← All changes
|
includes/endpoints/class-charitable-email-verification-endpoint.php
+15
-4
1.7.0.2
→
1.8.13
View file →
| @@ -3,9 +3,9 @@ | ||
| 3 | 3 | * Email verification endpoint. |
| 4 | 4 | * |
| 5 | 5 | * @package Charitable/Classes/Charitable_Email_Verification_Endpoint |
| 6 | 6 | * @author David Bisset |
| 7 | - * @copyright Copyright (c) 2022, WP Charitable LLC | |
| 7 | + * @copyright Copyright (c) 2023, WP Charitable LLC | |
| 8 | 8 | * @license http://opensource.org/licenses/gpl-2.0.php GNU Public License |
| 9 | 9 | * @since 1.5.0 |
| 10 | 10 | * @version 1.6.55 |
| 11 | 11 | */ |
| @@ -112,8 +112,9 @@ | ||
| 112 | 112 | /** |
| 113 | 113 | * If the page should redirect, return the URL it should redirect to. |
| 114 | 114 | * |
| 115 | 115 | * @since 1.6.26 |
| 116 | + * @version 1.8.9.1 | |
| 116 | 117 | * |
| 117 | 118 | * @return false|string |
| 118 | 119 | */ |
| 119 | 120 | public function get_redirect() { |
| @@ -123,11 +124,13 @@ | ||
| 123 | 124 | if ( is_a( $result, 'WP_User' ) ) { |
| 124 | 125 | charitable_get_notices()->add_success( __( 'Your email address has been verified.', 'charitable' ) ); |
| 125 | 126 | charitable_get_session()->add_notices(); |
| 126 | 127 | |
| 128 | + // phpcs:disable WordPress.Security.NonceVerification.Recommended | |
| 127 | 129 | if ( array_key_exists( 'redirect_to', $_GET ) ) { |
| 128 | - return $_GET['redirect_to']; | |
| 130 | + return sanitize_text_field( wp_unslash( $_GET['redirect_to'] ) ); | |
| 129 | 131 | } |
| 132 | + // phpcs:enable WordPress.Security.NonceVerification.Recommended | |
| 130 | 133 | } |
| 131 | 134 | |
| 132 | 135 | return false; |
| 133 | 136 | } |
| @@ -205,8 +208,9 @@ | ||
| 205 | 208 | /** |
| 206 | 209 | * Check whether a key and login were provided and are valid. |
| 207 | 210 | * |
| 208 | 211 | * @since 1.5.0 |
| 212 | + * @version 1.8.9.1 | |
| 209 | 213 | * |
| 210 | 214 | * @return false|WP_User|WP_Error False if the key or login are missing. |
| 211 | 215 | * WP_User if they are and the combo is valid. |
| 212 | 216 | * WP_Error in case of failure. |
| @@ -212,13 +216,17 @@ | ||
| 212 | 216 | * WP_Error in case of failure. |
| 213 | 217 | */ |
| 214 | 218 | protected function get_verification_check_result() { |
| 215 | 219 | if ( ! isset( $this->verification_result ) ) { |
| 220 | + // phpcs:disable WordPress.Security.NonceVerification.Recommended | |
| 216 | 221 | if ( ! isset( $_GET['key'] ) || ! isset( $_GET['login'] ) ) { |
| 217 | 222 | $this->verification_result = false; |
| 218 | 223 | } else { |
| 219 | - $this->verification_result = check_password_reset_key( wp_unslash( $_GET['key'] ), wp_unslash( $_GET['login'] ) ); | |
| 224 | + $key = sanitize_text_field( wp_unslash( $_GET['key'] ) ); | |
| 225 | + $login = sanitize_text_field( wp_unslash( $_GET['login'] ) ); | |
| 226 | + $this->verification_result = check_password_reset_key( $key, $login ); | |
| 220 | 227 | } |
| 228 | + // phpcs:enable WordPress.Security.NonceVerification.Recommended | |
| 221 | 229 | |
| 222 | 230 | /* The user is logged in but the verification was for a different user. */ |
| 223 | 231 | if ( is_user_logged_in() && get_current_user_id() !== $this->verification_result->ID ) { |
| 224 | 232 | $this->verification_result = false; |
| @@ -225,9 +233,12 @@ | ||
| 225 | 233 | } |
| 226 | 234 | |
| 227 | 235 | /* If everything checks out, mark the user as verified. */ |
| 228 | 236 | if ( is_a( $this->verification_result, 'WP_User' ) ) { |
| 229 | - charitable_get_user( get_user_by( 'login', $_GET['login'] ) )->mark_as_verified( true ); | |
| 237 | + // phpcs:disable WordPress.Security.NonceVerification.Recommended | |
| 238 | + $login = sanitize_text_field( wp_unslash( $_GET['login'] ) ); | |
| 239 | + // phpcs:enable WordPress.Security.NonceVerification.Recommended | |
| 240 | + charitable_get_user( get_user_by( 'login', $login ) )->mark_as_verified( true ); | |
| 230 | 241 | } |
| 231 | 242 | } |
| 232 | 243 | |
| 233 | 244 | return $this->verification_result; |