← All changes | includes/class-common-function.php +28 -44 8.5.4 → 8.0.0 View file →

		@@ -1,6 +1,5 @@
1	1	<?php
2		-if (!defined('ABSPATH')) exit; // Exit if accessed directly
3	2	/**
4	3	* Common functions class
5	4	*/
6	5	class Qcld_WPBot_Common_Functions {
		@@ -82,22 +81,20 @@
82	81	}
83	82
84	83
85	84	public function wpbot_save_feedback() {
86		- check_ajax_referer('wp_chatbot', 'nonce');
87	85	global $wpdb;
88	86
89	87	$table = $wpdb->prefix . 'wpbot_chat_report';
90	88
91		- $user_id = intval(wp_unslash($_POST['user_id']));
92		- $conversation_id= intval(wp_unslash($_POST['conversation_id']));
93		- $message = sanitize_text_field(wp_unslash($_POST['message']));
94		- $feedback = sanitize_text_field(wp_unslash($_POST['feedback'])); // "like" or "dislike"
95		- $meta_info = sanitize_textarea_field(wp_unslash($_POST['meta_info']));
	89	+ $user_id = intval($_POST['user_id']);
	90	+ $conversation_id= intval($_POST['conversation_id']);
	91	+ $message = sanitize_text_field($_POST['message']);
	92	+ $feedback = sanitize_text_field($_POST['feedback']); // "like" or "dislike"
	93	+ $meta_info = sanitize_textarea_field($_POST['meta_info']);
96	94	$date = current_time('mysql');
97	95
98		- $inserted = $wpdb->insert( // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery
99		- $table, array(
	96	+ $inserted = $wpdb->insert($table, array(
100	97	'user_id' => $user_id,
101	98	'conversation_id'=> $conversation_id,
102	99	'message' => $message,
103	100	'feedback' => $feedback,
		@@ -118,17 +115,16 @@
118	115	*/
119	116
120	117
121	118	public function wpbot_save_report() {
122		- check_ajax_referer('wp_chatbot', 'nonce');
123	119	global $wpdb;
124	120	$table_report = $wpdb->prefix . 'wpbot_chat_report';
125	121
126		- $email = sanitize_email(wp_unslash($_POST['email']));
127		- $message = sanitize_textarea_field(wp_unslash($_POST['message']));
128		- $report_text = sanitize_textarea_field(wp_unslash($_POST['report_text']));
	122	+ $email = sanitize_email( $_POST['email'] );
	123	+ $message = sanitize_textarea_field( $_POST['message'] );
	124	+ $report_text = sanitize_textarea_field( $_POST['report_text'] );
129	125
130		- $wpdb->insert( // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery
	126	+ $wpdb->insert(
131	127	$table_report,
132	128	[
133	129	'user_id' => get_current_user_id(), // or match from wpbot_user.
134	130	'message' => $message,
		@@ -146,37 +142,32 @@
146	142	wp_send_json_success();
147	143	}
148	144	public function rate_limit_settings_option_callback()
149	145	{
150		-
151		- // Check is admin and verify nonce
	146	+ // Check is admin
152	147	if (! current_user_can('manage_options')) {
153	148	wp_send_json_error('Unauthorized');
154	149	wp_die();
155	150	}
156		- check_ajax_referer( 'wp_chatbot', 'nonce' );
157	151	// Save the rate limiting enabled/disabled setting
158	152	if (isset($_POST['is_rate_limiting_enabled'])) {
159		- $is_rate_limiting_enabled = intval( wp_unslash( $_POST['is_rate_limiting_enabled'] ) );
	153	+ $is_rate_limiting_enabled = intval($_POST['is_rate_limiting_enabled']);
160	154	update_option('is_rate_limiting_enabled', $is_rate_limiting_enabled);
161	155	}
162	156	// Save the rate limits for each role
163		- // phpcs:ignore WordPress.Security.ValidatedSanitizedInput
164		- if (isset($_POST['rate_limits']) && is_array( $_POST['rate_limits'] )) {
165		- $rate_limits = array_map( 'sanitize_text_field', wp_unslash( $_POST['rate_limits'] ) );
166		- foreach ($rate_limits as $role => $limit) {
167		- $option_name = 'rate_limit_' . sanitize_key( $role );
	157	+ if (isset($_POST['rate_limits']) && is_array($_POST['rate_limits'])) {
	158	+ foreach ($_POST['rate_limits'] as $role => $limit) {
	159	+ $option_name = 'rate_limit_' . sanitize_text_field($role);
168	160	$limit_value = intval($limit);
169	161	update_option($option_name, $limit_value);
170		- // phpcs:ignore WordPress.Security.ValidatedSanitizedInput
171		- $timeframe_raw = isset( $_POST['rate_limit_timeframes'][ $role ] ) ? sanitize_text_field( wp_unslash( $_POST['rate_limit_timeframes'][ $role ] ) ) : '24';
172		- $timeframe = intval($timeframe_raw) * 3600; // Convert hours to seconds
173		- update_option('rate_limit_timeframe_' . $role, $timeframe);
	162	+ $timeframe = isset($_POST['rate_limit_timeframes'][$role]) ? sanitize_text_field($_POST['rate_limit_timeframes'][$role]) : '24';
	163	+ $timeframe = intval($timeframe * 3600); // Convert hours to seconds
	164	+ update_option('rate_limit_timeframe_' . $role, $timeframe); // Convert hours to seconds
	165	+ $timeframe = get_option('rate_limit_timeframe_' . $role, true);
174	166	}
175		- // phpcs:ignore WordPress.Security.ValidatedSanitizedInput
176		- $guest_timeframe_raw = isset( $_POST['rate_limit_timeframes']['guest'] ) ? sanitize_text_field( wp_unslash( $_POST['rate_limit_timeframes']['guest'] ) ) : '24';
177		- $timeframe = intval($guest_timeframe_raw) * 3600; // Convert hours to seconds
178		- update_option('rate_limit_timeframe_guest', $timeframe);
	167	+ $timeframe = isset($_POST['rate_limit_timeframes']['guest']) ? sanitize_text_field($_POST['rate_limit_timeframes']['guest']) : '24';
	168	+ $timeframe = intval($timeframe * 3600); // Convert hours to seconds
	169	+ update_option('rate_limit_timeframe_' . 'guest', $timeframe);
179	170	}
180	171	// In your rate_limit_settings_option_callback(), after updating options:
181	172	$this->schedule_rate_limit_reset_events();
182	173	wp_send_json_success('Settings saved');
		@@ -189,9 +180,9 @@
189	180	$timeframe = intval(get_option('rate_limit_timeframe_' . $role, true));
190	181	// Minimum 3600 seconds
191	182	$schedules['session_schedules_rate_limit_' . $role] = array(
192	183	'interval' => $timeframe,
193		- 'display' => esc_html( 'session_schedules_rate_limit_' . $role ),
	184	+ 'display' => esc_attr('session_schedules_rate_limit_' . $role, 'wpchatbot'),
194	185	);
195	186	// Schedule the cron job for each role if not already scheduled);
196	187	}
197	188	return $schedules;
		@@ -227,22 +218,15 @@
227	218	);
228	219	if (get_option('is_stream_enabled') == 1) {
229	220	$response = array(
230	221	'status' => 'error',
231		- 'message' => esc_html(
232		- ( is_array( $qlcd_wp_chatbot_ai_rate_limiting_message ) && ! empty( $qlcd_wp_chatbot_ai_rate_limiting_message[0] ) )
233		- ? $qlcd_wp_chatbot_ai_rate_limiting_message[0]
234		- : __( 'Rate limit exceeded. Please try again later.', 'chatbot' )
235		- ),
	222	+ 'message' => esc_html__((is_array($qlcd_wp_chatbot_ai_rate_limiting_message) && !empty($qlcd_wp_chatbot_ai_rate_limiting_message[0]) ? $qlcd_wp_chatbot_ai_rate_limiting_message[0] : 'Rate limit exceeded. Please try again later.'), 'wpchatbot'),
	223	+
236	224	);
237	225	} else {
238	226	$response = array(
239	227	'status' => 'success',
240		- 'message' => esc_html(
241		- ( is_array( $qlcd_wp_chatbot_ai_rate_limiting_message ) && ! empty( $qlcd_wp_chatbot_ai_rate_limiting_message[0] ) )
242		- ? $qlcd_wp_chatbot_ai_rate_limiting_message[0]
243		- : __( 'Rate limit exceeded. Please try again later.', 'chatbot' )
244		- ),
	228	+ 'message' => esc_html__((is_array($qlcd_wp_chatbot_ai_rate_limiting_message) && !empty($qlcd_wp_chatbot_ai_rate_limiting_message[0]) ? $qlcd_wp_chatbot_ai_rate_limiting_message[0] : 'Rate limit exceeded. Please try again later.'), 'wpchatbot'),
245	229	);
246	230	}
247	231	if (is_user_logged_in()) {
248	232	$user = wp_get_current_user();
		@@ -290,9 +274,9 @@
290	274	{
291	275	if (empty($role)) {
292	276	return;
293	277	}
294		- // Resetting rate limit used counts for role.
	278	+ error_log('Resetting rate limit used counts for role: ');
295	279	// loop through each role
296	280	// for each role get all users with that role
297	281	$roles = wp_roles()->roles;
298	282	foreach ($roles as $list_roll => $details) {
		@@ -324,9 +308,9 @@
324	308	session_start();
325	309	}
326	310	// we will use guest_id to identify the guest user
327	311	if (! isset($_SESSION['guest_id'])) {
328		- $user_ip = isset( $_SERVER['REMOTE_ADDR'] ) ? sanitize_text_field( wp_unslash( $_SERVER['REMOTE_ADDR'] ) ) : '';
	312	+ $user_ip = $_SERVER['REMOTE_ADDR'];
329	313	$session_id = md5($user_ip . time());
330	314	$_SESSION['guest_id'] = $session_id;
331	315	$_SESSION['guest_id_time'][$session_id] = time();
332	316	get_option('rate_', 10);