← All changes | Inc/Core/Controllers/BoxSettings.php +35 -7 3.1.7 → 3.1.14 View file →

		@@ -1,8 +1,8 @@
1	1	<?php
2	2	/**
3	3	* @package FireBox
4		- * @version 3.1.7 Free
	4	+ * @version 3.1.14 Free
5	5	*
6	6	* @author FirePlugins <[email protected]>
7	7	* @link https://www.fireplugins.com
8	8	* @copyright Copyright © 2026 FirePlugins All Rights Reserved
		@@ -32,9 +32,9 @@
32	32	const settings_name = 'firebox_settings';
33	33
34	34	public function __construct()
35	35	{
36		- add_action('update_option_firebox_settings', [$this, 'after_update_settings'], 10, 3);
	36	+ add_action('update_option_firebox_settings', [$this, 'after_update_settings'], 10, 2);
37	37	}
38	38
39	39	/**
40	40	* Render the page content
		@@ -139,12 +139,12 @@
139	139	* @return void
140	140	*/
141	141	public function processBoxSettings($input)
142	142	{
143		- if (isset($_REQUEST['action']) && in_array($_REQUEST['action'], ['firebox_download_key_notice_activate', 'firebox_enable_usage_tracking']))
144		- {
145		- return $input;
146		- }
	143	+ if ($this->isAllowedProgrammaticSettingsUpdate())
	144	+ {
	145	+ return is_array($input) ? $input : [];
	146	+ }
147	147
148	148	$input = is_array($input) ? $input : [];
149	149	$is_settings_form_submit = isset($_POST['option_page']) && sanitize_text_field(wp_unslash($_POST['option_page'])) === self::settings_name;
150	150
		@@ -173,9 +173,12 @@
173	173	$stored_settings = get_option('firebox_settings', []);
174	174	$stored_settings = is_array($stored_settings) ? $stored_settings : [];
175	175	foreach (\FireBox\Core\Helpers\Integrations::getSettingsKeys() as $key)
176	176	{
177		- if (!array_key_exists($key, $input) && isset($stored_settings[$key]))
	177	+ // Only a stored credential is worth carrying over. The keys are
	178	+ // seeded empty at install, and copying those in would add a blank
	179	+ // entry for every integration the site never connected.
	180	+ if (!array_key_exists($key, $input) && !empty($stored_settings[$key]))
178	181	{
179	182	$input[$key] = $stored_settings[$key];
180	183	}
181	184	}
		@@ -185,8 +188,33 @@
185	188
186	189	\FPFramework\Libs\AdminNotice::displaySuccess(fpframework()->_('FPF_SETTINGS_SAVED'));
187	190
188	191	return $input;
	192	+ }
	193	+
	194	+ /**
	195	+ * Allow a small set of internal settings updates to bypass the settings-form nonce.
	196	+ *
	197	+ * @return bool
	198	+ */
	199	+ private function isAllowedProgrammaticSettingsUpdate()
	200	+ {
	201	+ if (!wp_doing_ajax())
	202	+ {
	203	+ return false;
	204	+ }
	205	+
	206	+ $action = isset($_REQUEST['action']) ? sanitize_key(wp_unslash($_REQUEST['action'])) : '';
	207	+
	208	+ if ($action === '')
	209	+ {
	210	+ return false;
	211	+ }
	212	+
	213	+ return in_array($action, [
	214	+ 'firebox_download_key_notice_activate',
	215	+ 'firebox_enable_usage_tracking',
	216	+ ], true);
189	217	}
190	218
191	219
192	220