| 1 |
<?php namespace EmailLog\Core\Request; |
| 2 |
|
| 3 |
use EmailLog\Core\Loadie; |
| 4 |
use EmailLog\Core\UI\Page\LogListPage; |
| 5 |
|
| 6 |
defined( 'ABSPATH' ) || exit; // Exit if accessed directly. |
| 7 |
|
| 8 |
/** |
| 9 |
* Check nonce for all Email Log requests. |
| 10 |
* |
| 11 |
* @since 2.0.0 |
| 12 |
*/ |
| 13 |
class NonceChecker implements Loadie { |
| 14 |
|
| 15 |
/** |
| 16 |
* Setup hooks. |
| 17 |
* |
| 18 |
* @inheritdoc |
| 19 |
*/ |
| 20 |
public function load() { |
| 21 |
add_action( 'admin_init', array( $this, 'check_nonce' ) ); |
| 22 |
} |
| 23 |
|
| 24 |
/** |
| 25 |
* Check nonce for all Email Log Requests. |
| 26 |
* All Email Log Requests will have the `el_` prefix and |
| 27 |
* nonce would be available at `el_{action_name}_nonce`. |
| 28 |
* |
| 29 |
* Bulk Action keys. |
| 30 |
* action => Bulk actions from the top dropdown. |
| 31 |
* action2 => Bulk actions from the bottom dropdown. |
| 32 |
*/ |
| 33 |
public function check_nonce() { |
| 34 |
if ( ! isset( $_POST['el-action'] ) && ! isset( $_REQUEST['action'] ) && ! isset( $_REQUEST['action2'] ) ) { |
| 35 |
return; |
| 36 |
} |
| 37 |
|
| 38 |
if ( isset( $_POST['el-action'] ) ) { |
| 39 |
$action = sanitize_text_field( wp_unslash($_POST['el-action']) ); |
| 40 |
|
| 41 |
$allowed_actions = [ |
| 42 |
'el-download-system-info', |
| 43 |
'el_license_activate', |
| 44 |
'el_license_deactivate', |
| 45 |
'el_bundle_license_activate', |
| 46 |
'el_bundle_license_deactivate', |
| 47 |
'el-log-list-export', |
| 48 |
'el-log-list-export-all', |
| 49 |
'el-export-logs-with-columns' |
| 50 |
]; |
| 51 |
|
| 52 |
|
| 53 |
|
| 54 |
if ( ! in_array( $action, $allowed_actions ) ) { |
| 55 |
return; |
| 56 |
} |
| 57 |
|
| 58 |
if ( ! isset( $_POST[ $action . '_nonce' ] ) ) { |
| 59 |
return; |
| 60 |
} |
| 61 |
|
| 62 |
if ( ! wp_verify_nonce( sanitize_text_field(wp_unslash($_POST[ $action . '_nonce' ] ?? '')), $action ) ) { |
| 63 |
return; |
| 64 |
} |
| 65 |
} |
| 66 |
|
| 67 |
if ( isset( $_REQUEST['action'] ) || isset( $_REQUEST['action2'] ) ) { |
| 68 |
$action = sanitize_text_field( wp_unslash($_REQUEST['action']) ); |
| 69 |
|
| 70 |
if ( '-1' === $action ) { |
| 71 |
if ( ! isset( $_REQUEST['action2'] ) ) { |
| 72 |
return; |
| 73 |
} |
| 74 |
|
| 75 |
$action = sanitize_text_field( wp_unslash($_REQUEST['action2']) ); |
| 76 |
} |
| 77 |
|
| 78 |
if ( strpos( $action, 'el-log-list-' ) !== 0 && strpos( $action, 'el-cron-' ) !== 0 ) { |
| 79 |
return; |
| 80 |
} |
| 81 |
|
| 82 |
|
| 83 |
if ( strpos( $action, 'el-log-list-' ) === 0 ) { |
| 84 |
if ( ! isset( $_REQUEST[ LogListPage::LOG_LIST_ACTION_NONCE_FIELD ] ) ) { |
| 85 |
return; |
| 86 |
} |
| 87 |
|
| 88 |
if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash($_REQUEST[ LogListPage::LOG_LIST_ACTION_NONCE_FIELD ] ?? '')), LogListPage::LOG_LIST_ACTION_NONCE ) ) { |
| 89 |
return; |
| 90 |
} |
| 91 |
} |
| 92 |
|
| 93 |
if ( strpos( $action, 'el-cron-' ) === 0 ) { |
| 94 |
if ( ! isset( $_REQUEST[ $action . '-nonce-field' ] ) ) { |
| 95 |
return; |
| 96 |
} |
| 97 |
|
| 98 |
if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash($_REQUEST[ $action . '-nonce-field' ] ?? '' )), $action . '-nonce' ) ) { |
| 99 |
return; |
| 100 |
} |
| 101 |
} |
| 102 |
} |
| 103 |
|
| 104 |
/** |
| 105 |
* Perform `el` action. |
| 106 |
* Nonce check has already happened at this point. |
| 107 |
* |
| 108 |
* @since 2.0.0 |
| 109 |
* |
| 110 |
* @param string $action Action name. |
| 111 |
* @param array $_REQUEST Request data. |
| 112 |
*/ |
| 113 |
do_action( 'el_action', $action, $_REQUEST ); |
| 114 |
|
| 115 |
/** |
| 116 |
* Perform `el` action. |
| 117 |
* Nonce check has already happened at this point. |
| 118 |
* |
| 119 |
* @since 2.0.0 |
| 120 |
* |
| 121 |
* @param array $_REQUEST Request data. |
| 122 |
*/ |
| 123 |
|
| 124 |
do_action( $action, $_REQUEST ); |
| 125 |
} |
| 126 |
} |
| 127 |
|
