if ( false === $wpdb->query( $wpdb->prepare( "UPDATE {$wpdb->prefix}bookingdates SET approved = %s WHERE booking_id IN ( {$approved_id_str} )", $is_approve_or_pending ) ) ) {
89	87	?>
90	88	<script type="text/javascript">
91	89	var my_message = '<?php echo esc_js( get_debuge_error( 'Error during updating to DB', __FILE__, __LINE__ ) ); ?>';
		@@ -187,11 +185,11 @@
187	185	if ( ! empty( $is_send_emeils ) ) { // FixIn: 8.1.3.35.
188	186	// wpbc_send_email_approved($approved_id_str, $is_send_emeils,$denyreason); // FixIn: 8.1.2.7.
189	187	}
190	188	}
191		-
192		- // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQL.InterpolatedNotPrepared
193		- if ( false === $wpdb->query( "UPDATE {$wpdb->prefix}booking AS bk SET bk.trash = {$is_trash} WHERE booking_id IN ({$approved_id_str})" ) ) {
	189	+ // FixIn: 10.12.1.5.
	190	+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared, PluginCheck.Security.DirectDB.UnescapedDBParameter, WordPress.DB.PreparedSQL.InterpolatedNotPrepared
	191	+ if ( false === $wpdb->query( "UPDATE {$wpdb->prefix}booking SET trash = {$is_trash} WHERE booking_id IN ({$approved_id_str})" ) ) {
194	192	?>
195	193	<script type="text/javascript">
196	194	var my_message = '<?php echo esc_attr( html_entity_decode( esc_js( get_debuge_error( 'Error during trash booking in DB', __FILE__, __LINE__ ) ), ENT_QUOTES ) ); ?>';
197	195	wpbc_admin_show_message(my_message, 'error', 30000);
		@@ -274,9 +272,9 @@
274	272	if ( ! empty( $is_send_emeils ) ) { // FixIn: 8.1.3.35.
275	273	wpbc_send_email_deleted( $approved_id_str, $is_send_emeils, $denyreason );
276	274	}
277	275
278		- // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQL.InterpolatedNotPrepared
	276	+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared, PluginCheck.Security.DirectDB.UnescapedDBParameter, WordPress.DB.PreparedSQL.InterpolatedNotPrepared
279	277	if ( false === $wpdb->query( "DELETE FROM {$wpdb->prefix}bookingdates WHERE booking_id IN ({$approved_id_str})" ) ) {
280	278	?>
281	279	<script type="text/javascript">
282	280	var my_message = '<?php echo esc_attr( html_entity_decode( esc_js( get_debuge_error( 'Error during deleting dates in DB', __FILE__, __LINE__ ) ), ENT_QUOTES ) ); ?>';
		@@ -285,9 +283,9 @@
285	283	<?php
286	284	die();
287	285	}
288	286
289		- // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQL.InterpolatedNotPrepared
	287	+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared, PluginCheck.Security.DirectDB.UnescapedDBParameter, WordPress.DB.PreparedSQL.InterpolatedNotPrepared
290	288	if ( false === $wpdb->query( "DELETE FROM {$wpdb->prefix}booking WHERE booking_id IN ({$approved_id_str})" ) ) {
291	289	?>
292	290	<script type="text/javascript">
293	291	var my_message = '<?php echo esc_attr( html_entity_decode( esc_js( get_debuge_error( 'Error during deleting booking in DB', __FILE__, __LINE__ ) ), ENT_QUOTES ) ); ?>';
		@@ -414,9 +412,9 @@
414	412
415	413	function wpbc_ajax_CHECK_BK_NEWS() {
416	414
417	415	if ( ! wpbc_check_nonce_in_admin_panel() ) return false; // FixIn: 7.2.1.10.
418		- wpdev_ajax_check_bk_news();
	416	+ wpbc_old_ajax_check_bk_news();
419	417	}
420	418
421	419
422	420	function wpbc_ajax_CHECK_BK_FEATURES() {
		@@ -421,9 +419,9 @@
421	419
422	420	function wpbc_ajax_CHECK_BK_FEATURES() {
423	421
424	422	if ( ! wpbc_check_nonce_in_admin_panel() ) return false; // FixIn: 7.2.1.10.
425		- wpdev_ajax_check_bk_news('info/features/');
	423	+ wpbc_old_ajax_check_bk_news('info/features/');
426	424	}
427	425
428	426
429	427	function wpbc_ajax_CHECK_BK_VERSION() {
		@@ -428,9 +426,9 @@
428	426
429	427	function wpbc_ajax_CHECK_BK_VERSION() {
430	428
431	429	if ( ! wpbc_check_nonce_in_admin_panel() ) return false; // FixIn: 7.2.1.10.
432		- wpdev_ajax_check_bk_version();
	430	+ wpbc_old_ajax_check_bk_version();
433	431	}
434	432
435	433
436	434
		@@ -442,10 +440,10 @@
442	440	if ( is_admin() && ( defined( 'DOING_AJAX' ) ) && ( DOING_AJAX ) ) {
443	441
444	442	// FixIn: 8.9.4.5.
445	443
446		- // Hooks list
447		- $actions_list = array(
	444	+ // Hooks list.
	445	+ $wpbc_booking_actions_list = array(
448	446	'WPBC_FLEXTIMELINE_NAV' => 'both' //FixIn: Flex TimeLine 1.0
449	447	,'CALCULATE_THE_COST' => 'both'
450	448
451	449
		@@ -464,19 +462,19 @@
464	462
465	463	, 'WPBC_IMPORT_ICS_URL' => 'admin' //FixIn: 7.3
466	464	);
467	465
468		- $actions_list = apply_filters( 'wpbc_ajax_action_list', $actions_list );
	466	+ $wpbc_booking_actions_list = apply_filters( 'wpbc_ajax_action_list', $wpbc_booking_actions_list );
469	467
470		- foreach ($actions_list as $action_name => $action_where) {
	468	+ foreach ( $wpbc_booking_actions_list as $wpbc_action_name => $wpbc_action_where) {
471	469
472	470	// phpcs:ignore WordPress.Security.NonceVerification.Recommended, WordPress.Security.NonceVerification.Missing
473		- if ( ( isset($_POST['action']) ) && ( $_POST['action'] == $action_name ) ){
	471	+ if ( ( isset($_POST['action']) ) && ( $_POST['action'] == $wpbc_action_name ) ){
474	472
475		- if ( ( $action_where == 'admin' ) || ( $action_where == 'both' ) )
476		- add_action( 'wp_ajax_' . $action_name, 'wpbc_ajax_' . $action_name); // Admin & Client (logged in usres)
	473	+ if ( ( $wpbc_action_where == 'admin' ) || ( $wpbc_action_where == 'both' ) )
	474	+ add_action( 'wp_ajax_' . $wpbc_action_name, 'wpbc_ajax_' . $wpbc_action_name); // Admin & Client (logged in usres)
477	475
478		- if ( ( $action_where == 'both' ) || ( $action_where == 'client' ) )
479		- add_action( 'wp_ajax_nopriv_' . $action_name, 'wpbc_ajax_' . $action_name); // Client (not logged in)
	476	+ if ( ( $wpbc_action_where == 'both' ) || ( $wpbc_action_where == 'client' ) )
	477	+ add_action( 'wp_ajax_nopriv_' . $wpbc_action_name, 'wpbc_ajax_' . $wpbc_action_name); // Client (not logged in)
480	478	}
481	479	}
482		-}
	480	+}